@warlock.js/core 5.29.0 → 5.31.0

package/esm/router/router.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"router.mjs","names":[],"sources":["../../../../../../../core/src/router/router.ts"],"sourcesContent":["import proxy, { type FastifyHttpProxyOptions } from \"@fastify/http-proxy\";\nimport fastifyStatic, { type FastifyStaticOptions } from \"@fastify/static\";\nimport { ltrim, merge, toCamelCase, trim } from \"@mongez/reinforcements\";\nimport { isEmpty } from \"@mongez/supportive-is\";\nimport { log } from \"@warlock.js/logger\";\nimport type { FastifyReply, FastifyRequest } from \"fastify\";\nimport { container } from \"../container\";\nimport { buildCorsOptions } from \"../http/build-cors-options\";\nimport { Request } from \"../http/request\";\nimport { Response } from \"../http/response\";\nimport { type FastifyInstance } from \"../http/server\";\nimport { buildTracingContext, dispatchPhase, isTracingEnabled } from \"../http/tracing\";\nimport { describeRouteForLog } from \"./describe-route-for-log\";\nimport { logRequestLifecycle } from \"./log-request-lifecycle\";\nimport {\n  forgetPositionalHandlerSuspects,\n  inspectHandlerSignature,\n  reportPositionalHandlerSuspects,\n} from \"./positional-handler-diagnostics\";\nimport { normalizeRoutePath } from \"./normalize-route-path\";\nimport { RouteBuilder } from \"./route-builder\";\nimport { buildRouteRateLimit } from \"./build-route-rate-limit\";\nimport { DEV_DISPATCH_METHODS, buildNotFoundBody, createDevRateLimiter } from \"./dev-dispatch\";\nimport { RouteRegistry } from \"./route-registry\";\nimport { routeNameMethodSuffix } from \"./route-name-method-suffix\";\nimport type {\n  GroupedRoutesOptions,\n  HttpContext,\n  NamedApiRoute,\n  NamedApiRoutesOptions,\n  RequestHandler,\n  RequestHandlerType,\n  RequestHandlerValidation,\n  ResourceMethod,\n  Route,\n  RouteOptions,\n  RouteResource,\n  RouterGroupCallback,\n  RouterStacks,\n} from \"./types\";\n\n/**\n * A Fastify lifecycle hook as it may be declared in a route's `serverOptions`.\n * Fastify accepts a single hook or an array in either position.\n */\ntype RouteLifecycleHook = (\n  request: FastifyRequest,\n  reply: FastifyReply,\n) => unknown | Promise<unknown>;\n\n/**\n * The pre-handler phases the dev server forwards from a route's `serverOptions`.\n *\n * These are the admission-control phases and they share the `(request, reply)`\n * signature. `preParsing` is deliberately absent — it must return the payload\n * stream, so forwarding it generically would corrupt the body rather than\n * guard it. `bodyLimit` cannot be forwarded at all; Fastify reads it at\n * registration time and no hook can bound a body already being parsed.\n */\nconst FORWARDED_ROUTE_PHASES = [\"onRequest\", \"preValidation\", \"preHandler\"] as const;\n\ntype ForwardedRoutePhase = (typeof FORWARDED_ROUTE_PHASES)[number];\n\n/**\n * The route the dev dispatcher matched, stashed on the request so the hooks and\n * the wildcard handler all act on one match rather than each matching again.\n */\ntype DevMatchedRoute = { route: Route; params: Record<string, string> };\n\ntype DevDispatchRequest = FastifyRequest & {\n  matchedDevRoute?: DevMatchedRoute;\n};\n\nfunction toHookList(\n  hook: RouteLifecycleHook | RouteLifecycleHook[] | undefined,\n): RouteLifecycleHook[] {\n  if (!hook) {\n    return [];\n  }\n\n  return Array.isArray(hook) ? hook : [hook];\n}\n\n/**\n * Run a matched route's hooks for one phase.\n *\n * Returning the reply is how an async Fastify hook signals that it has answered\n * the request; the chain must stop there, so the value is propagated rather\n * than discarded.\n */\nasync function runRouteHooks(\n  route: Route,\n  phase: ForwardedRoutePhase,\n  request: FastifyRequest,\n  reply: FastifyReply,\n) {\n  const hooks = toHookList(\n    route.serverOptions?.[phase] as RouteLifecycleHook | RouteLifecycleHook[] | undefined,\n  );\n\n  for (const hook of hooks) {\n    const outcome = await hook(request, reply);\n\n    if (outcome === reply) {\n      return reply;\n    }\n  }\n\n  return undefined;\n}\n\n/**\n * Bound functions do not inherit static properties, so the handler metadata that\n * documentation and typings read (`responseSchema`) is copied onto the bound copy.\n */\nfunction copyResponseSchema(source: unknown, target: RequestHandler): void {\n  const responseSchema = (source as RequestHandler | undefined)?.responseSchema;\n\n  if (responseSchema) {\n    target.responseSchema = responseSchema;\n  }\n}\n\n/**\n * Bind a restful resource method to its resource, keeping its `responseSchema`.\n */\nfunction bindResourceHandler(\n  resource: RouteResource,\n  method: ResourceMethod | \"bulkDelete\",\n): RequestHandler {\n  const source = resource[method];\n  const handler = source?.bind(resource) as RequestHandler;\n\n  copyResponseSchema(source, handler);\n\n  return handler;\n}\n\n/**\n * Describe one claimant of a route name, for the duplicate-name error.\n *\n * `warlock dev` registers SSR page routes on the same router as API routes, so\n * the two share a single route-name namespace and collide across kinds. The\n * error is only actionable if it says which claimant is which, so `isPage` —\n * the router's only route-kind discriminator — is what separates them here.\n *\n * `sourceFile` is stamped only on routes registered through `withSourceFile`.\n * Routes registered without that scope have no owner, so say the source is\n * unknown rather than printing an empty string.\n */\nfunction describeRouteClaimant(route: Route) {\n  const type = route.isPage ? \"page route\" : \"API route\";\n  const source = route.sourceFile ? `declared in ${route.sourceFile}` : \"source file unknown\";\n\n  return `${type} ${route.method} ${route.path} (${source})`;\n}\n\nexport class Router {\n  /**\n   * Routes list\n   */\n  private routes: Route[] = [];\n\n  /**\n   * Bumped on every mutation of {@link routes}.\n   *\n   * The dev dispatcher caches a route registry and needs to know when it is\n   * stale. Comparing `routes.length` would miss an HMR reload that replaces a\n   * route without changing the count — the registry would then keep matching\n   * paths that no longer exist. A version counter cannot miss that.\n   */\n  private routesVersion = 0;\n\n  /**\n   * In-progress atomic replacement, when one exists. Reads continue to use\n   * {@link routes}; mutations and collision checks use this isolated draft.\n   */\n  private routeReplacementTransaction?: {\n    routes: Route[];\n    removedSourceFiles: Set<string>;\n    addedRoutes: Route[];\n  };\n\n  /**\n   * Router Instance\n   */\n  private static instance: Router;\n\n  /**\n   * Static paths\n   */\n  protected staticDirectories: FastifyStaticOptions[] = [];\n\n  /**\n   * Event listeners\n   */\n  protected eventListeners: Record<string, ((router: Router, server: FastifyInstance) => void)[]> =\n    {};\n\n  /**\n   * Stacks\n   * Stacks will be used for grouping routes to add prefix, name or middleware\n   */\n  protected stacks: RouterStacks = {\n    prefix: [],\n    name: [],\n    middleware: [],\n  };\n\n  /**\n   * Get router instance\n   */\n  public static getInstance() {\n    if (!Router.instance) {\n      Router.instance = new Router();\n    }\n\n    return Router.instance;\n  }\n\n  private constructor() {\n    //\n  }\n\n  /**\n   * Listen to router before scan\n   */\n  public beforeScanning(callback: (router: Router, server: FastifyInstance) => void) {\n    this.eventListeners.beforeScan = [...(this.eventListeners.beforeScan || []), callback];\n\n    return this;\n  }\n\n  /**\n   * Listen to router after scanning\n   */\n  public afterScanning(callback: (router: Router, server: FastifyInstance) => void) {\n    this.eventListeners.afterScanning = [...(this.eventListeners.afterScanning || []), callback];\n\n    return this;\n  }\n\n  /**\n   * Redirect path to another path\n   */\n  public redirect(from: string, to: string, redirectMode: \"temporary\" | \"permanent\" = \"temporary\") {\n    return this.get(from, ({ response }) => {\n      response.redirect(to, redirectMode === \"temporary\" ? 302 : 301);\n    });\n  }\n\n  /**\n   * Server static folder\n   */\n  public directory(options: FastifyStaticOptions) {\n    this.staticDirectories.push(options);\n\n    return this;\n  }\n\n  /**\n   * Serve file\n   */\n  public file(path: string, location: string, cacheTime?: number) {\n    return this.get(path, ({ response }) => {\n      response.sendFile(location, cacheTime);\n    });\n  }\n\n  /**\n   * Serve cached file, it will cache the file to 1 year by default\n   */\n  public cachedFile(path: string, location: string, cacheTime?: number) {\n    return this.get(path, ({ response }) => {\n      response.sendCachedFile(location, cacheTime);\n    });\n  }\n\n  /**\n   * Serve list of files\n   */\n  public files(files: Record<string, string>, cacheTime?: number) {\n    for (const [path, location] of Object.entries(files)) {\n      this.get(path, ({ response }) => {\n        response.sendFile(location, cacheTime);\n      });\n    }\n  }\n\n  /**\n   * Serve list of cached files, it will cache the file to 1 year by default\n   */\n  public cachedFiles(files: Record<string, string>, cacheTime?: number) {\n    for (const [path, location] of Object.entries(files)) {\n      this.get(path, ({ response }) => {\n        response.sendCachedFile(location, cacheTime);\n      });\n    }\n  }\n\n  /**\n   * Add proxy route\n   */\n  public proxy(\n    path: string,\n    baseUrl: string,\n    options?: Omit<FastifyHttpProxyOptions, \"prefix\" | \"upstream\">,\n  ): this;\n  public proxy(options: FastifyHttpProxyOptions): this;\n  public proxy(...args: any[]) {\n    this.beforeScanning((_router, server) => {\n      if (args.length === 1) {\n        server.register(proxy, args[0]);\n      } else {\n        server.register(proxy, {\n          prefix: args[0],\n          upstream: args[1],\n          ...args[2],\n        });\n      }\n    });\n\n    return this;\n  }\n\n  /**\n   * Add route to routes list\n   */\n  public add(\n    method: Route[\"method\"],\n    path: string | string[],\n    handler: RequestHandlerType,\n    options: RouteOptions = {},\n  ) {\n    if (Array.isArray(path)) {\n      path.forEach((p) => this.add(method, p, handler, options));\n      return this;\n    }\n\n    const prefix = this.stacks.prefix.reduce((path, prefix) => {\n      return normalizeRoutePath(path, prefix);\n    }, \"\");\n\n    const name = this.stacks.name.reduceRight(\n      (name, prefixName) => {\n        return trim(prefixName + \".\" + name, \".\");\n      },\n      options.name || trim(path.replace(/\\//g, \".\"), \".\"),\n    );\n\n    // The one place a route path becomes canonical. `normalizeRoutePath` is\n    // exported so the build-time page-route manifest can produce the very same\n    // string without registering anything.\n    path = normalizeRoutePath(prefix, path);\n\n    const middlewarePrecedence = options.middlewarePrecedence || \"after\";\n\n    // Work on a copy: the caller may reuse one options object for several\n    // routes, and merging the group stack into it would compound per route.\n    options = { ...options };\n\n    if (middlewarePrecedence === \"before\") {\n      options.middleware = [...(options.middleware || []), ...this.stacks.middleware];\n    } else {\n      options.middleware = [...this.stacks.middleware, ...(options.middleware || [])];\n    }\n\n    if (Array.isArray(handler)) {\n      const [controller, action] = handler;\n\n      if (typeof controller[action] !== \"function\") {\n        throw new Error(\n          `Invalid controller action \"${action}\" for controller \"${controller.constructor.name}\"`,\n        );\n      }\n\n      handler = controller[action].bind(controller) as RequestHandler;\n      copyResponseSchema(controller[action], handler);\n\n      if (!handler.validation) {\n        handler.validation = {};\n        if (controller[`${action}ValidationSchema`]) {\n          handler.validation.schema = controller[`${action}ValidationSchema`]();\n        }\n\n        if (controller[`${action}Validate`]) {\n          handler.validation.validate = controller[`${action}Validate`];\n        }\n      }\n    }\n\n    const routeData: Route = {\n      method,\n      path,\n      handler,\n      ...options,\n      name,\n      rateLimit: options.rateLimit,\n      $prefix: prefix || \"/\",\n      // it must be a new array to avoid modifying the original array\n      $prefixStack: [...this.stacks.prefix],\n      // Inject source file from stacks if set\n      sourceFile: this.stacks.sourceFile || \"\",\n    };\n\n    const routes = this.routeReplacementTransaction?.routes ?? this.routes;\n\n    if (routeData.name) {\n      // check if the name exists\n      const route = routes.find((route) => route.name === routeData.name);\n\n      if (route) {\n        // check again if the route name exists with the same method\n        if (route.method === routeData.method) {\n          throw new Error(\n            `Route name \"${routeData.name}\" is already taken.\\n` +\n              `  already registered: ${describeRouteClaimant(route)}\\n` +\n              `  now being added:    ${describeRouteClaimant(routeData)}\\n` +\n              `Pages and API routes share one route-name namespace, so a name can only be ` +\n              `claimed once. Rename one of them via the \"name\" route option.`,\n          );\n        } else {\n          routeData.name += routeNameMethodSuffix(routeData.method);\n        }\n      }\n    }\n\n    // Registration-time only — nothing here runs per request. Suspects are\n    // collected now and reported together at boot (see `scan`), so a route file\n    // written against v4 produces one legible list instead of a mystery 500 per\n    // request. Recorded after the collision check so a route that never lands\n    // is never reported.\n    if (this.routeReplacementTransaction) {\n      this.routeReplacementTransaction.addedRoutes.push(routeData);\n    } else {\n      inspectHandlerSignature(routeData.handler, routeData);\n    }\n\n    routes.push(routeData);\n\n    if (!this.routeReplacementTransaction) {\n      this.routesVersion++;\n    }\n\n    return this;\n  }\n\n  /**\n   * Add a request that accepts all methods\n   */\n  public any(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"all\" as Route[\"method\"], path, handler, options);\n  }\n\n  /**\n   * Add get request method\n   */\n  public get(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"GET\", path, handler, options);\n  }\n\n  /**\n   * Add post request method\n   */\n  public post(path: string | string[], handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"POST\", path, handler, options);\n  }\n\n  /**\n   * Add put request method\n   */\n  public put(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"PUT\", path, handler, options);\n  }\n\n  /**\n   * Add delete request method\n   */\n  public delete(path: string | string[], handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"DELETE\", path, handler, options);\n  }\n\n  /**\n   * Add patch request method\n   */\n  public patch(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"PATCH\", path, handler, options);\n  }\n\n  /**\n   * Add head request method\n   */\n  public head(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"HEAD\", path, handler, options);\n  }\n\n  /**\n   * Add options request method\n   */\n  public options(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"OPTIONS\", path, handler, options);\n  }\n\n  /**\n   * Get a chainable route builder for the same route path\n   */\n  public route(path: string, options: RouteOptions = {}) {\n    return new RouteBuilder(this, path, options);\n  }\n\n  /**\n   * Add full restful resource routes\n   * This method will generate the following routes:\n   * 1. GET /path: list all resources\n   * 2. GET /path/:id: get a single resource\n   * 3. POST /path: create a new resource\n   * 4. PUT /path/:id: update a resource\n   * 5. DELETE /path/:id: delete a resource\n   * 6. PATCH /path/:id: update a resource partially\n   */\n  public restfulResource(\n    path: string,\n    resource: RouteResource,\n    options: RouteOptions & {\n      only?: ResourceMethod[];\n      except?: ResourceMethod[];\n      replace?: Partial<Record<ResourceMethod, RequestHandler>> & {\n        bulkDelete?: RequestHandler;\n      };\n    } = {},\n  ) {\n    // Derive the base resource name from the path before the group below\n    // clears it for use as the routes' relative path. `options.name`, when\n    // given, replaces the path-derived name entirely (see the explicit\n    // `name` passed to `group()`) rather than composing with it.