@warlock.js/core 5.30.0 → 5.31.0

package/esm/restful/restful.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"restful.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/restful/restful.ts"],"mappings":";;;;;;;;uBASsB,OAAA,WAAkB,KAAA,aAAkB,aAAA;;;;YAI9C,UAAA,EAAY,iBAAA;;AAJxB;;YASY,UAAA;EAT4B;;;EAAA,UAc5B,eAAA;EAUU;;;EAAA,mBALD,UAAA,EAAY,iBAAA,CAAkB,CAAA;EA8BpB;;;EAAA,UAzBnB,QAAA,EAAU,MAAA;EAyBgC;;;;;EAb7C,KAAA;EA+C4C;;;EA1CtC,IAAA,CAAK,EAAA,WAAU,OAAA,CAAA,CAAA;EAmE0B;;;EA3DzC,IAAA;IAAO,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA,SAAA,MAAA,gBAAA,QAAA;EAiHE;;;EA/EzC,GAAA;IAAM,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA,SAAA,MAAA,gBAAA,QAAA;EAiIE;;;EAxGxC,MAAA;IAAS,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA;EA0JA;;;EApGzC,MAAA;IAAS,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA;EAqInB;;;EAnFtB,KAAA;IAAQ,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA;EAmFK;;;EAjC7C,MAAA;IAAS,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA,SAAA,MAAA,gBAAA,QAAA;EAgF4B;;;EA/CrE,UAAA;IAAa,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA,SAAA,MAAA,gBAAA,QAAA;EAsDoB;;;EAAA,UAP9D,YAAA,CAAa,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,CAAA,GAAI,OAAA;EAkBnE;;;EAAA,UAXC,QAAA,CAAS,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,CAAA,GAAI,OAAA;EAsBnE;;;EAAA,UAfK,YAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,EAAS,CAAA,EACT,UAAA,GAAa,CAAA,GACZ,OAAA;EAmBwD;;;EAAA,UAZ3C,QAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,EAAS,CAAA,EACT,UAAA,EAAY,CAAA,GACX,OAAA;EAcoD;;;EAAA,UAPvC,YAAA,CAAa,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,CAAA,GAAI,OAAA;EAgBrE;;;EAAA,UATG,QAAA,CAAS,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,CAAA,GAAI,OAAA;EAoBlE;;;EAAA,UAbI,WAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,EAAS,CAAA,EACT,UAAA,GAAa,CAAA,GACZ,OAAA;EAYA;;;EAAA,UALa,OAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,EAAS,CAAA,EACT,UAAA,EAAY,CAAA,GACX,OAAA;EAWY;;;EAAA,UAJC,UAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,GAAU,CAAA,EACV,UAAA,GAAa,CAAA,GACZ,OAAA;EAUQ;;;EAAA,UAHK,MAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,EAAS,CAAA,EACT,UAAA,GAAa,CAAA,GACZ,OAAA;EASyE;;;;;EAAA,UAAlE,OAAA,CAAQ,MAAA,iCAAuC,OAAA,EAAS,OAAA,GAAU,aAAA;EA5bpB;;;;EAAA,UAsdxC,cAAA,CACd,MAAA,UACA,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,OAAA,SAAa,OAAA,SAAA,MAAA,gBAAA,QAAA;AAAA"}
+{"version":3,"file":"restful.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/restful/restful.ts"],"mappings":";;;;;;;;uBASsB,OAAA,WAAkB,KAAA,aAAkB,aAAA;;;;YAI9C,UAAA,EAAY,iBAAA;;AAJxB;;YASY,UAAA;EAT4B;;;EAAA,UAc5B,eAAA;EAUU;;;EAAA,mBALD,UAAA,EAAY,iBAAA,CAAkB,CAAA;EA8BpB;;;EAAA,UAzBnB,QAAA,EAAU,MAAA;EAyBgC;;;;;EAb7C,KAAA;EA+C4C;;;EA1CtC,IAAA,CAAK,EAAA,WAAU,OAAA,CAAA,CAAA;EAmE0B;;;EA3DzC,IAAA;IAAO,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA,SAAA,QAAA,GAAA,MAAA;EAiHE;;;EA/EzC,GAAA;IAAM,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA,SAAA,QAAA,GAAA,MAAA;EAiIE;;;EAxGxC,MAAA;IAAS,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA;EA0JA;;;EApGzC,MAAA;IAAS,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA;EAqInB;;;EAnFtB,KAAA;IAAQ,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA;EAmFK;;;EAjC7C,MAAA;IAAS,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA,SAAA,QAAA,GAAA,MAAA;EAgF4B;;;EA/CrE,UAAA;IAAa,OAAA;IAAS;EAAA,GAAY,WAAA,GAAW,OAAA,SAAA,QAAA,GAAA,MAAA;EAsDoB;;;EAAA,UAP9D,YAAA,CAAa,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,CAAA,GAAI,OAAA;EAkBnE;;;EAAA,UAXC,QAAA,CAAS,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,CAAA,GAAI,OAAA;EAsBnE;;;EAAA,UAfK,YAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,EAAS,CAAA,EACT,UAAA,GAAa,CAAA,GACZ,OAAA;EAmBwD;;;EAAA,UAZ3C,QAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,EAAS,CAAA,EACT,UAAA,EAAY,CAAA,GACX,OAAA;EAcoD;;;EAAA,UAPvC,YAAA,CAAa,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,CAAA,GAAI,OAAA;EAgBrE;;;EAAA,UATG,QAAA,CAAS,QAAA,EAAU,OAAA,EAAS,SAAA,EAAW,QAAA,EAAU,OAAA,EAAS,CAAA,GAAI,OAAA;EAoBlE;;;EAAA,UAbI,WAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,EAAS,CAAA,EACT,UAAA,GAAa,CAAA,GACZ,OAAA;EAYA;;;EAAA,UALa,OAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,EAAS,CAAA,EACT,UAAA,EAAY,CAAA,GACX,OAAA;EAWY;;;EAAA,UAJC,UAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,GAAU,CAAA,EACV,UAAA,GAAa,CAAA,GACZ,OAAA;EAUQ;;;EAAA,UAHK,MAAA,CACd,QAAA,EAAU,OAAA,EACV,SAAA,EAAW,QAAA,EACX,OAAA,EAAS,CAAA,EACT,UAAA,GAAa,CAAA,GACZ,OAAA;EASyE;;;;;EAAA,UAAlE,OAAA,CAAQ,MAAA,iCAAuC,OAAA,EAAS,OAAA,GAAU,aAAA;EA5bpB;;;;EAAA,UAydxC,cAAA,CACd,MAAA,UACA,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,OAAA,SAAa,OAAA,SAAA,QAAA,GAAA,MAAA;AAAA"}

