arkos 1.4.9-beta → 1.4.10-beta

package/dist/esm/utils/setup-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-app.js","sourceRoot":"","sources":["../../../src/utils/setup-app.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,SAAS,MAAM,oBAAoB,CAAC;AAC3C,OAAO,SAAS,MAAM,4BAA4B,CAAC;AACnD,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,YAAY,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,eAAe,MAAM,sCAAsC,CAAC;AAEnE,MAAM,CAAC,OAAO,UAAU,QAAQ,CAAC,GAAU;IACzC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAEhC,MAAM,iBAAiB,GAAG,MAAM,EAAE,WAAW,CAAC;IAE9C,IAAI,iBAAiB,EAAE,WAAW,KAAK,KAAK,EAAE,CAAC;QAC7C,IAAI,OAAO,iBAAiB,EAAE,WAAW,KAAK,UAAU,EAAE,CAAC;YACzD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,EAAE,SAAS,KAAK,KAAK,EAAE,CAAC;QAC3C,IAAI,OAAO,iBAAiB,EAAE,SAAS,KAAK,UAAU,EAAE,CAAC;YACvD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CACL,SAAS,CACP,SAAS,CACP;gBACE,QAAQ,EAAE,EAAE,GAAG,IAAI;gBACnB,KAAK,EAAE,GAAG;gBACV,eAAe,EAAE,SAAS;gBAC1B,aAAa,EAAE,KAAK;gBACpB,OAAO,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;oBAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;wBACnB,OAAO,EAAE,2CAA2C;qBACrD,CAAC,CAAC;gBACL,CAAC;aACF,EACD,iBAAiB,EAAE,SAAS,IAAI,EAAE,CACnC,CACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;QACtC,IAAI,OAAO,iBAAiB,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;YAClD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CACL,IAAI,CACF,iBAAiB,EAAE,IAAI,EAAE,aAAa;gBACpC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa;gBACtC,CAAC,CAAC,SAAS,CACP;oBACE,MAAM,EAAE,CACN,MAAc,EACd,EAAgD,EAChD,EAAE;wBACF,MAAM,OAAO,GAAI,iBAAiB,EAAE,IAAY;4BAC9C,EAAE,cAAc,CAAC;wBAEnB,IAAI,OAAO,KAAK,GAAG;4BAAE,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;6BAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;4BAC7B,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;6BAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ;4BAClC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC;;4BACrC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;oBACvB,CAAC;oBAED,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;oBAC7D,cAAc,EAAE;wBACd,cAAc;wBACd,eAAe;wBACf,YAAY;qBACb;oBACD,WAAW,EAAE,IAAI;iBAClB,EACD,iBAAiB,EAAE,IAAI,EAAE,OAAO,IAAI,EAAE,CACvC,CACN,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,EAAE,WAAW,KAAK,KAAK,EAAE,CAAC;QAC7C,IAAI,OAAO,iBAAiB,EAAE,WAAW,KAAK,UAAU,EAAE,CAAC;YACzD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,EAAE,YAAY,KAAK,KAAK,EAAE,CAAC;QAC9C,IAAI,OAAO,iBAAiB,EAAE,YAAY,KAAK,UAAU,EAAE,CAAC;YAC1D,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;QAC1C,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC;gBAC3D,CAAC,CAAC,iBAAiB,CAAC,YAAY;gBAChC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAI,MAAc,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,EAAE,WAAW,KAAK,KAAK,EAAE,CAAC;QAC7C,IAAI,OAAO,iBAAiB,EAAE,WAAW,KAAK,UAAU,EAAE,CAAC;YACzD,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CACL,WAAW,CACT,SAAS,CACP;gBACE,SAAS,EAAE,IAAI;gBACf,cAAc,EAAE,IAAI;gBACpB,YAAY,EAAE,IAAI;gBAClB,WAAW,EAAE,IAAI;aAClB,EACD,iBAAiB,EAAE,WAAW,IAAI,EAAE,CACrC,CACF,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,EAAE,aAAa,KAAK,KAAK,EAAE,CAAC;QAC/C,IAAI,OAAO,iBAAiB,EAAE,aAAa,KAAK,UAAU,EAAE,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC;IAExC,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["import compression from \"compression\";\nimport { Arkos } from \"../types/arkos\";\nimport { getArkosConfig } from \"./helpers/arkos-config.helpers\";\nimport rateLimit from \"express-rate-limit\";\nimport deepmerge from \"./helpers/deepmerge.helper\";\nimport cors from \"cors\";\nimport express from \"express\";\nimport cookieParser from \"cookie-parser\";\nimport { queryParser } from \"./helpers/query-parser.helpers\";\nimport { handleRequestLogs } from \"../modules/base/base.middlewares\";\nimport debuggerService from \"../modules/debugger/debugger.service\";\n\nexport default function setupApp(app: Arkos) {\n  const config = getArkosConfig();\n\n  const middlewaresConfig = config?.middlewares;\n\n  if (middlewaresConfig?.compression !== false) {\n    if (typeof middlewaresConfig?.compression === \"function\") {\n      app.use(middlewaresConfig.compression);\n    } else {\n      app.use(compression(middlewaresConfig?.compression || {}));\n    }\n  }\n\n  if (middlewaresConfig?.rateLimit !== false) {\n    if (typeof middlewaresConfig?.rateLimit === \"function\") {\n      app.use(middlewaresConfig.rateLimit);\n    } else {\n      app.use(\n        rateLimit(\n          deepmerge(\n            {\n              windowMs: 60 * 1000,\n              limit: 300,\n              standardHeaders: \"draft-7\",\n              legacyHeaders: false,\n              handler: (_, res) => {\n                res.status(429).json({\n                  message: \"Too many requests, please try again later\",\n                });\n              },\n            },\n            middlewaresConfig?.rateLimit || {}\n          )\n        )\n      );\n    }\n  }\n\n  if (middlewaresConfig?.cors !== false) {\n    if (typeof middlewaresConfig?.cors === \"function\") {\n      app.use(middlewaresConfig.cors);\n    } else {\n      app.use(\n        cors(\n          middlewaresConfig?.cors?.customHandler\n            ? middlewaresConfig.cors.customHandler\n            : deepmerge(\n                {\n                  origin: (\n                    origin: string,\n                    cb: (err: Error | null, allow?: boolean) => void\n                  ) => {\n                    const allowed = (middlewaresConfig?.cors as any)\n                      ?.allowedOrigins;\n\n                    if (allowed === \"*\") cb(null, true);\n                    else if (Array.isArray(allowed))\n                      cb(null, !origin || allowed?.includes?.(origin));\n                    else if (typeof allowed === \"string\")\n                      cb(null, !origin || allowed === origin);\n                    else cb(null, false);\n                  },\n\n                  methods: [\"GET\", \"POST\", \"PUT\", \"DELETE\", \"PATCH\", \"OPTIONS\"],\n                  allowedHeaders: [\n                    \"Content-Type\",\n                    \"Authorization\",\n                    \"Connection\",\n                  ],\n                  credentials: true,\n                },\n                middlewaresConfig?.cors?.options || {}\n              )\n        )\n      );\n    }\n  }\n\n  if (middlewaresConfig?.expressJson !== false) {\n    if (typeof middlewaresConfig?.expressJson === \"function\") {\n      app.use(middlewaresConfig.expressJson);\n    } else {\n      app.use(express.json(middlewaresConfig?.expressJson || {}));\n    }\n  }\n\n  if (middlewaresConfig?.cookieParser !== false) {\n    if (typeof middlewaresConfig?.cookieParser === \"function\") {\n      app.use(middlewaresConfig.cookieParser);\n    } else {\n      const params = Array.isArray(middlewaresConfig?.cookieParser)\n        ? middlewaresConfig.cookieParser\n        : [];\n      app.use(cookieParser(...(params as any))); // FIXME: check types correctly\n    }\n  }\n\n  if (middlewaresConfig?.queryParser !== false) {\n    if (typeof middlewaresConfig?.queryParser === \"function\") {\n      app.use(middlewaresConfig.queryParser);\n    } else {\n      app.use(\n        queryParser(\n          deepmerge(\n            {\n              parseNull: true,\n              parseUndefined: true,\n              parseBoolean: true,\n              parseNumber: true,\n            },\n            middlewaresConfig?.queryParser || {}\n          )\n        )\n      );\n    }\n  }\n\n  if (middlewaresConfig?.requestLogger !== false) {\n    if (typeof middlewaresConfig?.requestLogger === \"function\") {\n      app.use(middlewaresConfig.requestLogger);\n    } else {\n      app.use(handleRequestLogs);\n    }\n  }\n\n  app.use(debuggerService.logRequestInfo);\n\n  return app;\n}\n"]}