\n    const baseResourceName = options.name || toCamelCase(ltrim(path, \"/\"));\n\n    return this.group({ prefix: path, name: baseResourceName }, () => {\n      const path = \"\";\n\n      // clone the resource so we don't mess up with it\n      const routeResource = resource;\n\n      const isAcceptableResource = (type: ResourceMethod) => {\n        return Boolean(\n          // check if the route is not excluded\n          (!options.except || !options.except.includes(type)) &&\n          // check if the only option is set and the route is included\n          (!options.only || options.only.includes(type)),\n        );\n      };\n\n      if (routeResource.list && isAcceptableResource(\"list\")) {\n        this.get(path, options.replace?.list || bindResourceHandler(routeResource, \"list\"), {\n          ...options,\n          name: \"list\",\n          restful: true,\n        });\n      }\n\n      if (routeResource.get && isAcceptableResource(\"get\")) {\n        this.get(path + \"/:id\", options.replace?.get || bindResourceHandler(routeResource, \"get\"), {\n          ...options,\n          name: \"single\",\n          restful: true,\n        });\n      }\n\n      if (routeResource.create && isAcceptableResource(\"create\")) {\n        const handler = options.replace?.create || this.manageValidation(routeResource, \"create\");\n\n        this.post(path, handler, {\n          ...options,\n          name: \"create\",\n          restful: true,\n        });\n      }\n\n      if (routeResource.update && isAcceptableResource(\"update\")) {\n        const handler = options.replace?.update || this.manageValidation(routeResource, \"update\");\n\n        this.put(path + \"/:id\", handler, {\n          ...options,\n          name: \"update\",\n          restful: true,\n        });\n      }\n\n      if (routeResource.patch && isAcceptableResource(\"patch\")) {\n        const handler = options.replace?.patch || this.manageValidation(routeResource, \"patch\");\n\n        this.patch(path + \"/:id\", handler, {\n          ...options,\n          name: \"patch\",\n          restful: true,\n        });\n      }\n\n      if (routeResource.delete && isAcceptableResource(\"delete\")) {\n        this.delete(\n          path + \"/:id\",\n          options.replace?.delete || bindResourceHandler(routeResource, \"delete\"),\n          {\n            ...options,\n            name: \"delete\",\n            restful: true,\n          },\n        );\n      }\n\n      if (routeResource.bulkDelete && isAcceptableResource(\"delete\")) {\n        this.delete(\n          path,\n          options.replace?.bulkDelete || bindResourceHandler(routeResource, \"bulkDelete\"),\n          {\n            ...options,\n            name: \"bulkDelete\",\n            restful: true,\n          },\n        );\n      }\n\n      return this;\n    });\n  }\n\n  /**\n   * Group routes with options\n   */\n  public group(options: GroupedRoutesOptions, callback: RouterGroupCallback) {\n    const {\n      prefix,\n      // name must always be defined because\n      // if there are multiple groups without name\n      // they might generate the same route name\n      // thus causing an error\n      // in this case we need always to make sure that\n      // the name is always defined.\n      name = prefix ? trim(prefix.replace(/\\//g, \".\"), \".\") : undefined,\n      middleware,\n    } = options;\n\n    if (prefix) {\n      this.stacks.prefix.push(prefix);\n    }\n\n    if (name) {\n      this.stacks.name.push(name);\n    }\n\n    if (middleware) {\n      this.stacks.middleware.push(...middleware);\n    }\n\n    try {\n      callback();\n    } finally {\n      // Always pop/splice this group's stacks, even if the callback throws,\n      // so a throwing group never leaks state onto the process-global singleton.\n      if (prefix) {\n        this.stacks.prefix.pop();\n      }\n\n      if (name) {\n        this.stacks.name.pop();\n      }\n\n      if (middleware) {\n        this.stacks.middleware.splice(\n          this.stacks.middleware.length - middleware.length,\n          middleware.length,\n        );\n      }\n    }\n\n    return this;\n  }\n\n  /**\n   * Add prefix to all routes in the given callback\n   */\n  public prefix(prefix: string, callback: () => void) {\n    return this.group({ prefix }, callback);\n  }\n\n  /**\n   * Add API version prefix to all routes in the given callback\n   * Automatically formats the version as /v{version}\n   * @example\n   * router.version(\"1\", () => {\n   *   router.get(\"/users\", getUsersV1); // /v1/users\n   * });\n   *\n   * router.version(\"2\", () => {\n   *   router.get(\"/users\", getUsersV2); // /v2/users\n   * });\n   */\n  public version(version: string | number, callback: () => void) {\n    return this.prefix(`/v${version}`, callback);\n  }\n\n  /**\n   * Wrap route additions with a source file path\n   * Used for tracking which routes come from which file (for HMR)\n   * @param sourceFile Relative path to the source file (e.g., \"src/app/users/routes.ts\")\n   * @param callback Function that adds routes (will have sourceFile injected)\n   */\n  public async withSourceFile<T = any>(\n    sourceFile: string,\n    callback: () => T | Promise<T>,\n  ): Promise<T | undefined> {\n    // Set source file in stacks\n    this.stacks.sourceFile = sourceFile;\n\n    try {\n      // Execute callback (routes added here will have sourceFile injected)\n      return await callback();\n    } catch (error) {\n      // Log loudly, then RETHROW. Swallowing here silently dropped a whole\n      // route file (duplicate name, invalid action, import error) so the\n      // surface 404'd with no boot error. The caller decides what a throw\n      // means: at boot it aborts the boot, during HMR the dev server's\n      // batch-reload handler catches it, prints it, and keeps serving.\n      log.error({\n        module: \"router\",\n        action: \"registerRoutes\",\n        message: `Failed to register routes from \"${sourceFile}\"`,\n        context: { sourceFile, error },\n      });\n\n      throw error;\n    } finally {\n      // Always clear source file from stacks so a throwing file never leaks\n      // its sourceFile onto the process-global singleton.\n      delete this.stacks.sourceFile;\n    }\n  }\n\n  /**\n   * Remove all routes that belong to a specific source file\n   * Used when reloading routes files via HMR\n   * @param sourceFile Relative path to the source file\n   */\n  public removeRoutesBySourceFile(sourceFile: string): void {\n    if (this.routeReplacementTransaction) {\n      this.routeReplacementTransaction.routes = this.routeReplacementTransaction.routes.filter(\n        (route) => route.sourceFile !== sourceFile,\n      );\n      this.routeReplacementTransaction.removedSourceFiles.add(sourceFile);\n      return;\n    }\n\n    this.routes = this.routes.filter((route) => route.sourceFile !== sourceFile);\n\n    // Keep the signature diagnostics in step, so a reload that fixes a handler\n    // stops reporting the version it replaced.\n    forgetPositionalHandlerSuspects(sourceFile);\n\n    this.routesVersion++;\n  }\n\n  /**\n   * Atomically replace every route owned by the given exact source-file keys.\n   *\n   * The installer mutates an isolated draft. Public reads keep seeing the old\n   * live table across awaits, and a failed installer discards every draft\n   * mutation. A successful installer swaps the whole draft in one synchronous\n   * commit and invalidates the dev route registry exactly once.\n   */\n  public async replaceRoutesBySourceFiles<T>(\n    sourceFiles: Iterable<string>,\n    install: () => T | Promise<T>,\n  ): Promise<T> {\n    if (this.routeReplacementTransaction) {\n      throw new Error(\"Cannot nest route replacement transactions\");\n    }\n\n    const removedSourceFiles = new Set(sourceFiles);\n\n    this.routeReplacementTransaction = {\n      routes: this.routes.filter((route) => !removedSourceFiles.has(route.sourceFile)),\n      removedSourceFiles,\n      addedRoutes: [],\n    };\n\n    try {\n      const result = await install();\n      const transaction = this.routeReplacementTransaction!;\n\n      this.routes = transaction.routes;\n      this.routeReplacementTransaction = undefined;\n\n      // Diagnostic state follows the same commit boundary as the route table.\n      // Added routes were deliberately not inspected while still speculative.\n      for (const sourceFile of transaction.removedSourceFiles) {\n        forgetPositionalHandlerSuspects(sourceFile);\n      }\n\n      const committedRoutes = new Set(transaction.routes);\n\n      for (const route of transaction.addedRoutes) {\n        if (committedRoutes.has(route)) {\n          inspectHandlerSignature(route.handler, route);\n        }\n      }\n\n      this.routesVersion++;\n\n      return result;\n    } catch (error) {\n      this.routeReplacementTransaction = undefined;\n      throw error;\n    }\n  }\n\n  /**\n   * Manage validation system for the given resource\n   */\n  private manageValidation(resource: RouteResource, method: \"create\" | \"update\" | \"patch\") {\n    const handler = bindResourceHandler(resource, method);\n\n    const methodValidation = resource?.validation?.[method];\n\n    if (method === \"patch\") {\n      handler.validation = methodValidation;\n\n      if (handler.validation?.validate) {\n        handler.validation.validate = handler.validation.validate.bind(resource);\n      }\n\n      if (resource.validation?.patch) {\n        handler.validation = merge(resource.validation.patch, handler.validation);\n      }\n\n      return handler;\n    }\n\n    if (!resource.validation || (!methodValidation && !resource.validation.all)) return handler;\n\n    if (resource.validation.all) {\n      const validationMethods = {\n        all: resource?.validation?.all?.validate,\n        [method]: methodValidation?.validate,\n      };\n\n      const validation: RequestHandlerValidation = {};\n\n      if (resource.validation.all.schema || methodValidation?.schema) {\n        if (!methodValidation?.schema && resource.validation.all.schema) {\n          // Case 2: Only all.schema exists - clone it for this method\n          validation.schema = resource.validation.all.schema;\n        } else if (methodValidation?.schema && resource.validation.all.schema) {\n          // Case 3: Both exist - merge them (all is base, method overrides)\n          validation.schema = resource.validation.all.schema.merge(methodValidation.schema);\n        } else if (methodValidation?.schema && !resource.validation.all.schema) {\n          // Case 1: Only method schema exists - use it directly\n          validation.schema = methodValidation.schema;\n        }\n        // Case 4: Neither exists - handled by outer if being false\n      }\n\n      if (validationMethods.all || validationMethods[method]) {\n        validation.validate = async ({ request, response }: HttpContext) => {\n          if (validationMethods.all) {\n            const output = await validationMethods.all.call(resource, { request, response });\n\n            if (output) return output;\n          }\n\n          if (validationMethods[method]) {\n            return await validationMethods[method]?.call(resource, { request, response });\n          }\n\n          return;\n        };\n      }\n\n      if (!isEmpty(validation)) {\n        handler.validation = validation;\n      }\n    } else {\n      handler.validation = resource.validation[method];\n\n      if (handler.validation?.validate) {\n        handler.validation.validate = handler.validation.validate.bind(resource);\n      }\n    }\n\n    return handler;\n  }\n\n  /**\n   * Get all routes list\n   */\n  public list() {\n    return this.routes;\n  }\n\n  /**\n   * Return fresh browser-safe snapshots of named, non-page routes.\n   *\n   * Names are the registered names, including method suffixes. `all` stays\n   * intact as route metadata; consumers decide whether their use supports it.\n   */\n  public getNamedApiRoutes(options: NamedApiRoutesOptions = {}): readonly NamedApiRoute[] {\n    return Object.freeze(\n      this.routes\n        .filter((route) => !route.isPage && typeof route.name === \"string\" && route.name.length > 0)\n        .map((route) => {\n          const snapshot = { name: route.name!, path: route.path, method: route.method };\n          const schema = route.handler?.responseSchema;\n          const response = schema ? options.resolveResponse?.(schema, route) : undefined;\n\n          // A route without a declared schema keeps exactly the three-key record.\n          if (!response || Object.keys(response).length === 0) return Object.freeze(snapshot);\n\n          return Object.freeze({ ...snapshot, response: Object.freeze({ ...response }) });\n        }),\n    );\n  }\n\n  /**\n   * Number of routes currently registered on the singleton.\n   *\n   * Used as a readiness signal: a successful boot that ends up with zero\n   * routes almost always means a route module failed to register silently\n   * (see `withSourceFile`), so callers can surface that instead of letting\n   * the whole surface 404.\n   */\n  public routeCount(): number {\n    return this.routes.length;\n  }\n\n  /**\n   * Register routes to the server\n   */\n  public scan(server: FastifyInstance) {\n    // Every route is registered by the time we scan, so this is the first\n    // moment the whole list can be reported at once — and it is still before a\n    // single request is served.\n    reportPositionalHandlerSuspects();\n\n    this.eventListeners.beforeScan?.forEach((callback) => callback(this, server));\n\n    // Fastify automatically exposes HEAD for every GET route. When an app\n    // declares its own HEAD route at the same path, suppress only that GET\n    // route's implicit registration so the explicit handler owns HEAD,\n    // regardless of declaration order.\n    const explicitHeadPaths = new Set(\n      this.routes\n        .filter((route) => route.method.toLowerCase() === \"head\")\n        .map((route) => route.path),\n    );\n\n    this.routes.forEach((route) => {\n      const requestMethod = route.method.toLowerCase();\n      const requestMethodFunction = server[requestMethod].bind(server);\n\n      const options = {\n        ...route.serverOptions,\n        ...(requestMethod === \"get\" &&\n          explicitHeadPaths.has(route.path) && { exposeHeadRoute: false }),\n        config: {\n          ...route.serverOptions?.config,\n          ...(route.rateLimit && { rateLimit: buildRouteRateLimit(route.rateLimit) }),\n        },\n      };\n\n      requestMethodFunction(\n        route.path,\n        options,\n        async (baseRequest: FastifyRequest, reply: FastifyReply) => {\n          const { output, response } = await this.handleRoute(route)(baseRequest, reply);\n\n          return output || response.baseResponse;\n        },\n      );\n    });\n\n    for (const directoryOptions of this.staticDirectories) {\n      server.register(fastifyStatic, {\n        ...directoryOptions,\n        decorateReply: false,\n      });\n    }\n\n    this.eventListeners.afterScanning?.forEach((callback) => callback(this, server));\n  }\n\n  /**\n   * Scan routes for the development server\n   * Uses wildcard routing with find-my-way for HMR support\n   */\n  public scanDevServer(server: FastifyInstance) {\n    // Same boot-time report as production `scan`. Routes reloaded later by HMR\n    // are still recorded, but only surface on the next scan or via\n    // `warlock doctor`.\n    reportPositionalHandlerSuspects();\n\n    this.eventListeners.beforeScan?.forEach((callback) => callback(this, server));\n\n    let routeRegistry: RouteRegistry | undefined;\n    let registryVersion = -1;\n\n    const applyDevRateLimit = createDevRateLimiter(server);\n\n    // Rebuilt when the route table changes rather than per request. Building it\n    // inside the handler re-registered every route on every hit — and `all`\n    // routes expand into seven registrations each. Keyed on `routesVersion`\n    // rather than on the route count, so an HMR reload that swaps a route\n    // without changing the count still invalidates.\n    const resolveRouteRegistry = () => {\n      if (routeRegistry && registryVersion === this.routesVersion) {\n        return routeRegistry;\n      }\n\n      routeRegistry = new RouteRegistry();\n\n      routeRegistry.register(this.routes);\n\n      registryVersion = this.routesVersion;\n\n      return routeRegistry;\n    };\n\n    // Matching happens here, in Fastify's own onRequest phase, so a route's\n    // `serverOptions.onRequest` still runs BEFORE body parsing. Production\n    // `scan()` gets that from per-route registration; the wildcard dispatcher\n    // has no per-route slot, so without this the hook silently never runs.