@betterportal/framework 10.1.61 → 10.1.62

package/lib/adapters/h3.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"h3.d.ts","sourceRoot":"","sources":["../../src/adapters/h3.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxG,OAAO,KAAK,EAAsB,oBAAoB,EAAE,eAAe,EAAwD,MAAM,0BAA0B,CAAC;AAChK,OAAO,KAAK,EAGV,WAAW,EAIX,mBAAmB,EACnB,oBAAoB,EAIrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,sBAAsB,CAAC;AAErE,OAAO,EASL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AA0B1B,MAAM,WAAW,4BAA4B;IAC3C,0BAA0B,CAAC,EAAE,CAC3B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,uBAAuB,KAChC,yBAAyB,CAAC;IAC/B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yGAAyG;IACzG,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,GAAG,aAAa,GAAG,SAAS,CAAC;IACnI;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,sBAAsB,EAAE,mBAAmB,CAAC,GAAG,OAAO,sBAAsB,EAAE,mBAAmB,CAAC;IAC1K,qEAAqE;IACrE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC7I;AAQD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE;QACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AA+KD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAKvE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExG;AA2CD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,iBAAiB,EACtB,OAAO,GAAE,4BAAiC,GACzC,IAAI,CAqGN;AAyhDD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,QAAQ,GAAG,SAAS,CAAC;CAChC,GACL,IAAI,CAuDN"}
+{"version":3,"file":"h3.d.ts","sourceRoot":"","sources":["../../src/adapters/h3.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxG,OAAO,KAAK,EAAsB,oBAAoB,EAAE,eAAe,EAAwD,MAAM,0BAA0B,CAAC;AAChK,OAAO,KAAK,EAGV,WAAW,EAIX,mBAAmB,EACnB,oBAAoB,EAIrB,MAAM,uBAAuB,CAAC;AAI/B,OAAO,KAAK,EAAE,aAAa,EAAa,MAAM,sBAAsB,CAAC;AAErE,OAAO,EASL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AA0B1B,MAAM,WAAW,4BAA4B;IAC3C,0BAA0B,CAAC,EAAE,CAC3B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,uBAAuB,KAChC,yBAAyB,CAAC;IAC/B,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yGAAyG;IACzG,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,GAAG,aAAa,GAAG,SAAS,CAAC;IACnI;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,sBAAsB,EAAE,mBAAmB,CAAC,GAAG,OAAO,sBAAsB,EAAE,mBAAmB,CAAC;IAC1K,qEAAqE;IACrE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC7I;AAQD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,YAAY,CAAC,EAAE;QACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AA+KD,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAKvE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAExG;AA2CD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,oBAAoB,EAC9B,GAAG,EAAE,iBAAiB,EACtB,OAAO,GAAE,4BAAiC,GACzC,IAAI,CAqGN;AA8iDD;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,iBAAiB,EACtB,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE;IACP,MAAM,CAAC,EAAE,MAAM,QAAQ,GAAG,SAAS,CAAC;CAChC,GACL,IAAI,CAuDN"}

package/lib/adapters/h3.js

@@ -142,7 +142,7 @@ async function resolveRequiredHandlerContext(event, routerOptions, route) {
         : null;
 }
 export function isBpManagementAuthRoute(route) {
-    return route.auth.required && (route.path === "/.well-known/bp"
+    return Object.values(route.methodRoutes ?? {}).some((operation) => operation?.auth.required) && (route.path === "/.well-known/bp"
         || route.path.startsWith("/.well-known/bp/"));
 }
 export function isBpManagementAuthPath(routes, pathname) {
@@ -288,6 +288,9 @@ function requestAttributes(event, route, method, extra = {}) {
         "network.protocol.name": requestUrl.protocol.replace(":", ""),
         "bp.route.path": route.path,
         "bp.route.view_id": route.viewId,
+        ...route.methodRoutes?.[method]?.operationId
+            ? { "bp.route.operation_id": route.methodRoutes[method].operationId }
+            : {},
         ...(requestIp ? { "client.address": requestIp } : {}),
         ...extra
     };
@@ -326,6 +329,7 @@ function logNegotiationFailure(obs, route, method, reason, attributes = {}) {
         status: 406,
         reason,
         "bp.route.view_id": route.viewId,
+        "bp.route.operation_id": route.methodRoutes?.[method]?.operationId ?? "",
         ...attributes
     });
 }
@@ -347,19 +351,20 @@ function routePathsMatch(left, right) {
 function routeMountServicePath(routeMount) {
     return routeMount.resolvedServicePath ?? routeMount.servicePathVariant ?? routeMount.targetPath;
 }
-function methodAllowed(methods, method) {
-    return (methods?.length ? methods : ["GET"]).some((candidate) => candidate.toUpperCase() === method);
-}
 function appAllowsRoute(app, route, method, url, acceptHeader) {
     // Well-known routes are control-plane/service endpoints. Their access policy
     // is declared by the route and must not depend on being mounted as an app page.
