@webpieces/http-routing 0.4.769 → 0.4.770

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-routing",
-  "version": "0.4.769",
+  "version": "0.4.770",
   "description": "Decorator-based routing with auto-wiring for WebPieces",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,9 +22,9 @@
   },
   "dependencies": {
     "@inversifyjs/binding-decorators": "1.1.5",
-    "@webpieces/core-context": "0.4.769",
-    "@webpieces/core-util": "0.4.769",
-    "@webpieces/gcp-identity": "0.4.769",
+    "@webpieces/core-context": "0.4.770",
+    "@webpieces/core-util": "0.4.770",
+    "@webpieces/gcp-identity": "0.4.770",
     "inversify": "7.10.4",
     "jsonwebtoken": "9.0.2",
     "minimatch": "10.0.1"

package/src/ApiClient.d.ts

@@ -1,9 +1,10 @@
 import { ClassType } from './ApiRoutingFactory';
+import { RouteMetadata } from '@webpieces/core-util';
 /**
  * ApiClientProxy - the in-process client createApiClient(api) returns: a map of method name →
  * invoker(dto) that runs the filter chain → controller. (Cast to the API interface T for callers.)
  */
-export type ApiClientProxy = Record<string, (requestDto: unknown) => Promise<unknown>>;
+export type ApiClientProxy = Record<string, (...args: unknown[]) => Promise<unknown>>;
 /**
  * ApiClient - one registered API surface, reified by {@link ApiClientFactory}:
  *  - `api`    : the contract class passed to addRoutes,
@@ -18,5 +19,9 @@ export type ApiClientProxy = Record<string, (requestDto: unknown) => Promise<unk
 export declare class ApiClient {
     readonly api: ClassType;
     readonly client: ApiClientProxy;
-    constructor(api: ClassType, client: ApiClientProxy);
+    /** The exact registered routes this transport must expose for the contract. */
+    readonly routes: readonly RouteMetadata[];
+    constructor(api: ClassType, client: ApiClientProxy, 
+    /** The exact registered routes this transport must expose for the contract. */
+    routes: readonly RouteMetadata[]);
 }

package/src/ApiClient.js

@@ -15,9 +15,13 @@ exports.ApiClient = void 0;
 class ApiClient {
     api;
     client;
-    constructor(api, client) {
+    routes;
+    constructor(api, client, 
+    /** The exact registered routes this transport must expose for the contract. */
+    routes) {
         this.api = api;
         this.client = client;
+        this.routes = routes;
     }
 }
 exports.ApiClient = ApiClient;

package/src/ApiClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiClient.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/ApiClient.ts"],"names":[],"mappings":";;;AASA;;;;;;;;;;GAUG;AACH,MAAa,SAAS;IAEE;IACA;IAFpB,YACoB,GAAc,EACd,MAAsB;QADtB,QAAG,GAAH,GAAG,CAAW;QACd,WAAM,GAAN,MAAM,CAAgB;IACvC,CAAC;CACP;AALD,8BAKC","sourcesContent":["import { ClassType } from './ApiRoutingFactory';\n\n/**\n * ApiClientProxy - the in-process client createApiClient(api) returns: a map of method name →\n * invoker(dto) that runs the filter chain → controller. (Cast to the API interface T for callers.)\n */\n// webpieces-disable no-any-unknown -- proxy holds methods of arbitrary API shapes; DTOs are erased\nexport type ApiClientProxy = Record<string, (requestDto: unknown) => Promise<unknown>>;\n\n/**\n * ApiClient - one registered API surface, reified by {@link ApiClientFactory}:\n *  - `api`    : the contract class passed to addRoutes,\n *  - `client` : exactly what createApiClient(api) returns — a proxy whose methods run the\n *               filter chain → controller.\n *\n * That is ALL a transport needs: the express layer reads the api's @ApiPath/@Endpoint decorators\n * to bind each method's HTTP route to the matching `client` method — one-to-one with a test call\n * `client.method(dto)`. The proxy forms the RouteMetadata and drives it through the filters, so\n * the internal RouteBuilder never leaks out. Data-only structure (a class, per the guidelines).\n */\nexport class ApiClient {\n    constructor(\n        public readonly api: ClassType,\n        public readonly client: ApiClientProxy,\n    ) {}\n}\n"]}
+{"version":3,"file":"ApiClient.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/ApiClient.ts"],"names":[],"mappings":";;;AAUA;;;;;;;;;;GAUG;AACH,MAAa,SAAS;IAEE;IACA;IAEA;IAJpB,YACoB,GAAc,EACd,MAAsB;IACtC,+EAA+E;IAC/D,MAAgC;QAHhC,QAAG,GAAH,GAAG,CAAW;QACd,WAAM,GAAN,MAAM,CAAgB;QAEtB,WAAM,GAAN,MAAM,CAA0B;IACjD,CAAC;CACP;AAPD,8BAOC","sourcesContent":["import { ClassType } from './ApiRoutingFactory';\nimport { RouteMetadata } from '@webpieces/core-util';\n\n/**\n * ApiClientProxy - the in-process client createApiClient(api) returns: a map of method name →\n * invoker(dto) that runs the filter chain → controller. (Cast to the API interface T for callers.)\n */\n// webpieces-disable no-any-unknown -- proxy holds methods of arbitrary API shapes; DTOs are erased\nexport type ApiClientProxy = Record<string, (...args: unknown[]) => Promise<unknown>>;\n\n/**\n * ApiClient - one registered API surface, reified by {@link ApiClientFactory}:\n *  - `api`    : the contract class passed to addRoutes,\n *  - `client` : exactly what createApiClient(api) returns — a proxy whose methods run the\n *               filter chain → controller.\n *\n * That is ALL a transport needs: the express layer reads the api's @ApiPath/@Endpoint decorators\n * to bind each method's HTTP route to the matching `client` method — one-to-one with a test call\n * `client.method(dto)`. The proxy forms the RouteMetadata and drives it through the filters, so\n * the internal RouteBuilder never leaks out. Data-only structure (a class, per the guidelines).\n */\nexport class ApiClient {\n    constructor(\n        public readonly api: ClassType,\n        public readonly client: ApiClientProxy,\n        /** The exact registered routes this transport must expose for the contract. */\n        public readonly routes: readonly RouteMetadata[],\n    ) {}\n}\n"]}

package/src/ApiClientFactory.js

@@ -59,27 +59,39 @@ let ApiClientFactory = class ApiClientFactory {
      * the proxy's matching method, so no route metadata needs to leave here.
      */
     apiClients() {
-        const apis = new Set();
+        const routesByApi = new Map();
         for (const route of this.routeBuilder.getRoutes()) {
-            apis.add(route.definition.apiClass);
+            const api = route.definition.apiClass;
+            const routes = routesByApi.get(api) ?? [];
+            routes.push(route.definition.routeMeta);
+            routesByApi.set(api, routes);
         }
         // apiClients() just loops createApiClient — the EXACT method tests call — so the platform
         // (HTTP) and tests (in-process) bind the identical proxy, 1-to-1.
-        return [...apis].map((api) => {
-            // webpieces-disable no-any-unknown -- the registered api is an unconstrained ClassType
-            const client = this.createApiClient(api);
-            return new ApiClient_1.ApiClient(api, client);
-        });
+        const clients = [];
+        for (const entry of routesByApi.entries()) {
+            const api = entry[0];
+            const routes = entry[1];
+            // Build only the routes that were actually registered. A @WpAuthLocalOnly method is
+            // deliberately absent off-local and must not make mounting the rest of its API fail.
+            const client = this.buildProxy(api, routes);
+            clients.push(new ApiClient_1.ApiClient(api, client, routes));
+        }
+        return clients;
     }
     /** Build the proxy record (method name → invoker) from the API prototype's decorators. */
+    buildProxy(
     // webpieces-disable no-any-unknown -- accepts any ClassType / abstract-constructor API prototype
-    buildProxy(apiPrototype) {
-        const basePath = (0, core_util_1.getApiPath)(apiPrototype) || '';
+    apiPrototype, registeredRoutes) {
         const endpoints = (0, core_util_1.getEndpoints)(apiPrototype) || {};
         const proxy = {};
-        for (const [methodName, endpointPath] of Object.entries(endpoints)) {
-            const httpMethod = 'POST';
-            const path = basePath + endpointPath;
+        const methodNames = registeredRoutes
+            ? registeredRoutes.map((route) => route.methodName)
+            : Object.keys(endpoints);
+        for (const methodName of methodNames) {
+            const contractRoute = registeredRoutes?.find((route) => route.methodName === methodName) ?? core_util_1.RouteMetadataFactory.create(apiPrototype, methodName);
+            const httpMethod = contractRoute.httpMethod;
+            const path = contractRoute.path;
             // Use the REGISTERED route's metadata — it carries the real controller name AND api
             // name (so logging/recording read the right one); createRouteInvoker composes its chain.
             const routeMeta = this.routeBuilder.getRouteMeta(httpMethod, path);
@@ -88,16 +100,21 @@ let ApiClientFactory = class ApiClientFactory {
             }
             const service = this.routeBuilder.createRouteInvoker(httpMethod, path);
             // webpieces-disable no-any-unknown -- request/response DTOs are erased at the routing boundary
-            proxy[methodName] = async (requestDto) => {
+            proxy[methodName] = async (...args) => {
                 requireActiveContext(routeMeta);
-                return this.runMethod(routeMeta, requestDto, service);
+                // Run the shared mapping even in-process. It validates the exact path/query/body
+                // shape production clients use, then the controller receives the original typed args.
+                const mapped = core_util_1.HttpContractMapper.toWire(routeMeta.path, routeMeta.parameterBindings, routeMeta.bodyParameterIndex, args);
+                return this.runMethod(routeMeta, mapped.body === undefined ? args : mapped.body, args, service);
             };
         }
         return proxy;
     }
     // webpieces-disable no-any-unknown -- request/response DTOs are erased at the routing boundary
-    async runMethod(routeMeta, requestDto, service) {
-        const responseWrapper = await service.invoke(new MethodMeta_1.MethodMeta(routeMeta, requestDto));
+    async runMethod(routeMeta, requestDto, requestArgs, 
+    // webpieces-disable no-any-unknown -- filter service carries arbitrary contract response DTOs
+    service) {
+        const responseWrapper = await service.invoke(new MethodMeta_1.MethodMeta(routeMeta, requestDto, undefined, requestArgs));
         return responseWrapper.response;
     }
 };

