@ismaelsoilet/synapsejs 1.3.0 → 1.8.0

package/src/compiler/migration-runner.ts

@@ -63,14 +63,114 @@ export interface RollbackOptions {
 }
 
 export function parseBidirectionalDdl(rawDdl: string): BidirectionalDdl {
-  const downMarkerRegex = /^[ \t]*--\s*down:?[ \t]*$/im;
-  const match = downMarkerRegex.exec(rawDdl);
-  if (!match) {
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let inBlockComment = false;
+  let dollarTag: string | null = null;
+  let splitIndex = -1;
+  let matchLength = 0;
+
+  let i = 0;
+  while (i < rawDdl.length) {
+    const char = rawDdl[i];
+    const next = rawDdl[i + 1] ?? '';
+
+    if (inBlockComment) {
+      if (char === '*' && next === '/') {
+        inBlockComment = false;
+        i += 2;
+        continue;
+      }
+      i++;
+      continue;
+    }
+
+    if (inSingleQuote) {
+      if (char === '\\') {
+        i += 2;
+        continue;
+      }
+      if (char === "'") {
+        if (next === "'") {
+          i += 2;
+          continue;
+        }
+        inSingleQuote = false;
+      }
+      i++;
+      continue;
+    }
+
+    if (inDoubleQuote) {
+      if (char === '"') {
+        if (next === '"') {
+          i += 2;
+          continue;
+        }
+        inDoubleQuote = false;
+      }
+      i++;
+      continue;
+    }
+
+    if (dollarTag !== null) {
+      if (char === '$' && rawDdl.startsWith(dollarTag, i)) {
+        i += dollarTag.length;
+        dollarTag = null;
+        continue;
+      }
+      i++;
+      continue;
+    }
+
+    if (char === '/' && next === '*') {
+      inBlockComment = true;
+      i += 2;
+      continue;
+    }
+
+    if (char === "'") {
+      inSingleQuote = true;
+      i++;
+      continue;
+    }
+
+    if (char === '"') {
+      inDoubleQuote = true;
+      i++;
+      continue;
+    }
+
+    if (char === '$') {
+      const match = rawDdl.slice(i).match(/^\$[A-Za-z0-9_]*\$/);
+      if (match) {
+        dollarTag = match[0];
+        i += dollarTag.length;
+        continue;
+      }
+    }
+
+    // Check for -- down: marker at beginning of line outside strings/comments
+    const isLineStart = i === 0 || rawDdl[i - 1] === '\n';
+    if (isLineStart) {
+      const lineSlice = rawDdl.slice(i);
+      const match = lineSlice.match(/^[ \t]*--\s*down:?[ \t]*(?:\r?\n|$)/i);
+      if (match) {
+        splitIndex = i;
+        matchLength = match[0].length;
+        break;
+      }
+    }
+
+    i++;
+  }
+
+  if (splitIndex === -1) {
     return { upDdl: rawDdl.trim(), downDdl: null };
   }
-  const splitIndex = match.index;
+
   const upDdl = rawDdl.slice(0, splitIndex).trim();
-  const downDdl = rawDdl.slice(splitIndex + match[0].length).trim();
+  const downDdl = rawDdl.slice(splitIndex + matchLength).trim();
   return {
     upDdl,
     downDdl: downDdl.length > 0 ? downDdl : null
@@ -91,6 +191,7 @@ export function splitStatements(ddl: string): string[] {
   let inLineComment = false;
   let inBlockComment = false;
   let dollarTag: string | null = null;
+  let beginDepth = 0;
 
   let i = 0;
   while (i < ddl.length) {
@@ -207,8 +308,31 @@ export function splitStatements(ddl: string): string[] {
       }
     }
 
