lumen-framework 3.0.2 → 3.1.0

package/dist/index.js

@@ -43,6 +43,8 @@ module.exports = __toCommonJS(index_exports);
 var import_chalk4 = require("chalk");
 
 // src/packages/database/constants.ts
+var UNIQUE_CONSTRAINT_CODES = /* @__PURE__ */ new Set(["23505", "ER_DUP_ENTRY"]);
+var UNIQUE_CONSTRAINT = /unique(\s+key)?\s+constraint|duplicate key/i;
 var VALID_DRIVERS = [
   "pg",
   "sqlite3",
@@ -892,7 +894,7 @@ function underscore(source = "", upper = false) {
 var normalize_model_name_default = compose(import_inflection2.singularize, import_inflection2.dasherize, underscore);
 
 // src/packages/database/model/index.ts
-var import_inflection9 = require("inflection");
+var import_inflection10 = require("inflection");
 
 // src/packages/database/query/index.ts
 var import_inflection5 = require("inflection");
@@ -1090,10 +1092,16 @@ async function buildResults({
         }
       );
     }
+    const missing = new Set(
+      entries(record).filter(([key, value]) => value == null && pkPattern.test(key)).map(([key]) => key.split(".")[0])
+    );
+    const absent = Array.from(missing).filter(
+      (name) => model.relationshipFor(name)?.type === "hasOne"
+    );
     const instance = Reflect.construct(model, [
       entries(record).reduce((r, entry) => {
         let [key, value] = entry;
-        if (value == null && pkPattern.test(key)) {
+        if (key.indexOf(".") >= 0 && missing.has(key.split(".")[0])) {
           return r;
         } else if (key.indexOf(".") >= 0) {
           const [a, b] = key.split(".");
@@ -1113,6 +1121,7 @@ async function buildResults({
         };
       }, {})
     ]);
+    absent.forEach((name) => instance.absentRelationships.add(name));
     instance.currentChangeSet.persist();
     return instance;
   });
@@ -1124,6 +1133,17 @@ function createRunner(target, opts) {
     const { resolve: resolve2, reject } = opts;
     let didRun = false;
     RUNNERS.set(target, async () => {
+      if (didRun) {
+        return;
+      }
+      didRun = true;
+      try {
+        await run();
+      } catch (err) {
+        reject(err);
+      }
+    });
+    async function run() {
       let results;
       const {
         model,
@@ -1133,10 +1153,6 @@ function createRunner(target, opts) {
         shouldCount,
         relationships
       } = target;
-      if (didRun) {
-        return;
-      }
-      didRun = true;
       if (!shouldCount && !snapshots.some(([name]) => name === "select")) {
         target.select(...target.model.attributeNames);
       }
@@ -1177,7 +1193,7 @@ function createRunner(target, opts) {
           resolve2(result);
         }
       }
-    });
+    }
   }
 }
 function runQuery(target) {
@@ -1882,7 +1898,9 @@ async function get(owner, key) {
     let { foreignKey } = opts;
     value = owner.currentChangeSet.get(key);
     foreignKey = (0, import_inflection7.camelize)(foreignKey, true);
-    if (!value) {
+    if (!value && owner.absentRelationships.has(key)) {
+      value = null;
+    } else if (!value) {
       switch (type) {
         case "hasOne":
           value = await getHasOne(owner, {
@@ -2544,13 +2562,37 @@ async function initializeClass({
   return model;
 }
 
+// src/packages/server/utils/source-for.ts
+var import_inflection9 = require("inflection");
+function memberName(key) {
+  return (0, import_inflection9.dasherize)(underscore(key));
+}
+function escapePointer(segment) {
+  return segment.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function sourceFor(path) {
+  const [root, ...rest] = path.split(".").filter(Boolean).map(memberName);
+  if (!root) {
+    return {};
+  } else if (root === "data") {
+    return {
+      pointer: `/${[root, ...rest].map(escapePointer).join("/")}`
+    };
+  }
+  return {
+    parameter: `${root}${rest.map((key) => `[${key}]`).join("")}`
+  };
+}
+
 // src/packages/database/validation/errors/validation-error.ts
 var ValidationError = class extends Error {
-  constructor(key, value) {
-    super(`Validation failed for ${key}: ${value}`);
+  constructor(key) {
+    super(`Validation failed for ${key}.`);
+    this.key = key;
+    this.source = sourceFor(`data.attributes.${key}`);
   }
 };
-var validation_error_default = ValidationError;
+var validation_error_default = createServerError(ValidationError, 422);
 
 // src/packages/database/validation/index.ts
 var Validation = class {
@@ -2590,12 +2632,32 @@ function validate(instance) {
     validator: Reflect.get(instance.constructor.validates, key)
   })).filter(({ validator }) => validator).map((props) => new validation_default(props)).reduce((result, validation) => {
     if (!validation.isValid()) {
-      throw new validation_error_default(validation.key, String(validation.value));
+      throw new validation_error_default(validation.key);
     }
     return result;
   }, true);
 }
 
+// src/packages/database/model/utils/process-write-error.ts
+function driverMessage(message) {
+  const index = message.lastIndexOf(" - ");
+  return index >= 0 ? message.slice(index + 3) : message;
+}
+function processWriteError(err) {
+  if (!(err instanceof Error)) {
+    return err;
+  }
+  const { code } = err;
+  const { message } = err;
+  if (UNIQUE_CONSTRAINT_CODES.has(String(code)) || UNIQUE_CONSTRAINT.test(message)) {
+    return new unique_constraint_error_default(driverMessage(message));
+  }
+  return err;
+}
+function rethrowWriteError(err) {
+  throw processWriteError(err);
+}
+
 // src/packages/database/model/utils/run-hooks.ts
 function runHooks(record, trx, ...hooks) {
   return hooks.filter((hook) => Boolean(hook)).reduce(
@@ -2635,6 +2697,12 @@ var Model = class {
         writable: false,
         enumerable: false,
         configurable: false
+      },
+      absentRelationships: {
+        value: /* @__PURE__ */ new Set(),
+        writable: false,
+        enumerable: false,
+        configurable: false
       }
     });
     const {
@@ -2981,9 +3049,9 @@ var Model = class {
       return createTransactionResultProxy(this, hadDirtyAttrs || hadDirtyAssoc);
     };
     if (transaction) {
-      return run(transaction);
+      return run(transaction).catch(rethrowWriteError);
     }
-    return this.transaction(run);
+    return this.transaction(run).catch(rethrowWriteError);
   }
   /**
    * Permanently delete the instance from the database.
@@ -3103,9 +3171,9 @@ var Model = class {
       return createTransactionResultProxy(instance, true);
     };
     if (transaction) {
-      return run(transaction);
+      return run(transaction).catch(rethrowWriteError);
     }
-    return this.transaction(run);
+    return this.transaction(run).catch(rethrowWriteError);
   }
   /**
    * Specify the transaction object to use for following save, update, or
@@ -3283,7 +3351,7 @@ var Model = class {
       return Promise.resolve(this);
     }
     if (!this.tableName) {
-      const getTableName = compose(import_inflection9.pluralize, underscore);
+      const getTableName = compose(import_inflection10.pluralize, underscore);
       const tableName = getTableName(this.name);
       Reflect.defineProperty(this, "tableName", {
         value: tableName,
@@ -3481,7 +3549,7 @@ function parseNestedObject(source) {
 }
 
 // src/packages/server/request/parser/utils/format.ts
-var import_inflection11 = require("inflection");
+var import_inflection12 = require("inflection");
 
 // src/packages/server/request/parser/constants.ts
 var INT = /^\d+$/;
@@ -3492,7 +3560,7 @@ var TRUE = /^true$/;
 var BRACKETS = /(?:\[])/g;
 
