@atscript/moost-db 0.1.119 → 0.1.121

package/dist/index.cjs

@@ -922,7 +922,7 @@ function normalizeOptions(prefixOrOptions) {
 * Builds the shared binding metadata for a decorator invocation: classifies
 * the binding form, computes the static route prefix, and packages a uniform
 * `resolve()` used by both the DI provide factory and the base controller's
-* `super(undefined, app)` fallback.
+* `super(app)` fallback.
 */
 function buildBinding(binding, options, decoratorName) {
 	if ((0, _atscript_typescript_utils.isAnnotatedType)(binding)) {
@@ -1041,7 +1041,7 @@ function findReadableBinding(ctor) {
 *
 * Used by {@link AsDbReadableController}'s constructor when `readable` is
 * `undefined` — i.e. a subclass with its own constructor called
-* `super(undefined, app)` instead of forwarding an injected instance.
+* `super(app)` instead of forwarding an injected instance.
 */
 function resolveBoundReadable(ctor) {
 	const binding = findReadableBinding(ctor);
@@ -1096,7 +1096,7 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	_quantityRefByPath;
 	/** Paths the adapter vetoes for filtering (e.g. JSON storage on SQL). Symmetric with `/meta` `filterable: false`. */
 	_adapterNonFilterable;
-	constructor(readable, app) {
+	constructor(app, readable) {
 		const resolved = readable ?? resolveBoundReadable(new.target);
 		super(resolved.type, resolved.tableName, app, resolved.isView ? "view" : "table");
 		this.readable = resolved;
@@ -1758,9 +1758,9 @@ __decorate([
 ], AsDbReadableController.prototype, "getOneComposite", null);
 AsDbReadableController = __decorate([
 	(0, moost.Inherit)(),
-	__decorateParam(0, (0, moost.Inject)(READABLE_DEF)),
-	__decorateParam(0, (0, moost.Optional)()),
-	__decorateMetadata("design:paramtypes", [Object, typeof moost.Moost === "undefined" ? Object : moost.Moost])
+	__decorateParam(1, (0, moost.Inject)(READABLE_DEF)),
+	__decorateParam(1, (0, moost.Optional)()),
+	__decorateMetadata("design:paramtypes", [typeof moost.Moost === "undefined" ? Object : moost.Moost, Object])
 ], AsDbReadableController);
 registerAsDbReadableController(AsDbReadableController);
 //#endregion
@@ -1793,8 +1793,8 @@ let AsDbController = class AsDbController extends AsDbReadableController {
 	get table() {
 		return this.readable;
 	}
-	constructor(table, app) {
-		super(table, app);
+	constructor(app, table) {
+		super(app, table);
 	}
 	buildCrud() {
 		return {
@@ -1956,9 +1956,9 @@ __decorate([
 ], AsDbController.prototype, "removeComposite", null);
 AsDbController = __decorate([
 	(0, moost.Inherit)(),
-	__decorateParam(0, (0, moost.Inject)(TABLE_DEF)),
-	__decorateParam(0, (0, moost.Optional)()),
-	__decorateMetadata("design:paramtypes", [Object, typeof moost.Moost === "undefined" ? Object : moost.Moost])
+	__decorateParam(1, (0, moost.Inject)(TABLE_DEF)),
+	__decorateParam(1, (0, moost.Optional)()),
+	__decorateMetadata("design:paramtypes", [typeof moost.Moost === "undefined" ? Object : moost.Moost, Object])
 ], AsDbController);
 //#endregion
 //#region src/as-value-help.controller.ts
@@ -2802,40 +2802,82 @@ function classLevelActions(dict, forcedLevel) {
 }
 //#endregion
 //#region src/actions/db-action-input-form.decorator.ts
+/** Human-readable description of a rejected form candidate for the error hint. */
+function describeCandidate(candidate) {
+	if (candidate === void 0) return "undefined — no reflected type (emitDecoratorMetadata off, or a circular import)";
+	if (candidate === Object) return "Object — reflection lost the type (interface/union annotation, or the class was imported with `import type`)";
+	if (typeof candidate === "function") return `class ${candidate.name ?? "<anonymous>"} — not a compiled .as interface`;
+	return typeof candidate;
+}
 /**
 * Parameter decorator that injects the `input` field of the action request
-* envelope (`{ ids?, input? }`) into the handler.