-    // Statement terminator outside strings or comments
-    if (char === ';') {
+    // Track BEGIN ... END blocks (e.g. triggers, compound statements)
+    const remaining = ddl.slice(i);
+    const prevChar = i > 0 ? ddl[i - 1] : ' ';
+    const isWordStart = /[\s,;(]/.test(prevChar);
+
+    if (isWordStart) {
+      const beginMatch = remaining.match(/^BEGIN\b/i);
+      if (beginMatch) {
+        beginDepth++;
+        current += beginMatch[0];
+        i += beginMatch[0].length;
+        continue;
+      }
+
+      const endMatch = remaining.match(/^END\b/i);
+      if (endMatch) {
+        if (beginDepth > 0) beginDepth--;
+        current += endMatch[0];
+        i += endMatch[0].length;
+        continue;
+      }
+    }
+
+    // Statement terminator outside strings or comments, but only when not inside a BEGIN...END block
+    if (char === ';' && beginDepth === 0) {
       const trimmed = current.trim();
       if (trimmed.length > 0) {
         statements.push(trimmed);
@@ -394,14 +518,15 @@ export async function runSliceMigrations(
           status: 'APPLIED',
           statementsApplied: pending.length
         });
-      } catch (err: any) {
+      } catch (err: unknown) {
         hasFailure = true;
+        const errMessage = err instanceof Error ? err.message : String(err);
         migrations.push({
           slice: sliceName,
           filePath: path.relative(baseDir, filePath),
           status: 'FAILED',
           statementsApplied: 0,
-          error: err.message
+          error: errMessage
         });
       }
     }

package/src/compiler/scaffolder.ts

@@ -71,6 +71,9 @@ export const sliceSchema = \`
 ${sqlCols},
     created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
   );
+
+  -- down:
+  DROP TABLE IF EXISTS ${tableName};
 \`;
 
 // ============================================================================
@@ -222,6 +225,9 @@ export const sliceSchema = \`
     email TEXT NOT NULL UNIQUE,
     created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
   );
+
+  -- down:
+  DROP TABLE IF EXISTS ${tableName};
 \`;
 
 // ============================================================================
@@ -513,6 +519,62 @@ export function scaffoldCrud(
   return Ok(created);
 }
 
+/**
+ * Scaffolds a safe shared domain module in `src/shared/<name>.ts`.
+ */
+export function scaffoldShared(name: string, baseDir: string = process.cwd()): Result<string, ScaffoldError> {
+  const cleanName = name.replace(/\.ts$/, '');
+  const sharedDir = path.resolve(baseDir, 'src', 'shared');
+  if (!fs.existsSync(sharedDir)) {
+    fs.mkdirSync(sharedDir, { recursive: true });
+  }
+
+  const targetFile = path.join(sharedDir, `${cleanName}.ts`);
+  if (fs.existsSync(targetFile)) {
+    return Err({
+      code: 'SLICE_EXISTS',
+      message: `O módulo compartilhado "${cleanName}.ts" já existe em ${sharedDir}.`,
+      candidates: [targetFile]
+    });
+  }
+
+  const pascalName = toPascalCase(cleanName);
+  const content = `import type { DatabaseClient, Result } from 'synapsejs';
+import { Ok, Err } from 'synapsejs';
+
+/**
+ * Módulo compartilhado para o domínio ${cleanName}.
+ * Fatias não importam fatias — regras que envolvem múltiplas fatias ou transações cruzadas
+ * residem em src/shared/, recebem o DatabaseClient por parâmetro e abrem db.transaction().
+ */
+export async function executeShared${pascalName}(
+  db: DatabaseClient,
+  params: Record<string, unknown> = {}
+): Promise<Result<{ success: boolean; data?: unknown }, string>> {
+  if (!db) {
+    return Err('NO_DATABASE');
+  }
+
+  return await db.transaction(async (tx) => {
+    // Implemente a lógica transacional entre fatias aqui usando tx
+    return Ok({ success: true, data: params });
+  });
+}
+`;
+
+  try {
+    fs.writeFileSync(targetFile, content, 'utf-8');
+    return Ok(targetFile);
+  } catch (err: unknown) {
+    const message = err instanceof Error ? err.message : String(err);
+    return Err({
+      code: 'WRITE_FAILED',
+      message: `Falha ao escrever módulo compartilhado: ${message}`,
+      candidates: [targetFile]
+    });
+  }
+}
+
 if (import.meta.main) {
   const domain = process.argv[2] || 'core';
   const name = process.argv[3] || 'example-feature';

package/src/compiler/schema-dag.ts

@@ -25,26 +25,30 @@ export function parseTableDependencies(ddl: string): { created: string[]; refere
   const created: string[] = [];
   const referenced: string[] = [];
 
