fix(deps): catalog-pin zod so trusted plugins typecheck (#1019)

Astro bundles its own Zod and re-exports it as 'astro/zod'. Trusted
plugins like @emdash-cms/plugin-forms import their route schemas via
'astro/zod', then pass those schemas to definePlugin() in core. With
emdash's 'zod: ^4.3.5' resolving independently of Astro's caret,
pnpm kept two Zod 4 patches in the tree (e.g. 4.3.6 alongside 4.4.1).

Zod 4 embeds its semver in the type system, so two patches of Zod 4
are not assignable to each other. The forms plugin's route schemas
(ZodObject<..., $strip>) were rejected by PluginRoute<TInput>['input']
(ZodType<unknown, unknown, $ZodTypeInternals<unknown, unknown>>) with
'Type "3" is not assignable to type "4"' on the internal version
field. The native definePlugin overload silently failed, TS fell
through to the StandardPluginDefinition overload, and reported a
misleading 'id does not exist' error -- masking 8 cascading errors.

Catalog-pinning Zod forces a single workspace-wide instance and
restores normal overload resolution. No code changes needed in core
or plugins/forms.

Also adds a pnpm-workspace.yaml comment explaining the gotcha so the
next person doesn't bump emdash's pin past Astro's range.

Author: ascorbic

.changeset/sharp-knives-invite.md

@@ -0,0 +1,6 @@
+---
+"emdash": patch
+"@emdash-cms/auth": patch
+---
+
+Fixes a Zod type-incompatibility between trusted plugins and core. Without a workspace-level pin, emdash's `zod: ^4.3.5` could resolve to a different patch than Astro's bundled Zod, and Zod 4 embeds the version in the type — so schemas imported via `astro/zod` in trusted plugins (e.g. `@emdash-cms/plugin-forms`) were not assignable to `definePlugin`'s `PluginRoute<TInput>['input']`. Pins Zod in the pnpm catalog so the entire workspace dedupes on one instance.

packages/auth/package.json

@@ -42,7 +42,7 @@
     "@oslojs/encoding": "catalog:",
     "@oslojs/webauthn": "catalog:",
     "ulidx": "^2.4.1",
-    "zod": "^4.3.5"
+    "zod": "catalog:"
   },
   "peerDependencies": {
     "astro": ">=6.0.0-beta.0",

packages/core/package.json

@@ -207,7 +207,7 @@
     "sax": "^1.4.1",
     "ulidx": "^2.4.1",
     "upng-js": "^2.1.0",
-    "zod": "^4.3.5"
+    "zod": "catalog:"
   },
   "optionalDependencies": {
     "@libsql/kysely-libsql": "^0.4.0",

pnpm-lock.yaml

@@ -91,3 +91,9 @@ catalog:
   vite: ^8.0.11
   vitest: ^4.1.5
   wrangler: ^4.83.0
+  # Catalog-pin Zod so the whole workspace dedupes on a single instance.
+  # Zod 4 embeds the version in the type, so even ^4.3.6 vs ^4.4.1 produce
+  # structurally incompatible ZodType<T> across packages that mix astro/zod
+  # and emdash's zod (e.g. trusted plugins like @emdash-cms/plugin-forms
+  # importing 'z' from astro/zod and passing schemas to definePlugin).
+  zod: ^4.3.6