prisma-generator-express 1.64.2 → 1.64.3

package/src/copy/routeConfig.hono.ts

@@ -107,6 +107,91 @@ export type RouteConfig<
   >,
   HonoOpKeys
 > & {
+  /**
+   * SEVEN INDEPENDENT GUARD CONTROLS. Every default reproduces the public
+   * package's pre-1.64.2 behaviour exactly.
+   *
+   * 1.64.2 shipped these behaviours ON by default, which was a breaking change
+   * to a published package. The first correction put all seven behind one
+   * `requireGuard` switch, which was also wrong: they are unrelated decisions,
+   * and bundling them means a consumer who wants a missing-guard refusal is also
+   * forced into a hook-ordering change and the removal of a route they may use.
+   *
+   * So each is its own option. An unset option means the upstream default — never
+   * an opinionated value chosen on the consumer's behalf. `HARDENED_GUARD_PROFILE`
+   * selects all seven together for those who want them, but it is a set of values
+   * to spread, not a mode: what gets stored is the individual settings.
+   *
+   * `GUARD_OPTION_METADATA` describes these machine-readably, so a UI can render
+   * them without a hand-maintained second copy of the defaults.
+   */
+
+  /**
+   * Refuse an operation that configures no guard at all. **Default `false`.**
+   *
+   * With it off — the upstream default — an unconfigured operation is emitted and
+   * passes the caller's own where/select/include straight to Prisma. On, router
+   * construction throws, which on a Worker is boot.
+   */
+  requireGuardShape?: boolean
+
+  /**
+   * Validate that a shape constrains something. **Default `false`.**
+   *
+   * On, `shape: {}` and a shape mixing guard keys with non-guard keys (usually a
+   * typo: `wheer`, `iclude`) are refused, at the top level and inside variants.
+   */
+  validateGuardShapes?: boolean
+
+  /**
+   * Require `allowDefaultVariant: true` on an operation carrying a variant named
+   * `default`. **Default `false`.**
+   *
+   * A `default` variant answers every unrecognised, blank and missing caller.
+   * That is safe when it is the most restrictive variant and dangerous when it is
+   * the most permissive, and nothing can tell which from the shape.
+   */
+  requireDefaultVariantOptIn?: boolean
+
+  /**
+   * Register the `updateEach` batch route. **Default `true`.**
+   *
+   * It bypasses guard shapes by design — a batch of `{ where, data }` applied
+   * directly — and is protected only by a development-only warning. Set `false`
+   * to refuse it at router construction.
+   */
+  enableUpdateEach?: boolean
+
+  /**
+   * When guard failures are raised relative to operation `before` hooks.
+   * **Default `'after-hooks'`.**
+   *
+   * `'after-hooks'` is upstream behaviour: a hook may answer the request before
+   * variant resolution is settled. `'before-hooks'` settles the guard first, so a
+   * hook cannot answer a request whose guard was never established.
+   */
+  guardResolutionOrder?: 'after-hooks' | 'before-hooks'
+
+  /**
+   * Honour `E2E=true` in the environment as a guard bypass. **Default `true`.**
+   *
+   * Upstream behaviour, and a real hazard on an edge runtime where that variable
+   * is an ordinary config var — set on staging, copied forward, flagged as
+   * security-relevant nowhere. `false` makes guard behaviour a property of the
+   * artifact alone.
+   */
+  allowE2EGuardBypass?: boolean
+
+  /**
+   * Check what a shape FUNCTION returned before using it. **Default `false`.**
+   *
+   * A function shape is opaque at construction time. On, a resolved value that is
+   * empty, not an object, or carrying non-guard keys fails the request with 500 —
+   * a deployment fault, not a caller fault — instead of running unguarded. It
+   * also resolves the function exactly once and passes the validated value on.
+   */
+  validateResolvedShapes?: boolean
+
   findUnique?: OperationConfig<TShape, TEnv> | false
   findUniqueOrThrow?: OperationConfig<TShape, TEnv> | false
   findFirst?: OperationConfig<TShape, TEnv> | false

package/src/copy/routeConfig.ts

@@ -119,6 +119,14 @@ export type BaseOperationConfig<
   before?: TBefore[]
   after?: TAfter[]
   pagination?: Partial<PaginationConfig>
+  /**
+   * Confirms that a variant literally named `default` is meant to answer every
+   * unrecognised, blank and missing caller.
+   *
+   * Only consulted when `requireDefaultVariantOptIn` is on. Otherwise the key
+   * behaves as it always has, so this is inert for existing configurations.
+   */
+  allowDefaultVariant?: boolean
 }
 
 export interface BaseUpdateEachConfig<TBefore, TAfter = TBefore> {
@@ -216,6 +224,77 @@ type OperationConfigInput<TBefore, TAfter> = {
   pagination?: Partial<PaginationConfig>
 }
 
