🔧 fix: fix misclassification of non-object response schemas

Author: MarcelOlsen

src/index.ts

@@ -335,10 +335,39 @@ export default class Elysia<
 	}
 
 	/**
-	 * Get routes with standaloneValidator schemas merged into direct hook properties.
-	 * This is useful for plugins that need to access guard() schemas.
+	 * Get routes with guard() schemas merged into direct hook properties.
 	 *
-	 * @returns Routes with flattened schema structure
+	 * This method flattens the `standaloneValidator` array (created by `guard()` calls)
+	 * into direct hook properties (body, query, headers, params, cookie, response).
+	 * This makes it easier for plugins to access the complete validation schema for each route,
+	 * including schemas defined in parent guards.
+	 *
+	 * @example
+	 * ```ts
+	 * const app = new Elysia().guard(
+	 *   { headers: t.Object({ authorization: t.String() }) },
+	 *   (app) => app.get('/users', () => users, {
+	 *     query: t.Object({ page: t.Number() })
+	 *   })
+	 * )
+	 *
+	 * // Without flattening:
+	 * // route.hooks.standaloneValidator = [{ headers: ... }]
+	 * // route.hooks.query = { page: ... }
+	 *
+	 * // With flattening:
+	 * // route.hooks.headers = { authorization: ... }
+	 * // route.hooks.query = { page: ... }
+	 * ```
+	 *
+	 * @returns Routes with flattened schema structure where guard schemas are merged
+	 * into direct properties. Routes without guards are returned unchanged.
+	 *
+	 * @remarks
+	 * - Route-level schemas take precedence over guard schemas when merging
+	 * - String schema references (from `.model()`) are preserved as TRef nodes
+	 * - Response schemas properly handle both plain schemas and status code objects
+	 * - This is a protected method intended for plugin authors who need schema introspection
 	 */
 	protected getFlattenedRoutes(): InternalRoute[] {
 		return this.router.history.map((route) => {
@@ -452,6 +481,29 @@ export default class Elysia<
 		return t.Ref(schema)
 	}
 
+	/**
+	 * Check if a value is a TypeBox schema (vs a status code object)
+	 * Uses the TypeBox Kind symbol which all schemas have.
+	 *
+	 * This method distinguishes between:
+	 * - TypeBox schemas: Have the Kind symbol (unions, intersects, objects, etc.)
+	 * - Status code objects: Plain objects with numeric keys like { 200: schema, 404: schema }
+	 */
+	private isTSchema(value: any): value is TSchema {
+		if (!value || typeof value !== 'object') return false
+
+		// All TypeBox schemas have the Kind symbol
+		if (Kind in value) return true
+
+		// Additional check: if it's an object with only numeric keys, it's likely a status code map
+		const keys = Object.keys(value)
+		if (keys.length > 0 && keys.every(k => !isNaN(Number(k)))) {
+			return false
+		}
+
+		return false
+	}
+
 	/**
 	 * Merge two schema properties (body, query, headers, params, cookie)
 	 */
@@ -519,9 +571,10 @@ export default class Elysia<
 		if (!normalizedExisting) return incoming
 		if (!normalizedIncoming) return existing
 
-		// Check if either is a TSchema (has 'type' or '$ref' property) vs status code object
-		const existingIsSchema = 'type' in normalizedExisting || '$ref' in normalizedExisting
-		const incomingIsSchema = 'type' in normalizedIncoming || '$ref' in normalizedIncoming
+		// Check if either is a TSchema (using Kind symbol) vs status code object
+		// This correctly handles all TypeBox schemas including unions, intersects, etc.
+		const existingIsSchema = this.isTSchema(normalizedExisting)
+		const incomingIsSchema = this.isTSchema(normalizedIncoming)
 
