webspresso 0.0.111 → 0.0.113

package/core/orm/schema-helpers.js

@@ -5,6 +5,13 @@
  */
 
 const { safeJsonParse } = require('../utils/json');
+const {
+  getZodDef,
+  getZodTypeName,
+  getZodInner,
+  getZodEnumValues,
+  isZodInt,
+} = require('../validation/zod-introspect');
 
 const METADATA_MARKER = '__wdb__';
 const metaWeakMap = new WeakMap();
@@ -665,10 +672,7 @@ function createSchemaHelpers(z) {
      */
     json(options = {}) {
       const { nullable = false, ...rest } = options;
-      let schema = z.unknown();
-      if (nullable) {
-        schema = schema.nullable().optional();
-      }
+      let schema = nullable ? z.unknown().nullable().optional() : z.unknown().optional();
       return createSchemaBuilder(schema, {
         type: 'json',
         nullable,
@@ -888,14 +892,14 @@ function extractColumnsFromSchema(schema) {
     // Unwrap optional/nullable wrappers to get to the base schema
     let current = schemaToCheck;
     let isNullable = false;
-    while (current && current._def) {
-      if (current._def.typeName === 'ZodNullable' || current._def.typeName === 'ZodOptional') {
+    while (current && getZodDef(current)) {
+      const currentType = getZodTypeName(current);
+      if (currentType === 'ZodNullable' || currentType === 'ZodOptional') {
         isNullable = true;
       }
-      if (current._def.innerType) {
-        current = current._def.innerType;
-      } else if (current._def.schema) {
-        current = current._def.schema;
+      const inner = getZodInner(current);
+      if (inner) {
+        current = inner;
       } else {
         break;
       }
@@ -905,16 +909,15 @@ function extractColumnsFromSchema(schema) {
     const meta = getColumnMeta(schemaToCheck) || (current ? getColumnMeta(current) : null);
     if (meta) {
       columns.set(key, meta);
-    } else if (current && current._def && current._def.typeName) {
-      const typeName = current._def.typeName;
+    } else if (current && getZodTypeName(current)) {
+      const typeName = getZodTypeName(current);
       let inferred = null;
       switch (typeName) {
         case 'ZodString':
           inferred = { type: 'string', maxLength: 255, nullable: isNullable };
           break;
         case 'ZodNumber': {
-          const isInt = current._def.checks?.some((c) => c.kind === 'int');
-          inferred = { type: isInt ? 'integer' : 'float', nullable: isNullable };
+          inferred = { type: isZodInt(current) ? 'integer' : 'float', nullable: isNullable };
           break;
         }
         case 'ZodBoolean':
@@ -924,7 +927,7 @@ function extractColumnsFromSchema(schema) {
           inferred = { type: 'timestamp', nullable: isNullable };
           break;
         case 'ZodEnum':
-          inferred = { type: 'enum', enumValues: current._def.values || [], nullable: isNullable };
+          inferred = { type: 'enum', enumValues: getZodEnumValues(current), nullable: isNullable };
           break;
         case 'ZodArray':
           inferred = { type: 'files', nullable: isNullable };

package/core/orm/utils/nanoid.js

@@ -63,14 +63,13 @@ function resolveNanoidSize(arg) {
  * @param {typeof import('zod').z} zod
  */
 function extendZ(zod) {
-  return new Proxy(zod, {
-    get(target, prop, receiver) {
-      if (prop === 'nanoid') {
-        return function nanoid(arg) {
-          return zodNanoid(zod, resolveNanoidSize(arg));
-        };
-      }
-      return Reflect.get(target, prop, receiver);
+  return Object.create(zod, {
+    nanoid: {
+      value: function nanoid(arg) {
+        return zodNanoid(zod, resolveNanoidSize(arg));
+      },
+      enumerable: true,
+      configurable: true,
     },
   });
 }