     if (route.path.startsWith("/.well-known/"))
         return { allowed: true };
+    const operationId = route.methodRoutes?.[method]?.operationId;
+    if (!operationId)
+        return { allowed: false, reason: "operation_not_registered" };
+    const legacyOperationId = `legacy:${route.viewId}:${method}`;
     const appRoute = app.routes.find((candidate) => {
         const servicePath = routeMountServicePath(candidate);
         return candidate.enabled !== false
             && candidate.viewId === route.viewId
-            && methodAllowed(candidate.methods, method)
+            && (candidate.operations.includes(operationId) || candidate.operations.includes(legacyOperationId))
             && (!servicePath || routePathsMatch(servicePath, route.path));
     });
     if (appRoute)
@@ -622,7 +627,7 @@ function createUiRouteUrlBuilder(event, extraContext, dependencyAliases, current
         const serviceIds = serviceReferenceIds(extraContext, targetServiceId, dependencyAliases);
         const routes = appRouteIndex(extraContext.app).filter((candidate) => candidate.enabled !== false
             && (candidate.kind ?? "page") === "page"
-            && methodAllowed(candidate.methods, "GET")
+            && (candidate.resolvedMethods?.includes("GET") ?? false)
             && candidate.viewId === viewId
             && serviceIds.has(candidate.serviceId));
         const resolved = routes.flatMap((route) => {
@@ -649,6 +654,7 @@ function rejectUnallowedAppRoute(obs, route, method, extraContext, reason) {
         method,
         reason,
         "bp.route.view_id": route.viewId,
+        "bp.route.operation_id": route.methodRoutes?.[method]?.operationId ?? "",
         "bp.route.path": route.path,
         "bp.app.id": extraContext.app.id,
         "bp.tenant.id": extraContext.tenant.id,
@@ -656,6 +662,7 @@ function rejectUnallowedAppRoute(obs, route, method, extraContext, reason) {
     });
     return coreJsonResponse({ error: "Route not found" }, 404, "route.not_mounted", reason, {
         "bp.route.view_id": route.viewId,
+        "bp.route.operation_id": route.methodRoutes?.[method]?.operationId ?? "",
         "bp.route.path": route.path,
         "bp.route_allowlist.reason": reason
     });
@@ -713,13 +720,13 @@ async function withSpan(obs, name, attributes, handler) {
 }
 async function handleRouteRequest(registryRoutes, dependencyAliases, route, method, event, obs, routerOptions = {}) {
     const methodRoute = route.methodRoutes?.[method];
-    const handler = methodRoute?.handler ?? route.handlers[method];
+    const handler = methodRoute?.handler;
     const schemas = {
         ...route.schemas,
         ...(methodRoute?.schemas ?? {}),
         params: methodRoute?.schemas.params ?? route.schemas.params
     };
-    if (!handler) {
+    if (!handler || !methodRoute) {
         return coreJsonResponse({ error: `No handler for ${method} ${route.path}` }, 405, "route.handler_missing", `No handler for ${method} ${route.path}`);
     }
     // -- Parse inputs -------------------------------------------------
@@ -810,11 +817,11 @@ async function handleRouteRequest(registryRoutes, dependencyAliases, route, meth
         }, dependencyAliases, renderer, "page", "page", undefined, status) : undefined;
     };
     // -- Auth resolution (per spec section 0.5) ----------------------
-    const apiAuth = route.auth;
+    const apiAuth = methodRoute.auth;
     const authResolved = await loadAuthContext(event, route, routerOptions, obs);
     const authResult = await resolveRequestAuth(apiAuth, event, authResolved, route, method, obs);
     if (authResult.error) {
-        return renderAuthError(route, event, authResult.status, authResult.code ?? "auth.unclassified", authResult.error, authResult.requiredPermissions, earlyRenderContext(authResult.status));