\n    server.addHook(\n      \"onRequest\",\n      async (fastifyRequest: FastifyRequest, fastifyReply: FastifyReply) => {\n        // Only requests Fastify routed to the dev wildcard belong to the app's\n        // router. A plugin's own route (devtools' `/__warlock/api/requests/:id`)\n        // must keep its params even when an app catch-all matches the URL too.\n        if (fastifyRequest.routeOptions.url !== \"*\") {\n          return undefined;\n        }\n\n        const match = resolveRouteRegistry().find(fastifyRequest.method, fastifyRequest.url);\n\n        if (!match) {\n          return undefined;\n        }\n\n        (fastifyRequest as DevDispatchRequest).matchedDevRoute = match;\n\n        fastifyRequest.params = match.params;\n\n        // Same slot production gives it: the limiter runs first in onRequest,\n        // ahead of the route's own hooks.\n        await applyDevRateLimit(match.route, fastifyRequest, fastifyReply);\n\n        if (fastifyReply.sent) {\n          return fastifyReply;\n        }\n\n        return runRouteHooks(match.route, \"onRequest\", fastifyRequest, fastifyReply);\n      },\n    );\n\n    for (const phase of FORWARDED_ROUTE_PHASES.filter((name) => name !== \"onRequest\")) {\n      server.addHook(phase, async (fastifyRequest: FastifyRequest, fastifyReply: FastifyReply) => {\n        const match = (fastifyRequest as DevDispatchRequest).matchedDevRoute;\n\n        if (!match) {\n          return undefined;\n        }\n\n        return runRouteHooks(match.route, phase, fastifyRequest, fastifyReply);\n      });\n    }\n\n    // Shared handler for wildcard routing\n    const wildcardHandler = async (fastifyRequest: FastifyRequest, fastifyReply: FastifyReply) => {\n      const match = (fastifyRequest as DevDispatchRequest).matchedDevRoute;\n\n      // No match found - return 404\n      if (!match) {\n        return fastifyReply\n          .code(404)\n          .send(buildNotFoundBody(fastifyRequest.method, fastifyRequest.url));\n      }\n\n      try {\n        // Call the matched route handler\n        const { output, response } = await this.handleRoute(match.route)(\n          fastifyRequest,\n          fastifyReply,\n        );\n\n        return output || response.baseResponse;\n      } catch (error) {\n        log.error(\"router\", \"dev-dispatch\", error as Error, {\n          method: fastifyRequest.method,\n          url: fastifyRequest.url,\n        });\n\n        throw error;\n      }\n    };\n\n    // Every verb production can register. Fastify's implicit HEAD for the GET\n    // wildcard is switched off so the HEAD wildcard owns it (the registry falls\n    // back to the GET route, exactly as production's implicit HEAD does).\n    // `@fastify/cors` registers its own OPTIONS \"*\" catch-all whenever\n    // preflight is on. Plugins load after this runs, so `hasRoute` cannot see\n    // it yet: decide from the same options the cors plugin receives.\n    const corsOwnsPreflight = buildCorsOptions().preflight !== false;\n\n    for (const method of DEV_DISPATCH_METHODS) {\n      if (method === \"OPTIONS\" && (corsOwnsPreflight || server.hasRoute({ method: \"OPTIONS\", url: \"*\" }))) {\n        continue;\n      }\n\n      server.route({\n        method,\n        url: \"*\",\n        ...(method === \"GET\" && { exposeHeadRoute: false }),\n        handler: wildcardHandler,\n      });\n    }\n\n    // Register static directories\n    for (const directoryOptions of this.staticDirectories) {\n      server.register(fastifyStatic, {\n        ...directoryOptions,\n        decorateReply: false,\n      });\n    }\n\n    this.eventListeners.afterScanning?.forEach((callback) => callback(this, server));\n  }\n\n  /**\n   * Get the route path for the given route name\n   */\n  public getRoute(name: string, params: Record<string, any> = {}) {\n    const route = this.routes.find((route) => route.name === name);\n\n    if (!route) {\n      throw new Error(`Route name \"${name}\" not found`);\n    }\n\n    const used = new Set<string>();\n\n    const path = route.path.replace(/:([A-Za-z0-9_]+)(\\?)?/g, (_match, key: string, optional) => {\n      const value = params[key];\n\n      if (value === undefined || value === null) {\n        if (optional) return \"\";\n\n        throw new Error(`Route \"${name}\" is missing the \"${key}\" param`);\n      }\n\n      used.add(key);\n\n      return encodeURIComponent(String(value));\n    });\n\n    const query = Object.keys(params)\n      .filter((key) => !used.has(key) && params[key] !== undefined && params[key] !== null)\n      .map((key) => `${encodeURIComponent(key)}=${encodeURIComponent(String(params[key]))}`)\n      .join(\"&\");\n\n    return query ? `${path}?${query}` : path;\n  }\n\n  /**\n   * Handle the given route\n   */\n  private handleRoute(route: Route) {\n    return async (fastifyRequest: FastifyRequest, fastifyResponse: FastifyReply) => {\n      const request = new Request();\n      const response = new Response();\n      response.setResponse(fastifyResponse);\n      request.response = response;\n\n      response.request = request;\n\n      // \"route.match\" tracing phase: the pattern is\n      // already known here (`route.path`), so this brackets the cost of\n      // stamping the request/route onto the `Request` instance rather than\n      // route-registry matching itself, which happens upstream of this\n      // function for both the production `scan()` path and the dev wildcard\n      // dispatcher (both funnel into `handleRoute`).\n      const tracingEnabled = isTracingEnabled();\n      const routeMatchStartedAt = tracingEnabled ? performance.now() : 0;\n\n      request.setRequest(fastifyRequest).setRoute(route);\n\n      if (tracingEnabled) {\n        dispatchPhase(buildTracingContext(request), {\n          name: \"route.match\",\n          durationMs: performance.now() - routeMatchStartedAt,\n          attrs: { route: route.path },\n        });\n      }\n\n      /*\n        Both ends of the entry, not just the start — see\n        `log-request-lifecycle.ts`. A start line on its own made a hung request\n        and an instant one look identical, and the completion line is what makes\n        a MISSING one legible as a hang.\n      */\n      const result = await logRequestLifecycle(\n        {\n          info: (entry) => log.info(entry),\n          warn: (entry) => log.warn(entry),\n          error: (entry) => log.error(entry),\n          now: () => performance.now(),\n        },\n        {\n          module: \"route\",\n          action: describeRouteForLog(route.method, route.path),\n          requestId: request.id,\n          context: { request, response },\n          request,\n          // Read after the run: the status is decided during the request.\n          statusCode: () => fastifyResponse.statusCode,\n        },\n        () => request.execute(),\n      );\n\n      // A handler may return a plain object (`ReturnedResponse`). Route it\n      // through `Response.send` so status, events and hooks apply, exactly as\n      // middleware outputs already do.\n      let output = result;\n\n      if (\n        output !== undefined &&\n        output !== null &&\n        !(output instanceof Response) &&\n        (output as unknown) !== fastifyResponse\n      ) {\n        output = await response.send(output);\n      }\n\n      return {\n        output,\n        response,\n        request,\n      };\n    };\n  }\n}\n\nexport const router = Router.getInstance();\n\ncontainer.set(\"router\", router);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DA,MAAM,yBAAyB;CAAC;CAAa;CAAiB;AAAY;AAc1E,SAAS,WACP,MACsB;CACtB,IAAI,CAAC,MACH,OAAO,CAAC;CAGV,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI;AAC3C;;;;;;;;AASA,eAAe,cACb,OACA,OACA,SACA,OACA;CACA,MAAM,QAAQ,WACZ,MAAM,gBAAgB,MACxB;CAEA,KAAK,MAAM,QAAQ,OAGjB,IAAI,MAFkB,KAAK,SAAS,KAAK,MAEzB,OACd,OAAO;AAKb;;;;;AAMA,SAAS,mBAAmB,QAAiB,QAA8B;CACzE,MAAM,iBAAkB,QAAuC;CAE/D,IAAI,gBACF,OAAO,iBAAiB;AAE5B;;;;AAKA,SAAS,oBACP,UACA,QACgB;CAChB,MAAM,SAAS,SAAS;CACxB,MAAM,UAAU,QAAQ,KAAK,QAAQ;CAErC,mBAAmB,QAAQ,OAAO;CAElC,OAAO;AACT;;;;;;;;;;;;;AAcA,SAAS,sBAAsB,OAAc;CAC3C,MAAM,OAAO,MAAM,SAAS,eAAe;CAC3C,MAAM,SAAS,MAAM,aAAa,eAAe,MAAM,eAAe;CAEtE,OAAO,GAAG,KAAK,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,OAAO;AAC1D;AAEA,IAAa,SAAb,MAAa,OAAO;;;;CAuDlB,OAAc,cAAc;EAC1B,IAAI,CAAC,OAAO,UACV,OAAO,WAAW,IAAI,OAAO;EAG/B,OAAO,OAAO;CAChB;CAEA,AAAQ,cAAc;gBA3DI,CAAC;uBAUH;2BAoB8B,CAAC;wBAMrD,CAAC;gBAM8B;GAC/B,QAAQ,CAAC;GACT,MAAM,CAAC;GACP,YAAY,CAAC;EACf;CAeA;;;;CAKA,AAAO,eAAe,UAA6D;EACjF,KAAK,eAAe,aAAa,CAAC,GAAI,KAAK,eAAe,cAAc,CAAC,GAAI,QAAQ;EAErF,OAAO;CACT;;;;CAKA,AAAO,cAAc,UAA6D;EAChF,KAAK,eAAe,gBAAgB,CAAC,GAAI,KAAK,eAAe,iBAAiB,CAAC,GAAI,QAAQ;EAE3F,OAAO;CACT;;;;CAKA,AAAO,SAAS,MAAc,IAAY,eAA0C,aAAa;EAC/F,OAAO,KAAK,IAAI,OAAO,EAAE,eAAe;GACtC,SAAS,SAAS,IAAI,iBAAiB,cAAc,MAAM,GAAG;EAChE,CAAC;CACH;;;;CAKA,AAAO,UAAU,SAA+B;EAC9C,KAAK,kBAAkB,KAAK,OAAO;EAEnC,OAAO;CACT;;;;CAKA,AAAO,KAAK,MAAc,UAAkB,WAAoB;EAC9D,OAAO,KAAK,IAAI,OAAO,EAAE,eAAe;GACtC,SAAS,SAAS,UAAU,SAAS;EACvC,CAAC;CACH;;;;CAKA,AAAO,WAAW,MAAc,UAAkB,WAAoB;EACpE,OAAO,KAAK,IAAI,OAAO,EAAE,eAAe;GACtC,SAAS,eAAe,UAAU,SAAS;EAC7C,CAAC;CACH;;;;CAKA,AAAO,MAAM,OAA+B,WAAoB;EAC9D,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,GACjD,KAAK,IAAI,OAAO,EAAE,eAAe;GAC/B,SAAS,SAAS,UAAU,SAAS;EACvC,CAAC;CAEL;;;;CAKA,AAAO,YAAY,OAA+B,WAAoB;EACpE,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,GACjD,KAAK,IAAI,OAAO,EAAE,eAAe;GAC/B,SAAS,eAAe,UAAU,SAAS;EAC7C,CAAC;CAEL;CAWA,AAAO,MAAM,GAAG,MAAa;EAC3B,KAAK,gBAAgB,SAAS,WAAW;GACvC,IAAI,KAAK,WAAW,GAClB,OAAO,SAAS,OAAO,KAAK,EAAE;QAE9B,OAAO,SAAS,OAAO;IACrB,QAAQ,KAAK;IACb,UAAU,KAAK;IACf,GAAG,KAAK;GACV,CAAC;EAEL,CAAC;EAED,OAAO;CACT;;;;CAKA,AAAO,IACL,QACA,MACA,SACA,UAAwB,CAAC,GACzB;EACA,IAAI,MAAM,QAAQ,IAAI,GAAG;GACvB,KAAK,SAAS,MAAM,KAAK,IAAI,QAAQ,GAAG,SAAS,OAAO,CAAC;GACzD,OAAO;EACT;EAEA,MAAM,SAAS,KAAK,OAAO,OAAO,QAAQ,MAAM,WAAW;GACzD,OAAO,mBAAmB,MAAM,MAAM;EACxC,GAAG,EAAE;EAEL,MAAM,OAAO,KAAK,OAAO,KAAK,aAC3B,MAAM,eAAe;GACpB,OAAO,KAAK,aAAa,MAAM,MAAM,GAAG;EAC1C,GACA,QAAQ,QAAQ,KAAK,KAAK,QAAQ,OAAO,GAAG,GAAG,GAAG,CACpD;EAKA,OAAO,mBAAmB,QAAQ,IAAI;EAEtC,MAAM,uBAAuB,QAAQ,wBAAwB;EAI7D,UAAU,EAAE,GAAG,QAAQ;EAEvB,IAAI,yBAAyB,UAC3B,QAAQ,aAAa,CAAC,GAAI,QAAQ,cAAc,CAAC,GAAI,GAAG,KAAK,OAAO,UAAU;OAE9E,QAAQ,aAAa,CAAC,GAAG,KAAK,OAAO,YAAY,GAAI,QAAQ,cAAc,CAAC,CAAE;EAGhF,IAAI,MAAM,QAAQ,OAAO,GAAG;GAC1B,MAAM,CAAC,YAAY,UAAU;GAE7B,IAAI,OAAO,WAAW,YAAY,YAChC,MAAM,IAAI,MACR,8BAA8B,OAAO,oBAAoB,WAAW,YAAY,KAAK,EACvF;GAGF,UAAU,WAAW,OAAO,CAAC,KAAK,UAAU;GAC5C,mBAAmB,WAAW,SAAS,OAAO;GAE9C,IAAI,CAAC,QAAQ,YAAY;IACvB,QAAQ,aAAa,CAAC;IACtB,IAAI,WAAW,GAAG,OAAO,oBACvB,QAAQ,WAAW,SAAS,WAAW,GAAG,OAAO,kBAAkB,CAAC;IAGtE,IAAI,WAAW,GAAG,OAAO,YACvB,QAAQ,WAAW,WAAW,WAAW,GAAG,OAAO;GAEvD;EACF;EAEA,MAAM,YAAmB;GACvB;GACA;GACA;GACA,GAAG;GACH;GACA,WAAW,QAAQ;GACnB,SAAS,UAAU;GAEnB,cAAc,CAAC,GAAG,KAAK,OAAO,MAAM;GAEpC,YAAY,KAAK,OAAO,cAAc;EACxC;EAEA,MAAM,SAAS,KAAK,6BAA6B,UAAU,KAAK;EAEhE,IAAI,UAAU,MAAM;GAElB,MAAM,QAAQ,OAAO,MAAM,UAAU,MAAM,SAAS,UAAU,IAAI;GAElE,IAAI,OAEF,IAAI,MAAM,WAAW,UAAU,QAC7B,MAAM,IAAI,MACR,eAAe,UAAU,KAAK,6CACH,sBAAsB,KAAK,EAAE,0BAC7B,sBAAsB,SAAS,EAAE,2IAG9D;QAEA,UAAU,QAAQ,sBAAsB,UAAU,MAAM;EAG9D;EAOA,IAAI,KAAK,6BACP,KAAK,4BAA4B,YAAY,KAAK,SAAS;OAE3D,wBAAwB,UAAU,SAAS,SAAS;EAGtD,OAAO,KAAK,SAAS;EAErB,IAAI,CAAC,KAAK,6BACR,KAAK;EAGP,OAAO;CACT;;;;CAKA,AAAO,IAAI,MAAc,SAA6B,UAAwB,CAAC,GAAG;EAChF,OAAO,KAAK,IAAI,OAA0B,MAAM,SAAS,OAAO;CAClE;;;;CAKA,AAAO,IAAI,MAAc,SAA6B,UAAwB,CAAC,GAAG;EAChF,OAAO,KAAK,IAAI,OAAO,MAAM,SAAS,OAAO;CAC/C;;;;CAKA,AAAO,KAAK,MAAyB,SAA6B,UAAwB,CAAC,GAAG;EAC5F,OAAO,KAAK,IAAI,QAAQ,MAAM,SAAS,OAAO;CAChD;;;;CAKA,AAAO,IAAI,MAAc,SAA6B,UAAwB,CAAC,GAAG;EAChF,OAAO,KAAK,IAAI,OAAO,MAAM,SAAS,OAAO;CAC/C;;;;CAKA,AAAO,OAAO,MAAyB,SAA6B,UAAwB,CAAC,GAAG;EAC9F,OAAO,KAAK,IAAI,UAAU,MAAM,SAAS,OAAO;CAClD;;;;CAKA,AAAO,MAAM,MAAc,SAA6B,UAAwB,CAAC,GAAG;EAClF,OAAO,KAAK,IAAI,SAAS,MAAM,SAAS,OAAO;CACjD;;;;CAKA,AAAO,KAAK,MAAc,SAA6B,UAAwB,CAAC,GAAG;EACjF,OAAO,KAAK,IAAI,QAAQ,MAAM,SAAS,OAAO;CAChD;;;;CAKA,AAAO,QAAQ,MAAc,SAA6B,UAAwB,CAAC,GAAG;EACpF,OAAO,KAAK,IAAI,WAAW,MAAM,SAAS,OAAO;CACnD;;;;CAKA,AAAO,MAAM,MAAc,UAAwB,CAAC,GAAG;EACrD,OAAO,IAAI,aAAa,MAAM,MAAM,OAAO;CAC7C;;;;;;;;;;;CAYA,AAAO,gBACL,MACA,UACA,UAMI,CAAC,GACL;EAKA,MAAM,mBAAmB,QAAQ,QAAQ,YAAY,MAAM,MAAM,GAAG,CAAC;EAErE,OAAO,KAAK,MAAM;GAAE,QAAQ;GAAM,MAAM;EAAiB,SAAS;GAChE,MAAM,OAAO;GAGb,MAAM,gBAAgB;GAEtB,MAAM,wBAAwB,SAAyB;IACrD,OAAO,SAEJ,CAAC,QAAQ,UAAU,CAAC,QAAQ,OAAO,SAAS,IAAI,OAEhD,CAAC,QAAQ,QAAQ,QAAQ,KAAK,SAAS,IAAI,EAC9C;GACF;GAEA,IAAI,cAAc,QAAQ,qBAAqB,MAAM,GACnD,KAAK,IAAI,MAAM,QAAQ,SAAS,QAAQ,oBAAoB,eAAe,MAAM,GAAG;IAClF,GAAG;IACH,MAAM;IACN,SAAS;GACX,CAAC;GAGH,IAAI,cAAc,OAAO,qBAAqB,KAAK,GACjD,KAAK,IAAI,QAAe,QAAQ,SAAS,OAAO,oBAAoB,eAAe,KAAK,GAAG;IACzF,GAAG;IACH,MAAM;IACN,SAAS;GACX,CAAC;GAGH,IAAI,cAAc,UAAU,qBAAqB,QAAQ,GAAG;IAC1D,MAAM,UAAU,QAAQ,SAAS,UAAU,KAAK,iBAAiB,eAAe,QAAQ;IAExF,KAAK,KAAK,MAAM,SAAS;KACvB,GAAG;KACH,MAAM;KACN,SAAS;IACX,CAAC;GACH;GAEA,IAAI,cAAc,UAAU,qBAAqB,QAAQ,GAAG;IAC1D,MAAM,UAAU,QAAQ,SAAS,UAAU,KAAK,iBAAiB,eAAe,QAAQ;IAExF,KAAK,IAAI,QAAe,SAAS;KAC/B,GAAG;KACH,MAAM;KACN,SAAS;IACX,CAAC;GACH;GAEA,IAAI,cAAc,SAAS,qBAAqB,OAAO,GAAG;IACxD,MAAM,UAAU,QAAQ,SAAS,SAAS,KAAK,iBAAiB,eAAe,OAAO;IAEtF,KAAK,MAAM,QAAe,SAAS;KACjC,GAAG;KACH,MAAM;KACN,SAAS;IACX,CAAC;GACH;GAEA,IAAI,cAAc,UAAU,qBAAqB,QAAQ,GACvD,KAAK,OACH,QACA,QAAQ,SAAS,UAAU,oBAAoB,eAAe,QAAQ,GACtE;IACE,GAAG;IACH,MAAM;IACN,SAAS;GACX,CACF;GAGF,IAAI,cAAc,cAAc,qBAAqB,QAAQ,GAC3D,KAAK,OACH,MACA,QAAQ,SAAS,cAAc,oBAAoB,eAAe,YAAY,GAC9E;IACE,GAAG;IACH,MAAM;IACN,SAAS;GACX,CACF;GAGF,OAAO;EACT,CAAC;CACH;;;;CAKA,AAAO,MAAM,SAA+B,UAA+B;EACzE,MAAM,EACJ,QAOA,OAAO,SAAS,KAAK,OAAO,QAAQ,OAAO,GAAG,GAAG,GAAG,IAAI,QACxD,eACE;EAEJ,IAAI,QACF,KAAK,OAAO,OAAO,KAAK,MAAM;EAGhC,IAAI,MACF,KAAK,OAAO,KAAK,KAAK,IAAI;EAG5B,IAAI,YACF,KAAK,OAAO,WAAW,KAAK,GAAG,UAAU;EAG3C,IAAI;GACF,SAAS;EACX,UAAU;GAGR,IAAI,QACF,KAAK,OAAO,OAAO,IAAI;GAGzB,IAAI,MACF,KAAK,OAAO,KAAK,IAAI;GAGvB,IAAI,YACF,KAAK,OAAO,WAAW,OACrB,KAAK,OAAO,WAAW,SAAS,WAAW,QAC3C,WAAW,MACb;EAEJ;EAEA,OAAO;CACT;;;;CAKA,AAAO,OAAO,QAAgB,UAAsB;EAClD,OAAO,KAAK,MAAM,EAAE,OAAO,GAAG,QAAQ;CACxC;;;;;;;;;;;;;CAcA,AAAO,QAAQ,SAA0B,UAAsB;EAC7D,OAAO,KAAK,OAAO,KAAK,WAAW,QAAQ;CAC7C;;;;;;;CAQA,MAAa,eACX,YACA,UACwB;EAExB,KAAK,OAAO,aAAa;EAEzB,IAAI;GAEF,OAAO,MAAM,SAAS;EACxB,SAAS,OAAO;GAMd,IAAI,MAAM;IACR,QAAQ;IACR,QAAQ;IACR,SAAS,mCAAmC,WAAW;IACvD,SAAS;KAAE;KAAY;IAAM;GAC/B,CAAC;GAED,MAAM;EACR,UAAU;GAGR,OAAO,KAAK,OAAO;EACrB;CACF;;;;;;CAOA,AAAO,yBAAyB,YAA0B;EACxD,IAAI,KAAK,6BAA6B;GACpC,KAAK,4BAA4B,SAAS,KAAK,4BAA4B,OAAO,QAC/E,UAAU,MAAM,eAAe,UAClC;GACA,KAAK,4BAA4B,mBAAmB,IAAI,UAAU;GAClE;EACF;EAEA,KAAK,SAAS,KAAK,OAAO,QAAQ,UAAU,MAAM,eAAe,UAAU;EAI3E,gCAAgC,UAAU;EAE1C,KAAK;CACP;;;;;;;;;CAUA,MAAa,2BACX,aACA,SACY;EACZ,IAAI,KAAK,6BACP,MAAM,IAAI,MAAM,4CAA4C;EAG9D,MAAM,qBAAqB,IAAI,IAAI,WAAW;EAE9C,KAAK,8BAA8B;GACjC,QAAQ,KAAK,OAAO,QAAQ,UAAU,CAAC,mBAAmB,IAAI,MAAM,UAAU,CAAC;GAC/E;GACA,aAAa,CAAC;EAChB;EAEA,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ;GAC7B,MAAM,cAAc,KAAK;GAEzB,KAAK,SAAS,YAAY;GAC1B,KAAK,8BAA8B;GAInC,KAAK,MAAM,cAAc,YAAY,oBACnC,gCAAgC,UAAU;GAG5C,MAAM,kBAAkB,IAAI,IAAI,YAAY,MAAM;GAElD,KAAK,MAAM,SAAS,YAAY,aAC9B,IAAI,gBAAgB,IAAI,KAAK,GAC3B,wBAAwB,MAAM,SAAS,KAAK;GAIhD,KAAK;GAEL,OAAO;EACT,SAAS,OAAO;GACd,KAAK,8BAA8B;GACnC,MAAM;EACR;CACF;;;;CAKA,AAAQ,iBAAiB,UAAyB,QAAuC;EACvF,MAAM,UAAU,oBAAoB,UAAU,MAAM;EAEpD,MAAM,mBAAmB,UAAU,aAAa;EAEhD,IAAI,WAAW,SAAS;GACtB,QAAQ,aAAa;GAErB,IAAI,QAAQ,YAAY,UACtB,QAAQ,WAAW,WAAW,QAAQ,WAAW,SAAS,KAAK,QAAQ;GAGzE,IAAI,SAAS,YAAY,OACvB,QAAQ,aAAa,MAAM,SAAS,WAAW,OAAO,QAAQ,UAAU;GAG1E,OAAO;EACT;EAEA,IAAI,CAAC,SAAS,cAAe,CAAC,oBAAoB,CAAC,SAAS,WAAW,KAAM,OAAO;EAEpF,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB;IACxB,KAAK,UAAU,YAAY,KAAK;KAC/B,SAAS,kBAAkB;GAC9B;GAEA,MAAM,aAAuC,CAAC;GAE9C,IAAI,SAAS,WAAW,IAAI,UAAU,kBAAkB,QACtD;QAAI,CAAC,kBAAkB,UAAU,SAAS,WAAW,IAAI,QAEvD,WAAW,SAAS,SAAS,WAAW,IAAI;SACvC,IAAI,kBAAkB,UAAU,SAAS,WAAW,IAAI,QAE7D,WAAW,SAAS,SAAS,WAAW,IAAI,OAAO,MAAM,iBAAiB,MAAM;SAC3E,IAAI,kBAAkB,UAAU,CAAC,SAAS,WAAW,IAAI,QAE9D,WAAW,SAAS,iBAAiB;GACvC;GAIF,IAAI,kBAAkB,OAAO,kBAAkB,SAC7C,WAAW,WAAW,OAAO,EAAE,SAAS,eAA4B;IAClE,IAAI,kBAAkB,KAAK;KACzB,MAAM,SAAS,MAAM,kBAAkB,IAAI,KAAK,UAAU;MAAE;MAAS;KAAS,CAAC;KAE/E,IAAI,QAAQ,OAAO;IACrB;IAEA,IAAI,kBAAkB,SACpB,OAAO,MAAM,kBAAkB,OAAO,EAAE,KAAK,UAAU;KAAE;KAAS;IAAS,CAAC;GAIhF;GAGF,IAAI,CAAC,QAAQ,UAAU,GACrB,QAAQ,aAAa;EAEzB,OAAO;GACL,QAAQ,aAAa,SAAS,WAAW;GAEzC,IAAI,QAAQ,YAAY,UACtB,QAAQ,WAAW,WAAW,QAAQ,WAAW,SAAS,KAAK,QAAQ;EAE3E;EAEA,OAAO;CACT;;;;CAKA,AAAO,OAAO;EACZ,OAAO,KAAK;CACd;;;;;;;CAQA,AAAO,kBAAkB,UAAiC,CAAC,GAA6B;EACtF,OAAO,OAAO,OACZ,KAAK,OACF,QAAQ,UAAU,CAAC,MAAM,UAAU,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAC3F,KAAK,UAAU;GACd,MAAM,WAAW;IAAE,MAAM,MAAM;IAAO,MAAM,MAAM;IAAM,QAAQ,MAAM;GAAO;GAC7E,MAAM,SAAS,MAAM,SAAS;GAC9B,MAAM,WAAW,SAAS,QAAQ,kBAAkB,QAAQ,KAAK,IAAI;GAGrE,IAAI,CAAC,YAAY,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,GAAG,OAAO,OAAO,OAAO,QAAQ;GAElF,OAAO,OAAO,OAAO;IAAE,GAAG;IAAU,UAAU,OAAO,OAAO,EAAE,GAAG,SAAS,CAAC;GAAE,CAAC;EAChF