@grest-ts/http 0.0.47 → 0.0.49

package/dist/src/schema/httpSchema.js

@@ -41,54 +41,6 @@ class GGHttpSchemaBuilder {
         this._middlewares.push(middleware);
         return this;
     }
-    useHeader(contextKey) {
-        const codec = contextKey.getCodec("http");
-        if (!codec) {
-            throw new Error(`Context key '${contextKey.name}' does not have an 'http-header' codec registered.`);
-        }
-        // Build the typed header map from codec.inputSchema — the IsObject({headerName: schema})
-        // that describes which headers this codec reads and what format each value has.
-        const inputSchema = codec.inputSchema;
-        const headers = {};
-        if (inputSchema) {
-            const desc = inputSchema.toSchemaDescription();
-            if (desc.node.kind === 'object') {
-                for (const [k, fieldDesc] of Object.entries(desc.node.properties)) {
-                    headers[k] = fieldDesc.schema;
-                }
-            }
-        }
-        const middleware = {
-            headers,
-            responseHeaders: {},
-            updateRequest(req) {
-                const contextValue = contextKey.get();
-                if (contextValue !== undefined) {
-                    const result = codec.decode(contextValue);
-                    if (result.success) {
-                        Object.assign(req.headers, result.value);
-                    }
-                }
-                else {
-                    const emptyResult = codec.decode({});
-                    if (emptyResult.success) {
-                        for (const key of Object.keys(emptyResult.value)) {
-                            delete req.headers[key];
-                        }
-                    }
-                }
-            },
-            parseRequest(req) {
-                const headers = req.headers;
-                const result = codec.encode(headers);
-                if (result.success) {
-                    contextKey.set(result.value);
-                }
-            }
-        };
-        this._middlewares.push(middleware);
-        return this;
-    }
     routes(mapping) {
         return new GGHttpSchema(this._pathPrefix, this._contract, mapping, this._middlewares);
     }

package/dist/src/schema/httpSchema.js.map

@@ -1 +1 @@
-{"version":3,"file":"httpSchema.js","sourceRoot":"","sources":["../../../src/schema/httpSchema.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAKzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,UAAU,CACtB,QAAoC;IAEpC,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,mBAAmB;IAEJ,SAAS,CAA4B;IAC9C,WAAW,GAAW,EAAE,CAAA;IACxB,YAAY,GAAgC,EAAE,CAAA;IAEtD,YAAY,QAAoC;QAC5C,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,MAAc;QACrB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAA;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,GAAG,CAAsC,UAAa;QAClD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAClC,OAAO,IAA+D,CAAA;IAC1E,CAAC;IAED,SAAS,CAAQ,UAA+B;QAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,gBAAgB,UAAU,CAAC,IAAI,oDAAoD,CAAC,CAAC;QACzG,CAAC;QAED,yFAAyF;QACzF,gFAAgF;QAChF,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACtC,MAAM,OAAO,GAAiD,EAAE,CAAC;QACjE,IAAI,WAAW,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,WAAW,CAAC,mBAAmB,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBAChE,OAAO,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAsC,CAAC;gBAClE,CAAC;YACL,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAA8B;YAC1C,OAAO;YACP,eAAe,EAAE,EAAE;YACnB,aAAa,CAAC,GAAkB;gBAC5B,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;gBACtC,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;oBAC1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACjB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;oBAC7C,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACJ,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,EAAW,CAAC,CAAC;oBAC9C,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;wBACtB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAe,CAAC,EAAE,CAAC;4BACzD,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;wBAC5B,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;YACD,YAAY,CAAC,GAAyB;gBAClC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAiC,CAAC;gBACtD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACjC,CAAC;YACL,CAAC;SACJ,CAAC;QAEF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACnC,OAAO,IAAmE,CAAC;IAC/E,CAAC;IAED,MAAM,CAAC,OAAgD;QACnD,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACzF,CAAC;CACJ"}
+{"version":3,"file":"httpSchema.js","sourceRoot":"","sources":["../../../src/schema/httpSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAIzD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,UAAU,CACtB,QAAoC;IAEpC,OAAO,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAA;AAC5C,CAAC;AAED,MAAM,mBAAmB;IAEJ,SAAS,CAA4B;IAC9C,WAAW,GAAW,EAAE,CAAA;IACxB,YAAY,GAA4B,EAAE,CAAA;IAElD,YAAY,QAAoC;QAC5C,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC;IAC9B,CAAC;IAED,UAAU,CAAC,MAAc;QACrB,IAAI,CAAC,WAAW,GAAG,MAAM,CAAA;QACzB,OAAO,IAAI,CAAA;IACf,CAAC;IAED,GAAG,CAAkC,UAAa;QAC9C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAClC,OAAO,IAA+D,CAAA;IAC1E,CAAC;IAED,MAAM,CAAC,OAAgD;QACnD,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACzF,CAAC;CACJ"}