package/esm/restful/restful.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"restful.mjs","names":[],"sources":["../../../../../../../../packages/core/src/restful/restful.ts"],"sourcesContent":["import type { GenericObject } from \"@mongez/reinforcements\";\nimport type { Model } from \"@warlock.js/cascade\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Request, Response } from \"../http\";\nimport type { QueryBuilderContract, RepositoryManager } from \"../repositories\";\nimport type { HttpContext, RestfulMiddleware, RouteResource } from \"../router\";\n\nconst warnedUnvalidated = new WeakSet<object>();\n\nexport abstract class Restful<T extends Model> implements RouteResource {\n  /**\n   * Middleware for each method\n   */\n  protected middleware: RestfulMiddleware = {};\n\n  /**\n   * Record name\n   */\n  protected recordName = \"record\";\n\n  /**\n   * Records list name\n   */\n  protected recordsListName = \"records\";\n\n  /**\n   * Repository\n   */\n  protected abstract repository: RepositoryManager<T>;\n\n  /**\n   * Define what to be returned when a record is created|updated|deleted|patched\n   */\n  protected returnOn: Record<string, \"record\" | \"records\"> = {\n    create: \"record\",\n    update: \"record\",\n    delete: \"record\",\n    patch: \"record\",\n  };\n\n  /**\n   * Enable fetching cache\n   *\n   * @default true\n   */\n  public cache = true;\n\n  /**\n   * Find record instance by id\n   */\n  public async find(id: number) {\n    const findMethod = this.cache ? \"getCached\" : \"find\";\n    return this.repository[findMethod](id);\n  }\n\n  /**\n   * List records\n   */\n  public async list({ request, response }: HttpContext) {\n    try {\n      const middlewareOutput = await this.callMiddleware(\"list\", request, response);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      const responseDocument: GenericObject = {};\n\n      const data = request.heavy();\n\n      if (data.paginate === \"false\") {\n        data.paginate = false;\n      }\n\n      const listMethod = this.cache ? \"listCached\" : \"list\";\n\n      const { data: documents, pagination } = await this.repository[listMethod](data);\n\n      responseDocument[this.recordsListName] = documents;\n\n      if (pagination) {\n        responseDocument.pagination = pagination;\n      }\n\n      return response.success(responseDocument);\n    } catch (error: any) {\n      log.error(\"restful\", \"list\", error);\n      return response.serverError(error);\n    }\n  }\n\n  /**\n   * Get single record\n   */\n  public async get({ request, response }: HttpContext) {\n    try {\n      const middlewareOutput = await this.callMiddleware(\"get\", request, response);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      const record = await this.find(request.input(\"id\"));\n\n      if (!record) {\n        return response.notFound();\n      }\n\n      return response.success({\n        [this.recordName]: record,\n      });\n    } catch (error) {\n      log.error(\"restful\", \"get\", error);\n\n      throw error;\n    }\n  }\n\n  /**\n   * Create a new record\n   */\n  public async create({ request, response }: HttpContext) {\n    try {\n      const middlewareOutput = await this.callMiddleware(\"create\", request, response);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      const model = this.repository.newModel();\n      const beforeCreate = await this.beforeCreate(request, response, model);\n\n      if (beforeCreate) {\n        return beforeCreate;\n      }\n\n      const beforeSave = await this.beforeSave(request, response, model);\n\n      if (beforeSave) {\n        return beforeSave;\n      }\n\n      // Save the model the hooks received, so their changes are not discarded\n      await model.save(this.payload(\"create\", request));\n\n      const record = model;\n\n      const createOutput = await this.onCreate(request, response, record);\n\n      if (createOutput) {\n        return createOutput;\n      }\n\n      const saveOutput = await this.onSave(request, response, record);\n\n      if (saveOutput) {\n        return saveOutput;\n      }\n\n      if (this.returnOn.create === \"records\") {\n        return this.list({ request, response });\n      }\n\n      return response.successCreate({\n        [this.recordName]: record,\n      });\n    } catch (error: Error | any) {\n      log.error(\"restful\", \"create\", error);\n\n      // let the request error handler decide the status; never leak DB messages as 400\n      throw error;\n    }\n  }\n\n  /**\n   * Update record\n   */\n  public async update({ request, response }: HttpContext) {\n    try {\n      const middlewareOutput = await this.callMiddleware(\"update\", request, response);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      // Find record\n      const record = await this.find(request.input(\"id\"));\n\n      if (!record) {\n        return response.notFound({\n          error: \"Record not found\",\n        });\n      }\n\n      const beforeOutput = await this.beforeUpdate(request, response, record);\n      if (beforeOutput) {\n        return beforeOutput;\n      }\n\n      const beforeSafe = await this.beforeSave(request, response, record);\n\n      if (beforeSafe) {\n        return beforeSafe;\n      }\n\n      const oldRecord = record.clone();\n\n      await record.save(this.payload(\"update\", request));\n\n      await this.onUpdate(request, response, record, oldRecord);\n      await this.onSave(request, response, record, oldRecord);\n\n      if (this.returnOn.update === \"records\") {\n        return this.list({ request, response });\n      }\n\n      return response.success({\n        [this.recordName]: record,\n      });\n    } catch (error) {\n      log.error(\"restful\", \"update\", error);\n\n      throw error;\n    }\n  }\n\n  /**\n   * Patch record\n   */\n  public async patch({ request, response }: HttpContext) {\n    try {\n      const middlewareOutput = await this.callMiddleware(\"patch\", request, response);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      const record = await this.find(request.input(\"id\"));\n\n      if (!record) {\n        return response.notFound({\n          error: \"Record not found\",\n        });\n      }\n\n      const oldRecord = record.clone();\n\n      const beforePatch = await this.beforePatch(request, response, record, oldRecord);\n\n      if (beforePatch) {\n        return beforePatch;\n      }\n\n      const beforeSave = await this.beforeSave(request, response, record, oldRecord);\n\n      if (beforeSave) {\n        return beforeSave;\n      }\n\n      await record.save(this.payload(\"patch\", request));\n\n      await this.onPatch(request, response, record, oldRecord);\n      await this.onSave(request, response, record, oldRecord);\n\n      if (this.returnOn.patch === \"records\") {\n        return this.list({ request, response });\n      }\n\n      return response.success({\n        [this.recordName]: record,\n      });\n    } catch (error) {\n      log.error(\"restful\", \"patch\", error);\n\n      throw error;\n    }\n  }\n\n  /**\n   * Delete record\n   */\n  public async delete({ request, response }: HttpContext) {\n    try {\n      const record = await this.find(request.input(\"id\"));\n\n      if (!record) {\n        return response.notFound();\n      }\n\n      const middlewareOutput = await this.callMiddleware(\"delete\", request, response, record);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      await this.beforeDelete(request, response, record);\n\n      await record.destroy();\n\n      this.onDelete(request, response, record);\n\n      if (this.returnOn.delete === \"records\") {\n        return this.list({ request, response });\n      }\n\n      return response.success();\n    } catch (error: Error | any) {\n      log.error(\"restful\", \"delete\", error);\n\n      throw error;\n    }\n  }\n\n  /**\n   * Bulk delete records\n   */\n  public async bulkDelete({ request, response }: HttpContext) {\n    try {\n      const ids = request.input(\"id\");\n\n      if (!Array.isArray(ids)) {\n        return response.badRequest({\n          error: \"id must be an array\",\n        });\n      }\n\n      const records = await this.repository.all({\n        perform: (query: QueryBuilderContract<T>) =>\n          query.whereIn(\n            \"id\",\n            ids.map((id) => (/^\\d+$/.test(String(id)) ? Number(id) : id)),\n          ),\n      });\n\n      await Promise.all(\n        records.map(async (record) => {\n          if (await this.callMiddleware(\"delete\", request, response, record)) {\n            return;\n          }\n\n          await this.beforeDelete(request, response, record);\n          await record.destroy();\n          this.onDelete(request, response, record);\n        }),\n      );\n\n      if (this.returnOn.delete === \"records\") {\n        return this.list({ request, response });\n      }\n\n      return response.success({\n        deleted: records.length,\n      });\n    } catch (error: Error | any) {\n      log.error(\"restful\", \"bulkDelete\", error);\n\n      throw error;\n    }\n  }\n\n  /**\n   * Before create\n   */\n  protected async beforeCreate(_request: Request, _response: Response, _record: T): Promise<any> {\n    //\n  }\n\n  /**\n   * On create\n   */\n  protected async onCreate(_request: Request, _response: Response, _record: T): Promise<any> {\n    //\n  }\n\n  /**\n   * Before update\n   */\n  protected async beforeUpdate(\n    _request: Request,\n    _response: Response,\n    _record: T,\n    _oldRecord?: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * On update\n   */\n  protected async onUpdate(\n    _request: Request,\n    _response: Response,\n    _record: T,\n    _oldRecord: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * Before delete\n   */\n  protected async beforeDelete(_request: Request, _response: Response, _record: T): Promise<any> {\n    //\n  }\n\n  /**\n   * On delete\n   */\n  protected async onDelete(_request: Request, _response: Response, _record: T): Promise<any> {\n    //\n  }\n\n  /**\n   * Before patch\n   */\n  protected async beforePatch(\n    _request: Request,\n    _response: Response,\n    _record: T,\n    _oldRecord?: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * On patch\n   */\n  protected async onPatch(\n    _request: Request,\n    _response: Response,\n    _record: T,\n    _oldRecord: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * Before save\n   */\n  protected async beforeSave(\n    _request: Request,\n    _response: Response,\n    _record?: T,\n    _oldRecord?: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * On save\n   */\n  protected async onSave(\n    _request: Request,\n    _response: Response,\n    _record: T,\n    _oldRecord?: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * Data to persist: only the validated input.\n   * Without a validation schema the raw input is kept (legacy behaviour)\n   * and a one-time warning names the resource.\n   */\n  protected payload(action: \"create\" | \"update\" | \"patch\", request: Request): GenericObject {\n    const validation = (this as any).validation;\n\n    if (validation?.all || validation?.[action]) {\n      return request.validated();\n    }\n\n    if (!warnedUnvalidated.has(this.constructor)) {\n      warnedUnvalidated.add(this.constructor);\n\n      log.warn(\n        \"restful\",\n        \"validation\",\n        this.constructor.name + \" has no validation schema: \" + action + \" persists unvalidated request input. Define a validation schema to persist only validated fields.\",\n      );\n    }\n\n    if (action === \"create\") return request.all();\n\n    return action === \"update\" ? request.allExceptParams() : request.heavyExceptParams();\n  }\n\n  /**\n   * Call middleware for the given method\n   *\n   */\n  protected async callMiddleware(\n    method: string,\n    request: Request,\n    response: Response,\n    _record?: any,\n  ) {\n    if (!this.middleware[method]) return;\n\n    for (const middleware of this.middleware[method]) {\n      const output = await middleware({ request, response });\n\n      if (output) {\n        return output;\n      }\n    }\n\n    return;\n  }\n}\n"],"mappings":";;;AAOA,MAAM,oCAAoB,IAAI,QAAgB;AAE9C,IAAsB,UAAtB,MAAwE;;oBAI5B,CAAC;oBAKpB;yBAKK;kBAU+B;GACzD,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,OAAO;EACT;eAOe;;;;;CAKf,MAAa,KAAK,IAAY;EAC5B,MAAM,aAAa,KAAK,QAAQ,cAAc;EAC9C,OAAO,KAAK,WAAW,WAAW,CAAC,EAAE;CACvC;;;;CAKA,MAAa,KAAK,EAAE,SAAS,YAAyB;EACpD,IAAI;GACF,MAAM,mBAAmB,MAAM,KAAK,eAAe,QAAQ,SAAS,QAAQ;GAE5E,IAAI,kBAAkB,OAAO;GAE7B,MAAM,mBAAkC,CAAC;GAEzC,MAAM,OAAO,QAAQ,MAAM;GAE3B,IAAI,KAAK,aAAa,SACpB,KAAK,WAAW;GAGlB,MAAM,aAAa,KAAK,QAAQ,eAAe;GAE/C,MAAM,EAAE,MAAM,WAAW,eAAe,MAAM,KAAK,WAAW,WAAW,CAAC,IAAI;GAE9E,iBAAiB,KAAK,mBAAmB;GAEzC,IAAI,YACF,iBAAiB,aAAa;GAGhC,OAAO,SAAS,QAAQ,gBAAgB;EAC1C,SAAS,OAAY;GACnB,IAAI,MAAM,WAAW,QAAQ,KAAK;GAClC,OAAO,SAAS,YAAY,KAAK;EACnC;CACF;;;;CAKA,MAAa,IAAI,EAAE,SAAS,YAAyB;EACnD,IAAI;GACF,MAAM,mBAAmB,MAAM,KAAK,eAAe,OAAO,SAAS,QAAQ;GAE3E,IAAI,kBAAkB,OAAO;GAE7B,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC;GAElD,IAAI,CAAC,QACH,OAAO,SAAS,SAAS;GAG3B,OAAO,SAAS,QAAQ,GACrB,KAAK,aAAa,OACrB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,MAAM,WAAW,OAAO,KAAK;GAEjC,MAAM;EACR;CACF;;;;CAKA,MAAa,OAAO,EAAE,SAAS,YAAyB;EACtD,IAAI;GACF,MAAM,mBAAmB,MAAM,KAAK,eAAe,UAAU,SAAS,QAAQ;GAE9E,IAAI,kBAAkB,OAAO;GAE7B,MAAM,QAAQ,KAAK,WAAW,SAAS;GACvC,MAAM,eAAe,MAAM,KAAK,aAAa,SAAS,UAAU,KAAK;GAErE,IAAI,cACF,OAAO;GAGT,MAAM,aAAa,MAAM,KAAK,WAAW,SAAS,UAAU,KAAK;GAEjE,IAAI,YACF,OAAO;GAIT,MAAM,MAAM,KAAK,KAAK,QAAQ,UAAU,OAAO,CAAC;GAEhD,MAAM,SAAS;GAEf,MAAM,eAAe,MAAM,KAAK,SAAS,SAAS,UAAU,MAAM;GAElE,IAAI,cACF,OAAO;GAGT,MAAM,aAAa,MAAM,KAAK,OAAO,SAAS,UAAU,MAAM;GAE9D,IAAI,YACF,OAAO;GAGT,IAAI,KAAK,SAAS,WAAW,WAC3B,OAAO,KAAK,KAAK;IAAE;IAAS;GAAS,CAAC;GAGxC,OAAO,SAAS,cAAc,GAC3B,KAAK,aAAa,OACrB,CAAC;EACH,SAAS,OAAoB;GAC3B,IAAI,MAAM,WAAW,UAAU,KAAK;GAGpC,MAAM;EACR;CACF;;;;CAKA,MAAa,OAAO,EAAE,SAAS,YAAyB;EACtD,IAAI;GACF,MAAM,mBAAmB,MAAM,KAAK,eAAe,UAAU,SAAS,QAAQ;GAE9E,IAAI,kBAAkB,OAAO;GAG7B,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC;GAElD,IAAI,CAAC,QACH,OAAO,SAAS,SAAS,EACvB,OAAO,mBACT,CAAC;GAGH,MAAM,eAAe,MAAM,KAAK,aAAa,SAAS,UAAU,MAAM;GACtE,IAAI,cACF,OAAO;GAGT,MAAM,aAAa,MAAM,KAAK,WAAW,SAAS,UAAU,MAAM;GAElE,IAAI,YACF,OAAO;GAGT,MAAM,YAAY,OAAO,MAAM;GAE/B,MAAM,OAAO,KAAK,KAAK,QAAQ,UAAU,OAAO,CAAC;GAEjD,MAAM,KAAK,SAAS,SAAS,UAAU,QAAQ,SAAS;GACxD,MAAM,KAAK,OAAO,SAAS,UAAU,QAAQ,SAAS;GAEtD,IAAI,KAAK,SAAS,WAAW,WAC3B,OAAO,KAAK,KAAK;IAAE;IAAS;GAAS,CAAC;GAGxC,OAAO,SAAS,QAAQ,GACrB,KAAK,aAAa,OACrB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,MAAM,WAAW,UAAU,KAAK;GAEpC,MAAM;EACR;CACF;;;;CAKA,MAAa,MAAM,EAAE,SAAS,YAAyB;EACrD,IAAI;GACF,MAAM,mBAAmB,MAAM,KAAK,eAAe,SAAS,SAAS,QAAQ;GAE7E,IAAI,kBAAkB,OAAO;GAE7B,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC;GAElD,IAAI,CAAC,QACH,OAAO,SAAS,SAAS,EACvB,OAAO,mBACT,CAAC;GAGH,MAAM,YAAY,OAAO,MAAM;GAE/B,MAAM,cAAc,MAAM,KAAK,YAAY,SAAS,UAAU,QAAQ,SAAS;GAE/E,IAAI,aACF,OAAO;GAGT,MAAM,aAAa,MAAM,KAAK,WAAW,SAAS,UAAU,QAAQ,SAAS;GAE7E,IAAI,YACF,OAAO;GAGT,MAAM,OAAO,KAAK,KAAK,QAAQ,SAAS,OAAO,CAAC;GAEhD,MAAM,KAAK,QAAQ,SAAS,UAAU,QAAQ,SAAS;GACvD,MAAM,KAAK,OAAO,SAAS,UAAU,QAAQ,SAAS;GAEtD,IAAI,KAAK,SAAS,UAAU,WAC1B,OAAO,KAAK,KAAK;IAAE;IAAS;GAAS,CAAC;GAGxC,OAAO,SAAS,QAAQ,GACrB,KAAK,aAAa,OACrB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,MAAM,WAAW,SAAS,KAAK;GAEnC,MAAM;EACR;CACF;;;;CAKA,MAAa,OAAO,EAAE,SAAS,YAAyB;EACtD,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC;GAElD,IAAI,CAAC,QACH,OAAO,SAAS,SAAS;GAG3B,MAAM,mBAAmB,MAAM,KAAK,eAAe,UAAU,SAAS,UAAU,MAAM;GAEtF,IAAI,kBAAkB,OAAO;GAE7B,MAAM,KAAK,aAAa,SAAS,UAAU,MAAM;GAEjD,MAAM,OAAO,QAAQ;GAErB,KAAK,SAAS,SAAS,UAAU,MAAM;GAEvC,IAAI,KAAK,SAAS,WAAW,WAC3B,OAAO,KAAK,KAAK;IAAE;IAAS;GAAS,CAAC;GAGxC,OAAO,SAAS,QAAQ;EAC1B,SAAS,OAAoB;GAC3B,IAAI,MAAM,WAAW,UAAU,KAAK;GAEpC,MAAM;EACR;CACF;;;;CAKA,MAAa,WAAW,EAAE,SAAS,YAAyB;EAC1D,IAAI;GACF,MAAM,MAAM,QAAQ,MAAM,IAAI;GAE9B,IAAI,CAAC,MAAM,QAAQ,GAAG,GACpB,OAAO,SAAS,WAAW,EACzB,OAAO,sBACT,CAAC;GAGH,MAAM,UAAU,MAAM,KAAK,WAAW,IAAI,EACxC,UAAU,UACR,MAAM,QACJ,MACA,IAAI,KAAK,OAAQ,QAAQ,KAAK,OAAO,EAAE,CAAC,IAAI,OAAO,EAAE,IAAI,EAAG,CAC9D,EACJ,CAAC;GAED,MAAM,QAAQ,IACZ,QAAQ,IAAI,OAAO,WAAW;IAC5B,IAAI,MAAM,KAAK,eAAe,UAAU,SAAS,UAAU,MAAM,GAC/D;IAGF,MAAM,KAAK,aAAa,SAAS,UAAU,MAAM;IACjD,MAAM,OAAO,QAAQ;IACrB,KAAK,SAAS,SAAS,UAAU,MAAM;GACzC,CAAC,CACH;GAEA,IAAI,KAAK,SAAS,WAAW,WAC3B,OAAO,KAAK,KAAK;IAAE;IAAS;GAAS,CAAC;GAGxC,OAAO,SAAS,QAAQ,EACtB,SAAS,QAAQ,OACnB,CAAC;EACH,SAAS,OAAoB;GAC3B,IAAI,MAAM,WAAW,cAAc,KAAK;GAExC,MAAM;EACR;CACF;;;;CAKA,MAAgB,aAAa,UAAmB,WAAqB,SAA0B,CAE/F;;;;CAKA,MAAgB,SAAS,UAAmB,WAAqB,SAA0B,CAE3F;;;;CAKA,MAAgB,aACd,UACA,WACA,SACA,YACc,CAEhB;;;;CAKA,MAAgB,SACd,UACA,WACA,SACA,YACc,CAEhB;;;;CAKA,MAAgB,aAAa,UAAmB,WAAqB,SAA0B,CAE/F;;;;CAKA,MAAgB,SAAS,UAAmB,WAAqB,SAA0B,CAE3F;;;;CAKA,MAAgB,YACd,UACA,WACA,SACA,YACc,CAEhB;;;;CAKA,MAAgB,QACd,UACA,WACA,SACA,YACc,CAEhB;;;;CAKA,MAAgB,WACd,UACA,WACA,SACA,YACc,CAEhB;;;;CAKA,MAAgB,OACd,UACA,WACA,SACA,YACc,CAEhB;;;;;;CAOA,AAAU,QAAQ,QAAuC,SAAiC;EACxF,MAAM,aAAc,KAAa;EAEjC,IAAI,YAAY,OAAO,aAAa,SAClC,OAAO,QAAQ,UAAU;EAG3B,IAAI,CAAC,kBAAkB,IAAI,KAAK,WAAW,GAAG;GAC5C,kBAAkB,IAAI,KAAK,WAAW;GAEtC,IAAI,KACF,WACA,cACA,KAAK,YAAY,OAAO,gCAAgC,SAAS,mGACnE;EACF;EAEA,IAAI,WAAW,UAAU,OAAO,QAAQ,IAAI;EAE5C,OAAO,WAAW,WAAW,QAAQ,gBAAgB,IAAI,QAAQ,kBAAkB;CACrF;;;;;CAMA,MAAgB,eACd,QACA,SACA,UACA,SACA;EACA,IAAI,CAAC,KAAK,WAAW,SAAS;EAE9B,KAAK,MAAM,cAAc,KAAK,WAAW,SAAS;GAChD,MAAM,SAAS,MAAM,WAAW;IAAE;IAAS;GAAS,CAAC;GAErD,IAAI,QACF,OAAO;EAEX;CAGF;AACF"}
+{"version":3,"file":"restful.mjs","names":[],"sources":["../../../../../../../../packages/core/src/restful/restful.ts"],"sourcesContent":["import type { GenericObject } from \"@mongez/reinforcements\";\nimport type { Model } from \"@warlock.js/cascade\";\nimport { log } from \"@warlock.js/logger\";\nimport type { Request, Response } from \"../http\";\nimport type { QueryBuilderContract, RepositoryManager } from \"../repositories\";\nimport type { HttpContext, RestfulMiddleware, RouteResource } from \"../router\";\n\nconst warnedUnvalidated = new WeakSet<object>();\n\nexport abstract class Restful<T extends Model> implements RouteResource {\n  /**\n   * Middleware for each method\n   */\n  protected middleware: RestfulMiddleware = {};\n\n  /**\n   * Record name\n   */\n  protected recordName = \"record\";\n\n  /**\n   * Records list name\n   */\n  protected recordsListName = \"records\";\n\n  /**\n   * Repository\n   */\n  protected abstract repository: RepositoryManager<T>;\n\n  /**\n   * Define what to be returned when a record is created|updated|deleted|patched\n   */\n  protected returnOn: Record<string, \"record\" | \"records\"> = {\n    create: \"record\",\n    update: \"record\",\n    delete: \"record\",\n    patch: \"record\",\n  };\n\n  /**\n   * Enable fetching cache\n   *\n   * @default true\n   */\n  public cache = true;\n\n  /**\n   * Find record instance by id\n   */\n  public async find(id: number) {\n    const findMethod = this.cache ? \"getCached\" : \"find\";\n    return this.repository[findMethod](id);\n  }\n\n  /**\n   * List records\n   */\n  public async list({ request, response }: HttpContext) {\n    try {\n      const middlewareOutput = await this.callMiddleware(\"list\", request, response);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      const responseDocument: GenericObject = {};\n\n      const data = request.heavy();\n\n      if (data.paginate === \"false\") {\n        data.paginate = false;\n      }\n\n      const listMethod = this.cache ? \"listCached\" : \"list\";\n\n      const { data: documents, pagination } = await this.repository[listMethod](data);\n\n      responseDocument[this.recordsListName] = documents;\n\n      if (pagination) {\n        responseDocument.pagination = pagination;\n      }\n\n      return response.success(responseDocument);\n    } catch (error: any) {\n      log.error(\"restful\", \"list\", error);\n      return response.serverError(error);\n    }\n  }\n\n  /**\n   * Get single record\n   */\n  public async get({ request, response }: HttpContext) {\n    try {\n      const middlewareOutput = await this.callMiddleware(\"get\", request, response);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      const record = await this.find(request.input(\"id\"));\n\n      if (!record) {\n        return response.notFound();\n      }\n\n      return response.success({\n        [this.recordName]: record,\n      });\n    } catch (error) {\n      log.error(\"restful\", \"get\", error);\n\n      throw error;\n    }\n  }\n\n  /**\n   * Create a new record\n   */\n  public async create({ request, response }: HttpContext) {\n    try {\n      const middlewareOutput = await this.callMiddleware(\"create\", request, response);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      const model = this.repository.newModel();\n      const beforeCreate = await this.beforeCreate(request, response, model);\n\n      if (beforeCreate) {\n        return beforeCreate;\n      }\n\n      const beforeSave = await this.beforeSave(request, response, model);\n\n      if (beforeSave) {\n        return beforeSave;\n      }\n\n      // Save the model the hooks received, so their changes are not discarded\n      await model.save(this.payload(\"create\", request));\n\n      const record = model;\n\n      const createOutput = await this.onCreate(request, response, record);\n\n      if (createOutput) {\n        return createOutput;\n      }\n\n      const saveOutput = await this.onSave(request, response, record);\n\n      if (saveOutput) {\n        return saveOutput;\n      }\n\n      if (this.returnOn.create === \"records\") {\n        return this.list({ request, response });\n      }\n\n      return response.successCreate({\n        [this.recordName]: record,\n      });\n    } catch (error: Error | any) {\n      log.error(\"restful\", \"create\", error);\n\n      // let the request error handler decide the status; never leak DB messages as 400\n      throw error;\n    }\n  }\n\n  /**\n   * Update record\n   */\n  public async update({ request, response }: HttpContext) {\n    try {\n      const middlewareOutput = await this.callMiddleware(\"update\", request, response);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      // Find record\n      const record = await this.find(request.input(\"id\"));\n\n      if (!record) {\n        return response.notFound({\n          error: \"Record not found\",\n        });\n      }\n\n      const beforeOutput = await this.beforeUpdate(request, response, record);\n      if (beforeOutput) {\n        return beforeOutput;\n      }\n\n      const beforeSafe = await this.beforeSave(request, response, record);\n\n      if (beforeSafe) {\n        return beforeSafe;\n      }\n\n      const oldRecord = record.clone();\n\n      await record.save(this.payload(\"update\", request));\n\n      await this.onUpdate(request, response, record, oldRecord);\n      await this.onSave(request, response, record, oldRecord);\n\n      if (this.returnOn.update === \"records\") {\n        return this.list({ request, response });\n      }\n\n      return response.success({\n        [this.recordName]: record,\n      });\n    } catch (error) {\n      log.error(\"restful\", \"update\", error);\n\n      throw error;\n    }\n  }\n\n  /**\n   * Patch record\n   */\n  public async patch({ request, response }: HttpContext) {\n    try {\n      const middlewareOutput = await this.callMiddleware(\"patch\", request, response);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      const record = await this.find(request.input(\"id\"));\n\n      if (!record) {\n        return response.notFound({\n          error: \"Record not found\",\n        });\n      }\n\n      const oldRecord = record.clone();\n\n      const beforePatch = await this.beforePatch(request, response, record, oldRecord);\n\n      if (beforePatch) {\n        return beforePatch;\n      }\n\n      const beforeSave = await this.beforeSave(request, response, record, oldRecord);\n\n      if (beforeSave) {\n        return beforeSave;\n      }\n\n      await record.save(this.payload(\"patch\", request));\n\n      await this.onPatch(request, response, record, oldRecord);\n      await this.onSave(request, response, record, oldRecord);\n\n      if (this.returnOn.patch === \"records\") {\n        return this.list({ request, response });\n      }\n\n      return response.success({\n        [this.recordName]: record,\n      });\n    } catch (error) {\n      log.error(\"restful\", \"patch\", error);\n\n      throw error;\n    }\n  }\n\n  /**\n   * Delete record\n   */\n  public async delete({ request, response }: HttpContext) {\n    try {\n      const record = await this.find(request.input(\"id\"));\n\n      if (!record) {\n        return response.notFound();\n      }\n\n      const middlewareOutput = await this.callMiddleware(\"delete\", request, response, record);\n\n      if (middlewareOutput) return middlewareOutput;\n\n      await this.beforeDelete(request, response, record);\n\n      await record.destroy();\n\n      this.onDelete(request, response, record);\n\n      if (this.returnOn.delete === \"records\") {\n        return this.list({ request, response });\n      }\n\n      return response.success();\n    } catch (error: Error | any) {\n      log.error(\"restful\", \"delete\", error);\n\n      throw error;\n    }\n  }\n\n  /**\n   * Bulk delete records\n   */\n  public async bulkDelete({ request, response }: HttpContext) {\n    try {\n      const ids = request.input(\"id\");\n\n      if (!Array.isArray(ids)) {\n        return response.badRequest({\n          error: \"id must be an array\",\n        });\n      }\n\n      const records = await this.repository.all({\n        perform: (query: QueryBuilderContract<T>) =>\n          query.whereIn(\n            \"id\",\n            ids.map((id) => (/^\\d+$/.test(String(id)) ? Number(id) : id)),\n          ),\n      });\n\n      await Promise.all(\n        records.map(async (record) => {\n          if (await this.callMiddleware(\"delete\", request, response, record)) {\n            return;\n          }\n\n          await this.beforeDelete(request, response, record);\n          await record.destroy();\n          this.onDelete(request, response, record);\n        }),\n      );\n\n      if (this.returnOn.delete === \"records\") {\n        return this.list({ request, response });\n      }\n\n      return response.success({\n        deleted: records.length,\n      });\n    } catch (error: Error | any) {\n      log.error(\"restful\", \"bulkDelete\", error);\n\n      throw error;\n    }\n  }\n\n  /**\n   * Before create\n   */\n  protected async beforeCreate(_request: Request, _response: Response, _record: T): Promise<any> {\n    //\n  }\n\n  /**\n   * On create\n   */\n  protected async onCreate(_request: Request, _response: Response, _record: T): Promise<any> {\n    //\n  }\n\n  /**\n   * Before update\n   */\n  protected async beforeUpdate(\n    _request: Request,\n    _response: Response,\n    _record: T,\n    _oldRecord?: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * On update\n   */\n  protected async onUpdate(\n    _request: Request,\n    _response: Response,\n    _record: T,\n    _oldRecord: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * Before delete\n   */\n  protected async beforeDelete(_request: Request, _response: Response, _record: T): Promise<any> {\n    //\n  }\n\n  /**\n   * On delete\n   */\n  protected async onDelete(_request: Request, _response: Response, _record: T): Promise<any> {\n    //\n  }\n\n  /**\n   * Before patch\n   */\n  protected async beforePatch(\n    _request: Request,\n    _response: Response,\n    _record: T,\n    _oldRecord?: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * On patch\n   */\n  protected async onPatch(\n    _request: Request,\n    _response: Response,\n    _record: T,\n    _oldRecord: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * Before save\n   */\n  protected async beforeSave(\n    _request: Request,\n    _response: Response,\n    _record?: T,\n    _oldRecord?: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * On save\n   */\n  protected async onSave(\n    _request: Request,\n    _response: Response,\n    _record: T,\n    _oldRecord?: T,\n  ): Promise<any> {\n    //\n  }\n\n  /**\n   * Data to persist: only the validated input.\n   * Without a validation schema the raw input is kept (legacy behaviour)\n   * and a one-time warning names the resource.\n   */\n  protected payload(action: \"create\" | \"update\" | \"patch\", request: Request): GenericObject {\n    const validation = (this as any).validation;\n\n    if (validation?.all || validation?.[action]) {\n      return request.validated();\n    }\n\n    if (!warnedUnvalidated.has(this.constructor)) {\n      warnedUnvalidated.add(this.constructor);\n\n      log.warn(\n        \"restful\",\n        \"validation\",\n        this.constructor.name +\n          \" has no validation schema: \" +\n          action +\n          \" persists unvalidated request input. Define a validation schema to persist only validated fields.\",\n      );\n    }\n\n    if (action === \"create\") return request.all();\n\n    return action === \"update\" ? request.allExceptParams() : request.heavyExceptParams();\n  }\n\n  /**\n   * Call middleware for the given method\n   *\n   */\n  protected async callMiddleware(\n    method: string,\n    request: Request,\n    response: Response,\n    _record?: any,\n  ) {\n    if (!this.middleware[method]) return;\n\n    for (const middleware of this.middleware[method]) {\n      const output = await middleware({ request, response });\n\n      if (output) {\n        return output;\n      }\n    }\n\n    return;\n  }\n}\n"],"mappings":";;;AAOA,MAAM,oCAAoB,IAAI,QAAgB;AAE9C,IAAsB,UAAtB,MAAwE;;oBAI5B,CAAC;oBAKpB;yBAKK;kBAU+B;GACzD,QAAQ;GACR,QAAQ;GACR,QAAQ;GACR,OAAO;EACT;eAOe;;;;;CAKf,MAAa,KAAK,IAAY;EAC5B,MAAM,aAAa,KAAK,QAAQ,cAAc;EAC9C,OAAO,KAAK,WAAW,WAAW,CAAC,EAAE;CACvC;;;;CAKA,MAAa,KAAK,EAAE,SAAS,YAAyB;EACpD,IAAI;GACF,MAAM,mBAAmB,MAAM,KAAK,eAAe,QAAQ,SAAS,QAAQ;GAE5E,IAAI,kBAAkB,OAAO;GAE7B,MAAM,mBAAkC,CAAC;GAEzC,MAAM,OAAO,QAAQ,MAAM;GAE3B,IAAI,KAAK,aAAa,SACpB,KAAK,WAAW;GAGlB,MAAM,aAAa,KAAK,QAAQ,eAAe;GAE/C,MAAM,EAAE,MAAM,WAAW,eAAe,MAAM,KAAK,WAAW,WAAW,CAAC,IAAI;GAE9E,iBAAiB,KAAK,mBAAmB;GAEzC,IAAI,YACF,iBAAiB,aAAa;GAGhC,OAAO,SAAS,QAAQ,gBAAgB;EAC1C,SAAS,OAAY;GACnB,IAAI,MAAM,WAAW,QAAQ,KAAK;GAClC,OAAO,SAAS,YAAY,KAAK;EACnC;CACF;;;;CAKA,MAAa,IAAI,EAAE,SAAS,YAAyB;EACnD,IAAI;GACF,MAAM,mBAAmB,MAAM,KAAK,eAAe,OAAO,SAAS,QAAQ;GAE3E,IAAI,kBAAkB,OAAO;GAE7B,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC;GAElD,IAAI,CAAC,QACH,OAAO,SAAS,SAAS;GAG3B,OAAO,SAAS,QAAQ,GACrB,KAAK,aAAa,OACrB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,MAAM,WAAW,OAAO,KAAK;GAEjC,MAAM;EACR;CACF;;;;CAKA,MAAa,OAAO,EAAE,SAAS,YAAyB;EACtD,IAAI;GACF,MAAM,mBAAmB,MAAM,KAAK,eAAe,UAAU,SAAS,QAAQ;GAE9E,IAAI,kBAAkB,OAAO;GAE7B,MAAM,QAAQ,KAAK,WAAW,SAAS;GACvC,MAAM,eAAe,MAAM,KAAK,aAAa,SAAS,UAAU,KAAK;GAErE,IAAI,cACF,OAAO;GAGT,MAAM,aAAa,MAAM,KAAK,WAAW,SAAS,UAAU,KAAK;GAEjE,IAAI,YACF,OAAO;GAIT,MAAM,MAAM,KAAK,KAAK,QAAQ,UAAU,OAAO,CAAC;GAEhD,MAAM,SAAS;GAEf,MAAM,eAAe,MAAM,KAAK,SAAS,SAAS,UAAU,MAAM;GAElE,IAAI,cACF,OAAO;GAGT,MAAM,aAAa,MAAM,KAAK,OAAO,SAAS,UAAU,MAAM;GAE9D,IAAI,YACF,OAAO;GAGT,IAAI,KAAK,SAAS,WAAW,WAC3B,OAAO,KAAK,KAAK;IAAE;IAAS;GAAS,CAAC;GAGxC,OAAO,SAAS,cAAc,GAC3B,KAAK,aAAa,OACrB,CAAC;EACH,SAAS,OAAoB;GAC3B,IAAI,MAAM,WAAW,UAAU,KAAK;GAGpC,MAAM;EACR;CACF;;;;CAKA,MAAa,OAAO,EAAE,SAAS,YAAyB;EACtD,IAAI;GACF,MAAM,mBAAmB,MAAM,KAAK,eAAe,UAAU,SAAS,QAAQ;GAE9E,IAAI,kBAAkB,OAAO;GAG7B,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC;GAElD,IAAI,CAAC,QACH,OAAO,SAAS,SAAS,EACvB,OAAO,mBACT,CAAC;GAGH,MAAM,eAAe,MAAM,KAAK,aAAa,SAAS,UAAU,MAAM;GACtE,IAAI,cACF,OAAO;GAGT,MAAM,aAAa,MAAM,KAAK,WAAW,SAAS,UAAU,MAAM;GAElE,IAAI,YACF,OAAO;GAGT,MAAM,YAAY,OAAO,MAAM;GAE/B,MAAM,OAAO,KAAK,KAAK,QAAQ,UAAU,OAAO,CAAC;GAEjD,MAAM,KAAK,SAAS,SAAS,UAAU,QAAQ,SAAS;GACxD,MAAM,KAAK,OAAO,SAAS,UAAU,QAAQ,SAAS;GAEtD,IAAI,KAAK,SAAS,WAAW,WAC3B,OAAO,KAAK,KAAK;IAAE;IAAS;GAAS,CAAC;GAGxC,OAAO,SAAS,QAAQ,GACrB,KAAK,aAAa,OACrB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,MAAM,WAAW,UAAU,KAAK;GAEpC,MAAM;EACR;CACF;;;;CAKA,MAAa,MAAM,EAAE,SAAS,YAAyB;EACrD,IAAI;GACF,MAAM,mBAAmB,MAAM,KAAK,eAAe,SAAS,SAAS,QAAQ;GAE7E,IAAI,kBAAkB,OAAO;GAE7B,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC;GAElD,IAAI,CAAC,QACH,OAAO,SAAS,SAAS,EACvB,OAAO,mBACT,CAAC;GAGH,MAAM,YAAY,OAAO,MAAM;GAE/B,MAAM,cAAc,MAAM,KAAK,YAAY,SAAS,UAAU,QAAQ,SAAS;GAE/E,IAAI,aACF,OAAO;GAGT,MAAM,aAAa,MAAM,KAAK,WAAW,SAAS,UAAU,QAAQ,SAAS;GAE7E,IAAI,YACF,OAAO;GAGT,MAAM,OAAO,KAAK,KAAK,QAAQ,SAAS,OAAO,CAAC;GAEhD,MAAM,KAAK,QAAQ,SAAS,UAAU,QAAQ,SAAS;GACvD,MAAM,KAAK,OAAO,SAAS,UAAU,QAAQ,SAAS;GAEtD,IAAI,KAAK,SAAS,UAAU,WAC1B,OAAO,KAAK,KAAK;IAAE;IAAS;GAAS,CAAC;GAGxC,OAAO,SAAS,QAAQ,GACrB,KAAK,aAAa,OACrB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,MAAM,WAAW,SAAS,KAAK;GAEnC,MAAM;EACR;CACF;;;;CAKA,MAAa,OAAO,EAAE,SAAS,YAAyB;EACtD,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC;GAElD,IAAI,CAAC,QACH,OAAO,SAAS,SAAS;GAG3B,MAAM,mBAAmB,MAAM,KAAK,eAAe,UAAU,SAAS,UAAU,MAAM;GAEtF,IAAI,kBAAkB,OAAO;GAE7B,MAAM,KAAK,aAAa,SAAS,UAAU,MAAM;GAEjD,MAAM,OAAO,QAAQ;GAErB,KAAK,SAAS,SAAS,UAAU,MAAM;GAEvC,IAAI,KAAK,SAAS,WAAW,WAC3B,OAAO,KAAK,KAAK;IAAE;IAAS;GAAS,CAAC;GAGxC,OAAO,SAAS,QAAQ;EAC1B,SAAS,OAAoB;GAC3B,IAAI,MAAM,WAAW,UAAU,KAAK;GAEpC,MAAM;EACR;CACF;;;;CAKA,MAAa,WAAW,EAAE,SAAS,YAAyB;EAC1D,IAAI;GACF,MAAM,MAAM,QAAQ,MAAM,IAAI;GAE9B,IAAI,CAAC,MAAM,QAAQ,GAAG,GACpB,OAAO,SAAS,WAAW,EACzB,OAAO,sBACT,CAAC;GAGH,MAAM,UAAU,MAAM,KAAK,WAAW,IAAI,EACxC,UAAU,UACR,MAAM,QACJ,MACA,IAAI,KAAK,OAAQ,QAAQ,KAAK,OAAO,EAAE,CAAC,IAAI,OAAO,EAAE,IAAI,EAAG,CAC9D,EACJ,CAAC;GAED,MAAM,QAAQ,IACZ,QAAQ,IAAI,OAAO,WAAW;IAC5B,IAAI,MAAM,KAAK,eAAe,UAAU,SAAS,UAAU,MAAM,GAC/D;IAGF,MAAM,KAAK,aAAa,SAAS,UAAU,MAAM;IACjD,MAAM,OAAO,QAAQ;IACrB,KAAK,SAAS,SAAS,UAAU,MAAM;GACzC,CAAC,CACH;GAEA,IAAI,KAAK,SAAS,WAAW,WAC3B,OAAO,KAAK,KAAK;IAAE;IAAS;GAAS,CAAC;GAGxC,OAAO,SAAS,QAAQ,EACtB,SAAS,QAAQ,OACnB,CAAC;EACH,SAAS,OAAoB;GAC3B,IAAI,MAAM,WAAW,cAAc,KAAK;GAExC,MAAM;EACR;CACF;;;;CAKA,MAAgB,aAAa,UAAmB,WAAqB,SAA0B,CAE/F;;;;CAKA,MAAgB,SAAS,UAAmB,WAAqB,SAA0B,CAE3F;;;;CAKA,MAAgB,aACd,UACA,WACA,SACA,YACc,CAEhB;;;;CAKA,MAAgB,SACd,UACA,WACA,SACA,YACc,CAEhB;;;;CAKA,MAAgB,aAAa,UAAmB,WAAqB,SAA0B,CAE/F;;;;CAKA,MAAgB,SAAS,UAAmB,WAAqB,SAA0B,CAE3F;;;;CAKA,MAAgB,YACd,UACA,WACA,SACA,YACc,CAEhB;;;;CAKA,MAAgB,QACd,UACA,WACA,SACA,YACc,CAEhB;;;;CAKA,MAAgB,WACd,UACA,WACA,SACA,YACc,CAEhB;;;;CAKA,MAAgB,OACd,UACA,WACA,SACA,YACc,CAEhB;;;;;;CAOA,AAAU,QAAQ,QAAuC,SAAiC;EACxF,MAAM,aAAc,KAAa;EAEjC,IAAI,YAAY,OAAO,aAAa,SAClC,OAAO,QAAQ,UAAU;EAG3B,IAAI,CAAC,kBAAkB,IAAI,KAAK,WAAW,GAAG;GAC5C,kBAAkB,IAAI,KAAK,WAAW;GAEtC,IAAI,KACF,WACA,cACA,KAAK,YAAY,OACf,gCACA,SACA,mGACJ;EACF;EAEA,IAAI,WAAW,UAAU,OAAO,QAAQ,IAAI;EAE5C,OAAO,WAAW,WAAW,QAAQ,gBAAgB,IAAI,QAAQ,kBAAkB;CACrF;;;;;CAMA,MAAgB,eACd,QACA,SACA,UACA,SACA;EACA,IAAI,CAAC,KAAK,WAAW,SAAS;EAE9B,KAAK,MAAM,cAAc,KAAK,WAAW,SAAS;GAChD,MAAM,SAAS,MAAM,WAAW;IAAE;IAAS;GAAS,CAAC;GAErD,IAAI,QACF,OAAO;EAEX;CAGF;AACF"}

