@rvoh/psychic 3.8.5 → 3.9.0

package/dist/cjs/src/bin/helpers/OpenApiSpecDiff.js

@@ -189,6 +189,10 @@ export class OpenApiSpecDiff {
     }
     /**
      * Retrieves head branch content for a file
+     *
+     * Marked `protected` so tests can supply a deterministic baseline instead of
+     * the live head branch. Production code never overrides this.
+     *
      * @param absoluteFilePath - Absolute path to the file
      */
     getHeadBranchContent(absoluteFilePath) {

package/dist/cjs/src/openapi-renderer/app.js

@@ -7,6 +7,7 @@ import PsychicApp from '../psychic-app/index.js';
 import { HttpMethods } from '../router/types.js';
 import { DEFAULT_OPENAPI_COMPONENT_RESPONSES, DEFAULT_OPENAPI_COMPONENT_SCHEMAS } from './defaults.js';
 import { MissingControllerActionPairingInRoutes, } from './endpoint.js';
+import legacyImplicitRequestBodyParamsConfig from './helpers/legacyImplicitRequestBodyParamsConfig.js';
 import suppressResponseEnumsConfig from './helpers/suppressResponseEnumsConfig.js';
 const debugEnabled = debuglog('psychic').enabled;
 export default class OpenapiAppRenderer {
@@ -47,6 +48,7 @@ export default class OpenapiAppRenderer {
         const renderOpts = {
             casing: 'camel',
             suppressResponseEnums: suppressResponseEnumsConfig(openapiName),
+            legacyImplicitRequestBodyParams: legacyImplicitRequestBodyParamsConfig(openapiName),
         };
         const alreadyExtractedDescendantSerializers = {};
         const renderedSchemasOpenapi = {};

package/dist/cjs/src/openapi-renderer/body-segment.js

@@ -8,6 +8,7 @@ import isBlankDescription from './helpers/isBlankDescription.js';
 import maybeNullOpenapiShorthandToOpenapiShorthand from './helpers/maybeNullOpenapiShorthandToOpenapiShorthand.js';
 import primitiveOpenapiStatementToOpenapi from './helpers/primitiveOpenapiStatementToOpenapi.js';
 import schemaToRef from './helpers/schemaToRef.js';
+import serializersAndRefsFromSerializableRef from './helpers/serializersAndRefsFromSerializableRef.js';
 import SerializerOpenapiRenderer from './SerializerOpenapiRenderer.js';
 /**
  * @internal
@@ -53,6 +54,7 @@ export default class OpenapiSegmentExpander {
     bodySegment;
     casing;
     suppressResponseEnums;
+    legacyImplicitRequestBodyParams;
     target;
     source;
     /**
@@ -65,6 +67,7 @@ export default class OpenapiSegmentExpander {
         this.bodySegment = bodySegment;
         this.casing = renderOpts.casing;
         this.suppressResponseEnums = renderOpts.suppressResponseEnums;
+        this.legacyImplicitRequestBodyParams = renderOpts.legacyImplicitRequestBodyParams;
         this.target = target;
         this.source = source ?? 'unknown';
     }
@@ -488,19 +491,42 @@ The following values will be allowed:
             including: ref.including,
             required: ref.required,
             combining: ref.combining,
+            legacyImplicitRequestBodyParams: this.legacyImplicitRequestBodyParams,
         }, this.source);
         return this.recursivelyParseBody(paramsShape);
     }
     serializableStatement(bodySegment) {
         const serializableRef = bodySegment;
         const key = serializableRef.$serializableSerializerKey || serializableRef.key || 'default';
-        const serializer = DreamApp.system.inferSerializerFromDreamOrViewModel(serializableRef.$serializable.prototype, key);
-        if (!serializer)
-            throw new Error(`Failed to locate serializers getter from: ${serializableRef.$serializable.name} using key: ${key}`);
-        return this.serializerStatement({
-            $serializer: serializer,
-            ...serializableRef,
+        const { serializers, refs } = serializersAndRefsFromSerializableRef(serializableRef, {
+            casing: this.casing,
+            suppressResponseEnums: this.suppressResponseEnums,
         });
+        if (serializers.length === 0)
+            throw new Error(`Failed to locate serializers getter from: ${serializableRef.$serializable.name} using key: ${key}`);
+        if (serializers.length === 1) {
+            return this.serializerStatement({
+                $serializer: serializers[0],
+                ...serializableRef,
+            });
+        }
+        const serializerAnyOf = { anyOf: refs };
+        if (serializableRef.many) {
+            return {
+                referencedSerializers: serializers,
+                openapi: {
+                    type: serializableRef.maybeNull ? ['array', 'null'] : 'array',
+                    items: serializerAnyOf,
+                },
+            };
+        }
+        if (serializableRef.maybeNull) {
+            return {
+                referencedSerializers: serializers,
+                openapi: { anyOf: [...refs, { type: 'null' }] },
+            };
+        }
+        return { referencedSerializers: serializers, openapi: serializerAnyOf };
     }
     /**
      * @internal