package/core/services/validator.js

@@ -293,7 +293,18 @@ function validateServiceInput(schema, input, serviceName, options = {}) {
   // 1. Zod schema validation
   if (compiled instanceof z.ZodType || typeof compiled.safeParse === 'function') {
     try {
-      const result = compiled.safeParse(sanitized);
+      let result;
+      if (compiled._zod && typeof compiled._zod.run === 'function') {
+        const rawRun = compiled._zod.run({ value: sanitized, issues: [] }, { async: true });
+        if (rawRun instanceof Promise) {
+          // Attach no-op catch so async refinements rejected during sync preflight don't emit UnhandledRejection
+          rawRun.catch(() => {});
+          throw new Error('Encountered Promise during synchronous parse');
+        }
+        result = rawRun.issues.length ? compiled.safeParse(sanitized) : { success: true, data: rawRun.value };
+      } else {
+        result = compiled.safeParse(sanitized);
+      }
       if (!result.success) {
         const { message, fields, fieldErrors } = formatZodErrors(result.error, serviceName);
         throw createServiceValidationError(message, {

package/core/validation/apply.js

@@ -6,6 +6,9 @@
  * @module core/validation/apply
  */
 
+const { ensureZodCompat } = require('./zod-introspect');
+ensureZodCompat();
+
 const EMPTY_INPUT = Object.freeze({
   body: undefined,
   params: undefined,

package/core/validation/index.js

@@ -28,6 +28,31 @@ if (z.ZodType && z.ZodType.prototype && typeof z.ZodType.prototype._refinement =
   };
   wrappedRefinement.__webspresso_wrapped = true;
   z.ZodType.prototype._refinement = wrappedRefinement;
+} else if (z.ZodType && z.ZodType.prototype && typeof z.ZodType.prototype.refine === 'function' && !z.ZodType.prototype.refine.__webspresso_wrapped) {
+  const origRefine = z.ZodType.prototype.refine;
+  const wrappedRefine = function (check, params) {
+    const wrappedCheck = typeof check === 'function'
+      ? (val) => {
+          const res = check(val);
+          if (res && typeof res.catch === 'function') {
+            res.catch(() => {});
+          }
+          return res;
+        }
+      : check;
+    return origRefine.call(this, wrappedCheck, params);
+  };
+  wrappedRefine.__webspresso_wrapped = true;
+  z.ZodType.prototype.refine = wrappedRefine;
+}
+
+if (z.ZodError && z.ZodError.prototype && !Object.getOwnPropertyDescriptor(z.ZodError.prototype, 'errors')) {
+  Object.defineProperty(z.ZodError.prototype, 'errors', {
+    get() {
+      return this.issues;
+    },
+    configurable: true,
+  });
 }
 