,CAAC,CACL;CACF;;;;;;;;;CAUA,AAAO,aAAqB;EAC1B,OAAO,KAAK,OAAO;CACrB;;;;CAKA,AAAO,KAAK,QAAyB;EAInC,gCAAgC;EAEhC,KAAK,eAAe,YAAY,SAAS,aAAa,SAAS,MAAM,MAAM,CAAC;EAM5E,MAAM,oBAAoB,IAAI,IAC5B,KAAK,OACF,QAAQ,UAAU,MAAM,OAAO,YAAY,MAAM,MAAM,CAAC,CACxD,KAAK,UAAU,MAAM,IAAI,CAC9B;EAEA,KAAK,OAAO,SAAS,UAAU;GAC7B,MAAM,gBAAgB,MAAM,OAAO,YAAY;GAC/C,MAAM,wBAAwB,OAAO,cAAc,CAAC,KAAK,MAAM;GAE/D,MAAM,UAAU;IACd,GAAG,MAAM;IACT,GAAI,kBAAkB,SACpB,kBAAkB,IAAI,MAAM,IAAI,KAAK,EAAE,iBAAiB,MAAM;IAChE,QAAQ;KACN,GAAG,MAAM,eAAe;KACxB,GAAI,MAAM,aAAa,EAAE,WAAW,oBAAoB,MAAM,SAAS,EAAE;IAC3E;GACF;GAEA,sBACE,MAAM,MACN,SACA,OAAO,aAA6B,UAAwB;IAC1D,MAAM,EAAE,QAAQ,aAAa,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,aAAa,KAAK;IAE7E,OAAO,UAAU,SAAS;GAC5B,CACF;EACF,CAAC;EAED,KAAK,MAAM,oBAAoB,KAAK,mBAClC,OAAO,SAAS,eAAe;GAC7B,GAAG;GACH,eAAe;EACjB,CAAC;EAGH,KAAK,eAAe,eAAe,SAAS,aAAa,SAAS,MAAM,MAAM,CAAC;CACjF;;;;;CAMA,AAAO,cAAc,QAAyB;EAI5C,gCAAgC;EAEhC,KAAK,eAAe,YAAY,SAAS,aAAa,SAAS,MAAM,MAAM,CAAC;EAE5E,IAAI;EACJ,IAAI,kBAAkB;EAEtB,MAAM,oBAAoB,qBAAqB,MAAM;EAOrD,MAAM,6BAA6B;GACjC,IAAI,iBAAiB,oBAAoB,KAAK,eAC5C,OAAO;GAGT,gBAAgB,IAAI,cAAc;GAElC,cAAc,SAAS,KAAK,MAAM;GAElC,kBAAkB,KAAK;GAEvB,OAAO;EACT;EAMA,OAAO,QACL,aACA,OAAO,gBAAgC,iBAA+B;GAIpE,IAAI,eAAe,aAAa,QAAQ,KACtC;GAGF,MAAM,QAAQ,qBAAqB,CAAC,CAAC,KAAK,eAAe,QAAQ,eAAe,GAAG;GAEnF,IAAI,CAAC,OACH;GAGF,AAAC,eAAsC,kBAAkB;GAEzD,eAAe,SAAS,MAAM;GAI9B,MAAM,kBAAkB,MAAM,OAAO,gBAAgB,YAAY;GAEjE,IAAI,aAAa,MACf,OAAO;GAGT,OAAO,cAAc,MAAM,OAAO,aAAa,gBAAgB,YAAY;EAC7E,CACF;EAEA,KAAK,MAAM,SAAS,uBAAuB,QAAQ,SAAS,SAAS,WAAW,GAC9E,OAAO,QAAQ,OAAO,OAAO,gBAAgC,iBAA+B;GAC1F,MAAM,QAAS,eAAsC;GAErD,IAAI,CAAC,OACH;GAGF,OAAO,cAAc,MAAM,OAAO,OAAO,gBAAgB,YAAY;EACvE,CAAC;EAIH,MAAM,kBAAkB,OAAO,gBAAgC,iBAA+B;GAC5F,MAAM,QAAS,eAAsC;GAGrD,IAAI,CAAC,OACH,OAAO,aACJ,KAAK,GAAG,CAAC,CACT,KAAK,kBAAkB,eAAe,QAAQ,eAAe,GAAG,CAAC;GAGtE,IAAI;IAEF,MAAM,EAAE,QAAQ,aAAa,MAAM,KAAK,YAAY,MAAM,KAAK,CAAC,CAC9D,gBACA,YACF;IAEA,OAAO,UAAU,SAAS;GAC5B,SAAS,OAAO;IACd,IAAI,MAAM,UAAU,gBAAgB,OAAgB;KAClD,QAAQ,eAAe;KACvB,KAAK,eAAe;IACtB,CAAC;IAED,MAAM;GACR;EACF;EAQA,MAAM,oBAAoB,iBAAiB,CAAC,CAAC,cAAc;EAE3D,KAAK,MAAM,UAAU,sBAAsB;GACzC,IAAI,WAAW,cAAc,qBAAqB,OAAO,SAAS;IAAE,QAAQ;IAAW,KAAK;GAAI,CAAC,IAC/F;GAGF,OAAO,MAAM;IACX;IACA,KAAK;IACL,GAAI,WAAW,SAAS,EAAE,iBAAiB,MAAM;IACjD,SAAS;GACX,CAAC;EACH;EAGA,KAAK,MAAM,oBAAoB,KAAK,mBAClC,OAAO,SAAS,eAAe;GAC7B,GAAG;GACH,eAAe;EACjB,CAAC;EAGH,KAAK,eAAe,eAAe,SAAS,aAAa,SAAS,MAAM,MAAM,CAAC;CACjF;;;;CAKA,AAAO,SAAS,MAAc,SAA8B,CAAC,GAAG;EAC9D,MAAM,QAAQ,KAAK,OAAO,MAAM,UAAU,MAAM,SAAS,IAAI;EAE7D,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,eAAe,KAAK,YAAY;EAGlD,MAAM,uBAAO,IAAI,IAAY;EAE7B,MAAM,OAAO,MAAM,KAAK,QAAQ,2BAA2B,QAAQ,KAAa,aAAa;GAC3F,MAAM,QAAQ,OAAO;GAErB,IAAI,UAAU,UAAa,UAAU,MAAM;IACzC,IAAI,UAAU,OAAO;IAErB,MAAM,IAAI,MAAM,UAAU,KAAK,oBAAoB,IAAI,QAAQ;GACjE;GAEA,KAAK,IAAI,GAAG;GAEZ,OAAO,mBAAmB,OAAO,KAAK,CAAC;EACzC,CAAC;EAED,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAC9B,QAAQ,QAAQ,CAAC,KAAK,IAAI,GAAG,KAAK,OAAO,SAAS,UAAa,OAAO,SAAS,IAAI,CAAC,CACpF,KAAK,QAAQ,GAAG,mBAAmB,GAAG,EAAE,GAAG,mBAAmB,OAAO,OAAO,IAAI,CAAC,GAAG,CAAC,CACrF,KAAK,GAAG;EAEX,OAAO,QAAQ,GAAG,KAAK,GAAG,UAAU;CACtC;;;;CAKA,AAAQ,YAAY,OAAc;EAChC,OAAO,OAAO,gBAAgC,oBAAkC;GAC9E,MAAM,UAAU,IAAI,QAAQ;GAC5B,MAAM,WAAW,IAAI,SAAS;GAC9B,SAAS,YAAY,eAAe;GACpC,QAAQ,WAAW;GAEnB,SAAS,UAAU;GAQnB,MAAM,iBAAiB,iBAAiB;GACxC,MAAM,sBAAsB,iBAAiB,YAAY,IAAI,IAAI;GAEjE,QAAQ,WAAW,cAAc,CAAC,CAAC,SAAS,KAAK;GAEjD,IAAI,gBACF,cAAc,oBAAoB,OAAO,GAAG;IAC1C,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;IAChC,OAAO,EAAE,OAAO,MAAM,KAAK;GAC7B,CAAC;GA+BH,IAAI,SAAS,MAtBQ,oBACnB;IACE,OAAO,UAAU,IAAI,KAAK,KAAK;IAC/B,OAAO,UAAU,IAAI,KAAK,KAAK;IAC/B,QAAQ,UAAU,IAAI,MAAM,KAAK;IACjC,WAAW,YAAY,IAAI;GAC7B,GACA;IACE,QAAQ;IACR,QAAQ,oBAAoB,MAAM,QAAQ,MAAM,IAAI;IACpD,WAAW,QAAQ;IACnB,SAAS;KAAE;KAAS;IAAS;IAC7B;IAEA,kBAAkB,gBAAgB;GACpC,SACM,QAAQ,QAAQ,CACxB;GAOA,IACE,WAAW,UACX,WAAW,QACX,EAAE,kBAAkB,aACnB,WAAuB,iBAExB,SAAS,MAAM,SAAS,KAAK,MAAM;GAGrC,OAAO;IACL;IACA;IACA;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,OAAO,YAAY;AAEzC,UAAU,IAAI,UAAU,MAAM"}
+{"version":3,"file":"router.mjs","names":["configAccessor"],"sources":["../../../../../../../../packages/core/src/router/router.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport proxy, { type FastifyHttpProxyOptions } from \"@fastify/http-proxy\";\nimport { WarlockError } from \"../errors/warlock-error\";\nimport type { FastifyStaticOptions } from \"@fastify/static\";\nimport { ltrim, merge, toCamelCase, trim } from \"@mongez/reinforcements\";\nimport { isEmpty } from \"@mongez/supportive-is\";\nimport { log } from \"@warlock.js/logger\";\nimport type { FastifyReply, FastifyRequest } from \"fastify\";\nimport { container } from \"../container\";\nimport { registerLazyStatic } from \"../http/lazy-static\";\nimport { buildCorsOptions } from \"../http/build-cors-options\";\nimport { Request } from \"../http/request\";\nimport { buildRequestLogSnapshot } from \"../http/request-log-snapshot\";\nimport { Response } from \"../http/response\";\nimport { type FastifyInstance } from \"../http/server\";\nimport { buildTracingContext, dispatchPhase, isTracingEnabled } from \"../http/tracing\";\nimport { describeRouteForLog } from \"./describe-route-for-log\";\nimport { logRequestLifecycle } from \"./log-request-lifecycle\";\nimport {\n  forgetPositionalHandlerSuspects,\n  inspectHandlerSignature,\n  reportPositionalHandlerSuspects,\n} from \"./positional-handler-diagnostics\";\nimport { reportUnguardedMutatingRoutes } from \"./unguarded-route-diagnostics\";\nimport { config as configAccessor } from \"../config/config-getter\";\nimport { normalizeRoutePath } from \"./normalize-route-path\";\nimport { RouteBuilder } from \"./route-builder\";\nimport { resolveRouteRateLimit, resolveStaticRateLimit } from \"./resolve-route-rate-limit\";\nimport { RouteNameTakenError } from \"./route-name-taken-error\";\nimport { DEV_DISPATCH_METHODS, buildNotFoundBody, createDevRateLimiter } from \"./dev-dispatch\";\nimport { RouteRegistry } from \"./route-registry\";\nimport { routeNameMethodSuffix } from \"./route-name-method-suffix\";\nimport type {\n  GroupedRoutesOptions,\n  HttpContext,\n  NamedApiRoute,\n  NamedApiRoutesOptions,\n  RequestHandler,\n  RequestHandlerType,\n  RequestHandlerValidation,\n  ResourceMethod,\n  Route,\n  RouteOptions,\n  RouteResource,\n  RouterGroupCallback,\n  RouterStacks,\n  StaticMountOptions,\n} from \"./types\";\n\n/**\n * A Fastify lifecycle hook as it may be declared in a route's `serverOptions`.\n * Fastify accepts a single hook or an array in either position.\n */\ntype RouteLifecycleHook = (\n  request: FastifyRequest,\n  reply: FastifyReply,\n) => unknown | Promise<unknown>;\n\n/**\n * The pre-handler phases the dev server forwards from a route's `serverOptions`.\n *\n * These are the admission-control phases and they share the `(request, reply)`\n * signature. `preParsing` is deliberately absent — it must return the payload\n * stream, so forwarding it generically would corrupt the body rather than\n * guard it. `bodyLimit` cannot be forwarded at all; Fastify reads it at\n * registration time and no hook can bound a body already being parsed.\n */\nconst FORWARDED_ROUTE_PHASES = [\"onRequest\", \"preValidation\", \"preHandler\"] as const;\n\ntype ForwardedRoutePhase = (typeof FORWARDED_ROUTE_PHASES)[number];\n\n/**\n * The route the dev dispatcher matched, stashed on the request so the hooks and\n * the wildcard handler all act on one match rather than each matching again.\n */\ntype DevMatchedRoute = { route: Route; params: Record<string, string> };\n\ntype DevDispatchRequest = FastifyRequest & {\n  matchedDevRoute?: DevMatchedRoute;\n};\n\nfunction toHookList(\n  hook: RouteLifecycleHook | RouteLifecycleHook[] | undefined,\n): RouteLifecycleHook[] {\n  if (!hook) {\n    return [];\n  }\n\n  return Array.isArray(hook) ? hook : [hook];\n}\n\n/**\n * Run a matched route's hooks for one phase.\n *\n * Returning the reply is how an async Fastify hook signals that it has answered\n * the request; the chain must stop there, so the value is propagated rather\n * than discarded.\n */\nasync function runRouteHooks(\n  route: Route,\n  phase: ForwardedRoutePhase,\n  request: FastifyRequest,\n  reply: FastifyReply,\n) {\n  const hooks = toHookList(\n    route.serverOptions?.[phase] as RouteLifecycleHook | RouteLifecycleHook[] | undefined,\n  );\n\n  for (const hook of hooks) {\n    const outcome = await hook(request, reply);\n\n    if (outcome === reply) {\n      return reply;\n    }\n  }\n\n  return undefined;\n}\n\n/**\n * Bound functions do not inherit static properties, so the handler metadata that\n * documentation and typings read (`responseSchema`) is copied onto the bound copy.\n */\nfunction copyResponseSchema(source: unknown, target: RequestHandler): void {\n  const responseSchema = (source as RequestHandler | undefined)?.responseSchema;\n\n  if (responseSchema) {\n    target.responseSchema = responseSchema;\n  }\n}\n\n/**\n * Bind a restful resource method to its resource, keeping its `responseSchema`.\n */\nfunction bindResourceHandler(\n  resource: RouteResource,\n  method: ResourceMethod | \"bulkDelete\",\n): RequestHandler {\n  const source = resource[method];\n  const handler = source?.bind(resource) as RequestHandler;\n\n  copyResponseSchema(source, handler);\n\n  return handler;\n}\n\n/**\n * Describe one claimant of a route name, for the duplicate-name error.\n *\n * `warlock dev` registers SSR page routes on the same router as API routes, so\n * the two share a single route-name namespace and collide across kinds. The\n * error is only actionable if it says which claimant is which, so `isPage` —\n * the router's only route-kind discriminator — is what separates them here.\n *\n * `sourceFile` is stamped only on routes registered through `withSourceFile`.\n * Routes registered without that scope have no owner, so say the source is\n * unknown rather than printing an empty string.\n */\nfunction describeRouteClaimant(route: Route) {\n  const type = route.isPage ? \"page route\" : \"API route\";\n  const source = route.sourceFile ? `declared in ${route.sourceFile}` : \"source file unknown\";\n\n  return `${type} ${route.method} ${route.path} (${source})`;\n}\n\nexport class Router {\n  /**\n   * Routes list\n   */\n  private routes: Route[] = [];\n\n  /**\n   * Bumped on every mutation of {@link routes}.\n   *\n   * The dev dispatcher caches a route registry and needs to know when it is\n   * stale. Comparing `routes.length` would miss an HMR reload that replaces a\n   * route without changing the count — the registry would then keep matching\n   * paths that no longer exist. A version counter cannot miss that.\n   */\n  private routesVersion = 0;\n\n  /**\n   * In-progress atomic replacement, when one exists. Reads continue to use\n   * {@link routes}; mutations and collision checks use this isolated draft.\n   */\n  private routeReplacementTransaction?: {\n    routes: Route[];\n    removedSourceFiles: Set<string>;\n    addedRoutes: Route[];\n  };\n\n  /**\n   * Set by the dev server: whether to warn about mutating routes that have no\n   * auth middleware and no `public: true` (`http.warnUnguardedRoutes`).\n   */\n  private warnUnguardedRoutes = false;\n\n  /**\n   * Router Instance\n   */\n  private static instance: Router;\n\n  /**\n   * Static paths\n   */\n  protected staticDirectories: {\n    options: FastifyStaticOptions;\n    rateLimit: StaticMountOptions[\"rateLimit\"];\n  }[] = [];\n\n  /**\n   * Event listeners\n   */\n  protected eventListeners: Record<string, ((router: Router, server: FastifyInstance) => void)[]> =\n    {};\n\n  /**\n   * Stacks\n   * Stacks will be used for grouping routes to add prefix, name or middleware\n   */\n  protected stacks: RouterStacks = {\n    prefix: [],\n    name: [],\n    middleware: [],\n  };\n\n  /**\n   * Get router instance\n   */\n  public static getInstance() {\n    if (!Router.instance) {\n      Router.instance = new Router();\n    }\n\n    return Router.instance;\n  }\n\n  private constructor() {\n    //\n  }\n\n  /**\n   * Listen to router before scan\n   */\n  public beforeScanning(callback: (router: Router, server: FastifyInstance) => void) {\n    this.eventListeners.beforeScan = [...(this.eventListeners.beforeScan || []), callback];\n\n    return this;\n  }\n\n  /**\n   * Listen to router after scanning\n   */\n  public afterScanning(callback: (router: Router, server: FastifyInstance) => void) {\n    this.eventListeners.afterScanning = [...(this.eventListeners.afterScanning || []), callback];\n\n    return this;\n  }\n\n  /**\n   * Redirect path to another path\n   */\n  public redirect(from: string, to: string, redirectMode: \"temporary\" | \"permanent\" = \"temporary\") {\n    return this.get(from, ({ response }) => {\n      response.redirect(to, redirectMode === \"temporary\" ? 302 : 301);\n    });\n  }\n\n  /**\n   * Serve a static folder.\n   *\n   * Static mounts are exempt from the global rate limiter by default; set\n   * `http.rateLimit.staticFiles: true` to count every mount, or pass\n   * `{ rateLimit }` to decide for this mount alone: `true` counts it against\n   * the global limiter, `false` exempts it, and an object gives it its own\n   * limit and bucket.\n   *\n   * @example\n   * router.directory({ root: rootPath(\"docs\"), prefix: \"/docs/\" });\n   * router.directory({ root: rootPath(\"exports\"), prefix: \"/exports/\" }, { rateLimit: true });\n   */\n  public directory(options: FastifyStaticOptions, mountOptions: StaticMountOptions = {}) {\n    this.staticDirectories.push({ options, rateLimit: mountOptions.rateLimit });\n\n    return this;\n  }\n\n  /** Declare static routes at boot; load the upstream sender on the first file request. */\n  protected registerStaticDirectories(server: FastifyInstance) {\n    for (const directory of this.staticDirectories) {\n      registerLazyStatic(\n        server,\n        { ...directory.options, decorateReply: false },\n        { rateLimit: resolveStaticRateLimit(directory.rateLimit) },\n      );\n    }\n  }\n\n  /**\n   * Register a GET route that serves a static file. Like `directory()`, it is\n   * exempt from the global rate limiter unless `http.rateLimit.staticFiles`\n   * or its own `rateLimit` says otherwise.\n   */\n  protected addStaticFileRoute(\n    path: string,\n    handler: RequestHandler,\n    mountOptions: StaticMountOptions = {},\n  ) {\n    this.get(\n      path,\n      handler,\n      mountOptions.rateLimit === undefined ? {} : { rateLimit: mountOptions.rateLimit },\n    );\n\n    const routes = this.routeReplacementTransaction?.routes ?? this.routes;\n    const route = routes[routes.length - 1];\n\n    if (route) route.$staticFile = true;\n\n    return this;\n  }\n\n  /**\n   * Serve file\n   */\n  public file(\n    path: string,\n    location: string,\n    cacheTime?: number,\n    mountOptions: StaticMountOptions = {},\n  ) {\n    return this.addStaticFileRoute(\n      path,\n      ({ response }) => {\n        response.sendFile(location, cacheTime);\n      },\n      mountOptions,\n    );\n  }\n\n  /**\n   * Serve cached file, it will cache the file to 1 year by default\n   */\n  public cachedFile(\n    path: string,\n    location: string,\n    cacheTime?: number,\n    mountOptions: StaticMountOptions = {},\n  ) {\n    return this.addStaticFileRoute(\n      path,\n      ({ response }) => {\n        response.sendCachedFile(location, cacheTime);\n      },\n      mountOptions,\n    );\n  }\n\n  /**\n   * Serve list of files\n   */\n  public files(\n    files: Record<string, string>,\n    cacheTime?: number,\n    mountOptions: StaticMountOptions = {},\n  ) {\n    for (const [path, location] of Object.entries(files)) {\n      this.file(path, location, cacheTime, mountOptions);\n    }\n  }\n\n  /**\n   * Serve list of cached files, it will cache the file to 1 year by default\n   */\n  public cachedFiles(\n    files: Record<string, string>,\n    cacheTime?: number,\n    mountOptions: StaticMountOptions = {},\n  ) {\n    for (const [path, location] of Object.entries(files)) {\n      this.cachedFile(path, location, cacheTime, mountOptions);\n    }\n  }\n\n  /**\n   * Add proxy route\n   */\n  public proxy(\n    path: string,\n    baseUrl: string,\n    options?: Omit<FastifyHttpProxyOptions, \"prefix\" | \"upstream\">,\n  ): this;\n  public proxy(options: FastifyHttpProxyOptions): this;\n  public proxy(...args: any[]) {\n    this.beforeScanning((_router, server) => {\n      if (args.length === 1) {\n        server.register(proxy, args[0]);\n      } else {\n        server.register(proxy, {\n          prefix: args[0],\n          upstream: args[1],\n          ...args[2],\n        });\n      }\n    });\n\n    return this;\n  }\n\n  /**\n   * Add route to routes list\n   */\n  public add(\n    method: Route[\"method\"],\n    path: string | string[],\n    handler: RequestHandlerType,\n    options: RouteOptions = {},\n  ) {\n    if (Array.isArray(path)) {\n      path.forEach((p) => this.add(method, p, handler, options));\n      return this;\n    }\n\n    const prefix = this.stacks.prefix.reduce((path, prefix) => {\n      return normalizeRoutePath(path, prefix);\n    }, \"\");\n\n    const name = this.stacks.name.reduceRight(\n      (name, prefixName) => {\n        return trim(prefixName + \".