package/esm/router/build-route-rate-limit.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"build-route-rate-limit.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/build-route-rate-limit.ts"],"sourcesContent":["import type { RouteOptions } from \"./types\";\n\n/**\n * Turn a route's `rateLimit` option into `@fastify/rate-limit` route config.\n * `errorMessage` is not a plugin option, so it is mapped to\n * `errorResponseBuilder`; the rest passes through unchanged.\n */\nexport function buildRouteRateLimit(rateLimit: NonNullable<RouteOptions[\"rateLimit\"]>) {\n  const { errorMessage, ...rest } = rateLimit;\n\n  if (!errorMessage) {\n    return rest;\n  }\n\n  return {\n    ...rest,\n    errorResponseBuilder: () => ({\n      statusCode: 429,\n      error: \"Too Many Requests\",\n      message: errorMessage,\n    }),\n  };\n}\n"],"mappings":";;;;;;AAOA,SAAgB,oBAAoB,WAAmD;CACrF,MAAM,EAAE,cAAc,GAAG,SAAS;CAElC,IAAI,CAAC,cACH,OAAO;CAGT,OAAO;EACL,GAAG;EACH,6BAA6B;GAC3B,YAAY;GACZ,OAAO;GACP,SAAS;EACX;CACF;AACF"}
+{"version":3,"file":"build-route-rate-limit.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/build-route-rate-limit.ts"],"sourcesContent":["import type { RouteRateLimitOptions } from \"./types\";\n\n/**\n * Turn a route's `rateLimit` option into `@fastify/rate-limit` route config.\n * `errorMessage` is not a plugin option, so it is mapped to\n * `errorResponseBuilder`; the rest passes through unchanged.\n */\nexport function buildRouteRateLimit(rateLimit: RouteRateLimitOptions) {\n  const { errorMessage, ...rest } = rateLimit;\n\n  if (!errorMessage) {\n    return rest;\n  }\n\n  return {\n    ...rest,\n    errorResponseBuilder: () => ({\n      statusCode: 429,\n      error: \"Too Many Requests\",\n      message: errorMessage,\n    }),\n  };\n}\n"],"mappings":";;;;;;AAOA,SAAgB,oBAAoB,WAAkC;CACpE,MAAM,EAAE,cAAc,GAAG,SAAS;CAElC,IAAI,CAAC,cACH,OAAO;CAGT,OAAO;EACL,GAAG;EACH,6BAA6B;GAC3B,YAAY;GACZ,OAAO;GACP,SAAS;EACX;CACF;AACF"}

