@webpieces/http-routing 0.3.309 → 0.3.310

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-routing",
-  "version": "0.3.309",
+  "version": "0.3.310",
   "description": "Decorator-based routing with auto-wiring for WebPieces",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,8 +22,8 @@
   },
   "dependencies": {
     "@inversifyjs/binding-decorators": "1.1.5",
-    "@webpieces/core-context": "0.3.309",
-    "@webpieces/core-util": "0.3.309",
+    "@webpieces/core-context": "0.3.310",
+    "@webpieces/core-util": "0.3.310",
     "inversify": "7.10.4",
     "minimatch": "10.0.1"
   }

package/src/AuthConfig.d.ts

@@ -1,13 +1,4 @@
-import { ContextKey, JwtRequirement } from '@webpieces/core-util';
-/**
- * ContextValue - one (ContextKey, value) pair the JWT parse plugin wants stamped into the
- * RequestContext (e.g. USER_ID, ORG_ID). Data-only structure (a class, per the guidelines).
- */
-export declare class ContextValue {
-    readonly key: ContextKey;
-    readonly value: unknown;
-    constructor(key: ContextKey, value: unknown);
-}
+import { ContextTuple, JwtRequirement } from '@webpieces/core-util';
 /**
  * SharedSecrets - the accepted values for ONE `@AuthSharedSecret(name)`. BOTH secret1 AND secret2
  * are accepted — this is what makes zero-downtime ROTATION possible:
@@ -32,9 +23,9 @@ export declare class SharedSecrets {
 export declare class AuthValues {
     readonly userId: string;
     readonly roles: string[];
-    readonly entries: ContextValue[];
+    readonly entries: ContextTuple[];
     readonly claims: Record<string, unknown>;
-    constructor(userId: string, roles?: string[], entries?: ContextValue[], claims?: Record<string, unknown>);
+    constructor(userId: string, roles?: string[], entries?: ContextTuple[], claims?: Record<string, unknown>);
 }
 /**
  * AuthConfig - the ONE app-provided auth binding the framework {@link AuthFilter} injects to enforce
@@ -45,14 +36,18 @@ export declare class AuthValues {
  *                       Prod fills it from env; a test binds `{ NAME: 'some-test-key' }` and can then
  *                       exercise the shared-secret path (and a negative test with a wrong key).
  *  - `parseJwt`       — PLUGIN: decode/verify a user JWT into {@link AuthValues} (userId, roles,
- *                       context entries). Minting a JWT is a controller concern (login), not here.
+ *                       context entries). The app owns the VERIFICATION — it picks the JWT library
+ *                       and strategy (a static HS256 secret, RS256 + JWKS with key rotation, or a
+ *                       provider SDK like Firebase/Auth0/Cognito). Minting a JWT is a controller
+ *                       concern (login), not here.
  *  - `verifyOidc`     — PLUGIN: verify a Google OIDC service-to-service token against the endpoint's
  *                       caller allow-list. Fully generic — the company base wires it to
  *                       @webpieces/gcp-identity once, so apps never customize OIDC.
  *
- * Keeping the plugins app-side means http-routing needs NO jsonwebtoken / gcp-identity. AuthFilter
- * injects this `@optional`: a public-only server binds none; a non-public route with no AuthConfig
- * (or no value/plugin for its mode) fails fast.
+ * The framework owns the SEAM + policy (AuthMode dispatch, {@link authorizeJwt} roles, 401/403
+ * translation), NOT the crypto — so http-routing needs NO jsonwebtoken / gcp-identity and never
+ * locks apps to one JWT library. AuthFilter injects this `@optional`: a public-only server binds
+ * none; a non-public route with no AuthConfig (or no value/plugin for its mode) fails fast.
  */
 export declare abstract class AuthConfig {
     /**

package/src/AuthConfig.js

@@ -1,22 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthConfig = exports.AuthValues = exports.SharedSecrets = exports.ContextValue = void 0;
+exports.AuthConfig = exports.AuthValues = exports.SharedSecrets = void 0;
 const core_util_1 = require("@webpieces/core-util");
-/**
- * ContextValue - one (ContextKey, value) pair the JWT parse plugin wants stamped into the
- * RequestContext (e.g. USER_ID, ORG_ID). Data-only structure (a class, per the guidelines).
- */
-class ContextValue {
-    key;
-    value;
-    constructor(key, 
-    // webpieces-disable no-any-unknown -- context values are arbitrary app-defined data
-    value) {
-        this.key = key;
-        this.value = value;
-    }
-}
-exports.ContextValue = ContextValue;
 /**
  * SharedSecrets - the accepted values for ONE `@AuthSharedSecret(name)`. BOTH secret1 AND secret2
  * are accepted — this is what makes zero-downtime ROTATION possible:
@@ -66,14 +51,18 @@ exports.AuthValues = AuthValues;
  *                       Prod fills it from env; a test binds `{ NAME: 'some-test-key' }` and can then
  *                       exercise the shared-secret path (and a negative test with a wrong key).