package/dist/cjs/src/openapi-renderer/endpoint.js

@@ -529,7 +529,17 @@ export default class OpenapiEndpointRenderer {
             including: including,
             required: required,
             combining: combining,
+            legacyImplicitRequestBodyParams: renderOpts.legacyImplicitRequestBodyParams,
         }, source);
+        // When the model-derived shape contributes no properties and no `required`
+        // (e.g. the new none-default with no `params`/`only`/`combining`), there is
+        // nothing meaningful to advertise. Fall back to `defaultRequestBody()`, which
+        // omits the body entirely unless body-level pagination params are present.
+        const shapeProperties = paramsShape.properties;
+        const shapeRequired = paramsShape.required;
+        if (Object.keys(shapeProperties ?? {}).length === 0 && !shapeRequired) {
+            return this.defaultRequestBody();
+        }
         let processedSchema = new OpenapiSegmentExpander(paramsShape, {
             renderOpts,
             target: 'request',

package/dist/cjs/src/openapi-renderer/helpers/OpenapiPayloadValidator.js

@@ -2,6 +2,7 @@ import OpenapiRequestValidationFailure from '../../error/openapi/OpenapiRequestV
 import OpenapiResponseValidationFailure from '../../error/openapi/OpenapResponseValidationFailure.js';
 import { createValidator, formatAjvErrors, } from '../../helpers/validateOpenApiSchema.js';
 import PsychicApp from '../../psychic-app/index.js';
+import legacyImplicitRequestBodyParamsConfig from './legacyImplicitRequestBodyParamsConfig.js';
 import suppressResponseEnumsConfig from './suppressResponseEnumsConfig.js';
 import { cacheValidator, getCachedValidator } from './validator-cache.js';
 /**
@@ -207,6 +208,7 @@ export default class OpenapiPayloadValidator {
         return {
             casing: 'camel',
             suppressResponseEnums: suppressResponseEnumsConfig(this.openapiName),
+            legacyImplicitRequestBodyParams: legacyImplicitRequestBodyParamsConfig(this.openapiName),
         };
     }
     /**

package/dist/cjs/src/openapi-renderer/helpers/allSerializersFromHandWrittenOpenapi.js

@@ -1,5 +1,5 @@
-import { DreamApp } from '@rvoh/dream';
 import isObject from '../../helpers/isObject.js';
+import serializersAndRefsFromSerializableRef from './serializersAndRefsFromSerializableRef.js';
 /**
  * @internal
  *
@@ -54,8 +54,7 @@ value, serializers) {
         //
     }
     else if (value.$serializable) {
-        const foundSerializers = DreamApp.system.inferSerializersFromDreamClassOrViewModelClass(value.$serializable, value.$serializableSerializerKey);
-        foundSerializers.forEach(serializer => serializers.add(serializer));
+        serializersAndRefsFromSerializableRef(value).serializers.forEach(serializer => serializers.add(serializer));
         //
     }
     else if (isObject(value)) {

