@classytic/arc 2.21.0 → 2.23.0

package/skills/arc-code-review/SKILL.md

@@ -84,7 +84,7 @@ One `defineResource()` call **replaces all of these** in a typical Fastify servi
 ```markdown
 # Arc Convention Audit — <project-name>
 
-**Arc version:** 2.16.x · **Mongokit:** <version or "not installed"> · **Sqlitekit:** <version or "n/a"> · **Date:** <YYYY-MM-DD>
+**Arc version:** <installed version> · **Mongokit:** <version or "not installed"> · **Sqlitekit:** <version or "n/a"> · **Date:** <YYYY-MM-DD>
 **Files scanned:** <N> · **Findings:** <N critical · <N high · <N medium · <N low>
 
 ## Executive summary

package/skills/arc-code-review/references/anti-patterns.md

@@ -565,6 +565,8 @@ resources: async () => loadResources(import.meta.url, { context: { engine } }),
 // Each *.resource.ts then exports: (ctx) => defineResource({ adapter: ctx.engine.adapter() })
 ```
 
+For the DB **connection** itself (as opposed to engines), arc 2.21 adds `createApp({ beforeBoot: async () => connectDatabase() })` — awaited before Fastify exists, before module thunks resolve, and before any resource file imports. A composition root that connects the DB then dynamic-imports the app to control evaluation order is the pre-2.21 workaround; flag it and move the connect into `beforeBoot`.
+
 ---
 
 ## §21. Field-write denied as silent strip when reject is needed (or vice versa) 🟡
@@ -803,31 +805,19 @@ const userId = requireUserId(scope, 'finalize-checkout');    // hint surfaces in
 
 ---
 
-## §32f. `createMongooseAdapter` without `schemaGenerator` 🟠
+## §32f. Missing / dodged `schemaGenerator` 🟠
 
 **Detection:**
 ```
 pattern: "createMongooseAdapter\\s*\\(\\s*\\{[^}]*\\}\\s*\\)"
 multiline: true
 ```
-Then check whether the object literal includes a `schemaGenerator:` key.
-
-Also: `createDrizzleAdapter` without `schemaGenerator: buildCrudSchemasFromTable`.
+Then check the `schemaGenerator:` key — what to flag depends on the kit version:
 
-**Why high:** Arc 2.12 deleted the built-in mongoose / drizzle schema-gen fallback (~290 LOC). If `schemaGenerator` is omitted, OpenAPI bodies are emitted as `null` rather than silently inferred — the route still serves traffic but the docs / MCP tool input schemas are empty.
+- **mongokit >=3.21**: `schemaGenerator` DEFAULTS to `buildCrudSchemasFromModel` — omitting it is now correct. Flag the opposite: `schemaGenerator: false` used to dodge a wire-vs-model shape mismatch (minor-unit integers vs Money objects, enums, etc.). That opt-out silently kills OpenAPI bodies AND MCP tool input schemas for the whole resource. The right fix is a real wire contract: `customSchemas: { create: { body }, update: { body } }` with the generator ON — in arc 2.21 a custom part REPLACES the generated part wholesale (no `required[]` union), so wire and model shapes can differ cleanly.
+- **mongokit <3.21**: omitted `schemaGenerator` emits `null` OpenAPI bodies (arc 2.12 deleted the built-in fallback). Fix: upgrade the kit, or wire `schemaGenerator: buildCrudSchemasFromModel` explicitly.
 
-**Fix:**
-```typescript
-import { createMongooseAdapter } from '@classytic/mongokit/adapter';   // arc 2.12+
-import { buildCrudSchemasFromModel } from '@classytic/mongokit';
-
-createMongooseAdapter({
-  model: ProductModel,
-  repository: productRepo,
-  schemaGenerator: buildCrudSchemasFromModel,   // required
-});
-```
-For drizzle: `import { createDrizzleAdapter } from '@classytic/sqlitekit/adapter'` + `schemaGenerator: buildCrudSchemasFromTable` from `@classytic/sqlitekit`.
+For drizzle: `createDrizzleAdapter` still wants `schemaGenerator: buildCrudSchemasFromTable` from `@classytic/sqlitekit` — check the kit's own version before flagging.
 
