@webiny/event-handler-core 6.6.0-alpha.0 → 6.6.0-alpha.2

package/features/http/HttpStreamBody.d.ts

@@ -0,0 +1,34 @@
+export type HttpStreamChunk = Uint8Array | string;
+export type HttpStreamSource = AsyncIterable<HttpStreamChunk>;
+/**
+ * Marker for a streaming HTTP response body.
+ *
+ * `IHttpResponse.body` is untyped, and buffered bodies already carry meaning by their runtime type
+ * (string, Buffer/Uint8Array, plain object). Streaming has to be distinguishable from those WITHOUT
+ * duck-typing `Symbol.asyncIterator`: a plain object body could accidentally satisfy it, and
+ * `ReadableStream`'s async-iterator support (present in Node at runtime) isn't declared in the DOM
+ * types. So a route opts into streaming explicitly, by wrapping its source in this class.
+ *
+ * Transports that can stream (the Node HTTP server; AWS Lambda response streaming via a Function
+ * URL) write chunks as they are produced. Transports that cannot (API Gateway buffers the entire
+ * Lambda response no matter how it was produced) call {@link collect} and send one buffered body —
+ * so the same route still works there, just without incremental delivery.
+ */
+export declare class HttpStreamBody {
+    readonly source: HttpStreamSource;
+    constructor(source: HttpStreamSource);
+    static is(value: unknown): value is HttpStreamBody;
+    /**
+     * Wrap a web `ReadableStream` — what `fetch` and the AI SDK's `toUIMessageStreamResponse()`
+     * hand back. The reader is driven explicitly rather than relying on async iteration, because
+     * the DOM types don't declare it even though Node implements it.
+     */
+    static fromWebStream(stream: ReadableStream<Uint8Array>): HttpStreamBody;
+    /**
+     * Drain the whole stream into a single byte array, for transports that can't stream.
+     *
+     * Consumes the source — a stream can only be read once, so this must not be combined with
+     * writing the same body incrementally.
+     */
+    collect(): Promise<Uint8Array>;
+}

package/features/http/HttpStreamBody.js

@@ -0,0 +1,44 @@
+class HttpStreamBody {
+    constructor(source){
+        this.source = source;
+    }
+    static is(value) {
+        return value instanceof HttpStreamBody;
+    }
+    static fromWebStream(stream) {
+        return new HttpStreamBody({
+            async *[Symbol.asyncIterator] () {
+                const reader = stream.getReader();
+                try {
+                    while(true){
+                        const { done, value } = await reader.read();
+                        if (done) break;
+                        if (void 0 !== value) yield value;
+                    }
+                } finally{
+                    reader.releaseLock();
+                }
+            }
+        });
+    }
+    async collect() {
+        const encoder = new TextEncoder();
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of this.source){
+            const bytes = "string" == typeof chunk ? encoder.encode(chunk) : chunk;
+            chunks.push(bytes);
+            total += bytes.byteLength;
+        }
+        const result = new Uint8Array(total);
+        let offset = 0;
+        for (const chunk of chunks){
+            result.set(chunk, offset);
+            offset += chunk.byteLength;
+        }
+        return result;
+    }
+}
+export { HttpStreamBody };
+
+//# sourceMappingURL=HttpStreamBody.js.map

package/features/http/HttpStreamBody.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/http/HttpStreamBody.js","sources":["../../../src/features/http/HttpStreamBody.ts"],"sourcesContent":["export type HttpStreamChunk = Uint8Array | string;\n\nexport type HttpStreamSource = AsyncIterable<HttpStreamChunk>;\n\n/**\n * Marker for a streaming HTTP response body.\n *\n * `IHttpResponse.body` is untyped, and buffered bodies already carry meaning by their runtime type\n * (string, Buffer/Uint8Array, plain object). Streaming has to be distinguishable from those WITHOUT\n * duck-typing `Symbol.asyncIterator`: a plain object body could accidentally satisfy it, and\n * `ReadableStream`'s async-iterator support (present in Node at runtime) isn't declared in the DOM\n * types. So a route opts into streaming explicitly, by wrapping its source in this class.\n *\n * Transports that can stream (the Node HTTP server; AWS Lambda response streaming via a Function\n * URL) write chunks as they are produced. Transports that cannot (API Gateway buffers the entire\n * Lambda response no matter how it was produced) call {@link collect} and send one buffered body —\n * so the same route still works there, just without incremental delivery.\n */\nexport class HttpStreamBody {\n    constructor(readonly source: HttpStreamSource) {}\n\n    static is(value: unknown): value is HttpStreamBody {\n        return value instanceof HttpStreamBody;\n    }\n\n    /**\n     * Wrap a web `ReadableStream` — what `fetch` and the AI SDK's `toUIMessageStreamResponse()`\n     * hand back. The reader is driven explicitly rather than relying on async iteration, because\n     * the DOM types don't declare it even though Node implements it.\n     */\n    static fromWebStream(stream: ReadableStream<Uint8Array>): HttpStreamBody {\n        return new HttpStreamBody({\n            async *[Symbol.asyncIterator]() {\n                const reader = stream.getReader();\n                try {\n                    while (true) {\n                        const { done, value } = await reader.read();\n                        if (done) {\n                            break;\n                        }\n                        if (value !== undefined) {\n                            yield value;\n                        }\n                    }\n                } finally {\n                    reader.releaseLock();\n                }\n            }\n        });\n    }\n\n    /**\n     * Drain the whole stream into a single byte array, for transports that can't stream.\n     *\n     * Consumes the source — a stream can only be read once, so this must not be combined with\n     * writing the same body incrementally.\n     */\n    async collect(): Promise<Uint8Array> {\n        const encoder = new TextEncoder();\n        const chunks: Uint8Array[] = [];\n        let total = 0;\n\n        for await (const chunk of this.source) {\n            const bytes = typeof chunk === \"string\" ? encoder.encode(chunk) : chunk;\n            chunks.push(bytes);\n            total += bytes.byteLength;\n        }\n\n        const result = new Uint8Array(total);\n        let offset = 0;\n        for (const chunk of chunks) {\n            result.set(chunk, offset);\n            offset += chunk.byteLength;\n        }\n\n        return result;\n    }\n}\n"],"names":["HttpStreamBody","source","value","stream","Symbol","reader","done","undefined","encoder","TextEncoder","chunks","total","chunk","bytes","result","Uint8Array","offset"],"mappings":"AAkBO,MAAMA;IACT,YAAqBC,MAAwB,CAAE;aAA1BA,MAAM,GAANA;IAA2B;IAEhD,OAAO,GAAGC,KAAc,EAA2B;QAC/C,OAAOA,iBAAiBF;IAC5B;IAOA,OAAO,cAAcG,MAAkC,EAAkB;QACrE,OAAO,IAAIH,eAAe;YACtB,OAAO,CAACI,OAAO,aAAa,CAAC;gBACzB,MAAMC,SAASF,OAAO,SAAS;gBAC/B,IAAI;oBACA,MAAO,KAAM;wBACT,MAAM,EAAEG,IAAI,EAAEJ,KAAK,EAAE,GAAG,MAAMG,OAAO,IAAI;wBACzC,IAAIC,MACA;wBAEJ,IAAIJ,AAAUK,WAAVL,OACA,MAAMA;oBAEd;gBACJ,SAAU;oBACNG,OAAO,WAAW;gBACtB;YACJ;QACJ;IACJ;IAQA,MAAM,UAA+B;QACjC,MAAMG,UAAU,IAAIC;QACpB,MAAMC,SAAuB,EAAE;QAC/B,IAAIC,QAAQ;QAEZ,WAAW,MAAMC,SAAS,IAAI,CAAC,MAAM,CAAE;YACnC,MAAMC,QAAQ,AAAiB,YAAjB,OAAOD,QAAqBJ,QAAQ,MAAM,CAACI,SAASA;YAClEF,OAAO,IAAI,CAACG;YACZF,SAASE,MAAM,UAAU;QAC7B;QAEA,MAAMC,SAAS,IAAIC,WAAWJ;QAC9B,IAAIK,SAAS;QACb,KAAK,MAAMJ,SAASF,OAAQ;YACxBI,OAAO,GAAG,CAACF,OAAOI;YAClBA,UAAUJ,MAAM,UAAU;QAC9B;QAEA,OAAOE;IACX;AACJ"}

