@heliosjs/middlewares 10.0.5 → 10.0.7

package/dist/catch.d.ts

@@ -1,29 +1,32 @@
 import type { ErrorHandler } from '@heliosjs/core/types';
 /**
- * Decorator to register a global or controller-level error handler.
+ * Registers an error handler on a controller class or a single route method. It
+ * fires when a guard, pipe, middleware, handler, or interceptor throws.
  *
- * This decorator accepts an error handling callback function which will be invoked
- * whenever an error occurs within the decorated target's scope (e.g., controller or service).
- * It attaches the handler as metadata on the target class, allowing the framework to
- * retrieve and execute the error handler appropriately during runtime.
+ * Handlers run newest-first (method-level before controller-level). The first one
+ * that **returns a non-Error value** stops the chain and that value becomes the
+ * response body; a handler that returns an `Error` or re-throws passes control to
+ * the next handler, and if none resolves the error it propagates to the adapter's
+ * default error response.
  *
- * @param {ErrorHandler} handler - The error callback function to handle errors.
+ * Declaring `@Catch` also opts the route into handling the "self-resolving" error
+ * codes (`FORBIDDEN`, `NOT_FOUND`, `RATE_LIMIT_EXCEEDED`, `UNAUTHORIZED`) that
+ * otherwise bypass error handlers.
  *
- * @returns {Function} A class decorator function that defines the error handler metadata.
+ * @param handler - `(error, req, res) => unknown`. `error` is the thrown value
+ *   (often a `HeliosError` subclass with `.code` / `.status`). Return a value to
+ *   answer the request, or return/throw an `Error` to defer. May be async. Why:
+ *   map domain errors to response shapes in one place.
+ *
+ * @returns A class or method decorator.
  *
  * @example
- * // Register a global error handler for a controller
- * @Catch(async (error, context) => {
- *   console.error('Error caught:', error);
- *   // Custom error handling logic
+ * ```ts
+ * @Catch((err, req, res) => {
+ *   if (err instanceof NotFoundError) return { error: 'not found', path: req.path };
+ *   throw err; // let the framework handle everything else
  * })
- * class MyController {
- *   // ...
- * }
- *
- * @remarks
- * The metadata key used for storing the error handler is defined by `CATCH`.
- * This metadata is accessible via Reflect API and used internally by the framework
- * to invoke the registered error handler when errors occur.
+ * class MyController {}
+ * ```
  */
-export declare function Catch(handler: ErrorHandler): (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => void;
+export declare function Catch(handler: ErrorHandler): (target: any, propertyKey?: string, _descriptor?: PropertyDescriptor) => void;

package/dist/catch.js

@@ -3,36 +3,39 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Catch = Catch;
 const utils_1 = require("@heliosjs/core/utils");
 /**
- * Decorator to register a global or controller-level error handler.
+ * Registers an error handler on a controller class or a single route method. It
+ * fires when a guard, pipe, middleware, handler, or interceptor throws.
  *
- * This decorator accepts an error handling callback function which will be invoked
- * whenever an error occurs within the decorated target's scope (e.g., controller or service).
- * It attaches the handler as metadata on the target class, allowing the framework to
- * retrieve and execute the error handler appropriately during runtime.
+ * Handlers run newest-first (method-level before controller-level). The first one
+ * that **returns a non-Error value** stops the chain and that value becomes the
+ * response body; a handler that returns an `Error` or re-throws passes control to
+ * the next handler, and if none resolves the error it propagates to the adapter's
+ * default error response.
  *
- * @param {ErrorHandler} handler - The error callback function to handle errors.
+ * Declaring `@Catch` also opts the route into handling the "self-resolving" error
+ * codes (`FORBIDDEN`, `NOT_FOUND`, `RATE_LIMIT_EXCEEDED`, `UNAUTHORIZED`) that
+ * otherwise bypass error handlers.
  *
- * @returns {Function} A class decorator function that defines the error handler metadata.
+ * @param handler - `(error, req, res) => unknown`. `error` is the thrown value
+ *   (often a `HeliosError` subclass with `.code` / `.status`). Return a value to
+ *   answer the request, or return/throw an `Error` to defer. May be async. Why:
+ *   map domain errors to response shapes in one place.
+ *
+ * @returns A class or method decorator.
  *
  * @example
- * // Register a global error handler for a controller
- * @Catch(async (error, context) => {
- *   console.error('Error caught:', error);
- *   // Custom error handling logic
+ * ```ts
+ * @Catch((err, req, res) => {
+ *   if (err instanceof NotFoundError) return { error: 'not found', path: req.path };
+ *   throw err; // let the framework handle everything else
  * })
- * class MyController {
- *   // ...
- * }
- *
- * @remarks
- * The metadata key used for storing the error handler is defined by `CATCH`.
- * This metadata is accessible via Reflect API and used internally by the framework
- * to invoke the registered error handler when errors occur.
+ * class MyController {}
+ * ```
  */
 function Catch(handler) {
-    return function (target, propertyKey, descriptor) {
+    return function (target, propertyKey, _descriptor) {
         const data = [{ errorHandler: handler }];
-        if (descriptor) {
+        if (propertyKey) {
             (0, utils_1.defineMiddlewaresMeta)(data, target, propertyKey);
         }
         else {

package/dist/catch.js.map

@@ -1 +1 @@
-{"version":3,"file":"catch.js","sourceRoot":"","sources":["../src/catch.ts"],"names":[],"mappings":";;AA6BA,sBAUC;AAtCD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,SAAgB,KAAK,CAAC,OAAqB;IACzC,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,UAA+B;QACjF,MAAM,IAAI,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzC,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"catch.js","sourceRoot":"","sources":["../src/catch.ts"],"names":[],"mappings":";;AAgCA,sBAUC;AAzCD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,SAAgB,KAAK,CAAC,OAAqB;IACzC,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,WAAgC;QAClF,MAAM,IAAI,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QAEzC,IAAI,WAAW,EAAE,CAAC;YAChB,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/cors.d.ts