package/dist/src/server/GGHttp.d.ts

@@ -1,20 +1,7 @@
 import { GGHttpSchema } from "../schema/GGHttpSchema";
 import { GGContractApiDefinition, GGContractImplementation } from "@grest-ts/schema";
-import { GGHttpServerMiddleware } from "./GGHttpSchema.startServer";
+import type { GGTransportMiddleware } from "@grest-ts/context";
 import { GGHttpServer } from "./GGHttpServer";
-/**
- * Resolves the caller's permission scopes for the current request. The function
- * is called once between transport middleware and the handler. Sync or async —
- * both supported (the gate awaits).
- *
- * Return `null` when no caller identity is available (the gate will throw
- * NOT_AUTHORIZED for non-public methods). Return a (possibly empty) set
- * otherwise; the gate will call satisfies() against the method's permission.
- *
- * The resolver should read whatever app-defined context the upstream auth
- * middleware populated — it should NOT parse the token itself.
- */
-export type GGScopeResolver = () => ReadonlySet<string> | null | Promise<ReadonlySet<string> | null>;
 export declare class GGHttp<TContext = undefined> {
     /**
      * Protected (not private) so that plugin modules can access the underlying server
@@ -23,19 +10,8 @@ export declare class GGHttp<TContext = undefined> {
      */
     protected readonly httpServer: GGHttpServer;
     private readonly middlewares;
-    private permissionResolver?;
     constructor(httpServer: GGHttpServer);
-    use<M extends GGHttpServerMiddleware>(middleware: M): GGHttp<TContext | M>;
-    /**
-     * Register a scope resolver. Subsequent .http(...) calls capture this
-     * resolver and use it to gate every request against the contract's
-     * declared `permission`.
-     *
-     * Calling order matters: .use(auth) → .usePermissions(getScopes) → .http(api).
-     * If .http() runs before .usePermissions(), the call sees no resolver — and
-     * the startup check will hard-fail if its schema has any non-public method.
-     */
-    usePermissions(resolver: GGScopeResolver): this;
+    use<M extends GGTransportMiddleware>(middleware: M): GGHttp<TContext | M>;
     http<TContract extends GGContractApiDefinition, TSchemaContext>(schema: GGHttpSchema<TContract, TSchemaContext>, implementation: GGContractImplementation<TContract>): this;
 }
 //# sourceMappingURL=GGHttp.d.ts.map

package/dist/src/server/GGHttp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GGHttp.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAC,uBAAuB,EAAE,wBAAwB,EAAC,MAAM,kBAAkB,CAAC;AACnF,OAAO,EAAC,sBAAsB,EAAC,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAE5C;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,eAAe,GACvB,MAAM,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAA;AAE1E,qBAAa,MAAM,CAAC,QAAQ,GAAG,SAAS;IAEpC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAA;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;IAC5D,OAAO,CAAC,kBAAkB,CAAC,CAAkB;gBAEjC,UAAU,EAAE,YAAY;IAI7B,GAAG,CAAC,CAAC,SAAS,sBAAsB,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;IAKjF;;;;;;;;OAQG;IACI,cAAc,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI;IAK/C,IAAI,CAAC,SAAS,SAAS,uBAAuB,EAAE,cAAc,EACjE,MAAM,EAAE,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAC/C,cAAc,EAAE,wBAAwB,CAAC,SAAS,CAAC,GACpD,IAAI;CAQV"}
+{"version":3,"file":"GGHttp.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAC,uBAAuB,EAAE,wBAAwB,EAAC,MAAM,kBAAkB,CAAC;AACnF,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAE5C,qBAAa,MAAM,CAAC,QAAQ,GAAG,SAAS;IAEpC;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAA;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;gBAE/C,UAAU,EAAE,YAAY;IAI7B,GAAG,CAAC,CAAC,SAAS,qBAAqB,EAAE,UAAU,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;IAKzE,IAAI,CAAC,SAAS,SAAS,uBAAuB,EAAE,cAAc,EACjE,MAAM,EAAE,YAAY,CAAC,SAAS,EAAE,cAAc,CAAC,EAC/C,cAAc,EAAE,wBAAwB,CAAC,SAAS,CAAC,GACpD,IAAI;CAOV"}

package/dist/src/server/GGHttp.js

@@ -6,7 +6,6 @@ export class GGHttp {
      */
     httpServer;
     middlewares = [];
-    permissionResolver;
     constructor(httpServer) {
         this.httpServer = httpServer;
     }
@@ -14,24 +13,10 @@ export class GGHttp {
         this.middlewares.push(middleware);
         return this;
     }
-    /**
-     * Register a scope resolver. Subsequent .http(...) calls capture this
-     * resolver and use it to gate every request against the contract's
-     * declared `permission`.
-     *
-     * Calling order matters: .use(auth) → .usePermissions(getScopes) → .http(api).
-     * If .http() runs before .usePermissions(), the call sees no resolver — and
-     * the startup check will hard-fail if its schema has any non-public method.
-     */
-    usePermissions(resolver) {
-        this.permissionResolver = resolver;
-        return this;
-    }
     http(schema, implementation) {
         schema.register(implementation, {
             http: this.httpServer,
             middlewares: this.middlewares,
-            permissionResolver: this.permissionResolver,
         });
         return this;
     }

