@webpieces/core-util 0.4.957 → 0.4.958

package/src/http/auth-mode.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-mode.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/auth-mode.ts"],"names":[],"mappings":";;;AAkLA,kBAA6D;AAE7D,0CAA2G;AAE3G,4BAA6H;AAE7H,oCAA4G;AAE5G,0BAAuF;AAEvF,wBAAsI;AApItI,wFAAwF;AACxF,MAAa,QAAQ;IAKG;IAJX,OAAO,CAAqC;IAErD,YACI,OAA2C,EAC3B,YAAgC;QAAhC,iBAAY,GAAZ,YAAY,CAAoB;QAEhD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAuC,CAAC;QACjI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,oIAAoI;IAC5H,MAAM,CAAC,QAAQ,CAAC,MAAgB;QACpC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU;gBACjD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAgB,EAAE,CAAC;gBAC1F,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACnC,KAAK,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAA4B,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAsB,EAAE,CAAC,CAAC;YAChM,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;CACJ;AAvBD,4BAuBC;AAED,MAAa,eAAe;IACxB,oIAAoI;IACpI,MAAM,CAAC,QAAQ,CAAC,IAAc;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAChK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClG,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YAC3F,CAAC;QACL,CAAC;aAAM,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC7G,CAAC;IAED;;;;OAIG;IACH,oIAAoI;IAC5H,MAAM,CAAC,aAAa,CAAC,MAAgB;QACzC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/E,CAAC;IAED,oIAAoI;IAC5H,MAAM,CAAC,cAAc,CAAC,MAAgB;QAC1C,IAAI,IAAuB,CAAC;QAC5B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,KAAK,CAAC;YACX,KAAK,QAAQ;gBAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAM;YACtC,KAAK,MAAM;gBAAE,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAM;YACjD,KAAK,eAAe;gBAChB,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC7B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;gBAAC,MAAM;YAC9D,KAAK,SAAS;gBACV,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACxB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAAC,MAAM;YACpD,KAAK,QAAQ;gBACT,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;gBACzC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBAC5I,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBAC1C,IAAI,UAAU,CAAC,EAAE,KAAK,QAAQ;wBAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;yBACjE,IAAI,UAAU,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBACrI,CAAC;gBACD,MAAM;YACV,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,mGAAmG,CAAC,CAAC;QAClI,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,kDAAkD,CAAC,CAAC;QAC5H,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,oIAAoI;IAC5H,MAAM,CAAC,QAAQ,CAAC,MAAsB;QAC1C,IAAI,MAAM,CAAC,WAAW,KAAK,cAAc;YAAE,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAClI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACrK,MAAM,IAAI,KAAK,CAAC,sIAAsI,CAAC,CAAC;QAC5J,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,oIAAoI;IAC5H,MAAM,CAAC,gBAAgB,CAAC,GAA8B;QAC1D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;QACxI,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,IAAI,sIAAsI,CAAC,CAAC;QACrM,CAAC;IACL,CAAC;IAED,oIAAoI;IAC5H,MAAM,CAAC,WAAW,CAAC,KAAa,EAAE,KAAa;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IAC1G,CAAC;CACJ;AA7FD,0CA6FC;AAED,yFAAyF;AACzF,SAAgB,GAAG,KAAiB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC7D,yFAAyF;AACzF,SAAgB,eAAe,KAAqB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;AAC3G,yFAAyF;AACzF,SAAgB,QAAQ,CAAC,OAAoB,IAAoB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC7H,yFAAyF;AACzF,SAAgB,YAAY,CAAC,SAAiB,IAAgB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AAC5G,yFAAyF;AACzF,SAAgB,OAAO,CAAC,IAAY,IAAgB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACvF,yFAAyF;AACzF,SAAgB,MAAM,CAAC,MAAc,EAAE,WAA8B,IAAgB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC","sourcesContent":["import type { AnyContextKey } from '../ContextKey';\n\n/**\n * WHERE one api-key credential rides.\n *\n * A header credential names the {@link AnyContextKey ContextKey} that carries it — NEVER a header-name\n * string. The key's `httpHeader` is the wire name, so the ONE definition of each header (the\n * ContextKey) is reused on every surface: `RequestContext` put/get, the client/server header\n * transfer, this declaration, and the published OpenAPI document. A string here was a second copy a\n * rename left stale (#1249). The key MUST declare an `httpHeader` — {@link AuthDeclaration} refuses\n * one that does not, and the OpenAPI generator reads the header name off the key's\n * `ContextKey.trusted(...)` / `ContextKey.untrusted(...)` definition.\n */\nexport type ApiKeyCredential =\n    | { in: 'header'; key: AnyContextKey; description?: string }\n    | { in: 'bearer'; key?: never; description?: string };\n\nexport type ApiKeyCredentials = readonly [ApiKeyCredential, ...ApiKeyCredential[]];\n\n/**\n * The service accounts an `oidcSvcs([...])` endpoint names, at least one: an empty list is not a\n * policy anybody could mean, so it does not compile. Each entry resolves as `'self'` (this service's\n * runtime SA), a bare id (`<id>@<project>.iam.gserviceaccount.com`) or a full email (verbatim).\n */\nexport type OidcCallers = readonly [string, ...string[]];\n\n/**\n * WHICH Google-signed callers an OIDC endpoint accepts, named by `callerScope`:\n * - `'same-project'` (`oidcSameProject()`): any service account of THIS GCP project. Off GCP there is\n *   no project, so the check is open.\n * - `'services'` (`oidcSvcs([...])`): exactly the listed service accounts, which may belong to other\n *   projects.\n * One endpoint may declare one of each; see {@link OidcAuthMethods}.\n */\nexport type OidcAuthMethod =\n    | { kind: 'oidc'; callerScope: 'same-project' }\n    | { kind: 'oidc'; callerScope: 'services'; callers: OidcCallers };\n\n/**\n * The OIDC methods ONE endpoint declares, in declaration order: one, or one per caller scope. They are\n * ONE bearer credential, so a verifier receives them together, checks the token's signature once, and\n * admits the call when ANY of them admits the caller.\n */\nexport type OidcAuthMethods = readonly [OidcAuthMethod, ...OidcAuthMethod[]];\n\n/** One concrete mechanism; user policy belongs exclusively to WpAuthorization. */\nexport type AuthMethod =\n    | { kind: 'jwt' }\n    | OidcAuthMethod\n    | { kind: 'shared-secret'; secretKey: string }\n    | { kind: 'webhook'; name: string }\n    | { kind: 'apikey'; regime: string; credentials: ApiKeyCredentials };\n\nexport type AuthMethods = readonly [AuthMethod, ...AuthMethod[]];\nexport type AuthMode = AuthMethod | { kind: 'public' };\n\n/** Alternatives remain unresolved until a concrete mechanism is chosen for this hop. */\nexport class AuthMeta {\n    readonly methods: readonly [AuthMode, ...AuthMode[]];\n\n    constructor(\n        methods: readonly [AuthMode, ...AuthMode[]],\n        public readonly publicReason: string | undefined,\n    ) {\n        this.methods = methods;\n        AuthDeclaration.validate(this);\n        this.methods = Object.freeze(methods.map((method: AuthMode) => AuthMeta.snapshot(method))) as readonly [AuthMode, ...AuthMode[]];\n        Object.freeze(this);\n    }\n\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static snapshot(method: AuthMode): AuthMode {\n        switch (method.kind) {\n            case 'oidc': return method.callerScope === 'services'\n                ? Object.freeze({ ...method, callers: Object.freeze([...method.callers]) as OidcCallers })\n                : Object.freeze({ ...method });\n            case 'apikey': return Object.freeze({ ...method, credentials: Object.freeze(method.credentials.map((credential: ApiKeyCredential) => Object.freeze({ ...credential }))) as ApiKeyCredentials });\n            default: return Object.freeze({ ...method });\n        }\n    }\n}\n\nexport class AuthDeclaration {\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    static validate(meta: AuthMeta): void {\n        if (!Array.isArray(meta.methods) || meta.methods.length === 0) throw new Error('@WpAuth requires a nonempty methods tuple.');\n        const kinds = new Set<string>();\n        for (const method of meta.methods) {\n            if (!method || typeof method !