zod-compiler 1.0.6 → 1.0.8

package/dist/unplugin/hoist.js

@@ -1,4 +1,4 @@
-import { parseExpressionAt } from "acorn";
+import { Parser } from "acorn";
 /**
  * Hoist Zod schema construction out of functions to module scope —
  * equivalent of babel-plugin-zod-hoist.
@@ -16,14 +16,27 @@ import { parseExpressionAt } from "acorn";
  *     return _zh_94b7f5c1;                      // built once
  *   }
  *
- * Safety rules (mirroring babel-plugin-zod-hoist):
- * - Only expressions built solely from **imported bindings and literals**
- *   are hoisted. Local variables, module-level const/let/var, `this`,
- *   `await`/`yield`, and globals (`new Date()`, `Math.random()`) all
- *   disqualify — hoisting would freeze their evaluation at module load.
+ * Safety rules (babel-plugin-zod-hoist's `canSafelyHoist`, hardened for
+ * lexical analysis):
+ * - A free identifier must be an import or a KNOWN_GLOBALS member, and must
+ *   never be bound anywhere in the file (function params, locals, catch
+ *   clauses, class names, module-level const/let/var — hoisting above those
+ *   would change meaning or hit the TDZ). The babel plugin additionally
+ *   allows arbitrary unbound identifiers because it has real scope
+ *   information; this port's binding collector is lexical, so an unknown
+ *   bare name is treated as a possibly-missed binding rather than a global
+ *   (a wrong guess crashes at module load with a ReferenceError).
+ *   `this`/`super` disqualify anywhere. Eager `await`/`yield` also
+ *   disqualify (stricter than the babel plugin, which never encounters
+ *   them: hoisting one would emit top-level await / orphaned yield).
  * - Eligible roots: any binding imported from zod, an imported identifier
  *   matching /ZodSchema$/, or an imported identifier whose chain contains
  *   an inline z.* reference (e.g. `Base.extend({ a: z.string() })`).
+ * - Nesting (babel's `isNestedInZodCall`): the interior of a zod-rooted
+ *   chain never hoists separately — it goes with the outer schema or not at
+ *   all. Chains rooted elsewhere (`sql.type(...)`, `api.get(...)`) do NOT
+ *   suppress their arguments: when the outer chain is rejected, an inner
+ *   `z.object({...})` still hoists on its own.
  * - Declarations are inserted at the top of the module (after shebang and
  *   directive prologue). Imports are initialized before module code runs,
  *   so referencing them from above their textual position is safe.
@@ -47,21 +60,23 @@ const ZOD_MODULES = new Set(["zod", "zod/v4", "zod/mini", "zod/v4/mini"]);
 export function collectImportBindings(code) {
     const all = new Set();
     const zod = new Set();
+    const details = new Map();
     const importPattern = /import\s+(type\s+)?([^'";]+?)\s+from\s*["']([^"']+)["']/g;
     for (const match of code.matchAll(importPattern)) {
         const [, typeOnly, clause, specifier] = match;
         if (typeOnly || clause === undefined || specifier === undefined)
             continue;
         const isZod = ZOD_MODULES.has(specifier);
-        for (const name of parseImportClause(clause)) {
-            all.add(name);
+        for (const { local, imported } of parseImportClause(clause)) {
+            all.add(local);
             if (isZod)
-                zod.add(name);
+                zod.add(local);
+            details.set(local, { specifier, imported });
         }
     }
-    return { all, zod };
+    return { all, zod, details };
 }
-/** Extract local binding names from an import clause. */
+/** Extract local binding names (with their source export) from an import clause. */
 function parseImportClause(clause) {
     const names = [];
     const namedStart = clause.indexOf("{");
@@ -73,10 +88,10 @@ function parseImportClause(clause) {
             continue;
         const ns = trimmed.match(/^\*\s*as\s+([A-Za-z_$][\w$]*)$/);
         if (ns?.[1]) {
-            names.push(ns[1]);
+            names.push({ local: ns[1], imported: "*" });
         }
         else if (/^[A-Za-z_$][\w$]*$/.test(trimmed)) {
-            names.push(trimmed);
+            names.push({ local: trimmed, imported: "default" });
         }
     }
     if (namedStart !== -1) {
@@ -87,10 +102,13 @@ function parseImportClause(clause) {
             if (!spec || spec.startsWith("type "))
                 continue;
             // `a as b` binds b; plain `a` binds a
-            const asMatch = spec.match(/^[A-Za-z_$][\w$]*\s+as\s+([A-Za-z_$][\w$]*)$/);
-            const name = asMatch?.[1] ?? (/^[A-Za-z_$][\w$]*$/.test(spec) ? spec : null);
-            if (name)
-                names.push(name);
+            const asMatch = spec.match(/^([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)$/);
+            if (asMatch?.[1] && asMatch[2]) {
+                names.push({ local: asMatch[2], imported: asMatch[1] });
+            }
+            else if (/^[A-Za-z_$][\w$]*$/.test(spec)) {
+                names.push({ local: spec, imported: spec });
+            }
         }
     }
     return names;
@@ -301,9 +319,23 @@ function skipRegexLiteral(code, start) {
     }
     return code.length;
 }
+/**
+ * Parse a single assignment-level expression at `pos` — the same entry point
+ * acorn's own parseExpressionAt uses, one precedence level down. At
+ * expression level a trailing comma in an argument position
+ * (`sql.type(z.object({...}),\n)`) starts a sequence-expression parse that
+ * throws on the surrounding `)`; assignment level treats the comma as
+ * trailing garbage and stops cleanly. parseMaybeAssign is the entry point
+ * the acorn plugin ecosystem overrides — stable across versions.