package/dist/src/server/GGHttp.js.map

@@ -1 +1 @@
-{"version":3,"file":"GGHttp.js","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"AAoBA,MAAM,OAAO,MAAM;IAEf;;;;OAIG;IACgB,UAAU,CAAc;IAC1B,WAAW,GAA6B,EAAE,CAAC;IACpD,kBAAkB,CAAmB;IAE7C,YAAY,UAAwB;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IAEM,GAAG,CAAmC,UAAa;QACtD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAW,CAAC;IACvB,CAAC;IAED;;;;;;;;OAQG;IACI,cAAc,CAAC,QAAyB;QAC3C,IAAI,CAAC,kBAAkB,GAAG,QAAQ,CAAC;QACnC,OAAO,IAAI,CAAC;IAChB,CAAC;IAEM,IAAI,CACP,MAA+C,EAC/C,cAAmD;QAEnD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC9C,CAAC,CAAC;QACH,OAAO,IAAW,CAAC;IACvB,CAAC;CACJ"}
+{"version":3,"file":"GGHttp.js","sourceRoot":"","sources":["../../../src/server/GGHttp.ts"],"names":[],"mappings":"AAKA,MAAM,OAAO,MAAM;IAEf;;;;OAIG;IACgB,UAAU,CAAc;IAC1B,WAAW,GAA4B,EAAE,CAAC;IAE3D,YAAY,UAAwB;QAChC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IAEM,GAAG,CAAkC,UAAa;QACrD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,IAAW,CAAC;IACvB,CAAC;IAEM,IAAI,CACP,MAA+C,EAC/C,cAAmD;QAEnD,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC5B,IAAI,EAAE,IAAI,CAAC,UAAU;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW;SAChC,CAAC,CAAC;QACH,OAAO,IAAW,CAAC;IACvB,CAAC;CACJ"}

package/dist/src/server/GGHttpSchema.startServer.d.ts

@@ -3,8 +3,8 @@
  * This file should only be imported in server (Node.js) context.
  */
 import { GGContractApiDefinition, GGContractImplementation } from "@grest-ts/schema";
+import { type GGTransportMiddleware } from "@grest-ts/context";
 import { GGHttpServer } from "./GGHttpServer";
-import type { GGScopeResolver } from "./GGHttp";
 export interface GGHttpSchemaConfig {
     /**
      * The HTTP request handler to register with.
@@ -13,16 +13,7 @@ export interface GGHttpSchemaConfig {
     /**
      * Additional middlewares to apply to all routes.
      */
-    middlewares?: GGHttpServerMiddleware[];
-    /**
-     * Optional scope resolver. When set, the gate calls it once per request,
-     * populates GG_PERMISSIONS, and rejects requests whose contract permission
-     * is not satisfied by the resolved scopes.
-     */
-    permissionResolver?: GGScopeResolver;
-}
-export interface GGHttpServerMiddleware {
-    process?(): Promise<void>;
+    middlewares?: GGTransportMiddleware[];
 }
 declare module "../schema/GGHttpSchema" {
     interface GGHttpSchema<TContract extends GGContractApiDefinition> {

package/dist/src/server/GGHttpSchema.startServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GGHttpSchema.startServer.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttpSchema.startServer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAA0D,uBAAuB,EAAE,wBAAwB,EAAqF,MAAM,kBAAkB,CAAC;AAShO,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAG5C,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,UAAU,CAAC;AAE9C,MAAM,WAAW,kBAAkB;IAC/B;;OAEG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;OAEG;IACH,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACvC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,eAAe,CAAC;CACxC;AAED,MAAM,WAAW,sBAAsB;IACnC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAC5B;AAED,OAAO,QAAQ,wBAAwB,CAAC;IACpC,UAAU,YAAY,CAAC,SAAS,SAAS,uBAAuB;QAC5D;;;;WAIG;QACH,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;KACnG;CACJ"}
+{"version":3,"file":"GGHttpSchema.startServer.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttpSchema.startServer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAQ,uBAAuB,EAAE,wBAAwB,EAAqC,MAAM,kBAAkB,CAAC;AAG9H,OAAO,EAA4B,KAAK,qBAAqB,EAAC,MAAM,mBAAmB,CAAC;AAOxF,OAAO,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAI5C,MAAM,WAAW,kBAAkB;IAC/B;;OAEG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;OAEG;IACH,WAAW,CAAC,EAAE,qBAAqB,EAAE,CAAC;CACzC;AAED,OAAO,QAAQ,wBAAwB,CAAC;IACpC,UAAU,YAAY,CAAC,SAAS,SAAS,uBAAuB;QAC5D;;;;WAIG;QACH,QAAQ,CAAC,cAAc,EAAE,wBAAwB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAA;KACnG;CACJ"}