== 'object' || kinds.has(this.uniquenessKey(method))) throw new Error('@WpAuth rejects duplicate or invalid credential methods.');\n            kinds.add(this.uniquenessKey(method));\n            this.validateMethod(method);\n        }\n        if (kinds.has('public')) {\n            if (meta.methods.length !== 1 || typeof meta.publicReason !== 'string' || !meta.publicReason.trim()) {\n                throw new Error('Public auth must be declared separately with @WpAuthPublic(reason).');\n            }\n        } else if (meta.publicReason !== undefined) throw new Error('Protected @WpAuth rejects public reasons.');\n    }\n\n    /**\n     * One method per credential kind, except OIDC: one per `callerScope`, so `oidcSameProject()` and\n     * `oidcSvcs([...])` may pair on one endpoint (this project's accounts OR the listed ones). They are\n     * still ONE bearer credential, which AuthFilter verifies once for both.\n     */\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static uniquenessKey(method: AuthMode): string {\n        return method.kind === 'oidc' ? `oidc:${method.callerScope}` : method.kind;\n    }\n\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static validateMethod(method: AuthMode): void {\n        let keys: readonly string[];\n        switch (method.kind) {\n            case 'jwt':\n            case 'public': keys = ['kind']; break;\n            case 'oidc': keys = this.oidcKeys(method); break;\n            case 'shared-secret':\n                keys = ['kind', 'secretKey'];\n                this.requireText(method.secretKey, 'sharedSecret'); break;\n            case 'webhook':\n                keys = ['kind', 'name'];\n                this.requireText(method.name, 'webhook'); break;\n            case 'apikey':\n                keys = ['kind', 'regime', 'credentials'];\n                this.requireText(method.regime, 'apiKey');\n                if (!Array.isArray(method.credentials) || !method.credentials.length) throw new Error('apiKey(...) requires a nonempty credentials tuple.');\n                for (const credential of method.credentials) {\n                    if (credential.in === 'header') this.requireHeaderKey(credential.key);\n                    else if (credential.in !== 'bearer' || Object.hasOwn(credential, 'key')) throw new Error('Invalid API-key credential location.');\n                }\n                break;\n            default: throw new Error('Unknown @WpAuth method; use jwt/oidcSameProject/oidcSvcs/sharedSecret/webhook/apiKey descriptors.');\n        }\n        for (const key of Object.keys(method)) {\n            if (!keys.includes(key)) throw new Error(`Auth method rejects '${key}'; operation policy belongs in @WpAuthorization.`);\n        }\n    }\n\n    /**\n     * The keys an OIDC descriptor may carry, after checking its scope. `OidcCallers` already makes an\n     * empty `oidcSvcs([])` a compile error; this is the backstop for a list that reached the decorator\n     * around the type (a cast, a spread of a runtime array, plain JS), so it fails when the decorator\n     * is evaluated instead of reaching a verifier.\n     */\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static oidcKeys(method: OidcAuthMethod): readonly string[] {\n        if (method.callerScope === 'same-project') return ['kind', 'callerScope'];\n        if (method.callerScope !== 'services') throw new Error(\"Unknown OIDC callerScope; use oidcSameProject() or oidcSvcs(['svc-a']).\");\n        if (!Array.isArray(method.callers) || method.callers.length === 0 || !method.callers.every((caller: string) => typeof caller === 'string' && caller.trim().length > 0)) {\n            throw new Error(\"oidcSvcs([...]) requires at least one nonblank service account; use oidcSameProject() to accept this GCP project's service accounts.\");\n        }\n        return ['kind', 'callerScope', 'callers'];\n    }\n\n    /**\n     * A header credential's key must be a ContextKey that rides the wire. `httpHeader` is optional on\n     * ContextKey itself (most keys never leave the process), and the factories' explicit value-type\n     * argument (`ContextKey.untrusted<string>(...)`) stops TypeScript inferring whether one was\n     * passed, so the type cannot say \"a key WITH a header\". It is checked once, when the contract is\n     * decorated, and the OpenAPI generator refuses the same key statically.\n     */\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static requireHeaderKey(key: AnyContextKey | undefined): void {\n        if (!key || typeof key !== 'object' || typeof key.name !== 'string') {\n            throw new Error(\"apiKey header credential requires `key`: the ContextKey carrying it, e.g. { in: 'header', key: MyKeys.API_KEY }.\");\n        }\n        if (typeof key.httpHeader !== 'string' || !key.httpHeader.trim()) {\n            throw new Error(`apiKey header credential key '${key.name}' declares no httpHeader; define it with ContextKey.trusted(name, provenance, '<header>') or ContextKey.untrusted(name, '<header>').`);\n        }\n    }\n\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static requireText(value: string, label: string): void {\n        if (typeof value !== 'string' || !value.trim()) throw new Error(`${label} requires a nonempty name.`);\n    }\n}\n\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function jwt(): AuthMethod { return { kind: 'jwt' }; }\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function oidcSameProject(): OidcAuthMethod { return { kind: 'oidc', callerScope: 'same-project' }; }\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function oidcSvcs(callers: OidcCallers): OidcAuthMethod { return { kind: 'oidc', callerScope: 'services', callers }; }\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function sharedSecret(secretKey: string): AuthMethod { return { kind: 'shared-secret', secretKey }; }\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function webhook(name: string): AuthMethod { return { kind: 'webhook', name }; }\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function apiKey(regime: string, credentials: ApiKeyCredentials): AuthMethod { return { kind: 'apikey', regime, credentials }; }\n"]}
