zod-compiler 1.0.1 → 1.0.3

package/dist/unplugin/hoist.js

@@ -0,0 +1,815 @@
+import { parseExpressionAt } from "acorn";
+/**
+ * Hoist Zod schema construction out of functions to module scope —
+ * equivalent of babel-plugin-zod-hoist.
+ *
+ * Schemas built inside function bodies are re-constructed on every call:
+ *
+ *   function getSchema() {
+ *     return z.object({ name: z.string() });   // rebuilt per call
+ *   }
+ *
+ * becomes
+ *
+ *   const _zh_94b7f5c1 = z.object({ name: z.string() });
+ *   function getSchema() {
+ *     return _zh_94b7f5c1;                      // built once
+ *   }
+ *
+ * Safety rules (mirroring babel-plugin-zod-hoist):
+ * - Only expressions built solely from **imported bindings and literals**
+ *   are hoisted. Local variables, module-level const/let/var, `this`,
+ *   `await`/`yield`, and globals (`new Date()`, `Math.random()`) all
+ *   disqualify — hoisting would freeze their evaluation at module load.
+ * - Eligible roots: any binding imported from zod, an imported identifier
+ *   matching /ZodSchema$/, or an imported identifier whose chain contains
+ *   an inline z.* reference (e.g. `Base.extend({ a: z.string() })`).
+ * - Declarations are inserted at the top of the module (after shebang and
+ *   directive prologue). Imports are initialized before module code runs,
+ *   so referencing them from above their textual position is safe.
+ * - Names are content-hashed, so identical schemas dedupe to one binding.
+ *
+ * The source is TypeScript, which acorn cannot fully parse — candidates are
+ * located with a string/comment/depth-aware scanner and extracted with
+ * parseExpressionAt (the same technique as the autoDiscover rewrite).
+ * Anything unparseable (TS generics, `as` casts) is skipped: a miss leaves
+ * the schema unhoisted, never breaks the code.
+ */
+/** Imported identifiers matching this pattern are treated as schema roots. */
+const SCHEMA_NAME_PATTERN = /ZodSchema$/;
+/** Module specifiers whose bindings count as the zod namespace. */
+const ZOD_MODULES = new Set(["zod", "zod/v4", "zod/mini", "zod/v4/mini"]);
+/**
+ * Collect runtime import bindings with a regex over import statements.
+ * Type-only imports and `type` specifiers are excluded — they cannot be
+ * referenced at runtime, so excluding them keeps the capture rule sound.
+ */
+export function collectImportBindings(code) {
+    const all = new Set();
+    const zod = new Set();
+    const importPattern = /import\s+(type\s+)?([^'";]+?)\s+from\s*["']([^"']+)["']/g;
+    for (const match of code.matchAll(importPattern)) {
+        const [, typeOnly, clause, specifier] = match;
+        if (typeOnly || clause === undefined || specifier === undefined)
+            continue;
+        const isZod = ZOD_MODULES.has(specifier);
+        for (const name of parseImportClause(clause)) {
+            all.add(name);
+            if (isZod)
+                zod.add(name);
+        }
+    }
+    return { all, zod };
+}
+/** Extract local binding names from an import clause. */
+function parseImportClause(clause) {
+    const names = [];
+    const namedStart = clause.indexOf("{");
+    // Default import and/or namespace import before the named group
+    const head = namedStart === -1 ? clause : clause.slice(0, namedStart);
+    for (const part of head.split(",")) {
+        const trimmed = part.trim();
+        if (!trimmed)
+            continue;
+        const ns = trimmed.match(/^\*\s*as\s+([A-Za-z_$][\w$]*)$/);
+        if (ns?.[1]) {
+            names.push(ns[1]);
+        }
+        else if (/^[A-Za-z_$][\w$]*$/.test(trimmed)) {
+            names.push(trimmed);
+        }
+    }
+    if (namedStart !== -1) {
+        const namedEnd = clause.indexOf("}", namedStart);
+        const inner = clause.slice(namedStart + 1, namedEnd === -1 ? undefined : namedEnd);
+        for (const part of inner.split(",")) {
+            const spec = part.trim();
+            if (!spec || spec.startsWith("type "))
+                continue;
+            // `a as b` binds b; plain `a` binds a
+            const asMatch = spec.match(/^[A-Za-z_$][\w$]*\s+as\s+([A-Za-z_$][\w$]*)$/);
+            const name = asMatch?.[1] ?? (/^[A-Za-z_$][\w$]*$/.test(spec) ? spec : null);
+            if (name)
+                names.push(name);
+        }