package/dist/src/server/GGHttpSchema.startServer.js

@@ -4,16 +4,17 @@
  */
 import { GGLocator } from "@grest-ts/locator";
 import { GGHttpSchema } from "../schema/GGHttpSchema.js";
-import { describePermission, ERROR, FORBIDDEN, GG_NO_PERMISSIONS, GGPermissionChecker, NOT_AUTHORIZED, satisfies, SERVER_ERROR } from "@grest-ts/schema";
+import { ERROR, SERVER_ERROR } from "@grest-ts/schema";
 import { GG_DISCOVERY } from "@grest-ts/discovery";
 import { GGContext, GGContextStore } from "@grest-ts/context";
 import { GG_TRACE } from "@grest-ts/trace";
 import { GG_HTTP_REQUEST } from "./GG_HTTP_REQUEST.js";
+import { GG_COOKIE_WRITES } from "../schema/GGCookie.js";
 import { GG_METRICS } from "@grest-ts/metrics";
 import { GGHttpMetrics } from "./GGHttpMetrics.js";
 import { GG_HTTP_SERVER } from "./GG_HTTP_SERVER.js";
 import { GGLog } from "@grest-ts/logger";
-import { GG_PERMISSIONS } from "./GG_PERMISSIONS.js";
+import { GGHttpPermissionsChecker } from "../schema/GGHttpPermissionsChecker.js";
 GGHttpSchema.prototype.register = function (implementation, config) {
     return setupRoutes(this, implementation, config);
 };
@@ -30,9 +31,10 @@ function setupRoutes(httpSchema, implementation, config) {
     const apiMiddlewares = httpSchema.apiMiddlewares;
     const scope = GGLocator.getScope();
     const parentContext = GGContextStore.tryGetContext();
+    const permissionsChecker = new GGHttpPermissionsChecker(apiMiddlewares);
     for (const mw of apiMiddlewares) {
-        const hKeys = Object.keys(mw.headers);
-        const rhKeys = Object.keys(mw.responseHeaders);
+        const hKeys = Object.keys(mw.headers ?? {});
+        const rhKeys = Object.keys(mw.responseHeaders ?? {});
         if (hKeys.length)
             server.registerCorsHeaders(hKeys);
         if (rhKeys.length)
@@ -56,8 +58,6 @@ function setupRoutes(httpSchema, implementation, config) {
     // Info: Contract instance is auto-registered in GGLocator via patched implement()
     // @TODO This is not really used and only for testkit so it would register implementation of the contract... Not cool
     httpSchema.contract.implement(implementation);
-    if (config.permissionResolver)
-        server._markResolverWired(httpSchema);
     for (const methodName in httpSchema.codec) {
         // Wire format.
         const codec = httpSchema.codec[methodName];
@@ -74,36 +74,22 @@ function setupRoutes(httpSchema, implementation, config) {
         // build request mapping
         const requestParser = codec.createForServer({
             contract: contractFunctionSchema,
-            apiMiddlewares: apiMiddlewares,
-            serverMiddlewares: config.middlewares
+            middlewares: [...apiMiddlewares, ...(config.middlewares ?? [])]
         });
+        const cookieWriteNames = new Set((codec.updatesCookies ?? []).map(k => k.name));
         server.registerRoute(codec.method, pathPrefix + codec.path, async (req, res) => {
             scope.ensureEntered();
-            return new GGContext("REQ", parentContext).run(async () => {
+            return new GGContext("REQ", parentContext, true).run(async () => {
                 GG_TRACE.init();
                 GG_HTTP_REQUEST.set({ port: server.port, method: req.method, path: req.url });
+                GG_COOKIE_WRITES.set(cookieWriteNames);
                 const startTime = performance.now();
                 let rpcResult;
                 try {
-                    const rpcInput = await requestParser.parseRequest(req);
+                    const rawInput = await requestParser.readRequest(req);
+                    await permissionsChecker.assert(httpSchema.name, methodName, contractFunctionSchema.permission);
                     try {
-                        if (config.permissionResolver) {
-                            const scopes = await config.permissionResolver();
-                            if (scopes != null)
-                                GG_PERMISSIONS.set(new GGPermissionChecker(scopes));
-                            const required = contractFunctionSchema.permission;
-                            if (required !== undefined && required !== GG_NO_PERMISSIONS) {
-                                if (scopes == null)
-                                    throw new NOT_AUTHORIZED({
-                                        debugMessage: `${httpSchema.name}.${methodName} requires ${describePermission(required)} but no caller identity was resolved`
-                                    });
-                                if (!satisfies(required, scopes))
-                                    throw new FORBIDDEN({
-                                        debugMessage: `${httpSchema.name}.${methodName} requires ${describePermission(required)} — caller scopes did not satisfy`
-                                    });
-                            }
-                        }
-                        rpcResult = { success: true, type: "OK", data: await implFn(rpcInput) };
+                        rpcResult = { success: true, type: "OK", data: await implFn(requestParser.validateInput(rawInput)) };
                         // GGLog.debug(httpSchema, "Response", rpcResult) // This is very slow to log this (like 3x performance loss)
                     }
                     catch (error) {
@@ -123,7 +109,7 @@ function setupRoutes(httpSchema, implementation, config) {
                     metrics(rpcResult?.type, httpSchema.name, codec.method, pathPrefix, codec.path, startTime);
                 }
             });
-        });
+        }, `${httpSchema.name}.${methodName}`);
     }
 }
 function metrics(resultType, apiName, method, pathPrefix, pathSuffix, startTime) {

