@spinajs/http 2.0.481 → 2.0.484

package/lib/cjs/route-args/RouteArgs.js

@@ -43,6 +43,21 @@ function extractSchemaFromRuntimeType(runtimeType, validator) {
 }
 class RouteArgs {
     async tryHydrateParam(arg, routeParameter, route) {
+        // Enforce presence for params explicitly marked `{ required: true }` BEFORE
+        // the null/undefined skip below (absent optional params are intentionally
+        // not validated). Params without the flag keep the old optional behavior.
+        if (routeParameter.Options?.required === true && (arg === undefined || arg === null || arg === '')) {
+            throw new validation_1.ValidationFailed(`Parameter '${routeParameter.Name}' is required`, [
+                {
+                    propertyName: routeParameter.Name,
+                    message: `Parameter '${routeParameter.Name}' is required`,
+                    keyword: 'required',
+                    params: { missingParameter: routeParameter.Name },
+                    schemaPath: '#/required',
+                    instancePath: routeParameter.Name,
+                },
+            ]);
+        }
         let result = null;
         let schema = null;
         let hydrator = null;
@@ -61,14 +76,16 @@ class RouteArgs {
         }
         if (this.isRuntimeType(routeParameter)) {
             result = this.fromRuntimeType(routeParameter, arg);
-            if (schema) {
+            // absent optional params are not validated - validator treats null / undefined data as failure
+            if (schema && result !== null && result !== undefined) {
                 this.Validator.validate(schema, result);
             }
         }
         else {
             hydrator = this.getHydrator(routeParameter);
             result = hydrator ? arg : this.tryExtractObject(arg, routeParameter);
-            if (schema) {
+            // absent optional params are not validated - validator treats null / undefined data as failure
+            if (schema && result !== null && result !== undefined) {
                 this.Validator.validate(schema, result);
             }
             if (hydrator) {
@@ -93,13 +110,24 @@ class RouteArgs {
     }
     tryExtractObject(arg, param) {
         try {
-            if ((0, di_1.isClass)(param.RuntimeType)) {
-                return new param.RuntimeType(lodash_1.default.isString(arg) ? JSON.parse(arg) : arg);
-            }
-            else if (param.RuntimeType instanceof di_1.TypedArray) {
+            // TypedArray must be checked BEFORE isClass: a TypedArray instance's
+            // constructor is `class TypedArray`, so isClass() reports true for it and
+            // would (wrongly) try `new <instance>()`. Handle the typed-array case here.
+            if (param.RuntimeType instanceof di_1.TypedArray) {
                 const type = param.RuntimeType.Type;
                 const arrData = lodash_1.default.isString(arg) ? JSON.parse(arg) : arg;
-                return arrData ? arrData.map((x) => new type(x)) : [];
+                if (arrData === null || arrData === undefined) {
+                    return [];
+                }
+                if (!Array.isArray(arrData)) {
+                    // A typed-array param requires a JSON array; a non-array value is a
+                    // client error (400), not an uncaught TypeError from .map (500).
+                    throw new exceptions_1.InvalidArgument(`Parameter '${param.Name}' must be a JSON array`, param.Name);
+                }
+                return arrData.map((x) => new type(x));
+            }
+            else if ((0, di_1.isClass)(param.RuntimeType)) {
+                return new param.RuntimeType(lodash_1.default.isString(arg) ? JSON.parse(arg) : arg);
             }
             else if (param.RuntimeType.name === 'Object' || param.RuntimeType.name === 'Array') {
                 return lodash_1.default.isString(arg) ? JSON.parse(arg) : arg;
@@ -124,11 +152,23 @@ class RouteArgs {
             case 'String':
                 return arg;
             case 'Number':
-                return arg ? Number(arg) : undefined;
+                // Only treat truly-absent values as undefined — `0` is a valid number
+                // and must not be coerced away (JSON body can carry a literal 0).
+                return arg === undefined || arg === null || arg === '' ? undefined : Number(arg);
             case 'BigInt':
-                return BigInt(arg);
+                try {
+                    return BigInt(arg);
+                }
+                catch (err) {
+                    throw new exceptions_1.InvalidArgument(`Argument '${param.Name}' is not a valid integer`, err);
+                }
             case 'Boolean':
-                return arg ? (arg === 1 ? true : arg.toLowerCase() === 'true' ? true : false) : false;
+                // A JSON body can deliver a real boolean; return it as-is instead of
+                // calling String.toLowerCase on it (which threw). Query/param values
+                // arrive as strings and are matched case-insensitively.
+                if (typeof arg === 'boolean')
+                    return arg;
+                return arg ? arg === 1 || String(arg).toLowerCase() === 'true' : false;
             case 'Undefined':
                 return undefined;
             case 'Null':

