lumen-framework 3.0.3 → 3.1.1

package/dist/index.mjs

@@ -9,6 +9,8 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 import { green, yellow as yellow3 } from "chalk";
 
 // src/packages/database/constants.ts
+var UNIQUE_CONSTRAINT_CODES = /* @__PURE__ */ new Set(["23505", "ER_DUP_ENTRY"]);
+var UNIQUE_CONSTRAINT = /unique(\s+key)?\s+constraint|duplicate key/i;
 var VALID_DRIVERS = [
   "pg",
   "sqlite3",
@@ -1056,10 +1058,16 @@ async function buildResults({
         }
       );
     }
+    const missing = new Set(
+      entries(record).filter(([key, value]) => value == null && pkPattern.test(key)).map(([key]) => key.split(".")[0])
+    );
+    const absent = Array.from(missing).filter(
+      (name) => model.relationshipFor(name)?.type === "hasOne"
+    );
     const instance = Reflect.construct(model, [
       entries(record).reduce((r, entry) => {
         let [key, value] = entry;
-        if (value == null && pkPattern.test(key)) {
+        if (key.indexOf(".") >= 0 && missing.has(key.split(".")[0])) {
           return r;
         } else if (key.indexOf(".") >= 0) {
           const [a, b] = key.split(".");
@@ -1079,6 +1087,7 @@ async function buildResults({
         };
       }, {})
     ]);
+    absent.forEach((name) => instance.absentRelationships.add(name));
     instance.currentChangeSet.persist();
     return instance;
   });
@@ -1090,6 +1099,17 @@ function createRunner(target, opts) {
     const { resolve: resolve2, reject } = opts;
     let didRun = false;
     RUNNERS.set(target, async () => {
+      if (didRun) {
+        return;
+      }
+      didRun = true;
+      try {
+        await run();
+      } catch (err) {
+        reject(err);
+      }
+    });
+    async function run() {
       let results;
       const {
         model,
@@ -1099,10 +1119,6 @@ function createRunner(target, opts) {
         shouldCount,
         relationships
       } = target;
-      if (didRun) {
-        return;
-      }
-      didRun = true;
       if (!shouldCount && !snapshots.some(([name]) => name === "select")) {
         target.select(...target.model.attributeNames);
       }
@@ -1143,7 +1159,7 @@ function createRunner(target, opts) {
           resolve2(result);
         }
       }
-    });
+    }
   }
 }
 function runQuery(target) {
@@ -1154,6 +1170,17 @@ function runQuery(target) {
 }
 
 // src/packages/database/query/index.ts
+var CONDITIONS = /* @__PURE__ */ new Set([
+  "where",
+  "whereNot",
+  "whereIn",
+  "whereNotIn",
+  "whereNull",
+  "whereNotNull",
+  "whereBetween",
+  "whereNotBetween",
+  "whereRaw"
+]);
 var Query = class extends Promise {
   constructor(model) {
     let resolve2;
@@ -1346,12 +1373,11 @@ var Query = class extends Promise {
     return this;
   }
   count() {
-    const validName = /^(where(((Not)?(In)?)|(Raw)|(Between)))$/g;
     Object.assign(this, {
       shouldCount: true,
       snapshots: [
         ["count", "* as countAll"],
-        ...this.snapshots.filter(([name]) => validName.test(name))
+        ...this.snapshots.filter(([name]) => CONDITIONS.has(name))
       ]
     });
     return this;
@@ -1848,7 +1874,9 @@ async function get(owner, key) {
     let { foreignKey } = opts;
     value = owner.currentChangeSet.get(key);
     foreignKey = camelize5(foreignKey, true);
-    if (!value) {
+    if (!value && owner.absentRelationships.has(key)) {
+      value = null;
+    } else if (!value) {
       switch (type) {
         case "hasOne":
           value = await getHasOne(owner, {
@@ -2510,13 +2538,37 @@ async function initializeClass({
   return model;
 }
 
+// src/packages/server/utils/source-for.ts
+import { dasherize as dasherize3 } from "inflection";
+function memberName(key) {
+  return dasherize3(underscore(key));
+}
+function escapePointer(segment) {
+  return segment.replace(/~/g, "~0").replace(/\//g, "~1");
+}
+function sourceFor(path) {
+  const [root, ...rest] = path.split(".").filter(Boolean).map(memberName);
+  if (!root) {
+    return {};
+  } else if (root === "data") {
+    return {
+      pointer: `/${[root, ...rest].map(escapePointer).join("/")}`
+    };
+  }
+  return {
+    parameter: `${root}${rest.map((key) => `[${key}]`).join("")}`
+  };
+}
+
 // src/packages/database/validation/errors/validation-error.ts
 var ValidationError = class extends Error {
-  constructor(key, value) {
-    super(`Validation failed for ${key}: ${value}`);
+  constructor(key) {
+    super(`Validation failed for ${key}.`);
+    this.key = key;
+    this.source = sourceFor(`data.attributes.${key}`);
   }
 };
-var validation_error_default = ValidationError;
+var validation_error_default = createServerError(ValidationError, 422);
 
 // src/packages/database/validation/index.ts
 var Validation = class {
@@ -2556,12 +2608,32 @@ function validate(instance) {
     validator: Reflect.get(instance.constructor.validates, key)
   })).filter(({ validator }) => validator).map((props) => new validation_default(props)).reduce((result, validation) => {
     if (!validation.isValid()) {
-      throw new validation_error_default(validation.key, String(validation.value));
+      throw new validation_error_default(validation.key);
     }
     return result;
   }, true);
 }
 
+// src/packages/database/model/utils/process-write-error.ts
+function driverMessage(message) {
+  const index = message.lastIndexOf(" - ");
+  return index >= 0 ? message.slice(index + 3) : message;
+}
+function processWriteError(err) {
+  if (!(err instanceof Error)) {
+    return err;
+  }
+  const { code } = err;
+  const { message } = err;
+  if (UNIQUE_CONSTRAINT_CODES.has(String(code)) || UNIQUE_CONSTRAINT.test(message)) {
+    return new unique_constraint_error_default(driverMessage(message));
+  }
+  return err;
+}
+function rethrowWriteError(err) {
+  throw processWriteError(err);
+}
+
 // src/packages/database/model/utils/run-hooks.ts
 function runHooks(record, trx, ...hooks) {
   return hooks.filter((hook) => Boolean(hook)).reduce(
@@ -2601,6 +2673,12 @@ var Model = class {
         writable: false,
         enumerable: false,
         configurable: false
+      },
+      absentRelationships: {
+        value: /* @__PURE__ */ new Set(),
+        writable: false,
+        enumerable: false,
+        configurable: false
       }
     });
     const {
@@ -2947,9 +3025,9 @@ var Model = class {
       return createTransactionResultProxy(this, hadDirtyAttrs || hadDirtyAssoc);
     };
     if (transaction) {
-      return run(transaction);
+      return run(transaction).catch(rethrowWriteError);
     }
-    return this.transaction(run);
+    return this.transaction(run).catch(rethrowWriteError);
   }
   /**
    * Permanently delete the instance from the database.
@@ -3069,9 +3147,9 @@ var Model = class {
       return createTransactionResultProxy(instance, true);
     };
     if (transaction) {
-      return run(transaction);
+      return run(transaction).catch(rethrowWriteError);
     }
-    return this.transaction(run);
+    return this.transaction(run).catch(rethrowWriteError);
   }
   /**
    * Specify the transaction object to use for following save, update, or
@@ -3458,7 +3536,7 @@ var TRUE = /^true$/;
 var BRACKETS = /(?:\[])/g;
 
