@warlock.js/core 5.30.0 → 5.32.0

package/esm/openapi/schema-registry.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema-registry.mjs","names":[],"sources":["../../../../../../../../packages/core/src/openapi/schema-registry.ts"],"sourcesContent":["import { isLazy } from \"@mongez/reinforcements\";\nimport { isNullableResource } from \"../resource/nullable-resource\";\nimport { castToJsonSchema } from \"./cast-schema\";\nimport type { OpenApiSchema, WarningSink } from \"./types\";\n\ntype ResourceFieldContext = {\n  /** `$ref` schema of the resource whose field is being mapped, the target of `\"self\"`. */\n  ownerRef: OpenApiSchema;\n  /** Display name used in warnings, for example `UserResource.avatar`. */\n  path: string;\n};\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction sanitizeName(name: string): string {\n  return name.replace(/[^A-Za-z0-9._-]/g, \"\");\n}\n\n/**\n * Owns `components.schemas`: names resource classes (by identity), builds their schemas once\n * and hands out `$ref`s, so nested, lazy and `\"self\"` references recurse without unrolling.\n */\nexport class SchemaRegistry {\n  public readonly schemas: Record<string, OpenApiSchema> = {};\n\n  private readonly resourceNames = new Map<unknown, string>();\n  private readonly sharedNames = new Map<string, string>();\n  private fallbackCounter = 0;\n\n  public constructor(\n    private readonly resolveName: ((resource: unknown) => string | undefined) | undefined,\n    private readonly warn: WarningSink,\n  ) {}\n\n  /**\n   * Register a fixed schema (an error shape shared by many operations) under a stable key.\n   * Returns its `$ref`; the component name gets a numeric suffix only if a resource took it.\n   */\n  public shared(key: string, schema: OpenApiSchema): OpenApiSchema {\n    let name = this.sharedNames.get(key);\n\n    if (!name) {\n      name = this.claim(key);\n      this.sharedNames.set(key, name);\n      this.schemas[name] = schema;\n    }\n\n    return { $ref: `#/components/schemas/${name}` };\n  }\n\n  /**\n   * `$ref` to a resource class, building its component on first use.\n   */\n  public resourceRef(resource: unknown): OpenApiSchema {\n    const existing = this.resourceNames.get(resource);\n\n    if (existing) {\n      return { $ref: `#/components/schemas/${existing}` };\n    }\n\n    const name = this.claim(this.nameFor(resource));\n    const ref = { $ref: `#/components/schemas/${name}` };\n\n    // Named before its fields are mapped, so a cycle resolves to this same ref.\n    this.resourceNames.set(resource, name);\n    this.schemas[name] = {};\n    this.schemas[name] = this.buildResourceSchema(resource, name, ref);\n\n    return ref;\n  }\n\n  /**\n   * Schema of a cast string, or `{}` and a warning for an unknown cast.\n   */\n  public cast(cast: string, path: string, warn: WarningSink = this.warn): OpenApiSchema {\n    const schema = castToJsonSchema(cast);\n\n    if (!schema) {\n      warn(`${path}: unknown cast \"${cast}\" is documented as {}.`);\n\n      return {};\n    }\n\n    return schema;\n  }\n\n  /**\n   * True when the function looks like a resource class: it carries a static `schema` object.\n   */\n  public isResourceClass(value: unknown): boolean {\n    return typeof value === \"function\" && isRecord(Reflect.get(value, \"schema\"));\n  }\n\n  private nameFor(resource: unknown): string {\n    const resolved = sanitizeName(this.resolveName?.(resource) ?? \"\");\n\n    if (resolved && resolved !== \"default\") {\n      return resolved;\n    }\n\n    const className = typeof resource === \"function\" ? sanitizeName(resource.name) : \"\";\n\n    if (className && className !== \"default\") {\n      return className;\n    }\n\n    return `Resource${++this.fallbackCounter}`;\n  }\n\n  private claim(base: string): string {\n    if (!(base in this.schemas)) {\n      return base;\n    }\n\n    let suffix = 2;\n\n    while (`${base}${suffix}` in this.schemas) {\n      suffix++;\n    }\n\n    return `${base}${suffix}`;\n  }\n\n  private buildResourceSchema(resource: unknown, name: string, ref: OpenApiSchema): OpenApiSchema {\n    const schema = Reflect.get(resource as object, \"schema\");\n\n    if (!isRecord(schema) || Object.keys(schema).length === 0) {\n      this.warn(`Resource \"${name}\" declares no static schema and is documented as {}.`);\n\n      return {};\n    }\n\n    const properties: Record<string, OpenApiSchema> = {};\n\n    for (const [key, config] of Object.entries(schema)) {\n      properties[key] = this.fieldSchema(config, { ownerRef: ref, path: `${name}.${key}` });\n    }\n\n    return { type: \"object\", properties, required: Object.keys(properties) };\n  }\n\n  private fieldSchema(config: unknown, context: ResourceFieldContext): OpenApiSchema {\n    if (config === \"self\") {\n      return context.ownerRef;\n    }\n\n    if (config === \"self[]\") {\n      return { type: \"array\", items: context.ownerRef };\n    }\n\n    if (typeof config === \"string\") {\n      return this.cast(config, context.path);\n    }\n\n    if (isNullableResource(config)) {\n      return { oneOf: [this.fieldSchema(config.resource, context), { type: \"null\" }] };\n    }\n\n    if (isLazy(config)) {\n      return this.lazyFieldSchema(config, context);\n    }\n\n    if (Array.isArray(config) && config.length === 1) {\n      return { type: \"array\", items: this.fieldSchema(config[0], context) };\n    }\n\n    if (Array.isArray(config) && config.length === 2 && typeof config[1] === \"string\") {\n      return this.cast(config[1], context.path);\n    }\n\n    if (typeof config === \"function\") {\n      if (this.isResourceClass(config)) {\n        return this.resourceRef(config);\n      }\n\n      this.warn(`${context.path}: a resolver function has no static shape and is documented as {}.`);\n\n      return {};\n    }\n\n    if (isRecord(config) && config.__type === \"arrayOf\" && isRecord(config.schema)) {\n      const properties: Record<string, OpenApiSchema> = {};\n\n      for (const [key, item] of Object.entries(config.schema)) {\n        properties[key] = this.fieldSchema(item, { ...context, path: `${context.path}.${key}` });\n      }\n\n      return {\n        type: \"array\",\n        items: { type: \"object\", properties, required: Object.keys(properties) },\n      };\n    }\n\n    this.warn(\n      `${context.path}: a field builder has no static shape and is documented as {}. Declare it with a cast string to document it.`,\n    );\n\n    return {};\n  }\n\n  private lazyFieldSchema(lazy: { resolve(): unknown }, context: ResourceFieldContext): OpenApiSchema {\n    let resolved: unknown;\n\n    try {\n      resolved = lazy.resolve();\n    } catch (error) {\n      this.warn(\n        `${context.path}: a lazy resource reference could not be resolved (${\n          error instanceof Error ? error.message : String(error)\n        }) and is documented as {}.`,\n      );\n\n      return {};\n    }\n\n    return this.fieldSchema(resolved, context);\n  }\n}\n"],"mappings":";;;;;AAYA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,aAAa,MAAsB;CAC1C,OAAO,KAAK,QAAQ,oBAAoB,EAAE;AAC5C;;;;;AAMA,IAAa,iBAAb,MAA4B;CAO1B,AAAO,YACL,AAAiB,aACjB,AAAiB,MACjB;EAFiB;EACA;iBARsC,CAAC;uCAEzB,IAAI,IAAqB;qCAC3B,IAAI,IAAoB;yBAC7B;CAKvB;;;;;CAMH,AAAO,OAAO,KAAa,QAAsC;EAC/D,IAAI,OAAO,KAAK,YAAY,IAAI,GAAG;EAEnC,IAAI,CAAC,MAAM;GACT,OAAO,KAAK,MAAM,GAAG;GACrB,KAAK,YAAY,IAAI,KAAK,IAAI;GAC9B,KAAK,QAAQ,QAAQ;EACvB;EAEA,OAAO,EAAE,MAAM,wBAAwB,OAAO;CAChD;;;;CAKA,AAAO,YAAY,UAAkC;EACnD,MAAM,WAAW,KAAK,cAAc,IAAI,QAAQ;EAEhD,IAAI,UACF,OAAO,EAAE,MAAM,wBAAwB,WAAW;EAGpD,MAAM,OAAO,KAAK,MAAM,KAAK,QAAQ,QAAQ,CAAC;EAC9C,MAAM,MAAM,EAAE,MAAM,wBAAwB,OAAO;EAGnD,KAAK,cAAc,IAAI,UAAU,IAAI;EACrC,KAAK,QAAQ,QAAQ,CAAC;EACtB,KAAK,QAAQ,QAAQ,KAAK,oBAAoB,UAAU,MAAM,GAAG;EAEjE,OAAO;CACT;;;;CAKA,AAAO,KAAK,MAAc,MAAc,OAAoB,KAAK,MAAqB;EACpF,MAAM,SAAS,iBAAiB,IAAI;EAEpC,IAAI,CAAC,QAAQ;GACX,KAAK,GAAG,KAAK,kBAAkB,KAAK,uBAAuB;GAE3D,OAAO,CAAC;EACV;EAEA,OAAO;CACT;;;;CAKA,AAAO,gBAAgB,OAAyB;EAC9C,OAAO,OAAO,UAAU,cAAc,SAAS,QAAQ,IAAI,OAAO,QAAQ,CAAC;CAC7E;CAEA,AAAQ,QAAQ,UAA2B;EACzC,MAAM,WAAW,aAAa,KAAK,cAAc,QAAQ,KAAK,EAAE;EAEhE,IAAI,YAAY,aAAa,WAC3B,OAAO;EAGT,MAAM,YAAY,OAAO,aAAa,aAAa,aAAa,SAAS,IAAI,IAAI;EAEjF,IAAI,aAAa,cAAc,WAC7B,OAAO;EAGT,OAAO,WAAW,EAAE,KAAK;CAC3B;CAEA,AAAQ,MAAM,MAAsB;EAClC,IAAI,EAAE,QAAQ,KAAK,UACjB,OAAO;EAGT,IAAI,SAAS;EAEb,OAAO,GAAG,OAAO,YAAY,KAAK,SAChC;EAGF,OAAO,GAAG,OAAO;CACnB;CAEA,AAAQ,oBAAoB,UAAmB,MAAc,KAAmC;EAC9F,MAAM,SAAS,QAAQ,IAAI,UAAoB,QAAQ;EAEvD,IAAI,CAAC,SAAS,MAAM,KAAK,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;GACzD,KAAK,KAAK,aAAa,KAAK,qDAAqD;GAEjF,OAAO,CAAC;EACV;EAEA,MAAM,aAA4C,CAAC;EAEnD,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,MAAM,GAC/C,WAAW,OAAO,KAAK,YAAY,QAAQ;GAAE,UAAU;GAAK,MAAM,GAAG,KAAK,GAAG;EAAM,CAAC;EAGtF,OAAO;GAAE,MAAM;GAAU;GAAY,UAAU,OAAO,KAAK,UAAU;EAAE;CACzE;CAEA,AAAQ,YAAY,QAAiB,SAA8C;EACjF,IAAI,WAAW,QACb,OAAO,QAAQ;EAGjB,IAAI,WAAW,UACb,OAAO;GAAE,MAAM;GAAS,OAAO,QAAQ;EAAS;EAGlD,IAAI,OAAO,WAAW,UACpB,OAAO,KAAK,KAAK,QAAQ,QAAQ,IAAI;EAGvC,IAAI,mBAAmB,MAAM,GAC3B,OAAO,EAAE,OAAO,CAAC,KAAK,YAAY,OAAO,UAAU,OAAO,GAAG,EAAE,MAAM,OAAO,CAAC,EAAE;EAGjF,IAAI,OAAO,MAAM,GACf,OAAO,KAAK,gBAAgB,QAAQ,OAAO;EAG7C,IAAI,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAC7C,OAAO;GAAE,MAAM;GAAS,OAAO,KAAK,YAAY,OAAO,IAAI,OAAO;EAAE;EAGtE,IAAI,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,KAAK,OAAO,OAAO,OAAO,UACvE,OAAO,KAAK,KAAK,OAAO,IAAI,QAAQ,IAAI;EAG1C,IAAI,OAAO,WAAW,YAAY;GAChC,IAAI,KAAK,gBAAgB,MAAM,GAC7B,OAAO,KAAK,YAAY,MAAM;GAGhC,KAAK,KAAK,GAAG,QAAQ,KAAK,mEAAmE;GAE7F,OAAO,CAAC;EACV;EAEA,IAAI,SAAS,MAAM,KAAK,OAAO,WAAW,aAAa,SAAS,OAAO,MAAM,GAAG;GAC9E,MAAM,aAA4C,CAAC;GAEnD,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,OAAO,MAAM,GACpD,WAAW,OAAO,KAAK,YAAY,MAAM;IAAE,GAAG;IAAS,MAAM,GAAG,QAAQ,KAAK,GAAG;GAAM,CAAC;GAGzF,OAAO;IACL,MAAM;IACN,OAAO;KAAE,MAAM;KAAU;KAAY,UAAU,OAAO,KAAK,UAAU;IAAE;GACzE;EACF;EAEA,KAAK,KACH,GAAG,QAAQ,KAAK,6GAClB;EAEA,OAAO,CAAC;CACV;CAEA,AAAQ,gBAAgB,MAA8B,SAA8C;EAClG,IAAI;EAEJ,IAAI;GACF,WAAW,KAAK,QAAQ;EAC1B,SAAS,OAAO;GACd,KAAK,KACH,GAAG,QAAQ,KAAK,qDACd,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EACtD,2BACH;GAEA,OAAO,CAAC;EACV;EAEA,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C;AACF"}
