prisma-generator-express 1.64.2 → 1.64.4

package/src/generators/generateRouterHono.ts

@@ -81,7 +81,28 @@ function emitWriteOp(meta: (typeof OPERATION_METADATA)[number], modelName: strin
 }
 
 /**
- * Guard dropping is a GENERATION-TIME decision, never a runtime one.
+ * Guard behaviour is SEVEN INDEPENDENT OPT-IN CONTROLS on the route config.
+ *
+ * 1.64.2 shipped all of it as the default, which was a breaking change to a
+ * published package. The first correction put all of it behind one `requireGuard`
+ * switch, which was also wrong: these are unrelated decisions, and one switch
+ * forces a consumer who wants a missing-guard refusal to also accept a
+ * hook-ordering change and lose a route they may be using.
+ *
+ * Each is now its own option, each defaulting to the pre-1.64.2 behaviour:
+ *
+ *   - `requireGuardShape`           refuse an operation with no guard
+ *   - `validateGuardShapes`         refuse an empty or key-mixing shape
+ *   - `requireDefaultVariantOptIn`  confirm a `default` variant
+ *   - `enableUpdateEach`            register the batch route (default true)
+ *   - `guardResolutionOrder`        settle the guard before or after hooks
+ *   - `allowE2EGuardBypass`         honour E2E=true (default true)
+ *   - `validateResolvedShapes`      check what a shape function returned
+ *
+ * `HARDENED_GUARD_PROFILE` selects all seven, as values to spread rather than a
+ * mode to store. See routeConfig.ts.
+ *
+ * Guard dropping is then a GENERATION-TIME decision, never a runtime one.
  *
  * The emitted router used to compute `DROP_GUARD = <flag> || _env.E2E === 'true'`,
  * so setting `E2E=true` in a deployed environment downgraded enforcement even
@@ -99,13 +120,14 @@ function emitWriteOp(meta: (typeof OPERATION_METADATA)[number], modelName: strin
  * output is an artifact, and a paragraph about a bypass that no longer exists
  * would be copied into every router this generator writes.
  *
- * `updateEach` is refused for the same reason, one step further on. It bypasses
- * guard shapes by design — the endpoint is a batch of `{ where, data }` items
- * applied directly — and the only thing between it and an unguarded mass
- * mutation was a `console.warn` suppressed in production. A warning is not a
- * security boundary; it is advice to whoever happens to be reading a development
- * log. Refused at construction rather than silently dropped, so a deployment
- * expecting the route learns at boot instead of at the first 404.
+ * `updateEach` is refused for the same reason, one step further on — and, again,
+ * only under the flag. It bypasses guard shapes by design — the endpoint is a
+ * batch of `{ where, data }` items applied directly — and the only thing between
+ * it and an unguarded mass mutation is a `console.warn` suppressed in
+ * production. A warning is not a security boundary; it is advice to whoever
+ * happens to be reading a development log. Refused at construction rather than
+ * silently dropped, so a deployment expecting the route learns at boot instead
+ * of at the first 404.
  */
 export function generateHonoRouterFunction({
   model,
@@ -160,9 +182,11 @@ import { buildModelOpenApi } from '../buildModelOpenApi${ext}'
 import {
   normalizeOperation,
   resolveOperationVariantKey,
+  resolveGuardPolicy,
   resolveGuardShapeOnce,
   validateCountSourceWhere,
   validateOperationConfig,
+  validateUpdateEachConfig,
 } from '../routeConfig${ext}'
 import type { NormalizedOperationConfig } from '../routeConfig${ext}'
 import { transformResult } from '../operationRuntime${ext}'
@@ -176,8 +200,9 @@ import { MODEL_FIELDS, MODEL_ENUMS } from './${modelName}Metadata${ext}'
 ${generateRouteConfigType(modelName, 'HonoBeforeHook', guardShapesImport, importStyle, 'hono')}
 const _env = getEnv()
 
-// Fixed at generation time. Never read from the environment — see
-// generateRouterHono.ts.
+// Fixed at generation time. The \`allowE2EGuardBypass\` control decides whether the
+// environment can additionally drop the guard at runtime; it defaults to true,
+// which is upstream behaviour. See generateRouterHono.ts.
 const DROP_GUARD = ${dropGuard}
 
 type JsonLike =
@@ -236,6 +261,19 @@ async function parseBodyAsQueryMiddleware(c: HandlerContext): Promise<void> {
   c.set('parsedQuery', sanitizeKeys(body as Record<string, unknown>))
 }
 