@@ -1,37 +1,42 @@
 import type { CORSConfig } from '@heliosjs/core/types';
 /**
- * Decorator to configure Cross-Origin Resource Sharing (CORS) settings for HTTP controllers or methods.
+ * Configures Cross-Origin Resource Sharing for a controller class or a single
+ * route method. On a preflight (`OPTIONS`) request the response is answered
+ * directly with the negotiated CORS headers and `optionsSuccessStatus`; on a
+ * real request a disallowed origin is rejected with HTTP 403.
  *
- * This decorator allows you to specify CORS policies such as allowed origins, HTTP methods, and
- * the status code to return for successful OPTIONS requests. It can be applied at the class level
- * to affect all endpoints within a controller or at the method level to customize CORS for specific endpoints.
+ * Unspecified keys fall back to: `origin: '*'`, `optionsSuccessStatus: 204`,
+ * `methods:` every HTTP method Helios knows.
  *
- * When applied, the decorator defines metadata on the target (class prototype or method) which can be
- * later retrieved by the framework to enforce CORS policies during request handling.
+ * @param config - CORS options (all optional):
+ *   - `origin` — `string`, `string[]`, or `(origin) => boolean`. `'*'` allows
+ *     any origin; a list allows exact matches; a function decides per request.
+ *     Why: the allow-list is the core of the policy.
+ *   - `methods` — allowed methods for `Access-Control-Allow-Methods`, e.g.
+ *     `['GET', 'POST']`. Why: advertise only what the route group supports.
+ *   - `allowedHeaders` — value for `Access-Control-Allow-Headers` (request
+ *     headers the browser may send). Why: without this, custom headers like
+ *     `Authorization` are blocked on cross-origin calls.
+ *   - `exposedHeaders` — response headers JS may read
+ *     (`Access-Control-Expose-Headers`). Why: e.g. expose `X-Total-Count`.
+ *   - `credentials` — when `true`, sets `Access-Control-Allow-Credentials: true`
+ *     so cookies / `Authorization` are sent. Why: required for cookie auth;
+ *     cannot be combined with `origin: '*'` per the spec.
+ *   - `maxAge` — seconds a browser may cache the preflight result. Why: fewer
+ *     `OPTIONS` round-trips.
+ *   - `optionsSuccessStatus` — status for a successful preflight (default `204`;
+ *     use `200` for legacy browsers that choke on 204).
  *
- * @param {CORSConfig} [config={}] - Configuration object for CORS settings.
- * @param {string|string[]} [config.origin='*'] - Specifies the allowed origin(s) for CORS requests. Defaults to '*'.
- * @param {number} [config.optionsSuccessStatus=204] - HTTP status code to return for successful OPTIONS requests.
- * @param {string[]} [config.methods=Object.keys(HTTP_METHODS)] - Array of allowed HTTP methods for CORS.
- *
- * @returns {Function} A decorator function that applies the CORS configuration metadata.
- *
- * @example
- * // Apply CORS with default settings to all endpoints in a controller
- * @Cors()
- * class MyController {
- *   // ...
- * }
+ * @returns A class or method decorator.
  *
  * @example
- * // Apply CORS with custom settings to a specific method
- * @Cors({ origin: 'https://example.com', methods: ['GET', 'POST'] })
- * async myMethod() {
- *   // ...
- * }
- *
- * @remarks
- * The metadata key used for storing the CORS configuration is defined by `CORS_METADATA`.
- * This metadata is accessible via Reflect API and used internally by the framework to enforce CORS.
+ * ```ts
+ * @Cors({
+ *   origin: ['https://app.example.com'],
+ *   methods: ['GET', 'POST'],
+ *   credentials: true,
+ * })
+ * class ApiController {}
+ * ```
  */
-export declare function Cors(config?: CORSConfig): (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => void;
+export declare function Cors(config?: CORSConfig): (target: any, propertyKey?: string, _descriptor?: PropertyDescriptor) => void;

package/dist/cors.js

@@ -4,42 +4,47 @@ exports.Cors = Cors;
 const types_1 = require("@heliosjs/core/types");
 const utils_1 = require("@heliosjs/core/utils");
 /**
- * Decorator to configure Cross-Origin Resource Sharing (CORS) settings for HTTP controllers or methods.
+ * Configures Cross-Origin Resource Sharing for a controller class or a single
+ * route method. On a preflight (`OPTIONS`) request the response is answered
+ * directly with the negotiated CORS headers and `optionsSuccessStatus`; on a
+ * real request a disallowed origin is rejected with HTTP 403.
  *
- * This decorator allows you to specify CORS policies such as allowed origins, HTTP methods, and
- * the status code to return for successful OPTIONS requests. It can be applied at the class level
- * to affect all endpoints within a controller or at the method level to customize CORS for specific endpoints.
+ * Unspecified keys fall back to: `origin: '*'`, `optionsSuccessStatus: 204`,
+ * `methods:` every HTTP method Helios knows.
  *
- * When applied, the decorator defines metadata on the target (class prototype or method) which can be
- * later retrieved by the framework to enforce CORS policies during request handling.
+ * @param config - CORS options (all optional):
+ *   - `origin` — `string`, `string[]`, or `(origin) => boolean`. `'*'` allows
+ *     any origin; a list allows exact matches; a function decides per request.
+ *     Why: the allow-list is the core of the policy.
+ *   - `methods` — allowed methods for `Access-Control-Allow-Methods`, e.g.
+ *     `['GET', 'POST']`. Why: advertise only what the route group supports.
+ *   - `allowedHeaders` — value for `Access-Control-Allow-Headers` (request
+ *     headers the browser may send). Why: without this, custom headers like
+ *     `Authorization` are blocked on cross-origin calls.
+ *   - `exposedHeaders` — response headers JS may read
+ *     (`Access-Control-Expose-Headers`). Why: e.g. expose `X-Total-Count`.
+ *   - `credentials` — when `true`, sets `Access-Control-Allow-Credentials: true`
+ *     so cookies / `Authorization` are sent. Why: required for cookie auth;
+ *     cannot be combined with `origin: '*'` per the spec.
+ *   - `maxAge` — seconds a browser may cache the preflight result. Why: fewer
+ *     `OPTIONS` round-trips.
+ *   - `optionsSuccessStatus` — status for a successful preflight (default `204`;
+ *     use `200` for legacy browsers that choke on 204).
  *
- * @param {CORSConfig} [config={}] - Configuration object for CORS settings.
- * @param {string|string[]} [config.origin='*'] - Specifies the allowed origin(s) for CORS requests. Defaults to '*'.
- * @param {number} [config.optionsSuccessStatus=204] - HTTP status code to return for successful OPTIONS requests.
- * @param {string[]} [config.methods=Object.keys(HTTP_METHODS)] - Array of allowed HTTP methods for CORS.
- *
- * @returns {Function} A decorator function that applies the CORS configuration metadata.
- *
- * @example
- * // Apply CORS with default settings to all endpoints in a controller
- * @Cors()
- * class MyController {
- *   // ...
- * }
+ * @returns A class or method decorator.
  *
  * @example
- * // Apply CORS with custom settings to a specific method
- * @Cors({ origin: 'https://example.com', methods: ['GET', 'POST'] })
- * async myMethod() {
- *   // ...
- * }
- *
- * @remarks
- * The metadata key used for storing the CORS configuration is defined by `CORS_METADATA`.
- * This metadata is accessible via Reflect API and used internally by the framework to enforce CORS.
+ * ```ts
+ * @Cors({
+ *   origin: ['https://app.example.com'],
+ *   methods: ['GET', 'POST'],
+ *   credentials: true,
+ * })
+ * class ApiController {}
+ * ```
  */
 function Cors(config = {}) {
-    return function (target, propertyKey, descriptor) {
+    return function (target, propertyKey, _descriptor) {
         const defaultConfig = {
             origin: '*',
             optionsSuccessStatus: 204,
@@ -47,7 +52,7 @@ function Cors(config = {}) {
         };
         const finalConfig = { ...defaultConfig, ...config };
         const data = [{ cors: finalConfig }];
-        if (descriptor) {
+        if (propertyKey) {
             (0, utils_1.defineMiddlewaresMeta)(data, target, propertyKey);
         }
         else {

