@zerotal/core 1.7.0 → 1.7.3

package/CHANGELOG.md

@@ -6,6 +6,137 @@ follows the Zerotal monorepo's unified versioning.
 
 **Maturity: `stable`**
 
+## [Unreleased]
+
+### Fixed
+
+- **`make:request` generates a file that compiles.** The stub imported `@zerotal/validator`,
+  which a scaffolded app does not depend on — it depends on the `zerotal` umbrella — so the
+  generated file failed to resolve until the import was changed by hand. It also annotated
+  `rules(): Record<string, FieldRule>`, the one thing `FormRequest`'s own docblock warns
+  against: `validate()` reads the narrow return type through `ReturnType<T['rules']>`, so the
+  annotation widened it back and every validated field arrived as `unknown`, silently, with a
+  cast somewhere downstream the first sign of it.
+
+- **Every other `make:*` stub names a package the app has too.** The same fault ran through
+  nine generators: `make:command`, `make:controller`, `make:middleware` and `make:provider`
+  named `@zerotal/core`; `make:job` `@zerotal/queue`; `make:observer` `@zerotal/orm`;
+  `make:policy` `@zerotal/auth`; `make:test` `@zerotal/testing`. A scaffolded app depends on
+  none of them — it has the `zerotal` umbrella — so each wrote a file that did not resolve.
+  They now emit `zerotal` and its subpaths.
+
+  `make:resource` was worse: `Resource`, `ResourceCollection` and `PaginatedData` are not on
+  `@zerotal/core`'s root entry at all, so that stub was broken against the scoped name as
+  well. It emits `zerotal/http`, where they live.
+
+  `make:notification` keeps `@zerotal/notifications`: there is no umbrella subpath for it, and
+  the `api` template installs it directly.
+
+  A single test now runs all thirteen generators and fails on any import that is neither the
+  umbrella, a Bun/Node builtin, a relative path, nor one of the scoped packages a template
+  actually installs. Each generator's own test had only checked that the output mentioned the
+  class being made, which is why none of this showed.
+
+### Added
+
+- **`@zerotal/core/errors`** — a subpath for the error classes, so a module that can run in a
+  browser can import `ZerotalError` without reaching the root entry. The root re-exports
+  `CommandRunner`, which reaches the built-in CLI commands and `await import("bun")`, so a single
+  root import is enough to make a browser bundle fail at resolution. `@zerotal/core/helpers`
+  already covered `deepMerge` the same way.
+
+  The rule this makes workable: **core's root entry is server-only.** Anything that might be
+  bundled for a browser imports from a narrow subpath.
+
+## [1.7.1] — 2026-08-16
+
+### Changed
+
+- **`APP_ENV` is the deployment name; the runtime mode moved to `APP_TYPE`.** They shared one
+  variable and the mode won: `setAppEnv()` overwrote `APP_ENV` with `web` / `worker` /
+  `console` at boot, so an app whose `.env` said `APP_ENV=development` read `"console"` back
+  from `env("APP_ENV")` inside every CLI command.
+
+  The dangerous direction is the one nobody hits in development. A guard written the obvious
+  way —
+
+  ```ts
+  if (env("APP_ENV") === "production") refuseToWipe();
+  ```
+
+  — was **inert in every console command**, which is exactly where destructive commands live.
+  1.7.0 patched the framework's own gates by parking a copy that `deployEnv()` read back, but
+  application code reading the documented variable the documented way still got the mode.
+
+  Two questions, two variables. `setAppEnv()` no longer touches `APP_ENV` at all and writes
+  the mode to `APP_TYPE`; `runtimeMode()` reads it, and falls back to the legacy location so a
+  process started by an older launcher still boots the right providers. An explicit
+  `APP_TYPE` wins over the command, which is how `serve --dev` boots its supervised server as
+  `web`. `deployEnv()` and `config("app.env")` are unchanged and still correct.
+
+  No action needed in an app unless it sets `APP_ENV=web` by hand to force web mode — that
+  still works, and `APP_TYPE=web` is the spelling to move to.
+
