@webpieces/core-util 0.4.962 → 0.4.963

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/core-util",
-  "version": "0.4.962",
+  "version": "0.4.963",
   "description": "Utility functions for WebPieces - works in browser and Node.js",
   "type": "commonjs",
   "main": "./src/index.js",

package/src/http/EndpointCompileAssertions.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const HttpEndpointOptions_1 = require("./HttpEndpointOptions");
 const decorators_1 = require("./decorators");
 (0, decorators_1.Endpoint)(decorators_1.POST, '/valid-rpc', decorators_1.WRITE, decorators_1.RPC);
 (0, decorators_1.Endpoint)(decorators_1.PUT, '/valid-put', decorators_1.WRITE_IDEMPOTENT, decorators_1.RPC);
@@ -24,4 +25,17 @@ const decorators_1 = require("./decorators");
 (0, decorators_1.Endpoint)(decorators_1.POST, '/raw-trigger', decorators_1.WRITE, 'rpc');
 // @ts-expect-error callers must import the enum-backed HTTP method constant, for the new verbs too
 (0, decorators_1.Endpoint)('PUT', '/raw-put', decorators_1.WRITE, decorators_1.RPC);
+// A CLOUDTASKS / CRON endpoint has no response body BY KIND, an EXTERNAL_OUTBOUND one is shaped by the
+// vendor (#1348); NONE stays a declaration only where OUR server answers (RPC, EXTERNAL_INBOUND).
+(0, decorators_1.Endpoint)(decorators_1.POST, '/valid-task', decorators_1.WRITE, decorators_1.CLOUDTASKS);
+(0, decorators_1.Endpoint)(decorators_1.POST, '/valid-cron', decorators_1.WRITE, decorators_1.CRON, { noLogging: true });
+(0, decorators_1.Endpoint)(decorators_1.POST, '/valid-rpc-void', decorators_1.WRITE, decorators_1.RPC, { responseBody: HttpEndpointOptions_1.NONE });
+(0, decorators_1.Endpoint)(decorators_1.DELETE, '/valid-outbound-void', decorators_1.WRITE_IDEMPOTENT, decorators_1.EXTERNAL_OUTBOUND);
+(0, decorators_1.Endpoint)(decorators_1.POST, '/valid-inbound-void', decorators_1.WRITE, decorators_1.EXTERNAL_INBOUND, { calledBy: 'twilio', responseBody: HttpEndpointOptions_1.NONE });
+// @ts-expect-error CLOUDTASKS already implies no response body; responseBody: NONE is a second spelling
+(0, decorators_1.Endpoint)(decorators_1.POST, '/redundant-task-none', decorators_1.WRITE, decorators_1.CLOUDTASKS, { responseBody: HttpEndpointOptions_1.NONE });
+// @ts-expect-error CRON already implies no response body; responseBody: NONE is a second spelling
+(0, decorators_1.Endpoint)(decorators_1.POST, '/redundant-cron-none', decorators_1.WRITE, decorators_1.CRON, { responseBody: HttpEndpointOptions_1.NONE });
+// @ts-expect-error the vendor shapes an EXTERNAL_OUTBOUND response; responseBody: NONE describes OUR server
+(0, decorators_1.Endpoint)(decorators_1.DELETE, '/outbound-none', decorators_1.WRITE_IDEMPOTENT, decorators_1.EXTERNAL_OUTBOUND, { responseBody: HttpEndpointOptions_1.NONE });
 //# sourceMappingURL=EndpointCompileAssertions.js.map

package/src/http/EndpointCompileAssertions.js.map

@@ -1 +1 @@
-{"version":3,"file":"EndpointCompileAssertions.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/EndpointCompileAssertions.ts"],"names":[],"mappings":";;AAAA,6CAAgJ;AAEhJ,IAAA,qBAAQ,EAAC,iBAAI,EAAE,YAAY,EAAE,kBAAK,EAAE,gBAAG,CAAC,CAAC;AACzC,IAAA,qBAAQ,EAAC,gBAAG,EAAE,YAAY,EAAE,6BAAgB,EAAE,gBAAG,CAAC,CAAC;AACnD,IAAA,qBAAQ,EAAC,kBAAK,EAAE,cAAc,EAAE,kBAAK,EAAE,gBAAG,CAAC,CAAC;AAC5C,IAAA,qBAAQ,EAAC,mBAAM,EAAE,eAAe,EAAE,6BAAgB,EAAE,gBAAG,CAAC,CAAC;AACzD,IAAA,qBAAQ,EAAC,iBAAI,EAAE,iBAAiB,EAAE,kBAAK,EAAE,6BAAgB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AACnF,IAAA,qBAAQ,EAAC,gBAAG,EAAE,iBAAiB,EAAE,iBAAI,EAAE,8BAAiB,CAAC,CAAC;AAE1D,kFAAkF;AAClF,IAAA,qBAAQ,EAAC,iBAAI,EAAE,2BAA2B,EAAE,kBAAK,EAAE,6BAAgB,CAAC,CAAC;AAErE,sEAAsE;AACtE,IAAA,qBAAQ,EAAC,iBAAI,EAAE,0BAA0B,EAAE,kBAAK,EAAE,6BAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAExF,kFAAkF;AAClF,IAAA,qBAAQ,EAAC,iBAAI,EAAE,sBAAsB,EAAE,kBAAK,EAAE,6BAAgB,EAAE;IAC5D,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,QAAQ;CACvB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,IAAA,qBAAQ,EAAC,iBAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAG,CAAC,CAAC;AAE/C,4EAA4E;AAC5E,IAAA,qBAAQ,EAAC,MAAM,EAAE,aAAa,EAAE,kBAAK,EAAE,gBAAG,CAAC,CAAC;AAE5C,6EAA6E;AAC7E,IAAA,qBAAQ,EAAC,iBAAI,EAAE,cAAc,EAAE,kBAAK,EAAE,KAAK,CAAC,CAAC;AAE7C,mGAAmG;AACnG,IAAA,qBAAQ,EAAC,KAAK,EAAE,UAAU,EAAE,kBAAK,EAAE,gBAAG,CAAC,CAAC","sourcesContent":["import { DELETE, GET, READ, Endpoint, EXTERNAL_INBOUND, EXTERNAL_OUTBOUND, PATCH, POST, PUT, RPC, WRITE, WRITE_IDEMPOTENT } from './decorators';\n\nEndpoint(POST, '/valid-rpc', WRITE, RPC);\nEndpoint(PUT, '/valid-put', WRITE_IDEMPOTENT, RPC);\nEndpoint(PATCH, '/valid-patch', WRITE, RPC);\nEndpoint(DELETE, '/valid-delete', WRITE_IDEMPOTENT, RPC);\nEndpoint(POST, '/valid-external', WRITE, EXTERNAL_INBOUND, { calledBy: 'twilio' });\nEndpoint(GET, '/valid-outbound', READ, EXTERNAL_OUTBOUND);\n\n// @ts-expect-error inbound external endpoints require options containing calledBy\nEndpoint(POST, '/missing-external-options', WRITE, EXTERNAL_INBOUND);\n\n// @ts-expect-error inbound external endpoint options require calledBy\nEndpoint(POST, '/missing-external-caller', WRITE, EXTERNAL_INBOUND, { formPost: true });\n\n// @ts-expect-error callerKind is a closed enum-backed union rather than free text\nEndpoint(POST, '/invalid-caller-kind', WRITE, EXTERNAL_INBOUND, {\n    calledBy: 'twilio',\n    callerKind: 'vendor',\n});\n\n// @ts-expect-error callers must import the enum-backed operation constant\nEndpoint(POST, '/raw-operation', 'write', RPC);\n\n// @ts-expect-error callers must import the enum-backed HTTP method constant\nEndpoint('POST', '/raw-method', WRITE, RPC);\n\n// @ts-expect-error callers must import the enum-backed trigger-kind constant\nEndpoint(POST, '/raw-trigger', WRITE, 'rpc');\n\n// @ts-expect-error callers must import the enum-backed HTTP method constant, for the new verbs too\nEndpoint('PUT', '/raw-put', WRITE, RPC);\n"]}
+{"version":3,"file":"EndpointCompileAssertions.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/EndpointCompileAssertions.ts"],"names":[],"mappings":";;AAAA,+DAA6C;AAC7C,6CAAkK;AAElK,IAAA,qBAAQ,EAAC,iBAAI,EAAE,YAAY,EAAE,kBAAK,EAAE,gBAAG,CAAC,CAAC;AACzC,IAAA,qBAAQ,EAAC,gBAAG,EAAE,YAAY,EAAE,6BAAgB,EAAE,gBAAG,CAAC,CAAC;AACnD,IAAA,qBAAQ,EAAC,kBAAK,EAAE,cAAc,EAAE,kBAAK,EAAE,gBAAG,CAAC,CAAC;AAC5C,IAAA,qBAAQ,EAAC,mBAAM,EAAE,eAAe,EAAE,6BAAgB,EAAE,gBAAG,CAAC,CAAC;AACzD,IAAA,qBAAQ,EAAC,iBAAI,EAAE,iBAAiB,EAAE,kBAAK,EAAE,6BAAgB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;AACnF,IAAA,qBAAQ,EAAC,gBAAG,EAAE,iBAAiB,EAAE,iBAAI,EAAE,8BAAiB,CAAC,CAAC;AAE1D,kFAAkF;AAClF,IAAA,qBAAQ,EAAC,iBAAI,EAAE,2BAA2B,EAAE,kBAAK,EAAE,6BAAgB,CAAC,CAAC;AAErE,sEAAsE;AACtE,IAAA,qBAAQ,EAAC,iBAAI,EAAE,0BAA0B,EAAE,kBAAK,EAAE,6BAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAExF,kFAAkF;AAClF,IAAA,qBAAQ,EAAC,iBAAI,EAAE,sBAAsB,EAAE,kBAAK,EAAE,6BAAgB,EAAE;IAC5D,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,QAAQ;CACvB,CAAC,CAAC;AAEH,0EAA0E;AAC1E,IAAA,qBAAQ,EAAC,iBAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAG,CAAC,CAAC;AAE/C,4EAA4E;AAC5E,IAAA,qBAAQ,EAAC,MAAM,EAAE,aAAa,EAAE,kBAAK,EAAE,gBAAG,CAAC,CAAC;AAE5C,6EAA6E;AAC7E,IAAA,qBAAQ,EAAC,iBAAI,EAAE,cAAc,EAAE,kBAAK,EAAE,KAAK,CAAC,CAAC;AAE7C,mGAAmG;AACnG,IAAA,qBAAQ,EAAC,KAAK,EAAE,UAAU,EAAE,kBAAK,EAAE,gBAAG,CAAC,CAAC;AAExC,uGAAuG;AACvG,kGAAkG;AAClG,IAAA,qBAAQ,EAAC,iBAAI,EAAE,aAAa,EAAE,kBAAK,EAAE,uBAAU,CAAC,CAAC;AACjD,IAAA,qBAAQ,EAAC,iBAAI,EAAE,aAAa,EAAE,kBAAK,EAAE,iBAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,IAAA,qBAAQ,EAAC,iBAAI,EAAE,iBAAiB,EAAE,kBAAK,EAAE,gBAAG,EAAE,EAAE,YAAY,EAAE,0BAAI,EAAE,CAAC,CAAC;AACtE,IAAA,qBAAQ,EAAC,mBAAM,EAAE,sBAAsB,EAAE,6BAAgB,EAAE,8BAAiB,CAAC,CAAC;AAC9E,IAAA,qBAAQ,EAAC,iBAAI,EAAE,qBAAqB,EAAE,kBAAK,EAAE,6BAAgB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,0BAAI,EAAE,CAAC,CAAC;AAE3G,wGAAwG;AACxG,IAAA,qBAAQ,EAAC,iBAAI,EAAE,sBAAsB,EAAE,kBAAK,EAAE,uBAAU,EAAE,EAAE,YAAY,EAAE,0BAAI,EAAE,CAAC,CAAC;AAElF,kGAAkG;AAClG,IAAA,qBAAQ,EAAC,iBAAI,EAAE,sBAAsB,EAAE,kBAAK,EAAE,iBAAI,EAAE,EAAE,YAAY,EAAE,0BAAI,EAAE,CAAC,CAAC;AAE5E,4GAA4G;AAC5G,IAAA,qBAAQ,EAAC,mBAAM,EAAE,gBAAgB,EAAE,6BAAgB,EAAE,8BAAiB,EAAE,EAAE,YAAY,EAAE,0BAAI,EAAE,CAAC,CAAC","sourcesContent":["import { NONE } from './HttpEndpointOptions';\nimport { CLOUDTASKS, CRON, DELETE, GET, READ, Endpoint, EXTERNAL_INBOUND, EXTERNAL_OUTBOUND, PATCH, POST, PUT, RPC, WRITE, WRITE_IDEMPOTENT } from './decorators';\n\nEndpoint(POST, '/valid-rpc', WRITE, RPC);\nEndpoint(PUT, '/valid-put', WRITE_IDEMPOTENT, RPC);\nEndpoint(PATCH, '/valid-patch', WRITE, RPC);\nEndpoint(DELETE, '/valid-delete', WRITE_IDEMPOTENT, RPC);\nEndpoint(POST, '/valid-external', WRITE, EXTERNAL_INBOUND, { calledBy: 'twilio' });\nEndpoint(GET, '/valid-outbound', READ, EXTERNAL_OUTBOUND);\n\n// @ts-expect-error inbound external endpoints require options containing calledBy\nEndpoint(POST, '/missing-external-options', WRITE, EXTERNAL_INBOUND);\n\n// @ts-expect-error inbound external endpoint options require calledBy\nEndpoint(POST, '/missing-external-caller', WRITE, EXTERNAL_INBOUND, { formPost: true });\n\n// @ts-expect-error callerKind is a closed enum-backed union rather than free text\nEndpoint(POST, '/invalid-caller-kind', WRITE, EXTERNAL_INBOUND, {\n    calledBy: 'twilio',\n    callerKind: 'vendor',\n});\n\n// @ts-expect-error callers must import the enum-backed operation constant\nEndpoint(POST, '/raw-operation', 'write', RPC);\n\n// @ts-expect-error callers must import the enum-backed HTTP method constant\nEndpoint('POST', '/raw-method', WRITE, RPC);\n\n// @ts-expect-error callers must import the enum-backed trigger-kind constant\nEndpoint(POST, '/raw-trigger', WRITE, 'rpc');\n\n// @ts-expect-error callers must import the enum-backed HTTP method constant, for the new verbs too\nEndpoint('PUT', '/raw-put', WRITE, RPC);\n\n// A CLOUDTASKS / CRON endpoint has no response body BY KIND, an EXTERNAL_OUTBOUND one is shaped by the\n// vendor (#1348); NONE stays a declaration only where OUR server answers (RPC, EXTERNAL_INBOUND).\nEndpoint(POST, '/valid-task', WRITE, CLOUDTASKS);\nEndpoint(POST, '/valid-cron', WRITE, CRON, { noLogging: true });\nEndpoint(POST, '/valid-rpc-void', WRITE, RPC, { responseBody: NONE });\nEndpoint(DELETE, '/valid-outbound-void', WRITE_IDEMPOTENT, EXTERNAL_OUTBOUND);\nEndpoint(POST, '/valid-inbound-void', WRITE, EXTERNAL_INBOUND, { calledBy: 'twilio', responseBody: NONE });\n\n// @ts-expect-error CLOUDTASKS already implies no response body; responseBody: NONE is a second spelling\nEndpoint(POST, '/redundant-task-none', WRITE, CLOUDTASKS, { responseBody: NONE });\n\n// @ts-expect-error CRON already implies no response body; responseBody: NONE is a second spelling\nEndpoint(POST, '/redundant-cron-none', WRITE, CRON, { responseBody: NONE });\n\n// @ts-expect-error the vendor shapes an EXTERNAL_OUTBOUND response; responseBody: NONE describes OUR server\nEndpoint(DELETE, '/outbound-none', WRITE_IDEMPOTENT, EXTERNAL_OUTBOUND, { responseBody: NONE });\n"]}

package/src/http/HttpEndpointOptions.d.ts

@@ -25,14 +25,21 @@ export interface EndpointOptions {
     /** Return only a JSON body (default), or the full transport-neutral status/header/body value. */
     responseType?: EndpointResponseType;
     /**
-     * `NONE`: this method returns `Promise<void>` and its success response is 0 BYTES. Our server
+     * `NONE`: this method returns `Promise<void>` and OUR SERVER's success response is 0 BYTES: it
      * answers `204 No Content` with no body and no Content-Type, and every client (node, browser,
-     * in-process) resolves `undefined` — while still ACCEPTING `{}`, an empty `200` or a `204`,
-     * because a vendor whose spec documents no body may still send one.
+     * in-process) resolves `undefined` — while still ACCEPTING `{}`, an empty `200` or a `204`.
      *
      * WHY a declaration: `design:returntype` of an async method is just `Promise`, so the runtime
      * cannot see `void`. The architecture scan checks this option agrees with the declared
      * `Promise<void>` in both directions, so it cannot drift from the signature.
+     *
+     * Only for `RPC` and `EXTERNAL_INBOUND`, where our server answers and a body is a real
+     * question (#1348). Every other kind refuses it (see {@link NoResponseBodyOptionEndpointOptions}):
+     * - `CLOUDTASKS` / `CRON` are fire-and-forget BY KIND — the caller reads nothing but the status —
+     *   so the kind itself implies no response body; such a method must return `Promise<void>`.
+     * - `EXTERNAL_OUTBOUND` is served by the VENDOR, which shapes its own responses; no server of
+     *   ours implements it. Its client accepts any 2xx: 204 / empty -> `undefined`, a JSON body is
+     *   parsed, a non-JSON body -> `undefined`.
      */
     responseBody?: ResponseBodyKind;
     /**
@@ -160,4 +167,13 @@ export interface ExternalEndpointOptions extends EndpointOptions {
     /** What that caller is; picks its graph shape. Defaults to `'saas'`. */
     callerKind?: ExternalSystemKind;
 }
+/**
+ * The options of a `CLOUDTASKS`, `CRON` or `EXTERNAL_OUTBOUND` endpoint, where `responseBody: NONE`
+ * cannot be written (#1348): the CLOUDTASKS / CRON kind already says the response has no body (one
+ * spelling per decision), and an EXTERNAL_OUTBOUND response is shaped by the vendor, not by us.
+ */
+export interface NoResponseBodyOptionEndpointOptions extends EndpointOptions {
+    /** Implied by CLOUDTASKS / CRON, the vendor's to shape on EXTERNAL_OUTBOUND: `NONE` does not compile. */
+    responseBody?: never;
+}
 export {};

package/src/http/HttpEndpointOptions.js.map

@@ -1 +1 @@
-{"version":3,"file":"HttpEndpointOptions.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/HttpEndpointOptions.ts"],"names":[],"mappings":";;;AAGA,8EAA8E;AAC9E,IAAK,sBAIJ;AAJD,WAAK,sBAAsB;IACvB,uCAAa,CAAA;IACb,+DAAqC,CAAA;IACrC,yCAAe,CAAA;AACnB,CAAC,EAJI,sBAAsB,KAAtB,sBAAsB,QAI1B;AAED,wDAAwD;AAC3C,QAAA,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC;AACnC,QAAA,gBAAgB,GAAG,sBAAsB,CAAC,gBAAgB,CAAC;AAC3D,QAAA,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAKlD,gEAAgE;AAChE,IAAK,iBAEJ;AAFD,WAAK,iBAAiB;IAClB,kCAAa,CAAA;AACjB,CAAC,EAFI,iBAAiB,KAAjB,iBAAiB,QAErB;AAED,uFAAuF;AAC1E,QAAA,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC","sourcesContent":["import { ExternalSystemKind } from './external-caller';\nimport { EndpointResponseType } from './HttpContract';\n\n/** Nominal backing keeps raw string literals out of endpoint declarations. */\nenum EndpointOperationValue {\n    READ = 'read',\n    WRITE_IDEMPOTENT = 'write-idempotent',\n    WRITE = 'write',\n}\n\n/** Short, statically importable decorator arguments. */\nexport const READ = EndpointOperationValue.READ;\nexport const WRITE_IDEMPOTENT = EndpointOperationValue.WRITE_IDEMPOTENT;\nexport const WRITE = EndpointOperationValue.WRITE;\n\n/** The side-effect contract callers use to decide whether repeating an operation is safe. */\nexport type EndpointOperation = typeof READ | typeof WRITE_IDEMPOTENT | typeof WRITE;\n\n/** Nominal backing for {@link EndpointOptions.responseBody}. */\nenum ResponseBodyValue {\n    NONE = 'none',\n}\n\n/** `@Endpoint(..., { responseBody: NONE })` — the success response carries 0 bytes. */\nexport const NONE = ResponseBodyValue.NONE;\n\n/** The one response-body declaration an endpoint can make; absent means a JSON body. */\nexport type ResponseBodyKind = typeof NONE;\n\n/** Options for one `@Endpoint`, stored parallel to the method-to-path metadata. */\nexport interface EndpointOptions {\n    /** Return only a JSON body (default), or the full transport-neutral status/header/body value. */\n    responseType?: EndpointResponseType;\n    /**\n     * `NONE`: this method returns `Promise<void>` and its success response is 0 BYTES. Our server\n     * answers `204 No Content` with no body and no Content-Type, and every client (node, browser,\n     * in-process) resolves `undefined` — while still ACCEPTING `{}`, an empty `200` or a `204`,\n     * because a vendor whose spec documents no body may still send one.\n     *\n     * WHY a declaration: `design:returntype` of an async method is just `Promise`, so the runtime\n     * cannot see `void`. The architecture scan checks this option agrees with the declared\n     * `Promise<void>` in both directions, so it cannot drift from the signature.\n     */\n    responseBody?: ResponseBodyKind;\n    /**\n     * Parse the request body as application/x-www-form-urlencoded instead of JSON. The request\n     * DTO must be flat; urlencoded has no nesting. Default false = JSON.\n     */\n    formPost?: boolean;\n    /**\n     * Retain the verbatim request bytes and absolute URL for a `vendorAuth(...)` hook to verify.\n     * This is retention, not new buffering: the Express adapter already accumulates the body.\n     *\n     * A served `vendorAuth(...)` endpoint requires this option at wiring time. It combines with `formPost` for vendors\n     * that sign flat form bodies, e.g. `{ formPost: true, rawBody: true }`.\n     */\n    rawBody?: boolean;\n    /**\n     * The app should show NO progress UI for this call — it is not something the USER is waiting on\n     * (a background download, a log shipper, a heartbeat, a telemetry flush).\n     *\n     * webpieces draws no progress bar itself; it DECLARES the fact and carries it on\n     * `RouteMetadata.hideProgress`, which an app's `RequestLifecycleListener` reads to keep the call\n     * out of its bar. WHY a declaration on the endpoint: the alternative is the app matching path\n     * strings in its listener, which silently drifts the first time a route is renamed. The ROUTE is\n     * the stable fact, so the decision belongs to the route's author.\n     *\n     * Independent of {@link noLogging} and {@link allowUpgradeInFlight}: a background download hides\n     * its progress yet still wants its `[API-*]` lines (exactly what you need when a sync is slow)\n     * and still must finish before an app upgrades under it.\n     *\n     * Default false: absent means the call drives the app's progress UI, like any ordinary route.\n     * `grep -rn hideProgress` lists every endpoint the user is not shown waiting on.\n     */\n    hideProgress?: boolean;\n    /**\n     * webpieces writes NO `[API-*-req]` / `[API-*-resp-*]` line for this call, on either side —\n     * {@link LogApiCallImpl} reads it via `ApiMethodInfo.noLogging`, handed in by both the client\n     * proxy and the server's `LogApiFilter` — and stamps no per-call `api` tag.\n     *\n     * WHY a declaration and not a suppression switch: shipping a log over a logged transport logs\n     * about shipping logs — the line describing the call IS the thing being shipped, and emitting it\n     * feeds the next batch its own payload. The two mechanisms that do not know the endpoint both\n     * failed in prod (see #976) — a wall-clock \"we are shipping\" boolean swallowed unrelated lines\n     * including an error alarm, and a logger-name allowlist was incomplete by construction the moment\n     * anyone added a logger, producing a steady-state 4-lines-per-second request loop on an idle page.\n     * The ENDPOINT is the only stable, declarative fact, so it is where the decision belongs.\n     *\n     * Rides the route metadata for the same reason {@link formPost} and {@link rawBody} do: the\n     * consumer branches on the ROUTE, without knowing the apiClass/methodName.\n     *\n     * Default false: absent means the ordinary, fully-logged route. The quiet path is the one you\n     * have to say out loud, so `grep -rn noLogging` lists every endpoint webpieces stops logging.\n     */\n    noLogging?: boolean;\n    /**\n     * An app MAY upgrade (reload onto a newer deployed bundle) while this call is in flight, and the\n     * call neither blocks nor arms that upgrade.\n     *\n     * By default every RPC participates in the app's upgrade decision: the app must not upgrade while\n     * it is in flight, and it counts toward the \"finished with a SUCCESS result\" boundary at which an\n     * app typically arms its seamless upgrade. That default is the safe one — reloading under an\n     * in-flight write or download loses it. A call nobody asked for, and that is harmless to cut off\n     * (a log shipper, a heartbeat), declares `true` so it can neither hold an upgrade hostage nor be\n     * the success that triggers one.\n     *\n     * WHY separate from {@link hideProgress}: apps commonly arm an upgrade off their progress bar's\n     * request group, so hiding a call from the bar used to drop it out of the upgrade decision as a\n     * side effect. A hidden background download must still block an upgrade until it succeeds; only\n     * this flag, said out loud, lets a call stop participating.\n     *\n     * webpieces only declares and carries it (`RouteMetadata.allowUpgradeInFlight`); the app's\n     * `RequestLifecycleListener` / upgrade logic decides what to do with it. Default false.\n     * `grep -rn allowUpgradeInFlight` lists every endpoint an upgrade may cut off.\n     *\n     * THE SERVER'S HALF of the upgrade story is `ApiClientTooOldError` (HTTP 426,\n     * `errorCode: 'client-too-old'`). This flag is the CLIENT deciding WHEN it may upgrade; that\n     * error is a SERVER saying the client MUST. Who throws it: a server gate that compares the build\n     * the caller declared (a header, a version in the request) against the minimum it still\n     * supports. Receivers decode it back into `ApiClientTooOldError` on every hop, server-to-server\n     * and browser, HTTP and IPC, and treat it as an upgrade, never as a bug: the app's upgrade logic\n     * reloads or installs the new build, typically honouring this flag for the calls still in flight.\n     */\n    allowUpgradeInFlight?: boolean;\n    /**\n     * This route is NOT part of the CUSTOMER-facing contract. `public-openapi.json` — the document a\n     * customer gets, and the only one a publish path uploads — contains no path, no operation, no\n     * schema and no prose for it. It is not \"rendered with a flag set\", it is absent.\n     *\n     * It is still in `full-private-openapi.json`, and still in `mcp-openapi.json` when it carries\n     * `@WpMcpTool`. The reason it is withheld belongs in the method's JSDoc, which is where every\n     * other piece of its documentation already lives.\n     *\n     * WHY A BOOLEAN HERE IS NOT SHIM SHAPE #5, given that `@ApiType` exists precisely to avoid a\n     * falsy default meaning \"publish\": the two operate at different levels and the default here is\n     * NOT the permissive one. A contract reaches customers only by declaring\n     * `@ApiType(..., EXTERNAL_CUSTOMER)` — one deliberate token per contract — and `hidden` only ever\n     * SUBTRACTS from what that token already granted. Omitting it on a contract nobody published to\n     * customers publishes nothing. The per-method case it exists for is real and cannot be said at\n     * class level: a NEW endpoint on an already-published API, built on main before it is announced.\n     *\n     * Default false, and `grep -rn \"hidden: true\"` lists every method withheld from customers.\n     *\n     * HIDING IS A DOCUMENTATION DECISION AND NEVER AN ACCESS-CONTROL ONE. The route is served exactly\n     * as before and is still reachable by anything holding its credential — including an agent, if it\n     * also carries `@WpMcpTool`. Declare its authorization as loudly as a published one.\n     */\n    hidden?: boolean;\n    /**\n     * This operation may touch systems OUTSIDE this service — a payment processor, a partner's API,\n     * the physical world. It feeds MCP's `openWorldHint`, and it is rendered as a sentence in the\n     * operation's description so a human integrating against the document sees it too.\n     *\n     * DEFAULT FALSE, deliberately unlike the MCP specification's own `true` default. MCP defaults to\n     * \"open world\" because it cannot know; webpieces CAN know, because the author of the endpoint is\n     * right here. Defaulting to `true` would make the interesting case the silent one and the boring\n     * case the one you have to type, which is backwards — and an agent told that every endpoint might\n     * reach the outside world has been told nothing. `grep -rn \"openWorld: true\"` lists the ones that\n     * genuinely do.\n     */\n    openWorld?: boolean;\n}\n\n/** An EXTERNAL_INBOUND endpoint must also identify the outside system that calls it. */\nexport interface ExternalEndpointOptions extends EndpointOptions {\n    /** The outside system (`'twilio'`) — graph identity, not display text. */\n    calledBy: string;\n    /** What that caller is; picks its graph shape. Defaults to `'saas'`. */\n    callerKind?: ExternalSystemKind;\n}\n"]}
+{"version":3,"file":"HttpEndpointOptions.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/HttpEndpointOptions.ts"],"names":[],"mappings":";;;AAGA,8EAA8E;AAC9E,IAAK,sBAIJ;AAJD,WAAK,sBAAsB;IACvB,uCAAa,CAAA;IACb,+DAAqC,CAAA;IACrC,yCAAe,CAAA;AACnB,CAAC,EAJI,sBAAsB,KAAtB,sBAAsB,QAI1B;AAED,wDAAwD;AAC3C,QAAA,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC;AACnC,QAAA,gBAAgB,GAAG,sBAAsB,CAAC,gBAAgB,CAAC;AAC3D,QAAA,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC;AAKlD,gEAAgE;AAChE,IAAK,iBAEJ;AAFD,WAAK,iBAAiB;IAClB,kCAAa,CAAA;AACjB,CAAC,EAFI,iBAAiB,KAAjB,iBAAiB,QAErB;AAED,uFAAuF;AAC1E,QAAA,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC","sourcesContent":["import { ExternalSystemKind } from './external-caller';\nimport { EndpointResponseType } from './HttpContract';\n\n/** Nominal backing keeps raw string literals out of endpoint declarations. */\nenum EndpointOperationValue {\n    READ = 'read',\n    WRITE_IDEMPOTENT = 'write-idempotent',\n    WRITE = 'write',\n}\n\n/** Short, statically importable decorator arguments. */\nexport const READ = EndpointOperationValue.READ;\nexport const WRITE_IDEMPOTENT = EndpointOperationValue.WRITE_IDEMPOTENT;\nexport const WRITE = EndpointOperationValue.WRITE;\n\n/** The side-effect contract callers use to decide whether repeating an operation is safe. */\nexport type EndpointOperation = typeof READ | typeof WRITE_IDEMPOTENT | typeof WRITE;\n\n/** Nominal backing for {@link EndpointOptions.responseBody}. */\nenum ResponseBodyValue {\n    NONE = 'none',\n}\n\n/** `@Endpoint(..., { responseBody: NONE })` — the success response carries 0 bytes. */\nexport const NONE = ResponseBodyValue.NONE;\n\n/** The one response-body declaration an endpoint can make; absent means a JSON body. */\nexport type ResponseBodyKind = typeof NONE;\n\n/** Options for one `@Endpoint`, stored parallel to the method-to-path metadata. */\nexport interface EndpointOptions {\n    /** Return only a JSON body (default), or the full transport-neutral status/header/body value. */\n    responseType?: EndpointResponseType;\n    /**\n     * `NONE`: this method returns `Promise<void>` and OUR SERVER's success response is 0 BYTES: it\n     * answers `204 No Content` with no body and no Content-Type, and every client (node, browser,\n     * in-process) resolves `undefined` — while still ACCEPTING `{}`, an empty `200` or a `204`.\n     *\n     * WHY a declaration: `design:returntype` of an async method is just `Promise`, so the runtime\n     * cannot see `void`. The architecture scan checks this option agrees with the declared\n     * `Promise<void>` in both directions, so it cannot drift from the signature.\n     *\n     * Only for `RPC` and `EXTERNAL_INBOUND`, where our server answers and a body is a real\n     * question (#1348). Every other kind refuses it (see {@link NoResponseBodyOptionEndpointOptions}):\n     * - `CLOUDTASKS` / `CRON` are fire-and-forget BY KIND — the caller reads nothing but the status —\n     *   so the kind itself implies no response body; such a method must return `Promise<void>`.\n     * - `EXTERNAL_OUTBOUND` is served by the VENDOR, which shapes its own responses; no server of\n     *   ours implements it. Its client accepts any 2xx: 204 / empty -> `undefined`, a JSON body is\n     *   parsed, a non-JSON body -> `undefined`.\n     */\n    responseBody?: ResponseBodyKind;\n    /**\n     * Parse the request body as application/x-www-form-urlencoded instead of JSON. The request\n     * DTO must be flat; urlencoded has no nesting. Default false = JSON.\n     */\n    formPost?: boolean;\n    /**\n     * Retain the verbatim request bytes and absolute URL for a `vendorAuth(...)` hook to verify.\n     * This is retention, not new buffering: the Express adapter already accumulates the body.\n     *\n     * A served `vendorAuth(...)` endpoint requires this option at wiring time. It combines with `formPost` for vendors\n     * that sign flat form bodies, e.g. `{ formPost: true, rawBody: true }`.\n     */\n    rawBody?: boolean;\n    /**\n     * The app should show NO progress UI for this call — it is not something the USER is waiting on\n     * (a background download, a log shipper, a heartbeat, a telemetry flush).\n     *\n     * webpieces draws no progress bar itself; it DECLARES the fact and carries it on\n     * `RouteMetadata.hideProgress`, which an app's `RequestLifecycleListener` reads to keep the call\n     * out of its bar. WHY a declaration on the endpoint: the alternative is the app matching path\n     * strings in its listener, which silently drifts the first time a route is renamed. The ROUTE is\n     * the stable fact, so the decision belongs to the route's author.\n     *\n     * Independent of {@link noLogging} and {@link allowUpgradeInFlight}: a background download hides\n     * its progress yet still wants its `[API-*]` lines (exactly what you need when a sync is slow)\n     * and still must finish before an app upgrades under it.\n     *\n     * Default false: absent means the call drives the app's progress UI, like any ordinary route.\n     * `grep -rn hideProgress` lists every endpoint the user is not shown waiting on.\n     */\n    hideProgress?: boolean;\n    /**\n     * webpieces writes NO `[API-*-req]` / `[API-*-resp-*]` line for this call, on either side —\n     * {@link LogApiCallImpl} reads it via `ApiMethodInfo.noLogging`, handed in by both the client\n     * proxy and the server's `LogApiFilter` — and stamps no per-call `api` tag.\n     *\n     * WHY a declaration and not a suppression switch: shipping a log over a logged transport logs\n     * about shipping logs — the line describing the call IS the thing being shipped, and emitting it\n     * feeds the next batch its own payload. The two mechanisms that do not know the endpoint both\n     * failed in prod (see #976) — a wall-clock \"we are shipping\" boolean swallowed unrelated lines\n     * including an error alarm, and a logger-name allowlist was incomplete by construction the moment\n     * anyone added a logger, producing a steady-state 4-lines-per-second request loop on an idle page.\n     * The ENDPOINT is the only stable, declarative fact, so it is where the decision belongs.\n     *\n     * Rides the route metadata for the same reason {@link formPost} and {@link rawBody} do: the\n     * consumer branches on the ROUTE, without knowing the apiClass/methodName.\n     *\n     * Default false: absent means the ordinary, fully-logged route. The quiet path is the one you\n     * have to say out loud, so `grep -rn noLogging` lists every endpoint webpieces stops logging.\n     */\n    noLogging?: boolean;\n    /**\n     * An app MAY upgrade (reload onto a newer deployed bundle) while this call is in flight, and the\n     * call neither blocks nor arms that upgrade.\n     *\n     * By default every RPC participates in the app's upgrade decision: the app must not upgrade while\n     * it is in flight, and it counts toward the \"finished with a SUCCESS result\" boundary at which an\n     * app typically arms its seamless upgrade. That default is the safe one — reloading under an\n     * in-flight write or download loses it. A call nobody asked for, and that is harmless to cut off\n     * (a log shipper, a heartbeat), declares `true` so it can neither hold an upgrade hostage nor be\n     * the success that triggers one.\n     *\n     * WHY separate from {@link hideProgress}: apps commonly arm an upgrade off their progress bar's\n     * request group, so hiding a call from the bar used to drop it out of the upgrade decision as a\n     * side effect. A hidden background download must still block an upgrade until it succeeds; only\n     * this flag, said out loud, lets a call stop participating.\n     *\n     * webpieces only declares and carries it (`RouteMetadata.allowUpgradeInFlight`); the app's\n     * `RequestLifecycleListener` / upgrade logic decides what to do with it. Default false.\n     * `grep -rn allowUpgradeInFlight` lists every endpoint an upgrade may cut off.\n     *\n     * THE SERVER'S HALF of the upgrade story is `ApiClientTooOldError` (HTTP 426,\n     * `errorCode: 'client-too-old'`). This flag is the CLIENT deciding WHEN it may upgrade; that\n     * error is a SERVER saying the client MUST. Who throws it: a server gate that compares the build\n     * the caller declared (a header, a version in the request) against the minimum it still\n     * supports. Receivers decode it back into `ApiClientTooOldError` on every hop, server-to-server\n     * and browser, HTTP and IPC, and treat it as an upgrade, never as a bug: the app's upgrade logic\n     * reloads or installs the new build, typically honouring this flag for the calls still in flight.\n     */\n    allowUpgradeInFlight?: boolean;\n    /**\n     * This route is NOT part of the CUSTOMER-facing contract. `public-openapi.json` — the document a\n     * customer gets, and the only one a publish path uploads — contains no path, no operation, no\n     * schema and no prose for it. It is not \"rendered with a flag set\", it is absent.\n     *\n     * It is still in `full-private-openapi.json`, and still in `mcp-openapi.json` when it carries\n     * `@WpMcpTool`. The reason it is withheld belongs in the method's JSDoc, which is where every\n     * other piece of its documentation already lives.\n     *\n     * WHY A BOOLEAN HERE IS NOT SHIM SHAPE #5, given that `@ApiType` exists precisely to avoid a\n     * falsy default meaning \"publish\": the two operate at different levels and the default here is\n     * NOT the permissive one. A contract reaches customers only by declaring\n     * `@ApiType(..., EXTERNAL_CUSTOMER)` — one deliberate token per contract — and `hidden` only ever\n     * SUBTRACTS from what that token already granted. Omitting it on a contract nobody published to\n     * customers publishes nothing. The per-method case it exists for is real and cannot be said at\n     * class level: a NEW endpoint on an already-published API, built on main before it is announced.\n     *\n     * Default false, and `grep -rn \"hidden: true\"` lists every method withheld from customers.\n     *\n     * HIDING IS A DOCUMENTATION DECISION AND NEVER AN ACCESS-CONTROL ONE. The route is served exactly\n     * as before and is still reachable by anything holding its credential — including an agent, if it\n     * also carries `@WpMcpTool`. Declare its authorization as loudly as a published one.\n     */\n    hidden?: boolean;\n    /**\n     * This operation may touch systems OUTSIDE this service — a payment processor, a partner's API,\n     * the physical world. It feeds MCP's `openWorldHint`, and it is rendered as a sentence in the\n     * operation's description so a human integrating against the document sees it too.\n     *\n     * DEFAULT FALSE, deliberately unlike the MCP specification's own `true` default. MCP defaults to\n     * \"open world\" because it cannot know; webpieces CAN know, because the author of the endpoint is\n     * right here. Defaulting to `true` would make the interesting case the silent one and the boring\n     * case the one you have to type, which is backwards — and an agent told that every endpoint might\n     * reach the outside world has been told nothing. `grep -rn \"openWorld: true\"` lists the ones that\n     * genuinely do.\n     */\n    openWorld?: boolean;\n}\n\n/** An EXTERNAL_INBOUND endpoint must also identify the outside system that calls it. */\nexport interface ExternalEndpointOptions extends EndpointOptions {\n    /** The outside system (`'twilio'`) — graph identity, not display text. */\n    calledBy: string;\n    /** What that caller is; picks its graph shape. Defaults to `'saas'`. */\n    callerKind?: ExternalSystemKind;\n}\n\n/**\n * The options of a `CLOUDTASKS`, `CRON` or `EXTERNAL_OUTBOUND` endpoint, where `responseBody: NONE`\n * cannot be written (#1348): the CLOUDTASKS / CRON kind already says the response has no body (one\n * spelling per decision), and an EXTERNAL_OUTBOUND response is shaped by the vendor, not by us.\n */\nexport interface NoResponseBodyOptionEndpointOptions extends EndpointOptions {\n    /** Implied by CLOUDTASKS / CRON, the vendor's to shape on EXTERNAL_OUTBOUND: `NONE` does not compile. */\n    responseBody?: never;\n}\n"]}