 ---
 
@@ -937,6 +927,68 @@ For backends without `repo.aggregate`, declare a `materialized` hook on the aggr
 
 ---
 
+## §34. `as never` / `as unknown as` casts on engine bags in module packages 🟠
+
+**Detection:**
+```
+pattern: "as never|as unknown as"
+```
+Concentrated hits in `@classytic/arc-*` (or `@scope/arc-*`) module packages — especially around `defineResource(...)` assembly, adapter construction from an engine, or hand-rolled config spread-merges.
+
+**Anti-pattern (pre-2.21 module-author tax):**
+```typescript
+interface EngineLike { models: Record<string, unknown>; repositories: Record<string, unknown> }
+adapter: createMongooseAdapter(engine.models.Party as never, repo as never),
+...(cfg.extraRoutes ? { routes: [...base.routes, ...cfg.extraRoutes] as never } : {}),
+```
+
+**Why high:** every cast is a hole where the kernel's real types (optional sub-module members, role unions, doc shapes) stop flowing — typos compile, wrong repos pair with wrong models, and hand-rolled spread-merges clobber host arrays.
+
+**Fix (arc 2.21):** type the engine port with the KERNEL's own bags and assemble via `mergeResourceConfig`:
+```typescript
+import { mergeResourceConfig, type ResourceSeams, type AdapterLike } from '@classytic/arc';
+
+interface CatalogEngineLike {                    // kernel is already a peer — no new coupling
+  models: CatalogEngine['models'];
+  repositories: CatalogEngine['repositories'];
+}
+defineResource(mergeResourceConfig(
+  { name: 'product', adapter: createMongooseAdapter({ model: models.Product, repository: repositories.product }), ... },
+  hostSeams,                                     // typed ResourceSeams — arrays concat, objects deep-merge,
+));                                              // instances last-win, undefined never clobbers
+```
+Remaining honest boundaries (hydrated-vs-lean id widening at a kernel bridge, wire-body narrowing in action handlers) get a comment, not a blanket `as never`.
+
+---
+
+## §35. Hand-rolled recurring jobs (`setInterval` / cron + DB lock) 🟠
+
+**Detection:**
+```
+pattern: "setInterval\\s*\\(|node-cron|cron\\.schedule|new CronJob"
+```
+Plus home-grown "job registry" / "leader lock" / "acquireLock" modules paired with timers.
+
+**Why high:** every host regrows the same layer — overlap prevention, multi-replica leader lock, shutdown timer cleanup, failure counters — and gets at least one of them wrong (stacking `setInterval` runs, timers holding the process open, no lease recovery after a crashed leader).
+
+**Fix (arc 2.21):** `schedulesPlugin` from `@classytic/arc/plugins` — interval jobs with no-overlap by construction (timeout chain), optional `lock` (any `LockAdapter`: `@classytic/mongokit/lock`, sqlitekit, memory) for multi-replica lease safety, `jitterMs`, `runOnStart`, `getScheduleStats()`, clean `onClose` drain. Calendar cron-expressions / durable retries stay in the BullMQ tier (`@classytic/arc/integrations/jobs`) — don't flag hosts that need real cron semantics for using it.
+
+---
+
+## §36. Wrong tenant config key — `{ field }` instead of `{ tenantField }` 🔴
+
+**Detection:**
+```
+pattern: "tenant:\\s*\\{\\s*field\\s*:"
+```
+Also any object passed as tenant config whose keys aren't in repo-core's `TenantConfig`.
+
+**Why critical:** unknown keys are **silently ignored** — `{ tenant: { field: 'branchId' } }` compiles (loose host types), the resource falls back to the default tenant field, and cross-tenant reads/writes go unscoped for hosts on a custom field name. Found live in published spine packages (arc-assets / arc-pricelist 0.1.x).
+
+**Fix:** the key is `tenantField` (repo-core `TenantConfig`). In arc resources prefer the top-level `tenantField: 'branchId'` shorthand or the `multiTenant` preset; when passing a tenant object through a module seam, type it as `TenantConfig` so unknown keys fail the build.
+
+---
+
 ## Detection checklist (run-order)
 