+  Found seeding the first cookbook app, where a guard fired that should not have.
+
+### Fixed
+
+- **`Router.raw()` did not answer `HEAD`.** The pipeline derives a `HEAD` handler from every
+  `GET` — its own docblock notes that not doing so gives "every uptime monitor,
+  load-balancer probe, CDN origin check and `curl -I`" a 404 — and the raw path was left out
+  of it. So `curl -I` against a raw route answered 404 while the `GET` beside it answered 200. This framework's own site serves `/docs/*` and `/blog` from raw routes, so every link
+  checker and uptime probe aimed at the documentation was told the page did not exist.
+
+  Derived from the wrapped handler rather than the bare one, so the security headers below
+  ride along and a `HEAD` cannot answer with fewer than the `GET` it mirrors. A `HEAD` the
+  app registered itself still wins. Third gap in the same family, after the headers and
+  static files: any path that answers a request without running the pipeline needs whatever
+  the pipeline was doing for it.
+
+- **The dev deck would not scroll.** On the alternate screen a terminal has no scrollback of
+  its own, so the wheel and the scrollbar had nothing to move and the deck read as frozen —
+  from the moment tabs mode starts, every way of looking at an older line has to come from
+  the deck itself, and only Page Up/Down did.
+
+  It now asks the terminal to send the wheel as cursor keys (`?1007h`, released again on
+  exit) and handles `↑`/`↓` and Home/End. Deliberately not mouse tracking, which would give
+  real wheel events at the price of the terminal's own text selection.
+
+  Two things had to change underneath. A read from stdin is not one key: a wheel tick arrives
+  as the same arrow repeated once per line, all in one chunk, and two fast keystrokes arrive
+  together — so a chunk is split into keys and the frame painted once at the end. And a card
+  that has been scrolled up now holds its place: `scroll` counts up from the newest line, so a
+  busy process used to drag the window down by a line for every line it printed, sliding the
+  text somebody had stopped to read off the top while they read it. A card pinned to the
+  bottom still follows its output, which is the one that should.
+
+Both of the next two were found by wiring DevTools into this repo's own `apps/docs` and
+driving it in a browser.
+
+- **`Router.raw()` responses carried no security headers.** A raw route opts out of the
+  _request_ pipeline — CSRF on a transport endpoint, session resolution on a relay — and was
+  silently opting its response out of `SecureHeadersMiddleware` too. This framework's own
+  documentation site serves every `/docs/*` page from a raw route, so every page of it went
+  out with no `X-Content-Type-Options: nosniff`, no `X-Frame-Options`, no
+  `Referrer-Policy` and no `Permissions-Policy`. In production the reverse proxy happened
+  to add two of them, which is why nothing had noticed.
+
+  The header set is now applied to raw responses at compile time, **add-if-absent** rather
+  than overwrite: a raw route is the one place a handler owns its whole response, and an
+  endpoint that deliberately allows framing has a reason the framework cannot see. The
+  response is only reconstructed when something is missing, so the hot path — Flow's action
+  endpoint is a raw route — pays nothing when it already has them.
+
+  This is the third surface in the same family, after the pipeline and static files. Any
+  path that answers a request without running middleware needs the same treatment.
+
+- **`redactGraph` masked booleans.** Sensitivity is judged by key name, by substring, so
+  `cors.credentials` matched "credential" and the DevTools Config tab reported
+  `‹redacted›` where the answer was `false`. A boolean has two possible values: masking one
+  conceals nothing a reader could not guess, and hides the security setting they opened the
+  tab to check. Booleans now pass through; numbers still mask, since a number can be a PIN
+  or an account. The helper also gained the test file it shipped without.
+
 ## [1.7.0] — 2026-08-16
 
