@decohere/http 0.0.1-dev.130 → 0.0.1-dev.20261105.103

package/es6/src/routing/services/route-registry.js

@@ -95,6 +95,11 @@ export class RouteRegistry {
     }
     getRouteArgument(argumentType, argumentIndex, handler) {
         const argMeta = getArgumentMeta(MetadataKeys.parameter, handler, argumentIndex);
+        // A named value typed as a union or interface reaches here as Object, which would build an
+        // empty object. Pass the value through as it arrived.
+        if (argumentType === Object && argMeta?.mappingKey != null && !isInjectedPart(argMeta.argumentLocation)) {
+            return this.getRouteArgument(String, argumentIndex, handler);
+        }
         // @CurrentUser() / interface params are Object (or other non-DTO types) — no field map.
         if (isInjectedPart(argMeta?.argumentLocation) || !isConstructable(argumentType)) {
             return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/http",
-  "version": "0.0.1-dev.130",
+  "version": "0.0.1-dev.20261105.103",
   "description": "Web API and microservice platform built on Fastify with decorator-based routing",
   "keywords": [
     "typescript",
@@ -27,28 +27,23 @@
   "exports": {
     ".": {
       "types": "./types/src/index.d.ts",
-      "import": "./es6/src/index.js",
-      "require": "./commonjs/src/index.js"
+      "import": "./es6/src/index.js"
     },
     "./providers": {
       "types": "./types/src/providers/index.d.ts",
-      "import": "./es6/src/providers/index.js",
-      "require": "./commonjs/src/providers/index.js"
+      "import": "./es6/src/providers/index.js"
     },
     "./auth": {
       "types": "./types/src/auth/auth.extensions.d.ts",
-      "import": "./es6/src/auth/auth.extensions.js",
-      "require": "./commonjs/src/auth/auth.extensions.js"
+      "import": "./es6/src/auth/auth.extensions.js"
     },
     "./testing": {
       "types": "./types/src/testing/index.d.ts",
-      "import": "./es6/src/testing/index.js",
-      "require": "./commonjs/src/testing/index.js"
+      "import": "./es6/src/testing/index.js"
     },
     "./http": {
       "types": "./types/src/http/index.d.ts",
-      "import": "./es6/src/http/index.js",
-      "require": "./commonjs/src/http/index.js"
+      "import": "./es6/src/http/index.js"
     }
   },
   "scripts": {
@@ -56,9 +51,9 @@
   },
   "dependencies": {
     "@casl/ability": "^6.8.1",
-    "@decohere/core": "0.0.1-dev.130",
-    "@decohere/crucible": "0.0.1-dev.130",
-    "@decohere/scribe": "0.0.1-dev.130",
+    "@decohere/core": "0.0.1-dev.20261105.103",
+    "@decohere/crucible": "0.0.1-dev.20261105.103",
+    "@decohere/scribe": "0.0.1-dev.20261105.103",
     "@fastify/compress": "^9.2.1",
     "@fastify/cors": "^11.3.0",
     "@fastify/helmet": "^13.1.0",