package/dist/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":";;AAsCA,oBAkBC;AAvDD,gDAAoD;AACpD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,SAAgB,IAAI,CAAC,SAAqB,EAAE;IAC1C,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,UAA+B;QACjF,MAAM,aAAa,GAAe;YAChC,MAAM,EAAE,GAAG;YACX,oBAAoB,EAAE,GAAG;YACzB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAY,CAAC;SACnC,CAAC;QAEF,MAAM,WAAW,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC;QAEpD,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAErC,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":";;AA2CA,oBAkBC;AA5DD,gDAAoD;AACpD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,SAAgB,IAAI,CAAC,SAAqB,EAAE;IAC1C,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,WAAgC;QAClF,MAAM,aAAa,GAAe;YAChC,MAAM,EAAE,GAAG;YACX,oBAAoB,EAAE,GAAG;YACzB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAY,CAAC;SACnC,CAAC;QAEF,MAAM,WAAW,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,EAAE,CAAC;QAEpD,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAErC,IAAI,WAAW,EAAE,CAAC;YAChB,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/guard.d.ts

@@ -1,45 +1,42 @@
 import type { GuardFunction, GuardInstance } from '@heliosjs/core/types';
 import { type GuardClass } from '@heliosjs/core/types';
 /**
- * Decorator to register a guard.
- *
- * Guards are used to control access to a controller by validating
- * incoming requests before they reach route handlers. If a guard
- * returns `false`, the request is blocked.
- *
- * @param guard - A guard class or function used to determine whether
- * the request is allowed to proceed.
- *
- * @returns A class decorator that attaches guard metadata to the target.
- *
- * @example
- * // Using function guard
- * @GuardClass((req, res) => {
- *   return !!req.headers.authorization;
- * })
- * class MyController {}
+ * Registers a guard on a controller class or a single route method. Guards run
+ * before pipes, middlewares, and the handler; use them for authentication and
+ * authorization checks.
+ *
+ * A guard grants access by returning `true` and denies by returning `false` or a
+ * `string`. On denial the request is rejected with `ForbiddenError` (HTTP 403);
+ * a returned string becomes the error message (falling back to
+ * `guard.message`, then `"Forbidden"`). Guards may be async.
+ *
+ * @param guard - One of:
+ *   - a **function** `(req, res) => boolean | string | Promise<boolean | string>`;
+ *   - a **class** with a `canActivate(req, res)` method (instantiated per request,
+ *     may expose a `message` property for the denial text);
+ *   - an already-constructed **instance** with `canActivate` (and optional
+ *     `message`).
+ *   Why: pick the lightest form — a closure for simple checks, a class when the
+ *   guard needs its own dependencies.
+ *
+ * @returns A class or method decorator.
  *
  * @example
- * // Using class-based guard
- * class AuthGuard {
- *   canActivate(req: Request, res: Response) {
- *     return !!req.headers.authorization;
+ * ```ts
+ * @Guard((req) => !!req.getHeader('authorization') || 'Missing token')
+ * class SecureController {}
+ *
+ * class RoleGuard {
+ *   message = 'Admins only';
+ *   canActivate(req: Request) {
+ *     return req.getState('role') === 'admin';
  *   }
  * }
  *
- * @GuardClass(AuthGuard)
- * class MyController {}
- *
- * @remarks
- * Guards are executed before controller methods.
- * They can be used for:
- * - authentication
- * - authorization
- * - request validation
- *
- * If any guard returns `false`, the request handling is stopped.
- *
- * Metadata is stored under the CONTROLLER_CONFIGURATION key and used
- * internally by the framework during request processing.
+ * class AdminController {
+ *   @Guard(RoleGuard)
+ *   deleteEverything() {}
+ * }
+ * ```
  */
-export declare function Guard(guard: GuardClass | GuardFunction | GuardInstance): (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => void;
+export declare function Guard(guard: GuardClass | GuardFunction | GuardInstance): (target: any, propertyKey?: string, _descriptor?: PropertyDescriptor) => void;

package/dist/guard.js

@@ -3,51 +3,48 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Guard = Guard;
 const utils_1 = require("@heliosjs/core/utils");
 /**
- * Decorator to register a guard.
- *
- * Guards are used to control access to a controller by validating
- * incoming requests before they reach route handlers. If a guard
- * returns `false`, the request is blocked.
- *
- * @param guard - A guard class or function used to determine whether
- * the request is allowed to proceed.
- *
- * @returns A class decorator that attaches guard metadata to the target.
- *
- * @example
- * // Using function guard
- * @GuardClass((req, res) => {
- *   return !!req.headers.authorization;
- * })
- * class MyController {}
+ * Registers a guard on a controller class or a single route method. Guards run
+ * before pipes, middlewares, and the handler; use them for authentication and
+ * authorization checks.
+ *
+ * A guard grants access by returning `true` and denies by returning `false` or a
+ * `string`. On denial the request is rejected with `ForbiddenError` (HTTP 403);
+ * a returned string becomes the error message (falling back to
+ * `guard.message`, then `"Forbidden"`). Guards may be async.
+ *
+ * @param guard - One of:
+ *   - a **function** `(req, res) => boolean | string | Promise<boolean | string>`;
+ *   - a **class** with a `canActivate(req, res)` method (instantiated per request,
+ *     may expose a `message` property for the denial text);
+ *   - an already-constructed **instance** with `canActivate` (and optional
+ *     `message`).
+ *   Why: pick the lightest form — a closure for simple checks, a class when the
+ *   guard needs its own dependencies.
+ *
+ * @returns A class or method decorator.
  *
  * @example
- * // Using class-based guard
- * class AuthGuard {
- *   canActivate(req: Request, res: Response) {
- *     return !!req.headers.authorization;
+ * ```ts
+ * @Guard((req) => !!req.getHeader('authorization') || 'Missing token')
+ * class SecureController {}
+ *
+ * class RoleGuard {
+ *   message = 'Admins only';
+ *   canActivate(req: Request) {
+ *     return req.getState('role') === 'admin';
  *   }
  * }
  *
- * @GuardClass(AuthGuard)
- * class MyController {}
- *
- * @remarks
- * Guards are executed before controller methods.
- * They can be used for:
- * - authentication
- * - authorization
- * - request validation
- *
- * If any guard returns `false`, the request handling is stopped.
- *
- * Metadata is stored under the CONTROLLER_CONFIGURATION key and used
- * internally by the framework during request processing.
+ * class AdminController {
+ *   @Guard(RoleGuard)
+ *   deleteEverything() {}
+ * }
+ * ```
  */
 function Guard(guard) {
-    return function (target, propertyKey, descriptor) {
+    return function (target, propertyKey, _descriptor) {
         const data = [{ guard: guard }];
-        if (descriptor) {
+        if (propertyKey) {
             (0, utils_1.defineMiddlewaresMeta)(data, target, propertyKey);
         }
         else {