+        return renderAuthError(route, event, method, authResult.status, authResult.code ?? "auth.unclassified", authResult.error, authResult.requiredPermissions, earlyRenderContext(authResult.status));
     }
     // -- Tenant/app activation check (validateTenantApp hook -> 426) -----
     const tenantApp = readTenantAppFromEvent(event);
@@ -827,13 +834,13 @@ async function handleRouteRequest(registryRoutes, dependencyAliases, route, meth
                     appId: tenantApp.appId,
                     reason: validation.reason ?? "(unspecified)"
                 });
-                return renderUpgradeRequired(route, event, validation, earlyRenderContext(426));
+                return renderUpgradeRequired(route, event, method, validation, earlyRenderContext(426));
             }
         }
         catch (err) {
             obs?.logger.warn("validateTenantApp threw: {msg}", { msg: err.message });
             // Fail-open: validation error treated as block.
-            return renderUpgradeRequired(route, event, {
+            return renderUpgradeRequired(route, event, method, {
                 allowed: false,
                 reason: "Tenant-app validation error"
             }, earlyRenderContext(426));
@@ -877,6 +884,7 @@ async function handleRouteRequest(registryRoutes, dependencyAliases, route, meth
         }
         rawData = await withCoreFailure(event, "handler.exception", () => withSpan(obs, "bp.route.handler", {
             "bp.route.view_id": route.viewId,
+            "bp.route.operation_id": methodRoute.operationId,
             "bp.route.path": route.path,
             "http.request.method": method,
             "bp.route.stream_buffered": true
@@ -885,6 +893,7 @@ async function handleRouteRequest(registryRoutes, dependencyAliases, route, meth
     else {
         rawData = await withCoreFailure(event, "handler.exception", () => withSpan(obs, "bp.route.handler", {
             "bp.route.view_id": route.viewId,
+            "bp.route.operation_id": methodRoute.operationId,
             "bp.route.path": route.path,
             "http.request.method": method
         }, () => handler(ctx)));
@@ -912,9 +921,10 @@ async function handleRouteRequest(registryRoutes, dependencyAliases, route, meth
             title: route.title,
             description: route.description,
             path: route.path,
-            methods: [...route.methods],
-            auth: { ...route.auth, callers: [...(route.auth.callers ?? ["user"])] },
-            cacheHints: route.cacheHints
+            operationId: methodRoute.operationId,
+            method,
+            auth: { ...methodRoute.auth, callers: [...(methodRoute.auth.callers ?? ["user"])] },
+            cacheHints: methodRoute.cacheHints
         }, 200, {
             "content-type": "application/vnd.betterportal.metadata+json; charset=utf-8"
         });
@@ -976,11 +986,12 @@ async function handleRouteRequest(registryRoutes, dependencyAliases, route, meth
             }
             const html = await withCoreFailure(event, "render.status_failed", () => withSpan(obs, "bp.view.render", {
                 "bp.route.view_id": route.viewId,
+                "bp.route.operation_id": methodRoute.operationId,
                 "bp.view.renderer": renderer,
                 "bp.view.kind": requestedKind,
                 "bp.view.status": handlerStatus
             }, () => statusRenderer.render(data, renderContext)));
-            return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType("status", route.chrome));
+            return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType("status", methodRoute.chrome));
         }
         // No specific renderer found.