+{"version":3,"file":"schema-registry.mjs","names":[],"sources":["../../../../../../../../packages/core/src/openapi/schema-registry.ts"],"sourcesContent":["import { isLazy } from \"@mongez/reinforcements\";\nimport { isNullableResource } from \"../resource/nullable-resource\";\nimport { castToJsonSchema } from \"./cast-schema\";\nimport type { OpenApiSchema, WarningSink } from \"./types\";\n\ntype ResourceFieldContext = {\n  /** `$ref` schema of the resource whose field is being mapped, the target of `\"self\"`. */\n  ownerRef: OpenApiSchema;\n  /** Display name used in warnings, for example `UserResource.avatar`. */\n  path: string;\n};\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction sanitizeName(name: string): string {\n  return name.replace(/[^A-Za-z0-9._-]/g, \"\");\n}\n\n/**\n * Owns `components.schemas`: names resource classes (by identity), builds their schemas once\n * and hands out `$ref`s, so nested, lazy and `\"self\"` references recurse without unrolling.\n */\nexport class SchemaRegistry {\n  public readonly schemas: Record<string, OpenApiSchema> = {};\n\n  private readonly resourceNames = new Map<unknown, string>();\n  private readonly sharedNames = new Map<string, string>();\n  private fallbackCounter = 0;\n\n  public constructor(\n    private readonly resolveName: ((resource: unknown) => string | undefined) | undefined,\n    private readonly warn: WarningSink,\n  ) {}\n\n  /**\n   * Register a fixed schema (an error shape shared by many operations) under a stable key.\n   * Returns its `$ref`; the component name gets a numeric suffix only if a resource took it.\n   */\n  public shared(key: string, schema: OpenApiSchema): OpenApiSchema {\n    let name = this.sharedNames.get(key);\n\n    if (!name) {\n      name = this.claim(key);\n      this.sharedNames.set(key, name);\n      this.schemas[name] = schema;\n    }\n\n    return { $ref: `#/components/schemas/${name}` };\n  }\n\n  /**\n   * `$ref` to a resource class, building its component on first use.\n   */\n  public resourceRef(resource: unknown): OpenApiSchema {\n    const existing = this.resourceNames.get(resource);\n\n    if (existing) {\n      return { $ref: `#/components/schemas/${existing}` };\n    }\n\n    const name = this.claim(this.nameFor(resource));\n    const ref = { $ref: `#/components/schemas/${name}` };\n\n    // Named before its fields are mapped, so a cycle resolves to this same ref.\n    this.resourceNames.set(resource, name);\n    this.schemas[name] = {};\n    this.schemas[name] = this.buildResourceSchema(resource, name, ref);\n\n    return ref;\n  }\n\n  /**\n   * Schema of a cast string, or `{}` and a warning for an unknown cast.\n   */\n  public cast(cast: string, path: string, warn: WarningSink = this.warn): OpenApiSchema {\n    const schema = castToJsonSchema(cast);\n\n    if (!schema) {\n      warn(`${path}: unknown cast \"${cast}\" is documented as {}.`);\n\n      return {};\n    }\n\n    return schema;\n  }\n\n  /**\n   * True when the function looks like a resource class: it carries a static `schema` object.\n   */\n  public isResourceClass(value: unknown): boolean {\n    return typeof value === \"function\" && isRecord(Reflect.get(value, \"schema\"));\n  }\n\n  private nameFor(resource: unknown): string {\n    const resolved = sanitizeName(this.resolveName?.(resource) ?? \"\");\n\n    if (resolved && resolved !== \"default\") {\n      return resolved;\n    }\n\n    const className = typeof resource === \"function\" ? sanitizeName(resource.name) : \"\";\n\n    if (className && className !== \"default\") {\n      return className;\n    }\n\n    return `Resource${++this.fallbackCounter}`;\n  }\n\n  private claim(base: string): string {\n    if (!(base in this.schemas)) {\n      return base;\n    }\n\n    let suffix = 2;\n\n    while (`${base}${suffix}` in this.schemas) {\n      suffix++;\n    }\n\n    return `${base}${suffix}`;\n  }\n\n  private buildResourceSchema(resource: unknown, name: string, ref: OpenApiSchema): OpenApiSchema {\n    const schema = Reflect.get(resource as object, \"schema\");\n\n    if (!isRecord(schema) || Object.keys(schema).length === 0) {\n      this.warn(`Resource \"${name}\" declares no static schema and is documented as {}.`);\n\n      return {};\n    }\n\n    const properties: Record<string, OpenApiSchema> = {};\n\n    for (const [key, config] of Object.entries(schema)) {\n      properties[key] = this.fieldSchema(config, { ownerRef: ref, path: `${name}.${key}` });\n    }\n\n    return { type: \"object\", properties, required: Object.keys(properties) };\n  }\n\n  private fieldSchema(config: unknown, context: ResourceFieldContext): OpenApiSchema {\n    if (config === \"self\") {\n      return context.ownerRef;\n    }\n\n    if (config === \"self[]\") {\n      return { type: \"array\", items: context.ownerRef };\n    }\n\n    if (typeof config === \"string\") {\n      return this.cast(config, context.path);\n    }\n\n    if (isNullableResource(config)) {\n      return { oneOf: [this.fieldSchema(config.resource, context), { type: \"null\" }] };\n    }\n\n    if (isLazy(config)) {\n      return this.lazyFieldSchema(config, context);\n    }\n\n    if (Array.isArray(config) && config.length === 1) {\n      return { type: \"array\", items: this.fieldSchema(config[0], context) };\n    }\n\n    if (Array.isArray(config) && config.length === 2 && typeof config[1] === \"string\") {\n      return this.cast(config[1], context.path);\n    }\n\n    if (typeof config === \"function\") {\n      if (this.isResourceClass(config)) {\n        return this.resourceRef(config);\n      }\n\n      this.warn(\n        `${context.path}: a resolver function has no static shape and is documented as {}.`,\n      );\n\n      return {};\n    }\n\n    if (isRecord(config) && config.__type === \"arrayOf\" && isRecord(config.schema)) {\n      const properties: Record<string, OpenApiSchema> = {};\n\n      for (const [key, item] of Object.entries(config.schema)) {\n        properties[key] = this.fieldSchema(item, { ...context, path: `${context.path}.${key}` });\n      }\n\n      return {\n        type: \"array\",\n        items: { type: \"object\", properties, required: Object.keys(properties) },\n      };\n    }\n\n    this.warn(\n      `${context.path}: a field builder has no static shape and is documented as {}. Declare it with a cast string to document it.`,\n    );\n\n    return {};\n  }\n\n  private lazyFieldSchema(\n    lazy: { resolve(): unknown },\n    context: ResourceFieldContext,\n  ): OpenApiSchema {\n    let resolved: unknown;\n\n    try {\n      resolved = lazy.resolve();\n    } catch (error) {\n      this.warn(\n        `${context.path}: a lazy resource reference could not be resolved (${\n          error instanceof Error ? error.message : String(error)\n        }) and is documented as {}.`,\n      );\n\n      return {};\n    }\n\n    return this.fieldSchema(resolved, context);\n  }\n}\n"],"mappings":";;;;;AAYA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;AAEA,SAAS,aAAa,MAAsB;CAC1C,OAAO,KAAK,QAAQ,oBAAoB,EAAE;AAC5C;;;;;AAMA,IAAa,iBAAb,MAA4B;CAO1B,AAAO,YACL,AAAiB,aACjB,AAAiB,MACjB;EAFiB;EACA;iBARsC,CAAC;uCAEzB,IAAI,IAAqB;qCAC3B,IAAI,IAAoB;yBAC7B;CAKvB;;;;;CAMH,AAAO,OAAO,KAAa,QAAsC;EAC/D,IAAI,OAAO,KAAK,YAAY,IAAI,GAAG;EAEnC,IAAI,CAAC,MAAM;GACT,OAAO,KAAK,MAAM,GAAG;GACrB,KAAK,YAAY,IAAI,KAAK,IAAI;GAC9B,KAAK,QAAQ,QAAQ;EACvB;EAEA,OAAO,EAAE,MAAM,wBAAwB,OAAO;CAChD;;;;CAKA,AAAO,YAAY,UAAkC;EACnD,MAAM,WAAW,KAAK,cAAc,IAAI,QAAQ;EAEhD,IAAI,UACF,OAAO,EAAE,MAAM,wBAAwB,WAAW;EAGpD,MAAM,OAAO,KAAK,MAAM,KAAK,QAAQ,QAAQ,CAAC;EAC9C,MAAM,MAAM,EAAE,MAAM,wBAAwB,OAAO;EAGnD,KAAK,cAAc,IAAI,UAAU,IAAI;EACrC,KAAK,QAAQ,QAAQ,CAAC;EACtB,KAAK,QAAQ,QAAQ,KAAK,oBAAoB,UAAU,MAAM,GAAG;EAEjE,OAAO;CACT;;;;CAKA,AAAO,KAAK,MAAc,MAAc,OAAoB,KAAK,MAAqB;EACpF,MAAM,SAAS,iBAAiB,IAAI;EAEpC,IAAI,CAAC,QAAQ;GACX,KAAK,GAAG,KAAK,kBAAkB,KAAK,uBAAuB;GAE3D,OAAO,CAAC;EACV;EAEA,OAAO;CACT;;;;CAKA,AAAO,gBAAgB,OAAyB;EAC9C,OAAO,OAAO,UAAU,cAAc,SAAS,QAAQ,IAAI,OAAO,QAAQ,CAAC;CAC7E;CAEA,AAAQ,QAAQ,UAA2B;EACzC,MAAM,WAAW,aAAa,KAAK,cAAc,QAAQ,KAAK,EAAE;EAEhE,IAAI,YAAY,aAAa,WAC3B,OAAO;EAGT,MAAM,YAAY,OAAO,aAAa,aAAa,aAAa,SAAS,IAAI,IAAI;EAEjF,IAAI,aAAa,cAAc,WAC7B,OAAO;EAGT,OAAO,WAAW,EAAE,KAAK;CAC3B;CAEA,AAAQ,MAAM,MAAsB;EAClC,IAAI,EAAE,QAAQ,KAAK,UACjB,OAAO;EAGT,IAAI,SAAS;EAEb,OAAO,GAAG,OAAO,YAAY,KAAK,SAChC;EAGF,OAAO,GAAG,OAAO;CACnB;CAEA,AAAQ,oBAAoB,UAAmB,MAAc,KAAmC;EAC9F,MAAM,SAAS,QAAQ,IAAI,UAAoB,QAAQ;EAEvD,IAAI,CAAC,SAAS,MAAM,KAAK,OAAO,KAAK,MAAM,CAAC,CAAC,WAAW,GAAG;GACzD,KAAK,KAAK,aAAa,KAAK,qDAAqD;GAEjF,OAAO,CAAC;EACV;EAEA,MAAM,aAA4C,CAAC;EAEnD,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,MAAM,GAC/C,WAAW,OAAO,KAAK,YAAY,QAAQ;GAAE,UAAU;GAAK,MAAM,GAAG,KAAK,GAAG;EAAM,CAAC;EAGtF,OAAO;GAAE,MAAM;GAAU;GAAY,UAAU,OAAO,KAAK,UAAU;EAAE;CACzE;CAEA,AAAQ,YAAY,QAAiB,SAA8C;EACjF,IAAI,WAAW,QACb,OAAO,QAAQ;EAGjB,IAAI,WAAW,UACb,OAAO;GAAE,MAAM;GAAS,OAAO,QAAQ;EAAS;EAGlD,IAAI,OAAO,WAAW,UACpB,OAAO,KAAK,KAAK,QAAQ,QAAQ,IAAI;EAGvC,IAAI,mBAAmB,MAAM,GAC3B,OAAO,EAAE,OAAO,CAAC,KAAK,YAAY,OAAO,UAAU,OAAO,GAAG,EAAE,MAAM,OAAO,CAAC,EAAE;EAGjF,IAAI,OAAO,MAAM,GACf,OAAO,KAAK,gBAAgB,QAAQ,OAAO;EAG7C,IAAI,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,GAC7C,OAAO;GAAE,MAAM;GAAS,OAAO,KAAK,YAAY,OAAO,IAAI,OAAO;EAAE;EAGtE,IAAI,MAAM,QAAQ,MAAM,KAAK,OAAO,WAAW,KAAK,OAAO,OAAO,OAAO,UACvE,OAAO,KAAK,KAAK,OAAO,IAAI,QAAQ,IAAI;EAG1C,IAAI,OAAO,WAAW,YAAY;GAChC,IAAI,KAAK,gBAAgB,MAAM,GAC7B,OAAO,KAAK,YAAY,MAAM;GAGhC,KAAK,KACH,GAAG,QAAQ,KAAK,mEAClB;GAEA,OAAO,CAAC;EACV;EAEA,IAAI,SAAS,MAAM,KAAK,OAAO,WAAW,aAAa,SAAS,OAAO,MAAM,GAAG;GAC9E,MAAM,aAA4C,CAAC;GAEnD,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,OAAO,MAAM,GACpD,WAAW,OAAO,KAAK,YAAY,MAAM;IAAE,GAAG;IAAS,MAAM,GAAG,QAAQ,KAAK,GAAG;GAAM,CAAC;GAGzF,OAAO;IACL,MAAM;IACN,OAAO;KAAE,MAAM;KAAU;KAAY,UAAU,OAAO,KAAK,UAAU;IAAE;GACzE;EACF;EAEA,KAAK,KACH,GAAG,QAAQ,KAAK,6GAClB;EAEA,OAAO,CAAC;CACV;CAEA,AAAQ,gBACN,MACA,SACe;EACf,IAAI;EAEJ,IAAI;GACF,WAAW,KAAK,QAAQ;EAC1B,SAAS,OAAO;GACd,KAAK,KACH,GAAG,QAAQ,KAAK,qDACd,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EACtD,2BACH;GAEA,OAAO,CAAC;EACV;EAEA,OAAO,KAAK,YAAY,UAAU,OAAO;CAC3C;AACF"}