 // src/utils/transform-keys.ts
-var import_inflection10 = require("inflection");
+var import_inflection11 = require("inflection");
 function transformKeys(source, transformer, deep = false) {
   if (Array.isArray(source)) {
     return source.slice(0);
@@ -3516,14 +3584,14 @@ function transformKeys(source, transformer, deep = false) {
 function camelizeKeys(source, deep) {
   return transformKeys(
     source,
-    (key) => (0, import_inflection10.camelize)(underscore(key), true),
+    (key) => (0, import_inflection11.camelize)(underscore(key), true),
     deep
   );
 }
 function dasherizeKeys(source, deep) {
   return transformKeys(
     source,
-    (key) => (0, import_inflection10.dasherize)(underscore(key)),
+    (key) => (0, import_inflection11.dasherize)(underscore(key)),
     deep
   );
 }
@@ -3538,7 +3606,7 @@ function makeArray(source) {
 function formatString(source, method) {
   if (method === "GET") {
     if (source.indexOf(",") >= 0) {
-      return source.split(",").map((str) => (0, import_inflection11.camelize)(underscore(str), true));
+      return source.split(",").map((str) => (0, import_inflection12.camelize)(underscore(str), true));
     } else if (INT.test(source)) {
       return Number.parseInt(source, 10);
     } else if (BOOL.test(source)) {
@@ -3565,9 +3633,9 @@ function formatObject(source, method, formatter) {
 }
 function formatSort(sort) {
   if (sort.startsWith("-")) {
-    return `-${(0, import_inflection11.camelize)(underscore(sort.substr(1)), true)}`;
+    return `-${(0, import_inflection12.camelize)(underscore(sort.substr(1)), true)}`;
   }
-  return (0, import_inflection11.camelize)(underscore(sort), true);
+  return (0, import_inflection12.camelize)(underscore(sort), true);
 }
 function formatFields(fields) {
   return entries(fields).reduce(
@@ -3728,10 +3796,11 @@ var MIME_TYPE = "application/vnd.api+json";
 
 // src/packages/jsonapi/errors/not-acceptable-error.ts
 var NotAcceptableError = class extends TypeError {
-  constructor(contentType) {
+  constructor(accept) {
     super(line`
-      Media type parameters is not supported. Try your request again
-      without specifying '${contentType.replace(MIME_TYPE, "")}'.
+      Every '${MIME_TYPE}' in Accept: '${accept}' has media type parameters,
+      which are not supported. Try your request again with '${MIME_TYPE}'
+      without parameters.
     `);
   }
 };
@@ -3741,8 +3810,9 @@ var not_acceptable_error_default = createServerError(NotAcceptableError, 406);
 var UnsupportedMediaTypeError = class extends TypeError {
   constructor(contentType) {
     super(line`
-      Media type parameters is not supported. Try your request again
-      without specifying '${contentType.replace(MIME_TYPE, "")}'.
+      Media type parameters are not supported in Content-Type:
+      '${contentType}'. Try your request again with Content-Type:
+      '${MIME_TYPE}' without parameters.
     `);
   }
 };
@@ -3757,17 +3827,59 @@ var InvalidContentTypeError = class extends TypeError {
     `);
   }
 };
-var invalid_content_type_error_default = createServerError(InvalidContentTypeError, 400);
+var invalid_content_type_error_default = createServerError(InvalidContentTypeError, 415);
+
+// src/packages/jsonapi/utils/media-type.ts
+var QUALITY = /^q\s*=/i;
+function splitUnquoted(value, delimiter) {
+  const parts = [];
+  let current = "";
+  let quoted = false;
+  let escaped = false;
+  for (const char of value) {
+    if (escaped) {
+      escaped = false;
+    } else if (quoted && char === "\\") {
+      escaped = true;
+    } else if (char === '"') {
+      quoted = !quoted;
+    } else if (!quoted && char === delimiter) {
+      parts.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  return [...parts, current];
+}
+function parseMediaType(value) {
+  const [type = "", ...params] = splitUnquoted(value, ";").map(
+    (part) => part.trim()
+  );
+  return {
+    type: type.toLowerCase(),
+    params: params.filter(Boolean)
+  };
+}
+function parseAccept(value) {
+  return splitUnquoted(value, ",").map((range) => {
+    const { type, params } = parseMediaType(range);
+    const quality = params.findIndex((param) => QUALITY.test(param));
+    return {
+      type,
+      params: quality === -1 ? params : params.slice(0, quality)
+    };
+  }).filter(({ type }) => type.length > 0);
+}
 
 // src/packages/jsonapi/utils/is-jsonapi.ts
 function isJSONAPI(value) {
-  return value.startsWith(MIME_TYPE);
+  return parseMediaType(value).type === MIME_TYPE;
 }
 
-// src/packages/jsonapi/utils/has-media-type.ts
-var PATTERN2 = /^application\/vnd.api\+json;charset=.+$/;
-function hasMediaType(value) {
-  return PATTERN2.test(value);
+// src/packages/jsonapi/utils/has-media-type-params.ts
+function hasMediaTypeParams(value) {
+  return parseMediaType(value).params.length > 0;
 }
 
 // src/utils/env.ts
@@ -3788,6 +3900,10 @@ function dataFor(status, err) {
   if (title) {
     errData.title = title;
   }
+  const source = err?.source;
+  if (source && (source.pointer || source.parameter)) {
+    errData.source = source;
+  }
   if (err && (isDevelopment() || /^\[public\]/gi.test(err.message))) {
     errData.detail = err.message.replace(/^\[public\]/gi, "");
   }
@@ -3868,9 +3984,12 @@ function createResponder(req, res) {
 }
 
 // src/packages/server/utils/validate-accept.ts
-function validateAccept(contentType) {
-  if (contentType && hasMediaType(contentType)) {
-    throw new not_acceptable_error_default(contentType);
+function validateAccept(accept) {
+  if (accept) {
+    const ranges = parseAccept(accept).filter(({ type }) => type === MIME_TYPE);
+    if (ranges.length && ranges.every(({ params }) => params.length)) {
+      throw new not_acceptable_error_default(accept);
+    }
   }
   return true;
 }
@@ -3879,7 +3998,7 @@ function validateAccept(contentType) {
 function validateContentType(contentType) {
   if (!contentType || !isJSONAPI(contentType)) {
     throw new invalid_content_type_error_default(contentType);
-  } else if (hasMediaType(contentType)) {
+  } else if (hasMediaTypeParams(contentType)) {
     throw new unsupported_media_type_error_default(contentType);
   }
   return true;
@@ -4007,9 +4126,10 @@ function merge(dest, source) {
 }
 
 // src/packages/controller/utils/params-to-query.ts
-function paramsToQuery(model, { id, page, sort, filter, fields, include }) {
+function paramsToQuery(model, { id, page, sort, filter, fields, include }, serializerFor = (related) => related.serializer) {
   const relationships = entries(model.relationships);
   const includedFields = omit(fields, model.resourceName);
+  const included = include && include.map((path) => path.split(".")[0]);
   let query = {
     id,
     filter,
@@ -4052,9 +4172,9 @@ function paramsToQuery(model, { id, page, sort, filter, fields, include }) {
     if (!value.includes(relationship.model.primaryKey)) {
       value = [relationship.model.primaryKey, ...value];
     }
-    if (include && value.length === 1 && include.includes(name)) {
-      value = [...value, ...relationship.model.serializer.attributes];
-    } else if (!include && value.length > 1) {
+    if (included && value.length === 1 && included.includes(name)) {
+      value = [...value, ...serializerFor(relationship.model).attributes];
+    } else if (!included && value.length > 1) {
       value = value.slice(0, 1);
     }
     return {
@@ -4069,18 +4189,19 @@ function paramsToQuery(model, { id, page, sort, filter, fields, include }) {
 }
 