+ */
+function parseAssignmentAt(code, pos) {
+    const parser = new Parser({ ecmaVersion: "latest", sourceType: "module" }, code, pos);
+    parser.nextToken();
+    return parser.parseMaybeAssign();
+}
 /**
  * Narrow a parsed expression to the largest call chain starting at `start`.
- * parseExpressionAt can overshoot into surrounding operators
+ * The parse can overshoot into surrounding operators
  * (`z.string().min(1) || fallback` parses as a LogicalExpression) — descend
  * through same-start children until a CallExpression is found.
  */
@@ -361,9 +393,34 @@ function describeChain(node) {
 }
 /**
  * Combinators eligible on non-z chain bases (babel-plugin-zod-hoist's
- * documented set) — `Base.extend({...})`, `Base.pick({...})`, ...
+ * SCHEMA_COMBINATOR_METHODS, verbatim) — `Base.extend({...})`,
+ * `Base.pick({...})`, `UserZodSchema.optional()`, ...
  */
-const COMBINATOR_METHODS = new Set(["extend", "pick", "omit", "merge", "partial"]);
+const COMBINATOR_METHODS = new Set([
+    "and",
+    "array",
+    "brand",
+    "catchall",
+    "deepPartial",
+    "describe",
+    "extend",
+    "merge",
+    "nullable",
+    "nullish",
+    "omit",
+    "optional",
+    "or",
+    "partial",
+    "passthrough",
+    "pick",
+    "readonly",
+    "refine",
+    "required",
+    "strict",
+    "strip",
+    "superRefine",
+    "transform",
+]);
 /**
  * Methods that evaluate data rather than construct schemas. Hoisting one
  * would move the evaluation (and any throw) to module load.
@@ -379,12 +436,19 @@ const PARSE_METHODS = new Set([
     "encodeAsync",
 ]);
 /**
- * Globals that are safe to reference from a DEFERRED position (inside a
- * callback): the callback still runs per parse, so hoisting cannot change
- * when these evaluate. Eager positions stay imports-only — an eager
- * `Math.random()` / `Date.now()` would freeze at module load.
+ * Standard globals a hoisted expression may reference (eager or deferred —
+ * babel-parity behaviors like hoisting `z.date().default(new Date())` rely
+ * on Date/Math being recognized).
+ *
+ * The babel plugin allows ANY unbound identifier because it has real scope
+ * information; this port's binding collector is a lexical approximation, so
+ * an unknown bare name must be assumed to be a binding the collector missed
+ * — hoisting it would crash at module load with
+ * `ReferenceError: <name> is not defined`. A fixed allowlist converts that
+ * failure mode into a missed optimization.