package/commonjs/src/app/app.js

@@ -1,166 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get ApiConfiguration () {
-        return ApiConfiguration;
-    },
-    get App () {
-        return App;
-    }
-});
-const _crucible = require("@decohere/crucible");
-const _decorators = require("@decohere/crucible/decorators");
-const _configuration = require("@decohere/core/configuration");
-const _scribe = require("@decohere/scribe");
-const _const = require("../const.js");
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-function _ts_param(paramIndex, decorator) {
-    return function(target, key) {
-        decorator(target, key, paramIndex);
-    };
-}
-const DEFAULT_PORT = 3000;
-const DEFAULT_SHUTDOWN_SIGNALS = [
-    "SIGTERM",
-    "SIGINT"
-];
-const DEFAULT_SHUTDOWN_TIMEOUT_MS = 10_000;
-class ApiConfiguration {
-    port;
-}
-class App {
-    container;
-    configurationService;
-    httpProvider;
-    hostedServices;
-    _addresses = Array.of();
-    logger = _scribe.scribe.logger(App.name);
-    disposing;
-    disposingContainer = false;
-    signalHandler;
-    shutdownSignals = [];
-    constructor(container, configurationService, httpProvider, hostedServices){
-        this.container = container;
-        this.configurationService = configurationService;
-        this.httpProvider = httpProvider;
-        this.hostedServices = hostedServices;
-    }
-    get addresses() {
-        return this._addresses;
-    }
-    async start(options) {
-        this.logger.info("Starting app");
-        // Before HTTP, so a request never reaches a service that has not started.
-        await this.hostedServices?.start(this.container);
-        // The app was stopped while a hosted service was still starting.
-        if (this.disposing != null) return;
-        const hasHostedServices = this.hostedServices != null && !this.hostedServices.isEmpty;
-        if (!this.httpProvider) {
-            if (hasHostedServices) this.stopOnSignals(options);
-            return;
-        }
-        const port = await this.getPort(options);
-        this.logger.info(`Starting http on port ${port}`);
-        const startResponse = await this.httpProvider?.start({
-            port,
-            ...options?.host != null ? {
-                host: options.host
-            } : {}
-        });
-        this._addresses = [
-            ...startResponse.addresses
-        ];
-        this.logger.info("Listening on:", this._addresses);
-        this.stopOnSignals(options);
-        return startResponse;
-    }
-    [Symbol.asyncDispose]() {
-        // The container holds this App too; when stop() disposes the container it lands
-        // here, and awaiting our own shutdown would deadlock.
-        if (this.disposingContainer) return Promise.resolve();
-        return this.dispose();
-    }
-    /** Stop the app. Calling it again (or from a signal) returns the same shutdown. */ dispose() {
-        this.disposing ??= this.stop();
-        return this.disposing;
-    }
-    async stop() {
-        // Removed first, so a second Ctrl+C / SIGTERM gets Node's default: exit now.
-        this.removeSignalHandlers();
-        this.logger.info("Stopping");
-        // Hosted services hear the signal at once, so background work winds down while HTTP drains.
-        this.hostedServices?.abort();
-        try {
-            // HTTP first: in-flight requests still need the services (DB pools etc.) that
-            // disposing the container would close.
-            await this.httpProvider?.stop();
-            // Hosted services next, while what they use is still open.
-            await this.hostedServices?.stop();
-        } finally{
-            this.disposingContainer = true;
-            await this.container[Symbol.asyncDispose]();
-            await _scribe.scribe.stop();
-        }
-    }
-    stopOnSignals(options) {
-        const signals = options?.shutdownSignals ?? DEFAULT_SHUTDOWN_SIGNALS;
-        const timeoutMs = options?.shutdownTimeoutMs ?? DEFAULT_SHUTDOWN_TIMEOUT_MS;
-        if (signals === false || signals.length === 0) return;
-        this.signalHandler = (signal)=>{
-            this.logger.info(`Received ${signal}; finishing in-flight requests`);
-            // console.error, not the logger: scribe may be the thing that's stuck.
-            const timer = setTimeout(()=>{
-                console.error(`Shutdown did not finish within ${timeoutMs}ms; exiting.`);
-                process.exit(1);
-            }, timeoutMs);
-            timer.unref();
-            this.dispose().then(()=>clearTimeout(timer), (error)=>{
-                clearTimeout(timer);
-                console.error("Shutdown failed:", error);
-                process.exit(1);
-            });
-        };
-        this.shutdownSignals = signals;
-        for (const signal of signals)process.on(signal, this.signalHandler);
-    }
-    removeSignalHandlers() {
-        if (!this.signalHandler) return;
-        for (const signal of this.shutdownSignals)process.off(signal, this.signalHandler);
-    }
-    async getPort(options) {
-        const port = options?.port ?? (await this.configurationService?.get(ApiConfiguration))?.port ?? DEFAULT_PORT;
-        return port;
-    }
-}
-App = _ts_decorate([
-    _ts_param(0, (0, _decorators.inject)(_crucible.LifetimeScopeToken)),
-    _ts_param(1, (0, _decorators.inject)(_configuration.ConfigurationServiceToken)),
-    _ts_param(1, (0, _decorators.optional)()),
-    _ts_param(2, (0, _decorators.inject)(_const.HttpProviderToken)),
-    _ts_param(2, (0, _decorators.optional)()),
-    _ts_param(3, (0, _decorators.inject)(_const.HostedServiceHostToken)),
-    _ts_param(3, (0, _decorators.optional)()),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof LifetimeScope === "undefined" ? Object : LifetimeScope,
-        typeof IConfigurationService === "undefined" ? Object : IConfigurationService,
-        typeof HttpProvider === "undefined" ? Object : HttpProvider,
-        typeof HostedServiceHost === "undefined" ? Object : HostedServiceHost
-    ])
-], App);

