@webpieces/http-routing 0.4.987 → 0.4.989

package/src/RuntimeStartupTiming.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuntimeStartupTiming = exports.RuntimeStartupOperation = exports.RuntimeStartupPhase = void 0;
+const core_util_1 = require("@webpieces/core-util");
+/** Startup operations; durations are inclusive, so nested operations must not be added together. */
+var RuntimeStartupPhase;
+(function (RuntimeStartupPhase) {
+    RuntimeStartupPhase["HEADERS"] = "headers";
+    RuntimeStartupPhase["LOGGING"] = "logging";
+    RuntimeStartupPhase["WIRING"] = "wiring";
+    RuntimeStartupPhase["CONTAINER"] = "container";
+    RuntimeStartupPhase["FRAMEWORK_DI"] = "framework-di";
+    RuntimeStartupPhase["APPLICATION_DI"] = "application-di";
+    RuntimeStartupPhase["BIND_MODULE"] = "binding-module";
+    RuntimeStartupPhase["FIXED_FILTERS"] = "fixed-filters";
+    RuntimeStartupPhase["FILTER"] = "filter-resolution";
+    RuntimeStartupPhase["ROUTE_MODULE"] = "route-module";
+    RuntimeStartupPhase["ROUTES"] = "route-registration";
+    RuntimeStartupPhase["CONTROLLER"] = "controller-resolution";
+})(RuntimeStartupPhase || (exports.RuntimeStartupPhase = RuntimeStartupPhase = {}));
+/** Code identity only: never configuration, credentials, request data or exception payloads. */
+class RuntimeStartupOperation {
+    phase;
+    name;
+    constructor(phase, name) {
+        this.phase = phase;
+        this.name = name;
+    }
+}
+exports.RuntimeStartupOperation = RuntimeStartupOperation;
+/** Internal operation boundary. With no observer it creates no timing records and reads no clock. */
+class RuntimeStartupTiming {
+    observer;
+    disabled = false;
+    constructor(observer) {
+        this.observer = observer;
+    }
+    run(phase, name, operation) {
+        const span = this.begin(phase, name);
+        let succeeded = false;
+        // webpieces-disable no-unmanaged-exceptions -- finally only closes diagnostics; the original application error propagates unchanged
+        try {
+            const result = operation();
+            succeeded = true;
+            return result;
+        }
+        finally {
+            this.finish(span, succeeded);
+        }
+    }
+    async runAsync(phase, name, operation) {
+        const span = this.begin(phase, name);
+        let succeeded = false;
+        // webpieces-disable no-unmanaged-exceptions -- finally only closes diagnostics; the original application error propagates unchanged
+        try {
+            const result = await operation();
+            succeeded = true;
+            return result;
+        }
+        finally {
+            this.finish(span, succeeded);
+        }
+    }
+    begin(phase, name) {
+        if (!this.observer || this.disabled)
+            return undefined;
+        // webpieces-disable no-unmanaged-exceptions -- an optional observer must not replace startup's result/error; disable it with a bounded bootstrap diagnostic
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- diagnostic callback boundary preserves the application result and original error
+        try {
+            return this.observer.start(new RuntimeStartupOperation(phase, name));
+        }
+        catch (err) {
+            const error = (0, core_util_1.toError)(err);
+            this.disabled = true;
+            // Headers/logging may not exist yet; use one bootstrap diagnostic for this boundary.
+            console.warn('[startup] timing observer disabled after failure', error);
+            return undefined;
+        }
+    }
+    finish(span, succeeded) {
+        if (!span || this.disabled)
+            return;
+        // webpieces-disable no-unmanaged-exceptions -- preserve the application's original exception even if diagnostic output fails
+        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- diagnostic callback failure must not replace the original startup exception
+        try {
+            if (succeeded)
+                span.success();
+            else
+                span.failure();
+        }
+        catch (err) {
+            const error = (0, core_util_1.toError)(err);
+            this.disabled = true;
+            // Headers/logging may not exist yet; use one bootstrap diagnostic for this boundary.
+            console.warn('[startup] timing observer disabled after failure', error);
+        }
+    }
+}
+exports.RuntimeStartupTiming = RuntimeStartupTiming;
+//# sourceMappingURL=RuntimeStartupTiming.js.map

package/src/RuntimeStartupTiming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RuntimeStartupTiming.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/RuntimeStartupTiming.ts"],"names":[],"mappings":";;;AAAA,oDAA+C;AAE/C,oGAAoG;AACpG,IAAY,mBAaX;AAbD,WAAY,mBAAmB;IAC3B,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,wCAAiB,CAAA;IACjB,8CAAuB,CAAA;IACvB,oDAA6B,CAAA;IAC7B,wDAAiC,CAAA;IACjC,qDAA8B,CAAA;IAC9B,sDAA+B,CAAA;IAC/B,mDAA4B,CAAA;IAC5B,oDAA6B,CAAA;IAC7B,oDAA6B,CAAA;IAC7B,2DAAoC,CAAA;AACxC,CAAC,EAbW,mBAAmB,mCAAnB,mBAAmB,QAa9B;AAED,gGAAgG;AAChG,MAAa,uBAAuB;IAEZ;IACA;IAFpB,YACoB,KAA0B,EAC1B,IAAY;QADZ,UAAK,GAAL,KAAK,CAAqB;QAC1B,SAAI,GAAJ,IAAI,CAAQ;IAC7B,CAAC;CACP;AALD,0DAKC;AAiBD,qGAAqG;AACrG,MAAa,oBAAoB;IAGA;IAFrB,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAA6B,QAAiC;QAAjC,aAAQ,GAAR,QAAQ,CAAyB;IAAG,CAAC;IAElE,GAAG,CAAI,KAA0B,EAAE,IAAY,EAAE,SAAkB;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,oIAAoI;QACpI,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,MAAM,CAAC;QAClB,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CACV,KAA0B,EAC1B,IAAY,EACZ,SAA+B;QAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACrC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,oIAAoI;QACpI,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,MAAM,CAAC;QAClB,CAAC;gBAAS,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAA0B,EAAE,IAAY;QAClD,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACtD,4JAA4J;QAC5J,kJAAkJ;QAClJ,IAAI,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,uBAAuB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,qFAAqF;YACrF,OAAO,CAAC,IAAI,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;YACxE,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,IAAoC,EAAE,SAAkB;QACnE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QACnC,6HAA6H;QAC7H,6IAA6I;QAC7I,IAAI,CAAC;YACD,IAAI,SAAS;gBAAE,IAAI,CAAC,OAAO,EAAE,CAAC;;gBACzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,qFAAqF;YACrF,OAAO,CAAC,IAAI,CAAC,kDAAkD,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;CACJ;AAhED,oDAgEC","sourcesContent":["import { toError } from '@webpieces/core-util';\n\n/** Startup operations; durations are inclusive, so nested operations must not be added together. */\nexport enum RuntimeStartupPhase {\n    HEADERS = 'headers',\n    LOGGING = 'logging',\n    WIRING = 'wiring',\n    CONTAINER = 'container',\n    FRAMEWORK_DI = 'framework-di',\n    APPLICATION_DI = 'application-di',\n    BIND_MODULE = 'binding-module',\n    FIXED_FILTERS = 'fixed-filters',\n    FILTER = 'filter-resolution',\n    ROUTE_MODULE = 'route-module',\n    ROUTES = 'route-registration',\n    CONTROLLER = 'controller-resolution',\n}\n\n/** Code identity only: never configuration, credentials, request data or exception payloads. */\nexport class RuntimeStartupOperation {\n    constructor(\n        public readonly phase: RuntimeStartupPhase,\n        public readonly name: string,\n    ) {}\n}\n\n/** The host owns the monotonic clock/output and closes each started span exactly once. */\nexport interface RuntimeStartupSpan {\n    success(): void;\n    failure(): void;\n}\n\n/**\n * Optional startup-only diagnostics. Start/finish use the host's clock, so timing requires no SDK.\n * A controller-resolution event measures container.get, including dependencies and singleton reuse;\n * it does not assert that a new controller was constructed. Normal API calls emit no events.\n */\nexport interface RuntimeStartupObserver {\n    start(operation: RuntimeStartupOperation): RuntimeStartupSpan;\n}\n\n/** Internal operation boundary. With no observer it creates no timing records and reads no clock. */\nexport class RuntimeStartupTiming {\n    private disabled = false;\n\n    constructor(private readonly observer?: RuntimeStartupObserver) {}\n\n    run<T>(phase: RuntimeStartupPhase, name: string, operation: () => T): T {\n        const span = this.begin(phase, name);\n        let succeeded = false;\n        // webpieces-disable no-unmanaged-exceptions -- finally only closes diagnostics; the original application error propagates unchanged\n        try {\n            const result = operation();\n            succeeded = true;\n            return result;\n        } finally {\n            this.finish(span, succeeded);\n        }\n    }\n\n    async runAsync<T>(\n        phase: RuntimeStartupPhase,\n        name: string,\n        operation: () => T | Promise<T>,\n    ): Promise<T> {\n        const span = this.begin(phase, name);\n        let succeeded = false;\n        // webpieces-disable no-unmanaged-exceptions -- finally only closes diagnostics; the original application error propagates unchanged\n        try {\n            const result = await operation();\n            succeeded = true;\n            return result;\n        } finally {\n            this.finish(span, succeeded);\n        }\n    }\n\n    private begin(phase: RuntimeStartupPhase, name: string): RuntimeStartupSpan | undefined {\n        if (!this.observer || this.disabled) return undefined;\n        // webpieces-disable no-unmanaged-exceptions -- an optional observer must not replace startup's result/error; disable it with a bounded bootstrap diagnostic\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- diagnostic callback boundary preserves the application result and original error\n        try {\n            return this.observer.start(new RuntimeStartupOperation(phase, name));\n        } catch (err: unknown) {\n            const error = toError(err);\n            this.disabled = true;\n            // Headers/logging may not exist yet; use one bootstrap diagnostic for this boundary.\n            console.warn('[startup] timing observer disabled after failure', error);\n            return undefined;\n        }\n    }\n\n    private finish(span: RuntimeStartupSpan | undefined, succeeded: boolean): void {\n        if (!span || this.disabled) return;\n        // webpieces-disable no-unmanaged-exceptions -- preserve the application's original exception even if diagnostic output fails\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- diagnostic callback failure must not replace the original startup exception\n        try {\n            if (succeeded) span.success();\n            else span.failure();\n        } catch (err: unknown) {\n            const error = toError(err);\n            this.disabled = true;\n            // Headers/logging may not exist yet; use one bootstrap diagnostic for this boundary.\n            console.warn('[startup] timing observer disabled after failure', error);\n        }\n    }\n}\n"]}

package/src/WebAppMeta.d.ts

@@ -1,4 +1,6 @@
-import { RouteMetadata } from "@webpieces/core-util";
+import type { ClassType } from './ClassType';
+import type { LazyController } from './LazyController';
+import { RouteMetadata } from '@webpieces/core-util';
 /**
  * Represents a route configuration that can be registered with the router.
  * Similar to Java WebPieces Routes interface.
@@ -25,10 +27,10 @@ export interface RouteBuilder {
  */
 export declare class RouteDefinition {
     routeMeta: RouteMetadata;
-    controllerClass: any;
+    implementation: ClassType<object> | LazyController<object>;
     controllerFilepath?: string | undefined;
-    apiClass?: unknown | undefined;
-    constructor(routeMeta: RouteMetadata, controllerClass: any, controllerFilepath?: string | undefined, apiClass?: unknown | undefined);
+    apiClass?: ClassType<object> | undefined;
+    constructor(routeMeta: RouteMetadata, implementation: ClassType<object> | LazyController<object>, controllerFilepath?: string | undefined, apiClass?: ClassType<object> | undefined);
 }
 /**
  * Definition of a filter with priority.

package/src/WebAppMeta.js

@@ -9,16 +9,14 @@ exports.FilterDefinition = exports.RouteDefinition = void 0;
  */
 class RouteDefinition {
     routeMeta;
-    controllerClass;
+    implementation;
     controllerFilepath;
     apiClass;
-    constructor(routeMeta, 
-    // webpieces-disable no-any-unknown -- arbitrary DI controller class used as a container token
-    controllerClass, controllerFilepath, 
+    constructor(routeMeta, implementation, controllerFilepath, 
     // The @ApiPath prototype this route belongs to; surfaced on ApiFactory.apiClients().
