prisma-generator-express 1.64.1 → 1.64.3

package/src/generators/generateRouteConfigType.ts

@@ -117,10 +117,15 @@ export function generateRouteConfigType(
       `      after?: ${afterRef}[]\n` +
       `    }>`
 
+    // Only consulted when `requireDefaultVariantOptIn` is on; inert otherwise.
+    // Emitted so a TypeScript consumer who opts in can confirm a `default`
+    // variant without a cast — 1.64.2 demanded it and never added it to the type.
+    const allowDefault = `    allowDefaultVariant?: boolean`
+
     return (
       `  ${routerOp}?: (${commonConfig} & (\n` +
       `    | { shape?: ${m}${c}ShapeInput<TCtx>; variants?: never }\n` +
-      `    | { shape?: never; variants: ${variantsConfig} }\n` +
+      `    | { shape?: never; variants: ${variantsConfig}\n${allowDefault} }\n` +
       `  )) | false`
     )
   }).join('\n')

package/src/generators/generateRouterHono.ts

@@ -80,6 +80,55 @@ function emitWriteOp(meta: (typeof OPERATION_METADATA)[number], modelName: strin
   }`
 }
 
+/**
+ * Guard behaviour is SEVEN INDEPENDENT OPT-IN CONTROLS on the route config.
+ *
+ * 1.64.2 shipped all of it as the default, which was a breaking change to a
+ * published package. The first correction put all of it behind one `requireGuard`
+ * switch, which was also wrong: these are unrelated decisions, and one switch
+ * forces a consumer who wants a missing-guard refusal to also accept a
+ * hook-ordering change and lose a route they may be using.
+ *
+ * Each is now its own option, each defaulting to the pre-1.64.2 behaviour:
+ *
+ *   - `requireGuardShape`           refuse an operation with no guard
+ *   - `validateGuardShapes`         refuse an empty or key-mixing shape
+ *   - `requireDefaultVariantOptIn`  confirm a `default` variant
+ *   - `enableUpdateEach`            register the batch route (default true)
+ *   - `guardResolutionOrder`        settle the guard before or after hooks
+ *   - `allowE2EGuardBypass`         honour E2E=true (default true)
+ *   - `validateResolvedShapes`      check what a shape function returned
+ *
+ * `HARDENED_GUARD_PROFILE` selects all seven, as values to spread rather than a
+ * mode to store. See routeConfig.ts.
+ *
+ * Guard dropping is then a GENERATION-TIME decision, never a runtime one.
+ *
+ * The emitted router used to compute `DROP_GUARD = <flag> || _env.E2E === 'true'`,
+ * so setting `E2E=true` in a deployed environment downgraded enforcement even
+ * when the generator had been told to keep the guard. The two modes are not
+ * equivalent: with the guard, the shape goes to prisma-guard; with it dropped,
+ * `applyDroppedGuard` applies projection defaults and forced `where` clauses and
+ * nothing else is validated against the shape.
+ *
+ * On an edge runtime that variable is an ordinary config var — set on a staging
+ * deployment, copied forward, flagged as security-relevant nowhere. A
+ * deployment's guard behaviour has to be a property of the artifact, not of the
+ * environment it happens to land in.
+ *
+ * The rationale lives here rather than in the emitted file on purpose: generated
+ * output is an artifact, and a paragraph about a bypass that no longer exists
+ * would be copied into every router this generator writes.
+ *
+ * `updateEach` is refused for the same reason, one step further on — and, again,
+ * only under the flag. It bypasses guard shapes by design — the endpoint is a
+ * batch of `{ where, data }` items applied directly — and the only thing between
+ * it and an unguarded mass mutation is a `console.warn` suppressed in
+ * production. A warning is not a security boundary; it is advice to whoever
+ * happens to be reading a development log. Refused at construction rather than
+ * silently dropped, so a deployment expecting the route learns at boot instead
+ * of at the first 404.
+ */
 export function generateHonoRouterFunction({
   model,
   enums,
@@ -133,6 +182,8 @@ import { buildModelOpenApi } from '../buildModelOpenApi${ext}'
 import {
   normalizeOperation,
   resolveOperationVariantKey,
+  resolveGuardPolicy,
+  resolveGuardShapeOnce,
   validateCountSourceWhere,
   validateOperationConfig,
   validateUpdateEachConfig,
@@ -149,7 +200,10 @@ import { MODEL_FIELDS, MODEL_ENUMS } from './${modelName}Metadata${ext}'
 ${generateRouteConfigType(modelName, 'HonoBeforeHook', guardShapesImport, importStyle, 'hono')}
 const _env = getEnv()
 
