zod-compiler 1.23.8 → 1.24.0

package/README.md

@@ -118,18 +118,21 @@ that blocks eval both leave a working plain-Zod schema.
 
 ### Supported Build Tools
 
-| Build Tool | Import                                            |
-| ---------- | ------------------------------------------------- |
-| Vite       | `import zodCompiler from "zod-compiler/vite"`     |
-| webpack    | `import zodCompiler from "zod-compiler/webpack"`  |
-| esbuild    | `import zodCompiler from "zod-compiler/esbuild"`  |
-| SWC        | `import zodCompiler from "zod-compiler/swc"`      |
-| Rollup     | `import zodCompiler from "zod-compiler/rollup"`   |
-| Rolldown   | `import zodCompiler from "zod-compiler/rolldown"` |
-| Rsbuild    | `import zodCompiler from "zod-compiler/rsbuild"`  |
-| rspack     | `import zodCompiler from "zod-compiler/rspack"`   |
-| Bun        | `import zodCompiler from "zod-compiler/bun"`      |
-| Farm       | `import zodCompiler from "zod-compiler/farm"`     |
+| Build Tool          | Import                                            |
+| ------------------- | ------------------------------------------------- |
+| Vite                | `import zodCompiler from "zod-compiler/vite"`     |
+| webpack             | `import zodCompiler from "zod-compiler/webpack"`  |
+| Turbopack / Next.js | `loaders: ["zod-compiler/turbopack"]`             |
+| esbuild             | `import zodCompiler from "zod-compiler/esbuild"`  |
+| SWC                 | `import zodCompiler from "zod-compiler/swc"`      |
+| Rollup              | `import zodCompiler from "zod-compiler/rollup"`   |
+| Rolldown            | `import zodCompiler from "zod-compiler/rolldown"` |
+| Rsbuild             | `import zodCompiler from "zod-compiler/rsbuild"`  |
+| rspack              | `import zodCompiler from "zod-compiler/rspack"`   |
+| Bun                 | `import zodCompiler from "zod-compiler/bun"`      |
+| Farm                | `import zodCompiler from "zod-compiler/farm"`     |
+
+Turbopack takes a loader rather than a plugin — see [Next.js (Turbopack)](#nextjs-turbopack).
 
 ### Options
 
@@ -210,6 +213,13 @@ Validators share a runtime helper layer imported from one module, so each helper
 bundle. Schemas in a file sharing a structurally identical sub-shape emit its error walk once —
 **19-28% raw / 10-18% gzipped**, scaling with how much the file repeats.
 
+Build plugins serve that module from their own resolve hook — as `virtual:zod-compiler/runtime`, or
+`__zod-compiler-runtime__` on webpack and rspack, which reject the `virtual:` scheme. A host without
+hooks — a webpack loader such as [Turbopack](#nextjs-turbopack) — can instead import the same code
+from `zod-compiler/runtime`, a real package subpath that plain module resolution finds. That only
+pays off where the host bundles the import rather than leaving it external, which is why it is
+opt-in there.
+
 **Transpile-only esbuild builds** (no `--bundle`) never fire the bundler's resolve hooks, so the
 `virtual:` specifier would survive into `dist/` and fail at runtime. Set `codegenMode: "inline"` to emit
 helpers per file instead:
@@ -220,6 +230,100 @@ export default [zodCompiler({ schemas: "explicit", codegenMode: "inline" })];
 
 Set `output: "bag"` to also drop the retained Zod schema when you don't need `.shape` / `instanceof`.
 
+### Next.js (Turbopack)
+
+Turbopack — the default bundler since Next.js 16 — [runs webpack loaders but no webpack
+plugins](https://nextjs.org/docs/app/api-reference/turbopack#webpack-plugins), so it needs the
+loader entry point rather than `zod-compiler/webpack`:
+
+```typescript
+// next.config.ts
+import type { NextConfig } from "next";
+
+const nextConfig: NextConfig = {
+  turbopack: {
+    rules: {
+      "*.{ts,tsx}": {
+        condition: {
+          all: [
+            { not: "foreign" }, // skip node_modules
+            { content: /[Zz]od/ }, // skip files that cannot contain a schema
+          ],
+        },
+        loaders: ["zod-compiler/turbopack"],
+      },
+    },
+  },
+};
+
+export default nextConfig;
+```
+
+Pass options with the object form — `loaders: [{ loader: "zod-compiler/turbopack", options: { verbose: true } }]`.
+Next.js serializes them into its config, so they have to be plain JSON. That rules out a RegExp
+`hoist.schemaNamePattern` (pass the pattern as a string instead), and `apply` is Vite-only as always.
+There is no `cache` option either: the loader keeps no disk cache of its own, because
+Turbopack already caches loader results persistently, keyed on file content plus the dependencies
+the loader declares. Nothing lands in `node_modules/.cache/zod-compiler`, so the CI cache step under
+[Large projects and CI](#large-projects-and-ci) does not apply — cache `.next/cache` instead.
+
+The two `condition` clauses are the Turbopack equivalent of the plugin's own file filters — without
+them the loader is invoked on every `.ts` in the project. Keep the `content` pattern this loose:
+narrowing it to `"zod"` silently skips `zod/v4`, `zod/mini` and the `zod-compiler` import behind
+`schemas: "explicit"`, and skipped files just quietly stay uncompiled. Drop the `content` clause
+entirely if you set a custom `hoist.schemaNamePattern`, which makes schema roots out of identifiers
+(`UserModel`) in files that need never mention zod at all.
+
+Set no `as` or `type` on the rule. The loader emits TypeScript and Turbopack's own SWC pass handles
+it, so there is no second transpile and no `@swc/core` dependency.
+
+Helpers are emitted per file by default. `codegenMode: "lean"` imports them from
+`zod-compiler/runtime` instead — a real package subpath, resolvable without the hook a loader
+doesn't have — so one copy is shared across every transformed file:
+
+```typescript
+loaders: [{ loader: "zod-compiler/turbopack", options: { codegenMode: "lean" } }],
+```
+
+It is opt-in because it only holds where the host **bundles** that import. Next.js does for client
+and App Router server code. Pages Router server code externalizes `node_modules` imports unless
+[`bundlePagesRouterDependencies`](https://nextjs.org/docs/pages/api-reference/config/next-config-js/bundlePagesRouterDependencies)
+is on — and `zod-compiler` is usually a devDependency, so a production install prunes it and the
+route throws `ERR_MODULE_NOT_FOUND` on the first request, with nothing failing at build time. Use
+lean for an App-Router-only app, or move `zod-compiler` to `dependencies`.
+
+Expect a file reachable from both client and server components to be transformed more than once —
+Turbopack applies loaders per output environment, and runs them in a worker pool, so the cache of
+executed modules that makes discovery cheap is only shared within a worker. The first build of a
+large schema set is the expensive one.
+
+`next dev --webpack` / `next build --webpack` remain available, where `zod-compiler/webpack` applies
+unchanged:
+
+```typescript
+// next.config.ts — webpack only
+import type { NextConfig } from "next";
+import zodCompiler from "zod-compiler/webpack";
+
+const nextConfig: NextConfig = {
+  webpack: (config) => {
+    config.plugins?.push(zodCompiler({ verbose: true }));
+    return config;
+  },
+};
+
+export default nextConfig;
+```
+
+Schemas exported from a `"use client"` module compile like any other — the generated runtime is
+emitted below the directive so it stays the first statement. A `"use server"` file is different, and
+not because of zod-compiler: Next.js only allows async function exports there, so a schema in one
+has to stay inside a function, where [hoisting](#schema-hoisting) still lifts and compiles it.
+
+Note also the React Server Components rule that a server component may not import a _value_ from a
+`"use client"` module — that yields a client reference rather than the schema, with or without
+zod-compiler.
+
 ### SWC
 