 /**

package/core/validation/zod-introspect.js

@@ -0,0 +1,187 @@
+/**
+ * Zod v3 & v4 Introspection Helpers
+ * Provides a unified abstraction over Zod v3 (`_def.typeName`) and Zod v4 (`_zod.def.type`)
+ * for ORM column inference, TypeGen, API TypeGen, and OpenAPI/MCP JSON Schema generation.
+ * @module core/validation/zod-introspect
+ */
+
+const z = require('zod');
+
+const V4_TYPE_MAP = Object.freeze({
+  string: 'ZodString',
+  number: 'ZodNumber',
+  boolean: 'ZodBoolean',
+  date: 'ZodDate',
+  bigint: 'ZodBigInt',
+  any: 'ZodAny',
+  unknown: 'ZodUnknown',
+  never: 'ZodNever',
+  undefined: 'ZodUndefined',
+  void: 'ZodVoid',
+  null: 'ZodNull',
+  literal: 'ZodLiteral',
+  enum: 'ZodEnum',
+  array: 'ZodArray',
+  optional: 'ZodOptional',
+  nullable: 'ZodNullable',
+  default: 'ZodDefault',
+  prefault: 'ZodDefault',
+  transform: 'ZodEffects',
+  pipe: 'ZodPipeline',
+  union: 'ZodUnion',
+  object: 'ZodObject',
+  record: 'ZodRecord',
+  tuple: 'ZodTuple',
+  set: 'ZodSet',
+  map: 'ZodMap',
+  nonoptional: 'ZodNonOptional',
+  readonly: 'ZodReadonly',
+  catch: 'ZodCatch',
+});
+
+function getZodDef(schema) {
+  if (!schema || typeof schema !== 'object') return null;
+  return (schema._zod && schema._zod.def) || schema._def || null;
+}
+
+function getZodTypeName(schema) {
+  const def = getZodDef(schema);
+  if (!def) return null;
+  if (def.typeName) return def.typeName;
+  if (typeof def.type === 'string') {
+    return V4_TYPE_MAP[def.type] || null;
+  }
+  return null;
+}
+
+function isZodSchema(val) {
+  return Boolean(val && typeof val === 'object' && (val._zod || val._def) && typeof val.safeParse === 'function');
+}
+
+function getZodInner(schema) {
+  const def = getZodDef(schema);
+  if (!def) return null;
+  return def.innerType || def.schema || def.in || null;
+}
+
+function getZodPipeOut(schema) {
+  const def = getZodDef(schema);
+  if (!def) return null;
+  return def.out || null;
+}
+
+function getZodArrayElement(schema) {
+  const def = getZodDef(schema);
+  if (!def) return null;
+  if (def.element) return def.element;
+  if (def.type && typeof def.type === 'object') return def.type;
+  return null;
+}
+
+function getZodObjectShape(schema) {
+  if (!schema || typeof schema !== 'object') return {};
+  if (typeof schema.shape === 'object' && schema.shape !== null) return schema.shape;
+  const def = getZodDef(schema);
+  if (!def) return {};
+  if (typeof def.shape === 'function') return def.shape() || {};
+  if (typeof def.shape === 'object' && def.shape !== null) return def.shape;
+  return {};
+}
+
+function getZodEnumValues(schema) {
+  const def = getZodDef(schema);
+  if (!def) return [];
+  if (Array.isArray(def.values)) return def.values;
+  if (def.entries && typeof def.entries === 'object') return Object.values(def.entries);
+  if (def.values && typeof def.values === 'object') return Object.values(def.values);
+  return [];
+}
+
+function getZodLiteralValue(schema) {
+  const def = getZodDef(schema);
+  if (!def) return undefined;
+  if (def.value !== undefined) return def.value;
+  if (Array.isArray(def.values)) return def.values[0];
+  return undefined;
+}
+
+function isZodInt(schema) {
+  const def = getZodDef(schema);
+  if (!def) return false;
+  if (def.format === 'safeint' || def.format === 'int32' || def.format === 'uint32') return true;
+  if (!Array.isArray(def.checks)) return false;
+  return def.checks.some((c) => {
+    if (!c) return false;
+    if (c.kind === 'int') return true;
+    const cDef = c._zod && c._zod.def;
+    return Boolean(cDef && cDef.check === 'number_format' && (cDef.format === 'safeint' || cDef.format === 'int32'));
+  });
+}
+
+function isZodCoerced(schema) {
+  const def = getZodDef(schema);
+  return Boolean(def && def.coerce);
+}
+
+function zodToJsonSchemaCompat(schema, options = {}) {
+  if (typeof z.toJSONSchema === 'function') {
+    try {
+      const target = options.target === 'openApi3' ? 'openapi-3.0' : (options.target || 'draft-7');
+      const jsonSchema = z.toJSONSchema(schema, {
+        target,
+        unrepresentable: 'any',
+      });
+      if (jsonSchema && typeof jsonSchema === 'object') {
+        delete jsonSchema.$schema;
+      }
+      return jsonSchema;
+    } catch (_) {
+      // Fall through to legacy helper if needed
+    }
+  }
+  const { zodToJsonSchema } = require('zod-to-json-schema');
+  return zodToJsonSchema(schema, options);
+}
+
+/**
+ * Apply Zod v3 compatibility shims onto Zod v4 prototypes (idempotent).
+ * - Exposes `ZodError.prototype.errors` -> `this.issues`
+ */
+function ensureZodCompat(zodModule = z) {
+  if (!zodModule) return;
+
+  const sampleError = typeof zodModule.string === 'function'
+    ? zodModule.string().safeParse(123)?.error
+    : null;
+  const errProtos = [
+    sampleError ? Object.getPrototypeOf(sampleError) : null,
+    zodModule.ZodError?.prototype,
+  ];
+  for (const errProto of errProtos) {
+    if (errProto && !Object.getOwnPropertyDescriptor(errProto, 'errors')) {
+      Object.defineProperty(errProto, 'errors', {
+        get() {
+          return this.issues;
+        },
+        configurable: true,
+      });
+    }
+  }
+}
+
+module.exports = {
+  getZodDef,
+  getZodTypeName,
+  isZodSchema,
+  getZodInner,
+  getZodPipeOut,
+  getZodArrayElement,
+  getZodObjectShape,
+  getZodEnumValues,
+  getZodLiteralValue,
+  isZodInt,
+  isZodCoerced,
+  zodToJsonSchemaCompat,
+  ensureZodCompat,
+};
+