package/lib/cjs/route-args/RouteArgs.js.map

@@ -1 +1 @@
-{"version":3,"file":"RouteArgs.js","sourceRoot":"","sources":["../../../src/route-args/RouteArgs.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAiBA,oEAaC;AA9BD,oCAAkE;AAIlE,oDAAuB;AACvB,oDAAoD;AACpD,oDAAsD;AAEtD;;;;;;;;GAQG;AACH,SAAgB,4BAA4B,CAAC,WAAgB,EAAE,SAAwB;IACrF,IAAI,WAAW,YAAY,eAAU,EAAE,CAAC;QACtC,MAAM,cAAc,GAAI,WAA+B,CAAC,IAAI,CAAC;QAC7D,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC3D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,UAAU;aAClB,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAeD,MAAsB,SAAS;IAUnB,KAAK,CAAC,eAAe,CAAC,GAAQ,EAAE,cAA+B,EAAE,KAAa;QACtF,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,QAAQ,GAAG,IAAI,CAAC;QAEpB,mDAAmD;QACnD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;QACjC,CAAC;aAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,CAAC;YAC3C,MAAM,GAAG,cAAc,CAAC,gBAAgB,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,4BAA4B,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YAEnD,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YAC5C,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAErE,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,GAAQ,EAAE,KAAsB,EAAE,QAAa;QAC9E,MAAM,SAAS,GAAG,MAAM,OAAE,CAAC,OAAO,CAAc,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrF,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAES,WAAW,CAAC,KAAsB;QAC1C,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,KAAK,CAAC,WAAW,YAAY,eAAU,EAAE,CAAC;YAC5C,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,qBAAqB,EAAG,KAAK,CAAC,WAA+B,CAAC,IAAI,CAAC,CAAC;QACrG,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,qBAAqB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAES,gBAAgB,CAAC,GAAQ,EAAE,KAAsB;QACzD,IAAI,CAAC;YACH,IAAI,IAAA,YAAO,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/B,OAAO,IAAK,KAAK,CAAC,WAAmB,CAAC,gBAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjF,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,YAAY,eAAU,EAAE,CAAC;gBACnD,MAAM,IAAI,GAAI,KAAK,CAAC,WAA+B,CAAC,IAAW,CAAC;gBAChE,MAAM,OAAO,GAAG,gBAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBACxD,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrF,OAAO,gBAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACjD,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAAe,CAAC,aAAa,KAAK,CAAC,IAAI,8BAA8B,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACrG,CAAC;YAED,mBAAmB;YACnB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAES,aAAa,CAAC,KAAsB;QAC5C,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/G,CAAC;IAES,eAAe,CAAC,KAAsB,EAAE,GAAQ;QACxD,QAAQ,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC/B,yDAAyD;YACzD,6DAA6D;YAC7D,KAAK,QAAQ;gBACX,OAAO,GAAG,CAAC;YACb,KAAK,QAAQ;gBACX,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvC,KAAK,QAAQ;gBACX,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,KAAK,SAAS;gBACZ,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,GAAc,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACpG,KAAK,WAAW;gBACd,OAAO,SAAS,CAAC;YACnB,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC;YACd;gBACE,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC,gBAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF;AA/GD,8BA+GC;AA7GW;IADT,IAAA,eAAU,GAAE;8BACQ,0BAAa;4CAAC"}
+{"version":3,"file":"RouteArgs.js","sourceRoot":"","sources":["../../../src/route-args/RouteArgs.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAiBA,oEAaC;AA9BD,oCAAkE;AAIlE,oDAAuB;AACvB,oDAAsE;AACtE,oDAAsD;AAEtD;;;;;;;;GAQG;AACH,SAAgB,4BAA4B,CAAC,WAAgB,EAAE,SAAwB;IACrF,IAAI,WAAW,YAAY,eAAU,EAAE,CAAC;QACtC,MAAM,cAAc,GAAI,WAA+B,CAAC,IAAI,CAAC;QAC7D,MAAM,UAAU,GAAG,SAAS,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAC3D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,UAAU;aAClB,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAeD,MAAsB,SAAS;IAUnB,KAAK,CAAC,eAAe,CAAC,GAAQ,EAAE,cAA+B,EAAE,KAAa;QACtF,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAK,cAAc,CAAC,OAAe,EAAE,QAAQ,KAAK,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC,EAAE,CAAC;YAC5G,MAAM,IAAI,6BAAgB,CAAC,cAAc,cAAc,CAAC,IAAI,eAAe,EAAE;gBAC3E;oBACE,YAAY,EAAE,cAAc,CAAC,IAAI;oBACjC,OAAO,EAAE,cAAc,cAAc,CAAC,IAAI,eAAe;oBACzD,OAAO,EAAE,UAAU;oBACnB,MAAM,EAAE,EAAE,gBAAgB,EAAE,cAAc,CAAC,IAAI,EAAE;oBACjD,UAAU,EAAE,YAAY;oBACxB,YAAY,EAAE,cAAc,CAAC,IAAI;iBAClC;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,QAAQ,GAAG,IAAI,CAAC;QAEpB,mDAAmD;QACnD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC;QACjC,CAAC;aAAM,IAAI,cAAc,CAAC,gBAAgB,EAAE,CAAC;YAC3C,MAAM,GAAG,cAAc,CAAC,gBAAgB,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,4BAA4B,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC;YACvC,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YAEnD,+FAA+F;YAC/F,IAAI,MAAM,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACtD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YAC5C,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;YAErE,+FAA+F;YAC/F,IAAI,MAAM,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACtD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,GAAQ,EAAE,KAAsB,EAAE,QAAa;QAC9E,MAAM,SAAS,GAAG,MAAM,OAAE,CAAC,OAAO,CAAc,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrF,OAAO,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAES,WAAW,CAAC,KAAsB;QAC1C,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,KAAK,CAAC,WAAW,YAAY,eAAU,EAAE,CAAC;YAC5C,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,qBAAqB,EAAG,KAAK,CAAC,WAA+B,CAAC,IAAI,CAAC,CAAC;QACrG,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,qBAAqB,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAES,gBAAgB,CAAC,GAAQ,EAAE,KAAsB;QACzD,IAAI,CAAC;YACH,qEAAqE;YACrE,0EAA0E;YAC1E,4EAA4E;YAC5E,IAAI,KAAK,CAAC,WAAW,YAAY,eAAU,EAAE,CAAC;gBAC5C,MAAM,IAAI,GAAI,KAAK,CAAC,WAA+B,CAAC,IAAW,CAAC;gBAChE,MAAM,OAAO,GAAG,gBAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;gBACxD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC9C,OAAO,EAAE,CAAC;gBACZ,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5B,oEAAoE;oBACpE,iEAAiE;oBACjE,MAAM,IAAI,4BAAe,CAAC,cAAc,KAAK,CAAC,IAAI,wBAAwB,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1F,CAAC;gBACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,IAAA,YAAO,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,OAAO,IAAK,KAAK,CAAC,WAAmB,CAAC,gBAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjF,CAAC;iBAAM,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrF,OAAO,gBAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YACjD,CAAC;YAED,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAAe,CAAC,aAAa,KAAK,CAAC,IAAI,8BAA8B,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACrG,CAAC;YAED,mBAAmB;YACnB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAES,aAAa,CAAC,KAAsB;QAC5C,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/G,CAAC;IAES,eAAe,CAAC,KAAsB,EAAE,GAAQ;QACxD,QAAQ,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAC/B,yDAAyD;YACzD,6DAA6D;YAC7D,KAAK,QAAQ;gBACX,OAAO,GAAG,CAAC;YACb,KAAK,QAAQ;gBACX,sEAAsE;gBACtE,kEAAkE;gBAClE,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnF,KAAK,QAAQ;gBACX,IAAI,CAAC;oBACH,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;gBACrB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,IAAI,4BAAe,CAAC,aAAa,KAAK,CAAC,IAAI,0BAA0B,EAAE,GAAG,CAAC,CAAC;gBACpF,CAAC;YACH,KAAK,SAAS;gBACZ,qEAAqE;gBACrE,qEAAqE;gBACrE,wDAAwD;gBACxD,IAAI,OAAO,GAAG,KAAK,SAAS;oBAAE,OAAO,GAAG,CAAC;gBACzC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;YACzE,KAAK,WAAW;gBACd,OAAO,SAAS,CAAC;YACnB,KAAK,MAAM;gBACT,OAAO,IAAI,CAAC;YACd;gBACE,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC,gBAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;CACF;AAtJD,8BAsJC;AApJW;IADT,IAAA,eAAU,GAAE;8BACQ,0BAAa;4CAAC"}