package/src/http/RouteMetadata.d.ts

@@ -98,7 +98,8 @@ export declare class RouteMetadata {
      */
     readonly allowUpgradeInFlight: boolean;
     /**
-     * True when @Endpoint(..., { responseBody: NONE }): the method returns `Promise<void>` and the
+     * True when the endpoint is CLOUDTASKS or CRON (no response body BY KIND, #1348), or declares
+     * @Endpoint(..., { responseBody: NONE }): the method returns `Promise<void>` and the
      * success response is 0 bytes. The server answers 204 with no body; every client accepts `{}`,
      * an empty 200 or a 204 and resolves `undefined`. Default false = a JSON body.
      */

package/src/http/RouteMetadata.js

@@ -109,7 +109,8 @@ class RouteMetadata {
      */
     allowUpgradeInFlight;
     /**
-     * True when @Endpoint(..., { responseBody: NONE }): the method returns `Promise<void>` and the
+     * True when the endpoint is CLOUDTASKS or CRON (no response body BY KIND, #1348), or declares
+     * @Endpoint(..., { responseBody: NONE }): the method returns `Promise<void>` and the
      * success response is 0 bytes. The server answers 204 with no body; every client accepts `{}`,
      * an empty 200 or a 204 and resolves `undefined`. Default false = a JSON body.
      */

package/src/http/RouteMetadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"RouteMetadata.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/RouteMetadata.ts"],"names":[],"mappings":";;;AACA,2CAAuC;AAIvC,iDAA8C;AAG9C;;;;;;;;GAQG;AACH,MAAa,aAAa;IA0HT;IAQA;IAEA;IAEA;IAEA;IAvIb,QAAQ,CAAY;IACpB,oHAAoH;IACpH,aAAa,CAA+D;IAC5E,SAAS,GAAG,KAAK,CAAC;IAClB;;;OAGG;IACH,gBAAgB,GAAG,KAAK,CAAC;IACzB,qGAAqG;IACrG,mBAAmB,GAA6B,EAAE,CAAC;IAEnD,gGAAgG;IAChG,gBAAgB,CAAC,MAAsC;QACnD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QAClH,KAAK,CAAC,QAAQ,GAAG,IAAI,oBAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3G,OAAO,KAAK,CAAC;IACjB,CAAC;IACD;;;;OAIG;IACH,QAAQ,GAAa,mBAAQ,CAAC,UAAU,CAAC;IAEzC;;;;OAIG;IACH,YAAY,CAAC,IAAc;QACvB,IAAI,IAAI,KAAK,mBAAQ,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,aAAa,CAC3B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,mBAAmB,EACxB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,EACd,IAAI,EACJ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,oBAAoB,EACzB,IAAI,CAAC,cAAc,CACtB,CAAC;QACF,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC/C,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC;QACrD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,UAAU,CAAS;IACnB,IAAI,CAAS;IACb,UAAU,CAAS;IACnB,mBAAmB,CAAU;IAC7B,QAAQ,CAAY;IACpB,wFAAwF;IACxF,OAAO,CAAU;IACjB;;;;OAIG;IACM,QAAQ,CAAU;IAC3B;;;;OAIG;IACM,IAAI,CAAY;IACzB;;;;;OAKG;IACM,OAAO,CAAU;IAC1B;;;;;;OAMG;IACM,YAAY,CAAU;IAC/B;;;;;OAKG;IACM,SAAS,CAAU;IAC5B;;;;;OAKG;IACM,oBAAoB,CAAU;IACvC;;;;OAIG;IACM,cAAc,CAAU;IAEjC,YACI,UAAkB,EAClB,IAAY,EACZ,UAAkB;IAClB,iFAAiF;IACxE,SAA4B,EACrC,mBAA4B,EAC5B,QAAmB,EACnB,OAAgB,EAChB,WAAoB,KAAK,EACzB,IAAe,EACf,UAAmB,KAAK;IACxB,8DAA8D;IACrD,oBAAqD,EAAE;IAChE,8EAA8E;IACrE,kBAA2B;IACpC,yFAAyF;IAChF,eAAqC,MAAM;IACpD,+EAA+E;IACtE,SAAqC,EAC9C,eAAwB,KAAK,EAC7B,YAAqB,KAAK,EAC1B,uBAAgC,KAAK,EACrC,iBAA0B,KAAK;QAlBtB,cAAS,GAAT,SAAS,CAAmB;QAQ5B,sBAAiB,GAAjB,iBAAiB,CAAsC;QAEvD,uBAAkB,GAAlB,kBAAkB,CAAS;QAE3B,iBAAY,GAAZ,YAAY,CAA+B;QAE3C,cAAS,GAAT,SAAS,CAA4B;QAM9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACzC,CAAC;CACJ;AAhKD,sCAgKC","sourcesContent":["import { MaskSpec } from './LogFieldMask';\nimport { AuthMeta } from './auth-mode';\nimport { EndpointResponseType, HttpParameterBinding } from './HttpContract';\nimport { StreamingEndpointMetadata } from './StreamingContract';\nimport { EndpointOperation } from './HttpEndpointOptions';\nimport { CallMode } from '../errors/CallMode';\nimport { AnyContextKey } from '../ContextKey';\n\n/**\n * Route metadata stored per-method at runtime.\n * Used internally by http-routing and http-client as the runtime representation\n * of a route. Constructed from @ApiPath + @Endpoint metadata by ProxyClient\n * and ApiRoutingFactory.\n *\n * Lives in its own file (one class per file) purely for file size, exactly as `api-kind.ts` and\n * `external-caller.ts` were split off `decorators.ts` before it. Nothing about its role changed.\n */\nexport class RouteMetadata {\n    apiClass?: Function;\n    // webpieces-disable no-any-unknown -- erased application policy is validated by AuthorizationHook at server startup\n    authorization?: import('./authorization').AuthorizationRequirement<unknown>;\n    localOnly = false;\n    /**\n     * True when the contract is `EXTERNAL_OUTBOUND`: an outside system's API. Its client sends ONLY\n     * {@link externalContextKeys} and believes no response header (`DestinationTrust.forRoute`).\n     */\n    externalOutbound = false;\n    /** `@ExternalContextKeys(...)` resolved for this method — class-level keys plus the method's own. */\n    externalContextKeys: readonly AnyContextKey[] = [];\n\n    /** Clients clone metadata per call so a concrete winning mode governs both trust directions. */\n    withSelectedAuth(method: import('./auth-mode').AuthMode): RouteMetadata {\n        if (!this.authMeta?.methods.includes(method)) throw new Error('Selected credential is not declared by this endpoint.');\n        const route = Object.assign(new RouteMetadata(this.httpMethod, this.path, this.methodName, this.operation), this);\n        route.authMeta = new AuthMeta([method], method.kind === 'public' ? this.authMeta.publicReason : undefined);\n        return route;\n    }\n    /**\n     * Whether the user is waiting on THIS call (#1293). Not an endpoint declaration: a client stamps\n     * it per call with {@link withCallMode}, from the `ClientConfig` it was built with. FOREGROUND on\n     * every route a contract's decorators build.\n     */\n    callMode: CallMode = CallMode.FOREGROUND;\n\n    /**\n     * A per-call copy carrying `mode`. A BACKGROUND call also gets {@link hideProgress} — nobody is\n     * waiting on it — so an app's `RequestLifecycleListener` keeps it out of the progress bar with\n     * no endpoint declaration. FOREGROUND returns this route unchanged.\n     */\n    withCallMode(mode: CallMode): RouteMetadata {\n        if (mode === CallMode.FOREGROUND) return this;\n        const route = new RouteMetadata(\n            this.httpMethod,\n            this.path,\n            this.methodName,\n            this.operation,\n            this.controllerClassName,\n            this.authMeta,\n            this.apiName,\n            this.formPost,\n            this.mask,\n            this.rawBody,\n            this.parameterBindings,\n            this.bodyParameterIndex,\n            this.responseType,\n            this.streaming,\n            true,\n            this.noLogging,\n            this.allowUpgradeInFlight,\n            this.noResponseBody,\n        );\n        route.apiClass = this.apiClass;\n        route.authorization = this.authorization;\n        route.localOnly = this.localOnly;\n        route.externalOutbound = this.externalOutbound;\n        route.externalContextKeys = this.externalContextKeys;\n        route.callMode = mode;\n        return route;\n    }\n    httpMethod: string;\n    path: string;\n    methodName: string;\n    controllerClassName?: string;\n    authMeta?: AuthMeta;\n    /** The API contract class name (e.g. 'SaveApi') — distinct from the controller name. */\n    apiName?: string;\n    /**\n     * True when @Endpoint(..., { formPost: true }): the body is application/x-www-form-urlencoded\n     * (flat key→value), not JSON. Rides the route metadata so the per-route body parse can branch\n     * without knowing the apiClass/methodName. Default false = JSON.\n     */\n    readonly formPost: boolean;\n    /**\n     * The @MaskLog field-mask spec for this route, or undefined when the method declared none. Read\n     * ONCE here at route-build time and handed to {@link LogApiCallImpl} via ApiMethodInfo, so the per-call\n     * log path pays for masking only on routes that opted in (the rest stay on plain JSON.stringify).\n     */\n    readonly mask?: MaskSpec;\n    /**\n     * True when @Endpoint(..., { rawBody: true }): the transport must retain the verbatim bytes +\n     * absolute url for `VendorAuthHook.verify` to check a vendor credential over. Rides the route\n     * metadata for the same reason {@link formPost} does — the transport adapter decides how to read\n     * the body from the ROUTE, without knowing the apiClass/methodName.\n     */\n    readonly rawBody: boolean;\n    /**\n     * True when @Endpoint(..., { hideProgress: true }): the app should show no progress UI for this\n     * call. webpieces does not act on it; an app's `RequestLifecycleListener.onRequestStart/onRequestEnd`\n     * reads it from the ROUTE, for the same reason {@link formPost} and {@link rawBody} ride here —\n     * the consumer branches without knowing the apiClass/methodName. Default false = the call drives\n     * the progress UI.\n     */\n    readonly hideProgress: boolean;\n    /**\n     * True when @Endpoint(..., { noLogging: true }): read by {@link LogApiCallImpl} (via\n     * ApiMethodInfo, exactly as {@link mask} is) so no `[API-*-req]`/`[API-*-resp-*]` line is\n     * emitted for the call, on the client or the server. Default false = an ordinary, fully-logged\n     * route.\n     */\n    readonly noLogging: boolean;\n    /**\n     * True when @Endpoint(..., { allowUpgradeInFlight: true }): an app may upgrade while this call is\n     * in flight, and the call neither blocks nor arms an upgrade. webpieces only carries it; the\n     * app's `RequestLifecycleListener` / upgrade logic reads it. Default false = the app must not\n     * upgrade while the call is in flight, and its success counts toward arming one.\n     */\n    readonly allowUpgradeInFlight: boolean;\n    /**\n     * True when @Endpoint(..., { responseBody: NONE }): the method returns `Promise<void>` and the\n     * success response is 0 bytes. The server answers 204 with no body; every client accepts `{}`,\n     * an empty 200 or a 204 and resolves `undefined`. Default false = a JSON body.\n     */\n    readonly noResponseBody: boolean;\n\n    constructor(\n        httpMethod: string,\n        path: string,\n        methodName: string,\n        /** Explicit side-effect semantics; deliberately independent of the HTTP verb. */\n        readonly operation: EndpointOperation,\n        controllerClassName?: string,\n        authMeta?: AuthMeta,\n        apiName?: string,\n        formPost: boolean = false,\n        mask?: MaskSpec,\n        rawBody: boolean = false,\n        /** Explicit path/query mappings, in API declaration order. */\n        readonly parameterBindings: readonly HttpParameterBinding[] = [],\n        /** The sole unannotated POST parameter, or undefined for a bodyless route. */\n        readonly bodyParameterIndex?: number,\n        /** Whether clients receive only the body or the complete status/header/body response. */\n        readonly responseType: EndpointResponseType = 'body',\n        /** Present only for `(ResponseStream) => Promise<RequestStream>` contracts. */\n        readonly streaming?: StreamingEndpointMetadata,\n        hideProgress: boolean = false,\n        noLogging: boolean = false,\n        allowUpgradeInFlight: boolean = false,\n        noResponseBody: boolean = false,\n    ) {\n        this.httpMethod = httpMethod;\n        this.path = path;\n        this.methodName = methodName;\n        this.controllerClassName = controllerClassName;\n        this.authMeta = authMeta;\n        this.apiName = apiName;\n        this.formPost = formPost;\n        this.mask = mask;\n        this.rawBody = rawBody;\n        this.parameterBindings = parameterBindings;\n        this.bodyParameterIndex = bodyParameterIndex;\n        this.responseType = responseType;\n        this.streaming = streaming;\n        this.hideProgress = hideProgress;\n        this.noLogging = noLogging;\n        this.allowUpgradeInFlight = allowUpgradeInFlight;\n        this.noResponseBody = noResponseBody;\n    }\n}\n"]}
+{"version":3,"file":"RouteMetadata.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/RouteMetadata.ts"],"names":[],"mappings":";;;AACA,2CAAuC;AAIvC,iDAA8C;AAG9C;;;;;;;;GAQG;AACH,MAAa,aAAa;IA2HT;IAQA;IAEA;IAEA;IAEA;IAxIb,QAAQ,CAAY;IACpB,oHAAoH;IACpH,aAAa,CAA+D;IAC5E,SAAS,GAAG,KAAK,CAAC;IAClB;;;OAGG;IACH,gBAAgB,GAAG,KAAK,CAAC;IACzB,qGAAqG;IACrG,mBAAmB,GAA6B,EAAE,CAAC;IAEnD,gGAAgG;IAChG,gBAAgB,CAAC,MAAsC;QACnD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;QAClH,KAAK,CAAC,QAAQ,GAAG,IAAI,oBAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3G,OAAO,KAAK,CAAC;IACjB,CAAC;IACD;;;;OAIG;IACH,QAAQ,GAAa,mBAAQ,CAAC,UAAU,CAAC;IAEzC;;;;OAIG;IACH,YAAY,CAAC,IAAc;QACvB,IAAI,IAAI,KAAK,mBAAQ,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC;QAC9C,MAAM,KAAK,GAAG,IAAI,aAAa,CAC3B,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,mBAAmB,EACxB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,OAAO,EACZ,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,SAAS,EACd,IAAI,EACJ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,oBAAoB,EACzB,IAAI,CAAC,cAAc,CACtB,CAAC;QACF,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACzC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC/C,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAC;QACrD,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;QACtB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,UAAU,CAAS;IACnB,IAAI,CAAS;IACb,UAAU,CAAS;IACnB,mBAAmB,CAAU;IAC7B,QAAQ,CAAY;IACpB,wFAAwF;IACxF,OAAO,CAAU;IACjB;;;;OAIG;IACM,QAAQ,CAAU;IAC3B;;;;OAIG;IACM,IAAI,CAAY;IACzB;;;;;OAKG;IACM,OAAO,CAAU;IAC1B;;;;;;OAMG;IACM,YAAY,CAAU;IAC/B;;;;;OAKG;IACM,SAAS,CAAU;IAC5B;;;;;OAKG;IACM,oBAAoB,CAAU;IACvC;;;;;OAKG;IACM,cAAc,CAAU;IAEjC,YACI,UAAkB,EAClB,IAAY,EACZ,UAAkB;IAClB,iFAAiF;IACxE,SAA4B,EACrC,mBAA4B,EAC5B,QAAmB,EACnB,OAAgB,EAChB,WAAoB,KAAK,EACzB,IAAe,EACf,UAAmB,KAAK;IACxB,8DAA8D;IACrD,oBAAqD,EAAE;IAChE,8EAA8E;IACrE,kBAA2B;IACpC,yFAAyF;IAChF,eAAqC,MAAM;IACpD,+EAA+E;IACtE,SAAqC,EAC9C,eAAwB,KAAK,EAC7B,YAAqB,KAAK,EAC1B,uBAAgC,KAAK,EACrC,iBAA0B,KAAK;QAlBtB,cAAS,GAAT,SAAS,CAAmB;QAQ5B,sBAAiB,GAAjB,iBAAiB,CAAsC;QAEvD,uBAAkB,GAAlB,kBAAkB,CAAS;QAE3B,iBAAY,GAAZ,YAAY,CAA+B;QAE3C,cAAS,GAAT,SAAS,CAA4B;QAM9C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAC/C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;QACjD,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;IACzC,CAAC;CACJ;AAjKD,sCAiKC","sourcesContent":["import { MaskSpec } from './LogFieldMask';\nimport { AuthMeta } from './auth-mode';\nimport { EndpointResponseType, HttpParameterBinding } from './HttpContract';\nimport { StreamingEndpointMetadata } from './StreamingContract';\nimport { EndpointOperation } from './HttpEndpointOptions';\nimport { CallMode } from '../errors/CallMode';\nimport { AnyContextKey } from '../ContextKey';\n\n/**\n * Route metadata stored per-method at runtime.\n * Used internally by http-routing and http-client as the runtime representation\n * of a route. Constructed from @ApiPath + @Endpoint metadata by ProxyClient\n * and ApiRoutingFactory.\n *\n * Lives in its own file (one class per file) purely for file size, exactly as `api-kind.ts` and\n * `external-caller.ts` were split off `decorators.ts` before it. Nothing about its role changed.\n */\nexport class RouteMetadata {\n    apiClass?: Function;\n    // webpieces-disable no-any-unknown -- erased application policy is validated by AuthorizationHook at server startup\n    authorization?: import('./authorization').AuthorizationRequirement<unknown>;\n    localOnly = false;\n    /**\n     * True when the contract is `EXTERNAL_OUTBOUND`: an outside system's API. Its client sends ONLY\n     * {@link externalContextKeys} and believes no response header (`DestinationTrust.forRoute`).\n     */\n    externalOutbound = false;\n    /** `@ExternalContextKeys(...)` resolved for this method — class-level keys plus the method's own. */\n    externalContextKeys: readonly AnyContextKey[] = [];\n\n    /** Clients clone metadata per call so a concrete winning mode governs both trust directions. */\n    withSelectedAuth(method: import('./auth-mode').AuthMode): RouteMetadata {\n        if (!this.authMeta?.methods.includes(method)) throw new Error('Selected credential is not declared by this endpoint.');\n        const route = Object.assign(new RouteMetadata(this.httpMethod, this.path, this.methodName, this.operation), this);\n        route.authMeta = new AuthMeta([method], method.kind === 'public' ? this.authMeta.publicReason : undefined);\n        return route;\n    }\n    /**\n     * Whether the user is waiting on THIS call (#1293). Not an endpoint declaration: a client stamps\n     * it per call with {@link withCallMode}, from the `ClientConfig` it was built with. FOREGROUND on\n     * every route a contract's decorators build.\n     */\n    callMode: CallMode = CallMode.FOREGROUND;\n\n    /**\n     * A per-call copy carrying `mode`. A BACKGROUND call also gets {@link hideProgress} — nobody is\n     * waiting on it — so an app's `RequestLifecycleListener` keeps it out of the progress bar with\n     * no endpoint declaration. FOREGROUND returns this route unchanged.\n     */\n    withCallMode(mode: CallMode): RouteMetadata {\n        if (mode === CallMode.FOREGROUND) return this;\n        const route = new RouteMetadata(\n            this.httpMethod,\n            this.path,\n            this.methodName,\n            this.operation,\n            this.controllerClassName,\n            this.authMeta,\n            this.apiName,\n            this.formPost,\n            this.mask,\n            this.rawBody,\n            this.parameterBindings,\n            this.bodyParameterIndex,\n            this.responseType,\n            this.streaming,\n            true,\n            this.noLogging,\n            this.allowUpgradeInFlight,\n            this.noResponseBody,\n        );\n        route.apiClass = this.apiClass;\n        route.authorization = this.authorization;\n        route.localOnly = this.localOnly;\n        route.externalOutbound = this.externalOutbound;\n        route.externalContextKeys = this.externalContextKeys;\n        route.callMode = mode;\n        return route;\n    }\n    httpMethod: string;\n    path: string;\n    methodName: string;\n    controllerClassName?: string;\n    authMeta?: AuthMeta;\n    /** The API contract class name (e.g. 'SaveApi') — distinct from the controller name. */\n    apiName?: string;\n    /**\n     * True when @Endpoint(..., { formPost: true }): the body is application/x-www-form-urlencoded\n     * (flat key→value), not JSON. Rides the route metadata so the per-route body parse can branch\n     * without knowing the apiClass/methodName. Default false = JSON.\n     */\n    readonly formPost: boolean;\n    /**\n     * The @MaskLog field-mask spec for this route, or undefined when the method declared none. Read\n     * ONCE here at route-build time and handed to {@link LogApiCallImpl} via ApiMethodInfo, so the per-call\n     * log path pays for masking only on routes that opted in (the rest stay on plain JSON.stringify).\n     */\n    readonly mask?: MaskSpec;\n    /**\n     * True when @Endpoint(..., { rawBody: true }): the transport must retain the verbatim bytes +\n     * absolute url for `VendorAuthHook.verify` to check a vendor credential over. Rides the route\n     * metadata for the same reason {@link formPost} does — the transport adapter decides how to read\n     * the body from the ROUTE, without knowing the apiClass/methodName.\n     */\n    readonly rawBody: boolean;\n    /**\n     * True when @Endpoint(..., { hideProgress: true }): the app should show no progress UI for this\n     * call. webpieces does not act on it; an app's `RequestLifecycleListener.onRequestStart/onRequestEnd`\n     * reads it from the ROUTE, for the same reason {@link formPost} and {@link rawBody} ride here —\n     * the consumer branches without knowing the apiClass/methodName. Default false = the call drives\n     * the progress UI.\n     */\n    readonly hideProgress: boolean;\n    /**\n     * True when @Endpoint(..., { noLogging: true }): read by {@link LogApiCallImpl} (via\n     * ApiMethodInfo, exactly as {@link mask} is) so no `[API-*-req]`/`[API-*-resp-*]` line is\n     * emitted for the call, on the client or the server. Default false = an ordinary, fully-logged\n     * route.\n     */\n    readonly noLogging: boolean;\n    /**\n     * True when @Endpoint(..., { allowUpgradeInFlight: true }): an app may upgrade while this call is\n     * in flight, and the call neither blocks nor arms an upgrade. webpieces only carries it; the\n     * app's `RequestLifecycleListener` / upgrade logic reads it. Default false = the app must not\n     * upgrade while the call is in flight, and its success counts toward arming one.\n     */\n    readonly allowUpgradeInFlight: boolean;\n    /**\n     * True when the endpoint is CLOUDTASKS or CRON (no response body BY KIND, #1348), or declares\n     * @Endpoint(..., { responseBody: NONE }): the method returns `Promise<void>` and the\n     * success response is 0 bytes. The server answers 204 with no body; every client accepts `{}`,\n     * an empty 200 or a 204 and resolves `undefined`. Default false = a JSON body.\n     */\n    readonly noResponseBody: boolean;\n\n    constructor(\n        httpMethod: string,\n        path: string,\n        methodName: string,\n        /** Explicit side-effect semantics; deliberately independent of the HTTP verb. */\n        readonly operation: EndpointOperation,\n        controllerClassName?: string,\n        authMeta?: AuthMeta,\n        apiName?: string,\n        formPost: boolean = false,\n        mask?: MaskSpec,\n        rawBody: boolean = false,\n        /** Explicit path/query mappings, in API declaration order. */\n        readonly parameterBindings: readonly HttpParameterBinding[] = [],\n        /** The sole unannotated POST parameter, or undefined for a bodyless route. */\n        readonly bodyParameterIndex?: number,\n        /** Whether clients receive only the body or the complete status/header/body response. */\n        readonly responseType: EndpointResponseType = 'body',\n        /** Present only for `(ResponseStream) => Promise<RequestStream>` contracts. */\n        readonly streaming?: StreamingEndpointMetadata,\n        hideProgress: boolean = false,\n        noLogging: boolean = false,\n        allowUpgradeInFlight: boolean = false,\n        noResponseBody: boolean = false,\n    ) {\n        this.httpMethod = httpMethod;\n        this.path = path;\n        this.methodName = methodName;\n        this.controllerClassName = controllerClassName;\n        this.authMeta = authMeta;\n        this.apiName = apiName;\n        this.formPost = formPost;\n        this.mask = mask;\n        this.rawBody = rawBody;\n        this.parameterBindings = parameterBindings;\n        this.bodyParameterIndex = bodyParameterIndex;\n        this.responseType = responseType;\n        this.streaming = streaming;\n        this.hideProgress = hideProgress;\n        this.noLogging = noLogging;\n        this.allowUpgradeInFlight = allowUpgradeInFlight;\n        this.noResponseBody = noResponseBody;\n    }\n}\n"]}

package/src/http/RouteMetadataFactory.d.ts

@@ -57,7 +57,14 @@ export declare class RouteMetadataFactory {
      */
     private static validateQueryDeclarations;
     /**
-     * `responseBody: NONE` means the success response is 0 bytes, so it cannot combine with a
+     * Whether the success response is 0 bytes (server 204, every client resolves `undefined`).
+     *
+     * A CLOUDTASKS or CRON endpoint is fire-and-forget BY KIND — Cloud Tasks and the scheduler read
+     * nothing but the status — so the kind implies it (#1348), and an explicit `responseBody: NONE`
+     * there is a second spelling of a decision the kind already made, so it is refused. On an
+     * EXTERNAL_OUTBOUND endpoint the VENDOR shapes the response, so NONE (what OUR server sends) is
+     * refused there too and the client accepts any 2xx. On RPC / EXTERNAL_INBOUND
+     * `responseBody: NONE` declares it. Either way the 0-byte response cannot combine with a
      * caller-owned full response or a streaming endpoint (both of which DEFINE a response).
      */
     private static noResponseBody;

package/src/http/RouteMetadataFactory.js

@@ -36,7 +36,7 @@ class RouteMetadataFactory {
             ? this.validateStreamingParameters(apiClass, methodName, httpMethod, parameterTypes, declarations, streaming)
             : this.validateParameters(apiClass, methodName, fullPath, httpMethod, parameterTypes, declarations);
         const bindings = this.bindingsOf(declarations, parameterTypes);
-        const route = new RouteMetadata_1.RouteMetadata(httpMethod, fullPath, methodName, operation, controllerClassName, (0, decorators_1.getAuthMeta)(apiClass, methodName), apiClass.name || 'UnknownApi', options.formPost === true, (0, decorators_1.getMaskSpec)(apiClass, methodName), options.rawBody === true, bindings, bodyParameterIndex, this.responseType(options.responseType, apiClass, methodName), streaming, options.hideProgress === true, options.noLogging === true, options.allowUpgradeInFlight === true, this.noResponseBody(options, streaming, apiClass, methodName));
+        const route = new RouteMetadata_1.RouteMetadata(httpMethod, fullPath, methodName, operation, controllerClassName, (0, decorators_1.getAuthMeta)(apiClass, methodName), apiClass.name || 'UnknownApi', options.formPost === true, (0, decorators_1.getMaskSpec)(apiClass, methodName), options.rawBody === true, bindings, bodyParameterIndex, this.responseType(options.responseType, apiClass, methodName), streaming, options.hideProgress === true, options.noLogging === true, options.allowUpgradeInFlight === true, this.noResponseBody(options, streaming, apiClass, methodName, (0, decorators_1.getEndpointKind)(apiClass, methodName)));
         route.authorization = (0, authorization_1.getAuthorization)(apiClass, methodName);
         route.apiClass = apiClass;
         route.localOnly = (0, decorators_2.isLocalOnly)(apiClass, methodName);
@@ -203,19 +203,40 @@ class RouteMetadataFactory {
         }
     }
     /**
-     * `responseBody: NONE` means the success response is 0 bytes, so it cannot combine with a
+     * Whether the success response is 0 bytes (server 204, every client resolves `undefined`).
+     *
+     * A CLOUDTASKS or CRON endpoint is fire-and-forget BY KIND — Cloud Tasks and the scheduler read
+     * nothing but the status — so the kind implies it (#1348), and an explicit `responseBody: NONE`
+     * there is a second spelling of a decision the kind already made, so it is refused. On an
+     * EXTERNAL_OUTBOUND endpoint the VENDOR shapes the response, so NONE (what OUR server sends) is
+     * refused there too and the client accepts any 2xx. On RPC / EXTERNAL_INBOUND
+     * `responseBody: NONE` declares it. Either way the 0-byte response cannot combine with a
      * caller-owned full response or a streaming endpoint (both of which DEFINE a response).
      */
     // webpieces-disable no-function-outside-class -- private pure helper for the static metadata factory
-    static noResponseBody(options, streaming, apiClass, methodName) {
-        if (options.responseBody === undefined)
-            return false;
+    static noResponseBody(options, streaming, apiClass, methodName, kind) {
         const label = `${apiClass.name || 'Unknown'}.${methodName}`;
-        if (options.responseBody !== HttpEndpointOptions_1.NONE) {
+        if (kind === decorators_2.EXTERNAL_OUTBOUND && options.responseBody !== undefined) {
+            throw new Error(`${label} is an EXTERNAL_OUTBOUND endpoint and declares responseBody: NONE, which does not apply: ` +
+                `NONE describes what OUR server sends, and the vendor shapes an outbound response. The outbound ` +
+                `client accepts any 2xx (204 or empty -> undefined, JSON -> parsed). Delete responseBody: NONE.`);
+        }
+        const impliedByKind = kind === decorators_2.CLOUDTASKS || kind === decorators_2.CRON;
+        if (impliedByKind && options.responseBody !== undefined) {
+            throw new Error(`${label} is a ${kind.toUpperCase()} endpoint and declares responseBody: NONE, which is redundant: ` +
+                `a ${kind.toUpperCase()} endpoint is fire-and-forget, so its kind already means no response body ` +
+                `(204, 0 bytes). Delete responseBody: NONE from its @Endpoint options.`);
+        }
+        if (!impliedByKind && options.responseBody === undefined)
+            return false;
+        if (!impliedByKind && options.responseBody !== HttpEndpointOptions_1.NONE) {
             throw new Error(`${label} declares unsupported responseBody '${String(options.responseBody)}'; the only value is NONE.`);
         }
         if (options.responseType === 'full' || streaming !== undefined) {
-            throw new Error(`${label} declares responseBody: NONE together with ${streaming ? 'a stream' : "responseType: 'full'"}; ` +
+            const why = impliedByKind
+                ? `is a ${kind.toUpperCase()} endpoint (no response body by kind)`
+                : 'declares responseBody: NONE';
+            throw new Error(`${label} ${why} together with ${streaming ? 'a stream' : "responseType: 'full'"}; ` +
                 'a 0-byte response cannot also carry a caller-owned or streamed response.');
         }
         return true;