 A programmatic `@swc/core` bridge wrapping `transform()`, not a `.swcrc` plugin. Install

package/dist/runtime.d.ts

@@ -0,0 +1,53 @@
+// Generated at build time from zod-compiler's helper registries.
+// Imported by lean-mode generated code, never written by hand — `any`
+// because a caller would otherwise have to cast every helper to call it.
+export declare const __zcMkv: any;
+export declare const __zcFin: any;
+export declare const __zcFinD: any;
+export declare const __zcFinZ: any;
+export declare const __zcTS: any;
+export declare const __zcTSn: any;
+export declare const __zcTSx: any;
+export declare const __zcTB: any;
+export declare const __zcTBt: any;
+export declare const __zcTBx: any;
+export declare const __zcIT: any;
+export declare const __zcITc: any;
+export declare const __zcIF: any;
+export declare const __zcIV: any;
+export declare const __zcUK: any;
+export declare const __zcAb: any;
+export declare const __zcFsr: any;
+export declare const __zcFz: any;
+export declare const __zcHop: any;
+export declare const __zcLo: any;
+export declare const __zcSo: any;
+export declare const __zcPlain: any;
+export declare const __zcPfx: any;
+export declare const __zcCu: any;
+export declare const __zcSr: any;
+export declare const __zcSrOk: any;
+export declare const __zcReEmail: any;
+export declare const __zcReEmailSrc: any;
+export declare const __zcReUuid: any;
+export declare const __zcReUuidSrc: any;
+export declare const __zcReCuid: any;
+export declare const __zcReCuidSrc: any;
+export declare const __zcReCuid2: any;
+export declare const __zcReUlid: any;
+export declare const __zcReUlidSrc: any;
+export declare const __zcReNanoid: any;
+export declare const __zcReNanoidSrc: any;
+export declare const __zcReXid: any;
+export declare const __zcReXidSrc: any;
+export declare const __zcReKsuid: any;
+export declare const __zcReKsuidSrc: any;
+export declare const __zcReIpv4: any;
+export declare const __zcReIpv6: any;
+export declare const __zcReBase64: any;
+export declare const __zcReBase64Src: any;
+export declare const __zcReBase64Url: any;
+export declare const __zcReE164: any;
+export declare const __zcReE164Src: any;
+export declare const __zcReGuid: any;
+export declare const __zcReGuidSrc: any;