 Run sweeps in this order — early hits often invalidate later context:
@@ -951,5 +1003,6 @@ Run sweeps in this order — early hits often invalidate later context:
 8. §7, §8, §22, §23 — events/cache/idempotency/audit (silent inconsistency)
 9. §14, §18, §19 — preset adoption + custom controller wiring
 10. §11, §12, §13, §29, §30, §31 — style and edges
-11. §32a–§32g — canonical-contract drift (pagination / events / tenant / errors / adapter imports), missing `requireOrgId` accessors, missing `schemaGenerator`, kit-specific adapter imports from arc (3.0 break)
+11. §32a–§32g — canonical-contract drift (pagination / events / tenant / errors / adapter imports), missing `requireOrgId` accessors, missing/dodged `schemaGenerator`, kit-specific adapter imports from arc (3.0 break)
 12. §33 — hand-rolled `Model.aggregate([...])` in resource routes vs declarative `aggregations: { … }`
+13. §36 — tenant config `{ field }` key (security: silent unscoped queries), then §34–§35 — module-package `as never` casts vs 2.21 seams; hand-rolled recurring jobs vs `schedulesPlugin`

package/skills/arc-code-review/references/arc-cheatsheet.md

@@ -23,12 +23,22 @@ A condensed map of what arc provides, so during audit you can spot what the team
 | Custom `withRetry` / `withDLQ` plumbing on events | `RedisStreamTransport` (durable, consumer groups, DLQ) |
 | Hand-rolled idempotency token check | `idempotencyPlugin` (header-based, configurable store) |
 | Manual SCIM provisioning endpoints | `@classytic/arc/scim` — `scimPlugin({ users, groups, bearer })` |
+| `setInterval` sweeps + hand-rolled leader lock / job registry | `schedulesPlugin` from `@classytic/arc/plugins` (2.21 — interval jobs, LockAdapter lease, no Redis) |
+| `as never` casts + spread-merges assembling resources in module packages | `mergeResourceConfig` + `ResourceSeams` (2.21) with kernel-typed engine ports |
+| Same `view`/`manage` gate repeated across 5 CRUD keys | `permissionMatrix({ read, write, delete? })` (2.21) |
+| DB connect + dynamic-import ordering in the composition root | `createApp({ beforeBoot })` (2.21 — runs before Fastify + all imports) |
+| `import { x } from 'better-auth/plugins'` (barrel) | dedicated path `better-auth/plugins/<name>` — tree-shaking (BA best practice) |
+| Hand-rolled per-tenant usage/billing counters | `usagePlugin` from `@classytic/arc/usage` (2.22 — per-actor per-period counters, fail-safe, `UsageStore` backends) |
+| Per-plan rate limits via custom middleware | `rateLimit.plan { resolve, limits, default }` (2.22 — `false` = unlimited, fail-safe fallback, tenant-keyed buckets) |
+| Hand-built audit-timeline endpoints (`GET /:id/history` handlers over audit rows) | `history: true` on `defineResource` (2.22 — implies `audit: true`, stricter-than-read gate) |
 
 ## Boot order (FIXED)
 
 ```
+0. beforeBoot()     ← pre-everything (DB connect; before Fastify + imports) — 2.21
+0.5 module resolve  ← thunk imports + dependsOn topo-sort; module errorMappers merge
 1. Arc core (security, auth, events)
-2. plugins()        ← user infra (DB, docs, webhooks)
+2. plugins()        ← user infra (docs, webhooks)
 3. bootstrap[]      ← domain init (engines, singletons)
 4. resources (factory runs after bootstrap)
 5. resources[]      ← register each
@@ -54,7 +64,7 @@ defineResource({
   rateLimit?, tenantField?, idField?,
   prefix?, skipGlobalPrefix?,
   queryParser?, onFieldWriteDenied?,
-  audit?, mcp?,                                     // mcp: false to exclude from MCP tool gen
+  audit?, history?, mcp?,                           // mcp: false to exclude from MCP tool gen; history: true → GET /:id/history (2.22)
   displayName?, module?,
   onTenantDelete?,                                  // GDPR cascade strategy
 });
@@ -69,6 +79,7 @@ requireRoles(['admin'])                    requireServiceScope('jobs:bulk')
 requireOwnership('userId')                 requireScopeContext('branchId')
 requireOrgMembership()                     requireOrgInScope(targetId)
 allOf(...) · anyOf(...) · not(...) · when(...) · denyAll()
+permissionMatrix({ read, write, delete? })        // 2.21 — expands to the full CRUD map
 createDynamicPermissionMatrix({ resolveRolePermissions, cacheStore })
 ```
 
