@nanokajs/core 0.1.4 → 1.0.0

package/dist/config.js

@@ -1,4 +1,4 @@
-export { t } from './chunk-F5OBRXXY.js';
+export { t } from './chunk-UYXRKFAR.js';
 
 // src/config.ts
 function defineConfig(config) {

package/dist/{factories-CDsk1Hdt.d.ts → factories-Cmvx0495.d.ts}

@@ -1,6 +1,7 @@
 import { SQLiteColumnBuilderBase } from 'drizzle-orm/sqlite-core';
 import { z } from 'zod';
 
+type FieldPolicy = 'serverOnly' | 'writeOnly' | 'readOnly';
 interface FieldModifiers {
     optional?: boolean;
     primary?: boolean;
@@ -10,6 +11,7 @@ interface FieldModifiers {
     format?: 'email' | 'uuid';
     min?: number;
     max?: number;
+    policy?: FieldPolicy;
 }
 type FieldKind = 'string' | 'uuid' | 'number' | 'integer' | 'boolean' | 'timestamp' | 'json';
 /**
@@ -60,7 +62,7 @@ interface Field<TS = unknown, Mods extends FieldModifiers = {}, ZB extends z.Zod
  * type T1 = InferFieldType<typeof t.string()> // string
  * type T2 = InferFieldType<typeof t.string().optional()> // string | undefined
  */
-type InferFieldType<F> = F extends Field<infer T, FieldModifiers, z.ZodTypeAny> ? T : never;
+type InferFieldType<F> = F extends Field<infer T, FieldModifiers, z.ZodTypeAny> ? T : F extends Field<infer T, FieldModifiers, any> ? T : never;
 
 /**
  * Abstract base class for field builders.
@@ -94,7 +96,7 @@ declare abstract class BaseFieldBuilder<TS, Mods extends FieldModifiers = {}, ZB
     protected applyModifiersToZod(baseSchema: z.ZodTypeAny): z.ZodTypeAny;
 }
 
-declare class StringFieldBuilder<TS = string, Mods extends FieldModifiers = {}, ZB extends z.ZodType<TS, z.ZodTypeDef, TS> = z.ZodType<TS, z.ZodTypeDef, TS>> extends BaseFieldBuilder<TS, Mods, ZB> {
+declare class StringFieldBuilder<TS = string, Mods extends FieldModifiers = {}, ZB extends z.ZodTypeAny = z.ZodTypeAny> extends BaseFieldBuilder<TS, Mods, ZB> {
     readonly kind: "string";
     get zodBase(): ZB;
     drizzleColumn(name: string): SQLiteColumnBuilderBase;
@@ -141,8 +143,17 @@ declare class StringFieldBuilder<TS = string, Mods extends FieldModifiers = {},
     max(this: StringFieldBuilder<TS, Mods>, n: number): StringFieldBuilder<TS, Mods & {
         max: number;
     }>;
+    serverOnly(this: StringFieldBuilder<TS, Mods>): StringFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'serverOnly';
+    }>;
+    writeOnly(this: StringFieldBuilder<TS, Mods>): StringFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'writeOnly';
+    }>;
+    readOnly(this: StringFieldBuilder<TS, Mods>): StringFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'readOnly';
+    }>;
 }
-declare class UuidFieldBuilder<TS = string, Mods extends FieldModifiers = {}, ZB extends z.ZodType<TS, z.ZodTypeDef, TS> = z.ZodType<TS, z.ZodTypeDef, TS>> extends BaseFieldBuilder<TS, Mods, ZB> {
+declare class UuidFieldBuilder<TS = string, Mods extends FieldModifiers = {}, ZB extends z.ZodTypeAny = z.ZodTypeAny> extends BaseFieldBuilder<TS, Mods, ZB> {
     readonly kind: "uuid";
     get zodBase(): ZB;
     drizzleColumn(name: string): SQLiteColumnBuilderBase;
@@ -183,8 +194,17 @@ declare class UuidFieldBuilder<TS = string, Mods extends FieldModifiers = {}, ZB
     max(this: UuidFieldBuilder<TS, Mods>, n: number): UuidFieldBuilder<TS, Mods & {
         max: number;
     }>;
+    serverOnly(this: UuidFieldBuilder<TS, Mods>): UuidFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'serverOnly';
+    }>;
+    writeOnly(this: UuidFieldBuilder<TS, Mods>): UuidFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'writeOnly';
+    }>;
+    readOnly(this: UuidFieldBuilder<TS, Mods>): UuidFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'readOnly';
+    }>;
 }
-declare class NumberFieldBuilder<TS = number, Mods extends FieldModifiers = {}, ZB extends z.ZodType<TS, z.ZodTypeDef, TS> = z.ZodType<TS, z.ZodTypeDef, TS>> extends BaseFieldBuilder<TS, Mods, ZB> {
+declare class NumberFieldBuilder<TS = number, Mods extends FieldModifiers = {}, ZB extends z.ZodTypeAny = z.ZodTypeAny> extends BaseFieldBuilder<TS, Mods, ZB> {