package/esm/openapi/security.mjs

@@ -94,5 +94,5 @@ var SecuritySchemes = class {
 };
 
 //#endregion
-export { SecuritySchemes, readRouteAuth };
+export { AUTH_DESCRIPTOR_SYMBOL, SecuritySchemes, parseAuthDescriptor, readRouteAuth };
 //# sourceMappingURL=security.mjs.map

package/esm/openapi/security.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"security.mjs","names":[],"sources":["../../../../../../../../packages/core/src/openapi/security.ts"],"sourcesContent":["import type { AuthDescriptor, OpenApiSecurityRequirement, OpenApiSecurityScheme, WarningSink } from \"./types\";\n\n/**\n * The marker `authMiddleware()` attaches to the middleware it returns.\n * Core reads it structurally; it never imports the auth package.\n */\nexport const AUTH_DESCRIPTOR_SYMBOL = Symbol.for(\"warlock.auth\");\n\nfunction isAuthSource(value: unknown): value is AuthDescriptor[\"sources\"][number] {\n  if (value === \"header\") {\n    return true;\n  }\n\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    typeof (value as { cookie?: unknown }).cookie === \"string\" &&\n    (value as { cookie: string }).cookie.length > 0\n  );\n}\n\n/**\n * Validate an auth descriptor. Returns `undefined` for anything that is not\n * `{ sources: (\"header\" | { cookie: string })[], userTypes?: string[] }` with at least one source.\n */\nexport function parseAuthDescriptor(value: unknown): AuthDescriptor | undefined {\n  if (typeof value !== \"object\" || value === null) {\n    return undefined;\n  }\n\n  const { sources, userTypes } = value as { sources?: unknown; userTypes?: unknown };\n\n  if (!Array.isArray(sources) || sources.length === 0 || !sources.every(isAuthSource)) {\n    return undefined;\n  }\n\n  if (userTypes !== undefined && !(Array.isArray(userTypes) && userTypes.every((type) => typeof type === \"string\"))) {\n    return undefined;\n  }\n\n  return { sources: [...sources], userTypes: Array.isArray(userTypes) ? [...userTypes] : [] };\n}\n\n/**\n * Combine the descriptors of every guard on a route (group middleware is already merged into\n * the route): unique sources, union of user types.\n *\n * Middleware without a descriptor is ordinary middleware and is ignored silently. A function\n * that carries a descriptor of the wrong shape is reported through `warn`.\n *\n * @returns `undefined` when the route has no valid auth descriptor.\n */\nexport function readRouteAuth(middleware: unknown, warn: WarningSink): AuthDescriptor | undefined {\n  if (!Array.isArray(middleware)) {\n    return undefined;\n  }\n\n  const sources: AuthDescriptor[\"sources\"] = [];\n  const userTypes: string[] = [];\n  let found = false;\n\n  for (const fn of middleware) {\n    if (typeof fn !== \"function\") {\n      continue;\n    }\n\n    const raw = Reflect.get(fn, AUTH_DESCRIPTOR_SYMBOL);\n\n    if (raw === undefined) {\n      continue;\n    }\n\n    const descriptor = parseAuthDescriptor(raw);\n\n    if (!descriptor) {\n      warn(\"a middleware carries a malformed warlock.auth descriptor; the route is documented without security.\");\n\n      continue;\n    }\n\n    found = true;\n\n    for (const source of descriptor.sources) {\n      const duplicate = sources.some((existing) =>\n        typeof existing === \"string\" || typeof source === \"string\"\n          ? existing === source\n          : existing.cookie === source.cookie,\n      );\n\n      if (!duplicate) {\n        sources.push(source);\n      }\n    }\n\n    for (const type of descriptor.userTypes) {\n      if (!userTypes.includes(type)) {\n        userTypes.push(type);\n      }\n    }\n  }\n\n  return found ? { sources, userTypes } : undefined;\n}\n\n/**\n * Collects the security schemes the routes actually use and turns descriptors into\n * per-operation requirements. A dual header + cookie guard is an OR: one requirement each.\n */\nexport class SecuritySchemes {\n  public readonly schemes: Record<string, OpenApiSecurityScheme> = {};\n\n  private readonly cookieSchemeNames = new Map<string, string>();\n\n  public requirementsFor(descriptor: AuthDescriptor): OpenApiSecurityRequirement[] {\n    return descriptor.sources.map((source) => {\n      if (source === \"header\") {\n        this.schemes.bearerAuth = { type: \"http\", scheme: \"bearer\", bearerFormat: \"JWT\" };\n\n        return { bearerAuth: [] };\n      }\n\n      const name = this.cookieScheme(source.cookie);\n\n      return { [name]: [] };\n    });\n  }\n\n  private cookieScheme(cookie: string): string {\n    const existing = this.cookieSchemeNames.get(cookie);\n\n    if (existing) {\n      return existing;\n    }\n\n    // The first cookie keeps the conventional name; a second, different cookie gets its own.\n    const name =\n      this.cookieSchemeNames.size === 0 ? \"cookieAuth\" : `cookieAuth_${cookie.replace(/[^A-Za-z0-9._-]/g, \"\")}`;\n\n    this.cookieSchemeNames.set(cookie, name);\n    this.schemes[name] = { type: \"apiKey\", in: \"cookie\", name: cookie };\n\n    return name;\n  }\n\n  public hasSchemes(): boolean {\n    return Object.keys(this.schemes).length > 0;\n  }\n}\n"],"mappings":";;;;;AAMA,MAAa,yBAAyB,OAAO,IAAI,cAAc;AAE/D,SAAS,aAAa,OAA4D;CAChF,IAAI,UAAU,UACZ,OAAO;CAGT,OACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA+B,WAAW,YACjD,MAA6B,OAAO,SAAS;AAElD;;;;;AAMA,SAAgB,oBAAoB,OAA4C;CAC9E,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC;CAGF,MAAM,EAAE,SAAS,cAAc;CAE/B,IAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,KAAK,CAAC,QAAQ,MAAM,YAAY,GAChF;CAGF,IAAI,cAAc,UAAa,EAAE,MAAM,QAAQ,SAAS,KAAK,UAAU,OAAO,SAAS,OAAO,SAAS,QAAQ,IAC7G;CAGF,OAAO;EAAE,SAAS,CAAC,GAAG,OAAO;EAAG,WAAW,MAAM,QAAQ,SAAS,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC;CAAE;AAC5F;;;;;;;;;;AAWA,SAAgB,cAAc,YAAqB,MAA+C;CAChG,IAAI,CAAC,MAAM,QAAQ,UAAU,GAC3B;CAGF,MAAM,UAAqC,CAAC;CAC5C,MAAM,YAAsB,CAAC;CAC7B,IAAI,QAAQ;CAEZ,KAAK,MAAM,MAAM,YAAY;EAC3B,IAAI,OAAO,OAAO,YAChB;EAGF,MAAM,MAAM,QAAQ,IAAI,IAAI,sBAAsB;EAElD,IAAI,QAAQ,QACV;EAGF,MAAM,aAAa,oBAAoB,GAAG;EAE1C,IAAI,CAAC,YAAY;GACf,KAAK,qGAAqG;GAE1G;EACF;EAEA,QAAQ;EAER,KAAK,MAAM,UAAU,WAAW,SAO9B,IAAI,CANc,QAAQ,MAAM,aAC9B,OAAO,aAAa,YAAY,OAAO,WAAW,WAC9C,aAAa,SACb,SAAS,WAAW,OAAO,MAGpB,GACX,QAAQ,KAAK,MAAM;EAIvB,KAAK,MAAM,QAAQ,WAAW,WAC5B,IAAI,CAAC,UAAU,SAAS,IAAI,GAC1B,UAAU,KAAK,IAAI;CAGzB;CAEA,OAAO,QAAQ;EAAE;EAAS;CAAU,IAAI;AAC1C;;;;;AAMA,IAAa,kBAAb,MAA6B;;iBACsC,CAAC;2CAE7B,IAAI,IAAoB;;CAE7D,AAAO,gBAAgB,YAA0D;EAC/E,OAAO,WAAW,QAAQ,KAAK,WAAW;GACxC,IAAI,WAAW,UAAU;IACvB,KAAK,QAAQ,aAAa;KAAE,MAAM;KAAQ,QAAQ;KAAU,cAAc;IAAM;IAEhF,OAAO,EAAE,YAAY,CAAC,EAAE;GAC1B;GAIA,OAAO,GAFM,KAAK,aAAa,OAAO,MAEzB,IAAI,CAAC,EAAE;EACtB,CAAC;CACH;CAEA,AAAQ,aAAa,QAAwB;EAC3C,MAAM,WAAW,KAAK,kBAAkB,IAAI,MAAM;EAElD,IAAI,UACF,OAAO;EAIT,MAAM,OACJ,KAAK,kBAAkB,SAAS,IAAI,eAAe,cAAc,OAAO,QAAQ,oBAAoB,EAAE;EAExG,KAAK,kBAAkB,IAAI,QAAQ,IAAI;EACvC,KAAK,QAAQ,QAAQ;GAAE,MAAM;GAAU,IAAI;GAAU,MAAM;EAAO;EAElE,OAAO;CACT;CAEA,AAAO,aAAsB;EAC3B,OAAO,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,SAAS;CAC5C;AACF"}