package/features/http/abstractions.d.ts

@@ -1,4 +1,16 @@
 import { Abstraction } from "@webiny/di";
+import type { Constructor } from "@webiny/di";
+import type { HttpStreamSource } from "./HttpStreamBody.js";
+/**
+ * Which route the router matched, as seen from inside `handle()` — the `req.route` of Express-style
+ * handlers. It is the definition without its `handler`, so a route (or anything wrapping one) can
+ * tell WHICH route is running and act only on the one it cares about.
+ */
+export interface IMatchedRouteDefinition {
+    readonly name: string;
+    readonly method: string;
+    readonly path: string;
+}
 export interface IHttpRequest {
     method: string;
     path: string;
@@ -6,24 +18,163 @@ export interface IHttpRequest {
     query: Record<string, string>;
     pathParameters: Record<string, string>;
     body: any;
+    /**
+     * Set by `HttpRouter` once a route matches, so it is absent on the request a transport builds
+     * and always present by the time `handle()` runs. Handlers should take
+     * {@link HttpRouteHandler.Request}, where it is required.
+     */
+    route?: IMatchedRouteDefinition;
 }
 export interface IHttpResponse {
     statusCode: number;
     headers?: Record<string, string>;
+    /**
+     * Serialized `Set-Cookie` values. A separate field (not a header) because `Set-Cookie` is the
+     * one response header that can legally repeat, which `headers: Record<string, string>` cannot
+     * express. Transports map it to whatever their protocol needs — API Gateway's
+     * `multiValueHeaders` / `cookies`, or a repeated header on a Node `ServerResponse`.
+     */
+    cookies?: string[];
     body?: any;
 }
+export interface CookieOptions {
+    domain?: string;
+    path?: string;
+    expires?: Date;
+    /**
+     * Cookie lifetime in SECONDS — the `Max-Age` attribute value as the HTTP spec defines it.
+     * Note this differs from Express, whose `maxAge` is in milliseconds.
+     */
+    maxAge?: number;
+    httpOnly?: boolean;
+    secure?: boolean;
+    partitioned?: boolean;
+    sameSite?: "strict" | "lax" | "none";
+}
+/**
+ * The mutable response handed to every route as the second argument to `handle()` — the `res` of
+ * Express-style handlers. Every method returns `this`, so a route can chain and then return the
+ * builder directly:
+ *
+ * ```ts
+ * async handle(request: IHttpRequest, response: IHttpResponseBuilder) {
+ *     return response.status(201).cookie("sid", id, { httpOnly: true }).json({ id });
+ * }
+ * ```
+ *
+ * Returning it is optional: a route that mutates it and returns nothing gets the same response.
+ * Routes returning a plain {@link IHttpResponse} keep working — anything set on the builder
+ * (headers, cookies) is merged underneath the returned object, which wins on conflicts.
+ */
+export interface IHttpResponseBuilder {
+    /** Set the status code. Defaults to 200. */
+    status(statusCode: number): this;
+    /** Set a single response header (header names are stored lowercase). */
+    header(name: string, value: string): this;
+    /** Merge multiple response headers at once. */
+    setHeaders(headers: Record<string, string>): this;
+    getHeader(name: string): string | undefined;
+    removeHeader(name: string): this;
+    /**
+     * Set `Content-Type`. Accepts a full media type (`"image/png"`) or one of the shorthands
+     * `json`, `text`, `html`, `xml`, `bin`.
+     */
+    type(contentType: string): this;
+    /** Append a `Set-Cookie` value. Can be called multiple times for multiple cookies. */
+    cookie(name: string, value: string, options?: CookieOptions): this;
+    /** Append a `Set-Cookie` value that expires the cookie immediately. */
+    clearCookie(name: string, options?: Omit<CookieOptions, "expires" | "maxAge">): this;
+    /** JSON-serialize the body and set `Content-Type: application/json` (unless already set). */
+    json(body?: any): this;
+    /**
+     * Set the body, inferring `Content-Type` when it hasn't been set: `text/html` for a string,
+     * `application/octet-stream` for a Buffer/Uint8Array, `application/json` for anything else.
+     */
+    send(body?: any): this;
+    /** Set the body with `Content-Type: text/plain`. */
+    text(body: string): this;
+    /** Set the body with `Content-Type: text/html`. */
+    html(body: string): this;
+    /** Set `Location` and a redirect status code (302 by default). */
+    redirect(url: string, statusCode?: number): this;
+    /** Set the body verbatim, without touching `Content-Type`. */
+    end(body?: any): this;
+    /**
+     * Stream the response as server-sent events: sets the SSE headers and wraps `source` in an
+     * {@link HttpStreamBody} so transports that can stream write each chunk as it is produced.
+     *
+     * Two of the headers are not obvious and are easy to omit, and omitting either yields a response
+     * that looks correct yet never arrives incrementally: `no-transform` stops CloudFront (and other
+     * proxies) compressing the body, which buffers chunks, and `x-accel-buffering: no` opts out of
+     * nginx-family response buffering.
+     *
+     * Framing is the caller's job — `source` should yield complete `data: ...\n\n` records.
+     */
+    sse(source: HttpStreamSource): this;
+    /** Materialize the transport-agnostic response. Called by the router; routes rarely need it. */
+    toResponse(): IHttpResponse;
+}
 export interface IHttpRoute {
+    /**
+     * Handle the request. Either return a response (a plain {@link IHttpResponse}, or the
+     * {@link IHttpResponseBuilder} passed in as `response`), or mutate `response` and return
+     * nothing.
+     */
+    handle(request: IHttpRequest, response: IHttpResponseBuilder): Promise<IHttpResponse | IHttpResponseBuilder | void>;
+}
+/**
+ * What a route IS, separated from what it DOES.
+ *
+ * `method` and `path` are plain data, so the router matches a request without building anything.
+ * `handler` is the route's implementation class — declared with
+ * `HttpRouteHandler.createImplementation`, so it carries its own dependency metadata — and the
+ * router builds it only once this definition matches.
+ *
+ * Resolving every route just to read its path used to drag in each one's whole dependency graph, so
+ * a request for a static asset built the entire GraphQL engine, every contextual schema and the AI
+ * provider before finding the route it wanted.
+ */
+export interface IHttpRouteDefinition {
+    /**
+     * Identifies this route so a decorator can pick it out.
+     *
+     * Decorators DO reach `HttpRouteDefinition` (unlike `HttpRouteHandler`, which the router builds
+     * directly), so decorating it hands you every route in turn — `name` is how you tell which one
+     * you have, and whether to wrap its handler or pass it through.
+     */
+    readonly name: string;
     readonly method: string;
     readonly path: string;
-    handle(request: IHttpRequest): Promise<IHttpResponse>;
+    readonly handler: Constructor<IHttpRoute>;
 }
 export interface IHttpRouter {
     route(request: IHttpRequest): Promise<IHttpResponse>;
 }
-export declare const HttpRoute: Abstraction<IHttpRoute>;
+export declare const HttpRouteDefinition: Abstraction<IHttpRouteDefinition>;
+/**
+ * Declares a route's request handling. One shared abstraction: the router never resolves it from the
+ * container (that would build every route), it builds the ONE class a matched definition points at.
+ * Declaring implementations through it is what attaches their dependency metadata.
+ */
+export declare const HttpRouteHandler: Abstraction<IHttpRoute>;
 export declare const HttpRouter: Abstraction<IHttpRouter>;
-export declare namespace HttpRoute {
+export declare namespace HttpRouteDefinition {
+    type Interface = IHttpRouteDefinition;
+}
+export declare namespace HttpRouteHandler {
     type Interface = IHttpRoute;
+    /**
+     * The request handed to `handle()`: an {@link IHttpRequest} that has been through the router,
+     * so {@link IMatchedRouteDefinition} is guaranteed rather than optional.
+     */
+    type Request = IHttpRequest & {
+        route: IMatchedRouteDefinition;
+    };
+    /**
+     * The response handed to `handle()` — the mutable builder, not the materialized
+     * {@link IHttpResponse}. Shorthand for {@link IHttpResponseBuilder}.
+     */
+    type Response = IHttpResponseBuilder;
 }
 export declare namespace HttpRouter {
     type Interface = IHttpRouter;

package/features/http/abstractions.js

@@ -1,11 +1,12 @@
 import { Abstraction } from "@webiny/di";
-const HttpRoute = new Abstraction("HttpRoute");
+const HttpRouteDefinition = new Abstraction("HttpRouteDefinition");
+const HttpRouteHandler = new Abstraction("HttpRouteHandler");
 const HttpRouter = new Abstraction("HttpRouter");
 class RouteNotFoundError extends Error {
     constructor(method, path){
         super(`Route not found: ${method} ${path}`), this.code = "ROUTE_NOT_FOUND";
     }
 }
-export { HttpRoute, HttpRouter, RouteNotFoundError };
+export { HttpRouteDefinition, HttpRouteHandler, HttpRouter, RouteNotFoundError };
 