+/**
+ * The seven guard controls, resolved — the RUNTIME half.
+ *
+ * This lives here, not in the compiled `src/guardOptions.ts`, because a generated
+ * project gets these files copied in and must run with no dependency on this
+ * package. The two cannot import each other across that boundary, so the values
+ * appear twice and `guardOptionIndependence.test.ts` asserts they agree — against
+ * this resolver, which is the one the router actually runs.
+ *
+ * The machine-readable METADATA is compiled and public: see src/guardOptions.ts.
+ * Defining it here would put it in a file that never reaches `dist`.
+ */
+export type GuardPolicy = {
+  requireGuardShape: boolean
+  validateGuardShapes: boolean
+  requireDefaultVariantOptIn: boolean
+  enableUpdateEach: boolean
+  guardResolutionOrder: 'after-hooks' | 'before-hooks'
+  allowE2EGuardBypass: boolean
+  validateResolvedShapes: boolean
+}
+
+/**
+ * PRE-1.64.2 BEHAVIOUR, exactly. Changing any value here changes what an
+ * unconfigured consumer gets on upgrade, which is the thing that must not happen.
+ */
+export const UPSTREAM_GUARD_DEFAULTS: Readonly<GuardPolicy> = Object.freeze({
+  requireGuardShape: false,
+  validateGuardShapes: false,
+  requireDefaultVariantOptIn: false,
+  enableUpdateEach: true,
+  guardResolutionOrder: 'after-hooks',
+  allowE2EGuardBypass: true,
+  validateResolvedShapes: false,
+})
+
+/**
+ * Every control at its most restrictive — a SHORTCUT, not a mode.
+ *
+ * Spread it, edit what you disagree with, and store the result. There is
+ * deliberately no `preset: 'hardened'` option: a stored preset name would mean a
+ * future version of this package could silently change what a consumer's
+ * configuration does, which is the same class of mistake as 1.64.2 itself.
+ */
+export const HARDENED_GUARD_PROFILE: Readonly<GuardPolicy> = Object.freeze({
+  requireGuardShape: true,
+  validateGuardShapes: true,
+  requireDefaultVariantOptIn: true,
+  enableUpdateEach: false,
+  guardResolutionOrder: 'before-hooks',
+  allowE2EGuardBypass: false,
+  validateResolvedShapes: true,
+})
+
+/** Fill in the defaults. Absent means upstream, never an opinion. */
+export function resolveGuardPolicy(config: Partial<GuardPolicy> | undefined): GuardPolicy {
+  return {
+    requireGuardShape: config?.requireGuardShape ?? UPSTREAM_GUARD_DEFAULTS.requireGuardShape,
+    validateGuardShapes: config?.validateGuardShapes ?? UPSTREAM_GUARD_DEFAULTS.validateGuardShapes,
+    requireDefaultVariantOptIn:
+      config?.requireDefaultVariantOptIn ?? UPSTREAM_GUARD_DEFAULTS.requireDefaultVariantOptIn,
+    enableUpdateEach: config?.enableUpdateEach ?? UPSTREAM_GUARD_DEFAULTS.enableUpdateEach,
+    guardResolutionOrder:
+      config?.guardResolutionOrder ?? UPSTREAM_GUARD_DEFAULTS.guardResolutionOrder,
+    allowE2EGuardBypass:
+      config?.allowE2EGuardBypass ?? UPSTREAM_GUARD_DEFAULTS.allowE2EGuardBypass,
+    validateResolvedShapes:
+      config?.validateResolvedShapes ?? UPSTREAM_GUARD_DEFAULTS.validateResolvedShapes,
+  }
+}
+
 function classifyGuardRouting(shape: unknown): NormalizedGuardRouting {
   if (shape === undefined) return { kind: 'none' }
   if (typeof shape === 'function') return { kind: 'single' }
@@ -295,34 +374,79 @@ function validateShapeConfig(shape: unknown, location: string): void {
 export function validateOperationConfig(
   config: { shape?: unknown; variants?: unknown; allowDefaultVariant?: unknown } | undefined,
   location: string,
+  policy: Partial<GuardPolicy> = {},
 ): void {
+  const { requireGuardShape, validateGuardShapes, requireDefaultVariantOptIn } =
+    resolveGuardPolicy(policy)
+
+  /**
+   * THE CHECKS THAT PREDATE 1.64.2 RUN UNCONDITIONALLY.
+   *
+   * Everything below them is gated per option. Note each gate stands alone: a
+   * consumer who enables `validateGuardShapes` gets shape validation and NOT a
+   * missing-guard refusal, and vice versa. That independence is the point, and
+   * `guardOptionIndependence.test.ts` asserts it option by option.
+   */
   if (!config) {
-    throw new Error(
-      location + ': no guard configured. Every generated operation must define ' +
-      '"shape" or "variants"; an unguarded operation would pass the caller\'s ' +
-      'own where/select/include straight to Prisma.',
-    )
+    if (requireGuardShape) {
+      throw new Error(
+        location + ': no guard configured. Every generated operation must define ' +
+        '"shape" or "variants"; an unguarded operation would pass the caller\'s ' +
+        'own where/select/include straight to Prisma.',
+      )
+    }
+    return
   }
 