package/dist/runtime.js

@@ -0,0 +1,55 @@
+import { config as __zodCompilerConfig, core as __zcCore, ZodRealError as __zcZodError } from "zod";
+function __zcUw(m){return typeof m==="string"?m:(m===undefined||m===null?undefined:m.message);}var __zcMsg=function(iss){var c=__zodCompilerConfig(),m;if(c.customError){m=__zcUw(c.customError(iss));if(m!==undefined&&m!==null)return m;}if(c.localeError){m=__zcUw(c.localeError(iss));if(m!==undefined&&m!==null)return m;}return "Invalid input";};
+function __ZcFail(e,f,i){this.success=false;this._e=e;this._f=f;this._i=i;this._c=undefined;}Object.defineProperty(__ZcFail.prototype,"error",{configurable:true,get:function(){if(this._c)return this._c;var e=this._f!==null?this._f(this._i):this._e;for(var i=0;i<e.length;i++){if(e[i].message===undefined&&typeof __zcMsg==="function")e[i].message=__zcMsg(e[i]);delete e[i].input;delete e[i].continue;}return this._c=new __zcZodError(e);}});
+function __ZcFailZ(z,i){this.success=false;this._z=z;this._i=i;this._c=undefined;}Object.defineProperty(__ZcFailZ.prototype,"error",{configurable:true,get:function(){return this._c||(this._c=this._z(this._i).error);}});
+export function __zcMkv(fn,schema,fc,is){var w=schema||{};var zpa=w.parseAsync,zspa=w.safeParseAsync;w.parse=fc?function(input){if(fc(input))return input;var r=fn(input);if(r.success)return r.data;throw r.error;}:function(input){var r=fn(input);if(r.success)return r.data;throw r.error;};w.safeParse=fn;w.safeParseAsync=function(input){try{return Promise.resolve(fn(input));}catch(e){if(zspa)return zspa(input);throw e;}};w.parseAsync=fc?function(input){try{if(fc(input))return Promise.resolve(input);var r=fn(input);if(r.success)return Promise.resolve(r.data);return Promise.reject(r.error);}catch(e){if(zpa)return zpa(input);throw e;}}:function(input){try{var r=fn(input);if(r.success)return Promise.resolve(r.data);return Promise.reject(r.error);}catch(e){if(zpa)return zpa(input);throw e;}};w.is=is||function(input){return fn(input).success;};var s=w["~standard"],zv=s&&s.validate;Object.defineProperty(w,"~standard",{configurable:true,value:{version:1,vendor:(s&&s.vendor)||"zod",validate:function(input){var r;try{if(fc&&fc(input))return{value:input};r=fn(input);}catch(e){if(zv)return zv(input);throw e;}return r.success?{value:r.data}:{issues:r.error.issues};}}});return w;}
+export function __zcFin(e,d){if(!e.length)return{success:true,data:d};return new __ZcFail(e,null,null);}
+export function __zcFinD(f,inp){return new __ZcFail(null,f,inp);}
+export function __zcFinZ(z,i){return new __ZcFailZ(z,i);}
+function __zcSrRun(f,p){var r=f(p);if(r&&typeof r.then==="function"){throw new __zcCore.$ZodAsyncError();}}
+export function __zcTS(m,o,i,inp,p,msg){var r={origin:o,code:"too_small",minimum:m,inclusive:i,input:inp,path:p};if(msg!==undefined)r.message=msg;return r;}
+export function __zcTSn(m,o,inp,p,msg){var r={code:"too_small",minimum:m,origin:o,input:inp,path:p,continue:false};if(msg!==undefined)r.message=msg;return r;}
+export function __zcTSx(m,o,inp,p,msg){var r={origin:o,code:"too_small",minimum:m,inclusive:true,exact:true,input:inp,path:p};if(msg!==undefined)r.message=msg;return r;}
+export function __zcTB(m,o,i,inp,p,msg){var r={origin:o,code:"too_big",maximum:m,inclusive:i,input:inp,path:p};if(msg!==undefined)r.message=msg;return r;}
+export function __zcTBt(m,o,inp,p,msg){var r={code:"too_big",maximum:m,inclusive:true,origin:o,input:inp,path:p,continue:false};if(msg!==undefined)r.message=msg;return r;}
+export function __zcTBx(m,o,inp,p,msg){var r={origin:o,code:"too_big",maximum:m,inclusive:true,exact:true,input:inp,path:p};if(msg!==undefined)r.message=msg;return r;}
+export function __zcIT(e,inp,p,msg){var r={expected:e,code:"invalid_type",input:inp,path:p};if(msg!==undefined)r.message=msg;return r;}
+export function __zcITc(e,inp,p,msg){var r={code:"invalid_type",expected:e,input:inp,path:p};if(msg!==undefined)r.message=msg;return r;}
+export function __zcIF(o,f,inp,p,extra,msg){var r=o===undefined?{code:"invalid_format",format:f}:{origin:o,code:"invalid_format",format:f};if(extra)Object.assign(r,extra);r.input=inp;r.path=p;if(msg!==undefined)r.message=msg;return r;}
+export function __zcIV(values,inp,p,extra,msg){var r={code:"invalid_value"};if(extra)Object.assign(r,extra);r.values=values;r.input=inp;r.path=p;if(msg!==undefined)r.message=msg;return r;}
+export function __zcUK(k,inp,p,msg){var r={code:"unrecognized_keys",keys:k,input:inp,path:p};if(msg!==undefined)r.message=msg;return r;}
+export function __zcAb(e,i){for(;i<e.length;i++){var s=e[i];if(s.continue===false)return true;var c=s.code;if(c==="invalid_type"||c==="invalid_value"||c==="invalid_union"||c==="unrecognized_keys"||c==="invalid_key"||c==="invalid_element")return true;}return false;}
+export function __zcFsr(v,s){var vd=((""+v).split(".")[1]||"").length;var ss=""+s;var sd=(ss.split(".")[1]||"").length;if(sd===0&&/\d?e-\d?/.test(ss)){var m=ss.match(/\d?e-(\d?)/);if(m&&m[1]){sd=parseInt(m[1],10);}}var d=vd>sd?vd:sd;var vi=parseInt(v.toFixed(d).replace(".",""),10);var si=parseInt(s.toFixed(d).replace(".",""),10);return (vi%si)/Math.pow(10,d);}
+export function __zcFz(e){for(var i=0;i<e.length;i++){var s=e[i];if(s.message===undefined&&typeof __zcMsg==="function")s.message=__zcMsg(s);delete s.input;delete s.continue;}return e;}
+export const __zcHop=Object.prototype.hasOwnProperty;
+export function __zcLo(v){return Array.isArray(v)?"array":typeof v==="string"?"string":"unknown";}
+export function __zcSo(v){return v instanceof Set?"set":v instanceof Map?"map":(typeof File!=="undefined"&&v instanceof File)?"file":"unknown";}
+export function __zcPlain(o){if(typeof o!=="object"||o===null||Array.isArray(o))return false;var c=o.constructor;if(c===undefined||typeof c!=="function")return true;var p=c.prototype;if(typeof p!=="object"||p===null||Array.isArray(p))return false;return Object.prototype.hasOwnProperty.call(p,"isPrototypeOf");}
+export function __zcPfx(d,s,b,k){for(var i=0;i<s.length;i++){var x=s[i];x.path=b.concat(k,x.path);d.push(x);}}
+export function __zcCu(f,v){var r=f(v);if(r&&typeof r.then==="function"){throw new __zcCore.$ZodAsyncError();}return !!r;}
+export function __zcSr(f,v,p,e){var q={value:v,issues:[]};__zcSrRun(f,q);for(var i=0;i<q.issues.length;i++){var s=q.issues[i],t={};for(var k in s){if(k!=="inst"&&k!=="continue")t[k]=s[k];}if(s.continue!==true)q.aborted=true;t.path=s.path&&s.path.length?p.concat(s.path):p;e.push(t);}return q;}
+export function __zcSrOk(f,v){var p={value:v,issues:[]};__zcSrRun(f,p);return p.issues.length===0&&p.value===v;}
+export const __zcReEmail=new RegExp("^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$");
+export const __zcReEmailSrc="/^(?!\\.)(?!.*\\.\\.)([A-Za-z0-9_'+\\-\\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$/";
+export const __zcReUuid=new RegExp("^([0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]-[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$");
+export const __zcReUuidSrc="/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/";
+export const __zcReCuid=new RegExp("^[cC][^\\s-][^\\s-][^\\s-][^\\s-][^\\s-][^\\s-][^\\s-][^\\s-][^\\s-]*$");
+export const __zcReCuidSrc="/^[cC][^\\s-]{8,}$/";
+export const __zcReCuid2=new RegExp("^[0-9a-z]+$");
+export const __zcReUlid=new RegExp("^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z][0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]$");
+export const __zcReUlidSrc="/^[0-9A-HJKMNP-TV-Za-hjkmnp-tv-z]{26}$/";
+export const __zcReNanoid=new RegExp("^[a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-][a-zA-Z0-9_-]$");
+export const __zcReNanoidSrc="/^[a-zA-Z0-9_-]{21}$/";
+export const __zcReXid=new RegExp("^[0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V][0-9a-vA-V]$");
+export const __zcReXidSrc="/^[0-9a-vA-V]{20}$/";
+export const __zcReKsuid=new RegExp("^[A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9][A-Za-z0-9]$");
+export const __zcReKsuidSrc="/^[A-Za-z0-9]{27}$/";
+export const __zcReIpv4=new RegExp("^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$");
+export const __zcReIpv6=new RegExp("^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$");
+export const __zcReBase64=new RegExp("^$|^(?:[0-9a-zA-Z+/][0-9a-zA-Z+/][0-9a-zA-Z+/][0-9a-zA-Z+/])*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$");
+export const __zcReBase64Src="/^$|^(?:[0-9a-zA-Z+/]{4})*(?:(?:[0-9a-zA-Z+/]{2}==)|(?:[0-9a-zA-Z+/]{3}=))?$/";
+export const __zcReBase64Url=new RegExp("^[A-Za-z0-9_-]*$");
+export const __zcReE164=new RegExp("^\\+[1-9]\\d\\d\\d\\d\\d\\d\\d?\\d?\\d?\\d?\\d?\\d?\\d?\\d?$");
+export const __zcReE164Src="/^\\+[1-9]\\d{6,14}$/";
+export const __zcReGuid=new RegExp("^([0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]-[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]-[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]-[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F]-[0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F][0-9a-fA-F])$");
+export const __zcReGuidSrc="/^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$/";