package/src/http/RouteMetadataFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"RouteMetadataFactory.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/RouteMetadataFactory.ts"],"names":[],"mappings":";;;AAAA,6CASsB;AACtB,2EAA2E;AAC3E,iDAQwB;AACxB,mDAAgD;AAChD,+CAA4C;AAC5C,+DAA8D;AAC9D,2DAA2D;AAC3D,mDAAmD;AACnD,6CAKsB;AACtB,+DAA4F;AAC5F,2DAAiF;AAEjF;;;;GAIG;AACH,MAAa,oBAAoB;IAC7B,wIAAwI;IACxI,MAAM,CAAC,MAAM,CACT,QAAkB,EAClB,UAAkB,EAClB,mBAA4B;QAE5B,IAAA,2CAA8B,EAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAA,uBAAU,EAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACpG,MAAM,OAAO,GAAG,IAAA,+BAAkB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAA,wCAAoB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAA,kCAAqB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAA,iCAAoB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAClG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,IAAA,wDAA4B,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QACrG,MAAM,kBAAkB,GAAG,SAAS;YAChC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAC5B,QAAQ,EACR,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,SAAS,CACZ;YACH,CAAC,CAAC,IAAI,CAAC,kBAAkB,CACnB,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,UAAU,EACV,cAAc,EACd,YAAY,CACf,CAAC;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,6BAAa,CAC3B,UAAU,EACV,QAAQ,EACR,UAAU,EACV,SAAS,EACT,mBAAmB,EACnB,IAAA,wBAAW,EAAC,QAAQ,EAAE,UAAU,CAAC,EACjC,QAAQ,CAAC,IAAI,IAAI,YAAY,EAC7B,OAAO,CAAC,QAAQ,KAAK,IAAI,EACzB,IAAA,wBAAW,EAAC,QAAQ,EAAE,UAAU,CAAC,EACjC,OAAO,CAAC,OAAO,KAAK,IAAI,EACxB,QAAQ,EACR,kBAAkB,EAClB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,EAC7D,SAAS,EACT,OAAO,CAAC,YAAY,KAAK,IAAI,EAC7B,OAAO,CAAC,SAAS,KAAK,IAAI,EAC1B,OAAO,CAAC,oBAAoB,KAAK,IAAI,EACrC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAChE,CAAC;QACF,KAAK,CAAC,aAAa,GAAG,IAAA,gCAAgB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7D,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,KAAK,CAAC,SAAS,GAAG,IAAA,wBAAW,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpD,KAAK,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QAC1C,KAAK,CAAC,mBAAmB,GAAG,IAAA,4CAAsB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,0FAA0F;IAC1F,4GAA4G;IACpG,MAAM,CAAC,UAAU,CACrB,YAAiD,EACjD,cAAmC;QAEnC,OAAO,YAAY;aACd,GAAG,CACA,CAAC,WAAqC,EAAE,EAAE,CACtC,IAAI,mCAAoB,CACpB,WAAW,CAAC,KAAK,EACjB,WAAW,CAAC,MAAM,EAClB,WAAW,CAAC,QAAQ,EACpB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EACjD,WAAW,CAAC,QAAQ,CACvB,CACR;aACA,IAAI,CAAC,CAAC,CAAuB,EAAE,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC;IAED,4GAA4G;IACpG,MAAM,CAAC,YAAY,CAAC,QAAkB,EAAE,UAAkB;QAC9D,MAAM,IAAI,GAAG,CAAC,IAAA,yBAAY,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,GAAG,CAAC,CAAC;IAC9F,CAAC;IAED,4IAA4I;IACpI,MAAM,CAAC,uBAAuB,CAClC,QAAkB,EAClB,UAAkB,EAClB,UAAsB,EACtB,QAAkB,EAClB,OAAiB;QAEjB,IAAI,IAAA,8BAAe,EAAC,UAAU,CAAC;YAAE,OAAO;QACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,CAAC,IAAI,IAAI,UAAU,OAAO,UAAU,6CAA6C,UAAU,uBAAuB,CAChI,CAAC;QACN,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,CAAC,IAAI,IAAI,UAAU,OAAO,UAAU,4CAA4C,UAAU,uBAAuB,CAC/H,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,wGAAwG;IAChG,MAAM,CAAC,mBAAmB,CAAC,QAAkB,EAAE,UAAkB,EAAE,UAAsB;QAC7F,MAAM,IAAI,GAAG,IAAA,4BAAe,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,UAAU,KAAK,mBAAI,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,SAAS,IAAI,CAAC,WAAW,EAAE,sBAAsB,UAAU,IAAI;gBACtG,gFAAgF,CACvF,CAAC;QACN,CAAC;IACL,CAAC;IAED,+GAA+G;IACvG,MAAM,CAAC,2BAA2B,CACtC,QAAkB,EAClB,UAAkB,EAClB,UAAsB,EACtB,cAAmC,EACnC,YAAiD,EACjD,SAAoC;QAEpC,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5D,IACI,CAAC,SAAS,CAAC,oBAAoB;YAC/B,CAAC,SAAS,CAAC,qBAAqB;YAChC,CAAC,SAAS,CAAC,SAAS,KAAK,mCAAe,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;YAC9E,CAAC,SAAS,CAAC,SAAS,KAAK,mCAAe,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAChF,CAAC;YACC,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,sFAAsF,QAAQ,CAAC,IAAI,4BAA4B,CAC1I,CAAC;QACN,CAAC;QACD,IAAI,UAAU,KAAK,mBAAI;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;QACrF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yDAAyD,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,KAAK,mCAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,cAAc,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,GACN,SAAS,CAAC,SAAS,KAAK,mCAAe,CAAC,OAAO;gBAC3C,CAAC,CAAC,2EAA2E;gBAC7E,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,mCAAe,CAAC,QAAQ;oBAChD,CAAC,CAAC,6EAA6E;oBAC/E,CAAC,CAAC,0GAA0G,CAAC;YACvH,MAAM,IAAI,KAAK,CACX,qCAAqC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,YAAY,KAAK,IAAI;gBACvF,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,oBAAoB,IAAI,GAAG,CACtE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,iIAAiI;IACjI,MAAM,CAAC,uBAAuB,CAAC,QAAkB;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,IAAA,yBAAY,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAChD,6EAA6E;YAC7E,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,IAAI,QAAQ,QAAQ,KAAK,IAAI,UAAU,mBAAmB;oBAC9D,GAAG,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,gDAAgD;oBAClF,mFAAmF,CAC1F,CAAC;YACN,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC9B,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,qGAAqG;IAC7F,MAAM,CAAC,QAAQ,CAAC,QAAgB,EAAE,YAAoB;QAC1D,IAAI,QAAQ,KAAK,EAAE,IAAI,YAAY,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;IAC1D,CAAC;IAED,qGAAqG;IAC7F,MAAM,CAAC,YAAY,CACvB,KAAuC,EACvC,QAAkB,EAClB,UAAkB;QAElB,MAAM,YAAY,GAAG,KAAK,IAAI,MAAM,CAAC;QACrC,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,MAAM;YAAE,OAAO,YAAY,CAAC;QAC5E,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,CAAC,IAAI,IAAI,UAAU,uCAAuC,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAClH,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,wGAAwG;IAChG,MAAM,CAAC,gBAAgB,CAAC,QAAkB;QAC9C,IAAA,wCAA2B,EAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,gBAAgB,GAAG,IAAA,kCAAqB,EAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,gBAAgB,IAAI,IAAA,iDAA2B,EAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,2EAA2E;gBACpG,gGAAgG;gBAChG,gCAAgC,CACvC,CAAC;QACN,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,wGAAwG;IAChG,MAAM,CAAC,yBAAyB,CACpC,QAAkB,EAClB,UAAkB,EAClB,gBAAyB,EACzB,cAAmC,EACnC,YAAiD;QAEjD,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,0FAA0F;oBAC9F,6FAA6F,CACpG,CAAC;YACN,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,yBAAW,EAAE,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,aAAa,WAAW,CAAC,KAAK,mDAAmD,CAAC,CAAC;YAC/G,CAAC;YACD,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,iBAAiB,WAAW,CAAC,QAAQ,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,wBAAwB;oBAChG,gBAAgB,WAAW,CAAC,KAAK,iBAAiB,CACzD,CAAC;YACN,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,qGAAqG;IAC7F,MAAM,CAAC,cAAc,CACzB,OAAwB,EACxB,SAAgD,EAChD,QAAkB,EAClB,UAAkB;QAElB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACrD,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5D,IAAI,OAAO,CAAC,YAAY,KAAK,0BAAI,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,uCAAuC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,4BAA4B,CAC1G,CAAC;QACN,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,8CAA8C,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sBAAsB,IAAI;gBACrG,0EAA0E,CACjF,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,sGAAsG;IAC9F,MAAM,CAAC,cAAc,CAAC,QAAkB,EAAE,UAAkB;QAChE,OAAO,OAAO,CAAC,WAAW,CAAC,mBAAmB,EAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IAC1F,CAAC;IAED,kGAAkG;IAC1F,MAAM,CAAC,kBAAkB,CAC7B,QAAkB,EAClB,UAAkB,EAClB,QAAgB,EAChB,UAAsB,EACtB,cAAmC,EACnC,YAAiD;QAEjD,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5D,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CACxC,CAAC;QACF,MAAM,SAAS,GAAG,YAAY;aACzB,MAAM,CAAC,CAAC,WAAqC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC;aAChF,GAAG,CAAC,CAAC,WAAqC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1E,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,UAAU,QAAQ,eAAe,WAAW,wBAAwB,WAAW,eAAe,CACzG,CAAC;YACN,CAAC;QACL,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,yBAAyB,QAAQ,WAAW,QAAQ,aAAa,QAAQ,gBAAgB,CACpG,CAAC;YACN,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,GAAG,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YAChE,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU,OAAO,mBAAmB,CAAC,CAAC;YAClE,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC1B,cAAc,CAAC,MAAM,EACrB,YAAY,CAAC,MAAM,CACf,CAAC,OAAe,EAAE,WAAqC,EAAE,EAAE,CACvD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,GAAG,CAAC,CAAC,EAC5C,CAAC,CACJ,CACJ,CAAC;QACF,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAA,8BAAe,EAAC,UAAU,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,OAAO,UAAU,+EAA+E,OAAO,CAAC,CAAC,CAAC,eAAe,CACpI,CAAC;QACN,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,QAAQ,OAAO,CAAC,MAAM,yBAAyB,UAAU,sFAAsF,CAC1J,CAAC;QACN,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,4GAA4G;IACpG,MAAM,CAAC,SAAS,CAAC,IAA0B;QAC/C,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC;QACrC,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC;QACrC,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACvC,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,OAAO,CAAC;QACnC,OAAO,SAAS,CAAC;IACrB,CAAC;CACJ;AAxYD,oDAwYC","sourcesContent":["import {\n    getApiPath,\n    getAuthMeta,\n    getEndpointHttpMethod,\n    getEndpointKind,\n    getEndpointOperation,\n    getEndpointOptions,\n    getEndpoints,\n    getMaskSpec,\n} from './decorators';\nimport { getHttpParameterDeclarations } from './http-parameter-decorators';\nimport {\n    EndpointResponseType,\n    HttpParameterBinding,\n    HttpParameterDeclaration,\n    HttpParameterValueType,\n    HttpMethod,\n    POST,\n    verbCarriesBody,\n} from './HttpContract';\nimport { RouteMetadata } from './RouteMetadata';\nimport { QueryParams } from './QueryParams';\nimport { EndpointOptions, NONE } from './HttpEndpointOptions';\nimport { getStreamingEndpoint } from './StreamingContract';\nimport { getAuthorization } from './authorization';\nimport {\n    assertEveryEndpointHasAuthMode,\n    assertExternalEndpointKinds,\n    isExternalOutboundApi,\n    isLocalOnly,\n} from './decorators';\nimport { declaresExternalContextKeys, getExternalContextKeys } from './ExternalContextKeys';\nimport { StreamDirection, StreamingEndpointMetadata } from './StreamingContract';\n\n/**\n * Build the one runtime route model consumed by incoming routing, in-process clients, and both\n * generated HTTP clients. Keeping this join/validation here prevents four subtly different\n * interpretations of the same decorators.\n */\nexport class RouteMetadataFactory {\n    // webpieces-disable no-function-outside-class -- deterministic decorator metadata factory shared by DI-free browser and server runtimes\n    static create(\n        apiClass: Function,\n        methodName: string,\n        controllerClassName?: string,\n    ): RouteMetadata {\n        assertEveryEndpointHasAuthMode(apiClass);\n        const externalOutbound = this.externalOutbound(apiClass);\n        const fullPath = this.joinPath(getApiPath(apiClass) ?? '', this.endpointPath(apiClass, methodName));\n        const options = getEndpointOptions(apiClass, methodName);\n        const streaming = getStreamingEndpoint(apiClass, methodName);\n        const httpMethod = getEndpointHttpMethod(apiClass, methodName);\n        const operation = getEndpointOperation(apiClass, methodName);\n        this.validateEndpointOptions(apiClass, methodName, httpMethod, options.formPost, options.rawBody);\n        this.validateTriggerVerb(apiClass, methodName, httpMethod);\n        const parameterTypes = this.parameterTypes(apiClass, methodName);\n        const declarations = getHttpParameterDeclarations(apiClass, methodName);\n        this.validateQueryDeclarations(apiClass, methodName, externalOutbound, parameterTypes, declarations);\n        const bodyParameterIndex = streaming\n            ? this.validateStreamingParameters(\n                  apiClass,\n                  methodName,\n                  httpMethod,\n                  parameterTypes,\n                  declarations,\n                  streaming,\n              )\n            : this.validateParameters(\n                  apiClass,\n                  methodName,\n                  fullPath,\n                  httpMethod,\n                  parameterTypes,\n                  declarations,\n              );\n        const bindings = this.bindingsOf(declarations, parameterTypes);\n        const route = new RouteMetadata(\n            httpMethod,\n            fullPath,\n            methodName,\n            operation,\n            controllerClassName,\n            getAuthMeta(apiClass, methodName),\n            apiClass.name || 'UnknownApi',\n            options.formPost === true,\n            getMaskSpec(apiClass, methodName),\n            options.rawBody === true,\n            bindings,\n            bodyParameterIndex,\n            this.responseType(options.responseType, apiClass, methodName),\n            streaming,\n            options.hideProgress === true,\n            options.noLogging === true,\n            options.allowUpgradeInFlight === true,\n            this.noResponseBody(options, streaming, apiClass, methodName),\n        );\n        route.authorization = getAuthorization(apiClass, methodName);\n        route.apiClass = apiClass;\n        route.localOnly = isLocalOnly(apiClass, methodName);\n        route.externalOutbound = externalOutbound;\n        route.externalContextKeys = getExternalContextKeys(apiClass, methodName);\n        return route;\n    }\n    /** Each declaration resolved against its argument's reflected type, in argument order. */\n    // webpieces-disable no-function-outside-class -- private pure helper for static route metadata construction\n    private static bindingsOf(\n        declarations: readonly HttpParameterDeclaration[],\n        parameterTypes: readonly Function[],\n    ): HttpParameterBinding[] {\n        return declarations\n            .map(\n                (declaration: HttpParameterDeclaration) =>\n                    new HttpParameterBinding(\n                        declaration.index,\n                        declaration.source,\n                        declaration.wireName,\n                        this.valueType(parameterTypes[declaration.index]),\n                        declaration.itemType,\n                    ),\n            )\n            .sort((a: HttpParameterBinding, b: HttpParameterBinding) => a.index - b.index);\n    }\n\n    // webpieces-disable no-function-outside-class -- private pure helper for static route metadata construction\n    private static endpointPath(apiClass: Function, methodName: string): string {\n        const path = (getEndpoints(apiClass) ?? {})[methodName];\n        if (path !== undefined) return path;\n        throw new Error(`No @Endpoint metadata for ${apiClass.name || 'Unknown'}.${methodName}.`);\n    }\n\n    // webpieces-disable no-function-outside-class -- private pure helper keeps the existing static metadata factory below the method-size limit\n    private static validateEndpointOptions(\n        apiClass: Function,\n        methodName: string,\n        httpMethod: HttpMethod,\n        formPost?: boolean,\n        rawBody?: boolean,\n    ): void {\n        if (verbCarriesBody(httpMethod)) return;\n        if (formPost === true) {\n            throw new Error(\n                `${apiClass.name}.${methodName} is ${httpMethod} and cannot declare formPost:true because ${httpMethod} has no request body.`,\n            );\n        }\n        if (rawBody === true) {\n            throw new Error(\n                `${apiClass.name}.${methodName} is ${httpMethod} and cannot declare rawBody:true because ${httpMethod} has no request body.`,\n            );\n        }\n    }\n\n    /**\n     * A CLOUDTASKS or CRON endpoint must be POST: Cloud Tasks, Cloud Scheduler and the in-memory task\n     * invoker all deliver with POST, so any other verb would register a route nothing ever reaches\n     * (a 404 at delivery time, not at startup).\n     */\n    // webpieces-disable no-function-outside-class -- private pure validator for the static metadata factory\n    private static validateTriggerVerb(apiClass: Function, methodName: string, httpMethod: HttpMethod): void {\n        const kind = getEndpointKind(apiClass, methodName);\n        if ((kind === 'cloudtasks' || kind === 'cron') && httpMethod !== POST) {\n            throw new Error(\n                `${apiClass.name || 'Unknown'}.${methodName} is a ${kind.toUpperCase()} endpoint declared ${httpMethod}; ` +\n                    `task and scheduler delivery always uses POST, so declare @Endpoint(POST, ...).`,\n            );\n        }\n    }\n\n    // webpieces-disable no-function-outside-class -- private pure validator alongside existing contract validators\n    private static validateStreamingParameters(\n        apiClass: Function,\n        methodName: string,\n        httpMethod: HttpMethod,\n        parameterTypes: readonly Function[],\n        declarations: readonly HttpParameterDeclaration[],\n        streaming: StreamingEndpointMetadata,\n    ): number | undefined {\n        const label = `${apiClass.name || 'Unknown'}.${methodName}`;\n        if (\n            !streaming.initialRequestSchema ||\n            !streaming.initialResponseSchema ||\n            (streaming.direction !== StreamDirection.RESPONSE && !streaming.requestSchema) ||\n            (streaming.direction !== StreamDirection.REQUEST && !streaming.responseSchema)\n        ) {\n            throw new Error(\n                `${label} requires generated streaming schemas. Run wp-openapi and registerStreamingCatalog(${apiClass.name}, catalog) before binding.`,\n            );\n        }\n        if (httpMethod !== POST) throw new Error(`${label} is streaming and must use POST.`);\n        if (declarations.length > 0)\n            throw new Error(`${label} is streaming and cannot declare path/query parameters.`);\n        const expected = streaming.direction === StreamDirection.REQUEST ? 1 : 2;\n        if (parameterTypes.length !== expected) {\n            const form =\n                streaming.direction === StreamDirection.REQUEST\n                    ? '(InitialRequest) => Promise<RequestStream<InitialResponse, RequestEvent>>'\n                    : streaming.direction === StreamDirection.RESPONSE\n                      ? '(InitialRequest, ResponseStream<ResponseEvent>) => Promise<InitialResponse>'\n                      : '(InitialRequest, ResponseStream<ResponseEvent>) => Promise<RequestStream<InitialResponse, RequestEvent>>';\n            throw new Error(\n                `Invalid @WpStream(StreamDirection.${streaming.direction.toUpperCase()}) method ${label}: ` +\n                    `${streaming.direction.toUpperCase()} accepts exactly ${form}.`,\n            );\n        }\n        return 0;\n    }\n\n    /**\n     * Refuse a contract in which two endpoints resolve to the same HTTP method + path.\n     *\n     * Empty paths are LEGAL (`@ApiPath('')` + `@Endpoint(POST, '', ...)` is how a contract says \"the whole\n     * destination arrives per call\"), so the thing actually worth rejecting is ambiguity: two methods\n     * that land on one route. On the server the second registration would silently shadow the first\n     * in the route map, and on the client both would dial the same URL — neither is ever what the\n     * author meant. Placeholder NAMES are ignored when comparing (`/a/{id}` and `/a/{key}` are the\n     * same route to a router), `''` and `'/'` compare equal (the server serves an empty path at the\n     * root), and the error names BOTH methods so the fix is obvious.\n     *\n     * Called by every transport that binds a whole contract (the generated clients and the server's\n     * route registration), so a duplicate dies at startup however the contract is consumed.\n     *\n     * @throws Error naming both colliding methods and the shared route.\n     */\n    // webpieces-disable no-function-outside-class -- deterministic contract validation shared by DI-free browser and server runtimes\n    static assertNoDuplicateRoutes(apiClass: Function): void {\n        const label = apiClass.name || 'Unknown';\n        const seen = new Map<string, string>();\n        for (const methodName of Object.keys(getEndpoints(apiClass) ?? {})) {\n            const route = this.create(apiClass, methodName);\n            // '' and '/' are one route to a server (every request path starts with '/').\n            const shape = (route.path === '' ? '/' : route.path).replace(/\\{[^{}]+\\}/g, '{}');\n            const key = `${route.httpMethod} ${shape}`;\n            const previous = seen.get(key);\n            if (previous !== undefined) {\n                throw new Error(\n                    `${label}.${previous} and ${label}.${methodName} both resolve to ` +\n                        `${route.httpMethod} '${route.path}'. Two endpoints of one contract cannot share ` +\n                        `an HTTP method + path; give one of them a distinct @Endpoint path or HTTP method.`,\n                );\n            }\n            seen.set(key, methodName);\n        }\n    }\n\n    /**\n     * Join `@ApiPath` and `@Endpoint` into the route path.\n     *\n     * Both empty joins to `''`, NOT `'/'`. A contract declaring `@ApiPath('')` + `@Endpoint(POST, '', ...)`\n     * is saying \"this route adds nothing to the base URL\", and a client whose base URL is a full\n     * destination (host + path + query) must send it byte for byte. Before #926 the client joined with\n     * plain concatenation (`'' + ''`), and forcing a `/` here broke exactly that (#944).\n     */\n    // webpieces-disable no-function-outside-class -- private pure helper for the static metadata factory\n    private static joinPath(basePath: string, endpointPath: string): string {\n        if (basePath === '' && endpointPath === '') return '';\n        const joined = `${basePath}/${endpointPath}`.replace(/\\/{2,}/g, '/');\n        return joined.startsWith('/') ? joined : `/${joined}`;\n    }\n\n    // webpieces-disable no-function-outside-class -- private pure helper for the static metadata factory\n    private static responseType(\n        value: EndpointResponseType | undefined,\n        apiClass: Function,\n        methodName: string,\n    ): EndpointResponseType {\n        const responseType = value ?? 'body';\n        if (responseType === 'body' || responseType === 'full') return responseType;\n        throw new Error(\n            `${apiClass.name}.${methodName} declares unsupported responseType '${String(responseType)}'; use body or full.`,\n        );\n    }\n\n    /**\n     * The EXTERNAL_* rules ({@link assertExternalEndpointKinds}), then whether the contract is an\n     * outside system's API. `@ExternalContextKeys` says which context an OUTSIDE system may see, so it\n     * is refused on a contract this repo serves, which already receives the platform context.\n     */\n    // webpieces-disable no-function-outside-class -- private pure validator for the static metadata factory\n    private static externalOutbound(apiClass: Function): boolean {\n        assertExternalEndpointKinds(apiClass);\n        const externalOutbound = isExternalOutboundApi(apiClass);\n        if (!externalOutbound && declaresExternalContextKeys(apiClass)) {\n            throw new Error(\n                `${apiClass.name || 'Unknown'} declares @ExternalContextKeys but is not an EXTERNAL_OUTBOUND contract. ` +\n                    'The list says which context an OUTSIDE system may see; a contract served in this repo already ' +\n                    'receives the platform context.',\n            );\n        }\n        return externalOutbound;\n    }\n\n    /**\n     * `@QueryString()` (a free-form {@link QueryParams}) is the query spelling of an EXTERNAL_OUTBOUND\n     * contract ONLY — our own contracts keep the typed `@QueryParam` — and its argument must BE a\n     * `QueryParams`. An item type (`@QueryParam('ids', Number)`) only means something on a list.\n     */\n    // webpieces-disable no-function-outside-class -- private pure validator for the static metadata factory\n    private static validateQueryDeclarations(\n        apiClass: Function,\n        methodName: string,\n        externalOutbound: boolean,\n        parameterTypes: readonly Function[],\n        declarations: readonly HttpParameterDeclaration[],\n    ): void {\n        const label = `${apiClass.name || 'Unknown'}.${methodName}`;\n        for (const declaration of declarations) {\n            const type = parameterTypes[declaration.index];\n            if (declaration.source === 'query-map' && !externalOutbound) {\n                throw new Error(\n                    `${label} declares @QueryString(), which only an EXTERNAL_OUTBOUND contract may use — a vendor's ` +\n                        `query string is free-form. A contract this repo serves names each key: @QueryParam('name').`,\n                );\n            }\n            if (declaration.source === 'query-map' && type !== undefined && type !== QueryParams) {\n                throw new Error(`${label} argument ${declaration.index} is @QueryString() and must be typed QueryParams.`);\n            }\n            if (declaration.itemType !== undefined && type !== undefined && type !== Array) {\n                throw new Error(\n                    `${label} @QueryParam('${declaration.wireName}', ${declaration.itemType.name}) names an item type, ` +\n                        `but argument ${declaration.index} is not a list.`,\n                );\n            }\n        }\n    }\n\n    /**\n     * `responseBody: NONE` means the success response is 0 bytes, so it cannot combine with a\n     * caller-owned full response or a streaming endpoint (both of which DEFINE a response).\n     */\n    // webpieces-disable no-function-outside-class -- private pure helper for the static metadata factory\n    private static noResponseBody(\n        options: EndpointOptions,\n        streaming: StreamingEndpointMetadata | undefined,\n        apiClass: Function,\n        methodName: string,\n    ): boolean {\n        if (options.responseBody === undefined) return false;\n        const label = `${apiClass.name || 'Unknown'}.${methodName}`;\n        if (options.responseBody !== NONE) {\n            throw new Error(\n                `${label} declares unsupported responseBody '${String(options.responseBody)}'; the only value is NONE.`,\n            );\n        }\n        if (options.responseType === 'full' || streaming !== undefined) {\n            throw new Error(\n                `${label} declares responseBody: NONE together with ${streaming ? 'a stream' : \"responseType: 'full'\"}; ` +\n                    'a 0-byte response cannot also carry a caller-owned or streamed response.',\n            );\n        }\n        return true;\n    }\n\n    // webpieces-disable no-function-outside-class -- Reflect metadata lookup has no injectable dependency\n    private static parameterTypes(apiClass: Function, methodName: string): Function[] {\n        return Reflect.getMetadata('design:paramtypes', apiClass.prototype, methodName) ?? [];\n    }\n\n    // webpieces-disable no-function-outside-class -- private deterministic contract validation helper\n    private static validateParameters(\n        apiClass: Function,\n        methodName: string,\n        fullPath: string,\n        httpMethod: HttpMethod,\n        parameterTypes: readonly Function[],\n        declarations: readonly HttpParameterDeclaration[],\n    ): number | undefined {\n        const label = `${apiClass.name || 'Unknown'}.${methodName}`;\n        const placeholders = [...fullPath.matchAll(/\\{([^{}]+)\\}/g)].map(\n            (match: RegExpMatchArray) => match[1],\n        );\n        const pathNames = declarations\n            .filter((declaration: HttpParameterDeclaration) => declaration.source === 'path')\n            .map((declaration: HttpParameterDeclaration) => declaration.wireName);\n        for (const placeholder of new Set(placeholders)) {\n            if (!pathNames.includes(placeholder)) {\n                throw new Error(\n                    `${label} path '${fullPath}' contains {${placeholder}} but no @PathParam('${placeholder}') parameter.`,\n                );\n            }\n        }\n        for (const pathName of pathNames) {\n            if (!placeholders.includes(pathName)) {\n                throw new Error(\n                    `${label} declares @PathParam('${pathName}') but '${fullPath}' has no {${pathName}} placeholder.`,\n                );\n            }\n        }\n\n        const seenWire = new Set<string>();\n        const mappedIndexes = new Set<number>();\n        for (const declaration of declarations) {\n            const wireKey = `${declaration.source}:${declaration.wireName}`;\n            if (seenWire.has(wireKey)) {\n                throw new Error(`${label} maps '${wireKey}' more than once.`);\n            }\n            seenWire.add(wireKey);\n            mappedIndexes.add(declaration.index);\n        }\n\n        const declaredCount = Math.max(\n            parameterTypes.length,\n            declarations.reduce(\n                (highest: number, declaration: HttpParameterDeclaration) =>\n                    Math.max(highest, declaration.index + 1),\n                0,\n            ),\n        );\n        const unbound: number[] = [];\n        for (let index = 0; index < declaredCount; index++) {\n            if (!mappedIndexes.has(index)) unbound.push(index);\n        }\n        if (!verbCarriesBody(httpMethod) && unbound.length > 0) {\n            throw new Error(\n                `${label} is ${httpMethod}, so every parameter must use @PathParam(...) or @QueryParam(...); argument ${unbound[0]} is unmapped.`,\n            );\n        }\n        if (unbound.length > 1) {\n            throw new Error(\n                `${label} has ${unbound.length} unmapped parameters. ${httpMethod} permits exactly one unannotated request body; map every other parameter explicitly.`,\n            );\n        }\n        return unbound[0];\n    }\n\n    // webpieces-disable no-function-outside-class -- private conversion of reflected constructors to wire types\n    private static valueType(type: Function | undefined): HttpParameterValueType {\n        if (type === String) return 'string';\n        if (type === Number) return 'number';\n        if (type === Boolean) return 'boolean';\n        if (type === Array) return 'array';\n        return 'unknown';\n    }\n}\n"]}
+{"version":3,"file":"RouteMetadataFactory.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/RouteMetadataFactory.ts"],"names":[],"mappings":";;;AAAA,6CASsB;AACtB,2EAA2E;AAC3E,iDAQwB;AACxB,mDAAgD;AAChD,+CAA4C;AAC5C,+DAA8D;AAC9D,2DAA2D;AAC3D,mDAAmD;AACnD,6CASsB;AACtB,+DAA4F;AAC5F,2DAAiF;AAEjF;;;;GAIG;AACH,MAAa,oBAAoB;IAC7B,wIAAwI;IACxI,MAAM,CAAC,MAAM,CACT,QAAkB,EAClB,UAAkB,EAClB,mBAA4B;QAE5B,IAAA,2CAA8B,EAAC,QAAQ,CAAC,CAAC;QACzC,MAAM,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAA,uBAAU,EAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACpG,MAAM,OAAO,GAAG,IAAA,+BAAkB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAA,wCAAoB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,IAAA,kCAAqB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC/D,MAAM,SAAS,GAAG,IAAA,iCAAoB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAClG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,IAAA,wDAA4B,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;QACrG,MAAM,kBAAkB,GAAG,SAAS;YAChC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAC5B,QAAQ,EACR,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,SAAS,CACZ;YACH,CAAC,CAAC,IAAI,CAAC,kBAAkB,CACnB,QAAQ,EACR,UAAU,EACV,QAAQ,EACR,UAAU,EACV,cAAc,EACd,YAAY,CACf,CAAC;QACR,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,6BAAa,CAC3B,UAAU,EACV,QAAQ,EACR,UAAU,EACV,SAAS,EACT,mBAAmB,EACnB,IAAA,wBAAW,EAAC,QAAQ,EAAE,UAAU,CAAC,EACjC,QAAQ,CAAC,IAAI,IAAI,YAAY,EAC7B,OAAO,CAAC,QAAQ,KAAK,IAAI,EACzB,IAAA,wBAAW,EAAC,QAAQ,EAAE,UAAU,CAAC,EACjC,OAAO,CAAC,OAAO,KAAK,IAAI,EACxB,QAAQ,EACR,kBAAkB,EAClB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,CAAC,EAC7D,SAAS,EACT,OAAO,CAAC,YAAY,KAAK,IAAI,EAC7B,OAAO,CAAC,SAAS,KAAK,IAAI,EAC1B,OAAO,CAAC,oBAAoB,KAAK,IAAI,EACrC,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAA,4BAAe,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CACvG,CAAC;QACF,KAAK,CAAC,aAAa,GAAG,IAAA,gCAAgB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7D,KAAK,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC1B,KAAK,CAAC,SAAS,GAAG,IAAA,wBAAW,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpD,KAAK,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;QAC1C,KAAK,CAAC,mBAAmB,GAAG,IAAA,4CAAsB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,0FAA0F;IAC1F,4GAA4G;IACpG,MAAM,CAAC,UAAU,CACrB,YAAiD,EACjD,cAAmC;QAEnC,OAAO,YAAY;aACd,GAAG,CACA,CAAC,WAAqC,EAAE,EAAE,CACtC,IAAI,mCAAoB,CACpB,WAAW,CAAC,KAAK,EACjB,WAAW,CAAC,MAAM,EAClB,WAAW,CAAC,QAAQ,EACpB,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EACjD,WAAW,CAAC,QAAQ,CACvB,CACR;aACA,IAAI,CAAC,CAAC,CAAuB,EAAE,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC;IAED,4GAA4G;IACpG,MAAM,CAAC,YAAY,CAAC,QAAkB,EAAE,UAAkB;QAC9D,MAAM,IAAI,GAAG,CAAC,IAAA,yBAAY,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,6BAA6B,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,GAAG,CAAC,CAAC;IAC9F,CAAC;IAED,4IAA4I;IACpI,MAAM,CAAC,uBAAuB,CAClC,QAAkB,EAClB,UAAkB,EAClB,UAAsB,EACtB,QAAkB,EAClB,OAAiB;QAEjB,IAAI,IAAA,8BAAe,EAAC,UAAU,CAAC;YAAE,OAAO;QACxC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,CAAC,IAAI,IAAI,UAAU,OAAO,UAAU,6CAA6C,UAAU,uBAAuB,CAChI,CAAC;QACN,CAAC;QACD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,CAAC,IAAI,IAAI,UAAU,OAAO,UAAU,4CAA4C,UAAU,uBAAuB,CAC/H,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,wGAAwG;IAChG,MAAM,CAAC,mBAAmB,CAAC,QAAkB,EAAE,UAAkB,EAAE,UAAsB;QAC7F,MAAM,IAAI,GAAG,IAAA,4BAAe,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,UAAU,KAAK,mBAAI,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,SAAS,IAAI,CAAC,WAAW,EAAE,sBAAsB,UAAU,IAAI;gBACtG,gFAAgF,CACvF,CAAC;QACN,CAAC;IACL,CAAC;IAED,+GAA+G;IACvG,MAAM,CAAC,2BAA2B,CACtC,QAAkB,EAClB,UAAkB,EAClB,UAAsB,EACtB,cAAmC,EACnC,YAAiD,EACjD,SAAoC;QAEpC,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5D,IACI,CAAC,SAAS,CAAC,oBAAoB;YAC/B,CAAC,SAAS,CAAC,qBAAqB;YAChC,CAAC,SAAS,CAAC,SAAS,KAAK,mCAAe,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;YAC9E,CAAC,SAAS,CAAC,SAAS,KAAK,mCAAe,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAChF,CAAC;YACC,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,sFAAsF,QAAQ,CAAC,IAAI,4BAA4B,CAC1I,CAAC;QACN,CAAC;QACD,IAAI,UAAU,KAAK,mBAAI;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kCAAkC,CAAC,CAAC;QACrF,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yDAAyD,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,KAAK,mCAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,cAAc,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,GACN,SAAS,CAAC,SAAS,KAAK,mCAAe,CAAC,OAAO;gBAC3C,CAAC,CAAC,2EAA2E;gBAC7E,CAAC,CAAC,SAAS,CAAC,SAAS,KAAK,mCAAe,CAAC,QAAQ;oBAChD,CAAC,CAAC,6EAA6E;oBAC/E,CAAC,CAAC,0GAA0G,CAAC;YACvH,MAAM,IAAI,KAAK,CACX,qCAAqC,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,YAAY,KAAK,IAAI;gBACvF,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,EAAE,oBAAoB,IAAI,GAAG,CACtE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,CAAC;IACb,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,iIAAiI;IACjI,MAAM,CAAC,uBAAuB,CAAC,QAAkB;QAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;QACvC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,IAAA,yBAAY,EAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAChD,6EAA6E;YAC7E,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;YAClF,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,IAAI,QAAQ,QAAQ,KAAK,IAAI,UAAU,mBAAmB;oBAC9D,GAAG,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,gDAAgD;oBAClF,mFAAmF,CAC1F,CAAC;YACN,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QAC9B,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,qGAAqG;IAC7F,MAAM,CAAC,QAAQ,CAAC,QAAgB,EAAE,YAAoB;QAC1D,IAAI,QAAQ,KAAK,EAAE,IAAI,YAAY,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACrE,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;IAC1D,CAAC;IAED,qGAAqG;IAC7F,MAAM,CAAC,YAAY,CACvB,KAAuC,EACvC,QAAkB,EAClB,UAAkB;QAElB,MAAM,YAAY,GAAG,KAAK,IAAI,MAAM,CAAC;QACrC,IAAI,YAAY,KAAK,MAAM,IAAI,YAAY,KAAK,MAAM;YAAE,OAAO,YAAY,CAAC;QAC5E,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,CAAC,IAAI,IAAI,UAAU,uCAAuC,MAAM,CAAC,YAAY,CAAC,sBAAsB,CAClH,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,wGAAwG;IAChG,MAAM,CAAC,gBAAgB,CAAC,QAAkB;QAC9C,IAAA,wCAA2B,EAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,gBAAgB,GAAG,IAAA,kCAAqB,EAAC,QAAQ,CAAC,CAAC;QACzD,IAAI,CAAC,gBAAgB,IAAI,IAAA,iDAA2B,EAAC,QAAQ,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACX,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,2EAA2E;gBACpG,gGAAgG;gBAChG,gCAAgC,CACvC,CAAC;QACN,CAAC;QACD,OAAO,gBAAgB,CAAC;IAC5B,CAAC;IAED;;;;OAIG;IACH,wGAAwG;IAChG,MAAM,CAAC,yBAAyB,CACpC,QAAkB,EAClB,UAAkB,EAClB,gBAAyB,EACzB,cAAmC,EACnC,YAAiD;QAEjD,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,0FAA0F;oBAC9F,6FAA6F,CACpG,CAAC;YACN,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,KAAK,WAAW,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,yBAAW,EAAE,CAAC;gBACnF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,aAAa,WAAW,CAAC,KAAK,mDAAmD,CAAC,CAAC;YAC/G,CAAC;YACD,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBAC7E,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,iBAAiB,WAAW,CAAC,QAAQ,MAAM,WAAW,CAAC,QAAQ,CAAC,IAAI,wBAAwB;oBAChG,gBAAgB,WAAW,CAAC,KAAK,iBAAiB,CACzD,CAAC;YACN,CAAC;QACL,CAAC;IACL,CAAC;IAED;;;;;;;;;;OAUG;IACH,qGAAqG;IAC7F,MAAM,CAAC,cAAc,CACzB,OAAwB,EACxB,SAAgD,EAChD,QAAkB,EAClB,UAAkB,EAClB,IAA8B;QAE9B,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5D,IAAI,IAAI,KAAK,8BAAiB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,2FAA2F;gBAC/F,iGAAiG;gBACjG,gGAAgG,CACvG,CAAC;QACN,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,KAAK,uBAAU,IAAI,IAAI,KAAK,iBAAI,CAAC;QAC3D,IAAI,aAAa,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,iEAAiE;gBAChG,KAAK,IAAI,CAAC,WAAW,EAAE,2EAA2E;gBAClG,uEAAuE,CAC9E,CAAC;QACN,CAAC;QACD,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACvE,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,YAAY,KAAK,0BAAI,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,uCAAuC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,4BAA4B,CAC1G,CAAC;QACN,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7D,MAAM,GAAG,GAAG,aAAa;gBACrB,CAAC,CAAC,QAAQ,IAAI,CAAC,WAAW,EAAE,sCAAsC;gBAClE,CAAC,CAAC,6BAA6B,CAAC;YACpC,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,IAAI,GAAG,kBAAkB,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,sBAAsB,IAAI;gBAChF,0EAA0E,CACjF,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,sGAAsG;IAC9F,MAAM,CAAC,cAAc,CAAC,QAAkB,EAAE,UAAkB;QAChE,OAAO,OAAO,CAAC,WAAW,CAAC,mBAAmB,EAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;IAC1F,CAAC;IAED,kGAAkG;IAC1F,MAAM,CAAC,kBAAkB,CAC7B,QAAkB,EAClB,UAAkB,EAClB,QAAgB,EAChB,UAAsB,EACtB,cAAmC,EACnC,YAAiD;QAEjD,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;QAC5D,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAC5D,CAAC,KAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CACxC,CAAC;QACF,MAAM,SAAS,GAAG,YAAY;aACzB,MAAM,CAAC,CAAC,WAAqC,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC;aAChF,GAAG,CAAC,CAAC,WAAqC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1E,KAAK,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,UAAU,QAAQ,eAAe,WAAW,wBAAwB,WAAW,eAAe,CACzG,CAAC;YACN,CAAC;QACL,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,yBAAyB,QAAQ,WAAW,QAAQ,aAAa,QAAQ,gBAAgB,CACpG,CAAC;YACN,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,GAAG,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;YAChE,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,UAAU,OAAO,mBAAmB,CAAC,CAAC;YAClE,CAAC;YACD,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACtB,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC1B,cAAc,CAAC,MAAM,EACrB,YAAY,CAAC,MAAM,CACf,CAAC,OAAe,EAAE,WAAqC,EAAE,EAAE,CACvD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,KAAK,GAAG,CAAC,CAAC,EAC5C,CAAC,CACJ,CACJ,CAAC;QACF,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAA,8BAAe,EAAC,UAAU,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,OAAO,UAAU,+EAA+E,OAAO,CAAC,CAAC,CAAC,eAAe,CACpI,CAAC;QACN,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACX,GAAG,KAAK,QAAQ,OAAO,CAAC,MAAM,yBAAyB,UAAU,sFAAsF,CAC1J,CAAC;QACN,CAAC;QACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,4GAA4G;IACpG,MAAM,CAAC,SAAS,CAAC,IAA0B;QAC/C,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC;QACrC,IAAI,IAAI,KAAK,MAAM;YAAE,OAAO,QAAQ,CAAC;QACrC,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACvC,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,OAAO,CAAC;QACnC,OAAO,SAAS,CAAC;IACrB,CAAC;CACJ;AAlaD,oDAkaC","sourcesContent":["import {\n    getApiPath,\n    getAuthMeta,\n    getEndpointHttpMethod,\n    getEndpointKind,\n    getEndpointOperation,\n    getEndpointOptions,\n    getEndpoints,\n    getMaskSpec,\n} from './decorators';\nimport { getHttpParameterDeclarations } from './http-parameter-decorators';\nimport {\n    EndpointResponseType,\n    HttpParameterBinding,\n    HttpParameterDeclaration,\n    HttpParameterValueType,\n    HttpMethod,\n    POST,\n    verbCarriesBody,\n} from './HttpContract';\nimport { RouteMetadata } from './RouteMetadata';\nimport { QueryParams } from './QueryParams';\nimport { EndpointOptions, NONE } from './HttpEndpointOptions';\nimport { getStreamingEndpoint } from './StreamingContract';\nimport { getAuthorization } from './authorization';\nimport {\n    CLOUDTASKS,\n    CRON,\n    EndpointKind,\n    EXTERNAL_OUTBOUND,\n    assertEveryEndpointHasAuthMode,\n    assertExternalEndpointKinds,\n    isExternalOutboundApi,\n    isLocalOnly,\n} from './decorators';\nimport { declaresExternalContextKeys, getExternalContextKeys } from './ExternalContextKeys';\nimport { StreamDirection, StreamingEndpointMetadata } from './StreamingContract';\n\n/**\n * Build the one runtime route model consumed by incoming routing, in-process clients, and both\n * generated HTTP clients. Keeping this join/validation here prevents four subtly different\n * interpretations of the same decorators.\n */\nexport class RouteMetadataFactory {\n    // webpieces-disable no-function-outside-class -- deterministic decorator metadata factory shared by DI-free browser and server runtimes\n    static create(\n        apiClass: Function,\n        methodName: string,\n        controllerClassName?: string,\n    ): RouteMetadata {\n        assertEveryEndpointHasAuthMode(apiClass);\n        const externalOutbound = this.externalOutbound(apiClass);\n        const fullPath = this.joinPath(getApiPath(apiClass) ?? '', this.endpointPath(apiClass, methodName));\n        const options = getEndpointOptions(apiClass, methodName);\n        const streaming = getStreamingEndpoint(apiClass, methodName);\n        const httpMethod = getEndpointHttpMethod(apiClass, methodName);\n        const operation = getEndpointOperation(apiClass, methodName);\n        this.validateEndpointOptions(apiClass, methodName, httpMethod, options.formPost, options.rawBody);\n        this.validateTriggerVerb(apiClass, methodName, httpMethod);\n        const parameterTypes = this.parameterTypes(apiClass, methodName);\n        const declarations = getHttpParameterDeclarations(apiClass, methodName);\n        this.validateQueryDeclarations(apiClass, methodName, externalOutbound, parameterTypes, declarations);\n        const bodyParameterIndex = streaming\n            ? this.validateStreamingParameters(\n                  apiClass,\n                  methodName,\n                  httpMethod,\n                  parameterTypes,\n                  declarations,\n                  streaming,\n              )\n            : this.validateParameters(\n                  apiClass,\n                  methodName,\n                  fullPath,\n                  httpMethod,\n                  parameterTypes,\n                  declarations,\n              );\n        const bindings = this.bindingsOf(declarations, parameterTypes);\n        const route = new RouteMetadata(\n            httpMethod,\n            fullPath,\n            methodName,\n            operation,\n            controllerClassName,\n            getAuthMeta(apiClass, methodName),\n            apiClass.name || 'UnknownApi',\n            options.formPost === true,\n            getMaskSpec(apiClass, methodName),\n            options.rawBody === true,\n            bindings,\n            bodyParameterIndex,\n            this.responseType(options.responseType, apiClass, methodName),\n            streaming,\n            options.hideProgress === true,\n            options.noLogging === true,\n            options.allowUpgradeInFlight === true,\n            this.noResponseBody(options, streaming, apiClass, methodName, getEndpointKind(apiClass, methodName)),\n        );\n        route.authorization = getAuthorization(apiClass, methodName);\n        route.apiClass = apiClass;\n        route.localOnly = isLocalOnly(apiClass, methodName);\n        route.externalOutbound = externalOutbound;\n        route.externalContextKeys = getExternalContextKeys(apiClass, methodName);\n        return route;\n    }\n    /** Each declaration resolved against its argument's reflected type, in argument order. */\n    // webpieces-disable no-function-outside-class -- private pure helper for static route metadata construction\n    private static bindingsOf(\n        declarations: readonly HttpParameterDeclaration[],\n        parameterTypes: readonly Function[],\n    ): HttpParameterBinding[] {\n        return declarations\n            .map(\n                (declaration: HttpParameterDeclaration) =>\n                    new HttpParameterBinding(\n                        declaration.index,\n                        declaration.source,\n                        declaration.wireName,\n                        this.valueType(parameterTypes[declaration.index]),\n                        declaration.itemType,\n                    ),\n            )\n            .sort((a: HttpParameterBinding, b: HttpParameterBinding) => a.index - b.index);\n    }\n\n    // webpieces-disable no-function-outside-class -- private pure helper for static route metadata construction\n    private static endpointPath(apiClass: Function, methodName: string): string {\n        const path = (getEndpoints(apiClass) ?? {})[methodName];\n        if (path !== undefined) return path;\n        throw new Error(`No @Endpoint metadata for ${apiClass.name || 'Unknown'}.${methodName}.`);\n    }\n\n    // webpieces-disable no-function-outside-class -- private pure helper keeps the existing static metadata factory below the method-size limit\n    private static validateEndpointOptions(\n        apiClass: Function,\n        methodName: string,\n        httpMethod: HttpMethod,\n        formPost?: boolean,\n        rawBody?: boolean,\n    ): void {\n        if (verbCarriesBody(httpMethod)) return;\n        if (formPost === true) {\n            throw new Error(\n                `${apiClass.name}.${methodName} is ${httpMethod} and cannot declare formPost:true because ${httpMethod} has no request body.`,\n            );\n        }\n        if (rawBody === true) {\n            throw new Error(\n                `${apiClass.name}.${methodName} is ${httpMethod} and cannot declare rawBody:true because ${httpMethod} has no request body.`,\n            );\n        }\n    }\n\n    /**\n     * A CLOUDTASKS or CRON endpoint must be POST: Cloud Tasks, Cloud Scheduler and the in-memory task\n     * invoker all deliver with POST, so any other verb would register a route nothing ever reaches\n     * (a 404 at delivery time, not at startup).\n     */\n    // webpieces-disable no-function-outside-class -- private pure validator for the static metadata factory\n    private static validateTriggerVerb(apiClass: Function, methodName: string, httpMethod: HttpMethod): void {\n        const kind = getEndpointKind(apiClass, methodName);\n        if ((kind === 'cloudtasks' || kind === 'cron') && httpMethod !== POST) {\n            throw new Error(\n                `${apiClass.name || 'Unknown'}.${methodName} is a ${kind.toUpperCase()} endpoint declared ${httpMethod}; ` +\n                    `task and scheduler delivery always uses POST, so declare @Endpoint(POST, ...).`,\n            );\n        }\n    }\n\n    // webpieces-disable no-function-outside-class -- private pure validator alongside existing contract validators\n    private static validateStreamingParameters(\n        apiClass: Function,\n        methodName: string,\n        httpMethod: HttpMethod,\n        parameterTypes: readonly Function[],\n        declarations: readonly HttpParameterDeclaration[],\n        streaming: StreamingEndpointMetadata,\n    ): number | undefined {\n        const label = `${apiClass.name || 'Unknown'}.${methodName}`;\n        if (\n            !streaming.initialRequestSchema ||\n            !streaming.initialResponseSchema ||\n            (streaming.direction !== StreamDirection.RESPONSE && !streaming.requestSchema) ||\n            (streaming.direction !== StreamDirection.REQUEST && !streaming.responseSchema)\n        ) {\n            throw new Error(\n                `${label} requires generated streaming schemas. Run wp-openapi and registerStreamingCatalog(${apiClass.name}, catalog) before binding.`,\n            );\n        }\n        if (httpMethod !== POST) throw new Error(`${label} is streaming and must use POST.`);\n        if (declarations.length > 0)\n            throw new Error(`${label} is streaming and cannot declare path/query parameters.`);\n        const expected = streaming.direction === StreamDirection.REQUEST ? 1 : 2;\n        if (parameterTypes.length !== expected) {\n            const form =\n                streaming.direction === StreamDirection.REQUEST\n                    ? '(InitialRequest) => Promise<RequestStream<InitialResponse, RequestEvent>>'\n                    : streaming.direction === StreamDirection.RESPONSE\n                      ? '(InitialRequest, ResponseStream<ResponseEvent>) => Promise<InitialResponse>'\n                      : '(InitialRequest, ResponseStream<ResponseEvent>) => Promise<RequestStream<InitialResponse, RequestEvent>>';\n            throw new Error(\n                `Invalid @WpStream(StreamDirection.${streaming.direction.toUpperCase()}) method ${label}: ` +\n                    `${streaming.direction.toUpperCase()} accepts exactly ${form}.`,\n            );\n        }\n        return 0;\n    }\n\n    /**\n     * Refuse a contract in which two endpoints resolve to the same HTTP method + path.\n     *\n     * Empty paths are LEGAL (`@ApiPath('')` + `@Endpoint(POST, '', ...)` is how a contract says \"the whole\n     * destination arrives per call\"), so the thing actually worth rejecting is ambiguity: two methods\n     * that land on one route. On the server the second registration would silently shadow the first\n     * in the route map, and on the client both would dial the same URL — neither is ever what the\n     * author meant. Placeholder NAMES are ignored when comparing (`/a/{id}` and `/a/{key}` are the\n     * same route to a router), `''` and `'/'` compare equal (the server serves an empty path at the\n     * root), and the error names BOTH methods so the fix is obvious.\n     *\n     * Called by every transport that binds a whole contract (the generated clients and the server's\n     * route registration), so a duplicate dies at startup however the contract is consumed.\n     *\n     * @throws Error naming both colliding methods and the shared route.\n     */\n    // webpieces-disable no-function-outside-class -- deterministic contract validation shared by DI-free browser and server runtimes\n    static assertNoDuplicateRoutes(apiClass: Function): void {\n        const label = apiClass.name || 'Unknown';\n        const seen = new Map<string, string>();\n        for (const methodName of Object.keys(getEndpoints(apiClass) ?? {})) {\n            const route = this.create(apiClass, methodName);\n            // '' and '/' are one route to a server (every request path starts with '/').\n            const shape = (route.path === '' ? '/' : route.path).replace(/\\{[^{}]+\\}/g, '{}');\n            const key = `${route.httpMethod} ${shape}`;\n            const previous = seen.get(key);\n            if (previous !== undefined) {\n                throw new Error(\n                    `${label}.${previous} and ${label}.${methodName} both resolve to ` +\n                        `${route.httpMethod} '${route.path}'. Two endpoints of one contract cannot share ` +\n                        `an HTTP method + path; give one of them a distinct @Endpoint path or HTTP method.`,\n                );\n            }\n            seen.set(key, methodName);\n        }\n    }\n\n    /**\n     * Join `@ApiPath` and `@Endpoint` into the route path.\n     *\n     * Both empty joins to `''`, NOT `'/'`. A contract declaring `@ApiPath('')` + `@Endpoint(POST, '', ...)`\n     * is saying \"this route adds nothing to the base URL\", and a client whose base URL is a full\n     * destination (host + path + query) must send it byte for byte. Before #926 the client joined with\n     * plain concatenation (`'' + ''`), and forcing a `/` here broke exactly that (#944).\n     */\n    // webpieces-disable no-function-outside-class -- private pure helper for the static metadata factory\n    private static joinPath(basePath: string, endpointPath: string): string {\n        if (basePath === '' && endpointPath === '') return '';\n        const joined = `${basePath}/${endpointPath}`.replace(/\\/{2,}/g, '/');\n        return joined.startsWith('/') ? joined : `/${joined}`;\n    }\n\n    // webpieces-disable no-function-outside-class -- private pure helper for the static metadata factory\n    private static responseType(\n        value: EndpointResponseType | undefined,\n        apiClass: Function,\n        methodName: string,\n    ): EndpointResponseType {\n        const responseType = value ?? 'body';\n        if (responseType === 'body' || responseType === 'full') return responseType;\n        throw new Error(\n            `${apiClass.name}.${methodName} declares unsupported responseType '${String(responseType)}'; use body or full.`,\n        );\n    }\n\n    /**\n     * The EXTERNAL_* rules ({@link assertExternalEndpointKinds}), then whether the contract is an\n     * outside system's API. `@ExternalContextKeys` says which context an OUTSIDE system may see, so it\n     * is refused on a contract this repo serves, which already receives the platform context.\n     */\n    // webpieces-disable no-function-outside-class -- private pure validator for the static metadata factory\n    private static externalOutbound(apiClass: Function): boolean {\n        assertExternalEndpointKinds(apiClass);\n        const externalOutbound = isExternalOutboundApi(apiClass);\n        if (!externalOutbound && declaresExternalContextKeys(apiClass)) {\n            throw new Error(\n                `${apiClass.name || 'Unknown'} declares @ExternalContextKeys but is not an EXTERNAL_OUTBOUND contract. ` +\n                    'The list says which context an OUTSIDE system may see; a contract served in this repo already ' +\n                    'receives the platform context.',\n            );\n        }\n        return externalOutbound;\n    }\n\n    /**\n     * `@QueryString()` (a free-form {@link QueryParams}) is the query spelling of an EXTERNAL_OUTBOUND\n     * contract ONLY — our own contracts keep the typed `@QueryParam` — and its argument must BE a\n     * `QueryParams`. An item type (`@QueryParam('ids', Number)`) only means something on a list.\n     */\n    // webpieces-disable no-function-outside-class -- private pure validator for the static metadata factory\n    private static validateQueryDeclarations(\n        apiClass: Function,\n        methodName: string,\n        externalOutbound: boolean,\n        parameterTypes: readonly Function[],\n        declarations: readonly HttpParameterDeclaration[],\n    ): void {\n        const label = `${apiClass.name || 'Unknown'}.${methodName}`;\n        for (const declaration of declarations) {\n            const type = parameterTypes[declaration.index];\n            if (declaration.source === 'query-map' && !externalOutbound) {\n                throw new Error(\n                    `${label} declares @QueryString(), which only an EXTERNAL_OUTBOUND contract may use — a vendor's ` +\n                        `query string is free-form. A contract this repo serves names each key: @QueryParam('name').`,\n                );\n            }\n            if (declaration.source === 'query-map' && type !== undefined && type !== QueryParams) {\n                throw new Error(`${label} argument ${declaration.index} is @QueryString() and must be typed QueryParams.`);\n            }\n            if (declaration.itemType !== undefined && type !== undefined && type !== Array) {\n                throw new Error(\n                    `${label} @QueryParam('${declaration.wireName}', ${declaration.itemType.name}) names an item type, ` +\n                        `but argument ${declaration.index} is not a list.`,\n                );\n            }\n        }\n    }\n\n    /**\n     * Whether the success response is 0 bytes (server 204, every client resolves `undefined`).\n     *\n     * A CLOUDTASKS or CRON endpoint is fire-and-forget BY KIND — Cloud Tasks and the scheduler read\n     * nothing but the status — so the kind implies it (#1348), and an explicit `responseBody: NONE`\n     * there is a second spelling of a decision the kind already made, so it is refused. On an\n     * EXTERNAL_OUTBOUND endpoint the VENDOR shapes the response, so NONE (what OUR server sends) is\n     * refused there too and the client accepts any 2xx. On RPC / EXTERNAL_INBOUND\n     * `responseBody: NONE` declares it. Either way the 0-byte response cannot combine with a\n     * caller-owned full response or a streaming endpoint (both of which DEFINE a response).\n     */\n    // webpieces-disable no-function-outside-class -- private pure helper for the static metadata factory\n    private static noResponseBody(\n        options: EndpointOptions,\n        streaming: StreamingEndpointMetadata | undefined,\n        apiClass: Function,\n        methodName: string,\n        kind: EndpointKind | undefined,\n    ): boolean {\n        const label = `${apiClass.name || 'Unknown'}.${methodName}`;\n        if (kind === EXTERNAL_OUTBOUND && options.responseBody !== undefined) {\n            throw new Error(\n                `${label} is an EXTERNAL_OUTBOUND endpoint and declares responseBody: NONE, which does not apply: ` +\n                    `NONE describes what OUR server sends, and the vendor shapes an outbound response. The outbound ` +\n                    `client accepts any 2xx (204 or empty -> undefined, JSON -> parsed). Delete responseBody: NONE.`,\n            );\n        }\n        const impliedByKind = kind === CLOUDTASKS || kind === CRON;\n        if (impliedByKind && options.responseBody !== undefined) {\n            throw new Error(\n                `${label} is a ${kind.toUpperCase()} endpoint and declares responseBody: NONE, which is redundant: ` +\n                    `a ${kind.toUpperCase()} endpoint is fire-and-forget, so its kind already means no response body ` +\n                    `(204, 0 bytes). Delete responseBody: NONE from its @Endpoint options.`,\n            );\n        }\n        if (!impliedByKind && options.responseBody === undefined) return false;\n        if (!impliedByKind && options.responseBody !== NONE) {\n            throw new Error(\n                `${label} declares unsupported responseBody '${String(options.responseBody)}'; the only value is NONE.`,\n            );\n        }\n        if (options.responseType === 'full' || streaming !== undefined) {\n            const why = impliedByKind\n                ? `is a ${kind.toUpperCase()} endpoint (no response body by kind)`\n                : 'declares responseBody: NONE';\n            throw new Error(\n                `${label} ${why} together with ${streaming ? 'a stream' : \"responseType: 'full'\"}; ` +\n                    'a 0-byte response cannot also carry a caller-owned or streamed response.',\n            );\n        }\n        return true;\n    }\n\n    // webpieces-disable no-function-outside-class -- Reflect metadata lookup has no injectable dependency\n    private static parameterTypes(apiClass: Function, methodName: string): Function[] {\n        return Reflect.getMetadata('design:paramtypes', apiClass.prototype, methodName) ?? [];\n    }\n\n    // webpieces-disable no-function-outside-class -- private deterministic contract validation helper\n    private static validateParameters(\n        apiClass: Function,\n        methodName: string,\n        fullPath: string,\n        httpMethod: HttpMethod,\n        parameterTypes: readonly Function[],\n        declarations: readonly HttpParameterDeclaration[],\n    ): number | undefined {\n        const label = `${apiClass.name || 'Unknown'}.${methodName}`;\n        const placeholders = [...fullPath.matchAll(/\\{([^{}]+)\\}/g)].map(\n            (match: RegExpMatchArray) => match[1],\n        );\n        const pathNames = declarations\n            .filter((declaration: HttpParameterDeclaration) => declaration.source === 'path')\n            .map((declaration: HttpParameterDeclaration) => declaration.wireName);\n        for (const placeholder of new Set(placeholders)) {\n            if (!pathNames.includes(placeholder)) {\n                throw new Error(\n                    `${label} path '${fullPath}' contains {${placeholder}} but no @PathParam('${placeholder}') parameter.`,\n                );\n            }\n        }\n        for (const pathName of pathNames) {\n            if (!placeholders.includes(pathName)) {\n                throw new Error(\n                    `${label} declares @PathParam('${pathName}') but '${fullPath}' has no {${pathName}} placeholder.`,\n                );\n            }\n        }\n\n        const seenWire = new Set<string>();\n        const mappedIndexes = new Set<number>();\n        for (const declaration of declarations) {\n            const wireKey = `${declaration.source}:${declaration.wireName}`;\n            if (seenWire.has(wireKey)) {\n                throw new Error(`${label} maps '${wireKey}' more than once.`);\n            }\n            seenWire.add(wireKey);\n            mappedIndexes.add(declaration.index);\n        }\n\n        const declaredCount = Math.max(\n            parameterTypes.length,\n            declarations.reduce(\n                (highest: number, declaration: HttpParameterDeclaration) =>\n                    Math.max(highest, declaration.index + 1),\n                0,\n            ),\n        );\n        const unbound: number[] = [];\n        for (let index = 0; index < declaredCount; index++) {\n            if (!mappedIndexes.has(index)) unbound.push(index);\n        }\n        if (!verbCarriesBody(httpMethod) && unbound.length > 0) {\n            throw new Error(\n                `${label} is ${httpMethod}, so every parameter must use @PathParam(...) or @QueryParam(...); argument ${unbound[0]} is unmapped.`,\n            );\n        }\n        if (unbound.length > 1) {\n            throw new Error(\n                `${label} has ${unbound.length} unmapped parameters. ${httpMethod} permits exactly one unannotated request body; map every other parameter explicitly.`,\n            );\n        }\n        return unbound[0];\n    }\n\n    // webpieces-disable no-function-outside-class -- private conversion of reflected constructors to wire types\n    private static valueType(type: Function | undefined): HttpParameterValueType {\n        if (type === String) return 'string';\n        if (type === Number) return 'number';\n        if (type === Boolean) return 'boolean';\n        if (type === Array) return 'array';\n        return 'unknown';\n    }\n}\n"]}