package/dist/cjs/src/openapi-renderer/helpers/allSerializersToRefsInOpenapi.js

@@ -1,10 +1,6 @@
-/* eslint-disable @typescript-eslint/no-unsafe-return */
-/* eslint-disable @typescript-eslint/no-unsafe-argument */
-/* eslint-disable @typescript-eslint/no-unsafe-assignment */
-/* eslint-disable @typescript-eslint/no-unsafe-member-access */
-import { DreamApp } from '@rvoh/dream';
 import isObject from '../../helpers/isObject.js';
 import SerializerOpenapiRenderer from '../SerializerOpenapiRenderer.js';
+import serializersAndRefsFromSerializableRef from './serializersAndRefsFromSerializableRef.js';
 /**
  * @internal
  *
@@ -69,9 +65,8 @@ function transformValue(value) {
         //
     }
     else if (value.$serializable) {
-        const { $serializable, $serializableSerializerKey, ...rest } = value;
-        const foundSerializers = DreamApp.system.inferSerializersFromDreamClassOrViewModelClass($serializable, $serializableSerializerKey);
-        const refs = foundSerializers.map(serializer => new SerializerOpenapiRenderer(serializer).serializerRef);
+        const { $serializable, $serializableSerializerKey, key, ...rest } = value;
+        const { refs } = serializersAndRefsFromSerializableRef({ $serializable, $serializableSerializerKey, key });
         if (refs.length === 0)
             return rest;
         if (refs.length === 1) {

package/dist/cjs/src/openapi-renderer/helpers/buildDreamRequestBodyShape.js

@@ -11,9 +11,15 @@ import { dreamColumnOpenapiShape } from './dreamColumnOpenapiShape.js';
  * truth keeps top-level and nested semantics identical.
  */
 export default function buildDreamRequestBodyShape(dreamClass, opts, source) {
-    const { params, only, including, required, combining } = opts;
+    const { params, only, including, required, combining, legacyImplicitRequestBodyParams } = opts;
+    // When neither `params` nor `only` is provided, the default is to resolve to
+    // NO model columns (an empty allowlist), rather than implicitly exposing every
+    // param-safe column. The legacy implicit-all behavior can be re-activated via
+    // the `legacyImplicitRequestBodyParams` opt-in.
+    const resolvedOnly = params ?? only;
+    const onlyForResolution = resolvedOnly === undefined && !legacyImplicitRequestBodyParams ? [] : resolvedOnly;
     const paramSafeColumns = openapiParamNamesForDreamClass(dreamClass, {
-        only: params ?? only,
+        only: onlyForResolution,
         including,
     });
     const paramsShape = {

package/dist/cjs/src/openapi-renderer/helpers/dreamColumnOpenapiShape.js

@@ -18,6 +18,7 @@ source, dreamClass, column, openapi = undefined, { suppressResponseEnums = false
                     renderOpts: {
                         casing: 'camel',
                         suppressResponseEnums: false,
+                        legacyImplicitRequestBodyParams: false,
                     },
                     target: 'request',
                 }).render().openapi,

package/dist/cjs/src/openapi-renderer/helpers/legacyImplicitRequestBodyParamsConfig.js

@@ -0,0 +1,9 @@
+import openapiOpts from './openapiOpts.js';
+/**
+ * returns whether the named openapi config opts in to the legacy behavior of
+ * implicitly exposing all param-safe columns when a model-derived request body
+ * is given no `params`/`only`.
+ */
+export default function legacyImplicitRequestBodyParamsConfig(openapiName) {
+    return !!openapiOpts(openapiName)?.legacyImplicitRequestBodyParams;
+}

package/dist/cjs/src/openapi-renderer/helpers/serializersAndRefsFromSerializableRef.js

@@ -0,0 +1,17 @@
+import { DreamApp } from '@rvoh/dream';
+import { sortBy, uniq } from '@rvoh/dream/utils';
+import SerializerOpenapiRenderer from '../SerializerOpenapiRenderer.js';
+export default function serializersAndRefsFromSerializableRef(serializableRef, { casing = 'camel', suppressResponseEnums = false, } = {}) {
+    const key = serializableRef.$serializableSerializerKey || serializableRef.key || 'default';
+    const serializerRefs = sortBy(uniq(DreamApp.system.inferSerializersFromDreamClassOrViewModelClass(serializableRef.$serializable, key)).map(serializer => ({
+        serializer,
+        ref: new SerializerOpenapiRenderer(serializer, {
+            casing,
+            suppressResponseEnums,
+        }).serializerRef,
+    })), ({ ref }) => ref.$ref);
+    return {
+        serializers: serializerRefs.map(({ serializer }) => serializer),
+        refs: serializerRefs.map(({ ref }) => ref),
+    };
+}

package/dist/esm/src/bin/helpers/OpenApiSpecDiff.js

@@ -189,6 +189,10 @@ export class OpenApiSpecDiff {
     }
     /**
      * Retrieves head branch content for a file
+     *
+     * Marked `protected` so tests can supply a deterministic baseline instead of
+     * the live head branch. Production code never overrides this.
+     *
      * @param absoluteFilePath - Absolute path to the file
      */
     getHeadBranchContent(absoluteFilePath) {