+{"version":3,"file":"auth-mode.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/auth-mode.ts"],"names":[],"mappings":";;;AAkLA,kBAA6D;AAE7D,0CAA2G;AAE3G,4BAA6H;AAE7H,oCAA4G;AAQ5G,gCAA6F;AAE7F,wBAAsI;AA1ItI,wFAAwF;AACxF,MAAa,QAAQ;IAKG;IAJX,OAAO,CAAqC;IAErD,YACI,OAA2C,EAC3B,YAAgC;QAAhC,iBAAY,GAAZ,YAAY,CAAoB;QAEhD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAgB,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAuC,CAAC;QACjI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,oIAAoI;IAC5H,MAAM,CAAC,QAAQ,CAAC,MAAgB;QACpC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU;gBACjD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAgB,EAAE,CAAC;gBAC1F,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACnC,KAAK,QAAQ,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAA4B,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,EAAE,CAAC,CAAC,CAAsB,EAAE,CAAC,CAAC;YAChM,OAAO,CAAC,CAAC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;CACJ;AAvBD,4BAuBC;AAED,MAAa,eAAe;IACxB,oIAAoI;IACpI,MAAM,CAAC,QAAQ,CAAC,IAAc;QAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAC7H,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;QAChC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAChK,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;gBAClG,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;YAC3F,CAAC;QACL,CAAC;aAAM,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC7G,CAAC;IAED;;;;OAIG;IACH,oIAAoI;IAC5H,MAAM,CAAC,aAAa,CAAC,MAAgB;QACzC,OAAO,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/E,CAAC;IAED,oIAAoI;IAC5H,MAAM,CAAC,cAAc,CAAC,MAAgB;QAC1C,IAAI,IAAuB,CAAC;QAC5B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,KAAK,CAAC;YACX,KAAK,QAAQ;gBAAE,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAM;YACtC,KAAK,MAAM;gBAAE,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAAC,MAAM;YACjD,KAAK,eAAe;gBAChB,IAAI,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC7B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;gBAAC,MAAM;YAC9D,KAAK,YAAY;gBACb,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACxB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;gBAAC,MAAM;YACvD,KAAK,QAAQ;gBACT,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;gBACzC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;gBAC5I,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBAC1C,IAAI,UAAU,CAAC,EAAE,KAAK,QAAQ;wBAAE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;yBACjE,IAAI,UAAU,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBACrI,CAAC;gBACD,MAAM;YACV,OAAO,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,sGAAsG,CAAC,CAAC;QACrI,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,kDAAkD,CAAC,CAAC;QAC5H,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,oIAAoI;IAC5H,MAAM,CAAC,QAAQ,CAAC,MAAsB;QAC1C,IAAI,MAAM,CAAC,WAAW,KAAK,cAAc;YAAE,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAClI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;YACrK,MAAM,IAAI,KAAK,CAAC,sIAAsI,CAAC,CAAC;QAC5J,CAAC;QACD,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED;;;;;;OAMG;IACH,oIAAoI;IAC5H,MAAM,CAAC,gBAAgB,CAAC,GAA8B;QAC1D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClE,MAAM,IAAI,KAAK,CAAC,kHAAkH,CAAC,CAAC;QACxI,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,CAAC,IAAI,sIAAsI,CAAC,CAAC;QACrM,CAAC;IACL,CAAC;IAED,oIAAoI;IAC5H,MAAM,CAAC,WAAW,CAAC,KAAa,EAAE,KAAa;QACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,4BAA4B,CAAC,CAAC;IAC1G,CAAC;CACJ;AA7FD,0CA6FC;AAED,yFAAyF;AACzF,SAAgB,GAAG,KAAiB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC7D,yFAAyF;AACzF,SAAgB,eAAe,KAAqB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;AAC3G,yFAAyF;AACzF,SAAgB,QAAQ,CAAC,OAAoB,IAAoB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC7H,yFAAyF;AACzF,SAAgB,YAAY,CAAC,SAAiB,IAAgB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AAC5G;;;;;GAKG;AACH,yFAAyF;AACzF,SAAgB,UAAU,CAAC,IAAY,IAAgB,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7F,yFAAyF;AACzF,SAAgB,MAAM,CAAC,MAAc,EAAE,WAA8B,IAAgB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC","sourcesContent":["import type { AnyContextKey } from '../ContextKey';\n\n/**\n * WHERE one api-key credential rides.\n *\n * A header credential names the {@link AnyContextKey ContextKey} that carries it — NEVER a header-name\n * string. The key's `httpHeader` is the wire name, so the ONE definition of each header (the\n * ContextKey) is reused on every surface: `RequestContext` put/get, the client/server header\n * transfer, this declaration, and the published OpenAPI document. A string here was a second copy a\n * rename left stale (#1249). The key MUST declare an `httpHeader` — {@link AuthDeclaration} refuses\n * one that does not, and the OpenAPI generator reads the header name off the key's\n * `ContextKey.trusted(...)` / `ContextKey.untrusted(...)` definition.\n */\nexport type ApiKeyCredential =\n    | { in: 'header'; key: AnyContextKey; description?: string }\n    | { in: 'bearer'; key?: never; description?: string };\n\nexport type ApiKeyCredentials = readonly [ApiKeyCredential, ...ApiKeyCredential[]];\n\n/**\n * The service accounts an `oidcSvcs([...])` endpoint names, at least one: an empty list is not a\n * policy anybody could mean, so it does not compile. Each entry resolves as `'self'` (this service's\n * runtime SA), a bare id (`<id>@<project>.iam.gserviceaccount.com`) or a full email (verbatim).\n */\nexport type OidcCallers = readonly [string, ...string[]];\n\n/**\n * WHICH Google-signed callers an OIDC endpoint accepts, named by `callerScope`:\n * - `'same-project'` (`oidcSameProject()`): any service account of THIS GCP project. Off GCP there is\n *   no project, so the check is open.\n * - `'services'` (`oidcSvcs([...])`): exactly the listed service accounts, which may belong to other\n *   projects.\n * One endpoint may declare one of each; see {@link OidcAuthMethods}.\n */\nexport type OidcAuthMethod =\n    | { kind: 'oidc'; callerScope: 'same-project' }\n    | { kind: 'oidc'; callerScope: 'services'; callers: OidcCallers };\n\n/**\n * The OIDC methods ONE endpoint declares, in declaration order: one, or one per caller scope. They are\n * ONE bearer credential, so a verifier receives them together, checks the token's signature once, and\n * admits the call when ANY of them admits the caller.\n */\nexport type OidcAuthMethods = readonly [OidcAuthMethod, ...OidcAuthMethod[]];\n\n/** One concrete mechanism; user policy belongs exclusively to WpAuthorization. */\nexport type AuthMethod =\n    | { kind: 'jwt' }\n    | OidcAuthMethod\n    | { kind: 'shared-secret'; secretKey: string }\n    | { kind: 'vendorAuth'; name: string }\n    | { kind: 'apikey'; regime: string; credentials: ApiKeyCredentials };\n\nexport type AuthMethods = readonly [AuthMethod, ...AuthMethod[]];\nexport type AuthMode = AuthMethod | { kind: 'public' };\n\n/** Alternatives remain unresolved until a concrete mechanism is chosen for this hop. */\nexport class AuthMeta {\n    readonly methods: readonly [AuthMode, ...AuthMode[]];\n\n    constructor(\n        methods: readonly [AuthMode, ...AuthMode[]],\n        public readonly publicReason: string | undefined,\n    ) {\n        this.methods = methods;\n        AuthDeclaration.validate(this);\n        this.methods = Object.freeze(methods.map((method: AuthMode) => AuthMeta.snapshot(method))) as readonly [AuthMode, ...AuthMode[]];\n        Object.freeze(this);\n    }\n\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static snapshot(method: AuthMode): AuthMode {\n        switch (method.kind) {\n            case 'oidc': return method.callerScope === 'services'\n                ? Object.freeze({ ...method, callers: Object.freeze([...method.callers]) as OidcCallers })\n                : Object.freeze({ ...method });\n            case 'apikey': return Object.freeze({ ...method, credentials: Object.freeze(method.credentials.map((credential: ApiKeyCredential) => Object.freeze({ ...credential }))) as ApiKeyCredentials });\n            default: return Object.freeze({ ...method });\n        }\n    }\n}\n\nexport class AuthDeclaration {\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    static validate(meta: AuthMeta): void {\n        if (!Array.isArray(meta.methods) || meta.methods.length === 0) throw new Error('@WpAuth requires a nonempty methods tuple.');\n        const kinds = new Set<string>();\n        for (const method of meta.methods) {\n            if (!method || typeof method !