+{"version":3,"file":"security.mjs","names":[],"sources":["../../../../../../../../packages/core/src/openapi/security.ts"],"sourcesContent":["import type {\n  AuthDescriptor,\n  OpenApiSecurityRequirement,\n  OpenApiSecurityScheme,\n  WarningSink,\n} from \"./types\";\n\n/**\n * The marker `authMiddleware()` attaches to the middleware it returns.\n * Core reads it structurally; it never imports the auth package.\n */\nexport const AUTH_DESCRIPTOR_SYMBOL = Symbol.for(\"warlock.auth\");\n\nfunction isAuthSource(value: unknown): value is AuthDescriptor[\"sources\"][number] {\n  if (value === \"header\") {\n    return true;\n  }\n\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    typeof (value as { cookie?: unknown }).cookie === \"string\" &&\n    (value as { cookie: string }).cookie.length > 0\n  );\n}\n\n/**\n * Validate an auth descriptor. Returns `undefined` for anything that is not\n * `{ sources: (\"header\" | { cookie: string })[], userTypes?: string[] }` with at least one source.\n */\nexport function parseAuthDescriptor(value: unknown): AuthDescriptor | undefined {\n  if (typeof value !== \"object\" || value === null) {\n    return undefined;\n  }\n\n  const { sources, userTypes } = value as { sources?: unknown; userTypes?: unknown };\n\n  if (!Array.isArray(sources) || sources.length === 0 || !sources.every(isAuthSource)) {\n    return undefined;\n  }\n\n  if (\n    userTypes !== undefined &&\n    !(Array.isArray(userTypes) && userTypes.every((type) => typeof type === \"string\"))\n  ) {\n    return undefined;\n  }\n\n  return { sources: [...sources], userTypes: Array.isArray(userTypes) ? [...userTypes] : [] };\n}\n\n/**\n * Combine the descriptors of every guard on a route (group middleware is already merged into\n * the route): unique sources, union of user types.\n *\n * Middleware without a descriptor is ordinary middleware and is ignored silently. A function\n * that carries a descriptor of the wrong shape is reported through `warn`.\n *\n * @returns `undefined` when the route has no valid auth descriptor.\n */\nexport function readRouteAuth(middleware: unknown, warn: WarningSink): AuthDescriptor | undefined {\n  if (!Array.isArray(middleware)) {\n    return undefined;\n  }\n\n  const sources: AuthDescriptor[\"sources\"] = [];\n  const userTypes: string[] = [];\n  let found = false;\n\n  for (const fn of middleware) {\n    if (typeof fn !== \"function\") {\n      continue;\n    }\n\n    const raw = Reflect.get(fn, AUTH_DESCRIPTOR_SYMBOL);\n\n    if (raw === undefined) {\n      continue;\n    }\n\n    const descriptor = parseAuthDescriptor(raw);\n\n    if (!descriptor) {\n      warn(\n        \"a middleware carries a malformed warlock.auth descriptor; the route is documented without security.\",\n      );\n\n      continue;\n    }\n\n    found = true;\n\n    for (const source of descriptor.sources) {\n      const duplicate = sources.some((existing) =>\n        typeof existing === \"string\" || typeof source === \"string\"\n          ? existing === source\n          : existing.cookie === source.cookie,\n      );\n\n      if (!duplicate) {\n        sources.push(source);\n      }\n    }\n\n    for (const type of descriptor.userTypes) {\n      if (!userTypes.includes(type)) {\n        userTypes.push(type);\n      }\n    }\n  }\n\n  return found ? { sources, userTypes } : undefined;\n}\n\n/**\n * Collects the security schemes the routes actually use and turns descriptors into\n * per-operation requirements. A dual header + cookie guard is an OR: one requirement each.\n */\nexport class SecuritySchemes {\n  public readonly schemes: Record<string, OpenApiSecurityScheme> = {};\n\n  private readonly cookieSchemeNames = new Map<string, string>();\n\n  public requirementsFor(descriptor: AuthDescriptor): OpenApiSecurityRequirement[] {\n    return descriptor.sources.map((source) => {\n      if (source === \"header\") {\n        this.schemes.bearerAuth = { type: \"http\", scheme: \"bearer\", bearerFormat: \"JWT\" };\n\n        return { bearerAuth: [] };\n      }\n\n      const name = this.cookieScheme(source.cookie);\n\n      return { [name]: [] };\n    });\n  }\n\n  private cookieScheme(cookie: string): string {\n    const existing = this.cookieSchemeNames.get(cookie);\n\n    if (existing) {\n      return existing;\n    }\n\n    // The first cookie keeps the conventional name; a second, different cookie gets its own.\n    const name =\n      this.cookieSchemeNames.size === 0\n        ? \"cookieAuth\"\n        : `cookieAuth_${cookie.replace(/[^A-Za-z0-9._-]/g, \"\")}`;\n\n    this.cookieSchemeNames.set(cookie, name);\n    this.schemes[name] = { type: \"apiKey\", in: \"cookie\", name: cookie };\n\n    return name;\n  }\n\n  public hasSchemes(): boolean {\n    return Object.keys(this.schemes).length > 0;\n  }\n}\n"],"mappings":";;;;;AAWA,MAAa,yBAAyB,OAAO,IAAI,cAAc;AAE/D,SAAS,aAAa,OAA4D;CAChF,IAAI,UAAU,UACZ,OAAO;CAGT,OACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAQ,MAA+B,WAAW,YACjD,MAA6B,OAAO,SAAS;AAElD;;;;;AAMA,SAAgB,oBAAoB,OAA4C;CAC9E,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC;CAGF,MAAM,EAAE,SAAS,cAAc;CAE/B,IAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,QAAQ,WAAW,KAAK,CAAC,QAAQ,MAAM,YAAY,GAChF;CAGF,IACE,cAAc,UACd,EAAE,MAAM,QAAQ,SAAS,KAAK,UAAU,OAAO,SAAS,OAAO,SAAS,QAAQ,IAEhF;CAGF,OAAO;EAAE,SAAS,CAAC,GAAG,OAAO;EAAG,WAAW,MAAM,QAAQ,SAAS,IAAI,CAAC,GAAG,SAAS,IAAI,CAAC;CAAE;AAC5F;;;;;;;;;;AAWA,SAAgB,cAAc,YAAqB,MAA+C;CAChG,IAAI,CAAC,MAAM,QAAQ,UAAU,GAC3B;CAGF,MAAM,UAAqC,CAAC;CAC5C,MAAM,YAAsB,CAAC;CAC7B,IAAI,QAAQ;CAEZ,KAAK,MAAM,MAAM,YAAY;EAC3B,IAAI,OAAO,OAAO,YAChB;EAGF,MAAM,MAAM,QAAQ,IAAI,IAAI,sBAAsB;EAElD,IAAI,QAAQ,QACV;EAGF,MAAM,aAAa,oBAAoB,GAAG;EAE1C,IAAI,CAAC,YAAY;GACf,KACE,qGACF;GAEA;EACF;EAEA,QAAQ;EAER,KAAK,MAAM,UAAU,WAAW,SAO9B,IAAI,CANc,QAAQ,MAAM,aAC9B,OAAO,aAAa,YAAY,OAAO,WAAW,WAC9C,aAAa,SACb,SAAS,WAAW,OAAO,MAGpB,GACX,QAAQ,KAAK,MAAM;EAIvB,KAAK,MAAM,QAAQ,WAAW,WAC5B,IAAI,CAAC,UAAU,SAAS,IAAI,GAC1B,UAAU,KAAK,IAAI;CAGzB;CAEA,OAAO,QAAQ;EAAE;EAAS;CAAU,IAAI;AAC1C;;;;;AAMA,IAAa,kBAAb,MAA6B;;iBACsC,CAAC;2CAE7B,IAAI,IAAoB;;CAE7D,AAAO,gBAAgB,YAA0D;EAC/E,OAAO,WAAW,QAAQ,KAAK,WAAW;GACxC,IAAI,WAAW,UAAU;IACvB,KAAK,QAAQ,aAAa;KAAE,MAAM;KAAQ,QAAQ;KAAU,cAAc;IAAM;IAEhF,OAAO,EAAE,YAAY,CAAC,EAAE;GAC1B;GAIA,OAAO,GAFM,KAAK,aAAa,OAAO,MAEzB,IAAI,CAAC,EAAE;EACtB,CAAC;CACH;CAEA,AAAQ,aAAa,QAAwB;EAC3C,MAAM,WAAW,KAAK,kBAAkB,IAAI,MAAM;EAElD,IAAI,UACF,OAAO;EAIT,MAAM,OACJ,KAAK,kBAAkB,SAAS,IAC5B,eACA,cAAc,OAAO,QAAQ,oBAAoB,EAAE;EAEzD,KAAK,kBAAkB,IAAI,QAAQ,IAAI;EACvC,KAAK,QAAQ,QAAQ;GAAE,MAAM;GAAU,IAAI;GAAU,MAAM;EAAO;EAElE,OAAO;CACT;CAEA,AAAO,aAAsB;EAC3B,OAAO,OAAO,KAAK,KAAK,OAAO,CAAC,CAAC,SAAS;CAC5C;AACF"}

