bazis 0.96.5 → 0.97.0

package/cli/templates/module.ts

@@ -194,23 +194,24 @@ export class ${n.module}DbContext extends DbContext {
 }
 
 function serviceInterfaceFile(n: ModuleNaming): string {
-  return `import { createToken } from "bazis/core/di";
-import type { PageResult } from "bazis/core/orm";
+  return `import type { PageResult } from "bazis/core/orm";
 import type { ListQuery } from "bazis/library/jsonapi";
 import type { Create${n.entity}Request, Update${n.entity}Request } from "../http/contracts/${n.module}.requests";
 import type { ${n.entity}Response, ${n.module}Summary } from "../http/contracts/${n.module}.responses";
 
-export interface I${n.module}Service {
-  getAll(query: ListQuery): Promise<PageResult<${n.entity}Response>>;
-  summary(): Promise<${n.module}Summary>;
-  count(): Promise<number>;
-  getById(id: string): Promise<${n.entity}Response | null>;
-  create(body: Create${n.entity}Request): Promise<${n.entity}Response>;
-  update(id: string, body: Update${n.entity}Request): Promise<${n.entity}Response | null>;
-  delete(id: string): Promise<boolean>;
+/**
+ * Service contract. An abstract class, not an interface: it exists at runtime,
+ * so it is the DI token itself: \`scoped(I${n.module}Service, ${n.module}Service)\`.
+ */
+export abstract class I${n.module}Service {
+  abstract getAll(query: ListQuery): Promise<PageResult<${n.entity}Response>>;
+  abstract summary(): Promise<${n.module}Summary>;
+  abstract count(): Promise<number>;
+  abstract getById(id: string): Promise<${n.entity}Response | null>;
+  abstract create(body: Create${n.entity}Request): Promise<${n.entity}Response>;
+  abstract update(id: string, body: Update${n.entity}Request): Promise<${n.entity}Response | null>;
+  abstract delete(id: string): Promise<boolean>;
 }
-
-export const I${n.module}Service = createToken<I${n.module}Service>("I${n.module}Service");
 `;
 }
 

package/cli/templates/passport.ts

@@ -51,7 +51,7 @@ adapters that access it.
 | ${n.moduleClass} | [${n.module}.module.ts](${n.module}.module.ts) | host imports | ORM, DI, HTTP${profile === "full" ? ", background, AI" : ""} |
 | ${e} | [model/${m}.model.ts](model/${m}.model.ts) | Fields below | Table ${n.route} |
 | ${m}DbContext | [model/${m}.dbContext.ts](model/${m}.dbContext.ts) | Shared host ORM provider | DbSet ${n.collection} |
-| I${m}Service / ${m}Service | [services/${m}.service.ts](services/${m}.service.ts), [token](services/I${m}.service.ts) | ${m}DbContext${profile === "full" ? ", ICache" : ""} | CRUD, count, summary |
+| I${m}Service / ${m}Service | [services/${m}.service.ts](services/${m}.service.ts), [contract](services/I${m}.service.ts) | ${m}DbContext${profile === "full" ? ", ICache" : ""} | CRUD, count, summary |
 | ${m}Controller | [http/${m}.controller.ts](http/${m}.controller.ts) | I${m}Service, HTTP request | HTTP operations below |
 | Create${e}Request / Update${e}Request | [requests](http/contracts/${m}.requests.ts) | JSON body | RequestModel + Validator |
 | ${e}Response / ${m}Summary / to${e}Response | [responses](http/contracts/${m}.responses.ts) | ORM entity | Public data projection |

package/core/di/README.md

@@ -14,7 +14,7 @@ contracts are described in [MODULE.md](MODULE.md).
 - `ServiceCollection.ts`: service registration.
 - `ServiceScope.ts`: scoped resolve and scoped dispose.
 - `container.ts`: a compatible alias wrapper over `ServiceProvider`.
-- `token.ts`: DI tokens (`createToken`, open generic family).
+- `token.ts`: DI tokens: classes, abstract classes as service contracts, `createToken`, open generic family.
 