package/dist/src/server/GGHttpSchema.startServer.js.map

@@ -1 +1 @@
-{"version":3,"file":"GGHttpSchema.startServer.js","sourceRoot":"","sources":["../../../src/server/GGHttpSchema.startServer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAC,SAAS,EAAC,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAwD,YAAY,EAAC,MAAM,wBAAwB,CAAC;AAC3G,OAAO,EAAC,kBAAkB,EAAE,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAuE,mBAAmB,EAAE,cAAc,EAAM,SAAS,EAAE,YAAY,EAAC,MAAM,kBAAkB,CAAC;AAEhO,OAAO,EAAC,YAAY,EAAC,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAC,SAAS,EAAE,cAAc,EAAC,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAC,QAAQ,EAAC,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAC,eAAe,EAAC,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAC,UAAU,EAAC,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAC,aAAa,EAAC,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAC,KAAK,EAAC,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAmChD,YAAY,CAAC,SAAS,CAAC,QAAQ,GAAG,UAE9B,cAAmD,EACnD,MAA2B;IAE3B,OAAO,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;AACpD,CAAC,CAAA;AAED,SAAS,WAAW,CAChB,UAAmC,EACnC,cAAmD,EACnD,MAA2B;IAE3B,MAAM,KAAK,EAAE,CAAC;IACd,MAAM,CAAC,WAAW,KAAK,EAAE,CAAC;IAE1B,IAAI,CAAC,UAAU,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,IAAI,oBAAoB,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAA;IAEvI,MAAM,CAAC,eAAe,CAAC,UAAoC,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,GAAG,GAAG,UAAU,CAAC,UAAU,GAAG,GAAG,CAAA;IACpD,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAErD,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,KAAK,GAAgB,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;QAChB,YAAY,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;gBACnC,OAAO,EAAE,KAAK,CAAC,WAAW;gBAC1B,GAAG,EAAE,UAAU,CAAC,IAAI;gBACpB,UAAU,EAAE,UAAU;gBACtB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;aACpB,CAAC,CAAC,CAAC;IACR,CAAC,CAAC,CAAA;IAEF,kFAAkF;IAClF,qHAAqH;IACrH,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAE9C,IAAI,MAAM,CAAC,kBAAkB;QAAE,MAAM,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAErE,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACxC,eAAe;QACf,MAAM,KAAK,GAAgB,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACvD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,CAAC,IAAI,IAAI,UAAU,2BAA2B,CAAC,CAAA;QAEtG,0BAA0B;QAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,UAAU,CAAC,IAAI,IAAI,UAAU,qCAAqC,CAAC,CAAA;QAEvH,eAAe;QACf,MAAM,sBAAsB,GAAqB,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,UAA6B,CAAC,CAAA;QAC3G,IAAI,CAAC,sBAAsB;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,CAAC,IAAI,IAAI,UAAU,wCAAwC,CAAC,CAAA;QAEpI,wBAAwB;QACxB,MAAM,aAAa,GAA6C,KAAK,CAAC,eAAe,CAAC;YAClF,QAAQ,EAAE,sBAAsB;YAChC,cAAc,EAAE,cAAc;YAC9B,iBAAiB,EAAE,MAAM,CAAC,WAAW;SACxC,CAAC,CAAA;QACF,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAwB,EAAiB,EAAE;YACrI,KAAK,CAAC,aAAa,EAAE,CAAC;YACtB,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;gBACtD,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAChB,eAAe,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAC,CAAC,CAAC;gBAC5E,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;gBACnC,IAAI,SAA+C,CAAA;gBACnD,IAAI,CAAC;oBACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;oBACtD,IAAI,CAAC;wBACD,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;4BAC5B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAA;4BAChD,IAAI,MAAM,IAAI,IAAI;gCAAE,cAAc,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAA;4BACvE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAA;4BAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gCAC3D,IAAI,MAAM,IAAI,IAAI;oCAAE,MAAM,IAAI,cAAc,CAAC;wCACzC,YAAY,EAAE,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,aAAa,kBAAkB,CAAC,QAAQ,CAAC,sCAAsC;qCAChI,CAAC,CAAA;gCACF,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;oCAAE,MAAM,IAAI,SAAS,CAAC;wCAClD,YAAY,EAAE,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,aAAa,kBAAkB,CAAC,QAAQ,CAAC,kCAAkC;qCAC5H,CAAC,CAAA;4BACN,CAAC;wBACL,CAAC;wBACD,SAAS,GAAG,EAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAC,CAAA;wBACrE,6GAA6G;oBACjH,CAAC;oBAAC,OAAO,KAAc,EAAE,CAAC;wBACtB,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;wBACrC,IAAI,SAAS,YAAY,YAAY,IAAK,SAAoC,CAAC,eAAe,EAAE,EAAE,CAAC;4BAC/F,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;wBACtC,CAAC;oBACL,CAAC;oBACD,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA,CAAC,YAAY;gBACjE,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACtB,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA,CAAC,iBAAiB;oBAClE,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;gBACtC,CAAC;wBAAS,CAAC;oBACP,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC9F,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAA;IACN,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CACZ,UAAkB,EAClB,OAAe,EACf,MAAkB,EAClB,UAAkB,EAClB,UAAkB,EAClB,SAAiB;IAEjB,IAAI,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,GAAG,GAAG,GAAG,UAAU,GAAG,UAAU,CAAC;QACpD,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE;YAC1B,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,UAAU;SACrB,CAAC,CAAC;QACH,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;YACjE,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,IAAI;SACb,CAAC,CAAC;IACP,CAAC;AACL,CAAC"}