\" + name, \".\");\n      },\n      options.name || trim(path.replace(/\\//g, \".\"), \".\"),\n    );\n\n    // The one place a route path becomes canonical. `normalizeRoutePath` is\n    // exported so the build-time page-route manifest can produce the very same\n    // string without registering anything.\n    path = normalizeRoutePath(prefix, path);\n\n    const middlewarePrecedence = options.middlewarePrecedence || \"after\";\n\n    // Work on a copy: the caller may reuse one options object for several\n    // routes, and merging the group stack into it would compound per route.\n    options = { ...options };\n\n    if (middlewarePrecedence === \"before\") {\n      options.middleware = [...(options.middleware || []), ...this.stacks.middleware];\n    } else {\n      options.middleware = [...this.stacks.middleware, ...(options.middleware || [])];\n    }\n\n    // An enclosing `router.group({ public: true })` makes the route public\n    // unless it says otherwise itself.\n    if (options.public === undefined && (this.stacks.public ?? 0) > 0) {\n      options.public = true;\n    }\n\n    if (Array.isArray(handler)) {\n      const [controller, action] = handler;\n\n      if (typeof controller[action] !== \"function\") {\n        throw new WarlockError(\n          \"WL3002\",\n          `Invalid controller action \"${action}\" for controller \"${controller.constructor.name}\"`,\n        );\n      }\n\n      handler = controller[action].bind(controller) as RequestHandler;\n      copyResponseSchema(controller[action], handler);\n\n      if (!handler.validation) {\n        handler.validation = {};\n        if (controller[`${action}ValidationSchema`]) {\n          handler.validation.schema = controller[`${action}ValidationSchema`]();\n        }\n\n        if (controller[`${action}Validate`]) {\n          handler.validation.validate = controller[`${action}Validate`];\n        }\n      }\n    }\n\n    const routeData: Route = {\n      method,\n      path,\n      handler,\n      ...options,\n      name,\n      rateLimit: options.rateLimit,\n      $prefix: prefix || \"/\",\n      // it must be a new array to avoid modifying the original array\n      $prefixStack: [...this.stacks.prefix],\n      // Inject source file from stacks if set\n      sourceFile: this.stacks.sourceFile || \"\",\n    };\n\n    const routes = this.routeReplacementTransaction?.routes ?? this.routes;\n\n    if (routeData.name) {\n      // check if the name exists\n      const route = routes.find((route) => route.name === routeData.name);\n\n      if (route) {\n        // check again if the route name exists with the same method\n        if (route.method === routeData.method) {\n          throw new RouteNameTakenError(\n            routeData.name,\n            `Route name \"${routeData.name}\" is already taken.\\n` +\n              `  already registered: ${describeRouteClaimant(route)}\\n` +\n              `  now being added:    ${describeRouteClaimant(routeData)}\\n` +\n              `Pages and API routes share one route-name namespace, so a name can only be ` +\n              `claimed once. Rename one of them via the \"name\" route option.`,\n          );\n        } else {\n          routeData.name += routeNameMethodSuffix(routeData.method);\n        }\n      }\n    }\n\n    // Registration-time only — nothing here runs per request. Suspects are\n    // collected now and reported together at boot (see `scan`), so a route file\n    // written against v4 produces one legible list instead of a mystery 500 per\n    // request. Recorded after the collision check so a route that never lands\n    // is never reported.\n    if (this.routeReplacementTransaction) {\n      this.routeReplacementTransaction.addedRoutes.push(routeData);\n    } else {\n      inspectHandlerSignature(routeData.handler, routeData);\n    }\n\n    routes.push(routeData);\n\n    if (!this.routeReplacementTransaction) {\n      this.routesVersion++;\n    }\n\n    return this;\n  }\n\n  /**\n   * Add a request that accepts all methods\n   */\n  public any(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"all\" as Route[\"method\"], path, handler, options);\n  }\n\n  /**\n   * Add get request method\n   */\n  public get(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"GET\", path, handler, options);\n  }\n\n  /**\n   * Add post request method\n   */\n  public post(path: string | string[], handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"POST\", path, handler, options);\n  }\n\n  /**\n   * Add put request method\n   */\n  public put(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"PUT\", path, handler, options);\n  }\n\n  /**\n   * Add delete request method\n   */\n  public delete(path: string | string[], handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"DELETE\", path, handler, options);\n  }\n\n  /**\n   * Add patch request method\n   */\n  public patch(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"PATCH\", path, handler, options);\n  }\n\n  /**\n   * Add head request method\n   */\n  public head(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"HEAD\", path, handler, options);\n  }\n\n  /**\n   * Add options request method\n   */\n  public options(path: string, handler: RequestHandlerType, options: RouteOptions = {}) {\n    return this.add(\"OPTIONS\", path, handler, options);\n  }\n\n  /**\n   * Get a chainable route builder for the same route path\n   */\n  public route(path: string, options: RouteOptions = {}) {\n    return new RouteBuilder(this, path, options);\n  }\n\n  /**\n   * Add full restful resource routes\n   * This method will generate the following routes:\n   * 1. GET /path: list all resources\n   * 2. GET /path/:id: get a single resource\n   * 3. POST /path: create a new resource\n   * 4. PUT /path/:id: update a resource\n   * 5. DELETE /path/:id: delete a resource\n   * 6. PATCH /path/:id: update a resource partially\n   */\n  public restfulResource(\n    path: string,\n    resource: RouteResource,\n    options: RouteOptions & {\n      only?: ResourceMethod[];\n      except?: ResourceMethod[];\n      replace?: Partial<Record<ResourceMethod, RequestHandler>> & {\n        bulkDelete?: RequestHandler;\n      };\n    } = {},\n  ) {\n    // Derive the base resource name from the path before the group below\n    // clears it for use as the routes' relative path. `options.name`, when\n    // given, replaces the path-derived name entirely (see the explicit\n    // `name` passed to `group()`) rather than composing with it.\n    const baseResourceName = options.name || toCamelCase(ltrim(path, \"/\"));\n\n    return this.group({ prefix: path, name: baseResourceName }, () => {\n      const path = \"\";\n\n      // clone the resource so we don't mess up with it\n      const routeResource = resource;\n\n      const isAcceptableResource = (type: ResourceMethod) => {\n        return Boolean(\n          // check if the route is not excluded\n          (!options.except || !options.except.includes(type)) &&\n          // check if the only option is set and the route is included\n          (!options.only || options.only.includes(type)),\n        );\n      };\n\n      if (routeResource.list && isAcceptableResource(\"list\")) {\n        this.get(path, options.replace?.list || bindResourceHandler(routeResource, \"list\"), {\n          ...options,\n          name: \"list\",\n          restful: true,\n        });\n      }\n\n      if (routeResource.get && isAcceptableResource(\"get\")) {\n        this.get(path + \"/:id\", options.replace?.get || bindResourceHandler(routeResource, \"get\"), {\n          ...options,\n          name: \"single\",\n          restful: true,\n        });\n      }\n\n      if (routeResource.create && isAcceptableResource(\"create\")) {\n        const handler = options.replace?.create || this.manageValidation(routeResource, \"create\");\n\n        this.post(path, handler, {\n          ...options,\n          name: \"create\",\n          restful: true,\n        });\n      }\n\n      if (routeResource.update && isAcceptableResource(\"update\")) {\n        const handler = options.replace?.update || this.manageValidation(routeResource, \"update\");\n\n        this.put(path + \"/:id\", handler, {\n          ...options,\n          name: \"update\",\n          restful: true,\n        });\n      }\n\n      if (routeResource.patch && isAcceptableResource(\"patch\")) {\n        const handler = options.replace?.patch || this.manageValidation(routeResource, \"patch\");\n\n        this.patch(path + \"/:id\", handler, {\n          ...options,\n          name: \"patch\",\n          restful: true,\n        });\n      }\n\n      if (routeResource.delete && isAcceptableResource(\"delete\")) {\n        this.delete(\n          path + \"/:id\",\n          options.replace?.delete || bindResourceHandler(routeResource, \"delete\"),\n          {\n            ...options,\n            name: \"delete\",\n            restful: true,\n          },\n        );\n      }\n\n      if (routeResource.bulkDelete && isAcceptableResource(\"delete\")) {\n        this.delete(\n          path,\n          options.replace?.bulkDelete || bindResourceHandler(routeResource, \"bulkDelete\"),\n          {\n            ...options,\n            name: \"bulkDelete\",\n            restful: true,\n          },\n        );\n      }\n\n      return this;\n    });\n  }\n\n  /**\n   * Group routes with options\n   */\n  public group(options: GroupedRoutesOptions, callback: RouterGroupCallback) {\n    const {\n      prefix,\n      // name must always be defined because\n      // if there are multiple groups without name\n      // they might generate the same route name\n      // thus causing an error\n      // in this case we need always to make sure that\n      // the name is always defined.\n      name = prefix ? trim(prefix.replace(/\\//g, \".\"), \".\") : undefined,\n      middleware,\n      public: isPublic,\n    } = options;\n\n    if (isPublic) {\n      this.stacks.public = (this.stacks.public ?? 0) + 1;\n    }\n\n    if (prefix) {\n      this.stacks.prefix.push(prefix);\n    }\n\n    if (name) {\n      this.stacks.name.push(name);\n    }\n\n    if (middleware) {\n      this.stacks.middleware.push(...middleware);\n    }\n\n    try {\n      callback();\n    } finally {\n      // Always pop/splice this group's stacks, even if the callback throws,\n      // so a throwing group never leaks state onto the process-global singleton.\n      if (prefix) {\n        this.stacks.prefix.pop();\n      }\n\n      if (name) {\n        this.stacks.name.pop();\n      }\n\n      if (middleware) {\n        this.stacks.middleware.splice(\n          this.stacks.middleware.length - middleware.length,\n          middleware.length,\n        );\n      }\n      if (isPublic) {\n        this.stacks.public = (this.stacks.public ?? 1) - 1;\n      }\n    }\n\n    return this;\n  }\n\n  /**\n   * Add prefix to all routes in the given callback\n   */\n  public prefix(prefix: string, callback: () => void) {\n    return this.group({ prefix }, callback);\n  }\n\n  /**\n   * Add API version prefix to all routes in the given callback\n   * Automatically formats the version as /v{version}\n   * @example\n   * router.version(\"1\", () => {\n   *   router.get(\"/users\", getUsersV1); // /v1/users\n   * });\n   *\n   * router.version(\"2\", () => {\n   *   router.get(\"/users\", getUsersV2); // /v2/users\n   * });\n   */\n  public version(version: string | number, callback: () => void) {\n    return this.prefix(`/v${version}`, callback);\n  }\n\n  /**\n   * Wrap route additions with a source file path\n   * Used for tracking which routes come from which file (for HMR)\n   * @param sourceFile Relative path to the source file (e.g., \"src/app/users/routes.ts\")\n   * @param callback Function that adds routes (will have sourceFile injected)\n   */\n  public async withSourceFile<T = any>(\n    sourceFile: string,\n    callback: () => T | Promise<T>,\n  ): Promise<T | undefined> {\n    // Set source file in stacks\n    this.stacks.sourceFile = sourceFile;\n\n    try {\n      // Execute callback (routes added here will have sourceFile injected)\n      return await callback();\n    } catch (error) {\n      // Log loudly, then RETHROW. Swallowing here silently dropped a whole\n      // route file (duplicate name, invalid action, import error) so the\n      // surface 404'd with no boot error. The caller decides what a throw\n      // means: at boot it aborts the boot, during HMR the dev server's\n      // batch-reload handler catches it, prints it, and keeps serving.\n      log.error({\n        module: \"router\",\n        action: \"registerRoutes\",\n        message: `Failed to register routes from \"${sourceFile}\"`,\n        context: { sourceFile, error },\n      });\n\n      throw error;\n    } finally {\n      // Always clear source file from stacks so a throwing file never leaks\n      // its sourceFile onto the process-global singleton.\n      delete this.stacks.sourceFile;\n    }\n  }\n\n  /**\n   * Remove all routes that belong to a specific source file\n   * Used when reloading routes files via HMR\n   * @param sourceFile Relative path to the source file\n   */\n  public removeRoutesBySourceFile(sourceFile: string): void {\n    if (this.routeReplacementTransaction) {\n      this.routeReplacementTransaction.routes = this.routeReplacementTransaction.routes.filter(\n        (route) => route.sourceFile !== sourceFile,\n      );\n      this.routeReplacementTransaction.removedSourceFiles.add(sourceFile);\n      return;\n    }\n\n    this.routes = this.routes.filter((route) => route.sourceFile !== sourceFile);\n\n    // Keep the signature diagnostics in step, so a reload that fixes a handler\n    // stops reporting the version it replaced.\n    forgetPositionalHandlerSuspects(sourceFile);\n\n    this.routesVersion++;\n  }\n\n  /**\n   * Atomically replace every route owned by the given exact source-file keys.\n   *\n   * The installer mutates an isolated draft. Public reads keep seeing the old\n   * live table across awaits, and a failed installer discards every draft\n   * mutation. A successful installer swaps the whole draft in one synchronous\n   * commit and invalidates the dev route registry exactly once.\n   */\n  public async replaceRoutesBySourceFiles<T>(\n    sourceFiles: Iterable<string>,\n    install: () => T | Promise<T>,\n  ): Promise<T> {\n    if (this.routeReplacementTransaction) {\n      throw new Error(\"Cannot nest route replacement transactions\");\n    }\n\n    const removedSourceFiles = new Set(sourceFiles);\n\n    this.routeReplacementTransaction = {\n      routes: this.routes.filter((route) => !removedSourceFiles.has(route.sourceFile)),\n      removedSourceFiles,\n      addedRoutes: [],\n    };\n\n    try {\n      const result = await install();\n      const transaction = this.routeReplacementTransaction!;\n\n      this.routes = transaction.routes;\n      this.routeReplacementTransaction = undefined;\n\n      // Diagnostic state follows the same commit boundary as the route table.\n      // Added routes were deliberately not inspected while still speculative.\n      for (const sourceFile of transaction.removedSourceFiles) {\n        forgetPositionalHandlerSuspects(sourceFile);\n      }\n\n      const committedRoutes = new Set(transaction.routes);\n\n      for (const route of transaction.addedRoutes) {\n        if (committedRoutes.has(route)) {\n          inspectHandlerSignature(route.handler, route);\n        }\n      }\n\n      if (this.warnUnguardedRoutes) {\n        reportUnguardedMutatingRoutes(\n          transaction.addedRoutes.filter((route) => committedRoutes.has(route)),\n        );\n      }\n\n      this.routesVersion++;\n\n      return result;\n    } catch (error) {\n      this.routeReplacementTransaction = undefined;\n      throw error;\n    }\n  }\n\n  /**\n   * Manage validation system for the given resource\n   */\n  private manageValidation(resource: RouteResource, method: \"create\" | \"update\" | \"patch\") {\n    const handler = bindResourceHandler(resource, method);\n\n    const methodValidation = resource?.validation?.