package/lib/cjs/route-args/index.d.ts

@@ -8,6 +8,8 @@ export * from './FromForm.js';
 export * from './FromHeaderArg.js';
 export * from './FromParams.js';
 export * from './FromQuery.js';
+export * from './FromXml.js';
+export * from './RequestContext.js';
 export * from './RouteArgs.js';
 export * from './RequestFields.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/route-args/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/route-args/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/route-args/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,oBAAoB,CAAC;AACnC,cAAc,iBAAiB,CAAC;AAChC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,cAAc,CAAC;AAC7B,cAAc,qBAAqB,CAAC;AACpC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC"}

package/lib/cjs/route-args/index.js

@@ -24,6 +24,8 @@ __exportStar(require("./FromForm.js"), exports);
 __exportStar(require("./FromHeaderArg.js"), exports);
 __exportStar(require("./FromParams.js"), exports);
 __exportStar(require("./FromQuery.js"), exports);
+__exportStar(require("./FromXml.js"), exports);
+__exportStar(require("./RequestContext.js"), exports);
 __exportStar(require("./RouteArgs.js"), exports);
 __exportStar(require("./RequestFields.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/route-args/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/route-args/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,qDAAmC;AACnC,mDAAiC;AACjC,gDAA8B;AAC9B,kDAAgC;AAChC,8CAA4B;AAC5B,gDAA8B;AAC9B,qDAAmC;AACnC,kDAAgC;AAChC,iDAA+B;AAC/B,iDAA+B;AAC/B,qDAAmC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/route-args/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,qDAAmC;AACnC,mDAAiC;AACjC,gDAA8B;AAC9B,kDAAgC;AAChC,8CAA4B;AAC5B,gDAA8B;AAC9B,qDAAmC;AACnC,kDAAgC;AAChC,iDAA+B;AAC/B,+CAA6B;AAC7B,sDAAoC;AACpC,iDAA+B;AAC/B,qDAAmC"}

package/lib/cjs/server.d.ts

@@ -5,7 +5,7 @@ import '@spinajs/templates-pug';
 import { Server as Http } from 'http';
 import { Server as Https } from 'https';
 import Express, { ErrorRequestHandler, RequestHandler } from 'express';
-import { ServerMiddleware, IHttpServerConfiguration } from './interfaces.js';
+import { ServerMiddleware, IHttpServerConfiguration, LifecycleState } from './interfaces.js';
 import './transformers/index.js';
 import './middlewares/ResponseTime.js';
 import './middlewares/RequestId.js';
@@ -25,6 +25,7 @@ export declare class HttpServer extends AsyncService {
     protected HttpConfig: IHttpServerConfiguration;
     protected HttpsEnabled: boolean;
     protected AppEnv: string;
+    protected ShutdownTimeout: number;
     /**
      * Express app instance
      */
@@ -38,6 +39,23 @@ export declare class HttpServer extends AsyncService {
      * Track active connections for cleanup
      */
     protected _connections: Set<any>;
+    /**
+     * Lifecycle state. All three public entry points ( start / stop / dispose )
+     * transition through it so double-close, restart and idempotency are decided
+     * in one place.
+     */
+    protected _state: LifecycleState;
+    /**
+     * The in-flight close promise, so concurrent / repeated stop() calls share one
+     * shutdown rather than each issuing a second Server.close().
+     */
+    protected _closePromise: Promise<void> | null;
+    /**
+     * After-middlewares ( NotFound / ErrorHandler / ServerTiming ... ) attach to
+     * the Express app exactly once per instance. Restart must not re-stack them.
+     */
+    protected _afterAttached: boolean;
+    get State(): LifecycleState;
     get Server(): Http | Https;
     /**
      * Logger for this module
@@ -57,11 +75,26 @@ export declare class HttpServer extends AsyncService {
      * Starts http server & express
      */
     start(): Promise<void>;
-    stop(): void;
     /**
-     * Enhanced dispose method with proper connection cleanup and timeout handling
+     * Emit a lifecycle event on the DI bus, isolating the state machine from a
+     * throwing subscriber. Container.emit is synchronous, so without this guard a
+     * listener that throws would pre-empt the caller - eg. a throwing
+     * `http.server.listening` listener runs before res() and would hang start(),
+     * and a throwing `http.server.closing` listener would escape stop().
+     */
+    protected _emit(event: string): void;
+    stop(): Promise<void>;
+    /**
+     * AsyncService teardown. HttpServer holds no resources beyond the socket
+     * server and its tracked connections, both released by stop(); this awaits it.
      */
     dispose(): Promise<void>;
+    /**
+     * Single shutdown path for both stop() and dispose(). Idempotent: repeated or
+     * concurrent calls share one Server.close() instead of issuing a second one
+     * ( which would reject with ERR_SERVER_NOT_RUNNING ).
+     */
+    protected _close(): Promise<void>;
     /**
      * Force close all tracked connections
      */