-const DROP_GUARD = ${dropGuard} || _env.E2E === 'true'
+// Fixed at generation time. The \`allowE2EGuardBypass\` control decides whether the
+// environment can additionally drop the guard at runtime; it defaults to true,
+// which is upstream behaviour. See generateRouterHono.ts.
+const DROP_GUARD = ${dropGuard}
 
 type JsonLike =
   | string
@@ -207,28 +261,28 @@ async function parseBodyAsQueryMiddleware(c: HandlerContext): Promise<void> {
   c.set('parsedQuery', sanitizeKeys(body as Record<string, unknown>))
 }
 
-async function parseWriteBodyMiddleware(c: HandlerContext): Promise<void> {
+async function parseUpdateEachBodyMiddleware(c: HandlerContext): Promise<void> {
   let body: unknown
   try {
     body = await c.req.json()
   } catch {
-    throw new HTTPException(400, { message: 'Request body must be a JSON object' })
+    throw new HTTPException(400, { message: 'updateEach body must be an array of { where, data } items' })
   }
-  if (!body || typeof body !== 'object' || Array.isArray(body)) {
-    throw new HTTPException(400, { message: 'Request body must be a JSON object' })
+  if (!Array.isArray(body)) {
+    throw new HTTPException(400, { message: 'updateEach body must be an array of { where, data } items' })
   }
   c.set('body', body)
 }
 
-async function parseUpdateEachBodyMiddleware(c: HandlerContext): Promise<void> {
+async function parseWriteBodyMiddleware(c: HandlerContext): Promise<void> {
   let body: unknown
   try {
     body = await c.req.json()
   } catch {
-    throw new HTTPException(400, { message: 'updateEach body must be an array of { where, data } items' })
+    throw new HTTPException(400, { message: 'Request body must be a JSON object' })
   }
-  if (!Array.isArray(body)) {
-    throw new HTTPException(400, { message: 'updateEach body must be an array of { where, data } items' })
+  if (!body || typeof body !== 'object' || Array.isArray(body)) {
+    throw new HTTPException(400, { message: 'Request body must be a JSON object' })
   }
   c.set('body', body)
 }
@@ -238,6 +292,17 @@ function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
   opConfig: NormalizedOp<TEnv>,
   opKind: OpKind,
 ) {
+  const policy = resolveGuardPolicy(config)
+
+  /**
+   * The environment bypass, honoured unless the consumer turned it off.
+   *
+   * \`E2E=true\` downgrading enforcement in a deployed environment is a real
+   * hazard, and it is also upstream behaviour — so it is a control, not a
+   * decision made here.
+   */
+  const dropGuard = DROP_GUARD || (policy.allowE2EGuardBypass && _env.E2E === 'true')
+
   return async (c: Context<GeneratedHonoEnv<TEnv>>): Promise<void> => {
     const merged = mergePaginationConfig(config.pagination, opConfig.pagination)
     if (merged) c.set('routeConfig', { pagination: merged })
@@ -260,15 +325,35 @@ function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
     if (resolvedKey !== undefined) c.set('guardVariantKey', resolvedKey)
 