 // src/utils/transform-keys.ts
-import { camelize as camelize7, dasherize as dasherize3 } from "inflection";
+import { camelize as camelize7, dasherize as dasherize4 } from "inflection";
 function transformKeys(source, transformer, deep = false) {
   if (Array.isArray(source)) {
     return source.slice(0);
@@ -3489,7 +3567,7 @@ function camelizeKeys(source, deep) {
 function dasherizeKeys(source, deep) {
   return transformKeys(
     source,
-    (key) => dasherize3(underscore(key)),
+    (key) => dasherize4(underscore(key)),
     deep
   );
 }
@@ -3798,6 +3876,10 @@ function dataFor(status, err) {
   if (title) {
     errData.title = title;
   }
+  const source = err?.source;
+  if (source && (source.pointer || source.parameter)) {
+    errData.source = source;
+  }
   if (err && (isDevelopment() || /^\[public\]/gi.test(err.message))) {
     errData.detail = err.message.replace(/^\[public\]/gi, "");
   }
@@ -4020,9 +4102,10 @@ function merge(dest, source) {
 }
 
 // src/packages/controller/utils/params-to-query.ts
-function paramsToQuery(model, { id, page, sort, filter, fields, include }) {
+function paramsToQuery(model, { id, page, sort, filter, fields, include }, serializerFor = (related) => related.serializer) {
   const relationships = entries(model.relationships);
   const includedFields = omit(fields, model.resourceName);
+  const included = include && include.map((path) => path.split(".")[0]);
   let query = {
     id,
     filter,
@@ -4065,9 +4148,9 @@ function paramsToQuery(model, { id, page, sort, filter, fields, include }) {
     if (!value.includes(relationship.model.primaryKey)) {
       value = [relationship.model.primaryKey, ...value];
     }
-    if (include && value.length === 1 && include.includes(name)) {
-      value = [...value, ...relationship.model.serializer.attributes];
-    } else if (!include && value.length > 1) {
+    if (included && value.length === 1 && included.includes(name)) {
+      value = [...value, ...serializerFor(relationship.model).attributes];
+    } else if (!included && value.length > 1) {
       value = value.slice(0, 1);
     }
     return {
@@ -4082,18 +4165,19 @@ function paramsToQuery(model, { id, page, sort, filter, fields, include }) {
 }
 
 // src/packages/controller/utils/find-one.ts
-function findOne(model, req) {
+function findOne(model, req, serializerFor) {
   const params = merge(req.defaultParams, req.params);
-  const { id, select, include } = paramsToQuery(model, params);
+  const { id, select, include } = paramsToQuery(model, params, serializerFor);
   return model.find(id).select(...select).include(include);
 }
 
 // src/packages/controller/utils/find-many.ts
-function findMany(model, req) {
+function findMany(model, req, serializerFor) {
   const params = merge(req.defaultParams, req.params);
   const { sort, page, limit, select, filter, include } = paramsToQuery(
     model,
-    params
+    params,
+    serializerFor
   );
   return model.select(...select).include(include).limit(limit).page(page).where(filter).order(...sort);
 }
@@ -4123,6 +4207,53 @@ function resolveRelationships(model, relationships = {}) {
   );
 }
 
+// src/packages/controller/errors/related-record-not-found-error.ts
+var RelatedRecordNotFoundError = class extends Error {
+  constructor({ name, primaryKey }, primaryKeyValue, path) {
+    super(
+      `Could not find ${name} with ${primaryKey} ${stringify(primaryKeyValue)}.`
+    );
+    this.source = sourceFor(path);
+  }
+};
+var related_record_not_found_error_default = createServerError(RelatedRecordNotFoundError, 404);
+
+// src/packages/controller/utils/validate-relationships.ts
+async function validateRelationships(model, relationships = {}) {
+  await Promise.all(
+    entries(relationships).map(async ([key, value]) => {
+      const opts = model.relationshipFor(key);
+      const { data = null } = value || {};
+      if (!opts || !data) {
+        return;
+      }
+      const { model: related } = opts;
+      const isMany = Array.isArray(data);
+      const ids = (isMany ? data : [data]).map(
+        (item) => Reflect.get(Object(item), "id")
+      );
+      if (!ids.length) {
+        return;
+      }
+      const column = related.columnNameFor(related.primaryKey) || "id";
+      const rows = await related.table().whereIn(
+        `${related.tableName}.${column}`,
+        ids.filter((id) => id != null)
+      ).select(`${related.tableName}.${column}`);
+      const found = new Set(rows.map((row) => String(Reflect.get(row, column))));
+      const missing = ids.findIndex((id) => !found.has(String(id)));
+      if (missing >= 0) {
+        const path = `data.relationships.${key}.data`;
+        throw new related_record_not_found_error_default(
+          related,
+          ids[missing],
+          isMany ? `${path}.${missing}` : path
+        );
+      }
+    })
+  );
+}
+
 // src/packages/controller/constants.ts
 var BUILT_IN_ACTIONS = Object.freeze(["show", "index", "create", "update", "destroy"]);
 