package/lib/cjs/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAiD,MAAM,aAAa,CAAC;AACtG,OAAO,EAAU,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAU,GAAG,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,wBAAwB,CAAC;AAEhC,OAAO,EAAE,MAAM,IAAI,IAAI,EAAoC,MAAM,MAAM,CAAC;AACxE,OAAO,EAAE,MAAM,IAAI,KAAK,EAAqC,MAAM,OAAO,CAAC;AAE3E,OAAO,OAAO,EAAE,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAIvE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,yBAAyB,CAAC;AACjC,OAAO,+BAA+B,CAAC;AACvC,OAAO,4BAA4B,CAAC;AACpC,OAAO,yBAAyB,CAAC;AACjC,OAAO,6BAA6B,CAAC;AACrC,OAAO,2BAA2B,CAAC;AACnC,OAAO,+BAA+B,CAAC;AACvC,OAAO,4BAA4B,CAAC;AACpC,OAAO,8BAA8B,CAAC;AACtC,OAAO,uBAAuB,CAAC;AAC/B,OAAO,qCAAqC,CAAC;AAC7C,OAAO,+BAA+B,CAAC;AAEvC,qBAEa,UAAW,SAAQ,YAAY;IAE1C,SAAS,CAAC,aAAa,EAAG,aAAa,CAAC;IAGxC,SAAS,CAAC,SAAS,EAAG,UAAU,CAAC;IAGjC,SAAS,CAAC,WAAW,EAAG,gBAAgB,EAAE,CAAC;IAG3C,SAAS,CAAC,UAAU,EAAG,wBAAwB,CAAC;IAGhD,SAAS,CAAC,YAAY,EAAG,OAAO,CAAC;IAKjC,SAAS,CAAC,MAAM,EAAG,MAAM,CAAC;IAE1B;;OAEG;IACH,SAAS,CAAC,OAAO,EAAG,OAAO,CAAC,OAAO,CAAC;IAEpC;;OAEG;IACH,SAAS,CAAC,WAAW,EAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,YAAY,EAAG,KAAK,CAAC;IAE/B;;OAEG;IACH,SAAS,CAAC,YAAY,WAAkB;IAExC,IAAW,MAAM,IAAI,IAAI,GAAG,KAAK,CAEhC;IAED;;OAEG;IAEH,SAAS,CAAC,GAAG,EAAG,GAAG,CAAC;;IAMP,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAsCrC;;OAEG;IACH,OAAO,CAAC,aAAa;IAuCrB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAc1B;;OAEG;IACI,KAAK;IAwBL,IAAI;IAMX;;OAEG;IACU,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA4CrC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAW9B;;;;OAIG;IACI,GAAG,CAAC,UAAU,EAAE,cAAc,GAAG,mBAAmB,GAAG,IAAI;CAGnE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAiD,MAAM,aAAa,CAAC;AACtG,OAAO,EAAU,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAU,GAAG,EAAE,MAAM,cAAc,CAAC;AAG3C,OAAO,wBAAwB,CAAC;AAEhC,OAAO,EAAE,MAAM,IAAI,IAAI,EAAoC,MAAM,MAAM,CAAC;AACxE,OAAO,EAAE,MAAM,IAAI,KAAK,EAAqC,MAAM,OAAO,CAAC;AAE3E,OAAO,OAAO,EAAE,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAIvE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,yBAAyB,CAAC;AACjC,OAAO,+BAA+B,CAAC;AACvC,OAAO,4BAA4B,CAAC;AACpC,OAAO,yBAAyB,CAAC;AACjC,OAAO,6BAA6B,CAAC;AACrC,OAAO,2BAA2B,CAAC;AACnC,OAAO,+BAA+B,CAAC;AACvC,OAAO,4BAA4B,CAAC;AACpC,OAAO,8BAA8B,CAAC;AACtC,OAAO,uBAAuB,CAAC;AAC/B,OAAO,qCAAqC,CAAC;AAC7C,OAAO,+BAA+B,CAAC;AAEvC,qBAEa,UAAW,SAAQ,YAAY;IAE1C,SAAS,CAAC,aAAa,EAAG,aAAa,CAAC;IAGxC,SAAS,CAAC,SAAS,EAAG,UAAU,CAAC;IAGjC,SAAS,CAAC,WAAW,EAAG,gBAAgB,EAAE,CAAC;IAG3C,SAAS,CAAC,UAAU,EAAG,wBAAwB,CAAC;IAGhD,SAAS,CAAC,YAAY,EAAG,OAAO,CAAC;IAKjC,SAAS,CAAC,MAAM,EAAG,MAAM,CAAC;IAK1B,SAAS,CAAC,eAAe,EAAG,MAAM,CAAC;IAEnC;;OAEG;IACH,SAAS,CAAC,OAAO,EAAG,OAAO,CAAC,OAAO,CAAC;IAEpC;;OAEG;IACH,SAAS,CAAC,WAAW,EAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,YAAY,EAAG,KAAK,CAAC;IAE/B;;OAEG;IACH,SAAS,CAAC,YAAY,WAAkB;IAExC;;;;OAIG;IACH,SAAS,CAAC,MAAM,EAAE,cAAc,CAA0B;IAE1D;;;OAGG;IACH,SAAS,CAAC,aAAa,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAQ;IAErD;;;OAGG;IACH,SAAS,CAAC,cAAc,UAAS;IAEjC,IAAW,KAAK,IAAI,cAAc,CAEjC;IAED,IAAW,MAAM,IAAI,IAAI,GAAG,KAAK,CAEhC;IAED;;OAEG;IAEH,SAAS,CAAC,GAAG,EAAG,GAAG,CAAC;;IAMP,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAsCrC;;OAEG;IACH,OAAO,CAAC,aAAa;IAuDrB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAgB1B;;OAEG;IACU,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA+CnC;;;;;;OAMG;IACH,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAQ7B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B;;;OAGG;IACU,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrC;;;;OAIG;IACH,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAoDjC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAW9B;;;;OAIG;IACI,GAAG,CAAC,UAAU,EAAE,cAAc,GAAG,mBAAmB,GAAG,IAAI;CAGnE"}