-  // Match CREATE TABLE [IF NOT EXISTS] <name>
-  const createRegex = /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["'`]?([a-zA-Z0-9_]+)["'`]?/gi;
-  let match: RegExpExecArray | null = createRegex.exec(ddl);
+  // Strip SQL comments to avoid false-positive dependencies
+  const cleanDdl = ddl.replace(/--.*$/gm, '').replace(/\/\*[\s\S]*?\*\//g, '');
+
+  // Match CREATE TABLE [IF NOT EXISTS] [schema.]<name>
+  const createRegex =
+    /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:["'`]?[a-zA-Z0-9_]+["'`]?\.)?["'`]?([a-zA-Z0-9_]+)["'`]?/gi;
+  let match: RegExpExecArray | null = createRegex.exec(cleanDdl);
   while (match !== null) {
     const tableName = match[1].toLowerCase();
     if (!created.includes(tableName)) {
       created.push(tableName);
     }
-    match = createRegex.exec(ddl);
+    match = createRegex.exec(cleanDdl);
   }
 
-  // Match REFERENCES <name>
-  const refRegex = /REFERENCES\s+["'`]?([a-zA-Z0-9_]+)["'`]?/gi;
-  let refMatch: RegExpExecArray | null = refRegex.exec(ddl);
+  // Match REFERENCES [schema.]<name>[(columns)]
+  const refRegex = /REFERENCES\s+(?:["'`]?[a-zA-Z0-9_]+["'`]?\.)?["'`]?([a-zA-Z0-9_]+)["'`]?/gi;
+  let refMatch: RegExpExecArray | null = refRegex.exec(cleanDdl);
   while (refMatch !== null) {
     const tableName = refMatch[1].toLowerCase();
     if (!created.includes(tableName) && !referenced.includes(tableName)) {
       referenced.push(tableName);
     }
-    refMatch = refRegex.exec(ddl);
+    refMatch = refRegex.exec(cleanDdl);
   }
 
   return { created, referenced };
@@ -92,9 +96,12 @@ export function orderSlicesByDag(sliceFiles: string[]): string[] {
     for (const refTable of meta.tablesReferenced) {
       const parentFilePath = tableToSlice.get(refTable);
       if (parentFilePath && parentFilePath !== filePath) {
-        // parentFilePath must run before filePath
-        graph.get(parentFilePath)?.push(filePath);
-        inDegree.set(filePath, (inDegree.get(filePath) || 0) + 1);
+        // parentFilePath must run before filePath (prevent duplicate edge)
+        const neighbors = graph.get(parentFilePath);
+        if (neighbors && !neighbors.includes(filePath)) {
+          neighbors.push(filePath);
+          inDegree.set(filePath, (inDegree.get(filePath) || 0) + 1);
+        }
       }
     }
   }

package/src/compiler/slice-splitter.ts

@@ -75,11 +75,31 @@ const SERVER_ONLY_PATTERNS: Array<{ label: string; pattern: RegExp }> = [
   { label: 'UPDATE statement', pattern: /\bUPDATE\s+\w+\s+SET\b/i },
   { label: 'DELETE statement', pattern: /\bDELETE\s+FROM\b/i },
   { label: 'CREATE TABLE statement', pattern: /\bCREATE\s+TABLE\b/i },
+  { label: 'ALTER TABLE statement', pattern: /\bALTER\s+TABLE\b/i },
+  { label: 'DROP TABLE statement', pattern: /\bDROP\s+TABLE\b/i },
   { label: 'database call', pattern: /\bdb\s*\.\s*(?:query|findMany|findOne|insert|update|delete|sql|sqlOne)\b/ },
   { label: 'sliceSchema symbol', pattern: /\bsliceSchema\b/ },
   { label: 'test runner import', pattern: /from\s+['"]bun:test['"]/ },
-  { label: 'process.env access', pattern: /\bprocess\.env\b/ },
-  { label: 'Bun global', pattern: /\bBun\./ }
+  { label: 'process.env access', pattern: /\bprocess\s*(?:\.\s*env|\[\s*['"]env['"]\s*\])/ },
+  { label: 'process destructuring', pattern: /\b(?:const|let|var)\s*\{[^}]*\benv\b[^}]*\}\s*=\s*process\b/ },
+  { label: 'Bun global', pattern: /\bBun(?:\.|\s*\[)/ },
+  {
+    label: 'globalThis server access',
+    pattern: /\bglobalThis\s*(?:\.\s*(?:process|Bun)|\[\s*['"](?:process|Bun)['"]\s*\])/
+  },
+  {
+    label: 'node server module import',
+    pattern: /from\s+['"](?:node:)?(?:fs|child_process|cluster|dgram|dns|net|tls|v8|vm)['"]/
+  },
+  {
+    label: 'server dynamic import',
+    pattern: /\bimport\s*\(\s*['"](?:node:)?(?:fs|child_process|sqlite|postgres|bun|cluster|net|tls)['"]/
+  },
+  {
+    label: 'server require leak',
+    pattern: /\brequire\s*\(\s*['"](?:node:)?(?:fs|child_process|sqlite|postgres|bun|cluster|net|tls)['"]/
+  },
+  { label: 'dynamic code evaluation', pattern: /\b(?:eval|new\s+Function)\s*\(/ }
 ];
 