  *  - `parseJwt`       — PLUGIN: decode/verify a user JWT into {@link AuthValues} (userId, roles,
- *                       context entries). Minting a JWT is a controller concern (login), not here.
+ *                       context entries). The app owns the VERIFICATION — it picks the JWT library
+ *                       and strategy (a static HS256 secret, RS256 + JWKS with key rotation, or a
+ *                       provider SDK like Firebase/Auth0/Cognito). Minting a JWT is a controller
+ *                       concern (login), not here.
  *  - `verifyOidc`     — PLUGIN: verify a Google OIDC service-to-service token against the endpoint's
  *                       caller allow-list. Fully generic — the company base wires it to
  *                       @webpieces/gcp-identity once, so apps never customize OIDC.
  *
- * Keeping the plugins app-side means http-routing needs NO jsonwebtoken / gcp-identity. AuthFilter
- * injects this `@optional`: a public-only server binds none; a non-public route with no AuthConfig
- * (or no value/plugin for its mode) fails fast.
+ * The framework owns the SEAM + policy (AuthMode dispatch, {@link authorizeJwt} roles, 401/403
+ * translation), NOT the crypto — so http-routing needs NO jsonwebtoken / gcp-identity and never
+ * locks apps to one JWT library. AuthFilter injects this `@optional`: a public-only server binds
+ * none; a non-public route with no AuthConfig (or no value/plugin for its mode) fails fast.
  */
 class AuthConfig {
     /**

package/src/AuthConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/AuthConfig.ts"],"names":[],"mappings":";;;AAAA,oDAAsF;AAEtF;;;GAGG;AACH,MAAa,YAAY;IAED;IAEA;IAHpB,YACoB,GAAe;IAC/B,oFAAoF;IACpE,KAAc;QAFd,QAAG,GAAH,GAAG,CAAY;QAEf,UAAK,GAAL,KAAK,CAAS;IAC/B,CAAC;CACP;AAND,oCAMC;AAED;;;;;;;;;GASG;AACH,MAAa,aAAa;IAEF;IACA;IAFpB,YACoB,OAAe,EACf,OAAe;QADf,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAQ;IAChC,CAAC;CACP;AALD,sCAKC;AAED;;;;;GAKG;AACH,MAAa,UAAU;IAEC;IACA;IACA;IAEA;IALpB,YACoB,MAAc,EACd,QAAkB,EAAE,EACpB,UAA0B,EAAE;IAC5C,wGAAwG;IACxF,SAAkC,EAAE;QAJpC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAe;QACpB,YAAO,GAAP,OAAO,CAAqB;QAE5B,WAAM,GAAN,MAAM,CAA8B;IACrD,CAAC;CACP;AARD,gCAQC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAsB,UAAU;IAc5B;;;;;;OAMG;IACH,YAAY,CAAC,MAAkB,EAAE,WAA2B;QACxD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAAkB,CAAC,mCAAmC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACL,CAAC;CACJ;AA3BD,gCA2BC","sourcesContent":["import { ContextKey, JwtRequirement, HttpForbiddenError } from '@webpieces/core-util';\n\n/**\n * ContextValue - one (ContextKey, value) pair the JWT parse plugin wants stamped into the\n * RequestContext (e.g. USER_ID, ORG_ID). Data-only structure (a class, per the guidelines).\n */\nexport class ContextValue {\n    constructor(\n        public readonly key: ContextKey,\n        // webpieces-disable no-any-unknown -- context values are arbitrary app-defined data\n        public readonly value: unknown,\n    ) {}\n}\n\n/**\n * SharedSecrets - the accepted values for ONE `@AuthSharedSecret(name)`. BOTH secret1 AND secret2\n * are accepted — this is what makes zero-downtime ROTATION possible:\n *\n *   to rotate: shift secret2 → secret1, and put the NEW secret in secret2. Callers cut over from\n *   the old value to the new during the window; once every caller sends the new one, the stale\n *   value falls out on the next shift. At all times EITHER key works, so no request is dropped.\n *\n * Data-only structure (a class, per the guidelines). Leave secret2 empty for a single secret.\n */\nexport class SharedSecrets {\n    constructor(\n        public readonly secret1: string,\n        public readonly secret2: string,\n    ) {}\n}\n\n/**\n * AuthValues - what {@link AuthConfig.parseJwt} returns: the authenticated user's id + roles (used\n * by the framework to stamp a principal and enforce @AuthJwt(...roles)) plus any extra context\n * entries the app wants set (orgId, tenant, ...). The framework sets `entries` into RequestContext\n * via {@link RequestContext.putHeader}. Data-only structure (a class, per the guidelines).\n */\nexport class AuthValues {\n    constructor(\n        public readonly userId: string,\n        public readonly roles: string[] = [],\n        public readonly entries: ContextValue[] = [],\n        // webpieces-disable no-any-unknown -- raw JWT claims for app-defined authorization (inOrg, tenant, ...)