@palbase/backend 23.0.0 → 24.0.0

package/dist/openapi/index.d.cts

@@ -1,7 +1,7 @@
 import { OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
 import { ZodTypeAny } from 'zod';
-import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-i8TTCohk.cjs';
-import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig } from '../registry-C3H2uPeZ.cjs';
+import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-CcQ1a36a.cjs';
+import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-1X-skBNu.cjs';
 import '../stack.cjs';
 
 /** A controller class (constructor). Kept loose — the only contract is that it
@@ -39,7 +39,8 @@ interface FlatRoute {
      * (MembersController → "members"). "" when the derivation is empty — the
      * operationId then falls back to the flat verb-prefixed form. */
     controllerName: string;
-    /** Resolved auth: route option ?? controller default ?? true (secure). */
+    /** Resolved auth: route option ?? controller default ?? application default
+     * ?? true (secure) — the cascade lives in `resolveEffectiveAuth`. */
     effectiveAuth: AuthSpec;
     /** All parameter metas for this route (ordered by index). */
     params: ParamMeta[];
@@ -58,6 +59,9 @@ interface FlatRoute {
      * presence MARKS this as an upload route through openapi + codegen (the bytes
      * go client→storage; the method body is the completion handler). */
     uploadConfig?: UploadConfig;
+    /** Present ONLY on `@Sse` routes — the marker the converter turns into
+     * `x-palbase-sse`. */
+    sseConfig?: SseConfig;
 }
 /**
  * Flatten a `@Controller` class into its route entries. The full path is
@@ -65,7 +69,8 @@ interface FlatRoute {
  * `<controllerName>.<fnName>` id (PlacesController.importNearby →
  * places.importNearby) — matching the Go runtime (extract_meta.js derives the
  * namespace from the class name; generator.go joins). Effective auth resolves
- * the cascade (route ?? controller default ?? secure-by-default).
+ * the cascade (route ?? controller default ?? application default ??
+ * secure-by-default) through the one resolver the route table asks too.
  */
 declare function flattenController(controller: ControllerClass): FlatRoute[];
 /** The operationId for a route — exposed so callers (convert/aggregate)

package/dist/openapi/index.d.ts

@@ -1,7 +1,7 @@
 import { OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
 import { ZodTypeAny } from 'zod';
-import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-BavvbW4P.js';
-import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig } from '../registry-DY3d9l1k.js';
+import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-0_DGBajf.js';
+import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-CEod_5sz.js';
 import '../stack.js';
 
 /** A controller class (constructor). Kept loose — the only contract is that it
@@ -39,7 +39,8 @@ interface FlatRoute {
      * (MembersController → "members"). "" when the derivation is empty — the
      * operationId then falls back to the flat verb-prefixed form. */
     controllerName: string;
-    /** Resolved auth: route option ?? controller default ?? true (secure). */
+    /** Resolved auth: route option ?? controller default ?? application default
+     * ?? true (secure) — the cascade lives in `resolveEffectiveAuth`. */
     effectiveAuth: AuthSpec;
     /** All parameter metas for this route (ordered by index). */
     params: ParamMeta[];
@@ -58,6 +59,9 @@ interface FlatRoute {
      * presence MARKS this as an upload route through openapi + codegen (the bytes
      * go client→storage; the method body is the completion handler). */
     uploadConfig?: UploadConfig;
+    /** Present ONLY on `@Sse` routes — the marker the converter turns into
+     * `x-palbase-sse`. */
+    sseConfig?: SseConfig;
 }
 /**
  * Flatten a `@Controller` class into its route entries. The full path is
@@ -65,7 +69,8 @@ interface FlatRoute {
  * `<controllerName>.<fnName>` id (PlacesController.importNearby →
  * places.importNearby) — matching the Go runtime (extract_meta.js derives the
  * namespace from the class name; generator.go joins). Effective auth resolves
- * the cascade (route ?? controller default ?? secure-by-default).
+ * the cascade (route ?? controller default ?? application default ??
+ * secure-by-default) through the one resolver the route table asks too.
  */
 declare function flattenController(controller: ControllerClass): FlatRoute[];
 /** The operationId for a route — exposed so callers (convert/aggregate)