     readonly kind: "number";
     get zodBase(): ZB;
     drizzleColumn(name: string): SQLiteColumnBuilderBase;
@@ -225,8 +245,17 @@ declare class NumberFieldBuilder<TS = number, Mods extends FieldModifiers = {},
     max(this: NumberFieldBuilder<TS, Mods>, n: number): NumberFieldBuilder<TS, Mods & {
         max: number;
     }>;
+    serverOnly(this: NumberFieldBuilder<TS, Mods>): NumberFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'serverOnly';
+    }>;
+    writeOnly(this: NumberFieldBuilder<TS, Mods>): NumberFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'writeOnly';
+    }>;
+    readOnly(this: NumberFieldBuilder<TS, Mods>): NumberFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'readOnly';
+    }>;
 }
-declare class IntegerFieldBuilder<TS = number, Mods extends FieldModifiers = {}, ZB extends z.ZodType<TS, z.ZodTypeDef, TS> = z.ZodType<TS, z.ZodTypeDef, TS>> extends BaseFieldBuilder<TS, Mods, ZB> {
+declare class IntegerFieldBuilder<TS = number, Mods extends FieldModifiers = {}, ZB extends z.ZodTypeAny = z.ZodTypeAny> extends BaseFieldBuilder<TS, Mods, ZB> {
     readonly kind: "integer";
     get zodBase(): ZB;
     drizzleColumn(name: string): SQLiteColumnBuilderBase;
@@ -267,8 +296,17 @@ declare class IntegerFieldBuilder<TS = number, Mods extends FieldModifiers = {},
     max(this: IntegerFieldBuilder<TS, Mods>, n: number): IntegerFieldBuilder<TS, Mods & {
         max: number;
     }>;
+    serverOnly(this: IntegerFieldBuilder<TS, Mods>): IntegerFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'serverOnly';
+    }>;
+    writeOnly(this: IntegerFieldBuilder<TS, Mods>): IntegerFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'writeOnly';
+    }>;
+    readOnly(this: IntegerFieldBuilder<TS, Mods>): IntegerFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'readOnly';
+    }>;
 }
-declare class BooleanFieldBuilder<TS = boolean, Mods extends FieldModifiers = {}, ZB extends z.ZodType<TS, z.ZodTypeDef, TS> = z.ZodType<TS, z.ZodTypeDef, TS>> extends BaseFieldBuilder<TS, Mods, ZB> {
+declare class BooleanFieldBuilder<TS = boolean, Mods extends FieldModifiers = {}, ZB extends z.ZodTypeAny = z.ZodTypeAny> extends BaseFieldBuilder<TS, Mods, ZB> {
     readonly kind: "boolean";
     get zodBase(): ZB;
     drizzleColumn(name: string): SQLiteColumnBuilderBase;
@@ -297,8 +335,17 @@ declare class BooleanFieldBuilder<TS = boolean, Mods extends FieldModifiers = {}
     default(this: BooleanFieldBuilder<TS, Mods>, value: TS | (() => TS)): BooleanFieldBuilder<TS, Mods & {
         hasDefault: true;
     }>;
+    serverOnly(this: BooleanFieldBuilder<TS, Mods>): BooleanFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'serverOnly';
+    }>;
+    writeOnly(this: BooleanFieldBuilder<TS, Mods>): BooleanFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'writeOnly';
+    }>;
+    readOnly(this: BooleanFieldBuilder<TS, Mods>): BooleanFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'readOnly';
+    }>;
 }
-declare class TimestampFieldBuilder<TS = Date, Mods extends FieldModifiers = {}, ZB extends z.ZodType<TS, z.ZodTypeDef, Date | string | number> = z.ZodType<TS, z.ZodTypeDef, Date | string | number>> extends BaseFieldBuilder<TS, Mods, ZB> {
+declare class TimestampFieldBuilder<TS = Date, Mods extends FieldModifiers = {}, ZB extends z.ZodTypeAny = z.ZodTypeAny> extends BaseFieldBuilder<TS, Mods, ZB> {
     readonly kind: "timestamp";
     get zodBase(): ZB;
     drizzleColumn(name: string): SQLiteColumnBuilderBase;
@@ -327,15 +374,26 @@ declare class TimestampFieldBuilder<TS = Date, Mods extends FieldModifiers = {},
     default(this: TimestampFieldBuilder<TS, Mods>, value: TS | (() => TS)): TimestampFieldBuilder<TS, Mods & {
         hasDefault: true;
     }>;
+    serverOnly(this: TimestampFieldBuilder<TS, Mods>): TimestampFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'serverOnly';
+    }>;
+    writeOnly(this: TimestampFieldBuilder<TS, Mods>): TimestampFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'writeOnly';