package/dist/types/components/arkos-policy/index.d.ts

@@ -0,0 +1,31 @@
+import { IArkosPolicy } from "./types";
+/**
+ * Creates a typed policy for a Prisma model resource.
+ *
+ * Each `.rule()` call registers an action and returns the policy
+ * with a typed `can{Action}` permission checker and a typed `{Action}`
+ * entry — both passable to the `authentication` field on `ArkosRouteHook`
+ * and `ArkosRouter`, and callable for fine-grained permission checks.
+ *
+ * @param resource - The resource name in kebab-case (e.g. `"user"`, `"blog-post"`)
+ *
+ * @example
+ * ```ts
+ * const userPolicy = ArkosPolicy("user")
+ *   .rule("Create", ["Admin", "Editor"])
+ *   .rule("View", "*")
+ *   .rule("Delete", ["Admin"]);
+ *
+ * // Pass to authentication field
+ * userRouter.post({ path: "/users", authentication: userPolicy.Create });
+ * userRouteHook.deleteOne({ authentication: userPolicy.Delete });
+ *
+ * // Fine-grained check
+ * if (userPolicy.canCreate(req.user)) { ... }
+ *
+ * export default userPolicy;
+ * ```
+ *
+ * @see {@link https://www.arkosjs.com/docs/api-referency/arkos-policy}
+ */
+export declare function ArkosPolicy<TResource extends string>(resource: TResource): IArkosPolicy<TResource, never>;