+async function parseUpdateEachBodyMiddleware(c: HandlerContext): Promise<void> {
+  let body: unknown
+  try {
+    body = await c.req.json()
+  } catch {
+    throw new HTTPException(400, { message: 'updateEach body must be an array of { where, data } items' })
+  }
+  if (!Array.isArray(body)) {
+    throw new HTTPException(400, { message: 'updateEach body must be an array of { where, data } items' })
+  }
+  c.set('body', body)
+}
+
 async function parseWriteBodyMiddleware(c: HandlerContext): Promise<void> {
   let body: unknown
   try {
@@ -254,6 +292,17 @@ function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
   opConfig: NormalizedOp<TEnv>,
   opKind: OpKind,
 ) {
+  const policy = resolveGuardPolicy(config)
+
+  /**
+   * The environment bypass, honoured unless the consumer turned it off.
+   *
+   * \`E2E=true\` downgrading enforcement in a deployed environment is a real
+   * hazard, and it is also upstream behaviour — so it is a control, not a
+   * decision made here.
+   */
+  const dropGuard = DROP_GUARD || (policy.allowE2EGuardBypass && _env.E2E === 'true')
+
   return async (c: Context<GeneratedHonoEnv<TEnv>>): Promise<void> => {
     const merged = mergePaginationConfig(config.pagination, opConfig.pagination)
     if (merged) c.set('routeConfig', { pagination: merged })
@@ -281,18 +330,26 @@ function makeShapeMiddleware<TCtx, TPrisma, TEnv extends HonoEnvBase>(
         : undefined
 
       /**
-       * Resolved ONCE, here, and the validated value is what travels onward —
-       * see resolveGuardShapeOnce. Passing the function on would let it return a
-       * different shape when it is enforced than when it was checked.
+       * With \`validateResolvedShapes\`, resolved ONCE here and the validated value
+       * is what travels onward — see resolveGuardShapeOnce. Passing the function
+       * on would let it return a different shape when it is enforced than when it
+       * was checked.
+       *
+       * Without it the raw shape is passed through untouched, which is upstream
+       * behaviour: it is resolved at the point of use, and a function returning
+       * something unusable is not this router's business to refuse.
        */
-      const resolution = await resolveGuardShapeOnce(opConfig.guardShape, resolvedKey, resolveCtx)
-      if (!resolution.ok) {
-        c.set('guardShapeFailure', resolution.problem)
-        return
+      let effectiveShape: unknown = opConfig.guardShape
+      if (policy.validateResolvedShapes) {
+        const resolution = await resolveGuardShapeOnce(opConfig.guardShape, resolvedKey, resolveCtx)
+        if (!resolution.ok) {
+          c.set('guardShapeFailure', resolution.problem)
+          return
+        }
+        effectiveShape = resolution.shape
       }
-      const effectiveShape = resolution.shape
 
-      if (!DROP_GUARD) {
+      if (!dropGuard) {
         c.set('guardShape', effectiveShape)
       } else {
         await applyDroppedGuard(
@@ -438,6 +495,38 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     })
   }
 
+  const POLICY = resolveGuardPolicy(config)
+  const SETTLE_BEFORE_HOOKS = POLICY.guardResolutionOrder === 'before-hooks'
+
+  /**
+   * The guard-resolution failures, raised in one place so both handlers and both
+   * orderings share exactly one definition of what a failure is.
+   *
+   * WHERE it is called is the behavioural difference, and it is the
+   * \`guardResolutionOrder\` control. \`'before-hooks'\` runs it before any operation
+   * hook, because a hook that returns a Response — an auth gate, a cache, a
+   * short-circuit for a known caller — would otherwise answer a request whose
+   * guard was never established. \`'after-hooks'\` is upstream behaviour.
+   *
+   * \`guardShapeFailure\` is only ever set when \`validateResolvedShapes\` is on, so
+   * that branch is inert rather than merely unreached when it is off.
+   */
+  const settleGuard = (c: Context<GeneratedHonoEnv<TEnv>>): void => {
+    const failure = c.get('guardVariantFailure')
+    if (failure) {
+      throw new HTTPException(400, {
+        message: formatGuardVariantResolutionError(failure),
+      })
+    }
+
+    const shapeFailure = c.get('guardShapeFailure')
+    if (shapeFailure) {
+      throw new HTTPException(500, {
+        message: 'guard shape could not be resolved: ' + shapeFailure,
+      })
+    }
+  }
+
   const handleRead = (
     opConfig: NormalizedOp<TEnv>,
     handlerFn: (c: HandlerContext) => Promise<void>,
@@ -448,41 +537,15 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
       await parseFn(c as unknown as HandlerContext)
       await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, opKind)(c)
 
