Declare zod as a peer dependency only, and fail loudly on duplicate installs

[brainkim]

Closes part of #20.

The bug

zod was declared in both dependencies and peerDependencies (^4.0.0 in each). That's self-contradictory: the peer contract says the host provides zod, while the dependencies entry lets a second copy be installed alongside it. The drivers in this same manifest (better-sqlite3, postgres, mysql2) already use the correct pattern — devDependency + peer — so zod is now brought in line.

@b9g/zen now has zero runtime dependencies.

Why it matters

1. Bundle size (#20). Consumers could bundle their zod and ours — the nested copy is visible in the paste on #20 (node_modules/@b9g/zen/node_modules/zod/...). The locale tree-shaking bug itself is upstream (colinhacks/zod#5561) and not ours to fix, but shipping a second copy of zod was.

2. Silent schema corruption — the serious one. ddl.ts maps columns with core instanceof z.ZodString and friends. Under a duplicate install, those checks compare against the other copy's classes and all fail, falling through to:

} else {
    // Fallback for unknown types
    sqlType = "TEXT";
}

So every column silently becomes TEXT — numbers, booleans, dates, JSON. No error, no warning. You'd get a quietly wrong schema and find out much later.

The guard

That fallback is no longer a trapdoor. A schema that advertises vendor: "zod" via Standard Schema but fails instanceof z.ZodType can only have come from a duplicate install, so it now throws a TableDefinitionError that names the actual cause.

Crucially this cannot false-positive: Zod types we genuinely don't map (ZodUnion, etc.) still pass instanceof z.ZodType and still take the TEXT fallback. Pinned by tests.

Also

Corrects the Standard Schema error message, which claimed any "Standard Schema-compliant library" would work. It won't — validation goes through ~standard, but DDL generation introspects Zod specifically. The message now says so, and points at the peer dependency.

Verification

• bun test — 597 pass / 0 fail (3 new)
• npm run test:node — passes
• tsc --noEmit — clean
• eslint — clean

🤖 Generated with Claude Code