[method];\n\n    if (method === \"patch\") {\n      handler.validation = methodValidation;\n\n      if (handler.validation?.validate) {\n        handler.validation.validate = handler.validation.validate.bind(resource);\n      }\n\n      if (resource.validation?.patch) {\n        handler.validation = merge(resource.validation.patch, handler.validation);\n      }\n\n      return handler;\n    }\n\n    if (!resource.validation || (!methodValidation && !resource.validation.all)) return handler;\n\n    if (resource.validation.all) {\n      const validationMethods = {\n        all: resource?.validation?.all?.validate,\n        [method]: methodValidation?.validate,\n      };\n\n      const validation: RequestHandlerValidation = {};\n\n      if (resource.validation.all.schema || methodValidation?.schema) {\n        if (!methodValidation?.schema && resource.validation.all.schema) {\n          // Case 2: Only all.schema exists - clone it for this method\n          validation.schema = resource.validation.all.schema;\n        } else if (methodValidation?.schema && resource.validation.all.schema) {\n          // Case 3: Both exist - merge them (all is base, method overrides)\n          validation.schema = resource.validation.all.schema.merge(methodValidation.schema);\n        } else if (methodValidation?.schema && !resource.validation.all.schema) {\n          // Case 1: Only method schema exists - use it directly\n          validation.schema = methodValidation.schema;\n        }\n        // Case 4: Neither exists - handled by outer if being false\n      }\n\n      if (validationMethods.all || validationMethods[method]) {\n        validation.validate = async ({ request, response }: HttpContext) => {\n          if (validationMethods.all) {\n            const output = await validationMethods.all.call(resource, { request, response });\n\n            if (output) return output;\n          }\n\n          if (validationMethods[method]) {\n            return await validationMethods[method]?.call(resource, { request, response });\n          }\n\n          return;\n        };\n      }\n\n      if (!isEmpty(validation)) {\n        handler.validation = validation;\n      }\n    } else {\n      handler.validation = resource.validation[method];\n\n      if (handler.validation?.validate) {\n        handler.validation.validate = handler.validation.validate.bind(resource);\n      }\n    }\n\n    return handler;\n  }\n\n  /**\n   * Get all routes list\n   */\n  public list() {\n    return this.routes;\n  }\n\n  /**\n   * Return fresh browser-safe snapshots of named, non-page routes.\n   *\n   * Names are the registered names, including method suffixes. `all` stays\n   * intact as route metadata; consumers decide whether their use supports it.\n   */\n  public getNamedApiRoutes(options: NamedApiRoutesOptions = {}): readonly NamedApiRoute[] {\n    return Object.freeze(\n      this.routes\n        .filter((route) => !route.isPage && typeof route.name === \"string\" && route.name.length > 0)\n        .map((route) => {\n          const snapshot = { name: route.name!, path: route.path, method: route.method };\n          const schema = route.handler?.responseSchema;\n          const response = schema ? options.resolveResponse?.(schema, route) : undefined;\n\n          // A route without a declared schema keeps exactly the three-key record.\n          if (!response || Object.keys(response).length === 0) return Object.freeze(snapshot);\n\n          return Object.freeze({ ...snapshot, response: Object.freeze({ ...response }) });\n        }),\n    );\n  }\n\n  /**\n   * Number of routes currently registered on the singleton.\n   *\n   * Used as a readiness signal: a successful boot that ends up with zero\n   * routes almost always means a route module failed to register silently\n   * (see `withSourceFile`), so callers can surface that instead of letting\n   * the whole surface 404.\n   */\n  public routeCount(): number {\n    return this.routes.length;\n  }\n\n  /**\n   * Register routes to the server\n   */\n  public scan(server: FastifyInstance) {\n    // Every route is registered by the time we scan, so this is the first\n    // moment the whole list can be reported at once — and it is still before a\n    // single request is served.\n    reportPositionalHandlerSuspects();\n\n    this.eventListeners.beforeScan?.forEach((callback) => callback(this, server));\n\n    // Fastify automatically exposes HEAD for every GET route. When an app\n    // declares its own HEAD route at the same path, suppress only that GET\n    // route's implicit registration so the explicit handler owns HEAD,\n    // regardless of declaration order.\n    const explicitHeadPaths = new Set(\n      this.routes\n        .filter((route) => route.method.toLowerCase() === \"head\")\n        .map((route) => route.path),\n    );\n\n    this.routes.forEach((route) => {\n      const requestMethod = route.method.toLowerCase();\n      const requestMethodFunction = server[requestMethod].bind(server);\n\n      const options = {\n        ...route.serverOptions,\n        ...(requestMethod === \"get\" &&\n          explicitHeadPaths.has(route.path) && { exposeHeadRoute: false }),\n        config: {\n          ...route.serverOptions?.config,\n          // `undefined` keeps the global policy; `false` exempts the route.\n          rateLimit: resolveRouteRateLimit(route),\n        },\n      };\n\n      requestMethodFunction(\n        route.path,\n        options,\n        async (baseRequest: FastifyRequest, reply: FastifyReply) => {\n          const { output, response } = await this.handleRoute(route)(baseRequest, reply);\n\n          return output || response.baseResponse;\n        },\n      );\n    });\n\n    this.registerStaticDirectories(server);\n\n    this.eventListeners.afterScanning?.forEach((callback) => callback(this, server));\n  }\n\n  /**\n   * Scan routes for the development server\n   * Uses wildcard routing with find-my-way for HMR support\n   */\n  public scanDevServer(server: FastifyInstance) {\n    // Same boot-time report as production `scan`. Routes reloaded later by HMR\n    // are still recorded, but only surface on the next scan or via\n    // `warlock doctor`.\n    reportPositionalHandlerSuspects();\n\n    // Development only: list mutating routes nobody guarded. Routes added by a\n    // later HMR reload are reported when their replacement commits.\n    this.warnUnguardedRoutes =\n      configAccessor.key<boolean>(\"http.warnUnguardedRoutes\", true) !== false;\n    if (this.warnUnguardedRoutes) {\n      reportUnguardedMutatingRoutes(this.routes);\n    }\n\n    this.eventListeners.beforeScan?.forEach((callback) => callback(this, server));\n\n    let routeRegistry: RouteRegistry | undefined;\n    let registryVersion = -1;\n\n    const applyDevRateLimit = createDevRateLimiter(\n      server,\n      config.get(\"http.rateLimit.global\") !== false,\n    );\n\n    // Rebuilt when the route table changes rather than per request. Building it\n    // inside the handler re-registered every route on every hit — and `all`\n    // routes expand into seven registrations each. Keyed on `routesVersion`\n    // rather than on the route count, so an HMR reload that swaps a route\n    // without changing the count still invalidates.\n    const resolveRouteRegistry = () => {\n      if (routeRegistry && registryVersion === this.routesVersion) {\n        return routeRegistry;\n      }\n\n      routeRegistry = new RouteRegistry();\n\n      routeRegistry.register(this.routes);\n\n      registryVersion = this.routesVersion;\n\n      return routeRegistry;\n    };\n\n    // Matching happens here, in Fastify's own onRequest phase, so a route's\n    // `serverOptions.onRequest` still runs BEFORE body parsing. Production\n    // `scan()` gets that from per-route registration; the wildcard dispatcher\n    // has no per-route slot, so without this the hook silently never runs.\n    server.addHook(\n      \"onRequest\",\n      async (fastifyRequest: FastifyRequest, fastifyReply: FastifyReply) => {\n        // Only requests Fastify routed to the dev wildcard belong to the app's\n        // router. A plugin's own route (devtools' `/__warlock/api/requests/:id`)\n        // must keep its params even when an app catch-all matches the URL too.\n        if (fastifyRequest.routeOptions.url !== \"*\") {\n          return undefined;\n        }\n\n        const match = resolveRouteRegistry().find(fastifyRequest.method, fastifyRequest.url);\n\n        if (!match) {\n          return undefined;\n        }\n\n        (fastifyRequest as DevDispatchRequest).matchedDevRoute = match;\n\n        fastifyRequest.params = match.params;\n\n        // Same slot production gives it: the limiter runs first in onRequest,\n        // ahead of the route's own hooks.\n        await applyDevRateLimit(match.route, fastifyRequest, fastifyReply);\n\n        if (fastifyReply.sent) {\n          return fastifyReply;\n        }\n\n        return runRouteHooks(match.route, \"onRequest\", fastifyRequest, fastifyReply);\n      },\n    );\n\n    for (const phase of FORWARDED_ROUTE_PHASES.filter((name) => name !== \"onRequest\")) {\n      server.addHook(phase, async (fastifyRequest: FastifyRequest, fastifyReply: FastifyReply) => {\n        const match = (fastifyRequest as DevDispatchRequest).matchedDevRoute;\n\n        if (!match) {\n          return undefined;\n        }\n\n        return runRouteHooks(match.route, phase, fastifyRequest, fastifyReply);\n      });\n    }\n\n    // Shared handler for wildcard routing\n    const wildcardHandler = async (fastifyRequest: FastifyRequest, fastifyReply: FastifyReply) => {\n      const match = (fastifyRequest as DevDispatchRequest).matchedDevRoute;\n\n      // No match found - return 404\n      if (!match) {\n        return fastifyReply\n          .code(404)\n          .send(buildNotFoundBody(fastifyRequest.method, fastifyRequest.url));\n      }\n\n      try {\n        // Call the matched route handler\n        const { output, response } = await this.handleRoute(match.route)(\n          fastifyRequest,\n          fastifyReply,\n        );\n\n        return output || response.baseResponse;\n      } catch (error) {\n        log.error(\"router\", \"dev-dispatch\", error as Error, {\n          method: fastifyRequest.method,\n          url: buildRequestLogSnapshot({\n            id: fastifyRequest.id,\n            method: fastifyRequest.method,\n            url: fastifyRequest.url,\n            route: match.route,\n          }).url,\n        });\n\n        throw error;\n      }\n    };\n\n    // Every verb production can register. Fastify's implicit HEAD for the GET\n    // wildcard is switched off so the HEAD wildcard owns it (the registry falls\n    // back to the GET route, exactly as production's implicit HEAD does).\n    // `@fastify/cors` registers its own OPTIONS \"*\" catch-all whenever\n    // preflight is on. Use the plugin's options as well as hasRoute so this\n    // dispatcher works both after HTTP plugin boot and before queued plugins.\n    const corsOwnsPreflight = buildCorsOptions().preflight !== false;\n\n    for (const method of DEV_DISPATCH_METHODS) {\n      if (\n        method === \"OPTIONS\" &&\n        (corsOwnsPreflight || server.hasRoute({ method: \"OPTIONS\", url: \"*\" }))\n      ) {\n        continue;\n      }\n\n      server.route({\n        method,\n        url: \"*\",\n        ...(method === \"GET\" && { exposeHeadRoute: false }),\n        // The dispatcher limits each matched route itself (see\n        // `createDevRateLimiter`), so the plugin must not limit the wildcard:\n        // that would count exempt routes and unmatched URLs too.\n        config: { rateLimit: false },\n        handler: wildcardHandler,\n      });\n    }\n\n    this.registerStaticDirectories(server);\n\n    this.eventListeners.afterScanning?.forEach((callback) => callback(this, server));\n  }\n\n  /**\n   * Get the route path for the given route name\n   */\n  public getRoute(name: string, params: Record<string, any> = {}) {\n    const route = this.routes.find((route) => route.name === name);\n\n    if (!route) {\n      throw new WarlockError(\"WL3003\", `Route name \"${name}\" not found`);\n    }\n\n    const used = new Set<string>();\n\n    const path = route.path.replace(/:([A-Za-z0-9_]+)(\\?)?/g, (_match, key: string, optional) => {\n      const value = params[key];\n\n      if (value === undefined || value === null) {\n        if (optional) return \"\";\n\n        throw new WarlockError(\"WL3004\", `Route \"${name}\" is missing the \"${key}\" param`);\n      }\n\n      used.add(key);\n\n      return encodeURIComponent(String(value));\n    });\n\n    const query = Object.keys(params)\n      .filter((key) => !used.has(key) && params[key] !== undefined && params[key] !== null)\n      .map((key) => `${encodeURIComponent(key)}=${encodeURIComponent(String(params[key]))}`)\n      .join(\"&\");\n\n    return query ? `${path}?${query}` : path;\n  }\n\n  /**\n   * Handle the given route\n   */\n  private handleRoute(route: Route) {\n    return async (fastifyRequest: FastifyRequest, fastifyResponse: FastifyReply) => {\n      const request = new Request();\n      const response = new Response();\n      response.setResponse(fastifyResponse);\n      request.response = response;\n\n      response.request = request;\n\n      // \"route.match\" tracing phase: the pattern is\n      // already known here (`route.path`), so this brackets the cost of\n      // stamping the request/route onto the `Request` instance rather than\n      // route-registry matching itself, which happens upstream of this\n      // function for both the production `scan()` path and the dev wildcard\n      // dispatcher (both funnel into `handleRoute`).\n      const tracingEnabled = isTracingEnabled();\n      const routeMatchStartedAt = tracingEnabled ? performance.now() : 0;\n\n      request.setRequest(fastifyRequest).setRoute(route);\n\n      if (tracingEnabled) {\n        dispatchPhase(buildTracingContext(request), {\n          name: \"route.match\",\n          durationMs: performance.now() - routeMatchStartedAt,\n          attrs: { route: route.path },\n        });\n      }\n\n      /*\n        Both ends of the entry, not just the start — see\n        `log-request-lifecycle.ts`. A start line on its own made a hung request\n        and an instant one look identical, and the completion line is what makes\n        a MISSING one legible as a hang.\n      */\n      const result = await logRequestLifecycle(\n        {\n          info: (entry) => log.info(entry),\n          warn: (entry) => log.warn(entry),\n          error: (entry) => log.error(entry),\n          now: () => performance.now(),\n        },\n        {\n          module: \"route\",\n          action: describeRouteForLog(route.method, route.path),\n          requestId: request.id,\n          // A bounded snapshot, built once with the route's logging policy\n          // applied — never the Request/Response instances, whose native\n          // request, reply and URL graphs would reach every log channel.\n          context: { request: request.toLogSnapshot() },\n          request,\n          // Read after the run: the status is decided during the request.\n          statusCode: () => fastifyResponse.statusCode,\n        },\n        () => request.execute(),\n      );\n\n      // A handler may return a plain object (`ReturnedResponse`). Route it\n      // through `Response.send` so status, events and hooks apply, exactly as\n      // middleware outputs already do.\n      let output = result;\n\n      if (\n        output !== undefined &&\n        output !== null &&\n        !(output instanceof Response) &&\n        (output as unknown) !