         if (!shouldFallThroughToDefaultRenderer(handlerStatus)) {
@@ -1009,11 +1020,12 @@ async function handleRouteRequest(registryRoutes, dependencyAliases, route, meth
         }
         const html = await withCoreFailure(event, "render.fragment_failed", () => withSpan(obs, "bp.view.render", {
             "bp.route.view_id": route.viewId,
+            "bp.route.operation_id": methodRoute.operationId,
             "bp.view.renderer": renderer,
             "bp.view.kind": "fragment",
             "bp.view.key": fragmentKey
         }, () => resolved.renderer.render(data, renderContext)));
-        return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType("fragment", route.chrome));
+        return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType("fragment", methodRoute.chrome));
     }
     // Component request via `_c` query param
     if (componentId) {
@@ -1031,11 +1043,12 @@ async function handleRouteRequest(registryRoutes, dependencyAliases, route, meth
         }
         const html = await withCoreFailure(event, "render.component_failed", () => withSpan(obs, "bp.view.render", {
             "bp.route.view_id": route.viewId,
+            "bp.route.operation_id": methodRoute.operationId,
             "bp.view.renderer": renderer,
             "bp.view.kind": "component",
             "bp.view.key": componentId
         }, () => resolved.renderer.render(data, renderContext)));
-        return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType("fragment", route.chrome));
+        return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType("fragment", methodRoute.chrome));
     }
     // Page request - only page renderers allowed
     const resolved = resolveRenderer(route, renderer, "page", method);
@@ -1051,11 +1064,12 @@ async function handleRouteRequest(registryRoutes, dependencyAliases, route, meth
     }
     const html = await withCoreFailure(event, "render.page_failed", () => withSpan(obs, "bp.view.render", {
         "bp.route.view_id": route.viewId,
+        "bp.route.operation_id": methodRoute.operationId,
         "bp.view.renderer": renderer,
         "bp.view.kind": "page"
     }, () => resolved.renderer.render(data, renderContext)));
     const mode = representation.mode ?? "page";
-    return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType(mode, route.chrome));
+    return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), handlerStatus, htmlContentType(mode, methodRoute.chrome));
 }
 /**
  * Handle representations that stream, returning null for buffered ones so the
@@ -1093,7 +1107,7 @@ async function handleStreamRepresentation(route, handler, ctx, event, url, metho
         "bp.view.renderer": renderer,
         "bp.view.kind": "stream-shell"
     }, () => streamSet.renderShell(shellCtx)));
-    return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), 200, htmlContentType("fragment", route.chrome));
+    return htmlResponse(rewriteServiceRouteTokens(toHtmlString(html), ctx.routeUrl, obs), 200, htmlContentType("fragment", route.methodRoutes?.[method]?.chrome));
 }
 /**
  * SSE delivery of the frame stream at `{path}/__sse`. With a theme context and
@@ -1117,8 +1131,12 @@ async function handleStreamSse(registryRoutes, dependencyAliases, route, handler
         return params;
     // The frame stream carries the same data as the view route - enforce the
     // same auth requirement.