     apiClass) {
         this.routeMeta = routeMeta;
-        this.controllerClass = controllerClass;
+        this.implementation = implementation;
         this.controllerFilepath = controllerFilepath;
         this.apiClass = apiClass;
     }

package/src/WebAppMeta.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebAppMeta.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/WebAppMeta.ts"],"names":[],"mappings":";;;AAsBA;;;;;GAKG;AACH,MAAa,eAAe;IAEb;IAEA;IACA;IAEA;IANX,YACW,SAAwB;IAC/B,8FAA8F;IACvF,eAAoB,EACpB,kBAA2B;IAClC,qFAAqF;IAC9E,QAAkB;QALlB,cAAS,GAAT,SAAS,CAAe;QAExB,oBAAe,GAAf,eAAe,CAAK;QACpB,uBAAkB,GAAlB,kBAAkB,CAAS;QAE3B,aAAQ,GAAR,QAAQ,CAAU;IAC1B,CAAC;CACP;AATD,0CASC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAa,gBAAgB;IACzB,QAAQ,CAAS;IACjB,6FAA6F;IAC7F,WAAW,CAAM;IACjB,uFAAuF;IACvF,MAAM,CAAO,CAAC,+DAA+D;IAE7E;;;OAGG;IACH,eAAe,CAAS;IAExB,8FAA8F;IAC9F,YAAY,QAAgB,EAAE,WAAgB,EAAE,eAAuB;QACnE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,4BAA4B;IACzD,CAAC;CACJ;AApBD,4CAoBC;AAGD,0FAA0F;AAC1F,2FAA2F;AAC3F,uGAAuG","sourcesContent":["import {RouteMetadata} from \"@webpieces/core-util\";\n\n/**\n * Represents a route configuration that can be registered with the router.\n * Similar to Java WebPieces Routes interface.\n */\nexport interface Routes {\n    /**\n     * Configure routes using the provided RouteBuilder.\n     */\n    configure(routeBuilder: RouteBuilder): void;\n}\n\n/**\n * Builder for registering routes.\n * Will be implemented in http-server package.\n */\nexport interface RouteBuilder {\n    addRoute(route: RouteDefinition): void;\n    addFilter(filter: FilterDefinition): void;\n}\n\n/**\n * Definition of a single route.\n *\n * Generic type parameter TResult represents the return type of the route handler.\n * This provides type safety for the entire request/response cycle.\n */\nexport class RouteDefinition {\n    constructor(\n        public routeMeta: RouteMetadata,\n        // webpieces-disable no-any-unknown -- arbitrary DI controller class used as a container token\n        public controllerClass: any,\n        public controllerFilepath?: string,\n        // The @ApiPath prototype this route belongs to; surfaced on ApiFactory.apiClients().\n        public apiClass?: unknown,\n    ) {}\n}\n\n/**\n * Definition of a filter with priority.\n *\n * Use filepathPattern to scope filters to specific controllers:\n *   - 'src/controllers/admin/**' + '/*.ts' - All admin controllers\n *   - '**' + '/admin/**' - Any file in admin directories\n *   - '**' + '/UserController.ts' - Specific controller file\n *\n * If filepathPattern is not specified, the filter matches all controllers.\n *\n * Every filter runs for BOTH real HTTP requests AND the in-process createApiClient — there is\n * no transport tier. Transport-boundary auth is a fixed framework filter (AuthFilter) that\n * reads the transport-neutral HttpRequest, so it runs identically in both.\n */\nexport class FilterDefinition {\n    priority: number;\n    // webpieces-disable no-any-unknown -- an arbitrary DI filter class used as a container token\n    filterClass: any;\n    // webpieces-disable no-any-unknown -- the resolved filter instance, of arbitrary shape\n    filter?: any; // Filter instance (set by RouteBuilder when resolving from DI)\n\n    /**\n     * Glob pattern to match controller file paths.\n     * If not specified, defaults to matching all controllers.\n     */\n    filepathPattern: string;\n\n    // webpieces-disable no-any-unknown -- filterClass param is an arbitrary DI filter class token\n    constructor(priority: number, filterClass: any, filepathPattern: string) {\n        this.priority = priority;\n        this.filterClass = filterClass;\n        this.filepathPattern = filepathPattern;\n        this.filter = undefined; // Set later by RouteBuilder\n    }\n}\n\n\n// The old WebAppMeta interface + WEBAPP_META_TOKEN were removed with the WebpiecesServer/\n// WebpiecesFactory flip. Apps now configure routes/filters imperatively on WebpiecesRouter\n// (see WebpiecesRouter.addRoutes/addFilter) instead of implementing WebAppMeta.getDIModules/getRoutes.\n"]}
+{"version":3,"file":"WebAppMeta.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/WebAppMeta.ts"],"names":[],"mappings":";;;AAwBA;;;;;GAKG;AACH,MAAa,eAAe;IAEb;IACA;IACA;IAEA;IALX,YACW,SAAwB,EACxB,cAA0D,EAC1D,kBAA2B;IAClC,qFAAqF;IAC9E,QAA4B;QAJ5B,cAAS,GAAT,SAAS,CAAe;QACxB,mBAAc,GAAd,cAAc,CAA4C;QAC1D,uBAAkB,GAAlB,kBAAkB,CAAS;QAE3B,aAAQ,GAAR,QAAQ,CAAoB;IACpC,CAAC;CACP;AARD,0CAQC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAa,gBAAgB;IACzB,QAAQ,CAAS;IACjB,6FAA6F;IAC7F,WAAW,CAAM;IACjB,uFAAuF;IACvF,MAAM,CAAO,CAAC,+DAA+D;IAE7E;;;OAGG;IACH,eAAe,CAAS;IAExB,8FAA8F;IAC9F,YAAY,QAAgB,EAAE,WAAgB,EAAE,eAAuB;QACnE,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,4BAA4B;IACzD,CAAC;CACJ;AApBD,4CAoBC;AAED,0FAA0F;AAC1F,2FAA2F;AAC3F,uGAAuG","sourcesContent":["import type { ClassType } from './ClassType';\nimport type { LazyController } from './LazyController';\nimport { RouteMetadata } from '@webpieces/core-util';\n\n/**\n * Represents a route configuration that can be registered with the router.\n * Similar to Java WebPieces Routes interface.\n */\nexport interface Routes {\n    /**\n     * Configure routes using the provided RouteBuilder.\n     */\n    configure(routeBuilder: RouteBuilder): void;\n}\n\n/**\n * Builder for registering routes.\n * Will be implemented in http-server package.\n */\nexport interface RouteBuilder {\n    addRoute(route: RouteDefinition): void;\n    addFilter(filter: FilterDefinition): void;\n}\n\n/**\n * Definition of a single route.\n *\n * Generic type parameter TResult represents the return type of the route handler.\n * This provides type safety for the entire request/response cycle.\n */\nexport class RouteDefinition {\n    constructor(\n        public routeMeta: RouteMetadata,\n        public implementation: ClassType<object> | LazyController<object>,\n        public controllerFilepath?: string,\n        // The @ApiPath prototype this route belongs to; surfaced on ApiFactory.apiClients().\n        public apiClass?: ClassType<object>,\n    ) {}\n}\n\n/**\n * Definition of a filter with priority.\n *\n * Use filepathPattern to scope filters to specific controllers:\n *   - 'src/controllers/admin/**' + '/*.ts' - All admin controllers\n *   - '**' + '/admin/**' - Any file in admin directories\n *   - '**' + '/UserController.ts' - Specific controller file\n *\n * If filepathPattern is not specified, the filter matches all controllers.\n *\n * Every filter runs for BOTH real HTTP requests AND the in-process createApiClient — there is\n * no transport tier. Transport-boundary auth is a fixed framework filter (AuthFilter) that\n * reads the transport-neutral HttpRequest, so it runs identically in both.\n */\nexport class FilterDefinition {\n    priority: number;\n    // webpieces-disable no-any-unknown -- an arbitrary DI filter class used as a container token\n    filterClass: any;\n    // webpieces-disable no-any-unknown -- the resolved filter instance, of arbitrary shape\n    filter?: any; // Filter instance (set by RouteBuilder when resolving from DI)\n\n    /**\n     * Glob pattern to match controller file paths.\n     * If not specified, defaults to matching all controllers.\n     */\n    filepathPattern: string;\n\n    // webpieces-disable no-any-unknown -- filterClass param is an arbitrary DI filter class token\n    constructor(priority: number, filterClass: any, filepathPattern: string) {\n        this.priority = priority;\n        this.filterClass = filterClass;\n        this.filepathPattern = filepathPattern;\n        this.filter = undefined; // Set later by RouteBuilder\n    }\n}\n\n// The old WebAppMeta interface + WEBAPP_META_TOKEN were removed with the WebpiecesServer/\n// WebpiecesFactory flip. Apps now configure routes/filters imperatively on WebpiecesRouter\n// (see WebpiecesRouter.addRoutes/addFilter) instead of implementing WebAppMeta.getDIModules/getRoutes.\n"]}

package/src/WebpiecesRouter.d.ts

@@ -1,13 +1,15 @@
+import { LazyController } from './LazyController';
 import { AuthorizationService } from './AuthorizationHook';
 import { InvocationAuthentication } from './InvocationAuthentication';
 import { Container, ContainerModule } from 'inversify';
 import { RouteBuilderImpl } from './RouteBuilderImpl';
-import { ClassType } from './ApiRoutingFactory';
+import type { ClassType } from './ClassType';
 import { FilterDefinition } from './WebAppMeta';
 import { WebpiecesConfig } from './WebpiecesConfig';
 import { ApiClientFactory } from './ApiClientFactory';
 import { ApiFactory } from './ApiFactory';
 import { ApiClient } from './ApiClient';
+import { RuntimeStartupObserver } from './RuntimeStartupTiming';
 /**
  * Options for {@link WebpiecesRouterFactory.create} — one object (config lives inside it).