 ## Internals (do not use directly)
 

package/core/di/index.ts

@@ -75,6 +75,7 @@ export {
 export {
   createOpenGenericTokenFamily,
   createToken,
+  type AbstractClass,
   type Class,
   type InjectionToken,
   type OpenGenericTokenFamily,

package/core/di/module/encapsulation.ts

@@ -170,6 +170,16 @@ export function validateModuleEncapsulation(
     }
   }
 
+  // Why a provided token is not visible: the owner does not export it, or the
+  // consumer module does not import the owner. Both used to read "not exported".
+  const explainHidden = (token: Token<unknown>, consumer: ModuleGraphRecord): string => {
+    const owner = records.find((record) => record !== consumer && record.providedTokens.has(token));
+    if (owner === undefined) return "which is provided by another module but not exported.";
+    return exportedTokens(owner).has(token)
+      ? `which module "${owner.name}" exports, but "${consumer.name}" does not list "${owner.name}" in its imports. Add "${owner.name}" to the imports of "${consumer.name}".`
+      : `which module "${owner.name}" provides but does not export. Add it to the exports of "${owner.name}".`;
+  };
+
   const contexts = new Map<ModuleGraphRecord, DependencyCheckContext>();
   for (let recordIndex = 0; recordIndex < records.length; recordIndex += 1) {
     const record = records[recordIndex] as ModuleGraphRecord;
@@ -183,7 +193,7 @@ export function validateModuleEncapsulation(
     }
 
     const context: DependencyCheckContext = {
-      visible, familiesVisible, tokensByName, allProvidedTokens, allProvidedFamilies, issues,
+      visible, familiesVisible, tokensByName, allProvidedTokens, allProvidedFamilies, issues, explainHidden,
     };
     contexts.set(record, context);
     for (const definition of record.definitions) {
@@ -214,6 +224,7 @@ interface DependencyCheckContext {
   readonly allProvidedTokens: ReadonlySet<Token<unknown>>;
   readonly allProvidedFamilies: ReadonlySet<symbol>;
   readonly issues: string[];
+  readonly explainHidden: (token: Token<unknown>, consumer: ModuleGraphRecord) => string;
 }
 
 function checkDefinition(
@@ -265,8 +276,9 @@ function checkDependency(
         return;
       }
     }
+    const provided = candidates.find((candidate) => context.allProvidedTokens.has(candidate as Token<unknown>)) as Token<unknown> | undefined;
     context.issues.push(
-      `Module "${record.name}": "${consumer}" depends on "${dep.name}", which is provided by another module but not exported.`,
+      `Module "${record.name}": "${consumer}" depends on "${dep.name}", ${provided ? context.explainHidden(provided, record) : "which is provided by another module but not exported."}`,
     );
     return;
   }
@@ -293,7 +305,7 @@ function checkDependency(
     return;
   }
   context.issues.push(
-    `Module "${record.name}": "${consumer}" depends on "${tokenToDebugName(token)}", which is provided by another module but not exported.`,
+    `Module "${record.name}": "${consumer}" depends on "${tokenToDebugName(token)}", ${context.explainHidden(token, record)}`,
   );
 }
 

package/core/di/token.ts

@@ -3,6 +3,14 @@
 // constructor deps is still validated by the container.
 export type Class<T> = new (...args: any[]) => T;
 
+/**
+ * A class usable only as a key: an abstract class declared as a contract
+ * (`export abstract class IClock { abstract now(): Date }`) and registered with
+ * `scoped(IClock, SystemClock)`. Unlike an interface it exists at runtime, so it
+ * needs no `createToken`. The container never constructs it.
+ */
+export type AbstractClass<T> = abstract new (...args: any[]) => T;
+
 export interface InjectionToken<T> {
   readonly id: symbol;
   readonly description: string;
@@ -18,7 +26,7 @@ export function createToken<T>(description: string): InjectionToken<T> {
   };
 }
 
-export type Token<T> = Class<T> | InjectionToken<T>;
+export type Token<T> = Class<T> | AbstractClass<T> | InjectionToken<T>;
 
 export interface OpenGenericTokenFamily<TArg, TResult> {
   readonly id: symbol;

