@metaobjectsdev/runtime-ts 1.0.9-rc.1 → 1.0.9-rc.3

package/dist/hono/mount-read-only.js

@@ -3,9 +3,11 @@
 // equivalent so the cross-port API contract holds for projection endpoints.
 import { sql, eq, and, count } from "drizzle-orm";
 import qs from "qs";
-import { parseFilterParams, FilterParseError } from "../drizzle-fastify/filter-parser.js";
+import { parseFilterParams, parsePageBound, RAW_VIEW_MAX_LIMIT, FilterParseError } from "../drizzle-fastify/filter-parser.js";
 import { isTruthyFlag, coerceIdForColumn, rawIdLiteral, contractErrorCode, viewBaseConfig } from "../drizzle-fastify/util.js";
 import { timestampWire } from "../timestamp-wire.js";
+// An unexpected error on a mounted route answers `500 { error: "internal" }`.
+import { guardRoute } from "./route-guard.js";
 function resolveViewName(view) {
     const cfg = viewBaseConfig(view);
     if (cfg) {
@@ -75,15 +77,16 @@ export function mountReadOnlyCrudRoutes(opts) {
     // The raw-SQL branch has no declared columns, so nothing names a timestamp there.
     const toWire = timestampWire(view);
     // ── List ──────────────────────────────────────────────────────────────────
-    app.get(path, async (c) => {
+    app.get(path, guardRoute(async (c) => {
         try {
             if (useRawSql) {
                 const url = c.req.url;
                 const qIdx = url.indexOf("?");
                 const queryString = qIdx >= 0 ? url.slice(qIdx + 1) : "";
                 const parsed = qs.parse(queryString);
-                const limitVal = Math.min(1000, Math.max(1, Number(typeof parsed["limit"] === "string" ? parsed["limit"] : 1000)));
-                const offsetVal = Math.max(0, Number(typeof parsed["offset"] === "string" ? parsed["offset"] : 0));
+                // A bound that is not an integer in range is a 400, not silently clamped.
+                const limitVal = parsePageBound(parsed, "limit", RAW_VIEW_MAX_LIMIT) ?? RAW_VIEW_MAX_LIMIT;
+                const offsetVal = parsePageBound(parsed, "offset") ?? 0;
                 const withCount = isTruthyFlag(parsed["withCount"]);
                 // biome-ignore lint/suspicious/noExplicitAny: dynamic raw result
                 const rows = (await rawRows(db, dialect, sql.raw(`SELECT * FROM "${viewName}" LIMIT ${limitVal} OFFSET ${offsetVal}`)));
@@ -142,9 +145,9 @@ export function mountReadOnlyCrudRoutes(opts) {
             }
             throw err;
         }
-    });
+    }));
     // ── Get by ID ─────────────────────────────────────────────────────────────
-    app.get(`${path}/:id`, async (c) => {
+    app.get(`${path}/:id`, guardRoute(async (c) => {
         const id = c.req.param("id") ?? "";
         if (useRawSql) {
             // biome-ignore lint/suspicious/noExplicitAny: dynamic raw result
@@ -168,7 +171,7 @@ export function mountReadOnlyCrudRoutes(opts) {
             .limit(1);
         const row = rows[0];
         return row ? c.json(toWire(row)) : c.json({ error: "not_found" }, 404);
-    });
+    }));
     // ── Mutations explicitly rejected (405) ───────────────────────────────────
     const reject = (c) => c.json({ error: "method_not_allowed", message: `${c.req.method} is not supported on a projection (read-only).` }, 405);
     // biome-ignore lint/suspicious/noExplicitAny: cross-version Hono typing