+    }
+    return names;
+}
+/** Deterministic FNV-1a 32-bit hash, hex-encoded. */
+function fnv1a(text) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < text.length; i++) {
+        hash ^= text.charCodeAt(i);
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return (hash >>> 0).toString(16).padStart(8, "0");
+}
+const IDENT_START = /[A-Za-z_$]/;
+const IDENT_PART = /[\w$]/;
+/** After these tokens a `/` starts a regex literal, not division. */
+const REGEX_PRECEDING_KEYWORDS = new Set([
+    "return",
+    "typeof",
+    "instanceof",
+    "in",
+    "of",
+    "new",
+    "delete",
+    "void",
+    "throw",
+    "do",
+    "else",
+    "case",
+    "yield",
+    "await",
+]);
+/** Is `/` after this token division (true) or a regex literal (false)? */
+function isDivisionContext(lastToken) {
+    if (lastToken === ")" || lastToken === "]")
+        return true;
+    if (/^["'`]$/.test(lastToken))
+        return true;
+    if (/^[\w$]+$/.test(lastToken))
+        return !REGEX_PRECEDING_KEYWORDS.has(lastToken);
+    return false;
+}
+/**
+ * Scan the source for candidate root identifiers (`z`, `FooZodSchema`, ...)
+ * followed by a `.`, tracking string/template/comment state and nesting
+ * depth. Depth 0 candidates are top-level initializers — already evaluated
+ * once — and are recorded only so their extents mask nested candidates.
+ */
+function scanSource(code, roots) {
+    const candidates = [];
+    const out = code.split("");
+    const mask = (from, to) => {
+        for (let p = from; p < to; p++) {
+            if (out[p] !== "\n")
+                out[p] = " ";
+        }
+    };
+    let depth = 0;
+    // Template literals interleave string and expression states; the stack
+    // records the brace depth at which each `${` opened so the matching `}`
+    // resumes string state.
+    const templateStack = [];
+    let lastToken = "";
+    let i = 0;
+    while (i < code.length) {
+        const ch = code[i];
+        const next = code[i + 1];
+        // Comments
+        if (ch === "/" && next === "/") {
+            const nl = code.indexOf("\n", i);
+            const end = nl === -1 ? code.length : nl + 1;
+            mask(i, end);
+            i = end;
+            continue;
+        }
+        if (ch === "/" && next === "*") {
+            const close = code.indexOf("*/", i + 2);
+            const end = close === -1 ? code.length : close + 2;
+            mask(i, end);
+            i = end;
+            continue;
+        }
+        if (ch === "/") {
+            if (!isDivisionContext(lastToken)) {
+                const end = skipRegexLiteral(code, i);
+                mask(i, end);
+                i = end;
+                lastToken = ")"; // a regex literal is an operand
+                continue;
+            }
+            lastToken = ch;
+            i++;
+            continue;
+        }
+        // Strings
+        if (ch === '"' || ch === "'") {
+            const end = skipString(code, i, ch);
+            mask(i, end);
+            i = end;
+            lastToken = ch;
+            continue;
+        }
+        // Template literals
+        if (ch === "`") {
+            const end = skipTemplateChunk(code, i + 1, templateStack, depth);
+            mask(i, end);
+            i = end;
+            lastToken = "`";
+            continue;
+        }
+        if (templateStack.length > 0 &&
+            ch === "}" &&
+            depth === templateStack[templateStack.length - 1]) {
+            // End of a ${ } expression — back into template string state
+            templateStack.pop();
+            const end = skipTemplateChunk(code, i + 1, templateStack, depth);
+            mask(i, end);
+            i = end;
+            lastToken = "`";
+            continue;
+        }
+        if (ch === "(" || ch === "[" || ch === "{") {
+            depth++;
+            lastToken = ch;
+            i++;
+            continue;
+        }
+        if (ch === ")" || ch === "]" || ch === "}") {
+            depth--;
+            lastToken = ch;
+            i++;
+            continue;
+        }
+        if (IDENT_START.test(ch) && !IDENT_PART.test(code[i - 1] ?? "")) {
+            let j = i + 1;
+            while (j < code.length && IDENT_PART.test(code[j]))
+                j++;