package/core/http/Authorization/Authorize.ts

@@ -17,7 +17,8 @@ type ClassOrMethodDecorator = (
  * Protects a controller or a single action: the route gets the
  * {@link AuthorizeCheck} function. The HTTP kernel does not know *what* it
  * checks: JWT, login/password, Telegram sign-in and so on. Several checks
- * can be passed; all of them must pass.
+ * can be passed; all of them must pass. On a method of a protected controller
+ * the checks are added to the controller's ones: the class checks run first.
  *
  * ```ts
  * @Authorize(requireTokenKind(TokenKind.Admin))   // access token kind
@@ -40,7 +41,7 @@ export function Authorize(check: AuthorizeCheck, ...rest: AuthorizeCheck[]): Cla
   };
 }
 
-/** Public route: overrides `@Authorize` declared on the controller. */
+/** Public route: on a method, removes every check, including the controller's `@Authorize`. */
 export function AllowAnonymous(): ClassOrMethodDecorator {
   return (_value, context) => {
     if (context.kind === "class") {

package/core/http/Authorization/metadata.ts

@@ -122,15 +122,22 @@ export function setActionAllowAnonymous(metadata: object, methodName: string | s
   delete action.authorize;
 }
 
-/** Effective route requirement (the method overrides the controller). */
+/** Effective route requirement: the class and method checks combined. */
 export interface ResolvedAuthorizeMeta {
   readonly allowAnonymous: boolean;
   readonly authorize?: AuthorizeOptions;
 }
 
 /**
- * Resolves the authorization requirement of a specific action. Precedence:
- * `@AllowAnonymous`/`@Authorize` on the method override those declared on the class.
+ * Resolves the authorization requirement of a specific action:
+ *
+ * - `@AllowAnonymous` on the method opens it, whatever the class declares;
+ * - `@Authorize` on the class and on the method combine: the class checks run
+ *   first, then the method checks (a check repeated on both runs once);
+ * - `@AllowAnonymous` on the class opens the methods without their own `@Authorize`.
+ *
+ * Inheritance is different: a subclass's own class-level declaration replaces
+ * the base class's, and an overriding method's declaration replaces the base method's.
  */
 export function resolveAuthorizeMeta(ctor: object, methodName: string | symbol): ResolvedAuthorizeMeta {
   const metadata = (ctor as { [key: symbol]: unknown })[Symbol.metadata as unknown as symbol] as
@@ -145,14 +152,13 @@ export function resolveAuthorizeMeta(ctor: object, methodName: string | symbol):
   if (action?.allowAnonymous) {
     return { allowAnonymous: true };
   }
-  if (action?.authorize) {
-    return { allowAnonymous: false, authorize: action.authorize };
-  }
-  if (meta.allowAnonymous) {
+  const classChecks = meta.authorize?.checks ?? [];
+  const actionChecks = action?.authorize?.checks ?? [];
+  if (actionChecks.length === 0 && meta.allowAnonymous) {
     return { allowAnonymous: true };
   }
-  if (meta.authorize) {
-    return { allowAnonymous: false, authorize: meta.authorize };
-  }
-  return { allowAnonymous: false };
+  const checks = [...new Set([...classChecks, ...actionChecks])];
+  return checks.length === 0
+    ? { allowAnonymous: false }
+    : { allowAnonymous: false, authorize: { checks } };
 }

package/core/http/Binding/ParameterBinder.ts

@@ -3,7 +3,7 @@ import { BadRequestError, UnsupportedMediaTypeError } from "../Errors/HttpError"
 import type { HttpContext } from "../HttpContext/HttpContext";
 import type { ParameterBinding } from "./bindings";
 import { convertOr400 } from "./convert";
-import { bindModel } from "./modelBinder";
+import { bindModelAsync } from "./modelBinder";
 
 /** Per-action constraints affecting binding (from decorators). */
 export interface BindingDefaults {
@@ -67,7 +67,7 @@ export async function bindArguments(
           throw new UnsupportedMediaTypeError("application/json");
         }
         const data = await ctx.json();
-        args[index] = binding.model ? bindModel(binding.model, data, ctx.modelValidator, { primitiveTypes: true }) : data;
+        args[index] = binding.model ? await bindModelAsync(binding.model, data, ctx.modelValidator, { primitiveTypes: true }) : data;
         break;
       }
       case "request":

package/core/http/Binding/modelBinder.ts

@@ -1,6 +1,6 @@
 import type { Class } from "../../di";
 import { BadRequestError, ModelValidationError } from "../Errors/HttpError";
-import { getModelValidator, type ModelValidator } from "./modelValidator";
+import { getModelValidator, type ModelValidationIssue, type ModelValidationResult, type ModelValidator } from "./modelValidator";
 import {
   findRequestModelShape,
   type RequestModelClass,
@@ -17,6 +17,9 @@ const MAX_JSON_NODES = 100_000;
 interface BindingTraversal {
   readonly stack: WeakSet<object>;
   readonly options: ModelBindingOptions;
+  /** Per-field binding problems; a bad field does not stop the other fields. */
+  readonly issues: ModelValidationIssue[];
+  readonly typeMessage?: (property: string, expected: string, actual: string) => string;