package/esm/router/dev-dispatch.mjs

@@ -1,4 +1,4 @@
-import { buildRouteRateLimit } from "./build-route-rate-limit.mjs";
+import { resolveRouteRateLimit } from "./resolve-route-rate-limit.mjs";
 
 //#region ../../packages/core/src/router/dev-dispatch.ts
 /**
@@ -27,28 +27,47 @@ function buildNotFoundBody(method, url) {
 	};
 }
 /**
-* Per-route rate limiting for the dev wildcard dispatcher.
+* Rate limiting for the dev wildcard dispatcher, with the same outcome per
+* route as production registration.
 *
 * `@fastify/rate-limit` reads `config.rateLimit` in its `onRoute` hook, which
-* never sees individual routes behind a wildcard. It exposes the same limiter
-* as `server.rateLimit(options)`, built here from the identical
-* `buildRouteRateLimit` options `scan()` passes in production. Limiters are
-* cached per rate-limit config + method so counters survive across requests.
+* never sees individual routes behind a wildcard. The wildcard is therefore
+* registered exempt (`config.rateLimit: false`) and each matched route is
+* limited here through `server.rateLimit(options)`, resolved by the same
+* `resolveRouteRateLimit` that `scan()` uses:
+*
+* - a route's own limit gets its own limiter (cached per route + method so
+*   counters survive across requests, and `all` routes count per verb as
+*   they do in production);
+* - an exempt route (`rateLimit: false`, a passed-through
+*   `serverOptions.config.rateLimit: false`, or a static file route) is not
+*   limited;
+* - every other route shares the global limiter and its bucket, the same one
+*   the plugin's `onRoute` hook gives routes registered on Fastify directly.
+*
+* Unmatched requests are not limited, like production's not-found handler.
 */
-function createDevRateLimiter(server) {
+function createDevRateLimiter(server, globalLimit) {
 	const limiters = /* @__PURE__ */ new WeakMap();
+	let globalLimiter;
 	return async (route, request, reply) => {
-		const options = route.rateLimit;
 		const factory = server.rateLimit;
-		if (!options || typeof factory !== "function") return;
-		let byMethod = limiters.get(options);
+		if (typeof factory !== "function") return;
+		const setting = resolveRouteRateLimit(route);
+		if (setting === false) return;
+		if (setting === void 0) {
+			if (!globalLimit) return void 0;
+			globalLimiter ??= factory.call(server);
+			return globalLimiter(request, reply);
+		}
+		let byMethod = limiters.get(route);
 		if (!byMethod) {
 			byMethod = /* @__PURE__ */ new Map();
-			limiters.set(options, byMethod);
+			limiters.set(route, byMethod);
 		}
 		let limiter = byMethod.get(request.method);
 		if (!limiter) {
-			limiter = factory.call(server, buildRouteRateLimit(options));
+			limiter = factory.call(server, setting);
 			byMethod.set(request.method, limiter);
 		}
 		return limiter(request, reply);

package/esm/router/dev-dispatch.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"dev-dispatch.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/dev-dispatch.ts"],"sourcesContent":["import type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport { buildRouteRateLimit } from \"./build-route-rate-limit\";\nimport type { Route } from \"./types\";\n\n/**\n * Every verb the dev wildcard answers. Mirrors what production registers per\n * route: `head`/`options` routes are ordinary registrations there, so the dev\n * dispatcher must be reachable for them too.\n */\nexport const DEV_DISPATCH_METHODS = [\n  \"GET\",\n  \"HEAD\",\n  \"POST\",\n  \"PUT\",\n  \"DELETE\",\n  \"PATCH\",\n  \"OPTIONS\",\n] as const;\n\n/**\n * The body of an unmatched request — Fastify's own default 404 shape, so an\n * unknown URL looks the same in dev as it does in production.\n */\nexport function buildNotFoundBody(method: string, url: string) {\n  return {\n    message: `Route ${method}:${url} not found`,\n    error: \"Not Found\",\n    statusCode: 404,\n  };\n}\n\ntype RateLimitHandler = (request: FastifyRequest, reply: FastifyReply) => Promise<unknown>;\n\n/**\n * Per-route rate limiting for the dev wildcard dispatcher.\n *\n * `@fastify/rate-limit` reads `config.rateLimit` in its `onRoute` hook, which\n * never sees individual routes behind a wildcard. It exposes the same limiter\n * as `server.rateLimit(options)`, built here from the identical\n * `buildRouteRateLimit` options `scan()` passes in production. Limiters are\n * cached per rate-limit config + method so counters survive across requests.\n */\nexport function createDevRateLimiter(server: FastifyInstance) {\n  const limiters = new WeakMap<object, Map<string, RateLimitHandler>>();\n\n  return async (route: Route, request: FastifyRequest, reply: FastifyReply) => {\n    const options = route.rateLimit;\n\n    const factory = (server as any).rateLimit;\n\n    if (!options || typeof factory !== \"function\") {\n      return undefined;\n    }\n\n    let byMethod = limiters.get(options);\n\n    if (!byMethod) {\n      byMethod = new Map();\n      limiters.set(options, byMethod);\n    }\n\n    // `all` routes are expanded per verb in production, each with its own counter.\n    let limiter = byMethod.get(request.method);\n\n    if (!limiter) {\n      limiter = factory.call(server, buildRouteRateLimit(options)) as RateLimitHandler;\n      byMethod.set(request.method, limiter);\n    }\n\n    return limiter(request, reply);\n  };\n}\n"],"mappings":";;;;;;;;AASA,MAAa,uBAAuB;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAMA,SAAgB,kBAAkB,QAAgB,KAAa;CAC7D,OAAO;EACL,SAAS,SAAS,OAAO,GAAG,IAAI;EAChC,OAAO;EACP,YAAY;CACd;AACF;;;;;;;;;;AAaA,SAAgB,qBAAqB,QAAyB;CAC5D,MAAM,2BAAW,IAAI,QAA+C;CAEpE,OAAO,OAAO,OAAc,SAAyB,UAAwB;EAC3E,MAAM,UAAU,MAAM;EAEtB,MAAM,UAAW,OAAe;EAEhC,IAAI,CAAC,WAAW,OAAO,YAAY,YACjC;EAGF,IAAI,WAAW,SAAS,IAAI,OAAO;EAEnC,IAAI,CAAC,UAAU;GACb,2BAAW,IAAI,IAAI;GACnB,SAAS,IAAI,SAAS,QAAQ;EAChC;EAGA,IAAI,UAAU,SAAS,IAAI,QAAQ,MAAM;EAEzC,IAAI,CAAC,SAAS;GACZ,UAAU,QAAQ,KAAK,QAAQ,oBAAoB,OAAO,CAAC;GAC3D,SAAS,IAAI,QAAQ,QAAQ,OAAO;EACtC;EAEA,OAAO,QAAQ,SAAS,KAAK;CAC/B;AACF"}
+{"version":3,"file":"dev-dispatch.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/dev-dispatch.ts"],"sourcesContent":["import type { FastifyInstance, FastifyReply, FastifyRequest } from \"fastify\";\nimport { resolveRouteRateLimit } from \"./resolve-route-rate-limit\";\nimport type { Route } from \"./types\";\n\n/**\n * Every verb the dev wildcard answers. Mirrors what production registers per\n * route: `head`/`options` routes are ordinary registrations there, so the dev\n * dispatcher must be reachable for them too.\n */\nexport const DEV_DISPATCH_METHODS = [\n  \"GET\",\n  \"HEAD\",\n  \"POST\",\n  \"PUT\",\n  \"DELETE\",\n  \"PATCH\",\n  \"OPTIONS\",\n] as const;\n\n/**\n * The body of an unmatched request — Fastify's own default 404 shape, so an\n * unknown URL looks the same in dev as it does in production.\n */\nexport function buildNotFoundBody(method: string, url: string) {\n  return {\n    message: `Route ${method}:${url} not found`,\n    error: \"Not Found\",\n    statusCode: 404,\n  };\n}\n\ntype RateLimitHandler = (request: FastifyRequest, reply: FastifyReply) => Promise<unknown>;\n\ntype RateLimitFactory = (options?: Record<string, unknown>) => RateLimitHandler;\n\n/**\n * Rate limiting for the dev wildcard dispatcher, with the same outcome per\n * route as production registration.\n *\n * `@fastify/rate-limit` reads `config.rateLimit` in its `onRoute` hook, which\n * never sees individual routes behind a wildcard. The wildcard is therefore\n * registered exempt (`config.rateLimit: false`) and each matched route is\n * limited here through `server.rateLimit(options)`, resolved by the same\n * `resolveRouteRateLimit` that `scan()` uses:\n *\n * - a route's own limit gets its own limiter (cached per route + method so\n *   counters survive across requests, and `all` routes count per verb as\n *   they do in production);\n * - an exempt route (`rateLimit: false`, a passed-through\n *   `serverOptions.config.rateLimit: false`, or a static file route) is not\n *   limited;\n * - every other route shares the global limiter and its bucket, the same one\n *   the plugin's `onRoute` hook gives routes registered on Fastify directly.\n *\n * Unmatched requests are not limited, like production's not-found handler.\n */\nexport function createDevRateLimiter(server: FastifyInstance, globalLimit: boolean) {\n  const limiters = new WeakMap<Route, Map<string, RateLimitHandler>>();\n  let globalLimiter: RateLimitHandler | undefined;\n\n  return async (route: Route, request: FastifyRequest, reply: FastifyReply) => {\n    const factory = (server as unknown as { rateLimit?: RateLimitFactory }).rateLimit;\n\n    if (typeof factory !== \"function\") {\n      return undefined;\n    }\n\n    const setting = resolveRouteRateLimit(route);\n\n    if (setting === false) {\n      return undefined;\n    }\n\n    if (setting === undefined) {\n      if (!globalLimit) return undefined;\n\n      // No options: the plugin's own global params and store, so dev\n      // requests share the bucket of routes registered on Fastify directly.\n      globalLimiter ??= factory.call(server);\n\n      return globalLimiter(request, reply);\n    }\n\n    let byMethod = limiters.get(route);\n\n    if (!byMethod) {\n      byMethod = new Map();\n      limiters.set(route, byMethod);\n    }\n\n    // `all` routes are expanded per verb in production, each with its own counter.\n    let limiter = byMethod.get(request.method);\n\n    if (!limiter) {\n      limiter = factory.call(server, setting);\n      byMethod.set(request.method, limiter);\n    }\n\n    return limiter(request, reply);\n  };\n}\n"],"mappings":";;;;;;;;AASA,MAAa,uBAAuB;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;;;AAMA,SAAgB,kBAAkB,QAAgB,KAAa;CAC7D,OAAO;EACL,SAAS,SAAS,OAAO,GAAG,IAAI;EAChC,OAAO;EACP,YAAY;CACd;AACF;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,qBAAqB,QAAyB,aAAsB;CAClF,MAAM,2BAAW,IAAI,QAA8C;CACnE,IAAI;CAEJ,OAAO,OAAO,OAAc,SAAyB,UAAwB;EAC3E,MAAM,UAAW,OAAuD;EAExE,IAAI,OAAO,YAAY,YACrB;EAGF,MAAM,UAAU,sBAAsB,KAAK;EAE3C,IAAI,YAAY,OACd;EAGF,IAAI,YAAY,QAAW;GACzB,IAAI,CAAC,aAAa,OAAO;GAIzB,kBAAkB,QAAQ,KAAK,MAAM;GAErC,OAAO,cAAc,SAAS,KAAK;EACrC;EAEA,IAAI,WAAW,SAAS,IAAI,KAAK;EAEjC,IAAI,CAAC,UAAU;GACb,2BAAW,IAAI,IAAI;GACnB,SAAS,IAAI,OAAO,QAAQ;EAC9B;EAGA,IAAI,UAAU,SAAS,IAAI,QAAQ,MAAM;EAEzC,IAAI,CAAC,SAAS;GACZ,UAAU,QAAQ,KAAK,QAAQ,OAAO;GACtC,SAAS,IAAI,QAAQ,QAAQ,OAAO;EACtC;EAEA,OAAO,QAAQ,SAAS,KAAK;CAC/B;AACF"}

package/esm/router/index.d.mts

@@ -1,7 +1,9 @@
 import { normalizeRoutePath } from "./normalize-route-path.mjs";
 import { normalizeRequestPath } from "./normalize-request-path.mjs";
-import { GroupedRoutesOptions, HttpContext, Middleware, MiddlewareResponse, NamedApiRoute, NamedApiRoutesOptions, PartialPick, RequestControllerContract, RequestHandler, RequestHandlerType, RequestHandlerValidation, RequestMethod, ResourceMethod, RestfulMiddleware, Route, RouteOptions, RouteResource, RouterGroupCallback, RouterStacks } from "./types.mjs";
+import { GroupedRoutesOptions, HttpContext, Middleware, MiddlewareResponse, NamedApiRoute, NamedApiRoutesOptions, PartialPick, RequestControllerContract, RequestHandler, RequestHandlerType, RequestHandlerValidation, RequestMethod, ResourceMethod, RestfulMiddleware, Route, RouteOptions, RouteRateLimitOptions, RouteResource, RouterGroupCallback, RouterStacks, StaticMountOptions, ValidationFailureContext, ValidationFailureHandler, ValidationFailureResponse } from "./types.mjs";
 import { PositionalHandlerSuspect, clearPositionalHandlerSuspects, describePositionalHandlerSuspect, forgetPositionalHandlerSuspects, inspectHandlerSignature, listPositionalHandlerSuspects, looksLikePositionalHandler, reportPositionalHandlerSuspects } from "./positional-handler-diagnostics.mjs";
 import { matchesDerivedRouteName, routeNameMethodSuffix } from "./route-name-method-suffix.mjs";
+import { RouteNameTakenError } from "./route-name-taken-error.mjs";
 import { RouteRegistry } from "./route-registry.mjs";
-import { Router, router } from "./router.mjs";
+import { Router, router } from "./router.mjs";
+import { AUTH_GUARD_MARKER, isAuthGuardMiddleware, isUnguardedMutatingRoute, markAuthGuard, reportUnguardedMutatingRoutes, resetUnguardedRouteReports } from "./unguarded-route-diagnostics.mjs";

package/esm/router/index.mjs

@@ -2,7 +2,9 @@ import { normalizeRoutePath } from "./normalize-route-path.mjs";
 import { normalizeRequestPath } from "./normalize-request-path.mjs";
 import { clearPositionalHandlerSuspects, describePositionalHandlerSuspect, forgetPositionalHandlerSuspects, inspectHandlerSignature, listPositionalHandlerSuspects, looksLikePositionalHandler, reportPositionalHandlerSuspects } from "./positional-handler-diagnostics.mjs";
 import { matchesDerivedRouteName, routeNameMethodSuffix } from "./route-name-method-suffix.mjs";
+import { RouteNameTakenError } from "./route-name-taken-error.mjs";
 import { RouteRegistry } from "./route-registry.mjs";
+import { AUTH_GUARD_MARKER, isAuthGuardMiddleware, isUnguardedMutatingRoute, markAuthGuard, reportUnguardedMutatingRoutes, resetUnguardedRouteReports } from "./unguarded-route-diagnostics.mjs";
 import { Router, router } from "./router.mjs";
 