  *
@@ -21,6 +23,8 @@ export interface WebpiecesRouterOptions {
     appBindings: ContainerModule[];
     appOverrides?: ContainerModule;
     config?: WebpiecesConfig;
+    /** Optional startup spans; no observer means no clock or timing-output work. */
+    startupObserver?: RuntimeStartupObserver;
 }
 /**
  * WebpiecesRouter - the node-only heart of a webpieces app: a DI container + a filter
@@ -58,6 +62,7 @@ export declare class WebpiecesRouter implements ApiFactory {
     private readonly apiClientFactory;
     private webpiecesContainer;
     private appContainer;
+    private startupTiming;
     constructor(routeBuilder: RouteBuilderImpl, apiClientFactory: ApiClientFactory);
     /**
      * Build the app container (child of the framework container), load the @provideSingleton
@@ -77,9 +82,10 @@ export declare class WebpiecesRouter implements ApiFactory {
     private loadDIModules;
     /**
      * Wire an API prototype (with @ApiPath/@Endpoint decorators) to its controller.
-     * The controller is resolved from the container at request time.
+     * A class resolves eagerly. A LazyController retains metadata now and imports its implementation
+     * only after the ordinary filter chain permits an invocation.
      */
-    addRoutes<TApi, TController extends TApi>(api: ClassType<TApi>, controller: ClassType<TController>): this;
+    addRoutes<TApi extends object, TController extends TApi>(api: ClassType<TApi>, controller: ClassType<TController> | LazyController<TController>): this;
     /**
      * Register a user filter (runs in-process AND over HTTP, below the auto-installed fixed
      * LogApiFilter + AuthFilter).
@@ -99,6 +105,11 @@ export declare class WebpiecesRouter implements ApiFactory {
      */
     apiClients(): ApiClient[];
     authorizationService(): AuthorizationService;
+    /**
+     * Warm and validate every optional implementation in a SEPARATE build/integration process with
+     * fake external providers. Never invoke this in the production entry point or from a request.
+     */
+    validateLazyRoutesForBuild(): Promise<void>;
     /** The application DI container (child of the framework container). */
     getContainer(): Container;
 }

package/src/WebpiecesRouter.js

@@ -15,6 +15,7 @@ const ApiClientFactory_1 = require("./ApiClientFactory");
 const LogApiFilter_1 = require("./filters/LogApiFilter");
 const AuthFilter_1 = require("./filters/AuthFilter");
 const AuthorizationFilter_1 = require("./filters/AuthorizationFilter");
+const RuntimeStartupTiming_1 = require("./RuntimeStartupTiming");
 /**
  * WebpiecesRouter - the node-only heart of a webpieces app: a DI container + a filter
  * chain + an in-process API client. It has NO express dependency, so it runs anywhere
@@ -51,6 +52,7 @@ let WebpiecesRouter = class WebpiecesRouter {
     apiClientFactory;
     webpiecesContainer;
     appContainer;
+    startupTiming = new RuntimeStartupTiming_1.RuntimeStartupTiming();
     constructor(routeBuilder, apiClientFactory) {
         this.routeBuilder = routeBuilder;
         this.apiClientFactory = apiClientFactory;
@@ -62,6 +64,8 @@ let WebpiecesRouter = class WebpiecesRouter {
      */
     async initialize(webpiecesContainer, options) {
         this.webpiecesContainer = webpiecesContainer;
+        this.startupTiming = new RuntimeStartupTiming_1.RuntimeStartupTiming(options.startupObserver);
+        this.routeBuilder.setStartupObserver(options.startupObserver);
         // App container is a child so app bindings see framework bindings while staying separate.
         // autobind:true lets a concrete @injectable(Singleton) app class self-bind on first resolve
         // (inject-by-type, no @provideSingleton). Framework singletons stay explicit in the parent
@@ -69,7 +73,7 @@ let WebpiecesRouter = class WebpiecesRouter {
         this.appContainer = new inversify_1.Container({ parent: webpiecesContainer, autobind: true });
         this.routeBuilder.setContainer(this.appContainer);
         await this.loadDIModules(options);
-        this.installFixedFilters();
+        this.startupTiming.run(RuntimeStartupTiming_1.RuntimeStartupPhase.FIXED_FILTERS, 'fixed-filters', () => this.installFixedFilters());
     }
     /**
      * Auto-install the two fixed framework filters on every route (apps add only their own
@@ -88,24 +92,26 @@ let WebpiecesRouter = class WebpiecesRouter {
         // Load BOTH registries: framework classes (provideFrameworkSingleton) + the client's
         // own @provideSingleton classes (binding-decorators global). A client's
         // buildProviderModule() only ever contains the client's classes — never framework internals.
-        await this.appContainer.load((0, core_context_1.buildFrameworkModule)());
-        await this.appContainer.load((0, binding_decorators_1.buildProviderModule)());
+        await this.startupTiming.runAsync(RuntimeStartupTiming_1.RuntimeStartupPhase.FRAMEWORK_DI, 'application-framework-bindings', () => this.appContainer.load((0, core_context_1.buildFrameworkModule)()));
+        await this.startupTiming.runAsync(RuntimeStartupTiming_1.RuntimeStartupPhase.APPLICATION_DI, 'provider-bindings', () => this.appContainer.load((0, binding_decorators_1.buildProviderModule)()));
         // Load all app modules into application container
         // (webpiecesContainer is currently empty, reserved for future framework bindings)
-        for (const module of options.appBindings) {
-            await this.appContainer.load(module);
+        for (const [index, module] of options.appBindings.entries()) {
+            await this.startupTiming.runAsync(RuntimeStartupTiming_1.RuntimeStartupPhase.APPLICATION_DI, `app-binding-${index}`, () => this.appContainer.load(module));
         }
         // Load appOverrides LAST so they can override existing bindings
         if (options.appOverrides) {
-            await this.appContainer.load(options.appOverrides);
+            const overrides = options.appOverrides;
+            await this.startupTiming.runAsync(RuntimeStartupTiming_1.RuntimeStartupPhase.APPLICATION_DI, 'app-overrides', () => this.appContainer.load(overrides));
         }
     }
     /**
      * Wire an API prototype (with @ApiPath/@Endpoint decorators) to its controller.