package/src/ApiClientFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiClientFactory.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/ApiClientFactory.ts"],"names":[],"mappings":";;;;AAAA,yCAAmC;AACnC,oDAI8B;AAC9B,0DAAoF;AACpF,6CAA0C;AAG1C,yDAAsD;AACtD,2CAAwD;AAGxD;;;;GAIG;AACH,uGAAuG;AACvG,SAAS,oBAAoB,CAAC,SAAwB;IAClD,IAAI,6BAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5B,OAAO;IACX,CAAC;IACD,MAAM,IAAI,KAAK,CACX,GAAG,SAAS,CAAC,mBAAmB,IAAI,SAAS,CAAC,UAAU,6CAA6C;QACrG,mGAAmG;QACnG,wFAAwF,CAC3F,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC8B;IAAvD,YAAuD,YAA8B;QAA9B,iBAAY,GAAZ,YAAY,CAAkB;IAAG,CAAC;IAEzF;;;OAGG;IACH,yFAAyF;IACzF,eAAe,CAAI,YAAgD;QAC/D,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAM,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,UAAU;QACN,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,QAAqB,CAAC,CAAC;QACrD,CAAC;QACD,0FAA0F;QAC1F,kEAAkE;QAClE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAc,EAAE,EAAE;YACpC,uFAAuF;YACvF,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAiB,GAAU,CAAC,CAAC;YAChE,OAAO,IAAI,qBAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACtC,CAAC,CAAC,CAAC;IACP,CAAC;IAED,0FAA0F;IAC1F,iGAAiG;IACzF,UAAU,CAAC,YAAiB;QAChC,MAAM,QAAQ,GAAG,IAAA,sBAAU,EAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,IAAA,wBAAY,EAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,KAAK,GAAmB,EAAE,CAAC;QAEjC,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjE,MAAM,UAAU,GAAG,MAAM,CAAC;YAC1B,MAAM,IAAI,GAAG,QAAQ,GAAG,YAAY,CAAC;YAErC,oFAAoF;YACpF,yFAAyF;YACzF,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACnE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACX,2BAA2B,YAAY,CAAC,IAAI,IAAI,UAAU,KAAK,UAAU,IAAI,IAAI,4CAA4C,CAChI,CAAC;YACN,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEvE,+FAA+F;YAC/F,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,UAAmB,EAAoB,EAAE;gBAChE,oBAAoB,CAAC,SAAS,CAAC,CAAC;gBAChC,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC1D,CAAC,CAAC;QACN,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,+FAA+F;IACvF,KAAK,CAAC,SAAS,CAAC,SAAwB,EAAE,UAAmB,EAAE,OAAiD;QACpH,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,uBAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACpF,OAAO,eAAe,CAAC,QAAQ,CAAC;IACpC,CAAC;CACJ,CAAA;AAnEY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,wCAAyB,GAAE;IAEX,mBAAA,IAAA,kBAAM,EAAC,mCAAgB,CAAC,CAAA;6CAAgC,mCAAgB;GAD5E,gBAAgB,CAmE5B","sourcesContent":["import { inject } from 'inversify';\nimport {\n    getApiPath,\n    getEndpoints,\n    RouteMetadata,\n} from '@webpieces/core-util';\nimport { provideFrameworkSingleton, RequestContext } from '@webpieces/core-context';\nimport { MethodMeta } from './MethodMeta';\nimport { Service } from '@webpieces/core-util';\nimport { WpResponse } from './WpResponse';\nimport { RouteBuilderImpl } from './RouteBuilderImpl';\nimport { ApiClient, ApiClientProxy } from './ApiClient';\nimport { ClassType } from './ApiRoutingFactory';\n\n/**\n * Every call through the proxy needs an ambient RequestContext, established ABOVE the api boundary.\n * It is NOT auto-created here: manufacturing one silently would hide a missing top-level filter, and\n * every log line, outbound call, and enqueued task under it would quietly lose its request id.\n */\n// webpieces-disable no-function-outside-class -- a guard over ambient state; a class would own nothing\nfunction requireActiveContext(routeMeta: RouteMetadata): void {\n    if (RequestContext.isActive()) {\n        return;\n    }\n    throw new Error(\n        `${routeMeta.controllerClassName}.${routeMeta.methodName} was called with no active RequestContext. ` +\n        `A server transport must wrap each request in RequestContext.run(...) (WebpiecesMiddleware does). ` +\n        `In a test, wrap the call yourself: await RequestContext.run(async () => api.foo(req));`,\n    );\n}\n\n/**\n * ApiClientFactory - THE piece that wires api → Proxy → filters → controller.\n *\n * For an API prototype (its @ApiPath/@Endpoint decorators) it builds a proxy whose methods\n * invoke the composed filter chain (via RouteBuilder.createRouteInvoker) — that proxy IS what\n * createApiClient() returns. {@link apiClients} reuses the SAME proxy per registered api, so the\n * express layer binds each method through it. There is no express dependency here, so the proxy\n * is the single invocation path for BOTH in-process (tests) and HTTP.\n *\n * Establishing the request scope is a PRECONDITION of calling in here, never this class's job. The\n * caller above the api boundary opens `RequestContext.run(...)`, publishes the inbound\n * `HttpRequest`, and calls `RequestContextHeaders.fillFromRequest()` to move its headers into the\n * context. `WebpiecesMiddleware` does all three for you; a non-webpieces transport (or a test\n * driving `createApiClient` directly) must do the same. This proxy only CHECKS that it happened —\n * manufacturing a context here would hide a missing filter and silently strip every request id.\n *\n * @provideFrameworkSingleton so WebpiecesRouter can inject it (it shares the one RouteBuilder).\n */\n@provideFrameworkSingleton()\nexport class ApiClientFactory {\n    constructor(@inject(RouteBuilderImpl) private readonly routeBuilder: RouteBuilderImpl) {}\n\n    /**\n     * Create an API client proxy (cast to the API interface T). The proxy's methods run the full\n     * filter chain + controller; used by tests in-process AND driven by the express adapter.\n     */\n    // webpieces-disable no-any-unknown -- abstract constructor signature requires any[] args\n    createApiClient<T>(apiPrototype: abstract new (...args: any[]) => T): T {\n        return this.buildProxy(apiPrototype) as T;\n    }\n\n    /**\n     * Reify every registered API as an {@link ApiClient} — the contract + its proxy (the\n     * createApiClient object). The transport reads the api's decorators to bind each endpoint to\n     * the proxy's matching method, so no route metadata needs to leave here.\n     */\n    apiClients(): ApiClient[] {\n        const apis = new Set<ClassType>();\n        for (const route of this.routeBuilder.getRoutes()) {\n            apis.add(route.definition.apiClass as ClassType);\n        }\n        // apiClients() just loops createApiClient — the EXACT method tests call — so the platform\n        // (HTTP) and tests (in-process) bind the identical proxy, 1-to-1.\n        return [...apis].map((api: ClassType) => {\n            // webpieces-disable no-any-unknown -- the registered api is an unconstrained ClassType\n            const client = this.createApiClient<ApiClientProxy>(api as any);\n            return new ApiClient(api, client);\n        });\n    }\n\n    /** Build the proxy record (method name → invoker) from the API prototype's decorators. */\n    // webpieces-disable no-any-unknown -- accepts any ClassType / abstract-constructor API prototype\n    private buildProxy(apiPrototype: any): ApiClientProxy {\n        const basePath = getApiPath(apiPrototype) || '';\n        const endpoints = getEndpoints(apiPrototype) || {};\n        const proxy: ApiClientProxy = {};\n\n        for (const [methodName, endpointPath] of Object.entries(endpoints)) {\n            const httpMethod = 'POST';\n            const path = basePath + endpointPath;\n\n            // Use the REGISTERED route's metadata — it carries the real controller name AND api\n            // name (so logging/recording read the right one); createRouteInvoker composes its chain.\n            const routeMeta = this.routeBuilder.getRouteMeta(httpMethod, path);\n            if (!routeMeta) {\n                throw new Error(\n                    `No registered route for ${apiPrototype.name}.${methodName} (${httpMethod} ${path}) — call addRoutes(api, controller) first.`,\n                );\n            }\n            const service = this.routeBuilder.createRouteInvoker(httpMethod, path);\n\n            // webpieces-disable no-any-unknown -- request/response DTOs are erased at the routing boundary\n            proxy[methodName] = async (requestDto: unknown): Promise<unknown> => {\n                requireActiveContext(routeMeta);\n                return this.runMethod(routeMeta, requestDto, service);\n            };\n        }\n\n        return proxy;\n    }\n\n    // webpieces-disable no-any-unknown -- request/response DTOs are erased at the routing boundary\n    private async runMethod(routeMeta: RouteMetadata, requestDto: unknown, service: Service<MethodMeta, WpResponse<unknown>>): Promise<unknown> {\n        const responseWrapper = await service.invoke(new MethodMeta(routeMeta, requestDto));\n        return responseWrapper.response;\n    }\n}\n"]}
+{"version":3,"file":"ApiClientFactory.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/ApiClientFactory.ts"],"names":[],"mappings":";;;;AAAA,yCAAmC;AACnC,oDAK8B;AAC9B,0DAAoF;AACpF,6CAA0C;AAG1C,yDAAsD;AACtD,2CAAwD;AAGxD;;;;GAIG;AACH,uGAAuG;AACvG,SAAS,oBAAoB,CAAC,SAAwB;IAClD,IAAI,6BAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC5B,OAAO;IACX,CAAC;IACD,MAAM,IAAI,KAAK,CACX,GAAG,SAAS,CAAC,mBAAmB,IAAI,SAAS,CAAC,UAAU,6CAA6C;QACjG,mGAAmG;QACnG,wFAAwF,CAC/F,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC8B;IAAvD,YAAuD,YAA8B;QAA9B,iBAAY,GAAZ,YAAY,CAAkB;IAAG,CAAC;IAEzF;;;OAGG;IACH,yFAAyF;IACzF,eAAe,CAAI,YAAgD;QAC/D,OAAO,IAAI,CAAC,UAAU,CAAC,YAAY,CAAM,CAAC;IAC9C,CAAC;IAED;;;;OAIG;IACH,UAAU;QACN,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAC;QAC1D,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,QAAqB,CAAC;YACnD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACxC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,0FAA0F;QAC1F,kEAAkE;QAClE,MAAM,OAAO,GAAgB,EAAE,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,oFAAoF;YACpF,qFAAqF;YACrF,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,IAAI,qBAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,0FAA0F;IAClF,UAAU;IACd,iGAAiG;IACjG,YAAiB,EACjB,gBAA2C;QAE3C,MAAM,SAAS,GAAG,IAAA,wBAAY,EAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,KAAK,GAAmB,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,gBAAgB;YAChC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAoB,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE7B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACnC,MAAM,aAAa,GACf,gBAAgB,EAAE,IAAI,CAClB,CAAC,KAAoB,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,KAAK,UAAU,CAC5D,IAAI,gCAAoB,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC/D,MAAM,UAAU,GAAG,aAAa,CAAC,UAAU,CAAC;YAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC;YAEhC,oFAAoF;YACpF,yFAAyF;YACzF,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACnE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACX,2BAA2B,YAAY,CAAC,IAAI,IAAI,UAAU,KAAK,UAAU,IAAI,IAAI,4CAA4C,CAChI,CAAC;YACN,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEvE,+FAA+F;YAC/F,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,EAAE,GAAG,IAAe,EAAoB,EAAE;gBAC/D,oBAAoB,CAAC,SAAS,CAAC,CAAC;gBAChC,iFAAiF;gBACjF,sFAAsF;gBACtF,MAAM,MAAM,GAAG,8BAAkB,CAAC,MAAM,CACpC,SAAS,CAAC,IAAI,EACd,SAAS,CAAC,iBAAiB,EAC3B,SAAS,CAAC,kBAAkB,EAC5B,IAAI,CACP,CAAC;gBACF,OAAO,IAAI,CAAC,SAAS,CACjB,SAAS,EACT,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAC9C,IAAI,EACJ,OAAO,CACV,CAAC;YACN,CAAC,CAAC;QACN,CAAC;QAED,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,+FAA+F;IACvF,KAAK,CAAC,SAAS,CACnB,SAAwB,EACxB,UAAmB,EACnB,WAAsB;IACtB,8FAA8F;IAC9F,OAAiD;QAGjD,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,MAAM,CACxC,IAAI,uBAAU,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAChE,CAAC;QACF,OAAO,eAAe,CAAC,QAAQ,CAAC;IACpC,CAAC;CACJ,CAAA;AA1GY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,wCAAyB,GAAE;IAEX,mBAAA,IAAA,kBAAM,EAAC,mCAAgB,CAAC,CAAA;6CAAgC,mCAAgB;GAD5E,gBAAgB,CA0G5B","sourcesContent":["import { inject } from 'inversify';\nimport {\n    getEndpoints,\n    HttpContractMapper,\n    RouteMetadata,\n    RouteMetadataFactory,\n} from '@webpieces/core-util';\nimport { provideFrameworkSingleton, RequestContext } from '@webpieces/core-context';\nimport { MethodMeta } from './MethodMeta';\nimport { Service } from '@webpieces/core-util';\nimport { WpResponse } from './WpResponse';\nimport { RouteBuilderImpl } from './RouteBuilderImpl';\nimport { ApiClient, ApiClientProxy } from './ApiClient';\nimport { ClassType } from './ApiRoutingFactory';\n\n/**\n * Every call through the proxy needs an ambient RequestContext, established ABOVE the api boundary.\n * It is NOT auto-created here: manufacturing one silently would hide a missing top-level filter, and\n * every log line, outbound call, and enqueued task under it would quietly lose its request id.\n */\n// webpieces-disable no-function-outside-class -- a guard over ambient state; a class would own nothing\nfunction requireActiveContext(routeMeta: RouteMetadata): void {\n    if (RequestContext.isActive()) {\n        return;\n    }\n    throw new Error(\n        `${routeMeta.controllerClassName}.${routeMeta.methodName} was called with no active RequestContext. ` +\n            `A server transport must wrap each request in RequestContext.run(...) (WebpiecesMiddleware does). ` +\n            `In a test, wrap the call yourself: await RequestContext.run(async () => api.foo(req));`,\n    );\n}\n\n/**\n * ApiClientFactory - THE piece that wires api → Proxy → filters → controller.\n *\n * For an API prototype (its @ApiPath/@Endpoint decorators) it builds a proxy whose methods\n * invoke the composed filter chain (via RouteBuilder.createRouteInvoker) — that proxy IS what\n * createApiClient() returns. {@link apiClients} reuses the SAME proxy per registered api, so the\n * express layer binds each method through it. There is no express dependency here, so the proxy\n * is the single invocation path for BOTH in-process (tests) and HTTP.\n *\n * Establishing the request scope is a PRECONDITION of calling in here, never this class's job. The\n * caller above the api boundary opens `RequestContext.run(...)`, publishes the inbound\n * `HttpRequest`, and calls `RequestContextHeaders.fillFromRequest()` to move its headers into the\n * context. `WebpiecesMiddleware` does all three for you; a non-webpieces transport (or a test\n * driving `createApiClient` directly) must do the same. This proxy only CHECKS that it happened —\n * manufacturing a context here would hide a missing filter and silently strip every request id.\n *\n * @provideFrameworkSingleton so WebpiecesRouter can inject it (it shares the one RouteBuilder).\n */\n@provideFrameworkSingleton()\nexport class ApiClientFactory {\n    constructor(@inject(RouteBuilderImpl) private readonly routeBuilder: RouteBuilderImpl) {}\n\n    /**\n     * Create an API client proxy (cast to the API interface T). The proxy's methods run the full\n     * filter chain + controller; used by tests in-process AND driven by the express adapter.\n     */\n    // webpieces-disable no-any-unknown -- abstract constructor signature requires any[] args\n    createApiClient<T>(apiPrototype: abstract new (...args: any[]) => T): T {\n        return this.buildProxy(apiPrototype) as T;\n    }\n\n    /**\n     * Reify every registered API as an {@link ApiClient} — the contract + its proxy (the\n     * createApiClient object). The transport reads the api's decorators to bind each endpoint to\n     * the proxy's matching method, so no route metadata needs to leave here.\n     */\n    apiClients(): ApiClient[] {\n        const routesByApi = new Map<ClassType, RouteMetadata[]>();\n        for (const route of this.routeBuilder.getRoutes()) {\n            const api = route.definition.apiClass as ClassType;\n            const routes = routesByApi.get(api) ?? [];\n            routes.push(route.definition.routeMeta);\n            routesByApi.set(api, routes);\n        }\n        // apiClients() just loops createApiClient — the EXACT method tests call — so the platform\n        // (HTTP) and tests (in-process) bind the identical proxy, 1-to-1.\n        const clients: ApiClient[] = [];\n        for (const entry of routesByApi.entries()) {\n            const api = entry[0];\n            const routes = entry[1];\n            // Build only the routes that were actually registered. A @WpAuthLocalOnly method is\n            // deliberately absent off-local and must not make mounting the rest of its API fail.\n            const client = this.buildProxy(api, routes);\n            clients.push(new ApiClient(api, client, routes));\n        }\n        return clients;\n    }\n\n    /** Build the proxy record (method name → invoker) from the API prototype's decorators. */\n    private buildProxy(\n        // webpieces-disable no-any-unknown -- accepts any ClassType / abstract-constructor API prototype\n        apiPrototype: any,\n        registeredRoutes?: readonly RouteMetadata[],\n    ): ApiClientProxy {\n        const endpoints = getEndpoints(apiPrototype) || {};\n        const proxy: ApiClientProxy = {};\n        const methodNames = registeredRoutes\n            ? registeredRoutes.map((route: RouteMetadata) => route.methodName)\n            : Object.keys(endpoints);\n\n        for (const methodName of methodNames) {\n            const contractRoute =\n                registeredRoutes?.find(\n                    (route: RouteMetadata) => route.methodName === methodName,\n                ) ?? RouteMetadataFactory.create(apiPrototype, methodName);\n            const httpMethod = contractRoute.httpMethod;\n            const path = contractRoute.path;\n\n            // Use the REGISTERED route's metadata — it carries the real controller name AND api\n            // name (so logging/recording read the right one); createRouteInvoker composes its chain.\n            const routeMeta = this.routeBuilder.getRouteMeta(httpMethod, path);\n            if (!routeMeta) {\n                throw new Error(\n                    `No registered route for ${apiPrototype.name}.${methodName} (${httpMethod} ${path}) — call addRoutes(api, controller) first.`,\n                );\n            }\n            const service = this.routeBuilder.createRouteInvoker(httpMethod, path);\n\n            // webpieces-disable no-any-unknown -- request/response DTOs are erased at the routing boundary\n            proxy[methodName] = async (...args: unknown[]): Promise<unknown> => {\n                requireActiveContext(routeMeta);\n                // Run the shared mapping even in-process. It validates the exact path/query/body\n                // shape production clients use, then the controller receives the original typed args.\n                const mapped = HttpContractMapper.toWire(\n                    routeMeta.path,\n                    routeMeta.parameterBindings,\n                    routeMeta.bodyParameterIndex,\n                    args,\n                );\n                return this.runMethod(\n                    routeMeta,\n                    mapped.body === undefined ? args : mapped.body,\n                    args,\n                    service,\n                );\n            };\n        }\n\n        return proxy;\n    }\n\n    // webpieces-disable no-any-unknown -- request/response DTOs are erased at the routing boundary\n    private async runMethod(\n        routeMeta: RouteMetadata,\n        requestDto: unknown,\n        requestArgs: unknown[],\n        // webpieces-disable no-any-unknown -- filter service carries arbitrary contract response DTOs\n        service: Service<MethodMeta, WpResponse<unknown>>,\n        // webpieces-disable no-any-unknown -- API return type is erased at the routing proxy boundary\n    ): Promise<unknown> {\n        const responseWrapper = await service.invoke(\n            new MethodMeta(routeMeta, requestDto, undefined, requestArgs),\n        );\n        return responseWrapper.response;\n    }\n}\n"]}

package/src/ApiRoutingFactory.js

@@ -62,12 +62,11 @@ class ApiRoutingFactory {
         // mistake, so it dies at STARTUP naming the fix — not as a 401 in production on exactly the
         // traffic the endpoint exists for.
         (0, core_util_1.assertEveryWebhookEndpointRetainsRawBody)(this.apiMetaClass);
-        const basePath = (0, core_util_1.getApiPath)(this.apiMetaClass);
         const endpoints = (0, core_util_1.getEndpoints)(this.apiMetaClass) || {};
         const controllerFilepath = this.getControllerFilepath();
         const apiName = this.apiMetaClass.name || 'Unknown';
         const controllerName = this.controllerClass.name || 'Unknown';
-        for (const [methodName, endpointPath] of Object.entries(endpoints)) {
+        for (const methodName of Object.keys(endpoints)) {
             // Validate controller implements this method
             if (typeof this.controllerClass.prototype[methodName] !== 'function') {
                 throw new Error(`Controller ${controllerName} must implement method ${methodName} from API ${apiName}`);
@@ -88,8 +87,7 @@ class ApiRoutingFactory {
                     `a local developer machine, so the route is not registered at all.`);
                 continue;
             }
-            const fullPath = basePath + endpointPath;
-            const routeMeta = new core_util_1.RouteMetadata('POST', fullPath, methodName, controllerName, authMeta, apiName, (0, core_util_1.isFormPost)(this.apiMetaClass, methodName), (0, core_util_1.getMaskSpec)(this.apiMetaClass, methodName), (0, core_util_1.isRawBody)(this.apiMetaClass, methodName));
+            const routeMeta = core_util_1.RouteMetadataFactory.create(this.apiMetaClass, methodName, controllerName);
             routeBuilder.addRoute(new WebAppMeta_1.RouteDefinition(routeMeta, this.controllerClass, controllerFilepath, this.apiMetaClass));
         }
     }