 export {  };

package/esm/router/log-request-lifecycle.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"log-request-lifecycle.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/log-request-lifecycle.ts"],"sourcesContent":["/**\n * Both ends of a request's log entry.\n *\n * ## Why the completion line exists\n *\n * The router logged `Starting Request: <id>` and nothing else. A request that\n * hung for thirty seconds and one that returned in two milliseconds produced\n * **byte-identical output**, so the log could not answer the one question\n * anyone opens it to ask.\n *\n * Note what \"detecting a hang\" actually means. Nothing can log the completion\n * of a request that never completes — the mechanism is the **absence** of a\n * completion line beside a start line that has one. That only works if the\n * completion line is emitted on every settled path, **including a throw**,\n * which is why the error path here is not an afterthought.\n *\n * ## Why the level tracks the status\n *\n * A handled 500 does not throw; it returns a response. Logging it at `info`\n * would bury the exact entries someone scanning the log is hunting for, so the\n * level is derived from the outcome: informational below 400, a warning for\n * client errors, an error for server errors and for anything that threw.\n *\n * ## Ports rather than a direct `log` import\n *\n * The behaviour worth pinning down is *which lines come out, in which order,\n * at which level, when the run throws*. Injecting the sink and the clock makes\n * that assertable without a server, a socket or a fake timer.\n *\n * ## Tracing\n *\n * This function is the single funnel for both the success and throw paths\n * (the try/catch below), and it already reads the settled status via\n * `descriptor.statusCode()` after the run settles — the natural place to\n * fire `onRequestStart` / `onRequestEnd`, since that is when the response is\n * actually written and a trace can record what really happened. Gated on\n * `isTracingEnabled()` before building any context object, so a disabled app\n * pays one boolean check and allocates nothing extra.\n */\nimport type { Request } from \"../http/request\";\nimport { buildTracingContext, dispatchRequestEnd, dispatchRequestStart, isTracingEnabled } from \"../http/tracing\";\n\nexport type RequestLogEntry = {\n  module: string;\n  action: string;\n  message: string;\n  /**\n   * Typed as the logger accepts it, not as `unknown`. These entries exist to be\n   * handed to `log.info` / `warn` / `error`, whose parameter is\n   * `Record<string, any>` — `unknown` was not assignable, so the adapter in\n   * router.ts could not compile even though every real caller passes an object.\n   */\n  context?: Record<string, any>;\n};\n\nexport type RequestLogPorts = {\n  info(entry: RequestLogEntry): void;\n  warn(entry: RequestLogEntry): void;\n  error(entry: RequestLogEntry): void;\n  /** Monotonic milliseconds. Called exactly twice per request. */\n  now(): number;\n};\n\nexport type RequestLogDescriptor = {\n  module: string;\n  action: string;\n  requestId: string;\n  /**\n   * Typed as the logger accepts it, not as `unknown`. These entries exist to be\n   * handed to `log.info` / `warn` / `error`, whose parameter is\n   * `Record<string, any>` — `unknown` was not assignable, so the adapter in\n   * router.ts could not compile even though every real caller passes an object.\n   */\n  context?: Record<string, any>;\n  /**\n   * Read AFTER the run settles — the status is decided during the request, so\n   * capturing it up front would report the default on every entry.\n   */\n  statusCode(): number | undefined;\n  /**\n   * The `Request` instance, when tracing needs it to build\n   * the `TracingContext` for `onRequestStart` / `onRequestEnd`. Optional —\n   * absent, tracing dispatch for this request is skipped, which is correct\n   * for any non-HTTP caller of this same lifecycle wrapper.\n   */\n  request?: Request;\n};\n\ntype Level = \"info\" | \"warn\" | \"error\";\n\nfunction levelForStatus(statusCode: number | undefined): Level {\n  // An unknown status is not evidence of a problem; saying \"error\" because we\n  // failed to read a number would be inventing a defect.\n  if (statusCode === undefined) return \"info\";\n\n  if (statusCode >= 500) return \"error\";\n\n  if (statusCode >= 400) return \"warn\";\n\n  return \"info\";\n}\n\nexport async function logRequestLifecycle<TResult>(\n  ports: RequestLogPorts,\n  descriptor: RequestLogDescriptor,\n  run: () => Promise<TResult>,\n): Promise<TResult> {\n  const startedAt = ports.now();\n  const tracingEnabled = isTracingEnabled();\n\n  ports.info({\n    module: descriptor.module,\n    action: descriptor.action,\n    message: `Starting Request: ${descriptor.requestId}`,\n    context: descriptor.context,\n  });\n\n  if (tracingEnabled && descriptor.request) {\n    dispatchRequestStart(buildTracingContext(descriptor.request));\n  }\n\n  const finish = (level: Level, outcome: string, error?: unknown): void => {\n    const duration = Math.round(ports.now() - startedAt);\n\n    ports[level]({\n      module: descriptor.module,\n      action: descriptor.action,\n      message: `Completed Request: ${descriptor.requestId} — ${outcome} in ${duration}ms`,\n      context: descriptor.context,\n    });\n\n    if (tracingEnabled && descriptor.request) {\n      dispatchRequestEnd(buildTracingContext(descriptor.request), {\n        status: descriptor.statusCode(),\n        durationMs: duration,\n        error,\n      });\n    }\n  };\n\n  try {\n    const result = await run();\n\n    const statusCode = descriptor.statusCode();\n\n    finish(levelForStatus(statusCode), statusCode === undefined ? \"no status\" : String(statusCode));\n\n    return result;\n  } catch (error) {\n    // The throw is reported and then re-thrown untouched: this function\n    // observes the request, it does not own its error handling.\n    finish(\"error\", `threw ${error instanceof Error ? error.name : typeof error}`, error);\n\n    throw error;\n  }\n}\n"],"mappings":";;;;AA0FA,SAAS,eAAe,YAAuC;CAG7D,IAAI,eAAe,QAAW,OAAO;CAErC,IAAI,cAAc,KAAK,OAAO;CAE9B,IAAI,cAAc,KAAK,OAAO;CAE9B,OAAO;AACT;AAEA,eAAsB,oBACpB,OACA,YACA,KACkB;CAClB,MAAM,YAAY,MAAM,IAAI;CAC5B,MAAM,iBAAiB,iBAAiB;CAExC,MAAM,KAAK;EACT,QAAQ,WAAW;EACnB,QAAQ,WAAW;EACnB,SAAS,qBAAqB,WAAW;EACzC,SAAS,WAAW;CACtB,CAAC;CAED,IAAI,kBAAkB,WAAW,SAC/B,qBAAqB,oBAAoB,WAAW,OAAO,CAAC;CAG9D,MAAM,UAAU,OAAc,SAAiB,UAA0B;EACvE,MAAM,WAAW,KAAK,MAAM,MAAM,IAAI,IAAI,SAAS;EAEnD,MAAM,MAAM,CAAC;GACX,QAAQ,WAAW;GACnB,QAAQ,WAAW;GACnB,SAAS,sBAAsB,WAAW,UAAU,KAAK,QAAQ,MAAM,SAAS;GAChF,SAAS,WAAW;EACtB,CAAC;EAED,IAAI,kBAAkB,WAAW,SAC/B,mBAAmB,oBAAoB,WAAW,OAAO,GAAG;GAC1D,QAAQ,WAAW,WAAW;GAC9B,YAAY;GACZ;EACF,CAAC;CAEL;CAEA,IAAI;EACF,MAAM,SAAS,MAAM,IAAI;EAEzB,MAAM,aAAa,WAAW,WAAW;EAEzC,OAAO,eAAe,UAAU,GAAG,eAAe,SAAY,cAAc,OAAO,UAAU,CAAC;EAE9F,OAAO;CACT,SAAS,OAAO;EAGd,OAAO,SAAS,SAAS,iBAAiB,QAAQ,MAAM,OAAO,OAAO,SAAS,KAAK;EAEpF,MAAM;CACR;AACF"}
+{"version":3,"file":"log-request-lifecycle.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/log-request-lifecycle.ts"],"sourcesContent":["/**\n * Both ends of a request's log entry.\n *\n * ## Why the completion line exists\n *\n * The router logged `Starting Request: <id>` and nothing else. A request that\n * hung for thirty seconds and one that returned in two milliseconds produced\n * **byte-identical output**, so the log could not answer the one question\n * anyone opens it to ask.\n *\n * Note what \"detecting a hang\" actually means. Nothing can log the completion\n * of a request that never completes — the mechanism is the **absence** of a\n * completion line beside a start line that has one. That only works if the\n * completion line is emitted on every settled path, **including a throw**,\n * which is why the error path here is not an afterthought.\n *\n * ## Why the level tracks the status\n *\n * A handled 500 does not throw; it returns a response. Logging it at `info`\n * would bury the exact entries someone scanning the log is hunting for, so the\n * level is derived from the outcome: informational below 400, a warning for\n * client errors, an error for server errors and for anything that threw.\n *\n * ## Ports rather than a direct `log` import\n *\n * The behaviour worth pinning down is *which lines come out, in which order,\n * at which level, when the run throws*. Injecting the sink and the clock makes\n * that assertable without a server, a socket or a fake timer.\n *\n * ## Tracing\n *\n * This function is the single funnel for both the success and throw paths\n * (the try/catch below), and it already reads the settled status via\n * `descriptor.statusCode()` after the run settles — the natural place to\n * fire `onRequestStart` / `onRequestEnd`, since that is when the response is\n * actually written and a trace can record what really happened. Gated on\n * `isTracingEnabled()` before building any context object, so a disabled app\n * pays one boolean check and allocates nothing extra.\n */\nimport type { Request } from \"../http/request\";\nimport {\n  buildTracingContext,\n  dispatchRequestEnd,\n  dispatchRequestStart,\n  isTracingEnabled,\n} from \"../http/tracing\";\n\nexport type RequestLogEntry = {\n  module: string;\n  action: string;\n  message: string;\n  /**\n   * Typed as the logger accepts it, not as `unknown`. These entries exist to be\n   * handed to `log.info` / `warn` / `error`, whose parameter is\n   * `Record<string, any>` — `unknown` was not assignable, so the adapter in\n   * router.ts could not compile even though every real caller passes an object.\n   */\n  context?: Record<string, any>;\n};\n\nexport type RequestLogPorts = {\n  info(entry: RequestLogEntry): void;\n  warn(entry: RequestLogEntry): void;\n  error(entry: RequestLogEntry): void;\n  /** Monotonic milliseconds. Called exactly twice per request. */\n  now(): number;\n};\n\nexport type RequestLogDescriptor = {\n  module: string;\n  action: string;\n  requestId: string;\n  /**\n   * Typed as the logger accepts it, not as `unknown`. These entries exist to be\n   * handed to `log.info` / `warn` / `error`, whose parameter is\n   * `Record<string, any>` — `unknown` was not assignable, so the adapter in\n   * router.ts could not compile even though every real caller passes an object.\n   */\n  context?: Record<string, any>;\n  /**\n   * Read AFTER the run settles — the status is decided during the request, so\n   * capturing it up front would report the default on every entry.\n   */\n  statusCode(): number | undefined;\n  /**\n   * The `Request` instance, when tracing needs it to build\n   * the `TracingContext` for `onRequestStart` / `onRequestEnd`. Optional —\n   * absent, tracing dispatch for this request is skipped, which is correct\n   * for any non-HTTP caller of this same lifecycle wrapper.\n   */\n  request?: Request;\n};\n\ntype Level = \"info\" | \"warn\" | \"error\";\n\nfunction levelForStatus(statusCode: number | undefined): Level {\n  // An unknown status is not evidence of a problem; saying \"error\" because we\n  // failed to read a number would be inventing a defect.\n  if (statusCode === undefined) return \"info\";\n\n  if (statusCode >= 500) return \"error\";\n\n  if (statusCode >= 400) return \"warn\";\n\n  return \"info\";\n}\n\nexport async function logRequestLifecycle<TResult>(\n  ports: RequestLogPorts,\n  descriptor: RequestLogDescriptor,\n  run: () => Promise<TResult>,\n): Promise<TResult> {\n  const startedAt = ports.now();\n  const tracingEnabled = isTracingEnabled();\n\n  ports.info({\n    module: descriptor.module,\n    action: descriptor.action,\n    message: `Starting Request: ${descriptor.requestId}`,\n    context: descriptor.context,\n  });\n\n  if (tracingEnabled && descriptor.request) {\n    dispatchRequestStart(buildTracingContext(descriptor.request));\n  }\n\n  const finish = (level: Level, outcome: string, error?: unknown): void => {\n    const duration = Math.round(ports.now() - startedAt);\n\n    ports[level]({\n      module: descriptor.module,\n      action: descriptor.action,\n      message: `Completed Request: ${descriptor.requestId} — ${outcome} in ${duration}ms`,\n      context: descriptor.context,\n    });\n\n    if (tracingEnabled && descriptor.request) {\n      dispatchRequestEnd(buildTracingContext(descriptor.request), {\n        status: descriptor.statusCode(),\n        durationMs: duration,\n        error,\n      });\n    }\n  };\n\n  try {\n    const result = await run();\n\n    const statusCode = descriptor.statusCode();\n\n    finish(levelForStatus(statusCode), statusCode === undefined ? \"no status\" : String(statusCode));\n\n    return result;\n  } catch (error) {\n    // The throw is reported and then re-thrown untouched: this function\n    // observes the request, it does not own its error handling.\n    finish(\"error\", `threw ${error instanceof Error ? error.name : typeof error}`, error);\n\n    throw error;\n  }\n}\n"],"mappings":";;;;AA+FA,SAAS,eAAe,YAAuC;CAG7D,IAAI,eAAe,QAAW,OAAO;CAErC,IAAI,cAAc,KAAK,OAAO;CAE9B,IAAI,cAAc,KAAK,OAAO;CAE9B,OAAO;AACT;AAEA,eAAsB,oBACpB,OACA,YACA,KACkB;CAClB,MAAM,YAAY,MAAM,IAAI;CAC5B,MAAM,iBAAiB,iBAAiB;CAExC,MAAM,KAAK;EACT,QAAQ,WAAW;EACnB,QAAQ,WAAW;EACnB,SAAS,qBAAqB,WAAW;EACzC,SAAS,WAAW;CACtB,CAAC;CAED,IAAI,kBAAkB,WAAW,SAC/B,qBAAqB,oBAAoB,WAAW,OAAO,CAAC;CAG9D,MAAM,UAAU,OAAc,SAAiB,UAA0B;EACvE,MAAM,WAAW,KAAK,MAAM,MAAM,IAAI,IAAI,SAAS;EAEnD,MAAM,MAAM,CAAC;GACX,QAAQ,WAAW;GACnB,QAAQ,WAAW;GACnB,SAAS,sBAAsB,WAAW,UAAU,KAAK,QAAQ,MAAM,SAAS;GAChF,SAAS,WAAW;EACtB,CAAC;EAED,IAAI,kBAAkB,WAAW,SAC/B,mBAAmB,oBAAoB,WAAW,OAAO,GAAG;GAC1D,QAAQ,WAAW,WAAW;GAC9B,YAAY;GACZ;EACF,CAAC;CAEL;CAEA,IAAI;EACF,MAAM,SAAS,MAAM,IAAI;EAEzB,MAAM,aAAa,WAAW,WAAW;EAEzC,OAAO,eAAe,UAAU,GAAG,eAAe,SAAY,cAAc,OAAO,UAAU,CAAC;EAE9F,OAAO;CACT,SAAS,OAAO;EAGd,OAAO,SAAS,SAAS,iBAAiB,QAAQ,MAAM,OAAO,OAAO,SAAS,KAAK;EAEpF,MAAM;CACR;AACF"}

package/esm/router/positional-handler-diagnostics.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"positional-handler-diagnostics.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/router/positional-handler-diagnostics.ts"],"mappings":";;;;AA+PsE;AAmBtE;;AAnBsE,KA3N1D,wBAAA;EA8OsE,kDA5OhF,MAAA,EAAQ,KAAK,YAqPC;EAlPd,IAAA;EAGA,WAAA,UA+OgE;EA5OhE,UAAA;AAAA;;;AA0P4C;AAS9C;;;;AAAkF;AAclF;;;;;;;;;;;;;AAAsF;;;;;;;;;;;iBApGtE,0BAAA,CAA2B,OAAgB;;;;;;;;;iBAiC3C,uBAAA,CACd,OAAA,WACA,KAAA;EAAS,MAAA,EAAQ,KAAK;EAAY,IAAA;EAAc,UAAA;AAAA;;;;iBAmBlC,6BAAA,aAA0C,wBAAwB;;;;;;iBASlE,+BAAA,CAAgC,UAAkB;;;;;iBAclD,8BAAA;;;;;;iBASA,gCAAA,CAAiC,OAAiC,EAAxB,wBAAwB;;;;;;;iBAclE,+BAAA,CAAgC,MAAA,GAAQ,IAAA,QAAY,GAAA,YAAkB,wBAAA"}
+{"version":3,"file":"positional-handler-diagnostics.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/router/positional-handler-diagnostics.ts"],"mappings":";;;;AAiQsE;AAmBtE;;AAnBsE,KA7N1D,wBAAA;EAgPsE,kDA9OhF,MAAA,EAAQ,KAAK,YAuPC;EApPd,IAAA;EAGA,WAAA,UAiPgE;EA9OhE,UAAA;AAAA;;;AA4P4C;AAS9C;;;;AAAkF;AAclF;;;;;;;;;;;;;AAAsF;;;;;;;;;;;iBAtGtE,0BAAA,CAA2B,OAAgB;;;;;;;;;iBAmC3C,uBAAA,CACd,OAAA,WACA,KAAA;EAAS,MAAA,EAAQ,KAAK;EAAY,IAAA;EAAc,UAAA;AAAA;;;;iBAmBlC,6BAAA,aAA0C,wBAAwB;;;;;;iBASlE,+BAAA,CAAgC,UAAkB;;;;;iBAclD,8BAAA;;;;;;iBASA,gCAAA,CAAiC,OAAiC,EAAxB,wBAAwB;;;;;;;iBAclE,+BAAA,CAAgC,MAAA,GAAQ,IAAA,QAAY,GAAA,YAAkB,wBAAA"}