package/dist/esm/src/openapi-renderer/app.js

@@ -7,6 +7,7 @@ import PsychicApp from '../psychic-app/index.js';
 import { HttpMethods } from '../router/types.js';
 import { DEFAULT_OPENAPI_COMPONENT_RESPONSES, DEFAULT_OPENAPI_COMPONENT_SCHEMAS } from './defaults.js';
 import { MissingControllerActionPairingInRoutes, } from './endpoint.js';
+import legacyImplicitRequestBodyParamsConfig from './helpers/legacyImplicitRequestBodyParamsConfig.js';
 import suppressResponseEnumsConfig from './helpers/suppressResponseEnumsConfig.js';
 const debugEnabled = debuglog('psychic').enabled;
 export default class OpenapiAppRenderer {
@@ -47,6 +48,7 @@ export default class OpenapiAppRenderer {
         const renderOpts = {
             casing: 'camel',
             suppressResponseEnums: suppressResponseEnumsConfig(openapiName),
+            legacyImplicitRequestBodyParams: legacyImplicitRequestBodyParamsConfig(openapiName),
         };
         const alreadyExtractedDescendantSerializers = {};
         const renderedSchemasOpenapi = {};

package/dist/esm/src/openapi-renderer/body-segment.js

@@ -8,6 +8,7 @@ import isBlankDescription from './helpers/isBlankDescription.js';
 import maybeNullOpenapiShorthandToOpenapiShorthand from './helpers/maybeNullOpenapiShorthandToOpenapiShorthand.js';
 import primitiveOpenapiStatementToOpenapi from './helpers/primitiveOpenapiStatementToOpenapi.js';
 import schemaToRef from './helpers/schemaToRef.js';
+import serializersAndRefsFromSerializableRef from './helpers/serializersAndRefsFromSerializableRef.js';
 import SerializerOpenapiRenderer from './SerializerOpenapiRenderer.js';
 /**
  * @internal
@@ -53,6 +54,7 @@ export default class OpenapiSegmentExpander {
     bodySegment;
     casing;
     suppressResponseEnums;
+    legacyImplicitRequestBodyParams;
     target;
     source;
     /**
@@ -65,6 +67,7 @@ export default class OpenapiSegmentExpander {
         this.bodySegment = bodySegment;
         this.casing = renderOpts.casing;
         this.suppressResponseEnums = renderOpts.suppressResponseEnums;
+        this.legacyImplicitRequestBodyParams = renderOpts.legacyImplicitRequestBodyParams;
         this.target = target;
         this.source = source ?? 'unknown';
     }
@@ -488,19 +491,42 @@ The following values will be allowed:
             including: ref.including,
             required: ref.required,
             combining: ref.combining,
+            legacyImplicitRequestBodyParams: this.legacyImplicitRequestBodyParams,
         }, this.source);
         return this.recursivelyParseBody(paramsShape);
     }
     serializableStatement(bodySegment) {
         const serializableRef = bodySegment;
         const key = serializableRef.$serializableSerializerKey || serializableRef.key || 'default';
-        const serializer = DreamApp.system.inferSerializerFromDreamOrViewModel(serializableRef.$serializable.prototype, key);
-        if (!serializer)
-            throw new Error(`Failed to locate serializers getter from: ${serializableRef.$serializable.name} using key: ${key}`);
-        return this.serializerStatement({
-            $serializer: serializer,
-            ...serializableRef,
+        const { serializers, refs } = serializersAndRefsFromSerializableRef(serializableRef, {
+            casing: this.casing,
+            suppressResponseEnums: this.suppressResponseEnums,
         });
+        if (serializers.length === 0)
+            throw new Error(`Failed to locate serializers getter from: ${serializableRef.$serializable.name} using key: ${key}`);
+        if (serializers.length === 1) {
+            return this.serializerStatement({
+                $serializer: serializers[0],
+                ...serializableRef,
+            });
+        }
+        const serializerAnyOf = { anyOf: refs };
+        if (serializableRef.many) {
+            return {
+                referencedSerializers: serializers,
+                openapi: {
+                    type: serializableRef.maybeNull ? ['array', 'null'] : 'array',
+                    items: serializerAnyOf,
+                },
+            };
+        }
+        if (serializableRef.maybeNull) {
+            return {
+                referencedSerializers: serializers,
+                openapi: { anyOf: [...refs, { type: 'null' }] },
+            };
+        }
+        return { referencedSerializers: serializers, openapi: serializerAnyOf };
     }
     /**
      * @internal