package/dist/turbopack.d.ts

@@ -0,0 +1,56 @@
+import { ZodCompilerPluginOptions } from "./unplugin/types.js";
+import { TransformSourceMap } from "./unplugin/transform.js";
+//#region src/turbopack.d.ts
+/**
+ * Plugin options minus the ones a loader host cannot express.
+ *
+ * Turbopack serializes loader options through `next.config`, so they have to be
+ * plain JSON — hence no `apply` (a Vite lifecycle function) and a string-only
+ * `schemaNamePattern` where the plugin also accepts a RegExp.
+ *
+ * No `cache` either: the disk cache's dependency bookkeeping leans on a
+ * `buildEnd` flush that a loader has no equivalent for, and loader hosts keep
+ * their own persistent result cache — Turbopack's is keyed on content plus the
+ * dependencies declared below, which is what this would have re-implemented.
+ */
+type ZodCompilerTurbopackOptions = Omit<ZodCompilerPluginOptions, "apply" | "cache" | "codegenMode" | "hoist"> & {
+  hoist?: boolean | {
+    schemaNamePattern?: string | null | undefined;
+  } | undefined;
+  /**
+   * `"inline"` (default) emits the shared helpers into every transformed file.
+   *
+   * `"lean"` imports them from `zod-compiler/runtime` instead, so a bundle
+   * carries one copy however many files were transformed. That specifier is a
+   * real package subpath, which is what makes it usable from a loader at all —
+   * the `virtual:` id the build plugins emit needs a `resolveId` hook, and a
+   * loader has none.
+   *
+   * Opt-in rather than the default because it only holds when the host BUNDLES
+   * the import. Next.js does for client and App Router server code, but Pages
+   * Router server code externalizes node_modules imports unless
+   * `bundlePagesRouterDependencies` is set — and `zod-compiler` is normally a
+   * devDependency, so a production install prunes it and the route throws
+   * ERR_MODULE_NOT_FOUND on the first request. A bigger bundle is the better
+   * default than a runtime failure that no build step reports.
+   * @default "inline"
+   */
+  codegenMode?: "lean" | "inline" | undefined;
+};
+/**
+ * The slice of webpack's loader context this uses. Structural rather than
+ * imported from webpack: the package must not take a webpack dependency to
+ * serve a host that is not webpack.
+ */
+interface ZodCompilerLoaderContext {
+  resourcePath: string;
+  async(): (error: Error | null, code?: string, map?: TransformSourceMap) => void;
+  getOptions?(): ZodCompilerTurbopackOptions | undefined;
+  addDependency?(file: string): void;
+  cacheable?(flag: boolean): void;
+  query?: unknown;
+}
+declare function zodCompilerLoader(this: ZodCompilerLoaderContext, source: string, inputMap?: TransformSourceMap): void;
+//#endregion
+export { ZodCompilerLoaderContext, ZodCompilerTurbopackOptions, zodCompilerLoader as default };
+//# sourceMappingURL=turbopack.d.ts.map

package/dist/turbopack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"turbopack.d.ts","names":[],"sources":["../src/turbopack.ts"],"mappings":";;;;;;;;;;;;;;;KA+DY,8BAA8B,KACxC;EAGA;IAAoB;;;;;;;;;;;;;;;;;;;;EAmBpB;;;;;;;UAQe;EACf;EACA,UAAU,OAAO,cAAc,eAAe,MAAM;EACpD,eAAe;EACf,eAAe;EACf,WAAW;EACX;;iBAwMsB,kBACtB,MAAM,0BACN,gBACA,WAAW"}