package/src/ApiRoutingFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiRoutingFactory.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/ApiRoutingFactory.ts"],"names":[],"mappings":";;;AAAA,6CAAqE;AACrE,oDAe8B;AAC9B,4BAA0B;AAC1B,6CAAqD;AAErD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAQtD;;;;;;;;;;;;;;;;GAgBG;AACH,+FAA+F;AAC/F,MAAa,iBAAiB;IAClB,YAAY,CAAkB;IAC9B,eAAe,CAAyB;IAEhD;;;OAGG;IACH,YAAY,YAA6B,EAAE,eAAuC;QAC9E,IAAA,gCAAoB,EAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QAEvC,qDAAqD;QACrD,IAAI,CAAC,IAAA,qBAAS,EAAC,YAAY,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,IAAI,SAAS,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,SAAS,SAAS,oCAAoC,CAAC,CAAC;QAC5E,CAAC;QAED,+DAA+D;QAC/D,mFAAmF;QACnF,kFAAkF;QAClF,mFAAmF;QACnF,+CAA+C;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,IAAI,SAAS,CAAC;QAC/C,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,IAAI,SAAS,CAAC;QACzD,IACI,CAAE,YAAY,CAAC,SAAoB,CAAC,aAAa,CAAC,eAAe,CAAC,SAAmB,CAAC,EACxF,CAAC;YACC,MAAM,IAAI,KAAK,CACX,cAAc,cAAc,gBAAgB,OAAO,IAAI;gBACnD,mCAAmC;gBACnC,iBAAiB,cAAc,YAAY,OAAO,WAAW,CACpE,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,YAA0B;QAChC,yFAAyF;QACzF,4FAA4F;QAC5F,mCAAmC;QACnC,IAAA,oDAAwC,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE5D,MAAM,QAAQ,GAAG,IAAA,sBAAU,EAAC,IAAI,CAAC,YAAY,CAAE,CAAC;QAChD,MAAM,SAAS,GAAG,IAAA,wBAAY,EAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,kBAAkB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,SAAS,CAAC;QACpD,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,SAAS,CAAC;QAE9D,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjE,6CAA6C;YAC7C,IAAI,OAAO,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CACX,cAAc,cAAc,0BAA0B,UAAU,aAAa,OAAO,EAAE,CACzF,CAAC;YACN,CAAC;YAED,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAA,uBAAW,EAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACX,aAAa,UAAU,QAAQ,OAAO,0BAA0B;oBAC5D,sCAA0B,CACjC,CAAC;YACN,CAAC;YAED,sFAAsF;YACtF,yFAAyF;YACzF,wFAAwF;YACxF,wFAAwF;YACxF,oDAAoD;YACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,2BAAe,CAAC,kBAAkB,EAAE,EAAE,CAAC;gBAC/E,GAAG,CAAC,IAAI,CACJ,sCAAsC,OAAO,IAAI,UAAU,yBAAyB;oBAChF,mEAAmE,CAC1E,CAAC;gBACF,SAAS;YACb,CAAC;YAED,MAAM,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;YACzC,MAAM,SAAS,GAAG,IAAI,yBAAa,CAC/B,MAAM,EACN,QAAQ,EACR,UAAU,EACV,cAAc,EACd,QAAQ,EACR,OAAO,EACP,IAAA,sBAAU,EAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,EACzC,IAAA,uBAAW,EAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,EAC1C,IAAA,qBAAS,EAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAC3C,CAAC;YAEF,YAAY,CAAC,QAAQ,CACjB,IAAI,4BAAe,CACf,SAAS,EACT,IAAI,CAAC,eAAe,EACpB,kBAAkB,EAClB,IAAI,CAAC,YAAY,CACpB,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,qBAAqB;QACzB,oDAAoD;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAChC,kCAAqB,CAAC,eAAe,EACrC,IAAI,CAAC,eAAe,CACvB,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAC5C,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,UAAkB;QACnC,OAAO,IAAA,uBAAW,EAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,WAAW;QACP,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,kBAAkB;QACd,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;CACJ;AAlJD,8CAkJC","sourcesContent":["import { Routes, RouteBuilder, RouteDefinition } from './WebAppMeta';\nimport {\n    isApiPath,\n    getApiPath,\n    getEndpoints,\n    getAuthMeta,\n    isFormPost,\n    isRawBody,\n    assertEveryWebhookEndpointRetainsRawBody,\n    assertNotInternalApi,\n    getMaskSpec,\n    LogManager,\n    RouteMetadata,\n    AuthMeta,\n    MISSING_AUTH_DECORATOR_FIX,\n    RuntimeLocality,\n} from '@webpieces/core-util';\nimport 'reflect-metadata';\nimport { ROUTING_METADATA_KEYS } from './decorators';\n\nconst log = LogManager.getLogger('ApiRoutingFactory');\n\n/**\n * Type representing a class constructor (abstract or concrete).\n */\n// webpieces-disable no-any-unknown -- generic type alias requires unconstrained default\nexport type ClassType<T = unknown> = Function & { prototype: T };\n\n/**\n * ApiRoutingFactory - Automatically wire API interfaces to controllers.\n * Reads @ApiPath/@Endpoint decorators from an API prototype class and\n * registers POST routes for each endpoint.\n *\n * Replaces the old RESTApiRoutes class.\n *\n * Usage:\n * ```typescript\n * // In your ServerMeta:\n * getRoutes(): Routes[] {\n *   return [\n *     new ApiRoutingFactory(SaveApi, SaveController),\n *   ];\n * }\n * ```\n */\n// webpieces-disable no-any-unknown -- generic class requires unconstrained default type params\nexport class ApiRoutingFactory<TApi = unknown, TController extends TApi = TApi> implements Routes {\n    private apiMetaClass: ClassType<TApi>;\n    private controllerClass: ClassType<TController>;\n\n    /**\n     * @param apiMetaClass - The API prototype class with @ApiPath/@Endpoint decorators\n     * @param controllerClass - The controller class that implements the API\n     */\n    constructor(apiMetaClass: ClassType<TApi>, controllerClass: ClassType<TController>) {\n        assertNotInternalApi(apiMetaClass, 'ApiRoutingFactory');\n        this.apiMetaClass = apiMetaClass;\n        this.controllerClass = controllerClass;\n\n        // Validate that apiMetaClass is marked with @ApiPath\n        if (!isApiPath(apiMetaClass)) {\n            const className = apiMetaClass.name || 'Unknown';\n            throw new Error(`Class ${className} must be decorated with @ApiPath()`);\n        }\n\n        // Validate that controllerClass actually extends apiMetaClass.\n        // TypeScript's structural typing won't catch a missing `extends` here, so we check\n        // the runtime prototype chain. Without this, a controller can silently drift from\n        // the API contract (wrong method names, wrong signatures) and only fail later as a\n        // confusing routing or method-not-found error.\n        const apiName = apiMetaClass.name || 'Unknown';\n        const controllerName = controllerClass.name || 'Unknown';\n        if (\n            !(apiMetaClass.prototype as object).isPrototypeOf(controllerClass.prototype as object)\n        ) {\n            throw new Error(\n                `Controller ${controllerName} must extend ${apiName}. ` +\n                    `Change the class declaration to: ` +\n                    `'export class ${controllerName} extends ${apiName} { ... }'`,\n            );\n        }\n    }\n\n    /**\n     * Configure routes by reading @ApiPath + @Endpoint metadata.\n     * Validates controller methods and auth decorators in single loop.\n     */\n    configure(routeBuilder: RouteBuilder): void {\n        // A webhook route whose transport keeps no bytes has nothing to verify. That is a wiring\n        // mistake, so it dies at STARTUP naming the fix — not as a 401 in production on exactly the\n        // traffic the endpoint exists for.\n        assertEveryWebhookEndpointRetainsRawBody(this.apiMetaClass);\n\n        const basePath = getApiPath(this.apiMetaClass)!;\n        const endpoints = getEndpoints(this.apiMetaClass) || {};\n        const controllerFilepath = this.getControllerFilepath();\n        const apiName = this.apiMetaClass.name || 'Unknown';\n        const controllerName = this.controllerClass.name || 'Unknown';\n\n        for (const [methodName, endpointPath] of Object.entries(endpoints)) {\n            // Validate controller implements this method\n            if (typeof this.controllerClass.prototype[methodName] !== 'function') {\n                throw new Error(\n                    `Controller ${controllerName} must implement method ${methodName} from API ${apiName}`,\n                );\n            }\n\n            // Validate auth decorator exists (class-level or method-level)\n            const authMeta = getAuthMeta(this.apiMetaClass, methodName);\n            if (!authMeta) {\n                throw new Error(\n                    `Endpoint '${methodName}' in ${apiName} has no auth decorator. ` +\n                        MISSING_AUTH_DECORATOR_FIX,\n                );\n            }\n\n            // @WpAuthLocalOnly: off-local the route is never registered, so the endpoint does not\n            // exist rather than existing-and-refusing. This is the PRIMARY gate; AuthFilter's 404 is\n            // the backstop for routes added by hand through RouteBuilder. One decorator drives both\n            // — the point of moving this into the framework was that apps were hand-syncing exactly\n            // these two halves across two files with a comment.\n            if (authMeta.mode.kind === 'local-only' && !RuntimeLocality.isLocalDevelopment()) {\n                log.info(\n                    `Skipping @WpAuthLocalOnly endpoint ${apiName}.${methodName} — this process is not ` +\n                        `a local developer machine, so the route is not registered at all.`,\n                );\n                continue;\n            }\n\n            const fullPath = basePath + endpointPath;\n            const routeMeta = new RouteMetadata(\n                'POST',\n                fullPath,\n                methodName,\n                controllerName,\n                authMeta,\n                apiName,\n                isFormPost(this.apiMetaClass, methodName),\n                getMaskSpec(this.apiMetaClass, methodName),\n                isRawBody(this.apiMetaClass, methodName),\n            );\n\n            routeBuilder.addRoute(\n                new RouteDefinition(\n                    routeMeta,\n                    this.controllerClass,\n                    controllerFilepath,\n                    this.apiMetaClass,\n                ),\n            );\n        }\n    }\n\n    /**\n     * Get the filepath of the controller source file.\n     * Uses a heuristic based on the controller class name.\n     */\n    private getControllerFilepath(): string | undefined {\n        // Check for explicit @SourceFile decorator metadata\n        const filepath = Reflect.getMetadata(\n            ROUTING_METADATA_KEYS.SOURCE_FILEPATH,\n            this.controllerClass,\n        );\n        if (filepath) {\n            return filepath;\n        }\n\n        // Fallback to class name pattern\n        const className = this.controllerClass.name;\n        return className ? `**/${className}.ts` : undefined;\n    }\n\n    /**\n     * Get auth metadata for a specific method, falling back to class-level.\n     */\n    getAuthMetaForMethod(methodName: string): AuthMeta | undefined {\n        return getAuthMeta(this.apiMetaClass, methodName);\n    }\n\n    /**\n     * Get the API interface class.\n     */\n    getApiClass(): ClassType<TApi> {\n        return this.apiMetaClass;\n    }\n\n    /**\n     * Get the controller class.\n     */\n    getControllerClass(): ClassType<TController> {\n        return this.controllerClass;\n    }\n}\n"]}
+{"version":3,"file":"ApiRoutingFactory.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/ApiRoutingFactory.ts"],"names":[],"mappings":";;;AAAA,6CAAqE;AACrE,oDAW8B;AAC9B,4BAA0B;AAC1B,6CAAqD;AAErD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAQtD;;;;;;;;;;;;;;;;GAgBG;AACH,+FAA+F;AAC/F,MAAa,iBAAiB;IAClB,YAAY,CAAkB;IAC9B,eAAe,CAAyB;IAEhD;;;OAGG;IACH,YAAY,YAA6B,EAAE,eAAuC;QAC9E,IAAA,gCAAoB,EAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QAEvC,qDAAqD;QACrD,IAAI,CAAC,IAAA,qBAAS,EAAC,YAAY,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,IAAI,SAAS,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,SAAS,SAAS,oCAAoC,CAAC,CAAC;QAC5E,CAAC;QAED,+DAA+D;QAC/D,mFAAmF;QACnF,kFAAkF;QAClF,mFAAmF;QACnF,+CAA+C;QAC/C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,IAAI,SAAS,CAAC;QAC/C,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,IAAI,SAAS,CAAC;QACzD,IACI,CAAE,YAAY,CAAC,SAAoB,CAAC,aAAa,CAAC,eAAe,CAAC,SAAmB,CAAC,EACxF,CAAC;YACC,MAAM,IAAI,KAAK,CACX,cAAc,cAAc,gBAAgB,OAAO,IAAI;gBACnD,mCAAmC;gBACnC,iBAAiB,cAAc,YAAY,OAAO,WAAW,CACpE,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,YAA0B;QAChC,yFAAyF;QACzF,4FAA4F;QAC5F,mCAAmC;QACnC,IAAA,oDAAwC,EAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE5D,MAAM,SAAS,GAAG,IAAA,wBAAY,EAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,kBAAkB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,SAAS,CAAC;QACpD,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,IAAI,SAAS,CAAC;QAE9D,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,6CAA6C;YAC7C,IAAI,OAAO,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CACX,cAAc,cAAc,0BAA0B,UAAU,aAAa,OAAO,EAAE,CACzF,CAAC;YACN,CAAC;YAED,+DAA+D;YAC/D,MAAM,QAAQ,GAAG,IAAA,uBAAW,EAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;YAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CACX,aAAa,UAAU,QAAQ,OAAO,0BAA0B;oBAC5D,sCAA0B,CACjC,CAAC;YACN,CAAC;YAED,sFAAsF;YACtF,yFAAyF;YACzF,wFAAwF;YACxF,wFAAwF;YACxF,oDAAoD;YACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,2BAAe,CAAC,kBAAkB,EAAE,EAAE,CAAC;gBAC/E,GAAG,CAAC,IAAI,CACJ,sCAAsC,OAAO,IAAI,UAAU,yBAAyB;oBAChF,mEAAmE,CAC1E,CAAC;gBACF,SAAS;YACb,CAAC;YAED,MAAM,SAAS,GAAG,gCAAoB,CAAC,MAAM,CACzC,IAAI,CAAC,YAAY,EACjB,UAAU,EACV,cAAc,CACjB,CAAC;YAEF,YAAY,CAAC,QAAQ,CACjB,IAAI,4BAAe,CACf,SAAS,EACT,IAAI,CAAC,eAAe,EACpB,kBAAkB,EAClB,IAAI,CAAC,YAAY,CACpB,CACJ,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,qBAAqB;QACzB,oDAAoD;QACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAChC,kCAAqB,CAAC,eAAe,EACrC,IAAI,CAAC,eAAe,CACvB,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACX,OAAO,QAAQ,CAAC;QACpB,CAAC;QAED,iCAAiC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAC5C,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,UAAkB;QACnC,OAAO,IAAA,uBAAW,EAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,WAAW;QACP,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,kBAAkB;QACd,OAAO,IAAI,CAAC,eAAe,CAAC;IAChC,CAAC;CACJ;AA1ID,8CA0IC","sourcesContent":["import { Routes, RouteBuilder, RouteDefinition } from './WebAppMeta';\nimport {\n    isApiPath,\n    getEndpoints,\n    getAuthMeta,\n    assertEveryWebhookEndpointRetainsRawBody,\n    assertNotInternalApi,\n    LogManager,\n    RouteMetadataFactory,\n    AuthMeta,\n    MISSING_AUTH_DECORATOR_FIX,\n    RuntimeLocality,\n} from '@webpieces/core-util';\nimport 'reflect-metadata';\nimport { ROUTING_METADATA_KEYS } from './decorators';\n\nconst log = LogManager.getLogger('ApiRoutingFactory');\n\n/**\n * Type representing a class constructor (abstract or concrete).\n */\n// webpieces-disable no-any-unknown -- generic type alias requires unconstrained default\nexport type ClassType<T = unknown> = Function & { prototype: T };\n\n/**\n * ApiRoutingFactory - Automatically wire API interfaces to controllers.\n * Reads @ApiPath/@Endpoint decorators from an API prototype class and\n * registers POST routes for each endpoint.\n *\n * Replaces the old RESTApiRoutes class.\n *\n * Usage:\n * ```typescript\n * // In your ServerMeta:\n * getRoutes(): Routes[] {\n *   return [\n *     new ApiRoutingFactory(SaveApi, SaveController),\n *   ];\n * }\n * ```\n */\n// webpieces-disable no-any-unknown -- generic class requires unconstrained default type params\nexport class ApiRoutingFactory<TApi = unknown, TController extends TApi = TApi> implements Routes {\n    private apiMetaClass: ClassType<TApi>;\n    private controllerClass: ClassType<TController>;\n\n    /**\n     * @param apiMetaClass - The API prototype class with @ApiPath/@Endpoint decorators\n     * @param controllerClass - The controller class that implements the API\n     */\n    constructor(apiMetaClass: ClassType<TApi>, controllerClass: ClassType<TController>) {\n        assertNotInternalApi(apiMetaClass, 'ApiRoutingFactory');\n        this.apiMetaClass = apiMetaClass;\n        this.controllerClass = controllerClass;\n\n        // Validate that apiMetaClass is marked with @ApiPath\n        if (!isApiPath(apiMetaClass)) {\n            const className = apiMetaClass.name || 'Unknown';\n            throw new Error(`Class ${className} must be decorated with @ApiPath()`);\n        }\n\n        // Validate that controllerClass actually extends apiMetaClass.\n        // TypeScript's structural typing won't catch a missing `extends` here, so we check\n        // the runtime prototype chain. Without this, a controller can silently drift from\n        // the API contract (wrong method names, wrong signatures) and only fail later as a\n        // confusing routing or method-not-found error.\n        const apiName = apiMetaClass.name || 'Unknown';\n        const controllerName = controllerClass.name || 'Unknown';\n        if (\n            !(apiMetaClass.prototype as object).isPrototypeOf(controllerClass.prototype as object)\n        ) {\n            throw new Error(\n                `Controller ${controllerName} must extend ${apiName}. ` +\n                    `Change the class declaration to: ` +\n                    `'export class ${controllerName} extends ${apiName} { ... }'`,\n            );\n        }\n    }\n\n    /**\n     * Configure routes by reading @ApiPath + @Endpoint metadata.\n     * Validates controller methods and auth decorators in single loop.\n     */\n    configure(routeBuilder: RouteBuilder): void {\n        // A webhook route whose transport keeps no bytes has nothing to verify. That is a wiring\n        // mistake, so it dies at STARTUP naming the fix — not as a 401 in production on exactly the\n        // traffic the endpoint exists for.\n        assertEveryWebhookEndpointRetainsRawBody(this.apiMetaClass);\n\n        const endpoints = getEndpoints(this.apiMetaClass) || {};\n        const controllerFilepath = this.getControllerFilepath();\n        const apiName = this.apiMetaClass.name || 'Unknown';\n        const controllerName = this.controllerClass.name || 'Unknown';\n\n        for (const methodName of Object.keys(endpoints)) {\n            // Validate controller implements this method\n            if (typeof this.controllerClass.prototype[methodName] !== 'function') {\n                throw new Error(\n                    `Controller ${controllerName} must implement method ${methodName} from API ${apiName}`,\n                );\n            }\n\n            // Validate auth decorator exists (class-level or method-level)\n            const authMeta = getAuthMeta(this.apiMetaClass, methodName);\n            if (!authMeta) {\n                throw new Error(\n                    `Endpoint '${methodName}' in ${apiName} has no auth decorator. ` +\n                        MISSING_AUTH_DECORATOR_FIX,\n                );\n            }\n\n            // @WpAuthLocalOnly: off-local the route is never registered, so the endpoint does not\n            // exist rather than existing-and-refusing. This is the PRIMARY gate; AuthFilter's 404 is\n            // the backstop for routes added by hand through RouteBuilder. One decorator drives both\n            // — the point of moving this into the framework was that apps were hand-syncing exactly\n            // these two halves across two files with a comment.\n            if (authMeta.mode.kind === 'local-only' && !RuntimeLocality.isLocalDevelopment()) {\n                log.info(\n                    `Skipping @WpAuthLocalOnly endpoint ${apiName}.${methodName} — this process is not ` +\n                        `a local developer machine, so the route is not registered at all.`,\n                );\n                continue;\n            }\n\n            const routeMeta = RouteMetadataFactory.create(\n                this.apiMetaClass,\n                methodName,\n                controllerName,\n            );\n\n            routeBuilder.addRoute(\n                new RouteDefinition(\n                    routeMeta,\n                    this.controllerClass,\n                    controllerFilepath,\n                    this.apiMetaClass,\n                ),\n            );\n        }\n    }\n\n    /**\n     * Get the filepath of the controller source file.\n     * Uses a heuristic based on the controller class name.\n     */\n    private getControllerFilepath(): string | undefined {\n        // Check for explicit @SourceFile decorator metadata\n        const filepath = Reflect.getMetadata(\n            ROUTING_METADATA_KEYS.SOURCE_FILEPATH,\n            this.controllerClass,\n        );\n        if (filepath) {\n            return filepath;\n        }\n\n        // Fallback to class name pattern\n        const className = this.controllerClass.name;\n        return className ? `**/${className}.ts` : undefined;\n    }\n\n    /**\n     * Get auth metadata for a specific method, falling back to class-level.\n     */\n    getAuthMetaForMethod(methodName: string): AuthMeta | undefined {\n        return getAuthMeta(this.apiMetaClass, methodName);\n    }\n\n    /**\n     * Get the API interface class.\n     */\n    getApiClass(): ClassType<TApi> {\n        return this.apiMetaClass;\n    }\n\n    /**\n     * Get the controller class.\n     */\n    getControllerClass(): ClassType<TController> {\n        return this.controllerClass;\n    }\n}\n"]}

