@palbase/backend 34.1.0 → 35.0.0

package/dist/openapi/index.d.cts

@@ -1,7 +1,7 @@
 import { OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
 import { ZodTypeAny } from 'zod';
-import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-DqhUP7RT.cjs';
-import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-BkIVHPzB.cjs';
+import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-DaGnjt42.cjs';
+import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-BnKvIyve.cjs';
 import '../stack.cjs';
 import '../db/env.cjs';
 import 'node:async_hooks';

package/dist/openapi/index.d.ts

@@ -1,7 +1,7 @@
 import { OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
 import { ZodTypeAny } from 'zod';
-import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-BXPdsTA5.js';
-import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-CvGLR5j1.js';
+import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-BI0yGuEL.js';
+import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-zDCj0eOU.js';
 import '../stack.js';
 import '../db/env.js';
 import 'node:async_hooks';

package/dist/{registry-BkIVHPzB.d.cts → registry-BnKvIyve.d.cts}

@@ -1,4 +1,4 @@
-import { D as DatabaseBudget, A as AuthSpec, R as RateLimitConfig } from './endpoint-DqhUP7RT.cjs';
+import { D as DatabaseBudget, A as AuthSpec, R as RateLimitConfig } from './endpoint-DaGnjt42.cjs';
 import { ZodTypeAny } from 'zod';
 import { PalbaseBucketName } from './stack.cjs';
 

package/dist/{registry-CvGLR5j1.d.ts → registry-zDCj0eOU.d.ts}

@@ -1,4 +1,4 @@
-import { D as DatabaseBudget, A as AuthSpec, R as RateLimitConfig } from './endpoint-BXPdsTA5.js';
+import { D as DatabaseBudget, A as AuthSpec, R as RateLimitConfig } from './endpoint-BI0yGuEL.js';
 import { ZodTypeAny } from 'zod';
 import { PalbaseBucketName } from './stack.js';
 

package/dist/test/index.d.cts

@@ -1,5 +1,5 @@
 import { T as Token } from '../module-Dl1KFVtc.cjs';
-import { E as EnvServiceDatabase, a as DBClient, b as RuntimeServices } from '../endpoint-DqhUP7RT.cjs';
+import { E as EnvServiceDatabase, a as DBClient, b as RuntimeServices } from '../endpoint-DaGnjt42.cjs';
 import 'zod';
 import '../stack.cjs';
 import '../db/env.cjs';

package/dist/test/index.d.ts

@@ -1,5 +1,5 @@
 import { T as Token } from '../module-Dl1KFVtc.js';
-import { E as EnvServiceDatabase, a as DBClient, b as RuntimeServices } from '../endpoint-BXPdsTA5.js';
+import { E as EnvServiceDatabase, a as DBClient, b as RuntimeServices } from '../endpoint-BI0yGuEL.js';
 import 'zod';
 import '../stack.js';
 import '../db/env.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@palbase/backend",
-  "version": "34.1.0",
+  "version": "35.0.0",
   "description": "Palbase Backend SDK — class controllers (@Controller/@Get/@Post + @Body/@QueryParams/@Param), error classes, schema DSL",
   "license": "MIT",
   "repository": {
@@ -94,24 +94,12 @@
     "stager",
     "template"
   ],
-  "scripts": {
-    "build": "tsup && npm run build:stager",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "typecheck": "tsc --noEmit",
-    "docs:build": "node scripts/build-llms.mjs",
-    "emit:openapi-fixture": "tsx scripts/emit-openapi-fixture.mjs",
-    "check:api": "node scripts/api-surface.mjs",
-    "api:update": "node scripts/api-surface.mjs --update",
-    "build:stager": "mkdir -p stager && for f in src/stager/*.js; do case \"$f\" in *.test.js) ;; *) cp \"$f\" stager/ ;; esac; done && cp src/stager/package.json stager/"
-  },
   "dependencies": {
     "@asteasolutions/zod-to-openapi": "^7.3.4",
     "reflect-metadata": "^0.2.2",
     "zod": "^3.24.0"
   },
   "devDependencies": {
-    "@palbase/core": "workspace:^",
     "@swc/core": "^1.16.1",
     "@types/node": "^25.5.2",
     "bun-types": "^1.4.0",
@@ -121,12 +109,24 @@
     "tsx": "^4.22.4",
     "typescript": "^5.7.0",
     "unplugin-swc": "^1.5.11",
-    "vitest": "^3.0.0"
+    "vitest": "^3.0.0",
+    "@palbase/core": "^2.4.0"
   },
   "publishConfig": {
     "access": "public"
   },
   "bin": {
     "palbase-backend": "./dist/bin/palbase-backend.js"
+  },
+  "scripts": {
+    "build": "tsup && npm run build:stager",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "docs:build": "node scripts/build-llms.mjs",
+    "emit:openapi-fixture": "tsx scripts/emit-openapi-fixture.mjs",
+    "check:api": "node scripts/api-surface.mjs",
+    "api:update": "node scripts/api-surface.mjs --update",
+    "build:stager": "mkdir -p stager && for f in src/stager/*.js; do case \"$f\" in *.test.js) ;; *) cp \"$f\" stager/ ;; esac; done && cp src/stager/package.json stager/"
   }
-}
+}