package/dist/turbopack.js

@@ -0,0 +1,200 @@
+import { getFirstPartyModulePaths, invalidateModuleCache } from "./loader.js";
+import { RUNTIME_PACKAGE_ID } from "./unplugin/virtual.js";
+import { log, shouldTransform, transformCodeWithMap } from "./unplugin/transform.js";
+import { resetDepGraphMemo, transformDependencies } from "./unplugin/dep-graph.js";
+import remapping from "@jridgewell/remapping";
+import fs from "node:fs";
+//#region src/turbopack.ts
+/**
+* Webpack-loader entry point, for Turbopack (Next.js) and any other host that
+* runs webpack loaders but not webpack plugins.
+*
+* Turbopack deliberately supports no webpack plugins, so the unplugin build
+* plugins cannot reach it. Loaders it does run, through the real `loader-runner`
+* library, and that is enough: this module is the whole zod-compiler transform
+* behind `this.async()`.
+*
+* It emits TypeScript, not JavaScript. A `turbopack.rules` entry that sets no
+* `as`/`type` leaves the loader's output to be parsed as whatever the file
+* already was, so Turbopack's own SWC pass handles the syntax — there is no
+* second transpile here and no @swc/core dependency.
+*
+* `codegenMode: "lean"` is available here — it imports the shared helpers from
+* `zod-compiler/runtime`, a real package subpath, rather than the `virtual:` id
+* the build plugins answer from a resolve hook that a loader does not have. It
+* is opt-in; see the option's doc for why.
+*
+*   // next.config.ts
+*   export default {
+*     turbopack: {
+*       rules: {
+*         "*.{ts,tsx}": {
+*           condition: { all: [{ not: "foreign" }, { content: /[Zz]od/ }] },
+*           loaders: ["zod-compiler/turbopack"],
+*         },
+*       },
+*     },
+*   };
+*
+* The `content` condition is the Turbopack equivalent of the plugins' own code
+* filter and must stay as loose as ZOD_MENTION: narrowing it to the literal
+* specifier `"zod"` would silently skip `zod/v4`, `zod/mini` and the
+* `zod-compiler` import that drives `schemas: "explicit"` — no error, those
+* schemas just quietly stay uncompiled.
+*/
+/**
+* Disk stamps of every module the shared execution cache is currently holding.
+*
+* Discovery executes schema files from DISK through a module cache that outlives
+* loader calls. The bundler plugins evict it from `watchChange`; a loader has no
+* such hook, so staleness has to be detected here or compiled validators keep
+* reflecting whatever the files said when they were first executed.
+*
+* Diffing the entry's own content is NOT enough, and the gap is exactly the case
+* `addDependency` exists to handle: when an imported constant changes, the host
+* re-runs the loader for a schema file whose content is UNCHANGED.
+*
+* Tracked GLOBALLY rather than per file, because that is what it describes: one
+* process-wide module cache, stale the moment any file behind it changes. A
+* per-file dependency list cannot express that — a file being transformed for
+* the FIRST time has no list yet, but the cache it is about to read from is
+* already warm and may already be stale. Keying on the cache's own inventory
+* also means one edit costs one eviction rather than one per dependent file.
+*
+* `getFirstPartyModulePaths()` is that inventory, which is why it is sound here
+* while being unsound as a per-file dependency list (see transformDependencies):
+* the question is "what is cached", not "what does this file need". It covers
+* dependencies the host never feeds through this loader at all — a constants
+* file that never mentions zod, or one a rule's `exclude` skips — but only the
+* ones jiti holds, so the two known gaps are its gaps:
+*
+* - `.js`/`.mjs` deps go through native `import()` (see loader.ts), which has no
+*   evictable cache. The build plugins are equally stale there; on Bun and Deno
+*   that is every module, and this whole mechanism is inert.
+* - A file being CREATED changes nothing's stamp, so a new module that shadows
+*   an existing resolution (`limits.ts` beside `limits/index.ts`) keeps serving
+*   the old one until some stamped file also changes. `watchChange` gives the
+*   plugins a signal for this that a loader host has no equivalent of.
+*
+* mtime+size like the disk cache's fast path, minus its content hashes: those
+* exist to survive checkouts across processes, and this map dies with the
+* process.
+*/
+const executedModuleStamps = /* @__PURE__ */ new Map();
+function stampOf(file) {
+	try {
+		const stat = fs.statSync(file, { throwIfNoEntry: false });
+		return stat === void 0 ? "" : `${stat.mtimeMs}:${stat.size}`;
+	} catch {
+		return "";
+	}
+}
+/**
+* Drop cached module executions when any file behind them changed on disk.
+*
+* Eviction is global (see invalidateModuleCache), so it is deliberately paired
+* with the dep-graph memos the plugin also resets in `watchChange`: a resolution
+* memoized before a file existed would otherwise pin that importer to an
+* unanalyzable graph for the life of the process.
+*
+* Costs one stat per executed module, paid by every file that reaches the
+* transform — ~3 ms per file against the 1,900-module project dep-graph.ts
+* cites, the same order as the closure walk `transformDependencies` does a few
+* lines later, and far below the discovery it is protecting.
+*/
+function invalidateStaleExecutions() {
+	let stale = false;
+	for (const [file, stamp] of executedModuleStamps) if (stampOf(file) !== stamp) {
+		stale = true;
+		break;
+	}
+	if (!stale) return;
+	invalidateModuleCache();
+	resetDepGraphMemo();
+	executedModuleStamps.clear();
+}
+/**
+* Stamp whatever discovery just executed.
+*
+* Keeps the FIRST stamp for a file rather than refreshing: a file edited between
+* its execution and this call must keep its pre-edit stamp, or the next run
+* would see it as fresh and pin the stale execution permanently.
+*
+* `null` means no jiti instance exists — a runtime whose module cache cannot be
+* evicted at all (loader.ts), so there is nothing to track and nothing to fix.
+*/
+function recordExecutedModules() {
+	for (const file of getFirstPartyModulePaths() ?? []) if (!executedModuleStamps.has(file)) executedModuleStamps.set(file, stampOf(file));
+}
+function readOptions(context) {
+	const options = context.getOptions?.();
+	if (options !== void 0) return options;
+	return typeof context.query === "object" && context.query !== null ? context.query : {};
+}
+/**
+* Declare what a rebuild must watch. The host caches this file's output keyed on
+* its own content, but discovery executed the whole import graph — without these
+* an edit to an imported constant leaves a stale validator in the bundle.
+*/
+function declareDependencies(context, id, verbose) {
+	const { files, complete } = transformDependencies(id);
+	for (const file of files) context.addDependency?.(file);
+	if (complete) return;
+	context.cacheable?.(false);
+	if (verbose) log(`Cannot analyze the import graph of ${id} — re-running its transform every build`);
+}
+/** The transform itself, split out so the loader shell stays callback-only. */
+async function run(context, source, inputMap) {
+	const id = context.resourcePath;
+	const options = readOptions(context);
+	if (!shouldTransform(id, options)) return {
+		code: source,
+		map: inputMap
+	};
+	invalidateStaleExecutions();
+	const output = options.output ?? "schema";
+	let discoveryRan = false;
+	const result = await transformCodeWithMap(source, id, {
+		mode: options.codegenMode ?? "inline",
+		runtimeId: RUNTIME_PACKAGE_ID,
+		verbose: options.verbose,
+		zodCompat: output === "schema" || output === "compact",
+		compact: output === "compact",
+		autoDiscover: (options.schemas ?? "auto") === "auto",
+		hoist: options.hoist,
+		onDiscovery: () => {
+			discoveryRan = true;
+		},
+		onUncacheableResult: () => {
+			context.cacheable?.(false);
+		}
+	});
+	if (discoveryRan) {
+		recordExecutedModules();
+		declareDependencies(context, id, options.verbose === true);
+	}
+	if (result === null) return {
+		code: source,
+		map: inputMap
+	};
+	return {
+		code: result.code,
+		map: composeMaps(result.map, inputMap)
+	};
+}
+/** Chain this transform's map onto an earlier loader's, newest first. */
+function composeMaps(map, inputMap) {
+	if (map === null) return inputMap;
+	if (inputMap === void 0) return map;
+	return remapping([map, inputMap], () => null);
+}
+function zodCompilerLoader(source, inputMap) {
+	const callback = this.async();
+	const succeed = (result) => callback(null, result.code, result.map);
+	const fail = (error) => callback(error instanceof Error ? error : new Error(String(error)));
+	run(this, source, inputMap).then(succeed, fail);
+}
+//#endregion
+export { zodCompilerLoader as default };
+
+//# sourceMappingURL=turbopack.js.map