+{"version":3,"file":"GGHttpSchema.startServer.js","sourceRoot":"","sources":["../../../src/server/GGHttpSchema.startServer.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAC,SAAS,EAAC,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAwD,YAAY,EAAC,MAAM,wBAAwB,CAAC;AAC3G,OAAO,EAAC,KAAK,EAA2E,YAAY,EAAC,MAAM,kBAAkB,CAAC;AAE9H,OAAO,EAAC,YAAY,EAAC,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAC,SAAS,EAAE,cAAc,EAA6B,MAAM,mBAAmB,CAAC;AACxF,OAAO,EAAC,QAAQ,EAAC,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAC,eAAe,EAAC,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAC,gBAAgB,EAAC,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAC,UAAU,EAAC,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAC,aAAa,EAAC,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAC,cAAc,EAAC,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAC,KAAK,EAAC,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAC,wBAAwB,EAAC,MAAM,oCAAoC,CAAC;AAwB5E,YAAY,CAAC,SAAS,CAAC,QAAQ,GAAG,UAE9B,cAAmD,EACnD,MAA2B;IAE3B,OAAO,WAAW,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,CAAA;AACpD,CAAC,CAAA;AAED,SAAS,WAAW,CAChB,UAAmC,EACnC,cAAmD,EACnD,MAA2B;IAE3B,MAAM,KAAK,EAAE,CAAC;IACd,MAAM,CAAC,WAAW,KAAK,EAAE,CAAC;IAE1B,IAAI,CAAC,UAAU,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,UAAU,CAAC,IAAI,oBAAoB,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvE,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAA;IAEvI,MAAM,CAAC,eAAe,CAAC,UAAoC,CAAC,CAAC;IAE7D,MAAM,UAAU,GAAG,GAAG,GAAG,UAAU,CAAC,UAAU,GAAG,GAAG,CAAA;IACpD,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC;IACnC,MAAM,aAAa,GAAG,cAAc,CAAC,aAAa,EAAE,CAAC;IAErD,MAAM,kBAAkB,GAAG,IAAI,wBAAwB,CAAC,cAAc,CAAC,CAAC;IACxE,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,KAAK,GAAgB,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;QAChB,YAAY,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;gBACnC,OAAO,EAAE,KAAK,CAAC,WAAW;gBAC1B,GAAG,EAAE,UAAU,CAAC,IAAI;gBACpB,UAAU,EAAE,UAAU;gBACtB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;aACpB,CAAC,CAAC,CAAC;IACR,CAAC,CAAC,CAAA;IAEF,kFAAkF;IAClF,qHAAqH;IACrH,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;IAE9C,KAAK,MAAM,UAAU,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACxC,eAAe;QACf,MAAM,KAAK,GAAgB,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACvD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,CAAC,IAAI,IAAI,UAAU,2BAA2B,CAAC,CAAA;QAEtG,0BAA0B;QAC1B,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,UAAU,CAAC,IAAI,IAAI,UAAU,qCAAqC,CAAC,CAAA;QAEvH,eAAe;QACf,MAAM,sBAAsB,GAAqB,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,UAA6B,CAAC,CAAA;QAC3G,IAAI,CAAC,sBAAsB;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,UAAU,CAAC,IAAI,IAAI,UAAU,wCAAwC,CAAC,CAAA;QAEpI,wBAAwB;QACxB,MAAM,aAAa,GAA6C,KAAK,CAAC,eAAe,CAAC;YAClF,QAAQ,EAAE,sBAAsB;YAChC,WAAW,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;SAClE,CAAC,CAAA;QACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAC/E,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAyB,EAAE,GAAwB,EAAiB,EAAE;YACrI,KAAK,CAAC,aAAa,EAAE,CAAC;YACtB,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC5D,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAChB,eAAe,CAAC,GAAG,CAAC,EAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,EAAC,CAAC,CAAC;gBAC5E,gBAAgB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBACvC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;gBACnC,IAAI,SAA+C,CAAA;gBACnD,IAAI,CAAC;oBACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;oBACrD,MAAM,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,sBAAsB,CAAC,UAAU,CAAC,CAAA;oBAC/F,IAAI,CAAC;wBACD,SAAS,GAAG,EAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAC,CAAA;wBAClG,6GAA6G;oBACjH,CAAC;oBAAC,OAAO,KAAc,EAAE,CAAC;wBACtB,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;wBACrC,IAAI,SAAS,YAAY,YAAY,IAAK,SAAoC,CAAC,eAAe,EAAE,EAAE,CAAC;4BAC/F,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;wBACtC,CAAC;oBACL,CAAC;oBACD,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA,CAAC,YAAY;gBACjE,CAAC;gBAAC,OAAO,KAAc,EAAE,CAAC;oBACtB,SAAS,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;oBACpC,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA,CAAC,iBAAiB;oBAClE,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,CAAA;gBACtC,CAAC;wBAAS,CAAC;oBACP,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;gBAC9F,CAAC;YACL,CAAC,CAAC,CAAC;QACP,CAAC,EAAE,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC,CAAA;IAC1C,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CACZ,UAAkB,EAClB,OAAe,EACf,MAAkB,EAClB,UAAkB,EAClB,UAAkB,EAClB,SAAiB;IAEjB,IAAI,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,MAAM,GAAG,GAAG,GAAG,UAAU,GAAG,UAAU,CAAC;QACpD,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE;YAC1B,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,UAAU;SACrB,CAAC,CAAC;QACH,aAAa,CAAC,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;YACjE,GAAG,EAAE,OAAO;YACZ,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,IAAI;SACb,CAAC,CAAC;IACP,CAAC;AACL,CAAC"}