== 'object' || kinds.has(this.uniquenessKey(method))) throw new Error('@WpAuth rejects duplicate or invalid credential methods.');\n            kinds.add(this.uniquenessKey(method));\n            this.validateMethod(method);\n        }\n        if (kinds.has('public')) {\n            if (meta.methods.length !== 1 || typeof meta.publicReason !== 'string' || !meta.publicReason.trim()) {\n                throw new Error('Public auth must be declared separately with @WpAuthPublic(reason).');\n            }\n        } else if (meta.publicReason !== undefined) throw new Error('Protected @WpAuth rejects public reasons.');\n    }\n\n    /**\n     * One method per credential kind, except OIDC: one per `callerScope`, so `oidcSameProject()` and\n     * `oidcSvcs([...])` may pair on one endpoint (this project's accounts OR the listed ones). They are\n     * still ONE bearer credential, which AuthFilter verifies once for both.\n     */\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static uniquenessKey(method: AuthMode): string {\n        return method.kind === 'oidc' ? `oidc:${method.callerScope}` : method.kind;\n    }\n\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static validateMethod(method: AuthMode): void {\n        let keys: readonly string[];\n        switch (method.kind) {\n            case 'jwt':\n            case 'public': keys = ['kind']; break;\n            case 'oidc': keys = this.oidcKeys(method); break;\n            case 'shared-secret':\n                keys = ['kind', 'secretKey'];\n                this.requireText(method.secretKey, 'sharedSecret'); break;\n            case 'vendorAuth':\n                keys = ['kind', 'name'];\n                this.requireText(method.name, 'vendorAuth'); break;\n            case 'apikey':\n                keys = ['kind', 'regime', 'credentials'];\n                this.requireText(method.regime, 'apiKey');\n                if (!Array.isArray(method.credentials) || !method.credentials.length) throw new Error('apiKey(...) requires a nonempty credentials tuple.');\n                for (const credential of method.credentials) {\n                    if (credential.in === 'header') this.requireHeaderKey(credential.key);\n                    else if (credential.in !== 'bearer' || Object.hasOwn(credential, 'key')) throw new Error('Invalid API-key credential location.');\n                }\n                break;\n            default: throw new Error('Unknown @WpAuth method; use jwt/oidcSameProject/oidcSvcs/sharedSecret/vendorAuth/apiKey descriptors.');\n        }\n        for (const key of Object.keys(method)) {\n            if (!keys.includes(key)) throw new Error(`Auth method rejects '${key}'; operation policy belongs in @WpAuthorization.`);\n        }\n    }\n\n    /**\n     * The keys an OIDC descriptor may carry, after checking its scope. `OidcCallers` already makes an\n     * empty `oidcSvcs([])` a compile error; this is the backstop for a list that reached the decorator\n     * around the type (a cast, a spread of a runtime array, plain JS), so it fails when the decorator\n     * is evaluated instead of reaching a verifier.\n     */\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static oidcKeys(method: OidcAuthMethod): readonly string[] {\n        if (method.callerScope === 'same-project') return ['kind', 'callerScope'];\n        if (method.callerScope !== 'services') throw new Error(\"Unknown OIDC callerScope; use oidcSameProject() or oidcSvcs(['svc-a']).\");\n        if (!Array.isArray(method.callers) || method.callers.length === 0 || !method.callers.every((caller: string) => typeof caller === 'string' && caller.trim().length > 0)) {\n            throw new Error(\"oidcSvcs([...]) requires at least one nonblank service account; use oidcSameProject() to accept this GCP project's service accounts.\");\n        }\n        return ['kind', 'callerScope', 'callers'];\n    }\n\n    /**\n     * A header credential's key must be a ContextKey that rides the wire. `httpHeader` is optional on\n     * ContextKey itself (most keys never leave the process), and the factories' explicit value-type\n     * argument (`ContextKey.untrusted<string>(...)`) stops TypeScript inferring whether one was\n     * passed, so the type cannot say \"a key WITH a header\". It is checked once, when the contract is\n     * decorated, and the OpenAPI generator refuses the same key statically.\n     */\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static requireHeaderKey(key: AnyContextKey | undefined): void {\n        if (!key || typeof key !== 'object' || typeof key.name !== 'string') {\n            throw new Error(\"apiKey header credential requires `key`: the ContextKey carrying it, e.g. { in: 'header', key: MyKeys.API_KEY }.\");\n        }\n        if (typeof key.httpHeader !== 'string' || !key.httpHeader.trim()) {\n            throw new Error(`apiKey header credential key '${key.name}' declares no httpHeader; define it with ContextKey.trusted(name, provenance, '<header>') or ContextKey.untrusted(name, '<header>').`);\n        }\n    }\n\n    // webpieces-disable no-function-outside-class -- stateless contract validation or scope metadata reader used before DI registration\n    private static requireText(value: string, label: string): void {\n        if (typeof value !== 'string' || !value.trim()) throw new Error(`${label} requires a nonempty name.`);\n    }\n}\n\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function jwt(): AuthMethod { return { kind: 'jwt' }; }\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function oidcSameProject(): OidcAuthMethod { return { kind: 'oidc', callerScope: 'same-project' }; }\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function oidcSvcs(callers: OidcCallers): OidcAuthMethod { return { kind: 'oidc', callerScope: 'services', callers }; }\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function sharedSecret(secretKey: string): AuthMethod { return { kind: 'shared-secret', secretKey }; }\n/**\n * A credential in a VENDOR's scheme, on both ends of a hop: the app-bound `VendorAuthHook` (core-context)\n * mints it when WE call the vendor (and refreshes it once on a 401), and verifies it when the vendor\n * calls US. `name` selects the vendor. A served `vendorAuth(...)` endpoint requires\n * `@Endpoint(..., { rawBody: true })` so the hook has the exact bytes to verify.\n */\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function vendorAuth(name: string): AuthMethod { return { kind: 'vendorAuth', name }; }\n// webpieces-disable no-function-outside-class -- canonical credential descriptor factory\nexport function apiKey(regime: string, credentials: ApiKeyCredentials): AuthMethod { return { kind: 'apikey', regime, credentials }; }\n"]}

package/src/http/decorators.d.ts

@@ -5,10 +5,11 @@ import { EndpointOperation, EndpointOptions, ExternalEndpointOptions } from './H
 import { HttpMethod } from './HttpContract';
 export type { EndpointOptions, ExternalEndpointOptions } from './HttpEndpointOptions';
 export type { EndpointOperation } from './HttpEndpointOptions';
-export { READ, WRITE_IDEMPOTENT, WRITE } from './HttpEndpointOptions';
+export { READ, WRITE_IDEMPOTENT, WRITE, NONE } from './HttpEndpointOptions';
+export type { ResponseBodyKind } from './HttpEndpointOptions';
 export type { HttpMethod } from './HttpContract';
-export { GET, POST } from './HttpContract';
-export { PathParam, QueryParam, getHttpParameterDeclarations } from './http-parameter-decorators';
+export { GET, POST, PUT, PATCH, DELETE } from './HttpContract';
+export { PathParam, QueryParam, QueryString, getHttpParameterDeclarations } from './http-parameter-decorators';
 /**
  * Metadata keys for storing API routing information.