 // src/packages/controller/utils/find-one.ts
-function findOne(model, req) {
+function findOne(model, req, serializerFor) {
   const params = merge(req.defaultParams, req.params);
-  const { id, select, include } = paramsToQuery(model, params);
+  const { id, select, include } = paramsToQuery(model, params, serializerFor);
   return model.find(id).select(...select).include(include);
 }
 
 // src/packages/controller/utils/find-many.ts
-function findMany(model, req) {
+function findMany(model, req, serializerFor) {
   const params = merge(req.defaultParams, req.params);
   const { sort, page, limit, select, filter, include } = paramsToQuery(
     model,
-    params
+    params,
+    serializerFor
   );
   return model.select(...select).include(include).limit(limit).page(page).where(filter).order(...sort);
 }
@@ -4110,6 +4231,53 @@ function resolveRelationships(model, relationships = {}) {
   );
 }
 
+// src/packages/controller/errors/related-record-not-found-error.ts
+var RelatedRecordNotFoundError = class extends Error {
+  constructor({ name, primaryKey }, primaryKeyValue, path) {
+    super(
+      `Could not find ${name} with ${primaryKey} ${stringify(primaryKeyValue)}.`
+    );
+    this.source = sourceFor(path);
+  }
+};
+var related_record_not_found_error_default = createServerError(RelatedRecordNotFoundError, 404);
+
+// src/packages/controller/utils/validate-relationships.ts
+async function validateRelationships(model, relationships = {}) {
+  await Promise.all(
+    entries(relationships).map(async ([key, value]) => {
+      const opts = model.relationshipFor(key);
+      const { data = null } = value || {};
+      if (!opts || !data) {
+        return;
+      }
+      const { model: related } = opts;
+      const isMany = Array.isArray(data);
+      const ids = (isMany ? data : [data]).map(
+        (item) => Reflect.get(Object(item), "id")
+      );
+      if (!ids.length) {
+        return;
+      }
+      const column = related.columnNameFor(related.primaryKey) || "id";
+      const rows = await related.table().whereIn(
+        `${related.tableName}.${column}`,
+        ids.filter((id) => id != null)
+      ).select(`${related.tableName}.${column}`);
+      const found = new Set(rows.map((row) => String(Reflect.get(row, column))));
+      const missing = ids.findIndex((id) => !found.has(String(id)));
+      if (missing >= 0) {
+        const path = `data.relationships.${key}.data`;
+        throw new related_record_not_found_error_default(
+          related,
+          ids[missing],
+          isMany ? `${path}.${missing}` : path
+        );
+      }
+    })
+  );
+}
+
 // src/packages/controller/constants.ts
 var BUILT_IN_ACTIONS = Object.freeze(["show", "index", "create", "update", "destroy"]);
 
@@ -4295,6 +4463,74 @@ var Controller = class {
    * @public
    */
   defaultPerPage = 25;
+  /**
+   * How many relationships deep an `?include` path may go on this
+   * controller's routes. `comments.reactions.user` is 3 levels deep; with `1`
+   * only direct relationships (`comments`) can be included. Paths deeper than
+   * this are rejected with `400 Bad Request`.
+   *
+   * Set it on `ApplicationController` to change it for the whole app, or on a
+   * single controller to override it there.
+   *
+   * ```javascript
+   * class ApplicationController extends Controller {
+   *   maxIncludeDepth = 2;
+   * }
+   * ```
+   *
+   * Every allowed path is enumerated up front from the serializers'
+   * relationships, and each nested level costs its own queries per request, so
+   * keep this small.
+   *
+   * @property maxIncludeDepth
+   * @type {Number}
+   * @default 3
+   * @public
+   */
+  maxIncludeDepth = 3;
+  /**
+   * Whether a namespace may fall back to the root Serializer of a type it has
+   * no Serializer for. Read from a namespace's `ApplicationController` and
+   * applies to the whole namespace.
+   *
+   * By default `app/controllers/admin/comments.js` without an
+   * `app/serializers/admin/comments.js` — or an included type without one —
+   * is serialized by the root Serializer, with every attribute and
+   * relationship it declares. For a namespace that must only expose what it
+   * declares itself, turn the fallback off:
+   *
+   * ```javascript
+   * // app/controllers/admin/application.js
+   * class AdminApplicationController extends ApplicationController {
+   *   serializerFallback = false;
+   * }
+   * ```
+   *
+   * The application then refuses to boot while any type the namespace can
+   * serialize or `include` (down to each controller's `maxIncludeDepth`) has
+   * no Serializer in that namespace, listing each missing one.
+   *
+   * @property serializerFallback
+   * @type {Boolean}
+   * @default true
+   * @public
+   */
+  serializerFallback = true;
+  /**
+   * The Serializer to serialize (and validate, and load) related resources of
+   * this Controller's responses with: the related model's Serializer in this
+   * Controller's namespace, falling back to the root one.
+   *
+   * Always this Controller's namespace — not its Serializer's, which is the
+   * root one when the namespace has no Serializer for this resource.
+   *
+   * @method serializerFor
+   * @private
+   */
+  serializerFor(model) {
+    const { serializer, namespace } = this;
+    return serializer ? serializer.serializerFor(model, namespace) : model.serializer;
+  }
   constructor({ model, namespace, serializer }) {
     Object.assign(this, {
       model,
@@ -4320,7 +4556,7 @@ var Controller = class {
    * @public
    */
   index(req) {
-    return findMany(this.model, req);
+    return findMany(this.model, req, (related) => this.serializerFor(related));
   }
   /**
    * This method supports including relationships, and sparse fieldsets via
@@ -4335,7 +4571,7 @@ var Controller = class {
    * @public
    */
   show(req) {
-    return findOne(this.model, req);
+    return findOne(this.model, req, (related) => this.serializerFor(related));
   }
   /**
    * Create and return a single Model instance that the Controller instance
@@ -4356,6 +4592,7 @@ var Controller = class {
         data: { attributes, relationships }
       }
     } = req;
+    await validateRelationships(model, relationships);
     const record = await model.create({
       ...attributes,
       ...resolveRelationships(model, relationships)
@@ -4381,12 +4618,13 @@ var Controller = class {
    */
   update(req) {
     const { model } = this;
-    return findOne(model, req).then((record) => {
+    return findOne(model, req, (related) => this.serializerFor(related)).then(async (record) => {
       const {
         params: {
           data: { attributes, relationships }
         }
       } = req;
+      await validateRelationships(model, relationships);
       return record.update({
         ...attributes,
         ...resolveRelationships(model, relationships)
@@ -4410,7 +4648,7 @@ var Controller = class {
    * @public
    */
   destroy(req) {
-    return findOne(this.model, req).then((record) => record.destroy()).then(() => 204);
+    return findOne(this.model, req, (related) => this.serializerFor(related)).then((record) => record.destroy()).then(() => 204);
   }
   /**
    * Respond to HEAD or OPTIONS requests.
@@ -4428,7 +4666,194 @@ var Controller = class {
 var controller_default = Controller;
 
