@atscript/moost-db 0.1.120 → 0.1.121

package/dist/index.cjs

@@ -2802,40 +2802,82 @@ function classLevelActions(dict, forcedLevel) {
 }
 //#endregion
 //#region src/actions/db-action-input-form.decorator.ts
+/** Human-readable description of a rejected form candidate for the error hint. */
+function describeCandidate(candidate) {
+	if (candidate === void 0) return "undefined — no reflected type (emitDecoratorMetadata off, or a circular import)";
+	if (candidate === Object) return "Object — reflection lost the type (interface/union annotation, or the class was imported with `import type`)";
+	if (typeof candidate === "function") return `class ${candidate.name ?? "<anonymous>"} — not a compiled .as interface`;
+	return typeof candidate;
+}
 /**
 * Parameter decorator that injects the `input` field of the action request
-* envelope (`{ ids?, input? }`) into the handler.
+* envelope (`{ ids?, input? }`) into the handler, **validated** against the
+* action's form.
+*
+* The form type may be passed explicitly — `@InputForm(MyForm)` — or inferred
+* from the parameter's reflected design type when omitted:
+*
+* ```ts
+* @Post("actions/comment")
+* @DbAction("comment", { label: "Comment" })
+* async comment(@InputForm() input: CommentForm) { ... }
+* ```
 *
-* Pairs the resolved value with two pieces of param-level metadata:
+* Inference reads `design:paramtypes`, so it only works when the parameter is
+* annotated with the compiled `.as` class through a VALUE import — an
+* `import type` elides the class and reflection yields `Object`. When the
+* reflected type is unusable, decoration **throws** (fail-loud, at import
+* time) instead of silently serving an action without a form. The explicit
+* argument sidesteps reflection entirely and always wins over the annotation.
 *
-* 1. `atscript_db_action_input_form` — the compiled `.as` class plus its
-*    name, consumed by `discoverActions` to:
-*    - emit `inputForm: FormType.name` on the action's `/meta` entry, and
-*    - register the type in the controller's form registry so
-*      `GET /meta/form/:name` can serve the serialized schema.
-* 2. `atscript_type` — just the type ref, providing a generic hook any
-*    atscript-aware Moost pipe can read without knowing about the
-*    moost-db-specific key.
+* The resolved form drives three things:
 *
-* Validation is intentionally *not* performed here. To validate `input`
-* against `FormType`, install an atscript validator pipe globally
-* (`app.applyGlobalPipes(...)`) or scope it via `@Pipe(...)`. The pipe reads
-* `atscript_type` off the param and runs `FormType.validator()`.
+* 1. `atscript_db_action_input_form` — `{ type, name }` param metadata,
+*    consumed by `discoverActions` to emit `inputForm: <name>` on the
+*    action's `/meta` entry and to register the schema for
+*    `GET /meta/form/:name`.
+* 2. `atscript_type` — a generic hook any atscript-aware Moost pipe can read
+*    without knowing the moost-db-specific key.
+* 3. **Request-time validation** — the resolver runs
+*    `FormType.validator(opts).validate(input ?? {})` before the handler
+*    fires. A failure throws `ValidatorError`, which the controllers' own
+*    `validationErrorTransform` shapes into the same structured `400`
+*    envelope as strict-`ids` failures. Absent `input` is validated as `{}`
+*    (all-optional forms pass; required fields produce per-field errors) and
+*    the handler always receives an object, never `undefined`. Pass
+*    `validatorOpts` to tune validation; an app-level `validatorPipe()` may
+*    re-validate the same value harmlessly.
 *
 * Only one `@InputForm()` per action is supported. To collect multiple
 * structured inputs, compose them into a single `.as` interface and pass an
 * array form on the field whose user-facing intent is "list of items".
 *
 * @param formType A compiled `.as` interface class (carries `.validator()`,
-*                 `.metadata`, etc.).
+*                 `.metadata`, etc.). Optional — inferred from the param's
+*                 reflected type when omitted.
+* @param validatorOpts Options forwarded to `formType.validator()`.