package/esm/router/positional-handler-diagnostics.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"positional-handler-diagnostics.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/positional-handler-diagnostics.ts"],"sourcesContent":["/**\n * Early detection of route handlers still written against the **v4 positional\n * signature** — `(request, response)` — after v5 moved to a single context\n * object, `({ request, response })`.\n *\n * ## Why this exists\n *\n * A v4 handler is not rejected anywhere. It registers fine, and the router\n * calls it with one argument, so `response` is simply `undefined`. The app only\n * breaks on the first request that reaches it, with:\n *\n *     TypeError: Cannot read properties of undefined (reading 'success')\n *\n * That message names nothing the reader can act on — not the route, not the\n * handler, not the change to make. This module turns that late, opaque failure\n * into one explicit list printed at boot, and into a `warlock doctor` check.\n *\n * The break itself is intentional; nothing here restores the positional form.\n * Detection and diagnostics only.\n *\n * ## Why it warns and never throws\n *\n * The signal is a heuristic (see {@link looksLikePositionalHandler}), so a\n * false positive is possible in principle. Turning one into a boot failure\n * would take a working application down over a guess, which is strictly worse\n * than the problem being diagnosed. Everything on this path is therefore a\n * warning: nothing here throws, and nothing here changes how a handler is\n * called. A miss simply degrades to the old runtime `TypeError`.\n */\n\nimport { log } from \"@warlock.js/logger\";\nimport type { Route } from \"./types\";\n\n/**\n * One route whose handler looks like it was written for v4.\n */\nexport type PositionalHandlerSuspect = {\n  /** HTTP method the route was registered under. */\n  method: Route[\"method\"];\n\n  /** Full route path, prefixes already applied. */\n  path: string;\n\n  /** Handler function name, or `\"(anonymous)\"` when it has none. */\n  handlerName: string;\n\n  /** Route file the route came from, when the router knows it. */\n  sourceFile: string;\n};\n\n/**\n * Collected across the whole registration pass so the warning can be emitted\n * ONCE, as a single list, rather than one line per route (or — as before — one\n * mystery 500 per request).\n */\nconst suspects: PositionalHandlerSuspect[] = [];\n\n/**\n * Split the parameter list of a function's source into top-level parameters.\n *\n * Depth-aware and quote-aware, because a default value may itself contain\n * commas, parentheses, braces or strings — `(request, response = f(a, b))` is\n * two parameters, not three. Anything unbalanced returns `undefined`: refusing\n * to guess is what keeps a parse quirk from becoming a false warning.\n *\n * @param openIndex index of the `(` that opens the parameter list.\n */\nfunction splitTopLevelParameters(source: string, openIndex: number): string[] | undefined {\n  const parameters: string[] = [];\n\n  let depth = 0;\n  let current = \"\";\n  let quote = \"\";\n\n  for (let index = openIndex; index < source.length; index++) {\n    const char = source[index];\n\n    if (quote) {\n      if (char === \"\\\\\") {\n        current += char + (source[index + 1] ?? \"\");\n        index++;\n        continue;\n      }\n\n      if (char === quote) {\n        quote = \"\";\n      }\n\n      current += char;\n      continue;\n    }\n\n    if (char === '\"' || char === \"'\" || char === \"`\") {\n      quote = char;\n      current += char;\n      continue;\n    }\n\n    if (char === \"(\" || char === \"[\" || char === \"{\") {\n      depth++;\n\n      // The paren that opens the list is punctuation, not part of a parameter.\n      if (depth === 1) continue;\n\n      current += char;\n      continue;\n    }\n\n    if (char === \")\" || char === \"]\" || char === \"}\") {\n      depth--;\n\n      if (depth === 0) {\n        if (current.trim()) {\n          parameters.push(current.trim());\n        }\n\n        return parameters;\n      }\n\n      current += char;\n      continue;\n    }\n\n    if (char === \",\" && depth === 1) {\n      parameters.push(current.trim());\n      current = \"\";\n      continue;\n    }\n\n    current += char;\n  }\n\n  // Never found the closing paren — treat the source as unreadable.\n  return undefined;\n}\n\n/**\n * Read a function's declared parameters from its own source.\n *\n * Returns `undefined` whenever the source cannot be trusted, which callers must\n * treat as \"no information\" rather than \"no parameters\":\n *\n * - `Function.prototype.bind` replaces the body with `[native code]`, so every\n *   `[Controller, \"method\"]` tuple handler lands here (the router binds them);\n * - native functions likewise;\n * - a class, whose first `(` belongs to a constructor or a method, not to a\n *   parameter list;\n * - anything that fails to parse.\n */\nfunction readParameterList(handler: Function): string[] | undefined {\n  let source: string;\n\n  try {\n    source = Function.prototype.toString.call(handler);\n  } catch {\n    return undefined;\n  }\n\n  if (source.includes(\"[native code]\")) return undefined;\n\n  if (/^\\s*class[\\s{]/.test(source)) return undefined;\n\n  // A single parameter needs no parentheses: `ctx => …`, `async ctx => …`.\n  const bareArrow = source.match(/^\\s*(?:async\\s+)?([A-Za-z_$][\\w$]*)\\s*=>/);\n\n  if (bareArrow) {\n    const parameter = bareArrow[1];\n\n    return parameter === undefined ? undefined : [parameter];\n  }\n\n  const openIndex = source.indexOf(\"(\");\n\n  if (openIndex === -1) return undefined;\n\n  return splitTopLevelParameters(source, openIndex);\n}\n\n/**\n * Whether a parameter is written as a destructuring pattern — `{ request }` or\n * `[a, b]` — as opposed to a plain name.\n */\nfunction isDestructured(parameter: string) {\n  const start = parameter.trimStart();\n\n  return start.startsWith(\"{\") || start.startsWith(\"[\");\n}\n\n/**\n * Does this handler look like it was written for the v4 positional signature?\n *\n * ## The signal, and what it misses\n *\n * `Function.length` alone is not enough, because it stops counting at the first\n * defaulted parameter:\n *\n * | handler                            | `.length` | actually |\n * | ---------------------------------- | --------- | -------- |\n * | `({ request, response }) => …`     | 1         | v5       |\n * | `(ctx) => …`                       | 1         | v5       |\n * | `(request, response) => …`         | 2         | v4       |\n * | `(request, response = x) => …`     | 1         | v4       |\n *\n * So the primary signal is the function's own source: a handler is suspect when\n * it declares **two or more** parameters and the first is **not** destructured.\n * Reading the source catches the defaulted row that arity cannot, and rules out\n * the `({ … }, extra)` shape that arity would wrongly flag.\n *\n * When the source is unreadable — a bound or native function — this falls back\n * to `handler.length >= 2`, which `bind` preserves. That is a weaker signal but\n * never a wrong one for the common cases; it only loses the defaulted row.\n *\n * ## What is still missed, by design\n *\n * A one-parameter v4 handler (`(request) => …`) is indistinguishable from a v5\n * `(ctx) => …` and is deliberately not flagged — guessing there would produce\n * false positives on correct code. False positives against the canonical\n * `({ … })` form are essentially nil, and every miss simply leaves today's\n * behaviour in place.\n */\nexport function looksLikePositionalHandler(handler: unknown): boolean {\n  if (typeof handler !== \"function\") return false;\n\n  const parameters = readParameterList(handler);\n\n  if (parameters) {\n    const firstParameter = parameters[0];\n\n    return parameters.length >= 2 && firstParameter !== undefined && !isDestructured(firstParameter);\n  }\n\n  return handler.length >= 2;\n}\n\n/**\n * The name to print for a handler.\n *\n * `Function.bind` prefixes the name with `\"bound \"`, and the router binds every\n * `[Controller, \"method\"]` tuple handler. The bare method name is what the user\n * actually wrote, so that is what gets printed.\n */\nfunction handlerDisplayName(handler: Function): string {\n  return handler.name?.replace(/^bound /, \"\").trim() || \"(anonymous)\";\n}\n\n/**\n * Inspect one route's handler as it registers, recording it when it looks like\n * the v4 positional form. Called from `Router.add`, so the cost is paid once per\n * route at registration and never per request.\n *\n * Deliberately total: any unexpected failure in the heuristic is swallowed, so a\n * diagnostic can never be the reason a route fails to register.\n */\nexport function inspectHandlerSignature(\n  handler: unknown,\n  route: { method: Route[\"method\"]; path: string; sourceFile: string },\n) {\n  try {\n    if (!looksLikePositionalHandler(handler)) return;\n\n    suspects.push({\n      method: route.method,\n      path: route.path,\n      handlerName: handlerDisplayName(handler as Function),\n      sourceFile: route.sourceFile,\n    });\n  } catch {\n    // A diagnostic must never break registration.\n  }\n}\n\n/**\n * Every suspect recorded so far, in registration order.\n */\nexport function listPositionalHandlerSuspects(): readonly PositionalHandlerSuspect[] {\n  return suspects;\n}\n\n/**\n * Drop the suspects belonging to a route file. Kept in step with\n * `Router.removeRoutesBySourceFile` so an HMR reload that fixes a handler does\n * not keep reporting the version it replaced.\n */\nexport function forgetPositionalHandlerSuspects(sourceFile: string) {\n  for (let index = suspects.length - 1; index >= 0; index--) {\n    const suspect = suspects[index];\n\n    if (suspect?.sourceFile === sourceFile) {\n      suspects.splice(index, 1);\n    }\n  }\n}\n\n/**\n * Drop every recorded suspect. Intended for tests, which share the router\n * singleton.\n */\nexport function clearPositionalHandlerSuspects() {\n  suspects.length = 0;\n}\n\n/**\n * The one-line diagnostic for a single route. Written for someone who has never\n * read Warlock's internals: it names the handler, the route, what is wrong, and\n * the exact edit that fixes it.\n */\nexport function describePositionalHandlerSuspect(suspect: PositionalHandlerSuspect): string {\n  return (\n    `Handler \"${suspect.handlerName}\" (${suspect.method} ${suspect.path}) looks like ` +\n    `the v4 positional signature (request, response). ` +\n    `v5 passes a single context object — change it to ({ request, response }).`\n  );\n}\n\n/**\n * The full boot-time warning: every suspect, once, in one entry.\n *\n * One boot, one list — not one warning per route, and emphatically not one 500\n * per request. Returns the reported suspects so callers can assert on them.\n */\nexport function reportPositionalHandlerSuspects(logger: Pick<typeof log, \"warn\"> = log) {\n  const reported = [...suspects];\n\n  if (reported.length === 0) return reported;\n\n  const headline =\n    reported.length === 1\n      ? \"1 route handler looks like the v4 positional signature.\"\n      : `${reported.length} route handlers look like the v4 positional signature.`;\n\n  logger.warn({\n    module: \"router\",\n    action: \"handlerSignature\",\n    message:\n      `${headline} Warlock v5 calls every route handler with a single context object, ` +\n      `so a second parameter is always undefined and the request fails as soon as it is used:\\n` +\n      reported.map((suspect) => `  - ${describePositionalHandlerSuspect(suspect)}`).join(\"\\n\"),\n    context: { handlers: reported },\n  });\n\n  return reported;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,MAAM,WAAuC,CAAC;;;;;;;;;;;AAY9C,SAAS,wBAAwB,QAAgB,WAAyC;CACxF,MAAM,aAAuB,CAAC;CAE9B,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,IAAI,QAAQ;CAEZ,KAAK,IAAI,QAAQ,WAAW,QAAQ,OAAO,QAAQ,SAAS;EAC1D,MAAM,OAAO,OAAO;EAEpB,IAAI,OAAO;GACT,IAAI,SAAS,MAAM;IACjB,WAAW,QAAQ,OAAO,QAAQ,MAAM;IACxC;IACA;GACF;GAEA,IAAI,SAAS,OACX,QAAQ;GAGV,WAAW;GACX;EACF;EAEA,IAAI,SAAS,QAAO,SAAS,OAAO,SAAS,KAAK;GAChD,QAAQ;GACR,WAAW;GACX;EACF;EAEA,IAAI,SAAS,OAAO,SAAS,OAAO,SAAS,KAAK;GAChD;GAGA,IAAI,UAAU,GAAG;GAEjB,WAAW;GACX;EACF;EAEA,IAAI,SAAS,OAAO,SAAS,OAAO,SAAS,KAAK;GAChD;GAEA,IAAI,UAAU,GAAG;IACf,IAAI,QAAQ,KAAK,GACf,WAAW,KAAK,QAAQ,KAAK,CAAC;IAGhC,OAAO;GACT;GAEA,WAAW;GACX;EACF;EAEA,IAAI,SAAS,OAAO,UAAU,GAAG;GAC/B,WAAW,KAAK,QAAQ,KAAK,CAAC;GAC9B,UAAU;GACV;EACF;EAEA,WAAW;CACb;AAIF;;;;;;;;;;;;;;AAeA,SAAS,kBAAkB,SAAyC;CAClE,IAAI;CAEJ,IAAI;EACF,SAAS,SAAS,UAAU,SAAS,KAAK,OAAO;CACnD,QAAQ;EACN;CACF;CAEA,IAAI,OAAO,SAAS,eAAe,GAAG,OAAO;CAE7C,IAAI,iBAAiB,KAAK,MAAM,GAAG,OAAO;CAG1C,MAAM,YAAY,OAAO,MAAM,0CAA0C;CAEzE,IAAI,WAAW;EACb,MAAM,YAAY,UAAU;EAE5B,OAAO,cAAc,SAAY,SAAY,CAAC,SAAS;CACzD;CAEA,MAAM,YAAY,OAAO,QAAQ,GAAG;CAEpC,IAAI,cAAc,IAAI,OAAO;CAE7B,OAAO,wBAAwB,QAAQ,SAAS;AAClD;;;;;AAMA,SAAS,eAAe,WAAmB;CACzC,MAAM,QAAQ,UAAU,UAAU;CAElC,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,GAAG;AACtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,2BAA2B,SAA2B;CACpE,IAAI,OAAO,YAAY,YAAY,OAAO;CAE1C,MAAM,aAAa,kBAAkB,OAAO;CAE5C,IAAI,YAAY;EACd,MAAM,iBAAiB,WAAW;EAElC,OAAO,WAAW,UAAU,KAAK,mBAAmB,UAAa,CAAC,eAAe,cAAc;CACjG;CAEA,OAAO,QAAQ,UAAU;AAC3B;;;;;;;;AASA,SAAS,mBAAmB,SAA2B;CACrD,OAAO,QAAQ,MAAM,QAAQ,WAAW,EAAE,CAAC,CAAC,KAAK,KAAK;AACxD;;;;;;;;;AAUA,SAAgB,wBACd,SACA,OACA;CACA,IAAI;EACF,IAAI,CAAC,2BAA2B,OAAO,GAAG;EAE1C,SAAS,KAAK;GACZ,QAAQ,MAAM;GACd,MAAM,MAAM;GACZ,aAAa,mBAAmB,OAAmB;GACnD,YAAY,MAAM;EACpB,CAAC;CACH,QAAQ,CAER;AACF;;;;AAKA,SAAgB,gCAAqE;CACnF,OAAO;AACT;;;;;;AAOA,SAAgB,gCAAgC,YAAoB;CAClE,KAAK,IAAI,QAAQ,SAAS,SAAS,GAAG,SAAS,GAAG,SAGhD,IAFgB,SAAS,MAEd,EAAE,eAAe,YAC1B,SAAS,OAAO,OAAO,CAAC;AAG9B;;;;;AAMA,SAAgB,iCAAiC;CAC/C,SAAS,SAAS;AACpB;;;;;;AAOA,SAAgB,iCAAiC,SAA2C;CAC1F,OACE,YAAY,QAAQ,YAAY,KAAK,QAAQ,OAAO,GAAG,QAAQ,KAAK;AAIxE;;;;;;;AAQA,SAAgB,gCAAgC,SAAmC,KAAK;CACtF,MAAM,WAAW,CAAC,GAAG,QAAQ;CAE7B,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,WACJ,SAAS,WAAW,IAChB,4DACA,GAAG,SAAS,OAAO;CAEzB,OAAO,KAAK;EACV,QAAQ;EACR,QAAQ;EACR,SACE,GAAG,SAAS,gKAEZ,SAAS,KAAK,YAAY,OAAO,iCAAiC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI;EACzF,SAAS,EAAE,UAAU,SAAS;CAChC,CAAC;CAED,OAAO;AACT"}
+{"version":3,"file":"positional-handler-diagnostics.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/positional-handler-diagnostics.ts"],"sourcesContent":["/**\n * Early detection of route handlers still written against the **v4 positional\n * signature** — `(request, response)` — after v5 moved to a single context\n * object, `({ request, response })`.\n *\n * ## Why this exists\n *\n * A v4 handler is not rejected anywhere. It registers fine, and the router\n * calls it with one argument, so `response` is simply `undefined`. The app only\n * breaks on the first request that reaches it, with:\n *\n *     TypeError: Cannot read properties of undefined (reading 'success')\n *\n * That message names nothing the reader can act on — not the route, not the\n * handler, not the change to make. This module turns that late, opaque failure\n * into one explicit list printed at boot, and into a `warlock doctor` check.\n *\n * The break itself is intentional; nothing here restores the positional form.\n * Detection and diagnostics only.\n *\n * ## Why it warns and never throws\n *\n * The signal is a heuristic (see {@link looksLikePositionalHandler}), so a\n * false positive is possible in principle. Turning one into a boot failure\n * would take a working application down over a guess, which is strictly worse\n * than the problem being diagnosed. Everything on this path is therefore a\n * warning: nothing here throws, and nothing here changes how a handler is\n * called. A miss simply degrades to the old runtime `TypeError`.\n */\n\nimport { log } from \"@warlock.js/logger\";\nimport type { Route } from \"./types\";\n\n/**\n * One route whose handler looks like it was written for v4.\n */\nexport type PositionalHandlerSuspect = {\n  /** HTTP method the route was registered under. */\n  method: Route[\"method\"];\n\n  /** Full route path, prefixes already applied. */\n  path: string;\n\n  /** Handler function name, or `\"(anonymous)\"` when it has none. */\n  handlerName: string;\n\n  /** Route file the route came from, when the router knows it. */\n  sourceFile: string;\n};\n\n/**\n * Collected across the whole registration pass so the warning can be emitted\n * ONCE, as a single list, rather than one line per route (or — as before — one\n * mystery 500 per request).\n */\nconst suspects: PositionalHandlerSuspect[] = [];\n\n/**\n * Split the parameter list of a function's source into top-level parameters.\n *\n * Depth-aware and quote-aware, because a default value may itself contain\n * commas, parentheses, braces or strings — `(request, response = f(a, b))` is\n * two parameters, not three. Anything unbalanced returns `undefined`: refusing\n * to guess is what keeps a parse quirk from becoming a false warning.\n *\n * @param openIndex index of the `(` that opens the parameter list.\n */\nfunction splitTopLevelParameters(source: string, openIndex: number): string[] | undefined {\n  const parameters: string[] = [];\n\n  let depth = 0;\n  let current = \"\";\n  let quote = \"\";\n\n  for (let index = openIndex; index < source.length; index++) {\n    const char = source[index];\n\n    if (quote) {\n      if (char === \"\\\\\") {\n        current += char + (source[index + 1] ?? \"\");\n        index++;\n        continue;\n      }\n\n      if (char === quote) {\n        quote = \"\";\n      }\n\n      current += char;\n      continue;\n    }\n\n    if (char === '\"' || char === \"'\" || char === \"`\") {\n      quote = char;\n      current += char;\n      continue;\n    }\n\n    if (char === \"(\" || char === \"[\" || char === \"{\") {\n      depth++;\n\n      // The paren that opens the list is punctuation, not part of a parameter.\n      if (depth === 1) continue;\n\n      current += char;\n      continue;\n    }\n\n    if (char === \")\" || char === \"]\" || char === \"}\") {\n      depth--;\n\n      if (depth === 0) {\n        if (current.trim()) {\n          parameters.push(current.trim());\n        }\n\n        return parameters;\n      }\n\n      current += char;\n      continue;\n    }\n\n    if (char === \",\" && depth === 1) {\n      parameters.push(current.trim());\n      current = \"\";\n      continue;\n    }\n\n    current += char;\n  }\n\n  // Never found the closing paren — treat the source as unreadable.\n  return undefined;\n}\n\n/**\n * Read a function's declared parameters from its own source.\n *\n * Returns `undefined` whenever the source cannot be trusted, which callers must\n * treat as \"no information\" rather than \"no parameters\":\n *\n * - `Function.prototype.bind` replaces the body with `[native code]`, so every\n *   `[Controller, \"method\"]` tuple handler lands here (the router binds them);\n * - native functions likewise;\n * - a class, whose first `(` belongs to a constructor or a method, not to a\n *   parameter list;\n * - anything that fails to parse.\n */\nfunction readParameterList(handler: Function): string[] | undefined {\n  let source: string;\n\n  try {\n    source = Function.prototype.toString.call(handler);\n  } catch {\n    return undefined;\n  }\n\n  if (source.includes(\"[native code]\")) return undefined;\n\n  if (/^\\s*class[\\s{]/.test(source)) return undefined;\n\n  // A single parameter needs no parentheses: `ctx => …`, `async ctx => …`.\n  const bareArrow = source.match(/^\\s*(?:async\\s+)?([A-Za-z_$][\\w$]*)\\s*=>/);\n\n  if (bareArrow) {\n    const parameter = bareArrow[1];\n\n    return parameter === undefined ? undefined : [parameter];\n  }\n\n  const openIndex = source.indexOf(\"(\");\n\n  if (openIndex === -1) return undefined;\n\n  return splitTopLevelParameters(source, openIndex);\n}\n\n/**\n * Whether a parameter is written as a destructuring pattern — `{ request }` or\n * `[a, b]` — as opposed to a plain name.\n */\nfunction isDestructured(parameter: string) {\n  const start = parameter.trimStart();\n\n  return start.startsWith(\"{\") || start.startsWith(\"[\");\n}\n\n/**\n * Does this handler look like it was written for the v4 positional signature?\n *\n * ## The signal, and what it misses\n *\n * `Function.length` alone is not enough, because it stops counting at the first\n * defaulted parameter:\n *\n * | handler                            | `.length` | actually |\n * | ---------------------------------- | --------- | -------- |\n * | `({ request, response }) => …`     | 1         | v5       |\n * | `(ctx) => …`                       | 1         | v5       |\n * | `(request, response) => …`         | 2         | v4       |\n * | `(request, response = x) => …`     | 1         | v4       |\n *\n * So the primary signal is the function's own source: a handler is suspect when\n * it declares **two or more** parameters and the first is **not** destructured.\n * Reading the source catches the defaulted row that arity cannot, and rules out\n * the `({ … }, extra)` shape that arity would wrongly flag.\n *\n * When the source is unreadable — a bound or native function — this falls back\n * to `handler.length >= 2`, which `bind` preserves. That is a weaker signal but\n * never a wrong one for the common cases; it only loses the defaulted row.\n *\n * ## What is still missed, by design\n *\n * A one-parameter v4 handler (`(request) => …`) is indistinguishable from a v5\n * `(ctx) => …` and is deliberately not flagged — guessing there would produce\n * false positives on correct code. False positives against the canonical\n * `({ … })` form are essentially nil, and every miss simply leaves today's\n * behaviour in place.\n */\nexport function looksLikePositionalHandler(handler: unknown): boolean {\n  if (typeof handler !== \"function\") return false;\n\n  const parameters = readParameterList(handler);\n\n  if (parameters) {\n    const firstParameter = parameters[0];\n\n    return (\n      parameters.length >= 2 && firstParameter !== undefined && !isDestructured(firstParameter)\n    );\n  }\n\n  return handler.length >= 2;\n}\n\n/**\n * The name to print for a handler.\n *\n * `Function.bind` prefixes the name with `\"bound \"`, and the router binds every\n * `[Controller, \"method\"]` tuple handler. The bare method name is what the user\n * actually wrote, so that is what gets printed.\n */\nfunction handlerDisplayName(handler: Function): string {\n  return handler.name?.replace(/^bound /, \"\").trim() || \"(anonymous)\";\n}\n\n/**\n * Inspect one route's handler as it registers, recording it when it looks like\n * the v4 positional form. Called from `Router.add`, so the cost is paid once per\n * route at registration and never per request.\n *\n * Deliberately total: any unexpected failure in the heuristic is swallowed, so a\n * diagnostic can never be the reason a route fails to register.\n */\nexport function inspectHandlerSignature(\n  handler: unknown,\n  route: { method: Route[\"method\"]; path: string; sourceFile: string },\n) {\n  try {\n    if (!looksLikePositionalHandler(handler)) return;\n\n    suspects.push({\n      method: route.method,\n      path: route.path,\n      handlerName: handlerDisplayName(handler as Function),\n      sourceFile: route.sourceFile,\n    });\n  } catch {\n    // A diagnostic must never break registration.\n  }\n}\n\n/**\n * Every suspect recorded so far, in registration order.\n */\nexport function listPositionalHandlerSuspects(): readonly PositionalHandlerSuspect[] {\n  return suspects;\n}\n\n/**\n * Drop the suspects belonging to a route file. Kept in step with\n * `Router.removeRoutesBySourceFile` so an HMR reload that fixes a handler does\n * not keep reporting the version it replaced.\n */\nexport function forgetPositionalHandlerSuspects(sourceFile: string) {\n  for (let index = suspects.length - 1; index >= 0; index--) {\n    const suspect = suspects[index];\n\n    if (suspect?.sourceFile === sourceFile) {\n      suspects.splice(index, 1);\n    }\n  }\n}\n\n/**\n * Drop every recorded suspect. Intended for tests, which share the router\n * singleton.\n */\nexport function clearPositionalHandlerSuspects() {\n  suspects.length = 0;\n}\n\n/**\n * The one-line diagnostic for a single route. Written for someone who has never\n * read Warlock's internals: it names the handler, the route, what is wrong, and\n * the exact edit that fixes it.\n */\nexport function describePositionalHandlerSuspect(suspect: PositionalHandlerSuspect): string {\n  return (\n    `Handler \"${suspect.handlerName}\" (${suspect.method} ${suspect.path}) looks like ` +\n    `the v4 positional signature (request, response). ` +\n    `v5 passes a single context object — change it to ({ request, response }).`\n  );\n}\n\n/**\n * The full boot-time warning: every suspect, once, in one entry.\n *\n * One boot, one list — not one warning per route, and emphatically not one 500\n * per request. Returns the reported suspects so callers can assert on them.\n */\nexport function reportPositionalHandlerSuspects(logger: Pick<typeof log, \"warn\"> = log) {\n  const reported = [...suspects];\n\n  if (reported.length === 0) return reported;\n\n  const headline =\n    reported.length === 1\n      ? \"1 route handler looks like the v4 positional signature.\"\n      : `${reported.length} route handlers look like the v4 positional signature.`;\n\n  logger.warn({\n    module: \"router\",\n    action: \"handlerSignature\",\n    message:\n      `${headline} Warlock v5 calls every route handler with a single context object, ` +\n      `so a second parameter is always undefined and the request fails as soon as it is used:\\n` +\n      reported.map((suspect) => `  - ${describePositionalHandlerSuspect(suspect)}`).join(\"\\n\"),\n    context: { handlers: reported },\n  });\n\n  return reported;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,MAAM,WAAuC,CAAC;;;;;;;;;;;AAY9C,SAAS,wBAAwB,QAAgB,WAAyC;CACxF,MAAM,aAAuB,CAAC;CAE9B,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,IAAI,QAAQ;CAEZ,KAAK,IAAI,QAAQ,WAAW,QAAQ,OAAO,QAAQ,SAAS;EAC1D,MAAM,OAAO,OAAO;EAEpB,IAAI,OAAO;GACT,IAAI,SAAS,MAAM;IACjB,WAAW,QAAQ,OAAO,QAAQ,MAAM;IACxC;IACA;GACF;GAEA,IAAI,SAAS,OACX,QAAQ;GAGV,WAAW;GACX;EACF;EAEA,IAAI,SAAS,QAAO,SAAS,OAAO,SAAS,KAAK;GAChD,QAAQ;GACR,WAAW;GACX;EACF;EAEA,IAAI,SAAS,OAAO,SAAS,OAAO,SAAS,KAAK;GAChD;GAGA,IAAI,UAAU,GAAG;GAEjB,WAAW;GACX;EACF;EAEA,IAAI,SAAS,OAAO,SAAS,OAAO,SAAS,KAAK;GAChD;GAEA,IAAI,UAAU,GAAG;IACf,IAAI,QAAQ,KAAK,GACf,WAAW,KAAK,QAAQ,KAAK,CAAC;IAGhC,OAAO;GACT;GAEA,WAAW;GACX;EACF;EAEA,IAAI,SAAS,OAAO,UAAU,GAAG;GAC/B,WAAW,KAAK,QAAQ,KAAK,CAAC;GAC9B,UAAU;GACV;EACF;EAEA,WAAW;CACb;AAIF;;;;;;;;;;;;;;AAeA,SAAS,kBAAkB,SAAyC;CAClE,IAAI;CAEJ,IAAI;EACF,SAAS,SAAS,UAAU,SAAS,KAAK,OAAO;CACnD,QAAQ;EACN;CACF;CAEA,IAAI,OAAO,SAAS,eAAe,GAAG,OAAO;CAE7C,IAAI,iBAAiB,KAAK,MAAM,GAAG,OAAO;CAG1C,MAAM,YAAY,OAAO,MAAM,0CAA0C;CAEzE,IAAI,WAAW;EACb,MAAM,YAAY,UAAU;EAE5B,OAAO,cAAc,SAAY,SAAY,CAAC,SAAS;CACzD;CAEA,MAAM,YAAY,OAAO,QAAQ,GAAG;CAEpC,IAAI,cAAc,IAAI,OAAO;CAE7B,OAAO,wBAAwB,QAAQ,SAAS;AAClD;;;;;AAMA,SAAS,eAAe,WAAmB;CACzC,MAAM,QAAQ,UAAU,UAAU;CAElC,OAAO,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,GAAG;AACtD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,2BAA2B,SAA2B;CACpE,IAAI,OAAO,YAAY,YAAY,OAAO;CAE1C,MAAM,aAAa,kBAAkB,OAAO;CAE5C,IAAI,YAAY;EACd,MAAM,iBAAiB,WAAW;EAElC,OACE,WAAW,UAAU,KAAK,mBAAmB,UAAa,CAAC,eAAe,cAAc;CAE5F;CAEA,OAAO,QAAQ,UAAU;AAC3B;;;;;;;;AASA,SAAS,mBAAmB,SAA2B;CACrD,OAAO,QAAQ,MAAM,QAAQ,WAAW,EAAE,CAAC,CAAC,KAAK,KAAK;AACxD;;;;;;;;;AAUA,SAAgB,wBACd,SACA,OACA;CACA,IAAI;EACF,IAAI,CAAC,2BAA2B,OAAO,GAAG;EAE1C,SAAS,KAAK;GACZ,QAAQ,MAAM;GACd,MAAM,MAAM;GACZ,aAAa,mBAAmB,OAAmB;GACnD,YAAY,MAAM;EACpB,CAAC;CACH,QAAQ,CAER;AACF;;;;AAKA,SAAgB,gCAAqE;CACnF,OAAO;AACT;;;;;;AAOA,SAAgB,gCAAgC,YAAoB;CAClE,KAAK,IAAI,QAAQ,SAAS,SAAS,GAAG,SAAS,GAAG,SAGhD,IAFgB,SAAS,MAEd,EAAE,eAAe,YAC1B,SAAS,OAAO,OAAO,CAAC;AAG9B;;;;;AAMA,SAAgB,iCAAiC;CAC/C,SAAS,SAAS;AACpB;;;;;;AAOA,SAAgB,iCAAiC,SAA2C;CAC1F,OACE,YAAY,QAAQ,YAAY,KAAK,QAAQ,OAAO,GAAG,QAAQ,KAAK;AAIxE;;;;;;;AAQA,SAAgB,gCAAgC,SAAmC,KAAK;CACtF,MAAM,WAAW,CAAC,GAAG,QAAQ;CAE7B,IAAI,SAAS,WAAW,GAAG,OAAO;CAElC,MAAM,WACJ,SAAS,WAAW,IAChB,4DACA,GAAG,SAAS,OAAO;CAEzB,OAAO,KAAK;EACV,QAAQ;EACR,QAAQ;EACR,SACE,GAAG,SAAS,gKAEZ,SAAS,KAAK,YAAY,OAAO,iCAAiC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI;EACzF,SAAS,EAAE,UAAU,SAAS;CAChC,CAAC;CAED,OAAO;AACT"}