 // src/packages/serializer/index.ts
-var import_inflection12 = require("inflection");
+var import_path3 = require("path");
+var import_inflection14 = require("inflection");
+
+// src/packages/loader/resolver/utils/closest-ancestor.ts
+var import_path2 = require("path");
+function closestAncestor(source, key) {
+  const name = import_path2.posix.basename(key);
+  let namespace = import_path2.posix.dirname(key);
+  if (namespace === ".") {
+    return source.get(name);
+  }
+  namespace = import_path2.posix.dirname(namespace);
+  const ancestor = source.get(import_path2.posix.join(namespace, name));
+  if (ancestor) {
+    return ancestor;
+  }
+  return closestAncestor(source, import_path2.posix.join(import_path2.posix.dirname(namespace), name));
+}
+
+// src/packages/serializer/utils/load-linkage.ts
+var import_inflection13 = require("inflection");
+var valueOf = (record, key) => Reflect.get(record, key);
+var toId = (value) => value == null ? null : String(value);
+async function loadLinkage(model, records, names) {
+  const ids = Array.from(
+    new Set(records.map((record) => record.getPrimaryKey()))
+  );
+  const linkage = /* @__PURE__ */ new Map();
+  const belongsTo = [];
+  const queries = [];
+  ids.forEach((id) => {
+    linkage.set(
+      String(id),
+      names.reduce((result, name) => {
+        const opts = model.relationshipFor(name);
+        result[name] = opts && opts.type === "hasMany" ? [] : null;
+        return result;
+      }, {})
+    );
+  });
+  if (!ids.length) {
+    return linkage;
+  }
+  const link = (ownerId, name, relatedId) => {
+    const owner = linkage.get(String(ownerId));
+    const id = toId(relatedId);
+    if (!owner || id === null) {
+      return;
+    }
+    const current = owner[name];
+    if (Array.isArray(current)) {
+      if (!current.includes(id)) {
+        current.push(id);
+      }
+    } else if (current === null) {
+      owner[name] = id;
+    }
+  };
+  names.forEach((name) => {
+    const opts = model.relationshipFor(name);
+    if (!opts) {
+      return;
+    }
+    const { type, through, model: related } = opts;
+    const foreignKey = (0, import_inflection13.camelize)(opts.foreignKey, true);
+    if (type === "belongsTo") {
+      belongsTo.push([name, foreignKey, related]);
+    } else if (through) {
+      const inverse = related.relationshipFor(opts.inverse);
+      if (!inverse) {
+        return;
+      }
+      const relatedKey = (0, import_inflection13.camelize)(inverse.foreignKey, true);
+      queries.push(
+        (async () => {
+          const rows = await through.select(foreignKey, relatedKey).where({ [foreignKey]: ids });
+          rows.forEach((row) => {
+            link(valueOf(row, foreignKey), name, valueOf(row, relatedKey));
+          });
+        })()
+      );
+    } else {
+      queries.push(
+        (async () => {
+          const rows = await related.select(related.primaryKey, foreignKey).where({ [foreignKey]: ids }).order(related.primaryKey, "ASC");
+          rows.forEach((row) => {
+            link(valueOf(row, foreignKey), name, row.getPrimaryKey());
+          });
+        })()
+      );
+    }
+  });
+  if (belongsTo.length) {
+    queries.push(
+      (async () => {
+        const rows = await model.select(model.primaryKey, ...belongsTo.map(([, key]) => key)).where({ [model.primaryKey]: ids });
+        rows.forEach((row) => {
+          belongsTo.forEach(([name, key]) => {
+            link(row.getPrimaryKey(), name, valueOf(row, key));
+          });
+        });
+        await dropDangling(linkage, belongsTo);
+      })()
+    );
+  }
+  await Promise.all(queries);
+  return linkage;
+}
+async function dropDangling(linkage, belongsTo) {
+  const wanted = /* @__PURE__ */ new Map();
+  belongsTo.forEach(([name, , related]) => {
+    const ids = wanted.get(related) || /* @__PURE__ */ new Set();
+    linkage.forEach(({ [name]: id }) => {
+      if (typeof id === "string") {
+        ids.add(id);
+      }
+    });
+    wanted.set(related, ids);
+  });
+  const existing = /* @__PURE__ */ new Map();
+  await Promise.all(
+    Array.from(wanted, async ([related, ids]) => {
+      if (!ids.size) {
+        existing.set(related, ids);
+        return;
+      }
+      const rows = await related.select(related.primaryKey).where({ [related.primaryKey]: Array.from(ids) });
+      existing.set(
+        related,
+        new Set(rows.map((row) => String(row.getPrimaryKey())))
+      );
+    })
+  );
+  belongsTo.forEach(([name, , related]) => {
+    const found = existing.get(related);
+    linkage.forEach((owner) => {
+      const id = owner[name];
+      if (typeof id === "string" && !found?.has(id)) {
+        owner[name] = null;
+      }
+    });
+  });
+}
+
+// src/packages/serializer/utils/include-tree.ts
+function createIncludeTree(paths = []) {
+  const tree = /* @__PURE__ */ new Map();
+  paths.forEach((path) => {
+    path.split(".").filter(Boolean).reduce((node, name) => {
+      let child = node.get(name);
+      if (!child) {
+        child = /* @__PURE__ */ new Map();
+        node.set(name, child);
+      }
+      return child;
+    }, tree);
+  });
+  return tree;
+}
+function enumerateIncludePaths(model, names, depth, serializerFor = (related) => related.serializer) {
+  if (depth < 1) {
+    return [];
+  }
+  return names.reduce((paths, name) => {
+    const opts = model.relationshipFor(name);
+    if (!opts) {
+      return paths;
+    }
+    const { model: related } = opts;
+    const serializer = serializerFor(related);
+    if (!serializer) {
+      return [...paths, name];
+    }
+    const { hasOne, hasMany } = serializer;
+    return [
+      ...paths,
+      name,
+      ...enumerateIncludePaths(
+        related,
+        [...hasOne, ...hasMany],
+        depth - 1,
+        serializerFor
+      ).map((path) => `${name}.${path}`)
+    ];
+  }, []);
+}
+
+// src/packages/serializer/index.ts
 var Serializer = class {
   /**
    * An Array of the `hasOne` or `belongsTo` relationships on a Serializer
@@ -4515,9 +4940,17 @@ var Serializer = class {
    * the resource and relationship objects in the returned [JSON API](
    * http://jsonapi.org) document object.
    *
-   * @param {Array} options.include - An array of strings containing the
-   * relationship keys that should be added to the top level included object of
-   * the returned [JSON API](http://jsonapi.org) document object.
+   * @param {Array} options.include - An array of relationship paths (e.g.
+   * `'comments'` or `'comments.user'`) whose resources should be added to the
+   * top level included object of the returned [JSON API](http://jsonapi.org)
+   * document object. Intermediate resources of a nested path are included too.
+   *
+   * @param {String} options.namespace - The namespace of the request, i.e. of
+   * the Controller handling it. Every link in the document is built in it, and
+   * included resources are serialized by their Serializer in it (falling back
+   * to the root). Defaults to this Serializer's namespace — which is the root
+   * one when a namespaced Controller has no Serializer of its own, so the
+   * Controller passes its namespace explicitly.
    *
    * @return {Promise} Resolves with a [JSON API](http://jsonapi.org) document
    * object.
@@ -4528,38 +4961,61 @@ var Serializer = class {
     data,
     links,
     domain,
-    include
+    include,
+    namespace = this.namespace
   }) {
-    let serialized = {};
-    const included = [];
+    const tree = createIncludeTree(include);
+    const related = /* @__PURE__ */ new Map();
+    const included = /* @__PURE__ */ new Map();
+    const names = Array.from(tree.keys());
+    let primary;
+    let serialized;
     if (Array.isArray(data)) {
-      serialized = {
-        data: await Promise.all(
-          data.map(
-            (item) => this.formatOne({
-              item,
-              domain,
-              include,
-              included
-            })
-          )
+      primary = await Promise.all(
+        data.map(
+          (item) => this.formatOne({
+            item,
+            domain,
+            related,
+            namespace,
+            include: names
+          })
         )
-      };
+      );
+      serialized = { data: primary };
     } else {
-      serialized = {
-        data: await this.formatOne({
+      const resource2 = await this.formatOne({
+        domain,
+        related,
+        namespace,
+        item: data,
+        include: names,
+        links: false
+      });
+      primary = [resource2];
+      serialized = { data: resource2 };
+    }
+    for (const [name, children] of tree) {
+      const opts = this.model.relationshipFor(name);
+      const records = related.get(name);
+      if (opts && records) {
+        await this.addIncluded({
           domain,
-          include,
+          records,
           included,
-          item: data,
-          links: false
-        })
-      };
+          namespace,
+          model: opts.model,
+          tree: children
+        });
+      }
     }
-    if (included.length) {
+    primary.forEach((resource2) => {
+      included.delete(resourceKey(resource2));
+    });
+    if (included.size) {
       serialized = {
         ...serialized,
-        included: uniq(included, "id", "type")
+        included: Array.from(included.values())
       };
     }
     return {
@@ -4574,6 +5030,12 @@ var Serializer = class {
    * Transform a single Model instance into a [JSON API](http://jsonapi.org)
    * resource object.
    *
+   * Relationships are serialized in one of two ways. By default each one is
+   * read from the Model instance (for primary data the query has already
+   * loaded them). When `linkage` is given — as it is for included resources,
+   * whose relationships are batch-loaded by `addIncluded()` — the resource
+   * linkage is built from it instead, without touching the database.
+   *
    * @method formatOne
    *
    * @param {Object} options - An options object used for building the returned
@@ -4590,17 +5052,19 @@ var Serializer = class {
    * the top level links object or relationship links objects in the returned
    * [JSON API](http://jsonapi.org) resource object.
    *
-   * @param {Array} options.include - An array of strings containing the
-   * relationship keys that should be added to the top level included object of
-   * a [JSON API](http://jsonapi.org) document object.
+   * @param {Array} options.include - An array of the relationship keys whose
+   * related records should be collected into `options.related`.
    *
-   * @param {Array} options.included - An array of [JSON API](
-   * http://jsonapi.org) resource objects that will be added to the top level
-   * included array of a [JSON API](http://jsonapi.org) document object.
+   * @param {Map} options.related - Collects, per relationship key in
+   * `options.include`, the related Model instances that belong in the top
+   * level included object of a [JSON API](http://jsonapi.org) document object.
    *
-   * @param {Boolean} options.formatRelationships - Wether or not
-   * relationships should be formatted and included in the returned
-   * [JSON API](http://jsonapi.org) resource object.
+   * @param {Object} options.linkage - Pre-loaded resource linkage (related
+   * primary keys per relationship key) to serialize relationships from.
+   *
+   * @param {String} options.namespace - The namespace to build links in.
+   * Defaults to this Serializer's; included resources pass the namespace of
+   * the request, so every link in a document points into the same namespace.
    *
    * @return {Promise} Resolves with a [JSON API](http://jsonapi.org) resource
    * object.
@@ -4611,13 +5075,15 @@ var Serializer = class {
     item,
     links,
     domain,
-    include,
-    included,
-    formatRelationships = true
+    include = [],
+    related,
+    linkage,
+    namespace = this.namespace
   }) {
     const { resourceName: type } = item;
     const id = String(item.getPrimaryKey());
-    let relationships = {};
+    const names = [...this.hasOne, ...this.hasMany];
+    let relationships;
     const attributes = dasherizeKeys(
       item.getAttributes(
         ...Object.keys(item.rawColumnData).filter(
@@ -4630,34 +5096,41 @@ var Serializer = class {
       type,
       attributes
     };
-    if (formatRelationships) {
+    if (linkage) {
+      relationships = names.reduce(
+        (hash, name) => ({
+          ...hash,
+          [(0, import_inflection14.dasherize)(underscore(name))]: this.formatLinkage(
+            domain,
+            this.model.relationshipFor(name)?.model.resourceName,
+            linkage[name],
+            namespace
+          )
+        }),
+        {}
+      );
+    } else {
+      const collect = (name, records) => {
+        if (related && include.includes(name)) {
+          related.set(name, [...related.get(name) || [], ...records]);
+        }
+      };
       relationships = await promiseHash(
-        [...this.hasOne, ...this.hasMany].reduce(
+        names.reduce(
           (hash, name) => ({
             ...hash,
-            [(0, import_inflection12.dasherize)(underscore(name))]: (async () => {
-              const related = await Reflect.get(item, name);
-              if (Array.isArray(related)) {
+            [(0, import_inflection14.dasherize)(underscore(name))]: (async () => {
+              const value = await Reflect.get(item, name);
+              if (Array.isArray(value)) {
+                collect(name, value);
                 return {
-                  data: await Promise.all(
-                    related.map(async (relatedItem) => {
-                      const { data: relatedData } = await this.formatRelationship({
-                        domain,
-                        included,
-                        item: relatedItem,
-                        include: include.includes(name)
-                      });
-                      return relatedData;
-                    })
+                  data: value.map(
+                    (relatedItem) => this.formatRelationship(relatedItem, domain, namespace).data
                   )
                 };
-              } else if (related && related.id != null) {
-                return this.formatRelationship({
-                  domain,
-                  included,
-                  item: related,
-                  include: include.includes(name)
-                });
+              } else if (value && value.id != null) {
+                collect(name, [value]);
+                return this.formatRelationship(value, domain, namespace);
               }
               return {
                 data: null
@@ -4672,16 +5145,9 @@ var Serializer = class {
       serialized.relationships = relationships;
     }
     if (links || typeof links !== "boolean") {
-      const { namespace } = this;
-      if (namespace) {
-        serialized.links = {
-          self: `${domain}/${namespace}/${type}/${id}`
-        };
-      } else {
-        serialized.links = {
-          self: `${domain}/${type}/${id}`
-        };
-      }
+      serialized.links = {
+        self: this.linkFor(domain, type, id, namespace)
+      };
     }
     return serialized;
   }
@@ -4691,70 +5157,167 @@ var Serializer = class {
    *
    * @method formatRelationship
    *
-   * @param {Object} options - An options object used for building the returned
+   * @param {Model} item - The Model instance to transform into the returned
    * [JSON API](http://jsonapi.org) relationship object.
    *
-   * @param {Model} options.item - The Model instance to transform into the
+   * @param {String} domain - A string used to build links included in the
    * returned [JSON API](http://jsonapi.org) relationship object.
    *
-   * @param {String} options.domain - A string used to build links included in
-   * the returned [JSON API](http://jsonapi.org) relationship object.
+   * @return {Object} A [JSON API](http://jsonapi.org) relationship object.
    *
-   * @param {Array} options.include - An array of strings containing the
-   * relationship keys that should be added to the top level included object of
-   * a [JSON API](http://jsonapi.org) document object.
-   *
-   * @param {Array} options.included - An array of [JSON API](
-   * http://jsonapi.org) resource objects that will be added to the top level
-   * included array of a [JSON API](http://jsonapi.org) document object.
-   *
-   * @return {Promise} Resolves with a [JSON API](http://jsonapi.org)
-   * relationship object.
+   * @private
+   */
+  formatRelationship(item, domain, namespace = this.namespace) {
+    return this.formatLinkage(
+      domain,
+      item.resourceName,
+      String(item.getPrimaryKey()),
+      namespace
+    );
+  }
+  /**
+   * Build a [JSON API](http://jsonapi.org) relationship object from resource
+   * linkage, in the same shape `formatRelationship()` produces from Model
+   * instances: to-one relationships carry a `links` object, to-many ones only
+   * `data`, and a missing to-one relationship is `{ data: null }`.
    *
+   * @method formatLinkage
    * @private
    */
-  async formatRelationship({
-    item,
-    domain,
-    include,
-    included
-  }) {
-    const { namespace } = this;
-    const {
-      resourceName: type,
-      constructor: { serializer }
-    } = item;
-    const id = String(item.getPrimaryKey());
-    let links;
-    if (namespace) {
-      links = {
-        self: `${domain}/${namespace}/${type}/${id}`
-      };
-    } else {
-      links = {
-        self: `${domain}/${type}/${id}`
+  formatLinkage(domain, type, linkage, namespace = this.namespace) {
+    if (Array.isArray(linkage)) {
+      return {
+        data: type ? linkage.map((id) => ({ id, type })) : []
       };
     }
-    if (include) {
-      included.push(
-        await serializer.formatOne({
-          item,
-          domain,
-          include: [],
-          included: [],
-          formatRelationships: false
-        })
-      );
+    if (linkage == null || !type) {
+      return {
+        data: null
+      };
     }
     return {
       data: {
-        id,
+        id: linkage,
         type
       },
-      links
+      links: {
+        self: this.linkFor(domain, type, linkage, namespace)
+      }
     };
   }
+  /**
+   * Add `records` (instances of `model`) to `included` as resource objects,
+   * then recurse into the relationships named in `tree`. Each is serialized by
+   * `model`'s Serializer in this Serializer's namespace (`serializerFor()`), so
+   * `/admin/posts?include=comments` uses `AdminCommentsSerializer` when there
+   * is one and `CommentsSerializer` otherwise. The relationships of every level
+   * are batch-loaded with one query per relationship, not one per record.
+   *
+   * @method addIncluded
+   * @private
+   */
+  async addIncluded({
+    model,
+    records,
+    tree,
+    domain,
+    included,
+    namespace
+  }) {
+    const serializer = this.serializerFor(model, namespace);
+    const unique = Array.from(
+      new Map(records.map((record) => [record.getPrimaryKey(), record])).values()
+    );
+    if (!unique.length) {
+      return;
+    }
+    const names = [...serializer.hasOne, ...serializer.hasMany];
+    const linkage = await loadLinkage(model, unique, names);
+    for (const item of unique) {
+      const id = String(item.getPrimaryKey());
+      const key = resourceKey({ id, type: item.resourceName });
+      if (!included.has(key)) {
+        included.set(
+          key,
+          await serializer.formatOne({
+            item,
+            domain,
+            linkage: linkage.get(id),
+            namespace
+          })
+        );
+      }
+    }
+    for (const [name, children] of tree) {
+      const opts = model.relationshipFor(name);
+      if (!opts || !names.includes(name)) {
+        continue;
+      }
+      const { model: next } = opts;
+      const ids = /* @__PURE__ */ new Set();
+      linkage.forEach(({ [name]: value }) => {
+        (Array.isArray(value) ? value : [value]).forEach((relatedId) => {
+          if (relatedId != null) {
+            ids.add(relatedId);
+          }
+        });
+      });
+      if (ids.size) {
+        const attributes = this.serializerFor(
+          next,
+          namespace
+        ).attributes.filter((attr) => next.attributeNames.includes(attr));
+        const nextRecords = await next.select(next.primaryKey, ...attributes).where({ [next.primaryKey]: Array.from(ids) });
+        await this.addIncluded({
+          domain,
+          included,
+          namespace,
+          model: next,
+          records: nextRecords,
+          tree: children
+        });
+      }
+    }
+  }
+  /**
+   * Resolve the Serializer for `model` in `namespace` (this Serializer's by
+   * default), the way a namespaced Controller resolves its own:
+   * `admin/comments` if it exists, otherwise the closest ancestor namespace's,
+   * down to the root `comments` Serializer. Falls back to `model.serializer`
+   * when this Serializer was not created by an application (e.g. in
+   * isolation).
+   *
+   * Pass the request's namespace when there is one: a Serializer's own
+   * namespace is the root one whenever it is a namespaced Controller's
+   * fallback.
+   *
+   * @method serializerFor
+   * @private
+   */
+  serializerFor(model, namespace = this.namespace) {
+    const { serializers } = this;
+    if (serializers) {
+      const key = import_path3.posix.join(namespace || ".", model.resourceName);
+      const serializer = serializers.get(key) || closestAncestor(serializers, key);
+      if (serializer) {
+        return serializer;
+      }
+    }
+    return model.serializer;
+  }
+  /**
+   * @private
+   */
+  linkFor(domain, type, id, namespace = this.namespace) {
+    if (namespace) {
+      return `${domain}/${namespace}/${type}/${id}`;
+    }
+    return `${domain}/${type}/${id}`;
+  }
 };
+function resourceKey({ id, type }) {
+  return `${type}:${id}`;
+}
 var serializer_default = Serializer;
 