package/dist/guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":";;AA6CA,sBAUC;AArDD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,SAAgB,KAAK,CAAC,KAAiD;IACrE,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,UAA+B;QACjF,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhC,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":";;AA0CA,sBAUC;AAlDD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,SAAgB,KAAK,CAAC,KAAiD;IACrE,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,WAAgC;QAClF,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAEhC,IAAI,WAAW,EAAE,CAAC;YAChB,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/interceptor.d.ts

@@ -2,37 +2,33 @@ import type { InterceptorCB } from '@heliosjs/core/types';
 /**
  * Decorator to register an interceptor at the controller or method level.
  *
- * Interceptors are functions that wrap the execution of a route handler.
- * They can run logic before after the handler is executed, allowing
- * you to modify  responses, or handle cross-cutting concerns.
+ * An interceptor runs *after* the route handler. It receives the value the
+ * handler returned and whatever it returns becomes the new response payload,
+ * so it is the place for response shaping, wrapping, or caching.
  *
- * @param handler - Interceptor callback function.
+ * Signature: `(data, req, res) => newData` (may be async). Interceptors run
+ * regardless of whether the handler returned a value, including `undefined`.
+ *
+ * @param interceptor - `(data, req, res) => newData` callback.
  *
  * @returns A decorator that attaches interceptor metadata to the target
  * (either a class or a method).
  *
  * @example
- * // Logging interceptor
- * @Intercept(async (ctx, next) => {
- *   console.log('Before');
- *   const result = await next();
- *   console.log('After');
- *   return result;
- * })
+ * // Wrap every response body
+ * @Intercept((data) => ({ data, timestamp: Date.now() }))
  * class MyController {}
  *
  * @example
  * // Method-level interceptor
  * class MyController {
- *   @Intercept(async (ctx, next) => {
- *     return next();
- *   })
+ *   @Intercept(async (data, req) => ({ ...data, path: req.path }))
  *   getData() {}
  * }
  *
  * @remarks
- * - Interceptors can modify the result returned by the handler.
- * - They are executed in the order they are applied.
+ * - Interceptors replace the result returned by the handler.
+ * - Multiple interceptors run in reverse order (the one nearest the handler first).
  * - Can be used for:
  *   - logging
  *   - response transformation
@@ -42,4 +38,4 @@ import type { InterceptorCB } from '@heliosjs/core/types';
  * Metadata is stored using the MIDDLEWARES_CONFIG key and
  * used internally by the framework during request processing.
  */
-export declare function Intercept(interceptor: InterceptorCB): (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => void;
+export declare function Intercept(interceptor: InterceptorCB): (target: any, propertyKey?: string, _descriptor?: PropertyDescriptor) => void;

package/dist/interceptor.js

@@ -5,37 +5,33 @@ const utils_1 = require("@heliosjs/core/utils");
 /**
  * Decorator to register an interceptor at the controller or method level.
  *
- * Interceptors are functions that wrap the execution of a route handler.
- * They can run logic before after the handler is executed, allowing
- * you to modify  responses, or handle cross-cutting concerns.
+ * An interceptor runs *after* the route handler. It receives the value the
+ * handler returned and whatever it returns becomes the new response payload,
+ * so it is the place for response shaping, wrapping, or caching.
  *
- * @param handler - Interceptor callback function.
+ * Signature: `(data, req, res) => newData` (may be async). Interceptors run
+ * regardless of whether the handler returned a value, including `undefined`.
+ *
+ * @param interceptor - `(data, req, res) => newData` callback.
  *
  * @returns A decorator that attaches interceptor metadata to the target
  * (either a class or a method).
  *
  * @example
- * // Logging interceptor
- * @Intercept(async (ctx, next) => {
- *   console.log('Before');
- *   const result = await next();
- *   console.log('After');
- *   return result;
- * })
+ * // Wrap every response body
+ * @Intercept((data) => ({ data, timestamp: Date.now() }))
  * class MyController {}
  *
  * @example
  * // Method-level interceptor
  * class MyController {
- *   @Intercept(async (ctx, next) => {
- *     return next();
- *   })
+ *   @Intercept(async (data, req) => ({ ...data, path: req.path }))
  *   getData() {}
  * }
  *
  * @remarks
- * - Interceptors can modify the result returned by the handler.
- * - They are executed in the order they are applied.
+ * - Interceptors replace the result returned by the handler.
+ * - Multiple interceptors run in reverse order (the one nearest the handler first).
  * - Can be used for:
  *   - logging
  *   - response transformation
@@ -46,9 +42,9 @@ const utils_1 = require("@heliosjs/core/utils");
  * used internally by the framework during request processing.
  */
 function Intercept(interceptor) {
-    return function (target, propertyKey, descriptor) {
+    return function (target, propertyKey, _descriptor) {
         const data = [{ interceptor }];
-        if (descriptor) {
+        if (propertyKey) {
             (0, utils_1.defineMiddlewaresMeta)(data, target, propertyKey);
         }
         else {

package/dist/interceptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"interceptor.js","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":";;AA6CA,8BAUC;AAtDD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,SAAgB,SAAS,CAAC,WAA0B;IAClD,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,UAA+B;QACjF,MAAM,IAAI,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QAE/B,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"interceptor.js","sourceRoot":"","sources":["../src/interceptor.ts"],"names":[],"mappings":";;AAyCA,8BAUC;AAlDD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,SAAgB,SAAS,CAAC,WAA0B;IAClD,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,WAAgC;QAClF,MAAM,IAAI,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QAE/B,IAAI,WAAW,EAAE,CAAC;YAChB,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/pipe.d.ts