+            const word = code.slice(i, j);
+            // Skip whitespace to check for the member access
+            let k = j;
+            while (k < code.length && /\s/.test(code[k]))
+                k++;
+            if (roots.has(word) && code[k] === "." && lastToken !== ".") {
+                candidates.push({ index: i, depth, name: word, afterArrow: lastToken === "=>" });
+            }
+            lastToken = word;
+            i = j;
+            continue;
+        }
+        if (!/\s/.test(ch)) {
+            lastToken = ch === ">" && lastToken === "=" ? "=>" : ch;
+        }
+        i++;
+    }
+    return { candidates, stripped: out.join("") };
+}
+function skipString(code, start, quote) {
+    for (let i = start + 1; i < code.length; i++) {
+        if (code[i] === "\\") {
+            i++;
+        }
+        else if (code[i] === quote || code[i] === "\n") {
+            return i + 1;
+        }
+    }
+    return code.length;
+}
+/**
+ * Skip a template string chunk; returns the offset after the closing
+ * `` ` `` or after a `${`, recording the current depth so the scanner can
+ * recognize the matching `}` later.
+ */
+function skipTemplateChunk(code, start, templateStack, depth) {
+    for (let i = start; i < code.length; i++) {
+        if (code[i] === "\\") {
+            i++;
+        }
+        else if (code[i] === "`") {
+            return i + 1;
+        }
+        else if (code[i] === "$" && code[i + 1] === "{") {
+            templateStack.push(depth);
+            return i + 2;
+        }
+    }
+    return code.length;
+}
+function skipRegexLiteral(code, start) {
+    let inClass = false;
+    for (let i = start + 1; i < code.length; i++) {
+        const ch = code[i];
+        if (ch === "\\") {
+            i++;
+        }
+        else if (ch === "[") {
+            inClass = true;
+        }
+        else if (ch === "]") {
+            inClass = false;
+        }
+        else if (ch === "/" && !inClass) {
+            return i + 1;
+        }
+        else if (ch === "\n") {
+            // Not a regex after all (unterminated) — treat as division
+            return start + 1;
+        }
+    }
+    return code.length;
+}
+/**
+ * Narrow a parsed expression to the largest call chain starting at `start`.
+ * parseExpressionAt can overshoot into surrounding operators
+ * (`z.string().min(1) || fallback` parses as a LogicalExpression) — descend
+ * through same-start children until a CallExpression is found.
+ */
+function narrowToCallChain(node, start) {
+    let current = node;
+    while (current.start === start) {
+        if (current.type === "CallExpression")
+            return current;
+        const child = sameStartChild(current, start);
+        if (!child)
+            return null;
+        current = child;
+    }
+    return null;
+}
+function sameStartChild(node, start) {
+    const record = node;
+    for (const key of ["left", "object", "callee", "test", "tag", "expression", "expressions"]) {
+        const value = record[key];
+        const child = Array.isArray(value) ? value[0] : value;
+        if (typeof child === "object" &&
+            child !== null &&
+            child.start === start &&
+            typeof child.type === "string") {
+            return child;
+        }
+    }
+    return null;
+}
+/**
+ * Walk a member/call chain down to its base identifier, collecting the
+ * non-computed method names along the spine. Computed members
+ * (`base[name]()`) are unanalyzable — the chain is rejected.
+ */
+function describeChain(node) {
+    const methods = [];
+    let current = node;
+    while (true) {
+        if (current.type === "CallExpression") {
+            current = current.callee;
+        }
+        else if (current.type === "MemberExpression") {
+            if (current.computed || current.property.type !== "Identifier")
+                return null;
+            methods.push(current.property.name);
+            current = current.object;
+        }
+        else if (current.type === "Identifier") {
+            return { root: current.name, methods };
+        }
+        else {
+            return null;
+        }
+    }
+}
+/**
+ * Combinators eligible on non-z chain bases (babel-plugin-zod-hoist's
+ * documented set) — `Base.extend({...})`, `Base.pick({...})`, ...