     if (opConfig.guardShape) {
-      if (!DROP_GUARD) {
-        c.set('guardShape', opConfig.guardShape)
-      } else {
-        const resolveCtx = typeof config.resolveContext === 'function'
-          ? () => (config.resolveContext as (ctx: Context<GeneratedHonoEnv<TEnv>>) => unknown | Promise<unknown>)(c)
-          : undefined
+      const resolveCtx = typeof config.resolveContext === 'function'
+        ? () => (config.resolveContext as (ctx: Context<GeneratedHonoEnv<TEnv>>) => unknown | Promise<unknown>)(c)
+        : undefined
+
+      /**
+       * With \`validateResolvedShapes\`, resolved ONCE here and the validated value
+       * is what travels onward — see resolveGuardShapeOnce. Passing the function
+       * on would let it return a different shape when it is enforced than when it
+       * was checked.
+       *
+       * Without it the raw shape is passed through untouched, which is upstream
+       * behaviour: it is resolved at the point of use, and a function returning
+       * something unusable is not this router's business to refuse.
+       */
+      let effectiveShape: unknown = opConfig.guardShape
+      if (policy.validateResolvedShapes) {
+        const resolution = await resolveGuardShapeOnce(opConfig.guardShape, resolvedKey, resolveCtx)
+        if (!resolution.ok) {
+          c.set('guardShapeFailure', resolution.problem)
+          return
+        }
+        effectiveShape = resolution.shape
+      }
 
+      if (!dropGuard) {
+        c.set('guardShape', effectiveShape)
+      } else {
         await applyDroppedGuard(
-          opConfig.guardShape,
+          effectiveShape,
           resolvedKey,
           resolveCtx,
           opKind,
@@ -410,6 +495,38 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     })
   }
 
+  const POLICY = resolveGuardPolicy(config)
+  const SETTLE_BEFORE_HOOKS = POLICY.guardResolutionOrder === 'before-hooks'
+
+  /**
+   * The guard-resolution failures, raised in one place so both handlers and both
+   * orderings share exactly one definition of what a failure is.
+   *
+   * WHERE it is called is the behavioural difference, and it is the
+   * \`guardResolutionOrder\` control. \`'before-hooks'\` runs it before any operation
+   * hook, because a hook that returns a Response — an auth gate, a cache, a
+   * short-circuit for a known caller — would otherwise answer a request whose
+   * guard was never established. \`'after-hooks'\` is upstream behaviour.
+   *
+   * \`guardShapeFailure\` is only ever set when \`validateResolvedShapes\` is on, so
+   * that branch is inert rather than merely unreached when it is off.
+   */
+  const settleGuard = (c: Context<GeneratedHonoEnv<TEnv>>): void => {
+    const failure = c.get('guardVariantFailure')
+    if (failure) {
+      throw new HTTPException(400, {
+        message: formatGuardVariantResolutionError(failure),
+      })
+    }
+
+    const shapeFailure = c.get('guardShapeFailure')
+    if (shapeFailure) {
+      throw new HTTPException(500, {
+        message: 'guard shape could not be resolved: ' + shapeFailure,
+      })
+    }
+  }
+
   const handleRead = (
     opConfig: NormalizedOp<TEnv>,
     handlerFn: (c: HandlerContext) => Promise<void>,
@@ -419,15 +536,15 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     try {
       await parseFn(c as unknown as HandlerContext)
       await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, opKind)(c)
+
+      // Settled BEFORE any hook can answer the request, when asked for.
+      if (SETTLE_BEFORE_HOOKS) settleGuard(c)
+
       const operationBefore = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
       if (operationBefore) return operationBefore
 
-      const failure = c.get('guardVariantFailure')
-      if (failure) {
-        throw new HTTPException(400, {
-          message: formatGuardVariantResolutionError(failure),
-        })
-      }
+      // Upstream order: hooks first, guard failure after.
+      if (!SETTLE_BEFORE_HOOKS) settleGuard(c)
 
       const key = c.get('guardVariantKey')
       const variantHooks =
@@ -454,15 +571,15 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     try {
       await parseWriteBodyMiddleware(c as unknown as HandlerContext)
       await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, opKind)(c)
+
+      // Settled BEFORE any hook can answer the request, when asked for.
+      if (SETTLE_BEFORE_HOOKS) settleGuard(c)
+
       const operationBefore = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
       if (operationBefore) return operationBefore
 
-      const failure = c.get('guardVariantFailure')
-      if (failure) {
-        throw new HTTPException(400, {
-          message: formatGuardVariantResolutionError(failure),
-        })
-      }
+      // Upstream order: hooks first, guard failure after.
+      if (!SETTLE_BEFORE_HOOKS) settleGuard(c)
 
       const key = c.get('guardVariantKey')
       const variantHooks =
@@ -485,7 +602,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     key: K,
   ): NormalizedOp<TEnv> => {
     const raw = config[key] as unknown as OperationConfigLike<TEnv> | undefined
-    validateOperationConfig(raw, '${modelName}.' + String(key))
+    validateOperationConfig(raw, '${modelName}.' + String(key), POLICY)
     return normalizeHonoOperation(raw)
   }
 