@@ -1,31 +1,34 @@
 import { type Pipe } from '@heliosjs/core/types';
 /**
- * Decorator to register a data transformation pipe.
+ * Registers a transformation pipe on a controller class or a single route method.
+ * Pipes run after guards and before middlewares; each supplied function replaces
+ * the matching part of the request with its return value, so the handler and its
+ * `@Body()` / `@QueryParam()` decorators see the transformed data.
  *
- * Pipes are used to transform incoming request data before it reaches
- * the route handler. They can be applied at the controller level and
- * modify parts of the request such as body, query, params, or headers.
+ * Use pipes for normalization and coercion (trim, lowercase, `Number(...)`,
+ * defaults). For schema validation prefer a DTO on the param decorator or
+ * `@Sanitize`.
  *
- * @param config - Configuration object containing transformation functions
- * for different parts of the request.
+ * @param pipe - An object with any of these keys, each a
+ *   `(value, request) => value` transformer:
+ *   - `body` — `(body, req) => body`. Why: reshape or clean the parsed body.
+ *   - `query` — `(query, req) => query`, where query is
+ *     `Record<string, string | string[]>`. Why: coerce query strings to the
+ *     types the handler expects.
+ *   - `params` — `(params, req) => params`, `Record<string, string>`. Why:
+ *     normalize path segments (case, padding).
+ *   - `headers` — `(headers, req) => headers`. Why: canonicalize header values.
+ *   Omitted keys leave that part untouched.
  *
- * @returns A class decorator that attaches pipe metadata to the target.
+ * @returns A class or method decorator.
  *
  * @example
+ * ```ts
  * @Pipe({
- *   body: (body) => ({ ...body, name: body.name.trim() }),
- *   query: (query) => ({ ...query, page: Number(query.page) }),
+ *   body: (body) => ({ ...body, name: body.name?.trim() }),
+ *   query: (query) => ({ ...query, page: Number(query.page ?? 1) }),
  * })
  * class MyController {}
- *
- * @remarks
- * Each function in the pipe receives raw data and must return the transformed value.
- * Pipes are executed before controller methods and can be used for:
- * - data normalization
- * - type casting
- * - sanitization
- *
- * Metadata is stored under the CONTROLLER_CONFIGURATION key and later used
- * by the framework during request processing.
+ * ```
  */
-export declare function Pipe(pipe: Pipe): (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => void;
+export declare function Pipe(pipe: Pipe): (target: any, propertyKey?: string, _descriptor?: PropertyDescriptor) => void;

package/dist/pipe.js

@@ -3,38 +3,41 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Pipe = Pipe;
 const utils_1 = require("@heliosjs/core/utils");
 /**
- * Decorator to register a data transformation pipe.
+ * Registers a transformation pipe on a controller class or a single route method.
+ * Pipes run after guards and before middlewares; each supplied function replaces
+ * the matching part of the request with its return value, so the handler and its
+ * `@Body()` / `@QueryParam()` decorators see the transformed data.
  *
- * Pipes are used to transform incoming request data before it reaches
- * the route handler. They can be applied at the controller level and
- * modify parts of the request such as body, query, params, or headers.
+ * Use pipes for normalization and coercion (trim, lowercase, `Number(...)`,
+ * defaults). For schema validation prefer a DTO on the param decorator or
+ * `@Sanitize`.
  *
- * @param config - Configuration object containing transformation functions
- * for different parts of the request.
+ * @param pipe - An object with any of these keys, each a
+ *   `(value, request) => value` transformer:
+ *   - `body` — `(body, req) => body`. Why: reshape or clean the parsed body.
+ *   - `query` — `(query, req) => query`, where query is
+ *     `Record<string, string | string[]>`. Why: coerce query strings to the
+ *     types the handler expects.
+ *   - `params` — `(params, req) => params`, `Record<string, string>`. Why:
+ *     normalize path segments (case, padding).
+ *   - `headers` — `(headers, req) => headers`. Why: canonicalize header values.
+ *   Omitted keys leave that part untouched.
  *
- * @returns A class decorator that attaches pipe metadata to the target.
+ * @returns A class or method decorator.
  *
  * @example
+ * ```ts
  * @Pipe({
- *   body: (body) => ({ ...body, name: body.name.trim() }),
- *   query: (query) => ({ ...query, page: Number(query.page) }),
+ *   body: (body) => ({ ...body, name: body.name?.trim() }),
+ *   query: (query) => ({ ...query, page: Number(query.page ?? 1) }),
  * })
  * class MyController {}
- *
- * @remarks
- * Each function in the pipe receives raw data and must return the transformed value.
- * Pipes are executed before controller methods and can be used for:
- * - data normalization
- * - type casting
- * - sanitization
- *
- * Metadata is stored under the CONTROLLER_CONFIGURATION key and later used
- * by the framework during request processing.
+ * ```
  */
 function Pipe(pipe) {
-    return function (target, propertyKey, descriptor) {
+    return function (target, propertyKey, _descriptor) {
         const data = [{ pipe }];
-        if (descriptor) {
+        if (propertyKey) {
             (0, utils_1.defineMiddlewaresMeta)(data, target, propertyKey);
         }
         else {

package/dist/pipe.js.map

@@ -1 +1 @@
-{"version":3,"file":"pipe.js","sourceRoot":"","sources":["../src/pipe.ts"],"names":[],"mappings":";;AA+BA,oBAUC;AAxCD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,SAAgB,IAAI,CAAC,IAAU;IAC7B,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,UAA+B;QACjF,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAExB,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"pipe.js","sourceRoot":"","sources":["../src/pipe.ts"],"names":[],"mappings":";;AAkCA,oBAUC;AA3CD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAgB,IAAI,CAAC,IAAU;IAC7B,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,WAAgC;QAClF,MAAM,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAExB,IAAI,WAAW,EAAE,CAAC;YAChB,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/roles.d.ts

@@ -26,5 +26,5 @@ export declare function createRolesGuard(required: string[], options: RolesOptio
  * @example
  * @Roles(['admin', 'editor'], { mode: 'all' })  // ALL
  */
-export declare function Roles(...args: (RolesArg | RolesOptions)[]): (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => void;
+export declare function Roles(...args: (RolesArg | RolesOptions)[]): (target: any, propertyKey?: string, _descriptor?: PropertyDescriptor) => void;
 export {};

package/dist/roles.js

@@ -59,9 +59,9 @@ function createRolesGuard(required, options) {
 function Roles(...args) {
     const { roles, options } = normalizeArgs(args);
     const guard = createRolesGuard(roles, options);
-    return function (target, propertyKey, descriptor) {
+    return function (target, propertyKey, _descriptor) {
         const data = [{ guard }];
-        if (descriptor) {
+        if (propertyKey) {
             (0, utils_1.defineMiddlewaresMeta)(data, target, propertyKey);
         }
         else {