package/dist/turbopack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"turbopack.js","names":[],"sources":["../src/turbopack.ts"],"sourcesContent":["/**\n * Webpack-loader entry point, for Turbopack (Next.js) and any other host that\n * runs webpack loaders but not webpack plugins.\n *\n * Turbopack deliberately supports no webpack plugins, so the unplugin build\n * plugins cannot reach it. Loaders it does run, through the real `loader-runner`\n * library, and that is enough: this module is the whole zod-compiler transform\n * behind `this.async()`.\n *\n * It emits TypeScript, not JavaScript. A `turbopack.rules` entry that sets no\n * `as`/`type` leaves the loader's output to be parsed as whatever the file\n * already was, so Turbopack's own SWC pass handles the syntax — there is no\n * second transpile here and no @swc/core dependency.\n *\n * `codegenMode: \"lean\"` is available here — it imports the shared helpers from\n * `zod-compiler/runtime`, a real package subpath, rather than the `virtual:` id\n * the build plugins answer from a resolve hook that a loader does not have. It\n * is opt-in; see the option's doc for why.\n *\n *   // next.config.ts\n *   export default {\n *     turbopack: {\n *       rules: {\n *         \"*.{ts,tsx}\": {\n *           condition: { all: [{ not: \"foreign\" }, { content: /[Zz]od/ }] },\n *           loaders: [\"zod-compiler/turbopack\"],\n *         },\n *       },\n *     },\n *   };\n *\n * The `content` condition is the Turbopack equivalent of the plugins' own code\n * filter and must stay as loose as ZOD_MENTION: narrowing it to the literal\n * specifier `\"zod\"` would silently skip `zod/v4`, `zod/mini` and the\n * `zod-compiler` import that drives `schemas: \"explicit\"` — no error, those\n * schemas just quietly stay uncompiled.\n */\n\nimport fs from \"node:fs\";\nimport remapping from \"@jridgewell/remapping\";\nimport { getFirstPartyModulePaths, invalidateModuleCache } from \"./loader.js\";\nimport { resetDepGraphMemo, transformDependencies } from \"./unplugin/dep-graph.js\";\nimport {\n  log,\n  shouldTransform,\n  type TransformSourceMap,\n  transformCodeWithMap,\n} from \"./unplugin/transform.js\";\nimport type { ZodCompilerPluginOptions } from \"./unplugin/types.js\";\nimport { RUNTIME_PACKAGE_ID } from \"./unplugin/virtual.js\";\n\n/**\n * Plugin options minus the ones a loader host cannot express.\n *\n * Turbopack serializes loader options through `next.config`, so they have to be\n * plain JSON — hence no `apply` (a Vite lifecycle function) and a string-only\n * `schemaNamePattern` where the plugin also accepts a RegExp.\n *\n * No `cache` either: the disk cache's dependency bookkeeping leans on a\n * `buildEnd` flush that a loader has no equivalent for, and loader hosts keep\n * their own persistent result cache — Turbopack's is keyed on content plus the\n * dependencies declared below, which is what this would have re-implemented.\n */\nexport type ZodCompilerTurbopackOptions = Omit<\n  ZodCompilerPluginOptions,\n  \"apply\" | \"cache\" | \"codegenMode\" | \"hoist\"\n> & {\n  hoist?: boolean | { schemaNamePattern?: string | null | undefined } | undefined;\n  /**\n   * `\"inline\"` (default) emits the shared helpers into every transformed file.\n   *\n   * `\"lean\"` imports them from `zod-compiler/runtime` instead, so a bundle\n   * carries one copy however many files were transformed. That specifier is a\n   * real package subpath, which is what makes it usable from a loader at all —\n   * the `virtual:` id the build plugins emit needs a `resolveId` hook, and a\n   * loader has none.\n   *\n   * Opt-in rather than the default because it only holds when the host BUNDLES\n   * the import. Next.js does for client and App Router server code, but Pages\n   * Router server code externalizes node_modules imports unless\n   * `bundlePagesRouterDependencies` is set — and `zod-compiler` is normally a\n   * devDependency, so a production install prunes it and the route throws\n   * ERR_MODULE_NOT_FOUND on the first request. A bigger bundle is the better\n   * default than a runtime failure that no build step reports.\n   * @default \"inline\"\n   */\n  codegenMode?: \"lean\" | \"inline\" | undefined;\n};\n\n/**\n * The slice of webpack's loader context this uses. Structural rather than\n * imported from webpack: the package must not take a webpack dependency to\n * serve a host that is not webpack.\n */\nexport interface ZodCompilerLoaderContext {\n  resourcePath: string;\n  async(): (error: Error | null, code?: string, map?: TransformSourceMap) => void;\n  getOptions?(): ZodCompilerTurbopackOptions | undefined;\n  addDependency?(file: string): void;\n  cacheable?(flag: boolean): void;\n  query?: unknown;\n}\n\n/**\n * Disk stamps of every module the shared execution cache is currently holding.\n *\n * Discovery executes schema files from DISK through a module cache that outlives\n * loader calls. The bundler plugins evict it from `watchChange`; a loader has no\n * such hook, so staleness has to be detected here or compiled validators keep\n * reflecting whatever the files said when they were first executed.\n *\n * Diffing the entry's own content is NOT enough, and the gap is exactly the case\n * `addDependency` exists to handle: when an imported constant changes, the host\n * re-runs the loader for a schema file whose content is UNCHANGED.\n *\n * Tracked GLOBALLY rather than per file, because that is what it describes: one\n * process-wide module cache, stale the moment any file behind it changes. A\n * per-file dependency list cannot express that — a file being transformed for\n * the FIRST time has no list yet, but the cache it is about to read from is\n * already warm and may already be stale. Keying on the cache's own inventory\n * also means one edit costs one eviction rather than one per dependent file.\n *\n * `getFirstPartyModulePaths()` is that inventory, which is why it is sound here\n * while being unsound as a per-file dependency list (see transformDependencies):\n * the question is \"what is cached\", not \"what does this file need\". It covers\n * dependencies the host never feeds through this loader at all — a constants\n * file that never mentions zod, or one a rule's `exclude` skips — but only the\n * ones jiti holds, so the two known gaps are its gaps:\n *\n * - `.js`/`.mjs` deps go through native `import()` (see loader.ts), which has no\n *   evictable cache. The build plugins are equally stale there; on Bun and Deno\n *   that is every module, and this whole mechanism is inert.\n * - A file being CREATED changes nothing's stamp, so a new module that shadows\n *   an existing resolution (`limits.ts` beside `limits/index.ts`) keeps serving\n *   the old one until some stamped file also changes. `watchChange` gives the\n *   plugins a signal for this that a loader host has no equivalent of.\n *\n * mtime+size like the disk cache's fast path, minus its content hashes: those\n * exist to survive checkouts across processes, and this map dies with the\n * process.\n */\nconst executedModuleStamps = new Map<string, string>();\n\nfunction stampOf(file: string): string {\n  try {\n    const stat = fs.statSync(file, { throwIfNoEntry: false });\n    return stat === undefined ? \"\" : `${stat.mtimeMs}:${stat.size}`;\n  } catch {\n    // Non-ENOENT (EACCES, ELOOP, ENOTDIR): unreadable is indistinguishable from\n    // changed, and must never fail the build.\n    return \"\";\n  }\n}\n\n/**\n * Drop cached module executions when any file behind them changed on disk.\n *\n * Eviction is global (see invalidateModuleCache), so it is deliberately paired\n * with the dep-graph memos the plugin also resets in `watchChange`: a resolution\n * memoized before a file existed would otherwise pin that importer to an\n * unanalyzable graph for the life of the process.