+    }>;
+    readOnly(this: TimestampFieldBuilder<TS, Mods>): TimestampFieldBuilder<TS, Omit<Mods, 'policy'> & {
+        policy: 'readOnly';
+    }>;
 }
 /**
  * JSON フィールドビルダー。
  *
- * ⚠️ セキュリティ警告: zod ベースは `z.unknown()` のため、API に晒す際は
- * `validator()` で除外するか、別途検証が必須。
+ * `t.json(zodSchema)` 形式で Zod スキーマを渡すと runtime 検証が走る。
+ * スキーマ省略時は `z.unknown()` で後方互換を維持する。
  */
-declare class JsonFieldBuilder<T = unknown, TS = T, Mods extends FieldModifiers = {}, ZB extends z.ZodType<TS, z.ZodTypeDef, TS> = z.ZodType<TS, z.ZodTypeDef, TS>> extends BaseFieldBuilder<TS, Mods, ZB> {
+declare class JsonFieldBuilder<T = unknown, TS = T, Mods extends FieldModifiers = {}, ZB extends z.ZodTypeAny = z.ZodTypeAny> extends BaseFieldBuilder<TS, Mods, ZB> {
     readonly kind: "json";
+    private readonly _zodSchema;
+    constructor(modifiers?: Mods, zodSchema?: z.ZodTypeAny);
     get zodBase(): ZB;
     drizzleColumn(name: string): SQLiteColumnBuilderBase;
     protected cloneWithModifiers<NewMods extends FieldModifiers>(mods: NewMods): JsonFieldBuilder<T, TS, NewMods>;
@@ -363,7 +421,18 @@ declare class JsonFieldBuilder<T = unknown, TS = T, Mods extends FieldModifiers
     default(this: JsonFieldBuilder<T, TS, Mods>, value: TS | (() => TS)): JsonFieldBuilder<T, TS, Mods & {
         hasDefault: true;
     }>;
+    serverOnly(this: JsonFieldBuilder<T, TS, Mods>): JsonFieldBuilder<T, TS, Omit<Mods, 'policy'> & {
+        policy: 'serverOnly';
+    }>;
+    writeOnly(this: JsonFieldBuilder<T, TS, Mods>): JsonFieldBuilder<T, TS, Omit<Mods, 'policy'> & {
+        policy: 'writeOnly';
+    }>;
+    readOnly(this: JsonFieldBuilder<T, TS, Mods>): JsonFieldBuilder<T, TS, Omit<Mods, 'policy'> & {
+        policy: 'readOnly';
+    }>;
 }
+declare function jsonField<S extends z.ZodTypeAny>(schema: S): JsonFieldBuilder<z.infer<S>, z.infer<S>, {}>;
+declare function jsonField<T = unknown>(): JsonFieldBuilder<T, T, {}>;
 /**
  * Field DSL factory for building type-safe database fields.
  *
@@ -374,6 +443,7 @@ declare class JsonFieldBuilder<T = unknown, TS = T, Mods extends FieldModifiers
  * const ageField = t.integer().min(0).max(150)
  * const createdAtField = t.timestamp().default(() => new Date())
  * const dataField = t.json<{ foo: string }>()
+ * const dataField2 = t.json(z.object({ foo: z.string() }))  // runtime validation
  */
 declare const t: {
     string(): StringFieldBuilder<string, {}>;
@@ -383,20 +453,17 @@ declare const t: {
     boolean(): BooleanFieldBuilder<boolean, {}>;
     timestamp(): TimestampFieldBuilder<Date, {}>;
     /**
-     * JSON フィールド。任意の JSON 値を受け入れる（Zod 内部表現は `z.unknown()`）。
+     * JSON フィールド。
+     *
+     * `t.json(zodSchema)` 形式で Zod スキーマを渡すと runtime 検証が走る。
+     * スキーマ省略時は `z.unknown()` で後方互換を維持する。
      *
-     * ⚠️ セキュリティ警告:
-     * このフィールドの zod ベースは `z.unknown()` のため、型パラメータ `T` で
-     * 指定した制約は **コンパイル時のみ** 適用され、validator() 経由でも
-     * runtime バリデーションは行われません。API 入力として晒す場合は:
-     *   - `model.validator(target, { omit: ['<json field name>'] })` で除外する、または
-     *   - ハンドラ側で別途 Zod スキーマを使って手動検証する、
-     * のいずれかを必ず実施してください。型パラメータが `unknown` 以外の値を
-     * runtime で保証することはありません。
+     * `t.json(z.object({ foo: z.string() }))` でオブジェクト形状の runtime 検証が可能。
      *
-     * Phase 2 以降で `t.json(zodSchema)` 形式の引数追加を検討中。
+     * @note codegen (`nanoka generate`) は `t.json(zodSchema)` を渡しても `$type<unknown>()` のまま出力する。
+     * Drizzle 型が欲しい場合は生成後に手動で書き換えるか `as` を使うこと。
      */
-    json<T = unknown>(): JsonFieldBuilder<T, T, {}>;
+    json: typeof jsonField;
 };
 
-export { type Field as F, type InferFieldType as I, type FieldModifiers as a, t };
+export { type Field as F, type InferFieldType as I, type FieldPolicy as a, type FieldModifiers as b, t };

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import { D1Database } from '@cloudflare/workers-types';
 import { BatchItem, BatchResponse } from 'drizzle-orm/batch';
 import { BaseSQLiteDatabase, SQLiteTable } from 'drizzle-orm/sqlite-core';
-import { F as Field, I as InferFieldType } from './factories-CDsk1Hdt.js';