 // src/packages/config/index.ts
@@ -4953,7 +5516,10 @@ function resource(action) {
         data,
         links,
         domain,
-        include
+        include,
+        // The request's namespace, not the serializer's: a namespaced
+        // controller without its own serializer is given the root one.
+        namespace
       });
     }
     return data;
@@ -5034,6 +5600,7 @@ var ParameterTypeError = class extends TypeError {
       Expected type '${type || "undefined"}' for parameter '${path}' but got
       '${actual}'.
     `);
+    this.source = sourceFor(path);
   }
 };
 var parameter_type_error_default = createServerError(ParameterTypeError, 400);
@@ -5046,6 +5613,7 @@ var ParameterValueError = class extends TypeError {
       [${param.size ? Array.from(param.values()).join(", ") : ""}] but got
       ${String(actual)}.
     `);
+    this.source = sourceFor(param.path);
   }
 };
 var parameter_value_error_default = createServerError(ParameterValueError, 400);
@@ -5054,6 +5622,7 @@ var parameter_value_error_default = createServerError(ParameterValueError, 400);
 var InvalidParameterError = class extends TypeError {
   constructor(path) {
     super(`'${path}' is not a valid parameter for this resource.`);
+    this.source = sourceFor(path);
   }
 };
 var invalid_parameter_error_default = createServerError(InvalidParameterError, 400);
@@ -5069,6 +5638,7 @@ var ResourceMismatchError = class extends TypeError {
       Expected '${String(expected)}' for parameter '${path}' but got
       ${String(normalized)}.
     `);
+    this.source = sourceFor(path);
   }
 };
 var resource_mismatch_error_default = createServerError(ResourceMismatchError, 409);
@@ -5077,14 +5647,34 @@ var resource_mismatch_error_default = createServerError(ResourceMismatchError, 4
 var ParameterRequiredError = class extends TypeError {
   constructor(path) {
     super(`Missing required parameter '${path}'.`);
+    this.source = sourceFor(path);
   }
 };
 var parameter_required_error_default = createServerError(ParameterRequiredError, 400);
 