 //# sourceMappingURL=abstractions.js.map

package/features/http/abstractions.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/http/abstractions.js","sources":["../../../src/features/http/abstractions.ts"],"sourcesContent":["import { Abstraction } from \"@webiny/di\";\n\nexport interface IHttpRequest {\n    method: string;\n    path: string;\n    headers: Record<string, string>;\n    query: Record<string, string>;\n    pathParameters: Record<string, string>;\n    body: any;\n}\n\nexport interface IHttpResponse {\n    statusCode: number;\n    headers?: Record<string, string>;\n    body?: any;\n}\n\nexport interface IHttpRoute {\n    readonly method: string;\n    readonly path: string;\n    handle(request: IHttpRequest): Promise<IHttpResponse>;\n}\n\nexport interface IHttpRouter {\n    route(request: IHttpRequest): Promise<IHttpResponse>;\n}\n\nexport const HttpRoute = new Abstraction<IHttpRoute>(\"HttpRoute\");\nexport const HttpRouter = new Abstraction<IHttpRouter>(\"HttpRouter\");\n\nexport namespace HttpRoute {\n    export type Interface = IHttpRoute;\n}\n\nexport namespace HttpRouter {\n    export type Interface = IHttpRouter;\n}\n\nexport class RouteNotFoundError extends Error {\n    readonly code = \"ROUTE_NOT_FOUND\" as const;\n\n    constructor(method: string, path: string) {\n        super(`Route not found: ${method} ${path}`);\n    }\n}\n"],"names":["HttpRoute","Abstraction","HttpRouter","RouteNotFoundError","Error","method","path"],"mappings":";AA2BO,MAAMA,YAAY,IAAIC,YAAwB;AAC9C,MAAMC,aAAa,IAAID,YAAyB;AAUhD,MAAME,2BAA2BC;IAGpC,YAAYC,MAAc,EAAEC,IAAY,CAAE;QACtC,KAAK,CAAC,CAAC,iBAAiB,EAAED,OAAO,CAAC,EAAEC,MAAM,QAHrC,IAAI,GAAG;IAIhB;AACJ"}
+{"version":3,"file":"features/http/abstractions.js","sources":["../../../src/features/http/abstractions.ts"],"sourcesContent":["import { Abstraction } from \"@webiny/di\";\nimport type { Constructor } from \"@webiny/di\";\nimport type { HttpStreamSource } from \"./HttpStreamBody.js\";\n\n/**\n * Which route the router matched, as seen from inside `handle()` — the `req.route` of Express-style\n * handlers. It is the definition without its `handler`, so a route (or anything wrapping one) can\n * tell WHICH route is running and act only on the one it cares about.\n */\nexport interface IMatchedRouteDefinition {\n    readonly name: string;\n    readonly method: string;\n    readonly path: string;\n}\n\nexport interface IHttpRequest {\n    method: string;\n    path: string;\n    headers: Record<string, string>;\n    query: Record<string, string>;\n    pathParameters: Record<string, string>;\n    body: any;\n    /**\n     * Set by `HttpRouter` once a route matches, so it is absent on the request a transport builds\n     * and always present by the time `handle()` runs. Handlers should take\n     * {@link HttpRouteHandler.Request}, where it is required.\n     */\n    route?: IMatchedRouteDefinition;\n}\n\nexport interface IHttpResponse {\n    statusCode: number;\n    headers?: Record<string, string>;\n    /**\n     * Serialized `Set-Cookie` values. A separate field (not a header) because `Set-Cookie` is the\n     * one response header that can legally repeat, which `headers: Record<string, string>` cannot\n     * express. Transports map it to whatever their protocol needs — API Gateway's\n     * `multiValueHeaders` / `cookies`, or a repeated header on a Node `ServerResponse`.\n     */\n    cookies?: string[];\n    body?: any;\n}\n\nexport interface CookieOptions {\n    domain?: string;\n    path?: string;\n    expires?: Date;\n    /**\n     * Cookie lifetime in SECONDS — the `Max-Age` attribute value as the HTTP spec defines it.\n     * Note this differs from Express, whose `maxAge` is in milliseconds.\n     */\n    maxAge?: number;\n    httpOnly?: boolean;\n    secure?: boolean;\n    partitioned?: boolean;\n    sameSite?: \"strict\" | \"lax\" | \"none\";\n}\n\n/**\n * The mutable response handed to every route as the second argument to `handle()` — the `res` of\n * Express-style handlers. Every method returns `this`, so a route can chain and then return the\n * builder directly:\n *\n * ```ts\n * async handle(request: IHttpRequest, response: IHttpResponseBuilder) {\n *     return response.status(201).cookie(\"sid\", id, { httpOnly: true }).json({ id });\n * }\n * ```\n *\n * Returning it is optional: a route that mutates it and returns nothing gets the same response.\n * Routes returning a plain {@link IHttpResponse} keep working — anything set on the builder\n * (headers, cookies) is merged underneath the returned object, which wins on conflicts.\n */\nexport interface IHttpResponseBuilder {\n    /** Set the status code. Defaults to 200. */\n    status(statusCode: number): this;\n    /** Set a single response header (header names are stored lowercase). */\n    header(name: string, value: string): this;\n    /** Merge multiple response headers at once. */\n    setHeaders(headers: Record<string, string>): this;\n    getHeader(name: string): string | undefined;\n    removeHeader(name: string): this;\n    /**\n     * Set `Content-Type`. Accepts a full media type (`\"image/png\"`) or one of the shorthands\n     * `json`, `text`, `html`, `xml`, `bin`.\n     */\n    type(contentType: string): this;\n    /** Append a `Set-Cookie` value. Can be called multiple times for multiple cookies. */\n    cookie(name: string, value: string, options?: CookieOptions): this;\n    /** Append a `Set-Cookie` value that expires the cookie immediately. */\n    clearCookie(name: string, options?: Omit<CookieOptions, \"expires\" | \"maxAge\">): this;\n    /** JSON-serialize the body and set `Content-Type: application/json` (unless already set). */\n    json(body?: any): this;\n    /**\n     * Set the body, inferring `Content-Type` when it hasn't been set: `text/html` for a string,\n     * `application/octet-stream` for a Buffer/Uint8Array, `application/json` for anything else.\n     */\n    send(body?: any): this;\n    /** Set the body with `Content-Type: text/plain`. */\n    text(body: string): this;\n    /** Set the body with `Content-Type: text/html`. */\n    html(body: string): this;\n    /** Set `Location` and a redirect status code (302 by default). */\n    redirect(url: string, statusCode?: number): this;\n    /** Set the body verbatim, without touching `Content-Type`. */\n    end(body?: any): this;\n    /**\n     * Stream the response as server-sent events: sets the SSE headers and wraps `source` in an\n     * {@link HttpStreamBody} so transports that can stream write each chunk as it is produced.\n     *\n     * Two of the headers are not obvious and are easy to omit, and omitting either yields a response\n     * that looks correct yet never arrives incrementally: `no-transform` stops CloudFront (and other\n     * proxies) compressing the body, which buffers chunks, and `x-accel-buffering: no` opts out of\n     * nginx-family response buffering.\n     *\n     * Framing is the caller's job — `source` should yield complete `data: ...\\n\\n` records.\n     */\n    sse(source: HttpStreamSource): this;\n    /** Materialize the transport-agnostic response. Called by the router; routes rarely need it. */\n    toResponse(): IHttpResponse;\n}\n\nexport interface IHttpRoute {\n    /**\n     * Handle the request. Either return a response (a plain {@link IHttpResponse}, or the\n     * {@link IHttpResponseBuilder} passed in as `response`), or mutate `response` and return\n     * nothing.\n     */\n    handle(\n        request: IHttpRequest,\n        response: IHttpResponseBuilder\n    ): Promise<IHttpResponse | IHttpResponseBuilder | void>;\n}\n\n/**\n * What a route IS, separated from what it DOES.\n *\n * `method` and `path` are plain data, so the router matches a request without building anything.\n * `handler` is the route's implementation class — declared with\n * `HttpRouteHandler.createImplementation`, so it carries its own dependency metadata — and the\n * router builds it only once this definition matches.\n *\n * Resolving every route just to read its path used to drag in each one's whole dependency graph, so\n * a request for a static asset built the entire GraphQL engine, every contextual schema and the AI\n * provider before finding the route it wanted.\n */\nexport interface IHttpRouteDefinition {\n    /**\n     * Identifies this route so a decorator can pick it out.\n     *\n     * Decorators DO reach `HttpRouteDefinition` (unlike `HttpRouteHandler`, which the router builds\n     * directly), so decorating it hands you every route in turn — `name` is how you tell which one\n     * you have, and whether to wrap its handler or pass it through.\n     */\n    readonly name: string;\n    readonly method: string;\n    readonly path: string;\n    readonly handler: Constructor<IHttpRoute>;\n}\n\nexport interface IHttpRouter {\n    route(request: IHttpRequest): Promise<IHttpResponse>;\n}\n\nexport const HttpRouteDefinition = new Abstraction<IHttpRouteDefinition>(\"HttpRouteDefinition\");\n/**\n * Declares a route's request handling. One shared abstraction: the router never resolves it from the\n * container (that would build every route), it builds the ONE class a matched definition points at.\n * Declaring implementations through it is what attaches their dependency metadata.\n */\nexport const HttpRouteHandler = new Abstraction<IHttpRoute>(\"HttpRouteHandler\");\nexport const HttpRouter = new Abstraction<IHttpRouter>(\"HttpRouter\");\n\nexport namespace HttpRouteDefinition {\n    export type Interface = IHttpRouteDefinition;\n}\n\nexport namespace HttpRouteHandler {\n    export type Interface = IHttpRoute;\n    /**\n     * The request handed to `handle()`: an {@link IHttpRequest} that has been through the router,\n     * so {@link IMatchedRouteDefinition} is guaranteed rather than optional.\n     */\n    export type Request = IHttpRequest & { route: IMatchedRouteDefinition };\n    /**\n     * The response handed to `handle()` — the mutable builder, not the materialized\n     * {@link IHttpResponse}. Shorthand for {@link IHttpResponseBuilder}.\n     */\n    export type Response = IHttpResponseBuilder;\n}\n\nexport namespace HttpRouter {\n    export type Interface = IHttpRouter;\n}\n\nexport class RouteNotFoundError extends Error {\n    readonly code = \"ROUTE_NOT_FOUND\" as const;\n\n    constructor(method: string, path: string) {\n        super(`Route not found: ${method} ${path}`);\n    }\n}\n"],"names":["HttpRouteDefinition","Abstraction","HttpRouteHandler","HttpRouter","RouteNotFoundError","Error","method","path"],"mappings":";AAoKO,MAAMA,sBAAsB,IAAIC,YAAkC;AAMlE,MAAMC,mBAAmB,IAAID,YAAwB;AACrD,MAAME,aAAa,IAAIF,YAAyB;AAwBhD,MAAMG,2BAA2BC;IAGpC,YAAYC,MAAc,EAAEC,IAAY,CAAE;QACtC,KAAK,CAAC,CAAC,iBAAiB,EAAED,OAAO,CAAC,EAAEC,MAAM,QAHrC,IAAI,GAAG;IAIhB;AACJ"}