package/dist/hono/mount-read-only.js.map

@@ -1 +1 @@
-{"version":3,"file":"mount-read-only.js","sourceRoot":"","sources":["../../src/hono/mount-read-only.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,4EAA4E;AAG5E,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAK1F,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC9H,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAoBrD,SAAS,eAAe,CAAC,IAAa;IACpC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,MAAM,CAAW,CAAC;IACpE,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,OAAO,CACL,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAwC,CAAC;QAC5E,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,iFAAiF;AACjF,KAAK,UAAU,OAAO,CAAC,EAAO,EAAE,OAA2B,EAAE,KAAc;IACzE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAY,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAgC,CAAC;QAChE,OAAQ,GAAmD,EAAE,IAAI,IAAI,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAA8B,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAA0B;IAChE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IAEpC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IACxD,kFAAkF;IAClF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEnC,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;gBACtB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAA4B,CAAC;gBAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,IAAI,EACJ,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAClF,CAAC;gBACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CACxB,CAAC,EACD,MAAM,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACpE,CAAC;gBACF,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;gBACpD,iEAAiE;gBACjE,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,QAAQ,WAAW,QAAQ,WAAW,SAAS,EAAE,CAAC,CAAC,CAAU,CAAC;gBACjI,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3E,IAAI,CAAC,SAAS;oBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzC,iEAAiE;gBACjE,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,8BAA8B,QAAQ,GAAG,CAAC,CAAC,CAAU,CAAC;gBAC5G,MAAM,KAAK,GAAW,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5C,CAAC;YAED,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAA4B,CAAC;YAChE,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,iBAAiB,CAAC;gBAC/B,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,eAAe;gBAC1B,aAAa;gBACb,OAAO;aACR,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW;gBACtD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC;gBACvC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,aAAa;gBAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,OAAO;gBAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7D,yEAAyE;YACzE,oEAAoE;YACpE,2EAA2E;YAC3E,0EAA0E;YAC1E,6DAA6D;YAC7D,MAAM,IAAI,GAAG,CAAC,MAAM,CAAe,CAAA,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEhD,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,aAAa;gBAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAA8B,CAAC;YAC5D,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,2EAA2E;gBAC3E,yCAAyC;gBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,SAAS,EAAE,CAAC;YACd,iEAAiE;YACjE,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,QAAQ,YAAY,KAAK,OAAO,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAU,CAAC;YAC1I,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,sEAAsE;QACtE,MAAM,MAAM,GAAI,IAAY,CAAC,KAAK,CAAC,CAAC;QACpC,qFAAqF;QACrF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,6EAA6E;QAC7E,0CAA0C;QAC1C,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;aAC7D,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,GAAG,GAAI,IAAkB,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,MAAM,MAAM,GAAG,CAAC,CAAgF,EAAE,EAAE,CAClG,CAAC,CAAC,IAAI,CACJ,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,gDAAgD,EAAE,EACzG,GAAG,CACJ,CAAC;IACJ,wEAAwE;IACxE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAa,CAAC,CAAC;IAC9B,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE,MAAa,CAAC,CAAC;IACxC,gFAAgF;IAChF,2EAA2E;IAC3E,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,EAAE,MAAa,CAAC,CAAC;IACtC,wEAAwE;IACxE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,EAAE,MAAa,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"mount-read-only.js","sourceRoot":"","sources":["../../src/hono/mount-read-only.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,8EAA8E;AAC9E,4EAA4E;AAG5E,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AAK9H,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC9H,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,8EAA8E;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAoB9C,SAAS,eAAe,CAAC,IAAa;IACpC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,MAAM,CAAW,CAAC;IACpE,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,OAAO,CACL,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAa;IACtC,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,CAAwC,CAAC;QAC5E,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B;IAC/C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,iFAAiF;AACjF,KAAK,UAAU,OAAO,CAAC,EAAO,EAAE,OAA2B,EAAE,KAAc;IACzE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAY,MAAM,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,GAAgC,CAAC;QAChE,OAAQ,GAAmD,EAAE,IAAI,IAAI,EAAE,CAAC;IAC1E,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAA8B,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAA0B;IAChE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;IAEpC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IACxD,kFAAkF;IAClF,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEnC,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;gBACtB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC9B,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAA4B,CAAC;gBAChE,0EAA0E;gBAC1E,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,kBAAkB,CAAC;gBAC3F,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACxD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;gBACpD,iEAAiE;gBACjE,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,QAAQ,WAAW,QAAQ,WAAW,SAAS,EAAE,CAAC,CAAC,CAAU,CAAC;gBACjI,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3E,IAAI,CAAC,SAAS;oBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACzC,iEAAiE;gBACjE,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,8BAA8B,QAAQ,GAAG,CAAC,CAAC,CAAU,CAAC;gBAC5G,MAAM,KAAK,GAAW,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5C,CAAC;YAED,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YACtB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAA4B,CAAC;YAChE,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,iBAAiB,CAAC;gBAC/B,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,IAAI;gBACX,SAAS,EAAE,eAAe;gBAC1B,aAAa;gBACb,OAAO;aACR,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW;gBACtD,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC;gBACvC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC;YACzC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,aAAa;gBAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAC9C,IAAI,MAAM,CAAC,OAAO;gBAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;gBAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7D,yEAAyE;YACzE,oEAAoE;YACpE,2EAA2E;YAC3E,0EAA0E;YAC1E,6DAA6D;YAC7D,MAAM,IAAI,GAAG,CAAC,MAAM,CAAe,CAAA,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAEhD,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEpC,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,aAAa;gBAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAChD,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAA8B,CAAC;YAC5D,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,gBAAgB,EAAE,CAAC;gBACpC,2EAA2E;gBAC3E,yCAAyC;gBACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC,CAAC;IAEJ,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,SAAS,EAAE,CAAC;YACd,iEAAiE;YACjE,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,QAAQ,YAAY,KAAK,OAAO,YAAY,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAU,CAAC;YAC1I,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvD,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,sEAAsE;QACtE,MAAM,MAAM,GAAI,IAAY,CAAC,KAAK,CAAC,CAAC;QACpC,qFAAqF;QACrF,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,6EAA6E;QAC7E,0CAA0C;QAC1C,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,IAAI,CAAC;aACV,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;aAC7D,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,GAAG,GAAI,IAAkB,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC,CAAC;IAEJ,6EAA6E;IAC7E,MAAM,MAAM,GAAG,CAAC,CAAgF,EAAE,EAAE,CAClG,CAAC,CAAC,IAAI,CACJ,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,gDAAgD,EAAE,EACzG,GAAG,CACJ,CAAC;IACJ,wEAAwE;IACxE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,MAAa,CAAC,CAAC;IAC9B,wEAAwE;IACxE,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,MAAM,EAAE,MAAa,CAAC,CAAC;IACxC,gFAAgF;IAChF,2EAA2E;IAC3E,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,MAAM,EAAE,MAAa,CAAC,CAAC;IACtC,wEAAwE;IACxE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,MAAM,EAAE,MAAa,CAAC,CAAC;AAC3C,CAAC"}