-      /**
-       * Variant resolution is settled BEFORE any operation hook runs.
-       *
-       * The check used to sit after \`operationBefore\`, so a hook that returned a
-       * Response — an auth gate, a cache, a short-circuit for a known caller —
-       * answered the request before anyone established which guard applied to
-       * it. A cached response served for a request whose variant could not be
-       * resolved is a response served under a guard nobody chose.
-       *
-       * Hooks that must run first belong outside the generated router, where
-       * they are visibly not part of guard resolution.
-       */
-      const failure = c.get('guardVariantFailure')
-      if (failure) {
-        throw new HTTPException(400, {
-          message: formatGuardVariantResolutionError(failure),
-        })
-      }
-
-      /**
-       * A shape function that returned something unusable is a DEPLOYMENT fault,
-       * not a caller fault — 500, and refused here, before any hook can answer
-       * the request and before Prisma is reached. Running unguarded because the
-       * guard failed to produce a guard is the outcome this exists to prevent.
-       */
-      const shapeFailure = c.get('guardShapeFailure')
-      if (shapeFailure) {
-        throw new HTTPException(500, {
-          message: 'guard shape could not be resolved: ' + shapeFailure,
-        })
-      }
+      // Settled BEFORE any hook can answer the request, when asked for.
+      if (SETTLE_BEFORE_HOOKS) settleGuard(c)
 
       const operationBefore = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
       if (operationBefore) return operationBefore
 
+      // Upstream order: hooks first, guard failure after.
+      if (!SETTLE_BEFORE_HOOKS) settleGuard(c)
+
       const key = c.get('guardVariantKey')
       const variantHooks =
         key !== undefined ? opConfig.variantHooks[key] : undefined
@@ -509,30 +572,15 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
       await parseWriteBodyMiddleware(c as unknown as HandlerContext)
       await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, opKind)(c)
 
-      // Settled before any operation hook — see the read handler above.
-      const failure = c.get('guardVariantFailure')
-      if (failure) {
-        throw new HTTPException(400, {
-          message: formatGuardVariantResolutionError(failure),
-        })
-      }
-
-      /**
-       * A shape function that returned something unusable is a DEPLOYMENT fault,
-       * not a caller fault — 500, and refused here, before any hook can answer
-       * the request and before Prisma is reached. Running unguarded because the
-       * guard failed to produce a guard is the outcome this exists to prevent.
-       */
-      const shapeFailure = c.get('guardShapeFailure')
-      if (shapeFailure) {
-        throw new HTTPException(500, {
-          message: 'guard shape could not be resolved: ' + shapeFailure,
-        })
-      }
+      // Settled BEFORE any hook can answer the request, when asked for.
+      if (SETTLE_BEFORE_HOOKS) settleGuard(c)
 
       const operationBefore = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
       if (operationBefore) return operationBefore
 
+      // Upstream order: hooks first, guard failure after.
+      if (!SETTLE_BEFORE_HOOKS) settleGuard(c)
+
       const key = c.get('guardVariantKey')
       const variantHooks =
         key !== undefined ? opConfig.variantHooks[key] : undefined
@@ -554,7 +602,7 @@ export function ${routerFunctionName}<TCtx = unknown, TPrisma = any, TEnv extend
     key: K,
   ): NormalizedOp<TEnv> => {
     const raw = config[key] as unknown as OperationConfigLike<TEnv> | undefined
-    validateOperationConfig(raw, '${modelName}.' + String(key))
+    validateOperationConfig(raw, '${modelName}.' + String(key), POLICY)
     return normalizeHonoOperation(raw)
   }
 