@@ -4308,6 +4439,74 @@ var Controller = class {
    * @public
    */
   defaultPerPage = 25;
+  /**
+   * How many relationships deep an `?include` path may go on this
+   * controller's routes. `comments.reactions.user` is 3 levels deep; with `1`
+   * only direct relationships (`comments`) can be included. Paths deeper than
+   * this are rejected with `400 Bad Request`.
+   *
+   * Set it on `ApplicationController` to change it for the whole app, or on a
+   * single controller to override it there.
+   *
+   * ```javascript
+   * class ApplicationController extends Controller {
+   *   maxIncludeDepth = 2;
+   * }
+   * ```
+   *
+   * Every allowed path is enumerated up front from the serializers'
+   * relationships, and each nested level costs its own queries per request, so
+   * keep this small.
+   *
+   * @property maxIncludeDepth
+   * @type {Number}
+   * @default 3
+   * @public
+   */
+  maxIncludeDepth = 3;
+  /**
+   * Whether a namespace may fall back to the root Serializer of a type it has
+   * no Serializer for. Read from a namespace's `ApplicationController` and
+   * applies to the whole namespace.
+   *
+   * By default `app/controllers/admin/comments.js` without an
+   * `app/serializers/admin/comments.js` — or an included type without one —
+   * is serialized by the root Serializer, with every attribute and
+   * relationship it declares. For a namespace that must only expose what it
+   * declares itself, turn the fallback off:
+   *
+   * ```javascript
+   * // app/controllers/admin/application.js
+   * class AdminApplicationController extends ApplicationController {
+   *   serializerFallback = false;
+   * }
+   * ```
+   *
+   * The application then refuses to boot while any type the namespace can
+   * serialize or `include` (down to each controller's `maxIncludeDepth`) has
+   * no Serializer in that namespace, listing each missing one.
+   *
+   * @property serializerFallback
+   * @type {Boolean}
+   * @default true
+   * @public
+   */
+  serializerFallback = true;
+  /**
+   * The Serializer to serialize (and validate, and load) related resources of
+   * this Controller's responses with: the related model's Serializer in this
+   * Controller's namespace, falling back to the root one.
+   *
+   * Always this Controller's namespace — not its Serializer's, which is the
+   * root one when the namespace has no Serializer for this resource.
+   *
+   * @method serializerFor
+   * @private
+   */
+  serializerFor(model) {
+    const { serializer, namespace } = this;
+    return serializer ? serializer.serializerFor(model, namespace) : model.serializer;
+  }
   constructor({ model, namespace, serializer }) {
     Object.assign(this, {
       model,
@@ -4333,7 +4532,7 @@ var Controller = class {
    * @public
    */
   index(req) {
-    return findMany(this.model, req);
+    return findMany(this.model, req, (related) => this.serializerFor(related));
   }
   /**
    * This method supports including relationships, and sparse fieldsets via
@@ -4348,7 +4547,7 @@ var Controller = class {
    * @public
    */
   show(req) {
-    return findOne(this.model, req);
+    return findOne(this.model, req, (related) => this.serializerFor(related));
   }
   /**
    * Create and return a single Model instance that the Controller instance
@@ -4369,6 +4568,7 @@ var Controller = class {
         data: { attributes, relationships }
       }
     } = req;
+    await validateRelationships(model, relationships);
     const record = await model.create({
       ...attributes,
       ...resolveRelationships(model, relationships)
@@ -4394,12 +4594,13 @@ var Controller = class {
    */
   update(req) {
     const { model } = this;
-    return findOne(model, req).then((record) => {
+    return findOne(model, req, (related) => this.serializerFor(related)).then(async (record) => {
       const {
         params: {
           data: { attributes, relationships }
         }
       } = req;
+      await validateRelationships(model, relationships);
       return record.update({
         ...attributes,
         ...resolveRelationships(model, relationships)
@@ -4423,7 +4624,7 @@ var Controller = class {
    * @public
    */
   destroy(req) {
-    return findOne(this.model, req).then((record) => record.destroy()).then(() => 204);
+    return findOne(this.model, req, (related) => this.serializerFor(related)).then((record) => record.destroy()).then(() => 204);
   }
   /**
    * Respond to HEAD or OPTIONS requests.
@@ -4441,7 +4642,194 @@ var Controller = class {
 var controller_default = Controller;
 