   const hasShape = config.shape !== undefined
   const hasVariants = config.variants !== undefined
 
+  // Pre-1.64.2. Not gated.
   if (hasShape && hasVariants) {
     throw new Error(location + ': shape and variants cannot both be defined')
   }
 
   if (!hasShape && !hasVariants) {
-    throw new Error(
-      location + ': no guard configured. Define "shape" or "variants".',
-    )
+    if (requireGuardShape) {
+      throw new Error(
+        location + ': no guard configured. Define "shape" or "variants".',
+      )
+    }
+    return
   }
 
   if (hasShape) {
-    validateShapeConfig(config.shape, location)
+    if (validateGuardShapes) validateShapeConfig(config.shape, location)
     return
   }
 
-  const variants = config.variants
+  validateVariantMap(
+    config.variants,
+    location,
+    { validateGuardShapes, requireDefaultVariantOptIn },
+    config.allowDefaultVariant,
+  )
+}
+
+/**
+ * The variant-map checks.
+ *
+ * The four that predate 1.64.2 — non-array object, at least one entry, no
+ * reserved-key collision, every entry an object carrying a `shape` — run
+ * ALWAYS, because they are not new and removing them would be its own breaking
+ * change.
+ *
+ * The two the hardening added are gated on their OWN options, independently:
+ * `requireDefaultVariantOptIn` confirms a `default` variant,
+ * `validateGuardShapes` validates each variant's shape the way a top-level
+ * `shape` is validated. Enabling either does not enable the other.
+ */
+function validateVariantMap(
+  variants: unknown,
+  location: string,
+  flags: { validateGuardShapes: boolean; requireDefaultVariantOptIn: boolean },
+  allowDefaultVariant?: unknown,
+): void {
   if (!isPlainObject(variants)) {
     throw new Error(location + ': variants must be a non-array object')
   }
@@ -343,18 +467,20 @@ export function validateOperationConfig(
    * writes on purpose; a key called `default` is one they may have typed without
    * noticing what it catches.
    */
-  if (Object.prototype.hasOwnProperty.call(variants, 'default')) {
-    if (config.allowDefaultVariant !== true) {
+  if (flags.requireDefaultVariantOptIn) {
+    if (Object.prototype.hasOwnProperty.call(variants, 'default')) {
+      if (allowDefaultVariant !== true) {
+        throw new Error(
+          location + ': a variant named "default" answers every unrecognised, ' +
+          'blank and missing caller. Set allowDefaultVariant: true to confirm ' +
+          'that is intended, and make sure it is the most restrictive variant.',
+        )
+      }
+    } else if (allowDefaultVariant !== undefined) {
       throw new Error(
-        location + ': a variant named "default" answers every unrecognised, ' +
-        'blank and missing caller. Set allowDefaultVariant: true to confirm ' +
-        'that is intended, and make sure it is the most restrictive variant.',
+        location + ': allowDefaultVariant is set but no "default" variant exists.',
       )
     }
-  } else if (config.allowDefaultVariant !== undefined) {
-    throw new Error(
-      location + ': allowDefaultVariant is set but no "default" variant exists.',
-    )
   }
 