package/features/http/createHttpRouteDefinition.d.ts

@@ -0,0 +1,17 @@
+import type { Constructor } from "@webiny/di";
+import type { IHttpRoute, IHttpRouteDefinition } from "../../features/http/abstractions.js";
+export interface ICreateHttpRouteDefinitionParams {
+    readonly name: string;
+    readonly method: string;
+    readonly path: string;
+    readonly handler: Constructor<IHttpRoute>;
+}
+/**
+ * Builds an `HttpRouteDefinition` implementation from plain values.
+ *
+ * For callers that only learn a route's method and path at build time — the `Api.Route` extension
+ * generates its registration from the props in `webiny.config.tsx`, so the handler file never
+ * restates them and the two can't drift. Hand-written routes should declare the definition class
+ * directly instead; it reads better and keeps the values next to the handler.
+ */
+export declare function createHttpRouteDefinition(params: ICreateHttpRouteDefinitionParams): Constructor<IHttpRouteDefinition>;

package/features/http/createHttpRouteDefinition.js

@@ -0,0 +1,18 @@
+import { HttpRouteDefinition } from "./abstractions.js";
+function createHttpRouteDefinition(params) {
+    class GeneratedHttpRouteDefinition {
+        constructor(){
+            this.name = params.name;
+            this.method = params.method;
+            this.path = params.path;
+            this.handler = params.handler;
+        }
+    }
+    return HttpRouteDefinition.createImplementation({
+        implementation: GeneratedHttpRouteDefinition,
+        dependencies: []
+    });
+}
+export { createHttpRouteDefinition };
+
+//# sourceMappingURL=createHttpRouteDefinition.js.map

package/features/http/createHttpRouteDefinition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/http/createHttpRouteDefinition.js","sources":["../../../src/features/http/createHttpRouteDefinition.ts"],"sourcesContent":["import type { Constructor } from \"@webiny/di\";\nimport { HttpRouteDefinition } from \"~/features/http/abstractions.js\";\nimport type { IHttpRoute, IHttpRouteDefinition } from \"~/features/http/abstractions.js\";\n\nexport interface ICreateHttpRouteDefinitionParams {\n    readonly name: string;\n    readonly method: string;\n    readonly path: string;\n    readonly handler: Constructor<IHttpRoute>;\n}\n\n/**\n * Builds an `HttpRouteDefinition` implementation from plain values.\n *\n * For callers that only learn a route's method and path at build time — the `Api.Route` extension\n * generates its registration from the props in `webiny.config.tsx`, so the handler file never\n * restates them and the two can't drift. Hand-written routes should declare the definition class\n * directly instead; it reads better and keeps the values next to the handler.\n */\nexport function createHttpRouteDefinition(\n    params: ICreateHttpRouteDefinitionParams\n): Constructor<IHttpRouteDefinition> {\n    class GeneratedHttpRouteDefinition implements HttpRouteDefinition.Interface {\n        readonly name = params.name;\n        readonly method = params.method;\n        readonly path = params.path;\n        readonly handler = params.handler;\n    }\n\n    return HttpRouteDefinition.createImplementation({\n        implementation: GeneratedHttpRouteDefinition,\n        dependencies: []\n    });\n}\n"],"names":["createHttpRouteDefinition","params","GeneratedHttpRouteDefinition","HttpRouteDefinition"],"mappings":";AAmBO,SAASA,0BACZC,MAAwC;IAExC,MAAMC;;iBACO,IAAI,GAAGD,OAAO,IAAI;iBAClB,MAAM,GAAGA,OAAO,MAAM;iBACtB,IAAI,GAAGA,OAAO,IAAI;iBAClB,OAAO,GAAGA,OAAO,OAAO;;IACrC;IAEA,OAAOE,oBAAoB,oBAAoB,CAAC;QAC5C,gBAAgBD;QAChB,cAAc,EAAE;IACpB;AACJ"}

package/features/http/decorators/CompressionDecorator.d.ts

@@ -0,0 +1,28 @@
+import type { IHttpRouter, IHttpRequest, IHttpResponse } from "../../../features/http/abstractions.js";
+/**
+ * Compresses HTTP response bodies with brotli/gzip when the client accepts it.
+ *
+ * Why: large command-model / entry GraphQL responses were hitting the API Gateway response-size
+ * limit and failing. The previous Fastify stack compressed responses (@fastify/compress); that was
+ * lost in the move to the event-handler / httpRoute architecture. This restores it transport-
+ * agnostically — the compressed body is emitted as a `Buffer`, which both terminal translators
+ * already handle (API Gateway base64-encodes it with `isBase64Encoded: true`; the Node server writes
+ * the raw bytes), so no translator changes are needed.
+ *
+ * Registered as the OUTERMOST HTTP decorator so it compresses the fully-formed response (after CORS
+ * and other headers are set).
+ */
+declare class CompressionDecoratorImpl implements IHttpRouter {
+    private decoratee;
+    private static readonly THRESHOLD_BYTES;
+    constructor(decoratee: IHttpRouter);
+    route(request: IHttpRequest): Promise<IHttpResponse>;
+    private static getHeader;
+    private static serializeBody;
+    private static negotiateEncoding;
+    private static mergeVary;
+}
+export declare const CompressionDecorator: typeof CompressionDecoratorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<IHttpRouter>;
+};
+export {};