 // src/packages/serializer/index.ts
-import { dasherize as dasherize4 } from "inflection";
+import { posix as posix2 } from "path";
+import { dasherize as dasherize5 } from "inflection";
+
+// src/packages/loader/resolver/utils/closest-ancestor.ts
+import { posix } from "path";
+function closestAncestor(source, key) {
+  const name = posix.basename(key);
+  let namespace = posix.dirname(key);
+  if (namespace === ".") {
+    return source.get(name);
+  }
+  namespace = posix.dirname(namespace);
+  const ancestor = source.get(posix.join(namespace, name));
+  if (ancestor) {
+    return ancestor;
+  }
+  return closestAncestor(source, posix.join(posix.dirname(namespace), name));
+}
+
+// src/packages/serializer/utils/load-linkage.ts
+import { camelize as camelize9 } from "inflection";
+var valueOf = (record, key) => Reflect.get(record, key);
+var toId = (value) => value == null ? null : String(value);
+async function loadLinkage(model, records, names) {
+  const ids = Array.from(
+    new Set(records.map((record) => record.getPrimaryKey()))
+  );
+  const linkage = /* @__PURE__ */ new Map();
+  const belongsTo = [];
+  const queries = [];
+  ids.forEach((id) => {
+    linkage.set(
+      String(id),
+      names.reduce((result, name) => {
+        const opts = model.relationshipFor(name);
+        result[name] = opts && opts.type === "hasMany" ? [] : null;
+        return result;
+      }, {})
+    );
+  });
+  if (!ids.length) {
+    return linkage;
+  }
+  const link = (ownerId, name, relatedId) => {
+    const owner = linkage.get(String(ownerId));
+    const id = toId(relatedId);
+    if (!owner || id === null) {
+      return;
+    }
+    const current = owner[name];
+    if (Array.isArray(current)) {
+      if (!current.includes(id)) {
+        current.push(id);
+      }
+    } else if (current === null) {
+      owner[name] = id;
+    }
+  };
+  names.forEach((name) => {
+    const opts = model.relationshipFor(name);
+    if (!opts) {
+      return;
+    }
+    const { type, through, model: related } = opts;
+    const foreignKey = camelize9(opts.foreignKey, true);
+    if (type === "belongsTo") {
+      belongsTo.push([name, foreignKey, related]);
+    } else if (through) {
+      const inverse = related.relationshipFor(opts.inverse);
+      if (!inverse) {
+        return;
+      }
+      const relatedKey = camelize9(inverse.foreignKey, true);
+      queries.push(
+        (async () => {
+          const rows = await through.select(foreignKey, relatedKey).where({ [foreignKey]: ids });
+          rows.forEach((row) => {
+            link(valueOf(row, foreignKey), name, valueOf(row, relatedKey));
+          });
+        })()
+      );
+    } else {
+      queries.push(
+        (async () => {
+          const rows = await related.select(related.primaryKey, foreignKey).where({ [foreignKey]: ids }).order(related.primaryKey, "ASC");
+          rows.forEach((row) => {
+            link(valueOf(row, foreignKey), name, row.getPrimaryKey());
+          });
+        })()
+      );
+    }
+  });
+  if (belongsTo.length) {
+    queries.push(
+      (async () => {
+        const rows = await model.select(model.primaryKey, ...belongsTo.map(([, key]) => key)).where({ [model.primaryKey]: ids });
+        rows.forEach((row) => {
+          belongsTo.forEach(([name, key]) => {
+            link(row.getPrimaryKey(), name, valueOf(row, key));
+          });
+        });
+        await dropDangling(linkage, belongsTo);
+      })()
+    );
+  }
+  await Promise.all(queries);
+  return linkage;
+}
+async function dropDangling(linkage, belongsTo) {
+  const wanted = /* @__PURE__ */ new Map();
+  belongsTo.forEach(([name, , related]) => {
+    const ids = wanted.get(related) || /* @__PURE__ */ new Set();
+    linkage.forEach(({ [name]: id }) => {
+      if (typeof id === "string") {
+        ids.add(id);
+      }
+    });
+    wanted.set(related, ids);
+  });
+  const existing = /* @__PURE__ */ new Map();
+  await Promise.all(
+    Array.from(wanted, async ([related, ids]) => {
+      if (!ids.size) {
+        existing.set(related, ids);
+        return;
+      }
+      const rows = await related.select(related.primaryKey).where({ [related.primaryKey]: Array.from(ids) });
+      existing.set(
+        related,
+        new Set(rows.map((row) => String(row.getPrimaryKey())))
+      );
+    })
+  );
+  belongsTo.forEach(([name, , related]) => {
+    const found = existing.get(related);
+    linkage.forEach((owner) => {
+      const id = owner[name];
+      if (typeof id === "string" && !found?.has(id)) {
+        owner[name] = null;
+      }
+    });
+  });
+}
+
+// src/packages/serializer/utils/include-tree.ts
+function createIncludeTree(paths = []) {
+  const tree = /* @__PURE__ */ new Map();
+  paths.forEach((path) => {
+    path.split(".").filter(Boolean).reduce((node, name) => {
+      let child = node.get(name);
+      if (!child) {
+        child = /* @__PURE__ */ new Map();
+        node.set(name, child);
+      }
+      return child;
+    }, tree);
+  });
+  return tree;
+}
+function enumerateIncludePaths(model, names, depth, serializerFor = (related) => related.serializer) {
+  if (depth < 1) {
+    return [];
+  }
+  return names.reduce((paths, name) => {
+    const opts = model.relationshipFor(name);
+    if (!opts) {
+      return paths;
+    }
+    const { model: related } = opts;
+    const serializer = serializerFor(related);
+    if (!serializer) {
+      return [...paths, name];
+    }
+    const { hasOne, hasMany } = serializer;
+    return [
+      ...paths,
+      name,
+      ...enumerateIncludePaths(
+        related,
+        [...hasOne, ...hasMany],
+        depth - 1,
+        serializerFor
+      ).map((path) => `${name}.${path}`)
+    ];
+  }, []);
+}
+
+// src/packages/serializer/index.ts
 var Serializer = class {
   /**
    * An Array of the `hasOne` or `belongsTo` relationships on a Serializer
@@ -4528,9 +4916,17 @@ var Serializer = class {
    * the resource and relationship objects in the returned [JSON API](
    * http://jsonapi.org) document object.
    *
-   * @param {Array} options.include - An array of strings containing the
-   * relationship keys that should be added to the top level included object of
-   * the returned [JSON API](http://jsonapi.org) document object.
+   * @param {Array} options.include - An array of relationship paths (e.g.
+   * `'comments'` or `'comments.user'`) whose resources should be added to the
+   * top level included object of the returned [JSON API](http://jsonapi.org)
+   * document object. Intermediate resources of a nested path are included too.
+   *
+   * @param {String} options.namespace - The namespace of the request, i.e. of
+   * the Controller handling it. Every link in the document is built in it, and
+   * included resources are serialized by their Serializer in it (falling back
+   * to the root). Defaults to this Serializer's namespace — which is the root
+   * one when a namespaced Controller has no Serializer of its own, so the
+   * Controller passes its namespace explicitly.
    *
    * @return {Promise} Resolves with a [JSON API](http://jsonapi.org) document
    * object.
@@ -4541,38 +4937,61 @@ var Serializer = class {
     data,
     links,
     domain,
-    include
+    include,
+    namespace = this.namespace
   }) {
-    let serialized = {};
-    const included = [];
+    const tree = createIncludeTree(include);
+    const related = /* @__PURE__ */ new Map();
+    const included = /* @__PURE__ */ new Map();
+    const names = Array.from(tree.keys());
+    let primary;
+    let serialized;
     if (Array.isArray(data)) {
-      serialized = {
-        data: await Promise.all(
-          data.map(
-            (item) => this.formatOne({
-              item,
-              domain,
-              include,
-              included
-            })
-          )
+      primary = await Promise.all(
+        data.map(
+          (item) => this.formatOne({
+            item,
+            domain,
+            related,
+            namespace,
+            include: names
+          })
         )
-      };
+      );
+      serialized = { data: primary };
     } else {
-      serialized = {
-        data: await this.formatOne({
+      const resource2 = await this.formatOne({
+        domain,
+        related,
+        namespace,
+        item: data,
+        include: names,
+        links: false
+      });
+      primary = [resource2];
+      serialized = { data: resource2 };
+    }
+    for (const [name, children] of tree) {
+      const opts = this.model.relationshipFor(name);
+      const records = related.get(name);
+      if (opts && records) {
+        await this.addIncluded({
           domain,
-          include,
+          records,
           included,
-          item: data,
-          links: false
-        })
-      };
+          namespace,
+          model: opts.model,
+          tree: children
+        });
+      }
     }
-    if (included.length) {
+    primary.forEach((resource2) => {
+      included.delete(resourceKey(resource2));
+    });
+    if (included.size) {
       serialized = {
         ...serialized,
-        included: uniq(included, "id", "type")
+        included: Array.from(included.values())
       };
     }
     return {
@@ -4587,6 +5006,12 @@ var Serializer = class {
    * Transform a single Model instance into a [JSON API](http://jsonapi.org)
    * resource object.
    *
+   * Relationships are serialized in one of two ways. By default each one is
+   * read from the Model instance (for primary data the query has already
+   * loaded them). When `linkage` is given — as it is for included resources,
+   * whose relationships are batch-loaded by `addIncluded()` — the resource
+   * linkage is built from it instead, without touching the database.
+   *
    * @method formatOne
    *
    * @param {Object} options - An options object used for building the returned
@@ -4603,17 +5028,19 @@ var Serializer = class {
    * the top level links object or relationship links objects in the returned
    * [JSON API](http://jsonapi.org) resource object.
    *
-   * @param {Array} options.include - An array of strings containing the
-   * relationship keys that should be added to the top level included object of
-   * a [JSON API](http://jsonapi.org) document object.
+   * @param {Array} options.include - An array of the relationship keys whose
+   * related records should be collected into `options.related`.
    *
-   * @param {Array} options.included - An array of [JSON API](
-   * http://jsonapi.org) resource objects that will be added to the top level
-   * included array of a [JSON API](http://jsonapi.org) document object.
+   * @param {Map} options.related - Collects, per relationship key in
+   * `options.include`, the related Model instances that belong in the top
+   * level included object of a [JSON API](http://jsonapi.org) document object.
    *
-   * @param {Boolean} options.formatRelationships - Wether or not
-   * relationships should be formatted and included in the returned
-   * [JSON API](http://jsonapi.org) resource object.
+   * @param {Object} options.linkage - Pre-loaded resource linkage (related
+   * primary keys per relationship key) to serialize relationships from.
+   *
+   * @param {String} options.namespace - The namespace to build links in.
+   * Defaults to this Serializer's; included resources pass the namespace of
+   * the request, so every link in a document points into the same namespace.
    *
    * @return {Promise} Resolves with a [JSON API](http://jsonapi.org) resource
    * object.
@@ -4624,13 +5051,15 @@ var Serializer = class {
     item,
     links,
     domain,
-    include,
-    included,
-    formatRelationships = true
+    include = [],
+    related,
+    linkage,
+    namespace = this.namespace
   }) {
     const { resourceName: type } = item;
     const id = String(item.getPrimaryKey());
-    let relationships = {};
+    const names = [...this.hasOne, ...this.hasMany];
+    let relationships;
     const attributes = dasherizeKeys(
       item.getAttributes(
         ...Object.keys(item.rawColumnData).filter(
@@ -4643,34 +5072,41 @@ var Serializer = class {
       type,
       attributes
     };
-    if (formatRelationships) {
+    if (linkage) {
+      relationships = names.reduce(
+        (hash, name) => ({
+          ...hash,
+          [dasherize5(underscore(name))]: this.formatLinkage(
+            domain,
+            this.model.relationshipFor(name)?.model.resourceName,
+            linkage[name],
+            namespace
+          )
+        }),
+        {}
+      );
+    } else {
+      const collect = (name, records) => {
+        if (related && include.includes(name)) {
+          related.set(name, [...related.get(name) || [], ...records]);
+        }
+      };
       relationships = await promiseHash(
-        [...this.hasOne, ...this.hasMany].reduce(
+        names.reduce(
           (hash, name) => ({
             ...hash,
-            [dasherize4(underscore(name))]: (async () => {
-              const related = await Reflect.get(item, name);
-              if (Array.isArray(related)) {
+            [dasherize5(underscore(name))]: (async () => {
+              const value = await Reflect.get(item, name);
+              if (Array.isArray(value)) {
+                collect(name, value);
                 return {
-                  data: await Promise.all(
-                    related.map(async (relatedItem) => {
-                      const { data: relatedData } = await this.formatRelationship({
-                        domain,
-                        included,
-                        item: relatedItem,
-                        include: include.includes(name)
-                      });
-                      return relatedData;
-                    })
+                  data: value.map(
+                    (relatedItem) => this.formatRelationship(relatedItem, domain, namespace).data
                   )
                 };
-              } else if (related && related.id != null) {
-                return this.formatRelationship({
-                  domain,
-                  included,
-                  item: related,
-                  include: include.includes(name)
-                });
+              } else if (value && value.id != null) {
+                collect(name, [value]);
+                return this.formatRelationship(value, domain, namespace);
               }
               return {
                 data: null
@@ -4685,16 +5121,9 @@ var Serializer = class {
       serialized.relationships = relationships;
     }
     if (links || typeof links !== "boolean") {
-      const { namespace } = this;
-      if (namespace) {
-        serialized.links = {
-          self: `${domain}/${namespace}/${type}/${id}`
-        };
-      } else {
-        serialized.links = {
-          self: `${domain}/${type}/${id}`
-        };
-      }
+      serialized.links = {
+        self: this.linkFor(domain, type, id, namespace)
+      };
     }
     return serialized;
   }
@@ -4704,70 +5133,167 @@ var Serializer = class {
    *
    * @method formatRelationship
    *
-   * @param {Object} options - An options object used for building the returned
+   * @param {Model} item - The Model instance to transform into the returned
    * [JSON API](http://jsonapi.org) relationship object.
    *
-   * @param {Model} options.item - The Model instance to transform into the
+   * @param {String} domain - A string used to build links included in the
    * returned [JSON API](http://jsonapi.org) relationship object.
    *
-   * @param {String} options.domain - A string used to build links included in
-   * the returned [JSON API](http://jsonapi.org) relationship object.
-   *
-   * @param {Array} options.include - An array of strings containing the
-   * relationship keys that should be added to the top level included object of
-   * a [JSON API](http://jsonapi.org) document object.
-   *
-   * @param {Array} options.included - An array of [JSON API](
-   * http://jsonapi.org) resource objects that will be added to the top level
-   * included array of a [JSON API](http://jsonapi.org) document object.
+   * @return {Object} A [JSON API](http://jsonapi.org) relationship object.
    *
-   * @return {Promise} Resolves with a [JSON API](http://jsonapi.org)
-   * relationship object.
+   * @private
+   */
+  formatRelationship(item, domain, namespace = this.namespace) {
+    return this.formatLinkage(
+      domain,
+      item.resourceName,
+      String(item.getPrimaryKey()),
+      namespace
+    );
+  }
+  /**
+   * Build a [JSON API](http://jsonapi.org) relationship object from resource
+   * linkage, in the same shape `formatRelationship()` produces from Model
+   * instances: to-one relationships carry a `links` object, to-many ones only
+   * `data`, and a missing to-one relationship is `{ data: null }`.
    *
+   * @method formatLinkage
    * @private
    */
-  async formatRelationship({
-    item,
-    domain,
-    include,
-    included
-  }) {
-    const { namespace } = this;
-    const {
-      resourceName: type,
-      constructor: { serializer }
-    } = item;
-    const id = String(item.getPrimaryKey());
-    let links;
-    if (namespace) {
-      links = {
-        self: `${domain}/${namespace}/${type}/${id}`
-      };
-    } else {
-      links = {
-        self: `${domain}/${type}/${id}`
+  formatLinkage(domain, type, linkage, namespace = this.namespace) {
+    if (Array.isArray(linkage)) {
+      return {
+        data: type ? linkage.map((id) => ({ id, type })) : []
       };
     }
-    if (include) {
-      included.push(
-        await serializer.formatOne({
-          item,
-          domain,
-          include: [],
-          included: [],
-          formatRelationships: false
-        })
-      );
+    if (linkage == null || !type) {
+      return {
+        data: null
+      };
     }
     return {
       data: {
-        id,
+        id: linkage,
         type
       },
-      links
+      links: {
+        self: this.linkFor(domain, type, linkage, namespace)
+      }
     };
   }
+  /**
+   * Add `records` (instances of `model`) to `included` as resource objects,
+   * then recurse into the relationships named in `tree`. Each is serialized by
+   * `model`'s Serializer in this Serializer's namespace (`serializerFor()`), so
+   * `/admin/posts?include=comments` uses `AdminCommentsSerializer` when there
+   * is one and `CommentsSerializer` otherwise. The relationships of every level
+   * are batch-loaded with one query per relationship, not one per record.
+   *
+   * @method addIncluded
+   * @private
+   */
+  async addIncluded({
+    model,
+    records,
+    tree,
+    domain,
+    included,
+    namespace
+  }) {
+    const serializer = this.serializerFor(model, namespace);
+    const unique = Array.from(
+      new Map(records.map((record) => [record.getPrimaryKey(), record])).values()
+    );
+    if (!unique.length) {
+      return;
+    }
+    const names = [...serializer.hasOne, ...serializer.hasMany];
+    const linkage = await loadLinkage(model, unique, names);
+    for (const item of unique) {
+      const id = String(item.getPrimaryKey());
+      const key = resourceKey({ id, type: item.resourceName });
+      if (!included.has(key)) {
+        included.set(
+          key,
+          await serializer.formatOne({
+            item,
+            domain,
+            linkage: linkage.get(id),
+            namespace
+          })
+        );
+      }
+    }
+    for (const [name, children] of tree) {
+      const opts = model.relationshipFor(name);
+      if (!opts || !names.includes(name)) {
+        continue;
+      }
+      const { model: next } = opts;
+      const ids = /* @__PURE__ */ new Set();
+      linkage.forEach(({ [name]: value }) => {
+        (Array.isArray(value) ? value : [value]).forEach((relatedId) => {
+          if (relatedId != null) {
+            ids.add(relatedId);
+          }
+        });
+      });
+      if (ids.size) {
+        const attributes = this.serializerFor(
+          next,
+          namespace
+        ).attributes.filter((attr) => next.attributeNames.includes(attr));
+        const nextRecords = await next.select(next.primaryKey, ...attributes).where({ [next.primaryKey]: Array.from(ids) });
+        await this.addIncluded({
+          domain,
+          included,
+          namespace,
+          model: next,
+          records: nextRecords,
+          tree: children
+        });
+      }
+    }
+  }
+  /**
+   * Resolve the Serializer for `model` in `namespace` (this Serializer's by
+   * default), the way a namespaced Controller resolves its own:
+   * `admin/comments` if it exists, otherwise the closest ancestor namespace's,
+   * down to the root `comments` Serializer. Falls back to `model.serializer`
+   * when this Serializer was not created by an application (e.g. in
+   * isolation).
+   *
+   * Pass the request's namespace when there is one: a Serializer's own
+   * namespace is the root one whenever it is a namespaced Controller's
+   * fallback.
+   *
+   * @method serializerFor
+   * @private
+   */
+  serializerFor(model, namespace = this.namespace) {
+    const { serializers } = this;
+    if (serializers) {
+      const key = posix2.join(namespace || ".", model.resourceName);
+      const serializer = serializers.get(key) || closestAncestor(serializers, key);
+      if (serializer) {
+        return serializer;
+      }
+    }
+    return model.serializer;
+  }
+  /**
+   * @private
+   */
+  linkFor(domain, type, id, namespace = this.namespace) {
+    if (namespace) {
+      return `${domain}/${namespace}/${type}/${id}`;
+    }
+    return `${domain}/${type}/${id}`;
+  }
 };
+function resourceKey({ id, type }) {
+  return `${type}:${id}`;
+}
 var serializer_default = Serializer;
 