package/dist/src/server/GGHttpServer.d.ts

@@ -2,7 +2,9 @@ import http from "http";
 import { HttpMethod } from "@grest-ts/common";
 import { GGLocatorKey, GGLocatorScope } from "@grest-ts/locator";
 import type { GGHttpSchema } from "../schema/GGHttpSchema";
+import "../schema/GGWireContextKey.node";
 import { GGContractMethod, GGPermission } from "@grest-ts/schema";
+import type { GGTransportMiddleware } from "@grest-ts/context";
 type AnyWebSocketSchema = {
     name: string;
     path: string;
@@ -10,13 +12,37 @@ type AnyWebSocketSchema = {
         clientToServer: {
             methods: Record<string, GGContractMethod>;
         };
+        serverToClient: {
+            methods: Record<string, GGContractMethod>;
+        };
     };
-    middlewares: readonly unknown[];
+    middlewares: readonly GGTransportMiddleware[];
     connectPermission?: GGPermission;
 };
+export interface GGCorsConfig {
+    /**
+     * Allowed cross-origin origins. Either an exact-match list or a predicate.
+     * Only a matching Origin is echoed back — an arbitrary origin is never
+     * reflected (that would be a credential-leak / CSRF hole with credentials on).
+     */
+    origins: string[] | ((origin: string) => boolean);
+    /**
+     * When true, adds Access-Control-Allow-Credentials: true so the browser will
+     * send/store cross-origin cookies. Requires an exact-origin echo (never `*`),
+     * which this enforces by construction.
+     */
+    credentials?: boolean;
+}
 export interface GGHttpServerAdapterConfig {
     key?: GGLocatorKey<GGHttpServer>;
     port?: number;
+    /**
+     * Cross-origin policy. Omitted (default) keeps the permissive
+     * `Access-Control-Allow-Origin: *` with no credentials — backward compatible.
+     * When set, switches to allowlisted mode: only an Origin in `origins` is echoed
+     * (never `*`), and `credentials: true` enables cross-origin cookies.
+     */
+    cors?: GGCorsConfig;
     /**
      * If provided, the server listens over HTTPS using this cert+key. Both
      * must be PEM-encoded strings or Buffers. Leaving undefined keeps the
@@ -36,6 +62,7 @@ export declare class GGHttpServer {
     protected readonly scope: GGLocatorScope;
     protected readonly runtimeName: string;
     private readonly configuredPort;
+    private readonly cors?;
     private readonly _onStart;
     private readonly _onTeardown;
     /**
@@ -43,12 +70,9 @@ export declare class GGHttpServer {
      * Framework-internal — only setupRoutes() (in GGHttpSchema.startServer.ts) should push here.
      */
     private readonly _registeredSchemas;
-    /**
-     * All GGHttpSchema instances registered on this server, in registration order.
-     * Available from the moment compose() begins; frozen (no further push allowed) once start() is called.
-     */
-    get registeredSchemas(): ReadonlyArray<GGHttpSchema<any, any>>;
+    private readonly _registeredWebSocketSchemas;
     readonly httpServer: http.Server;
+    private readonly _routeOwners;
     private activeRequests;
     private router;
     private static readonly DEFAULT_CORS_HEADERS;
@@ -74,24 +98,31 @@ export declare class GGHttpServer {
     get port(): number | undefined;
     /** @internal Called by setupRoutes() during compose(). Do not call directly. */
     _registerSchema(schema: GGHttpSchema<any, any>): void;
-    private readonly _registeredWebSocketSchemas;
+    /**
+     * All GGHttpSchema instances registered on this server, in registration order.
+     * Available from the moment compose() begins; frozen (no further push allowed) once start() is called.
+     */
+    get registeredSchemas(): ReadonlyArray<GGHttpSchema<any, any>>;
+    /** @internal Called by GGWebSocketSchema.startServer(). Do not call directly. */
+    _registerWebSocketSchema(schema: AnyWebSocketSchema): void;
     /**
      * All GGWebSocketSchema instances registered on this server, in registration order.
      * Populated automatically by GGWebSocketSchema.startServer() / .register().
      */
     get registeredWebSocketSchemas(): ReadonlyArray<AnyWebSocketSchema>;
-    /** @internal Called by GGWebSocketSchema.startServer(). Do not call directly. */
-    _registerWebSocketSchema(schema: AnyWebSocketSchema): void;
-    private readonly _schemasWithResolver;
-    /** @internal Called by HTTP / WS register paths when a scope resolver is wired. */
-    _markResolverWired(schema: object): void;
-    private _checkPermissionsAtStart;
-    registerRoute(method: HttpMethod, path: string, handler: GGHttpRequestCallback): void;
+    registerRoute(method: HttpMethod, path: string, handler: GGHttpRequestCallback, owner?: string): void;
     start(): Promise<void>;
     teardown(): Promise<void>;
     onStart(callback: () => Promise<void> | void): this;
     onTeardown(callback: () => Promise<void> | void): this;
 }
 export type GGHttpRequestCallback = (req: http.IncomingMessage, res: http.ServerResponse) => Promise<void>;
+/**
+ * Computes CORS response headers for a request Origin. Pure (no req/res) so it is
+ * unit-testable. Default (no config) = permissive `*`, no credentials. With config =
+ * allowlisted: only a matching Origin is echoed (never `*`), `credentials` adds
+ * Allow-Credentials, and Vary: Origin is always set so caches key on the origin.
+ */
+export declare function corsResponseHeaders(origin: string | undefined, cors: GGCorsConfig | undefined, allowHeaders: string, exposeHeaders: string): Record<string, string>;
 export {};
 //# sourceMappingURL=GGHttpServer.d.ts.map