package/dist/openapi/index.js

@@ -1,13 +1,12 @@
 import {
   getErrorRegistry
-} from "../chunk-ZC6Q2BRD.js";
+} from "../chunk-T5IOSOE5.js";
 import {
+  getRoutes,
   isController,
-  resolveController
-} from "../chunk-Y5HXVUMP.js";
-import {
-  getRoutes
-} from "../chunk-OMRTHM4X.js";
+  resolveController,
+  resolveEffectiveAuth
+} from "../chunk-H3JAISUY.js";
 import {
   __commonJS,
   __require,
@@ -5836,10 +5835,24 @@ function flattenController(controller) {
   const meta = resolveController(controller);
   const controllerName = deriveControllerName(controller.name);
   const routes = getRoutes(controller);
+  const kindsByMethod = /* @__PURE__ */ new Map();
+  for (const route of routes) {
+    const seen = kindsByMethod.get(route.fnName) ?? { sse: false, upload: false };
+    if (route.options.sseConfig !== void 0) seen.sse = true;
+    if (route.options.uploadConfig !== void 0) seen.upload = true;
+    kindsByMethod.set(route.fnName, seen);
+  }
+  for (const [fnName, seen] of kindsByMethod) {
+    if (seen.sse && seen.upload) {
+      throw new Error(
+        `${controller.name}.${fnName} declares BOTH @Sse and @Upload. One method cannot be both a streaming response and an upload completion handler \u2014 the two describe the same handler twice and the second one read silently wins. Split them into two methods.`
+      );
+    }
+  }
   const out = [];
   for (const route of routes) {
     const fullPath = joinControllerPath(meta.basePath, route.subpath);
-    const effectiveAuth = route.options.auth ?? meta.defaultAuth ?? true;
+    const effectiveAuth = resolveEffectiveAuth(route.options.auth, meta.defaultAuth);
     const inputSchemas = {};
     const pathParams = [];
     for (const p of route.params) {
@@ -5876,7 +5889,8 @@ function flattenController(controller) {
       ...route.returnSchema !== void 0 ? { returnSchema: route.returnSchema } : {},
       ...route.options.rateLimit !== void 0 ? { rateLimit: route.options.rateLimit } : {},
       ...allThrows.length > 0 ? { throws: allThrows } : {},
-      ...route.options.uploadConfig !== void 0 ? { uploadConfig: route.options.uploadConfig } : {}
+      ...route.options.uploadConfig !== void 0 ? { uploadConfig: route.options.uploadConfig } : {},
+      ...route.options.sseConfig !== void 0 ? { sseConfig: route.options.sseConfig } : {}
     });
   }
   return out;
@@ -5974,7 +5988,8 @@ function registerControllerRoute(registry, route) {
     returnSchema: route.returnSchema,
     effectiveAuth: route.effectiveAuth,
     throws: route.throws,
-    ...route.uploadConfig !== void 0 ? { uploadConfig: route.uploadConfig } : {}
+    ...route.uploadConfig !== void 0 ? { uploadConfig: route.uploadConfig } : {},
+    ...route.sseConfig !== void 0 ? { sseConfig: route.sseConfig } : {}
   });
 }
 function registerOperation(registry, op) {
@@ -5995,7 +6010,11 @@ function registerOperation(registry, op) {
       description: "Success",
       content: {
         "application/json": {
-          schema: op.returnSchema !== void 0 ? op.returnSchema : z.unknown()
+          // A streaming operation's response is ONE FRAME, and its schema is the
+          // declared frame — not the handler's return type, which is void. Without
+          // this the document describes an untyped response and every generated
+          // client is opaque (measured live: the contract gate refuses the deploy).
+          schema: op.sseConfig !== void 0 ? op.sseConfig.frame : op.returnSchema !== void 0 ? op.returnSchema : z.unknown()
         }
       }
     },
@@ -6042,7 +6061,12 @@ function registerOperation(registry, op) {
         bucket: op.uploadConfig.bucket,
         pathTemplate: op.uploadConfig.pathTemplate
       }
-    } : {}
+    } : {},
+    // Without this extension the document describes a streaming route as a
+    // plain POST, and every client generated from it reads the body ONCE
+    // instead of iterating frames — a generated client that compiles, runs and
+    // is simply wrong. Same failure class as the upload extension above.
+    ...op.sseConfig !== void 0 ? { "x-palbase-sse": {} } : {}
   });
 }
 function resolveThrows(throws) {