package/commonjs/src/app/index.js

@@ -1,19 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-_export_star(require("./app.js"), exports);
-_export_star(require("./module.js"), exports);
-function _export_star(from, to) {
-    Object.keys(from).forEach(function(k) {
-        if (k !== "default" && !Object.prototype.hasOwnProperty.call(to, k)) {
-            Object.defineProperty(to, k, {
-                enumerable: true,
-                get: function() {
-                    return from[k];
-                }
-            });
-        }
-    });
-    return from;
-}

package/commonjs/src/app/module.js

@@ -1,17 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "Module", {
-    enumerable: true,
-    get: function() {
-        return Module;
-    }
-});
-class Module {
-    constructor(data){
-        Object.assign(this, data);
-    }
-    entities;
-    repositories;
-}

package/commonjs/src/auth/ability.js

@@ -1,54 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get ADMIN_ROLE () {
-        return ADMIN_ROLE;
-    },
-    get createPrincipalFromPayload () {
-        return createPrincipalFromPayload;
-    },
-    get defineAbilitiesFor () {
-        return defineAbilitiesFor;
-    }
-});
-const _ability = require("@casl/ability");
-const ADMIN_ROLE = "admin";
-function defineAbilitiesFor(principal) {
-    const { can, build } = new _ability.AbilityBuilder(_ability.createMongoAbility);
-    if (principal.roles?.includes(ADMIN_ROLE)) {
-        can("manage", "all");
-        return build();
-    }
-    for (const scope of principal.scopes ?? []){
-        const [action, subject] = scope.split(":");
-        if (action && subject) can(action, subject);
-    }
-    return build();
-}
-function createPrincipalFromPayload(payload) {
-    const sub = typeof payload.sub === "string" ? payload.sub : "";
-    const fromScopeClaim = typeof payload.scope === "string" ? payload.scope.split(" ").filter(Boolean) : Array.isArray(payload.scopes) ? payload.scopes.filter((s)=>typeof s === "string") : [];
-    const fromPermissions = Array.isArray(payload.permissions) ? payload.permissions.filter((s)=>typeof s === "string") : [];
-    const merged = [
-        ...new Set([
-            ...fromScopeClaim,
-            ...fromPermissions
-        ])
-    ];
-    const scopes = merged.length > 0 ? merged : undefined;
-    const roles = Array.isArray(payload.roles) ? payload.roles.filter((r)=>typeof r === "string") : undefined;
-    return {
-        ...payload,
-        sub,
-        roles: roles && roles.length > 0 ? roles : undefined,
-        scopes
-    };
-}

package/commonjs/src/auth/auth.config.js

@@ -1,23 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "AuthConfig", {
-    enumerable: true,
-    get: function() {
-        return AuthConfig;
-    }
-});
-class AuthConfig {
-    /** OIDC discovery URL — the issuer base URL, e.g. https://accounts.google.com.
-	 *  The framework appends `/.well-known/openid-configuration` automatically.
-	 *  Use this instead of `jwksUrl` for any standard OIDC-compliant IdP.
-	 */ discoveryUrl;
-    /** JWKS endpoint URL (RS256 / ES256 via remote key set). */ jwksUrl;
-    /** PEM-encoded public key or JWK JSON string (RS256 / ES256 static key). */ publicKey;
-    algorithms;
-    /** Shared secret for HS256. */ secret;
-    /** Issuer claim to validate (all non-devStatic variants). */ issuer;
-    /** Audience claim to validate (all non-devStatic variants). */ audience;
-    /** Static principal injected for every request (development only). */ devStatic;
-}