package/src/MethodMeta.d.ts

@@ -22,6 +22,8 @@ import { RouteMetadata } from '@webpieces/core-util';
  * static route reference + the request-scoped body/bag.
  */
 export declare class MethodMeta {
+    /** API method arguments in declaration order; defaults to the historical one-body call. */
+    readonly requestArgs: readonly unknown[];
     /**
      * Route metadata (httpMethod, path, methodName, parameterTypes)
      */
@@ -35,7 +37,9 @@ export declare class MethodMeta {
      * Used by filters to pass data to other filters/controllers.
      */
     metadata: Map<string, unknown>;
-    constructor(routeMeta: RouteMetadata, requestDto?: unknown, metadata?: Map<string, unknown>);
+    constructor(routeMeta: RouteMetadata, requestDto?: unknown, metadata?: Map<string, unknown>, 
+    /** API method arguments in declaration order; defaults to the historical one-body call. */
+    requestArgs?: readonly unknown[]);
     /**
      * Get the HTTP method (convenience accessor).
      */

package/src/MethodMeta.js

@@ -24,6 +24,7 @@ exports.MethodMeta = void 0;
  * static route reference + the request-scoped body/bag.
  */
 class MethodMeta {
+    requestArgs;
     /**
      * Route metadata (httpMethod, path, methodName, parameterTypes)
      */
@@ -43,7 +44,12 @@ class MethodMeta {
     // webpieces-disable no-any-unknown -- request DTO type is erased at the filter boundary
     requestDto, 
     // webpieces-disable no-any-unknown -- request-scoped bag holds heterogeneous filter data
-    metadata) {
+    metadata, 
+    /** API method arguments in declaration order; defaults to the historical one-body call. */
+    requestArgs = requestDto === undefined
+        ? []
+        : [requestDto]) {
+        this.requestArgs = requestArgs;
         this.routeMeta = routeMeta;
         this.requestDto = requestDto;
         this.metadata = metadata ?? new Map();

package/src/MethodMeta.js.map

@@ -1 +1 @@
-{"version":3,"file":"MethodMeta.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/MethodMeta.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAa,UAAU;IACnB;;OAEG;IACH,SAAS,CAAgB;IAEzB;;OAEG;IACH,wFAAwF;IACxF,UAAU,CAAW;IAErB;;;OAGG;IACH,yFAAyF;IACzF,QAAQ,CAAuB;IAE/B,YACI,SAAwB;IACxB,wFAAwF;IACxF,UAAoB;IACpB,yFAAyF;IACzF,QAA+B;QAE/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,GAAG,EAAE,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IACrC,CAAC;CACJ;AAnDD,gCAmDC","sourcesContent":["import { RouteMetadata } from '@webpieces/core-util';\n\n/**\n * Metadata about the method being invoked.\n * Passed to filters and contains request information.\n *\n * MethodMeta is DTO-only - it does NOT contain Express req/res, nor the raw headers. The raw\n * inbound request (headers/method/path) lives on the transport-neutral {@link HttpRequest} in\n * RequestContext (read via `RequestContext.getRequest()`); MethodMeta carries only the typed\n * body + route/auth metadata that flow as the chain's call argument.\n *\n * It is the meta type every `Filter<MethodMeta, …>` is parameterized over. It lives in\n * @webpieces/http-routing and is express-free, so filter authors reference it without pulling\n * in any express dependency.\n *\n * Fields:\n * - routeMeta: Static route information (httpMethod, path, methodName, authMeta)\n * - requestDto: The deserialized request body\n * - metadata: Request-scoped data for filters to communicate\n *\n * Auth mode lives on {@link RouteMetadata.authMeta} (the one source of truth for fixed route\n * metadata); read it via `methodMeta.routeMeta.authMeta`. MethodMeta itself carries only the\n * static route reference + the request-scoped body/bag.\n */\nexport class MethodMeta {\n    /**\n     * Route metadata (httpMethod, path, methodName, parameterTypes)\n     */\n    routeMeta: RouteMetadata;\n\n    /**\n     * The deserialized request DTO.\n     */\n    // webpieces-disable no-any-unknown -- request DTO type is erased at the filter boundary\n    requestDto?: unknown;\n\n    /**\n     * Additional metadata for storing request-scoped data.\n     * Used by filters to pass data to other filters/controllers.\n     */\n    // webpieces-disable no-any-unknown -- request-scoped bag holds heterogeneous filter data\n    metadata: Map<string, unknown>;\n\n    constructor(\n        routeMeta: RouteMetadata,\n        // webpieces-disable no-any-unknown -- request DTO type is erased at the filter boundary\n        requestDto?: unknown,\n        // webpieces-disable no-any-unknown -- request-scoped bag holds heterogeneous filter data\n        metadata?: Map<string, unknown>,\n    ) {\n        this.routeMeta = routeMeta;\n        this.requestDto = requestDto;\n        this.metadata = metadata ?? new Map();\n    }\n\n    /**\n     * Get the HTTP method (convenience accessor).\n     */\n    get httpMethod(): string {\n        return this.routeMeta.httpMethod;\n    }\n\n    /**\n     * Get the request path (convenience accessor).\n     */\n    get path(): string {\n        return this.routeMeta.path;\n    }\n\n    /**\n     * Get the method name (convenience accessor).\n     */\n    get methodName(): string {\n        return this.routeMeta.methodName;\n    }\n}\n"]}
+{"version":3,"file":"MethodMeta.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/MethodMeta.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAa,UAAU;IA0BC;IAzBpB;;OAEG;IACH,SAAS,CAAgB;IAEzB;;OAEG;IACH,wFAAwF;IACxF,UAAU,CAAW;IAErB;;;OAGG;IACH,yFAAyF;IACzF,QAAQ,CAAuB;IAE/B,YACI,SAAwB;IACxB,wFAAwF;IACxF,UAAoB;IACpB,yFAAyF;IACzF,QAA+B;IAC/B,2FAA2F;IAC3E,cAAkC,UAAU,KAAK,SAAS;QACtE,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,UAAU,CAAC;QAFF,gBAAW,GAAX,WAAW,CAET;QAElB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,GAAG,EAAE,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,IAAI,UAAU;QACV,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;IACrC,CAAC;CACJ;AAvDD,gCAuDC","sourcesContent":["import { RouteMetadata } from '@webpieces/core-util';\n\n/**\n * Metadata about the method being invoked.\n * Passed to filters and contains request information.\n *\n * MethodMeta is DTO-only - it does NOT contain Express req/res, nor the raw headers. The raw\n * inbound request (headers/method/path) lives on the transport-neutral {@link HttpRequest} in\n * RequestContext (read via `RequestContext.getRequest()`); MethodMeta carries only the typed\n * body + route/auth metadata that flow as the chain's call argument.\n *\n * It is the meta type every `Filter<MethodMeta, …>` is parameterized over. It lives in\n * @webpieces/http-routing and is express-free, so filter authors reference it without pulling\n * in any express dependency.\n *\n * Fields:\n * - routeMeta: Static route information (httpMethod, path, methodName, authMeta)\n * - requestDto: The deserialized request body\n * - metadata: Request-scoped data for filters to communicate\n *\n * Auth mode lives on {@link RouteMetadata.authMeta} (the one source of truth for fixed route\n * metadata); read it via `methodMeta.routeMeta.authMeta`. MethodMeta itself carries only the\n * static route reference + the request-scoped body/bag.\n */\nexport class MethodMeta {\n    /**\n     * Route metadata (httpMethod, path, methodName, parameterTypes)\n     */\n    routeMeta: RouteMetadata;\n\n    /**\n     * The deserialized request DTO.\n     */\n    // webpieces-disable no-any-unknown -- request DTO type is erased at the filter boundary\n    requestDto?: unknown;\n\n    /**\n     * Additional metadata for storing request-scoped data.\n     * Used by filters to pass data to other filters/controllers.\n     */\n    // webpieces-disable no-any-unknown -- request-scoped bag holds heterogeneous filter data\n    metadata: Map<string, unknown>;\n\n    constructor(\n        routeMeta: RouteMetadata,\n        // webpieces-disable no-any-unknown -- request DTO type is erased at the filter boundary\n        requestDto?: unknown,\n        // webpieces-disable no-any-unknown -- request-scoped bag holds heterogeneous filter data\n        metadata?: Map<string, unknown>,\n        /** API method arguments in declaration order; defaults to the historical one-body call. */\n        public readonly requestArgs: readonly unknown[] = requestDto === undefined\n            ? []\n            : [requestDto],\n    ) {\n        this.routeMeta = routeMeta;\n        this.requestDto = requestDto;\n        this.metadata = metadata ?? new Map();\n    }\n\n    /**\n     * Get the HTTP method (convenience accessor).\n     */\n    get httpMethod(): string {\n        return this.routeMeta.httpMethod;\n    }\n\n    /**\n     * Get the request path (convenience accessor).\n     */\n    get path(): string {\n        return this.routeMeta.path;\n    }\n\n    /**\n     * Get the method name (convenience accessor).\n     */\n    get methodName(): string {\n        return this.routeMeta.methodName;\n    }\n}\n"]}

package/src/RouteBuilderImpl.d.ts

@@ -22,7 +22,7 @@ export declare class FilterWithMeta {
 export declare class RouteHandlerImpl<TResult> implements RouteHandler<TResult> {
     private controller;
     private method;
-    constructor(controller: Record<string, unknown>, method: (this: unknown, requestDto?: unknown) => Promise<TResult>);
+    constructor(controller: Record<string, unknown>, method: (this: unknown, ...args: unknown[]) => Promise<TResult>);
     execute(meta: MethodMeta): Promise<TResult>;
 }
 /**