+    const operation = route.methodRoutes?.GET;
+    if (!operation) {
+        return coreJsonResponse({ error: "Streaming GET operation metadata is missing" }, 500, "route.operation_missing", "Streaming GET operation metadata is missing");
+    }
     const authResolved = await loadAuthContext(event, route, routerOptions, obs);
-    const authResult = await resolveRequestAuth(route.auth, event, authResolved, route, "GET", obs);
+    const authResult = await resolveRequestAuth(operation.auth, event, authResolved, route, "GET", obs);
     if (authResult.error) {
         return coreJsonResponse({ error: authResult.error, status: authResult.status }, authResult.status, authResult.code ?? "auth.unclassified", authResult.error);
     }
@@ -1428,11 +1446,12 @@ function formatRequiredPermissions(requiredPermissions = []) {
         .map((requirement) => `${requirement.serviceId} / ${requirement.viewId} / ${requirement.permissions.join("+")}`)
         .join("; ");
 }
-function renderAuthError(route, event, status, code, message, requiredPermissions = [], context) {
+function renderAuthError(route, event, method, status, code, message, requiredPermissions = [], context) {
     const renderer = rendererFromEvent(event);
     const acceptHeader = acceptHeaderFromEvent(event);
     const representation = resolveRequestedRepresentation(acceptHeader);
     const corsHeaders = corsHeadersFromEvent(event);
+    const chrome = route.methodRoutes?.[method]?.chrome;
     // Auth errors NEVER emit navigation headers (HX-Location / HX-Redirect). A
     // service has no reliable knowledge of where the auth provider lives - it only
     // knows the JWKS for token *validation*, not a URL the browser should navigate
@@ -1442,13 +1461,13 @@ function renderAuthError(route, event, status, code, message, requiredPermission
     // Prefer a route/theme status view so the body swaps cleanly into the htmx
     // target as a fragment rather than replacing the shell.
     if (renderer && (representation.kind === "html")) {
-        const statusRenderer = resolveStatusRenderer(route, renderer, status, "page", undefined, "GET");
+        const statusRenderer = resolveStatusRenderer(route, renderer, status, "page", undefined, method);
         if (statusRenderer && context) {
             try {
                 const html = statusRenderer.render({ error: message, status, requiredPermissions }, context);
                 return coreResponse(new Response(toHtmlString(html), {
                     status,
-                    headers: { ...corsHeaders, "content-type": htmlContentType("status", route.chrome) }
+                    headers: { ...corsHeaders, "content-type": htmlContentType("status", chrome) }
                 }), code, message);
             }
             catch {
@@ -1469,7 +1488,7 @@ function renderAuthError(route, event, status, code, message, requiredPermission
     `;
         return coreResponse(new Response(html, {
             status,
-            headers: { ...corsHeaders, "content-type": renderer ? htmlContentType("status", route.chrome) : "text/html; charset=utf-8" }
+            headers: { ...corsHeaders, "content-type": renderer ? htmlContentType("status", chrome) : "text/html; charset=utf-8" }
         }), code, message);
     }
     return coreJsonResponse({ error: message, status, requiredPermissions }, status, code, message, undefined, corsHeaders);
@@ -1492,18 +1511,19 @@ function readTenantAppFromEvent(event) {
         return undefined;
     return { tenantId: ctx.__bpTenantId, appId: ctx.__bpAppId };
 }
-function renderUpgradeRequired(route, event, validation, context) {
+function renderUpgradeRequired(route, event, method, validation, context) {
     const renderer = rendererFromEvent(event);
     const acceptHeader = acceptHeaderFromEvent(event);
     const representation = resolveRequestedRepresentation(acceptHeader);
     const status = 426;
+    const chrome = route.methodRoutes?.[method]?.chrome;
     // Honor Retry-After if requested
     const extraHeaders = {};
     if (validation.retryAfterSeconds) {
         extraHeaders["retry-after"] = String(validation.retryAfterSeconds);
     }
     if (renderer && representation.kind === "html") {
-        const statusRenderer = resolveStatusRenderer(route, renderer, status, "page", undefined, "GET");
+        const statusRenderer = resolveStatusRenderer(route, renderer, status, "page", undefined, method);
         if (statusRenderer && context) {
             try {
                 const html = statusRenderer.render({
@@ -1511,7 +1531,7 @@ function renderUpgradeRequired(route, event, validation, context) {
                     reason: validation.reason,
                     upgradeUrl: validation.upgradeUrl
                 }, context);
-                return coreResponse(htmlResponse(toHtmlString(html), status, htmlContentType("status", route.chrome)), "route.tenant_app_unavailable", validation.reason ?? "Tenant/app is not available for this service");
+                return coreResponse(htmlResponse(toHtmlString(html), status, htmlContentType("status", chrome)), "route.tenant_app_unavailable", validation.reason ?? "Tenant/app is not available for this service");
             }
             catch {
                 // fall through to JSON