package/src/http/decorators.d.ts

@@ -1,9 +1,9 @@
 import 'reflect-metadata';
 import { MaskSpec, MaskMode } from './LogFieldMask';
 import { AuthMeta, AuthMethods } from './auth-mode';
-import { EndpointOperation, EndpointOptions, ExternalEndpointOptions } from './HttpEndpointOptions';
+import { EndpointOperation, EndpointOptions, ExternalEndpointOptions, NoResponseBodyOptionEndpointOptions } from './HttpEndpointOptions';
 import { HttpMethod } from './HttpContract';
-export type { EndpointOptions, ExternalEndpointOptions } from './HttpEndpointOptions';
+export type { EndpointOptions, ExternalEndpointOptions, NoResponseBodyOptionEndpointOptions } from './HttpEndpointOptions';
 export type { EndpointOperation } from './HttpEndpointOptions';
 export { READ, WRITE_IDEMPOTENT, WRITE, NONE } from './HttpEndpointOptions';
 export type { ResponseBodyKind } from './HttpEndpointOptions';
@@ -80,7 +80,8 @@ export declare function ApiPath(basePath: string): ClassDecorator;
  * Each classification rides a parallel metadata map while ENDPOINTS remains method-name -> path.
  */
 export declare function Endpoint(httpMethod: HttpMethod, path: string, operation: EndpointOperation, kind: typeof EXTERNAL_INBOUND, options: ExternalEndpointOptions): MethodDecorator;
-export declare function Endpoint(httpMethod: HttpMethod, path: string, operation: EndpointOperation, kind: Exclude<EndpointKind, typeof EXTERNAL_INBOUND>, options?: EndpointOptions): MethodDecorator;
+export declare function Endpoint(httpMethod: HttpMethod, path: string, operation: EndpointOperation, kind: typeof CLOUDTASKS | typeof CRON | typeof EXTERNAL_OUTBOUND, options?: NoResponseBodyOptionEndpointOptions): MethodDecorator;
+export declare function Endpoint(httpMethod: HttpMethod, path: string, operation: EndpointOperation, kind: typeof RPC, options?: EndpointOptions): MethodDecorator;
 /** Declares request/response DTO field names that API logging must mask at any depth. */
 export declare function MaskLog(fields: Record<string, MaskMode>): MethodDecorator;
 /**