 */
-function InputForm(formType) {
+function InputForm(formType, validatorOpts) {
 	const mate = (0, moost.getMoostMate)();
-	const meta = {
-		type: formType,
-		name: formType.name
-	};
-	return (0, moost.ApplyDecorators)(mate.decorate("atscript_db_action_input_form", meta), mate.decorate("atscript_type", formType), (0, moost.Resolve)(async () => (0, _wooksjs_event_core.current)().get(dbActionInputSlot), "dbActionInputForm"));
+	let resolved;
+	return (0, moost.ApplyDecorators)(mate.decorate((paramMeta) => {
+		const candidate = formType ?? paramMeta.type;
+		if (!(0, _atscript_typescript_utils.isAnnotatedType)(candidate) || typeof candidate.name !== "string" || typeof candidate.validator !== "function") throw new Error(`@InputForm(${formType ? "…" : ""}) could not resolve the form type: expected a compiled .as interface, got ${describeCandidate(candidate)}. Annotate the parameter with the compiled .as class via a VALUE import, or pass the form explicitly: @InputForm(MyForm).`);
+		resolved = candidate;
+		const meta = {
+			type: resolved,
+			name: resolved.name
+		};
+		return {
+			...paramMeta,
+			atscript_db_action_input_form: meta,
+			atscript_type: resolved
+		};
+	}), (0, moost.Resolve)(async () => {
+		const input = await (0, _wooksjs_event_core.current)().get(dbActionInputSlot) ?? {};
+		if (resolved) resolved.validator(validatorOpts).validate(input);
+		return input;
+	}, "dbActionInputForm"));
 }
 //#endregion
 //#region src/actions/per-row.ts

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { i as resolveDbSpace, n as clearDbSpaces, r as provideDbSpace, t as DEFAULT_DB_SPACE } from "./db-space-registry-CWpYwZ4R.cjs";
-import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializedAnnotatedType, Validator } from "@atscript/typescript/utils";
+import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializedAnnotatedType, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AtscriptDbReadable, AtscriptDbTable, FilterExpr, FlatOf, TCrudOp, TCrudPermissions, TCrudPermissions as TCrudPermissions$1, TDbActionInfo, TDbActionInfo as TDbActionInfo$1, TDbActionIntent, TDbActionIntent as TDbActionIntent$1, TDbActionLevel, TDbActionLevel as TDbActionLevel$1, TDbActionProcessor, TDbFieldMeta, TIdentification, TMetaResponse, Uniquery, UniqueryControls } from "@atscript/db";
 import { HttpError } from "@moostjs/event-http";
 import { Mate, Moost, TConsoleBase, TMateParamMeta, TMoostMetadata } from "moost";
@@ -1056,34 +1056,55 @@ declare function DbRowsActions<TRow = unknown, const D extends Record<string, un
 //#region src/actions/db-action-input-form.decorator.d.ts
 /**
  * Parameter decorator that injects the `input` field of the action request
- * envelope (`{ ids?, input? }`) into the handler.
+ * envelope (`{ ids?, input? }`) into the handler, **validated** against the
+ * action's form.
  *
- * Pairs the resolved value with two pieces of param-level metadata:
+ * The form type may be passed explicitly — `@InputForm(MyForm)` — or inferred
+ * from the parameter's reflected design type when omitted:
  *
- * 1. `atscript_db_action_input_form` — the compiled `.as` class plus its
- *    name, consumed by `discoverActions` to:
- *    - emit `inputForm: FormType.name` on the action's `/meta` entry, and
- *    - register the type in the controller's form registry so
- *      `GET /meta/form/:name` can serve the serialized schema.
- * 2. `atscript_type` — just the type ref, providing a generic hook any
- *    atscript-aware Moost pipe can read without knowing about the
- *    moost-db-specific key.
+ * ```ts
+ * @Post("actions/comment")
+ * @DbAction("comment", { label: "Comment" })
+ * async comment(@InputForm() input: CommentForm) { ... }
+ * ```
+ *
+ * Inference reads `design:paramtypes`, so it only works when the parameter is
+ * annotated with the compiled `.as` class through a VALUE import — an
+ * `import type` elides the class and reflection yields `Object`. When the
+ * reflected type is unusable, decoration **throws** (fail-loud, at import
+ * time) instead of silently serving an action without a form. The explicit
+ * argument sidesteps reflection entirely and always wins over the annotation.
+ *
+ * The resolved form drives three things:
  *
- * Validation is intentionally *not* performed here. To validate `input`
- * against `FormType`, install an atscript validator pipe globally
- * (`app.applyGlobalPipes(...)`) or scope it via `@Pipe(...)`. The pipe reads
- * `atscript_type` off the param and runs `FormType.validator()`.
+ * 1. `atscript_db_action_input_form` — `{ type, name }` param metadata,
+ *    consumed by `discoverActions` to emit `inputForm: <name>` on the
+ *    action's `/meta` entry and to register the schema for
+ *    `GET /meta/form/:name`.
