@stacksjs/orm 0.72.62 → 0.72.64

package/dist/auto-crud.d.ts

@@ -159,17 +159,17 @@ declare function safeJSONOrEmpty(_s: string): unknown;
 export declare function applyCasts(record: Record<string, any> | null | undefined, casts: Record<string, string | { get: (v: unknown) => unknown, set: (v: unknown) => unknown }> | null | undefined, direction: 'get' | 'set'): any;
 export declare function validateWriteBody(data: Record<string, any>, model: any, hook: 'creating' | 'updating'): WriteValidationResult;
 /**
- * A route path with every parameter name flattened to `{}`.
+ * The already-registered route that would shadow a generated `method` + `path`,
+ * or undefined when the generated route is free to register.
  *
- * The "user routes win" guard compared paths literally, so an app's own
- * `/api/sites/{siteId}` did not suppress the ORM's `/api/sites/{id}` — the two
- * strings differ, so BOTH were registered and the ORM copy carried none of the
- * app's authorization. The app had declared the endpoint and still got a second,
- * unguarded one it never wrote (stacksjs/stacks#2224).
- *
- * The parameter's NAME is the app's business. The shape is what decides whether
- * this URL is already claimed.
+ * Pure, and separate from the logging wrapper in `../routes.ts`, so the rule can
+ * be tested without booting a router. The rule itself is the whole of
+ * stacksjs/stacks#2364: match on SHAPE, because a hand-written
+ * `/api/sites/{siteId}` and a generated `/api/sites/{id}` address the same URLs
+ * and a literal comparison sees two different strings, registers both, and lets
+ * the generated handler answer without the hand-written one's authorization.
  */
+export declare function findShadowingRoute<T extends RegisteredRouteLike>(routes: readonly T[], method: string, path: string): T | undefined;
 export declare function routeShape(path: string): string;
 /**
  * Resolve middleware lists for a model's `useApi` trait value (which may be
@@ -284,6 +284,23 @@ export declare const INDEX_DEFAULT_PER_PAGE: 15;
 // Upper bound on ?per_page= so a single request can't ask for an
 // unbounded page and exhaust memory.
 export declare const INDEX_MAX_PER_PAGE: 100;
+/**
+ * A route path with every parameter name flattened to `{}`.
+ *
+ * The "user routes win" guard compared paths literally, so an app's own
+ * `/api/sites/{siteId}` did not suppress the ORM's `/api/sites/{id}` — the two
+ * strings differ, so BOTH were registered and the ORM copy carried none of the
+ * app's authorization. The app had declared the endpoint and still got a second,
+ * unguarded one it never wrote (stacksjs/stacks#2224).
+ *
+ * The parameter's NAME is the app's business. The shape is what decides whether
+ * this URL is already claimed.
+ */
+/** The subset of a registered route this matching needs. */
+export declare interface RegisteredRouteLike {
+  method?: string
+  path?: unknown
+}
 /**
  * Pagination `meta` for the auto-CRUD index envelope (`{ data, meta }`).
  *