package/lib/cjs/server.js

@@ -38,6 +38,9 @@ require("./middlewares/Cors.js");
 require("./middlewares/SlowRequestWarning.js");
 require("./middlewares/ServerTiming.js");
 let HttpServer = class HttpServer extends di_1.AsyncService {
+    get State() {
+        return this._state;
+    }
     get Server() {
         return this.HttpsEnabled ? this._httpsServer : this._httpServer;
     }
@@ -47,6 +50,22 @@ let HttpServer = class HttpServer extends di_1.AsyncService {
          * Track active connections for cleanup
          */
         this._connections = new Set();
+        /**
+         * Lifecycle state. All three public entry points ( start / stop / dispose )
+         * transition through it so double-close, restart and idempotency are decided
+         * in one place.
+         */
+        this._state = interfaces_js_1.LifecycleState.Created;
+        /**
+         * The in-flight close promise, so concurrent / repeated stop() calls share one
+         * shutdown rather than each issuing a second Server.close().
+         */
+        this._closePromise = null;
+        /**
+         * After-middlewares ( NotFound / ErrorHandler / ServerTiming ... ) attach to
+         * the Express app exactly once per instance. Restart must not re-stack them.
+         */
+        this._afterAttached = false;
     }
     async resolve() {
         await super.resolve();
@@ -99,6 +118,13 @@ let HttpServer = class HttpServer extends di_1.AsyncService {
                     this._connections.delete(socket);
                 });
             });
+            // Persistent, log-only 'error' handler attached once per server ( same place
+            // as 'connection', so it never accumulates ). start()'s per-start .once is
+            // removed on listen success, so without this a server-level 'error' emitted
+            // AFTER listening would be unhandled and crash the process.
+            this._httpsServer.on('error', (err) => {
+                this.Log.error(`Server error: ${err?.message ?? err}`);
+            });
         }
         else {
             this.Log.info(`HTTP enabled !`);
@@ -110,13 +136,22 @@ let HttpServer = class HttpServer extends di_1.AsyncService {
                     this._connections.delete(socket);
                 });
             });
+            // Persistent, log-only 'error' handler attached once per server ( same place
+            // as 'connection', so it never accumulates ). start()'s per-start .once is
+            // removed on listen success, so without this a server-level 'error' emitted
+            // AFTER listening would be unhandled and crash the process.
+            this._httpServer.on('error', (err) => {
+                this.Log.error(`Server error: ${err?.message ?? err}`);
+            });
         }
     }
     /**
      * Server static files
      */
     _serverStaticFiles() {
-        lodash_1.default.uniq(this.HttpConfig.Static).forEach((s) => {
+        // uniqBy Path — Static entries are objects, so plain _.uniq (reference
+        // equality) would never dedupe two config entries pointing at the same dir.
+        lodash_1.default.uniqBy(this.HttpConfig.Static, (s) => s.Path).forEach((s) => {
             if (!(0, fs_1.existsSync)(s.Path)) {
                 this.Log.warn(`static file path ${s.Path} not exists`);
                 return;
@@ -129,71 +164,119 @@ let HttpServer = class HttpServer extends di_1.AsyncService {
     /**
      * Starts http server & express
      */
-    start() {
-        return new Promise((res, rej) => {
-            // add all middlewares to execute after
-            this.Middlewares.reverse().forEach((m) => {
+    async start() {
+        // Idempotent: already serving -> nothing to do. This is what stops a
+        // repeated start() ( HttpServer is a DI singleton ) re-stacking middleware.
+        if (this._state === interfaces_js_1.LifecycleState.Listening) {
+            return;
+        }
+        // A start() racing a shutdown waits for the close to finish, then re-listens.
+        if (this._state === interfaces_js_1.LifecycleState.Closing && this._closePromise) {
+            await this._closePromise;
+        }
+        // add all after-middlewares once per instance ( not once per start ).
+        if (!this._afterAttached) {
+            // Copy before reversing so we don't mutate the shared, already-sorted
+            // Middlewares array in place.
+            [...this.Middlewares].reverse().forEach((m) => {
                 const f = m.after();
                 if (f) {
                     this.Log.info(`Using server middleware::after() - ${m.constructor.name}`);
                     this.use(f);
                 }
             });
-            this.Server.listen(this.HttpConfig.port, () => {
-                this.Log.info(`Server started at port ${this.HttpConfig.port}`);
-                res();
-            }).on('error', (err) => {
-                if (err.errno === 'EADDRINUSE') {
+            this._afterAttached = true;
+        }
+        await new Promise((res, rej) => {
+            // .once, removed on success, so repeated start()/restart never accumulates
+            // 'error' listeners on the reused server object.
+            const onError = (err) => {
+                if (err.code === 'EADDRINUSE') {
                     this.Log.error(`----- Port ${this.HttpConfig.port} is busy -----`);
                 }
                 rej(err);
+            };
+            this.Server.once('error', onError);
+            this.Server.listen(this.HttpConfig.port, () => {
+                this.Server.removeListener('error', onError);
+                this._state = interfaces_js_1.LifecycleState.Listening;
+                this._emit('http.server.listening');
+                this.Log.info(`Server started at port ${this.HttpConfig.port}`);
+                res();
             });
         });
     }
-    stop() {
-        if (this.Server) {
-            this.Server.close();
+    /**
+     * Emit a lifecycle event on the DI bus, isolating the state machine from a
+     * throwing subscriber. Container.emit is synchronous, so without this guard a
+     * listener that throws would pre-empt the caller - eg. a throwing
+     * `http.server.listening` listener runs before res() and would hang start(),
+     * and a throwing `http.server.closing` listener would escape stop().
+     */
+    _emit(event) {
+        try {
+            this.Container.emit(event, this);
         }
+        catch (err) {
+            this.Log.warn(`Listener for ${event} threw: ${err?.message ?? err}`);
+        }
+    }
+    stop() {
+        return this._close();
     }
     /**
-     * Enhanced dispose method with proper connection cleanup and timeout handling
+     * AsyncService teardown. HttpServer holds no resources beyond the socket
+     * server and its tracked connections, both released by stop(); this awaits it.
      */
     async dispose() {
-        if (!this.Server) {
-            return;
+        await this.stop();
+    }
+    /**
+     * Single shutdown path for both stop() and dispose(). Idempotent: repeated or
+     * concurrent calls share one Server.close() instead of issuing a second one
+     * ( which would reject with ERR_SERVER_NOT_RUNNING ).
+     */
+    _close() {
+        if (this._state === interfaces_js_1.LifecycleState.Closing) {
+            return this._closePromise;
         }
-        return new Promise((resolve, reject) => {
-            // Set a timeout for graceful shutdown
-            const timeout = setTimeout(() => {
-                this.Log.warn('Server shutdown timeout, forcing close');
-                // Force close all tracked connections
+        if (this._state !== interfaces_js_1.LifecycleState.Listening || !this.Server) {
+            // Created or Closed - nothing to close
+            return Promise.resolve();
+        }
+        this._state = interfaces_js_1.LifecycleState.Closing;
+        this._closePromise = new Promise((resolve) => {
+            // One watchdog, unref'd so it can never hold the event loop open, and
+            // cleared on every close-callback path. The old code leaked a second,
+            // never-cleared 5s timer here.
+            const watchdog = setTimeout(() => {
+                this.Log.warn('Server shutdown grace period expired, forcing connections closed');
+                this.Server.closeAllConnections?.();
                 this._forceCloseConnections();
-                // Force close connections if available (Node.js 18.2+)
-                if (typeof this.Server.closeAllConnections === 'function') {
-                    this.Server.closeAllConnections();
-                }
-                // Still resolve as we've done our best to clean up
-                resolve();
-            }, 10000);
+            }, this.ShutdownTimeout);
+            watchdog.unref();
             this.Server.close((err) => {
-                clearTimeout(timeout);
+                clearTimeout(watchdog);
+                this._forceCloseConnections();
+                this._state = interfaces_js_1.LifecycleState.Closed;
                 if (err) {
-                    this.Log.error('Error during server close:', err);
-                    reject(err);
-                }
-                else {
-                    this.Log.info('Server closed successfully');
-                    resolve();
+                    // Unexpected given the guards above; log rather than reject so shutdown
+                    // always settles.
+                    this.Log.warn(`Error during server close: ${err.message}`);
                 }
+                this._emit('http.server.closed');
+                resolve();
             });
-            // For tracked connections, manually close them after grace period
-            setTimeout(() => {
-                if (this._connections.size > 0) {
-                    this.Log.warn(`Forcing closure of ${this._connections.size} remaining connections`);
-                    this._forceCloseConnections();
-                }
-            }, 5000);
+            // Free IDLE keep-alive sockets right away so the port releases promptly,
+            // while any in-flight request keeps the grace window above.
+            this.Server.closeIdleConnections?.();
         });
+        // Emit AFTER _closePromise is assigned. Container.emit is fully synchronous,
+        // so a listener that re-enters stop() during this emit hits the Closing guard
+        // and must find the shared promise already in place ( emitting before the
+        // assignment would hand that re-entrant caller a null instead of a thenable ).
+        this._emit('http.server.closing');
+        return this._closePromise;
     }
     /**
      * Force close all tracked connections
@@ -245,6 +328,12 @@ __decorate([
     }),
     __metadata("design:type", String)
 ], HttpServer.prototype, "AppEnv", void 0);
+__decorate([
+    (0, configuration_1.Config)('http.shutdownTimeout', {
+        defaultValue: 10000,
+    }),
+    __metadata("design:type", Number)
+], HttpServer.prototype, "ShutdownTimeout", void 0);
 __decorate([
     (0, log_1.Logger)('http'),
     __metadata("design:type", log_1.Log)