+* envelope (`{ ids?, input? }`) into the handler, **validated** against the
+* action's form.
+*
+* The form type may be passed explicitly — `@InputForm(MyForm)` — or inferred
+* from the parameter's reflected design type when omitted:
+*
+* ```ts
+* @Post("actions/comment")
+* @DbAction("comment", { label: "Comment" })
+* async comment(@InputForm() input: CommentForm) { ... }
+* ```
 *
-* Pairs the resolved value with two pieces of param-level metadata:
+* Inference reads `design:paramtypes`, so it only works when the parameter is
+* annotated with the compiled `.as` class through a VALUE import — an
+* `import type` elides the class and reflection yields `Object`. When the
+* reflected type is unusable, decoration **throws** (fail-loud, at import
+* time) instead of silently serving an action without a form. The explicit
+* argument sidesteps reflection entirely and always wins over the annotation.
 *
-* 1. `atscript_db_action_input_form` — the compiled `.as` class plus its
-*    name, consumed by `discoverActions` to:
-*    - emit `inputForm: FormType.name` on the action's `/meta` entry, and
-*    - register the type in the controller's form registry so
-*      `GET /meta/form/:name` can serve the serialized schema.
-* 2. `atscript_type` — just the type ref, providing a generic hook any
-*    atscript-aware Moost pipe can read without knowing about the
-*    moost-db-specific key.
+* The resolved form drives three things:
 *
-* Validation is intentionally *not* performed here. To validate `input`
-* against `FormType`, install an atscript validator pipe globally
-* (`app.applyGlobalPipes(...)`) or scope it via `@Pipe(...)`. The pipe reads
-* `atscript_type` off the param and runs `FormType.validator()`.
+* 1. `atscript_db_action_input_form` — `{ type, name }` param metadata,
+*    consumed by `discoverActions` to emit `inputForm: <name>` on the
+*    action's `/meta` entry and to register the schema for
+*    `GET /meta/form/:name`.
+* 2. `atscript_type` — a generic hook any atscript-aware Moost pipe can read
+*    without knowing the moost-db-specific key.
+* 3. **Request-time validation** — the resolver runs
+*    `FormType.validator(opts).validate(input ?? {})` before the handler
+*    fires. A failure throws `ValidatorError`, which the controllers' own
+*    `validationErrorTransform` shapes into the same structured `400`
+*    envelope as strict-`ids` failures. Absent `input` is validated as `{}`
+*    (all-optional forms pass; required fields produce per-field errors) and
+*    the handler always receives an object, never `undefined`. Pass
+*    `validatorOpts` to tune validation; an app-level `validatorPipe()` may
+*    re-validate the same value harmlessly.
 *
 * Only one `@InputForm()` per action is supported. To collect multiple
 * structured inputs, compose them into a single `.as` interface and pass an
 * array form on the field whose user-facing intent is "list of items".
 *
 * @param formType A compiled `.as` interface class (carries `.validator()`,
-*                 `.metadata`, etc.).
+*                 `.metadata`, etc.). Optional — inferred from the param's
+*                 reflected type when omitted.
+* @param validatorOpts Options forwarded to `formType.validator()`.