 ### Fixed

package/api-surface.md

@@ -316,6 +316,7 @@ class HttpContext = {
   new <TParams extends Record<string, unknown> = Record<string, string>>(request: Request, container: ScopedResolver): HttpContext<TParams>
   static fake: (url?: string, init?: RequestInit, container?: ScopedResolver) => HttpContext
   static tryGet: () => HttpContext | undefined
+  __: (key: string, replacements?: Replacements, locale?: string) => string
   _afterResponseCallbacks: (() => Promise<void>)[]
   _pageResolver?: (pageName: string) => number | undefined
   _primeBody: (data: Record<string, unknown>) => void
@@ -368,7 +369,6 @@ class HttpContext = {
   string: (key: string, fallback?: string) => string | undefined
   subdomain: (name: string) => string | null
   subdomains: Record<string, string>
-  t: (key: string, replacements?: Replacements, locale?: string) => string
   took: number
   user?: UserModel | undefined
   view: {    (markup: ViewMarkup, status?: number): void;    <P extends Record<string, unknown> = Record<string, never>>(component: (ctx: HttpContext, props: P) => ViewMarkup | Promise<ViewMarkup>, props?: P | undefined, status?: number): void | Promise<void>;}
@@ -1101,6 +1101,7 @@ interface WebhookOptions = {
 interface WebSocketHandlers = {
   close?: (ws: unknown, code: number, reason: string) => void
   drain?: (ws: unknown) => void
+  idleTimeout?: number
   message: (ws: unknown, message: string | Uint8Array) => void
   open?: (ws: unknown) => void
 }
@@ -2649,6 +2650,207 @@ type FieldType = 'string' | 'number' | 'boolean' | 'url' | 'enum' | 'port'
 
 type InferDef = D extends Def<infer T> ? T : never
 
+## ./errors  `(./src/errors/index.ts)`
+
+class BadRequestError = {
+  new (message?: string): BadRequestError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class BindingNotFoundError = {
+  new (token: string): BindingNotFoundError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class BootCheckError = {
+  new (failures: BootCheckFailure[]): BootCheckError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly failures: BootCheckFailure[]
+  readonly status: number
+}
+
+class CircularDependencyError = {
+  new (chain: string[]): CircularDependencyError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class ConfigError = {
+  new (message: string): ConfigError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class ConfigValidationError = {
+  new (issues: Array<{ namespace: string; message: string; }>): ConfigValidationError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly issues: {    namespace: string;    message: string;}[]
+  readonly status: number
+}
+
+class ConflictError = {
+  new (message?: string): ConflictError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class ContainerLockedError = {
+  new (method: string): ContainerLockedError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class ContextOutsideRequestError = {
+  new (): ContextOutsideRequestError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class FacadeAccessedBeforeBootError = {
+  new (facadeKey: string): FacadeAccessedBeforeBootError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class FacadeBindingMissingError = {
+  new (facadeKey: string): FacadeBindingMissingError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class ForbiddenError = {
+  new (message?: string): ForbiddenError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class GoneError = {
+  new (message?: string): GoneError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class HttpError = {
+  new (message: string, status: number, code?: string, headers?: Record<string, string>): HttpError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class MethodNotAllowedError = {
+  new (allowed?: string[], message?: string): MethodNotAllowedError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class NotFoundError = {
+  new (message?: string): NotFoundError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class ScopedAfterFlushError = {
+  new (message: string): ScopedAfterFlushError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class ScopedOutsideRequestError = {
+  new (message: string): ScopedOutsideRequestError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class ServiceUnavailableError = {
+  new (reason?: string, retryAfter?: number): ServiceUnavailableError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly retryAfter?: number | undefined
+  readonly status: number
+}
+
+class SyncResolutionError = {
+  new (message: string): SyncResolutionError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class TooManyRequestsError = {
+  new (retryAfter?: number, message?: string): TooManyRequestsError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly retryAfter?: number | undefined
+  readonly status: number
+}
+
+class UnauthorizedError = {
+  new (message?: string): UnauthorizedError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class UnprocessableEntityError = {
+  new (message?: string): UnprocessableEntityError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+class ValidationError = {
+  new (message: string, errors: Record<string, string[]>): ValidationError
+  headers?: Record<string, string>
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly errors: Record<string, string[]>
+  readonly status: number
+}
+
+class ZerotalError = {
+  new (message: string, code: string, status?: number, context?: Record<string, unknown> | undefined): ZerotalError
+  readonly code: string
+  readonly context?: Record<string, unknown> | undefined
+  readonly status: number
+}
+
+interface BootCheckFailure = {
+  provider: string
+  reason: string
+  token: string
+}
+
 ## ./facades  `(./src/facade/facades/index.ts)`
 