  */
-const SAFE_DEFERRED_GLOBALS = new Set([
+const KNOWN_GLOBALS = new Set([
+    "globalThis",
     "NaN",
     "Infinity",
     "Math",
@@ -400,11 +464,21 @@ const SAFE_DEFERRED_GLOBALS = new Set([
     "Symbol",
     "Map",
     "Set",
+    "WeakMap",
+    "WeakSet",
     "Promise",
+    "Proxy",
+    "Reflect",
+    "Intl",
     "Error",
     "TypeError",
     "RangeError",
     "SyntaxError",
+    "EvalError",
+    "URIError",
+    "AggregateError",
+    "ArrayBuffer",
+    "Uint8Array",
     "parseInt",
     "parseFloat",
     "isNaN",
@@ -414,6 +488,16 @@ const SAFE_DEFERRED_GLOBALS = new Set([
     "encodeURIComponent",
     "decodeURIComponent",
     "structuredClone",
+    "URL",
+    "URLSearchParams",
+    "TextEncoder",
+    "TextDecoder",
+    "atob",
+    "btoa",
+    "crypto",
+    "console",
+    "process",
+    "Buffer",
 ]);
 /**
  * Scope-aware free-variable analysis of an expression. Nested function
@@ -507,11 +591,10 @@ function analyzeCaptures(expr) {
                 return;
             case "AwaitExpression":
             case "YieldExpression":
-            case "NewExpression":
-            case "TaggedTemplateExpression":
-            case "MetaProperty":
-                // Deferred occurrences run per call (`refine(d => d < new Date())`)
-                // — hoisting does not change when they evaluate.
+                // Eager occurrences cannot be moved to module scope: hoisting would
+                // emit top-level await (broken in CJS output) or an orphaned yield.
+                // (Stricter than the babel plugin, whose suite never exercises
+                // these.) Deferred occurrences run per call — fine to move.
                 if (!deferred) {
                     impure = true;
                     return;
@@ -594,64 +677,208 @@ const NON_BINDING_KEYWORDS = "if|for|while|switch|return|typeof|await|yield|new|
 /**
  * Conservative shadow detection: collect every identifier appearing in a
  * binding-like position — function/method/arrow parameter lists, catch
- * clauses, const/let/var declarator names. The scanner has no scope
- * information, so an import referenced from a hoisted expression must
- * resolve to that import everywhere; a name that is ever re-bound cannot be
- * trusted and disqualifies hoists referencing it. Over-collection only
- * costs missed hoists; the identifiers extracted from each binding segment
- * are cut at `:` and `=` so TypeScript annotations and initializers
- * (`schema: z.ZodType`, `x = z.object()`) never poison the set.
+ * clauses, class names, const/let/var declarator patterns. The scanner has
+ * no scope information, so an import referenced from a hoisted expression
+ * must resolve to that import everywhere; a name that is ever re-bound
+ * cannot be trusted and disqualifies hoists referencing it.
+ *
+ * Collection is depth-aware and multiline (balanced delimiter scanning, not
+ * line-bounded regexes): multiline destructuring declarations and parameter
+ * defaults containing calls are real production patterns whose bindings a
+ * line-based collector misses — and a missed binding here used to mean a
+ * hoist referencing it crashed at module load (`ReferenceError`).
+ * Over-collection (type names, destructuring default values, for-of
+ * iterables) is deliberate and safe: it can only suppress a hoist.
  */
 function collectBoundNames(code) {
     const bound = new Set();
-    // Per comma-separated piece, keep only the binding side: names before any
-    // type annotation (`a: T`) or default/initializer (`a = v`).
+    // Per top-level-comma piece, keep only the binding side: names before any
+    // top-level `:` (type annotation) or `=` (default/initializer). Inside
+    // destructuring patterns the `:`/`=` sit at depth > 0, so the whole
+    // pattern is collected (renames and default values over-collect — safe).