 // src/packages/config/index.ts
@@ -4966,7 +5492,10 @@ function resource(action) {
         data,
         links,
         domain,
-        include
+        include,
+        // The request's namespace, not the serializer's: a namespaced
+        // controller without its own serializer is given the root one.
+        namespace
       });
     }
     return data;
@@ -5047,6 +5576,7 @@ var ParameterTypeError = class extends TypeError {
       Expected type '${type || "undefined"}' for parameter '${path}' but got
       '${actual}'.
     `);
+    this.source = sourceFor(path);
   }
 };
 var parameter_type_error_default = createServerError(ParameterTypeError, 400);
@@ -5059,6 +5589,7 @@ var ParameterValueError = class extends TypeError {
       [${param.size ? Array.from(param.values()).join(", ") : ""}] but got
       ${String(actual)}.
     `);
+    this.source = sourceFor(param.path);
   }
 };
 var parameter_value_error_default = createServerError(ParameterValueError, 400);
@@ -5067,6 +5598,7 @@ var parameter_value_error_default = createServerError(ParameterValueError, 400);
 var InvalidParameterError = class extends TypeError {
   constructor(path) {
     super(`'${path}' is not a valid parameter for this resource.`);
+    this.source = sourceFor(path);
   }
 };
 var invalid_parameter_error_default = createServerError(InvalidParameterError, 400);
@@ -5082,6 +5614,7 @@ var ResourceMismatchError = class extends TypeError {
       Expected '${String(expected)}' for parameter '${path}' but got
       ${String(normalized)}.
     `);
+    this.source = sourceFor(path);
   }
 };
 var resource_mismatch_error_default = createServerError(ResourceMismatchError, 409);
@@ -5090,14 +5623,34 @@ var resource_mismatch_error_default = createServerError(ResourceMismatchError, 4
 var ParameterRequiredError = class extends TypeError {
   constructor(path) {
     super(`Missing required parameter '${path}'.`);
+    this.source = sourceFor(path);
   }
 };
 var parameter_required_error_default = createServerError(ParameterRequiredError, 400);
 