+// src/packages/router/route/params/errors/client-generated-id-error.ts
+var ClientGeneratedIdError = class extends TypeError {
+  constructor() {
+    super("Client-generated IDs are not supported for this resource.");
+    this.source = sourceFor("data.id");
+  }
+};
+var client_generated_id_error_default = createServerError(ClientGeneratedIdError, 403);
+
+// src/packages/router/route/params/errors/forbidden-parameter-error.ts
+var ForbiddenParameterError = class extends TypeError {
+  constructor(path) {
+    super(`Setting '${path}' is not supported for this resource.`);
+    this.source = sourceFor(path);
+  }
+};
+var forbidden_parameter_error_default = createServerError(ForbiddenParameterError, 403);
+
 // src/packages/router/route/params/errors/parameter-not-nullable-error.ts
 var ParameterNotNullableError = class extends TypeError {
   constructor({ path }) {
     super(`Parameter '${path}' is not nullable.`);
+    this.source = sourceFor(path);
   }
 };
 var parameter_not_nullable_error_default = createServerError(ParameterNotNullableError, 400);
@@ -5213,13 +5803,14 @@ var Parameter = class extends set_default {
       path,
       type,
       required: Boolean(required),
-      sanitize: Boolean(sanitize)
+      sanitize: Boolean(sanitize),
+      restricted: values !== void 0
     });
     this.freeze();
   }
   validate(value) {
     validateType2(this, value);
-    if (this.size > 0) {
+    if (this.restricted) {
       return validateValue(this, value);
     }
     return value;
@@ -5238,6 +5829,17 @@ function getURLParams(dynamicSegments) {
   ]);
 }
 