     const addBindingSegment = (segment) => {
-        for (const piece of segment.split(",")) {
-            let cut = piece;
-            const colon = cut.indexOf(":");
-            if (colon !== -1)
-                cut = cut.slice(0, colon);
-            const eq = cut.indexOf("=");
-            if (eq !== -1)
-                cut = cut.slice(0, eq);
-            for (const id of cut.matchAll(/[A-Za-z_$][\w$]*/g)) {
+        let depth = 0;
+        let pieceStart = 0;
+        let cut = -1;
+        const flush = (end) => {
+            const prefix = segment.slice(pieceStart, cut === -1 ? end : cut);
+            for (const id of prefix.matchAll(/[A-Za-z_$][\w$]*/g)) {
                 bound.add(id[0]);
             }
+            cut = -1;
+        };
+        for (let i = 0; i < segment.length; i++) {
+            const ch = segment[i];
+            if (ch === "(" || ch === "[" || ch === "{") {
+                depth++;
+            }
+            else if (ch === ")" || ch === "]" || ch === "}") {
+                depth--;
+            }
+            else if (depth === 0 && ch === ",") {
+                flush(i);
+                pieceStart = i + 1;
+            }
+            else if (depth === 0 && cut === -1 && (ch === ":" || ch === "=")) {
+                cut = i;
+            }
+        }
+        flush(segment.length);
+    };
+    /** Balanced `( ... )` span starting at `open` (must point at `(`). */
+    const parenSpan = (open) => {
+        let depth = 0;
+        for (let i = open; i < code.length; i++) {
+            const ch = code[i];
+            if (ch === "(")
+                depth++;
+            else if (ch === ")") {
+                depth--;
+                if (depth === 0)
+                    return { inner: code.slice(open + 1, i), end: i };
+            }
         }
+        return null;
     };
-    // function f(a, b) / function (a, b)
-    for (const m of code.matchAll(/\bfunction\b[^(]*\(([^()]*)\)/g)) {
-        addBindingSegment(m[1] ?? "");
+    // function f(a, b) / function (a = call()) — balanced + multiline
+    for (const m of code.matchAll(/\bfunction\b/g)) {
+        let i = m.index + m[0].length;
+        while (i < code.length && code[i] !== "(" && code[i] !== "{" && code[i] !== ";")
+            i++;
+        if (code[i] !== "(")
+            continue;
+        const span = parenSpan(i);
+        if (span)
+            addBindingSegment(span.inner);
     }
-    // (a, b) => / (a, b): Ret =>
-    for (const m of code.matchAll(/\(([^()]*)\)\s*(?::[^=>{};()]*)?=>/g)) {
-        addBindingSegment(m[1] ?? "");
+    // (a, b) => / (a = call()): Ret => — balanced params located from the arrow
+    for (const m of code.matchAll(/=>/g)) {
+        let i = m.index - 1;
+        while (i >= 0 && /\s/.test(code[i]))
+            i--;
+        if (i < 0)
+            continue;
+        let closeAt = -1;
+        if (code[i] === ")") {
+            closeAt = i;
+        }
+        else {
+            // Possible return-type annotation between `)` and `=>`:
+            // `(a): Promise<T> =>`. Find the nearest `)` whose gap to the arrow
+            // looks like a type annotation; give up otherwise (over-approximation
+            // elsewhere keeps this safe).
+            const before = code.slice(0, m.index);
+            const lastClose = before.lastIndexOf(")");
+            if (lastClose !== -1 && /^\s*:[^(){};]*$/.test(before.slice(lastClose + 1))) {
+                closeAt = lastClose;
+            }
+        }
+        if (closeAt === -1)
+            continue;
+        // walk back to the matching `(`
+        let depth = 0;
+        for (let j = closeAt; j >= 0; j--) {
+            const ch = code[j];
+            if (ch === ")")
+                depth++;
+            else if (ch === "(") {
+                depth--;
+                if (depth === 0) {
+                    addBindingSegment(code.slice(j + 1, closeAt));
+                    break;
+                }
+            }
+        }
     }
     // bare arrow param: a =>
     for (const m of code.matchAll(/([A-Za-z_$][\w$]*)\s*=>/g)) {
         bound.add(m[1] ?? "");
     }
-    // method(a, b) { / method(a): Ret { — excluding control flow (`if (x) {`)
-    const methodPattern = new RegExp(String.raw `(?<![.\w$])(?!(?:${NON_BINDING_KEYWORDS})\b)[A-Za-z_$][\w$]*\s*\(([^()]*)\)\s*(?::[^{};()]*)?\{`, "g");
-    for (const m of code.matchAll(methodPattern)) {
-        addBindingSegment(m[1] ?? "");
+    // method(a, b) { / method(a = call()): Ret { — excluding control flow.
+    // The balanced span must be directly followed by `{` (after an optional
+    // return type), which call expressions essentially never are.
+    const methodAnchor = new RegExp(String.raw `(?<![.\w$])(?!(?:${NON_BINDING_KEYWORDS})\b)[A-Za-z_$][\w$]*\s*\(`, "g");
+    for (const m of code.matchAll(methodAnchor)) {
+        const span = parenSpan(m.index + m[0].length - 1);
+        if (!span)
+            continue;
+        const after = code.slice(span.end + 1);
+        if (/^\s*(?::[^{};()]*)?\{/.test(after))
+            addBindingSegment(span.inner);
     }
     // catch (e)
-    for (const m of code.matchAll(/\bcatch\s*\(([^()]*)\)/g)) {
-        addBindingSegment(m[1] ?? "");
+    for (const m of code.matchAll(/\bcatch\s*\(/g)) {
+        const span = parenSpan(m.index + m[0].length - 1);
+        if (span)
+            addBindingSegment(span.inner);
+    }
+    // class names are TDZ bindings (function declarations hoist, classes don't)
+    for (const m of code.matchAll(/\bclass\s+([A-Za-z_$][\w$]*)/g)) {
+        bound.add(m[1] ?? "");
     }
-    // const/let/var declarator names (cut per comma at `:` / `=`)
-    for (const m of code.matchAll(/\b(?:const|let|var)\s+([^;\n]*)/g)) {
-        addBindingSegment(m[1] ?? "");
+    // const/let/var declarator patterns — balanced + multiline. The span runs
+    // to the first top-level `;` (or an unbalanced closer: for-headers), so
+    // `const {\n  inputSchema,\n} = getSchemas();` collects inputSchema.