package/dist/hono/route-guard.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Per-handler error guard for the Hono mount helpers — the Hono twin of
+ * drizzle-fastify's route-scoped error handler (route-error-handler.ts).
+ *
+ * Hono has no per-route error handler: `app.onError` is app-wide, so installing one from
+ * a mount would change how the adopter's OTHER routes answer. Wrapping each handler the
+ * mount registers keeps the change to exactly the routes it owns.
+ *
+ * An unexpected error is logged server-side and answered `500 { "error": "internal" }`.
+ * Hono's default would answer a bare-text `Internal Server Error` — no leak, but not the
+ * contract's JSON envelope, and different from the Fastify flavor this adapter promises
+ * to match on the wire. An `HTTPException` (anything carrying `getResponse`) was thrown
+ * on purpose and is rethrown to the adopter's `onError` / Hono's default untouched.
+ */
+import type { Context } from "hono";
+type RouteHandler = (c: Context) => Promise<Response> | Response;
+export declare function guardRoute(handler: RouteHandler): RouteHandler;
+/** The outcome of reading a JSON request body: the value, or the 400 to answer. */
+export type JsonBodyRead = {
+    ok: true;
+    body: unknown;
+} | {
+    ok: false;
+    response: Response;
+};
+/**
+ * Read the request body as JSON. A body that does not parse — including an empty one —
+ * answers `400 { "error": "invalid_json" }`, matching the Fastify flavor. Before, the
+ * parse failure was swallowed into `undefined` and surfaced as a Zod `validation` error
+ * complaining that the body was not an object, which named the wrong problem.
+ */
+export declare function readJsonBody(c: Context): Promise<JsonBodyRead>;
+export {};
+//# sourceMappingURL=route-guard.d.ts.map

package/dist/hono/route-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-guard.d.ts","sourceRoot":"","sources":["../../src/hono/route-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AASpC,KAAK,YAAY,GAAG,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC;AAMjE,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAU9D;AAED,mFAAmF;AACnF,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE3F;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAMpE"}

package/dist/hono/route-guard.js

@@ -0,0 +1,46 @@
+/**
+ * Per-handler error guard for the Hono mount helpers — the Hono twin of
+ * drizzle-fastify's route-scoped error handler (route-error-handler.ts).
+ *
+ * Hono has no per-route error handler: `app.onError` is app-wide, so installing one from
+ * a mount would change how the adopter's OTHER routes answer. Wrapping each handler the
+ * mount registers keeps the change to exactly the routes it owns.
+ *
+ * An unexpected error is logged server-side and answered `500 { "error": "internal" }`.
+ * Hono's default would answer a bare-text `Internal Server Error` — no leak, but not the
+ * contract's JSON envelope, and different from the Fastify flavor this adapter promises
+ * to match on the wire. An `HTTPException` (anything carrying `getResponse`) was thrown
+ * on purpose and is rethrown to the adopter's `onError` / Hono's default untouched.
+ */
+import { HTTP_STATUS_BAD_REQUEST, HTTP_STATUS_INTERNAL, INTERNAL_ERROR_BODY, INVALID_JSON_BODY, logUnexpectedError, } from "../route-errors.js";
+function isHttpException(err) {
+    return typeof err?.getResponse === "function";
+}
+export function guardRoute(handler) {
+    return async (c) => {
+        try {
+            return await handler(c);
+        }
+        catch (err) {
+            if (isHttpException(err))
+                throw err;
+            logUnexpectedError(err);
+            return c.json(INTERNAL_ERROR_BODY, HTTP_STATUS_INTERNAL);
+        }
+    };
+}
+/**
+ * Read the request body as JSON. A body that does not parse — including an empty one —
+ * answers `400 { "error": "invalid_json" }`, matching the Fastify flavor. Before, the
+ * parse failure was swallowed into `undefined` and surfaced as a Zod `validation` error
+ * complaining that the body was not an object, which named the wrong problem.
+ */
+export async function readJsonBody(c) {
+    try {
+        return { ok: true, body: await c.req.json() };
+    }
+    catch {
+        return { ok: false, response: c.json(INVALID_JSON_BODY, HTTP_STATUS_BAD_REQUEST) };
+    }
+}
+//# sourceMappingURL=route-guard.js.map