@@ -159,7 +170,9 @@ import type { DataAdapter, RepositoryLike } from '@classytic/repo-core/adapter';
 
 ```typescript
 import { defineResource, BaseController, allowPublic }    from '@classytic/arc';
+import { mergeResourceConfig, type ResourceSeams }         from '@classytic/arc';         // 2.21
 import { createApp, loadResources }                        from '@classytic/arc/factory';
+import { schedulesPlugin }                                 from '@classytic/arc/plugins'; // 2.21
 import { MemoryCacheStore, RedisCacheStore, QueryCache }   from '@classytic/arc/cache';
 import { eventPlugin, EventOutbox }                        from '@classytic/arc/events';
 import { RedisEventTransport, RedisStreamTransport }       from '@classytic/arc/events/redis-stream';

package/skills/arc-code-review/references/migration-recipes.md

@@ -21,13 +21,13 @@ In arc 2.12:
 
 ### Coordinated versions
 
-| Package | Min |
-|---|---|
-| `@classytic/arc` | 2.12.0 |
-| `@classytic/repo-core` | 0.4.0 |
-| `@classytic/mongokit` | 3.13.0 |
-| `@classytic/sqlitekit` | 0.3.0 |
-| `@classytic/prismakit` | 0.1.0 |
+| Package | Min (adapter split) | Current best-practice floor |
+|---|---|---|
+| `@classytic/arc` | 2.12.0 | 2.21.0 — seams/`mergeResourceConfig`, `beforeBoot`, `permissionMatrix`, `schedulesPlugin` |
+| `@classytic/repo-core` | 0.4.0 | 0.9.0 — `StandardRepo.getByIds` contract member |
+| `@classytic/mongokit` | 3.13.0 | 3.21.0 — adapter `schemaGenerator` defaults ON |
+| `@classytic/sqlitekit` | 0.3.0 | 0.7.0 |
+| `@classytic/prismakit` | 0.1.0 | 0.1.0 |
 
 ### Import migration table
 

package/skills/arc-code-review/references/mongokit-migration.md

@@ -200,13 +200,14 @@ export const userRepo = new Repository<UserDoc>(User, [
 // resources/user/user.resource.ts — arc resource consuming the mongokit repo
 import { defineResource, requireRoles, allowPublic, fields } from '@classytic/arc';
 import { createMongooseAdapter } from '@classytic/mongokit/adapter';   // arc 2.12+: from the kit
-import { buildCrudSchemasFromModel } from '@classytic/mongokit';
 import { User } from '../../models/user.js';
 import { userRepo } from '../../repositories/userRepository.js';
 
 export const userResource = defineResource({
   name: 'user',
-  adapter: createMongooseAdapter({ model: User, repository: userRepo, schemaGenerator: buildCrudSchemasFromModel }),
+  // mongokit >=3.21 defaults schemaGenerator to buildCrudSchemasFromModel
+  // (pre-3.21: wire it explicitly, or OpenAPI/MCP bodies come out null)
+  adapter: createMongooseAdapter({ model: User, repository: userRepo }),
   presets: ['softDelete'],          // multiTenant is at the repo layer (mongokit), so we don't need the arc preset too — pick one
   permissions: {
     list:   requireRoles(['admin']),
@@ -344,7 +345,7 @@ For each Mongoose model in the project:
 
 If consumers see `as unknown as RepositoryLike<T>` casts when wiring a repo into the mongoose adapter, that's drift. Mongokit's `tests/unit/standard-repo-assignment.test-d.ts` proves whole-interface assignment via TypeScript. Run `npm run typecheck:tests` in mongokit; if it fails, the published version drifted from the contract — pin to a known-good version or open a PR.
 
-In the client project, prefer `createMongooseAdapter({ model, repository, schemaGenerator })` from `@classytic/mongokit/adapter` over manual `RepositoryLike` shaping — it accepts mongokit-native repos with no casts.
+In the client project, prefer `createMongooseAdapter({ model, repository })` from `@classytic/mongokit/adapter` over manual `RepositoryLike` shaping — it accepts mongokit-native repos with no casts, and since mongokit 3.21 `schemaGenerator` defaults to `buildCrudSchemasFromModel` (`schemaGenerator: false` opts out — see anti-patterns §32f before recommending that).
 
 ## arc 2.12 / mongokit 3.13.0 — adapter split
 

package/skills/arc-module-publishing/SKILL.md

@@ -11,7 +11,8 @@ description: |
   writing a defineModule() or an action preset, or preparing an arc module for npm publish.
   Triggers: publish arc module, arc package, arc ecosystem, defineModule, ArcModule, arc
   plugin package, arc action preset, extract domain to package, arc-approval, arc-involvement,
-  peer dependencies arc, tsdown arc package, arc module conventions, classytic publish.
+  peer dependencies arc, tsdown arc package, arc module conventions, classytic publish,
+  mergeResourceConfig, ResourceSeams, kernel-typed engine port, module errorMappers.
 license: MIT
 metadata:
   author: Classytic

package/skills/arc-module-publishing/references/authoring-modules.md

@@ -129,6 +129,11 @@ export const accountingModule = (deps: AccountingDeps) =>
 
     afterResources: (f) => { /* cross-resource event subscriptions the module owns */ },
     onClose: (f) => { /* stop timers, flush outbox, destroy engine */ },
+
+    errorMappers: [{                    // 2.21 — domain error → wire envelope, merged into the
+      type: AccountingError,            // host's error handler at boot (host mappers keep priority)
+      toResponse: (err) => ({ status: err.status, code: err.code, message: err.message }),
+    }],
   });
 ```
 