   nodes: number;
 }
 
@@ -49,19 +52,48 @@ export interface ModelBindingOptions {
  * runtime fallback.
  */
 export function bindModel<T extends object>(model: Class<T>, data: unknown, validator?: ModelValidator, options: ModelBindingOptions = {}): T {
+  const activeValidator = validator ?? getModelValidator();
+  const { instance, traversal } = hydrate(model, data, activeValidator, options);
+  finish(traversal, activeValidator, activeValidator?.validate(instance));
+  return instance;
+}
+
+/**
+ * `bindModel` for callers that can wait: runs async `custom` rules through
+ * `ModelValidator.validateAsync` when the validator provides it.
+ */
+export async function bindModelAsync<T extends object>(model: Class<T>, data: unknown, validator?: ModelValidator, options: ModelBindingOptions = {}): Promise<T> {
+  const activeValidator = validator ?? getModelValidator();
+  const { instance, traversal } = hydrate(model, data, activeValidator, options);
+  const result = activeValidator?.validateAsync !== undefined
+    ? await activeValidator.validateAsync(instance)
+    : activeValidator?.validate(instance);
+  finish(traversal, activeValidator, result);
+  return instance;
+}
+
+function hydrate<T extends object>(model: Class<T>, data: unknown, validator: ModelValidator | undefined, options: ModelBindingOptions): { instance: T; traversal: BindingTraversal } {
   if (!isPlainJsonObject(data)) {
     throw new BadRequestError("Request body must be a JSON object");
   }
-  const traversal: BindingTraversal = { stack: new WeakSet(), nodes: 0, options };
+  const traversal: BindingTraversal = {
+    stack: new WeakSet(), nodes: 0, options, issues: [],
+    typeMessage: validator?.typeMismatchMessage?.bind(validator),
+  };
   const instance = hydrateModel(model as RequestModelClass, data, "", traversal, 0) as T;
-  const activeValidator = validator ?? getModelValidator();
-  if (activeValidator !== undefined) {
-    const result = activeValidator.validate(instance);
-    if (!result.isValid) {
-      throw new ModelValidationError(result.errors);
-    }
+  return { instance, traversal };
+}
+
+/**
+ * One 400 with every problem: binding issues first, then `@Validator` errors of
+ * the other fields (a field with a wrong JSON type gets only its type error).
+ */
+function finish(traversal: BindingTraversal, validator: ModelValidator | undefined, result: ModelValidationResult | undefined): void {
+  const bound = new Set(traversal.issues.map((issue) => issue.property));
+  const errors = [...traversal.issues, ...(result?.errors ?? []).filter((error) => !bound.has(error.property))];
+  if (errors.length > 0) {
+    throw new ModelValidationError(errors, validator?.failureTitle?.() ?? "Validation failed");
   }
-  return instance;
 }
 
 function hydrateModel(
@@ -84,7 +116,12 @@ function hydrateModel(
       }
       const target = instance as Record<string, unknown>;
       const fieldPath = path === "" ? key : `${path}.${key}`;
-      target[key] = bindField(model, key, target[key], source[key], fieldPath, traversal, depth + 1);
+      try {
+        target[key] = bindField(model, key, target[key], source[key], fieldPath, traversal, depth + 1);
+      } catch (error) {
+        if (!(error instanceof BindingTypeError) && !(error instanceof ModelValidationError && error.errors.every((issue) => issue.code === "unknownField"))) throw error;
+        traversal.issues.push(...(error instanceof BindingTypeError ? [error.issue(traversal.typeMessage)] : error.errors));
+      }
     }
     return instance;
   } finally {
@@ -117,13 +154,13 @@ function checkPrimitive(shape: RequestModelPrimitiveFieldShape, incoming: unknow
     return;
   }
   if (shape.array !== true) {
-    if (typeof incoming !== shape.primitive) throw bindingTypeError(path, shape.primitive);
+    if (typeof incoming !== shape.primitive) throw bindingTypeError(path, shape.primitive, incoming);
     return;
   }
-  if (!Array.isArray(incoming)) throw bindingTypeError(path, "array");
+  if (!Array.isArray(incoming)) throw bindingTypeError(path, "array", incoming);
   incoming.forEach((item, index) => {
     if (!(item === null && shape.elementNullable === true) && typeof item !== shape.primitive) {
-      throw bindingTypeError(`${path}[${index}]`, shape.primitive);
+      throw bindingTypeError(`${path}[${index}]`, shape.primitive, item);
     }
   });
 }
@@ -142,11 +179,11 @@ function hydrateField(
     if (shape.nullable === true) {
       return null;
     }
-    throw bindingTypeError(path, shape.array === true ? "array" : "object");
+    throw bindingTypeError(path, shape.array === true ? "array" : "object", incoming);
   }
   if (shape.array === true) {
     if (!Array.isArray(incoming)) {
-      throw bindingTypeError(path, "array");
+      throw bindingTypeError(path, "array", incoming);
     }
     enterContainer(incoming, path, traversal, depth);
     try {
@@ -156,7 +193,7 @@ function hydrateField(
           return null;
         }