package/dist/hono/route-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-guard.js","sourceRoot":"","sources":["../../src/hono/route-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAI5B,SAAS,eAAe,CAAC,GAAY;IACnC,OAAO,OAAQ,GAAwC,EAAE,WAAW,KAAK,UAAU,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAqB;IAC9C,OAAO,KAAK,EAAE,CAAU,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACpC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,EAAE,oBAAoB,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAKD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,CAAU;IAC3C,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,EAAE,CAAC;IACrF,CAAC;AACH,CAAC"}

package/dist/route-errors.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The error envelopes the HTTP mount helpers answer with when a request fails for a
+ * reason that is NOT a filter, validation or constraint problem — shared by the
+ * drizzle-fastify, fastify (ObjectManager) and hono adapters so they cannot drift.
+ *
+ * Two defects, both found by a cold review of a generated app:
+ *
+ *  1. **An unexpected error leaked the query.** With the Drizzle schema out of step with
+ *     the database (a renamed column), a list answered Fastify's default 500 —
+ *     `{"statusCode":500,…,"message":"Failed query: select \"id\", \"display_name\" …
+ *     \nparams: …"}`: the SQL, the table and column names and the bound VALUES, to an
+ *     unauthenticated caller. The write paths had already been redacted
+ *     (`constraint-errors.ts`); the reads never were. Now every mounted route answers
+ *     `500 { "error": "internal" }` — the code the cross-port reference servers already
+ *     use — and the detail goes to the server log.
+ *  2. **A malformed JSON body bypassed the envelope.** Fastify's content-type parser
+ *     answered `{"statusCode":400,"code":"FST_ERR_CTP_INVALID_JSON_BODY",…}`, and the Hono
+ *     mount folded it into a Zod `validation` error. Both now answer
+ *     `400 { "error": "invalid_json" }`.
+ *
+ * The api-contract corpus pins neither response (5xx is implementation-defined there, and
+ * no scenario sends a malformed body), so both are TS-helper extensions — documented in
+ * docs/features/api-contract.md, "TS-only error responses".
+ */
+/** Wire code for an unexpected server-side failure. Carries no detail, by design. */
+export declare const ERROR_CODE_INTERNAL = "internal";
+/** Wire code for a request body that is not parseable JSON. */
+export declare const ERROR_CODE_INVALID_JSON = "invalid_json";
+export declare const HTTP_STATUS_BAD_REQUEST = 400;
+export declare const HTTP_STATUS_INTERNAL = 500;
+export interface ErrorEnvelope {
+    readonly error: string;
+}
+export declare const INTERNAL_ERROR_BODY: ErrorEnvelope;
+export declare const INVALID_JSON_BODY: ErrorEnvelope;
+/** True for Fastify's "the body is not valid JSON" errors. */
+export declare function isMalformedJsonBodyError(err: unknown): boolean;
+/**
+ * True when the error deliberately carries a CLIENT status (4xx) — an auth hook's 401, a
+ * schema-validation 400, a 413 for an oversized body. Those were raised on purpose by the
+ * adopter or the framework and are theirs to answer; the mount helpers only take over the
+ * errors nobody meant to send.
+ */
+export declare function isDeliberateClientError(err: unknown): boolean;
+/**
+ * Log an unexpected error server-side, exactly once. A `RedactedDatabaseError` was
+ * already logged by the write path that raised it (it carries no detail of its own).
+ */
+export declare function logUnexpectedError(err: unknown): void;
+//# sourceMappingURL=route-errors.d.ts.map

package/dist/route-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-errors.d.ts","sourceRoot":"","sources":["../src/route-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,qFAAqF;AACrF,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAC9C,+DAA+D;AAC/D,eAAO,MAAM,uBAAuB,iBAAiB,CAAC;AAEtD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,mBAAmB,EAAE,aAA6D,CAAC;AAChG,eAAO,MAAM,iBAAiB,EAAE,aAAiE,CAAC;AAWlG,8DAA8D;AAC9D,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAG9D;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAI7D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAGrD"}