 */
-function InputForm(formType) {
+function InputForm(formType, validatorOpts) {
 	const mate = (0, moost.getMoostMate)();
-	const meta = {
-		type: formType,
-		name: formType.name
-	};
-	return (0, moost.ApplyDecorators)(mate.decorate("atscript_db_action_input_form", meta), mate.decorate("atscript_type", formType), (0, moost.Resolve)(async () => (0, _wooksjs_event_core.current)().get(dbActionInputSlot), "dbActionInputForm"));
+	let resolved;
+	return (0, moost.ApplyDecorators)(mate.decorate((paramMeta) => {
+		const candidate = formType ?? paramMeta.type;
+		if (!(0, _atscript_typescript_utils.isAnnotatedType)(candidate) || typeof candidate.name !== "string" || typeof candidate.validator !== "function") throw new Error(`@InputForm(${formType ? "…" : ""}) could not resolve the form type: expected a compiled .as interface, got ${describeCandidate(candidate)}. Annotate the parameter with the compiled .as class via a VALUE import, or pass the form explicitly: @InputForm(MyForm).`);
+		resolved = candidate;
+		const meta = {
+			type: resolved,
+			name: resolved.name
+		};
+		return {
+			...paramMeta,
+			atscript_db_action_input_form: meta,
+			atscript_type: resolved
+		};
+	}), (0, moost.Resolve)(async () => {
+		const input = await (0, _wooksjs_event_core.current)().get(dbActionInputSlot) ?? {};
+		if (resolved) resolved.validator(validatorOpts).validate(input);
+		return input;
+	}, "dbActionInputForm"));
 }
 //#endregion
 //#region src/actions/per-row.ts

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { i as resolveDbSpace, n as clearDbSpaces, r as provideDbSpace, t as DEFAULT_DB_SPACE } from "./db-space-registry-CWpYwZ4R.cjs";
-import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializedAnnotatedType, Validator } from "@atscript/typescript/utils";
+import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializedAnnotatedType, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AtscriptDbReadable, AtscriptDbTable, FilterExpr, FlatOf, TCrudOp, TCrudPermissions, TCrudPermissions as TCrudPermissions$1, TDbActionInfo, TDbActionInfo as TDbActionInfo$1, TDbActionIntent, TDbActionIntent as TDbActionIntent$1, TDbActionLevel, TDbActionLevel as TDbActionLevel$1, TDbActionProcessor, TDbFieldMeta, TIdentification, TMetaResponse, Uniquery, UniqueryControls } from "@atscript/db";
 import { HttpError } from "@moostjs/event-http";
 import { Mate, Moost, TConsoleBase, TMateParamMeta, TMoostMetadata } from "moost";
@@ -181,7 +181,7 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   private readonly _quantityRefByPath;
   /** Paths the adapter vetoes for filtering (e.g. JSON storage on SQL). Symmetric with `/meta` `filterable: false`. */
   private readonly _adapterNonFilterable;
-  constructor(readable: AtscriptDbReadable<T> | undefined, app: Moost);
+  constructor(app: Moost, readable?: AtscriptDbReadable<T>);
   private _collectAdapterNonFilterable;
   private _collectQuantityRefs;
   private _buildGates;
@@ -323,7 +323,7 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
 declare class AsDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType, DataType = TAtscriptDataType<T>> extends AsDbReadableController<T, DataType> {
   /** Reference to the underlying table (typed for write access). */
   protected get table(): AtscriptDbTable<T>;
-  constructor(table: AtscriptDbTable<T> | undefined, app: Moost);
+  constructor(app: Moost, table?: AtscriptDbTable<T>);
   protected buildCrud(): TCrudPermissions$1;
   /**
    * Intercepts write operations. Return `undefined` to abort.
@@ -699,7 +699,7 @@ declare module "moost" {
  * Class-level readable-binding descriptor written by `@TableController` /
  * `@ReadableController` / `@ViewController`. One uniform `resolve()` backs
  * both the DI provide factory and the base controller's
- * `super(undefined, app)` fallback; `model` additionally feeds
+ * `super(app)` fallback; `model` additionally feeds
  * `assertExposed()`.
  */
 interface TReadableBindingMeta {
@@ -903,7 +903,7 @@ declare function findReadableBinding(ctor: Function | undefined): TReadableBindi
  *
  * Used by {@link AsDbReadableController}'s constructor when `readable` is
  * `undefined` — i.e. a subclass with its own constructor called
- * `super(undefined, app)` instead of forwarding an injected instance.
+ * `super(app)` instead of forwarding an injected instance.
  */
 declare function resolveBoundReadable(ctor: Function | undefined): AtscriptDbReadable<any>;
 //#endregion
@@ -1056,34 +1056,55 @@ declare function DbRowsActions<TRow = unknown, const D extends Record<string, un
 //#region src/actions/db-action-input-form.decorator.d.ts
 /**
  * Parameter decorator that injects the `input` field of the action request
- * envelope (`{ ids?, input? }`) into the handler.