package/esm/openapi/types.d.mts

@@ -1,11 +1,10 @@
 import { Route } from "../router/types.mjs";
-
 //#region ../../packages/core/src/openapi/types.d.ts
 /**
  * A JSON Schema fragment (OpenAPI 3.1 schemas are JSON Schema 2020-12).
  */
-type OpenApiSchema = Record<string, unknown>;
-type OpenApiParameter = {
+export type OpenApiSchema = Record<string, unknown>;
+export type OpenApiParameter = {
   name: string;
   in: "path" | "query" | "header" | "cookie";
   required?: boolean;
@@ -14,20 +13,20 @@ type OpenApiParameter = {
   explode?: boolean;
   schema: OpenApiSchema;
 };
-type OpenApiRequestBody = {
+export type OpenApiRequestBody = {
   required?: boolean;
   content: Record<string, {
     schema: OpenApiSchema;
   }>;
 };
-type OpenApiResponse = {
+export type OpenApiResponse = {
   description: string;
   content?: Record<string, {
     schema: OpenApiSchema;
   }>;
 };
-type OpenApiSecurityRequirement = Record<string, string[]>;
-type OpenApiOperation = {
+export type OpenApiSecurityRequirement = Record<string, string[]>;
+export type OpenApiOperation = {
   operationId: string;
   summary?: string;
   description?: string;
@@ -37,7 +36,7 @@ type OpenApiOperation = {
   responses: Record<string, OpenApiResponse>;
   security?: OpenApiSecurityRequirement[];
 };
-type OpenApiSecurityScheme = {
+export type OpenApiSecurityScheme = {
   type: "http";
   scheme: "bearer";
   bearerFormat?: string;
@@ -46,11 +45,11 @@ type OpenApiSecurityScheme = {
   in: "cookie";
   name: string;
 };
-type OpenApiComponents = {
+export type OpenApiComponents = {
   schemas?: Record<string, OpenApiSchema>;
   securitySchemes?: Record<string, OpenApiSecurityScheme>;
 };
-type OpenApiDocument = {
+export type OpenApiDocument = {
   openapi: "3.1.0";
   jsonSchemaDialect: string;
   info: {
@@ -71,49 +70,53 @@ type OpenApiDocument = {
  * The `validation.response` configuration keys that shape a failed-validation response.
  * Every key is optional; the documented defaults apply to the missing ones.
  */
-type OpenApiValidationResponseConfig = {
+export type OpenApiValidationResponseConfig = {
   errors?: string;
   inputKey?: string;
   inputError?: string;
   status?: number;
+  /** The global failure-body hook; only whether it is a function is read. */
+  body?: unknown;
 };
 /**
  * Everything the builder needs besides the routes. Plain values only, so the same call
  * serves the CLI child and the in-process dev path.
  */
-type OpenApiContext = {
+export type OpenApiContext = {
   info: {
     title: string;
     version: string;
     description?: string;
-  }; /** Absolute server URLs, first is the default. */
-  servers?: string[]; /** Also document page (SSR) routes. Defaults to `false`. */
+  };
+  /** Absolute server URLs, first is the default. */
+  servers?: string[];
+  /** Also document page (SSR) routes. Defaults to `false`. */
   includePages?: boolean;
   /**
    * Name a resource class for `components.schemas`, usually its export name
    * (`UserResource`). Return `undefined` for an unknown resource: it is named
    * `Resource1`, `Resource2`, ... in encounter order.
    */
-  resolveResourceName?: (resource: unknown) => string | undefined; /** The app's `validation.response` config value. */
+  resolveResourceName?: (resource: unknown) => string | undefined;
+  /** The app's `validation.response` config value. */
   validationResponse?: OpenApiValidationResponseConfig;
 };
-type OpenApiBuildResult = {
+export type OpenApiBuildResult = {
   document: OpenApiDocument;
   warnings: string[];
 };
 /** The slice of a route the builder reads. A full `Route` satisfies it. */
-type OpenApiRouteInput = Pick<Route, "method" | "path" | "handler"> & Partial<Pick<Route, "name" | "label" | "description" | "middleware" | "isPage" | "sourceFile">>;
+export type OpenApiRouteInput = Pick<Route, "method" | "path" | "handler"> & Partial<Pick<Route, "name" | "label" | "description" | "middleware" | "isPage" | "sourceFile" | "validation">>;
 /**
  * The descriptor `authMiddleware()` attaches under `Symbol.for("warlock.auth")`.
  * Read structurally and validated; core never imports the auth package.
  */
-type AuthDescriptor = {
+export type AuthDescriptor = {
   sources: ("header" | {
     cookie: string;
   })[];
   userTypes: string[];
 };
-type WarningSink = (message: string) => void;
+export type WarningSink = (message: string) => void;
 //#endregion
-export { AuthDescriptor, OpenApiBuildResult, OpenApiComponents, OpenApiContext, OpenApiDocument, OpenApiOperation, OpenApiParameter, OpenApiRequestBody, OpenApiResponse, OpenApiRouteInput, OpenApiSchema, OpenApiSecurityRequirement, OpenApiSecurityScheme, OpenApiValidationResponseConfig, WarningSink };
 //# sourceMappingURL=types.d.mts.map