@@ -494,6 +611,25 @@ ${readOpBlocks}
 ${writeOpBlocks}
 
   if (config.updateEach) {
+    /**
+     * Refused only when \`enableUpdateEach\` is false. It bypasses guard shapes by design — the
+     * endpoint is a batch of { where, data } applied directly — and the only thing
+     * between it and an unguarded mass mutation is a console.warn suppressed in
+     * production. A warning is not a security boundary.
+     *
+     * Removing the route outright was a breaking change to a published package,
+     * so by default it registers exactly as it did, warning and all.
+     */
+    if (!POLICY.enableUpdateEach) {
+      throw new Error(
+        '${modelName}.updateEach: enableUpdateEach is false, so this router ' +
+        'does not register updateEach. It bypasses guard shapes entirely, so ' +
+        'there is no configuration that makes it safe to expose. Perform batch ' +
+        'updates through a guarded operation, or behind your own authenticated ' +
+        'route outside the generated router.',
+      )
+    }
+
     const rawUpdateEach = config.updateEach as unknown as OperationConfigLike<TEnv>
     validateUpdateEachConfig(rawUpdateEach, '${modelName}.updateEach')
     const opConfig = normalizeHonoOperation(rawUpdateEach)

package/src/guardOptions.ts

@@ -0,0 +1,226 @@
+/**
+ * PUBLIC, COMPILED METADATA for the Hono guard controls.
+ *
+ * **Why this file exists separately from `src/copy/routeConfig.ts`.**
+ * `src/copy/**` is excluded from the TypeScript build (`tsconfig.json`) because
+ * those files are copied verbatim into a generated project rather than compiled
+ * into this package. So anything defined only there is absent from `dist` and
+ * unreachable through the package entry point — which made the first version of
+ * this metadata unusable by the very consumer it was written for.
+ *
+ * This module is compiled, exported from `src/index.ts`, and therefore importable
+ * as `require('prisma-generator-express').GUARD_OPTION_METADATA` from an
+ * installed package. `test/consumer/packedMetadata.test.ts` proves that by packing
+ * the tarball and importing it the way a consumer would.
+ *
+ * **Scope, stated narrowly.** This is authoritative for the seven M8.7 GUARD
+ * controls and nothing else. The generator has many other public settings that
+ * change the emitted API — `dropGuard`, the target, the write strategy, the
+ * pagination mode, prefixes, OpenAPI options, the query-builder toggle — and none
+ * of them are described here yet. A configuration UI cannot build a complete
+ * screen from this file alone, and should not pretend otherwise.
+ *
+ * **Duplication is deliberate and guarded.** The runtime defaults live in
+ * `src/copy/routeConfig.ts` because the generated project needs them with no
+ * dependency on this package. They cannot import each other across the compile
+ * boundary, so the values appear twice and
+ * `test/unit/copy/guardOptionIndependence.test.ts` asserts the two agree, against
+ * the resolver the router actually runs. Drift fails a test rather than shipping a
+ * UI that advertises a default the code does not apply.
+ */
+
+export type GuardResolutionOrder = 'after-hooks' | 'before-hooks'
+
+export type GuardPolicy = {
+  requireGuardShape: boolean
+  validateGuardShapes: boolean
+  requireDefaultVariantOptIn: boolean
+  enableUpdateEach: boolean
+  guardResolutionOrder: GuardResolutionOrder
+  allowE2EGuardBypass: boolean
+  validateResolvedShapes: boolean
+}
+
+/**
+ * The public package's pre-1.64.2 behaviour, exactly.
+ *
+ * An unset option resolves to the value here. Changing one changes what every
+ * consumer who configured nothing gets on upgrade, which is the failure 1.64.2
+ * shipped and this table exists to prevent.
+ */
+export const UPSTREAM_GUARD_DEFAULTS: Readonly<GuardPolicy> = Object.freeze({
+  requireGuardShape: false,
+  validateGuardShapes: false,