   for (const [key, rawEntry] of entries) {
@@ -384,7 +510,9 @@ export function validateOperationConfig(
      * different key. A guard is not more trustworthy for being written inside a
      * variant.
      */
-    validateShapeConfig(rawEntry.shape, location + ' variant "' + key + '"')
+    if (flags.validateGuardShapes) {
+      validateShapeConfig(rawEntry.shape, location + ' variant "' + key + '"')
+    }
   }
 }
 

package/src/generators/generateRouteConfigType.ts

@@ -117,10 +117,15 @@ export function generateRouteConfigType(
       `      after?: ${afterRef}[]\n` +
       `    }>`
 
+    // Only consulted when `requireDefaultVariantOptIn` is on; inert otherwise.
+    // Emitted so a TypeScript consumer who opts in can confirm a `default`
+    // variant without a cast — 1.64.2 demanded it and never added it to the type.
+    const allowDefault = `    allowDefaultVariant?: boolean`
+
     return (
       `  ${routerOp}?: (${commonConfig} & (\n` +
       `    | { shape?: ${m}${c}ShapeInput<TCtx>; variants?: never }\n` +
-      `    | { shape?: never; variants: ${variantsConfig} }\n` +
+      `    | { shape?: never; variants: ${variantsConfig}\n${allowDefault} }\n` +
       `  )) | false`
     )
   }).join('\n')

package/src/generators/generateRouterHono.ts

@@ -81,7 +81,28 @@ function emitWriteOp(meta: (typeof OPERATION_METADATA)[number], modelName: strin
 }
 
 /**
- * Guard dropping is a GENERATION-TIME decision, never a runtime one.
+ * Guard behaviour is SEVEN INDEPENDENT OPT-IN CONTROLS on the route config.
+ *
+ * 1.64.2 shipped all of it as the default, which was a breaking change to a
+ * published package. The first correction put all of it behind one `requireGuard`
+ * switch, which was also wrong: these are unrelated decisions, and one switch
+ * forces a consumer who wants a missing-guard refusal to also accept a
+ * hook-ordering change and lose a route they may be using.
+ *
+ * Each is now its own option, each defaulting to the pre-1.64.2 behaviour:
+ *
+ *   - `requireGuardShape`           refuse an operation with no guard
+ *   - `validateGuardShapes`         refuse an empty or key-mixing shape
+ *   - `requireDefaultVariantOptIn`  confirm a `default` variant
+ *   - `enableUpdateEach`            register the batch route (default true)
+ *   - `guardResolutionOrder`        settle the guard before or after hooks
+ *   - `allowE2EGuardBypass`         honour E2E=true (default true)
+ *   - `validateResolvedShapes`      check what a shape function returned
+ *
+ * `HARDENED_GUARD_PROFILE` selects all seven, as values to spread rather than a
+ * mode to store. See routeConfig.ts.
+ *
+ * Guard dropping is then a GENERATION-TIME decision, never a runtime one.
  *
  * The emitted router used to compute `DROP_GUARD = <flag> || _env.E2E === 'true'`,
  * so setting `E2E=true` in a deployed environment downgraded enforcement even
@@ -99,13 +120,14 @@ function emitWriteOp(meta: (typeof OPERATION_METADATA)[number], modelName: strin
  * output is an artifact, and a paragraph about a bypass that no longer exists
  * would be copied into every router this generator writes.
  *
- * `updateEach` is refused for the same reason, one step further on. It bypasses
- * guard shapes by design — the endpoint is a batch of `{ where, data }` items
- * applied directly — and the only thing between it and an unguarded mass
- * mutation was a `console.warn` suppressed in production. A warning is not a
- * security boundary; it is advice to whoever happens to be reading a development
- * log. Refused at construction rather than silently dropped, so a deployment
- * expecting the route learns at boot instead of at the first 404.
+ * `updateEach` is refused for the same reason, one step further on — and, again,
+ * only under the flag. It bypasses guard shapes by design — the endpoint is a
+ * batch of `{ where, data }` items applied directly — and the only thing between
+ * it and an unguarded mass mutation is a `console.warn` suppressed in
+ * production. A warning is not a security boundary; it is advice to whoever
+ * happens to be reading a development log. Refused at construction rather than
+ * silently dropped, so a deployment expecting the route learns at boot instead
+ * of at the first 404.
  */
 export function generateHonoRouterFunction({
   model,
@@ -160,9 +182,11 @@ import { buildModelOpenApi } from '../buildModelOpenApi${ext}'
 import {
   normalizeOperation,
   resolveOperationVariantKey,
+  resolveGuardPolicy,
   resolveGuardShapeOnce,
   validateCountSourceWhere,
   validateOperationConfig,
+  validateUpdateEachConfig,
 } from '../routeConfig${ext}'
 import type { NormalizedOperationConfig } from '../routeConfig${ext}'
 import { transformResult } from '../operationRuntime${ext}'
@@ -176,8 +200,9 @@ import { MODEL_FIELDS, MODEL_ENUMS } from './${modelName}Metadata${ext}'
 ${generateRouteConfigType(modelName, 'HonoBeforeHook', guardShapesImport, importStyle, 'hono')}
 const _env = getEnv()
 