\n        public readonly claims: Record<string, unknown> = {},\n    ) {}\n}\n\n/**\n * AuthConfig - the ONE app-provided auth binding the framework {@link AuthFilter} injects to enforce\n * each endpoint's AuthMode. It is a single abstract class (injected by type, per no-symbol-di-tokens)\n * bound in the APP container and rebindable in tests. Each mechanism has its RIGHT shape:\n *\n *  - `sharedSecrets`  — STATE: the expected secret VALUE per name (from `@AuthSharedSecret(name)`).\n *                       Prod fills it from env; a test binds `{ NAME: 'some-test-key' }` and can then\n *                       exercise the shared-secret path (and a negative test with a wrong key).\n *  - `parseJwt`       — PLUGIN: decode/verify a user JWT into {@link AuthValues} (userId, roles,\n *                       context entries). Minting a JWT is a controller concern (login), not here.\n *  - `verifyOidc`     — PLUGIN: verify a Google OIDC service-to-service token against the endpoint's\n *                       caller allow-list. Fully generic — the company base wires it to\n *                       @webpieces/gcp-identity once, so apps never customize OIDC.\n *\n * Keeping the plugins app-side means http-routing needs NO jsonwebtoken / gcp-identity. AuthFilter\n * injects this `@optional`: a public-only server binds none; a non-public route with no AuthConfig\n * (or no value/plugin for its mode) fails fast.\n */\nexport abstract class AuthConfig {\n    /**\n     * Accepted shared-secret values keyed by the `@AuthSharedSecret(name)` name. STATE. Each entry\n     * is a {@link SharedSecrets} (secret1 + secret2, either accepted) so secrets can be ROTATED\n     * with zero dropped requests.\n     */\n    abstract readonly sharedSecrets: Record<string, SharedSecrets>;\n\n    /** Parse a user JWT (kind:'jwt') — AUTHENTICATION only. Return who the user is, or throw. */\n    abstract parseJwt(token: string): AuthValues;\n\n    /** Verify a Google OIDC token from an allowed caller (kind:'oidc'); throw on failure. */\n    abstract verifyOidc(token: string, callers: string[]): Promise<void>;\n\n    /**\n     * AUTHORIZATION: check the authenticated user against the endpoint's {@link JwtRequirement}.\n     * DEFAULT enforces `roles` (any-of; empty = any authenticated user). OVERRIDE to enforce\n     * app-defined requirements carried by `@Auth({...})` — e.g.\n     * `if (requirement['inOrg'] && !values.claims['orgId']) throw new HttpForbiddenError(...)`.\n     * Throw HttpForbiddenError to deny; return to allow. This is the pluggable seam.\n     */\n    authorizeJwt(values: AuthValues, requirement: JwtRequirement): void {\n        const roles = requirement.roles ?? [];\n        if (roles.length > 0 && !roles.some((role: string) => values.roles.includes(role))) {\n            throw new HttpForbiddenError(`Endpoint requires one of roles: ${roles.join(', ')}`);\n        }\n    }\n}\n"]}
+{"version":3,"file":"AuthConfig.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/AuthConfig.ts"],"names":[],"mappings":";;;AAAA,oDAAwF;AAExF;;;;;;;;;GASG;AACH,MAAa,aAAa;IAEF;IACA;IAFpB,YACoB,OAAe,EACf,OAAe;QADf,YAAO,GAAP,OAAO,CAAQ;QACf,YAAO,GAAP,OAAO,CAAQ;IAChC,CAAC;CACP;AALD,sCAKC;AAED;;;;;GAKG;AACH,MAAa,UAAU;IAEC;IACA;IACA;IAEA;IALpB,YACoB,MAAc,EACd,QAAkB,EAAE,EACpB,UAA0B,EAAE;IAC5C,wGAAwG;IACxF,SAAkC,EAAE;QAJpC,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAe;QACpB,YAAO,GAAP,OAAO,CAAqB;QAE5B,WAAM,GAAN,MAAM,CAA8B;IACrD,CAAC;CACP;AARD,gCAQC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAsB,UAAU;IAc5B;;;;;;OAMG;IACH,YAAY,CAAC,MAAkB,EAAE,WAA2B;QACxD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,8BAAkB,CAAC,mCAAmC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxF,CAAC;IACL,CAAC;CACJ;AA3BD,gCA2BC","sourcesContent":["import { ContextTuple, JwtRequirement, HttpForbiddenError } from '@webpieces/core-util';\n\n/**\n * SharedSecrets - the accepted values for ONE `@AuthSharedSecret(name)`. BOTH secret1 AND secret2\n * are accepted — this is what makes zero-downtime ROTATION possible:\n *\n *   to rotate: shift secret2 → secret1, and put the NEW secret in secret2. Callers cut over from\n *   the old value to the new during the window; once every caller sends the new one, the stale\n *   value falls out on the next shift. At all times EITHER key works, so no request is dropped.