package/dist/types/components/arkos-policy/types.d.ts

@@ -0,0 +1,21 @@
+import { User } from "../../types";
+import { DetailedAccessControlRule } from "../../types/auth";
+export type ArkosPolicyRule = string[] | DetailedAccessControlRule | "*";
+export type PolicyAuthEntry<TResource extends string, TAction extends string> = {
+    readonly resource: TResource;
+    readonly action: TAction;
+    readonly rule: ArkosPolicyRule;
+};
+export type PolicyChecker = (user?: User) => Promise<boolean>;
+type CanKey<TAction extends string> = `can${Capitalize<TAction>}`;
+export type PolicyWithActions<TResource extends string, TActions extends string> = IArkosPolicy<TResource, TActions> & {
+    [K in TActions]: PolicyAuthEntry<TResource, K>;
+} & {
+    [K in CanKey<TActions>]: PolicyChecker;
+};
+export interface IArkosPolicy<TResource extends string, TActions extends string = never> {
+    readonly __type: "ArkosPolicy";
+    readonly resource: TResource;
+    rule<TAction extends string>(action: TAction, config?: ArkosPolicyRule): PolicyWithActions<TResource, TActions | TAction>;
+}
+export {};

package/dist/types/exports/config.d.ts

@@ -0,0 +1,2 @@
+import { defineConfig } from "../utils/define-config";
+export { defineConfig };

package/dist/types/modules/file-upload/file-upload.router.d.ts

@@ -1,3 +1,2 @@
-import { Router } from "express";
 import { ArkosConfig } from "../../exports";
-export declare function getFileUploadRouter(arkosConfig: ArkosConfig): Router;
+export declare function getFileUploadRouter(arkosConfig: ArkosConfig): import("../../exports").IArkosRouter;

package/dist/types/modules/swagger/utils/get-open-api-login-html.d.ts

@@ -0,0 +1 @@
+export default function getOpenApiLoginHtml(): string;

package/dist/types/types/arkos-config/utils.d.ts

@@ -0,0 +1,35 @@
+import { ArkosRequest } from "..";
+/**
+ * Context object passed to `before` and `after` auth hooks.
+ */
+export interface AuthHookContext {
+    req: ArkosRequest;
+    /**
+     * Continue to the next hook or core logic.
+     * Call with an error to abort and forward to the global error handler.
+     */
+    next: (err?: unknown) => void;
+    /**
+     * Only available in `before` hooks.
+     * Bypasses core logic and jumps directly to `after` hooks.
+     */
+    skip: () => void;
+}
+/**
+ * Context object passed to `onError` auth hooks.
+ */
+export interface AuthErrorHookContext {
+    req: ArkosRequest;
+    error: unknown;
+    /**
+     * Forward the original or a new error to the global error handler.
+     */
+    next: (err?: unknown) => void;
+    /**
+     * Suppress the error and jump to `after` hooks.
+     */
+    skip: () => void;
+}
+export type AuthHookHandler = (ctx: AuthHookContext) => void | Promise<void>;
+export type AuthAfterHookHandler = (ctx: Omit<AuthHookContext, "skip">) => void | Promise<void>;
+export type AuthErrorHookHandler = (ctx: AuthErrorHookContext) => void | Promise<void>;

package/dist/types/types/arkos.d.ts

@@ -0,0 +1,31 @@
+import { Express } from "express";
+import { IncomingMessage, Server, ServerResponse } from "http";
+import { IArkosRouter } from "../exports";
+type ArkosRouterMethods = "get" | "post" | "put" | "patch" | "delete" | "options" | "head" | "all" | "use" | "trace" | "route";
+export interface Arkos extends Omit<Express, "listen" | ArkosRouterMethods>, Pick<IArkosRouter, ArkosRouterMethods> {
+    (req: IncomingMessage, res: ServerResponse): void;
+    /**
+     * Applies all loaded items to the app by adding them as middleware,
+     * routers, or handlers at the end of the stack.
+     *
+     * This ensures that Arkos internals always run after user middleware/routes.
+     * Automatically called before listen() if not called manually.
+     */
+    build(): Promise<this>;
+    /**
+     * Starts the server using Arkos-managed port and host configuration.
+     * Automatically calls build() if not called manually.
+     *
+     * @param callback Optional callback invoked once server starts
+     */
+    listen(callback?: (error?: Error) => void): Promise<Server>;
+    /**
+     * Starts the server using Arkos-managed port and host configuration.
+     * app.build() must be called before this.
+     *
+     * @param server {Server} - Optional callback invoked once server starts
+     * @param callback Optional callback invoked once server starts
+     */
+    listen(server: Server, callback?: (error?: Error) => void): Promise<Server>;
+}
+export {};

package/dist/types/types/index.d.ts

@@ -1,4 +1,4 @@
-import { ErrorRequestHandler, NextFunction, Request, RequestHandler, Response } from "express";
+import { NextFunction, Request, Response } from "express";
 export type PrismaOperations = "findMany";
 /**
  * Type definition for authentication-related Prisma query operations
@@ -273,8 +273,6 @@ export interface ArkosResponse<ResBody = any, Locals extends Record<string, any>
 }
 export interface ArkosNextFunction extends NextFunction {
 }
-export interface ArkosRequestHandler<P extends Record<string, any> = any, ResBody = any, ReqBody = any, ReqQuery = qs.ParsedQs, Locals extends Record<string, any> = Record<string, any>> extends RequestHandler<P, ResBody, ReqBody, ReqQuery, Locals> {
-}
-export interface ArkosErrorRequestHandler<P extends Record<string, any> = any, ResBody = any, ReqBody = any, ReqQuery = qs.ParsedQs, Locals extends Record<string, any> = Record<string, any>> extends ErrorRequestHandler<P, ResBody, ReqBody, ReqQuery, Locals> {
-}
+export type ArkosRequestHandler<P extends Record<string, any> = any, ResBody = any, ReqBody = any, ReqQuery extends Record<string, any> = any, Locals extends Record<string, any> = Record<string, any>> = (req: ArkosRequest<P, ResBody, ReqBody, ReqQuery>, res: ArkosResponse<ResBody, Locals>, next: ArkosNextFunction) => void | Promise<void>;
+export type ArkosErrorRequestHandler<P extends Record<string, any> = any, ResBody = any, ReqBody = any, ReqQuery extends Record<string, any> = any, Locals extends Record<string, any> = Record<string, any>> = (err: any, req: ArkosRequest<P, ResBody, ReqBody, ReqQuery>, res: ArkosResponse<ResBody, Locals>, next: ArkosNextFunction) => void | Promise<void>;
 export {};