package/esm/openapi/types.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/openapi/types.ts"],"mappings":";;;;;AAKA;KAAY,aAAA,GAAgB,MAAM;AAAA,KAEtB,gBAAA;EACV,IAAA;EACA,EAAA;EACA,QAAA;EACA,WAAA;EACA,KAAA;EACA,OAAA;EACA,MAAA,EAAQ,aAAa;AAAA;AAAA,KAGX,kBAAA;EACV,QAAA;EACA,OAAA,EAAS,MAAM;IAAW,MAAA,EAAQ,aAAA;EAAA;AAAA;AAAA,KAGxB,eAAA;EACV,WAAA;EACA,OAAA,GAAU,MAAM;IAAW,MAAA,EAAQ,aAAA;EAAA;AAAA;AAAA,KAGzB,0BAAA,GAA6B,MAAM;AAAA,KAEnC,gBAAA;EACV,WAAA;EACA,OAAA;EACA,WAAA;EACA,IAAA;EACA,UAAA,GAAa,gBAAA;EACb,WAAA,GAAc,kBAAA;EACd,SAAA,EAAW,MAAA,SAAe,eAAA;EAC1B,QAAA,GAAW,0BAAA;AAAA;AAAA,KAGD,qBAAA;EACN,IAAA;EAAc,MAAA;EAAkB,YAAA;AAAA;EAChC,IAAA;EAAgB,EAAA;EAAc,IAAA;AAAA;AAAA,KAExB,iBAAA;EACV,OAAA,GAAU,MAAA,SAAe,aAAA;EACzB,eAAA,GAAkB,MAAA,SAAe,qBAAA;AAAA;AAAA,KAGvB,eAAA;EACV,OAAA;EACA,iBAAA;EACA,IAAA;IAAQ,KAAA;IAAe,OAAA;IAAiB,WAAA;EAAA;EACxC,OAAA;IAAY,GAAA;EAAA;EACZ,IAAA;IAAS,IAAA;EAAA;EACT,KAAA,EAAO,MAAA,SAAe,MAAA,SAAe,gBAAA;EACrC,UAAA,GAAa,iBAAA;AAAA;;;;;KAOH,+BAAA;EACV,MAAA;EACA,QAAA;EACA,UAAA;EACA,MAAA;AAAA;;;;;KAOU,cAAA;EACV,IAAA;IAAQ,KAAA;IAAe,OAAA;IAAiB,WAAA;EAAA,GA/Bb;EAiC3B,OAAA,aAhCyB;EAkCzB,YAAA;EAjCiC;;;;;EAuCjC,mBAAA,IAAuB,QAAA,kCAxCE;EA0CzB,kBAAA,GAAqB,+BAA+B;AAAA;AAAA,KAG1C,kBAAA;EACV,QAAA,EAAU,eAAe;EACzB,QAAA;AAAA;;KAIU,iBAAA,GAAoB,IAAA,CAAK,KAAA,mCACnC,OAAA,CACE,IAAA,CAAK,KAAA;;;;;KAOG,cAAA;EACV,OAAA;IAAuB,MAAA;EAAA;EACvB,SAAA;AAAA;AAAA,KAGU,WAAA,IAAe,OAAe"}
+{"version":3,"file":"types.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/openapi/types.ts"],"mappings":";;;;;YAKY,gBAAgB;YAEhB;EACV;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ;;YAGE;EACV;EACA,SAAS;IAAiB,QAAQ;;;YAGxB;EACV;EACA,UAAU;IAAiB,QAAQ;;;YAGzB,6BAA6B;YAE7B;EACV;EACA;EACA;EACA;EACA,aAAa;EACb,cAAc;EACd,WAAW,eAAe;EAC1B,WAAW;;YAGD;EACN;EAAc;EAAkB;;EAChC;EAAgB;EAAc;;YAExB;EACV,UAAU,eAAe;EACzB,kBAAkB,eAAe;;YAGvB;EACV;EACA;EACA;IAAQ;IAAe;IAAiB;;EACxC;IAAY;;EACZ;IAAS;;EACT,OAAO,eAAe,eAAe;EACrC,aAAa;;;;;;YAOH;EACV;EACA;EACA;EACA;;EAEA;;;;;;YAOU;EACV;IAAQ;IAAe;IAAiB;;;EAExC;;EAEA;;;;;;EAMA,uBAAuB;;EAEvB,qBAAqB;;YAGX;EACV,UAAU;EACV;;;YAIU,oBAAoB,KAAK,wCACnC,QACE,KACE;;;;;YASM;EACV;IAAuB;;EACvB;;YAGU,eAAe"}

package/esm/production/assert-generated-imports.mjs

@@ -19,6 +19,7 @@ var UndeclaredGeneratedImportError = class extends Error {
 			"resolves by accident under npm/yarn hoisting and fails under pnpm's strict layout."
 		].join("\n"));
 		this.violations = violations;
+		this.code = "WL7002";
 		this.name = "UndeclaredGeneratedImportError";
 	}
 };
@@ -91,5 +92,5 @@ function assertGeneratedImportsAreDeclared(files, declaredDependencies) {
 }
 
 //#endregion
-export { assertGeneratedImportsAreDeclared };
+export { UndeclaredGeneratedImportError, assertGeneratedImportsAreDeclared, extractSpecifiers, findUndeclaredImports, resolvePackageName };
 //# sourceMappingURL=assert-generated-imports.mjs.map