+// src/packages/router/route/params/errors/client-generated-id-error.ts
+var ClientGeneratedIdError = class extends TypeError {
+  constructor() {
+    super("Client-generated IDs are not supported for this resource.");
+    this.source = sourceFor("data.id");
+  }
+};
+var client_generated_id_error_default = createServerError(ClientGeneratedIdError, 403);
+
+// src/packages/router/route/params/errors/forbidden-parameter-error.ts
+var ForbiddenParameterError = class extends TypeError {
+  constructor(path) {
+    super(`Setting '${path}' is not supported for this resource.`);
+    this.source = sourceFor(path);
+  }
+};
+var forbidden_parameter_error_default = createServerError(ForbiddenParameterError, 403);
+
 // src/packages/router/route/params/errors/parameter-not-nullable-error.ts
 var ParameterNotNullableError = class extends TypeError {
   constructor({ path }) {
     super(`Parameter '${path}' is not nullable.`);
+    this.source = sourceFor(path);
   }
 };
 var parameter_not_nullable_error_default = createServerError(ParameterNotNullableError, 400);
@@ -5226,13 +5779,14 @@ var Parameter = class extends set_default {
       path,
       type,
       required: Boolean(required),
-      sanitize: Boolean(sanitize)
+      sanitize: Boolean(sanitize),
+      restricted: values !== void 0
     });
     this.freeze();
   }
   validate(value) {
     validateType2(this, value);
-    if (this.size > 0) {
+    if (this.restricted) {
       return validateValue(this, value);
     }
     return value;
@@ -5251,6 +5805,17 @@ function getURLParams(dynamicSegments) {
   ]);
 }
 