package/dist/types/utils/arkos-router/types/index.d.ts

@@ -1,5 +1,5 @@
-import { IRoute, IRouter } from "express";
-import { ZodSchema } from "zod";
+import { IRoute, IRouter, Locals } from "express";
+import { z, ZodSchema } from "zod";
 import { Options as RateLimitOptions } from "express-rate-limit";
 import { Options as QueryParserOptions } from "../../../utils/helpers/query-parser.helpers";
 import { DetailedAccessControlRule } from "../../../types/auth";
@@ -8,6 +8,7 @@ import compression from "compression";
 import { OpenApiConfig } from "./openapi-config";
 import { UploadConfig } from "./upload-config";
 import { BodyParserConfig } from "./body-parser-config";
+type InferValidationType<T, Fallback> = T extends ZodSchema ? z.infer<T> : T extends new (...args: any[]) => infer I ? I : Fallback;
 export type PathParams = string | RegExp | Array<string | RegExp>;
 export type ArkosAnyRequestHandler = ArkosRequestHandler | ArkosErrorRequestHandler | Array<ArkosRequestHandler | ArkosErrorRequestHandler>;
 /**
@@ -17,9 +18,17 @@ export type ArkosAnyRequestHandler = ArkosRequestHandler | ArkosErrorRequestHand
  * @param {...(ArkosRequestHandler | ArkosErrorRequestHandler)[]} handlers - Request and error handlers for the route.
  * @returns {IRouter} The Express router instance.
  */
-type RouterMethodHandler<T> = (config: ArkosRouteConfig | PathParams, ...handlers: Array<ArkosAnyRequestHandler>) => T;
-export type ArkosRouteMethodHandler<T> = (config: ArkosAnyRequestHandler | Omit<ArkosRouteConfig, "path">, ...handlers: Array<ArkosRequestHandler | ArkosErrorRequestHandler | Array<ArkosRequestHandler | ArkosErrorRequestHandler>>) => T;
-export interface ArkosIRoute extends IRoute {
+type RouterMethodHandler<T> = {
+    (config: PathParams, ...handlers: Array<ArkosAnyRequestHandler>): T;
+    <TQuery extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any, TBody extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any, TParams extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any>(config: ArkosRouteConfig<TQuery, TBody, TParams> | PathParams, ...handlers: Array<ArkosRequestHandler<InferValidationType<TParams, Record<string, string>>, any, InferValidationType<TBody, any>, InferValidationType<TQuery, qs.ParsedQs>, any> | Array<ArkosRequestHandler<InferValidationType<TParams, Record<string, string>>, any, InferValidationType<TBody, any>, InferValidationType<TQuery, qs.ParsedQs>, any>>>): T;
+    <TQuery extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any, TBody extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any, TParams extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any>(config: ArkosRouteConfig<TQuery, TBody, TParams> | PathParams, ...handlers: Array<ArkosErrorRequestHandler<InferValidationType<TParams, Record<string, string>>, any, InferValidationType<TBody, any>, InferValidationType<TQuery, qs.ParsedQs>, any> | Array<ArkosErrorRequestHandler<InferValidationType<TParams, Record<string, string>>, any, InferValidationType<TBody, any>, InferValidationType<TQuery, qs.ParsedQs>, any>>>): T;
+};
+export type ArkosRouteMethodHandler<T> = {
+    (config: ArkosAnyRequestHandler | Omit<ArkosRouteConfig, "path">, ...handlers: Array<ArkosRequestHandler | ArkosErrorRequestHandler | Array<ArkosRequestHandler | ArkosErrorRequestHandler>>): T;
+    <TQuery extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any, TBody extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any, TParams extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any>(config: Omit<ArkosRouteConfig<TQuery, TBody, TParams>, "path">, ...handlers: Array<ArkosRequestHandler<InferValidationType<TParams, Record<string, string>>, any, InferValidationType<TBody, any>, InferValidationType<TQuery, qs.ParsedQs>, Locals> | Array<ArkosRequestHandler<InferValidationType<TParams, Record<string, string>>, any, InferValidationType<TBody, any>, InferValidationType<TQuery, qs.ParsedQs>, Locals>>>): T;
+    <TQuery extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any, TBody extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any, TParams extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any>(config: Omit<ArkosRouteConfig<TQuery, TBody, TParams>, "path">, ...handlers: Array<ArkosErrorRequestHandler<InferValidationType<TParams, Record<string, string>>, any, InferValidationType<TBody, any>, InferValidationType<TQuery, qs.ParsedQs>, Locals> | Array<ArkosErrorRequestHandler<InferValidationType<TParams, Record<string, string>>, any, InferValidationType<TBody, any>, InferValidationType<TQuery, qs.ParsedQs>, Locals>>>): T;
+};
+export interface IArkosRoute extends IRoute {
     /** GET method handler with route configuration support */
     get: ArkosRouteMethodHandler<this>;
     /** POST method handler with route configuration support */
@@ -80,13 +89,13 @@ export interface IArkosRouter extends IRouter {
     trace: RouterMethodHandler<this>;
     /** ALL methods handler with route configuration support */
     all: RouterMethodHandler<this>;
-    route<T extends string>(prefix: T): ArkosIRoute;
-    route(prefix: PathParams): ArkosIRoute;
+    route<T extends string>(prefix: T): IArkosRoute;
+    route(prefix: PathParams): IArkosRoute;
 }
 /**
  * Configuration object for defining routes in Arkos.js.
  */
-export type ArkosRouteConfig = {
+export type ArkosRouteConfig<TQuery extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any, TBody extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any, TParams extends ZodSchema | (new (...args: any[]) => object) | false | undefined = any> = {
     /**
      * Disables the route by not mounting it internally.
      */
@@ -119,9 +128,9 @@ export type ArkosRouteConfig = {
      * - Each property accepts a Zod schema, a class constructor, or `false` to disable validation for that part.
      */
     validation?: false | {
-        query?: ZodSchema | (new (...args: any[]) => object) | false;
-        body?: ZodSchema | (new (...args: any[]) => object) | false;
-        params?: ZodSchema | (new (...args: any[]) => object) | false;
+        query?: TQuery;
+        body?: TBody;
+        params?: TParams;
     };
     /**
      * Rate limiting configuration for this route.