-     * The controller is resolved from the container at request time.
+     * A class resolves eagerly. A LazyController retains metadata now and imports its implementation
+     * only after the ordinary filter chain permits an invocation.
      */
     addRoutes(api, controller) {
-        new ApiRoutingFactory_1.ApiRoutingFactory(api, controller).configure(this.routeBuilder);
+        this.startupTiming.run(RuntimeStartupTiming_1.RuntimeStartupPhase.ROUTES, `${api.name}:${controller.name}`, () => new ApiRoutingFactory_1.ApiRoutingFactory(api, controller).configure(this.routeBuilder));
         return this;
     }
     /**
@@ -140,6 +146,15 @@ let WebpiecesRouter = class WebpiecesRouter {
     authorizationService() {
         return this.appContainer.get(AuthorizationHook_1.AuthorizationService);
     }
+    /**
+     * Warm and validate every optional implementation in a SEPARATE build/integration process with
+     * fake external providers. Never invoke this in the production entry point or from a request.
+     */
+    async validateLazyRoutesForBuild() {
+        if (core_context_1.RequestContext.isActive())
+            throw new Error('Lazy implementation build validation cannot run inside a request.');
+        await this.routeBuilder.validateLazyRoutesForBuild();
+    }
     /** The application DI container (child of the framework container). */
     getContainer() {
         return this.appContainer;
@@ -164,13 +179,14 @@ class WebpiecesRouterFactory {
         // Platform (framework) container — build via buildFrameworkModule so framework
         // singletons (WebpiecesRouter, RouteBuilderImpl) come from the webpieces registry,
         // NOT the client's global one.
+        const timing = new RuntimeStartupTiming_1.RuntimeStartupTiming(options.startupObserver);
         const webpiecesContainer = new inversify_1.Container();
         webpiecesContainer
             .bind(WebpiecesConfig_1.WEBPIECES_CONFIG_TOKEN)
             .toConstantValue(options.config ?? new WebpiecesConfig_1.WebpiecesConfig());
-        await webpiecesContainer.load((0, core_context_1.buildFrameworkModule)());
+        await timing.runAsync(RuntimeStartupTiming_1.RuntimeStartupPhase.FRAMEWORK_DI, 'platform-framework-bindings', () => webpiecesContainer.load((0, core_context_1.buildFrameworkModule)()));
         // Resolve the router from the container (NOT new'd) so @DocumentDesign + DI hold.
-        const router = webpiecesContainer.get(WebpiecesRouter);
+        const router = timing.run(RuntimeStartupTiming_1.RuntimeStartupPhase.FRAMEWORK_DI, 'router-resolution', () => webpiecesContainer.get(WebpiecesRouter));
         await router.initialize(webpiecesContainer, options);
         return router;
     }

package/src/WebpiecesRouter.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebpiecesRouter.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/WebpiecesRouter.ts"],"names":[],"mappings":";;;;AAAA,2DAA2D;AAE3D,yCAA+D;AAC/D,wEAAsE;AACtE,oDAAsD;AACtD,0DAA0F;AAC1F,yDAAsD;AACtD,2DAAmE;AACnE,6CAAgD;AAChD,uDAA4E;AAC5E,yDAAsD;AAGtD,yDAAsD;AACtD,qDAAkD;AAClD,uEAAoE;AAiBpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGI,IAAM,eAAe,GAArB,MAAM,eAAe;IAKuB;IACA;IALvC,kBAAkB,CAAa;IAC/B,YAAY,CAAa;IAEjC,YAC+C,YAA8B,EAC9B,gBAAkC;QADlC,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;IAC9E,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,UAAU,CACZ,kBAA6B,EAC7B,OAA+B;QAE/B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAE7C,0FAA0F;QAC1F,4FAA4F;QAC5F,2FAA2F;QAC3F,6FAA6F;QAC7F,IAAI,CAAC,YAAY,GAAG,IAAI,qBAAS,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAElD,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;;;OAOG;IACK,mBAAmB;QACvB,IAAI,CAAC,SAAS,CAAC,IAAI,6BAAgB,CAAC,SAAS,EAAE,2BAAY,EAAE,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,SAAS,CAAC,IAAI,6BAAgB,CAAC,OAAO,EAAE,uBAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,CAAC,IAAI,6BAAgB,CAAC,OAAO,EAAE,yCAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAA+B;QACvD,qFAAqF;QACrF,wEAAwE;QACxE,6FAA6F;QAC7F,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAA,mCAAoB,GAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAA,wCAAmB,GAAE,CAAC,CAAC;QAEpD,kDAAkD;QAClD,kFAAkF;QAClF,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,gEAAgE;QAChE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,SAAS,CACL,GAAoB,EACpB,UAAkC;QAElC,IAAI,qCAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,MAAwB;QAC9B,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,yFAAyF;IACzF,eAAe,CAAI,YAAgD;QAC/D,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,oFAAoF;IACpF,yEAAyE;IACzE,yBAAyB,CACrB,YAAgD,EAChD,cAAwC;QAExC,OAAO,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACzF,CAAC;IAED;;;;OAIG;IACH,UAAU;QACN,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,oBAAoB;QAChB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,wCAAoB,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,YAAY;QACR,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;CACJ,CAAA;AAxHY,0CAAe;0BAAf,eAAe;IAF3B,IAAA,0BAAc,GAAE;IAChB,IAAA,wCAAyB,GAAE;IAMnB,mBAAA,IAAA,kBAAM,EAAC,mCAAgB,CAAC,CAAA;IACxB,mBAAA,IAAA,kBAAM,EAAC,mCAAgB,CAAC,CAAA;6CADgC,mCAAgB;QACZ,mCAAgB;GANxE,eAAe,CAwH3B;AAED;;;;GAIG;AACH,MAAa,sBAAsB;IAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAA+B;QAC/C,+EAA+E;QAC/E,mFAAmF;QACnF,+BAA+B;QAC/B,MAAM,kBAAkB,GAAG,IAAI,qBAAS,EAAE,CAAC;QAC3C,kBAAkB;aACb,IAAI,CAAC,wCAAsB,CAAC;aAC5B,eAAe,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,iCAAe,EAAE,CAAC,CAAC;QAC9D,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAA,mCAAoB,GAAE,CAAC,CAAC;QAEtD,kFAAkF;QAClF,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AAhBD,wDAgBC","sourcesContent":["import { AuthorizationService } from './AuthorizationHook';\nimport { InvocationAuthentication } from './InvocationAuthentication';\nimport { Container, ContainerModule, inject } from 'inversify';\nimport { buildProviderModule } from '@inversifyjs/binding-decorators';\nimport { DocumentDesign } from '@webpieces/core-util';\nimport { provideFrameworkSingleton, buildFrameworkModule } from '@webpieces/core-context';\nimport { RouteBuilderImpl } from './RouteBuilderImpl';\nimport { ApiRoutingFactory, ClassType } from './ApiRoutingFactory';\nimport { FilterDefinition } from './WebAppMeta';\nimport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\nimport { ApiClientFactory } from './ApiClientFactory';\nimport { ApiFactory } from './ApiFactory';\nimport { ApiClient } from './ApiClient';\nimport { LogApiFilter } from './filters/LogApiFilter';\nimport { AuthFilter } from './filters/AuthFilter';\nimport { AuthorizationFilter } from './filters/AuthorizationFilter';\n\n/**\n * Options for {@link WebpiecesRouterFactory.create} — one object (config lives inside it).