package/src/http/decorators.js.map

@@ -1 +1 @@
-{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/decorators.ts"],"names":[],"mappings":";;;AAsGA,0BAcC;AAwBD,4BAqBC;AAgFD,0BAUC;AAOD,kCAIC;AAqCD,oCAOC;AAID,wBAEC;AAID,kCAKC;AAGD,kCAEC;AASD,gCAEC;AAMD,oCAEC;AAOD,4CAEC;AAWD,0CAEC;AAID,sDAUC;AAMD,gDASC;AAID,oDAWC;AAiCD,kEAsBC;AAID,sDAGC;AAOD,gCAEC;AAOD,8BAEC;AAeD,kGAeC;AAKD,8BAEC;AAMD,kCAEC;AAmBD,wEAuBC;AAOD,0EAkBC;AA3lBD,4BAA0B;AAC1B,iDAAoD;AACpD,uDAK2B;AAC3B,4FAA4F;AAC5F,2CAA8D;AAC9D,+DAO+B;AAC/B,iDAAwE;AACxE,mDAA2H;AAC3H,2EAA2E;AAI3E,6DAA4E;AAAnE,2GAAA,IAAI,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAAE,4GAAA,KAAK,OAAA;AAAE,2GAAA,IAAI,OAAA;AAG5C,+CAA+D;AAAtD,mGAAA,GAAG,OAAA;AAAE,oGAAA,IAAI,OAAA;AAAE,mGAAA,GAAG,OAAA;AAAE,qGAAA,KAAK,OAAA;AAAE,sGAAA,MAAM,OAAA;AACtC,yEAA+G;AAAtG,sHAAA,SAAS,OAAA;AAAE,uHAAA,UAAU,OAAA;AAAE,wHAAA,WAAW,OAAA;AAAE,yIAAA,4BAA4B,OAAA;AAEzE;;;GAGG;AACU,QAAA,aAAa,GAAG;IACzB,QAAQ,EAAE,oBAAoB;IAC9B,SAAS,EAAE,qBAAqB;IAChC,SAAS,EAAE,qBAAqB;IAChC,2EAA2E;IAC3E,YAAY,EAAE,wBAAwB;IACtC,uFAAuF;IACvF,QAAQ,EAAE,oBAAoB;IAC9B,mEAAmE;IACnE,cAAc,EAAE,0BAA0B;IAC1C,2EAA2E;IAC3E,gBAAgB,EAAE,4BAA4B;IAC9C,8DAA8D;IAC9D,oBAAoB,EAAE,gCAAgC;IACtD,uEAAuE;IACvE,kBAAkB,EAAE,8BAA8B;IAClD,iIAAiI;IACjI,aAAa,EAAE,yBAAyB;IACxC,qGAAqG;IACrG,eAAe,EAAE,qCAAmB;IACpC,6EAA6E;IAC7E,QAAQ,EAAE,oBAAoB;IAC9B,gFAAgF;IAChF,SAAS,EAAE,qBAAqB;IAChC,6FAA6F;IAC7F,WAAW,EAAE,uBAAuB;IACpC,iFAAiF;IACjF,gBAAgB,EAAE,4BAA4B;IAC9C,oFAAoF;IACpF,UAAU,EAAE,sBAAsB;IAClC,uFAAuF;IACvF,eAAe,EAAE,wDAA4B;CAChD,CAAC;AAEF,8EAA8E;AAC9E,IAAK,iBAMJ;AAND,WAAK,iBAAiB;IAClB,gCAAW,CAAA;IACX,8CAAyB,CAAA;IACzB,kCAAa,CAAA;IACb,0DAAqC,CAAA;IACrC,4DAAuC,CAAA;AAC3C,CAAC,EANI,iBAAiB,KAAjB,iBAAiB,QAMrB;AAED,wDAAwD;AAC3C,QAAA,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC;AAC5B,QAAA,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC;AAC1C,QAAA,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;AAC3C;;;GAGG;AACU,QAAA,gBAAgB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC;AACnE;;;;GAIG;AACU,QAAA,iBAAiB,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;AAUrE,wEAAwE;AACxE,SAAgB,OAAO,CAAC,QAAgB;IACpC,OAAO,CAAC,MAAgB,EAAE,EAAE;QACxB,IAAI,OAAO,CAAC,WAAW,CAAC,sBAAsB,EAAE,MAAM,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACX,SAAS,MAAM,CAAC,IAAI,IAAI,SAAS,4CAA4C,CAChF,CAAC;QACN,CAAC;QACD,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEjE,yCAAyC;QACzC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;IACL,CAAC,CAAC;AACN,CAAC;AAuBD,2GAA2G;AAC3G,SAAgB,QAAQ,CACpB,UAAsB,EACtB,IAAY,EACZ,SAA4B,EAC5B,IAAkB,EAClB,UAA2B,EAAE;IAE7B,8BAA8B,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5D,kFAAkF;IAClF,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,WAA+B,EAAE,EAAE;QAClF,MAAM,cAAc,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QAClF,sBAAsB,CAClB,cAAc,EACd,WAAqB,EACrB,UAAU,EACV,IAAI,EACJ,SAAS,EACT,IAAI,EACJ,OAAO,CACV,CAAC;IACN,CAAC,CAAC;AACN,CAAC;AAED,8FAA8F;AAC9F,SAAS,8BAA8B,CACnC,UAAsB,EACtB,SAA4B,EAC5B,IAAkB;IAElB,IAAI,CAAC,IAAA,2BAAY,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACX,uCAAuC,2BAAY,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,UAAU,CAAC,IAAI,CACtG,CAAC;IACN,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACX,2EAA2E,MAAM,CAAC,SAAS,CAAC,IAAI,CACnG,CAAC;IACN,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACX,sGAAsG,MAAM,CAAC,IAAI,CAAC,IAAI,CACzH,CAAC;IACN,CAAC;AACL,CAAC;AAED,sGAAsG;AACtG,SAAS,sBAAsB,CAC3B,cAAwB,EACxB,WAAmB,EACnB,UAAsB,EACtB,IAAY,EACZ,SAA4B,EAC5B,IAAkB,EAClB,OAAwB;IAExB,MAAM,SAAS,GACX,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAEvE,SAAS,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;IAE9B,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IAE3E,MAAM,OAAO,GACT,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,oBAAoB,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAClF,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC;IAClC,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,oBAAoB,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAEpF,MAAM,UAAU,GACZ,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,kBAAkB,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAChF,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IACpC,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,kBAAkB,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAErF,MAAM,KAAK,GACP,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,aAAa,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAC3E,KAAK,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,aAAa,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAE3E,MAAM,IAAI,GACN,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;IAC5B,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,gBAAgB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,OAAkC,CAAC;IACpD,IACI,IAAI,KAAK,wBAAgB;QACzB,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QACrC,QAAQ,CAAC,QAAQ,KAAK,EAAE;QAExB,OAAO;IACX,MAAM,OAAO,GACT,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAC7E,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,gCAAc,CACrC,QAAQ,CAAC,UAAU,IAAI,qCAAmB,EAC1C,QAAQ,CAAC,QAAQ,CACpB,CAAC;IACF,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,eAAe,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AACnF,CAAC;AAED,yFAAyF;AACzF,2GAA2G;AAC3G,SAAgB,OAAO,CAAC,MAAgC;IACpD,MAAM,IAAI,GAAG,IAAI,uBAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,kFAAkF;IAClF,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,WAA+B,EAAE,EAAE;QAClF,MAAM,cAAc,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QAClF,MAAM,KAAK,GACP,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;QACtE,KAAK,CAAC,WAAqB,CAAC,GAAG,IAAI,CAAC;QACpC,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1E,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,wGAAwG;AACxG,SAAgB,WAAW,CAAC,QAAkB,EAAE,UAAkB;IAC9D,MAAM,KAAK,GACP,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChE,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,2GAA2G;AAC3G,SAAS,kBAAkB,CAAC,QAAkB;IAE1C,kFAAkF;IAClF,OAAO,CAAC,MAAW,EAAE,WAA6B,EAAE,WAAgC,EAAE,EAAE;QACpF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACX,gFAAgF,CACnF,CAAC;QACN,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QAClF,IAAI,OAAO,CAAC,WAAW,CAAC,sBAAsB,EAAE,cAAc,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACX,gBAAgB,cAAc,CAAC,IAAI,IAAI,SAAS,4CAA4C,CAC/F,CAAC;QACN,CAAC;QACD,+BAA+B,CAAC,cAAc,EAAE,WAAqB,CAAC,CAAC;QACvE,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,IAAI,GAAG,CACnB,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,EAAE,CACxE,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,WAAqB,CAAC,CAAC;QACnC,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;IACrF,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,2GAA2G;AAC3G,SAAgB,YAAY,CAAC,MAAc;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACX,wFAAwF,CAC3F,CAAC;IACN,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,oBAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,qGAAqG;AACrG,oFAAoF;AACpF,SAAgB,MAAM,CAAC,OAAoB;IACvC,OAAO,kBAAkB,CAAC,IAAI,oBAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,6FAA6F;AAC7F,oFAAoF;AACpF,SAAgB,WAAW;IACvB,OAAO,CAAC,MAAc,EAAE,UAA2B,EAAE,EAAE;QACnD,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9E,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC3F,CAAC,CAAC;AACN,CAAC;AAED,2EAA2E;AAC3E,SAAgB,WAAW,CAAC,QAAkB,EAAE,UAAkB;IAC9D,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC;AACxF,CAAC;AAED,+DAA+D;AAC/D,mBAAmB;AACnB,+DAA+D;AAE/D;;GAEG;AACH,SAAgB,UAAU,CAAC,QAAkB;IACzC,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,QAAkB;IAC3C,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,kGAAkG;AAClG,SAAgB,gBAAgB,CAAC,QAAkB;IAC/C,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,kGAAkG;AAClG,SAAgB,eAAe,CAAC,QAAkB,EAAE,UAAkB;IAClE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,iDAAiD;AACjD,qGAAqG;AACrG,SAAgB,qBAAqB,CAAC,QAAkB,EAAE,UAAkB;IACxE,MAAM,OAAO,GACT,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,oBAAoB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,IAAA,2BAAY,EAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACX,aAAa,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,wBAAwB,2BAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1G,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,kGAAkG;AAClG,SAAgB,kBAAkB,CAAC,QAAkB,EAAE,UAAkB;IACrE,MAAM,IAAI,GACN,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QACjE,uFAAuF;QACvF,OAAO,EAAqB,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,wGAAwG;AACxG,SAAgB,oBAAoB,CAAC,QAAkB,EAAE,UAAkB;IACvE,MAAM,UAAU,GACZ,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACX,aAAa,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,sBAAsB;YACvE,6BAA6B,CACpC,CAAC;IACN,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,wMAAwM;AACxM,SAAS,mBAAmB,CAAC,KAAc;IACvC,OAAO,CACH,KAAK,KAAK,0BAAI;QACd,KAAK,KAAK,sCAAgB;QAC1B,KAAK,KAAK,2BAAK,CAClB,CAAC;AACN,CAAC;AAED,mMAAmM;AACnM,SAAS,cAAc,CAAC,KAAc;IAClC,OAAO,CACH,KAAK,KAAK,WAAG;QACb,KAAK,KAAK,kBAAU;QACpB,KAAK,KAAK,YAAI;QACd,KAAK,KAAK,wBAAgB;QAC1B,KAAK,KAAK,yBAAiB,CAC9B,CAAC;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,+GAA+G;AAC/G,SAAgB,2BAA2B,CAAC,QAAkB;IAC1D,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,yBAAiB,CAAC,CAAC;IACjG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,yBAAiB,CAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CACX,GAAG,OAAO,6BAA6B,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,KAAK;YACzG,sGAAsG;YACtG,6FAA6F,CACpG,CAAC;IACN,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,wBAAgB,IAAI,IAAA,mCAAiB,EAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,SAAS;YAC/F,SAAS;QACb,MAAM,IAAI,KAAK,CACX,sBAAsB,UAAU,QAAQ,OAAO,+BAA+B;YAC1E,mHAAmH;YACnH,8DAA8D,CACrE,CAAC;IACN,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,sGAAsG;AACtG,SAAgB,qBAAqB,CAAC,QAAkB;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAkB,EAAE,EAAE,CAAC,IAAI,KAAK,yBAAiB,CAAC,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,kGAAkG;AAClG,SAAgB,UAAU,CAAC,QAAkB,EAAE,UAAkB;IAC7D,OAAO,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,gGAAgG;AAChG,SAAgB,SAAS,CAAC,QAAkB,EAAE,UAAkB;IAC5D,OAAO,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,+GAA+G;AAC/G,SAAgB,2CAA2C,CAAC,QAAkB;IAC1E,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,IACI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC;YACpG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC;YAE/B,SAAS;QACb,MAAM,IAAI,KAAK,CACX,aAAa,UAAU,QAAQ,QAAQ,CAAC,IAAI,IAAI,SAAS,wCAAwC;YAC7F,mGAAmG;YACnG,4FAA4F;YAC5F,uDAAuD,CAC9D,CAAC;IACN,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAC,QAAkB;IACxC,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,uGAAuG;AACvG,SAAgB,WAAW,CAAC,QAAkB,EAAE,UAAkB;IAC9D,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACU,QAAA,0BAA0B,GACnC,mKAAmK;IACnK,0IAA0I,CAAC;AAE/I;;;;;GAKG;AACH,SAAgB,8BAA8B,CAAC,QAAkB;IAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;IAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACX,aAAa,UAAU,QAAQ,OAAO,0BAA0B;gBAC5D,kCAA0B,CACjC,CAAC;QACN,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,gCAAgB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,QAAQ,OAAO,6BAA6B,CAAC,CAAC;QAClG,wCAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACnF,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,iCAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,kIAAkI,CAAC,CAAC;QAC/K,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAa,OAAO,CAAC,WAAW,CAAC,yCAAyB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/F,KAAK,MAAM,UAAU,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,IAAI,UAAU,sBAAsB,CAAC,CAAC;IAC/H,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,sFAAsF;AACtF,SAAgB,+BAA+B,CAC3C,QAAkB,EAClB,UAA8B;IAE9B,MAAM,QAAQ,GAAG,UAAU;QACvB,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC;QACpE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE7D,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;QAC9C,MAAM,QAAQ,GAAG,UAAU;YACvB,CAAC,CAAC,WAAW,UAAU,QAAQ,UAAU,EAAE;YAC3C,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACX,iCAAiC,QAAQ,IAAI;YACzC,gFAAgF,CACvF,CAAC;IACN,CAAC;AACL,CAAC","sourcesContent":["import 'reflect-metadata';\nimport { MaskSpec, MaskMode } from './LogFieldMask';\nimport {\n    DEFAULT_CALLER_KIND,\n    ENDPOINT_CALLER_KEY,\n    ExternalCaller,\n    getEndpointCaller,\n} from './external-caller';\n// The TYPE layer these decorators attach — split out for file size only (see auth-mode.ts).\nimport { AuthMeta, AuthMethods, AuthMode } from './auth-mode';\nimport {\n    EndpointOperation,\n    EndpointOptions,\n    ExternalEndpointOptions,\n    READ,\n    WRITE_IDEMPOTENT,\n    WRITE,\n} from './HttpEndpointOptions';\nimport { HTTP_METHODS, HttpMethod, isHttpMethod } from './HttpContract';\nimport { AuthorizationDeclaration, AuthorizationType, AUTHORIZATION_METHODS_KEY, getAuthorization } from './authorization';\nimport { HTTP_PARAMETERS_METADATA_KEY } from './http-parameter-decorators';\n\nexport type { EndpointOptions, ExternalEndpointOptions } from './HttpEndpointOptions';\nexport type { EndpointOperation } from './HttpEndpointOptions';\nexport { READ, WRITE_IDEMPOTENT, WRITE, NONE } from './HttpEndpointOptions';\nexport type { ResponseBodyKind } from './HttpEndpointOptions';\nexport type { HttpMethod } from './HttpContract';\nexport { GET, POST, PUT, PATCH, DELETE } from './HttpContract';\nexport { PathParam, QueryParam, QueryString, getHttpParameterDeclarations } from './http-parameter-decorators';\n\n/**\n * Metadata keys for storing API routing information.\n * These keys are used by both server-side (routing) and client-side (client generation).\n */\nexport const METADATA_KEYS = {\n    API_PATH: 'webpieces:api-path',\n    ENDPOINTS: 'webpieces:endpoints',\n    AUTH_META: 'webpieces:auth-meta',\n    /** Method names carrying one of the canonical authorization decorators. */\n    AUTH_METHODS: 'webpieces:auth-methods',\n    /** 'rpc' (default, sync request/response) vs 'pubsub' (fire-and-forget cloud task). */\n    API_KIND: 'webpieces:api-kind',\n    /** Per-method Cloud Tasks queue-name override (set via @Queue). */\n    QUEUE_OVERRIDE: 'webpieces:queue-override',\n    /** Per-method @Endpoint options (e.g. formPost), parallel to ENDPOINTS. */\n    ENDPOINT_OPTIONS: 'webpieces:endpoint-options',\n    /** Per-method required HTTP method, parallel to ENDPOINTS. */\n    ENDPOINT_HTTP_METHOD: 'webpieces:endpoint-http-method',\n    /** Per-method required read/write semantics, parallel to ENDPOINTS. */\n    ENDPOINT_OPERATION: 'webpieces:endpoint-operation',\n    /** Per-method @Endpoint trigger kind (rpc | cloudtasks | cron | external-inbound | external-outbound), parallel to ENDPOINTS. */\n    ENDPOINT_KIND: 'webpieces:endpoint-kind',\n    /** Per-method declared external CALLER (only for kind 'external-inbound'), parallel to ENDPOINTS. */\n    ENDPOINT_CALLER: ENDPOINT_CALLER_KEY,\n    /** Per-method @MaskLog spec (which DTO fields the LogApiCall path masks). */\n    MASK_LOG: 'webpieces:mask-log',\n    /** Per-method opt-in metadata for publishing an RPC endpoint as an MCP tool. */\n    MCP_TOOLS: 'webpieces:mcp-tools',\n    /** Per-method PERMANENT exclusion from MCP, with the reason — see @InvalidEndpointForMcp. */\n    MCP_INVALID: 'webpieces:mcp-invalid',\n    /** Per-method request/response event metadata for a typed streaming endpoint. */\n    STREAM_ENDPOINTS: 'webpieces:stream-endpoints',\n    /** Per-method MCP-user authorization, intentionally separate from HTTP hop auth. */\n    LOCAL_ONLY: 'webpieces:local-only',\n    /** Per-method explicit path/query parameter declarations, keyed by parameter index. */\n    HTTP_PARAMETERS: HTTP_PARAMETERS_METADATA_KEY,\n};\n\n/** Nominal backing keeps raw string literals out of endpoint declarations. */\nenum EndpointKindValue {\n    RPC = 'rpc',\n    CLOUDTASKS = 'cloudtasks',\n    CRON = 'cron',\n    EXTERNAL_INBOUND = 'external-inbound',\n    EXTERNAL_OUTBOUND = 'external-outbound',\n}\n\n/** Short, statically importable decorator arguments. */\nexport const RPC = EndpointKindValue.RPC;\nexport const CLOUDTASKS = EndpointKindValue.CLOUDTASKS;\nexport const CRON = EndpointKindValue.CRON;\n/**\n * An OUTSIDE system calls US (a vendor webhook, a push subscription). Requires `calledBy`, which names\n * that system on the runtime architecture graph.\n */\nexport const EXTERNAL_INBOUND = EndpointKindValue.EXTERNAL_INBOUND;\n/**\n * WE call an OUTSIDE system (a vendor API, a partner's webhook receiver). No server in this repo\n * implements it, every method of the contract must be this kind, and the client sends ONLY the\n * context keys listed with `@ExternalContextKeys(...)` and merges no response header into our context.\n */\nexport const EXTERNAL_OUTBOUND = EndpointKindValue.EXTERNAL_OUTBOUND;\n\n/** Runtime trigger/delivery owner used by validation, architecture, and infrastructure tooling. */\nexport type EndpointKind =\n    | typeof RPC\n    | typeof CLOUDTASKS\n    | typeof CRON\n    | typeof EXTERNAL_INBOUND\n    | typeof EXTERNAL_OUTBOUND;\n\n/** Class decorator that sets the shared base path for all endpoints. */\nexport function ApiPath(basePath: string): ClassDecorator {\n    return (target: Function) => {\n        if (Reflect.hasMetadata('webpieces:ipc-api-id', target)) {\n            throw new Error(\n                `Class ${target.name || 'Unknown'} cannot combine @ApiPath with @WpInternal.`,\n            );\n        }\n        Reflect.defineMetadata(METADATA_KEYS.API_PATH, basePath, target);\n\n        // Initialize endpoints map if not exists\n        if (!Reflect.hasMetadata(METADATA_KEYS.ENDPOINTS, target)) {\n            Reflect.defineMetadata(METADATA_KEYS.ENDPOINTS, {}, target);\n        }\n    };\n}\n\n/**\n * Registers `@Endpoint(POST, path, WRITE, RPC)`. Method, operation, and trigger are required enum\n * values. Operation is independent of the HTTP verb. EXTERNAL_INBOUND additionally requires `calledBy`.\n * Each classification rides a parallel metadata map while ENDPOINTS remains method-name -> path.\n */\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nexport function Endpoint(\n    httpMethod: HttpMethod,\n    path: string,\n    operation: EndpointOperation,\n    kind: typeof EXTERNAL_INBOUND,\n    options: ExternalEndpointOptions,\n): MethodDecorator;\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nexport function Endpoint(\n    httpMethod: HttpMethod,\n    path: string,\n    operation: EndpointOperation,\n    kind: Exclude<EndpointKind, typeof EXTERNAL_INBOUND>,\n    options?: EndpointOptions,\n): MethodDecorator;\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nexport function Endpoint(\n    httpMethod: HttpMethod,\n    path: string,\n    operation: EndpointOperation,\n    kind: EndpointKind,\n    options: EndpointOptions = {},\n): MethodDecorator {\n    validateEndpointClassification(httpMethod, operation, kind);\n    // webpieces-disable no-any-unknown -- reflect-metadata decorator API requires any\n    return (target: any, propertyKey: string | symbol, _descriptor: PropertyDescriptor) => {\n        const metadataTarget = typeof target === 'function' ? target : target.constructor;\n        recordEndpointMetadata(\n            metadataTarget,\n            propertyKey as string,\n            httpMethod,\n            path,\n            operation,\n            kind,\n            options,\n        );\n    };\n}\n\n// webpieces-disable no-function-outside-class -- runtime validation backs up nominal TS enums\nfunction validateEndpointClassification(\n    httpMethod: HttpMethod,\n    operation: EndpointOperation,\n    kind: EndpointKind,\n): void {\n    if (!isHttpMethod(httpMethod)) {\n        throw new Error(\n            `@Endpoint httpMethod must be one of ${HTTP_METHODS.join(', ')}, received '${String(httpMethod)}'.`,\n        );\n    }\n    if (!isEndpointOperation(operation)) {\n        throw new Error(\n            `@Endpoint operation must be READ, WRITE_IDEMPOTENT, or WRITE, received '${String(operation)}'.`,\n        );\n    }\n    if (!isEndpointKind(kind)) {\n        throw new Error(\n            `@Endpoint trigger must be RPC, CLOUDTASKS, CRON, EXTERNAL_INBOUND, or EXTERNAL_OUTBOUND, received '${String(kind)}'.`,\n        );\n    }\n}\n\n// webpieces-disable no-function-outside-class -- one metadata write shared by the decorator overloads\nfunction recordEndpointMetadata(\n    metadataTarget: Function,\n    propertyKey: string,\n    httpMethod: HttpMethod,\n    path: string,\n    operation: EndpointOperation,\n    kind: EndpointKind,\n    options: EndpointOptions,\n): void {\n    const endpoints: Record<string, string> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINTS, metadataTarget) || {};\n\n    endpoints[propertyKey] = path;\n\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINTS, endpoints, metadataTarget);\n\n    const methods: Record<string, HttpMethod> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_HTTP_METHOD, metadataTarget) || {};\n    methods[propertyKey] = httpMethod;\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINT_HTTP_METHOD, methods, metadataTarget);\n\n    const operations: Record<string, EndpointOperation> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_OPERATION, metadataTarget) || {};\n    operations[propertyKey] = operation;\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINT_OPERATION, operations, metadataTarget);\n\n    const kinds: Record<string, EndpointKind> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_KIND, metadataTarget) || {};\n    kinds[propertyKey] = kind;\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINT_KIND, kinds, metadataTarget);\n\n    const opts: Record<string, EndpointOptions> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_OPTIONS, metadataTarget) || {};\n    opts[propertyKey] = options;\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINT_OPTIONS, opts, metadataTarget);\n\n    const declared = options as ExternalEndpointOptions;\n    if (\n        kind !== EXTERNAL_INBOUND ||\n        typeof declared.calledBy !== 'string' ||\n        declared.calledBy === ''\n    )\n        return;\n    const callers: Record<string, ExternalCaller> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_CALLER, metadataTarget) || {};\n    callers[propertyKey] = new ExternalCaller(\n        declared.callerKind ?? DEFAULT_CALLER_KIND,\n        declared.calledBy,\n    );\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINT_CALLER, callers, metadataTarget);\n}\n\n/** Declares request/response DTO field names that API logging must mask at any depth. */\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nexport function MaskLog(fields: Record<string, MaskMode>): MethodDecorator {\n    const spec = new MaskSpec(fields);\n    // webpieces-disable no-any-unknown -- reflect-metadata decorator API requires any\n    return (target: any, propertyKey: string | symbol, _descriptor: PropertyDescriptor) => {\n        const metadataTarget = typeof target === 'function' ? target : target.constructor;\n        const specs: Record<string, MaskSpec> =\n            Reflect.getMetadata(METADATA_KEYS.MASK_LOG, metadataTarget) || {};\n        specs[propertyKey as string] = spec;\n        Reflect.defineMetadata(METADATA_KEYS.MASK_LOG, specs, metadataTarget);\n    };\n}\n\n/**\n * The @MaskLog spec for one method, or undefined if the method declared none (the common case — the\n * caller then logs the DTO verbatim on the plain JSON.stringify fast path).\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpointOptions\nexport function getMaskSpec(apiClass: Function, methodName: string): MaskSpec | undefined {\n    const specs: Record<string, MaskSpec> =\n        Reflect.getMetadata(METADATA_KEYS.MASK_LOG, apiClass) || {};\n    return specs[methodName];\n}\n\n/**\n * Shared implementation for every auth decorator. Authorization is deliberately\n * method-only: a class-level default is too easy to miss when reviewing one endpoint.\n */\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nfunction defineAuthMetadata(authMeta: AuthMeta): MethodDecorator {\n\n    // webpieces-disable no-any-unknown -- reflect-metadata decorator API requires any\n    return (target: any, propertyKey?: string | symbol, _descriptor?: PropertyDescriptor) => {\n        if (propertyKey === undefined) {\n            throw new Error(\n                'Authorization decorators are method-only; annotate every @Endpoint explicitly.',\n            );\n        }\n        const metadataTarget = typeof target === 'function' ? target : target.constructor;\n        if (Reflect.hasMetadata('webpieces:ipc-api-id', metadataTarget)) {\n            throw new Error(\n                `Internal API ${metadataTarget.name || 'Unknown'} cannot use HTTP authorization decorators.`,\n            );\n        }\n        validateNoConflictingDecorators(metadataTarget, propertyKey as string);\n        Reflect.defineMetadata(METADATA_KEYS.AUTH_META, authMeta, metadataTarget, propertyKey);\n        const methods = new Set<string>(\n            Reflect.getMetadata(METADATA_KEYS.AUTH_METHODS, metadataTarget) || [],\n        );\n        methods.add(propertyKey as string);\n        Reflect.defineMetadata(METADATA_KEYS.AUTH_METHODS, [...methods], metadataTarget);\n    };\n}\n\n/**\n * @WpAuthPublic(reason) - endpoint intentionally requires no authentication.\n * The non-empty reason makes anonymous exposure an explicit review decision.\n */\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nexport function WpAuthPublic(reason: string): MethodDecorator {\n    if (typeof reason !== 'string' || reason.trim() === '') {\n        throw new Error(\n            '@WpAuthPublic requires a non-empty reason explaining why anonymous access is required.',\n        );\n    }\n    return defineAuthMetadata(new AuthMeta([{ kind: 'public' }], reason));\n}\n\n/** Protected network ingress: authenticate one declared credential, then authorize independently. */\n// webpieces-disable no-function-outside-class -- canonical method decorator factory\nexport function WpAuth(methods: AuthMethods): MethodDecorator {\n    return defineAuthMetadata(new AuthMeta(methods, undefined));\n}\n\n/** Locality is independent of authentication and cannot prove a user or machine identity. */\n// webpieces-disable no-function-outside-class -- canonical method decorator factory\nexport function WpLocalOnly(): MethodDecorator {\n    return (target: object, methodName: string | symbol) => {\n        if (methodName === undefined) throw new Error('@WpLocalOnly is method-only.');\n        Reflect.defineMetadata(METADATA_KEYS.LOCAL_ONLY, true, target.constructor, methodName);\n    };\n}\n\n// webpieces-disable no-function-outside-class -- canonical metadata reader\nexport function isLocalOnly(apiClass: Function, methodName: string): boolean {\n    return Reflect.getMetadata(METADATA_KEYS.LOCAL_ONLY, apiClass, methodName) === true;\n}\n\n// ============================================================\n// Helper functions\n// ============================================================\n\n/**\n * Get the base path from @ApiPath decorator.\n */\nexport function getApiPath(apiClass: Function): string | undefined {\n    return Reflect.getMetadata(METADATA_KEYS.API_PATH, apiClass);\n}\n\n/**\n * Get all endpoints from @Endpoint decorators.\n * Returns a record of methodName -> endpoint path.\n */\nexport function getEndpoints(apiClass: Function): Record<string, string> | undefined {\n    return Reflect.getMetadata(METADATA_KEYS.ENDPOINTS, apiClass);\n}\n\n/**\n * Every method's declared trigger kind, as `methodName -> kind`. Parallel to {@link getEndpoints}.\n * Empty for a class carrying no @Endpoint at all.\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpoints\nexport function getEndpointKinds(apiClass: Function): Record<string, EndpointKind> {\n    return Reflect.getMetadata(METADATA_KEYS.ENDPOINT_KIND, apiClass) || {};\n}\n\n/**\n * What triggers ONE method, or undefined when the method carries no @Endpoint.\n *\n * Defaults to nothing rather than to 'rpc': `kind` is a required argument, so a missing entry means\n * \"this is not an endpoint\", never \"an endpoint that forgot to say\". Silently defaulting here would\n * put an undeclared cron or webhook back into the graph as a normal rpc call — the exact blindness\n * the required argument exists to remove.\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpoints\nexport function getEndpointKind(apiClass: Function, methodName: string): EndpointKind | undefined {\n    return getEndpointKinds(apiClass)[methodName];\n}\n\n/** The required HTTP method for one endpoint. */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpointKind\nexport function getEndpointHttpMethod(apiClass: Function, methodName: string): HttpMethod {\n    const methods: Record<string, HttpMethod> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_HTTP_METHOD, apiClass) || {};\n    const method = methods[methodName];\n    if (!isHttpMethod(method)) {\n        throw new Error(\n            `@Endpoint ${apiClass.name || 'Unknown'}.${methodName} must declare one of ${HTTP_METHODS.join(', ')}.`,\n        );\n    }\n    return method;\n}\n\n/**\n * Get the @Endpoint options for one method (empty object if the method had no options).\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpoints\nexport function getEndpointOptions(apiClass: Function, methodName: string): EndpointOptions {\n    const opts: Record<string, EndpointOptions> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_OPTIONS, apiClass) || {};\n    const options = opts[methodName];\n    if (!options && getEndpoints(apiClass)?.[methodName] === undefined) {\n        // Preserve the historical helper behavior for a method that is not an endpoint at all.\n        return {} as EndpointOptions;\n    }\n    return options ?? {};\n}\n\n/** Read one endpoint's required side-effect semantics. */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpointOptions\nexport function getEndpointOperation(apiClass: Function, methodName: string): EndpointOperation {\n    const operations: Record<string, EndpointOperation> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_OPERATION, apiClass) || {};\n    const operation = operations[methodName];\n    if (!isEndpointOperation(operation)) {\n        throw new Error(\n            `@Endpoint ${apiClass.name || 'Unknown'}.${methodName} must declare READ, ` +\n                'WRITE_IDEMPOTENT, or WRITE.',\n        );\n    }\n    return operation;\n}\n\n// webpieces-disable no-function-outside-class -- runtime backstop for JavaScript and `as any` callers; webpieces-disable no-any-unknown -- untrusted runtime value is narrowed to an endpoint operation\nfunction isEndpointOperation(value: unknown): value is EndpointOperation {\n    return (\n        value === READ ||\n        value === WRITE_IDEMPOTENT ||\n        value === WRITE\n    );\n}\n\n// webpieces-disable no-function-outside-class -- runtime backstop for JavaScript and `as any` callers; webpieces-disable no-any-unknown -- untrusted runtime value is narrowed to an endpoint kind\nfunction isEndpointKind(value: unknown): value is EndpointKind {\n    return (\n        value === RPC ||\n        value === CLOUDTASKS ||\n        value === CRON ||\n        value === EXTERNAL_INBOUND ||\n        value === EXTERNAL_OUTBOUND\n    );\n}\n\n/**\n * Fail-fast at wiring time on the two EXTERNAL_* rules, called by `RouteMetadataFactory` for every\n * transport (server routes and every client). The {@link Endpoint} overloads already make a missing\n * `calledBy` a COMPILE error; this is the backstop for the ways TS is bypassed — a JS caller, an\n * `as any` options object, a hand-rolled Reflect.defineMetadata. The second rule cannot be a type:\n * \"every method of this class\" spans several decorators.\n *\n * @throws Error naming the first EXTERNAL_INBOUND endpoint with no `calledBy`, or the first method of\n * a contract that mixes EXTERNAL_OUTBOUND with any other kind.\n */\n// webpieces-disable no-function-outside-class -- wiring-time assert, sibling of assertEveryEndpointHasAuthMode\nexport function assertExternalEndpointKinds(apiClass: Function): void {\n    const kinds = getEndpointKinds(apiClass);\n    const apiName = apiClass.name || 'Unknown';\n    const methods = Object.keys(kinds);\n    const outbound = methods.filter((methodName: string) => kinds[methodName] === EXTERNAL_OUTBOUND);\n    if (outbound.length > 0 && outbound.length !== methods.length) {\n        const other = methods.find((methodName: string) => kinds[methodName] !== EXTERNAL_OUTBOUND)!;\n        throw new Error(\n            `${apiName} mixes EXTERNAL_OUTBOUND (${outbound[0]}) with ${String(kinds[other]).toUpperCase()} (${other}). ` +\n                `An EXTERNAL_OUTBOUND contract is an outside system's API that no server in this repo implements, so ` +\n                `EVERY method of it must be EXTERNAL_OUTBOUND; move the other methods to their own contract.`,\n        );\n    }\n    for (const methodName of methods) {\n        if (kinds[methodName] !== EXTERNAL_INBOUND || getEndpointCaller(apiClass, methodName) !== undefined)\n            continue;\n        throw new Error(\n            `External endpoint '${methodName}' in ${apiName} declares no caller. Say WHO ` +\n                `posts to it: @Endpoint(POST, path, WRITE, EXTERNAL_INBOUND, { calledBy: '<vendor>' }) — the runtime architecture ` +\n                `graph cannot name an inbound caller it was never told about.`,\n        );\n    }\n}\n\n/** True when the contract is an outside system's API: every method is EXTERNAL_OUTBOUND. */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpointKinds\nexport function isExternalOutboundApi(apiClass: Function): boolean {\n    const kinds = Object.values(getEndpointKinds(apiClass));\n    return kinds.length > 0 && kinds.every((kind: EndpointKind) => kind === EXTERNAL_OUTBOUND);\n}\n\n/**\n * True when the method's @Endpoint declared `{ formPost: true }` — its body is\n * application/x-www-form-urlencoded (flat), not JSON.\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpoints\nexport function isFormPost(apiClass: Function, methodName: string): boolean {\n    return getEndpointOptions(apiClass, methodName).formPost === true;\n}\n\n/**\n * True when the method's @Endpoint declared `{ rawBody: true }` — the transport must retain the\n * verbatim bytes + absolute url for a `VendorAuthHook.verify` to check.\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of isFormPost\nexport function isRawBody(apiClass: Function, methodName: string): boolean {\n    return getEndpointOptions(apiClass, methodName).rawBody === true;\n}\n\n/**\n * Fail-fast at wiring time when a SERVED `vendorAuth(...)` endpoint did not ask the transport to keep the\n * bytes it is supposed to verify. A hook with nothing to verify is a MISCONFIGURATION, and it must\n * surface at startup, naming the fix — not as a 401 in production on exactly the traffic the endpoint\n * exists for.\n *\n * This pairing is a runtime assert rather than a type because the two halves live on DIFFERENT\n * decorators (`vendorAuth(...)` and `@Endpoint`), and no union over one decorator's argument can say\n * anything about the other's.\n *\n * @throws Error naming the first `vendorAuth(...)` endpoint missing `{ rawBody: true }`.\n */\n// webpieces-disable no-function-outside-class -- wiring-time assert, sibling of assertEveryEndpointHasAuthMode\nexport function assertEveryVendorAuthEndpointRetainsRawBody(apiClass: Function): void {\n    const endpoints = getEndpoints(apiClass) || {};\n    for (const methodName of Object.keys(endpoints)) {\n        if (\n            !getAuthMeta(apiClass, methodName)?.methods.some((method: AuthMode) => method.kind === 'vendorAuth') ||\n            isRawBody(apiClass, methodName)\n        )\n            continue;\n        throw new Error(\n            `Endpoint '${methodName}' in ${apiClass.name || 'Unknown'} is vendorAuth(...) but its @Endpoint ` +\n                `does not declare { rawBody: true }. VendorAuthHook.verify checks a credential over the bytes and ` +\n                `the url the SENDER transmitted, and without that option the transport parses the body and ` +\n                `throws them away — leaving the hook nothing to check.`,\n        );\n    }\n}\n\n/**\n * Check if a class has @ApiPath decorator.\n */\nexport function isApiPath(apiClass: Function): boolean {\n    return Reflect.hasMetadata(METADATA_KEYS.API_PATH, apiClass);\n}\n\n/**\n * Get method-level auth metadata. Class-level authorization is forbidden.\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader paired with the decorator API\nexport function getAuthMeta(apiClass: Function, methodName: string): AuthMeta | undefined {\n    return Reflect.getMetadata(METADATA_KEYS.AUTH_META, apiClass, methodName);\n}\n\n/**\n * The ONE prescription for \"this endpoint declares no auth\", shared by the two places that raise it\n * (here and http-routing's ApiRoutingFactory) because they had drifted into teaching different menus.\n * A message teaching an incomplete API is the same defect as an API with two spellings: whichever menu\n * the caller hits becomes the API they believe exists. It leads with the ROLE-GATED member on purpose —\n * the first thing offered should not be the widest grant.\n */\nexport const MISSING_AUTH_DECORATOR_FIX =\n    \"Declare @WpAuth([jwt(), oidcSameProject() or oidcSvcs(['svc-a']), sharedSecret(key), vendorAuth(name), apiKey('regime', [{in: 'header', key: MyKeys.API_KEY}])]) \" +\n    \"or @WpAuthPublic('reason'), and exactly one @WpAuthorization on every endpoint. Add @WpLocalOnly() separately when locality is required.\";\n\n/**\n * Fail-fast at wiring time if any endpoint lacks an auth mode. Both the server\n * (ApiRoutingFactory) and the task/rpc clients call this so a missing auth\n * decorator is a startup error, never a silent open endpoint.\n * @throws Error naming the first endpoint with no auth decorator, via {@link MISSING_AUTH_DECORATOR_FIX}.\n */\nexport function assertEveryEndpointHasAuthMode(apiClass: Function): void {\n    const apiName = apiClass.name || 'Unknown';\n    const endpoints = getEndpoints(apiClass) || {};\n    for (const methodName of Object.keys(endpoints)) {\n        if (!getAuthMeta(apiClass, methodName)) {\n            throw new Error(\n                `Endpoint '${methodName}' in ${apiName} has no auth decorator. ` +\n                    MISSING_AUTH_DECORATOR_FIX,\n            );\n        }\n        const policy = getAuthorization(apiClass, methodName);\n        if (!policy) throw new Error(`Endpoint '${methodName}' in ${apiName} requires @WpAuthorization.`);\n        AuthorizationDeclaration.validate(policy);\n        const auth = getAuthMeta(apiClass, methodName)!;\n        const isPublic = auth.methods.some((method: AuthMode) => method.kind === 'public');\n        if (isPublic !== (policy.authType === AuthorizationType.ANONYMOUS)) {\n            throw new Error(`Endpoint '${methodName}' must pair public authentication with ANONYMOUS authorization, or protected authentication with protected/CUSTOM authorization.`);\n        }\n    }\n    const policyMethods: string[] = Reflect.getMetadata(AUTHORIZATION_METHODS_KEY, apiClass) ?? [];\n    for (const methodName of policyMethods) {\n        if (!(methodName in endpoints)) throw new Error(`Orphan @WpAuthorization on ${apiName}.${methodName}; declare @Endpoint.`);\n    }\n}\n\n/**\n * Validate that a class/method doesn't have conflicting auth decorators.\n * @throws Error if multiple auth decorators are found on the same target.\n */\n// webpieces-disable no-function-outside-class -- shared decorator metadata validation\nexport function validateNoConflictingDecorators(\n    apiClass: Function,\n    methodName: string | undefined,\n): void {\n    const existing = methodName\n        ? Reflect.getMetadata(METADATA_KEYS.AUTH_META, apiClass, methodName)\n        : Reflect.getMetadata(METADATA_KEYS.AUTH_META, apiClass);\n\n    if (existing) {\n        const targetName = apiClass.name || 'Unknown';\n        const location = methodName\n            ? `method '${methodName}' of ${targetName}`\n            : `class ${targetName}`;\n        throw new Error(\n            `Conflicting auth decorator on ${location}. ` +\n                `Exactly one @WpAuth([...]) or @WpAuthPublic('reason') is allowed per endpoint.`,\n        );\n    }\n}\n"]}