@@ -562,14 +610,50 @@ ${readOpBlocks}
 
 ${writeOpBlocks}
 
-  // Not registered on this target — see generateRouterHono.ts for why.
   if (config.updateEach) {
-    throw new Error(
-      '${modelName}.updateEach: this target does not register updateEach. It bypasses ' +
-      'guard shapes entirely, so there is no configuration that makes it safe to ' +
-      'expose. Perform batch updates through a guarded operation, or behind your own ' +
-      'authenticated route outside the generated router.',
-    )
+    /**
+     * Refused only when \`enableUpdateEach\` is false. It bypasses guard shapes by design — the
+     * endpoint is a batch of { where, data } applied directly — and the only thing
+     * between it and an unguarded mass mutation is a console.warn suppressed in
+     * production. A warning is not a security boundary.
+     *
+     * Removing the route outright was a breaking change to a published package,
+     * so by default it registers exactly as it did, warning and all.
+     */
+    if (!POLICY.enableUpdateEach) {
+      throw new Error(
+        '${modelName}.updateEach: enableUpdateEach is false, so this router ' +
+        'does not register updateEach. It bypasses guard shapes entirely, so ' +
+        'there is no configuration that makes it safe to expose. Perform batch ' +
+        'updates through a guarded operation, or behind your own authenticated ' +
+        'route outside the generated router.',
+      )
+    }
+
+    const rawUpdateEach = config.updateEach as unknown as OperationConfigLike<TEnv>
+    validateUpdateEachConfig(rawUpdateEach, '${modelName}.updateEach')
+    const opConfig = normalizeHonoOperation(rawUpdateEach)
+    if (opConfig.operationBefore.length === 0 && _env.NODE_ENV !== 'production') {
+      console.warn(
+        '[${modelName}Router] updateEach is enabled without a before hook. ' +
+        'This endpoint bypasses guard shapes and should be protected by authentication middleware.',
+      )
+    }
+    const path = basePath ? \`\${basePath}/each\` : '/each'
+    app.post(path, async (c: Context<GeneratedHonoEnv<TEnv>>): Promise<Response> => {
+      try {
+        await parseUpdateEachBodyMiddleware(c as unknown as HandlerContext)
+        await makeShapeMiddleware<TCtx, TPrisma, TEnv>(config, opConfig, 'noop')(c)
+        const beforeResponse = await runBeforeHooks<TEnv>(opConfig.operationBefore, c)
+        if (beforeResponse) return beforeResponse
+        await ${modelName}UpdateEach(c as unknown as HandlerContext)
+        const afterResponse = await runAfterHooks<TEnv>(opConfig.operationAfter, c)
+        if (afterResponse) return afterResponse
+        return sendResult(c as unknown as HandlerContext)
+      } catch (error: unknown) {
+        return sendError(c as unknown as HandlerContext, error)
+      }
+    })
   }
 