\n *\n * appBindings  - DI ContainerModules to load (framework + app). Loaded after the\n *                @provideSingleton auto-scan so they can add/override bindings.\n * appOverrides - A single ContainerModule loaded LAST so tests can rebind real\n *                controllers/clients to mocks (see @webpieces/core-mock createMock()).\n * config       - Optional {@link WebpiecesConfig} (recording flags, etc.); defaults to a fresh one.\n */\nexport interface WebpiecesRouterOptions {\n    appBindings: ContainerModule[];\n    appOverrides?: ContainerModule;\n    config?: WebpiecesConfig;\n}\n\n/**\n * WebpiecesRouter - the node-only heart of a webpieces app: a DI container + a filter\n * chain + an in-process API client. It has NO express dependency, so it runs anywhere\n * node runs and is fully testable with zero HTTP.\n *\n * DI-resolved from the platform container (like the old WebpiecesServerImpl):\n * `@provideSingleton @injectable`, RouteBuilderImpl injected, and the two containers set in\n * initialize(). Built by {@link WebpiecesRouterFactory.create} — never `new`ed by callers.\n *\n * Two-container pattern (mirrors Java WebPieces):\n *  - webpiecesContainer : framework bindings (config token, @DocumentDesign design roots)\n *  - appContainer       : your controllers/filters/modules (a child of the framework one)\n *\n * Usage:\n * ```typescript\n * const router = await WebpiecesRouterFactory.create({ appBindings: [AppModule] });\n * router.addRoutes(SaveApi, SaveController);\n * router.addFilter(new FilterDefinition(1800, MyFilter, '*'));  // your own filters\n * // (LogApiFilter + AuthFilter are auto-installed above yours; auth is AuthMode-driven.\n * //  LogApiFilter logs request+response for EVERY call — do NOT install it yourself.)\n *\n * // test (no express): runs the SAME filter chain (incl. auth) -> controller\n * const api = router.createApiClient(SaveApi);\n * await api.save(new SaveRequest(...));\n * ```\n *\n * To serve real HTTP, hand this router to the express adapter in @webpieces/http-server\n * (bindExpress / bindAndStartExpress) — express lifecycle lives THERE, never here.\n *\n * @DocumentDesign marks it a design root so it appears in http-routing's designed-lib graph.\n */\n@DocumentDesign()\n@provideFrameworkSingleton()\nexport class WebpiecesRouter implements ApiFactory {\n    private webpiecesContainer!: Container;\n    private appContainer!: Container;\n\n    constructor(\n        @inject(RouteBuilderImpl) private readonly routeBuilder: RouteBuilderImpl,\n        @inject(ApiClientFactory) private readonly apiClientFactory: ApiClientFactory,\n    ) {}\n\n    /**\n     * Build the app container (child of the framework container), load the @provideSingleton\n     * auto-scan + appBindings + appOverrides, and point the RouteBuilder at it. Called once by\n     * the factory after this router is resolved from the framework container.\n     */\n    async initialize(\n        webpiecesContainer: Container,\n        options: WebpiecesRouterOptions,\n    ): Promise<void> {\n        this.webpiecesContainer = webpiecesContainer;\n\n        // App container is a child so app bindings see framework bindings while staying separate.\n        // autobind:true lets a concrete @injectable(Singleton) app class self-bind on first resolve\n        // (inject-by-type, no @provideSingleton). Framework singletons stay explicit in the parent\n        // (provideFrameworkSingleton -> buildFrameworkModule), found before child-autobind kicks in.\n        this.appContainer = new Container({ parent: webpiecesContainer, autobind: true });\n        this.routeBuilder.setContainer(this.appContainer);\n\n        await this.loadDIModules(options);\n        this.installFixedFilters();\n    }\n\n    /**\n     * Auto-install the two fixed framework filters on every route (apps add only their own\n     * filters below these): LogApiFilter outermost (logs request + response/failure for every\n     * call and stamps [Controller.method], then re-throws for the transport to translate), then\n     * AuthFilter (enforces the endpoint's AuthMode off the HttpRequest). Both run over HTTP AND\n     * in-process — there is no transport tier. Because LogApiFilter is outermost, requests that\n     * AuthFilter rejects (401) are still logged with their body + controller identity.\n     */\n    private installFixedFilters(): void {\n        this.addFilter(new FilterDefinition(1_000_000, LogApiFilter, '*'));\n        this.addFilter(new FilterDefinition(900_000, AuthFilter, '*'));\n        this.addFilter(new FilterDefinition(800_000, AuthorizationFilter, '*'));\n    }\n\n    private async loadDIModules(options: WebpiecesRouterOptions): Promise<void> {\n        // Load BOTH registries: framework classes (provideFrameworkSingleton) + the client's\n        // own @provideSingleton classes (binding-decorators global). A client's\n        // buildProviderModule() only ever contains the client's classes — never framework internals.\n        await this.appContainer.load(buildFrameworkModule());\n        await this.appContainer.load(buildProviderModule());\n\n        // Load all app modules into application container\n        // (webpiecesContainer is currently empty, reserved for future framework bindings)\n        for (const module of options.appBindings) {\n            await this.appContainer.load(module);\n        }\n\n        // Load appOverrides LAST so they can override existing bindings\n        if (options.appOverrides) {\n            await this.appContainer.load(options.appOverrides);\n        }\n    }\n\n    /**\n     * Wire an API prototype (with @ApiPath/@Endpoint decorators) to its controller.\n     * The controller is resolved from the container at request time.\n     */\n    addRoutes<TApi, TController extends TApi>(\n        api: ClassType<TApi>,\n        controller: ClassType<TController>,\n    ): this {\n        new ApiRoutingFactory(api, controller).configure(this.routeBuilder);\n        return this;\n    }\n\n    /**\n     * Register a user filter (runs in-process AND over HTTP, below the auto-installed fixed\n     * LogApiFilter + AuthFilter).\n     */\n    addFilter(filter: FilterDefinition): this {\n        this.routeBuilder.addFilter(filter);\n        return this;\n    }\n\n    /**\n     * Create an in-process API client that runs the api-tier filter chain + controller\n     * with NO express/HTTP. The primary path for tests and node-only callers.