         if (!isPlainJsonObject(item)) {
-          throw bindingTypeError(itemPath, "object");
+          throw bindingTypeError(itemPath, "object", item);
         }
         return hydrateModel(shape.model, item, itemPath, traversal, depth + 1);
       });
@@ -165,17 +202,25 @@ function hydrateField(
     }
   }
   if (!isPlainJsonObject(incoming)) {
-    throw bindingTypeError(path, "object");
+    throw bindingTypeError(path, "object", incoming);
   }
   return hydrateModel(shape.model, incoming, path, traversal, depth);
 }
 
-function bindingTypeError(property: string, expected: string): ModelValidationError {
-  return new ModelValidationError([{
-    property: property || "$",
-    message: `Field "${property || "$"}" must be a ${expected}`,
-    code: "type",
-  }]);
+/** A JSON value of the wrong type; the field is skipped and the binding goes on. */
+class BindingTypeError extends ModelValidationError {
+  constructor(readonly property: string, readonly expected: string, readonly actual: string) {
+    super([{ property, message: `Field "${property}" must be a ${expected}`, code: "type" }]);
+  }
+
+  issue(format?: (property: string, expected: string, actual: string) => string): ModelValidationIssue {
+    return { property: this.property, message: format?.(this.property, this.expected, this.actual) ?? this.errors[0]!.message, code: "type" };
+  }
+}
+
+function bindingTypeError(property: string, expected: string, value: unknown): BindingTypeError {
+  const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
+  return new BindingTypeError(property || "$", expected, actual);
 }
 
 function isPlainJsonObject(value: unknown): value is Record<string, unknown> {
@@ -215,7 +260,7 @@ function sanitizeBoundValue(
 
   if (Array.isArray(incoming)) {
     if (isNestedModel(template) || isPlainJsonObject(template)) {
-      throw bindingTypeError(path, "object");
+      throw bindingTypeError(path, "object", incoming);
     }
     enterContainer(incoming, path, traversal, depth);
     try {
@@ -228,10 +273,10 @@ function sanitizeBoundValue(
   }
 
   if (!isPlainJsonObject(incoming)) {
-    throw bindingTypeError(path, "JSON object or array");
+    throw bindingTypeError(path, "JSON object or array", incoming);
   }
   if (Array.isArray(template)) {
-    throw bindingTypeError(path, "array");
+    throw bindingTypeError(path, "array", incoming);
   }
 
   enterContainer(incoming, path, traversal, depth);

package/core/http/Binding/modelValidator.ts

@@ -13,8 +13,19 @@ export interface ModelValidationIssue {
   readonly code?: string;
 }
 
+export interface ModelValidationResult {
+  readonly isValid: boolean;
+  readonly errors: readonly ModelValidationIssue[];
+}
+
 export interface ModelValidator {
-  validate(instance: object): { readonly isValid: boolean; readonly errors: readonly ModelValidationIssue[] };
+  validate(instance: object): ModelValidationResult;
+  /** Async rules (custom checks returning a Promise). HTTP binding prefers it when present. */
+  validateAsync?(instance: object): Promise<ModelValidationResult>;
+  /** Text for a JSON value of the wrong type; without it the binder uses its English default. */
+  typeMismatchMessage?(property: string, expected: string, actual: string): string;
+  /** Title of a 400 validation response; without it "Validation failed". */
+  failureTitle?(): string;
 }
 
 let activeValidator: ModelValidator | undefined;

package/core/http/Errors/HttpError.ts

@@ -72,9 +72,9 @@ export class TooManyRequestsError extends HttpError {
  * of validation problems.
  */
 export class ModelValidationError extends BadRequestError {
-  constructor(readonly errors: readonly ModelValidationIssue[]) {
+  constructor(readonly errors: readonly ModelValidationIssue[], title = "Validation failed") {
     super(
-      "Validation failed",
+      title,
       errors.map((error) => ({ property: error.property, message: error.message, code: error.code })),
     );
   }

package/core/http/SPEC.md

@@ -804,8 +804,13 @@ Do not create a **new** middleware function per request, only at load/startup.
 `@Authorize(check, ...checks)` on a controller or a method compiles into the built-in
 authorization link [6]. A check is `(ctx) => boolean | Promise<boolean>`: `true` lets the
 request through, `false` gives `403`, and a thrown `HttpError` defines the response
-itself (for example `UnauthorizedError` → `401`). A method-level `@Authorize` or
-`@AllowAnonymous` overrides the controller's.
+itself (for example `UnauthorizedError` → `401`). Checks of the controller and of the
+method combine: the controller's run first, then the method's; a check repeated on both
+runs once. A method-level `@AllowAnonymous` removes every check, including the
+controller's. On an `@AllowAnonymous` controller only methods with their own
+`@Authorize` are protected. Inheritance replaces instead: a subclass's own class-level
+declaration replaces the base class's (since 0.97.0; before it a method-level
+`@Authorize` replaced the controller's checks).
 