+ */
+const COMBINATOR_METHODS = new Set(["extend", "pick", "omit", "merge", "partial"]);
+/**
+ * Methods that evaluate data rather than construct schemas. Hoisting one
+ * would move the evaluation (and any throw) to module load.
+ */
+const PARSE_METHODS = new Set([
+    "parse",
+    "safeParse",
+    "parseAsync",
+    "safeParseAsync",
+    "decode",
+    "encode",
+    "decodeAsync",
+    "encodeAsync",
+]);
+/**
+ * Globals that are safe to reference from a DEFERRED position (inside a
+ * callback): the callback still runs per parse, so hoisting cannot change
+ * when these evaluate. Eager positions stay imports-only — an eager
+ * `Math.random()` / `Date.now()` would freeze at module load.
+ */
+const SAFE_DEFERRED_GLOBALS = new Set([
+    "NaN",
+    "Infinity",
+    "Math",
+    "Number",
+    "String",
+    "Boolean",
+    "Array",
+    "Object",
+    "JSON",
+    "Date",
+    "RegExp",
+    "BigInt",
+    "Symbol",
+    "Map",
+    "Set",
+    "Promise",
+    "Error",
+    "TypeError",
+    "RangeError",
+    "SyntaxError",
+    "parseInt",
+    "parseFloat",
+    "isNaN",
+    "isFinite",
+    "encodeURI",
+    "decodeURI",
+    "encodeURIComponent",
+    "decodeURIComponent",
+    "structuredClone",
+]);
+/**
+ * Scope-aware free-variable analysis of an expression. Nested function
+ * params and local declarations are bound names, not captures — so
+ * `z.string().refine((v) => v.length > 0)` has no free variables beyond `z`.
+ * References inside nested function bodies are tracked separately: they
+ * evaluate per call even after hoisting, so safe globals are allowed there.
+ */
+function analyzeCaptures(expr) {
+    const eagerFree = new Set();
+    const deferredFree = new Set();
+    let impure = false;
+    function patternNames(node, into) {
+        switch (node.type) {
+            case "Identifier":
+                into.add(node.name);
+                return;
+            case "ObjectPattern":
+                for (const prop of node.properties) {
+                    if (prop.type === "Property")
+                        patternNames(prop.value, into);
+                    else
+                        patternNames(prop.argument, into);
+                }
+                return;
+            case "ArrayPattern":
+                for (const el of node.elements) {
+                    if (el)
+                        patternNames(el, into);
+                }
+                return;
+            case "AssignmentPattern":
+                patternNames(node.left, into);
+                return;
+            case "RestElement":
+                patternNames(node.argument, into);
+                return;
+            default:
+                return;
+        }
+    }
+    function collectFunctionScope(body, into) {
+        // Flatten block scoping into the function scope — over-approximating
+        // bound names can only suppress a hoist's free set, and the failure
+        // mode is a loud ReferenceError, never silent misvalidation.
+        const stack = [body];
+        while (stack.length > 0) {
+            const node = stack.pop();
+            if (!node || typeof node !== "object")
+                continue;
+            if (node.type === "VariableDeclaration") {
+                for (const decl of node.declarations)
+                    patternNames(decl.id, into);
+            }
+            else if (node.type === "FunctionDeclaration" || node.type === "ClassDeclaration") {
+                if (node.id)
+                    into.add(node.id.name);
+                continue; // do not descend into nested declarations' bodies here
+            }
+            else if (node.type === "FunctionExpression" || node.type === "ArrowFunctionExpression") {
+                continue; // nested functions get their own scope in visit()
+            }
+            for (const value of Object.values(node)) {
+                if (Array.isArray(value)) {
+                    for (const item of value) {
+                        if (typeof item === "object" && item !== null && "type" in item) {
+                            stack.push(item);
+                        }
+                    }
+                }
+                else if (typeof value === "object" && value !== null && "type" in value) {
+                    stack.push(value);
+                }
+            }
+        }
+    }
+    function visit(node, scopes, deferred) {
+        switch (node.type) {
+            case "Identifier": {
+                const name = node.name;
+                if (name !== "undefined" && !scopes.some((s) => s.has(name))) {
+                    (deferred ? deferredFree : eagerFree).add(name);
+                }
+                return;
+            }
+            case "ThisExpression":
+            case "Super":
+                // Arrows bind `this` lexically — hoisting changes it even when the
+                // reference sits inside a callback. Always disqualifying.