package/esm/production/assert-generated-imports.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"assert-generated-imports.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/assert-generated-imports.ts"],"sourcesContent":["import { builtinModules } from \"node:module\";\n\n/**\n * A specifier the builder wrote into generated code that the consuming app does\n * not declare.\n */\nexport type UndeclaredImport = {\n  /** File the import was written into, relative to the generation directory. */\n  file: string;\n  /** The specifier exactly as emitted. */\n  specifier: string;\n  /** The package the specifier resolves to — `@scope/name` for a deep import. */\n  packageName: string;\n};\n\nexport type GeneratedFile = {\n  file: string;\n  content: string;\n};\n\n/**\n * Raised when generated code would ship an import the app cannot resolve.\n *\n * Carries every violation rather than the first, so a build reports the whole\n * problem in one pass instead of one specifier per re-run.\n */\nexport class UndeclaredGeneratedImportError extends Error {\n  public constructor(public readonly violations: UndeclaredImport[]) {\n    super(\n      [\n        `Generated code imports ${violations.length} package(s) the application does not declare:`,\n        \"\",\n        ...violations.map(\n          ({ file, specifier, packageName }) =>\n            `  ${file} → \"${specifier}\" (requires \"${packageName}\" in the app's dependencies)`,\n        ),\n        \"\",\n        \"Generated code may only import packages the app itself declares. A framework-internal\",\n        \"dependency must be reached through a re-export from @warlock.js/core — a bare specifier\",\n        \"resolves by accident under npm/yarn hoisting and fails under pnpm's strict layout.\",\n      ].join(\"\\n\"),\n    );\n\n    this.name = \"UndeclaredGeneratedImportError\";\n  }\n}\n\n// The clause between `import` and `from` excludes `;` and both quote\n// characters so the lazy match cannot run past the end of its own statement.\n// Allowing it to would let a side-effect import (`import \"./bootstrap\";`) bind\n// to the `from` of the NEXT statement and disappear from the results.\nconst IMPORT_PATTERN =\n  /(?:import|export)\\s+(?:[^\"';]*?\\sfrom\\s*)?[\"']([^\"']+)[\"']|import\\s*\\(\\s*[\"']([^\"']+)[\"']\\s*\\)/g;\n\n/**\n * Every module specifier a source file references — static, side-effect,\n * re-export and dynamic `import()` forms alike.\n *\n * Regex is sufficient and deliberate here: the input is code this builder wrote\n * itself, so it has no comments, no strings that look like imports, and no\n * syntax the pattern could misread. Parsing it with a full AST would buy\n * nothing and cost a dependency in the build path.\n */\nexport function extractSpecifiers(content: string): string[] {\n  const specifiers: string[] = [];\n\n  for (const match of content.matchAll(IMPORT_PATTERN)) {\n    const specifier = match[1] ?? match[2];\n\n    if (specifier) {\n      specifiers.push(specifier);\n    }\n  }\n\n  return specifiers;\n}\n\n/**\n * The package a specifier resolves to — `@scope/name` or `name`, ignoring any\n * deep path after it. Returns undefined for anything that is not a package:\n * relative paths, absolute paths, URLs, and Node builtins.\n */\nexport function resolvePackageName(specifier: string): string | undefined {\n  if (\n    specifier.startsWith(\".\") ||\n    specifier.startsWith(\"/\") ||\n    specifier.startsWith(\"node:\") ||\n    specifier.includes(\"://\")\n  ) {\n    return undefined;\n  }\n\n  const segments = specifier.split(\"/\");\n  const packageName = specifier.startsWith(\"@\") ? segments.slice(0, 2).join(\"/\") : segments[0];\n\n  if (!packageName) {\n    return undefined;\n  }\n\n  if (builtinModules.includes(packageName)) {\n    return undefined;\n  }\n\n  return packageName;\n}\n\n/**\n * Find every import in generated code that the app does not declare.\n *\n * `dependencies` only, deliberately: the artifact this checks is a production\n * bundle, so a package the app lists as a dev dependency is not guaranteed to\n * be installed where it runs.\n */\nexport function findUndeclaredImports(\n  files: GeneratedFile[],\n  declaredDependencies: string[],\n): UndeclaredImport[] {\n  const declared = new Set(declaredDependencies);\n  const violations: UndeclaredImport[] = [];\n\n  for (const { file, content } of files) {\n    for (const specifier of extractSpecifiers(content)) {\n      const packageName = resolvePackageName(specifier);\n\n      if (!packageName || declared.has(packageName)) {\n        continue;\n      }\n\n      violations.push({ file, specifier, packageName });\n    }\n  }\n\n  return violations;\n}\n\n/**\n * Fail the build when generated code would import something the app cannot\n * resolve.\n *\n * This is the part that stops the defect class from returning. Rewriting the\n * one bad specifier fixes today's bundle; only the assertion stops the next\n * change to the generator from reintroducing it — under npm or yarn the mistake\n * is invisible, because hoisting resolves it by accident.\n *\n * @throws {UndeclaredGeneratedImportError} listing every violation found.\n */\nexport function assertGeneratedImportsAreDeclared(\n  files: GeneratedFile[],\n  declaredDependencies: string[],\n): void {\n  const violations = findUndeclaredImports(files, declaredDependencies);\n\n  if (violations.length > 0) {\n    throw new UndeclaredGeneratedImportError(violations);\n  }\n}\n"],"mappings":";;;;;;;;;AA0BA,IAAa,iCAAb,cAAoD,MAAM;CACxD,AAAO,YAAY,AAAgB,YAAgC;EACjE,MACE;GACE,0BAA0B,WAAW,OAAO;GAC5C;GACA,GAAG,WAAW,KACX,EAAE,MAAM,WAAW,kBAClB,KAAK,KAAK,MAAM,UAAU,eAAe,YAAY,6BACzD;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KAAK,IAAI,CACb;EAdiC;EAgBjC,KAAK,OAAO;CACd;AACF;AAMA,MAAM,iBACJ;;;;;;;;;;AAWF,SAAgB,kBAAkB,SAA2B;CAC3D,MAAM,aAAuB,CAAC;CAE9B,KAAK,MAAM,SAAS,QAAQ,SAAS,cAAc,GAAG;EACpD,MAAM,YAAY,MAAM,MAAM,MAAM;EAEpC,IAAI,WACF,WAAW,KAAK,SAAS;CAE7B;CAEA,OAAO;AACT;;;;;;AAOA,SAAgB,mBAAmB,WAAuC;CACxE,IACE,UAAU,WAAW,GAAG,KACxB,UAAU,WAAW,GAAG,KACxB,UAAU,WAAW,OAAO,KAC5B,UAAU,SAAS,KAAK,GAExB;CAGF,MAAM,WAAW,UAAU,MAAM,GAAG;CACpC,MAAM,cAAc,UAAU,WAAW,GAAG,IAAI,SAAS,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,SAAS;CAE1F,IAAI,CAAC,aACH;CAGF,IAAI,eAAe,SAAS,WAAW,GACrC;CAGF,OAAO;AACT;;;;;;;;AASA,SAAgB,sBACd,OACA,sBACoB;CACpB,MAAM,WAAW,IAAI,IAAI,oBAAoB;CAC7C,MAAM,aAAiC,CAAC;CAExC,KAAK,MAAM,EAAE,MAAM,aAAa,OAC9B,KAAK,MAAM,aAAa,kBAAkB,OAAO,GAAG;EAClD,MAAM,cAAc,mBAAmB,SAAS;EAEhD,IAAI,CAAC,eAAe,SAAS,IAAI,WAAW,GAC1C;EAGF,WAAW,KAAK;GAAE;GAAM;GAAW;EAAY,CAAC;CAClD;CAGF,OAAO;AACT;;;;;;;;;;;;AAaA,SAAgB,kCACd,OACA,sBACM;CACN,MAAM,aAAa,sBAAsB,OAAO,oBAAoB;CAEpE,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,+BAA+B,UAAU;AAEvD"}
+{"version":3,"file":"assert-generated-imports.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/assert-generated-imports.ts"],"sourcesContent":["import { builtinModules } from \"node:module\";\n\n/**\n * A specifier the builder wrote into generated code that the consuming app does\n * not declare.\n */\nexport type UndeclaredImport = {\n  /** File the import was written into, relative to the generation directory. */\n  file: string;\n  /** The specifier exactly as emitted. */\n  specifier: string;\n  /** The package the specifier resolves to — `@scope/name` for a deep import. */\n  packageName: string;\n};\n\nexport type GeneratedFile = {\n  file: string;\n  content: string;\n};\n\n/**\n * Raised when generated code would ship an import the app cannot resolve.\n *\n * Carries every violation rather than the first, so a build reports the whole\n * problem in one pass instead of one specifier per re-run.\n */\nexport class UndeclaredGeneratedImportError extends Error {\n  /** Stable Warlock error code; `warlock explain WL7002` prints the fix. */\n  public readonly code = \"WL7002\";\n\n  public constructor(public readonly violations: UndeclaredImport[]) {\n    super(\n      [\n        `Generated code imports ${violations.length} package(s) the application does not declare:`,\n        \"\",\n        ...violations.map(\n          ({ file, specifier, packageName }) =>\n            `  ${file} → \"${specifier}\" (requires \"${packageName}\" in the app's dependencies)`,\n        ),\n        \"\",\n        \"Generated code may only import packages the app itself declares. A framework-internal\",\n        \"dependency must be reached through a re-export from @warlock.js/core — a bare specifier\",\n        \"resolves by accident under npm/yarn hoisting and fails under pnpm's strict layout.\",\n      ].join(\"\\n\"),\n    );\n\n    this.name = \"UndeclaredGeneratedImportError\";\n  }\n}\n\n// The clause between `import` and `from` excludes `;` and both quote\n// characters so the lazy match cannot run past the end of its own statement.\n// Allowing it to would let a side-effect import (`import \"./bootstrap\";`) bind\n// to the `from` of the NEXT statement and disappear from the results.\nconst IMPORT_PATTERN =\n  /(?:import|export)\\s+(?:[^\"';]*?\\sfrom\\s*)?[\"']([^\"']+)[\"']|import\\s*\\(\\s*[\"']([^\"']+)[\"']\\s*\\)/g;\n\n/**\n * Every module specifier a source file references — static, side-effect,\n * re-export and dynamic `import()` forms alike.\n *\n * Regex is sufficient and deliberate here: the input is code this builder wrote\n * itself, so it has no comments, no strings that look like imports, and no\n * syntax the pattern could misread. Parsing it with a full AST would buy\n * nothing and cost a dependency in the build path.\n */\nexport function extractSpecifiers(content: string): string[] {\n  const specifiers: string[] = [];\n\n  for (const match of content.matchAll(IMPORT_PATTERN)) {\n    const specifier = match[1] ?? match[2];\n\n    if (specifier) {\n      specifiers.push(specifier);\n    }\n  }\n\n  return specifiers;\n}\n\n/**\n * The package a specifier resolves to — `@scope/name` or `name`, ignoring any\n * deep path after it. Returns undefined for anything that is not a package:\n * relative paths, absolute paths, URLs, and Node builtins.\n */\nexport function resolvePackageName(specifier: string): string | undefined {\n  if (\n    specifier.startsWith(\".\") ||\n    specifier.startsWith(\"/\") ||\n    specifier.startsWith(\"node:\") ||\n    specifier.includes(\"://\")\n  ) {\n    return undefined;\n  }\n\n  const segments = specifier.split(\"/\");\n  const packageName = specifier.startsWith(\"@\") ? segments.slice(0, 2).join(\"/\") : segments[0];\n\n  if (!packageName) {\n    return undefined;\n  }\n\n  if (builtinModules.includes(packageName)) {\n    return undefined;\n  }\n\n  return packageName;\n}\n\n/**\n * Find every import in generated code that the app does not declare.\n *\n * `dependencies` only, deliberately: the artifact this checks is a production\n * bundle, so a package the app lists as a dev dependency is not guaranteed to\n * be installed where it runs.\n */\nexport function findUndeclaredImports(\n  files: GeneratedFile[],\n  declaredDependencies: string[],\n): UndeclaredImport[] {\n  const declared = new Set(declaredDependencies);\n  const violations: UndeclaredImport[] = [];\n\n  for (const { file, content } of files) {\n    for (const specifier of extractSpecifiers(content)) {\n      const packageName = resolvePackageName(specifier);\n\n      if (!packageName || declared.has(packageName)) {\n        continue;\n      }\n\n      violations.push({ file, specifier, packageName });\n    }\n  }\n\n  return violations;\n}\n\n/**\n * Fail the build when generated code would import something the app cannot\n * resolve.\n *\n * This is the part that stops the defect class from returning. Rewriting the\n * one bad specifier fixes today's bundle; only the assertion stops the next\n * change to the generator from reintroducing it — under npm or yarn the mistake\n * is invisible, because hoisting resolves it by accident.\n *\n * @throws {UndeclaredGeneratedImportError} listing every violation found.\n */\nexport function assertGeneratedImportsAreDeclared(\n  files: GeneratedFile[],\n  declaredDependencies: string[],\n): void {\n  const violations = findUndeclaredImports(files, declaredDependencies);\n\n  if (violations.length > 0) {\n    throw new UndeclaredGeneratedImportError(violations);\n  }\n}\n"],"mappings":";;;;;;;;;AA0BA,IAAa,iCAAb,cAAoD,MAAM;CAIxD,AAAO,YAAY,AAAgB,YAAgC;EACjE,MACE;GACE,0BAA0B,WAAW,OAAO;GAC5C;GACA,GAAG,WAAW,KACX,EAAE,MAAM,WAAW,kBAClB,KAAK,KAAK,MAAM,UAAU,eAAe,YAAY,6BACzD;GACA;GACA;GACA;GACA;EACF,CAAC,CAAC,KAAK,IAAI,CACb;EAdiC;cAFZ;EAkBrB,KAAK,OAAO;CACd;AACF;AAMA,MAAM,iBACJ;;;;;;;;;;AAWF,SAAgB,kBAAkB,SAA2B;CAC3D,MAAM,aAAuB,CAAC;CAE9B,KAAK,MAAM,SAAS,QAAQ,SAAS,cAAc,GAAG;EACpD,MAAM,YAAY,MAAM,MAAM,MAAM;EAEpC,IAAI,WACF,WAAW,KAAK,SAAS;CAE7B;CAEA,OAAO;AACT;;;;;;AAOA,SAAgB,mBAAmB,WAAuC;CACxE,IACE,UAAU,WAAW,GAAG,KACxB,UAAU,WAAW,GAAG,KACxB,UAAU,WAAW,OAAO,KAC5B,UAAU,SAAS,KAAK,GAExB;CAGF,MAAM,WAAW,UAAU,MAAM,GAAG;CACpC,MAAM,cAAc,UAAU,WAAW,GAAG,IAAI,SAAS,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,SAAS;CAE1F,IAAI,CAAC,aACH;CAGF,IAAI,eAAe,SAAS,WAAW,GACrC;CAGF,OAAO;AACT;;;;;;;;AASA,SAAgB,sBACd,OACA,sBACoB;CACpB,MAAM,WAAW,IAAI,IAAI,oBAAoB;CAC7C,MAAM,aAAiC,CAAC;CAExC,KAAK,MAAM,EAAE,MAAM,aAAa,OAC9B,KAAK,MAAM,aAAa,kBAAkB,OAAO,GAAG;EAClD,MAAM,cAAc,mBAAmB,SAAS;EAEhD,IAAI,CAAC,eAAe,SAAS,IAAI,WAAW,GAC1C;EAGF,WAAW,KAAK;GAAE;GAAM;GAAW;EAAY,CAAC;CAClD;CAGF,OAAO;AACT;;;;;;;;;;;;AAaA,SAAgB,kCACd,OACA,sBACM;CACN,MAAM,aAAa,sBAAsB,OAAO,oBAAoB;CAEpE,IAAI,WAAW,SAAS,GACtB,MAAM,IAAI,+BAA+B,UAAU;AAEvD"}