+// src/packages/router/route/params/parameter/forbidden-parameter.ts
+var ForbiddenParameter = class extends parameter_default {
+  constructor(path) {
+    super({ path });
+  }
+  validate() {
+    throw new forbidden_parameter_error_default(this.path);
+  }
+};
+var forbidden_parameter_default = ForbiddenParameter;
+
 // src/packages/router/route/params/utils/get-data-params.ts
 function getIDParam({ model }) {
   const primaryKeyColumn = model.columnFor(model.primaryKey);
@@ -5290,16 +5892,48 @@ function getRelationshipsParam({
   model,
   params
 }) {
+  const forbidden = Object.keys(model.relationships).filter((key) => !params.includes(key)).map((key) => [
+    key,
+    new forbidden_parameter_default(`data.relationships.${key}`)
+  ]);
   return [
     "relationships",
     new parameter_group_default(
-      params.reduce((group, param) => {
-        const path = `data.relationships.${param}`;
-        const opts = model.relationshipFor(param);
-        if (!opts) {
-          return group;
-        }
-        if (opts.type === "hasMany") {
+      [
+        ...params.reduce((group, param) => {
+          const path = `data.relationships.${param}`;
+          const opts = model.relationshipFor(param);
+          if (!opts) {
+            return group;
+          }
+          if (opts.type === "hasMany") {
+            return [
+              ...group,
+              [
+                param,
+                new parameter_group_default(
+                  [
+                    [
+                      "data",
+                      new parameter_default({
+                        type: "array",
+                        path: `${path}.data`,
+                        required: true
+                      })
+                    ]
+                  ],
+                  {
+                    path
+                  }
+                )
+              ]
+            ];
+          }
+          const primaryKeyColumn = opts.model.columnFor(opts.model.primaryKey);
+          let primaryKeyType = "number";
+          if (primaryKeyColumn) {
+            primaryKeyType = typeForColumn(primaryKeyColumn);
+          }
           return [
             ...group,
             [
@@ -5308,11 +5942,32 @@ function getRelationshipsParam({
                 [
                   [
                     "data",
-                    new parameter_default({
-                      type: "array",
-                      path: `${path}.data`,
-                      required: true
-                    })
+                    new parameter_group_default(
+                      [
+                        [
+                          "id",
+                          new parameter_default({
+                            type: primaryKeyType,
+                            path: `${path}.data.id`,
+                            required: true
+                          })
+                        ],
+                        [
+                          "type",
+                          new parameter_default({
+                            type: "string",
+                            path: `${path}.data.type`,
+                            values: [opts.model.resourceName],
+                            required: true
+                          })
+                        ]
+                      ],
+                      {
+                        type: "array",
+                        path: `${path}.data`,
+                        required: true
+                      }
+                    )
                   ]
                 ],
                 {
@@ -5321,55 +5976,9 @@ function getRelationshipsParam({
               )
             ]
           ];
-        }
-        const primaryKeyColumn = opts.model.columnFor(opts.model.primaryKey);
-        let primaryKeyType = "number";
-        if (primaryKeyColumn) {
-          primaryKeyType = typeForColumn(primaryKeyColumn);
-        }
-        return [
-          ...group,
-          [
-            param,
-            new parameter_group_default(
-              [
-                [
-                  "data",
-                  new parameter_group_default(
-                    [
-                      [
-                        "id",
-                        new parameter_default({
-                          type: primaryKeyType,
-                          path: `${path}.data.id`,
-                          required: true
-                        })
-                      ],
-                      [
-                        "type",
-                        new parameter_default({
-                          type: "string",
-                          path: `${path}.data.type`,
-                          values: [opts.model.resourceName],
-                          required: true
-                        })
-                      ]
-                    ],
-                    {
-                      type: "array",
-                      path: `${path}.data`,
-                      required: true
-                    }
-                  )
-                ]
-              ],
-              {
-                path
-              }
-            )
-          ]
-        ];
-      }, []),
+        }, []),
+        ...forbidden
+      ],
       {
         path: "data.relationships"
       }
@@ -5477,10 +6086,9 @@ function getFilterParam({ filter }) {
     )
   ];
 }
-function getFieldsParam({
-  model,
-  serializer: { hasOne, hasMany, attributes }
-}) {
+function getFieldsParam(controller) {
+  const { model, serializer } = controller;
+  const { hasOne, hasMany, attributes } = serializer;
   const relationships = [...hasOne, ...hasMany];
   return [
     "fields",
@@ -5509,7 +6117,7 @@ function getFieldsParam({
                     sanitize: true,
                     values: [
                       opts.model.primaryKey,
-                      ...opts.model.serializer.attributes
+                      ...controller.serializerFor(opts.model).attributes
                     ]
                   })
                 ]
@@ -5527,16 +6135,30 @@ function getFieldsParam({
     )
   ];
 }
-function getIncludeParam({
-  serializer: { hasOne, hasMany }
-}) {
+function getIncludeParam(controller) {
+  const { model, maxIncludeDepth, serializer } = controller;
+  const { hasOne, hasMany } = serializer;
   const relationships = [...hasOne, ...hasMany];
   return [
     "include",
     new parameter_default({
       path: "include",
       type: "array",
-      values: relationships
+      // Every top level name stays allowed (as before), plus the nested paths
+      // (`comments.user`) reachable through each related serializer in the
+      // controller's namespace (at every level, even below a root fallback
+      // serializer), down to the controller's `maxIncludeDepth`.
+      values: Array.from(
+        /* @__PURE__ */ new Set([
+          ...relationships,
+          ...enumerateIncludePaths(
+            model,
+            relationships,
+            maxIncludeDepth,
+            (related) => controller.serializerFor(related)
+          )
+        ])
+      )
     })
   ];
 }
@@ -5574,6 +6196,15 @@ function getCollectionQueryParams(controller) {
   return getCustomParams(controller);
 }
 
+// src/packages/router/route/params/utils/validate-client-id.ts
+function validateClientId(params) {
+  const { data } = params;
+  if (data && typeof data === "object" && Reflect.has(data, "id")) {
+    throw new client_generated_id_error_default();
+  }
+  return true;
+}
+
 // src/packages/router/route/params/utils/validate-resource-id.ts
 function validateResourceId({
   params: {
@@ -5739,6 +6370,9 @@ var Route = class extends set_default {
       ...req.params,
       ...this.parseParams(req.url.params)
     };
+    if (this.action === "create" && req.method === "POST") {
+      validateClientId(params);
+    }
     if (req.method !== "OPTIONS") {
       params = this.params.validate(params);
     }
@@ -6051,10 +6685,10 @@ var Router = class extends map_default {
 var router_default = Router;
 
 // src/packages/loader/utils/bundle-for.ts
-var import_path2 = require("path");
+var import_path4 = require("path");
 
 // src/packages/loader/utils/format-key.ts
-var import_inflection13 = require("inflection");
+var import_inflection15 = require("inflection");
 var NAMESPACE_DELIMITER = /\$-/g;
 function formatKey(key, formatter) {
   return chain(key).pipe((str) => {
@@ -6062,7 +6696,7 @@ function formatKey(key, formatter) {
       return formatter(str);
     }
     return str;
-  }).pipe(underscore).pipe(import_inflection13.dasherize).pipe((str) => str.replace(NAMESPACE_DELIMITER, "/")).value();
+  }).pipe(underscore).pipe(import_inflection15.dasherize).pipe((str) => str.replace(NAMESPACE_DELIMITER, "/")).value();
 }
 