 interface DeclEntry {
@@ -595,7 +615,8 @@ export function splitSlice(sliceFilePath: string, baseDir: string = process.cwd(
       message:
         `Uma fatia não importa outra: ${path.basename(sliceFilePath)} alcança ` +
         `${path.relative(process.cwd(), illegalImport)}. Mova o código comum para ` +
-        'src/shared/<nome>.ts, receba o db por parâmetro e chame de dentro das duas fatias.',
+        'src/shared/<nome>.ts, receba o db por parâmetro e chame de dentro das duas fatias. ' +
+        'Dica: use `synapse new-shared <nome>` para criar um módulo compartilhado seguro em src/shared/.',
       candidates: [illegalImport]
     });
   }
@@ -823,8 +844,12 @@ export function verifySplit(result: SplitResult, outDir: string): SplitVerificat
       leaks.push('pacote-raiz-no-cliente');
     }
 
+    const normalizedCode = clientArtifact.code.replace(/\\u([0-9a-fA-F]{4})/g, (_, hex) =>
+      String.fromCharCode(parseInt(hex, 16))
+    );
+
     for (const { label, pattern } of SERVER_ONLY_PATTERNS) {
-      if (pattern.test(clientArtifact.code)) {
+      if (pattern.test(clientArtifact.code) || pattern.test(normalizedCode)) {
         leaks.push(label);
       }
     }

package/src/compiler/slice-templates.ts

@@ -820,6 +820,9 @@ export const sliceSchema = \`
     roles TEXT NOT NULL DEFAULT 'user',
     created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
   );
+
+  -- down:
+  DROP TABLE IF EXISTS users;
 \`;
 
 // Para criar o primeiro usuário, num seed fora da fatia:
@@ -1099,6 +1102,10 @@ export const sliceSchema = \`
     FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
     UNIQUE(provider, provider_user_id)
   );
+
+  -- down:
+  DROP TABLE IF EXISTS oauth_accounts;
+  DROP TABLE IF EXISTS users;
 \`;
 
 // ============================================================================
@@ -1366,6 +1373,9 @@ export const sliceSchema = \`
     enabled INTEGER DEFAULT 1,
     verified_at TIMESTAMP
   );
+
+  -- down:
+  DROP TABLE IF EXISTS ${names.table};
 \`;
 
 // ============================================================================

package/src/compiler/standalone-builder.ts

@@ -9,6 +9,7 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { Err, Ok, type Result } from '../core/machine-types';
+import { SYNAPSE_VERSION } from '../version';
 import { type BuildReportEntry, buildAllClientBundles } from './client-bundler';
 import { resolveSlicesDir, type SlicesDirError } from './slice-discovery';
 
@@ -60,10 +61,23 @@ export async function buildStandalone(
   fs.mkdirSync(path.dirname(slicesDest), { recursive: true });
   fs.cpSync(slicesSrc, slicesDest, { recursive: true });
 