package/stager/generics.js

@@ -163,6 +163,12 @@ const SKIP = new Set([
   '.palbase',
   '.palbase-staged-controllers',
   '.palbase-build-controllers',
+  // An iOS app's build output beside the backend (stage.js SKIP, same list):
+  // not source, large, and Xcode writes symlinks into it.
+  'DerivedData',
+  '.build',
+  'Pods',
+  'xcuserdata',
 ]);
 
 function sources(dir, root, out) {
@@ -173,12 +179,14 @@ function sources(dir, root, out) {
     return out;
   }
   for (const entry of entries) {
-    if (entry.name.startsWith('.') && entry.name !== '.') {
-      if (SKIP.has(entry.name)) continue;
-    }
+    if (SKIP.has(entry.name)) continue;
+    // Symlinks are skipped here for the same reason stage.js skips them: this
+    // walk runs BEFORE staging, on the whole project root, and a dangling link
+    // whose name ends in `.ts` used to refuse the entire push with ENOENT one
+    // function before the stager's own guard could (W4 r2 C-2).
+    if (entry.isSymbolicLink()) continue;
     const full = path.join(dir, entry.name);
     if (entry.isDirectory()) {
-      if (SKIP.has(entry.name)) continue;
       sources(full, root, out);
     } else if (/\.(c?ts|tsx)$/i.test(entry.name) && !/\.d\.ts$/i.test(entry.name)) {
       out.push(full);

package/stager/stage.js

@@ -36,9 +36,23 @@ const throwAnalysis = require("./throw_analysis.js");
  * resolves from above the staged tree anyway, and `.palbase*` holds build output
  * including previous staging runs.
  */
-const SKIP = new Set(["node_modules", "dist", "build", ".git", ".palbase"]);
+//
+// The last four are an iOS app's build output, which lives BESIDE the backend
+// in a project that ships both (the 2026-09-06 demo did). None of it is source
+// the stager could type, all of it is large, and Xcode writes symlinks into it.
+const SKIP = new Set([
+  "node_modules",
+  "dist",
+  "build",
+  ".git",
+  ".palbase",
+  "DerivedData",
+  ".build",
+  "Pods",
+  "xcuserdata",
+]);
 
-function walk(dir) {
+function walk(dir, root = dir) {
   const out = [];
   for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
     // Skipped by NAME, not by type: `node_modules` is often a SYMLINK (pnpm, and
@@ -46,8 +60,29 @@ function walk(dir) {
     // for one — so a type-gated check walked straight into it and tried to
     // `copyFileSync` a symlinked directory. Measured: ENOTSUP, copyfile.
     if (SKIP.has(entry.name) || entry.name.startsWith(".palbase")) continue;
+    // And every OTHER symlink is skipped by TYPE. A staged copy is a copy of
+    // the project's source; a link is a pointer to something that is either
+    // already in the tree (staged once under its real name), outside it (not
+    // this project's source), or gone. `copyFileSync` on one is ENOENT when the
+    // target is missing and ENOTSUP on a bind mount — measured 2026-09-06 on a
+    // demo whose `ios/DerivedData/Framework/Resources` was a dangling link, and
+    // that one link refused the whole push.
     const full = path.join(dir, entry.name);
-    if (entry.isDirectory()) out.push(...walk(full));
+    if (entry.isSymbolicLink()) {
+      // Said once, with the path from the project root, so a `TS2307 Cannot
+      // find module` in the staged copy has its explanation next to it: a
+      // project that symlinks a shared source directory stages a tree without
+      // it (the declared FR-037 trade-off).
+      let target = '';
+      try {
+        target = fs.readlinkSync(full);
+      } catch {
+        /* unreadable link: nothing to name */
+      }
+      process.stderr.write(`stager: skipped symlink ${path.relative(root, full)} -> ${target}\n`);
+      continue;
+    }
+    if (entry.isDirectory()) out.push(...walk(full, root));
     else out.push(full);
   }
   return out;