   return app

package/src/guardOptions.ts

@@ -0,0 +1,226 @@
+/**
+ * PUBLIC, COMPILED METADATA for the Hono guard controls.
+ *
+ * **Why this file exists separately from `src/copy/routeConfig.ts`.**
+ * `src/copy/**` is excluded from the TypeScript build (`tsconfig.json`) because
+ * those files are copied verbatim into a generated project rather than compiled
+ * into this package. So anything defined only there is absent from `dist` and
+ * unreachable through the package entry point — which made the first version of
+ * this metadata unusable by the very consumer it was written for.
+ *
+ * This module is compiled, exported from `src/index.ts`, and therefore importable
+ * as `require('prisma-generator-express').GUARD_OPTION_METADATA` from an
+ * installed package. `test/consumer/packedMetadata.test.ts` proves that by packing
+ * the tarball and importing it the way a consumer would.
+ *
+ * **Scope, stated narrowly.** This is authoritative for the seven M8.7 GUARD
+ * controls and nothing else. The generator has many other public settings that
+ * change the emitted API — `dropGuard`, the target, the write strategy, the
+ * pagination mode, prefixes, OpenAPI options, the query-builder toggle — and none
+ * of them are described here yet. A configuration UI cannot build a complete
+ * screen from this file alone, and should not pretend otherwise.
+ *
+ * **Duplication is deliberate and guarded.** The runtime defaults live in
+ * `src/copy/routeConfig.ts` because the generated project needs them with no
+ * dependency on this package. They cannot import each other across the compile
+ * boundary, so the values appear twice and
+ * `test/unit/copy/guardOptionIndependence.test.ts` asserts the two agree, against
+ * the resolver the router actually runs. Drift fails a test rather than shipping a
+ * UI that advertises a default the code does not apply.
+ */
+
+export type GuardResolutionOrder = 'after-hooks' | 'before-hooks'
+
+export type GuardPolicy = {
+  requireGuardShape: boolean
+  validateGuardShapes: boolean
+  requireDefaultVariantOptIn: boolean
+  enableUpdateEach: boolean
+  guardResolutionOrder: GuardResolutionOrder
+  allowE2EGuardBypass: boolean
+  validateResolvedShapes: boolean
+}
+
+/**
+ * The public package's pre-1.64.2 behaviour, exactly.
+ *
+ * An unset option resolves to the value here. Changing one changes what every
+ * consumer who configured nothing gets on upgrade, which is the failure 1.64.2
+ * shipped and this table exists to prevent.
+ */
+export const UPSTREAM_GUARD_DEFAULTS: Readonly<GuardPolicy> = Object.freeze({
+  requireGuardShape: false,
+  validateGuardShapes: false,
+  requireDefaultVariantOptIn: false,
+  enableUpdateEach: true,
+  guardResolutionOrder: 'after-hooks',
+  allowE2EGuardBypass: true,
+  validateResolvedShapes: false,
+})
+
+/**
+ * Every control at its most restrictive — a SHORTCUT, not a mode.
+ *
+ * Spread it, change what you disagree with, store the result. There is
+ * deliberately no `preset: 'hardened'` option anywhere in this package: a stored
+ * preset NAME would let a future version silently change what an existing
+ * configuration does, which is the same class of mistake as 1.64.2.
+ */
+export const HARDENED_GUARD_PROFILE: Readonly<GuardPolicy> = Object.freeze({
+  requireGuardShape: true,
+  validateGuardShapes: true,
+  requireDefaultVariantOptIn: true,
+  enableUpdateEach: false,
+  guardResolutionOrder: 'before-hooks',
+  allowE2EGuardBypass: false,
+  validateResolvedShapes: true,
+})
+
+export type GuardOptionMetadata = {
+  name: keyof GuardPolicy
+  type: 'boolean' | 'enum'
+  values?: readonly string[]
+  default: boolean | string
+  hardened: boolean | string
+  label: string
+  description: string
+  /** Present where the permissive value can emit an unguarded or caller-selected route. */
+  warning: string
+  /** The target whose generated router reads this control. */
+  target: 'hono'
+}
+
+/**
+ * Machine-readable description of the seven guard controls.
+ *
+ * `target: 'hono'` on every entry is not decoration. These options are declared
+ * on the Hono route configuration only, because only the Hono generator reads
+ * them; declaring them on the shared base made Express and Fastify accept them in
+ * TypeScript and ignore them at runtime, which is a false public API.
+ */
+export const GUARD_OPTION_METADATA: readonly GuardOptionMetadata[] = Object.freeze([
+  {
+    name: 'requireGuardShape',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.requireGuardShape,
+    hardened: HARDENED_GUARD_PROFILE.requireGuardShape,
+    label: 'Require a guard on every enabled operation',
+    description:
+      'Refuses at router construction when an operation defines neither "shape" nor "variants".',
+    warning:
+      "Off, an operation nobody configured passes the caller's own where/select/include straight to Prisma.",
+    target: 'hono',
+  },
+  {
+    name: 'validateGuardShapes',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.validateGuardShapes,
+    hardened: HARDENED_GUARD_PROFILE.validateGuardShapes,
+    label: 'Validate guard shapes',
+    description:
+      'Refuses an empty shape, and one mixing guard keys with non-guard keys, at the top level and inside variants.',