+{"version":3,"file":"decorators.js","sourceRoot":"","sources":["../../../../../../packages/core/core-util/src/http/decorators.ts"],"names":[],"mappings":";;;AAuGA,0BAcC;AAgCD,4BAqBC;AAgFD,0BAUC;AAOD,kCAIC;AAqCD,oCAOC;AAID,wBAEC;AAID,kCAKC;AAGD,kCAEC;AASD,gCAEC;AAMD,oCAEC;AAOD,4CAEC;AAWD,0CAEC;AAID,sDAUC;AAMD,gDASC;AAID,oDAWC;AAiCD,kEAsBC;AAID,sDAGC;AAOD,gCAEC;AAOD,8BAEC;AAeD,kGAeC;AAKD,8BAEC;AAMD,kCAEC;AAmBD,wEAuBC;AAOD,0EAkBC;AApmBD,4BAA0B;AAC1B,iDAAoD;AACpD,uDAK2B;AAC3B,4FAA4F;AAC5F,2CAA8D;AAC9D,+DAQ+B;AAC/B,iDAAwE;AACxE,mDAA2H;AAC3H,2EAA2E;AAI3E,6DAA4E;AAAnE,2GAAA,IAAI,OAAA;AAAE,uHAAA,gBAAgB,OAAA;AAAE,4GAAA,KAAK,OAAA;AAAE,2GAAA,IAAI,OAAA;AAG5C,+CAA+D;AAAtD,mGAAA,GAAG,OAAA;AAAE,oGAAA,IAAI,OAAA;AAAE,mGAAA,GAAG,OAAA;AAAE,qGAAA,KAAK,OAAA;AAAE,sGAAA,MAAM,OAAA;AACtC,yEAA+G;AAAtG,sHAAA,SAAS,OAAA;AAAE,uHAAA,UAAU,OAAA;AAAE,wHAAA,WAAW,OAAA;AAAE,yIAAA,4BAA4B,OAAA;AAEzE;;;GAGG;AACU,QAAA,aAAa,GAAG;IACzB,QAAQ,EAAE,oBAAoB;IAC9B,SAAS,EAAE,qBAAqB;IAChC,SAAS,EAAE,qBAAqB;IAChC,2EAA2E;IAC3E,YAAY,EAAE,wBAAwB;IACtC,uFAAuF;IACvF,QAAQ,EAAE,oBAAoB;IAC9B,mEAAmE;IACnE,cAAc,EAAE,0BAA0B;IAC1C,2EAA2E;IAC3E,gBAAgB,EAAE,4BAA4B;IAC9C,8DAA8D;IAC9D,oBAAoB,EAAE,gCAAgC;IACtD,uEAAuE;IACvE,kBAAkB,EAAE,8BAA8B;IAClD,iIAAiI;IACjI,aAAa,EAAE,yBAAyB;IACxC,qGAAqG;IACrG,eAAe,EAAE,qCAAmB;IACpC,6EAA6E;IAC7E,QAAQ,EAAE,oBAAoB;IAC9B,gFAAgF;IAChF,SAAS,EAAE,qBAAqB;IAChC,6FAA6F;IAC7F,WAAW,EAAE,uBAAuB;IACpC,iFAAiF;IACjF,gBAAgB,EAAE,4BAA4B;IAC9C,oFAAoF;IACpF,UAAU,EAAE,sBAAsB;IAClC,uFAAuF;IACvF,eAAe,EAAE,wDAA4B;CAChD,CAAC;AAEF,8EAA8E;AAC9E,IAAK,iBAMJ;AAND,WAAK,iBAAiB;IAClB,gCAAW,CAAA;IACX,8CAAyB,CAAA;IACzB,kCAAa,CAAA;IACb,0DAAqC,CAAA;IACrC,4DAAuC,CAAA;AAC3C,CAAC,EANI,iBAAiB,KAAjB,iBAAiB,QAMrB;AAED,wDAAwD;AAC3C,QAAA,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC;AAC5B,QAAA,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC;AAC1C,QAAA,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC;AAC3C;;;GAGG;AACU,QAAA,gBAAgB,GAAG,iBAAiB,CAAC,gBAAgB,CAAC;AACnE;;;;GAIG;AACU,QAAA,iBAAiB,GAAG,iBAAiB,CAAC,iBAAiB,CAAC;AAUrE,wEAAwE;AACxE,SAAgB,OAAO,CAAC,QAAgB;IACpC,OAAO,CAAC,MAAgB,EAAE,EAAE;QACxB,IAAI,OAAO,CAAC,WAAW,CAAC,sBAAsB,EAAE,MAAM,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CACX,SAAS,MAAM,CAAC,IAAI,IAAI,SAAS,4CAA4C,CAChF,CAAC;QACN,CAAC;QACD,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEjE,yCAAyC;QACzC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;IACL,CAAC,CAAC;AACN,CAAC;AA+BD,2GAA2G;AAC3G,SAAgB,QAAQ,CACpB,UAAsB,EACtB,IAAY,EACZ,SAA4B,EAC5B,IAAkB,EAClB,UAA2B,EAAE;IAE7B,8BAA8B,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAC5D,kFAAkF;IAClF,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,WAA+B,EAAE,EAAE;QAClF,MAAM,cAAc,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QAClF,sBAAsB,CAClB,cAAc,EACd,WAAqB,EACrB,UAAU,EACV,IAAI,EACJ,SAAS,EACT,IAAI,EACJ,OAAO,CACV,CAAC;IACN,CAAC,CAAC;AACN,CAAC;AAED,8FAA8F;AAC9F,SAAS,8BAA8B,CACnC,UAAsB,EACtB,SAA4B,EAC5B,IAAkB;IAElB,IAAI,CAAC,IAAA,2BAAY,EAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACX,uCAAuC,2BAAY,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,UAAU,CAAC,IAAI,CACtG,CAAC;IACN,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACX,2EAA2E,MAAM,CAAC,SAAS,CAAC,IAAI,CACnG,CAAC;IACN,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACX,sGAAsG,MAAM,CAAC,IAAI,CAAC,IAAI,CACzH,CAAC;IACN,CAAC;AACL,CAAC;AAED,sGAAsG;AACtG,SAAS,sBAAsB,CAC3B,cAAwB,EACxB,WAAmB,EACnB,UAAsB,EACtB,IAAY,EACZ,SAA4B,EAC5B,IAAkB,EAClB,OAAwB;IAExB,MAAM,SAAS,GACX,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAEvE,SAAS,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;IAE9B,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;IAE3E,MAAM,OAAO,GACT,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,oBAAoB,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAClF,OAAO,CAAC,WAAW,CAAC,GAAG,UAAU,CAAC;IAClC,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,oBAAoB,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAEpF,MAAM,UAAU,GACZ,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,kBAAkB,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAChF,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IACpC,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,kBAAkB,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAErF,MAAM,KAAK,GACP,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,aAAa,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAC3E,KAAK,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,aAAa,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAE3E,MAAM,IAAI,GACN,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,gBAAgB,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAC9E,IAAI,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;IAC5B,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,gBAAgB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IAE7E,MAAM,QAAQ,GAAG,OAAkC,CAAC;IACpD,IACI,IAAI,KAAK,wBAAgB;QACzB,OAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ;QACrC,QAAQ,CAAC,QAAQ,KAAK,EAAE;QAExB,OAAO;IACX,MAAM,OAAO,GACT,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,eAAe,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;IAC7E,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,gCAAc,CACrC,QAAQ,CAAC,UAAU,IAAI,qCAAmB,EAC1C,QAAQ,CAAC,QAAQ,CACpB,CAAC;IACF,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,eAAe,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;AACnF,CAAC;AAED,yFAAyF;AACzF,2GAA2G;AAC3G,SAAgB,OAAO,CAAC,MAAgC;IACpD,MAAM,IAAI,GAAG,IAAI,uBAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,kFAAkF;IAClF,OAAO,CAAC,MAAW,EAAE,WAA4B,EAAE,WAA+B,EAAE,EAAE;QAClF,MAAM,cAAc,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QAClF,MAAM,KAAK,GACP,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;QACtE,KAAK,CAAC,WAAqB,CAAC,GAAG,IAAI,CAAC;QACpC,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;IAC1E,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,wGAAwG;AACxG,SAAgB,WAAW,CAAC,QAAkB,EAAE,UAAkB;IAC9D,MAAM,KAAK,GACP,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChE,OAAO,KAAK,CAAC,UAAU,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,2GAA2G;AAC3G,SAAS,kBAAkB,CAAC,QAAkB;IAE1C,kFAAkF;IAClF,OAAO,CAAC,MAAW,EAAE,WAA6B,EAAE,WAAgC,EAAE,EAAE;QACpF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACX,gFAAgF,CACnF,CAAC;QACN,CAAC;QACD,MAAM,cAAc,GAAG,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;QAClF,IAAI,OAAO,CAAC,WAAW,CAAC,sBAAsB,EAAE,cAAc,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACX,gBAAgB,cAAc,CAAC,IAAI,IAAI,SAAS,4CAA4C,CAC/F,CAAC;QACN,CAAC;QACD,+BAA+B,CAAC,cAAc,EAAE,WAAqB,CAAC,CAAC;QACvE,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,IAAI,GAAG,CACnB,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,EAAE,CACxE,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,WAAqB,CAAC,CAAC;QACnC,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;IACrF,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,2GAA2G;AAC3G,SAAgB,YAAY,CAAC,MAAc;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACX,wFAAwF,CAC3F,CAAC;IACN,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,oBAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,qGAAqG;AACrG,oFAAoF;AACpF,SAAgB,MAAM,CAAC,OAAoB;IACvC,OAAO,kBAAkB,CAAC,IAAI,oBAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,6FAA6F;AAC7F,oFAAoF;AACpF,SAAgB,WAAW;IACvB,OAAO,CAAC,MAAc,EAAE,UAA2B,EAAE,EAAE;QACnD,IAAI,UAAU,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9E,OAAO,CAAC,cAAc,CAAC,qBAAa,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAC3F,CAAC,CAAC;AACN,CAAC;AAED,2EAA2E;AAC3E,SAAgB,WAAW,CAAC,QAAkB,EAAE,UAAkB;IAC9D,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC;AACxF,CAAC;AAED,+DAA+D;AAC/D,mBAAmB;AACnB,+DAA+D;AAE/D;;GAEG;AACH,SAAgB,UAAU,CAAC,QAAkB;IACzC,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,QAAkB;IAC3C,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,kGAAkG;AAClG,SAAgB,gBAAgB,CAAC,QAAkB;IAC/C,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;GAOG;AACH,kGAAkG;AAClG,SAAgB,eAAe,CAAC,QAAkB,EAAE,UAAkB;IAClE,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AAED,iDAAiD;AACjD,qGAAqG;AACrG,SAAgB,qBAAqB,CAAC,QAAkB,EAAE,UAAkB;IACxE,MAAM,OAAO,GACT,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,oBAAoB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnC,IAAI,CAAC,IAAA,2BAAY,EAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACX,aAAa,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,wBAAwB,2BAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1G,CAAC;IACN,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,kGAAkG;AAClG,SAAgB,kBAAkB,CAAC,QAAkB,EAAE,UAAkB;IACrE,MAAM,IAAI,GACN,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,gBAAgB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,CAAC,OAAO,IAAI,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;QACjE,uFAAuF;QACvF,OAAO,EAAqB,CAAC;IACjC,CAAC;IACD,OAAO,OAAO,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,0DAA0D;AAC1D,wGAAwG;AACxG,SAAgB,oBAAoB,CAAC,QAAkB,EAAE,UAAkB;IACvE,MAAM,UAAU,GACZ,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,kBAAkB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACX,aAAa,QAAQ,CAAC,IAAI,IAAI,SAAS,IAAI,UAAU,sBAAsB;YACvE,6BAA6B,CACpC,CAAC;IACN,CAAC;IACD,OAAO,SAAS,CAAC;AACrB,CAAC;AAED,wMAAwM;AACxM,SAAS,mBAAmB,CAAC,KAAc;IACvC,OAAO,CACH,KAAK,KAAK,0BAAI;QACd,KAAK,KAAK,sCAAgB;QAC1B,KAAK,KAAK,2BAAK,CAClB,CAAC;AACN,CAAC;AAED,mMAAmM;AACnM,SAAS,cAAc,CAAC,KAAc;IAClC,OAAO,CACH,KAAK,KAAK,WAAG;QACb,KAAK,KAAK,kBAAU;QACpB,KAAK,KAAK,YAAI;QACd,KAAK,KAAK,wBAAgB;QAC1B,KAAK,KAAK,yBAAiB,CAC9B,CAAC;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,+GAA+G;AAC/G,SAAgB,2BAA2B,CAAC,QAAkB;IAC1D,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,yBAAiB,CAAC,CAAC;IACjG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,yBAAiB,CAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CACX,GAAG,OAAO,6BAA6B,QAAQ,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,KAAK;YACzG,sGAAsG;YACtG,6FAA6F,CACpG,CAAC;IACN,CAAC;IACD,KAAK,MAAM,UAAU,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,wBAAgB,IAAI,IAAA,mCAAiB,EAAC,QAAQ,EAAE,UAAU,CAAC,KAAK,SAAS;YAC/F,SAAS;QACb,MAAM,IAAI,KAAK,CACX,sBAAsB,UAAU,QAAQ,OAAO,+BAA+B;YAC1E,mHAAmH;YACnH,8DAA8D,CACrE,CAAC;IACN,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,sGAAsG;AACtG,SAAgB,qBAAqB,CAAC,QAAkB;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAkB,EAAE,EAAE,CAAC,IAAI,KAAK,yBAAiB,CAAC,CAAC;AAC/F,CAAC;AAED;;;GAGG;AACH,kGAAkG;AAClG,SAAgB,UAAU,CAAC,QAAkB,EAAE,UAAkB;IAC7D,OAAO,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,gGAAgG;AAChG,SAAgB,SAAS,CAAC,QAAkB,EAAE,UAAkB;IAC5D,OAAO,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,+GAA+G;AAC/G,SAAgB,2CAA2C,CAAC,QAAkB;IAC1E,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,IACI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC;YACpG,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC;YAE/B,SAAS;QACb,MAAM,IAAI,KAAK,CACX,aAAa,UAAU,QAAQ,QAAQ,CAAC,IAAI,IAAI,SAAS,wCAAwC;YAC7F,mGAAmG;YACnG,4FAA4F;YAC5F,uDAAuD,CAC9D,CAAC;IACN,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,SAAS,CAAC,QAAkB;IACxC,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,uGAAuG;AACvG,SAAgB,WAAW,CAAC,QAAkB,EAAE,UAAkB;IAC9D,OAAO,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACU,QAAA,0BAA0B,GACnC,mKAAmK;IACnK,0IAA0I,CAAC;AAE/I;;;;;GAKG;AACH,SAAgB,8BAA8B,CAAC,QAAkB;IAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;IAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACX,aAAa,UAAU,QAAQ,OAAO,0BAA0B;gBAC5D,kCAA0B,CACjC,CAAC;QACN,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,gCAAgB,EAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,QAAQ,OAAO,6BAA6B,CAAC,CAAC;QAClG,wCAAwB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAgB,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACnF,IAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,iCAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,aAAa,UAAU,kIAAkI,CAAC,CAAC;QAC/K,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAa,OAAO,CAAC,WAAW,CAAC,yCAAyB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/F,KAAK,MAAM,UAAU,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,IAAI,UAAU,sBAAsB,CAAC,CAAC;IAC/H,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,sFAAsF;AACtF,SAAgB,+BAA+B,CAC3C,QAAkB,EAClB,UAA8B;IAE9B,MAAM,QAAQ,GAAG,UAAU;QACvB,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,CAAC;QACpE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,qBAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE7D,IAAI,QAAQ,EAAE,CAAC;QACX,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;QAC9C,MAAM,QAAQ,GAAG,UAAU;YACvB,CAAC,CAAC,WAAW,UAAU,QAAQ,UAAU,EAAE;YAC3C,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACX,iCAAiC,QAAQ,IAAI;YACzC,gFAAgF,CACvF,CAAC;IACN,CAAC;AACL,CAAC","sourcesContent":["import 'reflect-metadata';\nimport { MaskSpec, MaskMode } from './LogFieldMask';\nimport {\n    DEFAULT_CALLER_KIND,\n    ENDPOINT_CALLER_KEY,\n    ExternalCaller,\n    getEndpointCaller,\n} from './external-caller';\n// The TYPE layer these decorators attach — split out for file size only (see auth-mode.ts).\nimport { AuthMeta, AuthMethods, AuthMode } from './auth-mode';\nimport {\n    EndpointOperation,\n    EndpointOptions,\n    ExternalEndpointOptions,\n    NoResponseBodyOptionEndpointOptions,\n    READ,\n    WRITE_IDEMPOTENT,\n    WRITE,\n} from './HttpEndpointOptions';\nimport { HTTP_METHODS, HttpMethod, isHttpMethod } from './HttpContract';\nimport { AuthorizationDeclaration, AuthorizationType, AUTHORIZATION_METHODS_KEY, getAuthorization } from './authorization';\nimport { HTTP_PARAMETERS_METADATA_KEY } from './http-parameter-decorators';\n\nexport type { EndpointOptions, ExternalEndpointOptions, NoResponseBodyOptionEndpointOptions } from './HttpEndpointOptions';\nexport type { EndpointOperation } from './HttpEndpointOptions';\nexport { READ, WRITE_IDEMPOTENT, WRITE, NONE } from './HttpEndpointOptions';\nexport type { ResponseBodyKind } from './HttpEndpointOptions';\nexport type { HttpMethod } from './HttpContract';\nexport { GET, POST, PUT, PATCH, DELETE } from './HttpContract';\nexport { PathParam, QueryParam, QueryString, getHttpParameterDeclarations } from './http-parameter-decorators';\n\n/**\n * Metadata keys for storing API routing information.\n * These keys are used by both server-side (routing) and client-side (client generation).\n */\nexport const METADATA_KEYS = {\n    API_PATH: 'webpieces:api-path',\n    ENDPOINTS: 'webpieces:endpoints',\n    AUTH_META: 'webpieces:auth-meta',\n    /** Method names carrying one of the canonical authorization decorators. */\n    AUTH_METHODS: 'webpieces:auth-methods',\n    /** 'rpc' (default, sync request/response) vs 'pubsub' (fire-and-forget cloud task). */\n    API_KIND: 'webpieces:api-kind',\n    /** Per-method Cloud Tasks queue-name override (set via @Queue). */\n    QUEUE_OVERRIDE: 'webpieces:queue-override',\n    /** Per-method @Endpoint options (e.g. formPost), parallel to ENDPOINTS. */\n    ENDPOINT_OPTIONS: 'webpieces:endpoint-options',\n    /** Per-method required HTTP method, parallel to ENDPOINTS. */\n    ENDPOINT_HTTP_METHOD: 'webpieces:endpoint-http-method',\n    /** Per-method required read/write semantics, parallel to ENDPOINTS. */\n    ENDPOINT_OPERATION: 'webpieces:endpoint-operation',\n    /** Per-method @Endpoint trigger kind (rpc | cloudtasks | cron | external-inbound | external-outbound), parallel to ENDPOINTS. */\n    ENDPOINT_KIND: 'webpieces:endpoint-kind',\n    /** Per-method declared external CALLER (only for kind 'external-inbound'), parallel to ENDPOINTS. */\n    ENDPOINT_CALLER: ENDPOINT_CALLER_KEY,\n    /** Per-method @MaskLog spec (which DTO fields the LogApiCall path masks). */\n    MASK_LOG: 'webpieces:mask-log',\n    /** Per-method opt-in metadata for publishing an RPC endpoint as an MCP tool. */\n    MCP_TOOLS: 'webpieces:mcp-tools',\n    /** Per-method PERMANENT exclusion from MCP, with the reason — see @InvalidEndpointForMcp. */\n    MCP_INVALID: 'webpieces:mcp-invalid',\n    /** Per-method request/response event metadata for a typed streaming endpoint. */\n    STREAM_ENDPOINTS: 'webpieces:stream-endpoints',\n    /** Per-method MCP-user authorization, intentionally separate from HTTP hop auth. */\n    LOCAL_ONLY: 'webpieces:local-only',\n    /** Per-method explicit path/query parameter declarations, keyed by parameter index. */\n    HTTP_PARAMETERS: HTTP_PARAMETERS_METADATA_KEY,\n};\n\n/** Nominal backing keeps raw string literals out of endpoint declarations. */\nenum EndpointKindValue {\n    RPC = 'rpc',\n    CLOUDTASKS = 'cloudtasks',\n    CRON = 'cron',\n    EXTERNAL_INBOUND = 'external-inbound',\n    EXTERNAL_OUTBOUND = 'external-outbound',\n}\n\n/** Short, statically importable decorator arguments. */\nexport const RPC = EndpointKindValue.RPC;\nexport const CLOUDTASKS = EndpointKindValue.CLOUDTASKS;\nexport const CRON = EndpointKindValue.CRON;\n/**\n * An OUTSIDE system calls US (a vendor webhook, a push subscription). Requires `calledBy`, which names\n * that system on the runtime architecture graph.\n */\nexport const EXTERNAL_INBOUND = EndpointKindValue.EXTERNAL_INBOUND;\n/**\n * WE call an OUTSIDE system (a vendor API, a partner's webhook receiver). No server in this repo\n * implements it, every method of the contract must be this kind, and the client sends ONLY the\n * context keys listed with `@ExternalContextKeys(...)` and merges no response header into our context.\n */\nexport const EXTERNAL_OUTBOUND = EndpointKindValue.EXTERNAL_OUTBOUND;\n\n/** Runtime trigger/delivery owner used by validation, architecture, and infrastructure tooling. */\nexport type EndpointKind =\n    | typeof RPC\n    | typeof CLOUDTASKS\n    | typeof CRON\n    | typeof EXTERNAL_INBOUND\n    | typeof EXTERNAL_OUTBOUND;\n\n/** Class decorator that sets the shared base path for all endpoints. */\nexport function ApiPath(basePath: string): ClassDecorator {\n    return (target: Function) => {\n        if (Reflect.hasMetadata('webpieces:ipc-api-id', target)) {\n            throw new Error(\n                `Class ${target.name || 'Unknown'} cannot combine @ApiPath with @WpInternal.`,\n            );\n        }\n        Reflect.defineMetadata(METADATA_KEYS.API_PATH, basePath, target);\n\n        // Initialize endpoints map if not exists\n        if (!Reflect.hasMetadata(METADATA_KEYS.ENDPOINTS, target)) {\n            Reflect.defineMetadata(METADATA_KEYS.ENDPOINTS, {}, target);\n        }\n    };\n}\n\n/**\n * Registers `@Endpoint(POST, path, WRITE, RPC)`. Method, operation, and trigger are required enum\n * values. Operation is independent of the HTTP verb. EXTERNAL_INBOUND additionally requires `calledBy`.\n * Each classification rides a parallel metadata map while ENDPOINTS remains method-name -> path.\n */\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nexport function Endpoint(\n    httpMethod: HttpMethod,\n    path: string,\n    operation: EndpointOperation,\n    kind: typeof EXTERNAL_INBOUND,\n    options: ExternalEndpointOptions,\n): MethodDecorator;\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nexport function Endpoint(\n    httpMethod: HttpMethod,\n    path: string,\n    operation: EndpointOperation,\n    kind: typeof CLOUDTASKS | typeof CRON | typeof EXTERNAL_OUTBOUND,\n    options?: NoResponseBodyOptionEndpointOptions,\n): MethodDecorator;\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nexport function Endpoint(\n    httpMethod: HttpMethod,\n    path: string,\n    operation: EndpointOperation,\n    kind: typeof RPC,\n    options?: EndpointOptions,\n): MethodDecorator;\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nexport function Endpoint(\n    httpMethod: HttpMethod,\n    path: string,\n    operation: EndpointOperation,\n    kind: EndpointKind,\n    options: EndpointOptions = {},\n): MethodDecorator {\n    validateEndpointClassification(httpMethod, operation, kind);\n    // webpieces-disable no-any-unknown -- reflect-metadata decorator API requires any\n    return (target: any, propertyKey: string | symbol, _descriptor: PropertyDescriptor) => {\n        const metadataTarget = typeof target === 'function' ? target : target.constructor;\n        recordEndpointMetadata(\n            metadataTarget,\n            propertyKey as string,\n            httpMethod,\n            path,\n            operation,\n            kind,\n            options,\n        );\n    };\n}\n\n// webpieces-disable no-function-outside-class -- runtime validation backs up nominal TS enums\nfunction validateEndpointClassification(\n    httpMethod: HttpMethod,\n    operation: EndpointOperation,\n    kind: EndpointKind,\n): void {\n    if (!isHttpMethod(httpMethod)) {\n        throw new Error(\n            `@Endpoint httpMethod must be one of ${HTTP_METHODS.join(', ')}, received '${String(httpMethod)}'.`,\n        );\n    }\n    if (!isEndpointOperation(operation)) {\n        throw new Error(\n            `@Endpoint operation must be READ, WRITE_IDEMPOTENT, or WRITE, received '${String(operation)}'.`,\n        );\n    }\n    if (!isEndpointKind(kind)) {\n        throw new Error(\n            `@Endpoint trigger must be RPC, CLOUDTASKS, CRON, EXTERNAL_INBOUND, or EXTERNAL_OUTBOUND, received '${String(kind)}'.`,\n        );\n    }\n}\n\n// webpieces-disable no-function-outside-class -- one metadata write shared by the decorator overloads\nfunction recordEndpointMetadata(\n    metadataTarget: Function,\n    propertyKey: string,\n    httpMethod: HttpMethod,\n    path: string,\n    operation: EndpointOperation,\n    kind: EndpointKind,\n    options: EndpointOptions,\n): void {\n    const endpoints: Record<string, string> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINTS, metadataTarget) || {};\n\n    endpoints[propertyKey] = path;\n\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINTS, endpoints, metadataTarget);\n\n    const methods: Record<string, HttpMethod> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_HTTP_METHOD, metadataTarget) || {};\n    methods[propertyKey] = httpMethod;\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINT_HTTP_METHOD, methods, metadataTarget);\n\n    const operations: Record<string, EndpointOperation> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_OPERATION, metadataTarget) || {};\n    operations[propertyKey] = operation;\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINT_OPERATION, operations, metadataTarget);\n\n    const kinds: Record<string, EndpointKind> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_KIND, metadataTarget) || {};\n    kinds[propertyKey] = kind;\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINT_KIND, kinds, metadataTarget);\n\n    const opts: Record<string, EndpointOptions> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_OPTIONS, metadataTarget) || {};\n    opts[propertyKey] = options;\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINT_OPTIONS, opts, metadataTarget);\n\n    const declared = options as ExternalEndpointOptions;\n    if (\n        kind !== EXTERNAL_INBOUND ||\n        typeof declared.calledBy !== 'string' ||\n        declared.calledBy === ''\n    )\n        return;\n    const callers: Record<string, ExternalCaller> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_CALLER, metadataTarget) || {};\n    callers[propertyKey] = new ExternalCaller(\n        declared.callerKind ?? DEFAULT_CALLER_KIND,\n        declared.calledBy,\n    );\n    Reflect.defineMetadata(METADATA_KEYS.ENDPOINT_CALLER, callers, metadataTarget);\n}\n\n/** Declares request/response DTO field names that API logging must mask at any depth. */\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nexport function MaskLog(fields: Record<string, MaskMode>): MethodDecorator {\n    const spec = new MaskSpec(fields);\n    // webpieces-disable no-any-unknown -- reflect-metadata decorator API requires any\n    return (target: any, propertyKey: string | symbol, _descriptor: PropertyDescriptor) => {\n        const metadataTarget = typeof target === 'function' ? target : target.constructor;\n        const specs: Record<string, MaskSpec> =\n            Reflect.getMetadata(METADATA_KEYS.MASK_LOG, metadataTarget) || {};\n        specs[propertyKey as string] = spec;\n        Reflect.defineMetadata(METADATA_KEYS.MASK_LOG, specs, metadataTarget);\n    };\n}\n\n/**\n * The @MaskLog spec for one method, or undefined if the method declared none (the common case — the\n * caller then logs the DTO verbatim on the plain JSON.stringify fast path).\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpointOptions\nexport function getMaskSpec(apiClass: Function, methodName: string): MaskSpec | undefined {\n    const specs: Record<string, MaskSpec> =\n        Reflect.getMetadata(METADATA_KEYS.MASK_LOG, apiClass) || {};\n    return specs[methodName];\n}\n\n/**\n * Shared implementation for every auth decorator. Authorization is deliberately\n * method-only: a class-level default is too easy to miss when reviewing one endpoint.\n */\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nfunction defineAuthMetadata(authMeta: AuthMeta): MethodDecorator {\n\n    // webpieces-disable no-any-unknown -- reflect-metadata decorator API requires any\n    return (target: any, propertyKey?: string | symbol, _descriptor?: PropertyDescriptor) => {\n        if (propertyKey === undefined) {\n            throw new Error(\n                'Authorization decorators are method-only; annotate every @Endpoint explicitly.',\n            );\n        }\n        const metadataTarget = typeof target === 'function' ? target : target.constructor;\n        if (Reflect.hasMetadata('webpieces:ipc-api-id', metadataTarget)) {\n            throw new Error(\n                `Internal API ${metadataTarget.name || 'Unknown'} cannot use HTTP authorization decorators.`,\n            );\n        }\n        validateNoConflictingDecorators(metadataTarget, propertyKey as string);\n        Reflect.defineMetadata(METADATA_KEYS.AUTH_META, authMeta, metadataTarget, propertyKey);\n        const methods = new Set<string>(\n            Reflect.getMetadata(METADATA_KEYS.AUTH_METHODS, metadataTarget) || [],\n        );\n        methods.add(propertyKey as string);\n        Reflect.defineMetadata(METADATA_KEYS.AUTH_METHODS, [...methods], metadataTarget);\n    };\n}\n\n/**\n * @WpAuthPublic(reason) - endpoint intentionally requires no authentication.\n * The non-empty reason makes anonymous exposure an explicit review decision.\n */\n// webpieces-disable no-function-outside-class -- decorator factory; decorators are inherently module-scope\nexport function WpAuthPublic(reason: string): MethodDecorator {\n    if (typeof reason !== 'string' || reason.trim() === '') {\n        throw new Error(\n            '@WpAuthPublic requires a non-empty reason explaining why anonymous access is required.',\n        );\n    }\n    return defineAuthMetadata(new AuthMeta([{ kind: 'public' }], reason));\n}\n\n/** Protected network ingress: authenticate one declared credential, then authorize independently. */\n// webpieces-disable no-function-outside-class -- canonical method decorator factory\nexport function WpAuth(methods: AuthMethods): MethodDecorator {\n    return defineAuthMetadata(new AuthMeta(methods, undefined));\n}\n\n/** Locality is independent of authentication and cannot prove a user or machine identity. */\n// webpieces-disable no-function-outside-class -- canonical method decorator factory\nexport function WpLocalOnly(): MethodDecorator {\n    return (target: object, methodName: string | symbol) => {\n        if (methodName === undefined) throw new Error('@WpLocalOnly is method-only.');\n        Reflect.defineMetadata(METADATA_KEYS.LOCAL_ONLY, true, target.constructor, methodName);\n    };\n}\n\n// webpieces-disable no-function-outside-class -- canonical metadata reader\nexport function isLocalOnly(apiClass: Function, methodName: string): boolean {\n    return Reflect.getMetadata(METADATA_KEYS.LOCAL_ONLY, apiClass, methodName) === true;\n}\n\n// ============================================================\n// Helper functions\n// ============================================================\n\n/**\n * Get the base path from @ApiPath decorator.\n */\nexport function getApiPath(apiClass: Function): string | undefined {\n    return Reflect.getMetadata(METADATA_KEYS.API_PATH, apiClass);\n}\n\n/**\n * Get all endpoints from @Endpoint decorators.\n * Returns a record of methodName -> endpoint path.\n */\nexport function getEndpoints(apiClass: Function): Record<string, string> | undefined {\n    return Reflect.getMetadata(METADATA_KEYS.ENDPOINTS, apiClass);\n}\n\n/**\n * Every method's declared trigger kind, as `methodName -> kind`. Parallel to {@link getEndpoints}.\n * Empty for a class carrying no @Endpoint at all.\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpoints\nexport function getEndpointKinds(apiClass: Function): Record<string, EndpointKind> {\n    return Reflect.getMetadata(METADATA_KEYS.ENDPOINT_KIND, apiClass) || {};\n}\n\n/**\n * What triggers ONE method, or undefined when the method carries no @Endpoint.\n *\n * Defaults to nothing rather than to 'rpc': `kind` is a required argument, so a missing entry means\n * \"this is not an endpoint\", never \"an endpoint that forgot to say\". Silently defaulting here would\n * put an undeclared cron or webhook back into the graph as a normal rpc call — the exact blindness\n * the required argument exists to remove.\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpoints\nexport function getEndpointKind(apiClass: Function, methodName: string): EndpointKind | undefined {\n    return getEndpointKinds(apiClass)[methodName];\n}\n\n/** The required HTTP method for one endpoint. */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpointKind\nexport function getEndpointHttpMethod(apiClass: Function, methodName: string): HttpMethod {\n    const methods: Record<string, HttpMethod> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_HTTP_METHOD, apiClass) || {};\n    const method = methods[methodName];\n    if (!isHttpMethod(method)) {\n        throw new Error(\n            `@Endpoint ${apiClass.name || 'Unknown'}.${methodName} must declare one of ${HTTP_METHODS.join(', ')}.`,\n        );\n    }\n    return method;\n}\n\n/**\n * Get the @Endpoint options for one method (empty object if the method had no options).\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpoints\nexport function getEndpointOptions(apiClass: Function, methodName: string): EndpointOptions {\n    const opts: Record<string, EndpointOptions> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_OPTIONS, apiClass) || {};\n    const options = opts[methodName];\n    if (!options && getEndpoints(apiClass)?.[methodName] === undefined) {\n        // Preserve the historical helper behavior for a method that is not an endpoint at all.\n        return {} as EndpointOptions;\n    }\n    return options ?? {};\n}\n\n/** Read one endpoint's required side-effect semantics. */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpointOptions\nexport function getEndpointOperation(apiClass: Function, methodName: string): EndpointOperation {\n    const operations: Record<string, EndpointOperation> =\n        Reflect.getMetadata(METADATA_KEYS.ENDPOINT_OPERATION, apiClass) || {};\n    const operation = operations[methodName];\n    if (!isEndpointOperation(operation)) {\n        throw new Error(\n            `@Endpoint ${apiClass.name || 'Unknown'}.${methodName} must declare READ, ` +\n                'WRITE_IDEMPOTENT, or WRITE.',\n        );\n    }\n    return operation;\n}\n\n// webpieces-disable no-function-outside-class -- runtime backstop for JavaScript and `as any` callers; webpieces-disable no-any-unknown -- untrusted runtime value is narrowed to an endpoint operation\nfunction isEndpointOperation(value: unknown): value is EndpointOperation {\n    return (\n        value === READ ||\n        value === WRITE_IDEMPOTENT ||\n        value === WRITE\n    );\n}\n\n// webpieces-disable no-function-outside-class -- runtime backstop for JavaScript and `as any` callers; webpieces-disable no-any-unknown -- untrusted runtime value is narrowed to an endpoint kind\nfunction isEndpointKind(value: unknown): value is EndpointKind {\n    return (\n        value === RPC ||\n        value === CLOUDTASKS ||\n        value === CRON ||\n        value === EXTERNAL_INBOUND ||\n        value === EXTERNAL_OUTBOUND\n    );\n}\n\n/**\n * Fail-fast at wiring time on the two EXTERNAL_* rules, called by `RouteMetadataFactory` for every\n * transport (server routes and every client). The {@link Endpoint} overloads already make a missing\n * `calledBy` a COMPILE error; this is the backstop for the ways TS is bypassed — a JS caller, an\n * `as any` options object, a hand-rolled Reflect.defineMetadata. The second rule cannot be a type:\n * \"every method of this class\" spans several decorators.\n *\n * @throws Error naming the first EXTERNAL_INBOUND endpoint with no `calledBy`, or the first method of\n * a contract that mixes EXTERNAL_OUTBOUND with any other kind.\n */\n// webpieces-disable no-function-outside-class -- wiring-time assert, sibling of assertEveryEndpointHasAuthMode\nexport function assertExternalEndpointKinds(apiClass: Function): void {\n    const kinds = getEndpointKinds(apiClass);\n    const apiName = apiClass.name || 'Unknown';\n    const methods = Object.keys(kinds);\n    const outbound = methods.filter((methodName: string) => kinds[methodName] === EXTERNAL_OUTBOUND);\n    if (outbound.length > 0 && outbound.length !== methods.length) {\n        const other = methods.find((methodName: string) => kinds[methodName] !== EXTERNAL_OUTBOUND)!;\n        throw new Error(\n            `${apiName} mixes EXTERNAL_OUTBOUND (${outbound[0]}) with ${String(kinds[other]).toUpperCase()} (${other}). ` +\n                `An EXTERNAL_OUTBOUND contract is an outside system's API that no server in this repo implements, so ` +\n                `EVERY method of it must be EXTERNAL_OUTBOUND; move the other methods to their own contract.`,\n        );\n    }\n    for (const methodName of methods) {\n        if (kinds[methodName] !== EXTERNAL_INBOUND || getEndpointCaller(apiClass, methodName) !== undefined)\n            continue;\n        throw new Error(\n            `External endpoint '${methodName}' in ${apiName} declares no caller. Say WHO ` +\n                `posts to it: @Endpoint(POST, path, WRITE, EXTERNAL_INBOUND, { calledBy: '<vendor>' }) — the runtime architecture ` +\n                `graph cannot name an inbound caller it was never told about.`,\n        );\n    }\n}\n\n/** True when the contract is an outside system's API: every method is EXTERNAL_OUTBOUND. */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpointKinds\nexport function isExternalOutboundApi(apiClass: Function): boolean {\n    const kinds = Object.values(getEndpointKinds(apiClass));\n    return kinds.length > 0 && kinds.every((kind: EndpointKind) => kind === EXTERNAL_OUTBOUND);\n}\n\n/**\n * True when the method's @Endpoint declared `{ formPost: true }` — its body is\n * application/x-www-form-urlencoded (flat), not JSON.\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of getEndpoints\nexport function isFormPost(apiClass: Function, methodName: string): boolean {\n    return getEndpointOptions(apiClass, methodName).formPost === true;\n}\n\n/**\n * True when the method's @Endpoint declared `{ rawBody: true }` — the transport must retain the\n * verbatim bytes + absolute url for a `VendorAuthHook.verify` to check.\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader, sibling of isFormPost\nexport function isRawBody(apiClass: Function, methodName: string): boolean {\n    return getEndpointOptions(apiClass, methodName).rawBody === true;\n}\n\n/**\n * Fail-fast at wiring time when a SERVED `vendorAuth(...)` endpoint did not ask the transport to keep the\n * bytes it is supposed to verify. A hook with nothing to verify is a MISCONFIGURATION, and it must\n * surface at startup, naming the fix — not as a 401 in production on exactly the traffic the endpoint\n * exists for.\n *\n * This pairing is a runtime assert rather than a type because the two halves live on DIFFERENT\n * decorators (`vendorAuth(...)` and `@Endpoint`), and no union over one decorator's argument can say\n * anything about the other's.\n *\n * @throws Error naming the first `vendorAuth(...)` endpoint missing `{ rawBody: true }`.\n */\n// webpieces-disable no-function-outside-class -- wiring-time assert, sibling of assertEveryEndpointHasAuthMode\nexport function assertEveryVendorAuthEndpointRetainsRawBody(apiClass: Function): void {\n    const endpoints = getEndpoints(apiClass) || {};\n    for (const methodName of Object.keys(endpoints)) {\n        if (\n            !getAuthMeta(apiClass, methodName)?.methods.some((method: AuthMode) => method.kind === 'vendorAuth') ||\n            isRawBody(apiClass, methodName)\n        )\n            continue;\n        throw new Error(\n            `Endpoint '${methodName}' in ${apiClass.name || 'Unknown'} is vendorAuth(...) but its @Endpoint ` +\n                `does not declare { rawBody: true }. VendorAuthHook.verify checks a credential over the bytes and ` +\n                `the url the SENDER transmitted, and without that option the transport parses the body and ` +\n                `throws them away — leaving the hook nothing to check.`,\n        );\n    }\n}\n\n/**\n * Check if a class has @ApiPath decorator.\n */\nexport function isApiPath(apiClass: Function): boolean {\n    return Reflect.hasMetadata(METADATA_KEYS.API_PATH, apiClass);\n}\n\n/**\n * Get method-level auth metadata. Class-level authorization is forbidden.\n */\n// webpieces-disable no-function-outside-class -- reflect-metadata reader paired with the decorator API\nexport function getAuthMeta(apiClass: Function, methodName: string): AuthMeta | undefined {\n    return Reflect.getMetadata(METADATA_KEYS.AUTH_META, apiClass, methodName);\n}\n\n/**\n * The ONE prescription for \"this endpoint declares no auth\", shared by the two places that raise it\n * (here and http-routing's ApiRoutingFactory) because they had drifted into teaching different menus.\n * A message teaching an incomplete API is the same defect as an API with two spellings: whichever menu\n * the caller hits becomes the API they believe exists. It leads with the ROLE-GATED member on purpose —\n * the first thing offered should not be the widest grant.\n */\nexport const MISSING_AUTH_DECORATOR_FIX =\n    \"Declare @WpAuth([jwt(), oidcSameProject() or oidcSvcs(['svc-a']), sharedSecret(key), vendorAuth(name), apiKey('regime', [{in: 'header', key: MyKeys.API_KEY}])]) \" +\n    \"or @WpAuthPublic('reason'), and exactly one @WpAuthorization on every endpoint. Add @WpLocalOnly() separately when locality is required.\";\n\n/**\n * Fail-fast at wiring time if any endpoint lacks an auth mode. Both the server\n * (ApiRoutingFactory) and the task/rpc clients call this so a missing auth\n * decorator is a startup error, never a silent open endpoint.\n * @throws Error naming the first endpoint with no auth decorator, via {@link MISSING_AUTH_DECORATOR_FIX}.\n */\nexport function assertEveryEndpointHasAuthMode(apiClass: Function): void {\n    const apiName = apiClass.name || 'Unknown';\n    const endpoints = getEndpoints(apiClass) || {};\n    for (const methodName of Object.keys(endpoints)) {\n        if (!getAuthMeta(apiClass, methodName)) {\n            throw new Error(\n                `Endpoint '${methodName}' in ${apiName} has no auth decorator. ` +\n                    MISSING_AUTH_DECORATOR_FIX,\n            );\n        }\n        const policy = getAuthorization(apiClass, methodName);\n        if (!policy) throw new Error(`Endpoint '${methodName}' in ${apiName} requires @WpAuthorization.`);\n        AuthorizationDeclaration.validate(policy);\n        const auth = getAuthMeta(apiClass, methodName)!;\n        const isPublic = auth.methods.some((method: AuthMode) => method.kind === 'public');\n        if (isPublic !== (policy.authType === AuthorizationType.ANONYMOUS)) {\n            throw new Error(`Endpoint '${methodName}' must pair public authentication with ANONYMOUS authorization, or protected authentication with protected/CUSTOM authorization.`);\n        }\n    }\n    const policyMethods: string[] = Reflect.getMetadata(AUTHORIZATION_METHODS_KEY, apiClass) ?? [];\n    for (const methodName of policyMethods) {\n        if (!(methodName in endpoints)) throw new Error(`Orphan @WpAuthorization on ${apiName}.${methodName}; declare @Endpoint.`);\n    }\n}\n\n/**\n * Validate that a class/method doesn't have conflicting auth decorators.\n * @throws Error if multiple auth decorators are found on the same target.\n */\n// webpieces-disable no-function-outside-class -- shared decorator metadata validation\nexport function validateNoConflictingDecorators(\n    apiClass: Function,\n    methodName: string | undefined,\n): void {\n    const existing = methodName\n        ? Reflect.getMetadata(METADATA_KEYS.AUTH_META, apiClass, methodName)\n        : Reflect.getMetadata(METADATA_KEYS.AUTH_META, apiClass);\n\n    if (existing) {\n        const targetName = apiClass.name || 'Unknown';\n        const location = methodName\n            ? `method '${methodName}' of ${targetName}`\n            : `class ${targetName}`;\n        throw new Error(\n            `Conflicting auth decorator on ${location}. ` +\n                `Exactly one @WpAuth([...]) or @WpAuthPublic('reason') is allowed per endpoint.`,\n        );\n    }\n}\n"]}