package/index.d.ts

@@ -5075,6 +5075,11 @@ export interface DefineApiOptions<
   middleware?: (string | import('express').RequestHandler | [string, Record<string, unknown>])[];
   flag?: string | { key: string; statusCode?: number; message?: string };
   schema?: TSchema;
+  validateFields?: boolean | string[];
+  validate?: (
+    req: ApiRequest<TBody, TParams, TQuery, THeaders>,
+    ctx: { body: TBody; fields: string[]; req: ApiRequest<TBody, TParams, TQuery, THeaders>; res: ApiResponse<TBody, TParams, TQuery, THeaders> }
+  ) => Promise<Record<string, string> | null | undefined> | Record<string, string> | null | undefined;
   response?: Record<number | string, unknown>;
   handler: (
     req: ApiRequest<TBody, TParams, TQuery, THeaders>,
@@ -5094,6 +5099,16 @@ export function defineApi<
 >(
   config: {
     schema: TSchema;
+    validateFields?: boolean | string[];
+    validate?: (
+      req: ApiRequest<ApiNoInfer<TBody>, ApiNoInfer<TParams>, ApiNoInfer<TQuery>, ApiNoInfer<THeaders>>,
+      ctx: {
+        body: ApiNoInfer<TBody>;
+        fields: string[];
+        req: ApiRequest<ApiNoInfer<TBody>, ApiNoInfer<TParams>, ApiNoInfer<TQuery>, ApiNoInfer<THeaders>>;
+        res: ApiResponse<ApiNoInfer<TBody>, ApiNoInfer<TParams>, ApiNoInfer<TQuery>, ApiNoInfer<THeaders>>;
+      }
+    ) => Promise<Record<string, string> | null | undefined> | Record<string, string> | null | undefined;
     description?: string;
     tags?: string[];
     middleware?: (string | import('express').RequestHandler | [string, Record<string, unknown>])[];
@@ -6367,6 +6382,9 @@ export class ClientRequestError<TData = unknown> extends Error {
   readonly isTimedOut: boolean;
   readonly isDropped: boolean;
   readonly isSuperseded: boolean;
+  readonly dispatched: boolean;
+  readonly outcomeUnknown: boolean;
+  readonly outcome: 'unknown' | 'failed' | 'not_sent';
   readonly cause?: unknown;
   constructor(options: {
     message: string;
@@ -6383,6 +6401,9 @@ export class ClientRequestError<TData = unknown> extends Error {
     isTimedOut?: boolean;
     isDropped?: boolean;
     isSuperseded?: boolean;
+    dispatched?: boolean;
+    outcomeUnknown?: boolean;
+    outcome?: 'unknown' | 'failed' | 'not_sent';
   });
 }
 
@@ -6411,6 +6432,12 @@ export interface ClientRequestCallOptions<
   timeout?: number;
   retry?: boolean | number | ClientRetryOptions;
   retryMutations?: boolean;
+  onUploadProgress?: (progress: {
+    loaded: number;
+    total: number;
+    percent: number | null;
+    lengthComputable: boolean;
+  }) => void;
 }
 