-export { a as FieldModifiers, t } from './factories-CDsk1Hdt.js';
+import { F as Field, I as InferFieldType, a as FieldPolicy } from './factories-Cmvx0495.js';
+export { b as FieldModifiers, t } from './factories-Cmvx0495.js';
 import { Hook } from '@hono/zod-validator';
 import * as hono from 'hono';
 import { ValidationTargets, Env, MiddlewareHandler, Hono } from 'hono';
@@ -40,6 +40,14 @@ interface Adapter<TSchema extends Record<string, unknown> = Record<string, never
  */
 declare function d1Adapter<TSchema extends Record<string, unknown> = Record<string, never>>(d1: D1Database): Adapter<TSchema>;
 
+type OpenAPISchemaObject = Record<string, unknown>;
+interface OpenAPIModelComponent {
+    create: OpenAPISchemaObject;
+    update: OpenAPISchemaObject;
+    output: OpenAPISchemaObject;
+}
+type OpenAPIUsage = 'create' | 'update' | 'output';
+
 /**
  * Options for findMany query.
  * `limit` is required (no default).
@@ -78,13 +86,84 @@ type RowType<Fields extends Record<string, Field<any, any, any>>> = {
     [K in keyof Fields]: InferFieldType<Fields[K]>;
 };
 /**
- * Create input: partial row (most fields optional for insert).
- * Phase 1 では `Partial<RowType>` のままとし、必須/任意フィールドの型区別は Phase 2 で扱う。
+ * @internal
+ * Extracts the policy from a Field's modifiers.
+ *
+ * Uses `Field<any, { policy: infer P }, any>` rather than a two-step
+ * `infer M` + `M extends { policy: infer P }` pattern.
+ * The two-step pattern is broken when TypeScript widens `M` to the constraint
+ * `FieldModifiers` (which has `policy?: FieldPolicy` as optional), causing
+ * `M extends { policy: infer P }` to be true for ALL fields regardless of their
+ * actual policy value. Directly matching `{ policy: infer P }` avoids this.
+ */
+type PolicyOf<F> = F extends Field<any, {
+    policy: infer P extends FieldPolicy;
+}, any> ? P : never;
+/**
+ * @internal
+ * Computes which field keys should be omitted based on policy and usage.
+ * Mirrors the runtime logic in derivePolicyOptions() in schema.ts.
+ *
+ * NOTE: `[PolicyOf<Fields[K]>] extends [never]` (non-distributive form) is used to
+ * short-circuit fields with no policy to `never` (do not omit). Without this guard,
+ * `never extends 'serverOnly'` evaluates to `true` (vacuously), causing every field
+ * without a policy to be incorrectly included in the omit set.
+ */
+type PolicyOmitKeys<Fields extends Record<string, Field<any, any, any>>, Usage extends 'input-create' | 'input-update' | 'output'> = {
+    [K in keyof Fields]: [PolicyOf<Fields[K]>] extends [never] ? never : PolicyOf<Fields[K]> extends 'serverOnly' ? K : Usage extends 'output' ? PolicyOf<Fields[K]> extends 'writeOnly' ? K : never : Usage extends 'input-create' | 'input-update' ? PolicyOf<Fields[K]> extends 'readOnly' ? K : never : never;
+}[keyof Fields];
+/**
+ * @internal
+ * Computes which field keys have the serverOnly policy.
+ * serverOnly fields are completely excluded from CreateInput
+ * (cannot be passed even from library internals — they are server-side only).
+ *
+ * Uses `[PolicyOf<Fields[K]>] extends [never]` (non-distributive form) to short-circuit
+ * fields with no policy to `never`. Without this guard, `never extends 'serverOnly'`
+ * evaluates to `true` (vacuously), causing every field without a policy to be included.
+ */
+type ServerOnlyKeys<Fields extends Record<string, Field<any, any, any>>> = {
+    [K in keyof Fields]: [PolicyOf<Fields[K]>] extends [never] ? never : PolicyOf<Fields[K]> extends 'serverOnly' ? K : never;
+}[keyof Fields];
+/**
+ * @internal
+ * Determines if a field is required for create input.
+ * A field is optional if it has a default, is optional, or is readOnly.
+ *
+ * Uses direct shape matching (`Field<any, { hasDefault: true }, any>`) to avoid
+ * the TypeScript infer-widening issue where `infer M` resolves to `FieldModifiers`
+ * (the constraint bound) instead of the concrete Mods type, causing `M extends
+ * { policy: 'readOnly' }` to be false even for readOnly fields.