 ```ts
 const isSignedIn: AuthorizeCheck = (ctx) => {

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.96.5" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.97.0" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/library/validation/MessageRegistry.ts

@@ -6,11 +6,16 @@ export type MessageParams = Readonly<Record<string, unknown>>;
 
 /** Built-in default messages (English). */
 const BUILT_IN: Readonly<Record<string, string>> = {
+  validationFailed: "Validation failed",
+  invalid: 'Field "{property}" is invalid ({code})',
   required: 'Field "{property}" is required',
   notEmpty: 'Field "{property}" must not be empty',
   minLength: 'Field "{property}" must be at least {min} characters long',
   maxLength: 'Field "{property}" must be at most {max} characters long',
   length: 'Field "{property}" must be {min} to {max} characters long',
+  minItems: 'Field "{property}" must contain at least {min} items',
+  maxItems: 'Field "{property}" must contain at most {max} items',
+  itemCount: 'Field "{property}" must contain {min} to {max} items',
   contains: 'Field "{property}" must contain "{contains}"',
   notContains: 'Field "{property}" must not contain "{contains}"',
   pattern: 'Field "{property}" does not match the format {pattern}',
@@ -41,11 +46,16 @@ const BUILT_IN: Readonly<Record<string, string>> = {
  * `MessageRegistry.setDefaults(RU_VALIDATION_MESSAGES)`.
  */
 export const RU_VALIDATION_MESSAGES: Readonly<Record<string, string>> = Object.freeze({
+  validationFailed: "Проверка данных не пройдена",
+  invalid: 'Поле "{property}" не прошло проверку ({code})',
   required: 'Поле "{property}" обязательно для заполнения',
   notEmpty: 'Поле "{property}" не должно быть пустым',
   minLength: 'Поле "{property}" должно содержать не менее {min} символов',
   maxLength: 'Поле "{property}" должно содержать не более {max} символов',
   length: 'Поле "{property}" должно содержать от {min} до {max} символов',
+  minItems: 'Поле "{property}" должно содержать не менее {min} элементов',
+  maxItems: 'Поле "{property}" должно содержать не более {max} элементов',
+  itemCount: 'Поле "{property}" должно содержать от {min} до {max} элементов',
   contains: 'Поле "{property}" должно содержать "{contains}"',
   notContains: 'Поле "{property}" не должно содержать "{contains}"',
   pattern: 'Поле "{property}" не соответствует формату {pattern}',
@@ -118,7 +128,7 @@ export class MessageRegistry {
       localMessage ??
       (Object.prototype.hasOwnProperty.call(MessageRegistry.defaults, code)
         ? MessageRegistry.defaults[code]!
-        : 'Поле "{property}" не прошло проверку ({code})');
+        : MessageRegistry.defaults.invalid ?? BUILT_IN.invalid!);
     return MessageRegistry.interpolate(template, params);
   }
 