package/lib/cjs/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oCAAsG;AACtG,0DAA+D;AAC/D,sCAA2C;AAE3C,kDAA+C;AAC/C,kCAAgC;AAEhC,+BAAwE;AACxE,iCAA2E;AAC3E,2BAAgC;AAChC,sDAAuE;AACvE,oDAAuB;AACvB,4CAAoB;AAEpB,mDAA6E;AAC7E,mCAAiC;AACjC,yCAAuC;AACvC,sCAAoC;AACpC,mCAAiC;AACjC,uCAAqC;AACrC,qCAAmC;AACnC,yCAAuC;AACvC,sCAAoC;AACpC,wCAAsC;AACtC,iCAA+B;AAC/B,+CAA6C;AAC7C,yCAAuC;AAIhC,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,iBAAY;IAqC1C,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAClE,CAAC;IAQD;QACE,KAAK,EAAE,CAAC;QAhBV;;WAEG;QACO,iBAAY,GAAG,IAAI,GAAG,EAAO,CAAC;IAcxC,CAAC;IAEM,KAAK,CAAC,OAAO;QAElB,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO,GAAG,IAAA,iBAAO,GAAE,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAChD,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,CAAC,GAAG,OAAE,CAAC,OAAO,CAA4B,mBAAmB,EAAE,CAAC,gCAAgC,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;QAC3H,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,mEAAmE;QAEnE,oCAAoC;QACpC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,EAAE,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAEnE,MAAM,GAAG,GAAG,YAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,YAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAEvD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEjC,IAAI,CAAC,YAAY,GAAG,IAAA,oBAAiB,EACnC;gBACE,GAAG,EAAE,GAAG;gBACR,IAAI,EAAE,IAAI;aACX,EACD,IAAI,CAAC,OAAO,CACb,CAAC;YAEF,gCAAgC;YAChC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC5C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC9B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAChC,IAAI,CAAC,WAAW,GAAG,IAAA,mBAAgB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAElD,gCAAgC;YAChC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC3C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC9B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACK,kBAAkB;QACxB,gBAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3C,IAAI,CAAC,IAAA,eAAU,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC;YAEpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,IAAI,aAAa,MAAM,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK;QACV,OAAO,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACpC,uCAAuC;YACvC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBACvC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;gBACpB,IAAI,CAAC,EAAE,CAAC;oBACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC1E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC5C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChE,GAAG,EAAE,CAAC;YACR,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE;gBAC1B,IAAI,GAAG,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;oBAC/B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,IAAI,gBAAgB,CAAC,CAAC;gBACrE,CAAC;gBAED,GAAG,CAAC,GAAG,CAAC,CAAC;YACX,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAEM,IAAI;QACT,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,sCAAsC;YACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBAExD,sCAAsC;gBACtC,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAE9B,uDAAuD;gBACvD,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,KAAK,UAAU,EAAE,CAAC;oBAC1D,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,CAAC;gBACpC,CAAC;gBAED,mDAAmD;gBACnD,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,KAAK,CAAC,CAAC;YAEV,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxB,YAAY,CAAC,OAAO,CAAC,CAAC;gBAEtB,IAAI,GAAG,EAAE,CAAC;oBACR,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;oBAClD,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAC5C,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,kEAAkE;YAClE,UAAU,CAAC,GAAG,EAAE;gBACd,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBAC/B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,YAAY,CAAC,IAAI,wBAAwB,CAAC,CAAC;oBACpF,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAChC,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,CAAC;QACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,sBAAsB;QAC5B,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACI,GAAG,CAAC,UAAgD;QACzD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;CACF,CAAA;AA1PY,gCAAU;AAEX;IADT,IAAA,eAAU,EAAC,6BAAa,CAAC;8BACA,6BAAa;iDAAC;AAG9B;IADT,IAAA,eAAU,EAAC,cAAS,CAAC;;6CACW;AAGvB;IADT,IAAA,eAAU,EAAC,gCAAgB,CAAC;;+CACc;AAGjC;IADT,IAAA,sBAAM,EAAC,MAAM,CAAC;;8CACiC;AAGtC;IADT,IAAA,sBAAM,EAAC,OAAO,CAAC;;gDACiB;AAKvB;IAHT,IAAA,sBAAM,EAAC,qBAAqB,EAAE;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC;;0CACwB;AA0BhB;IADT,IAAA,YAAM,EAAC,MAAM,CAAC;8BACC,SAAG;uCAAC;qBA7CT,UAAU;IAFtB,IAAA,eAAU,GAAE;IACZ,IAAA,WAAM,EAAC,qBAAS,CAAC;;GACL,UAAU,CA0PtB"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oCAAsG;AACtG,0DAA+D;AAC/D,sCAA2C;AAE3C,kDAA+C;AAC/C,kCAAgC;AAEhC,+BAAwE;AACxE,iCAA2E;AAC3E,2BAAgC;AAChC,sDAAuE;AACvE,oDAAuB;AACvB,4CAAoB;AAEpB,mDAA6F;AAC7F,mCAAiC;AACjC,yCAAuC;AACvC,sCAAoC;AACpC,mCAAiC;AACjC,uCAAqC;AACrC,qCAAmC;AACnC,yCAAuC;AACvC,sCAAoC;AACpC,wCAAsC;AACtC,iCAA+B;AAC/B,+CAA6C;AAC7C,yCAAuC;AAIhC,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,iBAAY;IA6D1C,IAAW,KAAK;QACd,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAClE,CAAC;IAQD;QACE,KAAK,EAAE,CAAC;QAvCV;;WAEG;QACO,iBAAY,GAAG,IAAI,GAAG,EAAO,CAAC;QAExC;;;;WAIG;QACO,WAAM,GAAmB,8BAAc,CAAC,OAAO,CAAC;QAE1D;;;WAGG;QACO,kBAAa,GAAyB,IAAI,CAAC;QAErD;;;WAGG;QACO,mBAAc,GAAG,KAAK,CAAC;IAkBjC,CAAC;IAEM,KAAK,CAAC,OAAO;QAElB,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QAEtB,IAAI,CAAC,OAAO,GAAG,IAAA,iBAAO,GAAE,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAChD,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,MAAM,CAAC,GAAG,OAAE,CAAC,OAAO,CAA4B,mBAAmB,EAAE,CAAC,gCAAgC,