\n *\n * Data-only structure (a class, per the guidelines). Leave secret2 empty for a single secret.\n */\nexport class SharedSecrets {\n    constructor(\n        public readonly secret1: string,\n        public readonly secret2: string,\n    ) {}\n}\n\n/**\n * AuthValues - what {@link AuthConfig.parseJwt} returns: the authenticated user's id + roles (used\n * by the framework to stamp a principal and enforce @AuthJwt(...roles)) plus any extra context\n * entries the app wants set (orgId, tenant, ...). The framework sets `entries` into RequestContext\n * via {@link RequestContext.putHeader}. Data-only structure (a class, per the guidelines).\n */\nexport class AuthValues {\n    constructor(\n        public readonly userId: string,\n        public readonly roles: string[] = [],\n        public readonly entries: ContextTuple[] = [],\n        // webpieces-disable no-any-unknown -- raw JWT claims for app-defined authorization (inOrg, tenant, ...)\n        public readonly claims: Record<string, unknown> = {},\n    ) {}\n}\n\n/**\n * AuthConfig - the ONE app-provided auth binding the framework {@link AuthFilter} injects to enforce\n * each endpoint's AuthMode. It is a single abstract class (injected by type, per no-symbol-di-tokens)\n * bound in the APP container and rebindable in tests. Each mechanism has its RIGHT shape:\n *\n *  - `sharedSecrets`  — STATE: the expected secret VALUE per name (from `@AuthSharedSecret(name)`).\n *                       Prod fills it from env; a test binds `{ NAME: 'some-test-key' }` and can then\n *                       exercise the shared-secret path (and a negative test with a wrong key).\n *  - `parseJwt`       — PLUGIN: decode/verify a user JWT into {@link AuthValues} (userId, roles,\n *                       context entries). The app owns the VERIFICATION — it picks the JWT library\n *                       and strategy (a static HS256 secret, RS256 + JWKS with key rotation, or a\n *                       provider SDK like Firebase/Auth0/Cognito). Minting a JWT is a controller\n *                       concern (login), not here.\n *  - `verifyOidc`     — PLUGIN: verify a Google OIDC service-to-service token against the endpoint's\n *                       caller allow-list. Fully generic — the company base wires it to\n *                       @webpieces/gcp-identity once, so apps never customize OIDC.\n *\n * The framework owns the SEAM + policy (AuthMode dispatch, {@link authorizeJwt} roles, 401/403\n * translation), NOT the crypto — so http-routing needs NO jsonwebtoken / gcp-identity and never\n * locks apps to one JWT library. AuthFilter injects this `@optional`: a public-only server binds\n * none; a non-public route with no AuthConfig (or no value/plugin for its mode) fails fast.\n */\nexport abstract class AuthConfig {\n    /**\n     * Accepted shared-secret values keyed by the `@AuthSharedSecret(name)` name. STATE. Each entry\n     * is a {@link SharedSecrets} (secret1 + secret2, either accepted) so secrets can be ROTATED\n     * with zero dropped requests.\n     */\n    abstract readonly sharedSecrets: Record<string, SharedSecrets>;\n\n    /** Parse a user JWT (kind:'jwt') — AUTHENTICATION only. Return who the user is, or throw. */\n    abstract parseJwt(token: string): AuthValues;\n\n    /** Verify a Google OIDC token from an allowed caller (kind:'oidc'); throw on failure. */\n    abstract verifyOidc(token: string, callers: string[]): Promise<void>;\n\n    /**\n     * AUTHORIZATION: check the authenticated user against the endpoint's {@link JwtRequirement}.\n     * DEFAULT enforces `roles` (any-of; empty = any authenticated user). OVERRIDE to enforce\n     * app-defined requirements carried by `@Auth({...})` — e.g.\n     * `if (requirement['inOrg'] && !values.claims['orgId']) throw new HttpForbiddenError(...)`.\n     * Throw HttpForbiddenError to deny; return to allow. This is the pluggable seam.\n     */\n    authorizeJwt(values: AuthValues, requirement: JwtRequirement): void {\n        const roles = requirement.roles ?? [];\n        if (roles.length > 0 && !roles.some((role: string) => values.roles.includes(role))) {\n            throw new HttpForbiddenError(`Endpoint requires one of roles: ${roles.join(', ')}`);\n        }\n    }\n}\n"]}

package/src/index.d.ts