package/features/http/decorators/CompressionDecorator.js

@@ -0,0 +1,66 @@
+import node_zlib from "node:zlib";
+import { promisify } from "node:util";
+import { HttpRouter } from "../abstractions.js";
+import { HttpStreamBody } from "../HttpStreamBody.js";
+const gzip = promisify(node_zlib.gzip);
+const brotli = promisify(node_zlib.brotliCompress);
+class CompressionDecoratorImpl {
+    static{
+        this.THRESHOLD_BYTES = 1024;
+    }
+    constructor(decoratee){
+        this.decoratee = decoratee;
+    }
+    async route(request) {
+        const response = await this.decoratee.route(request);
+        if (CompressionDecoratorImpl.getHeader(response.headers, "content-encoding")) return response;
+        const acceptEncoding = CompressionDecoratorImpl.getHeader(request.headers, "accept-encoding") || "";
+        const encoding = CompressionDecoratorImpl.negotiateEncoding(acceptEncoding);
+        if (!encoding) return response;
+        const serialized = CompressionDecoratorImpl.serializeBody(response.body);
+        if (!serialized || serialized.length < CompressionDecoratorImpl.THRESHOLD_BYTES) return response;
+        const compressed = "br" === encoding ? await brotli(serialized) : await gzip(serialized);
+        return {
+            ...response,
+            body: compressed,
+            headers: {
+                ...response.headers,
+                "content-encoding": encoding,
+                "content-length": String(compressed.length),
+                vary: CompressionDecoratorImpl.mergeVary(CompressionDecoratorImpl.getHeader(response.headers, "vary"))
+            }
+        };
+    }
+    static getHeader(headers, name) {
+        if (!headers) return;
+        const lower = name.toLowerCase();
+        for(const key in headers)if (key.toLowerCase() === lower) return headers[key];
+    }
+    static serializeBody(body) {
+        if (null == body) return null;
+        if (HttpStreamBody.is(body)) return null;
+        if ("string" == typeof body) return Buffer.from(body, "utf8");
+        if (Buffer.isBuffer(body) || body instanceof Uint8Array) return null;
+        return Buffer.from(JSON.stringify(body), "utf8");
+    }
+    static negotiateEncoding(acceptEncoding) {
+        const value = acceptEncoding.toLowerCase();
+        if (value.includes("br")) return "br";
+        if (value.includes("gzip")) return "gzip";
+        return null;
+    }
+    static mergeVary(existing) {
+        const parts = new Set((existing || "").split(",").map((part)=>part.trim().toLowerCase()).filter(Boolean));
+        parts.add("accept-encoding");
+        return [
+            ...parts
+        ].join(", ");
+    }
+}
+const CompressionDecorator = HttpRouter.createDecorator({
+    decorator: CompressionDecoratorImpl,
+    dependencies: []
+});
+export { CompressionDecorator };
+
+//# sourceMappingURL=CompressionDecorator.js.map