+    for (const m of code.matchAll(/\b(?:const|let|var)\b/g)) {
+        const start = m.index + m[0].length;
+        let depth = 0;
+        let end = code.length;
+        for (let i = start; i < code.length; i++) {
+            const ch = code[i];
+            if (ch === "(" || ch === "[" || ch === "{") {
+                depth++;
+            }
+            else if (ch === ")" || ch === "]" || ch === "}") {
+                depth--;
+                if (depth < 0) {
+                    end = i;
+                    break;
+                }
+            }
+            else if (depth === 0 && ch === ";") {
+                end = i;
+                break;
+            }
+        }
+        addBindingSegment(code.slice(start, end));
     }
     return bound;
 }
+/**
+ * Free-variable analysis of a hoisted expression's source text, for the
+ * build-time compile step. Returns null when the text does not parse (it
+ * always should — it was extracted by this module).
+ */
+export function analyzeHoistedExpression(text) {
+    try {
+        const parsed = parseAssignmentAt(text, 0);
+        const { eagerFree, deferredFree, impure } = analyzeCaptures(parsed);
+        if (impure)
+            return null;
+        return { eagerFree, deferredFree };
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Hoist eligible Zod schema expressions to module scope.
  * Returns the rewritten source, or null when nothing was hoisted.
  */
 export function hoistZodSchemas(code, options) {
+    return hoistZodSchemasMeta(code, options)?.code ?? null;
+}
+/**
+ * hoistZodSchemas + metadata about each hoisted declaration, so the
+ * transform can compile the hoisted schemas into optimized validators.
+ */
+export function hoistZodSchemasMeta(code, options) {
+    // Idempotency: a file carrying hoisted declarations IS this pass's output.
+    // Plain hoists are naturally inert on re-runs (depth-0 masking), but a
+    // compiled hoisted decl embeds its original z.* expression inside the IIFE
+    // (depth > 0) — re-hoisting it would emit a duplicate _zh_ declaration.
+    if (/\bconst _zh_[0-9a-f]{8} = /.test(code))
+        return null;
     const imports = collectImportBindings(code);
     if (imports.all.size === 0)
         return null;
@@ -694,10 +921,7 @@ export function hoistZodSchemas(code, options) {
             continue;
         let parsed;
         try {
-            parsed = parseExpressionAt(code, candidate.index, {
-                ecmaVersion: "latest",
-                sourceType: "module",
-            });
+            parsed = parseAssignmentAt(code, candidate.index);
         }
         catch {
             continue;
@@ -705,14 +929,25 @@ export function hoistZodSchemas(code, options) {
         let chain = narrowToCallChain(parsed, candidate.index);
         if (!chain)
             continue;
-        // Mask nested candidates inside this extent regardless of eligibility —
-        // an inner z.string() of a top-level schema must not hoist on its own.
-        consumedUntil = chain.end;
-        // Depth 0 expressions are top-level statements/initializers: already
-        // evaluated once per module load, nothing to gain. Exception: concise
-        // arrow bodies (`const make = () => z.object(...)`) re-run per call.
-        if (candidate.depth === 0 && !candidate.afterArrow)
+        const rootIsZod = imports.zod.has(candidate.name);
+        // Masking (babel-plugin-zod-hoist nesting semantics):
+        // - Depth-0 chains are top-level statements/initializers — already
+        //   evaluated once per module load, nothing to gain — and their interior
+        //   must not hoist separately either. Exception: concise arrow bodies
+        //   (`const make = () => z.object(...)`) re-run per call.
+        // - Zod-rooted chains mask their interior REGARDLESS of eligibility (an
+        //   inner z.string() of `z.object({ a: z.string(), b: local })` belongs
+        //   to the outer schema — babel's isNestedInZodCall).