@@ -13,7 +13,7 @@ export { RouteHandler } from './RouteHandler';
 export { FilterMatcher, HttpFilter } from './FilterMatcher';
 export { ApiFactory } from './ApiFactory';
 export { ApiClient, ApiClientProxy } from './ApiClient';
-export { AuthConfig, AuthValues, ContextValue, SharedSecrets } from './AuthConfig';
+export { AuthConfig, AuthValues, SharedSecrets } from './AuthConfig';
 export { fillContext } from './fillContext';
 export { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';
 export { setupRuntime, RuntimeSetupOptions } from './setupRuntime';

package/src/index.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.fillContext = exports.SharedSecrets = exports.ContextValue = exports.AuthValues = exports.AuthConfig = exports.ApiClient = exports.FilterMatcher = exports.RouteHandler = exports.MethodMeta = exports.FilterChain = exports.WpResponse = exports.Filter = exports.HttpRequest = exports.FilterDefinition = exports.RouteDefinition = exports.ApiRoutingFactory = exports.buildFrameworkModule = exports.provideFrameworkSingletonAs = exports.provideFrameworkSingleton = exports.provideTransient = exports.provideSingletonAs = exports.provideSingleton = exports.ROUTING_METADATA_KEYS = exports.SourceFile = exports.isDocumentDesign = exports.DocumentDesign = exports.METADATA_KEYS = exports.RouteMetadata = exports.AuthMeta = exports.getQueueName = exports.assertPubSubConventions = exports.assertApiKind = exports.getApiKind = exports.assertEveryEndpointHasAuthMode = exports.getAuthMode = exports.getAuthMeta = exports.isApiPath = exports.getEndpoints = exports.getApiPath = exports.Queue = exports.PubSub = exports.Rpc = exports.AuthSharedSecret = exports.AuthOidc = exports.AuthJwt = exports.Public = exports.AuthenticationConfig = exports.Authentication = exports.Endpoint = exports.ApiPath = void 0;
-exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = exports.RequestContextReader = exports.RuntimeSetupOptions = exports.setupRuntime = exports.WebpiecesRouterFactory = exports.WebpiecesRouter = void 0;
+exports.WebpiecesRouter = exports.fillContext = exports.SharedSecrets = exports.AuthValues = exports.AuthConfig = exports.ApiClient = exports.FilterMatcher = exports.RouteHandler = exports.MethodMeta = exports.FilterChain = exports.WpResponse = exports.Filter = exports.HttpRequest = exports.FilterDefinition = exports.RouteDefinition = exports.ApiRoutingFactory = exports.buildFrameworkModule = exports.provideFrameworkSingletonAs = exports.provideFrameworkSingleton = exports.provideTransient = exports.provideSingletonAs = exports.provideSingleton = exports.ROUTING_METADATA_KEYS = exports.SourceFile = exports.isDocumentDesign = exports.DocumentDesign = exports.METADATA_KEYS = exports.RouteMetadata = exports.AuthMeta = exports.getQueueName = exports.assertPubSubConventions = exports.assertApiKind = exports.getApiKind = exports.assertEveryEndpointHasAuthMode = exports.getAuthMode = exports.getAuthMeta = exports.isApiPath = exports.getEndpoints = exports.getApiPath = exports.Queue = exports.PubSub = exports.Rpc = exports.AuthSharedSecret = exports.AuthOidc = exports.AuthJwt = exports.Public = exports.AuthenticationConfig = exports.Authentication = exports.Endpoint = exports.ApiPath = void 0;
+exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = exports.RequestContextReader = exports.RuntimeSetupOptions = exports.setupRuntime = exports.WebpiecesRouterFactory = void 0;
 // Re-export API decorators from core-util for convenience
 var core_util_1 = require("@webpieces/core-util");
 Object.defineProperty(exports, "ApiPath", { enumerable: true, get: function () { return core_util_1.ApiPath; } });
@@ -77,7 +77,6 @@ Object.defineProperty(exports, "ApiClient", { enumerable: true, get: function ()
 var AuthConfig_1 = require("./AuthConfig");
 Object.defineProperty(exports, "AuthConfig", { enumerable: true, get: function () { return AuthConfig_1.AuthConfig; } });
 Object.defineProperty(exports, "AuthValues", { enumerable: true, get: function () { return AuthConfig_1.AuthValues; } });
-Object.defineProperty(exports, "ContextValue", { enumerable: true, get: function () { return AuthConfig_1.ContextValue; } });
 Object.defineProperty(exports, "SharedSecrets", { enumerable: true, get: function () { return AuthConfig_1.SharedSecrets; } });
 // Above-boundary context setup shared by every transport adapter.