 const App = {    readonly container: Container;    readonly instance: () => Application;    readonly environment: () => Application['environment'];    readonly isProduction: () => boolean;    readonly isLocal: () => boolean;    readonly make: <T>(token: BindingToken<T>, consumer?: unknown) => Promise<T>;    readonly makeSync: <T>(token: BindingToken<T>) => T;    readonly build: <T>(ctor: new (...args: unknown[]) => T) => Promise<T>;    readonly tryMake: <K extends keyof ContainerBindings>(token: K) => ContainerBindings[K] | undefined;    readonly bound: (token: BindingToken) => boolean;    readonly bind: <T>(token: BindingToken<T>, factory: Factory<T>) => Container;    readonly singleton: <T>(token: BindingToken<T>, factory: Factory<T>) => Container;    readonly scoped: <T>(token: BindingToken<T>, factory: Factory<T>) => Container;    readonly value: <T>(token: BindingToken<T>, instance: T) => Container;    readonly alias: (from: unknown, to: unknown) => Container;    readonly forget: (token: BindingToken) => boolean;}
@@ -3294,14 +3496,37 @@ interface HttpMetricsSnapshot = {
 
 const route = RouteBuilder
 
+function action = <N extends RouteTarget>(name: N, params?: RouteParamValues | undefined, query?: RouteQuery | undefined) => RouteAction
+
+function defineRouteMethods = (table: Readonly<Record<string, string>>) => void
+
 function defineRoutes = (table: RouteTable) => void
 
 function hasRoute = (name: string) => boolean
 
 function resetRoutes = () => void
 
+function routeMethod = (name: string) => string | undefined
+
+interface RouteAction = {
+  method: string
+  url: string
+}
+
+interface RouteMethodRegistry = {}
+
+type MethodedRouteName = never
+
+type RouteArgs = [params?: RouteParamValues, query?: RouteQuery]
+
+type RouteParamValues = {    [x: string]: RouteParamValue | readonly RouteParamValue[];}
+
+type RouteQuery = {    [x: string]: string | number | boolean | readonly (string | number | boolean)[] | null | undefined;}
+
 type RouteTable = Readonly<Record<string, string>> | ReadonlyMap<string, string>
 
+type RouteTarget = string
+
 ## ./security  `(./src/security/index.ts)`
 
 class CryptKeyMissingError = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zerotal/core",
-  "version": "1.7.0",
+  "version": "1.7.3",
   "license": "MIT",
   "maturity": "stable",
   "private": false,
@@ -11,6 +11,7 @@
     ".": "./src/index.ts",
     "./routes": "./src/router/routes.ts",
     "./contracts": "./src/contracts/index.ts",
+    "./errors": "./src/errors/index.ts",
     "./lock": "./src/lock/index.ts",
     "./logger": "./src/logger/index.ts",
     "./commands": "./src/command/builtin/index.ts",