+  requireDefaultVariantOptIn: false,
+  enableUpdateEach: true,
+  guardResolutionOrder: 'after-hooks',
+  allowE2EGuardBypass: true,
+  validateResolvedShapes: false,
+})
+
+/**
+ * Every control at its most restrictive — a SHORTCUT, not a mode.
+ *
+ * Spread it, change what you disagree with, store the result. There is
+ * deliberately no `preset: 'hardened'` option anywhere in this package: a stored
+ * preset NAME would let a future version silently change what an existing
+ * configuration does, which is the same class of mistake as 1.64.2.
+ */
+export const HARDENED_GUARD_PROFILE: Readonly<GuardPolicy> = Object.freeze({
+  requireGuardShape: true,
+  validateGuardShapes: true,
+  requireDefaultVariantOptIn: true,
+  enableUpdateEach: false,
+  guardResolutionOrder: 'before-hooks',
+  allowE2EGuardBypass: false,
+  validateResolvedShapes: true,
+})
+
+export type GuardOptionMetadata = {
+  name: keyof GuardPolicy
+  type: 'boolean' | 'enum'
+  values?: readonly string[]
+  default: boolean | string
+  hardened: boolean | string
+  label: string
+  description: string
+  /** Present where the permissive value can emit an unguarded or caller-selected route. */
+  warning: string
+  /** The target whose generated router reads this control. */
+  target: 'hono'
+}
+
+/**
+ * Machine-readable description of the seven guard controls.
+ *
+ * `target: 'hono'` on every entry is not decoration. These options are declared
+ * on the Hono route configuration only, because only the Hono generator reads
+ * them; declaring them on the shared base made Express and Fastify accept them in
+ * TypeScript and ignore them at runtime, which is a false public API.
+ */
+export const GUARD_OPTION_METADATA: readonly GuardOptionMetadata[] = Object.freeze([
+  {
+    name: 'requireGuardShape',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.requireGuardShape,
+    hardened: HARDENED_GUARD_PROFILE.requireGuardShape,
+    label: 'Require a guard on every enabled operation',
+    description:
+      'Refuses at router construction when an operation defines neither "shape" nor "variants".',
+    warning:
+      "Off, an operation nobody configured passes the caller's own where/select/include straight to Prisma.",
+    target: 'hono',
+  },
+  {
+    name: 'validateGuardShapes',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.validateGuardShapes,
+    hardened: HARDENED_GUARD_PROFILE.validateGuardShapes,
+    label: 'Validate guard shapes',
+    description:
+      'Refuses an empty shape, and one mixing guard keys with non-guard keys, at the top level and inside variants.',
+    warning:
+      'Off, "shape: {}" reads as guarded and constrains nothing. On, strict validation may reject existing route configs.',
+    target: 'hono',
+  },
+  {
+    name: 'requireDefaultVariantOptIn',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.requireDefaultVariantOptIn,
+    hardened: HARDENED_GUARD_PROFILE.requireDefaultVariantOptIn,
+    label: 'Require confirmation for a "default" variant',
+    description:
+      'A variant named "default" must set allowDefaultVariant: true to be accepted.',
+    warning: 'A "default" variant answers every unrecognised, blank and missing caller.',
+    target: 'hono',
+  },
+  {
+    name: 'enableUpdateEach',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.enableUpdateEach,
+    hardened: HARDENED_GUARD_PROFILE.enableUpdateEach,
+    label: 'Register the updateEach batch route',
+    description: 'Mounts POST <base>/each. Set false to refuse it at router construction.',
+    warning:
+      'updateEach bypasses guard shapes entirely; only a development-only warning stands between it and an unguarded mass update.',
+    target: 'hono',
+  },
+  {
+    name: 'guardResolutionOrder',
+    type: 'enum',
+    values: Object.freeze(['after-hooks', 'before-hooks']),
+    default: UPSTREAM_GUARD_DEFAULTS.guardResolutionOrder,