@@ -198,6 +203,56 @@ packages (or several subpath exports) and let the host list them — don't retur
 modules from one factory. The host owns the flat `modules:` list and its ordering; keep that
 control theirs.
 
+### Resource assembly — kernel-typed ports + `mergeResourceConfig` (2.21 standard)
+
+Two rules kill the `as never` tax that plagued pre-2.21 module packages:
+
+**1. Type the engine port with the KERNEL's own bags.** The kernel is already your peer, so
+indexing its exported engine type adds zero coupling — and its truths (optional sub-module
+members, literal unions) flow into your resource builders:
+
+```ts
+import type { CatalogEngine } from "@classytic/catalog";
+
+export interface CatalogEngineLike {          // structural — any conforming engine composes
+  models: CatalogEngine["models"];
+  repositories: CatalogEngine["repositories"];
+}
+```
+
+Never re-declare the bags as `Record<string, unknown>` — that's what forced every
+`createMongooseAdapter(engine.models.X as never, ...)` cast.
+
+**2. Merge base config + host seams with `mergeResourceConfig`, not hand-rolled spreads.**
+Expose your per-resource override surface as projections of arc's `ResourceSeams` and let
+arc's slot-aware merge do assembly — arrays CONCAT (host routes append, never clobber),
+plain objects deep-merge, class instances (queryParser, adapter) last-win, `undefined`
+never overwrites, `as const` readonly host tables are accepted:
+
+```ts
+import { defineResource, mergeResourceConfig, type ResourceSeams } from "@classytic/arc";
+import { permissionMatrix } from "@classytic/arc/permissions";
+
+export interface ProductSeams {               // your public seam names, arc's slot types
+  extraRoutes?: ResourceSeams["routes"];
+  extraActions?: ResourceSeams["actions"];
+  cache?: ResourceSeams["cache"];
+}
+
+defineResource(mergeResourceConfig(
+  {
+    name: "product",
+    adapter: createMongooseAdapter({ model: models.Product, repository: repositories.product }),
+    permissions: permissionMatrix({ read: deps.permissions.view, write: deps.permissions.manage }),
+  },
+  { routes: cfg.extraRoutes, actions: cfg.extraActions, cache: cfg.cache },
+));
+```
+
+The only casts left in a well-formed package are documented boundaries: wire-body narrowing
+in action handlers (`data as { role: PartyRole }` — narrow to the KERNEL's union, not
+`string`) and hydrated-vs-lean id widening at a kernel bridge. Anything else is a smell.
+
 ---
 