package/src/application/Application.ts

@@ -14,6 +14,7 @@ import type { HttpContext } from "../pipeline/HttpContext.ts";
 import { Pipeline } from "../pipeline/Pipeline.ts";
 import { ExceptionHandler } from "./ExceptionHandler.ts";
 import { Router, RouterState } from "../router/Router.ts";
+import { defineRouteMethods, defineRoutes } from "../router/routes.ts";
 import type { StaticOptions } from "../router/Router.ts";
 import { Health, resolveHealthConfig, checkHealthAccess } from "../health/Health.ts";
 import type { HealthConfigShape } from "../health/Health.ts";
@@ -42,7 +43,7 @@ import { NotFoundError } from "../errors/HttpError.ts";
 import type { ContainerBindings } from "../container/types.ts";
 import { dispatchRequest } from "../router/RouteHandler.ts";
 import type { ProviderHooks } from "../router/RouteHandler.ts";
-import { isProdLike, deployEnv } from "../support/env.ts";
+import { isProdLike, deployEnv, runtimeMode } from "../support/env.ts";
 import { appKeyStrengthWarning } from "../support/appKey.ts";
 import { runBootDoctor } from "./BootDoctor.ts";
 import { runConfigValidators } from "../config/validation.ts";
@@ -254,6 +255,8 @@ export async function _lazyStaticResponse(
 
 /** Minimal WebSocket handler shape accepted by Bun.serve(). */
 export interface WebSocketHandlers {
+  /** Seconds a connection may go quiet before Bun closes it. Bun's default is 10. */
+  idleTimeout?: number;
   open?(ws: unknown): void;
   message(ws: unknown, message: string | Uint8Array): void;
   close?(ws: unknown, code: number, reason: string): void;
@@ -501,8 +504,12 @@ export class Application {
       );
     }
 
-    // eslint-disable-next-line no-restricted-syntax -- runtime mode is exactly what Application.create() wants; _normaliseEnv maps deployment names onto it
-    const rawEnv = options.env ?? Bun.env["APP_ENV"] ?? "web";
+    // The runtime mode, which is what provider filtering is keyed on. Reading
+    // `APP_ENV` here used to be right only because `setAppEnv()` had overwritten
+    // it with the mode; now the mode has its own variable and this asks for it
+    // directly. `_normaliseEnv` still maps a deployment name onto a mode, for an
+    // explicit `options.env`.
+    const rawEnv = options.env ?? runtimeMode("web");
     const resolvedEnv: Environment = _normaliseEnv(rawEnv);
 
     const app = new Application();
@@ -1068,6 +1075,17 @@ export class Application {
     };
 
     return {
+      // Bun closes an idle WebSocket after 10 seconds by default, and the client
+      // pings every 30 — so a connection that is merely *quiet* was being cut
+      // before it ever had reason to speak, taking its channel subscriptions
+      // with it. Nothing surfaced: the page stayed rendered, the client kept its
+      // channel objects, and broadcasts simply stopped arriving for anyone who
+      // had been reading for more than ten seconds.
+      //
+      // 120s leaves room for four missed pings before a genuinely dead socket is
+      // reaped, which is the direction to err: a stale connection costs memory,
+      // a reaped live one costs the feature.
+      idleTimeout: 120,
       open: (ws: unknown) => {
         if ((ws as AnyWS).data._dev) {
           DevWsServer.open(ws as AnyWS);
@@ -1213,6 +1231,21 @@ export class Application {
       await this._loadFileRoutes();
     }
 
+    // Install the route table for `zerotal/routes`, now that every route is
+    // registered.
+    //
+    // That module is the standalone URL builder a browser bundle imports, so it
+    // cannot reach for `Router` itself — importing the router would drag the
+    // server into every client bundle. The dependency therefore points this way:
+    // the server, which already has both, pushes the table in.
+    //
+    // Without this, `route()` threw on the server for any app that renders its
+    // own markup — a `view` build produces every href and form action there —
+    // and the fix was a `defineRoutes()` call each app had to know to write.
+    // A browser entry still calls it; that is a different process with no router
+    // to read. See T24.
+    this._installRouteTable();
+
     // A routes/ directory nobody routed is a silent 404 for every path in it — the file
     // imports cleanly and registers nothing, which looks identical to a typo'd URL.
     this._warnUnroutedRoutesDir(process.cwd());
@@ -1266,6 +1299,23 @@ export class Application {
     if (warning) frameworkLog("app").warn(warning);
   }
 