package/library/validation/RuleEngine.ts

@@ -115,11 +115,14 @@ export class RuleEngine {
 
     // 3. String rules: first one type check, then the rules themselves.
     if (rule.needsString) {
-      if (typeof value !== "string") {
+      if (Array.isArray(value) && RuleEngine.onlyLengthRules(o)) {
+        RuleEngine.applyArrayLengthRules(o, value, path, errors);
+      } else if (typeof value !== "string") {
         RuleEngine.failType(errors, path, value, o, "string");
         return;
+      } else {
+        RuleEngine.applyStringRules(rule, value, path, errors);
       }
-      RuleEngine.applyStringRules(rule, value, path, errors);
     }
 
     // 4. Number rules.
@@ -167,6 +170,27 @@ export class RuleEngine {
     }
   }
 
+  /** notEmpty/minLength/maxLength/length also apply to arrays; any other string rule needs a string. */
+  private static onlyLengthRules(o: ValidatorOptions): boolean {
+    return o.type === undefined && o.contains === undefined && o.notContains === undefined && o.pattern === undefined
+      && o.email !== true && o.url !== true && o.uuid !== true && o.json !== true && o.phone !== true;
+  }
+
+  private static applyArrayLengthRules(o: ValidatorOptions, value: readonly unknown[], path: string, errors: ValidationError[]): void {
+    if (o.notEmpty === true && value.length === 0) {
+      RuleEngine.fail(errors, ValidationCodes.notEmpty, path, value, o, undefined);
+    }
+    if (o.minLength !== undefined && value.length < o.minLength) {
+      RuleEngine.fail(errors, ValidationCodes.minItems, path, value, o, { min: o.minLength });
+    }
+    if (o.maxLength !== undefined && value.length > o.maxLength) {
+      RuleEngine.fail(errors, ValidationCodes.maxItems, path, value, o, { max: o.maxLength });
+    }
+    if (o.length !== undefined && (value.length < o.length[0] || value.length > o.length[1])) {
+      RuleEngine.fail(errors, ValidationCodes.itemCount, path, value, o, { min: o.length[0], max: o.length[1] });
+    }
+  }
+
   private static applyStringRules(rule: CompiledRule, value: string, path: string, errors: ValidationError[]): void {
     const o = rule.options;
     if (o.notEmpty === true && value.length === 0) {
@@ -361,7 +385,7 @@ export class RuleEngine {
   }
 
   private static failType(errors: ValidationError[], path: string, value: unknown, o: ValidatorOptions, expected: string): void {
-    const actual = typeof value === "number" && Number.isNaN(value) ? "NaN" : value === null ? "null" : typeof value;
+    const actual = typeof value === "number" && Number.isNaN(value) ? "NaN" : value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
     RuleEngine.fail(errors, ValidationCodes.type, path, value, o, { expected, actual });
   }
 

package/library/validation/SPEC.md

@@ -114,6 +114,11 @@ Any of these rules requires the value to be a string (otherwise one `type` error
 `maxLength` and the upper bound of `length` limit the input of the later content checks
 **of the same decorator**: `contains`, `notContains`, `pattern`, `email`, `url`, `uuid`,
 `json`, `phone`. When exceeded, the length errors stay and the listed checks do not run.
+
+On an **array** value, `notEmpty`, `minLength`, `maxLength` and `length` count its
+items (codes `notEmpty`, `minItems`, `maxItems`, `itemCount`), as long as the decorator
+has no other string rule and no `type` hint. Any other string rule on an array is a
+`type` error (`got: array`).
 The lower length bound, the other fields/decorators and `custom` keep their behavior.
 For an untrusted `pattern`, set the upper bound in the same decorator; a separate
 limiting decorator does not change the neighboring rules.
@@ -480,7 +485,8 @@ from your own `ValidationError`.
 | Code | When |
 |---|---|
 | `required` | the value is `undefined`/`null` with `required: true` |
-| `notEmpty`, `minLength`, `maxLength`, `length` | the string length |
+| `notEmpty`, `minLength`, `maxLength`, `length` | the string length (`notEmpty` also an empty array) |
+| `minItems`, `maxItems`, `itemCount` | the array item count (`minLength`, `maxLength`, `length` on an array) |
 | `contains`, `notContains`, `pattern` | the string content |
 | `email`, `url`, `uuid`, `json`, `phone`, `date` | the format |
 | `type` | the value has the wrong type (including `NaN` for number rules) |