+ * envelope (`{ ids?, input? }`) into the handler, **validated** against the
+ * action's form.
  *
- * Pairs the resolved value with two pieces of param-level metadata:
+ * The form type may be passed explicitly — `@InputForm(MyForm)` — or inferred
+ * from the parameter's reflected design type when omitted:
  *
- * 1. `atscript_db_action_input_form` — the compiled `.as` class plus its
- *    name, consumed by `discoverActions` to:
- *    - emit `inputForm: FormType.name` on the action's `/meta` entry, and
- *    - register the type in the controller's form registry so
- *      `GET /meta/form/:name` can serve the serialized schema.
- * 2. `atscript_type` — just the type ref, providing a generic hook any
- *    atscript-aware Moost pipe can read without knowing about the
- *    moost-db-specific key.
+ * ```ts
+ * @Post("actions/comment")
+ * @DbAction("comment", { label: "Comment" })
+ * async comment(@InputForm() input: CommentForm) { ... }
+ * ```
+ *
+ * Inference reads `design:paramtypes`, so it only works when the parameter is
+ * annotated with the compiled `.as` class through a VALUE import — an
+ * `import type` elides the class and reflection yields `Object`. When the
+ * reflected type is unusable, decoration **throws** (fail-loud, at import
+ * time) instead of silently serving an action without a form. The explicit
+ * argument sidesteps reflection entirely and always wins over the annotation.
+ *
+ * The resolved form drives three things:
  *
- * Validation is intentionally *not* performed here. To validate `input`
- * against `FormType`, install an atscript validator pipe globally
- * (`app.applyGlobalPipes(...)`) or scope it via `@Pipe(...)`. The pipe reads
- * `atscript_type` off the param and runs `FormType.validator()`.
+ * 1. `atscript_db_action_input_form` — `{ type, name }` param metadata,
+ *    consumed by `discoverActions` to emit `inputForm: <name>` on the
+ *    action's `/meta` entry and to register the schema for
+ *    `GET /meta/form/:name`.
+ * 2. `atscript_type` — a generic hook any atscript-aware Moost pipe can read
+ *    without knowing the moost-db-specific key.
+ * 3. **Request-time validation** — the resolver runs
+ *    `FormType.validator(opts).validate(input ?? {})` before the handler
+ *    fires. A failure throws `ValidatorError`, which the controllers' own
+ *    `validationErrorTransform` shapes into the same structured `400`
+ *    envelope as strict-`ids` failures. Absent `input` is validated as `{}`
+ *    (all-optional forms pass; required fields produce per-field errors) and
+ *    the handler always receives an object, never `undefined`. Pass
+ *    `validatorOpts` to tune validation; an app-level `validatorPipe()` may
+ *    re-validate the same value harmlessly.
  *
  * Only one `@InputForm()` per action is supported. To collect multiple
  * structured inputs, compose them into a single `.as` interface and pass an
  * array form on the field whose user-facing intent is "list of items".
  *
  * @param formType A compiled `.as` interface class (carries `.validator()`,
- *                 `.metadata`, etc.).
+ *                 `.metadata`, etc.). Optional — inferred from the param's
+ *                 reflected type when omitted.
+ * @param validatorOpts Options forwarded to `formType.validator()`.