+                impure = true;
+                return;
+            case "AwaitExpression":
+            case "YieldExpression":
+            case "NewExpression":
+            case "TaggedTemplateExpression":
+            case "MetaProperty":
+                // Deferred occurrences run per call (`refine(d => d < new Date())`)
+                // — hoisting does not change when they evaluate.
+                if (!deferred) {
+                    impure = true;
+                    return;
+                }
+                break;
+            case "MemberExpression":
+                visit(node.object, scopes, deferred);
+                if (node.computed)
+                    visit(node.property, scopes, deferred);
+                return;
+            case "Property":
+                if (node.computed)
+                    visit(node.key, scopes, deferred);
+                visit(node.value, scopes, deferred);
+                return;
+            case "FunctionExpression":
+            case "ArrowFunctionExpression": {
+                const scope = new Set();
+                for (const param of node.params)
+                    patternNames(param, scope);
+                if (node.type === "FunctionExpression" && node.id)
+                    scope.add(node.id.name);
+                collectFunctionScope(node.body, scope);
+                visit(node.body, [...scopes, scope], true);
+                return;
+            }
+            default:
+                break;
+        }
+        for (const value of Object.values(node)) {
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    if (typeof item === "object" && item !== null && "type" in item) {
+                        visit(item, scopes, deferred);
+                    }
+                }
+            }
+            else if (typeof value === "object" && value !== null && "type" in value) {
+                visit(value, scopes, deferred);
+            }
+        }
+    }
+    visit(expr, [], false);
+    return { eagerFree, deferredFree, impure };
+}
+/** Offset after the shebang and directive prologue ("use client", ...). */
+function insertionOffset(code) {
+    let i = 0;
+    if (code.startsWith("#!")) {
+        const nl = code.indexOf("\n");
+        i = nl === -1 ? code.length : nl + 1;
+    }
+    while (true) {
+        // Skip whitespace and comments between directives
+        while (i < code.length) {
+            const ch = code[i];
+            if (/\s/.test(ch)) {
+                i++;
+            }
+            else if (ch === "/" && code[i + 1] === "/") {
+                const nl = code.indexOf("\n", i);
+                i = nl === -1 ? code.length : nl + 1;
+            }
+            else if (ch === "/" && code[i + 1] === "*") {
+                const end = code.indexOf("*/", i + 2);
+                i = end === -1 ? code.length : end + 2;
+            }
+            else {
+                break;
+            }
+        }
+        const directive = code.slice(i).match(/^(["'])use [^"'\n]*\1\s*;?[^\S\n]*\n?/);
+        if (!directive)
+            return i;
+        i += directive[0].length;
+    }
+}
+/** Keywords that precede `( ... ) {` without binding anything. */
+const NON_BINDING_KEYWORDS = "if|for|while|switch|return|typeof|await|yield|new|do|else|case|in|of|delete|void";
+/**
+ * Conservative shadow detection: collect every identifier appearing in a
+ * binding-like position — function/method/arrow parameter lists, catch
+ * clauses, const/let/var declarator names. The scanner has no scope
+ * information, so an import referenced from a hoisted expression must
+ * resolve to that import everywhere; a name that is ever re-bound cannot be
+ * trusted and disqualifies hoists referencing it. Over-collection only
+ * costs missed hoists; the identifiers extracted from each binding segment
+ * are cut at `:` and `=` so TypeScript annotations and initializers
+ * (`schema: z.ZodType`, `x = z.object()`) never poison the set.
+ */
+function collectBoundNames(code) {
+    const bound = new Set();
+    // Per comma-separated piece, keep only the binding side: names before any
+    // type annotation (`a: T`) or default/initializer (`a = v`).