package/src/RouteBuilderImpl.js

@@ -27,14 +27,16 @@ exports.FilterWithMeta = FilterWithMeta;
 class RouteHandlerImpl {
     controller;
     method;
-    constructor(controller, method) {
+    constructor(controller, 
+    // webpieces-disable no-any-unknown -- route handlers invoke arbitrary API argument shapes
+    method) {
         this.controller = controller;
         this.method = method;
     }
     async execute(meta) {
         // Invoke the method with requestDto from meta
         // The controller is already resolved - no DI lookup on every request!
-        const result = await this.method.call(this.controller, meta.requestDto);
+        const result = await this.method.apply(this.controller, [...meta.requestArgs]);
         return result;
     }
 }
@@ -137,8 +139,11 @@ let RouteBuilderImpl = class RouteBuilderImpl {
             const controllerName = route.controllerClass.name || 'Unknown';
             throw new Error(`Method ${routeMeta.methodName} not found on controller ${controllerName}`);
         }
-        const handler = new RouteHandlerImpl(controller, method);
+        const handler = new RouteHandlerImpl(controller, 
+        // webpieces-disable no-any-unknown -- resolved controller method has the registered API's arguments
+        method);
         // Return handler with route definition
+        // webpieces-disable no-any-unknown -- heterogeneous handlers share one registration collection
         return new RouteHandlerWithMeta(handler, route);
     }
     /**
@@ -225,7 +230,7 @@ let RouteBuilderImpl = class RouteBuilderImpl {
             },
         };
         if (matchingFilters.length === 0) {
-            throw new Error("No filters found for route — the framework auto-installs LogApiFilter + AuthFilter, so this indicates a wiring problem.");
+            throw new Error('No filters found for route — the framework auto-installs LogApiFilter + AuthFilter, so this indicates a wiring problem.');
         }
         // Chain filters: highest priority (first in array) should run first (be outermost)
         // Build from innermost (lowest priority) to outermost (highest priority)