+ * 2. `atscript_type` — a generic hook any atscript-aware Moost pipe can read
+ *    without knowing the moost-db-specific key.
+ * 3. **Request-time validation** — the resolver runs
+ *    `FormType.validator(opts).validate(input ?? {})` before the handler
+ *    fires. A failure throws `ValidatorError`, which the controllers' own
+ *    `validationErrorTransform` shapes into the same structured `400`
+ *    envelope as strict-`ids` failures. Absent `input` is validated as `{}`
+ *    (all-optional forms pass; required fields produce per-field errors) and
+ *    the handler always receives an object, never `undefined`. Pass
+ *    `validatorOpts` to tune validation; an app-level `validatorPipe()` may
+ *    re-validate the same value harmlessly.
  *
  * Only one `@InputForm()` per action is supported. To collect multiple
  * structured inputs, compose them into a single `.as` interface and pass an
  * array form on the field whose user-facing intent is "list of items".
  *
  * @param formType A compiled `.as` interface class (carries `.validator()`,
- *                 `.metadata`, etc.).
+ *                 `.metadata`, etc.). Optional — inferred from the param's
+ *                 reflected type when omitted.
+ * @param validatorOpts Options forwarded to `formType.validator()`.
  */
 declare function InputForm<T extends TAtscriptAnnotatedType & {
   readonly name: string;
-}>(formType: T): ParameterDecorator;
+}>(formType?: T, validatorOpts?: Partial<TValidatorOptions>): ParameterDecorator;
 //#endregion
 //#region src/actions/discover.d.ts
 /**

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { i as resolveDbSpace, n as clearDbSpaces, r as provideDbSpace, t as DEFAULT_DB_SPACE } from "./db-space-registry-CKR6G-hi.mjs";
-import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializedAnnotatedType, Validator } from "@atscript/typescript/utils";
+import { TAtscriptAnnotatedType, TAtscriptDataType, TSerializeOptions, TSerializedAnnotatedType, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { HttpError } from "@moostjs/event-http";
 import { Mate, Moost, TConsoleBase, TMateParamMeta, TMoostMetadata } from "moost";
 import { parseUrl } from "@uniqu/url";
@@ -1056,34 +1056,55 @@ declare function DbRowsActions<TRow = unknown, const D extends Record<string, un
 //#region src/actions/db-action-input-form.decorator.d.ts
 /**
  * Parameter decorator that injects the `input` field of the action request
- * envelope (`{ ids?, input? }`) into the handler.
+ * envelope (`{ ids?, input? }`) into the handler, **validated** against the
+ * action's form.
  *
- * Pairs the resolved value with two pieces of param-level metadata:
+ * The form type may be passed explicitly — `@InputForm(MyForm)` — or inferred
+ * from the parameter's reflected design type when omitted:
  *
- * 1. `atscript_db_action_input_form` — the compiled `.as` class plus its
- *    name, consumed by `discoverActions` to:
- *    - emit `inputForm: FormType.name` on the action's `/meta` entry, and
- *    - register the type in the controller's form registry so
- *      `GET /meta/form/:name` can serve the serialized schema.
- * 2. `atscript_type` — just the type ref, providing a generic hook any
- *    atscript-aware Moost pipe can read without knowing about the
- *    moost-db-specific key.
+ * ```ts
+ * @Post("actions/comment")
+ * @DbAction("comment", { label: "Comment" })
+ * async comment(@InputForm() input: CommentForm) { ... }
+ * ```
+ *
+ * Inference reads `design:paramtypes`, so it only works when the parameter is
+ * annotated with the compiled `.as` class through a VALUE import — an
+ * `import type` elides the class and reflection yields `Object`. When the
+ * reflected type is unusable, decoration **throws** (fail-loud, at import
+ * time) instead of silently serving an action without a form. The explicit
+ * argument sidesteps reflection entirely and always wins over the annotation.
+ *
+ * The resolved form drives three things:
  *
- * Validation is intentionally *not* performed here. To validate `input`
- * against `FormType`, install an atscript validator pipe globally
- * (`app.applyGlobalPipes(...)`) or scope it via `@Pipe(...)`. The pipe reads
- * `atscript_type` off the param and runs `FormType.validator()`.
+ * 1. `atscript_db_action_input_form` — `{ type, name }` param metadata,
+ *    consumed by `discoverActions` to emit `inputForm: <name>` on the
+ *    action's `/meta` entry and to register the schema for
+ *    `GET /meta/form/:name`.