+    hardened: HARDENED_GUARD_PROFILE.guardResolutionOrder,
+    label: 'When guard failures are raised',
+    description:
+      'after-hooks is the upstream behaviour; before-hooks settles variant and shape resolution before any operation hook runs.',
+    warning:
+      'With after-hooks, a hook that returns a Response can answer a request whose guard was never established.',
+    target: 'hono',
+  },
+  {
+    name: 'allowE2EGuardBypass',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.allowE2EGuardBypass,
+    hardened: HARDENED_GUARD_PROFILE.allowE2EGuardBypass,
+    label: 'Honour the E2E environment guard bypass',
+    description: 'Treats E2E=true in the environment as a request to drop the guard.',
+    warning:
+      'A runtime variable can weaken a deployed artifact after generation. On an edge runtime this is an ordinary config var.',
+    target: 'hono',
+  },
+  {
+    name: 'validateResolvedShapes',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.validateResolvedShapes,
+    hardened: HARDENED_GUARD_PROFILE.validateResolvedShapes,
+    label: 'Validate what a shape function returns',
+    description:
+      'Checks a dynamically resolved shape before use and fails the request with 500 if it is unusable. Also resolves it exactly once.',
+    warning:
+      'Off, a shape function returning {} or undefined runs the operation unguarded, once per request.',
+    target: 'hono',
+  },
+])
+
+/**
+ * What this metadata does NOT cover.
+ *
+ * Exported so a consumer can display the gap rather than infer completeness from
+ * silence, and so a test can assert the claim is narrow. Every name here is a
+ * public setting that changes the emitted API and has no entry above.
+ */
+export const GUARD_METADATA_SCOPE = Object.freeze({
+  covers: 'the seven M8.7 guard controls on the Hono target',
+  complete: false,
+  notDescribedYet: Object.freeze([
+    'dropGuard',
+    'target',
+    'writeStrategy',
+    'findManyPaginated / pagination mode',
+    'pagination.countSource',
+    'addModelPrefix / customUrlPrefix / specBasePath',
+    'disableOpenApi and the OpenAPI metadata options',
+    'disablePostReads',
+    'queryBuilder',
+    'guard.resolveVariant / guard.variantHeader',
+  ]),
+})
+
+/** Fill in the defaults. Absent means upstream, never an opinion. */
+export function resolveGuardPolicy(config: Partial<GuardPolicy> | undefined): GuardPolicy {
+  return {
+    requireGuardShape: config?.requireGuardShape ?? UPSTREAM_GUARD_DEFAULTS.requireGuardShape,
+    validateGuardShapes:
+      config?.validateGuardShapes ?? UPSTREAM_GUARD_DEFAULTS.validateGuardShapes,
+    requireDefaultVariantOptIn:
+      config?.requireDefaultVariantOptIn ?? UPSTREAM_GUARD_DEFAULTS.requireDefaultVariantOptIn,
+    enableUpdateEach: config?.enableUpdateEach ?? UPSTREAM_GUARD_DEFAULTS.enableUpdateEach,
+    guardResolutionOrder:
+      config?.guardResolutionOrder ?? UPSTREAM_GUARD_DEFAULTS.guardResolutionOrder,
+    allowE2EGuardBypass:
+      config?.allowE2EGuardBypass ?? UPSTREAM_GUARD_DEFAULTS.allowE2EGuardBypass,
+    validateResolvedShapes:
+      config?.validateResolvedShapes ?? UPSTREAM_GUARD_DEFAULTS.validateResolvedShapes,
+  }
+}

package/src/index.ts

@@ -1,3 +1,22 @@
+/**
+ * Public, compiled configuration metadata (M8.7).
+ *
+ * Re-exported here because `src/copy/**` is excluded from the build, so anything
+ * defined only there never reaches `dist` and cannot be imported from an
+ * installed package. See src/guardOptions.ts.
+ *
+ * Authoritative for the seven Hono guard controls only — `GUARD_METADATA_SCOPE`
+ * lists what is not described yet.
+ */
+export {
+  GUARD_OPTION_METADATA,
+  GUARD_METADATA_SCOPE,
+  UPSTREAM_GUARD_DEFAULTS,
+  HARDENED_GUARD_PROFILE,
+  resolveGuardPolicy,
+} from './guardOptions'
+export type { GuardPolicy, GuardOptionMetadata, GuardResolutionOrder } from './guardOptions'
+
 import {
   generatorHandler,
   GeneratorOptions,