package/src/RouteBuilderImpl.js.map

@@ -1 +1 @@
-{"version":3,"file":"RouteBuilderImpl.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/RouteBuilderImpl.ts"],"names":[],"mappings":";;;;AAEA,0DAAoE;AAKpE,6CAA0C;AAC1C,mDAA4D;AAC5D,oDAAkD;AAElD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;AAEjD;;;GAGG;AACH,MAAa,cAAc;IAEZ;IACA;IAFX,YACW,MAAkB,EAClB,UAA4B;QAD5B,WAAM,GAAN,MAAM,CAAY;QAClB,eAAU,GAAV,UAAU,CAAkB;IACpC,CAAC;CACP;AALD,wCAKC;AAED;;;GAGG;AACH,MAAa,gBAAgB;IAEb;IACA;IAFZ,YACY,UAAmC,EACnC,MAAiE;QADjE,eAAU,GAAV,UAAU,CAAyB;QACnC,WAAM,GAAN,MAAM,CAA2D;IAC1E,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,IAAgB;QAC1B,8CAA8C;QAC9C,sEAAsE;QACtE,MAAM,MAAM,GAAY,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACjF,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAZD,4CAYC;AACD;;;;;;GAMG;AACH,MAAa,oBAAoB;IAElB;IACA;IAFX,YACW,uBAA8C,EAC9C,UAA2B;QAD3B,4BAAuB,GAAvB,uBAAuB,CAAuB;QAC9C,eAAU,GAAV,UAAU,CAAiB;IACnC,CAAC;CACP;AALD,oDAKC;AAED;;;;;;;;;;;;;;;GAeG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IACjB,MAAM,GAA2B,EAAE,CAAC;IACpC,cAAc,GAA0B,EAAE,CAAC;IAC3C,SAAS,CAAa;IAE9B;;;OAGG;IACK,QAAQ,GAAsC,IAAI,GAAG,EAAE,CAAC;IAEhE;;;OAGG;IACK,cAAc,CAAC,MAAc,EAAE,IAAY;QAC/C,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,SAAoB;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAsB;QAC3B,MAAM,aAAa,GAAG,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAEhC,iDAAiD;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAC3B,KAAK,CAAC,SAAS,CAAC,UAAU,EAC1B,KAAK,CAAC,SAAS,CAAC,IAAI,CACvB,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,0BAA0B,CAC9B,KAAsB;QAEtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAElC,6EAA6E;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAA4B,CAAC;QAExF,4BAA4B;QAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,cAAc,GAAI,KAAK,CAAC,eAAqC,CAAC,IAAI,IAAI,SAAS,CAAC;YACtF,MAAM,IAAI,KAAK,CACX,UAAU,SAAS,CAAC,UAAU,4BAA4B,cAAc,EAAE,CAC7E,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAChC,UAAU,EACV,MAAmE,CACtE,CAAC;QAEF,uCAAuC;QACvC,OAAO,IAAI,oBAAoB,CAC3B,OAAgC,EAChC,KAAK,CACR,CAAC;IACN,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAA2B;QACjC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC1F,CAAC;QAED,4CAA4C;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAa,SAAS,CAAC,WAAW,CAAC,CAAC;QAErE,mCAAmC;QACnC,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,SAAS;QACL,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,gBAAgB;QACZ,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAC1D,CAAC;IACN,CAAC;IAED;;OAEG;IACK,uBAAuB,CAAsB;IAErD;;OAEG;IACK,oBAAoB;QACxB,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9C,IAAI,CAAC,uBAAuB,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACrD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC;gBAC3B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBACxB,OAAO,GAAG,CAAC;YACf,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,uBAAuB,CAAC;IACxC,CAAC;IAED;;;;;;;;;;OAUG;IACI,kBAAkB,CACrB,aAAmC;QAEnC,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,CAAC;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAElC,GAAG,CAAC,IAAI,CAAC,qBAAqB,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAExE,kFAAkF;QAClF,uFAAuF;QACvF,gDAAgD;QAChD,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAEtD,uCAAuC;QACvC,MAAM,eAAe,GAAG,6BAAa,CAAC,mBAAmB,CACrD,KAAK,CAAC,kBAAkB,EACxB,iBAAiB,CACpB,CAAC;QAEF,qDAAqD;QACrD,MAAM,iBAAiB,GAA6C;YAChE,MAAM,EAAE,KAAK,EAAE,IAAgB,EAAgC,EAAE;gBAC7D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACzE,8EAA8E;gBAC9E,yEAAyE;gBACzE,+EAA+E;gBAC/E,OAAO,IAAI,uBAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC;SACJ,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,yHAAyH,CAAC,CAAC;QAC/I,CAAC;QAED,mFAAmF;QACnF,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,OAAO,GAA6C,iBAAiB,CAAC;QAC1E,KAAK,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACnD,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,MAAc,EAAE,IAAY;QAC3C,oDAAoD;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE7C,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,0FAA0F;QAC1F,OAAO,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAc,EAAE,IAAY;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;IACxD,CAAC;CACJ,CAAA;AAzPY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,wCAAyB,GAAE;GACf,gBAAgB,CAyP5B","sourcesContent":["import { Container } from 'inversify';\nimport { RouteBuilder, RouteDefinition, FilterDefinition } from './WebAppMeta';\nimport { provideFrameworkSingleton } from '@webpieces/core-context';\nimport { RouteHandler } from './RouteHandler';\nimport { MethodMeta } from './MethodMeta';\nimport { RouteMetadata, DocumentDesign } from '@webpieces/core-util';\nimport { Service } from '@webpieces/core-util';\nimport { WpResponse } from './WpResponse';\nimport { FilterMatcher, HttpFilter } from './FilterMatcher';\nimport { LogManager } from '@webpieces/core-util';\n\nconst log = LogManager.getLogger('RouteBuilder');\n\n/**\n * FilterWithMeta - Pairs a resolved filter instance with its definition.\n * Stores both the DI-resolved filter and the metadata needed for matching.\n */\nexport class FilterWithMeta {\n    constructor(\n        public filter: HttpFilter,\n        public definition: FilterDefinition,\n    ) {}\n}\n\n/**\n * RouteHandlerImpl - Concrete implementation of RouteHandler.\n * Wraps a resolved controller and method to invoke on each request.\n */\nexport class RouteHandlerImpl<TResult> implements RouteHandler<TResult> {\n    constructor(\n        private controller: Record<string, unknown>,\n        private method: (this: unknown, requestDto?: unknown) => Promise<TResult>,\n    ) {}\n\n    async execute(meta: MethodMeta): Promise<TResult> {\n        // Invoke the method with requestDto from meta\n        // The controller is already resolved - no DI lookup on every request!\n        const result: TResult = await this.method.call(this.controller, meta.requestDto);\n        return result;\n    }\n}\n/**\n * RouteHandlerWithMeta - Pairs a route handler with its definition.\n * Stores both the handler (which wraps the DI-resolved controller) and the route metadata.\n *\n * We use unknown for the generic type since we store different TResult types in the same Map.\n * Type safety is maintained through the generic on RouteDefinition at registration time.\n */\nexport class RouteHandlerWithMeta {\n    constructor(\n        public invokeControllerHandler: RouteHandler<unknown>,\n        public definition: RouteDefinition,\n    ) {}\n}\n\n/**\n * RouteBuilderImpl - Concrete implementation of RouteBuilder interface.\n *\n * Similar to Java WebPieces RouteBuilder, this class is responsible for:\n * 1. Registering routes with their handlers\n * 2. Registering filters with priority\n *\n * This class is explicit (not anonymous) to:\n * - Improve traceability and debugging\n * - Make the code easier to understand\n * - Enable better IDE navigation (Cmd+Click on addRoute works!)\n *\n * DI Pattern: This class is registered in webpiecesContainer via @provideFrameworkSingleton()\n * but needs appContainer to resolve filters/controllers. The container is set via\n * setContainer() after appContainer is created (late binding pattern).\n */\n@provideFrameworkSingleton()\nexport class RouteBuilderImpl implements RouteBuilder {\n    private routes: RouteHandlerWithMeta[] = [];\n    private filterRegistry: Array<FilterWithMeta> = [];\n    private container?: Container;\n\n    /**\n     * Map for O(1) route lookup by method:path.\n     * Used by both addRoute() and createRouteInvoker() for fast route access.\n     */\n    private routeMap: Map<string, RouteHandlerWithMeta> = new Map();\n\n    /**\n     * Create route key for consistent lookup.\n     * Key format: \"${METHOD}:${path}\" (e.g., \"POST:/search/item\")\n     */\n    private createRouteKey(method: string, path: string): string {\n        return `${method.toUpperCase()}:${path}`;\n    }\n\n    /**\n     * Set the DI container used for resolving filters and controllers.\n     * Called by WebpiecesCoreServer after appContainer is created.\n     *\n     * @param container - The application DI container (appContainer)\n     */\n    setContainer(container: Container): void {\n        this.container = container;\n    }\n\n    /**\n     * Register a route with the router.\n     *\n     * Uses createRouteHandlerWithMeta() to create the handler, then stores it\n     * in both the routes array and the routeMap for O(1) lookup.\n     *\n     * @param route - Route definition with controller class and method name\n     */\n    addRoute(route: RouteDefinition): void {\n        const routeWithMeta = this.createRouteHandlerWithMeta(route);\n        this.routes.push(routeWithMeta);\n\n        // Also add to map for O(1) lookup by method:path\n        const key = this.createRouteKey(\n            route.routeMeta.httpMethod,\n            route.routeMeta.path\n        );\n        this.routeMap.set(key, routeWithMeta);\n    }\n\n    /**\n     * Create RouteHandlerWithMeta from a RouteDefinition.\n     *\n     * Resolves controller from DI container ONCE and creates a handler that\n     * invokes the controller method with the request DTO.\n     *\n     * This method is used by:\n     * - addRoute() for production route registration\n     * - createRouteInvoker() for test clients (via createApiClient)\n     *\n     * @param route - Route definition with controller class and method name\n     * @returns RouteHandlerWithMeta containing the handler and route definition\n     */\n    private createRouteHandlerWithMeta<TResult = unknown>(\n        route: RouteDefinition,\n    ): RouteHandlerWithMeta {\n        if (!this.container) {\n            throw new Error('Container not set. Call setContainer() before registering routes.');\n        }\n\n        const routeMeta = route.routeMeta;\n\n        // Resolve controller instance from DI container ONCE (not on every request!)\n        const controller = this.container.get(route.controllerClass) as Record<string, unknown>;\n\n        // Get the controller method\n        const method = controller[routeMeta.methodName];\n        if (typeof method !== 'function') {\n            const controllerName = (route.controllerClass as { name?: string }).name || 'Unknown';\n            throw new Error(\n                `Method ${routeMeta.methodName} not found on controller ${controllerName}`,\n            );\n        }\n\n        const handler = new RouteHandlerImpl<TResult>(\n            controller,\n            method as (this: unknown, requestDto?: unknown) => Promise<TResult>\n        );\n\n        // Return handler with route definition\n        return new RouteHandlerWithMeta(\n            handler as RouteHandler<unknown>,\n            route,\n        );\n    }\n\n    /**\n     * Register a filter with the filter chain.\n     *\n     * Resolves the filter from DI container and pairs it with the filter definition.\n     * The definition includes pattern information used for route-specific filtering.\n     *\n     * @param filterDef - Filter definition with priority, filter class, and optional filepath pattern\n     */\n    addFilter(filterDef: FilterDefinition): void {\n        if (!this.container) {\n            throw new Error('Container not set. Call setContainer() before registering filters.');\n        }\n\n        // Resolve filter instance from DI container\n        const filter = this.container.get<HttpFilter>(filterDef.filterClass);\n\n        // Store filter with its definition\n        const filterWithMeta = new FilterWithMeta(filter, filterDef);\n        this.filterRegistry.push(filterWithMeta);\n    }\n\n    /**\n     * Get all registered routes.\n     *\n     * @returns Map of routes with handlers and definitions, keyed by \"METHOD:path\"\n     */\n    getRoutes(): RouteHandlerWithMeta[] {\n        return this.routes;\n    }\n\n    /**\n     * Get all filters sorted by priority (highest priority first).\n     *\n     * @returns Array of FilterWithMeta sorted by priority\n     */\n    getSortedFilters(): Array<FilterWithMeta> {\n        return [...this.filterRegistry].sort(\n            (a, b) => b.definition.priority - a.definition.priority,\n        );\n    }\n\n    /**\n     * Cached filter definitions for lazy route setup.\n     */\n    private cachedFilterDefinitions?: FilterDefinition[];\n\n    /**\n     * Get filter definitions, computing once and caching.\n     */\n    private getFilterDefinitions(): FilterDefinition[] {\n        if (!this.cachedFilterDefinitions) {\n            const sortedFilters = this.getSortedFilters();\n            this.cachedFilterDefinitions = sortedFilters.map((fwm) => {\n                const def = fwm.definition;\n                def.filter = fwm.filter;\n                return def;\n            });\n        }\n        return this.cachedFilterDefinitions;\n    }\n\n    /**\n     * Setup a single route by creating its filter chain.\n     * This is called lazily by createHandler() and getRouteService().\n     *\n     * Creates a Service that wraps the filter chain and controller invocation.\n     * The service is DTO-only and has no Express dependency.\n     *\n     * @param key - Route key in format \"METHOD:path\"\n     * @param routeWithMeta - Route handler with metadata\n     * @returns The service for this route\n     */\n    public createRouteHandler(\n        routeWithMeta: RouteHandlerWithMeta,\n    ): Service<MethodMeta, WpResponse<unknown>> {\n        const route = routeWithMeta.definition;\n        const routeMeta = route.routeMeta;\n\n        log.info(`Setting up route: ${routeMeta.httpMethod} ${routeMeta.path}`);\n\n        // ONE chain for both HTTP and in-process — no transport tier. The fixed framework\n        // filters (LogApiFilter, AuthFilter) are auto-installed and read the transport-neutral\n        // HttpRequest, so they run identically in both.\n        const filterDefinitions = this.getFilterDefinitions();\n\n        // Find matching filters for this route\n        const matchingFilters = FilterMatcher.findMatchingFilters(\n            route.controllerFilepath,\n            filterDefinitions,\n        );\n\n        // Create service that wraps the controller execution\n        const controllerService: Service<MethodMeta, WpResponse<unknown>> = {\n            invoke: async (meta: MethodMeta): Promise<WpResponse<unknown>> => {\n                const result = await routeWithMeta.invokeControllerHandler.execute(meta);\n                // A void endpoint (e.g. a @PubSub cloud-task handler returning Promise<void>)\n                // yields undefined; coerce to {} so the response is a non-null JSON body\n                // (downstream LogApiCall/serialization require one), mirroring `result ?? {}`.\n                return new WpResponse(result ?? {});\n            },\n        };\n\n        if (matchingFilters.length === 0) {\n            throw new Error(\"No filters found for route — the framework auto-installs LogApiFilter + AuthFilter, so this indicates a wiring problem.\");\n        }\n\n        // Chain filters: highest priority (first in array) should run first (be outermost)\n        // Build from innermost (lowest priority) to outermost (highest priority)\n        // Start with controller, then wrap with filters in reverse priority order\n        let service: Service<MethodMeta, WpResponse<unknown>> = controllerService;\n        for (let i = matchingFilters.length - 1; i >= 0; i--) {\n            service = matchingFilters[i].chainService(service);\n        }\n\n        return service;\n    }\n\n    /**\n     * Create an invoker function for a route (for testing via createApiClient).\n     * Uses routeMap for O(1) lookup, sets up the filter chain ONCE,\n     * and returns a Service that can be called multiple times without\n     * recreating the filter chain.\n     *\n     * This method is called by WebpiecesServer.createApiClient() during proxy setup.\n     * The returned Service is stored as the proxy method and invoked on each call.\n     *\n     * @param method - HTTP method (GET, POST, etc.)\n     * @param path - URL path\n     * @returns A Service that invokes the route\n     */\n    createRouteInvoker(method: string, path: string): Service<MethodMeta, WpResponse<unknown>> {\n        // Use routeMap for O(1) lookup (not linear search!)\n        const key = this.createRouteKey(method, path);\n        const routeWithMeta = this.routeMap.get(key);\n\n        if (!routeWithMeta) {\n            throw new Error(`Route not found: ${method} ${path}`);\n        }\n\n        // Setup filter chain ONCE (not on every invocation!). Same chain as HTTP — auth included.\n        return this.createRouteHandler(routeWithMeta);\n    }\n\n    /**\n     * Look up the RouteMetadata (incl. authMeta) for a registered route by method+path.\n     * Used to build a MethodMeta for an in-process dispatch (e.g. a delivered cloud\n     * task) so the filter chain sees the same routeMeta production HTTP would.\n     *\n     * @returns the route's RouteMetadata, or undefined if no route is registered.\n     */\n    getRouteMeta(method: string, path: string): RouteMetadata | undefined {\n        const key = this.createRouteKey(method, path);\n        return this.routeMap.get(key)?.definition.routeMeta;\n    }\n}\n"]}
+{"version":3,"file":"RouteBuilderImpl.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/RouteBuilderImpl.ts"],"names":[],"mappings":";;;;AAEA,0DAAoE;AAKpE,6CAA0C;AAC1C,mDAA4D;AAC5D,oDAAkD;AAElD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;AAMjD;;;GAGG;AACH,MAAa,cAAc;IAEZ;IACA;IAFX,YACW,MAAkB,EAClB,UAA4B;QAD5B,WAAM,GAAN,MAAM,CAAY;QAClB,eAAU,GAAV,UAAU,CAAkB;IACpC,CAAC;CACP;AALD,wCAKC;AAED;;;GAGG;AACH,MAAa,gBAAgB;IAEb;IAEA;IAHZ,YACY,UAAmC;IAC3C,0FAA0F;IAClF,MAA+D;QAF/D,eAAU,GAAV,UAAU,CAAyB;QAEnC,WAAM,GAAN,MAAM,CAAyD;IACxE,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,IAAgB;QAC1B,8CAA8C;QAC9C,sEAAsE;QACtE,MAAM,MAAM,GAAY,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QACxF,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAbD,4CAaC;AACD;;;;;;GAMG;AACH,MAAa,oBAAoB;IAElB;IACA;IAFX,YACW,uBAA8C,EAC9C,UAA2B;QAD3B,4BAAuB,GAAvB,uBAAuB,CAAuB;QAC9C,eAAU,GAAV,UAAU,CAAiB;IACnC,CAAC;CACP;AALD,oDAKC;AAED;;;;;;;;;;;;;;;GAeG;AAEI,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IACjB,MAAM,GAA2B,EAAE,CAAC;IACpC,cAAc,GAA0B,EAAE,CAAC;IAC3C,SAAS,CAAa;IAE9B;;;OAGG;IACK,QAAQ,GAAsC,IAAI,GAAG,EAAE,CAAC;IAEhE;;;OAGG;IACK,cAAc,CAAC,MAAc,EAAE,IAAY;QAC/C,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACH,YAAY,CAAC,SAAoB;QAC7B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAsB;QAC3B,MAAM,aAAa,GAAG,IAAI,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAEhC,iDAAiD;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;OAYG;IACK,0BAA0B,CAC9B,KAAsB;QAEtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAElC,6EAA6E;QAC7E,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAA4B,CAAC;QAExF,4BAA4B;QAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,OAAO,MAAM,KAAK,UAAU,EAAE,CAAC;YAC/B,MAAM,cAAc,GAAI,KAAK,CAAC,eAA8B,CAAC,IAAI,IAAI,SAAS,CAAC;YAC/E,MAAM,IAAI,KAAK,CACX,UAAU,SAAS,CAAC,UAAU,4BAA4B,cAAc,EAAE,CAC7E,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAChC,UAAU;QACV,oGAAoG;QACpG,MAAiE,CACpE,CAAC;QAEF,uCAAuC;QACvC,+FAA+F;QAC/F,OAAO,IAAI,oBAAoB,CAAC,OAAgC,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,SAA2B;QACjC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC1F,CAAC;QAED,4CAA4C;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAa,SAAS,CAAC,WAAW,CAAC,CAAC;QAErE,mCAAmC;QACnC,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,SAAS;QACL,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAED;;;;OAIG;IACH,gBAAgB;QACZ,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAChC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,QAAQ,CAC1D,CAAC;IACN,CAAC;IAED;;OAEG;IACK,uBAAuB,CAAsB;IAErD;;OAEG;IACK,oBAAoB;QACxB,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAChC,MAAM,aAAa,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC9C,IAAI,CAAC,uBAAuB,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACrD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC;gBAC3B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBACxB,OAAO,GAAG,CAAC;YACf,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,uBAAuB,CAAC;IACxC,CAAC;IAED;;;;;;;;;;OAUG;IACI,kBAAkB,CACrB,aAAmC;QAEnC,MAAM,KAAK,GAAG,aAAa,CAAC,UAAU,CAAC;QACvC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAElC,GAAG,CAAC,IAAI,CAAC,qBAAqB,SAAS,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAExE,kFAAkF;QAClF,uFAAuF;QACvF,gDAAgD;QAChD,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAEtD,uCAAuC;QACvC,MAAM,eAAe,GAAG,6BAAa,CAAC,mBAAmB,CACrD,KAAK,CAAC,kBAAkB,EACxB,iBAAiB,CACpB,CAAC;QAEF,qDAAqD;QACrD,MAAM,iBAAiB,GAA6C;YAChE,MAAM,EAAE,KAAK,EAAE,IAAgB,EAAgC,EAAE;gBAC7D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACzE,8EAA8E;gBAC9E,yEAAyE;gBACzE,+EAA+E;gBAC/E,OAAO,IAAI,uBAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC;SACJ,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACX,yHAAyH,CAC5H,CAAC;QACN,CAAC;QAED,mFAAmF;QACnF,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,OAAO,GAA6C,iBAAiB,CAAC;QAC1E,KAAK,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACnD,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,kBAAkB,CAAC,MAAc,EAAE,IAAY;QAC3C,oDAAoD;QACpD,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE7C,IAAI,CAAC,aAAa,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,0FAA0F;QAC1F,OAAO,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,MAAc,EAAE,IAAY;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC;IACxD,CAAC;CACJ,CAAA;AAvPY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,wCAAyB,GAAE;GACf,gBAAgB,CAuP5B","sourcesContent":["import { Container } from 'inversify';\nimport { RouteBuilder, RouteDefinition, FilterDefinition } from './WebAppMeta';\nimport { provideFrameworkSingleton } from '@webpieces/core-context';\nimport { RouteHandler } from './RouteHandler';\nimport { MethodMeta } from './MethodMeta';\nimport { RouteMetadata, DocumentDesign } from '@webpieces/core-util';\nimport { Service } from '@webpieces/core-util';\nimport { WpResponse } from './WpResponse';\nimport { FilterMatcher, HttpFilter } from './FilterMatcher';\nimport { LogManager } from '@webpieces/core-util';\n\nconst log = LogManager.getLogger('RouteBuilder');\n\ninterface NamedClass {\n    name?: string;\n}\n\n/**\n * FilterWithMeta - Pairs a resolved filter instance with its definition.\n * Stores both the DI-resolved filter and the metadata needed for matching.\n */\nexport class FilterWithMeta {\n    constructor(\n        public filter: HttpFilter,\n        public definition: FilterDefinition,\n    ) {}\n}\n\n/**\n * RouteHandlerImpl - Concrete implementation of RouteHandler.\n * Wraps a resolved controller and method to invoke on each request.\n */\nexport class RouteHandlerImpl<TResult> implements RouteHandler<TResult> {\n    constructor(\n        private controller: Record<string, unknown>,\n        // webpieces-disable no-any-unknown -- route handlers invoke arbitrary API argument shapes\n        private method: (this: unknown, ...args: unknown[]) => Promise<TResult>,\n    ) {}\n\n    async execute(meta: MethodMeta): Promise<TResult> {\n        // Invoke the method with requestDto from meta\n        // The controller is already resolved - no DI lookup on every request!\n        const result: TResult = await this.method.apply(this.controller, [...meta.requestArgs]);\n        return result;\n    }\n}\n/**\n * RouteHandlerWithMeta - Pairs a route handler with its definition.\n * Stores both the handler (which wraps the DI-resolved controller) and the route metadata.\n *\n * We use unknown for the generic type since we store different TResult types in the same Map.\n * Type safety is maintained through the generic on RouteDefinition at registration time.\n */\nexport class RouteHandlerWithMeta {\n    constructor(\n        public invokeControllerHandler: RouteHandler<unknown>,\n        public definition: RouteDefinition,\n    ) {}\n}\n\n/**\n * RouteBuilderImpl - Concrete implementation of RouteBuilder interface.\n *\n * Similar to Java WebPieces RouteBuilder, this class is responsible for:\n * 1. Registering routes with their handlers\n * 2. Registering filters with priority\n *\n * This class is explicit (not anonymous) to:\n * - Improve traceability and debugging\n * - Make the code easier to understand\n * - Enable better IDE navigation (Cmd+Click on addRoute works!)\n *\n * DI Pattern: This class is registered in webpiecesContainer via @provideFrameworkSingleton()\n * but needs appContainer to resolve filters/controllers. The container is set via\n * setContainer() after appContainer is created (late binding pattern).\n */\n@provideFrameworkSingleton()\nexport class RouteBuilderImpl implements RouteBuilder {\n    private routes: RouteHandlerWithMeta[] = [];\n    private filterRegistry: Array<FilterWithMeta> = [];\n    private container?: Container;\n\n    /**\n     * Map for O(1) route lookup by method:path.\n     * Used by both addRoute() and createRouteInvoker() for fast route access.\n     */\n    private routeMap: Map<string, RouteHandlerWithMeta> = new Map();\n\n    /**\n     * Create route key for consistent lookup.\n     * Key format: \"${METHOD}:${path}\" (e.g., \"POST:/search/item\")\n     */\n    private createRouteKey(method: string, path: string): string {\n        return `${method.toUpperCase()}:${path}`;\n    }\n\n    /**\n     * Set the DI container used for resolving filters and controllers.\n     * Called by WebpiecesCoreServer after appContainer is created.\n     *\n     * @param container - The application DI container (appContainer)\n     */\n    setContainer(container: Container): void {\n        this.container = container;\n    }\n\n    /**\n     * Register a route with the router.\n     *\n     * Uses createRouteHandlerWithMeta() to create the handler, then stores it\n     * in both the routes array and the routeMap for O(1) lookup.\n     *\n     * @param route - Route definition with controller class and method name\n     */\n    addRoute(route: RouteDefinition): void {\n        const routeWithMeta = this.createRouteHandlerWithMeta(route);\n        this.routes.push(routeWithMeta);\n\n        // Also add to map for O(1) lookup by method:path\n        const key = this.createRouteKey(route.routeMeta.httpMethod, route.routeMeta.path);\n        this.routeMap.set(key, routeWithMeta);\n    }\n\n    /**\n     * Create RouteHandlerWithMeta from a RouteDefinition.\n     *\n     * Resolves controller from DI container ONCE and creates a handler that\n     * invokes the controller method with the request DTO.\n     *\n     * This method is used by:\n     * - addRoute() for production route registration\n     * - createRouteInvoker() for test clients (via createApiClient)\n     *\n     * @param route - Route definition with controller class and method name\n     * @returns RouteHandlerWithMeta containing the handler and route definition\n     */\n    private createRouteHandlerWithMeta<TResult = unknown>(\n        route: RouteDefinition,\n    ): RouteHandlerWithMeta {\n        if (!this.container) {\n            throw new Error('Container not set. Call setContainer() before registering routes.');\n        }\n\n        const routeMeta = route.routeMeta;\n\n        // Resolve controller instance from DI container ONCE (not on every request!)\n        const controller = this.container.get(route.controllerClass) as Record<string, unknown>;\n\n        // Get the controller method\n        const method = controller[routeMeta.methodName];\n        if (typeof method !== 'function') {\n            const controllerName = (route.controllerClass as NamedClass).name || 'Unknown';\n            throw new Error(\n                `Method ${routeMeta.methodName} not found on controller ${controllerName}`,\n            );\n        }\n\n        const handler = new RouteHandlerImpl<TResult>(\n            controller,\n            // webpieces-disable no-any-unknown -- resolved controller method has the registered API's arguments\n            method as (this: unknown, ...args: unknown[]) => Promise<TResult>,\n        );\n\n        // Return handler with route definition\n        // webpieces-disable no-any-unknown -- heterogeneous handlers share one registration collection\n        return new RouteHandlerWithMeta(handler as RouteHandler<unknown>, route);\n    }\n\n    /**\n     * Register a filter with the filter chain.\n     *\n     * Resolves the filter from DI container and pairs it with the filter definition.\n     * The definition includes pattern information used for route-specific filtering.\n     *\n     * @param filterDef - Filter definition with priority, filter class, and optional filepath pattern\n     */\n    addFilter(filterDef: FilterDefinition): void {\n        if (!this.container) {\n            throw new Error('Container not set. Call setContainer() before registering filters.');\n        }\n\n        // Resolve filter instance from DI container\n        const filter = this.container.get<HttpFilter>(filterDef.filterClass);\n\n        // Store filter with its definition\n        const filterWithMeta = new FilterWithMeta(filter, filterDef);\n        this.filterRegistry.push(filterWithMeta);\n    }\n\n    /**\n     * Get all registered routes.\n     *\n     * @returns Map of routes with handlers and definitions, keyed by \"METHOD:path\"\n     */\n    getRoutes(): RouteHandlerWithMeta[] {\n        return this.routes;\n    }\n\n    /**\n     * Get all filters sorted by priority (highest priority first).\n     *\n     * @returns Array of FilterWithMeta sorted by priority\n     */\n    getSortedFilters(): Array<FilterWithMeta> {\n        return [...this.filterRegistry].sort(\n            (a, b) => b.definition.priority - a.definition.priority,\n        );\n    }\n\n    /**\n     * Cached filter definitions for lazy route setup.\n     */\n    private cachedFilterDefinitions?: FilterDefinition[];\n\n    /**\n     * Get filter definitions, computing once and caching.\n     */\n    private getFilterDefinitions(): FilterDefinition[] {\n        if (!this.cachedFilterDefinitions) {\n            const sortedFilters = this.getSortedFilters();\n            this.cachedFilterDefinitions = sortedFilters.map((fwm) => {\n                const def = fwm.definition;\n                def.filter = fwm.filter;\n                return def;\n            });\n        }\n        return this.cachedFilterDefinitions;\n    }\n\n    /**\n     * Setup a single route by creating its filter chain.\n     * This is called lazily by createHandler() and getRouteService().\n     *\n     * Creates a Service that wraps the filter chain and controller invocation.\n     * The service is DTO-only and has no Express dependency.\n     *\n     * @param key - Route key in format \"METHOD:path\"\n     * @param routeWithMeta - Route handler with metadata\n     * @returns The service for this route\n     */\n    public createRouteHandler(\n        routeWithMeta: RouteHandlerWithMeta,\n    ): Service<MethodMeta, WpResponse<unknown>> {\n        const route = routeWithMeta.definition;\n        const routeMeta = route.routeMeta;\n\n        log.info(`Setting up route: ${routeMeta.httpMethod} ${routeMeta.path}`);\n\n        // ONE chain for both HTTP and in-process — no transport tier. The fixed framework\n        // filters (LogApiFilter, AuthFilter) are auto-installed and read the transport-neutral\n        // HttpRequest, so they run identically in both.\n        const filterDefinitions = this.getFilterDefinitions();\n\n        // Find matching filters for this route\n        const matchingFilters = FilterMatcher.findMatchingFilters(\n            route.controllerFilepath,\n            filterDefinitions,\n        );\n\n        // Create service that wraps the controller execution\n        const controllerService: Service<MethodMeta, WpResponse<unknown>> = {\n            invoke: async (meta: MethodMeta): Promise<WpResponse<unknown>> => {\n                const result = await routeWithMeta.invokeControllerHandler.execute(meta);\n                // A void endpoint (e.g. a @PubSub cloud-task handler returning Promise<void>)\n                // yields undefined; coerce to {} so the response is a non-null JSON body\n                // (downstream LogApiCall/serialization require one), mirroring `result ?? {}`.\n                return new WpResponse(result ?? {});\n            },\n        };\n\n        if (matchingFilters.length === 0) {\n            throw new Error(\n                'No filters found for route — the framework auto-installs LogApiFilter + AuthFilter, so this indicates a wiring problem.',\n            );\n        }\n\n        // Chain filters: highest priority (first in array) should run first (be outermost)\n        // Build from innermost (lowest priority) to outermost (highest priority)\n        // Start with controller, then wrap with filters in reverse priority order\n        let service: Service<MethodMeta, WpResponse<unknown>> = controllerService;\n        for (let i = matchingFilters.length - 1; i >= 0; i--) {\n            service = matchingFilters[i].chainService(service);\n        }\n\n        return service;\n    }\n\n    /**\n     * Create an invoker function for a route (for testing via createApiClient).\n     * Uses routeMap for O(1) lookup, sets up the filter chain ONCE,\n     * and returns a Service that can be called multiple times without\n     * recreating the filter chain.\n     *\n     * This method is called by WebpiecesServer.createApiClient() during proxy setup.\n     * The returned Service is stored as the proxy method and invoked on each call.\n     *\n     * @param method - HTTP method (GET, POST, etc.)\n     * @param path - URL path\n     * @returns A Service that invokes the route\n     */\n    createRouteInvoker(method: string, path: string): Service<MethodMeta, WpResponse<unknown>> {\n        // Use routeMap for O(1) lookup (not linear search!)\n        const key = this.createRouteKey(method, path);\n        const routeWithMeta = this.routeMap.get(key);\n\n        if (!routeWithMeta) {\n            throw new Error(`Route not found: ${method} ${path}`);\n        }\n\n        // Setup filter chain ONCE (not on every invocation!). Same chain as HTTP — auth included.\n        return this.createRouteHandler(routeWithMeta);\n    }\n\n    /**\n     * Look up the RouteMetadata (incl. authMeta) for a registered route by method+path.\n     * Used to build a MethodMeta for an in-process dispatch (e.g. a delivered cloud\n     * task) so the filter chain sees the same routeMeta production HTTP would.\n     *\n     * @returns the route's RouteMetadata, or undefined if no route is registered.\n     */\n    getRouteMeta(method: string, path: string): RouteMetadata | undefined {\n        const key = this.createRouteKey(method, path);\n        return this.routeMap.get(key)?.definition.routeMeta;\n    }\n}\n"]}