package/dist/esm/src/openapi-renderer/endpoint.js

@@ -529,7 +529,17 @@ export default class OpenapiEndpointRenderer {
             including: including,
             required: required,
             combining: combining,
+            legacyImplicitRequestBodyParams: renderOpts.legacyImplicitRequestBodyParams,
         }, source);
+        // When the model-derived shape contributes no properties and no `required`
+        // (e.g. the new none-default with no `params`/`only`/`combining`), there is
+        // nothing meaningful to advertise. Fall back to `defaultRequestBody()`, which
+        // omits the body entirely unless body-level pagination params are present.
+        const shapeProperties = paramsShape.properties;
+        const shapeRequired = paramsShape.required;
+        if (Object.keys(shapeProperties ?? {}).length === 0 && !shapeRequired) {
+            return this.defaultRequestBody();
+        }
         let processedSchema = new OpenapiSegmentExpander(paramsShape, {
             renderOpts,
             target: 'request',

package/dist/esm/src/openapi-renderer/helpers/OpenapiPayloadValidator.js

@@ -2,6 +2,7 @@ import OpenapiRequestValidationFailure from '../../error/openapi/OpenapiRequestV
 import OpenapiResponseValidationFailure from '../../error/openapi/OpenapResponseValidationFailure.js';
 import { createValidator, formatAjvErrors, } from '../../helpers/validateOpenApiSchema.js';
 import PsychicApp from '../../psychic-app/index.js';
+import legacyImplicitRequestBodyParamsConfig from './legacyImplicitRequestBodyParamsConfig.js';
 import suppressResponseEnumsConfig from './suppressResponseEnumsConfig.js';
 import { cacheValidator, getCachedValidator } from './validator-cache.js';
 /**
@@ -207,6 +208,7 @@ export default class OpenapiPayloadValidator {
         return {
             casing: 'camel',
             suppressResponseEnums: suppressResponseEnumsConfig(this.openapiName),
+            legacyImplicitRequestBodyParams: legacyImplicitRequestBodyParamsConfig(this.openapiName),
         };
     }
     /**

package/dist/esm/src/openapi-renderer/helpers/allSerializersFromHandWrittenOpenapi.js

@@ -1,5 +1,5 @@
-import { DreamApp } from '@rvoh/dream';
 import isObject from '../../helpers/isObject.js';
+import serializersAndRefsFromSerializableRef from './serializersAndRefsFromSerializableRef.js';
 /**
  * @internal
  *
@@ -54,8 +54,7 @@ value, serializers) {
         //
     }
     else if (value.$serializable) {
-        const foundSerializers = DreamApp.system.inferSerializersFromDreamClassOrViewModelClass(value.$serializable, value.$serializableSerializerKey);
-        foundSerializers.forEach(serializer => serializers.add(serializer));
+        serializersAndRefsFromSerializableRef(value).serializers.forEach(serializer => serializers.add(serializer));
         //
     }
     else if (isObject(value)) {

package/dist/esm/src/openapi-renderer/helpers/allSerializersToRefsInOpenapi.js

@@ -1,10 +1,6 @@
-/* eslint-disable @typescript-eslint/no-unsafe-return */
-/* eslint-disable @typescript-eslint/no-unsafe-argument */
-/* eslint-disable @typescript-eslint/no-unsafe-assignment */
-/* eslint-disable @typescript-eslint/no-unsafe-member-access */
-import { DreamApp } from '@rvoh/dream';
 import isObject from '../../helpers/isObject.js';
 import SerializerOpenapiRenderer from '../SerializerOpenapiRenderer.js';
+import serializersAndRefsFromSerializableRef from './serializersAndRefsFromSerializableRef.js';
 /**
  * @internal
  *
@@ -69,9 +65,8 @@ function transformValue(value) {
         //
     }
     else if (value.$serializable) {
-        const { $serializable, $serializableSerializerKey, ...rest } = value;
-        const foundSerializers = DreamApp.system.inferSerializersFromDreamClassOrViewModelClass($serializable, $serializableSerializerKey);
-        const refs = foundSerializers.map(serializer => new SerializerOpenapiRenderer(serializer).serializerRef);
+        const { $serializable, $serializableSerializerKey, key, ...rest } = value;
+        const { refs } = serializersAndRefsFromSerializableRef({ $serializable, $serializableSerializerKey, key });
         if (refs.length === 0)
             return rest;
         if (refs.length === 1) {