-  // 5. Copy package.json & tsconfig.json if present
+  // 5. Copy package.json & tsconfig.json if present (normalizing workspace:* dependencies)
   const pkgSrc = path.join(appRoot, 'package.json');
   if (fs.existsSync(pkgSrc)) {
-    fs.copyFileSync(pkgSrc, path.join(standaloneDir, 'package.json'));
+    try {
+      const rawPkg = fs.readFileSync(pkgSrc, 'utf-8');
+      const pkg = JSON.parse(rawPkg);
+      if (pkg.dependencies) {
+        for (const [dep, ver] of Object.entries(pkg.dependencies)) {
+          if (typeof ver === 'string' && ver.startsWith('workspace:')) {
+            pkg.dependencies[dep] = `^${SYNAPSE_VERSION}`;
+          }
+        }
+      }
+      fs.writeFileSync(path.join(standaloneDir, 'package.json'), `${JSON.stringify(pkg, null, 2)}\n`, 'utf-8');
+    } catch {
+      fs.copyFileSync(pkgSrc, path.join(standaloneDir, 'package.json'));
+    }
   }
 
   const tsconfigSrc = path.join(appRoot, 'tsconfig.json');

package/src/core/action-context.ts

@@ -31,6 +31,43 @@ export type EnqueueFn = <TPayload>(
 
 export type BroadcastFn = (topic: string, data: unknown) => number;
 
+export interface CookieOptions {
+  httpOnly?: boolean;
+  secure?: boolean;
+  sameSite?: 'lax' | 'strict' | 'none';
+  maxAge?: number;
+  path?: string;
+  domain?: string;
+}
+
+export interface PendingCookie {
+  name: string;
+  value: string;
+  options?: CookieOptions;
+}
+
+export function serializeCookie(name: string, value: string, options: CookieOptions = {}): string {
+  const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
+  if (options.maxAge !== undefined) {
+    parts.push(`Max-Age=${Math.floor(options.maxAge)}`);
+  }
+  if (options.domain && !/[\r\n;\s]/.test(options.domain)) {
+    parts.push(`Domain=${options.domain.trim()}`);
+  }
+  const cleanPath = options.path && !/[\r\n;\s]/.test(options.path) ? options.path.trim() : '/';
+  parts.push(`Path=${cleanPath}`);
+  if (options.secure) {
+    parts.push('Secure');
+  }
+  if (options.httpOnly) {
+    parts.push('HttpOnly');
+  }
+  if (options.sameSite) {
+    parts.push(`SameSite=${options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1).toLowerCase()}`);
+  }
+  return parts.join('; ');
+}
+
 export interface ActionContext<TServices = Record<string, unknown>> extends DatabaseClient {
   /** Underlying Database Client */
   readonly db: DatabaseClient;
@@ -56,6 +93,15 @@ export interface ActionContext<TServices = Record<string, unknown>> extends Data
   /** Broadcasts a real-time event to SSE subscribers */
   readonly broadcast: BroadcastFn;
 
+  /** Invalidates SSR cache entries by tag or completely */
+  readonly invalidateCache: (tags?: string[]) => void;
+
+  /** Sets an HTTP response cookie (e.g. HttpOnly session token) */
+  readonly setCookie: (name: string, value: string, options?: CookieOptions) => void;
+
+  /** Internal list of pending cookies to be set on the response */
+  readonly _pendingCookies?: PendingCookie[];
+
   /** Lazy adapter for Kysely (if configured or requested) */
   readonly kysely?: unknown;
 }
@@ -83,6 +129,7 @@ export interface ActionContextOptions<TServices = Record<string, unknown>> {
   enqueue?: EnqueueFn;
   storage?: StorageClient;
   broadcast?: BroadcastFn;
+  invalidateCache?: (tags?: string[]) => void;
   kysely?: unknown;
 }
 
@@ -102,9 +149,15 @@ export function createActionContext<TServices = Record<string, unknown>>(
     enqueue = async () => 'job_noop',
     storage = getStorage(),
     broadcast = (topic: string, data: unknown) => getEventHub().publish(topic, data),
+    invalidateCache = () => {},
     kysely
   } = options;
 