package/src/index.d.ts

@@ -1,5 +1,5 @@
-export { ApiPath, Endpoint, WpAuthPublic, WpAuthJwt, rolesRequired, WpAuthOidc, WpAuthSharedSecret, WpAuthWebhook, WpAuthLocalOnly, Rpc, PubSub, Queue, getApiPath, getEndpoints, getEndpointOptions, isFormPost, isRawBody, isApiPath, getAuthMeta, getAuthMode, assertEveryEndpointHasAuthMode, getApiKind, assertApiKind, assertPubSubConventions, getQueueName, AuthMeta, RouteMetadata, METADATA_KEYS, ValidateImplementation, DocumentDesign, isDocumentDesign, } from '@webpieces/core-util';
-export type { AuthMode, ApiKind, EndpointOptions, } from '@webpieces/core-util';
+export { ApiPath, Endpoint, PathParam, QueryParam, WpAuthPublic, WpAuthJwt, rolesRequired, WpAuthOidc, WpAuthSharedSecret, WpAuthWebhook, WpAuthLocalOnly, Rpc, PubSub, Queue, getApiPath, getEndpoints, getEndpointOptions, getHttpParameterDeclarations, isFormPost, isRawBody, isApiPath, getAuthMeta, getAuthMode, assertEveryEndpointHasAuthMode, getApiKind, assertApiKind, assertPubSubConventions, getQueueName, AuthMeta, RouteMetadata, RouteMetadataFactory, HttpContractMapper, METADATA_KEYS, ValidateImplementation, DocumentDesign, isDocumentDesign, } from '@webpieces/core-util';
+export type { AuthMode, ApiKind, EndpointOptions, ContractHttpMethod, EndpointResponseType, } from '@webpieces/core-util';
 export { SourceFile, ROUTING_METADATA_KEYS } from './decorators';
 export { provideSingletonDefaultForApi } from '@webpieces/core-context';
 export { provideFrameworkSingleton, provideFrameworkSingletonDefaultForApi, buildFrameworkModule, } from '@webpieces/core-context';

package/src/index.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthenticatedCaller = exports.AUTH_CONFIG = exports.AuthConfig = exports.ApiClient = exports.FilterMatcher = exports.LogApiFilter = exports.RouteHandler = exports.MethodMeta = exports.WpResponse = exports.RawRequest = exports.HttpRequest = exports.FilterDefinition = exports.RouteDefinition = exports.ApiRoutingFactory = exports.buildFrameworkModule = exports.provideFrameworkSingletonDefaultForApi = exports.provideFrameworkSingleton = exports.provideSingletonDefaultForApi = exports.ROUTING_METADATA_KEYS = exports.SourceFile = exports.isDocumentDesign = exports.DocumentDesign = exports.METADATA_KEYS = exports.RouteMetadata = exports.AuthMeta = exports.getQueueName = exports.assertPubSubConventions = exports.assertApiKind = exports.getApiKind = exports.assertEveryEndpointHasAuthMode = exports.getAuthMode = exports.getAuthMeta = exports.isApiPath = exports.isRawBody = exports.isFormPost = exports.getEndpointOptions = exports.getEndpoints = exports.getApiPath = exports.Queue = exports.PubSub = exports.Rpc = exports.WpAuthLocalOnly = exports.WpAuthWebhook = exports.WpAuthSharedSecret = exports.WpAuthOidc = exports.rolesRequired = exports.WpAuthJwt = exports.WpAuthPublic = exports.Endpoint = exports.ApiPath = void 0;
-exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = exports.RuntimeSetupOptions = exports.setupRuntime = exports.WebpiecesRouterFactory = exports.WebpiecesRouter = exports.DefaultJwtMintRequest = exports.DefaultJwtHook = exports.DefaultOidcVerifier = exports.API_KEY_HOOK = exports.ApiKeyHook = exports.WEBHOOK_AUTH_CALLBACK = exports.WebhookAuthCallback = exports.OIDC_HOOK = exports.OidcHook = exports.JWT_HOOK = exports.MintedJwt = exports.JwtHook = exports.SharedSecrets = exports.AUTHENTICATED_CALLER_KEY = void 0;
+exports.LogApiFilter = exports.RouteHandler = exports.MethodMeta = exports.WpResponse = exports.RawRequest = exports.HttpRequest = exports.FilterDefinition = exports.RouteDefinition = exports.ApiRoutingFactory = exports.buildFrameworkModule = exports.provideFrameworkSingletonDefaultForApi = exports.provideFrameworkSingleton = exports.provideSingletonDefaultForApi = exports.ROUTING_METADATA_KEYS = exports.SourceFile = exports.isDocumentDesign = exports.DocumentDesign = exports.METADATA_KEYS = exports.HttpContractMapper = exports.RouteMetadataFactory = exports.RouteMetadata = exports.AuthMeta = exports.getQueueName = exports.assertPubSubConventions = exports.assertApiKind = exports.getApiKind = exports.assertEveryEndpointHasAuthMode = exports.getAuthMode = exports.getAuthMeta = exports.isApiPath = exports.isRawBody = exports.isFormPost = exports.getHttpParameterDeclarations = exports.getEndpointOptions = exports.getEndpoints = exports.getApiPath = exports.Queue = exports.PubSub = exports.Rpc = exports.WpAuthLocalOnly = exports.WpAuthWebhook = exports.WpAuthSharedSecret = exports.WpAuthOidc = exports.rolesRequired = exports.WpAuthJwt = exports.WpAuthPublic = exports.QueryParam = exports.PathParam = exports.Endpoint = exports.ApiPath = void 0;
+exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = exports.RuntimeSetupOptions = exports.setupRuntime = exports.WebpiecesRouterFactory = exports.WebpiecesRouter = exports.DefaultJwtMintRequest = exports.DefaultJwtHook = exports.DefaultOidcVerifier = exports.API_KEY_HOOK = exports.ApiKeyHook = exports.WEBHOOK_AUTH_CALLBACK = exports.WebhookAuthCallback = exports.OIDC_HOOK = exports.OidcHook = exports.JWT_HOOK = exports.MintedJwt = exports.JwtHook = exports.SharedSecrets = exports.AUTHENTICATED_CALLER_KEY = exports.AuthenticatedCaller = exports.AUTH_CONFIG = exports.AuthConfig = exports.ApiClient = exports.FilterMatcher = void 0;
 // Re-export API decorators from core-util for convenience
 var core_util_1 = require("@webpieces/core-util");
 Object.defineProperty(exports, "ApiPath", { enumerable: true, get: function () { return core_util_1.ApiPath; } });
 Object.defineProperty(exports, "Endpoint", { enumerable: true, get: function () { return core_util_1.Endpoint; } });
+Object.defineProperty(exports, "PathParam", { enumerable: true, get: function () { return core_util_1.PathParam; } });
+Object.defineProperty(exports, "QueryParam", { enumerable: true, get: function () { return core_util_1.QueryParam; } });
 Object.defineProperty(exports, "WpAuthPublic", { enumerable: true, get: function () { return core_util_1.WpAuthPublic; } });
 Object.defineProperty(exports, "WpAuthJwt", { enumerable: true, get: function () { return core_util_1.WpAuthJwt; } });
 Object.defineProperty(exports, "rolesRequired", { enumerable: true, get: function () { return core_util_1.rolesRequired; } });
@@ -19,6 +21,7 @@ Object.defineProperty(exports, "Queue", { enumerable: true, get: function () { r
 Object.defineProperty(exports, "getApiPath", { enumerable: true, get: function () { return core_util_1.getApiPath; } });
 Object.defineProperty(exports, "getEndpoints", { enumerable: true, get: function () { return core_util_1.getEndpoints; } });
 Object.defineProperty(exports, "getEndpointOptions", { enumerable: true, get: function () { return core_util_1.getEndpointOptions; } });
+Object.defineProperty(exports, "getHttpParameterDeclarations", { enumerable: true, get: function () { return core_util_1.getHttpParameterDeclarations; } });
 Object.defineProperty(exports, "isFormPost", { enumerable: true, get: function () { return core_util_1.isFormPost; } });
 Object.defineProperty(exports, "isRawBody", { enumerable: true, get: function () { return core_util_1.isRawBody; } });
 Object.defineProperty(exports, "isApiPath", { enumerable: true, get: function () { return core_util_1.isApiPath; } });
@@ -31,6 +34,8 @@ Object.defineProperty(exports, "assertPubSubConventions", { enumerable: true, ge
 Object.defineProperty(exports, "getQueueName", { enumerable: true, get: function () { return core_util_1.getQueueName; } });
 Object.defineProperty(exports, "AuthMeta", { enumerable: true, get: function () { return core_util_1.AuthMeta; } });
 Object.defineProperty(exports, "RouteMetadata", { enumerable: true, get: function () { return core_util_1.RouteMetadata; } });
+Object.defineProperty(exports, "RouteMetadataFactory", { enumerable: true, get: function () { return core_util_1.RouteMetadataFactory; } });
+Object.defineProperty(exports, "HttpContractMapper", { enumerable: true, get: function () { return core_util_1.HttpContractMapper; } });
 Object.defineProperty(exports, "METADATA_KEYS", { enumerable: true, get: function () { return core_util_1.METADATA_KEYS; } });
 // @DocumentDesign moved to core-util (design-root marker, browser + Node);
 // re-exported here for back-compat.