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yGAAyG,CAAC,CAAC;QAC3H,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,0EAA0E;QAC1E,mEAAmE;QAEnE,oCAAoC;QACpC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC,EAAE,CAAC;gBACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,aAAa;QACnB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAEnE,MAAM,GAAG,GAAG,YAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,YAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAEvD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAEjC,IAAI,CAAC,YAAY,GAAG,IAAA,oBAAiB,EACnC;gBACE,GAAG,EAAE,GAAG;gBACR,IAAI,EAAE,IAAI;aACX,EACD,IAAI,CAAC,OAAO,CACb,CAAC;YAEF,gCAAgC;YAChC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC5C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC9B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,6EAA6E;YAC7E,2EAA2E;YAC3E,4EAA4E;YAC5E,4DAA4D;YAC5D,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE;gBACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAChC,IAAI,CAAC,WAAW,GAAG,IAAA,mBAAgB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAElD,gCAAgC;YAChC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;gBAC3C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC9B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACnC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,6EAA6E;YAC7E,2EAA2E;YAC3E,4EAA4E;YAC5E,4DAA4D;YAC5D,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE;gBACxC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;YACzD,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;OAEG;IACK,kBAAkB;QACxB,uEAAuE;QACvE,4EAA4E;QAC5E,gBAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5D,IAAI,CAAC,IAAA,eAAU,EAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,IAAI,SAAS,CAAC;YAEpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,IAAI,aAAa,MAAM,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,KAAK;QAChB,qEAAqE;QACrE,4EAA4E;QAC5E,IAAI,IAAI,CAAC,MAAM,KAAK,8BAAc,CAAC,SAAS,EAAE,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,8EAA8E;QAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,8BAAc,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,aAAa,CAAC;QAC3B,CAAC;QAED,sEAAsE;QACtE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,sEAAsE;YACtE,8BAA8B;YAC9B,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC5C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;gBACpB,IAAI,CAAC,EAAE,CAAC;oBACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC1E,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,MAAM,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACnC,2EAA2E;YAC3E,iDAAiD;YACjD,MAAM,OAAO,GAAG,CAAC,GAAQ,EAAE,EAAE;gBAC3B,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,IAAI,gBAAgB,CAAC,CAAC;gBACrE,CAAC;gBACD,GAAG,CAAC,GAAG,CAAC,CAAC;YACX,CAAC,CAAC;YACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAEnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE;gBAC5C,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7C,IAAI,CAAC,MAAM,GAAG,8BAAc,CAAC,SAAS,CAAC;gBACvC,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;gBAChE,GAAG,EAAE,CAAC;YACR,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACO,KAAK,CAAC,KAAa;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,KAAK,WAAW,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAEM,IAAI;QACT,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,OAAO;QAClB,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACO,MAAM;QACd,IAAI,IAAI,CAAC,MAAM,KAAK,8BAAc,CAAC,OAAO,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC,aAAc,CAAC;QAC7B,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,8BAAc,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAC7D,uCAAuC;YACvC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,8BAAc,CAAC,OAAO,CAAC;QAErC,IAAI,CAAC,aAAa,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACjD,sEAAsE;YACtE,sEAAsE;YACtE,+BAA+B;YAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC/B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;gBAClF,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,CAAC;gBACpC,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YACzB,QAAQ,CAAC,KAAK,EAAE,CAAC;YAEjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxB,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACvB,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,GAAG,8BAAc,CAAC,MAAM,CAAC;gBAEpC,IAAI,GAAG,EAAE,CAAC;oBACR,wEAAwE;oBACxE,kBAAkB;oBAClB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBAED,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;gBACjC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,yEAAyE;YACzE,4DAA4D;YAC5D,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,CAAC;QACvC,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,8EAA8E;QAC9E,0EAA0E;QAC1E,+EAA+E;QAC/E,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAElC,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED;;OAEG;IACK,sBAAsB;QAC5B,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,UAAU,CAAC,OAAO,EAAE,CAAC;YACvB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACI,GAAG,CAAC,UAAgD;QACzD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;CACF,CAAA;AA9VY,gCAAU;AAEX;IADT,IAAA,eAAU,EAAC,6BAAa,CAAC;8BACA,6BAAa;iDAAC;AAG9B;IADT,IAAA,eAAU,EAAC,cAAS,CAAC;;6CACW;AAGvB;IADT,IAAA,eAAU,EAAC,gCAAgB,CAAC;;+CACc;AAGjC;IADT,IAAA,sBAAM,EAAC,MAAM,CAAC;;8CACiC;AAGtC;IADT,IAAA,sBAAM,EAAC,OAAO,CAAC;;gDACiB;AAKvB;IAHT,IAAA,sBAAM,EAAC,qBAAqB,EAAE;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC;;0CACwB;AAKhB;IAHT,IAAA,sBAAM,EAAC,sBAAsB,EAAE;QAC9B,YAAY,EAAE,KAAK;KACpB,CAAC;;mDACiC;AAiDzB;IADT,IAAA,YAAM,EAAC,MAAM,CAAC;8BACC,SAAG;uCAAC;qBAzET,UAAU;IAFtB,IAAA,eAAU,GAAE;IACZ,IAAA,WAAM,EAAC,qBAAS,CAAC;;GACL,UAAU,CA8VtB"}