package/dist/route-errors.js

@@ -0,0 +1,67 @@
+/**
+ * The error envelopes the HTTP mount helpers answer with when a request fails for a
+ * reason that is NOT a filter, validation or constraint problem — shared by the
+ * drizzle-fastify, fastify (ObjectManager) and hono adapters so they cannot drift.
+ *
+ * Two defects, both found by a cold review of a generated app:
+ *
+ *  1. **An unexpected error leaked the query.** With the Drizzle schema out of step with
+ *     the database (a renamed column), a list answered Fastify's default 500 —
+ *     `{"statusCode":500,…,"message":"Failed query: select \"id\", \"display_name\" …
+ *     \nparams: …"}`: the SQL, the table and column names and the bound VALUES, to an
+ *     unauthenticated caller. The write paths had already been redacted
+ *     (`constraint-errors.ts`); the reads never were. Now every mounted route answers
+ *     `500 { "error": "internal" }` — the code the cross-port reference servers already
+ *     use — and the detail goes to the server log.
+ *  2. **A malformed JSON body bypassed the envelope.** Fastify's content-type parser
+ *     answered `{"statusCode":400,"code":"FST_ERR_CTP_INVALID_JSON_BODY",…}`, and the Hono
+ *     mount folded it into a Zod `validation` error. Both now answer
+ *     `400 { "error": "invalid_json" }`.
+ *
+ * The api-contract corpus pins neither response (5xx is implementation-defined there, and
+ * no scenario sends a malformed body), so both are TS-helper extensions — documented in
+ * docs/features/api-contract.md, "TS-only error responses".
+ */
+import { RedactedDatabaseError, logAndRedact } from "./constraint-errors.js";
+/** Wire code for an unexpected server-side failure. Carries no detail, by design. */
+export const ERROR_CODE_INTERNAL = "internal";
+/** Wire code for a request body that is not parseable JSON. */
+export const ERROR_CODE_INVALID_JSON = "invalid_json";
+export const HTTP_STATUS_BAD_REQUEST = 400;
+export const HTTP_STATUS_INTERNAL = 500;
+export const INTERNAL_ERROR_BODY = Object.freeze({ error: ERROR_CODE_INTERNAL });
+export const INVALID_JSON_BODY = Object.freeze({ error: ERROR_CODE_INVALID_JSON });
+/**
+ * Fastify's error codes for a body its JSON parser refused: syntactically invalid, and
+ * empty-while-declared-JSON. Both are the caller sending something that is not JSON.
+ */
+const FASTIFY_MALFORMED_JSON_CODES = new Set([
+    "FST_ERR_CTP_INVALID_JSON_BODY",
+    "FST_ERR_CTP_EMPTY_JSON_BODY",
+]);
+/** True for Fastify's "the body is not valid JSON" errors. */
+export function isMalformedJsonBodyError(err) {
+    const code = err?.code;
+    return typeof code === "string" && FASTIFY_MALFORMED_JSON_CODES.has(code);
+}
+/**
+ * True when the error deliberately carries a CLIENT status (4xx) — an auth hook's 401, a
+ * schema-validation 400, a 413 for an oversized body. Those were raised on purpose by the
+ * adopter or the framework and are theirs to answer; the mount helpers only take over the
+ * errors nobody meant to send.
+ */
+export function isDeliberateClientError(err) {
+    const o = err;
+    const status = typeof o?.statusCode === "number" ? o.statusCode : o?.status;
+    return typeof status === "number" && status >= 400 && status < 500;
+}
+/**
+ * Log an unexpected error server-side, exactly once. A `RedactedDatabaseError` was
+ * already logged by the write path that raised it (it carries no detail of its own).
+ */
+export function logUnexpectedError(err) {
+    if (err instanceof RedactedDatabaseError)
+        return;
+    logAndRedact(err);
+}
+//# sourceMappingURL=route-errors.js.map

package/dist/route-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-errors.js","sourceRoot":"","sources":["../src/route-errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE7E,qFAAqF;AACrF,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAC9C,+DAA+D;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,cAAc,CAAC;AAEtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAMxC,MAAM,CAAC,MAAM,mBAAmB,GAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAChG,MAAM,CAAC,MAAM,iBAAiB,GAAkB,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;AAElG;;;GAGG;AACH,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IAChE,+BAA+B;IAC/B,6BAA6B;CAC9B,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,MAAM,IAAI,GAAI,GAAiC,EAAE,IAAI,CAAC;IACtD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,4BAA4B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,MAAM,CAAC,GAAG,GAAwD,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;IAC5E,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,IAAI,GAAG,YAAY,qBAAqB;QAAE,OAAO;IACjD,YAAY,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metaobjectsdev/runtime-ts",
-  "version": "1.0.9-rc.1",
+  "version": "1.0.9-rc.3",
   "description": "Node-side runtime helpers for MetaObjects: Fastify route builders, Drizzle filter/sort integration, Kysely drivers.",
   "type": "module",
   "main": "./dist/index.js",
@@ -64,8 +64,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@metaobjectsdev/metadata": "1.0.9-rc.1",
-    "@metaobjectsdev/render": "1.0.9-rc.1",
+    "@metaobjectsdev/metadata": "1.0.9-rc.3",
+    "@metaobjectsdev/render": "1.0.9-rc.3",
     "qs": "^6.13.0"
   },
   "peerDependencies": {

package/src/drizzle-fastify/filter-allowlist.ts

@@ -10,12 +10,30 @@ import {
   FILTER_OPS,
   OPS_BY_SUBTYPE,
   opsForSubType,
+  FIELD_SUBTYPE_DATE,
+  FIELD_SUBTYPE_TIME,
+  FIELD_SUBTYPE_TIMESTAMP,
+  FIELD_SUBTYPE_UUID,
   type FilterOp,
 } from "@metaobjectsdev/metadata";
 export { FILTER_OPS, OPS_BY_SUBTYPE, opsForSubType, type FilterOp };
 
 export type FilterSubType = "string" | "number" | "boolean" | "datetime";
 