  * These keys are used by both server-side (routing) and client-side (client generation).
@@ -29,9 +30,9 @@ export declare const METADATA_KEYS: {
     ENDPOINT_HTTP_METHOD: string;
     /** Per-method required read/write semantics, parallel to ENDPOINTS. */
     ENDPOINT_OPERATION: string;
-    /** Per-method @Endpoint trigger kind (rpc | cloudtasks | cron | external), parallel to ENDPOINTS. */
+    /** Per-method @Endpoint trigger kind (rpc | cloudtasks | cron | external-inbound | external-outbound), parallel to ENDPOINTS. */
     ENDPOINT_KIND: string;
-    /** Per-method declared external CALLER (only for kind 'external'), parallel to ENDPOINTS. */
+    /** Per-method declared external CALLER (only for kind 'external-inbound'), parallel to ENDPOINTS. */
     ENDPOINT_CALLER: string;
     /** Per-method @MaskLog spec (which DTO fields the LogApiCall path masks). */
     MASK_LOG: string;
@@ -51,24 +52,35 @@ declare enum EndpointKindValue {
     RPC = "rpc",
     CLOUDTASKS = "cloudtasks",
     CRON = "cron",
-    EXTERNAL = "external"
+    EXTERNAL_INBOUND = "external-inbound",
+    EXTERNAL_OUTBOUND = "external-outbound"
 }
 /** Short, statically importable decorator arguments. */
 export declare const RPC = EndpointKindValue.RPC;
 export declare const CLOUDTASKS = EndpointKindValue.CLOUDTASKS;
 export declare const CRON = EndpointKindValue.CRON;
-export declare const EXTERNAL = EndpointKindValue.EXTERNAL;
+/**
+ * An OUTSIDE system calls US (a vendor webhook, a push subscription). Requires `calledBy`, which names
+ * that system on the runtime architecture graph.
+ */
+export declare const EXTERNAL_INBOUND = EndpointKindValue.EXTERNAL_INBOUND;
+/**
+ * WE call an OUTSIDE system (a vendor API, a partner's webhook receiver). No server in this repo
+ * implements it, every method of the contract must be this kind, and the client sends ONLY the
+ * context keys listed with `@ExternalContextKeys(...)` and merges no response header into our context.
+ */
+export declare const EXTERNAL_OUTBOUND = EndpointKindValue.EXTERNAL_OUTBOUND;
 /** Runtime trigger/delivery owner used by validation, architecture, and infrastructure tooling. */
-export type EndpointKind = typeof RPC | typeof CLOUDTASKS | typeof CRON | typeof EXTERNAL;
+export type EndpointKind = typeof RPC | typeof CLOUDTASKS | typeof CRON | typeof EXTERNAL_INBOUND | typeof EXTERNAL_OUTBOUND;
 /** Class decorator that sets the shared base path for all endpoints. */
 export declare function ApiPath(basePath: string): ClassDecorator;
 /**
  * Registers `@Endpoint(POST, path, WRITE, RPC)`. Method, operation, and trigger are required enum
- * values. Operation is independent of the HTTP verb. EXTERNAL additionally requires `calledBy`.
+ * values. Operation is independent of the HTTP verb. EXTERNAL_INBOUND additionally requires `calledBy`.
  * Each classification rides a parallel metadata map while ENDPOINTS remains method-name -> path.
  */
-export declare function Endpoint(httpMethod: HttpMethod, path: string, operation: EndpointOperation, kind: typeof EXTERNAL, options: ExternalEndpointOptions): MethodDecorator;
-export declare function Endpoint(httpMethod: HttpMethod, path: string, operation: EndpointOperation, kind: Exclude<EndpointKind, typeof EXTERNAL>, options?: EndpointOptions): MethodDecorator;
+export declare function Endpoint(httpMethod: HttpMethod, path: string, operation: EndpointOperation, kind: typeof EXTERNAL_INBOUND, options: ExternalEndpointOptions): MethodDecorator;
+export declare function Endpoint(httpMethod: HttpMethod, path: string, operation: EndpointOperation, kind: Exclude<EndpointKind, typeof EXTERNAL_INBOUND>, options?: EndpointOptions): MethodDecorator;
 /** Declares request/response DTO field names that API logging must mask at any depth. */
 export declare function MaskLog(fields: Record<string, MaskMode>): MethodDecorator;
 /**
@@ -118,12 +130,18 @@ export declare function getEndpointOptions(apiClass: Function, methodName: strin
 /** Read one endpoint's required side-effect semantics. */
 export declare function getEndpointOperation(apiClass: Function, methodName: string): EndpointOperation;
 /**
- * Fail-fast at wiring time when an `external` endpoint declared no caller. The {@link Endpoint}
- * overloads already make that a COMPILE error; this is the backstop for the ways TS is bypassed —
- * a JS caller, an `as any` options object, a hand-rolled Reflect.defineMetadata.
- * @throws Error naming the first external endpoint with no `calledBy`.
+ * Fail-fast at wiring time on the two EXTERNAL_* rules, called by `RouteMetadataFactory` for every
+ * transport (server routes and every client). The {@link Endpoint} overloads already make a missing
+ * `calledBy` a COMPILE error; this is the backstop for the ways TS is bypassed — a JS caller, an
+ * `as any` options object, a hand-rolled Reflect.defineMetadata. The second rule cannot be a type:
+ * "every method of this class" spans several decorators.
