Boundary Serialization & Validation

Declared constraints are metadata the framework reads and enforces on the bound model before the handler body runs, so the rule lives beside the field it describes and every endpoint binding that model inherits it.

A naming strategy is the rule that converts property names in code into key names in the document, and back on read. Setting it on the shared serializer makes one decision cover every payload instead of repeating it per field.

Declare the exclusion on the model the mapper serializes: mark the field write-only or ignored on output, or better, use a response model that has no such field at all. Do not strip it per handler.

A view resolver maps a logical view name onto a concrete template, usually by adding a configured prefix and suffix and searching ordered locations; the engine then executes that template with the model as its variable scope.

A request transfer model is a type that carries only the fields a client may send. Keeping it apart from the domain object lets each shape change at its own pace and stops clients from setting internal fields.

Because the error body is a published contract, not handler detail. One converter registered on the framework's validation-failure hook gives every endpoint the same field names, codes, paths and redaction, and lets the shape change in a single place.

Validation of a bound model stops at its own fields. Reaching a nested object or a collection's elements requires declaring that the validator descends into them; a rule on the container only checks the container.

A serializer carries policy — naming, date and enum formats, null handling, unknown-key handling — plus per-type metadata caches. One registered instance settles those decisions for every endpoint; instances built per handler re-answer them from defaults and drift apart.

Fields on the model are tagged with one or more view names, and each endpoint declares which view is active; the mapper then writes only the fields carrying that tag. The server chooses the view, not the caller.

The raw marker skips the encoding the engine would apply to that one interpolated value, so the string is written as markup. The guarantee becomes yours: the value must come from your own code or a sanitizer.

Redirect after a successful write, so the browser's final URL is a safe GET and a reload repeats nothing. Render directly when the response needs state only this request holds, a rejected form's values and messages, under a 4xx status.

Over-posting is a client sending body fields the interface never offers, which the binder still assigns because they are real properties of the bound object. Nothing fails, so a caller can set internal state such as a role or a price.

A parse failure happens before any model exists, so it yields one failure at a wire position with the reader's own wording. A constraint failure happens after binding, so it yields a whole set of model paths, rule codes and parameters.

Defaults vary by serializer and version, and both representations leak code details onto the wire: an enum's declared constant name changes when someone renames it, and a numeric or zone-less timestamp drops information the reader needs.

The mapper recurses between the two sides with no base case, so the write dies on stack exhaustion or emits endlessly nested output. Cures: omit one direction, emit repeat visits as an identifier, cap depth, or serialize a tree.

Layouts compose top-down: a frame declares named holes a page fills. Partials compose bottom-up: a fragment renders inside a caller, taking either the caller's whole context or an explicit parameter list. Ambient partials cost reusability.

Name-based copying buys brevity and pays with silence: when names drift apart a field stops being copied and nothing reports it. Explicit mapping is verbose but states every assignment, so a rename surfaces as a visible change.

The engine composes a segment per step as it descends — property names, indexes for list elements, keys for keyed entries — producing paths like items[2].quantity. It misleads because those are model property names, not the names the client actually sent.

Declared constraints only run where the framework binds that model and evaluates it. Reading the raw request, building the model in code, binding a laxer second model, or mutating a field after the check all reach the write unprotected.

Settle one branch first: did that body pass through the registered serializer at all? Capture the raw bytes and content type, compare with a healthy endpoint, then look for a handler-built instance, a hand-assembled body, or a pre-encoded payload.

A stage between the handler returning and the mapper writing substitutes a wrapper object around the returned value, lifting page counts beside the items. Framework-generated errors, already-written responses, and non-model bodies bypass that stage and ship unwrapped.

Engines parse a template into an executable form once and cache it by resolved name for the process lifetime. Development configurations re-check the source or disable the cache; production keeps the compiled form until the process restarts.

A deny-list makes every field bindable by default, so each new domain field ships exposed until someone remembers to extend it. Replace it with an allow-list, ideally a transfer model, so new fields stay unbindable until deliberately added.

Decide by who owns the wording and who ships to change it. Codes with parameters suit clients writing their own copy or branching on failures; rendered text suits consumers without translation. Most publish both, code as contract.

Declare at the boundary what can be decided from the payload alone — presence, type-level shape, range, cardinality, cross-field agreement. Rules needing stored state, a lookup, or transactional certainty belong with the operation that can decide them atomically.

Make the boundary allow-listed by construction: endpoints serialize output types that carry only publishable fields, shaping lives in one stage, and a build check diffs every endpoint's produced key set so a new key fails CI instead of waiting for a reviewer.

Duplication buys a stable wire contract and an explicit write set; it stops paying when one consumer redeploys with the server and no field is privileged. Govern it per surface, enforcing the write-side boundary mechanically rather than per developer.

Writing works because the runtime type is in hand. Reading does not: only the declared type is known, so the document must carry a discriminator value that a configured registry maps to exactly one permitted concrete type.