@stacksjs/orm 0.70.294 → 0.70.297

package/dist/auto-crud.d.ts

@@ -137,6 +137,7 @@ declare function safeJSONOrEmpty(_s: string): unknown;
  * read path) now gets its casts instead of leaking raw SQLite `"1"`s.
  */
 export declare function applyCasts(record: Record<string, any> | null | undefined, casts: Record<string, string | { get: (v: unknown) => unknown, set: (v: unknown) => unknown }> | null | undefined, direction: 'get' | 'set'): any;
+export declare function validateWriteBody(data: Record<string, any>, model: any, hook: 'creating' | 'updating'): WriteValidationResult;
 /**
  * A route path with every parameter name flattened to `{}`.
  *
@@ -306,3 +307,22 @@ export declare interface IndexPaginator {
   first_page_url?: string
   last_page_url?: string
 }
+/**
+ * Run each declared `validation.rule` against a write payload.
+ *
+ * Returns `{ valid: true }` or `{ valid: false, errors }`. Per-attribute custom
+ * messages from `validation.message` override the rule's default text.
+ *
+ * Fields the caller never sent are skipped on the `updating` hook, so a partial
+ * update does not trip a `required` rule on a sibling field it never touched.
+ *
+ * Lives here rather than in `../routes.ts` so BOTH write paths can reach it.
+ * It used to be a local function in that module, which meant the declared rules
+ * ran on the generated REST routes and nowhere else: `Model.create()`,
+ * `.update()` and `.save()` went straight to the driver, and an over-length
+ * value first got noticed by Postgres as a 22001, surfacing as a 500 on
+ * whichever endpoint performed the write (stacksjs/stacks#2233). Importing it
+ * from `routes.ts` was not an option — that module registers routes on import.
+ */
+export type WriteValidationResult = | { valid: true }
+  | { valid: false, errors: Record<string, string[]> }

package/dist/define-model.d.ts

@@ -22,6 +22,17 @@ export type { ModelDefinition, InferRelationNames, ModelAttributes, InferModelAt
  * ```
  */
 export declare function withoutEvents<T>(fn: () => T | Promise<T>): Promise<T>;
+/**
+ * Run a callback with model validation suppressed for its entire duration.
+ *
+ * @example
+ * ```ts
+ * await User.withoutValidation(async () => {
+ *   for (const row of legacyRows) await User.create(row) // rules do not run
+ * })
+ * ```
+ */
+export declare function withoutValidation<T>(fn: () => T | Promise<T>): Promise<T>;
 export declare function defineModel<const TDef extends ModelDefinition>(definition: TDef): StacksModelStatic<TDef>;
 /**
  * Normalize a ModelInstance (or array of them, or already-plain row) into
@@ -152,6 +163,23 @@ export type StacksModelStatic<TDef extends ModelDefinition> = OrmModelStatic<TDe
   forceCreate: (data: Record<string, unknown>) => ReturnType<OrmModelStatic<TDef>['create']>
   delete: (id: number | string) => Promise<boolean>
   withoutEvents: <T>(fn: () => T | Promise<T>) => Promise<T>
+  /** Run `fn` with declared `validation.rule`s suppressed (bulk imports, backfills). */
+  withoutValidation: <T>(fn: () => T | Promise<T>) => Promise<T>
+}
+/**
+ * Thrown when a direct write fails a declared `validation.rule`.
+ *
+ * Carries `status = 422` and a per-field `errors` map, matching the shape the
+ * generated REST routes already return, so a handler that catches this can
+ * respond with the same body it would have produced through auto-CRUD. It is
+ * duck-typed by `mapWriteError`, which preserves any integer `status` in
+ * 400-599 — so an over-length value now surfaces as a 422 instead of the
+ * driver's raw 22001 becoming a 500 (stacksjs/stacks#2233).
+ */
+export declare class ModelValidationError extends Error {
+  readonly status: number;
+  readonly errors: Record<string, string[]>;
+  constructor(modelName: string, errors: Record<string, string[]>);
 }
 /**
  * Thrown by `Model.findOrFail(id)` (and other strict lookups) when no row matches.