+  /**
+   * Hand the registered routes to the standalone `route()` builder.
+   *
+   * Name → pattern for the URLs, and name → verb for `action()`. `RouteDefinition`
+   * carries its own `name` beside `method`, so the pair comes from one record —
+   * a path join would be wrong, since `GET /login` and `POST /login` share a path.
+   */
+  private _installRouteTable(): void {
+    const methods = new Map<string, string>();
+    for (const definition of Router.routes.values()) {
+      if (definition.name) methods.set(definition.name, definition.method);
+    }
+
+    defineRoutes(Router.namedRoutes);
+    defineRouteMethods(Object.fromEntries(methods));
+  }
+
   private async _loadFileRoutes(): Promise<void> {
     for (const { dir, prefix, middleware } of this._fileRouteGroups) {
       await Router.groupAsync({ prefix, middleware }, () => scanFileRoutes(dir).then(() => {}));

package/src/command/builtin/MakeCommandCommand.ts

@@ -14,8 +14,8 @@ export function toKebab(name: string): string {
 
 /** Source for a new CLI command class extending `Command`. */
 export function commandStub(name: string): string {
-  return `import { Command } from '@zerotal/core';
-import type { ArgDef, FlagDef } from '@zerotal/core';
+  return `import { Command } from 'zerotal';
+import type { ArgDef, FlagDef } from 'zerotal';
 
 export class ${name} extends Command {
   static commandName = '${toKebab(name)}';

package/src/command/builtin/MakeControllerCommand.ts

@@ -5,7 +5,7 @@ import { Command } from "../Command.ts";
 
 /** Source for a minimal controller with a single `index` action. */
 export function basicStub(name: string): string {
-  return `import type { HttpContext } from '@zerotal/core';
+  return `import type { HttpContext } from 'zerotal';
 
 export class ${name} {
   async index(ctx: HttpContext): Promise<void> {
@@ -17,7 +17,7 @@ export class ${name} {
 
 /** Source for a resourceful controller with full CRUD action stubs. */
 export function resourceStub(name: string): string {
-  return `import type { HttpContext } from '@zerotal/core';
+  return `import type { HttpContext } from 'zerotal';
 
 export class ${name} {
   async index(ctx: HttpContext): Promise<void> {

package/src/command/builtin/MakeJobCommand.ts

@@ -27,7 +27,7 @@ export class MakeJobCommand extends Command {
     }
     await Bun.write(
       path,
-      `import { Job, JobRegistry } from '@zerotal/queue';
+      `import { Job, JobRegistry } from 'zerotal/queue';
 
 export class ${name} extends Job {
   readonly queue = 'default';

package/src/command/builtin/MakeMiddlewareCommand.ts

@@ -5,7 +5,7 @@ import { Command } from "../Command.ts";
 
 /** Source for a pass-through middleware class implementing `Pipe<HttpContext>`. */
 export function middlewareStub(name: string): string {
-  return `import type { HttpContext, Pipe, NextFn } from '@zerotal/core';
+  return `import type { HttpContext, Pipe, NextFn } from 'zerotal';
 
 export class ${name} implements Pipe<HttpContext> {
   async handle(ctx: HttpContext, next: NextFn): Promise<Response | void> {

package/src/command/builtin/MakeObserverCommand.ts

@@ -47,7 +47,7 @@ export class MakeObserverCommand extends Command {
 }
 
 function _stub(name: string, model: string): string {
-  return `import type { ModelObserver } from '@zerotal/orm';
+  return `import type { ModelObserver } from 'zerotal/orm';
 
 export class ${name} implements ModelObserver {
   creating(${model.toLowerCase()}: Record<string, unknown>): void {