+// src/packages/router/route/params/parameter/forbidden-parameter.ts
+var ForbiddenParameter = class extends parameter_default {
+  constructor(path) {
+    super({ path });
+  }
+  validate() {
+    throw new forbidden_parameter_error_default(this.path);
+  }
+};
+var forbidden_parameter_default = ForbiddenParameter;
+
 // src/packages/router/route/params/utils/get-data-params.ts
 function getIDParam({ model }) {
   const primaryKeyColumn = model.columnFor(model.primaryKey);
@@ -5303,16 +5868,48 @@ function getRelationshipsParam({
   model,
   params
 }) {
+  const forbidden = Object.keys(model.relationships).filter((key) => !params.includes(key)).map((key) => [
+    key,
+    new forbidden_parameter_default(`data.relationships.${key}`)
+  ]);
   return [
     "relationships",
     new parameter_group_default(
-      params.reduce((group, param) => {
-        const path = `data.relationships.${param}`;
-        const opts = model.relationshipFor(param);
-        if (!opts) {
-          return group;
-        }
-        if (opts.type === "hasMany") {
+      [
+        ...params.reduce((group, param) => {
+          const path = `data.relationships.${param}`;
+          const opts = model.relationshipFor(param);
+          if (!opts) {
+            return group;
+          }
+          if (opts.type === "hasMany") {
+            return [
+              ...group,
+              [
+                param,
+                new parameter_group_default(
+                  [
+                    [
+                      "data",
+                      new parameter_default({
+                        type: "array",
+                        path: `${path}.data`,
+                        required: true
+                      })
+                    ]
+                  ],
+                  {
+                    path
+                  }
+                )
+              ]
+            ];
+          }
+          const primaryKeyColumn = opts.model.columnFor(opts.model.primaryKey);
+          let primaryKeyType = "number";
+          if (primaryKeyColumn) {
+            primaryKeyType = typeForColumn(primaryKeyColumn);
+          }
           return [
             ...group,
             [
@@ -5321,11 +5918,32 @@ function getRelationshipsParam({
                 [
                   [
                     "data",
-                    new parameter_default({
-                      type: "array",
-                      path: `${path}.data`,
-                      required: true
-                    })
+                    new parameter_group_default(
+                      [
+                        [
+                          "id",
+                          new parameter_default({
+                            type: primaryKeyType,
+                            path: `${path}.data.id`,
+                            required: true
+                          })
+                        ],
+                        [
+                          "type",
+                          new parameter_default({
+                            type: "string",
+                            path: `${path}.data.type`,
+                            values: [opts.model.resourceName],
+                            required: true
+                          })
+                        ]
+                      ],
+                      {
+                        type: "array",
+                        path: `${path}.data`,
+                        required: true
+                      }
+                    )
                   ]
                 ],
                 {
@@ -5334,55 +5952,9 @@ function getRelationshipsParam({
               )
             ]
           ];
-        }
-        const primaryKeyColumn = opts.model.columnFor(opts.model.primaryKey);
-        let primaryKeyType = "number";
-        if (primaryKeyColumn) {
-          primaryKeyType = typeForColumn(primaryKeyColumn);
-        }
-        return [
-          ...group,
-          [
-            param,
-            new parameter_group_default(
-              [
-                [
-                  "data",
-                  new parameter_group_default(
-                    [
-                      [
-                        "id",
-                        new parameter_default({
-                          type: primaryKeyType,
-                          path: `${path}.data.id`,
-                          required: true
-                        })
-                      ],
-                      [
-                        "type",
-                        new parameter_default({
-                          type: "string",
-                          path: `${path}.data.type`,
-                          values: [opts.model.resourceName],
-                          required: true
-                        })
-                      ]
-                    ],
-                    {
-                      type: "array",
-                      path: `${path}.data`,
-                      required: true
-                    }
-                  )
-                ]
-              ],
-              {
-                path
-              }
-            )
-          ]
-        ];
-      }, []),
+        }, []),
+        ...forbidden
+      ],
       {
         path: "data.relationships"
       }
@@ -5490,10 +6062,9 @@ function getFilterParam({ filter }) {
     )
   ];
 }
-function getFieldsParam({
-  model,
-  serializer: { hasOne, hasMany, attributes }
-}) {
+function getFieldsParam(controller) {
+  const { model, serializer } = controller;
+  const { hasOne, hasMany, attributes } = serializer;
   const relationships = [...hasOne, ...hasMany];
   return [
     "fields",
@@ -5522,7 +6093,7 @@ function getFieldsParam({
                     sanitize: true,
                     values: [
                       opts.model.primaryKey,
-                      ...opts.model.serializer.attributes
+                      ...controller.serializerFor(opts.model).attributes
                     ]
                   })
                 ]
@@ -5540,16 +6111,30 @@ function getFieldsParam({
     )
   ];
 }
-function getIncludeParam({
-  serializer: { hasOne, hasMany }
-}) {
+function getIncludeParam(controller) {
+  const { model, maxIncludeDepth, serializer } = controller;
+  const { hasOne, hasMany } = serializer;
   const relationships = [...hasOne, ...hasMany];
   return [
     "include",
     new parameter_default({
       path: "include",
       type: "array",
-      values: relationships
+      // Every top level name stays allowed (as before), plus the nested paths
+      // (`comments.user`) reachable through each related serializer in the
+      // controller's namespace (at every level, even below a root fallback
+      // serializer), down to the controller's `maxIncludeDepth`.
+      values: Array.from(
+        /* @__PURE__ */ new Set([
+          ...relationships,
+          ...enumerateIncludePaths(
+            model,
+            relationships,
+            maxIncludeDepth,
+            (related) => controller.serializerFor(related)
+          )
+        ])
+      )
     })
   ];
 }
@@ -5587,6 +6172,15 @@ function getCollectionQueryParams(controller) {
   return getCustomParams(controller);
 }
 
+// src/packages/router/route/params/utils/validate-client-id.ts
+function validateClientId(params) {
+  const { data } = params;
+  if (data && typeof data === "object" && Reflect.has(data, "id")) {
+    throw new client_generated_id_error_default();
+  }
+  return true;
+}
+
 // src/packages/router/route/params/utils/validate-resource-id.ts
 function validateResourceId({
   params: {
@@ -5752,6 +6346,9 @@ var Route = class extends set_default {
       ...req.params,
       ...this.parseParams(req.url.params)
     };
+    if (this.action === "create" && req.method === "POST") {
+      validateClientId(params);
+    }
     if (req.method !== "OPTIONS") {
       params = this.params.validate(params);
     }
@@ -6067,7 +6664,7 @@ var router_default = Router;
 import { join as joinPath2 } from "path";
 
 // src/packages/loader/utils/format-key.ts
-import { dasherize as dasherize5 } from "inflection";
+import { dasherize as dasherize6 } from "inflection";
 var NAMESPACE_DELIMITER = /\$-/g;
 function formatKey(key, formatter) {
   return chain(key).pipe((str) => {
@@ -6075,7 +6672,7 @@ function formatKey(key, formatter) {
       return formatter(str);
     }
     return str;
-  }).pipe(underscore).pipe(dasherize5).pipe((str) => str.replace(NAMESPACE_DELIMITER, "/")).value();
+  }).pipe(underscore).pipe(dasherize6).pipe((str) => str.replace(NAMESPACE_DELIMITER, "/")).value();
 }
 
