solid-v2: switch fullstack templates from zod to valibot

solid-v2/fullstack-tanstack/env.ts

@@ -1,7 +1,7 @@
-import { z } from 'zod';
+import * as v from 'valibot';
 
 // The typed env schema (probed by the plugin from the project root): plain
-// objects of Standard Schema validators — zod here, but valibot, arktype, or
+// objects of Standard Schema validators — valibot here, but zod, arktype, or
 // any compliant library works, even mixed per key.
 //
 // `server` vars come through `virtual:env/server` (server modules only —
@@ -14,9 +14,9 @@ export default {
   server: {
     // Comma-separated, newest first — see src/server/session.ts for the
     // rotation story. Generate one: `openssl rand -base64 32`.
-    SESSION_SECRET: z.string().min(32),
+    SESSION_SECRET: v.pipe(v.string(), v.minLength(32)),
   },
   client: {
-    VITE_APP_NAME: z.string().min(1).default('Solid App'),
+    VITE_APP_NAME: v.optional(v.pipe(v.string(), v.minLength(1)), 'Solid App'),
   },
 };

solid-v2/fullstack-tanstack/package.json

@@ -28,7 +28,7 @@
     "@solidjs/web": "^2.0.0-rc.0",
     "@tanstack/solid-router": "^2.0.0-rc.0",
     "solid-js": "^2.0.0-rc.0",
-    "zod": "^4.1.13",
+    "valibot": "^1.4.2",
     "@tanstack/solid-query": "^6.0.0-rc.0"
   }
 }

solid-v2/fullstack/README.md

@@ -38,7 +38,7 @@ The demo wires it as auth: `login`/`logout` actions write the cookie, `getCurren
 
 ## Typed environment variables
 
-`env.ts` at the project root declares every variable as a [Standard Schema](https://standardschema.dev) validator (zod here; valibot or arktype work identically — nothing is imported from the plugin). The plugin probes it automatically and serves two fully typed virtual modules; generated types land in `solid-env.d.ts`.
+`env.ts` at the project root declares every variable as a [Standard Schema](https://standardschema.dev) validator (valibot here; zod or arktype work identically — nothing is imported from the plugin). The plugin probes it automatically and serves two fully typed virtual modules; generated types land in `solid-env.d.ts`.
 
 - **`virtual:env/server`** — every var, **read from `process.env` when the server boots** and validated then: secrets rotate without a rebuild, platform-injected vars work, and no secret value exists in any build artifact. A misconfigured server fails at boot with a per-key report (delete `SESSION_SECRET` from `.env` and run `npm start` to see it). Importing this module from client code fails the build, naming the importer.
 - **`virtual:env/client`** — the `VITE_`-prefixed vars, validated and **baked into the bundle** at build time (defaults applied, zero schema-library bytes shipped). The prefix is the line: client values are public, server values never leave the server.
@@ -118,7 +118,7 @@ The default `{ fetch(request) }` export follows the Fetchable convention used by
 
 1. **Serve `dist/client` statically**, and route everything else — pages, `/_server`, API routes — to `handleRequest`.
 2. **Provide the server env vars** (`SESSION_SECRET` here) in the process environment: the server bundle reads and validates them **at boot**, not at build time, so they come from the platform's env/secret settings — never from a build artifact. Client `VITE_` vars are the opposite: baked in at `vite build`, so set those on the build machine/CI.
-3. **Resolve the bundle's dependencies**: `dist/server` imports its npm deps (`solid-js`, `@solidjs/web`, `zod`, ...) as bare specifiers rather than inlining them, so whatever runs or re-bundles it needs `node_modules` present — true in every recipe below. The bundle itself is pure web-standard code (no `node:` imports, no top-level `await`).
+3. **Resolve the bundle's dependencies**: `dist/server` imports its npm deps (`solid-js`, `@solidjs/web`, `valibot`, ...) as bare specifiers rather than inlining them, so whatever runs or re-bundles it needs `node_modules` present — true in every recipe below. The bundle itself is pure web-standard code (no `node:` imports, no top-level `await`).
 
 ### Node
 

solid-v2/fullstack/env.ts

@@ -1,7 +1,7 @@
-import { z } from 'zod';
+import * as v from 'valibot';
 
 // The typed env schema (probed by the plugin from the project root): plain
-// objects of Standard Schema validators — zod here, but valibot, arktype, or
+// objects of Standard Schema validators — valibot here, but zod, arktype, or
 // any compliant library works, even mixed per key.
 //
 // `server` vars come through `virtual:env/server` (server modules only —
@@ -14,9 +14,9 @@ export default {
   server: {
     // Comma-separated, newest first — see src/server/session.ts for the
     // rotation story. Generate one: `openssl rand -base64 32`.
-    SESSION_SECRET: z.string().min(32),
+    SESSION_SECRET: v.pipe(v.string(), v.minLength(32)),
   },
   client: {
-    VITE_APP_NAME: z.string().min(1).default('Solid App'),
+    VITE_APP_NAME: v.optional(v.pipe(v.string(), v.minLength(1)), 'Solid App'),
   },
 };

solid-v2/fullstack/package.json

@@ -28,6 +28,6 @@
     "@solidjs/router": "^2.0.0-next.16",
     "@solidjs/web": "^2.0.0-rc.0",
     "solid-js": "^2.0.0-rc.0",
-    "zod": "^4.1.13"
+    "valibot": "^1.4.2"
   }
 }