 ## Testing a package

package/skills/arc-module-publishing/references/package-manifest.md

@@ -38,8 +38,10 @@ optional-peer typing pattern. Values below are the real shapes shipped by
   },
 
   // CONTRACTS — what the host must provide. `>=`, never `^`.
+  // Floor >=2.21.0 if you use ResourceSeams / mergeResourceConfig / permissionMatrix /
+  // schedulesPlugin / errorMappers — declare the floor that matches the APIs you import.
   "peerDependencies": {
-    "@classytic/arc": ">=2.20.0",
+    "@classytic/arc": ">=2.21.0",
     "@classytic/primitives": ">=0.9.0"
   },
 
@@ -52,7 +54,7 @@ optional-peer typing pattern. Values below are the real shapes shipped by
 
   // TEST versions — pin with ^, floor >= each peer floor. Not shipped.
   "devDependencies": {
-    "@classytic/arc": "^2.20.0",
+    "@classytic/arc": "^2.21.0",
     "@classytic/primitives": "^0.9.1",
     "@biomejs/biome": "^2.5.2",
     "@types/node": "^22.19.21",

package/dist/preloadResources-CHw3_oA_.mjs

@@ -1,45 +0,0 @@
-//#region src/testing/preloadResources.ts
-/**
-* Normalize an eager `import.meta.glob` result into a `ResourceLike[]`.
-*
-* Accepts either:
-* - `{ import: 'default' }` form: values are the resource directly
-* - default form: values are the full module — picks first export with `toPlugin()`
-*
-* Throws if any module doesn't yield a valid `ResourceLike`.
-*/
-function preloadResources(globResult) {
-	const resources = [];
-	for (const [path, value] of Object.entries(globResult)) {
-		const resource = pickResource(value);
-		if (!resource) throw new Error(`preloadResources: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
-		resources.push(resource);
-	}
-	return resources.sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
-}
-/**
-* Normalize a lazy `import.meta.glob` result into a `Promise<ResourceLike[]>`.
-*
-* Use this when resources depend on prior bootstrap (e.g., engine init) and
-* cannot be evaluated at import time of the preload file.
-*/
-async function preloadResourcesAsync(globResult) {
-	return (await Promise.all(Object.entries(globResult).map(async ([path, loader]) => {
-		const resource = pickResource(await loader());
-		if (!resource) throw new Error(`preloadResourcesAsync: ${path} does not export a valid resource.\n    Expected: a default export OR a named export with toPlugin().`);
-		return resource;
-	}))).sort((a, b) => (a.name ?? "").localeCompare(b.name ?? ""));
-}
-function pickResource(value) {
-	if (!value || typeof value !== "object") return void 0;
-	if (typeof value.toPlugin === "function") return value;
-	const mod = value;
-	const candidates = [
-		mod.default,
-		mod.resource,
-		...Object.values(mod)
-	];
-	for (const c of candidates) if (c && typeof c === "object" && typeof c.toPlugin === "function") return c;
-}
-//#endregion
-export { preloadResourcesAsync as n, preloadResources as t };

