fix(devkit): scaffold zod@^4 — fresh apps fail npm install against published sdk

[blove]

What

P0 found by production smoke: every fresh `npm create dawn-ai-app` + `npm install` fails with ERESOLVE. The app templates pin `zod@^3.24.0`, but published `@dawn-ai/sdk` (0.8.5) declares `peerOptional zod@^4.0.0` — npm's strict peer resolution rejects the tree. `--legacy-peer-deps` is not an escape hatch (it skips peer installs → `@langchain/core` unresolvable at runtime).

Why CI never saw it: the generated-app harness installs with pnpm, which tolerates unmet optional peers. The break only manifests with npm against the real registry — exactly the new-user path.

Fix: templates scaffold `zod@^4.0.0` (research + basic), harness fixtures updated. Template code uses only `z.object`/`z.string` (both majors); `@langchain/core` accepts `^3.25.76 || ^4`. Validated manually against the real registry: with `^4` the strict npm install succeeds and `dawn check`/`dev` run.

Tests

• create-dawn-ai-app 5/5, devkit 9/9, full generated-app lane 15/15 (scaffold-tree comparisons + publish-lifecycle via test registry).

Follow-up (separate)

Consider widening sdk's peer to `^3.25.76 || ^4` for existing zod-3 apps — this PR fixes the broken new-user funnel without touching published semantics.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
dawnai	Ready	Preview, Comment	Jul 6, 2026 3:02pm

[github-actions]

Automated approval: this PR received an intelligent (AI) code review. See the review comments on this PR.

[github-actions]

Claude finished @blove's task in 1m 17s —— View job

---

Code Review

• Gather context
• Read diff and changed files
• Analyze for correctness, security, type-safety, test coverage
• Post findings

---

This PR looks correct and the fix is well-scoped. A few notes:

Root cause confirmed. packages/sdk/package.json:42-48 declares peerDependencies: { zod: "^4.0.0" } with optional: true. npm's strict resolver still rejects a ^3.24.0 install when an optional peer is declared as ^4 — the PR description is accurate.

Zod API usage is safe across majors. Template source files use only z.object, z.string, z.string().default(), and z.string().describe() — all stable in both v3 and v4. No breaking surface introduced.

Fixture coverage is complete. All four locations that pinned zod@^3.24.0 were updated (app-basic template, app-research template, basic.expected.json, custom-app-dir.expected.json). The remaining fixtures (*-runtime.expected.json, handwritten-runtime.expected.json) don't snapshot package.json dependencies so no changes needed there.

Changeset is correct. Both @dawn-ai/devkit and create-dawn-ai-app tagged as patch is the right bump for a dependency version fix.

One gap to be aware of (not a blocker): the PR only covers new scaffolds. Existing apps that were generated with zod@^3.24.0 still have the mismatch against the published SDK. The PR description calls this out as a follow-up (widening the SDK peer to ^3.25.76 || ^4), which is the right call — that's a published-package semantic change that deserves its own review.

No correctness bugs, no security issues, no type-safety problems. The test assertions match the template changes. Good to merge.