+    const addBindingSegment = (segment) => {
+        for (const piece of segment.split(",")) {
+            let cut = piece;
+            const colon = cut.indexOf(":");
+            if (colon !== -1)
+                cut = cut.slice(0, colon);
+            const eq = cut.indexOf("=");
+            if (eq !== -1)
+                cut = cut.slice(0, eq);
+            for (const id of cut.matchAll(/[A-Za-z_$][\w$]*/g)) {
+                bound.add(id[0]);
+            }
+        }
+    };
+    // function f(a, b) / function (a, b)
+    for (const m of code.matchAll(/\bfunction\b[^(]*\(([^()]*)\)/g)) {
+        addBindingSegment(m[1] ?? "");
+    }
+    // (a, b) => / (a, b): Ret =>
+    for (const m of code.matchAll(/\(([^()]*)\)\s*(?::[^=>{};()]*)?=>/g)) {
+        addBindingSegment(m[1] ?? "");
+    }
+    // bare arrow param: a =>
+    for (const m of code.matchAll(/([A-Za-z_$][\w$]*)\s*=>/g)) {
+        bound.add(m[1] ?? "");
+    }
+    // method(a, b) { / method(a): Ret { — excluding control flow (`if (x) {`)
+    const methodPattern = new RegExp(String.raw `(?<![.\w$])(?!(?:${NON_BINDING_KEYWORDS})\b)[A-Za-z_$][\w$]*\s*\(([^()]*)\)\s*(?::[^{};()]*)?\{`, "g");
+    for (const m of code.matchAll(methodPattern)) {
+        addBindingSegment(m[1] ?? "");
+    }
+    // catch (e)
+    for (const m of code.matchAll(/\bcatch\s*\(([^()]*)\)/g)) {
+        addBindingSegment(m[1] ?? "");
+    }
+    // const/let/var declarator names (cut per comma at `:` / `=`)
+    for (const m of code.matchAll(/\b(?:const|let|var)\s+([^;\n]*)/g)) {
+        addBindingSegment(m[1] ?? "");
+    }
+    return bound;
+}
+/**
+ * Hoist eligible Zod schema expressions to module scope.
+ * Returns the rewritten source, or null when nothing was hoisted.
+ */
+export function hoistZodSchemas(code, options) {
+    const imports = collectImportBindings(code);
+    if (imports.all.size === 0)
+        return null;
+    const rawPattern = options?.schemaNamePattern;
+    const namePattern = rawPattern === null
+        ? null
+        : rawPattern === undefined
+            ? SCHEMA_NAME_PATTERN
+            : typeof rawPattern === "string"
+                ? new RegExp(rawPattern)
+                : rawPattern;
+    const roots = new Set(imports.zod);
+    if (namePattern) {
+        for (const name of imports.all) {
+            if (namePattern.test(name))
+                roots.add(name);
+        }
+    }
+    // Imported roots that only qualify via an inline z.* reference in the
+    // chain are validated per-expression below; scan them as candidates too.
+    if (imports.zod.size > 0) {
+        for (const name of imports.all)
+            roots.add(name);
+    }
+    if (roots.size === 0)
+        return null;
+    const { candidates, stripped } = scanSource(code, roots);
+    if (candidates.length === 0)
+        return null;
+    let boundNames;
+    function isShadowed(name) {
+        boundNames ??= collectBoundNames(stripped);
+        return boundNames.has(name);
+    }
+    const hoists = [];
+    const declByText = new Map();
+    let consumedUntil = 0;
+    for (const candidate of candidates) {
+        if (candidate.index < consumedUntil)
+            continue;
+        let parsed;
+        try {
+            parsed = parseExpressionAt(code, candidate.index, {
+                ecmaVersion: "latest",
+                sourceType: "module",
+            });
+        }
+        catch {
+            continue;
+        }
+        let chain = narrowToCallChain(parsed, candidate.index);
+        if (!chain)
+            continue;
+        // Mask nested candidates inside this extent regardless of eligibility —
+        // an inner z.string() of a top-level schema must not hoist on its own.
+        consumedUntil = chain.end;
+        // Depth 0 expressions are top-level statements/initializers: already
+        // evaluated once per module load, nothing to gain. Exception: concise
+        // arrow bodies (`const make = () => z.object(...)`) re-run per call.