+ */
+type IsRequired<F extends Field<any, any, any>> = F extends Field<any, {
+    hasDefault: true;
+}, any> ? false : F extends Field<any, {
+    optional: true;
+}, any> ? false : F extends Field<any, {
+    policy: 'readOnly';
+}, any> ? false : true;
+/**
+ * Create input with precise types:
+ * - `readOnly` fields are optional (library internals can pass them; API callers
+ *   are excluded via inputSchema — but CreateInput itself keeps them as optional
+ *   so handlers can supply generated values like `id` or `createdAt`)
+ * - fields with `default` are optional
+ * - fields marked `optional` are optional
+ * - all other fields are required
+ * - `serverOnly` fields are completely excluded (cannot be passed even internally)
+ * - `writeOnly` fields are included as required (they are input fields by design)
  */
-type CreateInput<Fields extends Record<string, Field<any, any, any>>> = Partial<RowType<Fields>>;
+type CreateInput<Fields extends Record<string, Field<any, any, any>>> = {
+    [K in keyof Fields as IsRequired<Fields[K]> extends true ? K extends ServerOnlyKeys<Fields> ? never : K : never]: InferFieldType<Fields[K]>;
+} & {
+    [K in keyof Fields as IsRequired<Fields[K]> extends true ? never : K extends ServerOnlyKeys<Fields> ? never : K]?: InferFieldType<Fields[K]>;
+};
+type FieldAccessor<K extends string> = {
+    readonly [Key in K]: Key;
+};
 interface SchemaOptions<K extends string = string> {
-    readonly pick?: readonly K[];
-    readonly omit?: readonly K[];
+    readonly pick?: readonly K[] | ((f: FieldAccessor<K>) => readonly K[]);
+    readonly omit?: readonly K[] | ((f: FieldAccessor<K>) => readonly K[]);
     readonly partial?: boolean;
 }
 /**
@@ -101,16 +180,22 @@ type FieldsToZodShape<Fields extends Record<string, Field<any, any, any>>> = {
  * Utility to narrow array literal types to union of strings.
  */
 type ArrayKeys<A> = A extends readonly (infer U)[] ? U : never;
+/**
+ * @internal
+ * Resolves pick/omit option type to the array type.
+ * Handles both array form and accessor function form.
+ */
+type ResolveOptKeys<Opt> = Opt extends readonly string[] ? Opt : Opt extends (f: FieldAccessor<infer _K>) => readonly (infer R)[] ? readonly R[] : never;
 /**
  * @internal
  * Apply pick transformation to a shape.
  */
-type ApplyPickToShape<Shape extends z.ZodRawShape, PickKeys> = PickKeys extends readonly string[] ? Pick<Shape, ArrayKeys<PickKeys> & keyof Shape> : Shape;
+type ApplyPickToShape<Shape extends z.ZodRawShape, PickOpt> = ResolveOptKeys<PickOpt> extends readonly string[] ? Pick<Shape, ArrayKeys<ResolveOptKeys<PickOpt>> & keyof Shape> : Shape;
 /**
  * @internal
  * Apply omit transformation to a shape.
  */
-type ApplyOmitToShape<Shape extends z.ZodRawShape, OmitKeys> = OmitKeys extends readonly string[] ? Omit<Shape, ArrayKeys<OmitKeys> & keyof Shape> : Shape;
+type ApplyOmitToShape<Shape extends z.ZodRawShape, OmitOpt> = ResolveOptKeys<OmitOpt> extends readonly string[] ? Omit<Shape, ArrayKeys<ResolveOptKeys<OmitOpt>> & keyof Shape> : Shape;
 /**
  * @internal
  * Apply partial transformation to a shape.
@@ -118,38 +203,77 @@ type ApplyOmitToShape<Shape extends z.ZodRawShape, OmitKeys> = OmitKeys extends
 type ApplyPartialToShape<Shape extends z.ZodRawShape> = {
     [K in keyof Shape]: z.ZodOptional<Shape[K]>;
 };
+/**
+ * @internal
+ * Checks if an option value (array or function) is present (i.e. not undefined and not never).
+ * Uses distributive conditional to handle union types like `T | undefined`.
+ */
+type HasOpt<Opt> = undefined extends Opt ? false : [Opt] extends [never] ? false : true;
 /**
  * @internal
  * Apply pick/omit/partial transformations to a Zod raw shape.
  * Order: pick → omit → partial
+ * Handles both array form and accessor function form for pick/omit.