package/dist/esm/src/openapi-renderer/helpers/buildDreamRequestBodyShape.js

@@ -11,9 +11,15 @@ import { dreamColumnOpenapiShape } from './dreamColumnOpenapiShape.js';
  * truth keeps top-level and nested semantics identical.
  */
 export default function buildDreamRequestBodyShape(dreamClass, opts, source) {
-    const { params, only, including, required, combining } = opts;
+    const { params, only, including, required, combining, legacyImplicitRequestBodyParams } = opts;
+    // When neither `params` nor `only` is provided, the default is to resolve to
+    // NO model columns (an empty allowlist), rather than implicitly exposing every
+    // param-safe column. The legacy implicit-all behavior can be re-activated via
+    // the `legacyImplicitRequestBodyParams` opt-in.
+    const resolvedOnly = params ?? only;
+    const onlyForResolution = resolvedOnly === undefined && !legacyImplicitRequestBodyParams ? [] : resolvedOnly;
     const paramSafeColumns = openapiParamNamesForDreamClass(dreamClass, {
-        only: params ?? only,
+        only: onlyForResolution,
         including,
     });
     const paramsShape = {

package/dist/esm/src/openapi-renderer/helpers/dreamColumnOpenapiShape.js

@@ -18,6 +18,7 @@ source, dreamClass, column, openapi = undefined, { suppressResponseEnums = false
                     renderOpts: {
                         casing: 'camel',
                         suppressResponseEnums: false,
+                        legacyImplicitRequestBodyParams: false,
                     },
                     target: 'request',
                 }).render().openapi,

package/dist/esm/src/openapi-renderer/helpers/legacyImplicitRequestBodyParamsConfig.js

@@ -0,0 +1,9 @@
+import openapiOpts from './openapiOpts.js';
+/**
+ * returns whether the named openapi config opts in to the legacy behavior of
+ * implicitly exposing all param-safe columns when a model-derived request body
+ * is given no `params`/`only`.
+ */
+export default function legacyImplicitRequestBodyParamsConfig(openapiName) {
+    return !!openapiOpts(openapiName)?.legacyImplicitRequestBodyParams;
+}

package/dist/esm/src/openapi-renderer/helpers/serializersAndRefsFromSerializableRef.js

@@ -0,0 +1,17 @@
+import { DreamApp } from '@rvoh/dream';
+import { sortBy, uniq } from '@rvoh/dream/utils';
+import SerializerOpenapiRenderer from '../SerializerOpenapiRenderer.js';
+export default function serializersAndRefsFromSerializableRef(serializableRef, { casing = 'camel', suppressResponseEnums = false, } = {}) {
+    const key = serializableRef.$serializableSerializerKey || serializableRef.key || 'default';
+    const serializerRefs = sortBy(uniq(DreamApp.system.inferSerializersFromDreamClassOrViewModelClass(serializableRef.$serializable, key)).map(serializer => ({
+        serializer,
+        ref: new SerializerOpenapiRenderer(serializer, {
+            casing,
+            suppressResponseEnums,
+        }).serializerRef,
+    })), ({ ref }) => ref.$ref);
+    return {
+        serializers: serializerRefs.map(({ serializer }) => serializer),
+        refs: serializerRefs.map(({ ref }) => ref),
+    };
+}

package/dist/types/src/bin/helpers/OpenApiSpecDiff.d.ts

@@ -96,9 +96,13 @@ export declare class OpenApiSpecDiff {
     private createTempFilePath;
     /**
      * Retrieves head branch content for a file
+     *
+     * Marked `protected` so tests can supply a deterministic baseline instead of
+     * the live head branch. Production code never overrides this.
+     *
      * @param absoluteFilePath - Absolute path to the file
      */
-    private getHeadBranchContent;
+    protected getHeadBranchContent(absoluteFilePath: string): string;
     /**
      * Compares a single OpenAPI file against head branch
      */