package/commonjs/src/auth/auth.extensions.js

@@ -1,106 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get ADMIN_ROLE () {
-        return _ability.ADMIN_ROLE;
-    },
-    get BuilderExtensions () {
-        return BuilderExtensions;
-    },
-    get createPrincipalFromPayload () {
-        return _ability.createPrincipalFromPayload;
-    },
-    get defineAbilitiesFor () {
-        return _ability.defineAbilitiesFor;
-    }
-});
-const _extensibility = require("@decohere/core/extensibility");
-const _builder = require("../builder/builder.js");
-const _const = require("../const.js");
-const _ability = require("./ability.js");
-const _authconfig = require("./auth.config.js");
-const _authtypes = require("./auth.types.js");
-const _caslauthorizationservice = require("./casl-authorization.service.js");
-const _tokenservice = require("./token-service.js");
-function _ts_decorate(decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for(var i = decorators.length - 1; i >= 0; i--)if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-}
-function _ts_metadata(k, v) {
-    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
-}
-class BuilderExtensions {
-    static withAuth(builder, abilityFactory = _ability.defineAbilitiesFor, options) {
-        builder.registerPreBuildStep(async (configService, containerBuilder)=>{
-            const authConfig = await configService.get(_authconfig.AuthConfig);
-            const tokenConfig = toTokenServiceConfig(authConfig);
-            const tokenService = new _tokenservice.TokenService(tokenConfig, options?.principalMapper);
-            containerBuilder.registerSingleton(_const.TokenServiceToken, tokenService);
-            containerBuilder.registerSingleton(_const.AuthorizationServiceToken, new _caslauthorizationservice.CaslAuthorizationService(abilityFactory, tokenService));
-        });
-        return builder;
-    }
-}
-_ts_decorate([
-    (0, _extensibility.extension)(_builder.Builder),
-    _ts_metadata("design:type", Function),
-    _ts_metadata("design:paramtypes", [
-        typeof _builder.Builder === "undefined" ? Object : _builder.Builder,
-        typeof AbilityFactory === "undefined" ? Object : AbilityFactory,
-        typeof WithAuthOptions === "undefined" ? Object : WithAuthOptions
-    ]),
-    _ts_metadata("design:returntype", void 0)
-], BuilderExtensions, "withAuth", null);
-function toTokenServiceConfig(config) {
-    // Prefer real verification strategies over devStatic so a leftover
-    // development block cannot disable OIDC/JWKS in any environment.
-    if (config.discoveryUrl != null) {
-        (0, _authtypes.assertNonEmptyAudience)(config.audience);
-        return {
-            discoveryUrl: config.discoveryUrl,
-            audience: config.audience
-        };
-    }
-    if (config.jwksUrl != null) {
-        (0, _authtypes.assertNonEmptyAudience)(config.audience);
-        return {
-            jwksUrl: config.jwksUrl,
-            issuer: config.issuer,
-            audience: config.audience
-        };
-    }
-    if (config.publicKey != null) {
-        (0, _authtypes.assertNonEmptyAudience)(config.audience);
-        return {
-            publicKey: config.publicKey,
-            algorithms: config.algorithms,
-            issuer: config.issuer,
-            audience: config.audience
-        };
-    }
-    if (config.secret != null) {
-        (0, _authtypes.assertNonEmptyAudience)(config.audience);
-        return {
-            secret: config.secret,
-            issuer: config.issuer,
-            audience: config.audience
-        };
-    }
-    if (config.devStatic != null) {
-        (0, _authtypes.assertDevStaticAllowed)();
-        return {
-            devStatic: config.devStatic
-        };
-    }
-    throw new Error("AuthConfig must specify one of: discoveryUrl, jwksUrl, publicKey, secret, or devStatic");
-}