package/dist/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../src/roles.ts"],"names":[],"mappings":";;AAYA,gCAQC;AAED,sCAsBC;AAED,4CAoBC;AAiBD,sBAaC;AA/FD,gDAAmG;AAWnG,SAAgB,UAAU,CACxB,QAAkB,EAClB,SAAmB,EACnB,IAAc;IAEd,OAAO,IAAI,KAAK,KAAK;QACnB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,aAAa,CAC3B,IAAiC;IAEjC,IAAI,OAAO,GAAiB,EAAE,CAAC;IAC/B,IAAI,QAAQ,GAAG,IAAI,CAAC;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GACb,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,GAAG,IAAoB,CAAC;QAC/B,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAgB,gBAAgB,CAC9B,QAAkB,EAClB,OAAqB;IAErB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAC;IAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,SAAS,GAAG,IAAA,yBAAiB,GAAE,CAAC;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,yBAAiB,CACzB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAEtE,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,KAAK,CAAC,GAAG,IAAiC;IACxD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE/C,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,UAA+B;QACjF,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzB,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../src/roles.ts"],"names":[],"mappings":";;AAYA,gCAQC;AAED,sCAsBC;AAED,4CAoBC;AAiBD,sBAaC;AA/FD,gDAAmG;AAWnG,SAAgB,UAAU,CACxB,QAAkB,EAClB,SAAmB,EACnB,IAAc;IAEd,OAAO,IAAI,KAAK,KAAK;QACnB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,aAAa,CAC3B,IAAiC;IAEjC,IAAI,OAAO,GAAiB,EAAE,CAAC;IAC/B,IAAI,QAAQ,GAAG,IAAI,CAAC;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,GACb,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpE,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,GAAG,IAAoB,CAAC;QAC/B,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACrC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACnC,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,SAAgB,gBAAgB,CAC9B,QAAkB,EAClB,OAAqB;IAErB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC;IACnC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,mBAAmB,CAAC;IAEvD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,SAAS,GAAG,IAAA,yBAAiB,GAAE,CAAC;QACtC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,yBAAiB,CACzB,4DAA4D,CAC7D,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAEtE,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,KAAK,CAAC,GAAG,IAAiC;IACxD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAE/C,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,WAAgC;QAClF,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAEzB,IAAI,WAAW,EAAE,CAAC;YAChB,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/sanitize.d.ts

@@ -1,40 +1,36 @@
 import type { SanitizerConfig } from '@heliosjs/core/types';
 /**
- * Decorator to apply sanitization configurations to a controller or method.
+ * Runs a Joi schema over one part of the request on a controller class or a
+ * single route method. Sanitizers run first in the pipeline (before guards), so
+ * every later stage sees the cleaned/validated data.
  *
- * This decorator accepts one or more sanitization configuration objects which define
- * how incoming request data should be sanitized before processing. It can be applied
- * at the class level to apply sanitization globally to all methods or at the method level
- * for fine-grained control.
+ * Depending on `action` a config either validates (throws on mismatch),
+ * sanitizes (coerces/strips and writes the result back onto the request), or
+ * both. The `SANITIZER` helper from `@heliosjs/core` provides ready-made Joi
+ * builders (`SANITIZER.string.email()`, `SANITIZER.xss()`, …).
  *
- * The sanitization configurations are stored as metadata on the target or method,
- * which can be retrieved by the framework to perform the actual sanitization during
- * request handling.
+ * @param config - One `SanitizerConfig`, or an array applied in order. Each has:
+ *   - `schema` (**required**) — a `Joi.Schema` to run.
+ *   - `type` (**required**) — which request part to target, one of
+ *     `'body'`, `'query'`, `'params'`, `'headers'`.
+ *   - `action` — `'validate'` (reject on error), `'sanitize'` (transform in
+ *     place), or `'both'`. Default `'both'`.
+ *   - `options` — Joi `ValidationOptions` passed through.
+ *   - `stripUnknown` — drop keys not in the schema.
+ *   Why an array: apply different schemas to different request parts on the same
+ *   route.
  *
- * @param {SanitizerConfig | SanitizerConfig[]} sanitizeConfig - A single or array of sanitization configuration objects.
- *
- * @returns {Function} A decorator function that applies the sanitization metadata.
- *
- * @example
- * // Apply sanitization to all methods in a controller
- * @Sanitize({ trim: true, escape: true })
- * class MyController {
- *   // ...
- * }
+ * @returns A class or method decorator.
  *
  * @example
- * // Apply multiple sanitization rules to a specific method
- * @Sanitize([
- *   { trim: true },
- *   { escape: true }
- * ])
- * async myMethod() {
- *   // ...
- * }
- *
- * @remarks
- * The metadata key used for storing the sanitization configurations is defined by `SANITIZE`.
- * This metadata is accessible via Reflect API and used internally by the framework
- * to apply sanitization logic.
+ * ```ts
+ * @Sanitize({
+ *   type: 'body',
+ *   action: 'both',
+ *   schema: Joi.object({ email: SANITIZER.string.email(), bio: SANITIZER.xss() }),
+ *   stripUnknown: true,
+ * })
+ * class ProfileController {}
+ * ```
  */
-export declare function Sanitize(config: SanitizerConfig | SanitizerConfig[]): (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => void;
+export declare function Sanitize(config: SanitizerConfig | SanitizerConfig[]): (target: any, propertyKey?: string, _descriptor?: PropertyDescriptor) => void;