package/dist/types/src/openapi-renderer/body-segment.d.ts

@@ -56,6 +56,7 @@ export default class OpenapiSegmentExpander {
     private bodySegment;
     private casing;
     private suppressResponseEnums;
+    private legacyImplicitRequestBodyParams;
     private target;
     private source;
     /**

package/dist/types/src/openapi-renderer/endpoint.d.ts

@@ -11,6 +11,7 @@ import { OpenapiBodySegment, ReferencedSerializersAndOpenapiEndpointResponse, Se
 export interface OpenapiRenderOpts {
     casing: SerializerCasing;
     suppressResponseEnums: boolean;
+    legacyImplicitRequestBodyParams: boolean;
 }
 export interface ToPathObjectOpts {
     openapiName: string;

package/dist/types/src/openapi-renderer/helpers/buildDreamRequestBodyShape.d.ts

@@ -6,6 +6,13 @@ export interface BuildDreamRequestBodyShapeOpts {
     including?: readonly string[] | undefined;
     required?: readonly string[] | undefined;
     combining?: Record<string, unknown> | undefined;
+    /**
+     * When true, restores the legacy behavior of resolving to ALL param-safe
+     * columns when no `params`/`only` are provided. When false/undefined (the
+     * default), an absent `params`/`only` resolves to NO model columns, so that
+     * database-level structure is not implicitly leaked into the OpenAPI shape.
+     */
+    legacyImplicitRequestBodyParams?: boolean | undefined;
 }
 /**
  * @internal

package/dist/types/src/openapi-renderer/helpers/legacyImplicitRequestBodyParamsConfig.d.ts

@@ -0,0 +1,6 @@
+/**
+ * returns whether the named openapi config opts in to the legacy behavior of
+ * implicitly exposing all param-safe columns when a model-derived request body
+ * is given no `params`/`only`.
+ */
+export default function legacyImplicitRequestBodyParamsConfig(openapiName: string): boolean;

package/dist/types/src/openapi-renderer/helpers/serializersAndRefsFromSerializableRef.d.ts

@@ -0,0 +1,9 @@
+import { OpenapiSchemaExpressionRef, OpenapiSchemaShorthandExpressionSerializableRef } from '@rvoh/dream/openapi';
+import { DreamModelSerializerType, SerializerCasing, SimpleObjectSerializerType } from '@rvoh/dream/types';
+export default function serializersAndRefsFromSerializableRef(serializableRef: OpenapiSchemaShorthandExpressionSerializableRef, { casing, suppressResponseEnums, }?: {
+    casing?: SerializerCasing;
+    suppressResponseEnums?: boolean;
+}): {
+    serializers: (DreamModelSerializerType | SimpleObjectSerializerType)[];
+    refs: OpenapiSchemaExpressionRef[];
+};

package/dist/types/src/psychic-app/index.d.ts

@@ -356,6 +356,29 @@ interface PsychicOpenapiBaseOptions {
      * ```
      */
     suppressResponseEnums?: boolean;
+    /**
+     * @deprecated escape hatch — prefer explicit `params`/`only` on each request body.
+     *
+     * When true, restores the legacy behavior where a model-derived `requestBody`
+     * (or nested `$dream`/`for:` segment) given no `params`/`only` implicitly
+     * exposes ALL param-safe columns of the model.
+     *
+     * As of 3.9.0 the default flipped: an absent `params`/`only` now resolves to
+     * NO model columns, so that database-level structure is not implicitly leaked
+     * into the OpenAPI shape (an attacker could otherwise infer the column set).
+     * A top-level model-derived `requestBody` with nothing to contribute is
+     * omitted entirely; a nested `$dream`/`for:` segment renders an empty object.
+     *
+     * Set this to true to keep the pre-3.9.0 implicit-all behavior while you
+     * migrate to explicit allowlists.
+     *
+     * ```ts
+     * psy.set('openapi', {
+     *   legacyImplicitRequestBodyParams: true,
+     * })
+     * ```
+     */
+    legacyImplicitRequestBodyParams?: boolean;
     /**
      * When true, psychic will use the `openapi-typescript` package
      * to read this openapi.json file and create typescript interfaces

package/package.json

@@ -2,7 +2,7 @@
   "type": "module",
   "name": "@rvoh/psychic",
   "description": "Typescript web framework",
-  "version": "3.8.5",
+  "version": "3.9.0",
   "author": "RVOHealth",
   "publishConfig": {
     "access": "public"