+        if (candidate.depth === 0 && !candidate.afterArrow)
+            continue;
+        // Peel trailing parse calls: for `z.object({...}).safeParse(input)`,
+        // hoist the construction and leave `.safeParse(input)` — with its
+        // local-variable arguments — at the call site.
+        let described = describeChain(chain);
+        while (chain !== null &&
+            described !== null &&
+            described.methods.length > 0 &&
+            PARSE_METHODS.has(described.methods[0])) {
+            const callee = chain.type === "CallExpression" ? chain.callee : null;
+            const inner = callee !== null && callee.type === "MemberExpression" ? callee.object : null;
+            chain = inner !== null && inner.type === "CallExpression" ? inner : null;
+            described = chain === null ? null : describeChain(chain);
+        }
+        if (chain === null || described === null)
+            continue;
+        if (described.root !== candidate.name)
+            continue;
+        if (described.methods.some((m) => PARSE_METHODS.has(m)))
+            continue;
+        const rootIsZod = imports.zod.has(candidate.name);
+        const rootMatchesPattern = namePattern?.test(candidate.name) === true;
+        // Non-z bases must look like schema derivation: the chain must START
+        // with a combinator (`Base.extend({...}).optional()` qualifies via
+        // extend), so an arbitrary imported object with a z-mentioning argument
+        // (`api.get(z.string())`) is never hoisted. describeChain records
+        // methods outermost-first — the deepest method is last.
+        const deepestMethod = described.methods[described.methods.length - 1];
+        if (!rootIsZod && (deepestMethod === undefined || !COMBINATOR_METHODS.has(deepestMethod))) {
+            continue;
+        }
+        const { eagerFree, deferredFree, impure } = analyzeCaptures(chain);
+        if (impure)
+            continue;
+        // Imports-and-literals rule (babel-plugin-zod-hoist): eager positions
+        // may reference only imports — locals, module-level bindings, and
+        // globals all disqualify. Deferred positions (callback bodies) run per
+        // call regardless, so safe globals are additionally allowed there.
+        // Every referenced import must also be shadow-free: without scope
+        // information, a name that is ever re-bound (function parameter, local)
+        // cannot be trusted to mean the import.
+        let eligible = true;
+        for (const name of eagerFree) {
+            if (!imports.all.has(name) || isShadowed(name)) {
+                eligible = false;
+                break;
+            }
+        }
+        if (eligible) {
+            for (const name of deferredFree) {
+                const allowed = imports.all.has(name) || SAFE_DEFERRED_GLOBALS.has(name);
+                if (!allowed || isShadowed(name)) {
+                    eligible = false;
+                    break;
+                }
+            }
+        }
+        if (!eligible)
+            continue;
+        // Non-zod, non-pattern roots qualify only when the chain itself
+        // references a zod binding (`Base.extend({ a: z.string() })`).
+        if (!rootIsZod && !rootMatchesPattern) {
+            let referencesZod = false;
+            for (const name of eagerFree) {
+                if (imports.zod.has(name)) {
+                    referencesZod = true;
+                    break;
+                }
+            }
+            for (const name of deferredFree) {
+                if (imports.zod.has(name)) {
+                    referencesZod = true;
+                    break;
+                }
+            }
+            if (!referencesZod)
+                continue;
+        }
+        const text = code.slice(candidate.index, chain.end);
+        let declName = declByText.get(text);
+        if (!declName) {
+            declName = `_zh_${fnv1a(text)}`;
+            declByText.set(text, declName);
+        }
+        hoists.push({ start: candidate.index, end: chain.end, name: declName });
+    }
+    if (hoists.length === 0)
+        return null;
+    // Apply replacements from the end so earlier offsets stay valid.
+    let result = code;
+    for (let i = hoists.length - 1; i >= 0; i--) {
+        const hoist = hoists[i];
+        result = result.slice(0, hoist.start) + hoist.name + result.slice(hoist.end);
+    }
+    const decls = [...declByText.entries()]
+        .map(([text, name]) => `const ${name} = ${text};`)
+        .join("\n");
+    const offset = insertionOffset(result);
+    return `${result.slice(0, offset)}${decls}\n${result.slice(offset)}`;
+}
+//# sourceMappingURL=hoist.js.map