+/**
+ * The wire formats a filter value can be checked against, beyond the coarse
+ * `FilterSubType`. Each is the `field.*` subtype whose Tier-1 wire encoding
+ * (docs/features/api-contract.md, "Type encodings") the value must match — so the
+ * values ARE the metamodel subtype names, not a second vocabulary.
+ */
+export const FILTER_VALUE_FORMATS = [
+  FIELD_SUBTYPE_DATE,
+  FIELD_SUBTYPE_TIME,
+  FIELD_SUBTYPE_TIMESTAMP,
+  FIELD_SUBTYPE_UUID,
+] as const;
+export type FilterValueFormat = (typeof FILTER_VALUE_FORMATS)[number];
+
 export interface FilterFieldRule {
   readonly ops: readonly FilterOp[];
   readonly subType: FilterSubType;
@@ -32,6 +50,21 @@ export interface FilterFieldRule {
    * both as strings under every dialect, so they are not governed by `timestampMode`.
    */
   readonly dateValues?: boolean;
+  /**
+   * The field's exact wire format, set by codegen for `field.date` / `field.time` /
+   * `field.timestamp` / `field.uuid`. The filter parser rejects a value that does not
+   * match it with `invalid_filter_value` instead of binding it — on SQLite a malformed
+   * date compared as text and silently matched nothing; on Postgres it was a driver
+   * error. Absent (an allowlist generated before this existed), a `datetime` value is
+   * still checked against the union of the three temporal formats.
+   */
+  readonly format?: FilterValueFormat;
+  /**
+   * The declared members of a `field.enum` (`@values`), set by codegen. A value that is
+   * not a member is rejected with `invalid_filter_value`. Absent, the parser falls back
+   * to the Drizzle column's own `enumValues` when it has them.
+   */
+  readonly enumValues?: readonly string[];
 }
 
 export type FilterAllowlist = Readonly<Record<string, FilterFieldRule>>;

package/src/drizzle-fastify/filter-parser.ts

@@ -1,9 +1,16 @@
 import {
+  is, Column, SQL as DrizzleSQL,
   eq, ne, gt, gte, lt, lte, inArray, like, ilike, isNull, not, and, or, asc, desc, sql,
   type SQL, type SQLWrapper,
 } from "drizzle-orm";
 import type { FilterAllowlist, FilterOp, FilterFieldRule, SortAllowlist } from "./filter-allowlist.js";
 import { sortOrderSpec } from "./filter-allowlist.js";
+import { FilterParseError, parsePageBound, SORT_EXPECTED } from "./list-params.js";
+
+// Re-exported so existing importers keep one door; the definitions live in the
+// drizzle-free list-params module, which the ObjectManager Fastify mount also uses.
+export { FilterParseError, parsePageBound, PAGINATION_EXPECTED, RAW_VIEW_MAX_LIMIT, SORT_EXPECTED } from "./list-params.js";
+import { ANY_TEMPORAL_EXPECTED, FORMAT_EXPECTED, matchesAnyTemporal, matchesFormat } from "./filter-value-format.js";
 
 // biome-ignore lint/suspicious/noExplicitAny: dynamic dispatch over user's Drizzle table
 type AnyTable = any;
@@ -27,12 +34,6 @@ export interface ParseFilterResult {
   searchWhere?: SQL;
 }
 
-export class FilterParseError extends Error {
-  constructor(public readonly code: string, message: string, public readonly details?: Record<string, unknown>) {
-    super(message);
-    this.name = "FilterParseError";
-  }
-}
 
 const DEFAULT_MAX_NESTING = 5;
 const DEFAULT_MAX_IN_LIST = 100;
@@ -49,37 +50,58 @@ const RESERVED_LIST_PARAMS: ReadonlySet<string> = new Set([
  * meant `?filter[priority][eq]=low` — and silently ignoring it returns EVERY row, which
  * reads as "the filter matched everything". Refuse it, naming the syntax that works.
  *
- * Only a bare name that IS a filterable field is refused. Any other unknown parameter —
- * a cache-buster, a tracking tag, a param some proxy appends — is left alone, as before.
+ * A bare name that is a field of the entity but NOT on the filter allowlist is refused
+ * too — the caller plainly meant that field — saying it is not filterable and listing
+ * the fields that are. Any other unknown parameter — a cache-buster, a tracking tag, a
+ * param some proxy appends — is left alone, as before.
  * TS-only (the other ports ignore unknown parameters): see docs/features/api-contract.md,
  * "TS-only filter extensions".
  */
-function rejectBareFieldParams(query: Record<string, unknown>, allowlist: FilterAllowlist): void {
+function rejectBareFieldParams(query: Record<string, unknown>, allowlist: FilterAllowlist, table: AnyTable): void {
   for (const [key, value] of Object.entries(query)) {
-    if (RESERVED_LIST_PARAMS.has(key) || !Object.hasOwn(allowlist, key)) continue;
-    const shown = typeof value === "string" ? value : "<value>";
-    throw new FilterParseError(
-      "filter.bare_field",
-      `"${key}" is a filterable field, but a bare ?${key}= parameter is not a filter. Use filter[${key}][eq]=${shown}.`,
-      { field: key, expected: `filter[${key}][eq]=${shown}` },
-    );
+    if (RESERVED_LIST_PARAMS.has(key)) continue;
+    if (Object.hasOwn(allowlist, key)) {
+      const shown = typeof value === "string" ? value : "<value>";
+      throw new FilterParseError(
+        "filter.bare_field",
+        `"${key}" is a filterable field, but a bare ?${key}= parameter is not a filter. Use filter[${key}][eq]=${shown}.`,
+        { field: key, expected: `filter[${key}][eq]=${shown}` },
+      );
+    }
+    if (isEntityColumn(table, key)) {
+      const allowed = Object.keys(allowlist);
+      throw new FilterParseError(
+        "filter.bare_field",
+        `"${key}" is a field of this entity, but it is not @filterable, so it cannot be filtered on` +
+          (allowed.length > 0 ? ` (filterable: ${allowed.join(", ")}).` : " (no field is filterable)."),
+        { field: key, filterable: false, expected: `a filterable field — "${key}" is not @filterable`, allowed },
+      );
+    }
   }
 }
 
