@palbase/backend 12.0.0 → 13.0.0

package/dist/index.cjs

@@ -1249,7 +1249,13 @@ function baseTsType(def) {
       return "string";
     case "integer":
       return "number";
+    // Both are exact-precision in Postgres and lossy as a JSON number, so the
+    // database proxy serializes them as strings — measured: 9007199254740993
+    // used to arrive as ...992 and 41.00821234567890123 as 41.0082123456789.
+    // numeric had no case at all and fell through to `unknown`, which typed
+    // every numeric column out of existence.
     case "bigint":
+    case "numeric":
       return "string";
     case "boolean":
       return "boolean";
@@ -1768,38 +1774,6 @@ function defineFlags(input) {
   return { __config: FLAGS_CONFIG_KIND, flags };
 }
 
-// src/decorators/controller.ts
-var CONTROLLER_META = /* @__PURE__ */ Symbol.for("palbase.backend.controllerMeta");
-function Controller(basePath, options = {}) {
-  return function(ctor) {
-    const normalized = basePath.replace(/\/+$/, "");
-    if (normalized === "/webhooks" || normalized.startsWith("/webhooks/")) {
-      throw new Error(
-        `@Controller("${basePath}") uses the reserved /webhooks path \u2014 inbound webhooks are served there`
-      );
-    }
-    const carrier = ctor;
-    const meta = {
-      __palbase: "controller",
-      basePath,
-      ...options.auth !== void 0 ? { defaultAuth: options.auth } : {}
-    };
-    Object.defineProperty(carrier, CONTROLLER_META, {
-      value: meta,
-      enumerable: false,
-      configurable: true,
-      writable: false
-    });
-    Object.defineProperty(carrier, "__palbase", {
-      value: "controller",
-      enumerable: false,
-      configurable: true,
-      writable: false
-    });
-    return ctor;
-  };
-}
-
 // src/decorators/registry.ts
 var ROUTES = /* @__PURE__ */ Symbol.for("palbase.backend.routes");
 var PARAM_BUFFER = /* @__PURE__ */ Symbol.for("palbase.backend.paramBuffer");
@@ -1892,6 +1866,48 @@ function getRoutes(ctor) {
   }));
 }
 
+// src/decorators/controller.ts
+var CONTROLLER_META = /* @__PURE__ */ Symbol.for("palbase.backend.controllerMeta");
+var RESERVED_FIRST_SEGMENT = "webhooks";
+function assertNotReserved(path, subject) {
+  const [first] = path.split("/").filter(Boolean);
+  if (first === RESERVED_FIRST_SEGMENT) {
+    throw new Error(
+      `${subject} resolves under the reserved /${RESERVED_FIRST_SEGMENT} path \u2014 inbound webhooks are served there and would shadow this route`
+    );
+  }
+}
+function Controller(basePath, options = {}) {
+  return function(ctor) {
+    assertNotReserved(basePath, `@Controller("${basePath}")`);
+    for (const route of getRoutes(ctor)) {
+      assertNotReserved(
+        `${basePath}${route.subpath}`,
+        `@${route.method}("${route.subpath}") in @Controller("${basePath}")`
+      );
+    }
+    const carrier = ctor;
+    const meta = {
+      __palbase: "controller",
+      basePath,
+      ...options.auth !== void 0 ? { defaultAuth: options.auth } : {}
+    };
+    Object.defineProperty(carrier, CONTROLLER_META, {
+      value: meta,
+      enumerable: false,
+      configurable: true,
+      writable: false
+    });
+    Object.defineProperty(carrier, "__palbase", {
+      value: "controller",
+      enumerable: false,
+      configurable: true,
+      writable: false
+    });
+    return ctor;
+  };
+}
+
 // src/decorators/methods.ts
 function makeMethodDecorator(method) {
   return function(subpath, options = {}) {
@@ -2217,6 +2233,29 @@ function getWebhookConfig(ctor) {
       "@Webhook requires either a `provider` preset or an explicit `signature` \u2014 an endpoint with no verification would accept forged deliveries"
     );
   }
+  if (meta.provider && meta.signature) {
+    throw new Error(
+      "@Webhook declares BOTH a `provider` preset and an explicit `signature` \u2014 these are alternatives; keep the one that describes the sender, because only `provider` would be used"
+    );
+  }
+  if (meta.signature) {
+    const sig = meta.signature;
+    if (!sig.header) {
+      throw new Error("@Webhook signature requires `header` \u2014 the header the signature arrives in");
+    }
+    if (sig.algo !== "hmac-sha256" && sig.algo !== "hmac-sha1") {
+      throw new Error(`@Webhook signature has an unsupported algo "${sig.algo}"`);
+    }
+    if (sig.encoding !== "hex" && sig.encoding !== "base64") {
+      throw new Error(`@Webhook signature has an unsupported encoding "${sig.encoding}"`);
+    }
+    if (!sig.signs?.includes("{body}")) {
+      throw new Error("@Webhook signature `signs` must contain {body} \u2014 signing a constant is not a signature");
+    }
+    if (sig.signs.includes("{ts}") && !sig.timestampHeader) {
+      throw new Error("@Webhook signature uses {ts} but declares no `timestampHeader` to read it from");
+    }
+  }
   if (!meta.secret?.env) {
     throw new Error('@Webhook requires `secret: { env: "VAR_NAME" }`');
   }