+    warning:
+      'Off, "shape: {}" reads as guarded and constrains nothing. On, strict validation may reject existing route configs.',
+    target: 'hono',
+  },
+  {
+    name: 'requireDefaultVariantOptIn',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.requireDefaultVariantOptIn,
+    hardened: HARDENED_GUARD_PROFILE.requireDefaultVariantOptIn,
+    label: 'Require confirmation for a "default" variant',
+    description:
+      'A variant named "default" must set allowDefaultVariant: true to be accepted.',
+    warning: 'A "default" variant answers every unrecognised, blank and missing caller.',
+    target: 'hono',
+  },
+  {
+    name: 'enableUpdateEach',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.enableUpdateEach,
+    hardened: HARDENED_GUARD_PROFILE.enableUpdateEach,
+    label: 'Register the updateEach batch route',
+    description: 'Mounts POST <base>/each. Set false to refuse it at router construction.',
+    warning:
+      'updateEach bypasses guard shapes entirely; only a development-only warning stands between it and an unguarded mass update.',
+    target: 'hono',
+  },
+  {
+    name: 'guardResolutionOrder',
+    type: 'enum',
+    values: Object.freeze(['after-hooks', 'before-hooks']),
+    default: UPSTREAM_GUARD_DEFAULTS.guardResolutionOrder,
+    hardened: HARDENED_GUARD_PROFILE.guardResolutionOrder,
+    label: 'When guard failures are raised',
+    description:
+      'after-hooks is the upstream behaviour; before-hooks settles variant and shape resolution before any operation hook runs.',
+    warning:
+      'With after-hooks, a hook that returns a Response can answer a request whose guard was never established.',
+    target: 'hono',
+  },
+  {
+    name: 'allowE2EGuardBypass',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.allowE2EGuardBypass,
+    hardened: HARDENED_GUARD_PROFILE.allowE2EGuardBypass,
+    label: 'Honour the E2E environment guard bypass',
+    description: 'Treats E2E=true in the environment as a request to drop the guard.',
+    warning:
+      'A runtime variable can weaken a deployed artifact after generation. On an edge runtime this is an ordinary config var.',
+    target: 'hono',
+  },
+  {
+    name: 'validateResolvedShapes',
+    type: 'boolean',
+    default: UPSTREAM_GUARD_DEFAULTS.validateResolvedShapes,
+    hardened: HARDENED_GUARD_PROFILE.validateResolvedShapes,
+    label: 'Validate what a shape function returns',
+    description:
+      'Checks a dynamically resolved shape before use and fails the request with 500 if it is unusable. Also resolves it exactly once.',
+    warning:
+      'Off, a shape function returning {} or undefined runs the operation unguarded, once per request.',
+    target: 'hono',
+  },
+])
+
+/**
+ * What this metadata does NOT cover.
+ *
+ * Exported so a consumer can display the gap rather than infer completeness from
+ * silence, and so a test can assert the claim is narrow. Every name here is a
+ * public setting that changes the emitted API and has no entry above.
+ */
+export const GUARD_METADATA_SCOPE = Object.freeze({
+  covers: 'the seven M8.7 guard controls on the Hono target',
+  complete: false,
+  notDescribedYet: Object.freeze([
+    'dropGuard',
+    'target',
+    'writeStrategy',
+    'findManyPaginated / pagination mode',
+    'pagination.countSource',
+    'addModelPrefix / customUrlPrefix / specBasePath',
+    'disableOpenApi and the OpenAPI metadata options',
+    'disablePostReads',
+    'queryBuilder',
+    'guard.resolveVariant / guard.variantHeader',
+  ]),
+})
+
+/** Fill in the defaults. Absent means upstream, never an opinion. */
+export function resolveGuardPolicy(config: Partial<GuardPolicy> | undefined): GuardPolicy {
+  return {
+    requireGuardShape: config?.requireGuardShape ?? UPSTREAM_GUARD_DEFAULTS.requireGuardShape,
+    validateGuardShapes:
+      config?.validateGuardShapes ?? UPSTREAM_GUARD_DEFAULTS.validateGuardShapes,
+    requireDefaultVariantOptIn:
+      config?.requireDefaultVariantOptIn ?? UPSTREAM_GUARD_DEFAULTS.requireDefaultVariantOptIn,
+    enableUpdateEach: config?.enableUpdateEach ?? UPSTREAM_GUARD_DEFAULTS.enableUpdateEach,
+    guardResolutionOrder:
+      config?.guardResolutionOrder ?? UPSTREAM_GUARD_DEFAULTS.guardResolutionOrder,
+    allowE2EGuardBypass:
+      config?.allowE2EGuardBypass ?? UPSTREAM_GUARD_DEFAULTS.allowE2EGuardBypass,
+    validateResolvedShapes:
+      config?.validateResolvedShapes ?? UPSTREAM_GUARD_DEFAULTS.validateResolvedShapes,
+  }
+}

package/src/index.ts

@@ -1,3 +1,22 @@
+/**
+ * Public, compiled configuration metadata (M8.7).
+ *
+ * Re-exported here because `src/copy/**` is excluded from the build, so anything
+ * defined only there never reaches `dist` and cannot be imported from an
+ * installed package. See src/guardOptions.ts.
+ *
+ * Authoritative for the seven Hono guard controls only — `GUARD_METADATA_SCOPE`
+ * lists what is not described yet.
+ */
+export {
+  GUARD_OPTION_METADATA,
+  GUARD_METADATA_SCOPE,
+  UPSTREAM_GUARD_DEFAULTS,
+  HARDENED_GUARD_PROFILE,
+  resolveGuardPolicy,
+} from './guardOptions'
+export type { GuardPolicy, GuardOptionMetadata, GuardResolutionOrder } from './guardOptions'
+
 import {
   generatorHandler,
   GeneratorOptions,