+/** Is `key` one of the table's (or view's) own columns? A Drizzle table exposes each
+ *  column as a property keyed by its field name; anything else found there (a function,
+ *  a symbol-backed config, a proxy that throws on an unknown key) is not a field. */
+function isEntityColumn(table: AnyTable, key: string): boolean {
+  if (table === null || typeof table !== "object") return false;
+  try {
+    const v: unknown = table[key];
+    return is(v, Column) || is(v, DrizzleSQL.Aliased);
+  } catch {
+    return false;
+  }
+}
+
+
 export function parseFilterParams(opts: ParseFilterOpts): ParseFilterResult {
-  rejectBareFieldParams(opts.query, opts.allowlist);
+  rejectBareFieldParams(opts.query, opts.allowlist, opts.table);
   const result: ParseFilterResult = {};
 
-  const limit = opts.query.limit;
-  if (limit !== undefined) {
-    const n = Number(limit);
-    if (Number.isFinite(n)) result.limit = n;
-  }
-  const offset = opts.query.offset;
-  if (offset !== undefined) {
-    const n = Number(offset);
-    if (Number.isFinite(n)) result.offset = n;
-  }
+  const limit = parsePageBound(opts.query, "limit");
+  if (limit !== undefined) result.limit = limit;
+  const offset = parsePageBound(opts.query, "offset");
+  if (offset !== undefined) result.offset = offset;
 
   if (opts.query.filter && typeof opts.query.filter === "object") {
     const where = parseNode(
@@ -184,14 +206,14 @@ function compileOp(
     throw new FilterParseError("filter.unsupported_op", `Op "${op}" not supported for field "${field}".`, { field, op, allowed: rule.ops });
   }
   switch (op as FilterOp) {
-    case "eq":  return eq(col as any, coerce(value, rule.subType, field, op, rule.dateValues));
-    case "ne":  return ne(col as any, coerce(value, rule.subType, field, op, rule.dateValues));
-    case "gt":  return gt(col as any, coerce(value, rule.subType, field, op, rule.dateValues));
-    case "gte": return gte(col as any, coerce(value, rule.subType, field, op, rule.dateValues));
-    case "lt":  return lt(col as any, coerce(value, rule.subType, field, op, rule.dateValues));
-    case "lte": return lte(col as any, coerce(value, rule.subType, field, op, rule.dateValues));
+    case "eq":  return eq(col as any, coerce(value, rule, col, field, op));
+    case "ne":  return ne(col as any, coerce(value, rule, col, field, op));
+    case "gt":  return gt(col as any, coerce(value, rule, col, field, op));
+    case "gte": return gte(col as any, coerce(value, rule, col, field, op));
+    case "lt":  return lt(col as any, coerce(value, rule, col, field, op));
+    case "lte": return lte(col as any, coerce(value, rule, col, field, op));
     case "in": {
-      const list = String(value).split(",").map((v) => coerce(v.trim(), rule.subType, field, op, rule.dateValues));
+      const list = String(value).split(",").map((v) => coerce(v.trim(), rule, col, field, op));
       if (list.length > maxInList) {
         throw new FilterParseError("filter.in_too_large", `In-list size ${list.length} exceeds limit ${maxInList}.`, { field, limit: maxInList });
       }
@@ -216,7 +238,7 @@ function compileOp(
       // isNull's value is always coerced as boolean (true/false), regardless of the
       // field's declared subType — the operator is "is the value null?", not "is X
       // equal to null?". Field subtype is irrelevant.
-      const b = coerce(value, "boolean", field, op) as boolean;
+      const b = coerceAs(value, "boolean", field, op) as boolean;
       return b ? isNull(col as any) : not(isNull(col as any));
     }
   }
@@ -243,7 +265,54 @@ export function likePatternToGlob(pattern: string): string {
   return out;
 }
 