package/commonjs/src/auth/auth.types.js

@@ -1,65 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-function _export(target, all) {
-    for(var name in all)Object.defineProperty(target, name, {
-        enumerable: true,
-        get: Object.getOwnPropertyDescriptor(all, name).get
-    });
-}
-_export(exports, {
-    get assertDevStaticAllowed () {
-        return assertDevStaticAllowed;
-    },
-    get assertNonEmptyAudience () {
-        return assertNonEmptyAudience;
-    },
-    get isDevStaticConfig () {
-        return isDevStaticConfig;
-    },
-    get isDevelopmentNodeEnv () {
-        return isDevelopmentNodeEnv;
-    },
-    get isDiscoveryConfig () {
-        return isDiscoveryConfig;
-    },
-    get isJwksConfig () {
-        return isJwksConfig;
-    },
-    get isPublicKeyConfig () {
-        return isPublicKeyConfig;
-    },
-    get isSecretConfig () {
-        return isSecretConfig;
-    }
-});
-function isDiscoveryConfig(config) {
-    return "discoveryUrl" in config;
-}
-function isDevStaticConfig(config) {
-    return "devStatic" in config;
-}
-function isJwksConfig(config) {
-    return "jwksUrl" in config;
-}
-function isPublicKeyConfig(config) {
-    return "publicKey" in config;
-}
-function isSecretConfig(config) {
-    return "secret" in config;
-}
-function isDevelopmentNodeEnv(nodeEnv = process.env.NODE_ENV) {
-    const env = nodeEnv?.toLowerCase();
-    return env === "development" || env === "dev";
-}
-function assertDevStaticAllowed(nodeEnv = process.env.NODE_ENV) {
-    if (!isDevelopmentNodeEnv(nodeEnv)) {
-        throw new Error(`AuthConfig.devStatic is only allowed when NODE_ENV is "development" or "dev" (got ${JSON.stringify(nodeEnv ?? "")}).`);
-    }
-}
-function assertNonEmptyAudience(audience) {
-    if (typeof audience !== "string" || audience.trim().length === 0) {
-        throw new Error(`JWT audience must be a non-empty string (got ${JSON.stringify(audience)}). ` + "Empty audience disables aud validation and accepts tokens minted for other APIs.");
-    }
-}

package/commonjs/src/auth/casl-authorization.service.js

@@ -1,36 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "CaslAuthorizationService", {
-    enumerable: true,
-    get: function() {
-        return CaslAuthorizationService;
-    }
-});
-const _httptypes = require("../routing/http.types.js");
-class CaslAuthorizationService {
-    factory;
-    tokenService;
-    constructor(factory, tokenService){
-        this.factory = factory;
-        this.tokenService = tokenService;
-    }
-    async authorizeRequest(request, action, subject) {
-        const principal = await this.authenticateRequest(request);
-        await this.authorize(principal, action, subject);
-        return principal;
-    }
-    async authenticateRequest(request) {
-        if (!this.tokenService) {
-            throw new Error("CaslAuthorizationService requires a TokenService to authenticate requests. Register it via .withAuth().");
-        }
-        return this.tokenService.verifyRequest(request);
-    }
-    async authorize(principal, action, subject) {
-        const ability = this.factory(principal);
-        if (ability.cannot(action, subject)) {
-            throw new _httptypes.ForbiddenError(`Cannot perform "${action}" on "${subject}"`);
-        }
-    }
-}

package/commonjs/src/auth/index.js

@@ -1,23 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-_export_star(require("./ability.js"), exports);
-_export_star(require("./auth.config.js"), exports);
-_export_star(require("./auth.types.js"), exports);
-_export_star(require("./casl-authorization.service.js"), exports);
-_export_star(require("./principal-provider.js"), exports);
-_export_star(require("./token-service.js"), exports);
-function _export_star(from, to) {
-    Object.keys(from).forEach(function(k) {
-        if (k !== "default" && !Object.prototype.hasOwnProperty.call(to, k)) {
-            Object.defineProperty(to, k, {
-                enumerable: true,
-                get: function() {
-                    return from[k];
-                }
-            });
-        }
-    });
-    return from;
-}

package/commonjs/src/auth/principal-provider.js

@@ -1,19 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "PrincipalProvider", {
-    enumerable: true,
-    get: function() {
-        return PrincipalProvider;
-    }
-});
-class PrincipalProvider {
-    _principal;
-    get currentPrincipal() {
-        return this._principal;
-    }
-    setPrincipal(principal) {
-        this._principal = principal;
-    }
-}