 export interface AppApiRouteMap {
@@ -6429,6 +6456,7 @@ export interface ClientTask<TData = any, TArgs extends unknown[] = any[]> {
   readonly error: ClientRequestError | Error | null;
   readonly stale: boolean;
   readonly lastUpdatedAt: number;
+  readonly lastArgs: TArgs;
   isStale(): boolean;
   run(...args: TArgs): Promise<TData | undefined>;
   cancel(): void;
@@ -6439,6 +6467,8 @@ export interface ClientTaskOptions {
   concurrency?: ClientConcurrencyPolicy;
   policy?: ClientConcurrencyPolicy;
   key?: string;
+  mutation?: boolean;
+  kind?: 'query' | 'mutation';
   staleTime?: number | string;
   refetchOnMount?: ClientRefetchPolicy;
   refetchOnVisit?: ClientRefetchPolicy;
@@ -6713,6 +6743,8 @@ export interface ClientFormSubmitResult<TData = any> {
   hookError?: Error | null;
   error?: ClientRequestError | Error;
   aborted?: boolean;
+  outcomeUnknown?: boolean;
+  outcome?: 'unknown' | 'failed' | 'not_sent';
 }
 
 export interface ClientFormHookMeta<
@@ -6737,10 +6769,45 @@ export interface ClientFormHandle<
   readonly services: ClientServicesRegistry<TServices>;
   readonly pending: boolean;
   readonly dirty: boolean;
+  readonly touched: boolean;
+  readonly touchedFields: string[];
+  readonly submitted: boolean;
+  readonly inputRevision: number;
+  readonly draftKey: string;
+  readonly baseline: TValues;
   readonly errors: Record<string, string>;
-  readonly formError: string;
+  readonly formError: string | null;
+  readonly lastError: ClientRequestError | Error | null;
   readonly fieldErrors: Partial<Record<keyof TValues & string, string>> & Record<string, string>;
   disabled: boolean;
+  isTouched(fieldName?: keyof TValues & string | string): boolean;
+  touch(fieldName?: keyof TValues & string | string): this;
+  untouch(fieldName?: keyof TValues & string | string): this;
+  validateField(
+    fieldName: (keyof TValues & string) | string,
+    options?: { url?: string; method?: string; contextFields?: string[] | '*' }
+  ): Promise<{
+    ok: boolean;
+    valid?: boolean;
+    stale?: boolean;
+    canceled?: boolean;
+    networkError?: boolean;
+    errors?: Record<string, string>;
+    error?: Error;
+  }>;
+  readonly uploads: Array<{
+    field: string;
+    name: string;
+    size: number;
+    status: 'uploading' | 'done' | 'error' | 'canceled';
+    loaded: number;
+    total: number;
+    percent: number | null;
+    error: string | null;
+  }>;
+  cancelUpload(): boolean;
+  createPreviewUrl(file: File | Blob, fieldName?: string): string | null;
+  revokePreviewUrls(fieldName?: string): void;
   values(): TValues;
   read(submitter?: HTMLElement | null): TValues;
   fill(values: Partial<TValues> & Record<string, unknown>, options?: ClientFormFillOptions): this;
@@ -6754,8 +6821,12 @@ export interface ClientFormHandle<
   saveDraft(): boolean;
   restoreDraft(): boolean;
   clearDraft(): boolean;
+  setDraftKey(nextKey: string, options?: { restore?: boolean }): this;
   readonly hasDraft: boolean;
   submit(submitter?: HTMLElement | null | Record<string, unknown>): Promise<ClientFormSubmitResult<TResponse>>;
+  beforeSubmit(
+    callback: (values: TValues, meta: { form: ClientFormHandle<TValues, TResponse, TServices>; submitter?: HTMLElement | null; action: string; method: string }) => boolean | Promise<boolean>
+  ): () => void;
   onSuccess(
     callback: (data: TResponse, meta: ClientFormHookMeta<TValues, TResponse, TServices>) => void | Promise<void>
   ): () => void;
@@ -6792,10 +6863,12 @@ export interface ControllerFormsRegistry<TServices = AppClientServices> {
 