package/dist/schemaConverter-U0MnO9vd.mjs

@@ -1,110 +0,0 @@
-//#region src/utils/schemaConverter.ts
-/** Default target for Fastify-consumed schemas (matches Fastify v5's default AJV draft). */
-const DEFAULT_FASTIFY_TARGET = "draft-7";
-/** Default target for OpenAPI document generation (matches arc's emitted OpenAPI version). */
-const DEFAULT_OPENAPI_TARGET = "openapi-3.0";
-let _toJSONSchema = null;
-import("zod").then(({ z }) => {
-	if (typeof z?.toJSONSchema === "function") _toJSONSchema = (schema, opts) => z.toJSONSchema(schema, opts);
-}).catch(() => {});
-/**
-* Check if an object is already a plain JSON Schema.
-* Returns true if it has JSON Schema markers (`type`, `properties`, `$ref`,
-* `allOf`, `anyOf`, `oneOf`, `items`, `enum`) and does NOT have Zod markers.
-*/
-function isJsonSchema(input) {
-	if (input === null || typeof input !== "object") return false;
-	const obj = input;
-	if ("_def" in obj || "_zod" in obj) return false;
-	return "type" in obj || "properties" in obj || "$ref" in obj || "allOf" in obj || "anyOf" in obj || "oneOf" in obj || "items" in obj || "enum" in obj;
-}
-/**
-* Check if an object is a Zod schema (has `_zod` marker from Zod v4).
-*/
-function isZodSchema(input) {
-	return input !== null && typeof input === "object" && "_zod" in input;
-}
-/**
-* Convert any schema input to JSON Schema.
-*
-* Detection order:
-* 1. `null`/`undefined` → `undefined`
-* 2. Already JSON Schema → pass through as-is (zero overhead)
-* 3. Zod v4 schema → `z.toJSONSchema(schema, { target })`
-* 4. Unrecognized object → return as-is (treat as opaque schema)
-*
-* @param input Schema (Zod, plain JSON Schema, or opaque object)
-* @param target Output target — defaults to `draft-7` for Fastify compatibility.
-*               Pass `openapi-3.0`/`openapi-3.1` for OpenAPI document generation.
-*/
-function toJsonSchema(input, target = DEFAULT_FASTIFY_TARGET) {
-	if (input == null) return void 0;
-	if (typeof input !== "object") return void 0;
-	if (isJsonSchema(input)) return input;
-	if (isZodSchema(input)) {
-		if (!_toJSONSchema) return input;
-		try {
-			const converted = _toJSONSchema(input, { target });
-			if ("$schema" in converted) delete converted.$schema;
-			return converted;
-		} catch {
-			return { type: "object" };
-		}
-	}
-	return input;
-}
-/**
-* Convert all schema fields in an OpenApiSchemas object.
-* JSON Schema values pass through unchanged. Only Zod schemas are converted.
-*
-* Defaults to the `openapi-3.0` target since this function feeds OpenAPI doc
-* generation, not Fastify route validation.
-*/
-function convertOpenApiSchemas(schemas, target = DEFAULT_OPENAPI_TARGET) {
-	const result = {};
-	const schemaFields = [
-		"entity",
-		"createBody",
-		"updateBody",
-		"params",
-		"listQuery",
-		"response"
-	];
-	for (const field of schemaFields) {
-		const value = schemas[field];
-		if (value !== void 0) result[field] = toJsonSchema(value, target) ?? value;
-	}
-	for (const [key, value] of Object.entries(schemas)) if (!schemaFields.includes(key)) result[key] = value;
-	return result;
-}
-/**
-* Convert schema values in a Fastify route schema record.
-*
-* Handles `body`, `querystring`, `params`, `headers` (top-level conversion)
-* and `response` (iterates by status code — each value converted individually).
-*
-* JSON Schema values pass through unchanged. Only Zod schemas are converted.
-*
-* Used for both custom routes and customSchemas (CRUD overrides).
-*
-* Defaults to `draft-7` so Fastify v5's bundled AJV 8 accepts the output.
-* Pass `openapi-3.0` (or `openapi-3.1`) when generating OpenAPI documents.
-*/
-function convertRouteSchema(schema, target = DEFAULT_FASTIFY_TARGET) {
-	const result = { ...schema };
-	for (const field of [
-		"body",
-		"querystring",
-		"params",
-		"headers"
-	]) if (result[field] !== void 0) result[field] = toJsonSchema(result[field], target) ?? result[field];
-	if (result.response !== void 0 && typeof result.response === "object" && result.response !== null) {
-		const responseObj = result.response;
-		const convertedResponse = {};
-		for (const [statusCode, responseSchema] of Object.entries(responseObj)) convertedResponse[statusCode] = toJsonSchema(responseSchema, target) ?? responseSchema;
-		result.response = convertedResponse;
-	}
-	return result;
-}
-//#endregion
-export { toJsonSchema as a, isZodSchema as i, convertRouteSchema as n, isJsonSchema as r, convertOpenApiSchemas as t };