`@orpc/zod` (oz.file) pulls `@orpc/server` into client bundles via transitive dependencies

[timvandam]

Environment

• @orpc/zod: 1.13.5 (reproduced), verified still present in 1.13.8 (latest)
• @orpc/openapi: 1.13.5 / 1.13.8
• @orpc/server: 1.13.5 / 1.13.8
• Bundler: Vite
• Zod: v3

Reproduction

Contract-first setup where contracts are shared between server and client:

import { oc } from '@orpc/contract';
import { z } from 'zod/v3';
import { oz } from '@orpc/zod';

export const myRouter = oc.router({
  downloadFile: oc
    .route({ method: 'GET', path: '/download/{id}' })
    .input(z.object({ id: z.string() }))
    .output(oz.file()),
});

Any client importing this contract bundles @orpc/server (~21.6 kb minified).

Describe the bug

@orpc/zod compiles to a single flat index.mjs where oz.file() and ZodToJsonSchemaConverter are co-located. oz.file() itself doesn't need @orpc/openapi, but ZodToJsonSchemaConverter does, and because they share a module, importing anything from @orpc/zod pulls in:

@orpc/zod/dist/index.mjs
  → import { JSONSchemaFormat } from '@orpc/openapi'          (only used by ZodToJsonSchemaConverter)
  → import { JsonSchemaXNativeType } from '@orpc/json-schema'  (same)

@orpc/openapi/dist/index.mjs
  → import { ORPCError, createRouterClient } from '@orpc/server'  (top-level, not tree-shakeable)

sideEffects: false alone won't fix this because @orpc/openapi has top-level runtime imports of @orpc/server. Even if the bundler drops ZodToJsonSchemaConverter, resolving @orpc/openapi still pulls in @orpc/server.

Suggested fix

Split ZodToJsonSchemaConverter into a separate subpath export (e.g. @orpc/zod/json-schema). The main @orpc/zod entry would only export the schema helpers (oz.file(), oz.blob(), etc.) which have no dependency on @orpc/openapi or @orpc/server.