  */
-type ApplyShape<Shape extends z.ZodRawShape, Opts extends SchemaOptions | undefined> = Opts extends undefined ? Shape : Opts extends {
-    pick: readonly string[];
-} ? Opts extends {
-    omit: readonly string[];
-} ? Opts extends {
+type ApplyShape<Shape extends z.ZodRawShape, Opts extends SchemaOptions | undefined> = Opts extends SchemaOptions ? HasOpt<Opts['pick']> extends true ? HasOpt<Opts['omit']> extends true ? Opts extends {
     partial: true;
 } ? ApplyPartialToShape<ApplyOmitToShape<ApplyPickToShape<Shape, Opts['pick']>, Opts['omit']>> : ApplyOmitToShape<ApplyPickToShape<Shape, Opts['pick']>, Opts['omit']> : Opts extends {
     partial: true;
-} ? ApplyPartialToShape<ApplyPickToShape<Shape, Opts['pick']>> : ApplyPickToShape<Shape, Opts['pick']> : Opts extends {
-    omit: readonly string[];
-} ? Opts extends {
+} ? ApplyPartialToShape<ApplyPickToShape<Shape, Opts['pick']>> : ApplyPickToShape<Shape, Opts['pick']> : HasOpt<Opts['omit']> extends true ? Opts extends {
     partial: true;
 } ? ApplyPartialToShape<ApplyOmitToShape<Shape, Opts['omit']>> : ApplyOmitToShape<Shape, Opts['omit']> : Opts extends {
     partial: true;
-} ? ApplyPartialToShape<Shape> : Shape;
+} ? ApplyPartialToShape<Shape> : Shape : Shape;
 /**
  * @internal
  * Returns the correct Zod object type after applying pick/omit/partial transformations.
  */
 type Apply<Shape extends z.ZodRawShape, Opts extends SchemaOptions | undefined> = z.ZodObject<ApplyShape<Shape, Opts>>;
+/**
+ * @internal
+ * Apply pick transformation to a TS record type.
+ */
+type ApplyPickToRecord<R, PickOpt> = ResolveOptKeys<PickOpt> extends readonly string[] ? Pick<R, ArrayKeys<ResolveOptKeys<PickOpt>> & keyof R> : R;
+/**
+ * @internal
+ * Apply omit transformation to a TS record type.
+ */
+type ApplyOmitToRecord<R, OmitOpt> = ResolveOptKeys<OmitOpt> extends readonly string[] ? Omit<R, ArrayKeys<ResolveOptKeys<OmitOpt>> & keyof R> : R;
+/**
+ * @internal
+ * Apply pick/omit/partial transformations to a TypeScript record type.
+ * Mirrors ApplyShape but operates on TS types directly, not Zod shapes.
+ * Used for Zod v3/v4 compatible middleware input/output type computation.
+ */
+type ApplyToRecord<R, Opts extends SchemaOptions | undefined> = Opts extends SchemaOptions ? HasOpt<Opts['pick']> extends true ? HasOpt<Opts['omit']> extends true ? Opts extends {
+    partial: true;
+} ? Partial<ApplyOmitToRecord<ApplyPickToRecord<R, Opts['pick']>, Opts['omit']>> : ApplyOmitToRecord<ApplyPickToRecord<R, Opts['pick']>, Opts['omit']> : Opts extends {
+    partial: true;
+} ? Partial<ApplyPickToRecord<R, Opts['pick']>> : ApplyPickToRecord<R, Opts['pick']> : HasOpt<Opts['omit']> extends true ? Opts extends {
+    partial: true;
+} ? Partial<ApplyOmitToRecord<R, Opts['omit']>> : ApplyOmitToRecord<R, Opts['omit']> : Opts extends {
+    partial: true;
+} ? Partial<R> : R : R;
 /**
  * @internal
  * Mirrors @hono/zod-validator's middleware Input type.
  * Aligned with @hono/zod-validator@0.4.x; revisit on version bump.
  */
 type HasUndefined<T> = undefined extends T ? true : false;
-type ValidatorInput<Target extends keyof ValidationTargets, Schema extends z.ZodType<any, z.ZodTypeDef, any>, In = z.input<Schema>, Out = z.output<Schema>> = {
+/**
+ * @internal
+ * Hono middleware input/output type for validator middleware.
+ * Aligned with @hono/zod-validator@0.4.x; revisit on version bump.
+ *
+ * WARNING (Zod 4): `z.input<ZodTypeAny>` resolves to `unknown` in Zod 4, making
+ * `c.req.valid(target)` return `unknown` if `In`/`Out` are left as defaults.
+ * When using this type directly (outside of `ModelValidatorReturn`), always pass
+ * explicit `In` and `Out` type arguments — do NOT rely on the defaults.
+ *
+ * Internal usages in this file (ModelValidatorReturn and preset overloads) already
+ * pass `In`/`Out` explicitly via `ApplyToRecord` or `Omit<RowType<Fields>, ...>`.
+ */
+type ValidatorInput<Target extends keyof ValidationTargets, Schema extends z.ZodTypeAny, In = z.input<Schema>, Out = z.output<Schema>> = {
     in: HasUndefined<In> extends true ? {
         [K in Target]?: (In extends ValidationTargets[K] ? In : {
             [K2 in keyof In]?: ValidationTargets[K][K2] | undefined;
@@ -167,8 +291,11 @@ type ValidatorInput<Target extends keyof ValidationTargets, Schema extends z.Zod
  * @internal
  * Type-safe Hono middleware handler return for Model.validator().