-// Fixed at generation time. Never read from the environment — see
-// generateRouterHono.ts.
+// Fixed at generation time. The \`allowE2EGuardBypass\` control decides whether the
+// environment can additionally drop the guard at runtime; it defaults to true,
+// which is upstream behaviour. See generateRouterHono.ts.
 const DROP_GUARD = ${dropGuard}
 
 type JsonLike =
@@ -236,6 +261,19 @@ async function parseBodyAsQueryMiddleware(c: HandlerContext): Promise<void> {
   c.set('parsedQuery', sanitizeKeys(body as Record<string, unknown>))
 }
 
+async function parseUpdateEachBodyMiddleware(c: HandlerContext): Promise<void> {
+  let body: unknown
+  try {
+    body = await c.req.json()
+  } catch {
+    throw new HTTPException(400, { message: 'updateEach body must be an array of { where, data } items' })
+  }
+  if (!Array.isArray(body)) {
+    throw new HTTPException(400, { message: 'updateEach body must be an array of { where, data } items' })
+  }
+  c.set('body', body)
+}
+
 async function parseWriteBodyMiddleware(c: HandlerContext): Promise<void> {
   let body: unknown
   try {
@@ -254,6 +292,17 @@ function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
   opConfig: NormalizedOp<TEnv>,
   opKind: OpKind,
 ) {
+  const policy = resolveGuardPolicy(config)
+
+  /**
+   * The environment bypass, honoured unless the consumer turned it off.
+   *
+   * \`E2E=true\` downgrading enforcement in a deployed environment is a real
+   * hazard, and it is also upstream behaviour — so it is a control, not a
+   * decision made here.
+   */
+  const dropGuard = DROP_GUARD || (policy.allowE2EGuardBypass && _env.E2E === 'true')
+
   return async (c: Context<GeneratedHonoEnv<TEnv>>): Promise<void> => {
     const merged = mergePaginationConfig(config.pagination, opConfig.pagination)
     if (merged) c.set('routeConfig', { pagination: merged })
@@ -281,18 +330,26 @@ function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
         : undefined
 
       /**
-       * Resolved ONCE, here, and the validated value is what travels onward —
-       * see resolveGuardShapeOnce. Passing the function on would let it return a
-       * different shape when it is enforced than when it was checked.
+       * With \`validateResolvedShapes\`, resolved ONCE here and the validated value
+       * is what travels onward — see resolveGuardShapeOnce. Passing the function
+       * on would let it return a different shape when it is enforced than when it
+       * was checked.
+       *
+       * Without it the raw shape is passed through untouched, which is upstream
+       * behaviour: it is resolved at the point of use, and a function returning
+       * something unusable is not this router's business to refuse.
        */
-      const resolution = await resolveGuardShapeOnce(opConfig.guardShape, resolvedKey, resolveCtx)
-      if (!resolution.ok) {
-        c.set('guardShapeFailure', resolution.problem)
-        return
+      let effectiveShape: unknown = opConfig.guardShape
+      if (policy.validateResolvedShapes) {
+        const resolution = await resolveGuardShapeOnce(opConfig.guardShape, resolvedKey, resolveCtx)
+        if (!resolution.ok) {
+          c.set('guardShapeFailure', resolution.problem)
+          return
+        }
+        effectiveShape = resolution.shape
       }
-      const effectiveShape = resolution.shape
 