+ *
+ * @throws Error naming the first EXTERNAL_INBOUND endpoint with no `calledBy`, or the first method of
+ * a contract that mixes EXTERNAL_OUTBOUND with any other kind.
  */
-export declare function assertEveryExternalEndpointDeclaresCaller(apiClass: Function): void;
+export declare function assertExternalEndpointKinds(apiClass: Function): void;
+/** True when the contract is an outside system's API: every method is EXTERNAL_OUTBOUND. */
+export declare function isExternalOutboundApi(apiClass: Function): boolean;
 /**
  * True when the method's @Endpoint declared `{ formPost: true }` — its body is
  * application/x-www-form-urlencoded (flat), not JSON.
@@ -131,22 +149,22 @@ export declare function assertEveryExternalEndpointDeclaresCaller(apiClass: Func
 export declare function isFormPost(apiClass: Function, methodName: string): boolean;
 /**
  * True when the method's @Endpoint declared `{ rawBody: true }` — the transport must retain the
- * verbatim bytes + absolute url for an {@link WebhookAuthCallback} hook to verify.
+ * verbatim bytes + absolute url for a `VendorAuthHook.verify` to check.
  */
 export declare function isRawBody(apiClass: Function, methodName: string): boolean;
 /**
- * Fail-fast at wiring time when an `webhook(...)` endpoint did not ask the transport to keep the
+ * Fail-fast at wiring time when a SERVED `vendorAuth(...)` endpoint did not ask the transport to keep the
  * bytes it is supposed to verify. A hook with nothing to verify is a MISCONFIGURATION, and it must
  * surface at startup, naming the fix — not as a 401 in production on exactly the traffic the endpoint
  * exists for.
  *
  * This pairing is a runtime assert rather than a type because the two halves live on DIFFERENT
- * decorators (`webhook(...)` and `@Endpoint`), and no union over one decorator's argument can say
+ * decorators (`vendorAuth(...)` and `@Endpoint`), and no union over one decorator's argument can say
  * anything about the other's.
  *
- * @throws Error naming the first `webhook(...)` endpoint missing `{ rawBody: true }`.
+ * @throws Error naming the first `vendorAuth(...)` endpoint missing `{ rawBody: true }`.
  */
-export declare function assertEveryWebhookEndpointRetainsRawBody(apiClass: Function): void;
+export declare function assertEveryVendorAuthEndpointRetainsRawBody(apiClass: Function): void;
 /**
  * Check if a class has @ApiPath decorator.
  */

package/src/http/decorators.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MISSING_AUTH_DECORATOR_FIX = exports.EXTERNAL = exports.CRON = exports.CLOUDTASKS = exports.RPC = exports.METADATA_KEYS = exports.getHttpParameterDeclarations = exports.QueryParam = exports.PathParam = exports.POST = exports.GET = exports.WRITE = exports.WRITE_IDEMPOTENT = exports.READ = void 0;
+exports.MISSING_AUTH_DECORATOR_FIX = exports.EXTERNAL_OUTBOUND = exports.EXTERNAL_INBOUND = exports.CRON = exports.CLOUDTASKS = exports.RPC = exports.METADATA_KEYS = exports.getHttpParameterDeclarations = exports.QueryString = exports.QueryParam = exports.PathParam = exports.DELETE = exports.PATCH = exports.PUT = exports.POST = exports.GET = exports.NONE = exports.WRITE = exports.WRITE_IDEMPOTENT = exports.READ = void 0;
 exports.ApiPath = ApiPath;
 exports.Endpoint = Endpoint;
 exports.MaskLog = MaskLog;
@@ -16,10 +16,11 @@ exports.getEndpointKind = getEndpointKind;
 exports.getEndpointHttpMethod = getEndpointHttpMethod;
 exports.getEndpointOptions = getEndpointOptions;
 exports.getEndpointOperation = getEndpointOperation;
-exports.assertEveryExternalEndpointDeclaresCaller = assertEveryExternalEndpointDeclaresCaller;
+exports.assertExternalEndpointKinds = assertExternalEndpointKinds;
+exports.isExternalOutboundApi = isExternalOutboundApi;
 exports.isFormPost = isFormPost;
 exports.isRawBody = isRawBody;
-exports.assertEveryWebhookEndpointRetainsRawBody = assertEveryWebhookEndpointRetainsRawBody;
+exports.assertEveryVendorAuthEndpointRetainsRawBody = assertEveryVendorAuthEndpointRetainsRawBody;
 exports.isApiPath = isApiPath;
 exports.getAuthMeta = getAuthMeta;
 exports.assertEveryEndpointHasAuthMode = assertEveryEndpointHasAuthMode;
@@ -37,12 +38,17 @@ var HttpEndpointOptions_2 = require("./HttpEndpointOptions");
 Object.defineProperty(exports, "READ", { enumerable: true, get: function () { return HttpEndpointOptions_2.READ; } });
 Object.defineProperty(exports, "WRITE_IDEMPOTENT", { enumerable: true, get: function () { return HttpEndpointOptions_2.WRITE_IDEMPOTENT; } });
 Object.defineProperty(exports, "WRITE", { enumerable: true, get: function () { return HttpEndpointOptions_2.WRITE; } });
+Object.defineProperty(exports, "NONE", { enumerable: true, get: function () { return HttpEndpointOptions_2.NONE; } });
 var HttpContract_2 = require("./HttpContract");
 Object.defineProperty(exports, "GET", { enumerable: true, get: function () { return HttpContract_2.GET; } });
 Object.defineProperty(exports, "POST", { enumerable: true, get: function () { return HttpContract_2.POST; } });
+Object.defineProperty(exports, "PUT", { enumerable: true, get: function () { return HttpContract_2.PUT; } });
+Object.defineProperty(exports, "PATCH", { enumerable: true, get: function () { return HttpContract_2.PATCH; } });
+Object.defineProperty(exports, "DELETE", { enumerable: true, get: function () { return HttpContract_2.DELETE; } });
 var http_parameter_decorators_2 = require("./http-parameter-decorators");
 Object.defineProperty(exports, "PathParam", { enumerable: true, get: function () { return http_parameter_decorators_2.PathParam; } });
 Object.defineProperty(exports, "QueryParam", { enumerable: true, get: function () { return http_parameter_decorators_2.QueryParam; } });
+Object.defineProperty(exports, "QueryString", { enumerable: true, get: function () { return http_parameter_decorators_2.QueryString; } });
 Object.defineProperty(exports, "getHttpParameterDeclarations", { enumerable: true, get: function () { return http_parameter_decorators_2.getHttpParameterDeclarations; } });
 /**
  * Metadata keys for storing API routing information.