package/src/index.d.ts

@@ -38,7 +38,7 @@ export { StreamCorrelation, StreamEnvelope, StreamingEndpointMetadata, StreamEve
 export type { RequestStream, ResponseStream, StreamEnvelopeKind } from './http/StreamingContract';
 export type { EndpointResponseType, HttpMethod, HttpParameterSource, HttpParameterValueType, HttpQueryItemType, } from './http/HttpContract';
 export { GET, POST, PUT, PATCH, DELETE, HTTP_METHODS, verbCarriesBody, isHttpMethod, } from './http/HttpContract';
-export type { EndpointKind, EndpointOperation, EndpointOptions, ExternalEndpointOptions, } from './http/decorators';
+export type { EndpointKind, EndpointOperation, EndpointOptions, ExternalEndpointOptions, NoResponseBodyOptionEndpointOptions, } from './http/decorators';
 export { RPC, CLOUDTASKS, CRON, EXTERNAL_INBOUND, EXTERNAL_OUTBOUND, READ, WRITE_IDEMPOTENT, WRITE, NONE, } from './http/decorators';
 export { ExternalContextKeys, getExternalContextKeys, declaresExternalContextKeys, } from './http/ExternalContextKeys';
 export type { ResponseBodyKind } from './http/decorators';

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/core/core-util/src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;AAEH,+CAA2C;AAAlC,qGAAA,OAAO,OAAA;AAChB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AAOnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,+EAA+E;AAC/E,kFAAkF;AAClF,yCAAyC;AACzC,mDAA0F;AAAjF,gHAAA,cAAc,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAO/D,yDAAwD;AAA/C,8GAAA,aAAa,OAAA;AACtB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,mDAAkD;AAAzC,wGAAA,UAAU,OAAA;AACnB,mDAM8B;AAL1B,wGAAA,UAAU,OAAA;AACV,4GAAA,cAAc,OAAA;AACd,0GAAA,YAAY,OAAA;AACZ,+GAAA,iBAAiB,OAAA;AACjB,kHAAA,oBAAoB,OAAA;AAGxB,8DAA8D;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAElE,4BAA4B;AAC5B,gDA4B2B;AA3BvB,qGAAA,OAAO,OAAA;AACP,sGAAA,QAAQ,OAAA;AACR,mEAAmE;AACnE,0GAAA,YAAY,OAAA;AACZ,oGAAA,MAAM,OAAA;AACN,wHAAA,0BAA0B,OAAA;AAC1B,yGAAA,WAAW,OAAA;AACX,yGAAA,WAAW,OAAA;AACX,qGAAA,OAAO,OAAA;AACP,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AACZ,mHAAA,qBAAqB,OAAA;AACrB,gHAAA,kBAAkB,OAAA;AAClB,kHAAA,oBAAoB,OAAA;AACpB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAChB,yGAAA,WAAW,OAAA;AACX,wGAAA,UAAU,OAAA;AACV,uGAAA,SAAS,OAAA;AACT,uGAAA,SAAS,OAAA;AACT,yGAAA,WAAW,OAAA;AACX,4HAAA,8BAA8B,OAAA;AAC9B,yHAAA,2BAA2B,OAAA;AAC3B,mHAAA,qBAAqB,OAAA;AACrB,yIAAA,2CAA2C,OAAA;AAC3C,6HAAA,+BAA+B,OAAA;AAC/B,2GAAA,aAAa,OAAA;AAEjB,8EAK0C;AAJtC,sHAAA,SAAS,OAAA;AACT,uHAAA,UAAU,OAAA;AACV,wHAAA,WAAW,OAAA;AACX,yIAAA,4BAA4B,OAAA;AAEhC,kDAAiD;AAAxC,0GAAA,WAAW,OAAA;AAEpB,4EAA6F;AAApF,iHAAA,KAAK,OAAA;AAAE,iHAAA,KAAK,OAAA;AAAE,iHAAA,KAAK,OAAA;AAAE,iIAAA,qBAAqB,OAAA;AAEnD,4CAUyB;AATrB,mGAAA,OAAO,OAAA;AACP,sGAAA,UAAU,OAAA;AACV,6GAAA,iBAAiB,OAAA;AACjB,+FAAA,GAAG,OAAA;AACH,iHAAA,qBAAqB,OAAA;AACrB,6GAAA,iBAAiB,OAAA;AACjB,uGAAA,WAAW,OAAA;AACX,mHAAA,uBAAuB,OAAA;AACvB,wHAAA,4BAA4B,OAAA;AAGhC,qDAW6B;AAVzB,2GAAA,UAAU,OAAA;AACV,8GAAA,aAAa,OAAA;AACb,8GAAA,aAAa,OAAA;AACb,4GAAA,WAAW,OAAA;AACX,gHAAA,eAAe,OAAA;AACf,mHAAA,kBAAkB,OAAA;AAClB,+GAAA,cAAc,OAAA;AACd,kHAAA,iBAAiB,OAAA;AACjB,qHAAA,oBAAoB,OAAA;AACpB,kHAAA,iBAAiB,OAAA;AAGrB,2FAA2F;AAC3F,sDAAqD;AAA5C,8GAAA,aAAa,OAAA;AACtB,oEAAmE;AAA1D,4HAAA,oBAAoB,OAAA;AAC7B,sDAK8B;AAJ1B,kHAAA,iBAAiB,OAAA;AACjB,yHAAA,wBAAwB,OAAA;AACxB,gHAAA,eAAe,OAAA;AACf,iHAAA,gBAAgB,OAAA;AAGpB,wEAAiG;AAAxF,gIAAA,sBAAsB,OAAA;AAAE,kIAAA,wBAAwB,OAAA;AACzD,gEAImC;AAH/B,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AACnB,6HAAA,uBAAuB,OAAA;AAE3B,oDAK6B;AAJzB,gHAAA,gBAAgB,OAAA;AAChB,kHAAA,kBAAkB,OAAA;AAClB,oHAAA,oBAAoB,OAAA;AACpB,wHAAA,wBAAwB,OAAA;AAE5B,8DAWkC;AAV9B,sHAAA,iBAAiB,OAAA;AACjB,mHAAA,cAAc,OAAA;AACd,8HAAA,yBAAyB,OAAA;AACzB,yHAAA,oBAAoB,OAAA;AACpB,yHAAA,oBAAoB,OAAA;AACpB,iHAAA,YAAY,OAAA;AACZ,oHAAA,eAAe,OAAA;AACf,6GAAA,QAAQ,OAAA;AACR,yHAAA,oBAAoB,OAAA;AACpB,6HAAA,wBAAwB,OAAA;AAU5B,oDAS6B;AARzB,mGAAA,GAAG,OAAA;AACH,oGAAA,IAAI,OAAA;AACJ,mGAAA,GAAG,OAAA;AACH,qGAAA,KAAK,OAAA;AACL,sGAAA,MAAM,OAAA;AACN,4GAAA,YAAY,OAAA;AACZ,+GAAA,eAAe,OAAA;AACf,4GAAA,YAAY,OAAA;AAQhB,gDAU2B;AATvB,iGAAA,GAAG,OAAA;AACH,wGAAA,UAAU,OAAA;AACV,kGAAA,IAAI,OAAA;AACJ,8GAAA,gBAAgB,OAAA;AAChB,+GAAA,iBAAiB,OAAA;AACjB,kGAAA,IAAI,OAAA;AACJ,8GAAA,gBAAgB,OAAA;AAChB,mGAAA,KAAK,OAAA;AACL,kGAAA,IAAI,OAAA;AAER,kEAIoC;AAHhC,0HAAA,mBAAmB,OAAA;AACnB,6HAAA,sBAAsB,OAAA;AACtB,kIAAA,2BAA2B,OAAA;AAG/B,iDAS2B;AARvB,oHAAA,qBAAqB,OAAA;AACrB,4HAAA,6BAA6B,OAAA;AAC7B,wGAAA,SAAS,OAAA;AACT,6GAAA,cAAc,OAAA;AACd,gHAAA,iBAAiB,OAAA;AACjB,wHAAA,yBAAyB,OAAA;AACzB,4GAAA,aAAa,OAAA;AACb,mHAAA,oBAAoB,OAAA;AAGxB,iDAAgD;AAAvC,0GAAA,WAAW,OAAA;AACpB,6CAMyB;AALrB,0GAAA,aAAa,OAAA;AACb,uHAAA,0BAA0B,OAAA;AAC1B,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,gHAAA,mBAAmB,OAAA;AAGvB,+DAIkC;AAH9B,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AACnB,uHAAA,iBAAiB,OAAA;AAErB,uEAKsC;AAJlC,gIAAA,sBAAsB,OAAA;AACtB,+HAAA,qBAAqB,OAAA;AACrB,8HAAA,oBAAoB,OAAA;AACpB,8HAAA,oBAAoB,OAAA;AAQxB,+FAA+F;AAC/F,8CAS0B;AARtB,qGAAA,QAAQ,OAAA;AACR,4GAAA,eAAe,OAAA;AACf,gGAAA,GAAG,OAAA;AACH,4GAAA,eAAe,OAAA;AACf,qGAAA,QAAQ,OAAA;AACR,yGAAA,YAAY,OAAA;AACZ,uGAAA,UAAU,OAAA;AACV,mGAAA,MAAM,OAAA;AAYV,sGAAsG;AACtG,yFAAyF;AACzF,4CASyB;AARrB,+FAAA,GAAG,OAAA;AACH,kGAAA,MAAM,OAAA;AACN,iGAAA,KAAK,OAAA;AACL,sHAAA,0BAA0B,OAAA;AAC1B,sGAAA,UAAU,OAAA;AACV,yGAAA,aAAa,OAAA;AACb,mHAAA,uBAAuB,OAAA;AACvB,wGAAA,YAAY,OAAA;AAGhB,kEAAkE;AAClE,8DAA8D;AAC9D,mCAAmC;AACnC,0DAMgC;AAL5B,wHAAA,qBAAqB,OAAA;AACrB,sHAAA,mBAAmB,OAAA;AACnB,iHAAA,cAAc,OAAA;AACd,uHAAA,oBAAoB,OAAA;AACpB,oHAAA,iBAAiB,OAAA;AAGrB,4FAA4F;AAC5F,0CAAkD;AAAzC,kGAAA,OAAO,OAAA;AAAE,kGAAA,OAAO,OAAA;AAKzB,oCAAoC;AACpC,mCASkB;AARd,0GAAA,gBAAgB,OAAA;AAChB,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,sGAAA,YAAY,OAAA;AACZ,6GAAA,mBAAmB,OAAA;AACnB,sGAAA,YAAY,OAAA;AACZ,uGAAA,aAAa,OAAA;AACb,qGAAA,WAAW,OAAA;AAGf,sDAA+D;AAAtD,wHAAA,uBAAuB,OAAA;AAEhC,iEAAiE;AACjE,4CASyB;AAJrB,uGAAA,WAAW,OAAA;AACX,oGAAA,QAAQ,OAAA;AACR,oGAAA,QAAQ,OAAA;AACR,wGAAA,YAAY,OAAA;AAGhB,mEAAmE;AACnE,wDAAuD;AAA9C,gHAAA,cAAc,OAAA;AACvB,wDAAuD;AAA9C,gHAAA,cAAc,OAAA;AACvB,oDAAmD;AAA1C,4GAAA,YAAY,OAAA;AAErB,8CAAmD;AAA1C,4GAAA,eAAe,OAAA;AACxB,4DAA2D;AAAlD,oHAAA,gBAAgB,OAAA;AACzB,sDAAqD;AAA5C,8GAAA,aAAa,OAAA;AACtB,oDAAmD;AAA1C,4GAAA,YAAY,OAAA;AACrB,oDAAkD;AAAzC,2GAAA,WAAW,OAAA;AAEpB,kEAAiE;AAAxD,0HAAA,mBAAmB,OAAA;AAG5B,iFAAiF;AACjF,8EAA8E;AAC9E,kDAAiD;AAAxC,0GAAA,WAAW,OAAA;AACpB,qGAAqG;AACrG,uFAAuF;AACvF,0DAAyD;AAAhD,kHAAA,eAAe,OAAA;AAExB,4FAA4F;AAC5F,yFAAyF;AACzF,0DAAyF;AAAhF,6GAAA,UAAU,OAAA;AAAE,qHAAA,kBAAkB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAIxD,qGAAqG;AACrG,gFAAgF;AAChF,0FAGgD;AAF5C,kJAAA,+BAA+B,OAAA;AAC/B,qJAAA,kCAAkC,OAAA;AAEtC,iGAAiG;AACjG,qFAAqF;AACrF,0CAAsD;AAA7C,+GAAA,oBAAoB,OAAA;AAE7B,4FAA4F;AAC5F,sEAAqE;AAA5D,4HAAA,oBAAoB,OAAA;AAK7B,0DAAqD;AAA5C,8GAAA,WAAW,OAAA;AACpB,0FAGgD;AAF5C,kJAAA,+BAA+B,OAAA;AAC/B,qJAAA,kCAAkC,OAAA;AAEtC,0DAAyD;AAAhD,kHAAA,eAAe,OAAA;AACxB,oEAAmE;AAA1D,4HAAA,oBAAoB,OAAA;AAI7B,qGAAqG;AACrG,mFAAmF;AACnF,4DAA2D;AAAlD,oHAAA,gBAAgB,OAAA;AAEzB,iGAAiG;AACjG,gGAAgG;AAChG,kEAAkE;AAClE,gDAA+C;AAAtC,wGAAA,UAAU,OAAA;AAEnB,kGAAkG;AAClG,oGAAoG;AACpG,2EAA2E;AAC3E,gDAAmD;AAA1C,4GAAA,cAAc,OAAA;AACvB,sGAAsG;AACtG,wEAAwE;AACxE,gDAAiE;AAAxD,wGAAA,UAAU,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AAErC,iGAAiG;AACjG,uGAAuG;AACvG,oDAA+C;AAAtC,wGAAA,QAAQ,OAAA;AAGjB,yFAAyF;AACzF,kFAAkF;AAClF,gGAAgG;AAChG,kDAAqF;AAA5E,0GAAA,WAAW,OAAA;AAAE,4GAAA,aAAa,OAAA;AAAE,kHAAA,mBAAmB,OAAA;AAExD,oGAAoG;AACpG,wDAI+B;AAH3B,gHAAA,cAAc,OAAA;AACd,oHAAA,kBAAkB,OAAA;AAClB,0HAAA,wBAAwB,OAAA;AAE5B,sDAAqD;AAA5C,8GAAA,aAAa,OAAA;AAItB,iFAAiF;AACjF,qEAAkF;AAAvD,gHAAA,YAAY,OAAA;AACvC,qEAI0C;AAHtC,oHAAA,gBAAgB,OAAA;AAChB,iHAAA,aAAa,OAAA;AACb,oHAAA,gBAAgB,OAAA;AAEpB,2DAAgF;AAAvE,0GAAA,WAAW,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAC1C,qEAAoG;AAA3F,oHAAA,gBAAgB,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,mHAAA,eAAe,OAAA;AAEzD,gGAAgG;AAChG,2EAA2E;AAC3E,+FAA+F;AAC/F,kGAAkG;AAClG,wFAAwF;AACxF,2CAA0C;AAAjC,gGAAA,MAAM,OAAA;AAEf,qDAAoD;AAA3C,0GAAA,WAAW,OAAA;AAEpB,mCAuCkB;AAtCd,kGAAA,QAAQ,OAAA;AACR,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,4GAAA,kBAAkB,OAAA;AAClB,6GAAA,mBAAmB,OAAA;AACnB,mHAAA,yBAAyB,OAAA;AACzB,gHAAA,sBAAsB,OAAA;AACtB,6GAAA,mBAAmB,OAAA;AACnB,2GAAA,iBAAiB,OAAA;AACjB,gHAAA,sBAAsB,OAAA;AACtB,yGAAA,eAAe,OAAA;AACf,4GAAA,kBAAkB,OAAA;AAClB,8GAAA,oBAAoB,OAAA;AACpB,mHAAA,yBAAyB,OAAA;AACzB,kHAAA,wBAAwB,OAAA;AACxB,4GAAA,kBAAkB,OAAA;AAClB,kHAAA,wBAAwB,OAAA;AACxB,0GAAA,gBAAgB,OAAA;AAChB,+GAAA,qBAAqB,OAAA;AACrB,oHAAA,0BAA0B,OAAA;AAC1B,sHAAA,4BAA4B,OAAA;AAC5B,gHAAA,sBAAsB,OAAA;AACtB,uGAAA,aAAa,OAAA;AACb,8GAAA,oBAAoB,OAAA;AACpB,iHAAA,uBAAuB,OAAA;AACvB,kHAAA,wBAAwB,OAAA;AACxB,mHAAA,yBAAyB,OAAA;AACzB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AACpB,oGAAA,UAAU,OAAA;AACV,uGAAA,aAAa,OAAA;AACb,yGAAA,eAAe,OAAA;AACf,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,kGAAA,QAAQ,OAAA;AACR,wGAAA,cAAc,OAAA;AACd,8GAAA,oBAAoB,OAAA;AACpB,uGAAA,aAAa,OAAA;AASjB,gEAA+D;AAAtD,wHAAA,kBAAkB,OAAA;AAE3B,iGAAiG;AACjG,gGAAgG;AAChG,yDAAqF;AAA5E,gHAAA,cAAc,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAAE,2GAAA,SAAS,OAAA;AAQpD,iEAAkF;AAAzE,wHAAA,kBAAkB,OAAA;AAAE,sHAAA,gBAAgB,OAAA;AAC7C,qEAAoE;AAA3D,4HAAA,oBAAoB,OAAA;AAC7B,iEAAgF;AAAvE,oHAAA,cAAc,OAAA;AAAE,wHAAA,kBAAkB,OAAA;AAC3C,2FAA0F;AAAjF,kJAAA,+BAA+B,OAAA;AAGxC,iCAAwD;AAA/C,0FAAA,GAAG,OAAA;AAAE,6GAAA,sBAAsB,OAAA","sourcesContent":["/**\n * @webpieces/core-util\n *\n * Utility functions for WebPieces applications.\n * This package works in both browser and Node.js environments.\n *\n * @packageDocumentation\n */\n\nexport { toError } from './lib/errorUtils';\nexport { ContextKey } from './ContextKey';\nexport type {\n    AnyContextKey,\n    AnyTrustedContextKey,\n    AnyUntrustedContextKey,\n    Trust,\n} from './ContextKey';\nexport { ContextTuple } from './ContextTuple';\n\n// @DocumentDesign — DI-design-root marker. Applies to ANY project kind (server\n// controllers AND library impl classes), so it lives here (browser + Node) rather\n// than in a server-only routing package.\nexport { DocumentDesign, isDocumentDesign, DESIGN_METADATA_KEYS } from './DocumentDesign';\n\n// Logging (merged from former @webpieces/wp-logging).\n// Pluggable logging interface + a browser-safe console default; apps plug in\n// bunyan/winston/pino/etc. via LogManager.setFactory(...). Browser + Node.\nexport type { Logger, LogLevel } from './logging/Logger';\nexport type { LoggerFactory } from './logging/LoggerFactory';\nexport { ConsoleLogger } from './logging/ConsoleLogger';\nexport { ConsoleLoggerFactory } from './logging/ConsoleLoggerFactory';\nexport { LogManager } from './logging/LogManager';\nexport {\n    LogChunker,\n    LogChunkerImpl,\n    LogChunkInfo,\n    MAX_GCP_LOG_BYTES,\n    GCP_LOG_BUDGET_BYTES,\n} from './logging/LogChunker';\n\n// HTTP API contract (merged from former @webpieces/http-api).\n// Shared HTTP API definition consumed by both client and server: REST\n// decorators, the API error taxonomy, datetime DTOs, platform-header\n// registry/readers, ValidateImplementation, and the test-case recorder\n// contract. Pure definitions — express-free, browser + Node safe.\n\n// API definition decorators\nexport {\n    ApiPath,\n    Endpoint,\n    // Auth mode decorators (clean service-to-service + user JWT model)\n    WpAuthPublic,\n    WpAuth,\n    MISSING_AUTH_DECORATOR_FIX,\n    WpLocalOnly,\n    isLocalOnly,\n    MaskLog,\n    getApiPath,\n    getEndpoints,\n    getEndpointHttpMethod,\n    getEndpointOptions,\n    getEndpointOperation,\n    getEndpointKind,\n    getEndpointKinds,\n    getMaskSpec,\n    isFormPost,\n    isRawBody,\n    isApiPath,\n    getAuthMeta,\n    assertEveryEndpointHasAuthMode,\n    assertExternalEndpointKinds,\n    isExternalOutboundApi,\n    assertEveryVendorAuthEndpointRetainsRawBody,\n    validateNoConflictingDecorators,\n    METADATA_KEYS,\n} from './http/decorators';\nexport {\n    PathParam,\n    QueryParam,\n    QueryString,\n    getHttpParameterDeclarations,\n} from './http/http-parameter-decorators';\nexport { QueryParams } from './http/QueryParams';\nexport type { QueryParamValue } from './http/QueryParams';\nexport { WpInt, WpMin, WpMax, NUMERIC_METADATA_KEYS } from './http/numeric-field-decorators';\nexport type { Integer } from './http/numeric-field-decorators';\nexport {\n    ApiType,\n    SVC_TO_SVC,\n    EXTERNAL_CUSTOMER,\n    MCP,\n    API_TYPE_METADATA_KEY,\n    DEFAULT_API_TYPES,\n    getApiTypes,\n    getApiTypeEndpointNames,\n    assertApiTypeMatchesMcpTools,\n} from './http/api-type';\nexport type { ApiTypeKind } from './http/api-type';\nexport {\n    WpInternal,\n    WpIpcEndpoint,\n    isInternalApi,\n    getIpcApiId,\n    getIpcEndpoints,\n    getIpcEndpointKind,\n    getIpcMaskSpec,\n    assertInternalApi,\n    assertNotInternalApi,\n    IPC_METADATA_KEYS,\n} from './ipc/IpcDecorators';\nexport type { IpcApiType, IpcEndpointKind, IpcEndpointOptions } from './ipc/IpcDecorators';\n// The runtime representation of ONE route (split out of decorators.ts for file size only).\nexport { RouteMetadata } from './http/RouteMetadata';\nexport { RouteMetadataFactory } from './http/RouteMetadataFactory';\nexport {\n    AuthorizationType,\n    AuthorizationDeclaration,\n    WpAuthorization,\n    getAuthorization,\n} from './http/authorization';\nexport type { AuthorizationRequirement } from './http/authorization';\nexport { StreamingSchemaCatalog, registerStreamingCatalog } from './http/StreamingSchemaCatalog';\nexport {\n    StreamErrorControl,\n    StreamProtocolError,\n    StreamDisconnectedError,\n} from './http/StreamErrorControl';\nexport {\n    BoundHttpRequest,\n    HttpContractMapper,\n    HttpParameterBinding,\n    HttpParameterDeclaration,\n} from './http/HttpContract';\nexport {\n    StreamCorrelation,\n    StreamEnvelope,\n    StreamingEndpointMetadata,\n    StreamEventValidator,\n    StreamTransportError,\n    StreamWriter,\n    StreamDirection,\n    WpStream,\n    getStreamingEndpoint,\n    registerStreamingSchemas,\n} from './http/StreamingContract';\nexport type { RequestStream, ResponseStream, StreamEnvelopeKind } from './http/StreamingContract';\nexport type {\n    EndpointResponseType,\n    HttpMethod,\n    HttpParameterSource,\n    HttpParameterValueType,\n    HttpQueryItemType,\n} from './http/HttpContract';\nexport {\n    GET,\n    POST,\n    PUT,\n    PATCH,\n    DELETE,\n    HTTP_METHODS,\n    verbCarriesBody,\n    isHttpMethod,\n} from './http/HttpContract';\nexport type {\n    EndpointKind,\n    EndpointOperation,\n    EndpointOptions,\n    ExternalEndpointOptions,\n} from './http/decorators';\nexport {\n    RPC,\n    CLOUDTASKS,\n    CRON,\n    EXTERNAL_INBOUND,\n    EXTERNAL_OUTBOUND,\n    READ,\n    WRITE_IDEMPOTENT,\n    WRITE,\n    NONE,\n} from './http/decorators';\nexport {\n    ExternalContextKeys,\n    getExternalContextKeys,\n    declaresExternalContextKeys,\n} from './http/ExternalContextKeys';\nexport type { ResponseBodyKind } from './http/decorators';\nexport {\n    InvalidEndpointForMcp,\n    InvalidEndpointForMcpMetadata,\n    WpMcpTool,\n    WpMcpToolHints,\n    WpMcpToolMetadata,\n    getInvalidEndpointsForMcp,\n    getWpMcpTools,\n    mcpHintsForOperation,\n} from './mcp/McpMetadata';\nexport type { WpMcpMethodDecorator } from './mcp/McpMetadata';\nexport { McpToolName } from './mcp/McpToolName';\nexport {\n    ApiJsonSchema,\n    ApiJsonSchemaDiscriminator,\n    ApiJsonSchemaValidator,\n    DtoValidationFailure,\n    ObjectSchemaBuilder,\n} from './mcp/DtoSchema';\nexport type { ApiJsonSchemaType, DtoValue } from './mcp/DtoSchema';\nexport {\n    McpToolCatalogFile,\n    McpToolCatalogError,\n    McpToolDefinition,\n} from './mcp/McpToolCatalogFile';\nexport {\n    GeneratedApiDocsLayout,\n    GenerateLayoutProblem,\n    GenerateOutputLookup,\n    GenerateOutputTarget,\n} from './mcp/GeneratedApiDocsLayout';\nexport type {\n    LayoutDependsOn,\n    LayoutDependsOnObject,\n    LayoutTarget,\n    LayoutTargets,\n} from './mcp/GeneratedApiDocsLayout';\n// The TYPE layer of the auth surface — likewise split out of decorators.ts for file size only.\nexport {\n    AuthMeta,\n    AuthDeclaration,\n    jwt,\n    oidcSameProject,\n    oidcSvcs,\n    sharedSecret,\n    vendorAuth,\n    apiKey,\n} from './http/auth-mode';\nexport type {\n    AuthMode,\n    ApiKeyCredential,\n    ApiKeyCredentials,\n    AuthMethod,\n    AuthMethods,\n    OidcAuthMethod,\n    OidcAuthMethods,\n    OidcCallers,\n} from './http/auth-mode';\n// API kind (RPC vs PubSub/Cloud Tasks) + queue naming. Split out of decorators.ts for file size only;\n// one-way dependency api-kind -> decorators, and the barrel keeps the surface identical.\nexport {\n    Rpc,\n    PubSub,\n    Queue,\n    ENDPOINT_KINDS_BY_API_KIND,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n} from './http/api-kind';\nexport type { ApiKind } from './http/api-kind';\n// WHO calls an EXTERNAL_INBOUND endpoint — the caller declaration\n// @Endpoint(POST, ..., WRITE, EXTERNAL_INBOUND, { calledBy })\n// requires, and the reader for it.\nexport {\n    EXTERNAL_SYSTEM_KINDS,\n    DEFAULT_CALLER_KIND,\n    ExternalCaller,\n    isExternalSystemKind,\n    getEndpointCaller,\n} from './http/external-caller';\nexport type { ExternalSystemKind } from './http/external-caller';\n// Client-side shared-secret store (the value THIS service sends per sharedSecret(...) key).\nexport { Secrets, SECRETS } from './http/Secrets';\n\n// Type validators\nexport { ValidateImplementation } from './http/validators';\n\n// Authentication subtype constants.\nexport {\n    ENTITY_NOT_FOUND,\n    WRONG_LOGIN_TYPE,\n    WRONG_LOGIN,\n    NOT_APPROVED,\n    EMAIL_NOT_CONFIRMED,\n    WRONG_DOMAIN,\n    WRONG_COMPANY,\n    NO_REG_CODE,\n} from './errors';\n\nexport { NetworkRejectClassifier } from './http/networkReject';\n\n// Date/Time DTOs and Utilities (inspired by Java Time / JSR-310)\nexport {\n    InstantDto,\n    DateDto,\n    TimeDto,\n    DateTimeDto,\n    InstantUtil,\n    DateUtil,\n    TimeUtil,\n    DateTimeUtil,\n} from './http/datetime';\n\n// Context keys + registry (the global magic-context header system)\nexport { HeaderRegistry } from './http/HeaderRegistry';\nexport { ClientRegistry } from './http/ClientRegistry';\nexport { CallRegistry } from './http/CallRegistry';\nexport type { CallScope } from './http/CallScope';\nexport { CallScopeLadder } from './http/CallScope';\nexport { TransportDefault } from './http/TransportDefault';\nexport { RetryStrategy } from './http/RetryStrategy';\nexport { CallDeadline } from './http/CallDeadline';\nexport { CallContext } from './http/CallStrategy';\nexport type { Attempt, CallStrategy } from './http/CallStrategy';\nexport { ApiCallTimeoutError } from './http/ApiCallTimeoutError';\nexport type { ServiceUrlDeriver } from './http/ClientRegistry';\n\n// \"What service am I\" — set once at startup, read by the logging backends and by\n// RequestContextHeaders (to stamp requestIdSource on ids this service mints).\nexport { ServiceInfo } from './http/ServiceInfo';\n// \"Where am I running\" — declared once at startup (setupRuntime, from RuntimeSetupOptions.locality).\n// The ONE input to @WpLocalOnly enforcement. Undeclared reads as DEPLOYED (fail safe).\nexport { RuntimeLocality } from './http/RuntimeLocality';\nexport type { Locality } from './http/RuntimeLocality';\n// The ENTIRE HTTP response as pure data — the ONE form both transports (express, fetch) are\n// normalised into, so an ErrorTranslator implementation is written once and serves both.\nexport { HttpHeader, HttpResponseStatus, HttpResponseDto } from './http/HttpResponseDto';\n// Pluggable, bidirectional error translation (app exception <-> the WHOLE response). Set on\n// ClientRegistry at startup; consulted before the built-in webpieces mapping on BOTH sides.\nexport type { ErrorTranslator } from './http/ErrorTranslator';\n// THE webpieces default translator — always installed, and what an app's own translator delegates to\n// in order to decline an error. ONE class, both halves, node and browser alike.\nexport {\n    WebpiecesDefaultErrorTranslator,\n    WEBPIECES_DEFAULT_ERROR_TRANSLATOR,\n} from './http/WebpiecesDefaultErrorTranslator';\n// WHICH KIND OF CALLER drove this request (gui / llm / public-api), and the per-request end-user\n// status derived from it — the replacement for the deleted per-router EndUserStatus.\nexport { SurfaceEndUserStatus } from './http/Surface';\nexport type { Surface } from './http/Surface';\n// The ONE rule for an error RECEIVED from another process, shared verbatim by HTTP and IPC.\nexport { ReceivedApiErrorRule } from './errors/ReceivedApiErrorRule';\n// Pluggable per-client error classification: one CallOutcome (EXPECTED / TRANSIENT_FAILURE /\n// FAILURE) per thrown API-call error. Registered on ClientRegistry at startup; read by RetryStrategy,\n// CallRegistry's per-attempt log line, LogApiCall and the MCP renderer's retry advice.\nexport type { ErrorClassifier } from './http/ErrorClassifier';\nexport { CallOutcome } from './http/ErrorClassifier';\nexport {\n    WebpiecesDefaultErrorClassifier,\n    WEBPIECES_DEFAULT_ERROR_CLASSIFIER,\n} from './http/WebpiecesDefaultErrorClassifier';\nexport { templateDeriver } from './http/templateDeriver';\nexport { WebpiecesCoreHeaders } from './http/WebpiecesCoreHeaders';\nexport { ContextReader } from './http/ContextReader';\nexport { ContextWriter, ContextStore } from './http/ContextWriter';\n\n// The OUTBOUND half of the trust model: whether a TRUSTED context key may ride to the endpoint being\n// called. Built ONLY from the destination endpoint's AuthMode — see the class doc.\nexport { DestinationTrust } from './http/DestinationTrust';\n\n// BROWSER-ONLY outbound-header propagation (app-held store + registry -> outbound HTTP headers).\n// Only @webpieces/http-client-browser may name it; the server reads RequestContext directly via\n// RequestContextHeaders in the Node-only @webpieces/core-context.\nexport { ContextMgr } from './http/ContextMgr';\n\n// API-call logging helper (uses LogManager above). NOT a singleton: construct one per environment\n// with that environment's ApiCallContext — `new LogApiCallImpl(new RequestContextApiCallContext())`\n// on node, `new LogApiCallImpl(new BrowserApiCallContext())` in a browser.\nexport { LogApiCallImpl } from './http/LogApiCall';\n// The logged-body cap (#1300): a per-runtime default (browser 2,000 / node 50,000 chars), overridable\n// once at startup with `LogApiCall.configure(new LogApiCallConfig(n))`.\nexport { LogApiCall, LogApiCallConfig } from './http/LogApiCall';\n\n// Opt-in field masking for the LogApiCall log path — declare per-api sensitive fields so secrets\n// (OAuth refresh tokens, id-token JWTs) are masked in the logs while the real value stays on the wire.\nexport { MaskSpec } from './http/LogFieldMask';\nexport type { MaskMode } from './http/LogFieldMask';\n\n// The structured `api` tag + the context-writer seam LogApiCall stamps through. The Node\n// RequestContext-backed impl lives in @webpieces/core-context, the browser one in\n// @webpieces/http-client-browser; each is CONSTRUCTED by its package, never installed globally.\nexport { ApiCallInfo, HttpCallFacts, HttpCallFactsHolder } from './http/ApiCallInfo';\nexport type { ApiCallDirection, ApiResult } from './http/ApiCallInfo';\n// Console-render bridge: turns LogApiCall's [LogApiCall] bracket into [API.{side}.{phase}] locally.\nexport {\n    ApiCallLogName,\n    ApiCallLogNameImpl,\n    LOG_API_CALL_LOGGER_NAME,\n} from './http/ApiCallLogName';\nexport { ApiMethodInfo } from './http/ApiMethodInfo';\nexport type { ApiSide } from './http/ApiMethodInfo';\nexport type { ApiCallContext } from './http/ApiCallContext';\n\n// Test-case recording contract (impl lives in http-server; hooks in http-client)\nexport { TestCaseRecorder, RecorderKeys } from './http/recorder/TestCaseRecorder';\nexport {\n    RecordedEndpoint,\n    RecordedError,\n    RecordedTestCase,\n} from './http/recorder/RecordedEndpoint';\nexport { DoNotRecord, getDoNotRecordFields } from './http/recorder/DoNotRecord';\nexport { RecordSerializer, SerializedMap, SerializedError } from './http/recorder/RecordSerializer';\n\n// ---------------------------------------------------------------------------------------------\n// Filter-chain primitives, shared by BOTH chains: the inbound server chain\n// (`Filter<MethodMeta, WpResponse<unknown>>`, @webpieces/http-routing) and the outbound client\n// chain (`Filter<ClientRequest, Response>`, @webpieces/http-client-core). Declared once, here, in\n// the package both depend on — see the class doc for why a second pair would be a shim.\nexport { Filter } from './filters/Filter';\nexport type { Service } from './filters/Filter';\nexport { FilterChain } from './filters/FilterChain';\n\nexport {\n    ApiError,\n    ApiNotFoundError,\n    ApiDependencyError,\n    ApiBadGatewayError,\n    ApiUnavailableError,\n    ApiDependencyTimeoutError,\n    ApiImplementationError,\n    ApiRateLimitedError,\n    ApiForbiddenError,\n    ApiRequestTimeoutError,\n    ApiEndUserError,\n    ApiBadRequestError,\n    ApiUnauthorizedError,\n    ApiDependencyBackoffError,\n    ApiRetriesExhaustedError,\n    ApiConnectionError,\n    ApiEndpointNotFoundError,\n    ApiConflictError,\n    ApiUnprocessableError,\n    ApiPreconditionFailedError,\n    ApiUnsupportedMediaTypeError,\n    ApiNotImplementedError,\n    ApiCodedError,\n    ApiClientTooOldError,\n    ApiEndUserNotFoundError,\n    ApiEndUserForbiddenError,\n    ApiEndUserBadRequestError,\n    EndUserErrorCode,\n    EndUserErrorRegistry,\n    ClientRole,\n    ApiErrorCodec,\n    ApiErrorPayload,\n    ApiErrorBoundary,\n    ApiCallSite,\n    CallMode,\n    CallModeMarker,\n    ReportableApiFailure,\n    RpcCallFailed,\n} from './errors';\nexport type {\n    ApiErrorKind,\n    ApiStatusCode,\n    EdgeHttpStatus,\n    EndUserErrorFactory,\n    CallSiteBoundary,\n} from './errors';\nexport { ApiErrorHttpStatus } from './http/ApiErrorHttpStatus';\n\n// RFC 6749 / 6750 / 7591 OAuth refusals for app-hosted OAuth endpoints (#1176): the typed error,\n// its one renderer, the Bearer challenge builder and the authorization-endpoint error redirect.