package/dist/types/utils/arkos-router/utils/helpers/apply-arkos-router-proxy.d.ts

@@ -0,0 +1,7 @@
+import { RouterOptions } from "express";
+export declare function applyArkosRouterProxy<T extends object>(target: T, options?: RouterOptions & {
+    prefix?: string | RegExp | Array<string | RegExp>;
+    openapi?: {
+        tags?: string[];
+    };
+}, name?: "app" | "ArkosRouter()"): T;

package/dist/types/utils/bundler.d.ts

@@ -0,0 +1,152 @@
+/**
+ * Options for configuring a bundle run.
+ */
+interface BundlerOptions {
+    /** Output file extension: ".js" | ".cjs" | ".mjs" */
+    ext: string;
+    /** Directory containing the compiled output files to process */
+    outDir: string;
+    /** Source root directory used to resolve tsconfig paths. Defaults to process.cwd() */
+    rootDir?: string;
+    /** Explicit path to tsconfig.json or jsconfig.json. Auto-detected from rootDir if omitted */
+    configPath?: string;
+}
+/**
+ * Post-compilation import rewriter and alias resolver.
+ *
+ * Recursively processes all `.js`, `.cjs`, and `.mjs` files in the output
+ * directory, rewriting:
+ * - Relative imports to include the correct file extension
+ * - Directory imports to use `/index.ext`
+ * - Path aliases defined in tsconfig/jsconfig `paths` to relative paths
+ *
+ * Bare node_modules specifiers (e.g. `"express"`, `"@prisma/client"`) are
+ * left untouched.
+ *
+ * @example
+ * ```ts
+ * const bundler = new Bundler();
+ *
+ * bundler.bundle({
+ *   ext: ".js",
+ *   outDir: "./dist",
+ *   rootDir: "./",
+ *   configPath: "./tsconfig.json",
+ * });
+ * ```
+ */
+export declare class Bundler {
+    /**
+     * Regexes for matching all import/export/require statement forms.
+     * Defined as static to avoid recreation per file processed.
+     */
+    private static readonly IMPORT_REGEXES;
+    /**
+     * Pre-compiles path alias patterns into a lookup-friendly structure
+     * so alias matching during processing is O(n) over aliases rather than
+     * re-parsing patterns per import.
+     */
+    private compileAliases;
+    /**
+     * Loads and parses the tsconfig/jsconfig file, resolving any `extends` chain.
+     * Falls back to `{ baseUrl: rootDir, paths: {} }` if no config is found.
+     *
+     * @param rootDir - Absolute root directory
+     * @param configPath - Explicit config path, or undefined to auto-detect
+     */
+    private loadConfig;
+    /**
+     * Searches for a tsconfig.json or jsconfig.json in the given directory.
+     * Prefers tsconfig.json over jsconfig.json.
+     *
+     * @param dir - Directory to search in
+     * @returns Absolute path to the config file, or null if not found
+     */
+    private findConfig;
+    /**
+     * Recursively parses a tsconfig/jsconfig file, following `extends` chains
+     * and merging `paths` with child config taking precedence over parent.
+     *
+     * @param configPath - Absolute path to the config file to parse
+     * @param rootDir - Absolute root directory used as fallback baseUrl
+     */
+    private parseConfig;
+    /**
+     * Resolves a tsconfig `extends` value that points to a node_modules package,
+     * e.g. `"@tsconfig/node18/tsconfig.json"`.
+     *
+     * @param extendsValue - The raw extends string from tsconfig
+     * @param rootDir - Root directory to resolve from
+     * @returns Absolute path to the resolved config file, or null if not found
+     */
+    private resolveNodeModulesConfig;
+    /**
+     * Reads a JSON file that may contain comments and trailing commas
+     * (as tsconfig/jsconfig files allow) and returns the parsed object.
+     *
+     * @param filePath - Absolute path to the JSON file
+     * @returns Parsed object, or empty object if parsing fails
+     */
+    private readJsonWithComments;
+    /**
+     * Resolves a single import path to its final rewritten form.
+     *
+     * Resolution order:
+     * 1. Relative imports (`./`, `../`) — extension is added via `addExtension`
+     * 2. Aliased imports — matched against compiled aliases and converted to relative paths
+     * 3. Bare specifiers (`express`, `@prisma/client`) — returned untouched
+     *
+     * @param importPath - The raw import string from source code
+     * @param fileDir - Absolute directory of the file containing the import
+     * @param ext - The output file extension
+     * @param resolvedPaths - Resolved baseUrl and paths from tsconfig
+     * @param compiledAliases - Pre-compiled alias entries
+     */
+    private resolveImport;
+    private getFileDirInSource;
+    /**
+     * Appends the configured extension to an import path if not already present.
+     * If the path resolves to a directory containing an `index` file, appends
+     * `/index.ext` instead.
+     *
+     * @param importPath - The relative import path to fix
+     * @param fileDir - Absolute directory of the file containing the import
+     * @param ext - The output file extension
+     */
+    private addExtension;
+    /**
+     * Converts an absolute path to a relative path from a given directory,
+     * ensuring the result always starts with `./` or `../`.
+     *
+     * @param fromDir - The directory to compute the relative path from
+     * @param toPath - The absolute target path
+     * @returns A POSIX-style relative path
+     */
+    private toRelative;
+    /**
+     * Rewrites all import/export/require statements in a string of JS source code.
+     * Each regex is reset before use since they are stateful with the `/g` flag.
+     *
+     * @param content - Raw file content to process
+     * @param fileDir - Absolute directory of the file being processed
+     * @param ext - The output file extension
+     * @param resolvedPaths - Resolved baseUrl and paths from tsconfig
+     * @param compiledAliases - Pre-compiled alias entries
+     */
+    private rewriteImports;
+    /**
+     * Recursively processes all `.js`, `.cjs`, and `.mjs` files in the output
+     * directory, rewriting imports in-place. Files whose content is unchanged
+     * are not written back to disk.
+     *
+     * @param options - Configuration options for this bundle run
+     */
+    bundle(options: BundlerOptions): void;
+    /**
+     * Internal recursive directory walker, separated so that `bundle()` only
+     * resolves config once at the top level rather than on every recursion.
+     */
+    private _bundleDir;
+}
+export declare const bundler: Bundler;
+export {};