package/dist/src/server/GGHttpServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GGHttpServer.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttpServer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAC,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAY,YAAY,EAAE,cAAc,EAAuB,MAAM,mBAAmB,CAAC;AAIhG,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAwC,gBAAgB,EAAE,YAAY,EAAC,MAAM,kBAAkB,CAAC;AAGvG,KAAK,kBAAkB,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE;QAAC,cAAc,EAAE;YAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;SAAC,CAAA;KAAC,CAAC;IACxE,WAAW,EAAE,SAAS,OAAO,EAAE,CAAC;IAChC,iBAAiB,CAAC,EAAE,YAAY,CAAC;CACpC,CAAC;AAEF,MAAM,WAAW,yBAAyB;IACtC,GAAG,CAAC,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE;QACF,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;QACtB,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;KACxB,CAAC;CACL;AAED,qBAAa,YAAY;IAErB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACrD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IACzC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IAExC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IAErD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAgC;IAEnE;;;OAGG;IACH,IAAI,iBAAiB,IAAI,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAE7D;IAED,SAAgB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;IACxC,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,MAAM,CAAyC;IAEvD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAoB;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsD;IACnF,OAAO,CAAC,iBAAiB,CAAwD;IAEjF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,uBAAuB,CAAc;gBAEjC,MAAM,CAAC,EAAE,yBAAyB;IAsD9C;;;OAGG;IACI,mBAAmB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAa5D;;;OAGG;IACI,yBAAyB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAalE;;;OAGG;IACH,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,CAE7B;IAMD,gFAAgF;IACzE,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI;IAI5D,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAA4B;IAExE;;;OAGG;IACH,IAAI,0BAA0B,IAAI,aAAa,CAAC,kBAAkB,CAAC,CAElE;IAED,iFAAiF;IAC1E,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAIjE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAE1D,mFAAmF;IAC5E,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI/C,OAAO,CAAC,wBAAwB;IAoEzB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,GAAG,IAAI;IAI/E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBtB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB/B,OAAO,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;IAKnD,UAAU,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;CAIhE;AAED,MAAM,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"GGHttpServer.d.ts","sourceRoot":"","sources":["../../../src/server/GGHttpServer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAC,UAAU,EAAiB,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAY,YAAY,EAAE,cAAc,EAAuB,MAAM,mBAAmB,CAAC;AAIhG,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,wBAAwB,CAAC;AAIzD,OAAO,iCAAiC,CAAC;AACzC,OAAO,EAAC,gBAAgB,EAAE,YAAY,EAAC,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,mBAAmB,CAAC;AAG7D,KAAK,kBAAkB,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE;QACN,cAAc,EAAE;YAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;SAAC,CAAC;QAC5D,cAAc,EAAE;YAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;SAAC,CAAC;KAC/D,CAAC;IACF,WAAW,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC9C,iBAAiB,CAAC,EAAE,YAAY,CAAC;CACpC,CAAC;AAEF,MAAM,WAAW,YAAY;IACzB;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC;IAClD;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,yBAAyB;IACtC,GAAG,CAAC,EAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;;;;;OAOG;IACH,GAAG,CAAC,EAAE;QACF,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;QACtB,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;KACxB,CAAC;CACL;AAED,qBAAa,YAAY;IAErB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,SAAS,CAAC,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACrD,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IACzC,SAAS,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAe;IAErC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAyB;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAyB;IAErD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAgC;IACnE,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAA4B;IAExE,SAAgB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAC1D,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,MAAM,CAAyC;IAEvD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAoB;IAChE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsD;IACnF,OAAO,CAAC,iBAAiB,CAAwD;IAEjF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAqB;IACxD,OAAO,CAAC,uBAAuB,CAAc;gBAEjC,MAAM,CAAC,EAAE,yBAAyB;IAiD9C;;;OAGG;IACI,mBAAmB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAa5D;;;OAGG;IACI,yBAAyB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI;IAalE;;;OAGG;IACH,IAAI,IAAI,IAAI,MAAM,GAAG,SAAS,CAE7B;IAMD,gFAAgF;IACzE,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI;IAI5D;;;OAGG;IACH,IAAI,iBAAiB,IAAI,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAE7D;IAED,iFAAiF;IAC1E,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI;IAIjE;;;OAGG;IACH,IAAI,0BAA0B,IAAI,aAAa,CAAC,kBAAkB,CAAC,CAElE;IAEM,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI;IAa/F,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBtB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB/B,OAAO,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;IAKnD,UAAU,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;CAIhE;AAED,MAAM,MAAM,qBAAqB,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3G;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAC/B,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,IAAI,EAAE,YAAY,GAAG,SAAS,EAC9B,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,MAAM,GACtB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkBxB"}