  * Provides proper type narrowing for c.req.valid(target).
+ *
+ * Uses RowType<Fields> directly for input/output type computation
+ * to ensure Zod v3/v4 compatibility (z.input<ZodTypeAny> returns unknown in Zod v4).
  */
-type ModelValidatorReturn<Fields extends Record<string, Field<any, any, any>>, Target extends keyof ValidationTargets, Opts extends SchemaOptions<keyof Fields & string> | undefined> = MiddlewareHandler<any, string, ValidatorInput<Target, Apply<FieldsToZodShape<Fields>, Opts>>>;
+type ModelValidatorReturn<Fields extends Record<string, Field<any, any, any>>, Target extends keyof ValidationTargets, Opts extends SchemaOptions<keyof Fields & string> | undefined> = MiddlewareHandler<any, string, ValidatorInput<Target, Apply<FieldsToZodShape<Fields>, Opts>, ApplyToRecord<RowType<Fields>, Opts>, ApplyToRecord<RowType<Fields>, Opts>>>;
 
 /**
  * Represents a database model with type-safe schema derivation and CRUD operations.
@@ -185,22 +312,60 @@ interface Model<Fields extends Record<string, Field<any, any, any>>> {
      * const CreateSchema = User.schema({ omit: ['passwordHash'] })
      * const UpdateSchema = User.schema({ partial: true, pick: ['name', 'email'] })
      */
-    schema<Opts extends SchemaOptions<keyof Fields & string> | undefined = undefined>(opts?: Opts): Apply<FieldsToZodShape<Fields>, Opts>;
+    schema<Opts extends SchemaOptions<keyof Fields & string> | undefined>(opts?: Opts): Apply<FieldsToZodShape<Fields>, Opts>;
     /**
      * Returns a Hono middleware validator derived from this model's schema.
      * Integrates with @hono/zod-validator to validate request inputs.
      * The optional `hook` argument is passed through to @hono/zod-validator.
      *
+     * Accepts a preset ('create' | 'update') as second argument to use inputSchema.
+     * When a preset is used, the return type is a MiddlewareHandler (loosely typed in Phase 2A).
+     * Precise type narrowing for preset is deferred to Phase 2B M2.3.
+     *
      * @example
+     * app.post('/users', User.validator('json', 'create'), c => {
+     *   const body = c.req.valid('json')
+     * })
      * app.post('/users', User.validator('json', { omit: ['passwordHash'] }), c => {
      *   const body = c.req.valid('json')
      * })
-     * // With hook for hardened error responses:
+     * // With hook:
      * app.post('/users', User.validator('json', opts, (result, c) => {
      *   if (!result.success) return c.json({ error: 'Invalid request' }, 400)
      * }), handler)
      */
-    validator<Target extends keyof ValidationTargets, Opts extends SchemaOptions<keyof Fields & string> | undefined = undefined, E extends Env = Env, P extends string = string>(target: Target, opts?: Opts, hook?: Hook<z.output<Apply<FieldsToZodShape<Fields>, Opts>>, E, P, Target>): ModelValidatorReturn<Fields, Target, Opts>;
+    validator<Target extends keyof ValidationTargets, E extends Env = Env, P extends string = string>(target: Target, preset: 'create', hook?: Hook<Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-create'> & string>, E, P, Target>): MiddlewareHandler<E, P, ValidatorInput<Target, z.ZodObject<z.ZodRawShape>, Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-create'> & string>, Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-create'> & string>>>;
+    validator<Target extends keyof ValidationTargets, E extends Env = Env, P extends string = string>(target: Target, preset: 'update', hook?: Hook<Partial<Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-update'> & string>>, E, P, Target>): MiddlewareHandler<E, P, ValidatorInput<Target, z.ZodObject<z.ZodRawShape>, Partial<Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-update'> & string>>, Partial<Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-update'> & string>>>>;
+    validator<Target extends keyof ValidationTargets, Opts extends SchemaOptions<keyof Fields & string> | undefined, E extends Env = Env, P extends string = string>(target: Target, opts?: Opts, hook?: Hook<z.output<Apply<FieldsToZodShape<Fields>, Opts>>, E, P, Target>): ModelValidatorReturn<Fields, Target, Opts>;
+    /**
+     * Returns a Zod schema for API input, with policy-based field exclusions applied.
+     * - 'create': serverOnly and readOnly fields are excluded
+     * - 'update': same exclusions + all fields become optional (partial: true)
+     *
+     * The return type precisely reflects policy-derived omissions using PolicyOmitKeys.