package/features/http/decorators/CompressionDecorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/http/decorators/CompressionDecorator.js","sources":["../../../../src/features/http/decorators/CompressionDecorator.ts"],"sourcesContent":["import zlib from \"node:zlib\";\nimport { promisify } from \"node:util\";\nimport { HttpRouter } from \"~/features/http/abstractions.js\";\nimport type { IHttpRouter, IHttpRequest, IHttpResponse } from \"~/features/http/abstractions.js\";\nimport { HttpStreamBody } from \"~/features/http/HttpStreamBody.js\";\n\nconst gzip = promisify(zlib.gzip);\nconst brotli = promisify(zlib.brotliCompress);\n\n/**\n * Compresses HTTP response bodies with brotli/gzip when the client accepts it.\n *\n * Why: large command-model / entry GraphQL responses were hitting the API Gateway response-size\n * limit and failing. The previous Fastify stack compressed responses (@fastify/compress); that was\n * lost in the move to the event-handler / httpRoute architecture. This restores it transport-\n * agnostically — the compressed body is emitted as a `Buffer`, which both terminal translators\n * already handle (API Gateway base64-encodes it with `isBase64Encoded: true`; the Node server writes\n * the raw bytes), so no translator changes are needed.\n *\n * Registered as the OUTERMOST HTTP decorator so it compresses the fully-formed response (after CORS\n * and other headers are set).\n */\nclass CompressionDecoratorImpl implements IHttpRouter {\n    // Don't compress tiny payloads — the gzip/br framing overhead can make them LARGER, and the CPU\n    // cost isn't worth it. Matches the threshold used by the old Fastify (@fastify/compress) setup.\n    private static readonly THRESHOLD_BYTES = 1024;\n\n    constructor(private decoratee: IHttpRouter) {}\n\n    async route(request: IHttpRequest): Promise<IHttpResponse> {\n        const response = await this.decoratee.route(request);\n\n        // Never double-encode a body a route already compressed itself.\n        if (CompressionDecoratorImpl.getHeader(response.headers, \"content-encoding\")) {\n            return response;\n        }\n\n        const acceptEncoding =\n            CompressionDecoratorImpl.getHeader(request.headers, \"accept-encoding\") || \"\";\n        const encoding = CompressionDecoratorImpl.negotiateEncoding(acceptEncoding);\n        if (!encoding) {\n            return response;\n        }\n\n        const serialized = CompressionDecoratorImpl.serializeBody(response.body);\n        if (!serialized || serialized.length < CompressionDecoratorImpl.THRESHOLD_BYTES) {\n            return response;\n        }\n\n        const compressed = encoding === \"br\" ? await brotli(serialized) : await gzip(serialized);\n\n        return {\n            ...response,\n            body: compressed,\n            headers: {\n                ...response.headers,\n                \"content-encoding\": encoding,\n                \"content-length\": String(compressed.length),\n                vary: CompressionDecoratorImpl.mergeVary(\n                    CompressionDecoratorImpl.getHeader(response.headers, \"vary\")\n                )\n            }\n        };\n    }\n\n    // Case-insensitive header lookup. Header casing isn't guaranteed across transports (Node\n    // lowercases them, API Gateway payload formats vary), so we can't index by a fixed key.\n    private static getHeader(\n        headers: Record<string, string> | undefined,\n        name: string\n    ): string | undefined {\n        if (!headers) {\n            return undefined;\n        }\n        const lower = name.toLowerCase();\n        for (const key in headers) {\n            if (key.toLowerCase() === lower) {\n                return headers[key];\n            }\n        }\n        return undefined;\n    }\n\n    // Serialize the response body to the exact bytes the terminal transport would have written, so\n    // the size check and the compressed output match what the client receives. Binary bodies (Buffer\n    // / Uint8Array — e.g. asset delivery images) are returned as `null`: they're already in a\n    // compressed media format, so gzipping them wastes CPU and can even enlarge them.\n    private static serializeBody(body: any): Buffer | null {\n        if (body === undefined || body === null) {\n            return null;\n        }\n        // A streaming body must never be touched. Compressing it would mean draining it here, which\n        // defeats incremental delivery, and it must not fall through to the JSON branch below: that\n        // would REPLACE the body with a gzipped `{\"source\":...}` and silently lose the stream. A\n        // generator source stringifies to `{}` and so survives on size alone, but an object source\n        // with enumerable data does not.\n        if (HttpStreamBody.is(body)) {\n            return null;\n        }\n        if (typeof body === \"string\") {\n            return Buffer.from(body, \"utf8\");\n        }\n        if (Buffer.isBuffer(body) || body instanceof Uint8Array) {\n            return null;\n        }\n        return Buffer.from(JSON.stringify(body), \"utf8\");\n    }\n\n    // Pick the best encoding the client accepts. Prefer brotli (better ratio → more headroom under\n    // the API Gateway response-size limit) and fall back to gzip. Only encodings the client\n    // explicitly lists are used, so non-browser clients that send `accept-encoding: gzip` still get a\n    // body they can read.\n    private static negotiateEncoding(acceptEncoding: string): \"br\" | \"gzip\" | null {\n        const value = acceptEncoding.toLowerCase();\n        if (value.includes(\"br\")) {\n            return \"br\";\n        }\n        if (value.includes(\"gzip\")) {\n            return \"gzip\";\n        }\n        return null;\n    }\n\n    private static mergeVary(existing: string | undefined): string {\n        const parts = new Set(\n            (existing || \"\")\n                .split(\",\")\n                .map(part => part.trim().toLowerCase())\n                .filter(Boolean)\n        );\n        parts.add(\"accept-encoding\");\n        return [...parts].join(\", \");\n    }\n}\n\nexport const CompressionDecorator = HttpRouter.createDecorator({\n    decorator: CompressionDecoratorImpl,\n    dependencies: []\n});\n"],"names":["gzip","promisify","zlib","brotli","CompressionDecoratorImpl","decoratee","request","response","acceptEncoding","encoding","serialized","compressed","String","headers","name","lower","key","body","HttpStreamBody","Buffer","Uint8Array","JSON","value","existing","parts","Set","part","Boolean","CompressionDecorator","HttpRouter"],"mappings":";;;;AAMA,MAAMA,OAAOC,UAAUC,UAAAA,IAAS;AAChC,MAAMC,SAASF,UAAUC,UAAAA,cAAmB;AAe5C,MAAME;;aAGsB,eAAe,GAAG;;IAE1C,YAAoBC,SAAsB,CAAE;aAAxBA,SAAS,GAATA;IAAyB;IAE7C,MAAM,MAAMC,OAAqB,EAA0B;QACvD,MAAMC,WAAW,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAACD;QAG5C,IAAIF,yBAAyB,SAAS,CAACG,SAAS,OAAO,EAAE,qBACrD,OAAOA;QAGX,MAAMC,iBACFJ,yBAAyB,SAAS,CAACE,QAAQ,OAAO,EAAE,sBAAsB;QAC9E,MAAMG,WAAWL,yBAAyB,iBAAiB,CAACI;QAC5D,IAAI,CAACC,UACD,OAAOF;QAGX,MAAMG,aAAaN,yBAAyB,aAAa,CAACG,SAAS,IAAI;QACvE,IAAI,CAACG,cAAcA,WAAW,MAAM,GAAGN,yBAAyB,eAAe,EAC3E,OAAOG;QAGX,MAAMI,aAAaF,AAAa,SAAbA,WAAoB,MAAMN,OAAOO,cAAc,MAAMV,KAAKU;QAE7E,OAAO;YACH,GAAGH,QAAQ;YACX,MAAMI;YACN,SAAS;gBACL,GAAGJ,SAAS,OAAO;gBACnB,oBAAoBE;gBACpB,kBAAkBG,OAAOD,WAAW,MAAM;gBAC1C,MAAMP,yBAAyB,SAAS,CACpCA,yBAAyB,SAAS,CAACG,SAAS,OAAO,EAAE;YAE7D;QACJ;IACJ;IAIA,OAAe,UACXM,OAA2C,EAC3CC,IAAY,EACM;QAClB,IAAI,CAACD,SACD;QAEJ,MAAME,QAAQD,KAAK,WAAW;QAC9B,IAAK,MAAME,OAAOH,QACd,IAAIG,IAAI,WAAW,OAAOD,OACtB,OAAOF,OAAO,CAACG,IAAI;IAI/B;IAMA,OAAe,cAAcC,IAAS,EAAiB;QACnD,IAAIA,QAAAA,MACA,OAAO;QAOX,IAAIC,eAAe,EAAE,CAACD,OAClB,OAAO;QAEX,IAAI,AAAgB,YAAhB,OAAOA,MACP,OAAOE,OAAO,IAAI,CAACF,MAAM;QAE7B,IAAIE,OAAO,QAAQ,CAACF,SAASA,gBAAgBG,YACzC,OAAO;QAEX,OAAOD,OAAO,IAAI,CAACE,KAAK,SAAS,CAACJ,OAAO;IAC7C;IAMA,OAAe,kBAAkBT,cAAsB,EAAwB;QAC3E,MAAMc,QAAQd,eAAe,WAAW;QACxC,IAAIc,MAAM,QAAQ,CAAC,OACf,OAAO;QAEX,IAAIA,MAAM,QAAQ,CAAC,SACf,OAAO;QAEX,OAAO;IACX;IAEA,OAAe,UAAUC,QAA4B,EAAU;QAC3D,MAAMC,QAAQ,IAAIC,IACbF,AAAAA,CAAAA,YAAY,EAAC,EACT,KAAK,CAAC,KACN,GAAG,CAACG,CAAAA,OAAQA,KAAK,IAAI,GAAG,WAAW,IACnC,MAAM,CAACC;QAEhBH,MAAM,GAAG,CAAC;QACV,OAAO;eAAIA;SAAM,CAAC,IAAI,CAAC;IAC3B;AACJ;AAEO,MAAMI,uBAAuBC,WAAW,eAAe,CAAC;IAC3D,WAAWzB;IACX,cAAc,EAAE;AACpB"}

package/features/http/decorators/SecureHeadersDecorator.js

@@ -1,5 +1,5 @@
 import { HttpRouter } from "../abstractions.js";
-const ALLOWED_HEADERS = "accept, authorization, cache-control, content-type, x-i18n-locale, x-tenant";
+const ALLOWED_HEADERS = "accept, authorization, cache-control, content-type, x-i18n-locale, x-tenant, x-webiny-authorization, x-amz-content-sha256";
 class SecureHeadersDecoratorImpl {
     constructor(decoratee){
         this.decoratee = decoratee;