 // src/packages/loader/utils/bundle-for.ts
@@ -6129,31 +6763,15 @@ function normalize2(manifest) {
 }
 function bundleFor(path) {
   const manifest = Reflect.apply(require, null, [
-    (0, import_path2.join)(path, "dist", "bundle")
+    (0, import_path4.join)(path, "dist", "bundle")
   ]);
   return chain(manifest).pipe(normalize2).pipe(entries).pipe((pairs) => new map_default(pairs)).value().freeze();
 }
 
-// src/packages/loader/resolver/utils/closest-ancestor.ts
-var import_path3 = require("path");
-function closestAncestor(source, key) {
-  const name = import_path3.posix.basename(key);
-  let namespace = import_path3.posix.dirname(key);
-  if (namespace === ".") {
-    return source.get(name);
-  }
-  namespace = import_path3.posix.dirname(namespace);
-  const ancestor = source.get(import_path3.posix.join(namespace, name));
-  if (ancestor) {
-    return ancestor;
-  }
-  return closestAncestor(source, import_path3.posix.join(import_path3.posix.dirname(namespace), name));
-}
-
 // src/packages/loader/resolver/utils/closest-child.ts
-var import_path4 = require("path");
+var import_path5 = require("path");
 function closestChild(source, key) {
-  const [[, result] = []] = Array.from(source).map(([path, value]) => [import_path4.posix.basename(path), value]).filter(([resource2]) => key === resource2);
+  const [[, result] = []] = Array.from(source).map(([path, value]) => [import_path5.posix.basename(path), value]).filter(([resource2]) => key === resource2);
   return result;
 }
 
@@ -6176,7 +6794,7 @@ function resolve(group) {
 }
 
 // src/packages/loader/builder/utils/create-parent-builder.ts
-var import_path5 = require("path");
+var import_path6 = require("path");
 
 // src/packages/loader/builder/utils/sort-by-namespace.ts
 function sortByNamespace([a], [b]) {
@@ -6197,7 +6815,7 @@ function createParentBuilder(construct) {
       let grandparent = null;
       if (key !== "root") {
         const found = result.find((namespace) => {
-          const dirname = import_path5.posix.dirname(key);
+          const dirname = import_path6.posix.dirname(key);
           if (namespace.key === "root") {
             return dirname === ".";
           }
@@ -6267,13 +6885,13 @@ function normalizePort(port) {
 }
 
 // src/packages/application/utils/create-controller.ts
-var import_path6 = require("path");
+var import_path7 = require("path");
 function createController(constructor, opts) {
   const { key, store, serializers } = opts;
-  const namespace = import_path6.posix.dirname(key).replace(".", "");
+  const namespace = import_path7.posix.dirname(key).replace(".", "");
   let { parent } = opts;
   let model = tryCatchSync(
-    () => store.modelFor(import_path6.posix.basename(key))
+    () => store.modelFor(import_path7.posix.basename(key))
   );
   let serializer = serializers.get(key);
   if (!model) {
@@ -6329,13 +6947,13 @@ function createController(constructor, opts) {
 }
 
 // src/packages/application/utils/create-serializer.ts
-var import_path7 = require("path");
+var import_path8 = require("path");
 function createSerializer(constructor, opts) {
   const { key, store } = opts;
-  const namespace = import_path7.posix.dirname(key).replace(".", "");
+  const namespace = import_path8.posix.dirname(key).replace(".", "");
   let { parent } = opts;
   let model = tryCatchSync(
-    () => store.modelFor(import_path7.posix.basename(key))
+    () => store.modelFor(import_path8.posix.basename(key))
   );
   if (!model) {
     model = null;
@@ -6359,6 +6977,85 @@ function createSerializer(constructor, opts) {
   return deepFreezeProps(instance, true, "hasOne", "hasMany", "attributes");
 }
 
+// src/packages/application/utils/validate-namespaced-serializers.ts
+var import_path9 = require("path");
+
+// src/errors/namespaced-serializer-missing-error.ts
+var NamespacedSerializerMissingError = class extends ReferenceError {
+  /**
+   * @param missing - Each missing serializer key (`admin/comments`) with an
+   * example of how it is reached (`admin/posts?include=comments`).
+   */
+  constructor(missing) {
+    const lines = Array.from(missing).sort(([a], [b]) => a.localeCompare(b)).map(([key, via]) => `  - ${key} (reached from ${via})`);
+    super(
+      [
+        "Missing namespaced serializers. These namespaces set `serializerFallback = false`, so every type their controllers can serialize or include needs a serializer of its own:",
+        ...lines
+      ].join("\n")
+    );
+  }
+};
+var namespaced_serializer_missing_error_default = NamespacedSerializerMissingError;
+
+// src/packages/application/utils/validate-namespaced-serializers.ts
+var distance = (via) => {
+  const [, include] = via.split("?include=");
+  return include ? include.split(".").length : 0;
+};
+function validateNamespacedSerializers(controllers, serializers) {
+  const missing = /* @__PURE__ */ new Map();
+  controllers.forEach((controller, key) => {
+    const { namespace, model } = controller;
+    if (!namespace || !model) {
+      return;
+    }
+    const application = controllers.get(import_path9.posix.join(namespace, "application"));
+    if (!application || application.serializerFallback !== false) {
+      return;
+    }
+    const require2 = (type, via) => {
+      const serializerKey = import_path9.posix.join(namespace, type);
+      const serializer = serializers.get(serializerKey);
+      if (!serializer) {
+        const known = missing.get(serializerKey);
+        if (known === void 0 || distance(via) < distance(known)) {
+          missing.set(serializerKey, via);
+        }
+      }
+      return serializer;
+    };
+    const own = require2(model.resourceName, key);
+    if (!own) {
+      return;
+    }
+    const depth = Math.max(controller.maxIncludeDepth, 1);
+    let level = [
+      [model, own, []]
+    ];
+    for (let current = 1; current <= depth && level.length; current += 1) {
+      const next = [];
+      level.forEach(([parent, serializer, path]) => {
+        [...serializer.hasOne, ...serializer.hasMany].forEach((name) => {
+          const opts = parent.relationshipFor(name);
+          if (!opts) {
+            return;
+          }
+          const nextPath = [...path, name];
+          const related = require2(opts.model.resourceName, `${key}?include=${nextPath.join(".")}`);
+          if (related) {
+            next.push([opts.model, related, nextPath]);
+          }
+        });
+      });
+      level = next;
+    }
+  });
+  if (missing.size) {
+    throw new namespaced_serializer_missing_error_default(missing);
+  }
+}
+
 // src/packages/application/initialize.ts
 async function initialize3(app, { path, port, logging, database, server: serverConfig }) {
   const load = createLoader(path);
@@ -6381,6 +7078,14 @@ async function initialize3(app, { path, port, logging, database, server: serverC
       parent
     })
   );
+  serializers.forEach((serializer) => {
+    Reflect.defineProperty(serializer, "serializers", {
+      value: serializers,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+  });
   models.forEach((model) => {
     Reflect.defineProperty(model, "serializer", {
       value: closestChild(serializers, model.resourceName),
@@ -6406,6 +7111,7 @@ async function initialize3(app, { path, port, logging, database, server: serverC
       configurable: false
     });
   });
+  validateNamespacedSerializers(controllers, serializers);
   const ApplicationController = controllers.get("application");
   if (!ApplicationController) {
     throw new controller_missing_error_default("application");