-      if (!DROP_GUARD) {
+      if (!dropGuard) {
         c.set('guardShape', effectiveShape)
       } else {
         await applyDroppedGuard(
@@ -438,6 +495,38 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     })
   }
 
+  const POLICY = resolveGuardPolicy(config)
+  const SETTLE_BEFORE_HOOKS = POLICY.guardResolutionOrder === 'before-hooks'
+
+  /**
+   * The guard-resolution failures, raised in one place so both handlers and both
+   * orderings share exactly one definition of what a failure is.
+   *
+   * WHERE it is called is the behavioural difference, and it is the
+   * \`guardResolutionOrder\` control. \`'before-hooks'\` runs it before any operation
+   * hook, because a hook that returns a Response — an auth gate, a cache, a
+   * short-circuit for a known caller — would otherwise answer a request whose
+   * guard was never established. \`'after-hooks'\` is upstream behaviour.
+   *
+   * \`guardShapeFailure\` is only ever set when \`validateResolvedShapes\` is on, so
+   * that branch is inert rather than merely unreached when it is off.
+   */
+  const settleGuard = (c: Context<GeneratedHonoEnv<TEnv>>): void => {
+    const failure = c.get('guardVariantFailure')
+    if (failure) {
+      throw new HTTPException(400, {
+        message: formatGuardVariantResolutionError(failure),
+      })
+    }
+
+    const shapeFailure = c.get('guardShapeFailure')
+    if (shapeFailure) {
+      throw new HTTPException(500, {
+        message: 'guard shape could not be resolved: ' + shapeFailure,
+      })
+    }
+  }
+
   const handleRead = (
     opConfig: NormalizedOp<TEnv>,
     handlerFn: (c: HandlerContext) => Promise<void>,
@@ -448,41 +537,15 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
       await parseFn(c as unknown as HandlerContext)
       await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, opKind)(c)
 
-      /**
-       * Variant resolution is settled BEFORE any operation hook runs.
-       *
-       * The check used to sit after \`operationBefore\`, so a hook that returned a
-       * Response — an auth gate, a cache, a short-circuit for a known caller —
-       * answered the request before anyone established which guard applied to
-       * it. A cached response served for a request whose variant could not be
-       * resolved is a response served under a guard nobody chose.
-       *
-       * Hooks that must run first belong outside the generated router, where
-       * they are visibly not part of guard resolution.
-       */
-      const failure = c.get('guardVariantFailure')
-      if (failure) {
-        throw new HTTPException(400, {
-          message: formatGuardVariantResolutionError(failure),
-        })
-      }
-
-      /**
-       * A shape function that returned something unusable is a DEPLOYMENT fault,
-       * not a caller fault — 500, and refused here, before any hook can answer
-       * the request and before Prisma is reached. Running unguarded because the
-       * guard failed to produce a guard is the outcome this exists to prevent.
-       */
-      const shapeFailure = c.get('guardShapeFailure')
-      if (shapeFailure) {
-        throw new HTTPException(500, {
-          message: 'guard shape could not be resolved: ' + shapeFailure,
-        })
-      }
+      // Settled BEFORE any hook can answer the request, when asked for.
+      if (SETTLE_BEFORE_HOOKS) settleGuard(c)
 
       const operationBefore = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
       if (operationBefore) return operationBefore
 
+      // Upstream order: hooks first, guard failure after.
+      if (!SETTLE_BEFORE_HOOKS) settleGuard(c)
+
       const key = c.get('guardVariantKey')
       const variantHooks =
         key !== undefined ? opConfig.variantHooks[key] : undefined
@@ -509,30 +572,15 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
       await parseWriteBodyMiddleware(c as unknown as HandlerContext)
       await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, opKind)(c)
 