package/dist/sanitize.js

@@ -3,48 +3,44 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Sanitize = Sanitize;
 const utils_1 = require("@heliosjs/core/utils");
 /**
- * Decorator to apply sanitization configurations to a controller or method.
+ * Runs a Joi schema over one part of the request on a controller class or a
+ * single route method. Sanitizers run first in the pipeline (before guards), so
+ * every later stage sees the cleaned/validated data.
  *
- * This decorator accepts one or more sanitization configuration objects which define
- * how incoming request data should be sanitized before processing. It can be applied
- * at the class level to apply sanitization globally to all methods or at the method level
- * for fine-grained control.
+ * Depending on `action` a config either validates (throws on mismatch),
+ * sanitizes (coerces/strips and writes the result back onto the request), or
+ * both. The `SANITIZER` helper from `@heliosjs/core` provides ready-made Joi
+ * builders (`SANITIZER.string.email()`, `SANITIZER.xss()`, …).
  *
- * The sanitization configurations are stored as metadata on the target or method,
- * which can be retrieved by the framework to perform the actual sanitization during
- * request handling.
+ * @param config - One `SanitizerConfig`, or an array applied in order. Each has:
+ *   - `schema` (**required**) — a `Joi.Schema` to run.
+ *   - `type` (**required**) — which request part to target, one of
+ *     `'body'`, `'query'`, `'params'`, `'headers'`.
+ *   - `action` — `'validate'` (reject on error), `'sanitize'` (transform in
+ *     place), or `'both'`. Default `'both'`.
+ *   - `options` — Joi `ValidationOptions` passed through.
+ *   - `stripUnknown` — drop keys not in the schema.
+ *   Why an array: apply different schemas to different request parts on the same
+ *   route.
  *
- * @param {SanitizerConfig | SanitizerConfig[]} sanitizeConfig - A single or array of sanitization configuration objects.
- *
- * @returns {Function} A decorator function that applies the sanitization metadata.
- *
- * @example
- * // Apply sanitization to all methods in a controller
- * @Sanitize({ trim: true, escape: true })
- * class MyController {
- *   // ...
- * }
+ * @returns A class or method decorator.
  *
  * @example
- * // Apply multiple sanitization rules to a specific method
- * @Sanitize([
- *   { trim: true },
- *   { escape: true }
- * ])
- * async myMethod() {
- *   // ...
- * }
- *
- * @remarks
- * The metadata key used for storing the sanitization configurations is defined by `SANITIZE`.
- * This metadata is accessible via Reflect API and used internally by the framework
- * to apply sanitization logic.
+ * ```ts
+ * @Sanitize({
+ *   type: 'body',
+ *   action: 'both',
+ *   schema: Joi.object({ email: SANITIZER.string.email(), bio: SANITIZER.xss() }),
+ *   stripUnknown: true,
+ * })
+ * class ProfileController {}
+ * ```
  */
 function Sanitize(config) {
-    return function (target, propertyKey, descriptor) {
+    return function (target, propertyKey, _descriptor) {
         const sanitizers = Array.isArray(config) ? config : [config];
         const data = sanitizers.map(sanitizer => ({ sanitizer }));
-        if (descriptor) {
+        if (propertyKey) {
             (0, utils_1.defineMiddlewaresMeta)(data, target, propertyKey);
         }
         else {

package/dist/sanitize.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":";;AAwCA,4BAWC;AAlDD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,SAAgB,QAAQ,CAAC,MAA2C;IAClE,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,UAA+B;QACjF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAE1D,IAAI,UAAU,EAAE,CAAC;YACf,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../src/sanitize.ts"],"names":[],"mappings":";;AAoCA,4BAWC;AA9CD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,SAAgB,QAAQ,CAAC,MAA2C;IAClE,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,WAAgC;QAClF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAE1D,IAAI,WAAW,EAAE,CAAC;YAChB,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/status.d.ts

@@ -1,35 +1,25 @@
 /**
- * Decorator to set the HTTP status code for the response.
+ * Sets the HTTP status code for successful responses from a controller class or a
+ * single route method. Method-level wins over class-level. Without it a
+ * successful handler responds `200` (or the code you set via `res.status`).
  *
- * This decorator can be applied at the method level to specify the HTTP status code
- * that should be returned when the method's response is sent. It can also be applied
- * at the class level to set a default status code for all methods within the class.
+ * This only affects the success path — errors still carry the status of the
+ * thrown `HeliosError`, and an explicit `res.redirect()` keeps its own code.
  *
- * The status code is stored as metadata on the target or method, which can be retrieved
- * by the framework to set the HTTP response status accordingly.
+ * @param status - The HTTP status code to send, e.g. `201` for a create, `202`
+ *   for an accepted async job, `204` for an empty body. Why: express REST
+ *   semantics without touching the `Response` object.
  *
- * @param {number} status - The HTTP status code to set for the response.
- *
- * @returns {Function} A decorator function that applies the status code metadata.
+ * @returns A class or method decorator.
  *
  * @example
- * // Set status code 201 for a specific method
- * @Status(201)
- * async createResource() {
- *   // ...
+ * ```ts
+ * class UserController {
+ *   @Post('/')
+ *   @Status(201)
+ *   create(@Body() dto: CreateUserDto) {}
  * }
- *
- * @example
- * // Set default status code 204 for all methods in a controller
- * @Status(204)
- * class MyController {
- *   // ...
- * }
- *
- * @remarks
- * The metadata key used for storing the status code is defined by `OK_METADATA_KEY`.
- * This metadata is accessible via Reflect API and used internally by the framework
- * to set the HTTP response status.
+ * ```
  */
 export declare function Status(status: number): (target: any, propertyKey?: string) => void;
 /**

package/dist/status.js

@@ -4,43 +4,36 @@ exports.Ok204 = exports.Ok201 = exports.Ok200 = void 0;
 exports.Status = Status;
 const utils_1 = require("@heliosjs/core/utils");
 /**
- * Decorator to set the HTTP status code for the response.
+ * Sets the HTTP status code for successful responses from a controller class or a
+ * single route method. Method-level wins over class-level. Without it a
+ * successful handler responds `200` (or the code you set via `res.status`).
  *
- * This decorator can be applied at the method level to specify the HTTP status code
- * that should be returned when the method's response is sent. It can also be applied
- * at the class level to set a default status code for all methods within the class.
+ * This only affects the success path — errors still carry the status of the
+ * thrown `HeliosError`, and an explicit `res.redirect()` keeps its own code.
  *
- * The status code is stored as metadata on the target or method, which can be retrieved
- * by the framework to set the HTTP response status accordingly.
+ * @param status - The HTTP status code to send, e.g. `201` for a create, `202`
+ *   for an accepted async job, `204` for an empty body. Why: express REST
+ *   semantics without touching the `Response` object.
  *
- * @param {number} status - The HTTP status code to set for the response.
- *
- * @returns {Function} A decorator function that applies the status code metadata.
- *
- * @example
- * // Set status code 201 for a specific method
- * @Status(201)
- * async createResource() {
- *   // ...
- * }
+ * @returns A class or method decorator.
  *
  * @example
- * // Set default status code 204 for all methods in a controller
- * @Status(204)
- * class MyController {
- *   // ...
+ * ```ts
+ * class UserController {
+ *   @Post('/')
+ *   @Status(201)
+ *   create(@Body() dto: CreateUserDto) {}
  * }
- *
- * @remarks
- * The metadata key used for storing the status code is defined by `OK_METADATA_KEY`.
- * This metadata is accessible via Reflect API and used internally by the framework
- * to set the HTTP response status.
+ * ```
  */
 function Status(status) {
     return function (target, propertyKey) {
         if (propertyKey) {
             (0, utils_1.defineMiddlewaresMeta)([{ status }], target, propertyKey);
         }
+        else {
+            (0, utils_1.defineMiddlewaresMeta)([{ status }], target);
+        }
     };
 }
 /**