  */
 declare function InputForm<T extends TAtscriptAnnotatedType & {
   readonly name: string;
-}>(formType: T): ParameterDecorator;
+}>(formType?: T, validatorOpts?: Partial<TValidatorOptions>): ParameterDecorator;
 //#endregion
 //#region src/actions/discover.d.ts
 /**

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { i as resolveDbSpace, n as clearDbSpaces, r as provideDbSpace, t as DEFAULT_DB_SPACE } from "./db-space-registry-CKR6G-hi.mjs";
-import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializedAnnotatedType, Validator } from "@atscript/typescript/utils";
+import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializedAnnotatedType, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { HttpError } from "@moostjs/event-http";
 import { Mate, Moost, TConsoleBase, TMateParamMeta, TMoostMetadata } from "moost";
 import { parseUrl } from "@uniqu/url";
@@ -181,7 +181,7 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
   private readonly _quantityRefByPath;
   /** Paths the adapter vetoes for filtering (e.g. JSON storage on SQL). Symmetric with `/meta` `filterable: false`. */
   private readonly _adapterNonFilterable;
-  constructor(readable: AtscriptDbReadable<T> | undefined, app: Moost);
+  constructor(app: Moost, readable?: AtscriptDbReadable<T>);
   private _collectAdapterNonFilterable;
   private _collectQuantityRefs;
   private _buildGates;
@@ -323,7 +323,7 @@ declare class AsDbReadableController<T extends TAtscriptAnnotatedType = TAtscrip
 declare class AsDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType, DataType = TAtscriptDataType<T>> extends AsDbReadableController<T, DataType> {
   /** Reference to the underlying table (typed for write access). */
   protected get table(): AtscriptDbTable<T>;
-  constructor(table: AtscriptDbTable<T> | undefined, app: Moost);
+  constructor(app: Moost, table?: AtscriptDbTable<T>);
   protected buildCrud(): TCrudPermissions$1;
   /**
    * Intercepts write operations. Return `undefined` to abort.
@@ -699,7 +699,7 @@ declare module "moost" {
  * Class-level readable-binding descriptor written by `@TableController` /
  * `@ReadableController` / `@ViewController`. One uniform `resolve()` backs
  * both the DI provide factory and the base controller's
- * `super(undefined, app)` fallback; `model` additionally feeds
+ * `super(app)` fallback; `model` additionally feeds
  * `assertExposed()`.
  */
 interface TReadableBindingMeta {
@@ -903,7 +903,7 @@ declare function findReadableBinding(ctor: Function | undefined): TReadableBindi
  *
  * Used by {@link AsDbReadableController}'s constructor when `readable` is
  * `undefined` — i.e. a subclass with its own constructor called
- * `super(undefined, app)` instead of forwarding an injected instance.
+ * `super(app)` instead of forwarding an injected instance.
  */
 declare function resolveBoundReadable(ctor: Function | undefined): AtscriptDbReadable<any>;
 //#endregion
@@ -1056,34 +1056,55 @@ declare function DbRowsActions<TRow = unknown, const D extends Record<string, un
 //#region src/actions/db-action-input-form.decorator.d.ts
 /**
  * Parameter decorator that injects the `input` field of the action request
- * envelope (`{ ids?, input? }`) into the handler.
+ * envelope (`{ ids?, input? }`) into the handler, **validated** against the
+ * action's form.
  *
- * Pairs the resolved value with two pieces of param-level metadata:
+ * The form type may be passed explicitly — `@InputForm(MyForm)` — or inferred
+ * from the parameter's reflected design type when omitted:
  *
- * 1. `atscript_db_action_input_form` — the compiled `.as` class plus its
- *    name, consumed by `discoverActions` to:
- *    - emit `inputForm: FormType.name` on the action's `/meta` entry, and
- *    - register the type in the controller's form registry so
- *      `GET /meta/form/:name` can serve the serialized schema.
- * 2. `atscript_type` — just the type ref, providing a generic hook any
- *    atscript-aware Moost pipe can read without knowing about the
- *    moost-db-specific key.
+ * ```ts
+ * @Post("actions/comment")
+ * @DbAction("comment", { label: "Comment" })
+ * async comment(@InputForm() input: CommentForm) { ... }
+ * ```
+ *
+ * Inference reads `design:paramtypes`, so it only works when the parameter is
+ * annotated with the compiled `.as` class through a VALUE import — an
+ * `import type` elides the class and reflection yields `Object`. When the
+ * reflected type is unusable, decoration **throws** (fail-loud, at import
+ * time) instead of silently serving an action without a form. The explicit
+ * argument sidesteps reflection entirely and always wins over the annotation.
+ *
+ * The resolved form drives three things:
  *
- * Validation is intentionally *not* performed here. To validate `input`
- * against `FormType`, install an atscript validator pipe globally
- * (`app.applyGlobalPipes(...)`) or scope it via `@Pipe(...)`. The pipe reads
- * `atscript_type` off the param and runs `FormType.validator()`.