package/dist/types/utils/cli/utils/template-generator/templates/policy-template.d.ts

@@ -0,0 +1,2 @@
+import { TemplateOptions } from "../../template-generators";
+export declare function generatePolicyTemplate(options: TemplateOptions): string;

package/dist/types/utils/helpers/exit-error.d.ts

@@ -0,0 +1 @@
+export default function ExitError(message: any, code?: number): void;

package/dist/types/utils/helpers/routers.helpers.d.ts

@@ -1,5 +1,5 @@
 import { AuthConfigs } from "../../types/auth";
-import { AuthRouterEndpoint, RouterConfig, RouterEndpoint } from "../../types/router-config";
+import { AuthRouterEndpoint, FileUploadRouterEndpoint, RouterConfig, RouterEndpoint } from "../../types/router-config";
 import { ArkosRouteConfig } from "../arkos-router/types";
 import { ArkosConfig } from "../../exports";
 export declare const safeCatchAsync: (middleware: any, options?: {
@@ -8,7 +8,7 @@ export declare const safeCatchAsync: (middleware: any, options?: {
 export declare const processMiddleware: (middleware: any, options?: {
     type: "error" | "normal";
 }) => any[];
-export declare function getAuthenticationConfig(endpoint: RouterEndpoint | AuthRouterEndpoint, modelName: string, authConfigs?: AuthConfigs): boolean | {
+export declare function getAuthenticationConfig(endpoint: RouterEndpoint | AuthRouterEndpoint | FileUploadRouterEndpoint, modelName: string, authConfigs?: AuthConfigs): boolean | {
     resource: string;
     action: string;
     rule: string[] | import("../../types/auth").DetailedAccessControlRule | undefined;
@@ -24,4 +24,4 @@ export declare function getAuthenticationConfig(endpoint: RouterEndpoint | AuthR
  * @param validationSchema - Optional validation schema for the endpoint
  * @returns Route configuration object
  */
-export declare function createRouteConfig(arkosConfig: ArkosConfig, endpoint: RouterEndpoint | AuthRouterEndpoint, routeName: string, path: string, routerConfig: RouterConfig<any>, modelNameInKebab: string, authConfigs: any, validationSchema?: any): ArkosRouteConfig;
+export declare function createRouteConfig(arkosConfig: ArkosConfig, endpoint: RouterEndpoint | AuthRouterEndpoint | FileUploadRouterEndpoint, routeName: string, path: string, routerConfig: RouterConfig<any>, modelNameInKebab: string, authConfigs: any, validationSchema?: any): ArkosRouteConfig;