-      // Settled before any operation hook — see the read handler above.
-      const failure = c.get('guardVariantFailure')
-      if (failure) {
-        throw new HTTPException(400, {
-          message: formatGuardVariantResolutionError(failure),
-        })
-      }
-
-      /**
-       * A shape function that returned something unusable is a DEPLOYMENT fault,
-       * not a caller fault — 500, and refused here, before any hook can answer
-       * the request and before Prisma is reached. Running unguarded because the
-       * guard failed to produce a guard is the outcome this exists to prevent.
-       */
-      const shapeFailure = c.get('guardShapeFailure')
-      if (shapeFailure) {
-        throw new HTTPException(500, {
-          message: 'guard shape could not be resolved: ' + shapeFailure,
-        })
-      }
+      // Settled BEFORE any hook can answer the request, when asked for.
+      if (SETTLE_BEFORE_HOOKS) settleGuard(c)
 
       const operationBefore = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
       if (operationBefore) return operationBefore
 
+      // Upstream order: hooks first, guard failure after.
+      if (!SETTLE_BEFORE_HOOKS) settleGuard(c)
+
       const key = c.get('guardVariantKey')
       const variantHooks =
         key !== undefined ? opConfig.variantHooks[key] : undefined
@@ -554,7 +602,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     key: K,
   ): NormalizedOp<TEnv> => {
     const raw = config[key] as unknown as OperationConfigLike<TEnv> | undefined
-    validateOperationConfig(raw, '${modelName}.' + String(key))
+    validateOperationConfig(raw, '${modelName}.' + String(key), POLICY)
     return normalizeHonoOperation(raw)
   }
 
@@ -562,14 +610,50 @@ ${readOpBlocks}
 
 ${writeOpBlocks}
 
-  // Not registered on this target — see generateRouterHono.ts for why.
   if (config.updateEach) {
-    throw new Error(
-      '${modelName}.updateEach: this target does not register updateEach. It bypasses ' +
-      'guard shapes entirely, so there is no configuration that makes it safe to ' +
-      'expose. Perform batch updates through a guarded operation, or behind your own ' +
-      'authenticated route outside the generated router.',
-    )
+    /**
+     * Refused only when \`enableUpdateEach\` is false. It bypasses guard shapes by design — the
+     * endpoint is a batch of { where, data } applied directly — and the only thing
+     * between it and an unguarded mass mutation is a console.warn suppressed in
+     * production. A warning is not a security boundary.
+     *
+     * Removing the route outright was a breaking change to a published package,
+     * so by default it registers exactly as it did, warning and all.
+     */
+    if (!POLICY.enableUpdateEach) {
+      throw new Error(
+        '${modelName}.updateEach: enableUpdateEach is false, so this router ' +
+        'does not register updateEach. It bypasses guard shapes entirely, so ' +
+        'there is no configuration that makes it safe to expose. Perform batch ' +
+        'updates through a guarded operation, or behind your own authenticated ' +
+        'route outside the generated router.',
+      )
+    }
+
+    const rawUpdateEach = config.updateEach as unknown as OperationConfigLike<TEnv>
+    validateUpdateEachConfig(rawUpdateEach, '${modelName}.updateEach')
+    const opConfig = normalizeHonoOperation(rawUpdateEach)
+    if (opConfig.operationBefore.length === 0 && _env.NODE_ENV !== 'production') {
+      console.warn(
+        '[${modelName}Router] updateEach is enabled without a before hook. ' +
+        'This endpoint bypasses guard shapes and should be protected by authentication middleware.',
+      )
+    }
+    const path = basePath ? \`\${basePath}/each\` : '/each'
+    app.post(path, async (c: Context<GeneratedHonoEnv<TEnv>>): Promise<Response> => {
+      try {
+        await parseUpdateEachBodyMiddleware(c as unknown as HandlerContext)
+        await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, 'noop')(c)
+        const beforeResponse = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
+        if (beforeResponse) return beforeResponse
+        await ${modelName}UpdateEach(c as unknown as HandlerContext)
+        const afterResponse = await runAfterHooks<TEnv>(opConfig.operationAfter, c)
+        if (afterResponse) return afterResponse
+        return sendResult(c as unknown as HandlerContext)
+      } catch (error: unknown) {
+        return sendError(c as unknown as HandlerContext, error)
+      }
+    })
   }
 
   return app