package/library/validation/modelValidatorAdapter.ts

@@ -1,5 +1,7 @@
 import { Validator } from "./Validator";
 import { rulesOf } from "./metadata";
+import { MessageRegistry } from "./MessageRegistry";
+import type { ValidationResult } from "./ValidationResult";
 
 interface AdapterValidationIssue {
   readonly property: string;
@@ -27,11 +29,31 @@ interface AdapterValidationIssue {
  * kernel unaware of the concrete validation engine (dependency inversion).
  */
 export const modelValidatorAdapter = {
-  validate(instance: object): {
-    readonly isValid: boolean;
-    readonly errors: readonly { readonly property: string; readonly message: string; readonly code?: string }[];
-  } {
-    const result = Validator.validate(instance);
+  validate(instance: object): AdapterValidationResult {
+    return toAdapterResult(instance, Validator.validate(instance));
+  },
+
+  /** Runs async `custom` rules too; HTTP request binding uses this. */
+  async validateAsync(instance: object): Promise<AdapterValidationResult> {
+    return toAdapterResult(instance, await Validator.validateAsync(instance));
+  },
+
+  /** A JSON value of the wrong type, in the current `MessageRegistry` language. */
+  typeMismatchMessage(property: string, expected: string, actual: string): string {
+    return MessageRegistry.format("type", undefined, { property, expected, actual });
+  },
+
+  failureTitle(): string {
+    return MessageRegistry.format("validationFailed", undefined, {});
+  },
+};
+
+interface AdapterValidationResult {
+  readonly isValid: boolean;
+  readonly errors: readonly AdapterValidationIssue[];
+}
+
+function toAdapterResult(instance: object, result: ValidationResult): AdapterValidationResult {
     const nestedInstanceErrors = validateExplicitNestedInstances(instance);
     const errors: AdapterValidationIssue[] = result.errors.map((error) => ({
       property: error.property,
@@ -43,8 +65,7 @@ export const modelValidatorAdapter = {
       isValid: errors.length === 0,
       errors,
     };
-  },
-};
+}
 
 /**
  * `nested: true` must never silently validate a plain object with no class

package/library/validation/types/ValidationCode.ts

@@ -8,7 +8,7 @@
 export const ValidationCodes = {
   /** The value is missing (`undefined` or `null`) but the field is required. */
   required: "required",
-  /** The string is empty but the rule requires a non-empty one. */
+  /** The string or array is empty but the rule requires a non-empty one. */
   notEmpty: "notEmpty",
   /** The string is shorter than the minimum. */
   minLength: "minLength",
@@ -16,6 +16,12 @@ export const ValidationCodes = {
   maxLength: "maxLength",
   /** The string length is outside `length: [min, max]`. */
   length: "length",
+  /** The array has fewer items than `minLength`. */
+  minItems: "minItems",
+  /** The array has more items than `maxLength`. */
+  maxItems: "maxItems",
+  /** The array item count is outside `length: [min, max]`. */
+  itemCount: "itemCount",
   /** The string does not contain the required substring. */
   contains: "contains",
   /** The string contains a forbidden substring. */

package/library/validation/types/ValidatorOptions.ts

@@ -88,13 +88,13 @@ export interface ValidatorOptions {
 
   // ── Strings ──────────────────────────────────────────────────────────────
 
-  /** The string must not be empty (`""`). */
+  /** The string (`""`) or array (`[]`) must not be empty. */
   notEmpty?: boolean;
-  /** Minimum string length (inclusive). */
+  /** Minimum string length or array item count (inclusive). */
   minLength?: number;
-  /** Maximum string length (inclusive); exceeding it skips this decorator's content checks. */
+  /** Maximum string length or array item count (inclusive); for a string, exceeding it skips this decorator's content checks. */
   maxLength?: number;
-  /** String length range `[min, max]` (inclusive); exceeding max skips this decorator's content checks. */
+  /** String length or array item count range `[min, max]` (inclusive); for a string, exceeding max skips this decorator's content checks. */
   length?: readonly [number, number];
   /** The string must contain the substring. */
   contains?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.96.5",
+  "version": "0.97.0",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",