+  const pendingCookies: PendingCookie[] = [];
+  const setCookie = (name: string, value: string, options?: CookieOptions) => {
+    pendingCookies.push({ name, value, options });
+  };
+
   const context: ActionContext<TServices> = {
     // ActionContext properties
     db,
@@ -115,6 +168,9 @@ export function createActionContext<TServices = Record<string, unknown>>(
     enqueue,
     storage,
     broadcast,
+    invalidateCache,
+    setCookie,
+    _pendingCookies: pendingCookies,
     kysely,
 
     // DatabaseClient proxy methods

package/src/core/action-definition.ts

@@ -0,0 +1,89 @@
+/**
+ * SynapseJS - Declarative Action Definition Primitive
+ *
+ * Implements "Secure by Default" (Fail-Closed) semantics and wire-speed automatic
+ * TypeBox schema validation. Prevents inadvertent public exposure of RPC endpoints
+ * and eliminates repetitive manual `Value.Check` and `requireAuth` boilerplate.
+ */
+
+import type { Static, TSchema } from '@sinclair/typebox';
+import { Value } from '@sinclair/typebox/value';
+import type { DatabaseClient } from './database-client';
+import { Err, type Result } from './machine-types';
+import { requireAuth, type SessionContext } from './session-context';
+
+export type ActionAuthRule = 'public' | string[];
+
+export interface ActionDefinitionConfig<TSchemaInput extends TSchema | undefined, TOutput> {
+  /**
+   * Optional TypeBox schema for input payload validation.
+   * If supplied, incoming requests are automatically validated before the handler runs.
+   */
+  input?: TSchemaInput;
+
+  /**
+   * Authorization rules for this action.
+   * - Omitted / undefined: Requires an authenticated user session (Fail-Closed by default).
+   * - Array of strings (e.g. ['admin', 'manager']): Requires the session to possess at least one of these roles.
+   * - 'public': Explicitly marks the action as accessible to unauthenticated callers.
+   */
+  auth?: ActionAuthRule;
+
+  /**
+   * Handler function executing business logic.
+   * Receives strongly-typed validated input, database client and authenticated session context.
+   */
+  handler: (ctx: {
+    input: TSchemaInput extends TSchema ? Static<TSchemaInput> : unknown;
+    db?: DatabaseClient;
+    session?: SessionContext;
+  }) => Promise<TOutput> | TOutput;
+}
+
+export type ActionHandlerFn<TSchemaInput extends TSchema | undefined, TOutput> = {
+  (
+    payload: unknown,
+    db?: DatabaseClient,
+    session?: SessionContext
+  ): Promise<TOutput | Result<never, 'INVALID_SCHEMA' | 'UNAUTHORIZED' | 'FORBIDDEN'>>;
+  readonly __isSynapseAction: true;
+  readonly config: ActionDefinitionConfig<TSchemaInput, TOutput>;
+};
+
+export function defineAction<TSchemaInput extends TSchema | undefined, TOutput>(
+  config: ActionDefinitionConfig<TSchemaInput, TOutput>
+): ActionHandlerFn<TSchemaInput, TOutput> {
+  const actionFn = async (
+    payload: unknown,
+    db?: DatabaseClient,
+    session?: SessionContext
+  ): Promise<TOutput | Result<never, 'INVALID_SCHEMA' | 'UNAUTHORIZED' | 'FORBIDDEN'>> => {
+    // 1. Fail-Closed Authentication Guard
+    if (config.auth !== 'public') {
+      const requiredRoles = Array.isArray(config.auth) ? config.auth : undefined;
+      const auth = requireAuth(session, requiredRoles);
+      if (!auth.ok) {
+        return Err(auth.error);
+      }
+    }
+
+    // 2. Automatic Wire-Speed Schema Validation
+    if (config.input) {
+      if (!Value.Check(config.input, payload)) {
+        return Err('INVALID_SCHEMA');
+      }
+    }
+
+    // 3. Typed Handler Invocation
+    return config.handler({
+      input: payload as TSchemaInput extends TSchema ? Static<TSchemaInput> : unknown,
+      db,
+      session
+    });
+  };
+
+  Object.defineProperty(actionFn, '__isSynapseAction', { value: true, writable: false });
+  Object.defineProperty(actionFn, 'config', { value: config, writable: false });
+
+  return actionFn as ActionHandlerFn<TSchemaInput, TOutput>;
+}