+ * 1. `atscript_db_action_input_form` — `{ type, name }` param metadata,
+ *    consumed by `discoverActions` to emit `inputForm: <name>` on the
+ *    action's `/meta` entry and to register the schema for
+ *    `GET /meta/form/:name`.
+ * 2. `atscript_type` — a generic hook any atscript-aware Moost pipe can read
+ *    without knowing the moost-db-specific key.
+ * 3. **Request-time validation** — the resolver runs
+ *    `FormType.validator(opts).validate(input ?? {})` before the handler
+ *    fires. A failure throws `ValidatorError`, which the controllers' own
+ *    `validationErrorTransform` shapes into the same structured `400`
+ *    envelope as strict-`ids` failures. Absent `input` is validated as `{}`
+ *    (all-optional forms pass; required fields produce per-field errors) and
+ *    the handler always receives an object, never `undefined`. Pass
+ *    `validatorOpts` to tune validation; an app-level `validatorPipe()` may
+ *    re-validate the same value harmlessly.
  *
  * Only one `@InputForm()` per action is supported. To collect multiple
  * structured inputs, compose them into a single `.as` interface and pass an
  * array form on the field whose user-facing intent is "list of items".
  *
  * @param formType A compiled `.as` interface class (carries `.validator()`,
- *                 `.metadata`, etc.).
+ *                 `.metadata`, etc.). Optional — inferred from the param's
+ *                 reflected type when omitted.
+ * @param validatorOpts Options forwarded to `formType.validator()`.
  */
 declare function InputForm<T extends TAtscriptAnnotatedType & {
   readonly name: string;
-}>(formType: T): ParameterDecorator;
+}>(formType?: T, validatorOpts?: Partial<TValidatorOptions>): ParameterDecorator;
 //#endregion
 //#region src/actions/discover.d.ts
 /**

package/dist/index.mjs

@@ -921,7 +921,7 @@ function normalizeOptions(prefixOrOptions) {
 * Builds the shared binding metadata for a decorator invocation: classifies
 * the binding form, computes the static route prefix, and packages a uniform
 * `resolve()` used by both the DI provide factory and the base controller's
-* `super(undefined, app)` fallback.
+* `super(app)` fallback.
 */
 function buildBinding(binding, options, decoratorName) {
 	if (isAnnotatedType(binding)) {
@@ -1040,7 +1040,7 @@ function findReadableBinding(ctor) {
 *
 * Used by {@link AsDbReadableController}'s constructor when `readable` is
 * `undefined` — i.e. a subclass with its own constructor called
-* `super(undefined, app)` instead of forwarding an injected instance.
+* `super(app)` instead of forwarding an injected instance.
 */
 function resolveBoundReadable(ctor) {
 	const binding = findReadableBinding(ctor);
@@ -1095,7 +1095,7 @@ let AsDbReadableController = class AsDbReadableController extends AsReadableCont
 	_quantityRefByPath;
 	/** Paths the adapter vetoes for filtering (e.g. JSON storage on SQL). Symmetric with `/meta` `filterable: false`. */
 	_adapterNonFilterable;
-	constructor(readable, app) {
+	constructor(app, readable) {
 		const resolved = readable ?? resolveBoundReadable(new.target);
 		super(resolved.type, resolved.tableName, app, resolved.isView ? "view" : "table");
 		this.readable = resolved;
@@ -1757,9 +1757,9 @@ __decorate([
 ], AsDbReadableController.prototype, "getOneComposite", null);
 AsDbReadableController = __decorate([
 	Inherit(),
-	__decorateParam(0, Inject(READABLE_DEF)),
-	__decorateParam(0, Optional()),
-	__decorateMetadata("design:paramtypes", [Object, typeof Moost === "undefined" ? Object : Moost])
+	__decorateParam(1, Inject(READABLE_DEF)),
+	__decorateParam(1, Optional()),
+	__decorateMetadata("design:paramtypes", [typeof Moost === "undefined" ? Object : Moost, Object])
 ], AsDbReadableController);
 registerAsDbReadableController(AsDbReadableController);
 //#endregion
@@ -1792,8 +1792,8 @@ let AsDbController = class AsDbController extends AsDbReadableController {
 	get table() {
 		return this.readable;
 	}
-	constructor(table, app) {
-		super(table, app);
+	constructor(app, table) {
+		super(app, table);
 	}
 	buildCrud() {
 		return {