 var fillContext_1 = require("./fillContext");

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/index.ts"],"names":[],"mappings":";;;;AAAA,0DAA0D;AAC1D,kDA8B8B;AA7B1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AACpB,mGAAA,MAAM,OAAA;AACN,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,6GAAA,gBAAgB,OAAA;AAChB,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA;AACL,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AACZ,sGAAA,SAAS,OAAA;AACT,wGAAA,WAAW,OAAA;AACX,wGAAA,WAAW,OAAA;AACX,2HAAA,8BAA8B,OAAA;AAC9B,uGAAA,UAAU,OAAA;AACV,0GAAA,aAAa,OAAA;AACb,oHAAA,uBAAuB,OAAA;AACvB,yGAAA,YAAY,OAAA;AACZ,qGAAA,QAAQ,OAAA;AACR,0GAAA,aAAa,OAAA;AACb,0GAAA,aAAa,OAAA;AAEb,2EAA2E;AAC3E,oCAAoC;AACpC,2GAAA,cAAc,OAAA;AACd,6GAAA,gBAAgB,OAAA;AAIpB,+CAA+C;AAC/C,2CAGsB;AAFlB,wGAAA,UAAU,OAAA;AACV,mHAAA,qBAAqB,OAAA;AAGzB,iFAAiF;AACjF,wDAAiG;AAAxF,gHAAA,gBAAgB,OAAA;AAAE,kHAAA,kBAAkB,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAC/D,gGAAgG;AAChG,wDAIiC;AAH7B,yHAAA,yBAAyB,OAAA;AACzB,2HAAA,2BAA2B,OAAA;AAC3B,oHAAA,oBAAoB,OAAA;AAGxB,yDAAmE;AAA1D,sHAAA,iBAAiB,OAAA;AAE1B,qBAAqB;AACrB,2CAKsB;AAFlB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAGpB,sFAAsF;AACtF,+FAA+F;AAC/F,wDAAsD;AAA7C,2GAAA,WAAW,OAAA;AAEpB,qFAAqF;AACrF,mCAAuD;AAA9C,gGAAA,MAAM,OAAA;AAAE,oGAAA,UAAU,OAAA;AAC3B,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AACpB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,oFAAoF;AACpF,sFAAsF;AAEtF,kBAAkB;AAClB,iDAA4D;AAAnD,8GAAA,aAAa,OAAA;AAItB,yCAAwD;AAA/C,sGAAA,SAAS,OAAA;AAElB,uFAAuF;AACvF,2CAAmF;AAA1E,wGAAA,UAAU,OAAA;AAAE,wGAAA,UAAU,OAAA;AAAE,0GAAA,YAAY,OAAA;AAAE,2GAAA,aAAa,OAAA;AAE5D,kEAAkE;AAClE,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AAEpB,0FAA0F;AAC1F,qDAAoG;AAA3F,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAEhD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAAmE;AAA1D,4GAAA,YAAY,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAE1C,oFAAoF;AACpF,wDAA+D;AAAtD,oHAAA,oBAAoB,OAAA;AAE7B,uBAAuB;AACvB,qDAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA","sourcesContent":["// Re-export API decorators from core-util for convenience\nexport {\n    ApiPath,\n    Endpoint,\n    Authentication,\n    AuthenticationConfig,\n    Public,\n    AuthJwt,\n    AuthOidc,\n    AuthSharedSecret,\n    Rpc,\n    PubSub,\n    Queue,\n    getApiPath,\n    getEndpoints,\n    isApiPath,\n    getAuthMeta,\n    getAuthMode,\n    assertEveryEndpointHasAuthMode,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n    AuthMeta,\n    RouteMetadata,\n    METADATA_KEYS,\n    ValidateImplementation,\n    // @DocumentDesign moved to core-util (design-root marker, browser + Node);\n    // re-exported here for back-compat.\n    DocumentDesign,\n    isDocumentDesign,\n} from '@webpieces/core-util';\nexport type { AuthMode, ApiKind } from '@webpieces/core-util';\n\n// Server-side routing decorators and utilities\nexport {\n    SourceFile,\n    ROUTING_METADATA_KEYS,\n} from './decorators';\n\n// DI provider decorators moved to core-context; re-exported here for back-compat\nexport { provideSingleton, provideSingletonAs, provideTransient } from '@webpieces/core-context';\n// Framework-only DI registry (packages/** framework classes use these; see frameworkProvide.ts)\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonAs,\n    buildFrameworkModule,\n} from '@webpieces/core-context';\n\nexport { ApiRoutingFactory, ClassType } from './ApiRoutingFactory';\n\n// Core routing types\nexport {\n    Routes,\n    RouteBuilder,\n    RouteDefinition,\n    FilterDefinition,\n} from './WebAppMeta';\n\n// The transport-neutral request type (defined in core-context; this is http-routing's\n// public request — a transport adapter builds one and the chain reads it from RequestContext).