package/dist/types/utils/initialize-app.d.ts

@@ -0,0 +1,2 @@
+import { Arkos } from "../types/arkos";
+export default function initializeApp(app: Arkos): Arkos;

package/dist/types/utils/setup-app.d.ts

@@ -0,0 +1,2 @@
+import { Arkos } from "../types/arkos";
+export default function setupApp(app: Arkos): Arkos;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkos",
-  "version": "1.4.9-beta",
+  "version": "1.4.10-beta",
   "description": "The Express & Prisma RESTful Framework",
   "main": "dist/cjs/exports/index.js",
   "module": "dist/esm/exports/index.js",

package/dist/cjs/types/arkos-prisma-input.bak.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"arkos-prisma-input.bak.js","sourceRoot":"","sources":["../../../src/types/arkos-prisma-input.bak.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Helper type to exclude properties from T that exist in U\n * Used internally by XOR to create mutually exclusive types\n */\ntype Without<T, U> = {\n  [P in Exclude<keyof T, keyof U>]?: never;\n};\n/**\n * XOR (Exclusive OR) type for mutually exclusive union types\n * Ensures that properties from T and U cannot be mixed together\n * @see https://stackoverflow.com/questions/42123407/does-typescript-support-mutually-exclusive-types\n */\ntype XOR<T, U> = T extends object\n  ? U extends object\n    ? (Without<T, U> & U) | (Without<U, T> & T)\n    : U\n  : T;\n/**\n * Extract type from Prisma's Enumerable wrapper\n * Currently acts as identity but can be extended to handle array unwrapping\n */\n// type Unpack<T> = T extends Array<infer U> ? U : T extends (infer U)[] ? U : T;\ntype Unpack<T> = T;\n/**\n * Checks if a field is a Prisma relation field\n * A field is considered a relation if it has any of: create, connect, connectOrCreate, update, delete, disconnect\n * Handles optional fields by excluding undefined before checking\n * @template T - The type to check\n * @returns true if T is a relation field, false otherwise\n */\nexport type IsRelationField<T> =\n  Exclude<T, undefined> extends\n    | {\n        create?: { id?: any } | { id?: any }[];\n      }\n    | {\n        connect?: { id?: any } | { id?: any }[];\n      }\n    | {\n        update?: { where?: { id?: any }; data?: any };\n      }\n    | {\n        delete?: { where?: { id?: any } };\n      }\n    | {\n        disconnect?: { where?: { id?: any } };\n      }\n    ? true\n    : false;\n\n/**\n * Checks if a Prisma relation field is an array/many relation\n * Detects relations that support multiple records (one-to-many or many-to-many)\n * @template T - The relation field type\n * @returns true if it's an array relation, false otherwise\n */\nexport type IsArrayRelation<T> =\n  Exclude<T, undefined> extends { createMany?: any }\n    ? true\n    : Exclude<T, undefined> extends { deleteMany?: any }\n      ? true\n      : false;\n\n/**\n * Extracts the create data type from a Prisma relation field\n * @template T - The relation field type\n * @returns The type used in the create operation, or never if not present\n */\nexport type ExtractCreateType<T> =\n  Exclude<T, undefined> extends { create?: infer C }\n    ? C extends Array<infer U>\n      ? (U & {\n          apiAction?: \"create\";\n        })[]\n      : C & {\n          apiAction?: \"create\";\n        }\n    : never;\n\ntype ExtractConnectType<\n  T,\n  action extends \"connect\" | \"delete\" | \"udpate\" | \"disconnect\" | \"deleteMany\",\n> =\n  Exclude<T, undefined> extends { [k in action]?: infer C }\n    ? C extends Array<infer U>\n      ? (U & {\n          apiAction?: action;\n        })[]\n      : C & {\n          apiAction?: action;\n        }\n    : never;\n/**\n * Extracts and merges the update data type from a Prisma relation field\n * Combines the 'where' clause and 'data' fields into a single type\n * @template T - The relation field type\n * @returns Merged type of where & data fields, or never if not present\n */\ntype ExtractUpdateType<T> = T extends {\n  update?: infer U;\n}\n  ? U extends Array<infer Item>\n    ? Item extends {\n        where: infer W;\n        data: infer D;\n      }\n      ? ((W & D) & { apiAction?: \"update\" })[]\n      : never\n    : U extends {\n          where: infer W;\n          data: infer D;\n        }\n      ? (W & D) & { apiAction?: \"update\" }\n      : never\n  : never;\n\n/**\n * Creates a flattened union type for a single relation field\n * Combines all possible Prisma operations (create, connect, update, delete, etc.) into a discriminated union\n * Each variant includes an optional apiAction field for explicit operation specification\n * @template T - The Prisma relation field type\n */\ntype FlattenRelationField<T> =\n  /**\n   * Create Operation - Creates a new related entity\n   * Extracts the 'create' data type and recursively flattens nested relations\n   * @example { name: \"New Item\", apiAction?: \"create\" }\n   */\n  | (ExtractCreateType<T> extends never\n      ? never\n      : FlattenRelations<ExtractCreateType<T>>)\n  /**\n   * Connect Operation - Links to an existing entity using unique fields\n   * Extracts the 'connect' data type (typically unique identifiers like id, email, etc.)