@@ -1955,9 +1955,9 @@ __decorate([
 ], AsDbController.prototype, "removeComposite", null);
 AsDbController = __decorate([
 	Inherit(),
-	__decorateParam(0, Inject(TABLE_DEF)),
-	__decorateParam(0, Optional()),
-	__decorateMetadata("design:paramtypes", [Object, typeof Moost === "undefined" ? Object : Moost])
+	__decorateParam(1, Inject(TABLE_DEF)),
+	__decorateParam(1, Optional()),
+	__decorateMetadata("design:paramtypes", [typeof Moost === "undefined" ? Object : Moost, Object])
 ], AsDbController);
 //#endregion
 //#region src/as-value-help.controller.ts
@@ -2801,40 +2801,82 @@ function classLevelActions(dict, forcedLevel) {
 }
 //#endregion
 //#region src/actions/db-action-input-form.decorator.ts
+/** Human-readable description of a rejected form candidate for the error hint. */
+function describeCandidate(candidate) {
+	if (candidate === void 0) return "undefined — no reflected type (emitDecoratorMetadata off, or a circular import)";
+	if (candidate === Object) return "Object — reflection lost the type (interface/union annotation, or the class was imported with `import type`)";
+	if (typeof candidate === "function") return `class ${candidate.name ?? "<anonymous>"} — not a compiled .as interface`;
+	return typeof candidate;
+}
 /**
 * Parameter decorator that injects the `input` field of the action request
-* envelope (`{ ids?, input? }`) into the handler.
+* envelope (`{ ids?, input? }`) into the handler, **validated** against the
+* action's form.
+*
+* The form type may be passed explicitly — `@InputForm(MyForm)` — or inferred
+* from the parameter's reflected design type when omitted:
+*
+* ```ts
+* @Post("actions/comment")
+* @DbAction("comment", { label: "Comment" })
+* async comment(@InputForm() input: CommentForm) { ... }
+* ```
 *
-* Pairs the resolved value with two pieces of param-level metadata:
+* Inference reads `design:paramtypes`, so it only works when the parameter is
+* annotated with the compiled `.as` class through a VALUE import — an
+* `import type` elides the class and reflection yields `Object`. When the
+* reflected type is unusable, decoration **throws** (fail-loud, at import
+* time) instead of silently serving an action without a form. The explicit
+* argument sidesteps reflection entirely and always wins over the annotation.
 *
-* 1. `atscript_db_action_input_form` — the compiled `.as` class plus its
-*    name, consumed by `discoverActions` to:
-*    - emit `inputForm: FormType.name` on the action's `/meta` entry, and
-*    - register the type in the controller's form registry so
-*      `GET /meta/form/:name` can serve the serialized schema.
-* 2. `atscript_type` — just the type ref, providing a generic hook any
-*    atscript-aware Moost pipe can read without knowing about the
-*    moost-db-specific key.
+* The resolved form drives three things:
 *
-* Validation is intentionally *not* performed here. To validate `input`
-* against `FormType`, install an atscript validator pipe globally
-* (`app.applyGlobalPipes(...)`) or scope it via `@Pipe(...)`. The pipe reads
-* `atscript_type` off the param and runs `FormType.validator()`.
+* 1. `atscript_db_action_input_form` — `{ type, name }` param metadata,
+*    consumed by `discoverActions` to emit `inputForm: <name>` on the
+*    action's `/meta` entry and to register the schema for
+*    `GET /meta/form/:name`.
+* 2. `atscript_type` — a generic hook any atscript-aware Moost pipe can read
+*    without knowing the moost-db-specific key.
+* 3. **Request-time validation** — the resolver runs
+*    `FormType.validator(opts).validate(input ?? {})` before the handler
+*    fires. A failure throws `ValidatorError`, which the controllers' own
+*    `validationErrorTransform` shapes into the same structured `400`
+*    envelope as strict-`ids` failures. Absent `input` is validated as `{}`
+*    (all-optional forms pass; required fields produce per-field errors) and
+*    the handler always receives an object, never `undefined`. Pass
+*    `validatorOpts` to tune validation; an app-level `validatorPipe()` may
+*    re-validate the same value harmlessly.