\nexport { OAuthErrorCode, OAuthErrorStatus, OAuthText } from './oauth/OAuthErrorCode';\nexport type {\n    OAuthHttpStatus,\n    InvalidClientStatus,\n    OAuthFixedStatusErrorCode,\n    BearerErrorCode,\n    AuthorizationEndpointErrorCode,\n} from './oauth/OAuthErrorCode';\nexport { OAuthProtocolError, OAuthErrorExtras } from './oauth/OAuthProtocolError';\nexport { OAuthBearerChallenge } from './oauth/OAuthBearerChallenge';\nexport { OAuthErrorBody, OAuthErrorResponse } from './oauth/OAuthErrorResponse';\nexport { OAuthAuthorizationErrorRedirect } from './oauth/OAuthAuthorizationErrorRedirect';\nexport type { PublishedKind, PublishedApiError } from './http/ApiErrorHttpStatus';\n\nexport { Mcp, McpToolProfilesOptions } from './mcp/Mcp';\nexport type { McpToolProfiles } from './mcp/Mcp';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/core/core-util/src/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;AAEH,+CAA2C;AAAlC,qGAAA,OAAO,OAAA;AAChB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AAOnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,+EAA+E;AAC/E,kFAAkF;AAClF,yCAAyC;AACzC,mDAA0F;AAAjF,gHAAA,cAAc,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAAE,sHAAA,oBAAoB,OAAA;AAO/D,yDAAwD;AAA/C,8GAAA,aAAa,OAAA;AACtB,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,mDAAkD;AAAzC,wGAAA,UAAU,OAAA;AACnB,mDAM8B;AAL1B,wGAAA,UAAU,OAAA;AACV,4GAAA,cAAc,OAAA;AACd,0GAAA,YAAY,OAAA;AACZ,+GAAA,iBAAiB,OAAA;AACjB,kHAAA,oBAAoB,OAAA;AAGxB,8DAA8D;AAC9D,sEAAsE;AACtE,qEAAqE;AACrE,uEAAuE;AACvE,kEAAkE;AAElE,4BAA4B;AAC5B,gDA4B2B;AA3BvB,qGAAA,OAAO,OAAA;AACP,sGAAA,QAAQ,OAAA;AACR,mEAAmE;AACnE,0GAAA,YAAY,OAAA;AACZ,oGAAA,MAAM,OAAA;AACN,wHAAA,0BAA0B,OAAA;AAC1B,yGAAA,WAAW,OAAA;AACX,yGAAA,WAAW,OAAA;AACX,qGAAA,OAAO,OAAA;AACP,wGAAA,UAAU,OAAA;AACV,0GAAA,YAAY,OAAA;AACZ,mHAAA,qBAAqB,OAAA;AACrB,gHAAA,kBAAkB,OAAA;AAClB,kHAAA,oBAAoB,OAAA;AACpB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAChB,yGAAA,WAAW,OAAA;AACX,wGAAA,UAAU,OAAA;AACV,uGAAA,SAAS,OAAA;AACT,uGAAA,SAAS,OAAA;AACT,yGAAA,WAAW,OAAA;AACX,4HAAA,8BAA8B,OAAA;AAC9B,yHAAA,2BAA2B,OAAA;AAC3B,mHAAA,qBAAqB,OAAA;AACrB,yIAAA,2CAA2C,OAAA;AAC3C,6HAAA,+BAA+B,OAAA;AAC/B,2GAAA,aAAa,OAAA;AAEjB,8EAK0C;AAJtC,sHAAA,SAAS,OAAA;AACT,uHAAA,UAAU,OAAA;AACV,wHAAA,WAAW,OAAA;AACX,yIAAA,4BAA4B,OAAA;AAEhC,kDAAiD;AAAxC,0GAAA,WAAW,OAAA;AAEpB,4EAA6F;AAApF,iHAAA,KAAK,OAAA;AAAE,iHAAA,KAAK,OAAA;AAAE,iHAAA,KAAK,OAAA;AAAE,iIAAA,qBAAqB,OAAA;AAEnD,4CAUyB;AATrB,mGAAA,OAAO,OAAA;AACP,sGAAA,UAAU,OAAA;AACV,6GAAA,iBAAiB,OAAA;AACjB,+FAAA,GAAG,OAAA;AACH,iHAAA,qBAAqB,OAAA;AACrB,6GAAA,iBAAiB,OAAA;AACjB,uGAAA,WAAW,OAAA;AACX,mHAAA,uBAAuB,OAAA;AACvB,wHAAA,4BAA4B,OAAA;AAGhC,qDAW6B;AAVzB,2GAAA,UAAU,OAAA;AACV,8GAAA,aAAa,OAAA;AACb,8GAAA,aAAa,OAAA;AACb,4GAAA,WAAW,OAAA;AACX,gHAAA,eAAe,OAAA;AACf,mHAAA,kBAAkB,OAAA;AAClB,+GAAA,cAAc,OAAA;AACd,kHAAA,iBAAiB,OAAA;AACjB,qHAAA,oBAAoB,OAAA;AACpB,kHAAA,iBAAiB,OAAA;AAGrB,2FAA2F;AAC3F,sDAAqD;AAA5C,8GAAA,aAAa,OAAA;AACtB,oEAAmE;AAA1D,4HAAA,oBAAoB,OAAA;AAC7B,sDAK8B;AAJ1B,kHAAA,iBAAiB,OAAA;AACjB,yHAAA,wBAAwB,OAAA;AACxB,gHAAA,eAAe,OAAA;AACf,iHAAA,gBAAgB,OAAA;AAGpB,wEAAiG;AAAxF,gIAAA,sBAAsB,OAAA;AAAE,kIAAA,wBAAwB,OAAA;AACzD,gEAImC;AAH/B,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AACnB,6HAAA,uBAAuB,OAAA;AAE3B,oDAK6B;AAJzB,gHAAA,gBAAgB,OAAA;AAChB,kHAAA,kBAAkB,OAAA;AAClB,oHAAA,oBAAoB,OAAA;AACpB,wHAAA,wBAAwB,OAAA;AAE5B,8DAWkC;AAV9B,sHAAA,iBAAiB,OAAA;AACjB,mHAAA,cAAc,OAAA;AACd,8HAAA,yBAAyB,OAAA;AACzB,yHAAA,oBAAoB,OAAA;AACpB,yHAAA,oBAAoB,OAAA;AACpB,iHAAA,YAAY,OAAA;AACZ,oHAAA,eAAe,OAAA;AACf,6GAAA,QAAQ,OAAA;AACR,yHAAA,oBAAoB,OAAA;AACpB,6HAAA,wBAAwB,OAAA;AAU5B,oDAS6B;AARzB,mGAAA,GAAG,OAAA;AACH,oGAAA,IAAI,OAAA;AACJ,mGAAA,GAAG,OAAA;AACH,qGAAA,KAAK,OAAA;AACL,sGAAA,MAAM,OAAA;AACN,4GAAA,YAAY,OAAA;AACZ,+GAAA,eAAe,OAAA;AACf,4GAAA,YAAY,OAAA;AAShB,gDAU2B;AATvB,iGAAA,GAAG,OAAA;AACH,wGAAA,UAAU,OAAA;AACV,kGAAA,IAAI,OAAA;AACJ,8GAAA,gBAAgB,OAAA;AAChB,+GAAA,iBAAiB,OAAA;AACjB,kGAAA,IAAI,OAAA;AACJ,8GAAA,gBAAgB,OAAA;AAChB,mGAAA,KAAK,OAAA;AACL,kGAAA,IAAI,OAAA;AAER,kEAIoC;AAHhC,0HAAA,mBAAmB,OAAA;AACnB,6HAAA,sBAAsB,OAAA;AACtB,kIAAA,2BAA2B,OAAA;AAG/B,iDAS2B;AARvB,oHAAA,qBAAqB,OAAA;AACrB,4HAAA,6BAA6B,OAAA;AAC7B,wGAAA,SAAS,OAAA;AACT,6GAAA,cAAc,OAAA;AACd,gHAAA,iBAAiB,OAAA;AACjB,wHAAA,yBAAyB,OAAA;AACzB,4GAAA,aAAa,OAAA;AACb,mHAAA,oBAAoB,OAAA;AAGxB,iDAAgD;AAAvC,0GAAA,WAAW,OAAA;AACpB,6CAMyB;AALrB,0GAAA,aAAa,OAAA;AACb,uHAAA,0BAA0B,OAAA;AAC1B,mHAAA,sBAAsB,OAAA;AACtB,iHAAA,oBAAoB,OAAA;AACpB,gHAAA,mBAAmB,OAAA;AAGvB,+DAIkC;AAH9B,wHAAA,kBAAkB,OAAA;AAClB,yHAAA,mBAAmB,OAAA;AACnB,uHAAA,iBAAiB,OAAA;AAErB,uEAKsC;AAJlC,gIAAA,sBAAsB,OAAA;AACtB,+HAAA,qBAAqB,OAAA;AACrB,8HAAA,oBAAoB,OAAA;AACpB,8HAAA,oBAAoB,OAAA;AAQxB,+FAA+F;AAC/F,8CAS0B;AARtB,qGAAA,QAAQ,OAAA;AACR,4GAAA,eAAe,OAAA;AACf,gGAAA,GAAG,OAAA;AACH,4GAAA,eAAe,OAAA;AACf,qGAAA,QAAQ,OAAA;AACR,yGAAA,YAAY,OAAA;AACZ,uGAAA,UAAU,OAAA;AACV,mGAAA,MAAM,OAAA;AAYV,sGAAsG;AACtG,yFAAyF;AACzF,4CASyB;AARrB,+FAAA,GAAG,OAAA;AACH,kGAAA,MAAM,OAAA;AACN,iGAAA,KAAK,OAAA;AACL,sHAAA,0BAA0B,OAAA;AAC1B,sGAAA,UAAU,OAAA;AACV,yGAAA,aAAa,OAAA;AACb,mHAAA,uBAAuB,OAAA;AACvB,wGAAA,YAAY,OAAA;AAGhB,kEAAkE;AAClE,8DAA8D;AAC9D,mCAAmC;AACnC,0DAMgC;AAL5B,wHAAA,qBAAqB,OAAA;AACrB,sHAAA,mBAAmB,OAAA;AACnB,iHAAA,cAAc,OAAA;AACd,uHAAA,oBAAoB,OAAA;AACpB,oHAAA,iBAAiB,OAAA;AAGrB,4FAA4F;AAC5F,0CAAkD;AAAzC,kGAAA,OAAO,OAAA;AAAE,kGAAA,OAAO,OAAA;AAKzB,oCAAoC;AACpC,mCASkB;AARd,0GAAA,gBAAgB,OAAA;AAChB,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,sGAAA,YAAY,OAAA;AACZ,6GAAA,mBAAmB,OAAA;AACnB,sGAAA,YAAY,OAAA;AACZ,uGAAA,aAAa,OAAA;AACb,qGAAA,WAAW,OAAA;AAGf,sDAA+D;AAAtD,wHAAA,uBAAuB,OAAA;AAEhC,iEAAiE;AACjE,4CASyB;AAJrB,uGAAA,WAAW,OAAA;AACX,oGAAA,QAAQ,OAAA;AACR,oGAAA,QAAQ,OAAA;AACR,wGAAA,YAAY,OAAA;AAGhB,mEAAmE;AACnE,wDAAuD;AAA9C,gHAAA,cAAc,OAAA;AACvB,wDAAuD;AAA9C,gHAAA,cAAc,OAAA;AACvB,oDAAmD;AAA1C,4GAAA,YAAY,OAAA;AAErB,8CAAmD;AAA1C,4GAAA,eAAe,OAAA;AACxB,4DAA2D;AAAlD,oHAAA,gBAAgB,OAAA;AACzB,sDAAqD;AAA5C,8GAAA,aAAa,OAAA;AACtB,oDAAmD;AAA1C,4GAAA,YAAY,OAAA;AACrB,oDAAkD;AAAzC,2GAAA,WAAW,OAAA;AAEpB,kEAAiE;AAAxD,0HAAA,mBAAmB,OAAA;AAG5B,iFAAiF;AACjF,8EAA8E;AAC9E,kDAAiD;AAAxC,0GAAA,WAAW,OAAA;AACpB,qGAAqG;AACrG,uFAAuF;AACvF,0DAAyD;AAAhD,kHAAA,eAAe,OAAA;AAExB,4FAA4F;AAC5F,yFAAyF;AACzF,0DAAyF;AAAhF,6GAAA,UAAU,OAAA;AAAE,qHAAA,kBAAkB,OAAA;AAAE,kHAAA,eAAe,OAAA;AAIxD,qGAAqG;AACrG,gFAAgF;AAChF,0FAGgD;AAF5C,kJAAA,+BAA+B,OAAA;AAC/B,qJAAA,kCAAkC,OAAA;AAEtC,iGAAiG;AACjG,qFAAqF;AACrF,0CAAsD;AAA7C,+GAAA,oBAAoB,OAAA;AAE7B,4FAA4F;AAC5F,sEAAqE;AAA5D,4HAAA,oBAAoB,OAAA;AAK7B,0DAAqD;AAA5C,8GAAA,WAAW,OAAA;AACpB,0FAGgD;AAF5C,kJAAA,+BAA+B,OAAA;AAC/B,qJAAA,kCAAkC,OAAA;AAEtC,0DAAyD;AAAhD,kHAAA,eAAe,OAAA;AACxB,oEAAmE;AAA1D,4HAAA,oBAAoB,OAAA;AAI7B,qGAAqG;AACrG,mFAAmF;AACnF,4DAA2D;AAAlD,oHAAA,gBAAgB,OAAA;AAEzB,iGAAiG;AACjG,gGAAgG;AAChG,kEAAkE;AAClE,gDAA+C;AAAtC,wGAAA,UAAU,OAAA;AAEnB,kGAAkG;AAClG,oGAAoG;AACpG,2EAA2E;AAC3E,gDAAmD;AAA1C,4GAAA,cAAc,OAAA;AACvB,sGAAsG;AACtG,wEAAwE;AACxE,gDAAiE;AAAxD,wGAAA,UAAU,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AAErC,iGAAiG;AACjG,uGAAuG;AACvG,oDAA+C;AAAtC,wGAAA,QAAQ,OAAA;AAGjB,yFAAyF;AACzF,kFAAkF;AAClF,gGAAgG;AAChG,kDAAqF;AAA5E,0GAAA,WAAW,OAAA;AAAE,4GAAA,aAAa,OAAA;AAAE,kHAAA,mBAAmB,OAAA;AAExD,oGAAoG;AACpG,wDAI+B;AAH3B,gHAAA,cAAc,OAAA;AACd,oHAAA,kBAAkB,OAAA;AAClB,0HAAA,wBAAwB,OAAA;AAE5B,sDAAqD;AAA5C,8GAAA,aAAa,OAAA;AAItB,iFAAiF;AACjF,qEAAkF;AAAvD,gHAAA,YAAY,OAAA;AACvC,qEAI0C;AAHtC,oHAAA,gBAAgB,OAAA;AAChB,iHAAA,aAAa,OAAA;AACb,oHAAA,gBAAgB,OAAA;AAEpB,2DAAgF;AAAvE,0GAAA,WAAW,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAC1C,qEAAoG;AAA3F,oHAAA,gBAAgB,OAAA;AAAE,iHAAA,aAAa,OAAA;AAAE,mHAAA,eAAe,OAAA;AAEzD,gGAAgG;AAChG,2EAA2E;AAC3E,+FAA+F;AAC/F,kGAAkG;AAClG,wFAAwF;AACxF,2CAA0C;AAAjC,gGAAA,MAAM,OAAA;AAEf,qDAAoD;AAA3C,0GAAA,WAAW,OAAA;AAEpB,mCAuCkB;AAtCd,kGAAA,QAAQ,OAAA;AACR,0GAAA,gBAAgB,OAAA;AAChB,4GAAA,kBAAkB,OAAA;AAClB,4GAAA,kBAAkB,OAAA;AAClB,6GAAA,mBAAmB,OAAA;AACnB,mHAAA,yBAAyB,OAAA;AACzB,gHAAA,sBAAsB,OAAA;AACtB,6GAAA,mBAAmB,OAAA;AACnB,2GAAA,iBAAiB,OAAA;AACjB,gHAAA,sBAAsB,OAAA;AACtB,yGAAA,eAAe,OAAA;AACf,4GAAA,kBAAkB,OAAA;AAClB,8GAAA,oBAAoB,OAAA;AACpB,mHAAA,yBAAyB,OAAA;AACzB,kHAAA,wBAAwB,OAAA;AACxB,4GAAA,kBAAkB,OAAA;AAClB,kHAAA,wBAAwB,OAAA;AACxB,0GAAA,gBAAgB,OAAA;AAChB,+GAAA,qBAAqB,OAAA;AACrB,oHAAA,0BAA0B,OAAA;AAC1B,sHAAA,4BAA4B,OAAA;AAC5B,gHAAA,sBAAsB,OAAA;AACtB,uGAAA,aAAa,OAAA;AACb,8GAAA,oBAAoB,OAAA;AACpB,iHAAA,uBAAuB,OAAA;AACvB,kHAAA,wBAAwB,OAAA;AACxB,mHAAA,yBAAyB,OAAA;AACzB,0GAAA,gBAAgB,OAAA;AAChB,8GAAA,oBAAoB,OAAA;AACpB,oGAAA,UAAU,OAAA;AACV,uGAAA,aAAa,OAAA;AACb,yGAAA,eAAe,OAAA;AACf,0GAAA,gBAAgB,OAAA;AAChB,qGAAA,WAAW,OAAA;AACX,kGAAA,QAAQ,OAAA;AACR,wGAAA,cAAc,OAAA;AACd,8GAAA,oBAAoB,OAAA;AACpB,uGAAA,aAAa,OAAA;AASjB,gEAA+D;AAAtD,wHAAA,kBAAkB,OAAA;AAE3B,iGAAiG;AACjG,gGAAgG;AAChG,yDAAqF;AAA5E,gHAAA,cAAc,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAAE,2GAAA,SAAS,OAAA;AAQpD,iEAAkF;AAAzE,wHAAA,kBAAkB,OAAA;AAAE,sHAAA,gBAAgB,OAAA;AAC7C,qEAAoE;AAA3D,4HAAA,oBAAoB,OAAA;AAC7B,iEAAgF;AAAvE,oHAAA,cAAc,OAAA;AAAE,wHAAA,kBAAkB,OAAA;AAC3C,2FAA0F;AAAjF,kJAAA,+BAA+B,OAAA;AAGxC,iCAAwD;AAA/C,0FAAA,GAAG,OAAA;AAAE,6GAAA,sBAAsB,OAAA","sourcesContent":["/**\n * @webpieces/core-util\n *\n * Utility functions for WebPieces applications.\n * This package works in both browser and Node.js environments.\n *\n * @packageDocumentation\n */\n\nexport { toError } from './lib/errorUtils';\nexport { ContextKey } from './ContextKey';\nexport type {\n    AnyContextKey,\n    AnyTrustedContextKey,\n    AnyUntrustedContextKey,\n    Trust,\n} from './ContextKey';\nexport { ContextTuple } from './ContextTuple';\n\n// @DocumentDesign — DI-design-root marker. Applies to ANY project kind (server\n// controllers AND library impl classes), so it lives here (browser + Node) rather\n// than in a server-only routing package.\nexport { DocumentDesign, isDocumentDesign, DESIGN_METADATA_KEYS } from './DocumentDesign';\n\n// Logging (merged from former @webpieces/wp-logging).\n// Pluggable logging interface + a browser-safe console default; apps plug in\n// bunyan/winston/pino/etc. via LogManager.setFactory(...). Browser + Node.\nexport type { Logger, LogLevel } from './logging/Logger';\nexport type { LoggerFactory } from './logging/LoggerFactory';\nexport { ConsoleLogger } from './logging/ConsoleLogger';\nexport { ConsoleLoggerFactory } from './logging/ConsoleLoggerFactory';\nexport { LogManager } from './logging/LogManager';\nexport {\n    LogChunker,\n    LogChunkerImpl,\n    LogChunkInfo,\n    MAX_GCP_LOG_BYTES,\n    GCP_LOG_BUDGET_BYTES,\n} from './logging/LogChunker';\n\n// HTTP API contract (merged from former @webpieces/http-api).\n// Shared HTTP API definition consumed by both client and server: REST\n// decorators, the API error taxonomy, datetime DTOs, platform-header\n// registry/readers, ValidateImplementation, and the test-case recorder\n// contract. Pure definitions — express-free, browser + Node safe.\n\n// API definition decorators\nexport {\n    ApiPath,\n    Endpoint,\n    // Auth mode decorators (clean service-to-service + user JWT model)\n    WpAuthPublic,\n    WpAuth,\n    MISSING_AUTH_DECORATOR_FIX,\n    WpLocalOnly,\n    isLocalOnly,\n    MaskLog,\n    getApiPath,\n    getEndpoints,\n    getEndpointHttpMethod,\n    getEndpointOptions,\n    getEndpointOperation,\n    getEndpointKind,\n    getEndpointKinds,\n    getMaskSpec,\n    isFormPost,\n    isRawBody,\n    isApiPath,\n    getAuthMeta,\n    assertEveryEndpointHasAuthMode,\n    assertExternalEndpointKinds,\n    isExternalOutboundApi,\n    assertEveryVendorAuthEndpointRetainsRawBody,\n    validateNoConflictingDecorators,\n    METADATA_KEYS,\n} from './http/decorators';\nexport {\n    PathParam,\n    QueryParam,\n    QueryString,\n    getHttpParameterDeclarations,\n} from './http/http-parameter-decorators';\nexport { QueryParams } from './http/QueryParams';\nexport type { QueryParamValue } from './http/QueryParams';\nexport { WpInt, WpMin, WpMax, NUMERIC_METADATA_KEYS } from './http/numeric-field-decorators';\nexport type { Integer } from './http/numeric-field-decorators';\nexport {\n    ApiType,\n    SVC_TO_SVC,\n    EXTERNAL_CUSTOMER,\n    MCP,\n    API_TYPE_METADATA_KEY,\n    DEFAULT_API_TYPES,\n    getApiTypes,\n    getApiTypeEndpointNames,\n    assertApiTypeMatchesMcpTools,\n} from './http/api-type';\nexport type { ApiTypeKind } from './http/api-type';\nexport {\n    WpInternal,\n    WpIpcEndpoint,\n    isInternalApi,\n    getIpcApiId,\n    getIpcEndpoints,\n    getIpcEndpointKind,\n    getIpcMaskSpec,\n    assertInternalApi,\n    assertNotInternalApi,\n    IPC_METADATA_KEYS,\n} from './ipc/IpcDecorators';\nexport type { IpcApiType, IpcEndpointKind, IpcEndpointOptions } from './ipc/IpcDecorators';\n// The runtime representation of ONE route (split out of decorators.ts for file size only).\nexport { RouteMetadata } from './http/RouteMetadata';\nexport { RouteMetadataFactory } from './http/RouteMetadataFactory';\nexport {\n    AuthorizationType,\n    AuthorizationDeclaration,\n    WpAuthorization,\n    getAuthorization,\n} from './http/authorization';\nexport type { AuthorizationRequirement } from './http/authorization';\nexport { StreamingSchemaCatalog, registerStreamingCatalog } from './http/StreamingSchemaCatalog';\nexport {\n    StreamErrorControl,\n    StreamProtocolError,\n    StreamDisconnectedError,\n} from './http/StreamErrorControl';\nexport {\n    BoundHttpRequest,\n    HttpContractMapper,\n    HttpParameterBinding,\n    HttpParameterDeclaration,\n} from './http/HttpContract';\nexport {\n    StreamCorrelation,\n    StreamEnvelope,\n    StreamingEndpointMetadata,\n    StreamEventValidator,\n    StreamTransportError,\n    StreamWriter,\n    StreamDirection,\n    WpStream,\n    getStreamingEndpoint,\n    registerStreamingSchemas,\n} from './http/StreamingContract';\nexport type { RequestStream, ResponseStream, StreamEnvelopeKind } from './http/StreamingContract';\nexport type {\n    EndpointResponseType,\n    HttpMethod,\n    HttpParameterSource,\n    HttpParameterValueType,\n    HttpQueryItemType,\n} from './http/HttpContract';\nexport {\n    GET,\n    POST,\n    PUT,\n    PATCH,\n    DELETE,\n    HTTP_METHODS,\n    verbCarriesBody,\n    isHttpMethod,\n} from './http/HttpContract';\nexport type {\n    EndpointKind,\n    EndpointOperation,\n    EndpointOptions,\n    ExternalEndpointOptions,\n    NoResponseBodyOptionEndpointOptions,\n} from './http/decorators';\nexport {\n    RPC,\n    CLOUDTASKS,\n    CRON,\n    EXTERNAL_INBOUND,\n    EXTERNAL_OUTBOUND,\n    READ,\n    WRITE_IDEMPOTENT,\n    WRITE,\n    NONE,\n} from './http/decorators';\nexport {\n    ExternalContextKeys,\n    getExternalContextKeys,\n    declaresExternalContextKeys,\n} from './http/ExternalContextKeys';\nexport type { ResponseBodyKind } from './http/decorators';\nexport {\n    InvalidEndpointForMcp,\n    InvalidEndpointForMcpMetadata,\n    WpMcpTool,\n    WpMcpToolHints,\n    WpMcpToolMetadata,\n    getInvalidEndpointsForMcp,\n    getWpMcpTools,\n    mcpHintsForOperation,\n} from './mcp/McpMetadata';\nexport type { WpMcpMethodDecorator } from './mcp/McpMetadata';\nexport { McpToolName } from './mcp/McpToolName';\nexport {\n    ApiJsonSchema,\n    ApiJsonSchemaDiscriminator,\n    ApiJsonSchemaValidator,\n    DtoValidationFailure,\n    ObjectSchemaBuilder,\n} from './mcp/DtoSchema';\nexport type { ApiJsonSchemaType, DtoValue } from './mcp/DtoSchema';\nexport {\n    McpToolCatalogFile,\n    McpToolCatalogError,\n    McpToolDefinition,\n} from './mcp/McpToolCatalogFile';\nexport {\n    GeneratedApiDocsLayout,\n    GenerateLayoutProblem,\n    GenerateOutputLookup,\n    GenerateOutputTarget,\n} from './mcp/GeneratedApiDocsLayout';\nexport type {\n    LayoutDependsOn,\n    LayoutDependsOnObject,\n    LayoutTarget,\n    LayoutTargets,\n} from './mcp/GeneratedApiDocsLayout';\n// The TYPE layer of the auth surface — likewise split out of decorators.ts for file size only.\nexport {\n    AuthMeta,\n    AuthDeclaration,\n    jwt,\n    oidcSameProject,\n    oidcSvcs,\n    sharedSecret,\n    vendorAuth,\n    apiKey,\n} from './http/auth-mode';\nexport type {\n    AuthMode,\n    ApiKeyCredential,\n    ApiKeyCredentials,\n    AuthMethod,\n    AuthMethods,\n    OidcAuthMethod,\n    OidcAuthMethods,\n    OidcCallers,\n} from './http/auth-mode';\n// API kind (RPC vs PubSub/Cloud Tasks) + queue naming. Split out of decorators.ts for file size only;\n// one-way dependency api-kind -> decorators, and the barrel keeps the surface identical.\nexport {\n    Rpc,\n    PubSub,\n    Queue,\n    ENDPOINT_KINDS_BY_API_KIND,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n} from './http/api-kind';\nexport type { ApiKind } from './http/api-kind';\n// WHO calls an EXTERNAL_INBOUND endpoint — the caller declaration\n// @Endpoint(POST, ..., WRITE, EXTERNAL_INBOUND, { calledBy })\n// requires, and the reader for it.\nexport {\n    EXTERNAL_SYSTEM_KINDS,\n    DEFAULT_CALLER_KIND,\n    ExternalCaller,\n    isExternalSystemKind,\n    getEndpointCaller,\n} from './http/external-caller';\nexport type { ExternalSystemKind } from './http/external-caller';\n// Client-side shared-secret store (the value THIS service sends per sharedSecret(...) key).\nexport { Secrets, SECRETS } from './http/Secrets';\n\n// Type validators\nexport { ValidateImplementation } from './http/validators';\n\n// Authentication subtype constants.\nexport {\n    ENTITY_NOT_FOUND,\n    WRONG_LOGIN_TYPE,\n    WRONG_LOGIN,\n    NOT_APPROVED,\n    EMAIL_NOT_CONFIRMED,\n    WRONG_DOMAIN,\n    WRONG_COMPANY,\n    NO_REG_CODE,\n} from './errors';\n\nexport { NetworkRejectClassifier } from './http/networkReject';\n\n// Date/Time DTOs and Utilities (inspired by Java Time / JSR-310)\nexport {\n    InstantDto,\n    DateDto,\n    TimeDto,\n    DateTimeDto,\n    InstantUtil,\n    DateUtil,\n    TimeUtil,\n    DateTimeUtil,\n} from './http/datetime';\n\n// Context keys + registry (the global magic-context header system)\nexport { HeaderRegistry } from './http/HeaderRegistry';\nexport { ClientRegistry } from './http/ClientRegistry';\nexport { CallRegistry } from './http/CallRegistry';\nexport type { CallScope } from './http/CallScope';\nexport { CallScopeLadder } from './http/CallScope';\nexport { TransportDefault } from './http/TransportDefault';\nexport { RetryStrategy } from './http/RetryStrategy';\nexport { CallDeadline } from './http/CallDeadline';\nexport { CallContext } from './http/CallStrategy';\nexport type { Attempt, CallStrategy } from './http/CallStrategy';\nexport { ApiCallTimeoutError } from './http/ApiCallTimeoutError';\nexport type { ServiceUrlDeriver } from './http/ClientRegistry';\n\n// \"What service am I\" — set once at startup, read by the logging backends and by\n// RequestContextHeaders (to stamp requestIdSource on ids this service mints).\nexport { ServiceInfo } from './http/ServiceInfo';\n// \"Where am I running\" — declared once at startup (setupRuntime, from RuntimeSetupOptions.locality).\n// The ONE input to @WpLocalOnly enforcement. Undeclared reads as DEPLOYED (fail safe).\nexport { RuntimeLocality } from './http/RuntimeLocality';\nexport type { Locality } from './http/RuntimeLocality';\n// The ENTIRE HTTP response as pure data — the ONE form both transports (express, fetch) are\n// normalised into, so an ErrorTranslator implementation is written once and serves both.\nexport { HttpHeader, HttpResponseStatus, HttpResponseDto } from './http/HttpResponseDto';\n// Pluggable, bidirectional error translation (app exception <-> the WHOLE response). Set on\n// ClientRegistry at startup; consulted before the built-in webpieces mapping on BOTH sides.\nexport type { ErrorTranslator } from './http/ErrorTranslator';\n// THE webpieces default translator — always installed, and what an app's own translator delegates to\n// in order to decline an error. ONE class, both halves, node and browser alike.\nexport {\n    WebpiecesDefaultErrorTranslator,\n    WEBPIECES_DEFAULT_ERROR_TRANSLATOR,\n} from './http/WebpiecesDefaultErrorTranslator';\n// WHICH KIND OF CALLER drove this request (gui / llm / public-api), and the per-request end-user\n// status derived from it — the replacement for the deleted per-router EndUserStatus.\nexport { SurfaceEndUserStatus } from './http/Surface';\nexport type { Surface } from './http/Surface';\n// The ONE rule for an error RECEIVED from another process, shared verbatim by HTTP and IPC.\nexport { ReceivedApiErrorRule } from './errors/ReceivedApiErrorRule';\n// Pluggable per-client error classification: one CallOutcome (EXPECTED / TRANSIENT_FAILURE /\n// FAILURE) per thrown API-call error. Registered on ClientRegistry at startup; read by RetryStrategy,\n// CallRegistry's per-attempt log line, LogApiCall and the MCP renderer's retry advice.\nexport type { ErrorClassifier } from './http/ErrorClassifier';\nexport { CallOutcome } from './http/ErrorClassifier';\nexport {\n    WebpiecesDefaultErrorClassifier,\n    WEBPIECES_DEFAULT_ERROR_CLASSIFIER,\n} from './http/WebpiecesDefaultErrorClassifier';\nexport { templateDeriver } from './http/templateDeriver';\nexport { WebpiecesCoreHeaders } from './http/WebpiecesCoreHeaders';\nexport { ContextReader } from './http/ContextReader';\nexport { ContextWriter, ContextStore } from './http/ContextWriter';\n\n// The OUTBOUND half of the trust model: whether a TRUSTED context key may ride to the endpoint being\n// called. Built ONLY from the destination endpoint's AuthMode — see the class doc.\nexport { DestinationTrust } from './http/DestinationTrust';\n\n// BROWSER-ONLY outbound-header propagation (app-held store + registry -> outbound HTTP headers).\n// Only @webpieces/http-client-browser may name it; the server reads RequestContext directly via\n// RequestContextHeaders in the Node-only @webpieces/core-context.\nexport { ContextMgr } from './http/ContextMgr';\n\n// API-call logging helper (uses LogManager above). NOT a singleton: construct one per environment\n// with that environment's ApiCallContext — `new LogApiCallImpl(new RequestContextApiCallContext())`\n// on node, `new LogApiCallImpl(new BrowserApiCallContext())` in a browser.\nexport { LogApiCallImpl } from './http/LogApiCall';\n// The logged-body cap (#1300): a per-runtime default (browser 2,000 / node 50,000 chars), overridable\n// once at startup with `LogApiCall.configure(new LogApiCallConfig(n))`.\nexport { LogApiCall, LogApiCallConfig } from './http/LogApiCall';\n\n// Opt-in field masking for the LogApiCall log path — declare per-api sensitive fields so secrets\n// (OAuth refresh tokens, id-token JWTs) are masked in the logs while the real value stays on the wire.\nexport { MaskSpec } from './http/LogFieldMask';\nexport type { MaskMode } from './http/LogFieldMask';\n\n// The structured `api` tag + the context-writer seam LogApiCall stamps through. The Node\n// RequestContext-backed impl lives in @webpieces/core-context, the browser one in\n// @webpieces/http-client-browser; each is CONSTRUCTED by its package, never installed globally.\nexport { ApiCallInfo, HttpCallFacts, HttpCallFactsHolder } from './http/ApiCallInfo';\nexport type { ApiCallDirection, ApiResult } from './http/ApiCallInfo';\n// Console-render bridge: turns LogApiCall's [LogApiCall] bracket into [API.{side}.{phase}] locally.\nexport {\n    ApiCallLogName,\n    ApiCallLogNameImpl,\n    LOG_API_CALL_LOGGER_NAME,\n} from './http/ApiCallLogName';\nexport { ApiMethodInfo } from './http/ApiMethodInfo';\nexport type { ApiSide } from './http/ApiMethodInfo';\nexport type { ApiCallContext } from './http/ApiCallContext';\n\n// Test-case recording contract (impl lives in http-server; hooks in http-client)\nexport { TestCaseRecorder, RecorderKeys } from './http/recorder/TestCaseRecorder';\nexport {\n    RecordedEndpoint,\n    RecordedError,\n    RecordedTestCase,\n} from './http/recorder/RecordedEndpoint';\nexport { DoNotRecord, getDoNotRecordFields } from './http/recorder/DoNotRecord';\nexport { RecordSerializer, SerializedMap, SerializedError } from './http/recorder/RecordSerializer';\n\n// ---------------------------------------------------------------------------------------------\n// Filter-chain primitives, shared by BOTH chains: the inbound server chain\n// (`Filter<MethodMeta, WpResponse<unknown>>`, @webpieces/http-routing) and the outbound client\n// chain (`Filter<ClientRequest, Response>`, @webpieces/http-client-core). Declared once, here, in\n// the package both depend on — see the class doc for why a second pair would be a shim.\nexport { Filter } from './filters/Filter';\nexport type { Service } from './filters/Filter';\nexport { FilterChain } from './filters/FilterChain';\n\nexport {\n    ApiError,\n    ApiNotFoundError,\n    ApiDependencyError,\n    ApiBadGatewayError,\n    ApiUnavailableError,\n    ApiDependencyTimeoutError,\n    ApiImplementationError,\n    ApiRateLimitedError,\n    ApiForbiddenError,\n    ApiRequestTimeoutError,\n    ApiEndUserError,\n    ApiBadRequestError,\n    ApiUnauthorizedError,\n    ApiDependencyBackoffError,\n    ApiRetriesExhaustedError,\n    ApiConnectionError,\n    ApiEndpointNotFoundError,\n    ApiConflictError,\n    ApiUnprocessableError,\n    ApiPreconditionFailedError,\n    ApiUnsupportedMediaTypeError,\n    ApiNotImplementedError,\n    ApiCodedError,\n    ApiClientTooOldError,\n    ApiEndUserNotFoundError,\n    ApiEndUserForbiddenError,\n    ApiEndUserBadRequestError,\n    EndUserErrorCode,\n    EndUserErrorRegistry,\n    ClientRole,\n    ApiErrorCodec,\n    ApiErrorPayload,\n    ApiErrorBoundary,\n    ApiCallSite,\n    CallMode,\n    CallModeMarker,\n    ReportableApiFailure,\n    RpcCallFailed,\n} from './errors';\nexport type {\n    ApiErrorKind,\n    ApiStatusCode,\n    EdgeHttpStatus,\n    EndUserErrorFactory,\n    CallSiteBoundary,\n} from './errors';\nexport { ApiErrorHttpStatus } from './http/ApiErrorHttpStatus';\n\n// RFC 6749 / 6750 / 7591 OAuth refusals for app-hosted OAuth endpoints (#1176): the typed error,\n// its one renderer, the Bearer challenge builder and the authorization-endpoint error redirect.\nexport { OAuthErrorCode, OAuthErrorStatus, OAuthText } from './oauth/OAuthErrorCode';\nexport type {\n    OAuthHttpStatus,\n    InvalidClientStatus,\n    OAuthFixedStatusErrorCode,\n    BearerErrorCode,\n    AuthorizationEndpointErrorCode,\n} from './oauth/OAuthErrorCode';\nexport { OAuthProtocolError, OAuthErrorExtras } from './oauth/OAuthProtocolError';\nexport { OAuthBearerChallenge } from './oauth/OAuthBearerChallenge';\nexport { OAuthErrorBody, OAuthErrorResponse } from './oauth/OAuthErrorResponse';\nexport { OAuthAuthorizationErrorRedirect } from './oauth/OAuthAuthorizationErrorRedirect';\nexport type { PublishedKind, PublishedApiError } from './http/ApiErrorHttpStatus';\n\nexport { Mcp, McpToolProfilesOptions } from './mcp/Mcp';\nexport type { McpToolProfiles } from './mcp/Mcp';\n"]}