== fastifyResponse\n      ) {\n        output = await response.send(output);\n      }\n\n      return {\n        output,\n        response,\n        request,\n      };\n    };\n  }\n}\n\nexport const router = Router.getInstance();\n\ncontainer.set(\"router\", router);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmEA,MAAM,yBAAyB;CAAC;CAAa;CAAiB;AAAY;AAc1E,SAAS,WACP,MACsB;CACtB,IAAI,CAAC,MACH,OAAO,CAAC;CAGV,OAAO,MAAM,QAAQ,IAAI,IAAI,OAAO,CAAC,IAAI;AAC3C;;;;;;;;AASA,eAAe,cACb,OACA,OACA,SACA,OACA;CACA,MAAM,QAAQ,WACZ,MAAM,gBAAgB,MACxB;CAEA,KAAK,MAAM,QAAQ,OAGjB,IAAI,MAFkB,KAAK,SAAS,KAAK,MAEzB,OACd,OAAO;AAKb;;;;;AAMA,SAAS,mBAAmB,QAAiB,QAA8B;CACzE,MAAM,iBAAkB,QAAuC;CAE/D,IAAI,gBACF,OAAO,iBAAiB;AAE5B;;;;AAKA,SAAS,oBACP,UACA,QACgB;CAChB,MAAM,SAAS,SAAS;CACxB,MAAM,UAAU,QAAQ,KAAK,QAAQ;CAErC,mBAAmB,QAAQ,OAAO;CAElC,OAAO;AACT;;;;;;;;;;;;;AAcA,SAAS,sBAAsB,OAAc;CAC3C,MAAM,OAAO,MAAM,SAAS,eAAe;CAC3C,MAAM,SAAS,MAAM,aAAa,eAAe,MAAM,eAAe;CAEtE,OAAO,GAAG,KAAK,GAAG,MAAM,OAAO,GAAG,MAAM,KAAK,IAAI,OAAO;AAC1D;AAEA,IAAa,SAAb,MAAa,OAAO;;;;CAgElB,OAAc,cAAc;EAC1B,IAAI,CAAC,OAAO,UACV,OAAO,WAAW,IAAI,OAAO;EAG/B,OAAO,OAAO;CAChB;CAEA,AAAQ,cAAc;gBApEI,CAAC;uBAUH;6BAgBM;2BAaxB,CAAC;wBAML,CAAC;gBAM8B;GAC/B,QAAQ,CAAC;GACT,MAAM,CAAC;GACP,YAAY,CAAC;EACf;CAeA;;;;CAKA,AAAO,eAAe,UAA6D;EACjF,KAAK,eAAe,aAAa,CAAC,GAAI,KAAK,eAAe,cAAc,CAAC,GAAI,QAAQ;EAErF,OAAO;CACT;;;;CAKA,AAAO,cAAc,UAA6D;EAChF,KAAK,eAAe,gBAAgB,CAAC,GAAI,KAAK,eAAe,iBAAiB,CAAC,GAAI,QAAQ;EAE3F,OAAO;CACT;;;;CAKA,AAAO,SAAS,MAAc,IAAY,eAA0C,aAAa;EAC/F,OAAO,KAAK,IAAI,OAAO,EAAE,eAAe;GACtC,SAAS,SAAS,IAAI,iBAAiB,cAAc,MAAM,GAAG;EAChE,CAAC;CACH;;;;;;;;;;;;;;CAeA,AAAO,UAAU,SAA+B,eAAmC,CAAC,GAAG;EACrF,KAAK,kBAAkB,KAAK;GAAE;GAAS,WAAW,aAAa;EAAU,CAAC;EAE1E,OAAO;CACT;;CAGA,AAAU,0BAA0B,QAAyB;EAC3D,KAAK,MAAM,aAAa,KAAK,mBAC3B,mBACE,QACA;GAAE,GAAG,UAAU;GAAS,eAAe;EAAM,GAC7C,EAAE,WAAW,uBAAuB,UAAU,SAAS,EAAE,CAC3D;CAEJ;;;;;;CAOA,AAAU,mBACR,MACA,SACA,eAAmC,CAAC,GACpC;EACA,KAAK,IACH,MACA,SACA,aAAa,cAAc,SAAY,CAAC,IAAI,EAAE,WAAW,aAAa,UAAU,CAClF;EAEA,MAAM,SAAS,KAAK,6BAA6B,UAAU,KAAK;EAChE,MAAM,QAAQ,OAAO,OAAO,SAAS;EAErC,IAAI,OAAO,MAAM,cAAc;EAE/B,OAAO;CACT;;;;CAKA,AAAO,KACL,MACA,UACA,WACA,eAAmC,CAAC,GACpC;EACA,OAAO,KAAK,mBACV,OACC,EAAE,eAAe;GAChB,SAAS,SAAS,UAAU,SAAS;EACvC,GACA,YACF;CACF;;;;CAKA,AAAO,WACL,MACA,UACA,WACA,eAAmC,CAAC,GACpC;EACA,OAAO,KAAK,mBACV,OACC,EAAE,eAAe;GAChB,SAAS,eAAe,UAAU,SAAS;EAC7C,GACA,YACF;CACF;;;;CAKA,AAAO,MACL,OACA,WACA,eAAmC,CAAC,GACpC;EACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,GACjD,KAAK,KAAK,MAAM,UAAU,WAAW,YAAY;CAErD;;;;CAKA,AAAO,YACL,OACA,WACA,eAAmC,CAAC,GACpC;EACA,KAAK,MAAM,CAAC,MAAM,aAAa,OAAO,QAAQ,KAAK,GACjD,KAAK,WAAW,MAAM,UAAU,WAAW,YAAY;CAE3D;CAWA,AAAO,MAAM,GAAG,MAAa;EAC3B,KAAK,gBAAgB,SAAS,WAAW;GACvC,IAAI,KAAK,WAAW,GAClB,OAAO,SAAS,OAAO,KAAK,EAAE;QAE9B,OAAO,SAAS,OAAO;IACrB,QAAQ,KAAK;IACb,UAAU,KAAK;IACf,GAAG,KAAK;GACV,CAAC;EAEL,CAAC;EAED,OAAO;CACT;;;;CAKA,AAAO,IACL,QACA,MACA,SACA,UAAwB,CAAC,GACzB;EACA,IAAI,MAAM,QAAQ,IAAI,GAAG;GACvB,KAAK,SAAS,MAAM,KAAK,IAAI,QAAQ,GAAG,SAAS,OAAO,CAAC;GACzD,OAAO;EACT;EAEA,MAAM,SAAS,KAAK,OAAO,OAAO,QAAQ,MAAM,WAAW;GACzD,OAAO,mBAAmB,MAAM,MAAM;EACxC,GAAG,EAAE;EAEL,MAAM,OAAO,KAAK,OAAO,KAAK,aAC3B,MAAM,eAAe;GACpB,OAAO,KAAK,aAAa,MAAM,MAAM,GAAG;EAC1C,GACA,QAAQ,QAAQ,KAAK,KAAK,QAAQ,OAAO,GAAG,GAAG,GAAG,CACpD;EAKA,OAAO,mBAAmB,QAAQ,IAAI;EAEtC,MAAM,uBAAuB,QAAQ,wBAAwB;EAI7D,UAAU,EAAE,GAAG,QAAQ;EAEvB,IAAI,yBAAyB,UAC3B,QAAQ,aAAa,CAAC,GAAI,QAAQ,cAAc,CAAC,GAAI,GAAG,KAAK,OAAO,UAAU;OAE9E,QAAQ,aAAa,CAAC,GAAG,KAAK,OAAO,YAAY,GAAI,QAAQ,cAAc,CAAC,CAAE;EAKhF,IAAI,QAAQ,WAAW,WAAc,KAAK,OAAO,UAAU,KAAK,GAC9D,QAAQ,SAAS;EAGnB,IAAI,MAAM,QAAQ,OAAO,GAAG;GAC1B,MAAM,CAAC,YAAY,UAAU;GAE7B,IAAI,OAAO,WAAW,YAAY,YAChC,MAAM,IAAI,aACR,UACA,8BAA8B,OAAO,oBAAoB,WAAW,YAAY,KAAK,EACvF;GAGF,UAAU,WAAW,OAAO,CAAC,KAAK,UAAU;GAC5C,mBAAmB,WAAW,SAAS,OAAO;GAE9C,IAAI,CAAC,QAAQ,YAAY;IACvB,QAAQ,aAAa,CAAC;IACtB,IAAI,WAAW,GAAG,OAAO,oBACvB,QAAQ,WAAW,SAAS,WAAW,GAAG,OAAO,kBAAkB,CAAC;IAGtE,IAAI,WAAW,GAAG,OAAO,YACvB,QAAQ,WAAW,WAAW,WAAW,GAAG,OAAO;GAEvD;EACF;EAEA,MAAM,YAAmB;GACvB;GACA;GACA;GACA,GAAG;GACH;GACA,WAAW,QAAQ;GACnB,SAAS,UAAU;GAEnB,cAAc,CAAC,GAAG,KAAK,OAAO,MAAM;GAEpC,YAAY,KAAK,OAAO,cAAc;EACxC;EAEA,MAAM,SAAS,KAAK,6BAA6B,UAAU,KAAK;EAEhE,IAAI,UAAU,MAAM;GAElB,MAAM,QAAQ,OAAO,MAAM,UAAU,MAAM,SAAS,UAAU,IAAI;GAElE,IAAI,OAEF,IAAI,MAAM,WAAW,UAAU,QAC7B,MAAM,IAAI,oBACR,UAAU,MACV,eAAe,UAAU,KAAK,6CACH,sBAAsB,KAAK,EAAE,0BAC7B,sBAAsB,SAAS,EAAE,2IAG9D;QAEA,UAAU,QAAQ,sBAAsB,UAAU,MAAM;EAG9D;EAOA,IAAI,KAAK,6BACP,KAAK,4BAA4B,YAAY,KAAK,SAAS;OAE3D,wBAAwB,UAAU,SAAS,SAAS;EAGtD,OAAO,KAAK,SAAS;EAErB,IAAI,CAAC,KAAK,6BACR,KAAK;EAGP,OAAO;CACT;;;;CAKA,AAAO,IAAI,MAAc,SAA6B,UAAwB,CAAC,GAAG;EAChF,OAAO,KAAK,IAAI,OAA0B,MAAM,SAAS,OAAO;CAClE;;;;CAKA,AAAO,IAAI,MAAc,SAA6B,UAAwB,CAAC,GAAG;EAChF,OAAO,KAAK,IAAI,OAAO,MAAM,SAAS,OAAO;CAC/C;;;;CAKA,AAAO,KAAK,MAAyB,SAA6B,UAAwB,CAAC,GAAG;EAC5F,OAAO,KAAK,IAAI,QAAQ,MAAM,SAAS,OAAO;CAChD;;;;CAKA,AAAO,IAAI,MAAc,SAA6B,UAAwB,CAAC,GAAG;EAChF,OAAO,KAAK,IAAI,OAAO,MAAM,SAAS,OAAO;CAC/C;;;;CAKA,AAAO,OAAO,MAAyB,SAA6B,UAAwB,CAAC,GAAG;EAC9F,OAAO,KAAK,IAAI,UAAU,MAAM,SAAS,OAAO;CAClD;;;;CAKA,AAAO,MAAM,MAAc,SAA6B,UAAwB,CAAC,GAAG;EAClF,OAAO,KAAK,IAAI,SAAS,MAAM,SAAS,OAAO;CACjD;;;;CAKA,AAAO,KAAK,MAAc,SAA6B,UAAwB,CAAC,GAAG;EACjF,OAAO,KAAK,IAAI,QAAQ,MAAM,SAAS,OAAO;CAChD;;;;CAKA,AAAO,QAAQ,MAAc,SAA6B,UAAwB,CAAC,GAAG;EACpF,OAAO,KAAK,IAAI,WAAW,MAAM,SAAS,OAAO;CACnD;;;;CAKA,AAAO,MAAM,MAAc,UAAwB,CAAC,GAAG;EACrD,OAAO,IAAI,aAAa,MAAM,MAAM,OAAO;CAC7C;;;;;;;;;;;CAYA,AAAO,gBACL,MACA,UACA,UAMI,CAAC,GACL;EAKA,MAAM,mBAAmB,QAAQ,QAAQ,YAAY,MAAM,MAAM,GAAG,CAAC;EAErE,OAAO,KAAK,MAAM;GAAE,QAAQ;GAAM,MAAM;EAAiB,SAAS;GAChE,MAAM,OAAO;GAGb,MAAM,gBAAgB;GAEtB,MAAM,wBAAwB,SAAyB;IACrD,OAAO,SAEJ,CAAC,QAAQ,UAAU,CAAC,QAAQ,OAAO,SAAS,IAAI,OAEhD,CAAC,QAAQ,QAAQ,QAAQ,KAAK,SAAS,IAAI,EAC9C;GACF;GAEA,IAAI,cAAc,QAAQ,qBAAqB,MAAM,GACnD,KAAK,IAAI,MAAM,QAAQ,SAAS,QAAQ,oBAAoB,eAAe,MAAM,GAAG;IAClF,GAAG;IACH,MAAM;IACN,SAAS;GACX,CAAC;GAGH,IAAI,cAAc,OAAO,qBAAqB,KAAK,GACjD,KAAK,IAAI,QAAe,QAAQ,SAAS,OAAO,oBAAoB,eAAe,KAAK,GAAG;IACzF,GAAG;IACH,MAAM;IACN,SAAS;GACX,CAAC;GAGH,IAAI,cAAc,UAAU,qBAAqB,QAAQ,GAAG;IAC1D,MAAM,UAAU,QAAQ,SAAS,UAAU,KAAK,iBAAiB,eAAe,QAAQ;IAExF,KAAK,KAAK,MAAM,SAAS;KACvB,GAAG;KACH,MAAM;KACN,SAAS;IACX,CAAC;GACH;GAEA,IAAI,cAAc,UAAU,qBAAqB,QAAQ,GAAG;IAC1D,MAAM,UAAU,QAAQ,SAAS,UAAU,KAAK,iBAAiB,eAAe,QAAQ;IAExF,KAAK,IAAI,QAAe,SAAS;KAC/B,GAAG;KACH,MAAM;KACN,SAAS;IACX,CAAC;GACH;GAEA,IAAI,cAAc,SAAS,qBAAqB,OAAO,GAAG;IACxD,MAAM,UAAU,QAAQ,SAAS,SAAS,KAAK,iBAAiB,eAAe,OAAO;IAEtF,KAAK,MAAM,QAAe,SAAS;KACjC,GAAG;KACH,MAAM;KACN,SAAS;IACX,CAAC;GACH;GAEA,IAAI,cAAc,UAAU,qBAAqB,QAAQ,GACvD,KAAK,OACH,QACA,QAAQ,SAAS,UAAU,oBAAoB,eAAe,QAAQ,GACtE;IACE,GAAG;IACH,MAAM;IACN,SAAS;GACX,CACF;GAGF,IAAI,cAAc,cAAc,qBAAqB,QAAQ,GAC3D,KAAK,OACH,MACA,QAAQ,SAAS,cAAc,oBAAoB,eAAe,YAAY,GAC9E;IACE,GAAG;IACH,MAAM;IACN,SAAS;GACX,CACF;GAGF,OAAO;EACT,CAAC;CACH;;;;CAKA,AAAO,MAAM,SAA+B,UAA+B;EACzE,MAAM,EACJ,QAOA,OAAO,SAAS,KAAK,OAAO,QAAQ,OAAO,GAAG,GAAG,GAAG,IAAI,QACxD,YACA,QAAQ,aACN;EAEJ,IAAI,UACF,KAAK,OAAO,UAAU,KAAK,OAAO,UAAU,KAAK;EAGnD,IAAI,QACF,KAAK,OAAO,OAAO,KAAK,MAAM;EAGhC,IAAI,MACF,KAAK,OAAO,KAAK,KAAK,IAAI;EAG5B,IAAI,YACF,KAAK,OAAO,WAAW,KAAK,GAAG,UAAU;EAG3C,IAAI;GACF,SAAS;EACX,UAAU;GAGR,IAAI,QACF,KAAK,OAAO,OAAO,IAAI;GAGzB,IAAI,MACF,KAAK,OAAO,KAAK,IAAI;GAGvB,IAAI,YACF,KAAK,OAAO,WAAW,OACrB,KAAK,OAAO,WAAW,SAAS,WAAW,QAC3C,WAAW,MACb;GAEF,IAAI,UACF,KAAK,OAAO,UAAU,KAAK,OAAO,UAAU,KAAK;EAErD;EAEA,OAAO;CACT;;;;CAKA,AAAO,OAAO,QAAgB,UAAsB;EAClD,OAAO,KAAK,MAAM,EAAE,OAAO,GAAG,QAAQ;CACxC;;;;;;;;;;;;;CAcA,AAAO,QAAQ,SAA0B,UAAsB;EAC7D,OAAO,KAAK,OAAO,KAAK,WAAW,QAAQ;CAC7C;;;;;;;CAQA,MAAa,eACX,YACA,UACwB;EAExB,KAAK,OAAO,aAAa;EAEzB,IAAI;GAEF,OAAO,MAAM,SAAS;EACxB,SAAS,OAAO;GAMd,IAAI,MAAM;IACR,QAAQ;IACR,QAAQ;IACR,SAAS,mCAAmC,WAAW;IACvD,SAAS;KAAE;KAAY;IAAM;GAC/B,CAAC;GAED,MAAM;EACR,UAAU;GAGR,OAAO,KAAK,OAAO;EACrB;CACF;;;;;;CAOA,AAAO,yBAAyB,YAA0B;EACxD,IAAI,KAAK,6BAA6B;GACpC,KAAK,4BAA4B,SAAS,KAAK,4BAA4B,OAAO,QAC/E,UAAU,MAAM,eAAe,UAClC;GACA,KAAK,4BAA4B,mBAAmB,IAAI,UAAU;GAClE;EACF;EAEA,KAAK,SAAS,KAAK,OAAO,QAAQ,UAAU,MAAM,eAAe,UAAU;EAI3E,gCAAgC,UAAU;EAE1C,KAAK;CACP;;;;;;;;;CAUA,MAAa,2BACX,aACA,SACY;EACZ,IAAI,KAAK,6BACP,MAAM,IAAI,MAAM,4CAA4C;EAG9D,MAAM,qBAAqB,IAAI,IAAI,WAAW;EAE9C,KAAK,8BAA8B;GACjC,QAAQ,KAAK,OAAO,QAAQ,UAAU,CAAC,mBAAmB,IAAI,MAAM,UAAU,CAAC;GAC/E;GACA,aAAa,CAAC;EAChB;EAEA,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ;GAC7B,MAAM,cAAc,KAAK;GAEzB,KAAK,SAAS,YAAY;GAC1B,KAAK,8BAA8B;GAInC,KAAK,MAAM,cAAc,YAAY,oBACnC,gCAAgC,UAAU;GAG5C,MAAM,kBAAkB,IAAI,IAAI,YAAY,MAAM;GAElD,KAAK,MAAM,SAAS,YAAY,aAC9B,IAAI,gBAAgB,IAAI,KAAK,GAC3B,wBAAwB,MAAM,SAAS,KAAK;GAIhD,IAAI,KAAK,qBACP,8BACE,YAAY,YAAY,QAAQ,UAAU,gBAAgB,IAAI,KAAK,CAAC,CACtE;GAGF,KAAK;GAEL,OAAO;EACT,SAAS,OAAO;GACd,KAAK,8BAA8B;GACnC,MAAM;EACR;CACF;;;;CAKA,AAAQ,iBAAiB,UAAyB,QAAuC;EACvF,MAAM,UAAU,oBAAoB,UAAU,MAAM;EAEpD,MAAM,mBAAmB,UAAU,aAAa;EAEhD,IAAI,WAAW,SAAS;GACtB,QAAQ,aAAa;GAErB,IAAI,QAAQ,YAAY,UACtB,QAAQ,WAAW,WAAW,QAAQ,WAAW,SAAS,KAAK,QAAQ;GAGzE,IAAI,SAAS,YAAY,OACvB,QAAQ,aAAa,MAAM,SAAS,WAAW,OAAO,QAAQ,UAAU;GAG1E,OAAO;EACT;EAEA,IAAI,CAAC,SAAS,cAAe,CAAC,oBAAoB,CAAC,SAAS,WAAW,KAAM,OAAO;EAEpF,IAAI,SAAS,WAAW,KAAK;GAC3B,MAAM,oBAAoB;IACxB,KAAK,UAAU,YAAY,KAAK;KAC/B,SAAS,kBAAkB;GAC9B;GAEA,MAAM,aAAuC,CAAC;GAE9C,IAAI,SAAS,WAAW,IAAI,UAAU,kBAAkB,QACtD;QAAI,CAAC,kBAAkB,UAAU,SAAS,WAAW,IAAI,QAEvD,WAAW,SAAS,SAAS,WAAW,IAAI;SACvC,IAAI,kBAAkB,UAAU,SAAS,WAAW,IAAI,QAE7D,WAAW,SAAS,SAAS,WAAW,IAAI,OAAO,MAAM,iBAAiB,MAAM;SAC3E,IAAI,kBAAkB,UAAU,CAAC,SAAS,WAAW,IAAI,QAE9D,WAAW,SAAS,iBAAiB;GACvC;GAIF,IAAI,kBAAkB,OAAO,kBAAkB,SAC7C,WAAW,WAAW,OAAO,EAAE,SAAS,eAA4B;IAClE,IAAI,kBAAkB,KAAK;KACzB,MAAM,SAAS,MAAM,kBAAkB,IAAI,KAAK,UAAU;MAAE;MAAS;KAAS,CAAC;KAE/E,IAAI,QAAQ,OAAO;IACrB;IAEA,IAAI,kBAAkB,SACpB,OAAO,MAAM,kBAAkB,OAAO,EAAE,KAAK,UAAU;KAAE;KAAS;IAAS,CAAC;GAIhF;GAGF,IAAI,CAAC,QAAQ,UAAU,GACrB,QAAQ,aAAa;EAEzB,OAAO;GACL,QAAQ,aAAa,SAAS,WAAW;GAEzC,IAAI,QAAQ,YAAY,UACtB,QAAQ,WAAW,WAAW,QAAQ,WAAW,SAAS,KAAK,QAAQ;EAE3E;EAEA,OAAO;CACT;;;;CAKA,AAAO,OAAO;EACZ,OAAO,KAAK;CACd;;;;;;;CAQA,AAAO,kBAAkB,UAAiC,CAAC,GAA6B;EACtF,OAAO,OAAO,OACZ,KAAK,OACF,QAAQ,UAAU,CAAC,MAAM,UAAU,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAC3F,KAAK,UAAU;GACd,MAAM,WAAW;IAAE,MAAM,MAAM;IAAO,MAAM,MAAM;IAAM,QAAQ,MAAM;GAAO;GAC7E,MAAM,SAAS,MAAM,SAAS;GAC9B,MAAM,WAAW,SAAS,QAAQ,kBAAkB,QAAQ,KAAK,IAAI;GAGrE,IAAI,CAAC,YAAY,OAAO,KAAK,QAAQ,CAAC,CAAC,WAAW,GAAG,OAAO,OAAO,OAAO,QAAQ;GAElF,OAAO,OAAO,OAAO;IAAE,GAAG;IAAU,UAAU,OAAO,OAAO,EAAE,GAAG,SAAS,CAAC;GAAE,CAAC;EAChF,CAAC,CACL;CACF;;;;;;;;;CAUA,AAAO,aAAqB;EAC1B,OAAO,KAAK,OAAO;CACrB;;;;CAKA,AAAO,KAAK,QAAyB;EAInC,gCAAgC;EAEhC,KAAK,eAAe,YAAY,SAAS,aAAa,SAAS,MAAM,MAAM,CAAC;EAM5E,MAAM,oBAAoB,IAAI,IAC5B,KAAK,OACF,QAAQ,UAAU,MAAM,OAAO,YAAY,MAAM,MAAM,CAAC,CACxD,KAAK,UAAU,MAAM,IAAI,CAC9B;EAEA,KAAK,OAAO,SAAS,UAAU;GAC7B,MAAM,gBAAgB,MAAM,OAAO,YAAY;GAC/C,MAAM,wBAAwB,OAAO,cAAc,CAAC,KAAK,MAAM;GAE/D,MAAM,UAAU;IACd,GAAG,MAAM;IACT,GAAI,kBAAkB,SACpB,kBAAkB,IAAI,MAAM,IAAI,KAAK,EAAE,iBAAiB,MAAM;IAChE,QAAQ;KACN,GAAG,MAAM,eAAe;KAExB,WAAW,sBAAsB,KAAK;IACxC;GACF;GAEA,sBACE,MAAM,MACN,SACA,OAAO,aAA6B,UAAwB;IAC1D,MAAM,EAAE,QAAQ,aAAa,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,aAAa,KAAK;IAE7E,OAAO,UAAU,SAAS;GAC5B,CACF;EACF,CAAC;EAED,KAAK,0BAA0B,MAAM;EAErC,KAAK,eAAe,eAAe,SAAS,aAAa,SAAS,MAAM,MAAM,CAAC;CACjF;;;;;CAMA,AAAO,cAAc,QAAyB;EAI5C,gCAAgC;EAIhC,KAAK,sBACHA,SAAe,IAAa,4BAA4B,IAAI,MAAM;EACpE,IAAI,KAAK,qBACP,8BAA8B,KAAK,MAAM;EAG3C,KAAK,eAAe,YAAY,SAAS,aAAa,SAAS,MAAM,MAAM,CAAC;EAE5E,IAAI;EACJ,IAAI,kBAAkB;EAEtB,MAAM,oBAAoB,qBACxB,QACA,OAAO,IAAI,uBAAuB,MAAM,KAC1C;EAOA,MAAM,6BAA6B;GACjC,IAAI,iBAAiB,oBAAoB,KAAK,eAC5C,OAAO;GAGT,gBAAgB,IAAI,cAAc;GAElC,cAAc,SAAS,KAAK,MAAM;GAElC,kBAAkB,KAAK;GAEvB,OAAO;EACT;EAMA,OAAO,QACL,aACA,OAAO,gBAAgC,iBAA+B;GAIpE,IAAI,eAAe,aAAa,QAAQ,KACtC;GAGF,MAAM,QAAQ,qBAAqB,CAAC,CAAC,KAAK,eAAe,QAAQ,eAAe,GAAG;GAEnF,IAAI,CAAC,OACH;GAGF,AAAC,eAAsC,kBAAkB;GAEzD,eAAe,SAAS,MAAM;GAI9B,MAAM,kBAAkB,MAAM,OAAO,gBAAgB,YAAY;GAEjE,IAAI,aAAa,MACf,OAAO;GAGT,OAAO,cAAc,MAAM,OAAO,aAAa,gBAAgB,YAAY;EAC7E,CACF;EAEA,KAAK,MAAM,SAAS,uBAAuB,QAAQ,SAAS,SAAS,WAAW,GAC9E,OAAO,QAAQ,OAAO,OAAO,gBAAgC,iBAA+B;GAC1F,MAAM,QAAS,eAAsC;GAErD,IAAI,CAAC,OACH;GAGF,OAAO,cAAc,MAAM,OAAO,OAAO,gBAAgB,YAAY;EACvE,CAAC;EAIH,MAAM,kBAAkB,OAAO,gBAAgC,iBAA+B;GAC5F,MAAM,QAAS,eAAsC;GAGrD,IAAI,CAAC,OACH,OAAO,aACJ,KAAK,GAAG,CAAC,CACT,KAAK,kBAAkB,eAAe,QAAQ,eAAe,GAAG,CAAC;GAGtE,IAAI;IAEF,MAAM,EAAE,QAAQ,aAAa,MAAM,KAAK,YAAY,MAAM,KAAK,CAAC,CAC9D,gBACA,YACF;IAEA,OAAO,UAAU,SAAS;GAC5B,SAAS,OAAO;IACd,IAAI,MAAM,UAAU,gBAAgB,OAAgB;KAClD,QAAQ,eAAe;KACvB,KAAK,wBAAwB;MAC3B,IAAI,eAAe;MACnB,QAAQ,eAAe;MACvB,KAAK,eAAe;MACpB,OAAO,MAAM;KACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM;GACR;EACF;EAQA,MAAM,oBAAoB,iBAAiB,CAAC,CAAC,cAAc;EAE3D,KAAK,MAAM,UAAU,sBAAsB;GACzC,IACE,WAAW,cACV,qBAAqB,OAAO,SAAS;IAAE,QAAQ;IAAW,KAAK;GAAI,CAAC,IAErE;GAGF,OAAO,MAAM;IACX;IACA,KAAK;IACL,GAAI,WAAW,SAAS,EAAE,iBAAiB,MAAM;IAIjD,QAAQ,EAAE,WAAW,MAAM;IAC3B,SAAS;GACX,CAAC;EACH;EAEA,KAAK,0BAA0B,MAAM;EAErC,KAAK,eAAe,eAAe,SAAS,aAAa,SAAS,MAAM,MAAM,CAAC;CACjF;;;;CAKA,AAAO,SAAS,MAAc,SAA8B,CAAC,GAAG;EAC9D,MAAM,QAAQ,KAAK,OAAO,MAAM,UAAU,MAAM,SAAS,IAAI;EAE7D,IAAI,CAAC,OACH,MAAM,IAAI,aAAa,UAAU,eAAe,KAAK,YAAY;EAGnE,MAAM,uBAAO,IAAI,IAAY;EAE7B,MAAM,OAAO,MAAM,KAAK,QAAQ,2BAA2B,QAAQ,KAAa,aAAa;GAC3F,MAAM,QAAQ,OAAO;GAErB,IAAI,UAAU,UAAa,UAAU,MAAM;IACzC,IAAI,UAAU,OAAO;IAErB,MAAM,IAAI,aAAa,UAAU,UAAU,KAAK,oBAAoB,IAAI,QAAQ;GAClF;GAEA,KAAK,IAAI,GAAG;GAEZ,OAAO,mBAAmB,OAAO,KAAK,CAAC;EACzC,CAAC;EAED,MAAM,QAAQ,OAAO,KAAK,MAAM,CAAC,CAC9B,QAAQ,QAAQ,CAAC,KAAK,IAAI,GAAG,KAAK,OAAO,SAAS,UAAa,OAAO,SAAS,IAAI,CAAC,CACpF,KAAK,QAAQ,GAAG,mBAAmB,GAAG,EAAE,GAAG,mBAAmB,OAAO,OAAO,IAAI,CAAC,GAAG,CAAC,CACrF,KAAK,GAAG;EAEX,OAAO,QAAQ,GAAG,KAAK,GAAG,UAAU;CACtC;;;;CAKA,AAAQ,YAAY,OAAc;EAChC,OAAO,OAAO,gBAAgC,oBAAkC;GAC9E,MAAM,UAAU,IAAI,QAAQ;GAC5B,MAAM,WAAW,IAAI,SAAS;GAC9B,SAAS,YAAY,eAAe;GACpC,QAAQ,WAAW;GAEnB,SAAS,UAAU;GAQnB,MAAM,iBAAiB,iBAAiB;GACxC,MAAM,sBAAsB,iBAAiB,YAAY,IAAI,IAAI;GAEjE,QAAQ,WAAW,cAAc,CAAC,CAAC,SAAS,KAAK;GAEjD,IAAI,gBACF,cAAc,oBAAoB,OAAO,GAAG;IAC1C,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;IAChC,OAAO,EAAE,OAAO,MAAM,KAAK;GAC7B,CAAC;GAkCH,IAAI,SAAS,MAzBQ,oBACnB;IACE,OAAO,UAAU,IAAI,KAAK,KAAK;IAC/B,OAAO,UAAU,IAAI,KAAK,KAAK;IAC/B,QAAQ,UAAU,IAAI,MAAM,KAAK;IACjC,WAAW,YAAY,IAAI;GAC7B,GACA;IACE,QAAQ;IACR,QAAQ,oBAAoB,MAAM,QAAQ,MAAM,IAAI;IACpD,WAAW,QAAQ;IAInB,SAAS,EAAE,SAAS,QAAQ,cAAc,EAAE;IAC5C;IAEA,kBAAkB,gBAAgB;GACpC,SACM,QAAQ,QAAQ,CACxB;GAOA,IACE,WAAW,UACX,WAAW,QACX,EAAE,kBAAkB,aACnB,WAAuB,iBAExB,SAAS,MAAM,SAAS,KAAK,MAAM;GAGrC,OAAO;IACL;IACA;IACA;GACF;EACF;CACF;AACF;AAEA,MAAa,SAAS,OAAO,YAAY;AAEzC,UAAU,IAAI,UAAU,MAAM"}

package/esm/router/types.d.mts

@@ -1,12 +1,13 @@
+import { RequestLoggingOptions } from "../http/request-log-snapshot.mjs";
 import { Response } from "../http/response.mjs";
 import { Request } from "../http/request.mjs";
 import { ReturnedResponse } from "../http/types.mjs";
 import { ResponseSchema } from "../resource/types.mjs";
-import { ObjectValidator } from "@warlock.js/seal";
+import { ObjectValidator, ValidationResult } from "@warlock.js/seal";
 import { GenericObject } from "@mongez/reinforcements";
 import { RouteShorthandOptions } from "fastify";
 
-//#region ../core/src/router/types.d.ts
+//#region ../../packages/core/src/router/types.d.ts
 /**
  * Middleware response
  */
@@ -50,7 +51,54 @@ type RequestHandlerValidation<TRequest extends Request = Request> = {
    * schema expose their raw string params.
    */
   params?: ObjectValidator;
+  /**
+   * Shape the response when `schema` or `params` fails, instead of the
+   * framework's `{ errors: [...] }` body.
+   *
+   * Return `{ status?, body }`: `body` is sent as the response, with `status`
+   * or else `validation.response.status` (422 by default). Return `undefined`
+   * to fall back to the global `validation.response.body` hook, then the
+   * framework body. Wins over the global hook.
+   *
+   * Declare the body in the handler's `responseSchema` under the same status
+   * so `warlock generate.openapi` documents it.
+   *
+   * @example
+   * createImportController.validation = {
+   *   schema: importSchema,
+   *   onFailure: () => ({ status: 400, body: { error: "IMPORT_REQUEST_INVALID" } }),
+   * };
+   */
+  onFailure?: ValidationFailureHandler<TRequest>;
+};
+/**
+ * What a validation failure hook answers with.
+ */
+type ValidationFailureResponse = {
+  /**
+   * Response status. Defaults to `validation.response.status` (422).
+   */
+  status?: number;
+  /**
+   * Response body, sent as JSON.
+   */
+  body: unknown;
+};
+/**
+ * The second argument of a route's `validation.onFailure`.
+ */
+type ValidationFailureContext<TRequest extends Request = Request> = {
+  request: TRequest;
+  response: Response;
+  /**
+   * The route whose validation failed.
+   */
+  route: Route;
 };
+/**
+ * A route's `validation.onFailure` hook.
+ */
+type ValidationFailureHandler<TRequest extends Request = Request> = (result: ValidationResult, context: ValidationFailureContext<TRequest>) => ValidationFailureResponse | undefined | void | Promise<ValidationFailureResponse | undefined | void>;
 interface RequestControllerContract {
   /**
    * Request object
@@ -109,6 +157,37 @@ type RequestHandler<TRequest extends Request = Request> = {
    */
   responseSchema?: ResponseSchema;
 };
+/**
+ * A route's own rate limit: its own bucket and quota instead of the global
+ * `http.rateLimit` policy.
+ */
+type RouteRateLimitOptions = {
+  /**
+   * Max number of requests within the time window
+   */
+  max: number;
+  /**
+   * Time window in milliseconds
+   */
+  timeWindow: number;
+  /**
+   * Error message when rate limit is exceeded
+   */
+  errorMessage?: string;
+};
+/**
+ * Options for a static mount: `router.directory()`, `router.file()`,
+ * `router.cachedFile()`, `router.files()` and `router.cachedFiles()`.
+ */
+type StaticMountOptions = {
+  /**
+   * How the rate limiter treats this mount. Leave it unset to follow
+   * `http.rateLimit.staticFiles` (exempt by default); `true` counts the
+   * mount against the global limiter, `false` exempts it, and an object
+   * gives it its own limit and bucket.
+   */
+  rateLimit?: RouteRateLimitOptions | boolean;
+};
 interface RouteOptions {
   /**
    * Route middleware
@@ -169,22 +248,21 @@ interface RouteOptions {
    */
   isPage?: boolean;
   /**
-   * Rate limit options for this route
+   * How the rate limiter treats this route.