-function coerce(value: unknown, subType: string, field: string, op: string, dateValues?: boolean): unknown {
+function invalidValue(
+  field: string,
+  op: string,
+  s: string,
+  expected: string,
+  extra: Record<string, unknown> = {},
+): FilterParseError {
+  return new FilterParseError(
+    "filter.invalid_value",
+    `Field "${field}" op "${op}" requires ${expected}, got "${s}".`,
+    { field, op, expected, ...extra },
+  );
+}
+
+/** A Drizzle column's own enum members (`text(..., { enum })`, `pgEnum`), if it has them. */
+function columnEnumValues(col: unknown): readonly string[] | undefined {
+  const v = (col as { enumValues?: unknown } | null | undefined)?.enumValues;
+  return Array.isArray(v) && v.length > 0 && v.every((m) => typeof m === "string") ? (v as string[]) : undefined;
+}
+
+/**
+ * Refuse a value that cannot be the field's type BEFORE it is bound. Without this a
+ * malformed date on SQLite compared as text and silently matched nothing (200 `[]`),
+ * and on Postgres the driver refused the cast (a 500) — either way the caller could not
+ * tell a typo from an empty result. The envelope is the cross-port `invalid_filter_value`,
+ * carrying `op` and `expected` as the number/boolean checks already did.
+ */
+function assertWellFormed(s: string, rule: FilterFieldRule, col: unknown, field: string, op: string): void {
+  const members = rule.enumValues ?? columnEnumValues(col);
+  if (members !== undefined && !members.includes(s)) {
+    throw invalidValue(field, op, s, `one of: ${members.join(", ")}`, { allowed: [...members] });
+  }
+  if (rule.format !== undefined) {
+    if (!matchesFormat(rule.format, s)) throw invalidValue(field, op, s, FORMAT_EXPECTED[rule.format]);
+  } else if (rule.subType === "datetime" && !matchesAnyTemporal(s)) {
+    throw invalidValue(field, op, s, ANY_TEMPORAL_EXPECTED);
+  }
+}
+
+/** Check a comparison value against the field's rule, then coerce it for binding. */
+function coerce(value: unknown, rule: FilterFieldRule, col: unknown, field: string, op: string): unknown {
+  if (value === null || value === undefined) return null;
+  const s = typeof value === "string" ? value : String(value);
+  assertWellFormed(s, rule, col, field, op);
+  return coerceAs(s, rule.subType, field, op, rule.dateValues);
+}
+
+function coerceAs(value: unknown, subType: string, field: string, op: string, dateValues?: boolean): unknown {
   if (value === null || value === undefined) return null;
   const s = typeof value === "string" ? value : String(value);
   switch (subType) {
@@ -254,7 +323,8 @@ function coerce(value: unknown, subType: string, field: string, op: string, date
       throw new FilterParseError("filter.invalid_value", `Field "${field}" op "${op}" requires boolean, got "${s}".`, { field, op, expected: "boolean" });
     }
     case "number":   {
-      const n = Number(s);
+      // `Number("")` and `Number(" ")` are 0 — an empty bound is not the number zero.
+      const n = s.trim() === "" ? Number.NaN : Number(s);
       if (!Number.isFinite(n)) {
         throw new FilterParseError("filter.invalid_value", `Field "${field}" op "${op}" requires number, got "${s}".`, { field, op, expected: "number" });
       }
@@ -302,7 +372,11 @@ function parseSort(spec: string, table: AnyTable, sortAllowlist: SortAllowlist):
   const colonIdx = spec.indexOf(":");
   const field = colonIdx === -1 ? spec : spec.slice(0, colonIdx);
   if (!sortAllowlist[field]) {
-    throw new FilterParseError("sort.unknown_field", `Unknown sort field "${field}".`, { field, allowed: Object.keys(sortAllowlist) });
+    throw new FilterParseError(
+      "sort.unknown_field",
+      `Unknown sort field "${field}". The syntax is ${SORT_EXPECTED}.`,
+      { field, expected: SORT_EXPECTED, allowed: Object.keys(sortAllowlist) },
+    );
   }
   // `?sort=field` with no `:order` takes the field's DECLARED default order.
   //
@@ -324,7 +398,11 @@ function parseSort(spec: string, table: AnyTable, sortAllowlist: SortAllowlist):
   );
   const order = orderRaw.toLowerCase();
   if (order !== "asc" && order !== "desc") {
-    throw new FilterParseError("sort.invalid_order", `Sort order must be asc|desc, got "${orderRaw}".`, { field, expected: "asc | desc" });
+    throw new FilterParseError(
+      "sort.invalid_order",
+      `Sort order must be asc|desc, got "${orderRaw}". The syntax is ${SORT_EXPECTED}.`,
+      { field, expected: SORT_EXPECTED, allowed: Object.keys(sortAllowlist) },
+    );
   }
   const col = table[field];
   return [order === "asc" ? asc(col as any) : desc(col as any)];