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/index.ts"],"names":[],"mappings":";;;;AAAA,0DAA0D;AAC1D,kDAkC8B;AAjC1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,yGAAA,YAAY,OAAA;AACZ,sGAAA,SAAS,OAAA;AACT,0GAAA,aAAa,OAAA;AACb,uGAAA,UAAU,OAAA;AACV,+GAAA,kBAAkB,OAAA;AAClB,0GAAA,aAAa,OAAA;AACb,4GAAA,eAAe,OAAA;AACf,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA;AACL,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AACZ,+GAAA,kBAAkB,OAAA;AAClB,uGAAA,UAAU,OAAA;AACV,sGAAA,SAAS,OAAA;AACT,sGAAA,SAAS,OAAA;AACT,wGAAA,WAAW,OAAA;AACX,wGAAA,WAAW,OAAA;AACX,2HAAA,8BAA8B,OAAA;AAC9B,uGAAA,UAAU,OAAA;AACV,0GAAA,aAAa,OAAA;AACb,oHAAA,uBAAuB,OAAA;AACvB,yGAAA,YAAY,OAAA;AACZ,qGAAA,QAAQ,OAAA;AACR,0GAAA,aAAa,OAAA;AACb,0GAAA,aAAa,OAAA;AAEb,2EAA2E;AAC3E,oCAAoC;AACpC,2GAAA,cAAc,OAAA;AACd,6GAAA,gBAAgB,OAAA;AAQpB,+CAA+C;AAC/C,2CAAiE;AAAxD,wGAAA,UAAU,OAAA;AAAE,mHAAA,qBAAqB,OAAA;AAE1C,iFAAiF;AACjF,wDAAwE;AAA/D,6HAAA,6BAA6B,OAAA;AACtC,gGAAgG;AAChG,wDAIiC;AAH7B,yHAAA,yBAAyB,OAAA;AACzB,sIAAA,sCAAsC,OAAA;AACtC,oHAAA,oBAAoB,OAAA;AAGxB,yDAAmE;AAA1D,sHAAA,iBAAiB,OAAA;AAE1B,qBAAqB;AACrB,2CAAuF;AAAxD,6GAAA,eAAe,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AAEhE,sFAAsF;AACtF,+FAA+F;AAC/F,wDAAkF;AAAzE,2GAAA,WAAW,OAAA;AAAkB,0GAAA,UAAU,OAAA;AAEhD,+FAA+F;AAC/F,gGAAgG;AAChG,gFAAgF;AAChF,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,wFAAwF;AACxF,0FAA0F;AAC1F,uDAAsD;AAA7C,4GAAA,YAAY,OAAA;AAErB,oFAAoF;AACpF,sFAAsF;AAEtF,kBAAkB;AAClB,iDAA4D;AAAnD,8GAAA,aAAa,OAAA;AAOtB,yCAAwD;AAA/C,sGAAA,SAAS,OAAA;AAElB,mFAAmF;AACnF,mEAAmE;AACnE,6FAA6F;AAC7F,qFAAqF;AACrF,4FAA4F;AAC5F,2CAMsB;AALlB,wGAAA,UAAU,OAAA;AACV,yGAAA,WAAW,OAAA;AACX,iHAAA,mBAAmB,OAAA;AACnB,sHAAA,wBAAwB,OAAA;AACxB,2GAAA,aAAa,OAAA;AAEjB,yCAUqB;AATjB,oGAAA,OAAO,OAAA;AACP,sGAAA,SAAS,OAAA;AACT,qGAAA,QAAQ,OAAA;AACR,qGAAA,QAAQ,OAAA;AACR,sGAAA,SAAS,OAAA;AACT,gHAAA,mBAAmB,OAAA;AACnB,kHAAA,qBAAqB,OAAA;AACrB,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AAEhB,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAC5B,0FAA0F;AAC1F,mDAAyE;AAAhE,gHAAA,cAAc,OAAA;AAAE,uHAAA,qBAAqB,OAAA;AAE9C,kEAAkE;AAElE,0FAA0F;AAC1F,qDAAoG;AAA3F,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAEhD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAAmE;AAA1D,4GAAA,YAAY,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAE1C,uBAAuB;AACvB,qDAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA","sourcesContent":["// Re-export API decorators from core-util for convenience\nexport {\n    ApiPath,\n    Endpoint,\n    WpAuthPublic,\n    WpAuthJwt,\n    rolesRequired,\n    WpAuthOidc,\n    WpAuthSharedSecret,\n    WpAuthWebhook,\n    WpAuthLocalOnly,\n    Rpc,\n    PubSub,\n    Queue,\n    getApiPath,\n    getEndpoints,\n    getEndpointOptions,\n    isFormPost,\n    isRawBody,\n    isApiPath,\n    getAuthMeta,\n    getAuthMode,\n    assertEveryEndpointHasAuthMode,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n    AuthMeta,\n    RouteMetadata,\n    METADATA_KEYS,\n    ValidateImplementation,\n    // @DocumentDesign moved to core-util (design-root marker, browser + Node);\n    // re-exported here for back-compat.\n    DocumentDesign,\n    isDocumentDesign,\n} from '@webpieces/core-util';\nexport type {\n    AuthMode,\n    ApiKind,\n    EndpointOptions,\n} from '@webpieces/core-util';\n\n// Server-side routing decorators and utilities\nexport { SourceFile, ROUTING_METADATA_KEYS } from './decorators';\n\n// DI provider decorators moved to core-context; re-exported here for back-compat\nexport { provideSingletonDefaultForApi } from '@webpieces/core-context';\n// Framework-only DI registry (packages/** framework classes use these; see frameworkProvide.ts)\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonDefaultForApi,\n    buildFrameworkModule,\n} from '@webpieces/core-context';\n\nexport { ApiRoutingFactory, ClassType } from './ApiRoutingFactory';\n\n// Core routing types\nexport { Routes, RouteBuilder, RouteDefinition, FilterDefinition } from './WebAppMeta';\n\n// The transport-neutral request type (defined in core-context; this is http-routing's\n// public request — a transport adapter builds one and the chain reads it from RequestContext).\nexport { HttpRequest, RawHttpRequest, RawRequest } from '@webpieces/core-context';\n\n// The INBOUND chain's response type. `Filter`, `Service` and `FilterChain` are NOT re-exported\n// here: they moved to @webpieces/core-util so the outbound client chain is the SAME abstraction\n// rather than a second spelling of it. Import them from '@webpieces/core-util'.\nexport { WpResponse } from './WpResponse';\nexport { MethodMeta } from './MethodMeta';\nexport { RouteHandler } from './RouteHandler';\n\n// LogApiFilter: the fixed OUTERMOST framework filter (auto-installed at 1,000,000 above\n// AuthFilter). Exported for reference/testing only — apps must NOT install it themselves.\nexport { LogApiFilter } from './filters/LogApiFilter';\n\n// RouteBuilderImpl (the route table + chain composer) is now INTERNAL — it is never\n// handed to upper layers. The express layer consumes ApiFactory.apiClients() instead.\n\n// Filter matching\nexport { FilterMatcher, HttpFilter } from './FilterMatcher';\n\n// The app's server-surface declaration: DI binding modules + route groups + headers.\nexport { AppModules, RouteModule } from './AppModules';\n\n// The public API-surface abstraction: declare routes/filters, get them back as ApiClient[].\nexport { ApiFactory } from './ApiFactory';\nexport { ApiClient, ApiClientProxy } from './ApiClient';\n\n// Auth: the app-provided, container-bound pieces the framework AuthFilter injects.\n//  - AuthConfig: shared-secret STATE (@WpAuthSharedSecret values).\n//  - JwtHook / OidcHook / WebhookAuthCallback / ApiKeyHook: OPTIONAL verification mechanisms\n//    (bind only what you use; unbound means the matching endpoints 401, never open).\n//  - DefaultOidcVerifier: the built-in Google OIDC verifier used when no OidcHook is bound.\nexport {\n    AuthConfig,\n    AUTH_CONFIG,\n    AuthenticatedCaller,\n    AUTHENTICATED_CALLER_KEY,\n    SharedSecrets,\n} from './AuthConfig';\nexport {\n    JwtHook,\n    MintedJwt,\n    JWT_HOOK,\n    OidcHook,\n    OIDC_HOOK,\n    WebhookAuthCallback,\n    WEBHOOK_AUTH_CALLBACK,\n    ApiKeyHook,\n    API_KEY_HOOK,\n} from './AuthHooks';\nexport { DefaultOidcVerifier } from './DefaultOidcVerifier';\n// DefaultJwtHook: batteries-included HS256 JwtHook — `new DefaultJwtHook(secret)` and go.\nexport { DefaultJwtHook, DefaultJwtMintRequest } from './DefaultJwtHook';\n\n// Above-boundary context setup shared by every transport adapter.\n\n// Node-only router (the express-free heart: container + filter chain + in-process client)\nexport { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';\n\n// The ONE transport-free startup sequence (headers → logging → router → routes) → ApiFactory.\n// Reusable by any company/app and any framework adapter; a company wraps it with its own headers.\nexport { setupRuntime, RuntimeSetupOptions } from './setupRuntime';\n\n// Server configuration\nexport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/index.ts"],"names":[],"mappings":";;;;AAAA,0DAA0D;AAC1D,kDAuC8B;AAtC1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,sGAAA,SAAS,OAAA;AACT,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AACZ,sGAAA,SAAS,OAAA;AACT,0GAAA,aAAa,OAAA;AACb,uGAAA,UAAU,OAAA;AACV,+GAAA,kBAAkB,OAAA;AAClB,0GAAA,aAAa,OAAA;AACb,4GAAA,eAAe,OAAA;AACf,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA;AACL,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AACZ,+GAAA,kBAAkB,OAAA;AAClB,yHAAA,4BAA4B,OAAA;AAC5B,uGAAA,UAAU,OAAA;AACV,sGAAA,SAAS,OAAA;AACT,sGAAA,SAAS,OAAA;AACT,wGAAA,WAAW,OAAA;AACX,wGAAA,WAAW,OAAA;AACX,2HAAA,8BAA8B,OAAA;AAC9B,uGAAA,UAAU,OAAA;AACV,0GAAA,aAAa,OAAA;AACb,oHAAA,uBAAuB,OAAA;AACvB,yGAAA,YAAY,OAAA;AACZ,qGAAA,QAAQ,OAAA;AACR,0GAAA,aAAa,OAAA;AACb,iHAAA,oBAAoB,OAAA;AACpB,+GAAA,kBAAkB,OAAA;AAClB,0GAAA,aAAa,OAAA;AAEb,2EAA2E;AAC3E,oCAAoC;AACpC,2GAAA,cAAc,OAAA;AACd,6GAAA,gBAAgB,OAAA;AAUpB,+CAA+C;AAC/C,2CAAiE;AAAxD,wGAAA,UAAU,OAAA;AAAE,mHAAA,qBAAqB,OAAA;AAE1C,iFAAiF;AACjF,wDAAwE;AAA/D,6HAAA,6BAA6B,OAAA;AACtC,gGAAgG;AAChG,wDAIiC;AAH7B,yHAAA,yBAAyB,OAAA;AACzB,sIAAA,sCAAsC,OAAA;AACtC,oHAAA,oBAAoB,OAAA;AAGxB,yDAAmE;AAA1D,sHAAA,iBAAiB,OAAA;AAE1B,qBAAqB;AACrB,2CAAuF;AAAxD,6GAAA,eAAe,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AAEhE,sFAAsF;AACtF,+FAA+F;AAC/F,wDAAkF;AAAzE,2GAAA,WAAW,OAAA;AAAkB,0GAAA,UAAU,OAAA;AAEhD,+FAA+F;AAC/F,gGAAgG;AAChG,gFAAgF;AAChF,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,wFAAwF;AACxF,0FAA0F;AAC1F,uDAAsD;AAA7C,4GAAA,YAAY,OAAA;AAErB,oFAAoF;AACpF,sFAAsF;AAEtF,kBAAkB;AAClB,iDAA4D;AAAnD,8GAAA,aAAa,OAAA;AAOtB,yCAAwD;AAA/C,sGAAA,SAAS,OAAA;AAElB,mFAAmF;AACnF,mEAAmE;AACnE,6FAA6F;AAC7F,qFAAqF;AACrF,4FAA4F;AAC5F,2CAMsB;AALlB,wGAAA,UAAU,OAAA;AACV,yGAAA,WAAW,OAAA;AACX,iHAAA,mBAAmB,OAAA;AACnB,sHAAA,wBAAwB,OAAA;AACxB,2GAAA,aAAa,OAAA;AAEjB,yCAUqB;AATjB,oGAAA,OAAO,OAAA;AACP,sGAAA,SAAS,OAAA;AACT,qGAAA,QAAQ,OAAA;AACR,qGAAA,QAAQ,OAAA;AACR,sGAAA,SAAS,OAAA;AACT,gHAAA,mBAAmB,OAAA;AACnB,kHAAA,qBAAqB,OAAA;AACrB,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AAEhB,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAC5B,0FAA0F;AAC1F,mDAAyE;AAAhE,gHAAA,cAAc,OAAA;AAAE,uHAAA,qBAAqB,OAAA;AAE9C,kEAAkE;AAElE,0FAA0F;AAC1F,qDAAoG;AAA3F,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAEhD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAAmE;AAA1D,4GAAA,YAAY,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAE1C,uBAAuB;AACvB,qDAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA","sourcesContent":["// Re-export API decorators from core-util for convenience\nexport {\n    ApiPath,\n    Endpoint,\n    PathParam,\n    QueryParam,\n    WpAuthPublic,\n    WpAuthJwt,\n    rolesRequired,\n    WpAuthOidc,\n    WpAuthSharedSecret,\n    WpAuthWebhook,\n    WpAuthLocalOnly,\n    Rpc,\n    PubSub,\n    Queue,\n    getApiPath,\n    getEndpoints,\n    getEndpointOptions,\n    getHttpParameterDeclarations,\n    isFormPost,\n    isRawBody,\n    isApiPath,\n    getAuthMeta,\n    getAuthMode,\n    assertEveryEndpointHasAuthMode,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n    AuthMeta,\n    RouteMetadata,\n    RouteMetadataFactory,\n    HttpContractMapper,\n    METADATA_KEYS,\n    ValidateImplementation,\n    // @DocumentDesign moved to core-util (design-root marker, browser + Node);\n    // re-exported here for back-compat.\n    DocumentDesign,\n    isDocumentDesign,\n} from '@webpieces/core-util';\nexport type {\n    AuthMode,\n    ApiKind,\n    EndpointOptions,\n    ContractHttpMethod,\n    EndpointResponseType,\n} from '@webpieces/core-util';\n\n// Server-side routing decorators and utilities\nexport { SourceFile, ROUTING_METADATA_KEYS } from './decorators';\n\n// DI provider decorators moved to core-context; re-exported here for back-compat\nexport { provideSingletonDefaultForApi } from '@webpieces/core-context';\n// Framework-only DI registry (packages/** framework classes use these; see frameworkProvide.ts)\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonDefaultForApi,\n    buildFrameworkModule,\n} from '@webpieces/core-context';\n\nexport { ApiRoutingFactory, ClassType } from './ApiRoutingFactory';\n\n// Core routing types\nexport { Routes, RouteBuilder, RouteDefinition, FilterDefinition } from './WebAppMeta';\n\n// The transport-neutral request type (defined in core-context; this is http-routing's\n// public request — a transport adapter builds one and the chain reads it from RequestContext).\nexport { HttpRequest, RawHttpRequest, RawRequest } from '@webpieces/core-context';\n\n// The INBOUND chain's response type. `Filter`, `Service` and `FilterChain` are NOT re-exported\n// here: they moved to @webpieces/core-util so the outbound client chain is the SAME abstraction\n// rather than a second spelling of it. Import them from '@webpieces/core-util'.\nexport { WpResponse } from './WpResponse';\nexport { MethodMeta } from './MethodMeta';\nexport { RouteHandler } from './RouteHandler';\n\n// LogApiFilter: the fixed OUTERMOST framework filter (auto-installed at 1,000,000 above\n// AuthFilter). Exported for reference/testing only — apps must NOT install it themselves.\nexport { LogApiFilter } from './filters/LogApiFilter';\n\n// RouteBuilderImpl (the route table + chain composer) is now INTERNAL — it is never\n// handed to upper layers. The express layer consumes ApiFactory.apiClients() instead.\n\n// Filter matching\nexport { FilterMatcher, HttpFilter } from './FilterMatcher';\n\n// The app's server-surface declaration: DI binding modules + route groups + headers.\nexport { AppModules, RouteModule } from './AppModules';\n\n// The public API-surface abstraction: declare routes/filters, get them back as ApiClient[].\nexport { ApiFactory } from './ApiFactory';\nexport { ApiClient, ApiClientProxy } from './ApiClient';\n\n// Auth: the app-provided, container-bound pieces the framework AuthFilter injects.\n//  - AuthConfig: shared-secret STATE (@WpAuthSharedSecret values).\n//  - JwtHook / OidcHook / WebhookAuthCallback / ApiKeyHook: OPTIONAL verification mechanisms\n//    (bind only what you use; unbound means the matching endpoints 401, never open).\n//  - DefaultOidcVerifier: the built-in Google OIDC verifier used when no OidcHook is bound.\nexport {\n    AuthConfig,\n    AUTH_CONFIG,\n    AuthenticatedCaller,\n    AUTHENTICATED_CALLER_KEY,\n    SharedSecrets,\n} from './AuthConfig';\nexport {\n    JwtHook,\n    MintedJwt,\n    JWT_HOOK,\n    OidcHook,\n    OIDC_HOOK,\n    WebhookAuthCallback,\n    WEBHOOK_AUTH_CALLBACK,\n    ApiKeyHook,\n    API_KEY_HOOK,\n} from './AuthHooks';\nexport { DefaultOidcVerifier } from './DefaultOidcVerifier';\n// DefaultJwtHook: batteries-included HS256 JwtHook — `new DefaultJwtHook(secret)` and go.\nexport { DefaultJwtHook, DefaultJwtMintRequest } from './DefaultJwtHook';\n\n// Above-boundary context setup shared by every transport adapter.\n\n// Node-only router (the express-free heart: container + filter chain + in-process client)\nexport { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';\n\n// The ONE transport-free startup sequence (headers → logging → router → routes) → ApiFactory.\n// Reusable by any company/app and any framework adapter; a company wraps it with its own headers.\nexport { setupRuntime, RuntimeSetupOptions } from './setupRuntime';\n\n// Server configuration\nexport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\n"]}