package/esm/production/build-contributions.mjs

@@ -130,5 +130,5 @@ async function runHook(connector, hook, run) {
 }
 
 //#endregion
-export { dedupe, runEmitContributions, runGenerateContributions, runTypingsContributions };
+export { assertClosedContribution, dedupe, mergeEsbuildPatches, runEmitContributions, runGenerateContributions, runTypingsContributions };
 //# sourceMappingURL=build-contributions.mjs.map

package/esm/production/bundle-framework-dependencies.mjs

@@ -148,5 +148,5 @@ function bundleFrameworkDependencies(options) {
 }
 
 //#endregion
-export { bundleFrameworkDependencies };
+export { bundleFrameworkDependencies, isBareSpecifier, packageNameOfSpecifier };
 //# sourceMappingURL=bundle-framework-dependencies.mjs.map

package/esm/production/dist-build-manifest.mjs

@@ -43,5 +43,5 @@ async function readDistBuildManifestAsync(directory) {
 }
 
 //#endregion
-export { readDistBuildManifestAsync, writeDistBuildManifestAsync };
+export { DIST_BUILD_MANIFEST_FILE_NAME, readDistBuildManifestAsync, writeDistBuildManifestAsync };
 //# sourceMappingURL=dist-build-manifest.mjs.map

package/esm/production/esbuild-plugins.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"esbuild-plugins.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/esbuild-plugins.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport type { OnLoadArgs, OnResolveArgs, PluginBuild } from \"esbuild\";\n\nconst esmRequire = createRequire(import.meta.url);\n\nexport const nativeNodeModulesPlugin = {\n  name: \"native-node-modules\",\n  setup(build: PluginBuild) {\n    build.onResolve({ filter: /\\.node$/, namespace: \"file\" }, (args: OnResolveArgs) => ({\n      path: esmRequire.resolve(args.path, { paths: [args.resolveDir] }),\n      namespace: \"node-file\",\n    }));\n\n    build.onLoad({ filter: /.*/, namespace: \"node-file\" }, (args: OnLoadArgs) => ({\n      contents: `\n          import path from ${JSON.stringify(args.path)}\n          try { module.exports = require(path) }\n          catch {}\n        `,\n    }));\n\n    build.onResolve({ filter: /\\.node$/, namespace: \"node-file\" }, (args: OnResolveArgs) => ({\n      path: args.path,\n      namespace: \"file\",\n    }));\n\n    const opts = build.initialOptions;\n    opts.loader = opts.loader || {};\n    opts.loader[\".node\"] = \"file\";\n  },\n};\n"],"mappings":";;;AAGA,MAAM,aAAa,cAAc,OAAO,KAAK,GAAG;AAEhD,MAAa,0BAA0B;CACrC,MAAM;CACN,MAAM,OAAoB;EACxB,MAAM,UAAU;GAAE,QAAQ;GAAW,WAAW;EAAO,IAAI,UAAyB;GAClF,MAAM,WAAW,QAAQ,KAAK,MAAM,EAAE,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;GAChE,WAAW;EACb,EAAE;EAEF,MAAM,OAAO;GAAE,QAAQ;GAAM,WAAW;EAAY,IAAI,UAAsB,EAC5E,UAAU;6BACa,KAAK,UAAU,KAAK,IAAI,EAAE;;;UAInD,EAAE;EAEF,MAAM,UAAU;GAAE,QAAQ;GAAW,WAAW;EAAY,IAAI,UAAyB;GACvF,MAAM,KAAK;GACX,WAAW;EACb,EAAE;EAEF,MAAM,OAAO,MAAM;EACnB,KAAK,SAAS,KAAK,UAAU,CAAC;EAC9B,KAAK,OAAO,WAAW;CACzB;AACF"}
+{"version":3,"file":"esbuild-plugins.mjs","names":[],"sources":["../../../../../../../../packages/core/src/production/esbuild-plugins.ts"],"sourcesContent":["import { createRequire } from \"node:module\";\nimport type { OnLoadArgs, OnResolveArgs, PluginBuild } from \"esbuild\";\n\nconst esmRequire = createRequire(import.meta.url);\n\nexport const nativeNodeModulesPlugin = {\n  name: \"native-node-modules\",\n  setup(build: PluginBuild) {\n    build.onResolve({ filter: /\\.node$/, namespace: \"file\" }, (args: OnResolveArgs) => ({\n      path: esmRequire.resolve(args.path, { paths: [args.resolveDir] }),\n      namespace: \"node-file\",\n    }));\n\n    build.onLoad({ filter: /.*/, namespace: \"node-file\" }, (args: OnLoadArgs) => ({\n      contents: `\n          import path from ${JSON.stringify(args.path)}\n          try { module.exports = require(path) }\n          catch {}\n        `,\n    }));\n\n    build.onResolve({ filter: /\\.node$/, namespace: \"node-file\" }, (args: OnResolveArgs) => ({\n      path: args.path,\n      namespace: \"file\",\n    }));\n\n    const opts = build.initialOptions;\n    opts.loader = opts.loader || {};\n    opts.loader[\".node\"] = \"file\";\n  },\n};\n"],"mappings":";;;AAGA,MAAM,aAAa,cAAc,YAAY,GAAG;AAEhD,MAAa,0BAA0B;CACrC,MAAM;CACN,MAAM,OAAoB;EACxB,MAAM,UAAU;GAAE,QAAQ;GAAW,WAAW;EAAO,IAAI,UAAyB;GAClF,MAAM,WAAW,QAAQ,KAAK,MAAM,EAAE,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;GAChE,WAAW;EACb,EAAE;EAEF,MAAM,OAAO;GAAE,QAAQ;GAAM,WAAW;EAAY,IAAI,UAAsB,EAC5E,UAAU;6BACa,KAAK,UAAU,KAAK,IAAI,EAAE;;;UAInD,EAAE;EAEF,MAAM,UAAU;GAAE,QAAQ;GAAW,WAAW;EAAY,IAAI,UAAyB;GACvF,MAAM,KAAK;GACX,WAAW;EACb,EAAE;EAEF,MAAM,OAAO,MAAM;EACnB,KAAK,SAAS,KAAK,UAAU,CAAC;EAC9B,KAAK,OAAO,WAAW;CACzB;AACF"}

package/esm/production/esbuild-preflight.mjs

@@ -53,5 +53,5 @@ function isUnlinkedBinaryError(error) {
 }
 
 //#endregion
-export { assertEsbuildBinaryIsLinked };
+export { EsbuildBinaryMissingError, assertEsbuildBinaryIsLinked };
 //# sourceMappingURL=esbuild-preflight.mjs.map

package/esm/production/production-builder.mjs

@@ -287,22 +287,26 @@ bootstrap();
 	* Generate config-loader.ts
 	*/
 	async generateConfigLoader() {
+		const configDirectory = path.join(process.cwd(), "src/config");
 		const configNames = (await glob("**/*.{ts,tsx}", {
-			cwd: path.join(process.cwd(), "src/config"),
+			cwd: configDirectory,
 			absolute: false
 		})).filter((f) => isConfigFile("src/config/" + f)).map((f) => ({
 			path: f.replace(/\.(ts|tsx)$/, ""),
 			key: configKeyFromPath("src/config/" + f)
 		})).filter((entry) => entry.key !== void 0).sort((a, b) => a.path.localeCompare(b.path));
-		const imports = ["import { setConfig, configSpecialHandlers } from \"@warlock.js/core\";"];
+		const imports = ["import { assertValidConfigModules, configSpecialHandlers, setConfig } from \"@warlock.js/core\";"];
 		const configImports = [];
 		const configSetCalls = [];
+		const validations = [];
 		const executors = [];
 		configNames.forEach(({ path: configPath, key }, index) => {
 			const varName = `config${index}`;
-			configImports.push(`import ${varName} from "../../src/config/${configPath}";`);
-			configSetCalls.push(`setConfig(${JSON.stringify(key)}, ${varName});`);
-			executors.push(`await configSpecialHandlers.execute(${JSON.stringify(key)}, ${varName});`);
+			const name = JSON.stringify(key);
+			configImports.push(`import * as ${varName} from "../../src/config/${configPath}";`);
+			configSetCalls.push(`setConfig(${name}, ${varName}.default);`);
+			validations.push(`  { name: ${name}, module: ${varName} },`);
+			executors.push(`await configSpecialHandlers.execute(${name}, ${varName}.default);`);
 		});
 		const content = [
 			...await fileExistsAsync(appPath("prestart.ts")) ? ["import './../../src/app/prestart';"] : [],
@@ -314,6 +318,11 @@ bootstrap();
 			"// Register configs",
 			...configSetCalls,
 			"",
+			"// Refuse to start when a config file's `configSchema` is not satisfied",
+			"await assertValidConfigModules([",
+			...validations,
+			"]);",
+			"",
 			"// Special handlers",
 			...executors,
 			""