\n *\n * Costs one stat per executed module, paid by every file that reaches the\n * transform — ~3 ms per file against the 1,900-module project dep-graph.ts\n * cites, the same order as the closure walk `transformDependencies` does a few\n * lines later, and far below the discovery it is protecting.\n */\nfunction invalidateStaleExecutions(): void {\n  let stale = false;\n  for (const [file, stamp] of executedModuleStamps) {\n    if (stampOf(file) !== stamp) {\n      stale = true;\n      break;\n    }\n  }\n  if (!stale) return;\n  invalidateModuleCache();\n  resetDepGraphMemo();\n  executedModuleStamps.clear();\n}\n\n/**\n * Stamp whatever discovery just executed.\n *\n * Keeps the FIRST stamp for a file rather than refreshing: a file edited between\n * its execution and this call must keep its pre-edit stamp, or the next run\n * would see it as fresh and pin the stale execution permanently.\n *\n * `null` means no jiti instance exists — a runtime whose module cache cannot be\n * evicted at all (loader.ts), so there is nothing to track and nothing to fix.\n */\nfunction recordExecutedModules(): void {\n  for (const file of getFirstPartyModulePaths() ?? []) {\n    if (!executedModuleStamps.has(file)) executedModuleStamps.set(file, stampOf(file));\n  }\n}\n\nfunction readOptions(context: ZodCompilerLoaderContext): ZodCompilerTurbopackOptions {\n  const options = context.getOptions?.();\n  if (options !== undefined) return options;\n  // `getOptions` is standard but not universal; `query` is the older shape.\n  return typeof context.query === \"object\" && context.query !== null\n    ? (context.query as ZodCompilerTurbopackOptions)\n    : {};\n}\n\n/**\n * Declare what a rebuild must watch. The host caches this file's output keyed on\n * its own content, but discovery executed the whole import graph — without these\n * an edit to an imported constant leaves a stale validator in the bundle.\n */\nfunction declareDependencies(\n  context: ZodCompilerLoaderContext,\n  id: string,\n  verbose: boolean,\n): void {\n  const { files, complete } = transformDependencies(id);\n  for (const file of files) context.addDependency?.(file);\n  if (complete) return;\n  // The graph could not be analyzed (a non-literal dynamic import anywhere in\n  // the closure), so the list above is just this file — not enough for the host\n  // to know when to re-run us. Asking to be re-run every build is the only\n  // answer left. Freshness itself does not depend on this: whether the loader\n  // is re-invoked once or every time, invalidateStaleExecutions decides what\n  // discovery may reuse.\n  context.cacheable?.(false);\n  if (verbose) {\n    log(`Cannot analyze the import graph of ${id} — re-running its transform every build`);\n  }\n}\n\ninterface LoaderResult {\n  code: string;\n  map?: TransformSourceMap | undefined;\n}\n\n/** The transform itself, split out so the loader shell stays callback-only. */\nasync function run(\n  context: ZodCompilerLoaderContext,\n  source: string,\n  inputMap: TransformSourceMap | undefined,\n): Promise<LoaderResult> {\n  const id = context.resourcePath;\n  const options = readOptions(context);\n\n  if (!shouldTransform(id, options)) return { code: source, map: inputMap };\n\n  // Before discovery can read a stale execution. Note this covers an edit to\n  // THIS file too: discovery executed it, so it carries a stamp of its own —\n  // there is no separate host-content diff, which would only ever fire for\n  // content that differs from the disk discovery actually reads.\n  invalidateStaleExecutions();\n\n  const output = options.output ?? \"schema\";\n  let discoveryRan = false;\n  const result = await transformCodeWithMap(source, id, {\n    mode: options.codegenMode ?? \"inline\",\n    runtimeId: RUNTIME_PACKAGE_ID,\n    verbose: options.verbose,\n    // \"compact\" keeps the Zod schema (its safeParse IS the cold error path), so\n    // only \"bag\" drops Zod compatibility.\n    zodCompat: output === \"schema\" || output === \"compact\",\n    compact: output === \"compact\",\n    autoDiscover: (options.schemas ?? \"auto\") === \"auto\",\n    hoist: options.hoist,\n    onDiscovery: () => {\n      discoveryRan = true;\n    },\n    onUncacheableResult: () => {\n      // Discovery recovered from a process.exit (an env guard in a secret-less\n      // build): the result is a function of the ENVIRONMENT, not the file, so it\n      // must not be cached against this content.\n      context.cacheable?.(false);\n    },\n  });\n\n  // Only discovery reads other files. A hoist-only or bailed-out transform is a\n  // pure function of this file's content, which the host already keys on.\n  if (discoveryRan) {\n    recordExecutedModules();\n    declareDependencies(context, id, options.verbose === true);\n  }\n\n  if (result === null) return { code: source, map: inputMap };\n  return { code: result.code, map: composeMaps(result.map, inputMap) };\n}\n\n/** Chain this transform's map onto an earlier loader's, newest first. */\nfunction composeMaps(\n  map: TransformSourceMap | null,\n  inputMap: TransformSourceMap | undefined,\n): TransformSourceMap | undefined {\n  if (map === null) return inputMap;\n  if (inputMap === undefined) return map;\n  return remapping(\n    [map, inputMap] as Parameters<typeof remapping>[0],\n    () => null,\n  ) as unknown as TransformSourceMap;\n}\n\nexport default function zodCompilerLoader(\n  this: ZodCompilerLoaderContext,\n  source: string,\n  inputMap?: TransformSourceMap,\n): void {\n  const callback = this.async();\n  const succeed = (result: LoaderResult): void => callback(null, result.code, result.map);\n  const fail = (error: unknown): void =>\n    callback(error instanceof Error ? error : new Error(String(error)));\n\n  // Two `then` handlers rather than one plus a try/catch: loader-runner invokes\n  // the host's continuation synchronously from `callback`, so a throw inside it\n  // would re-enter a catch and call back a second time. As rejection handlers of\n  // the SAME promise, exactly one of these can ever run.\n  run(this, source, inputMap).then(succeed, fail);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6IA,MAAM,uCAAuB,IAAI,IAAoB;AAErD,SAAS,QAAQ,MAAsB;CACrC,IAAI;EACF,MAAM,OAAO,GAAG,SAAS,MAAM,EAAE,gBAAgB,MAAM,CAAC;EACxD,OAAO,SAAS,KAAA,IAAY,KAAK,GAAG,KAAK,QAAQ,GAAG,KAAK;CAC3D,QAAQ;EAGN,OAAO;CACT;AACF;;;;;;;;;;;;;;AAeA,SAAS,4BAAkC;CACzC,IAAI,QAAQ;CACZ,KAAK,MAAM,CAAC,MAAM,UAAU,sBAC1B,IAAI,QAAQ,IAAI,MAAM,OAAO;EAC3B,QAAQ;EACR;CACF;CAEF,IAAI,CAAC,OAAO;CACZ,sBAAsB;CACtB,kBAAkB;CAClB,qBAAqB,MAAM;AAC7B;;;;;;;;;;;AAYA,SAAS,wBAA8B;CACrC,KAAK,MAAM,QAAQ,yBAAyB,KAAK,CAAC,GAChD,IAAI,CAAC,qBAAqB,IAAI,IAAI,GAAG,qBAAqB,IAAI,MAAM,QAAQ,IAAI,CAAC;AAErF;AAEA,SAAS,YAAY,SAAgE;CACnF,MAAM,UAAU,QAAQ,aAAa;CACrC,IAAI,YAAY,KAAA,GAAW,OAAO;CAElC,OAAO,OAAO,QAAQ,UAAU,YAAY,QAAQ,UAAU,OACzD,QAAQ,QACT,CAAC;AACP;;;;;;AAOA,SAAS,oBACP,SACA,IACA,SACM;CACN,MAAM,EAAE,OAAO,aAAa,sBAAsB,EAAE;CACpD,KAAK,MAAM,QAAQ,OAAO,QAAQ,gBAAgB,IAAI;CACtD,IAAI,UAAU;CAOd,QAAQ,YAAY,KAAK;CACzB,IAAI,SACF,IAAI,sCAAsC,GAAG,wCAAwC;AAEzF;;AAQA,eAAe,IACb,SACA,QACA,UACuB;CACvB,MAAM,KAAK,QAAQ;CACnB,MAAM,UAAU,YAAY,OAAO;CAEnC,IAAI,CAAC,gBAAgB,IAAI,OAAO,GAAG,OAAO;EAAE,MAAM;EAAQ,KAAK;CAAS;CAMxE,0BAA0B;CAE1B,MAAM,SAAS,QAAQ,UAAU;CACjC,IAAI,eAAe;CACnB,MAAM,SAAS,MAAM,qBAAqB,QAAQ,IAAI;EACpD,MAAM,QAAQ,eAAe;EAC7B,WAAW;EACX,SAAS,QAAQ;EAGjB,WAAW,WAAW,YAAY,WAAW;EAC7C,SAAS,WAAW;EACpB,eAAe,QAAQ,WAAW,YAAY;EAC9C,OAAO,QAAQ;EACf,mBAAmB;GACjB,eAAe;EACjB;EACA,2BAA2B;GAIzB,QAAQ,YAAY,KAAK;EAC3B;CACF,CAAC;CAID,IAAI,cAAc;EAChB,sBAAsB;EACtB,oBAAoB,SAAS,IAAI,QAAQ,YAAY,IAAI;CAC3D;CAEA,IAAI,WAAW,MAAM,OAAO;EAAE,MAAM;EAAQ,KAAK;CAAS;CAC1D,OAAO;EAAE,MAAM,OAAO;EAAM,KAAK,YAAY,OAAO,KAAK,QAAQ;CAAE;AACrE;;AAGA,SAAS,YACP,KACA,UACgC;CAChC,IAAI,QAAQ,MAAM,OAAO;CACzB,IAAI,aAAa,KAAA,GAAW,OAAO;CACnC,OAAO,UACL,CAAC,KAAK,QAAQ,SACR,IACR;AACF;AAEA,SAAwB,kBAEtB,QACA,UACM;CACN,MAAM,WAAW,KAAK,MAAM;CAC5B,MAAM,WAAW,WAA+B,SAAS,MAAM,OAAO,MAAM,OAAO,GAAG;CACtF,MAAM,QAAQ,UACZ,SAAS,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;CAMpE,IAAI,MAAM,QAAQ,QAAQ,CAAC,CAAC,KAAK,SAAS,IAAI;AAChD"}