\nexport { HttpRequest } from '@webpieces/core-context';\n\n// Filter-chain primitives (absorbed from the former @webpieces/http-filters package)\nexport { Filter, WpResponse, Service } from './Filter';\nexport { FilterChain } from './FilterChain';\nexport { MethodMeta } from './MethodMeta';\nexport { RouteHandler } from './RouteHandler';\n\n// RouteBuilderImpl (the route table + chain composer) is now INTERNAL — it is never\n// handed to upper layers. The express layer consumes ApiFactory.apiClients() instead.\n\n// Filter matching\nexport { FilterMatcher, HttpFilter } from './FilterMatcher';\n\n// The public API-surface abstraction: declare routes/filters, get them back as ApiClient[].\nexport { ApiFactory } from './ApiFactory';\nexport { ApiClient, ApiClientProxy } from './ApiClient';\n\n// Auth: the app-provided, container-bound AuthConfig the framework AuthFilter injects.\nexport { AuthConfig, AuthValues, ContextValue, SharedSecrets } from './AuthConfig';\n\n// Above-boundary context setup shared by every transport adapter.\nexport { fillContext } from './fillContext';\n\n// Node-only router (the express-free heart: container + filter chain + in-process client)\nexport { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';\n\n// The ONE transport-free startup sequence (headers → logging → router → routes) → ApiFactory.\n// Reusable by any company/app and any framework adapter; a company wraps it with its own headers.\nexport { setupRuntime, RuntimeSetupOptions } from './setupRuntime';\n\n// Context readers (Node.js only) moved to core-context; re-exported for back-compat\nexport { RequestContextReader } from '@webpieces/core-context';\n\n// Server configuration\nexport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/index.ts"],"names":[],"mappings":";;;;AAAA,0DAA0D;AAC1D,kDA8B8B;AA7B1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,2GAAA,cAAc,OAAA;AACd,iHAAA,oBAAoB,OAAA;AACpB,mGAAA,MAAM,OAAA;AACN,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,6GAAA,gBAAgB,OAAA;AAChB,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA;AACL,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AACZ,sGAAA,SAAS,OAAA;AACT,wGAAA,WAAW,OAAA;AACX,wGAAA,WAAW,OAAA;AACX,2HAAA,8BAA8B,OAAA;AAC9B,uGAAA,UAAU,OAAA;AACV,0GAAA,aAAa,OAAA;AACb,oHAAA,uBAAuB,OAAA;AACvB,yGAAA,YAAY,OAAA;AACZ,qGAAA,QAAQ,OAAA;AACR,0GAAA,aAAa,OAAA;AACb,0GAAA,aAAa,OAAA;AAEb,2EAA2E;AAC3E,oCAAoC;AACpC,2GAAA,cAAc,OAAA;AACd,6GAAA,gBAAgB,OAAA;AAIpB,+CAA+C;AAC/C,2CAGsB;AAFlB,wGAAA,UAAU,OAAA;AACV,mHAAA,qBAAqB,OAAA;AAGzB,iFAAiF;AACjF,wDAAiG;AAAxF,gHAAA,gBAAgB,OAAA;AAAE,kHAAA,kBAAkB,OAAA;AAAE,gHAAA,gBAAgB,OAAA;AAC/D,gGAAgG;AAChG,wDAIiC;AAH7B,yHAAA,yBAAyB,OAAA;AACzB,2HAAA,2BAA2B,OAAA;AAC3B,oHAAA,oBAAoB,OAAA;AAGxB,yDAAmE;AAA1D,sHAAA,iBAAiB,OAAA;AAE1B,qBAAqB;AACrB,2CAKsB;AAFlB,6GAAA,eAAe,OAAA;AACf,8GAAA,gBAAgB,OAAA;AAGpB,sFAAsF;AACtF,+FAA+F;AAC/F,wDAAsD;AAA7C,2GAAA,WAAW,OAAA;AAEpB,qFAAqF;AACrF,mCAAuD;AAA9C,gGAAA,MAAM,OAAA;AAAE,oGAAA,UAAU,OAAA;AAC3B,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AACpB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,oFAAoF;AACpF,sFAAsF;AAEtF,kBAAkB;AAClB,iDAA4D;AAAnD,8GAAA,aAAa,OAAA;AAItB,yCAAwD;AAA/C,sGAAA,SAAS,OAAA;AAElB,uFAAuF;AACvF,2CAAqE;AAA5D,wGAAA,UAAU,OAAA;AAAE,wGAAA,UAAU,OAAA;AAAE,2GAAA,aAAa,OAAA;AAE9C,kEAAkE;AAClE,6CAA4C;AAAnC,0GAAA,WAAW,OAAA;AAEpB,0FAA0F;AAC1F,qDAAoG;AAA3F,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAEhD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAAmE;AAA1D,4GAAA,YAAY,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAE1C,oFAAoF;AACpF,wDAA+D;AAAtD,oHAAA,oBAAoB,OAAA;AAE7B,uBAAuB;AACvB,qDAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA","sourcesContent":["// Re-export