+ * 2. `atscript_type` — a generic hook any atscript-aware Moost pipe can read
+ *    without knowing the moost-db-specific key.
+ * 3. **Request-time validation** — the resolver runs
+ *    `FormType.validator(opts).validate(input ?? {})` before the handler
+ *    fires. A failure throws `ValidatorError`, which the controllers' own
+ *    `validationErrorTransform` shapes into the same structured `400`
+ *    envelope as strict-`ids` failures. Absent `input` is validated as `{}`
+ *    (all-optional forms pass; required fields produce per-field errors) and
+ *    the handler always receives an object, never `undefined`. Pass
+ *    `validatorOpts` to tune validation; an app-level `validatorPipe()` may
+ *    re-validate the same value harmlessly.
  *
  * Only one `@InputForm()` per action is supported. To collect multiple
  * structured inputs, compose them into a single `.as` interface and pass an
  * array form on the field whose user-facing intent is "list of items".
  *
  * @param formType A compiled `.as` interface class (carries `.validator()`,
- *                 `.metadata`, etc.).
+ *                 `.metadata`, etc.). Optional — inferred from the param's
+ *                 reflected type when omitted.
+ * @param validatorOpts Options forwarded to `formType.validator()`.
  */
 declare function InputForm<T extends TAtscriptAnnotatedType & {
   readonly name: string;
-}>(formType: T): ParameterDecorator;
+}>(formType?: T, validatorOpts?: Partial<TValidatorOptions>): ParameterDecorator;
 //#endregion
 //#region src/actions/discover.d.ts
 /**

package/dist/index.mjs

@@ -2801,40 +2801,82 @@ function classLevelActions(dict, forcedLevel) {
 }
 //#endregion
 //#region src/actions/db-action-input-form.decorator.ts
+/** Human-readable description of a rejected form candidate for the error hint. */
+function describeCandidate(candidate) {
+	if (candidate === void 0) return "undefined — no reflected type (emitDecoratorMetadata off, or a circular import)";
+	if (candidate === Object) return "Object — reflection lost the type (interface/union annotation, or the class was imported with `import type`)";
+	if (typeof candidate === "function") return `class ${candidate.name ?? "<anonymous>"} — not a compiled .as interface`;
+	return typeof candidate;
+}
 /**
 * Parameter decorator that injects the `input` field of the action request
-* envelope (`{ ids?, input? }`) into the handler.
+* envelope (`{ ids?, input? }`) into the handler, **validated** against the
+* action's form.
+*
+* The form type may be passed explicitly — `@InputForm(MyForm)` — or inferred
+* from the parameter's reflected design type when omitted:
+*
+* ```ts
+* @Post("actions/comment")
+* @DbAction("comment", { label: "Comment" })
+* async comment(@InputForm() input: CommentForm) { ... }
+* ```
 *
-* Pairs the resolved value with two pieces of param-level metadata:
+* Inference reads `design:paramtypes`, so it only works when the parameter is
+* annotated with the compiled `.as` class through a VALUE import — an
+* `import type` elides the class and reflection yields `Object`. When the
+* reflected type is unusable, decoration **throws** (fail-loud, at import
+* time) instead of silently serving an action without a form. The explicit
+* argument sidesteps reflection entirely and always wins over the annotation.
 *
-* 1. `atscript_db_action_input_form` — the compiled `.as` class plus its
-*    name, consumed by `discoverActions` to:
-*    - emit `inputForm: FormType.name` on the action's `/meta` entry, and
-*    - register the type in the controller's form registry so
-*      `GET /meta/form/:name` can serve the serialized schema.
-* 2. `atscript_type` — just the type ref, providing a generic hook any
-*    atscript-aware Moost pipe can read without knowing about the
-*    moost-db-specific key.
+* The resolved form drives three things:
 *
-* Validation is intentionally *not* performed here. To validate `input`
-* against `FormType`, install an atscript validator pipe globally
-* (`app.applyGlobalPipes(...)`) or scope it via `@Pipe(...)`. The pipe reads
-* `atscript_type` off the param and runs `FormType.validator()`.
+* 1. `atscript_db_action_input_form` — `{ type, name }` param metadata,
+*    consumed by `discoverActions` to emit `inputForm: <name>` on the
+*    action's `/meta` entry and to register the schema for
+*    `GET /meta/form/:name`.
+* 2. `atscript_type` — a generic hook any atscript-aware Moost pipe can read
+*    without knowing the moost-db-specific key.