 export interface FragmentRefreshResult {
   ok: boolean;
+  partial?: boolean;
   refreshed: string[];
   errors?: Error[];
   skipped?: boolean;
   canceled?: boolean;
+  superseded?: boolean;
   error?: Error | null;
   timings?: {
     loadMs: number;
@@ -6807,6 +6880,12 @@ export interface FragmentRefreshOptions {
   replaceInput?: boolean;
   timeout?: number;
   throwOnError?: boolean;
+  mode?: 'replace' | 'append' | 'prepend';
+  limit?: number;
+  target?: string;
+  removeKeys?: string[];
+  onBeforePatch?: (el: Element, inst: any) => void;
+  onAfterPatch?: (el: Element, inst: any) => void;
   onSuccess?: (result: FragmentRefreshResult) => void | Promise<void>;
   onFailure?: (error: Error) => void | Promise<void>;
   onError?: (error: Error) => void | Promise<void>;
@@ -6816,6 +6895,7 @@ export interface FragmentRefreshOptions {
 
 export interface ControllerFragmentHandle<TInput extends Record<string, any> = Record<string, any>> {
   readonly input: TInput;
+  readonly inputs: Record<string, TInput>;
   refresh(
     nextInput?: Partial<TInput> & Record<string, unknown>,
     options?: FragmentRefreshOptions
@@ -6827,10 +6907,17 @@ export interface ControllerErrorMeta {
   task?: string;
   event?: Event;
   actionEl?: HTMLElement | null;
-  phase?: 'action' | 'task' | 'connect' | 'disconnect';
+  phase?: 'action' | 'task' | 'connect' | 'disconnect' | 'beforePatch' | 'afterPatch';
   [key: string]: unknown;
 }
 
+export interface FragmentPatchHookMeta {
+  fragmentId?: string | null;
+  fragmentName?: string | null;
+  isFragmentRoot?: boolean;
+  isDescendant?: boolean;
+}
+
 export type WatchSource<T = any> =
   | (() => T)
   | string
@@ -6886,7 +6973,9 @@ export interface ControllerContext<
   readonly lastError: Error | null;
   clearError(): void;
   readonly storage: ClientStorage & { readonly global: ClientStorage; readonly root: ClientStorage };
+  readonly persistenceConflicts: Array<Record<string, unknown>>;
   clearPersistedState(): void;
+  retryFailedFragments(): Promise<FragmentRefreshResult>;
   onError(listener: (err: Error, meta?: ControllerErrorMeta) => void): () => void;
   task<TData = any, TArgs extends unknown[] = any[]>(
     runFn: (...args: TArgs) => Promise<TData>,
@@ -6977,6 +7066,22 @@ export interface ControllerDefinition<
       TServices
     >
   ) => void;
+  beforePatch?: (
+    ctx: ControllerContext<
+      [TState][TState extends any ? 0 : never] & { readonly [K in keyof TComputed]: ReturnType<TComputed[K]> },
+      Record<string, ClientTask>,
+      TServices
+    >,
+    meta: FragmentPatchHookMeta
+  ) => void;
+  afterPatch?: (
+    ctx: ControllerContext<
+      [TState][TState extends any ? 0 : never] & { readonly [K in keyof TComputed]: ReturnType<TComputed[K]> },
+      Record<string, ClientTask>,
+      TServices
+    >,
+    meta: FragmentPatchHookMeta
+  ) => void | Promise<void>;
   onError?: ControllerErrorHandler<
     [TState][TState extends any ? 0 : never] & { readonly [K in keyof TComputed]: ReturnType<TComputed[K]> },
     Record<string, ClientTask>,
@@ -7041,6 +7146,9 @@ export interface FragmentDefinition<TInput = Record<string, unknown>, TData = Re
   refetchOnVisit?: ClientRefetchPolicy;
   refetchInterval?: number | string | false;
   refetchIntervalInBackground?: boolean;
+  lazy?: boolean;
+  placeholder?: string | ((ctx: { input: TInput; instanceId: string; name: string }) => string);
+  placeholderTemplate?: string;
   load?: (context: FragmentLoaderContext<TInput>) => TData | Promise<TData>;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "webspresso",
-  "version": "0.0.111",
+  "version": "0.0.113",
   "description": "Minimal, production-ready SSR framework for Node.js with file-based routing, Nunjucks templating, built-in i18n, and CLI tooling",
   "main": "index.js",
   "types": "index.d.ts",
@@ -100,7 +100,7 @@
     "bench:ci:local": "npm run bench:baseline && npm run bench:ci",
     "bench:profile": "softscope --top 30 node scripts/profile-bench.mjs",
     "bench:profile:ai": "softscope --top 40 -o softscope-bench.ai node scripts/profile-bench.mjs",
-    "check:types": "tsc --project tests/ts-smoke/tsconfig.json && tsc --noEmit --skipLibCheck false --types node index.d.ts",
+    "check:types": "tsc --project tests/ts-smoke/tsconfig.json && tsc --noEmit --skipLibCheck false --esModuleInterop --types node index.d.ts",
     "rebuild:native": "npm rebuild better-sqlite3 bcrypt sharp",
     "docs:dev": "docboot dev ./docs",
     "docs:build": "docboot build ./docs",
@@ -148,7 +148,7 @@
     "qs": "^6.17.1",
     "sanitize-html": "^2.18.1",
     "yaml": "^2.8.3",
-    "zod": "^3.23.0",
+    "zod": "^4.6.7",
     "zod-to-json-schema": "^3.25.2"
   },
   "peerDependencies": {
@@ -218,7 +218,7 @@
     "@swup/scripts-plugin": "^2.1.0",
     "@types/express": "^5.0.0",
     "@types/node": "^20.14.0",
-    "@vitest/coverage-v8": "^4.1.11",
+    "@vitest/coverage-v8": "^4.1.12",
     "bcrypt": "^6.0.0",
     "better-sqlite3": "^11.10.0",
     "chokidar": "^4.0.3",
@@ -226,7 +226,7 @@
     "dotenv": "^16.3.1",
     "exceljs": "^4.4.0",
     "express-rate-limit": "^8.4.1",
-    "hono": "^4.13.13",
+    "hono": "^4.13.16",
     "mjml": "^5.4.0",
     "nodemailer": "^10.0.10",
     "release-it": "^20.2.1",
@@ -235,14 +235,14 @@
     "supertest": "^6.3.4",
     "swup": "^4.8.3",
     "typescript": "~5.6.3",
-    "vitest": "^4.1.11",
+    "vitest": "^4.1.12",
     "vitest-doctor": "^0.3.0"
   },
   "engines": {
     "node": ">=20.0.0"
   },
   "overrides": {
-    "basic-ftp": "^6.2.1",
+    "basic-ftp": "^6.2.4",
     "chokidar": "^4.0.3",
     "katex": "^0.18.2",
     "tar": "^7.5.11",
@@ -251,7 +251,8 @@
     "js-yaml": "^5.4.2",
     "qs": "^6.17.1",
     "sanitize-html": "^2.18.1",
-    "vite": "^8.3.5"
+    "vite": "^8.3.5",
+    "minimatch@>=7.0.0 <=11.0.0": "^11.0.8"
   },
   "allowScripts": {
     "bcrypt@6.0.0": true,