package/esm/router/resolve-route-rate-limit.mjs

@@ -0,0 +1,47 @@
+import { buildRouteRateLimit } from "./build-route-rate-limit.mjs";
+import config from "@mongez/config";
+
+//#region ../../packages/core/src/router/resolve-route-rate-limit.ts
+/**
+* Whether static files (the public folder, `router.directory()` mounts and
+* `router.file()` routes) count against the global limiter. Off by default:
+* one page load fetches many assets, which would spend a client's quota on
+* files instead of pages and API calls. `http.rateLimit.staticFiles: true`
+* opts them back in.
+*/
+function staticFilesAreRateLimited() {
+	return config.get("http.rateLimit.staticFiles") === true;
+}
+/**
+* Resolve a static mount's rate-limit setting: `true` keeps it under the
+* global limiter, `false` exempts it, an object gives it its own limit, and
+* leaving it unset follows `http.rateLimit.staticFiles`.
+*/
+function resolveStaticRateLimit(rateLimit) {
+	if (rateLimit === void 0) return staticFilesAreRateLimited() ? void 0 : false;
+	return resolveExplicitRateLimit(rateLimit);
+}
+/**
+* Resolve a router route's rate-limit setting, identically for production
+* registration and the development wildcard dispatcher.
+*
+* Precedence: the route's own `rateLimit` option, then a
+* `serverOptions.config.rateLimit` passed through to Fastify, then the
+* static-file default for `router.file()` routes, then the global policy.
+*/
+function resolveRouteRateLimit(route) {
+	if (route.rateLimit !== void 0) return resolveExplicitRateLimit(route.rateLimit);
+	const passedThrough = (route.serverOptions?.config)?.rateLimit;
+	if (passedThrough === false) return false;
+	if (typeof passedThrough === "object" && passedThrough !== null) return passedThrough;
+	if (route.$staticFile) return resolveStaticRateLimit(void 0);
+}
+function resolveExplicitRateLimit(rateLimit) {
+	if (rateLimit === true) return void 0;
+	if (rateLimit === false) return false;
+	return buildRouteRateLimit(rateLimit);
+}
+
+//#endregion
+export { resolveRouteRateLimit, resolveStaticRateLimit };
+//# sourceMappingURL=resolve-route-rate-limit.mjs.map