package/features/http/decorators/SecureHeadersDecorator.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/http/decorators/SecureHeadersDecorator.js","sources":["../../../../src/features/http/decorators/SecureHeadersDecorator.ts"],"sourcesContent":["import { HttpRouter } from \"~/features/http/abstractions.js\";\nimport type { IHttpRouter, IHttpRequest, IHttpResponse } from \"~/features/http/abstractions.js\";\n\nconst ALLOWED_HEADERS = [\n    \"accept\",\n    \"authorization\",\n    \"cache-control\",\n    \"content-type\",\n    \"x-i18n-locale\",\n    \"x-tenant\"\n].join(\", \");\n\nclass SecureHeadersDecoratorImpl implements IHttpRouter {\n    constructor(private decoratee: IHttpRouter) {}\n\n    async route(request: IHttpRequest): Promise<IHttpResponse> {\n        if (request.method === \"OPTIONS\") {\n            return this.optionsResponse(request);\n        }\n\n        const response = await this.decoratee.route(request);\n\n        return {\n            ...response,\n            headers: {\n                ...response.headers,\n                \"access-control-allow-origin\": request.headers[\"origin\"] || \"*\",\n                \"access-control-allow-credentials\": \"true\",\n                vary: \"origin\"\n            }\n        };\n    }\n\n    private optionsResponse(request: IHttpRequest): IHttpResponse {\n        return {\n            statusCode: 204,\n            headers: {\n                \"access-control-allow-origin\": request.headers[\"origin\"] || \"*\",\n                \"access-control-allow-credentials\": \"true\",\n                \"access-control-allow-methods\": \"OPTIONS,POST,GET,DELETE,PUT,PATCH\",\n                \"access-control-allow-headers\": ALLOWED_HEADERS,\n                \"access-control-max-age\": \"86400\",\n                \"cache-control\": \"public, max-age=86400\"\n            }\n        };\n    }\n}\n\nexport const SecureHeadersDecorator = HttpRouter.createDecorator({\n    decorator: SecureHeadersDecoratorImpl,\n    dependencies: []\n});\n"],"names":["ALLOWED_HEADERS","SecureHeadersDecoratorImpl","decoratee","request","response","SecureHeadersDecorator","HttpRouter"],"mappings":";AAGA,MAAMA,kBAAkB;AASxB,MAAMC;IACF,YAAoBC,SAAsB,CAAE;aAAxBA,SAAS,GAATA;IAAyB;IAE7C,MAAM,MAAMC,OAAqB,EAA0B;QACvD,IAAIA,AAAmB,cAAnBA,QAAQ,MAAM,EACd,OAAO,IAAI,CAAC,eAAe,CAACA;QAGhC,MAAMC,WAAW,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAACD;QAE5C,OAAO;YACH,GAAGC,QAAQ;YACX,SAAS;gBACL,GAAGA,SAAS,OAAO;gBACnB,+BAA+BD,QAAQ,OAAO,CAAC,SAAS,IAAI;gBAC5D,oCAAoC;gBACpC,MAAM;YACV;QACJ;IACJ;IAEQ,gBAAgBA,OAAqB,EAAiB;QAC1D,OAAO;YACH,YAAY;YACZ,SAAS;gBACL,+BAA+BA,QAAQ,OAAO,CAAC,SAAS,IAAI;gBAC5D,oCAAoC;gBACpC,gCAAgC;gBAChC,gCAAgCH;gBAChC,0BAA0B;gBAC1B,iBAAiB;YACrB;QACJ;IACJ;AACJ;AAEO,MAAMK,yBAAyBC,WAAW,eAAe,CAAC;IAC7D,WAAWL;IACX,cAAc,EAAE;AACpB"}
+{"version":3,"file":"features/http/decorators/SecureHeadersDecorator.js","sources":["../../../../src/features/http/decorators/SecureHeadersDecorator.ts"],"sourcesContent":["import { HttpRouter } from \"~/features/http/abstractions.js\";\nimport type { IHttpRouter, IHttpRequest, IHttpResponse } from \"~/features/http/abstractions.js\";\n\nconst ALLOWED_HEADERS = [\n    \"accept\",\n    \"authorization\",\n    \"cache-control\",\n    \"content-type\",\n    \"x-i18n-locale\",\n    \"x-tenant\",\n    // Streaming clients send the auth token here rather than in `Authorization`, which SigV4 occupies\n    // when a Lambda Function URL sits behind CloudFront with Origin Access Control. Omitting it makes\n    // the browser fail the preflight CORS check and never send the actual request.\n    \"x-webiny-authorization\",\n    // The SigV4 payload hash a streaming client sends when its request carries a body, because OAC\n    // signs the request without hashing the body itself. Same consequence as above if omitted: the\n    // browser fails the preflight and the real request is never sent.\n    \"x-amz-content-sha256\"\n].join(\", \");\n\nclass SecureHeadersDecoratorImpl implements IHttpRouter {\n    constructor(private decoratee: IHttpRouter) {}\n\n    async route(request: IHttpRequest): Promise<IHttpResponse> {\n        if (request.method === \"OPTIONS\") {\n            return this.optionsResponse(request);\n        }\n\n        const response = await this.decoratee.route(request);\n\n        return {\n            ...response,\n            headers: {\n                ...response.headers,\n                \"access-control-allow-origin\": request.headers[\"origin\"] || \"*\",\n                \"access-control-allow-credentials\": \"true\",\n                vary: \"origin\"\n            }\n        };\n    }\n\n    private optionsResponse(request: IHttpRequest): IHttpResponse {\n        return {\n            statusCode: 204,\n            headers: {\n                \"access-control-allow-origin\": request.headers[\"origin\"] || \"*\",\n                \"access-control-allow-credentials\": \"true\",\n                \"access-control-allow-methods\": \"OPTIONS,POST,GET,DELETE,PUT,PATCH\",\n                \"access-control-allow-headers\": ALLOWED_HEADERS,\n                \"access-control-max-age\": \"86400\",\n                \"cache-control\": \"public, max-age=86400\"\n            }\n        };\n    }\n}\n\nexport const SecureHeadersDecorator = HttpRouter.createDecorator({\n    decorator: SecureHeadersDecoratorImpl,\n    dependencies: []\n});\n"],"names":["ALLOWED_HEADERS","SecureHeadersDecoratorImpl","decoratee","request","response","SecureHeadersDecorator","HttpRouter"],"mappings":";AAGA,MAAMA,kBAAkB;AAiBxB,MAAMC;IACF,YAAoBC,SAAsB,CAAE;aAAxBA,SAAS,GAATA;IAAyB;IAE7C,MAAM,MAAMC,OAAqB,EAA0B;QACvD,IAAIA,AAAmB,cAAnBA,QAAQ,MAAM,EACd,OAAO,IAAI,CAAC,eAAe,CAACA;QAGhC,MAAMC,WAAW,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAACD;QAE5C,OAAO;YACH,GAAGC,QAAQ;YACX,SAAS;gBACL,GAAGA,SAAS,OAAO;gBACnB,+BAA+BD,QAAQ,OAAO,CAAC,SAAS,IAAI;gBAC5D,oCAAoC;gBACpC,MAAM;YACV;QACJ;IACJ;IAEQ,gBAAgBA,OAAqB,EAAiB;QAC1D,OAAO;YACH,YAAY;YACZ,SAAS;gBACL,+BAA+BA,QAAQ,OAAO,CAAC,SAAS,IAAI;gBAC5D,oCAAoC;gBACpC,gCAAgC;gBAChC,gCAAgCH;gBAChC,0BAA0B;gBAC1B,iBAAiB;YACrB;QACJ;IACJ;AACJ;AAEO,MAAMK,yBAAyBC,WAAW,eAAe,CAAC;IAC7D,WAAWL;IACX,cAAc,EAAE;AACpB"}

package/features/http/decorators/index.d.ts

@@ -1 +1,2 @@
 export * from "./SecureHeadersDecorator.js";
+export * from "./CompressionDecorator.js";

package/features/http/decorators/index.js

@@ -1 +1,2 @@
 export * from "./SecureHeadersDecorator.js";
+export * from "./CompressionDecorator.js";

package/features/http/feature.js

@@ -1,13 +1,13 @@
 import { createFeature } from "@webiny/feature/api";
 import { HttpRouterImpl } from "./HttpRouter.js";
 import { SecureHeadersDecorator } from "./decorators/SecureHeadersDecorator.js";
-import { RequestContextInitializerDecorator } from "./decorators/RequestContextInitializerDecorator.js";
+import { CompressionDecorator } from "./decorators/CompressionDecorator.js";
 const HttpFeature = createFeature({
     name: "Http",
     register (container) {
         container.register(HttpRouterImpl);
-        container.registerDecorator(RequestContextInitializerDecorator);
         container.registerDecorator(SecureHeadersDecorator);
+        container.registerDecorator(CompressionDecorator);
     }
 });
 export { HttpFeature };

package/features/http/feature.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/http/feature.js","sources":["../../../src/features/http/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { HttpRouterImpl } from \"~/features/http/HttpRouter.js\";\nimport { SecureHeadersDecorator } from \"~/features/http/decorators/SecureHeadersDecorator.js\";\nimport { RequestContextInitializerDecorator } from \"~/features/http/decorators/RequestContextInitializerDecorator.js\";\n\nexport const HttpFeature = createFeature({\n    name: \"Http\",\n    register(container) {\n        // Transient so per-request routes (e.g. GraphQLRoute) resolve from child container\n        container.register(HttpRouterImpl);\n        // Registered before SecureHeaders so SecureHeaders stays the OUTER decorator (it short-\n        // circuits OPTIONS before we do the per-request initializer work). This runs the post-auth\n        // RequestContextInitializers for every HTTP route, not just the GraphQL engine.\n        container.registerDecorator(RequestContextInitializerDecorator);\n        container.registerDecorator(SecureHeadersDecorator);\n    }\n});\n"],"names":["HttpFeature","createFeature","container","HttpRouterImpl","RequestContextInitializerDecorator","SecureHeadersDecorator"],"mappings":";;;;AAKO,MAAMA,cAAcC,cAAc;IACrC,MAAM;IACN,UAASC,SAAS;QAEdA,UAAU,QAAQ,CAACC;QAInBD,UAAU,iBAAiB,CAACE;QAC5BF,UAAU,iBAAiB,CAACG;IAChC;AACJ"}
+{"version":3,"file":"features/http/feature.js","sources":["../../../src/features/http/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/api\";\nimport { HttpRouterImpl } from \"~/features/http/HttpRouter.js\";\nimport { SecureHeadersDecorator } from \"~/features/http/decorators/SecureHeadersDecorator.js\";\nimport { CompressionDecorator } from \"~/features/http/decorators/CompressionDecorator.js\";\n\nexport const HttpFeature = createFeature({\n    name: \"Http\",\n    register(container) {\n        // Transient so per-request routes (e.g. GraphQLRoute) resolve from child container\n        container.register(HttpRouterImpl);\n        container.registerDecorator(SecureHeadersDecorator);\n        // Registered last so it's the OUTERMOST decorator: it compresses the fully-formed response\n        // (after CORS/other headers are set). Emits a gzip/br Buffer body — both terminal transports\n        // already handle Buffers (API Gateway base64 + isBase64Encoded; Node server raw bytes).\n        container.registerDecorator(CompressionDecorator);\n    }\n});\n"],"names":["HttpFeature","createFeature","container","HttpRouterImpl","SecureHeadersDecorator","CompressionDecorator"],"mappings":";;;;AAKO,MAAMA,cAAcC,cAAc;IACrC,MAAM;IACN,UAASC,SAAS;QAEdA,UAAU,QAAQ,CAACC;QACnBD,UAAU,iBAAiB,CAACE;QAI5BF,UAAU,iBAAiB,CAACG;IAChC;AACJ"}