package/dist/status.js.map

@@ -1 +1 @@
-{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":";;;AAkCA,wBAMC;AAxCD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,SAAgB,MAAM,CAAC,MAAc;IACnC,OAAO,UAAU,MAAW,EAAE,WAAoB;QAChD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAA,6BAAqB,EAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAA1B,QAAA,KAAK,SAAqB;AAEvC;;;;;;;GAOG;AACI,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAA1B,QAAA,KAAK,SAAqB;AAEvC;;;;;;;;GAQG;AACI,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAA1B,QAAA,KAAK,SAAqB"}
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":";;;AAwBA,wBAQC;AAhCD,gDAA6D;AAC7D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,SAAgB,MAAM,CAAC,MAAc;IACnC,OAAO,UAAU,MAAW,EAAE,WAAoB;QAChD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAA,6BAAqB,EAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAA1B,QAAA,KAAK,SAAqB;AAEvC;;;;;;;GAOG;AACI,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAA1B,QAAA,KAAK,SAAqB;AAEvC;;;;;;;;GAQG;AACI,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAA1B,QAAA,KAAK,SAAqB"}

package/dist/use.d.ts

@@ -1,46 +1,27 @@
 import type { MiddlewareCB } from '@heliosjs/core/types';
 /**
- * Decorator to register middleware(s) at the controller or method level.
+ * Registers one or more middlewares on a controller class or a single route
+ * method. Middlewares run before the handler, in declaration order, after guards
+ * and pipes in the request pipeline. Calling `next(err)` with an error aborts the
+ * request; not calling `next` still proceeds (the pipeline advances once the
+ * middleware resolves).
  *
- * Middlewares are functions executed before the route handler.
- * They can be used to:
- * - modify request/response
- * - perform logging
- * - handle authentication/authorization
- * - short-circuit request handling
+ * Applied to a class, the middleware covers every route in it (and its child
+ * controllers); applied to a method, only that route.
  *
- * @param middleware - A single middleware function or an array of middleware functions.
+ * @param middleware - A middleware callback `(req, res, next) => void | Promise<void>`,
+ *   or an array of them applied in order. Why: attach auth, logging, request
+ *   shaping, or short-circuit logic without hand-wiring it into each handler.
  *
- * @returns A decorator that attaches middleware metadata to the target
- * (either a class or a method).
+ * @returns A class or method decorator.
  *
  * @example
- * // Single middleware
- * @Use((req, res, next) => {
- *   console.log('Request received');
- *   next();
- * })
- * class MyController {}
- *
- * @example
- * // Multiple middlewares
- * @Use([
- *   authMiddleware,
- *   loggingMiddleware,
- * ])
- * class MyController {}
- *
- * @example
- * // Method-level middleware
+ * ```ts
+ * @Use([authMiddleware, loggingMiddleware])
  * class MyController {
- *   @Use(authMiddleware)
+ *   @Use(rateLimitMiddleware)
  *   getData() {}
  * }
- *
- * @remarks
- * - Middlewares are executed in the order they are defined.
- * - Can be applied at both class and method levels.
- * - Metadata is stored using the MIDDLEWARES_CONFIG key and used
- *   internally by the framework during request handling.
+ * ```
  */
 export declare function Use(middleware: MiddlewareCB | MiddlewareCB[]): (target: any, propertyKey?: string, descriptor?: PropertyDescriptor) => any;

package/dist/use.js

@@ -3,48 +3,29 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Use = Use;
 const utils_1 = require("@heliosjs/core/utils");
 /**
- * Decorator to register middleware(s) at the controller or method level.
+ * Registers one or more middlewares on a controller class or a single route
+ * method. Middlewares run before the handler, in declaration order, after guards
+ * and pipes in the request pipeline. Calling `next(err)` with an error aborts the
+ * request; not calling `next` still proceeds (the pipeline advances once the
+ * middleware resolves).
  *
- * Middlewares are functions executed before the route handler.
- * They can be used to:
- * - modify request/response
- * - perform logging
- * - handle authentication/authorization
- * - short-circuit request handling
+ * Applied to a class, the middleware covers every route in it (and its child
+ * controllers); applied to a method, only that route.
  *
- * @param middleware - A single middleware function or an array of middleware functions.
+ * @param middleware - A middleware callback `(req, res, next) => void | Promise<void>`,
+ *   or an array of them applied in order. Why: attach auth, logging, request
+ *   shaping, or short-circuit logic without hand-wiring it into each handler.
  *
- * @returns A decorator that attaches middleware metadata to the target
- * (either a class or a method).
+ * @returns A class or method decorator.
  *
  * @example
- * // Single middleware
- * @Use((req, res, next) => {
- *   console.log('Request received');
- *   next();
- * })
- * class MyController {}
- *
- * @example
- * // Multiple middlewares
- * @Use([
- *   authMiddleware,
- *   loggingMiddleware,
- * ])
- * class MyController {}
- *
- * @example
- * // Method-level middleware
+ * ```ts
+ * @Use([authMiddleware, loggingMiddleware])
  * class MyController {
- *   @Use(authMiddleware)
+ *   @Use(rateLimitMiddleware)
  *   getData() {}
  * }
- *
- * @remarks
- * - Middlewares are executed in the order they are defined.
- * - Can be applied at both class and method levels.
- * - Metadata is stored using the MIDDLEWARES_CONFIG key and used
- *   internally by the framework during request handling.
+ * ```
  */
 function Use(middleware) {
     return function (target, propertyKey, descriptor) {

package/dist/use.js.map

@@ -1 +1 @@
-{"version":3,"file":"use.js","sourceRoot":"","sources":["../src/use.ts"],"names":[],"mappings":";;AA+CA,kBAcC;AA5DD,gDAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,SAAgB,GAAG,CAAC,UAAyC;IAC3D,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,UAA+B;QACjF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAE1E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAE/D,IAAI,WAAW,EAAE,CAAC;YAChB,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"use.js","sourceRoot":"","sources":["../src/use.ts"],"names":[],"mappings":";;AA4BA,kBAcC;AAzCD,gDAA6D;AAE7D;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,GAAG,CAAC,UAAyC;IAC3D,OAAO,UAAU,MAAW,EAAE,WAAoB,EAAE,UAA+B;QACjF,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAE1E,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QAE/D,IAAI,WAAW,EAAE,CAAC;YAChB,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACnD,CAAC;aAAM,CAAC;YACN,IAAA,6BAAqB,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heliosjs/middlewares",
-  "version": "10.0.5",
+  "version": "10.0.7",
   "description": "Middlewares for @heliosjs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -30,7 +30,7 @@
     "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
-    "@heliosjs/core": "^3.2.8",
+    "@heliosjs/core": "^3.2.10",
     "@types/node": ">=20.0.0",
     "reflect-metadata": "^0.2.2",
     "typescript": ">=5.0.0"