package/plugins/mcp/providers/services.js

@@ -4,7 +4,7 @@
  * @module plugins/mcp/providers/services
  */
 
-const { zodToJsonSchema } = require('zod-to-json-schema');
+const { zodToJsonSchemaCompat } = require('../../../core/validation/zod-introspect');
 
 /**
  * Normalizes a dot-separated service name to an MCP-safe tool name
@@ -99,7 +99,7 @@ function convertZodToInputSchema(schema) {
   }
 
   try {
-    const rawSchema = zodToJsonSchema(schema, {
+    const rawSchema = zodToJsonSchemaCompat(schema, {
       $refStrategy: 'none',
       removeAdditionalStrategy: 'strict',
     });

package/src/api/define-api.js

@@ -13,6 +13,8 @@
  * @param {Array<string|Function>} [config.middleware] - Named or functional middlewares
  * @param {string|{ key: string, statusCode?: number, message?: string }} [config.flag] - Feature flag required to access this endpoint
  * @param {Object|Function} [config.schema] - Request schemas (params, query, body, headers)
+ * @param {boolean|string[]} [config.validateFields] - Opt-in field-level validation without running mutation handler
+ * @param {Function} [config.validate] - Optional async read-only validation hook: async (ctx, fields) => ({ field: 'msg' })
  * @param {Object} [config.response] - Expected response schemas by status code
  * @param {Function} config.handler - Request handler: async (req, ctx) => data
  * @returns {Object}