+   *
+   * - an object: the route gets its own limit and bucket instead of the
+   *   global `http.rateLimit` policy;
+   * - `false`: the route is exempt from the global limiter (development and
+   *   production alike);
+   * - `true`: the route stays under the global limiter. This is the default
+   *   for application routes; it puts a `router.file()` route back under the
+   *   global limiter when static files are exempt.
+   *
+   * @example
+   * router.post("/login", login, { rateLimit: { max: 5, timeWindow: 60_000 } });
+   * router.get("/webhooks/status", status, { rateLimit: false });
    */
-  rateLimit?: {
-    /**
-     * Max number of requests within the time window
-     */
-    max: number;
-    /**
-     * Time window in milliseconds
-     */
-    timeWindow: number;
-    /**
-     * Error message when rate limit is exceeded
-     */
-    errorMessage?: string;
-  };
+  rateLimit?: RouteRateLimitOptions | boolean;
   /**
    * Opt this route OUT of the default core CSRF-Origin guard
    * (`../http/csrf-default-guard.ts`, SECURITY card 8a752ab2) by passing
@@ -208,6 +286,43 @@ interface RouteOptions {
    * router.post("/oauth/callback", handler, { csrf: false });
    */
   csrf?: false;
+  /**
+   * Route-level validation, merged over the handler's own `validation`
+   * (keys set here win). Lets one handler serve several routes with different
+   * schemas or failure responses.
+   *
+   * @example
+   * router.post("/workspace-import", importWorkspace, {
+   *   validation: {
+   *     schema: importWorkspaceSchema,
+   *     onFailure: () => ({ status: 400, body: { error: "IMPORT_REQUEST_INVALID" } }),
+   *   },
+   * });
+   */
+  validation?: RequestHandlerValidation;
+  /**
+   * What this route's request log entries carry of its input, overriding
+   * `http.logging`. Applied before any entry is built, so an omitted body or
+   * query never reaches a log channel.
+   *
+   * @example
+   * router.post("/accounts/credentials", controller, {
+   *   logging: { body: false, query: false },
+   * });
+   */
+  logging?: RequestLoggingOptions;
+  /**
+   * Declare a mutating route (POST/PUT/PATCH/DELETE) intentionally reachable
+   * without signing in — a login, a webhook, a contact form. It changes
+   * nothing at runtime; it records the decision so `warlock dev` and
+   * `warlock check` (`WL9006`) stop reporting that the route has no auth
+   * middleware. A group's `public: true` applies to every route
+   * registered inside it. `warlock make endpoint --public` writes it.
+   *
+   * @example
+   * router.post("/auth/login", loginController, { public: true });
+   */
+  public?: boolean;
 }
 type RequestMethod = "GET" | "POST" | "PUT" | "DELETE" | "PATCH" | "OPTIONS" | "HEAD" | "all";
 /** Browser-safe snapshot metadata for a named application API route. */
@@ -268,6 +383,12 @@ type Route = RouteOptions & {
    * Rate limit
    */
   rateLimit?: RouteOptions["rateLimit"];
+  /**
+   * Set by `router.file()`, `router.cachedFile()`, `router.files()` and
+   * `router.cachedFiles()`: the route serves a static file, so it follows
+   * `http.rateLimit.staticFiles` unless it sets `rateLimit` itself.
+   */
+  $staticFile?: boolean;
 };
 type PartialPick<T, F extends keyof T> = Omit<T, F> & Partial<Pick<T, F>>;
 /**
@@ -287,6 +408,12 @@ type GroupedRoutesOptions = {
    * This will be added to each route as a name prefix
    */
   name?: string;
+  /**
+   * Mark every route in the group as intentionally reachable without
+   * signing in (see `RouteOptions.public`). A route's own `public: false`
+   * opts it back out.
+   */
+  public?: boolean;
 };
 /** Route resource */
 type RouteResource = {
@@ -344,11 +471,16 @@ type RouterStacks = {
   prefix: string[];
   name: string[];
   middleware: Middleware[];
+  /**
+   * Open `router.group({ public: true })` scopes; routes registered while any
+   * is open default to `public: true`.
+   */
+  public?: number;
   /**
    * Source file path for routes being added (for HMR route tracking)
    */
   sourceFile?: string;
 };
 //#endregion
-export { GroupedRoutesOptions, HttpContext, Middleware, MiddlewareResponse, NamedApiRoute, NamedApiRoutesOptions, PartialPick, RequestControllerContract, RequestHandler, RequestHandlerType, RequestHandlerValidation, RequestMethod, ResourceMethod, RestfulMiddleware, Route, RouteOptions, RouteResource, RouterGroupCallback, RouterStacks };
+export { GroupedRoutesOptions, HttpContext, Middleware, MiddlewareResponse, NamedApiRoute, NamedApiRoutesOptions, PartialPick, RequestControllerContract, RequestHandler, RequestHandlerType, RequestHandlerValidation, RequestMethod, ResourceMethod, RestfulMiddleware, Route, RouteOptions, RouteRateLimitOptions, RouteResource, RouterGroupCallback, RouterStacks, StaticMountOptions, ValidationFailureContext, ValidationFailureHandler, ValidationFailureResponse };
 //# sourceMappingURL=types.d.mts.map

package/esm/router/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../core/src/router/types.ts"],"mappings":";;;;;;;;;;;;KASY,kBAAA,GAAqB,gBAAgB;;AAAjD;;;;AAAiD;KAQrC,UAAA,2BAAqC,OAAA,GAAU,OAAA;EAAA,CACxD,OAAA,EAAS,WAAA,CAAY,iBAAA,IAAqB,kBAAA;AAAA;AAAA,KAGjC,mBAAA;AAAA,KAEA,kBAAA,GAAqB,cAAA,SAAuB,aAAa;;;;KAKzD,cAAA;AAAA,KAEA,iBAAA,GAAoB,MAAM,UAAU,UAAA;AAAA,KAEpC,wBAAA,kBAA0C,OAAA,GAAU,OAAA;EAff;;;EAmB/C,QAAA,GAAW,UAAA,CAAW,QAAA;EAlBrB;;;AAA4D;AAG/D;EAqBE,UAAA;;;AArB6B;EAyB7B,MAAA,GAAS,eAAA;EAvBmB;;;AAAuC;AAKrE;;;EA0BE,MAAA,GAAS,eAAA;AAAA;AAAA,UAGM,yBAAA;EA3BY;;;EA+B3B,OAAA,EAAS,OAAA;EA7BC;;;EAiCV,QAAA,EAAU,QAAA;EAjCoD;;;EAqC9D,OAAA,IAAW,OAAA,CAAQ,gBAAA;EAfV;;;EAmBT,WAAA;EAzCoD;;;EA6CpD,UAAA,SAAmB,OAAA,CAAQ,kBAAA,IAAsB,kBAAA;AAAA;;;;;;;AAvBzB;KAiCd,WAAA,kBAA6B,OAAA,GAAU,OAAA;EA9BT;;;EAkCxC,OAAA,EAAS,QAAA;EAtBU;;;EA0BnB,QAAA,EAAU,QAAA;AAAA;AAAA,KAGA,cAAA,kBAAgC,OAAA,GAAU,OAAA;EArBe;;;EAAA,CAyBlE,OAAA,EAAS,WAAA,CAAY,QAAA,IAAY,gBAAA;EArCxB;;;EA0CV,UAAA,GAAa,wBAAA,CAAyB,QAAA;EAlCtC;;;EAuCA,WAAA;EAnCiD;;AAAkB;AAUrE;EA+BE,cAAA,GAAiB,cAAA;AAAA;AAAA,UAGF,YAAA;EAlCkC;;;EAsCjD,UAAA,GAAa,UAAA;EA9BK;;;EAkClB,oBAAA;EAtCA;;;EA0CA,IAAA;EAtCkB;AAAA;AAGpB;;EAwCE,WAAA;EAxC0C;;;;;;;;;;;;;;;;;;;;;;;;AAoBX;AAGjC;EA4CE,aAAA,GAAgB,qBAAqB;;;;;;EAMrC,KAAA;EAjCA;;;EAqCA,OAAA;EAAA;;;EAIA,MAAA;EAYE;;;EARF,SAAA;IAoCI;AAGN;;IAnCI,GAAA;IAmCqB;AAAA;AAIzB;IAnCI,UAAA;IAmCqB;;;IA/BrB,YAAA;EAAA;EA+BgC;;;;;;;;;;;AAUR;AAI5B;;;;;;;;;;EArBE,IAAA;AAAA;AAAA,KAGU,aAAA;;KAIA,aAAA,GAAgB,QAAA;EAC1B,IAAA;EACA,IAAA;EACA,MAAA,EAAQ,aAAA;EAmBY;AAAA;AAMtB;;;;EAlBE,QAAA,GAAW,QAAA,CAAS,MAAA;AAAA;;KAIV,qBAAA,GAAwB,QAAA;EA+CV;;;;EA1CxB,eAAA,IACE,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,KAAA,KACJ,QAAA,CAAS,MAAA;AAAA;;;;KAMJ,KAAA,GAAQ,YAAA;EAiClB;;;EA7BA,MAAA,EAAQ,aAAA;EAgCE;;;EA5BV,UAAA;EA4BmD;;;EAxBnD,IAAA;EAwB2E;;;;EAnB3E,OAAA,EAAS,cAAA;EAmBa;;;;;EAbtB,OAAA;EAa2D;;;;;EAP3D,YAAA;EAYU;;;EARV,SAAA,GAAY,YAAA;AAAA;AAAA,KAGF,WAAA,oBAA+B,CAAA,IAAK,IAAA,CAAK,CAAA,EAAG,CAAA,IAAK,OAAA,CAAQ,IAAA,CAAK,CAAA,EAAG,CAAA;;;;KAKjE,oBAAA;EAiBA;;;EAbV,UAAA,GAAa,UAAU;EAqBjB;;;EAjBN,MAAA;EAiCS;;;;EA5BT,IAAA;AAAA;;KAIU,aAAA;EAIV;;;EAAA,IAAA,GAAO,cAAA;EAQP;;;EAJA,GAAA,GAAM,cAAA;EAYN;;;EARA,MAAA,GAAS,cAAA;EAgBT;;;EAZA,MAAA,GAAS,cAAA;EAoBD;;;EAhBR,KAAA,GAAQ,cAAA;EAwBG;;;EApBX,MAAA,GAAS,cAAA;EAwByB;AAIpC;;EAxBE,UAAA,GAAa,cAAA;EA2BS;;;EAvBtB,UAAA;IAuBY;;;IAnBV,GAAA,GAAM,wBAAA;;;;IAIN,MAAA,GAAS,wBAAA;;;;IAIT,MAAA,GAAS,wBAAA;;;;IAIT,KAAA,GAAQ,wBAAA;EAAA;AAAA;AAAA,KAIA,YAAA;EACV,MAAA;EACA,IAAA;EACA,UAAA,EAAY,UAAU;;;;EAItB,UAAA;AAAA"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/router/types.ts"],"mappings":";;;;;;;;;;;;;KAUY,kBAAA,GAAqB,gBAAgB;;AAAjD;;;;AAAiD;KAQrC,UAAA,2BAAqC,OAAA,GAAU,OAAA;EAAA,CACxD,OAAA,EAAS,WAAA,CAAY,iBAAA,IAAqB,kBAAA;AAAA;AAAA,KAGjC,mBAAA;AAAA,KAEA,kBAAA,GAAqB,cAAA,SAAuB,aAAa;;;;KAKzD,cAAA;AAAA,KAEA,iBAAA,GAAoB,MAAM,UAAU,UAAA;AAAA,KAEpC,wBAAA,kBAA0C,OAAA,GAAU,OAAA;EAff;;;EAmB/C,QAAA,GAAW,UAAA,CAAW,QAAA;EAlBrB;;;AAA4D;AAG/D;EAqBE,UAAA;;;AArB6B;EAyB7B,MAAA,GAAS,eAAA;EAvBmB;;;AAAuC;AAKrE;;;EA0BE,MAAA,GAAS,eAAA;EA1Be;AAE1B;;;;AAA0D;AAE1D;;;;;;;;;;;;EAyCE,SAAA,GAAY,wBAAA,CAAyB,QAAA;AAAA;;;;KAM3B,yBAAA;EA3CY;;;EA+CtB,MAAA;EA7BA;;;EAiCA,IAAI;AAAA;;AAdyC;AAM/C;KAcY,wBAAA,kBAA0C,OAAA,GAAU,OAAA;EAC9D,OAAA,EAAS,QAAA;EACT,QAAA,EAAU,QAAA;EARN;AAMN;;EAME,KAAA,EAAO,KAAA;AAAA;;;;KAMG,wBAAA,kBAA0C,OAAA,GAAU,OAAA,KAC9D,MAAA,EAAQ,gBAAA,EACR,OAAA,EAAS,wBAAA,CAAyB,QAAA,MAEhC,yBAAA,sBAGA,OAAA,CAAQ,yBAAA;AAAA,UAEK,yBAAA;EAfH;;;EAmBZ,OAAA,EAAS,OAAA;EAxBT;;;EA4BA,QAAA,EAAU,QAAA;EAvBV;;;EA2BA,OAAA,IAAW,OAAA,CAAQ,gBAAA;EArBT;;;EAyBV,WAAA;EAzB8D;;;EA6B9D,UAAA,SAAmB,OAAA,CAAQ,kBAAA,IAAsB,kBAAA;AAAA;;;;;;;;KAUvC,WAAA,kBAA6B,OAAA,GAAU,OAAA;EAtCjD;;;EA0CA,OAAA,EAAS,QAAA;EAvCP;;;EA2CF,QAAA,EAAU,QAAA;AAAA;AAAA,KAGA,cAAA,kBAAgC,OAAA,GAAU,OAAA;EAzCZ;;;EAAA,CA6CvC,OAAA,EAAS,WAAA,CAAY,QAAA,IAAY,gBAAA;EAjCf;;;EAsCnB,UAAA,GAAa,wBAAA,CAAyB,QAAA;EA9BW;;;EAmCjD,WAAA;EAnDS;;;;EAyDT,cAAA,GAAiB,cAAA;AAAA;;;;;KAOP,qBAAA;EAhDyD;AAAA;AAUrE;EA0CE,GAAA;EA1CqB;;;EA8CrB,UAAA;EAtCU;;;EA0CV,YAAA;AAAA;;;;;KAOU,kBAAA;EAjDQ;AAAA;AAGpB;;;;EAqDE,SAAA,GAAY,qBAAqB;AAAA;AAAA,UAGlB,YAAA;EApDmB;;;EAwDlC,UAAA,GAAa,UAAA;EAxCkB;;;EA4C/B,oBAAA;EAhEoD;;;EAoEpD,IAAA;EAhEkC;;;;EAqElC,WAAA;EArDA;;;AAA+B;AAOjC;;;;;;;;AAYc;AAOd;;;;AAOmC;AAGnC;;;;;;;;EA4CE,aAAA,GAAgB,qBAAA;EA8Ee;;;;;EAxE/B,KAAA;EANA;;;EAUA,OAAA;EAIA;;;EAAA,MAAA;EAqDA;;;;;;AAuBM;AAGR;;;;AAAyB;AAWzB;;;EA1EE,SAAA,GAAY,qBAAA;EAoFQ;;;;;;;;;;;;;;AAAM;AAI5B;;;;;;;EAjEE,IAAA;EAiE0C;;;;;;;;;;;AAQtB;AAMtB;EAjEE,UAAA,GAAa,wBAAA;;;;;;;;;;;EAWb,OAAA,GAAU,qBAAA;EAkEV;;;;;;;;;AA2BW;AAGb;EApFE,MAAA;AAAA;AAAA,KAGU,aAAA;;KAWA,aAAA,GAAgB,QAAA;EAC1B,IAAA;EACA,IAAA;EACA,MAAA,EAAQ,aAAA;EAmE2D;;;;;;EA5DnE,QAAA,GAAW,QAAA,CAAS,MAAA;AAAA;;KAIV,qBAAA,GAAwB,QAAA;EAwDyB;;;;EAnD3D,eAAA,IACE,MAAA,EAAQ,cAAA,EACR,KAAA,EAAO,KAAA,KACJ,QAAA,CAAS,MAAA;AAAA;AAqDhB;;;AAAA,KA/CY,KAAA,GAAQ,YAAA;EAmDlB;;;EA/CA,MAAA,EAAQ,aAAA;EA8DR;;AAAM;EA1DN,UAAA;EA8DuB;;;EA1DvB,IAAA;EAsES;;;;EAjET,OAAA,EAAS,cAAA;EAyFD;;;;;EAnFR,OAAA;EAmDA;;;;;EA7CA,YAAA;EAyDA;;;EArDA,SAAA,GAAY,YAAA;EA6DZ;;;;;EAvDA,WAAA;AAAA;AAAA,KAGU,WAAA,oBAA+B,CAAA,IAAK,IAAA,CAAK,CAAA,EAAG,CAAA,IAAK,OAAA,CAAQ,IAAA,CAAK,CAAA,EAAG,CAAA;;;;KAKjE,oBAAA;EAuEA;;AAAwB;EAnElC,UAAA,GAAa,UAAU;EAuED;;;EAnEtB,MAAA;EAqEA;;;;EAhEA,IAAA;EA0EU;AAAA;;;;EApEV,MAAA;AAAA;;KAIU,aAAA;;;;EAIV,IAAA,GAAO,cAAA;;;;EAIP,GAAA,GAAM,cAAA;;;;EAIN,MAAA,GAAS,cAAA;;;;EAIT,MAAA,GAAS,cAAA;;;;EAIT,KAAA,GAAQ,cAAA;;;;EAIR,MAAA,GAAS,cAAA;;;;EAIT,UAAA,GAAa,cAAA;;;;EAIb,UAAA;;;;IAIE,GAAA,GAAM,wBAAA;;;;IAIN,MAAA,GAAS,wBAAA;;;;IAIT,MAAA,GAAS,wBAAA;;;;IAIT,KAAA,GAAQ,wBAAA;EAAA;AAAA;AAAA,KAIA,YAAA;EACV,MAAA;EACA,IAAA;EACA,UAAA,EAAY,UAAU;;;;;EAKtB,MAAA;;;;EAIA,UAAA;AAAA"}

package/esm/router/unguarded-route-diagnostics.d.mts

@@ -0,0 +1,40 @@
+import { Route } from "./types.mjs";
+import { log } from "@warlock.js/logger";
+
+//#region ../../packages/core/src/router/unguarded-route-diagnostics.d.ts
+/**
+ * Marks a middleware as an authentication guard. A registry symbol, so a copy
+ * of core loaded twice (a linked package next to an installed one) still
+ * recognises guards the other copy marked.
+ */
+declare const AUTH_GUARD_MARKER: unique symbol;
+/**
+ * Declare whether a middleware authenticates the request. `authMiddleware()`
+ * from `@warlock.js/auth` marks itself (and marks `{ optional: true }` as not
+ * a guard); use this for a hand-written guard whose name does not contain
+ * `auth` or `guard`.
+ *
+ * @example
+ * export const requireApiKey = markAuthGuard(async ({ request, response }) => {
+ *   if (request.headers["x-api-key"] !== env("API_KEY")) return response.unauthorized();
+ * });
+ */
+declare function markAuthGuard<T extends (...args: never[]) => unknown>(middleware: T, isGuard?: boolean): T;
+/**
+ * Whether a middleware authenticates the request: its {@link markAuthGuard}
+ * marker when it has one, otherwise a function name containing `auth` or
+ * `guard`.
+ */
+declare function isAuthGuardMiddleware(middleware: unknown): boolean;
+/** Whether a route mutates state, is not a page route, and is neither guarded nor public. */
+declare function isUnguardedMutatingRoute(route: Route): boolean;
+/**
+ * Warn, once per route per process, about every mutating route with no auth
+ * middleware and no `public: true`. Returns the routes it reported.
+ */
+declare function reportUnguardedMutatingRoutes(routes: readonly Route[], logger?: Pick<typeof log, "warn">): Route[];
+/** Forget what was reported (tests). */
+declare function resetUnguardedRouteReports(): void;
+//#endregion
+export { AUTH_GUARD_MARKER, isAuthGuardMiddleware, isUnguardedMutatingRoute, markAuthGuard, reportUnguardedMutatingRoutes, resetUnguardedRouteReports };
+//# sourceMappingURL=unguarded-route-diagnostics.d.mts.map

package/esm/router/unguarded-route-diagnostics.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unguarded-route-diagnostics.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/router/unguarded-route-diagnostics.ts"],"mappings":";;;;;;;;;cAuBa,iBAAA;AA+Bb;;;;AAAyD;AAUzD;;;;AAAqD;AAoBrD;AA9BA,iBAlBgB,aAAA,eAA4B,IAAA,uBAC1C,UAAA,EAAY,CAAA,EACZ,OAAA,aACC,CAAC;;;;;;iBAeY,qBAAA,CAAsB,UAAmB;;iBAUzC,wBAAA,CAAyB,KAAY,EAAL,KAAK;;;;;iBAoBrC,6BAAA,CACd,MAAA,WAAiB,KAAA,IACjB,MAAA,GAAQ,IAAA,QAAY,GAAA,YACnB,KAAA;;iBAsCa,0BAAA"}