@@ -64,9 +70,9 @@ exports.METADATA_KEYS = {
     ENDPOINT_HTTP_METHOD: 'webpieces:endpoint-http-method',
     /** Per-method required read/write semantics, parallel to ENDPOINTS. */
     ENDPOINT_OPERATION: 'webpieces:endpoint-operation',
-    /** Per-method @Endpoint trigger kind (rpc | cloudtasks | cron | external), parallel to ENDPOINTS. */
+    /** Per-method @Endpoint trigger kind (rpc | cloudtasks | cron | external-inbound | external-outbound), parallel to ENDPOINTS. */
     ENDPOINT_KIND: 'webpieces:endpoint-kind',
-    /** Per-method declared external CALLER (only for kind 'external'), parallel to ENDPOINTS. */
+    /** Per-method declared external CALLER (only for kind 'external-inbound'), parallel to ENDPOINTS. */
     ENDPOINT_CALLER: external_caller_1.ENDPOINT_CALLER_KEY,
     /** Per-method @MaskLog spec (which DTO fields the LogApiCall path masks). */
     MASK_LOG: 'webpieces:mask-log',
@@ -87,13 +93,24 @@ var EndpointKindValue;
     EndpointKindValue["RPC"] = "rpc";
     EndpointKindValue["CLOUDTASKS"] = "cloudtasks";
     EndpointKindValue["CRON"] = "cron";
-    EndpointKindValue["EXTERNAL"] = "external";
+    EndpointKindValue["EXTERNAL_INBOUND"] = "external-inbound";
+    EndpointKindValue["EXTERNAL_OUTBOUND"] = "external-outbound";
 })(EndpointKindValue || (EndpointKindValue = {}));
 /** Short, statically importable decorator arguments. */
 exports.RPC = EndpointKindValue.RPC;
 exports.CLOUDTASKS = EndpointKindValue.CLOUDTASKS;
 exports.CRON = EndpointKindValue.CRON;
-exports.EXTERNAL = EndpointKindValue.EXTERNAL;
+/**
+ * An OUTSIDE system calls US (a vendor webhook, a push subscription). Requires `calledBy`, which names
+ * that system on the runtime architecture graph.
+ */
+exports.EXTERNAL_INBOUND = EndpointKindValue.EXTERNAL_INBOUND;
+/**
+ * WE call an OUTSIDE system (a vendor API, a partner's webhook receiver). No server in this repo
+ * implements it, every method of the contract must be this kind, and the client sends ONLY the
+ * context keys listed with `@ExternalContextKeys(...)` and merges no response header into our context.
+ */
+exports.EXTERNAL_OUTBOUND = EndpointKindValue.EXTERNAL_OUTBOUND;
 /** Class decorator that sets the shared base path for all endpoints. */
 function ApiPath(basePath) {
     return (target) => {
@@ -118,14 +135,14 @@ function Endpoint(httpMethod, path, operation, kind, options = {}) {
 }
 // webpieces-disable no-function-outside-class -- runtime validation backs up nominal TS enums
 function validateEndpointClassification(httpMethod, operation, kind) {
-    if (!isHttpMethod(httpMethod)) {
-        throw new Error(`@Endpoint httpMethod must be GET or POST, received '${String(httpMethod)}'.`);
+    if (!(0, HttpContract_1.isHttpMethod)(httpMethod)) {
+        throw new Error(`@Endpoint httpMethod must be one of ${HttpContract_1.HTTP_METHODS.join(', ')}, received '${String(httpMethod)}'.`);
     }
     if (!isEndpointOperation(operation)) {
         throw new Error(`@Endpoint operation must be READ, WRITE_IDEMPOTENT, or WRITE, received '${String(operation)}'.`);
     }
     if (!isEndpointKind(kind)) {
-        throw new Error(`@Endpoint trigger must be RPC, CLOUDTASKS, CRON, or EXTERNAL, received '${String(kind)}'.`);
+        throw new Error(`@Endpoint trigger must be RPC, CLOUDTASKS, CRON, EXTERNAL_INBOUND, or EXTERNAL_OUTBOUND, received '${String(kind)}'.`);
     }
 }
 // webpieces-disable no-function-outside-class -- one metadata write shared by the decorator overloads
@@ -146,7 +163,7 @@ function recordEndpointMetadata(metadataTarget, propertyKey, httpMethod, path, o
     opts[propertyKey] = options;
     Reflect.defineMetadata(exports.METADATA_KEYS.ENDPOINT_OPTIONS, opts, metadataTarget);
     const declared = options;
-    if (kind !== exports.EXTERNAL ||
+    if (kind !== exports.EXTERNAL_INBOUND ||
         typeof declared.calledBy !== 'string' ||
         declared.calledBy === '')
         return;
@@ -267,8 +284,8 @@ function getEndpointKind(apiClass, methodName) {
 function getEndpointHttpMethod(apiClass, methodName) {
     const methods = Reflect.getMetadata(exports.METADATA_KEYS.ENDPOINT_HTTP_METHOD, apiClass) || {};
     const method = methods[methodName];
-    if (!isHttpMethod(method)) {
-        throw new Error(`@Endpoint ${apiClass.name || 'Unknown'}.${methodName} must declare GET or POST.`);
+    if (!(0, HttpContract_1.isHttpMethod)(method)) {
+        throw new Error(`@Endpoint ${apiClass.name || 'Unknown'}.${methodName} must declare one of ${HttpContract_1.HTTP_METHODS.join(', ')}.`);
     }
     return method;
 }
@@ -302,35 +319,50 @@ function isEndpointOperation(value) {
         value === HttpEndpointOptions_1.WRITE_IDEMPOTENT ||
         value === HttpEndpointOptions_1.WRITE);
 }
-// webpieces-disable no-function-outside-class -- runtime backstop for JavaScript and `as any` callers; webpieces-disable no-any-unknown -- untrusted runtime value is narrowed to an HTTP method
-function isHttpMethod(value) {
-    return value === HttpContract_1.GET || value === HttpContract_1.POST;
-}
 // webpieces-disable no-function-outside-class -- runtime backstop for JavaScript and `as any` callers; webpieces-disable no-any-unknown -- untrusted runtime value is narrowed to an endpoint kind
 function isEndpointKind(value) {
     return (value === exports.RPC ||
         value === exports.CLOUDTASKS ||
         value === exports.CRON ||
-        value === exports.EXTERNAL);
+        value === exports.EXTERNAL_INBOUND ||
+        value === exports.EXTERNAL_OUTBOUND);
 }
 /**
- * Fail-fast at wiring time when an `external` endpoint declared no caller. The {@link Endpoint}
- * overloads already make that a COMPILE error; this is the backstop for the ways TS is bypassed —
- * a JS caller, an `as any` options object, a hand-rolled Reflect.defineMetadata.
- * @throws Error naming the first external endpoint with no `calledBy`.