package/src/command/builtin/MakePolicyCommand.ts

@@ -41,7 +41,7 @@ export class MakePolicyCommand extends Command {
 
 /** Source for a new authorization policy class extending `Policy`. */
 export function policyStub(name: string, model: string): string {
-  return `import { Policy } from '@zerotal/auth';
+  return `import { Policy } from 'zerotal/auth';
 // import type { ${model} } from '../models/${model}.ts';
 // import type { User } from '../models/User.ts';
 

package/src/command/builtin/MakeProviderCommand.ts

@@ -6,7 +6,7 @@ import { Command } from "../Command.ts";
 import { registerProvider } from "../../build/codemod.ts";
 
 function providerStub(name: string): string {
-  return `import { ServiceProvider } from '@zerotal/core';
+  return `import { ServiceProvider } from 'zerotal';
 
 export class ${name} extends ServiceProvider {
   override onRegister(): void {

package/src/command/builtin/MakeRequestCommand.ts

@@ -31,13 +31,23 @@ export class MakeRequestCommand extends Command {
   }
 }
 
+// Two things this stub deliberately does not do.
+//
+// It imports from `zerotal/validator`, not `@zerotal/validator`: a scaffolded app
+// depends on the umbrella, so the scoped name resolves to nothing and the file it
+// just generated does not compile.
+//
+// And it leaves `rules()` unannotated. `validate()` reads the narrow return type
+// through `ReturnType<T['rules']>`, so writing `Record<string, FieldRule>` there
+// widens it back and every validated field arrives as `unknown` — silently, with
+// the first sign a cast somewhere downstream. `FormRequest`'s own docblock says
+// so; the generator used to emit exactly what it warns against.
 function stub(name: string): string {
-  return `import { FormRequest } from '@zerotal/validator';
-import type { RuleBuilder }  from '@zerotal/validator';
-import type { FieldRule }    from '@zerotal/validator';
+  return `import { FormRequest } from 'zerotal/validator';
+import type { RuleBuilder } from 'zerotal/validator';
 
 export class ${name} extends FormRequest {
-  rules(r: RuleBuilder): Record<string, FieldRule> {
+  rules(r: RuleBuilder) {
     return {
       // example: title: r.string().min(3).max(255),
     };

package/src/command/builtin/MakeResourceCommand.ts

@@ -35,8 +35,8 @@ export class MakeResourceCommand extends Command {
 function _stub(name: string): string {
   const model = name.replace(/Resource$/, "");
   const snake = model.replace(/([A-Z])/g, (char, index) => (index ? "-" : "") + char.toLowerCase());
-  return `import { Resource, ResourceCollection } from '@zerotal/core';
-import type { PaginatedData } from '@zerotal/core';
+  return `import { Resource, ResourceCollection } from 'zerotal/http';
+import type { PaginatedData } from 'zerotal/http';
 
 export class ${name} extends Resource<${model}> {
   toArray(): Record<string, unknown> {

package/src/command/builtin/MakeTestCommand.ts

@@ -11,8 +11,8 @@ export function featureTestStub(name: string): string {
   // edit rather than one you have to rewrite.
   const resource = pluralize(subject.toLowerCase());
   return `import { describe, it, beforeAll, afterAll } from 'bun:test';
-import { migrateDatabase, refreshDatabase, assertDatabaseHas } from '@zerotal/testing';
-import type { TestApp } from '@zerotal/testing';
+import { migrateDatabase, refreshDatabase, assertDatabaseHas } from 'zerotal/testing';
+import type { TestApp } from 'zerotal/testing';
 import { createApp } from '../helpers.ts';
 
 let app: TestApp;

package/src/command/builtin/RouteTypesCommand.ts

@@ -34,6 +34,7 @@ export class RouteTypesCommand extends Command {
 
   async run(): Promise<void> {
     const check = this.flags["check"] as boolean;
+
     const result = await writeRouteTypes(Router.namedRoutes, { check });
 
     if (check) {