+        // - Chains rooted elsewhere (`sql.type(...)`, `api.get(...)`,
+        //   `Base.extend(...)`) mask their interior only when actually hoisted:
+        //   a rejected outer chain leaves its arguments free, so the inner
+        //   `z.object({...})` of `sql.type(z.object({...}))` hoists on its own.
+        if (candidate.depth === 0 && !candidate.afterArrow) {
+            consumedUntil = chain.end;
             continue;
+        }
+        if (rootIsZod)
+            consumedUntil = chain.end;
         // Peel trailing parse calls: for `z.object({...}).safeParse(input)`,
         // hoist the construction and leave `.safeParse(input)` — with its
         // local-variable arguments — at the call site.
@@ -728,11 +963,16 @@ export function hoistZodSchemas(code, options) {
         }
         if (chain === null || described === null)
             continue;
+        // Tighten the zod-rooted mask to the peeled construction extent: the
+        // arguments of a peeled `.parse(...)` are not part of the schema, so
+        // candidates inside them stay free (babel traverses execution-method
+        // arguments normally).
+        if (rootIsZod)
+            consumedUntil = chain.end;
         if (described.root !== candidate.name)
             continue;
         if (described.methods.some((m) => PARSE_METHODS.has(m)))
             continue;
-        const rootIsZod = imports.zod.has(candidate.name);
         const rootMatchesPattern = namePattern?.test(candidate.name) === true;
         // Non-z bases must look like schema derivation: the chain must START
         // with a combinator (`Base.extend({...}).optional()` qualifies via
@@ -746,24 +986,25 @@ export function hoistZodSchemas(code, options) {
         const { eagerFree, deferredFree, impure } = analyzeCaptures(chain);
         if (impure)
             continue;
-        // Imports-and-literals rule (babel-plugin-zod-hoist): eager positions
-        // may reference only imports — locals, module-level bindings, and
-        // globals all disqualify. Deferred positions (callback bodies) run per
-        // call regardless, so safe globals are additionally allowed there.
-        // Every referenced import must also be shadow-free: without scope
-        // information, a name that is ever re-bound (function parameter, local)
-        // cannot be trusted to mean the import.
+        // Capture rule (babel-plugin-zod-hoist's canSafelyHoist, hardened): a
+        // free name is safe only when it is an import or a recognized standard
+        // global, and is never re-bound anywhere in the file (no scope info, so
+        // a name bound in ANY function cannot be trusted to mean the import —
+        // over-rejection only costs a missed hoist). The babel plugin also
+        // allows arbitrary unbound identifiers, but it has real scope analysis;
+        // here an unknown bare name is more likely a binding the lexical
+        // collector missed than a genuine global, and hoisting it would crash
+        // at module load (`ReferenceError: <name> is not defined`).
         let eligible = true;
         for (const name of eagerFree) {
-            if (!imports.all.has(name) || isShadowed(name)) {
+            if ((!imports.all.has(name) && !KNOWN_GLOBALS.has(name)) || isShadowed(name)) {
                 eligible = false;
                 break;
             }
         }
         if (eligible) {
             for (const name of deferredFree) {
-                const allowed = imports.all.has(name) || SAFE_DEFERRED_GLOBALS.has(name);
-                if (!allowed || isShadowed(name)) {
+                if ((!imports.all.has(name) && !KNOWN_GLOBALS.has(name)) || isShadowed(name)) {
                     eligible = false;
                     break;
                 }
@@ -797,6 +1038,9 @@ export function hoistZodSchemas(code, options) {
             declByText.set(text, declName);
         }
         hoists.push({ start: candidate.index, end: chain.end, name: declName });
+        // Non-zod-rooted chains mask their interior only on success — the inner
+        // parts are consumed by this hoist's replacement.
+        consumedUntil = Math.max(consumedUntil, chain.end);
     }
     if (hoists.length === 0)
         return null;
@@ -810,6 +1054,9 @@ export function hoistZodSchemas(code, options) {
         .map(([text, name]) => `const ${name} = ${text};`)
         .join("\n");
     const offset = insertionOffset(result);
-    return `${result.slice(0, offset)}${decls}\n${result.slice(offset)}`;
+    return {
+        code: `${result.slice(0, offset)}${decls}\n${result.slice(offset)}`,
+        schemas: [...declByText.entries()].map(([text, name]) => ({ name, text })),
+    };
 }
 //# sourceMappingURL=hoist.js.map