 		// If both are plain schemas, preserve existing (route-specific schema takes precedence)
 		if (existingIsSchema && incomingIsSchema) {

test/core/flattened-routes.test.ts

@@ -271,4 +271,114 @@ describe('getFlattenedRoutes', () => {
 		expect(usersRoute?.hooks.response[401].$ref).toBe('ErrorResponse')
 		expect(usersRoute?.hooks.response[500].$ref).toBe('ErrorResponse')
 	})
+
+	it('correctly handles union response schemas from guards', () => {
+		// Regression test: unions don't have 'type' property, only 'anyOf'
+		// Previous implementation would misclassify them as status code objects
+		const app = new Elysia().guard(
+			{
+				response: t.Union([t.String(), t.Number()])
+			},
+			(app) =>
+				app.get('/data', () => 'test', {
+					response: t.Object({
+						value: t.String()
+					})
+				})
+		)
+
+		// @ts-expect-error - accessing protected method for testing
+		const flatRoutes = app.getFlattenedRoutes()
+
+		const dataRoute = flatRoutes.find((r) => r.path === '/data')
+
+		expect(dataRoute).toBeDefined()
+		expect(dataRoute?.hooks.response).toBeDefined()
+
+		// The route-level object schema should be preserved (takes precedence)
+		expect(dataRoute?.hooks.response.type).toBe('object')
+		expect(dataRoute?.hooks.response.properties).toHaveProperty('value')
+
+		// Should NOT have anyOf from the union polluting the response
+		expect(dataRoute?.hooks.response.anyOf).toBeUndefined()
+
+		// Should NOT have a synthetic status code structure
+		expect(dataRoute?.hooks.response[200]).toBeUndefined()
+	})
+
+	it('correctly handles intersect response schemas from guards', () => {
+		// Intersects use 'allOf' instead of 'type'
+		const app = new Elysia().guard(
+			{
+				response: {
+					200: t.Intersect([
+						t.Object({ id: t.String() }),
+						t.Object({ timestamp: t.Number() })
+					]),
+					404: t.Object({ error: t.String() })
+				}
+			},
+			(app) =>
+				app.get('/item', () => ({ id: '1', timestamp: 123 }), {
+					response: t.Object({
+						id: t.String(),
+						timestamp: t.Number(),
+						extra: t.String()
+					})
+				})
+		)
+
+		// @ts-expect-error - accessing protected method for testing
+		const flatRoutes = app.getFlattenedRoutes()
+
+		const itemRoute = flatRoutes.find((r) => r.path === '/item')
+
+		expect(itemRoute).toBeDefined()
+		expect(itemRoute?.hooks.response).toBeDefined()
+
+		// The 200 response should be the route-level object (takes precedence)
+		expect(itemRoute?.hooks.response[200]).toBeDefined()
+		expect(itemRoute?.hooks.response[200].type).toBe('object')
+		expect(itemRoute?.hooks.response[200].properties).toHaveProperty('extra')
+
+		// The 404 from guard should be preserved
+		expect(itemRoute?.hooks.response[404]).toBeDefined()
+		expect(itemRoute?.hooks.response[404].type).toBe('object')
+		expect(itemRoute?.hooks.response[404].properties).toHaveProperty('error')
+
+		// Should NOT have allOf polluting the status code object
+		expect(itemRoute?.hooks.response.allOf).toBeUndefined()
+	})
+
+	it('correctly handles t.Any and other schemas without type property', () => {
+		// Test other schemas that don't have 'type' property
+		const app = new Elysia().guard(
+			{
+				response: {
+					200: t.Any(),
+					500: t.Object({ error: t.String() })
+				}
+			},
+			(app) =>
+				app.get('/any', () => 'anything', {
+					response: t.String()
+				})
+		)
+
+		// @ts-expect-error - accessing protected method for testing
+		const flatRoutes = app.getFlattenedRoutes()
+
+		const anyRoute = flatRoutes.find((r) => r.path === '/any')
+
+		expect(anyRoute).toBeDefined()
+		expect(anyRoute?.hooks.response).toBeDefined()
+
+		// The 200 response should be the route-level string schema
+		expect(anyRoute?.hooks.response[200]).toBeDefined()
+		expect(anyRoute?.hooks.response[200].type).toBe('string')
+
+		// The 500 from guard should be preserved
+		expect(anyRoute?.hooks.response[500]).toBeDefined()
+		expect(anyRoute?.hooks.response[500].type).toBe('object')
+	})
 })