+* 3. **Request-time validation** — the resolver runs
+*    `FormType.validator(opts).validate(input ?? {})` before the handler
+*    fires. A failure throws `ValidatorError`, which the controllers' own
+*    `validationErrorTransform` shapes into the same structured `400`
+*    envelope as strict-`ids` failures. Absent `input` is validated as `{}`
+*    (all-optional forms pass; required fields produce per-field errors) and
+*    the handler always receives an object, never `undefined`. Pass
+*    `validatorOpts` to tune validation; an app-level `validatorPipe()` may
+*    re-validate the same value harmlessly.
 *
 * Only one `@InputForm()` per action is supported. To collect multiple
 * structured inputs, compose them into a single `.as` interface and pass an
 * array form on the field whose user-facing intent is "list of items".
 *
 * @param formType A compiled `.as` interface class (carries `.validator()`,
-*                 `.metadata`, etc.).
+*                 `.metadata`, etc.). Optional — inferred from the param's
+*                 reflected type when omitted.
+* @param validatorOpts Options forwarded to `formType.validator()`.
 */
-function InputForm(formType) {
+function InputForm(formType, validatorOpts) {
 	const mate = getMoostMate();
-	const meta = {
-		type: formType,
-		name: formType.name
-	};
-	return ApplyDecorators(mate.decorate("atscript_db_action_input_form", meta), mate.decorate("atscript_type", formType), Resolve(async () => current().get(dbActionInputSlot), "dbActionInputForm"));
+	let resolved;
+	return ApplyDecorators(mate.decorate((paramMeta) => {
+		const candidate = formType ?? paramMeta.type;
+		if (!isAnnotatedType(candidate) || typeof candidate.name !== "string" || typeof candidate.validator !== "function") throw new Error(`@InputForm(${formType ? "…" : ""}) could not resolve the form type: expected a compiled .as interface, got ${describeCandidate(candidate)}. Annotate the parameter with the compiled .as class via a VALUE import, or pass the form explicitly: @InputForm(MyForm).`);
+		resolved = candidate;
+		const meta = {
+			type: resolved,
+			name: resolved.name
+		};
+		return {
+			...paramMeta,
+			atscript_db_action_input_form: meta,
+			atscript_type: resolved
+		};
+	}), Resolve(async () => {
+		const input = await current().get(dbActionInputSlot) ?? {};
+		if (resolved) resolved.validator(validatorOpts).validate(input);
+		return input;
+	}, "dbActionInputForm"));
 }
 //#endregion
 //#region src/actions/per-row.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atscript/moost-db",
-  "version": "0.1.120",
+  "version": "0.1.121",
   "description": "Generic database controller for Moost with Atscript.",
   "keywords": [
     "annotations",
@@ -44,27 +44,27 @@
   },
   "dependencies": {
     "@uniqu/url": "^0.1.7",
-    "@atscript/db-memory": "^0.1.120"
+    "@atscript/db-memory": "^0.1.121"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.84",
-    "@atscript/typescript": "^0.1.84",
-    "@moostjs/event-http": "^0.6.32",
+    "@atscript/core": "^0.1.85",
+    "@atscript/typescript": "^0.1.85",
+    "@moostjs/event-http": "^0.6.33",
     "@uniqu/core": "^0.1.7",
-    "@wooksjs/event-core": "^0.7.20",
-    "@wooksjs/event-http": "^0.7.20",
-    "@wooksjs/http-body": "^0.7.20",
-    "moost": "^0.6.32",
-    "unplugin-atscript": "^0.1.84"
+    "@wooksjs/event-core": "^0.7.21",
+    "@wooksjs/event-http": "^0.7.21",
+    "@wooksjs/http-body": "^0.7.21",
+    "moost": "^0.6.33",
+    "unplugin-atscript": "^0.1.85"
   },
   "peerDependencies": {
-    "@atscript/typescript": "^0.1.84",
-    "@moostjs/event-http": "^0.6.32",
+    "@atscript/typescript": "^0.1.85",
+    "@moostjs/event-http": "^0.6.33",
     "@uniqu/core": "^0.1.7",
-    "@wooksjs/event-core": "^0.7.20",
-    "@wooksjs/http-body": "^0.7.20",
-    "moost": "^0.6.32",
-    "@atscript/db": "^0.1.120"
+    "@wooksjs/event-core": "^0.7.21",
+    "@wooksjs/http-body": "^0.7.21",
+    "moost": "^0.6.33",
+    "@atscript/db": "^0.1.121"
   },
   "scripts": {
     "postinstall": "asc -f dts",