package/features/http/index.d.ts

@@ -1,4 +1,9 @@
 export * from "./abstractions.js";
 export * from "./HttpRouter.js";
+export * from "./HttpStreamBody.js";
+export * from "./toSseFrame.js";
+export * from "./HttpResponseBuilder.js";
+export * from "./invokeHttpRoute.js";
 export * from "./decorators/index.js";
 export * from "./feature.js";
+export * from "./createHttpRouteDefinition.js";

package/features/http/index.js

@@ -1,4 +1,9 @@
 export * from "./abstractions.js";
 export * from "./HttpRouter.js";
+export * from "./HttpStreamBody.js";
+export * from "./toSseFrame.js";
+export * from "./HttpResponseBuilder.js";
+export * from "./invokeHttpRoute.js";
 export * from "./decorators/index.js";
 export * from "./feature.js";
+export * from "./createHttpRouteDefinition.js";

package/features/http/invokeHttpRoute.d.ts

@@ -0,0 +1,17 @@
+import { HttpResponseBuilder } from "./HttpResponseBuilder.js";
+import type { IHttpRequest, IHttpResponse, IHttpRoute } from "./abstractions.js";
+/**
+ * Normalize whatever a route's `handle()` returned into an IHttpResponse.
+ *
+ * A route can (a) return the response builder it was handed, (b) mutate it and return nothing, or
+ * (c) return a plain IHttpResponse object — the pre-builder style. In case (c) anything set on the
+ * builder is merged UNDERNEATH the returned object, so a route can mix the two (e.g.
+ * `response.cookie(...)` plus a literal return) and the explicit return wins on conflicts.
+ */
+export declare function toHttpResponse(result: unknown, builder: HttpResponseBuilder): IHttpResponse;
+/**
+ * Run a single route and get its IHttpResponse — the same call + normalization `HttpRouter` does,
+ * minus the path matching. Use it to exercise a route directly (typically in tests) instead of
+ * calling `route.handle()` by hand, which would leave the response builder undefined.
+ */
+export declare function invokeHttpRoute(route: IHttpRoute, request: IHttpRequest): Promise<IHttpResponse>;

package/features/http/invokeHttpRoute.js

@@ -0,0 +1,32 @@
+import { HttpResponseBuilder } from "./HttpResponseBuilder.js";
+function isResponseBuilder(value) {
+    return "object" == typeof value && null !== value && "function" == typeof value.toResponse;
+}
+function toHttpResponse(result, builder) {
+    if (null == result) return builder.toResponse();
+    if (isResponseBuilder(result)) return result.toResponse();
+    const response = result;
+    if (!builder.isModified()) return response;
+    const built = builder.toResponse();
+    const cookies = [
+        ...built.cookies ?? [],
+        ...response.cookies ?? []
+    ];
+    return {
+        ...response,
+        headers: {
+            ...built.headers,
+            ...response.headers
+        },
+        ...cookies.length > 0 ? {
+            cookies
+        } : {}
+    };
+}
+async function invokeHttpRoute(route, request) {
+    const response = new HttpResponseBuilder();
+    return toHttpResponse(await route.handle(request, response), response);
+}
+export { invokeHttpRoute, toHttpResponse };
+
+//# sourceMappingURL=invokeHttpRoute.js.map

package/features/http/invokeHttpRoute.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/http/invokeHttpRoute.js","sources":["../../../src/features/http/invokeHttpRoute.ts"],"sourcesContent":["import { HttpResponseBuilder } from \"./HttpResponseBuilder.js\";\nimport type {\n    IHttpRequest,\n    IHttpResponse,\n    IHttpResponseBuilder,\n    IHttpRoute\n} from \"./abstractions.js\";\n\nfunction isResponseBuilder(value: unknown): value is IHttpResponseBuilder {\n    return (\n        typeof value === \"object\" &&\n        value !== null &&\n        typeof (value as IHttpResponseBuilder).toResponse === \"function\"\n    );\n}\n\n/**\n * Normalize whatever a route's `handle()` returned into an IHttpResponse.\n *\n * A route can (a) return the response builder it was handed, (b) mutate it and return nothing, or\n * (c) return a plain IHttpResponse object — the pre-builder style. In case (c) anything set on the\n * builder is merged UNDERNEATH the returned object, so a route can mix the two (e.g.\n * `response.cookie(...)` plus a literal return) and the explicit return wins on conflicts.\n */\nexport function toHttpResponse(result: unknown, builder: HttpResponseBuilder): IHttpResponse {\n    if (result === undefined || result === null) {\n        return builder.toResponse();\n    }\n\n    if (isResponseBuilder(result)) {\n        return result.toResponse();\n    }\n\n    const response = result as IHttpResponse;\n\n    if (!builder.isModified()) {\n        return response;\n    }\n\n    const built = builder.toResponse();\n    const cookies = [...(built.cookies ?? []), ...(response.cookies ?? [])];\n\n    return {\n        ...response,\n        headers: { ...built.headers, ...response.headers },\n        ...(cookies.length > 0 ? { cookies } : {})\n    };\n}\n\n/**\n * Run a single route and get its IHttpResponse — the same call + normalization `HttpRouter` does,\n * minus the path matching. Use it to exercise a route directly (typically in tests) instead of\n * calling `route.handle()` by hand, which would leave the response builder undefined.\n */\nexport async function invokeHttpRoute(\n    route: IHttpRoute,\n    request: IHttpRequest\n): Promise<IHttpResponse> {\n    const response = new HttpResponseBuilder();\n    return toHttpResponse(await route.handle(request, response), response);\n}\n"],"names":["isResponseBuilder","value","toHttpResponse","result","builder","response","built","cookies","invokeHttpRoute","route","request","HttpResponseBuilder"],"mappings":";AAQA,SAASA,kBAAkBC,KAAc;IACrC,OACI,AAAiB,YAAjB,OAAOA,SACPA,AAAU,SAAVA,SACA,AAAsD,cAAtD,OAAQA,MAA+B,UAAU;AAEzD;AAUO,SAASC,eAAeC,MAAe,EAAEC,OAA4B;IACxE,IAAID,QAAAA,QACA,OAAOC,QAAQ,UAAU;IAG7B,IAAIJ,kBAAkBG,SAClB,OAAOA,OAAO,UAAU;IAG5B,MAAME,WAAWF;IAEjB,IAAI,CAACC,QAAQ,UAAU,IACnB,OAAOC;IAGX,MAAMC,QAAQF,QAAQ,UAAU;IAChC,MAAMG,UAAU;WAAKD,MAAM,OAAO,IAAI,EAAE;WAAOD,SAAS,OAAO,IAAI,EAAE;KAAE;IAEvE,OAAO;QACH,GAAGA,QAAQ;QACX,SAAS;YAAE,GAAGC,MAAM,OAAO;YAAE,GAAGD,SAAS,OAAO;QAAC;QACjD,GAAIE,QAAQ,MAAM,GAAG,IAAI;YAAEA;QAAQ,IAAI,CAAC,CAAC;IAC7C;AACJ;AAOO,eAAeC,gBAClBC,KAAiB,EACjBC,OAAqB;IAErB,MAAML,WAAW,IAAIM;IACrB,OAAOT,eAAe,MAAMO,MAAM,MAAM,CAACC,SAASL,WAAWA;AACjE"}