package/dist/unplugin/dep-graph.d.ts

@@ -1,6 +1,7 @@
 //#region src/unplugin/dep-graph.d.ts
 /**
- * Static per-file dependency graphs for disk-cache invalidation.
+ * Static per-file dependency graphs, for disk-cache invalidation and for the
+ * watch dependencies a loader host has to declare (see transformDependencies).
  *
  * The disk cache used to record `getFirstPartyModulePaths()` — the superset
  * of EVERY first-party module the loader had executed so far — as each
@@ -50,6 +51,48 @@ declare function resetDepGraphMemo(): void;
  * The entry itself is excluded (its content is part of the cache key).
  */
 declare function collectStaticDeps(entryFile: string): StaticDeps;
+interface TransformDependencies {
+  /**
+   * Files to declare as watch dependencies, entry first and deduped. Complete
+   * only when `complete` is true — otherwise it is just the entry.
+   */
+  files: string[];
+  /**
+   * False when the import graph could not be fully analyzed. `files` is then
+   * NOT sufficient, and the host has to reach for a coarser signal (a context
+   * dependency over the project, or refusing to cache the result) instead of
+   * trusting it.
+   */
+  complete: boolean;
+}
+/**
+ * Files whose contents can change what `id`'s transform produces — the set a
+ * host must declare as watch dependencies.
+ *
+ * Discovery EXECUTES the file's import graph, so a compiled validator reflects
+ * every constant, enum and helper that graph contributed. A host that keys its
+ * cache on `id`'s own content alone therefore serves a stale validator after an
+ * edit to any of them.
+ *
+ * Bundler plugins do not need this: their `watchChange` hook fires for every
+ * file in the project, so the plugin invalidates wholesale. Loader hosts
+ * (Turbopack, plain webpack loaders) have no such hook — their only lever is
+ * declaring dependencies per file, which is what this returns.
+ *
+ * The entry is always included, for the reason the disk cache records it too: a
+ * host keys on the content it PASSED, but discovery executed the file from disk.
+ *
+ * Deliberately NOT backed by `getFirstPartyModulePaths()` when the crawl comes
+ * up incomplete, unlike the disk cache's fallback. That superset is
+ * point-in-time, not cumulative — `invalidateModuleCache()` empties it — so
+ * after an unrelated file's discovery repopulates it, it describes THAT file's
+ * graph and can silently omit this one's. The disk cache survives that because
+ * `watchChange` invalidates wholesale and deferred entries flush against one
+ * end-of-build snapshot; a loader host has neither backstop, so a plausible but
+ * wrong list would go undetected. Reporting `complete: false` lets the caller
+ * do the sound thing instead.
+ */
+declare function transformDependencies(id: string): TransformDependencies;
 //#endregion
-export { StaticDeps, collectStaticDeps, resetDepGraphMemo };
+export { StaticDeps, TransformDependencies, collectStaticDeps, resetDepGraphMemo, transformDependencies };
 //# sourceMappingURL=dep-graph.d.ts.map

package/dist/unplugin/dep-graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dep-graph.d.ts","names":[],"sources":["../../src/unplugin/dep-graph.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4CiB;;EAEf;;EAEA;;;iBA0Cc;;;;;iBAsMA,kBAAkB,oBAAoB"}
+{"version":3,"file":"dep-graph.d.ts","names":[],"sources":["../../src/unplugin/dep-graph.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6CiB;;EAEf;;EAEA;;;iBA0Cc;;;;;iBAsMA,kBAAkB,oBAAoB;UA0BrC;;;;;EAKf;;;;;;;EAOA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA8Bc,sBAAsB,aAAa"}