package/lib/mjs/config/http.d.ts

@@ -6,13 +6,6 @@ declare const http: {
             cli: string[];
         };
     };
-    cookie: {
-        secret: string;
-        options: {
-            maxAge: number;
-            httpOnly: boolean;
-        };
-    };
     fs: {
         providers: {
             service: string;
@@ -21,6 +14,21 @@ declare const http: {
         }[];
     };
     http: {
+        /**
+         * Cookie defaults. This MUST live under `http.` - every consumer reads
+         * `http.cookie.secret` ( responses, @FromCookie, the rbac session middleware ),
+         * and the parser that makes signed cookies work is bound to it.
+         *
+         * Override the secret per app: this default is public, and signed cookies are
+         * only as trustworthy as the key that signs them.
+         */
+        cookie: {
+            secret: string;
+            options: {
+                maxAge: number;
+                httpOnly: boolean;
+            };
+        };
         /**
          * File upload default middlewares
          */

package/lib/mjs/config/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/config/http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AA0B9B,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;;;;;;;;QAuCN;;WAEG;;;;;;;;;;;;;;;QA6BH;;WAEG;;YAGC;;eAEG;;YAGH;;eAEG;;;QAKP;;WAEG;;QAGH;;;WAGG;;;CAgBN,CAAC;AAEF,eAAe,IAAI,CAAC"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../../src/config/http.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,SAAS,CAAC;AA0B9B,QAAA,MAAM,IAAI;;;;;;;;;;;;;;;QAgCN;;;;;;;WAOG;;;;;;;;QASH;;WAEG;;;;;;;;;;;;;;;QAwCH;;WAEG;;YAGC;;eAEG;;YAGH;;eAEG;;;QAKP;;WAEG;;QAGH;;;WAGG;;;CAgBN,CAAC;AAEF,eAAe,IAAI,CAAC"}

package/lib/mjs/config/http.js

@@ -1,6 +1,6 @@
 import express from 'express';
 import helmet from 'helmet';
-import cookieParser from 'cookie-parser';
+import { configuredCookieParser } from '../cookie.js';
 import compression from 'compression';
 import { join, normalize, resolve } from 'path';
 import os from 'os';
@@ -25,13 +25,6 @@ const http = {
             cli: [...dir('cli')],
         },
     },
-    cookie: {
-        secret: '1234adreewD',
-        options: {
-            maxAge: 900000,
-            httpOnly: true,
-        },
-    },
     fs: {
         providers: [
             // formidable default file provider, incoming
@@ -55,6 +48,21 @@ const http = {
         ],
     },
     http: {
+        /**
+         * Cookie defaults. This MUST live under `http.` - every consumer reads
+         * `http.cookie.secret` ( responses, @FromCookie, the rbac session middleware ),
+         * and the parser that makes signed cookies work is bound to it.
+         *
+         * Override the secret per app: this default is public, and signed cookies are
+         * only as trustworthy as the key that signs them.
+         */
+        cookie: {
+            secret: '1234adreewD',
+            options: {
+                maxAge: 900000,
+                httpOnly: true,
+            },
+        },
         /**
          * File upload default middlewares
          */
@@ -76,11 +84,22 @@ const http = {
             helmet(),
             express.json({
                 limit: '5mb',
+                // Capture the exact received bytes for the @RawBody() route arg
+                // (webhook signature verification needs the unmodified body).
+                verify: (req, _res, buf) => {
+                    req.rawBody = buf;
+                },
             }),
             express.urlencoded({
                 extended: true,
             }),
-            cookieParser(),
+            // Parse XML request bodies as text so the @FromXml() route arg can read
+            // and parse them. Covers application/xml, text/xml and *+xml types.
+            express.text({
+                type: ['application/xml', 'text/xml', 'application/*+xml'],
+                limit: '5mb',
+            }),
+            configuredCookieParser,
             compression(),
         ],
         /**