API decorators from core-util for convenience\nexport {\n    ApiPath,\n    Endpoint,\n    Authentication,\n    AuthenticationConfig,\n    Public,\n    AuthJwt,\n    AuthOidc,\n    AuthSharedSecret,\n    Rpc,\n    PubSub,\n    Queue,\n    getApiPath,\n    getEndpoints,\n    isApiPath,\n    getAuthMeta,\n    getAuthMode,\n    assertEveryEndpointHasAuthMode,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n    AuthMeta,\n    RouteMetadata,\n    METADATA_KEYS,\n    ValidateImplementation,\n    // @DocumentDesign moved to core-util (design-root marker, browser + Node);\n    // re-exported here for back-compat.\n    DocumentDesign,\n    isDocumentDesign,\n} from '@webpieces/core-util';\nexport type { AuthMode, ApiKind } from '@webpieces/core-util';\n\n// Server-side routing decorators and utilities\nexport {\n    SourceFile,\n    ROUTING_METADATA_KEYS,\n} from './decorators';\n\n// DI provider decorators moved to core-context; re-exported here for back-compat\nexport { provideSingleton, provideSingletonAs, provideTransient } from '@webpieces/core-context';\n// Framework-only DI registry (packages/** framework classes use these; see frameworkProvide.ts)\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonAs,\n    buildFrameworkModule,\n} from '@webpieces/core-context';\n\nexport { ApiRoutingFactory, ClassType } from './ApiRoutingFactory';\n\n// Core routing types\nexport {\n    Routes,\n    RouteBuilder,\n    RouteDefinition,\n    FilterDefinition,\n} from './WebAppMeta';\n\n// The transport-neutral request type (defined in core-context; this is http-routing's\n// public request — a transport adapter builds one and the chain reads it from RequestContext).\nexport { HttpRequest } from '@webpieces/core-context';\n\n// Filter-chain primitives (absorbed from the former @webpieces/http-filters package)\nexport { Filter, WpResponse, Service } from './Filter';\nexport { FilterChain } from './FilterChain';\nexport { MethodMeta } from './MethodMeta';\nexport { RouteHandler } from './RouteHandler';\n\n// RouteBuilderImpl (the route table + chain composer) is now INTERNAL — it is never\n// handed to upper layers. The express layer consumes ApiFactory.apiClients() instead.\n\n// Filter matching\nexport { FilterMatcher, HttpFilter } from './FilterMatcher';\n\n// The public API-surface abstraction: declare routes/filters, get them back as ApiClient[].\nexport { ApiFactory } from './ApiFactory';\nexport { ApiClient, ApiClientProxy } from './ApiClient';\n\n// Auth: the app-provided, container-bound AuthConfig the framework AuthFilter injects.\nexport { AuthConfig, AuthValues, SharedSecrets } from './AuthConfig';\n\n// Above-boundary context setup shared by every transport adapter.\nexport { fillContext } from './fillContext';\n\n// Node-only router (the express-free heart: container + filter chain + in-process client)\nexport { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';\n\n// The ONE transport-free startup sequence (headers → logging → router → routes) → ApiFactory.\n// Reusable by any company/app and any framework adapter; a company wraps it with its own headers.\nexport { setupRuntime, RuntimeSetupOptions } from './setupRuntime';\n\n// Context readers (Node.js only) moved to core-context; re-exported for back-compat\nexport { RequestContextReader } from '@webpieces/core-context';\n\n// Server configuration\nexport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\n"]}