+ * Fail-fast at wiring time on the two EXTERNAL_* rules, called by `RouteMetadataFactory` for every
+ * transport (server routes and every client). The {@link Endpoint} overloads already make a missing
+ * `calledBy` a COMPILE error; this is the backstop for the ways TS is bypassed — a JS caller, an
+ * `as any` options object, a hand-rolled Reflect.defineMetadata. The second rule cannot be a type:
+ * "every method of this class" spans several decorators.
+ *
+ * @throws Error naming the first EXTERNAL_INBOUND endpoint with no `calledBy`, or the first method of
+ * a contract that mixes EXTERNAL_OUTBOUND with any other kind.
  */
 // webpieces-disable no-function-outside-class -- wiring-time assert, sibling of assertEveryEndpointHasAuthMode
-function assertEveryExternalEndpointDeclaresCaller(apiClass) {
+function assertExternalEndpointKinds(apiClass) {
     const kinds = getEndpointKinds(apiClass);
-    for (const methodName of Object.keys(kinds)) {
-        if (kinds[methodName] !== 'external' ||
-            (0, external_caller_1.getEndpointCaller)(apiClass, methodName) !== undefined)
+    const apiName = apiClass.name || 'Unknown';
+    const methods = Object.keys(kinds);
+    const outbound = methods.filter((methodName) => kinds[methodName] === exports.EXTERNAL_OUTBOUND);
+    if (outbound.length > 0 && outbound.length !== methods.length) {
+        const other = methods.find((methodName) => kinds[methodName] !== exports.EXTERNAL_OUTBOUND);
+        throw new Error(`${apiName} mixes EXTERNAL_OUTBOUND (${outbound[0]}) with ${String(kinds[other]).toUpperCase()} (${other}). ` +
+            `An EXTERNAL_OUTBOUND contract is an outside system's API that no server in this repo implements, so ` +
+            `EVERY method of it must be EXTERNAL_OUTBOUND; move the other methods to their own contract.`);
+    }
+    for (const methodName of methods) {
+        if (kinds[methodName] !== exports.EXTERNAL_INBOUND || (0, external_caller_1.getEndpointCaller)(apiClass, methodName) !== undefined)
             continue;
-        throw new Error(`External endpoint '${methodName}' in ${apiClass.name || 'Unknown'} declares no caller. Say WHO ` +
-            `posts to it: @Endpoint(POST, path, WRITE, EXTERNAL, { calledBy: '<vendor>' }) — the runtime architecture ` +
+        throw new Error(`External endpoint '${methodName}' in ${apiName} declares no caller. Say WHO ` +
+            `posts to it: @Endpoint(POST, path, WRITE, EXTERNAL_INBOUND, { calledBy: '<vendor>' }) — the runtime architecture ` +
             `graph cannot name an inbound caller it was never told about.`);
     }
 }
+/** True when the contract is an outside system's API: every method is EXTERNAL_OUTBOUND. */
+// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpointKinds
+function isExternalOutboundApi(apiClass) {
+    const kinds = Object.values(getEndpointKinds(apiClass));
+    return kinds.length > 0 && kinds.every((kind) => kind === exports.EXTERNAL_OUTBOUND);
+}
 /**
  * True when the method's @Endpoint declared `{ formPost: true }` — its body is
  * application/x-www-form-urlencoded (flat), not JSON.
@@ -341,33 +373,33 @@ function isFormPost(apiClass, methodName) {
 }
 /**
  * True when the method's @Endpoint declared `{ rawBody: true }` — the transport must retain the
- * verbatim bytes + absolute url for an {@link WebhookAuthCallback} hook to verify.
+ * verbatim bytes + absolute url for a `VendorAuthHook.verify` to check.
  */
 // webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of isFormPost
 function isRawBody(apiClass, methodName) {
     return getEndpointOptions(apiClass, methodName).rawBody === true;
 }
 /**
- * Fail-fast at wiring time when an `webhook(...)` endpoint did not ask the transport to keep the
+ * Fail-fast at wiring time when a SERVED `vendorAuth(...)` endpoint did not ask the transport to keep the
  * bytes it is supposed to verify. A hook with nothing to verify is a MISCONFIGURATION, and it must
  * surface at startup, naming the fix — not as a 401 in production on exactly the traffic the endpoint
  * exists for.
  *
  * This pairing is a runtime assert rather than a type because the two halves live on DIFFERENT
- * decorators (`webhook(...)` and `@Endpoint`), and no union over one decorator's argument can say
+ * decorators (`vendorAuth(...)` and `@Endpoint`), and no union over one decorator's argument can say
  * anything about the other's.
  *
- * @throws Error naming the first `webhook(...)` endpoint missing `{ rawBody: true }`.
+ * @throws Error naming the first `vendorAuth(...)` endpoint missing `{ rawBody: true }`.
  */
 // webpieces-disable no-function-outside-class -- wiring-time assert, sibling of assertEveryEndpointHasAuthMode
-function assertEveryWebhookEndpointRetainsRawBody(apiClass) {
+function assertEveryVendorAuthEndpointRetainsRawBody(apiClass) {
     const endpoints = getEndpoints(apiClass) || {};
     for (const methodName of Object.keys(endpoints)) {
-        if (!getAuthMeta(apiClass, methodName)?.methods.some((method) => method.kind === 'webhook') ||
+        if (!getAuthMeta(apiClass, methodName)?.methods.some((method) => method.kind === 'vendorAuth') ||
             isRawBody(apiClass, methodName))
             continue;
-        throw new Error(`Endpoint '${methodName}' in ${apiClass.name || 'Unknown'} is webhook(...) but its @Endpoint ` +
-            `does not declare { rawBody: true }. A webhook hook verifies a signature over the bytes and ` +
+        throw new Error(`Endpoint '${methodName}' in ${apiClass.name || 'Unknown'} is vendorAuth(...) but its @Endpoint ` +
+            `does not declare { rawBody: true }. VendorAuthHook.verify checks a credential over the bytes and ` +
             `the url the SENDER transmitted, and without that option the transport parses the body and ` +
             `throws them away — leaving the hook nothing to check.`);
     }
@@ -392,7 +424,7 @@ function getAuthMeta(apiClass, methodName) {
  * the caller hits becomes the API they believe exists. It leads with the ROLE-GATED member on purpose —
  * the first thing offered should not be the widest grant.
  */
-exports.MISSING_AUTH_DECORATOR_FIX = "Declare @WpAuth([jwt(), oidcSameProject() or oidcSvcs(['svc-a']), sharedSecret(key), webhook(name), apiKey('regime', [{in: 'header', key: MyKeys.API_KEY}])]) " +
+exports.MISSING_AUTH_DECORATOR_FIX = "Declare @WpAuth([jwt(), oidcSameProject() or oidcSvcs(['svc-a']), sharedSecret(key), vendorAuth(name), apiKey('regime', [{in: 'header', key: MyKeys.API_KEY}])]) " +
     "or @WpAuthPublic('reason'), and exactly one @WpAuthorization on every endpoint. Add @WpLocalOnly() separately when locality is required.";
 /**
  * Fail-fast at wiring time if any endpoint lacks an auth mode. Both the server