\n   * @example { id: 123, apiAction?: \"connect\" } or { email: \"user@example.com\", apiAction?: \"connect\" }\n   */\n  | (ExtractConnectType<T, \"connect\"> extends never\n      ? never\n      : FlattenRelations<ExtractConnectType<T, \"connect\">>)\n  /**\n   * Update Operation - Modifies an existing related entity\n   * Combines the 'where' clause and 'data' fields into a single flat object\n   * @example { id: 123, name: \"Updated Name\", apiAction?: \"update\" }\n   */\n  | (ExtractUpdateType<T> extends never\n      ? never\n      : FlattenRelations<ExtractUpdateType<T>> & {\n          apiAction?: \"update\";\n        })\n  /**\n   * Delete Operation - Removes a related entity from the database\n   * Requires unique identifier(s) and explicit apiAction: \"delete\"\n   * For arrays, automatically uses deleteMany; for singular relations uses delete\n   * @example { id: 123, apiAction: \"delete\" }\n   */\n  | (T extends {\n      delete?: any;\n    }\n      ? {\n          apiAction: \"delete\";\n        } & ExtractConnectType<T, \"delete\">\n      : never)\n  /**\n   * Disconnect Operation - Breaks the relationship without deleting the entity\n   * Requires unique identifier(s) and explicit apiAction: \"disconnect\"\n   * Only available for optional relations\n   * @example { id: 123, apiAction: \"disconnect\" }\n   */\n  | (T extends {\n      disconnect?: any;\n    }\n      ? {\n          apiAction: \"disconnect\";\n        } & ExtractConnectType<T, \"disconnect\">\n      : never)\n  /**\n   * Set Operation - Replaces all related entities with a new set\n   * Typically used for many-to-many relations to completely replace the relation set\n   * @example { id: 456, apiAction?: \"set\" }\n   */\n  | (T extends {\n      set?: infer S;\n    }\n      ? Unpack<S> & {\n          apiAction?: \"set\";\n        }\n      : never)\n  /**\n   * Delete Many Operation - Removes multiple related entities matching criteria\n   * Requires unique identifier(s) and explicit apiAction: \"deleteMany\"\n   * Used for bulk deletion of related records\n   * @example { id: 123, apiAction: \"deleteMany\" }\n   */\n  | (T extends {\n      deleteMany?: any;\n    }\n      ? {\n          apiAction: \"deleteMany\";\n        } & ExtractConnectType<T, \"deleteMany\">\n      : never);\n\n/**\n * Ensures array relations only accept arrays, not single objects\n * For array relations (one-to-many, many-to-many), forces array type\n * For singular relations (one-to-one, many-to-one), keeps XOR behavior\n * @template T - The original Prisma field type\n * @template Flattened - The flattened relation field type\n */\ntype EnforceArrayRelation<T, Flattened> =\n  IsArrayRelation<T> extends true\n    ? // Array relation: Extract only array types from the union\n      Flattened extends Array<any>\n      ? Flattened\n      : never\n    : // Singular relation: Keep XOR behavior (can be object OR array)\n      Exclude<XOR<Flattened, T>, \"AND\">;\n\ntype FlattenRelations<T> = {\n  [K in keyof T]: IsRelationField<T[K]> extends true\n    ? EnforceArrayRelation<T[K], FlattenRelationField<T[K]>>\n    : T[K] extends object\n      ? T[K] extends Date | null | undefined\n        ? T[K]\n        : FlattenRelations<T[K]>\n      : T[K];\n};\n/**\n * Flattens Prisma relation inputs into a simpler, developer-friendly format\n *\n * Transforms Prisma's nested relation format:\n * ```typescript\n * { posts: { create: [...], connect: [...], update: [...] } }\n * ```\n *\n * Into a flattened format with optional apiAction discriminators:\n * ```typescript\n * { posts: [\n *   { title: \"New Post\" },                    // auto-detected as create\n *   { id: 1 },                                 // auto-detected as connect\n *   { id: 2, title: \"Updated\", apiAction: \"update\" }\n * ]}\n * ```\n *\n * Features:\n * - Preserves non-relation fields as-is\n * - Automatically detects operation type based on field presence\n * - Supports explicit apiAction for disambiguation\n * - Works recursively for deeply nested relations\n * - Enforces array-only types for array relations (one-to-many, many-to-many)\n * - Enforces mutual exclusivity between flattened and Prisma formats for singular relations\n *\n * @see {@link https://wwww.arkosjs.com/docs/api-reference/arkos-prisma-input}\n * @template T - The Prisma input type (e.g., Prisma.UserCreateInput)\n * @returns A flattened version of the input type with simplified relation handling\n *\n * @example\n * ```typescript\n * import { Prisma } from \"@prisma/client\";\n *\n * type FlatUserInput = ArkosPrismaInput<Prisma.UserCreateInput>;\n *\n * const user: FlatUserInput = {\n *   name: \"John\",\n *   email: \"john@example.com\",\n *   posts: [\n *     { title: \"My First Post\" },              // creates new post\n *     { id: 1 },                                // connects to existing post\n *     { id: 2, title: \"Updated\" },              // updates existing post\n *     { id: 3, apiAction: \"delete\" }            // deletes post\n *   ],\n *   profile: { bio: \"Software developer\" }     // singular relation (can be object or array)\n * };\n * ```\n */\nexport type ArkosPrismaInput<T> = FlattenRelations<T>;\n"]}