+     */
+    inputSchema<Opts extends SchemaOptions<keyof Fields & string> | undefined = undefined>(usage: 'create', opts?: Opts): z.ZodObject<ApplyShape<Omit<FieldsToZodShape<Fields>, PolicyOmitKeys<Fields, 'input-create'> & string>, Opts>>;
+    inputSchema<Opts extends SchemaOptions<keyof Fields & string> | undefined = undefined>(usage: 'update', opts?: Opts): z.ZodObject<ApplyShape<Omit<FieldsToZodShape<Fields>, PolicyOmitKeys<Fields, 'input-update'> & string>, Opts extends undefined ? {
+        partial: true;
+    } : Opts & {
+        partial: true;
+    }>>;
+    inputSchema(usage: 'create' | 'update', opts?: SchemaOptions<keyof Fields & string>): z.ZodObject<z.ZodRawShape>;
+    /**
+     * Returns a Zod schema for API output, with policy-based field exclusions applied.
+     * - serverOnly and writeOnly fields are excluded
+     * - readOnly fields remain present
+     *
+     * The return type precisely reflects policy-derived omissions using PolicyOmitKeys.
+     */
+    outputSchema<Opts extends SchemaOptions<keyof Fields & string> | undefined = undefined>(opts?: Opts): z.ZodObject<ApplyShape<Omit<FieldsToZodShape<Fields>, PolicyOmitKeys<Fields, 'output'> & string>, Opts>>;
+    /**
+     * Parses a DB row through outputSchema and returns the safe response object.
+     * Equivalent to `User.outputSchema().parse(row)`.
+     */
+    toResponse(row: RowType<Fields>): unknown;
+    toOpenAPIComponent(): OpenAPIModelComponent;
+    toOpenAPISchema(usage: OpenAPIUsage): OpenAPISchemaObject;
     /**
      * Fetches multiple rows with pagination and optional ordering.
      * `limit` is required (no default) to prevent accidental unbounded queries.
@@ -286,8 +451,25 @@ interface NanokaModel<Fields extends Record<string, Field<any, any, any>>> {
     /**
      * Returns a Hono middleware validator for this model.
      * The optional `hook` argument is passed through to @hono/zod-validator.
+     * Accepts a preset ('create' | 'update') as second argument to use inputSchema.
      */
+    validator<Target extends keyof hono.ValidationTargets, E extends Env$1 = Env$1, P extends string = string>(target: Target, preset: 'create', hook?: Hook<Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-create'> & string>, E, P, Target>): MiddlewareHandler<E, P, ValidatorInput<Target, z.ZodObject<z.ZodRawShape>, Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-create'> & string>, Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-create'> & string>>>;
+    validator<Target extends keyof hono.ValidationTargets, E extends Env$1 = Env$1, P extends string = string>(target: Target, preset: 'update', hook?: Hook<Partial<Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-update'> & string>>, E, P, Target>): MiddlewareHandler<E, P, ValidatorInput<Target, z.ZodObject<z.ZodRawShape>, Partial<Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-update'> & string>>, Partial<Omit<RowType<Fields>, PolicyOmitKeys<Fields, 'input-update'> & string>>>>;
     validator<Target extends keyof hono.ValidationTargets, Opts extends SchemaOptions<keyof Fields & string> | undefined = undefined, E extends Env$1 = Env$1, P extends string = string>(target: Target, opts?: Opts, hook?: Hook<z.output<Apply<FieldsToZodShape<Fields>, Opts>>, E, P, Target>): ModelValidatorReturn<Fields, Target, Opts>;
+    /**
+     * Returns a Zod schema for API input, with policy-based field exclusions applied.
+     */
+    inputSchema(usage: 'create' | 'update', opts?: SchemaOptions<keyof Fields & string>): z.ZodObject<z.ZodRawShape>;
+    /**
+     * Returns a Zod schema for API output, with policy-based field exclusions applied.
+     */
+    outputSchema(opts?: SchemaOptions<keyof Fields & string>): z.ZodObject<z.ZodRawShape>;
+    /**
+     * Parses a DB row through outputSchema and returns the safe response object.
+     */
+    toResponse(row: RowType<Fields>): unknown;
+    toOpenAPIComponent(): OpenAPIModelComponent;
+    toOpenAPISchema(usage: OpenAPIUsage): OpenAPISchemaObject;
     /**
      * Fetches multiple rows with pagination and optional ordering.
      * `limit` is required (no default) to prevent accidental unbounded queries.
@@ -364,4 +546,4 @@ interface Nanoka<E extends Env$1 = BlankEnv> extends Hono<E> {
  */
 declare function nanoka<E extends Env$1 = BlankEnv>(adapter: Adapter): Nanoka<E>;
 
-export { type Adapter, type CreateInput, Field, type FindManyOptions, type IdOrWhere, InferFieldType, type Model, type Nanoka, type NanokaModel, type OrderBy, type RowType, type SchemaOptions, type Where, d1Adapter, defineModel, nanoka };
+export { type Adapter, type CreateInput, Field, FieldPolicy, type FindManyOptions, type IdOrWhere, InferFieldType, type Model, type Nanoka, type NanokaModel, type OpenAPIModelComponent, type OpenAPISchemaObject, type OpenAPIUsage, type OrderBy, type RowType, type SchemaOptions, type Where, d1Adapter, defineModel, nanoka };