package/esm/router/resolve-route-rate-limit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-route-rate-limit.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/resolve-route-rate-limit.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport { buildRouteRateLimit } from \"./build-route-rate-limit\";\nimport type { Route, RouteRateLimitOptions } from \"./types\";\n\n/**\n * What `@fastify/rate-limit` reads from a route's `config.rateLimit`:\n * `false` exempts the route, an object gives it its own limit and bucket, and\n * `undefined` leaves it under the global policy.\n */\nexport type RouteRateLimitSetting = false | Record<string, unknown> | undefined;\n\n/**\n * Whether static files (the public folder, `router.directory()` mounts and\n * `router.file()` routes) count against the global limiter. Off by default:\n * one page load fetches many assets, which would spend a client's quota on\n * files instead of pages and API calls. `http.rateLimit.staticFiles: true`\n * opts them back in.\n */\nexport function staticFilesAreRateLimited(): boolean {\n  return config.get(\"http.rateLimit.staticFiles\") === true;\n}\n\n/**\n * Resolve a static mount's rate-limit setting: `true` keeps it under the\n * global limiter, `false` exempts it, an object gives it its own limit, and\n * leaving it unset follows `http.rateLimit.staticFiles`.\n */\nexport function resolveStaticRateLimit(\n  rateLimit: RouteRateLimitOptions | boolean | undefined,\n): RouteRateLimitSetting {\n  if (rateLimit === undefined) {\n    return staticFilesAreRateLimited() ? undefined : false;\n  }\n\n  return resolveExplicitRateLimit(rateLimit);\n}\n\n/**\n * Resolve a router route's rate-limit setting, identically for production\n * registration and the development wildcard dispatcher.\n *\n * Precedence: the route's own `rateLimit` option, then a\n * `serverOptions.config.rateLimit` passed through to Fastify, then the\n * static-file default for `router.file()` routes, then the global policy.\n */\nexport function resolveRouteRateLimit(\n  route: Pick<Route, \"rateLimit\" | \"serverOptions\" | \"$staticFile\">,\n): RouteRateLimitSetting {\n  if (route.rateLimit !== undefined) {\n    return resolveExplicitRateLimit(route.rateLimit);\n  }\n\n  const passedThrough: unknown = (\n    route.serverOptions?.config as { rateLimit?: unknown } | undefined\n  )?.rateLimit;\n\n  if (passedThrough === false) return false;\n\n  if (typeof passedThrough === \"object\" && passedThrough !== null) {\n    return passedThrough as Record<string, unknown>;\n  }\n\n  if (route.$staticFile) return resolveStaticRateLimit(undefined);\n\n  return undefined;\n}\n\nfunction resolveExplicitRateLimit(\n  rateLimit: RouteRateLimitOptions | boolean,\n): RouteRateLimitSetting {\n  if (rateLimit === true) return undefined;\n\n  if (rateLimit === false) return false;\n\n  return buildRouteRateLimit(rateLimit);\n}\n"],"mappings":";;;;;;;;;;;AAkBA,SAAgB,4BAAqC;CACnD,OAAO,OAAO,IAAI,4BAA4B,MAAM;AACtD;;;;;;AAOA,SAAgB,uBACd,WACuB;CACvB,IAAI,cAAc,QAChB,OAAO,0BAA0B,IAAI,SAAY;CAGnD,OAAO,yBAAyB,SAAS;AAC3C;;;;;;;;;AAUA,SAAgB,sBACd,OACuB;CACvB,IAAI,MAAM,cAAc,QACtB,OAAO,yBAAyB,MAAM,SAAS;CAGjD,MAAM,iBACJ,MAAM,eAAe,OAAM,EAC1B;CAEH,IAAI,kBAAkB,OAAO,OAAO;CAEpC,IAAI,OAAO,kBAAkB,YAAY,kBAAkB,MACzD,OAAO;CAGT,IAAI,MAAM,aAAa,OAAO,uBAAuB,MAAS;AAGhE;AAEA,SAAS,yBACP,WACuB;CACvB,IAAI,cAAc,MAAM,OAAO;CAE/B,IAAI,cAAc,OAAO,OAAO;CAEhC,OAAO,oBAAoB,SAAS;AACtC"}

package/esm/router/resolve-route-validation.mjs

@@ -0,0 +1,19 @@
+//#region ../../packages/core/src/router/resolve-route-validation.ts
+/**
+* The validation a route runs: the handler's own `validation`, with the
+* route's `validation` option merged over it (route keys win).
+*/
+function resolveRouteValidation(route) {
+	const own = route.handler?.validation;
+	const routeLevel = route.validation;
+	if (!routeLevel) return own;
+	if (!own) return routeLevel;
+	return {
+		...own,
+		...routeLevel
+	};
+}
+
+//#endregion
+export { resolveRouteValidation };
+//# sourceMappingURL=resolve-route-validation.mjs.map

package/esm/router/resolve-route-validation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-route-validation.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/resolve-route-validation.ts"],"sourcesContent":["import type { RequestHandlerValidation, Route } from \"./types\";\n\n/**\n * The validation a route runs: the handler's own `validation`, with the\n * route's `validation` option merged over it (route keys win).\n */\nexport function resolveRouteValidation(\n  route: Partial<Pick<Route, \"handler\" | \"validation\">>,\n): RequestHandlerValidation | undefined {\n  const own = route.handler?.validation;\n  const routeLevel = route.validation;\n\n  if (!routeLevel) return own;\n\n  if (!own) return routeLevel;\n\n  return { ...own, ...routeLevel };\n}\n"],"mappings":";;;;;AAMA,SAAgB,uBACd,OACsC;CACtC,MAAM,MAAM,MAAM,SAAS;CAC3B,MAAM,aAAa,MAAM;CAEzB,IAAI,CAAC,YAAY,OAAO;CAExB,IAAI,CAAC,KAAK,OAAO;CAEjB,OAAO;EAAE,GAAG;EAAK,GAAG;CAAW;AACjC"}

package/esm/router/route-guard-names.mjs

@@ -0,0 +1,30 @@
+//#region ../../packages/core/src/router/route-guard-names.ts
+/**
+* The names both route-guard checks share: the dev-server warning (which
+* reads registered routes) and `warlock check`'s `WL9006` (which reads the
+* source of `routes.ts` files). Keeping one definition means the two never
+* disagree about what counts as a mutating route or an auth guard.
+*
+* Side-effect free: imports nothing.
+*/
+/** HTTP methods that change state; a route answering one needs a guard or `public: true`. */
+const MUTATING_HTTP_METHODS = new Set([
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+/** Middleware named like this counts as a guard when it carries no marker. */
+const GUARD_NAME_PATTERN = /auth|guard/i;
+/** Whether an HTTP method (any case) mutates state: POST, PUT, PATCH or DELETE. */
+function isMutatingHttpMethod(method) {
+	return MUTATING_HTTP_METHODS.has(method.toUpperCase());
+}
+/** Whether a middleware name reads as an auth guard: it contains `auth` or `guard`. */
+function isAuthGuardName(name) {
+	return GUARD_NAME_PATTERN.test(name);
+}
+
+//#endregion
+export { isAuthGuardName, isMutatingHttpMethod };
+//# sourceMappingURL=route-guard-names.mjs.map

package/esm/router/route-guard-names.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-guard-names.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/route-guard-names.ts"],"sourcesContent":["/**\n * The names both route-guard checks share: the dev-server warning (which\n * reads registered routes) and `warlock check`'s `WL9006` (which reads the\n * source of `routes.ts` files). Keeping one definition means the two never\n * disagree about what counts as a mutating route or an auth guard.\n *\n * Side-effect free: imports nothing.\n */\n\n/** HTTP methods that change state; a route answering one needs a guard or `public: true`. */\nconst MUTATING_HTTP_METHODS: ReadonlySet<string> = new Set([\"POST\", \"PUT\", \"PATCH\", \"DELETE\"]);\n\n/** Middleware named like this counts as a guard when it carries no marker. */\nconst GUARD_NAME_PATTERN = /auth|guard/i;\n\n/** Whether an HTTP method (any case) mutates state: POST, PUT, PATCH or DELETE. */\nexport function isMutatingHttpMethod(method: string): boolean {\n  return MUTATING_HTTP_METHODS.has(method.toUpperCase());\n}\n\n/** Whether a middleware name reads as an auth guard: it contains `auth` or `guard`. */\nexport function isAuthGuardName(name: string): boolean {\n  return GUARD_NAME_PATTERN.test(name);\n}\n"],"mappings":";;;;;;;;;;AAUA,MAAM,wBAA6C,IAAI,IAAI;CAAC;CAAQ;CAAO;CAAS;AAAQ,CAAC;;AAG7F,MAAM,qBAAqB;;AAG3B,SAAgB,qBAAqB,QAAyB;CAC5D,OAAO,sBAAsB,IAAI,OAAO,YAAY,CAAC;AACvD;;AAGA,SAAgB,gBAAgB,MAAuB;CACrD,OAAO,mBAAmB,KAAK,IAAI;AACrC"}

package/esm/router/route-name-taken-error.d.mts

@@ -0,0 +1,14 @@
+import { WarlockError } from "../errors/warlock-error.mjs";
+
+//#region ../../packages/core/src/router/route-name-taken-error.d.ts
+/**
+ * Thrown when a route is registered under a name another route with the same
+ * method already claimed. Pages and API routes share one name namespace.
+ */
+declare class RouteNameTakenError extends WarlockError {
+  readonly routeName: string;
+  constructor(routeName: string, message: string);
+}
+//#endregion
+export { RouteNameTakenError };
+//# sourceMappingURL=route-name-taken-error.d.mts.map

package/esm/router/route-name-taken-error.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-name-taken-error.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/router/route-name-taken-error.ts"],"mappings":";;;;;AAMA;;cAAa,mBAAA,SAA4B,YAAY;EAAA,SAEjC,SAAA;cAAA,SAAA,UAChB,OAAA;AAAA"}

package/esm/router/route-name-taken-error.mjs

@@ -0,0 +1,18 @@
+import { WarlockError } from "../errors/warlock-error.mjs";
+
+//#region ../../packages/core/src/router/route-name-taken-error.ts
+/**
+* Thrown when a route is registered under a name another route with the same
+* method already claimed. Pages and API routes share one name namespace.
+*/
+var RouteNameTakenError = class extends WarlockError {
+	constructor(routeName, message) {
+		super("WL3001", message);
+		this.routeName = routeName;
+		this.name = "RouteNameTakenError";
+	}
+};
+
+//#endregion
+export { RouteNameTakenError };
+//# sourceMappingURL=route-name-taken-error.mjs.map

package/esm/router/route-name-taken-error.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-name-taken-error.mjs","names":[],"sources":["../../../../../../../../packages/core/src/router/route-name-taken-error.ts"],"sourcesContent":["import { WarlockError } from \"../errors/warlock-error\";\n\n/**\n * Thrown when a route is registered under a name another route with the same\n * method already claimed. Pages and API routes share one name namespace.\n */\nexport class RouteNameTakenError extends WarlockError {\n  public constructor(\n    public readonly routeName: string,\n    message: string,\n  ) {\n    super(\"WL3001\", message);\n    this.name = \"RouteNameTakenError\";\n  }\n}\n"],"mappings":";;;;;;;AAMA,IAAa,sBAAb,cAAyC,aAAa;CACpD,AAAO,YACL,AAAgB,WAChB,SACA;EACA,MAAM,UAAU,OAAO;EAHP;EAIhB,KAAK,OAAO;CACd;AACF"}

package/esm/router/router.d.mts

@@ -1,5 +1,5 @@
 import { FastifyInstance } from "../http/server.mjs";
-import { GroupedRoutesOptions, NamedApiRoute, NamedApiRoutesOptions, RequestHandler, RequestHandlerType, ResourceMethod, Route, RouteOptions, RouteResource, RouterGroupCallback, RouterStacks } from "./types.mjs";
+import { GroupedRoutesOptions, NamedApiRoute, NamedApiRoutesOptions, RequestHandler, RequestHandlerType, ResourceMethod, Route, RouteOptions, RouteResource, RouterGroupCallback, RouterStacks, StaticMountOptions } from "./types.mjs";
 import { RouteBuilder } from "./route-builder.mjs";
 import { FastifyHttpProxyOptions } from "@fastify/http-proxy";
 import { FastifyStaticOptions } from "@fastify/static";
@@ -24,6 +24,11 @@ declare class Router {
    * {@link routes}; mutations and collision checks use this isolated draft.
    */
   private routeReplacementTransaction?;
+  /**
+   * Set by the dev server: whether to warn about mutating routes that have no
+   * auth middleware and no `public: true` (`http.warnUnguardedRoutes`).
+   */
+  private warnUnguardedRoutes;
   /**
    * Router Instance
    */
@@ -31,7 +36,10 @@ declare class Router {
   /**
    * Static paths
    */
-  protected staticDirectories: FastifyStaticOptions[];
+  protected staticDirectories: {
+    options: FastifyStaticOptions;
+    rateLimit: StaticMountOptions["rateLimit"];
+  }[];
   /**
    * Event listeners
    */
@@ -59,32 +67,43 @@ declare class Router {
    */
   redirect(from: string, to: string, redirectMode?: "temporary" | "permanent"): this;
   /**
-   * Server static folder
+   * Serve a static folder.
+   *
+   * Static mounts are exempt from the global rate limiter by default; set
+   * `http.rateLimit.staticFiles: true` to count every mount, or pass
+   * `{ rateLimit }` to decide for this mount alone: `true` counts it against
+   * the global limiter, `false` exempts it, and an object gives it its own
+   * limit and bucket.
+   *
+   * @example
+   * router.directory({ root: rootPath("docs"), prefix: "/docs/" });
+   * router.directory({ root: rootPath("exports"), prefix: "/exports/" }, { rateLimit: true });
    */
-  directory(options: FastifyStaticOptions): this;
+  directory(options: FastifyStaticOptions, mountOptions?: StaticMountOptions): this;
+  /** Declare static routes at boot; load the upstream sender on the first file request. */
+  protected registerStaticDirectories(server: FastifyInstance): void;
   /**
-   * Register every `directory()` with `@fastify/static`. The plugin is
-   * imported only when at least one directory was declared: loading it is not
-   * free (its directory-listing module calls `os.cpus()` at load), and an app
-   * that serves no static folder should not pay for it (WR-027).
+   * Register a GET route that serves a static file. Like `directory()`, it is
+   * exempt from the global rate limiter unless `http.rateLimit.staticFiles`
+   * or its own `rateLimit` says otherwise.
    */
-  protected registerStaticDirectories(server: FastifyInstance): void;
+  protected addStaticFileRoute(path: string, handler: RequestHandler, mountOptions?: StaticMountOptions): this;
   /**
    * Serve file
    */
-  file(path: string, location: string, cacheTime?: number): this;
+  file(path: string, location: string, cacheTime?: number, mountOptions?: StaticMountOptions): this;
   /**
    * Serve cached file, it will cache the file to 1 year by default
    */
-  cachedFile(path: string, location: string, cacheTime?: number): this;
+  cachedFile(path: string, location: string, cacheTime?: number, mountOptions?: StaticMountOptions): this;
   /**
    * Serve list of files
    */
-  files(files: Record<string, string>, cacheTime?: number): void;
+  files(files: Record<string, string>, cacheTime?: number, mountOptions?: StaticMountOptions): void;
   /**
    * Serve list of cached files, it will cache the file to 1 year by default
    */
-  cachedFiles(files: Record<string, string>, cacheTime?: number): void;
+  cachedFiles(files: Record<string, string>, cacheTime?: number, mountOptions?: StaticMountOptions): void;
   /**
    * Add proxy route
    */