 // src/packages/loader/utils/bundle-for.ts
@@ -6147,26 +6744,10 @@ function bundleFor(path) {
   return chain(manifest).pipe(normalize2).pipe(entries).pipe((pairs) => new map_default(pairs)).value().freeze();
 }
 
-// src/packages/loader/resolver/utils/closest-ancestor.ts
-import { posix } from "path";
-function closestAncestor(source, key) {
-  const name = posix.basename(key);
-  let namespace = posix.dirname(key);
-  if (namespace === ".") {
-    return source.get(name);
-  }
-  namespace = posix.dirname(namespace);
-  const ancestor = source.get(posix.join(namespace, name));
-  if (ancestor) {
-    return ancestor;
-  }
-  return closestAncestor(source, posix.join(posix.dirname(namespace), name));
-}
-
 // src/packages/loader/resolver/utils/closest-child.ts
-import { posix as posix2 } from "path";
+import { posix as posix3 } from "path";
 function closestChild(source, key) {
-  const [[, result] = []] = Array.from(source).map(([path, value]) => [posix2.basename(path), value]).filter(([resource2]) => key === resource2);
+  const [[, result] = []] = Array.from(source).map(([path, value]) => [posix3.basename(path), value]).filter(([resource2]) => key === resource2);
   return result;
 }
 
@@ -6189,7 +6770,7 @@ function resolve(group) {
 }
 
 // src/packages/loader/builder/utils/create-parent-builder.ts
-import { posix as posix3 } from "path";
+import { posix as posix4 } from "path";
 
 // src/packages/loader/builder/utils/sort-by-namespace.ts
 function sortByNamespace([a], [b]) {
@@ -6210,7 +6791,7 @@ function createParentBuilder(construct) {
       let grandparent = null;
       if (key !== "root") {
         const found = result.find((namespace) => {
-          const dirname = posix3.dirname(key);
+          const dirname = posix4.dirname(key);
           if (namespace.key === "root") {
             return dirname === ".";
           }
@@ -6280,13 +6861,13 @@ function normalizePort(port) {
 }
 
 // src/packages/application/utils/create-controller.ts
-import { posix as posix4 } from "path";
+import { posix as posix5 } from "path";
 function createController(constructor, opts) {
   const { key, store, serializers } = opts;
-  const namespace = posix4.dirname(key).replace(".", "");
+  const namespace = posix5.dirname(key).replace(".", "");
   let { parent } = opts;
   let model = tryCatchSync(
-    () => store.modelFor(posix4.basename(key))
+    () => store.modelFor(posix5.basename(key))
   );
   let serializer = serializers.get(key);
   if (!model) {
@@ -6342,13 +6923,13 @@ function createController(constructor, opts) {
 }
 
 // src/packages/application/utils/create-serializer.ts
-import { posix as posix5 } from "path";
+import { posix as posix6 } from "path";
 function createSerializer(constructor, opts) {
   const { key, store } = opts;
-  const namespace = posix5.dirname(key).replace(".", "");
+  const namespace = posix6.dirname(key).replace(".", "");
   let { parent } = opts;
   let model = tryCatchSync(
-    () => store.modelFor(posix5.basename(key))
+    () => store.modelFor(posix6.basename(key))
   );
   if (!model) {
     model = null;
@@ -6372,6 +6953,85 @@ function createSerializer(constructor, opts) {
   return deepFreezeProps(instance, true, "hasOne", "hasMany", "attributes");
 }
 
+// src/packages/application/utils/validate-namespaced-serializers.ts
+import { posix as posix7 } from "path";
+
+// src/errors/namespaced-serializer-missing-error.ts
+var NamespacedSerializerMissingError = class extends ReferenceError {
+  /**
+   * @param missing - Each missing serializer key (`admin/comments`) with an
+   * example of how it is reached (`admin/posts?include=comments`).
+   */
+  constructor(missing) {
+    const lines = Array.from(missing).sort(([a], [b]) => a.localeCompare(b)).map(([key, via]) => `  - ${key} (reached from ${via})`);
+    super(
+      [
+        "Missing namespaced serializers. These namespaces set `serializerFallback = false`, so every type their controllers can serialize or include needs a serializer of its own:",
+        ...lines
+      ].join("\n")
+    );
+  }
+};
+var namespaced_serializer_missing_error_default = NamespacedSerializerMissingError;
+
+// src/packages/application/utils/validate-namespaced-serializers.ts
+var distance = (via) => {
+  const [, include] = via.split("?include=");
+  return include ? include.split(".").length : 0;
+};
+function validateNamespacedSerializers(controllers, serializers) {
+  const missing = /* @__PURE__ */ new Map();
+  controllers.forEach((controller, key) => {
+    const { namespace, model } = controller;
+    if (!namespace || !model) {
+      return;
+    }
+    const application = controllers.get(posix7.join(namespace, "application"));
+    if (!application || application.serializerFallback !== false) {
+      return;
+    }
+    const require2 = (type, via) => {
+      const serializerKey = posix7.join(namespace, type);
+      const serializer = serializers.get(serializerKey);
+      if (!serializer) {
+        const known = missing.get(serializerKey);
+        if (known === void 0 || distance(via) < distance(known)) {
+          missing.set(serializerKey, via);
+        }
+      }
+      return serializer;
+    };
+    const own = require2(model.resourceName, key);
+    if (!own) {
+      return;
+    }
+    const depth = Math.max(controller.maxIncludeDepth, 1);
+    let level = [
+      [model, own, []]
+    ];
+    for (let current = 1; current <= depth && level.length; current += 1) {
+      const next = [];
+      level.forEach(([parent, serializer, path]) => {
+        [...serializer.hasOne, ...serializer.hasMany].forEach((name) => {
+          const opts = parent.relationshipFor(name);
+          if (!opts) {
+            return;
+          }
+          const nextPath = [...path, name];
+          const related = require2(opts.model.resourceName, `${key}?include=${nextPath.join(".")}`);
+          if (related) {
+            next.push([opts.model, related, nextPath]);
+          }
+        });
+      });
+      level = next;
+    }
+  });
+  if (missing.size) {
+    throw new namespaced_serializer_missing_error_default(missing);
+  }
+}
+
 // src/packages/application/initialize.ts
 async function initialize3(app, { path, port, logging, database, server: serverConfig }) {
   const load = createLoader(path);
@@ -6394,6 +7054,14 @@ async function initialize3(app, { path, port, logging, database, server: serverC
       parent
     })
   );
+  serializers.forEach((serializer) => {
+    Reflect.defineProperty(serializer, "serializers", {
+      value: serializers,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+  });
   models.forEach((model) => {
     Reflect.defineProperty(model, "serializer", {
       value: closestChild(serializers, model.resourceName),
@@ -6419,6 +7087,7 @@ async function initialize3(app, { path, port, logging, database, server: serverC
       configurable: false
     });
   });
+  validateNamespacedSerializers(controllers, serializers);
   const ApplicationController = controllers.get("application");
   if (!ApplicationController) {
     throw new controller_missing_error_default("application");