Calling .merge() after refining an object

[ravinggenius]

How can I merge two schemas if I call .refine() on one first? I know .refine() actually returns ZodEffect, not ZodObject, but I seem to be able to treat the effects as a schema, at least for my purposes (.parse()). First some code:

// schema.ts

import { parseJSON } from "date-fns";
import validator from "validator";
import { z } from "zod";

const USER = z.object({
	id: z.string().uuid(),
	createdAt: z
		.string()
		.datetime()
		.transform(parseJSON),
	updatedAt: z
		.string()
		.datetime()
		.transform(parseJSON),
	name: z.string().trim(),
	email: z.string().trim().email(),
	emailVerifiedAt: z
		.string()
		.datetime()
		.transform((eva) => (eva ? parseJSON(eva) : undefined))
		.optional()
});

const USER_PASSWORD_ATTRS = z.object({
	password: z
		.string()
		.refine((password) =>
			validator.isStrongPassword(password, {
				minLength: config.passwordMinLength
			})
		),
	passwordConfirmation: z.string()
}).refine(({ password, passwordConfirmation }) => password === passwordConfirmation, {
	message: "Confirmation must match password",
	path: ["passwordConfirmation"]
});

// model.ts

import bcrypt from "bcrypt";

import { USER_ATTRS, USER_PASSWORD_ATTRS } from "./schema";

export const create = async ({
	password,
	passwordConfirmation,
	...attrs
}: UserAttrs & UserPasswordAttrs): Promise<User> => {
	const {
		password: validPassword,
		passwordConfirmation: _validPasswordConfirmation,
		...validAttrs
	} = await USER_ATTRS.omit({
		emailVerifiedAt: true
	})
		.merge(USER_PASSWORD_ATTRS)
		.parseAsync({
			...attrs,
			password,
			passwordConfirmation
		});

	const hashword = await bcrypt.hash(
		validPassword,
		config.passwordSaltRounds
	);

	return db.one(queries.create, {
		...validAttrs,
		hashword
	});
};

I want to parse all the attrs together because I want to present all validation errors at once, plus conceptually it makes sense to me. However from a security perspective, I want to keep the schemas and data for password/passwordConfirmation separate from the rest of the attributes.

The problem I'm having is .merge() doesn't like USER_PASSWORD_ATTRS unless I remove the refinement. Why can't I merge a schema with an effect? Actually for that matter, why does .refine() have to return ZodEffect? Why can't it return the type of schema it is given?

Right now the only way I can think to solve this is to move the password refinement into the create function after merging the two schemas, which I don't like. (For one thing I'll have to remember to add the refinement everywhere I want to use USER_PASSWORD_ATTRS.) If you have a better solution, please let me know.

[sebsheep]

Is there any update on this? I'm facing the exact same issue.