 *
 * Only one `@InputForm()` per action is supported. To collect multiple
 * structured inputs, compose them into a single `.as` interface and pass an
 * array form on the field whose user-facing intent is "list of items".
 *
 * @param formType A compiled `.as` interface class (carries `.validator()`,
-*                 `.metadata`, etc.).
+*                 `.metadata`, etc.). Optional — inferred from the param's
+*                 reflected type when omitted.
+* @param validatorOpts Options forwarded to `formType.validator()`.
 */
-function InputForm(formType) {
+function InputForm(formType, validatorOpts) {
 	const mate = getMoostMate();
-	const meta = {
-		type: formType,
-		name: formType.name
-	};
-	return ApplyDecorators(mate.decorate("atscript_db_action_input_form", meta), mate.decorate("atscript_type", formType), Resolve(async () => current().get(dbActionInputSlot), "dbActionInputForm"));
+	let resolved;
+	return ApplyDecorators(mate.decorate((paramMeta) => {
+		const candidate = formType ?? paramMeta.type;
+		if (!isAnnotatedType(candidate) || typeof candidate.name !== "string" || typeof candidate.validator !== "function") throw new Error(`@InputForm(${formType ? "…" : ""}) could not resolve the form type: expected a compiled .as interface, got ${describeCandidate(candidate)}. Annotate the parameter with the compiled .as class via a VALUE import, or pass the form explicitly: @InputForm(MyForm).`);
+		resolved = candidate;
+		const meta = {
+			type: resolved,
+			name: resolved.name
+		};
+		return {
+			...paramMeta,
+			atscript_db_action_input_form: meta,
+			atscript_type: resolved
+		};
+	}), Resolve(async () => {
+		const input = await current().get(dbActionInputSlot) ?? {};
+		if (resolved) resolved.validator(validatorOpts).validate(input);
+		return input;
+	}, "dbActionInputForm"));
 }
 //#endregion
 //#region src/actions/per-row.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atscript/moost-db",
-  "version": "0.1.119",
+  "version": "0.1.121",
   "description": "Generic database controller for Moost with Atscript.",
   "keywords": [
     "annotations",
@@ -44,27 +44,27 @@
   },
   "dependencies": {
     "@uniqu/url": "^0.1.7",
-    "@atscript/db-memory": "^0.1.119"
+    "@atscript/db-memory": "^0.1.121"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.84",
-    "@atscript/typescript": "^0.1.84",
-    "@moostjs/event-http": "^0.6.32",
+    "@atscript/core": "^0.1.85",
+    "@atscript/typescript": "^0.1.85",
+    "@moostjs/event-http": "^0.6.33",
     "@uniqu/core": "^0.1.7",
-    "@wooksjs/event-core": "^0.7.20",
-    "@wooksjs/event-http": "^0.7.20",
-    "@wooksjs/http-body": "^0.7.20",
-    "moost": "^0.6.32",
-    "unplugin-atscript": "^0.1.84"
+    "@wooksjs/event-core": "^0.7.21",
+    "@wooksjs/event-http": "^0.7.21",
+    "@wooksjs/http-body": "^0.7.21",
+    "moost": "^0.6.33",
+    "unplugin-atscript": "^0.1.85"
   },
   "peerDependencies": {
-    "@atscript/typescript": "^0.1.84",
-    "@moostjs/event-http": "^0.6.32",
+    "@atscript/typescript": "^0.1.85",
+    "@moostjs/event-http": "^0.6.33",
     "@uniqu/core": "^0.1.7",
-    "@wooksjs/event-core": "^0.7.20",
-    "@wooksjs/http-body": "^0.7.20",
-    "moost": "^0.6.32",
-    "@atscript/db": "^0.1.119"
+    "@wooksjs/event-core": "^0.7.21",
+    "@wooksjs/http-body": "^0.7.21",
+    "moost": "^0.6.33",
+    "@atscript/db": "^0.1.121"
   },
   "scripts": {
     "postinstall": "asc -f dts",