\n     */\n    // webpieces-disable no-any-unknown -- abstract constructor signature requires any[] args\n    createApiClient<T>(apiPrototype: abstract new (...args: any[]) => T): T {\n        return this.apiClientFactory.createApiClient(apiPrototype);\n    }\n\n    /** Transport-only credential bridge; ordinary endpoint filters remain mandatory. */\n    // webpieces-disable no-any-unknown -- abstract API constructor signature\n    createInvocationApiClient<T>(\n        apiPrototype: abstract new (...args: any[]) => T,\n        authentication: InvocationAuthentication,\n    ): T {\n        return this.apiClientFactory.createInvocationApiClient(apiPrototype, authentication);\n    }\n\n    /**\n     * Reify the registered APIs as {@link ApiClient}s (contract + the createApiClient proxy) via\n     * the shared {@link ApiClientFactory}. This is the ONLY handoff to the express layer — the\n     * internal RouteBuilder never leaves.\n     */\n    apiClients(): ApiClient[] {\n        return this.apiClientFactory.apiClients();\n    }\n\n    authorizationService(): AuthorizationService {\n        return this.appContainer.get(AuthorizationService);\n    }\n\n    /** The application DI container (child of the framework container). */\n    getContainer(): Container {\n        return this.appContainer;\n    }\n}\n\n/**\n * Builds a {@link WebpiecesRouter}: constructs the platform container (mirrors\n * WebpiecesServerFactory.create), RESOLVES the router from DI, then initializes its app child\n * container with the @provideSingleton auto-scan + appBindings + optional test overrides.\n */\nexport class WebpiecesRouterFactory {\n    static async create(options: WebpiecesRouterOptions): Promise<WebpiecesRouter> {\n        // Platform (framework) container — build via buildFrameworkModule so framework\n        // singletons (WebpiecesRouter, RouteBuilderImpl) come from the webpieces registry,\n        // NOT the client's global one.\n        const webpiecesContainer = new Container();\n        webpiecesContainer\n            .bind(WEBPIECES_CONFIG_TOKEN)\n            .toConstantValue(options.config ?? new WebpiecesConfig());\n        await webpiecesContainer.load(buildFrameworkModule());\n\n        // Resolve the router from the container (NOT new'd) so @DocumentDesign + DI hold.\n        const router = webpiecesContainer.get(WebpiecesRouter);\n        await router.initialize(webpiecesContainer, options);\n        return router;\n    }\n}\n"]}
+{"version":3,"file":"WebpiecesRouter.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/WebpiecesRouter.ts"],"names":[],"mappings":";;;;AACA,2DAA2D;AAE3D,yCAA+D;AAC/D,wEAAsE;AACtE,oDAAsD;AACtD,0DAIiC;AACjC,yDAAsD;AACtD,2DAAwD;AAExD,6CAAgD;AAChD,uDAA4E;AAC5E,yDAAsD;AAGtD,yDAAsD;AACtD,qDAAkD;AAClD,uEAAoE;AACpE,iEAIgC;AAmBhC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGI,IAAM,eAAe,GAArB,MAAM,eAAe;IAMuB;IACA;IANvC,kBAAkB,CAAa;IAC/B,YAAY,CAAa;IACzB,aAAa,GAAG,IAAI,2CAAoB,EAAE,CAAC;IAEnD,YAC+C,YAA8B,EAC9B,gBAAkC;QADlC,iBAAY,GAAZ,YAAY,CAAkB;QAC9B,qBAAgB,GAAhB,gBAAgB,CAAkB;IAC9E,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,UAAU,CACZ,kBAA6B,EAC7B,OAA+B;QAE/B,IAAI,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;QAC7C,IAAI,CAAC,aAAa,GAAG,IAAI,2CAAoB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACvE,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAE9D,0FAA0F;QAC1F,4FAA4F;QAC5F,2FAA2F;QAC3F,6FAA6F;QAC7F,IAAI,CAAC,YAAY,GAAG,IAAI,qBAAS,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAElD,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,0CAAmB,CAAC,aAAa,EAAE,eAAe,EAAE,GAAG,EAAE,CAC5E,IAAI,CAAC,mBAAmB,EAAE,CAC7B,CAAC;IACN,CAAC;IAED;;;;;;;OAOG;IACK,mBAAmB;QACvB,IAAI,CAAC,SAAS,CAAC,IAAI,6BAAgB,CAAC,SAAS,EAAE,2BAAY,EAAE,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,SAAS,CAAC,IAAI,6BAAgB,CAAC,OAAO,EAAE,uBAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,CAAC,IAAI,6BAAgB,CAAC,OAAO,EAAE,yCAAmB,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,OAA+B;QACvD,qFAAqF;QACrF,wEAAwE;QACxE,6FAA6F;QAC7F,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAC7B,0CAAmB,CAAC,YAAY,EAChC,gCAAgC,EAChC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAA,mCAAoB,GAAE,CAAC,CACvD,CAAC;QACF,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAC7B,0CAAmB,CAAC,cAAc,EAClC,mBAAmB,EACnB,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAA,wCAAmB,GAAE,CAAC,CACtD,CAAC;QAEF,kDAAkD;QAClD,kFAAkF;QAClF,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAC7B,0CAAmB,CAAC,cAAc,EAClC,eAAe,KAAK,EAAE,EACtB,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CACvC,CAAC;QACN,CAAC;QAED,gEAAgE;QAChE,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC;YACvC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAC7B,0CAAmB,CAAC,cAAc,EAClC,eAAe,EACf,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAC1C,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,SAAS,CACL,GAAoB,EACpB,UAAgE;QAEhE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,0CAAmB,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CACtF,IAAI,qCAAiB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CACtE,CAAC;QACF,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,SAAS,CAAC,MAAwB;QAC9B,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,yFAAyF;IACzF,eAAe,CAAI,YAAgD;QAC/D,OAAO,IAAI,CAAC,gBAAgB,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC;IAED,oFAAoF;IACpF,yEAAyE;IACzE,yBAAyB,CACrB,YAAgD,EAChD,cAAwC;QAExC,OAAO,IAAI,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;IACzF,CAAC;IAED;;;;OAIG;IACH,UAAU;QACN,OAAO,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;IAC9C,CAAC;IAED,oBAAoB;QAChB,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,wCAAoB,CAAC,CAAC;IACvD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,0BAA0B;QAC5B,IAAI,6BAAc,CAAC,QAAQ,EAAE;YACzB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACzF,MAAM,IAAI,CAAC,YAAY,CAAC,0BAA0B,EAAE,CAAC;IACzD,CAAC;IAED,uEAAuE;IACvE,YAAY;QACR,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;CACJ,CAAA;AA3JY,0CAAe;0BAAf,eAAe;IAF3B,IAAA,0BAAc,GAAE;IAChB,IAAA,wCAAyB,GAAE;IAOnB,mBAAA,IAAA,kBAAM,EAAC,mCAAgB,CAAC,CAAA;IACxB,mBAAA,IAAA,kBAAM,EAAC,mCAAgB,CAAC,CAAA;6CADgC,mCAAgB;QACZ,mCAAgB;GAPxE,eAAe,CA2J3B;AAED;;;;GAIG;AACH,MAAa,sBAAsB;IAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAA+B;QAC/C,+EAA+E;QAC/E,mFAAmF;QACnF,+BAA+B;QAC/B,MAAM,MAAM,GAAG,IAAI,2CAAoB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACjE,MAAM,kBAAkB,GAAG,IAAI,qBAAS,EAAE,CAAC;QAC3C,kBAAkB;aACb,IAAI,CAAC,wCAAsB,CAAC;aAC5B,eAAe,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,iCAAe,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,CAAC,QAAQ,CAAC,0CAAmB,CAAC,YAAY,EAAE,6BAA6B,EAAE,GAAG,EAAE,CACxF,kBAAkB,CAAC,IAAI,CAAC,IAAA,mCAAoB,GAAE,CAAC,CAClD,CAAC;QAEF,kFAAkF;QAClF,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,0CAAmB,CAAC,YAAY,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAClF,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,CAC1C,CAAC;QACF,MAAM,MAAM,CAAC,UAAU,CAAC,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC;IAClB,CAAC;CACJ;AArBD,wDAqBC","sourcesContent":["import { LazyController } from './LazyController';\nimport { AuthorizationService } from './AuthorizationHook';\nimport { InvocationAuthentication } from './InvocationAuthentication';\nimport { Container, ContainerModule, inject } from 'inversify';\nimport { buildProviderModule } from '@inversifyjs/binding-decorators';\nimport { DocumentDesign } from '@webpieces/core-util';\nimport {\n    provideFrameworkSingleton,\n    buildFrameworkModule,\n    RequestContext,\n} from '@webpieces/core-context';\nimport { RouteBuilderImpl } from './RouteBuilderImpl';\nimport { ApiRoutingFactory } from './ApiRoutingFactory';\nimport type { ClassType } from './ClassType';\nimport { FilterDefinition } from './WebAppMeta';\nimport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\nimport { ApiClientFactory } from './ApiClientFactory';\nimport { ApiFactory } from './ApiFactory';\nimport { ApiClient } from './ApiClient';\nimport { LogApiFilter } from './filters/LogApiFilter';\nimport { AuthFilter } from './filters/AuthFilter';\nimport { AuthorizationFilter } from './filters/AuthorizationFilter';\nimport {\n    RuntimeStartupObserver,\n    RuntimeStartupPhase,\n    RuntimeStartupTiming,\n} from './RuntimeStartupTiming';\n\n/**\n * Options for {@link WebpiecesRouterFactory.create} — one object (config lives inside it).\n *\n * appBindings  - DI ContainerModules to load (framework + app). Loaded after the\n *                @provideSingleton auto-scan so they can add/override bindings.\n * appOverrides - A single ContainerModule loaded LAST so tests can rebind real\n *                controllers/clients to mocks (see @webpieces/core-mock createMock()).\n * config       - Optional {@link WebpiecesConfig} (recording flags, etc.); defaults to a fresh one.\n */\nexport interface WebpiecesRouterOptions {\n    appBindings: ContainerModule[];\n    appOverrides?: ContainerModule;\n    config?: WebpiecesConfig;\n    /** Optional startup spans; no observer means no clock or timing-output work. */\n    startupObserver?: RuntimeStartupObserver;\n}\n\n/**\n * WebpiecesRouter - the node-only heart of a webpieces app: a DI container + a filter\n * chain + an in-process API client. It has NO express dependency, so it runs anywhere\n * node runs and is fully testable with zero HTTP.\n *\n * DI-resolved from the platform container (like the old WebpiecesServerImpl):\n * `@provideSingleton @injectable`, RouteBuilderImpl injected, and the two containers set in\n * initialize(). Built by {@link WebpiecesRouterFactory.create} — never `new`ed by callers.\n *\n * Two-container pattern (mirrors Java WebPieces):\n *  - webpiecesContainer : framework bindings (config token, @DocumentDesign design roots)\n *  - appContainer       : your controllers/filters/modules (a child of the framework one)\n *\n * Usage:\n * ```typescript\n * const router = await WebpiecesRouterFactory.create({ appBindings: [AppModule] });\n * router.addRoutes(SaveApi, SaveController);\n * router.addFilter(new FilterDefinition(1800, MyFilter, '*'));  // your own filters\n * // (LogApiFilter + AuthFilter are auto-installed above yours; auth is AuthMode-driven.\n * //  LogApiFilter logs request+response for EVERY call — do NOT install it yourself.)\n *\n * // test (no express): runs the SAME filter chain (incl. auth) -> controller\n * const api = router.createApiClient(SaveApi);\n * await api.save(new SaveRequest(...));\n * ```\n *\n * To serve real HTTP, hand this router to the express adapter in @webpieces/http-server\n * (bindExpress / bindAndStartExpress) — express lifecycle lives THERE, never here.\n *\n * @DocumentDesign marks it a design root so it appears in http-routing's designed-lib graph.\n */\n@DocumentDesign()\n@provideFrameworkSingleton()\nexport class WebpiecesRouter implements ApiFactory {\n    private webpiecesContainer!: Container;\n    private appContainer!: Container;\n    private startupTiming = new RuntimeStartupTiming();\n\n    constructor(\n        @inject(RouteBuilderImpl) private readonly routeBuilder: RouteBuilderImpl,\n        @inject(ApiClientFactory) private readonly apiClientFactory: ApiClientFactory,\n    ) {}\n\n    /**\n     * Build the app container (child of the framework container), load the @provideSingleton\n     * auto-scan + appBindings + appOverrides, and point the RouteBuilder at it. Called once by\n     * the factory after this router is resolved from the framework container.\n     */\n    async initialize(\n        webpiecesContainer: Container,\n        options: WebpiecesRouterOptions,\n    ): Promise<void> {\n        this.webpiecesContainer = webpiecesContainer;\n        this.startupTiming = new RuntimeStartupTiming(options.startupObserver);\n        this.routeBuilder.setStartupObserver(options.startupObserver);\n\n        // App container is a child so app bindings see framework bindings while staying separate.\n        // autobind:true lets a concrete @injectable(Singleton) app class self-bind on first resolve\n        // (inject-by-type, no @provideSingleton). Framework singletons stay explicit in the parent\n        // (provideFrameworkSingleton -> buildFrameworkModule), found before child-autobind kicks in.\n        this.appContainer = new Container({ parent: webpiecesContainer, autobind: true });\n        this.routeBuilder.setContainer(this.appContainer);\n\n        await this.loadDIModules(options);\n        this.startupTiming.run(RuntimeStartupPhase.FIXED_FILTERS, 'fixed-filters', () =>\n            this.installFixedFilters(),\n        );\n    }\n\n    /**\n     * Auto-install the two fixed framework filters on every route (apps add only their own\n     * filters below these): LogApiFilter outermost (logs request + response/failure for every\n     * call and stamps [Controller.method], then re-throws for the transport to translate), then\n     * AuthFilter (enforces the endpoint's AuthMode off the HttpRequest). Both run over HTTP AND\n     * in-process — there is no transport tier. Because LogApiFilter is outermost, requests that\n     * AuthFilter rejects (401) are still logged with their body + controller identity.\n     */\n    private installFixedFilters(): void {\n        this.addFilter(new FilterDefinition(1_000_000, LogApiFilter, '*'));\n        this.addFilter(new FilterDefinition(900_000, AuthFilter, '*'));\n        this.addFilter(new FilterDefinition(800_000, AuthorizationFilter, '*'));\n    }\n\n    private async loadDIModules(options: WebpiecesRouterOptions): Promise<void> {\n        // Load BOTH registries: framework classes (provideFrameworkSingleton) + the client's\n        // own @provideSingleton classes (binding-decorators global). A client's\n        // buildProviderModule() only ever contains the client's classes — never framework internals.\n        await this.startupTiming.runAsync(\n            RuntimeStartupPhase.FRAMEWORK_DI,\n            'application-framework-bindings',\n            () => this.appContainer.load(buildFrameworkModule()),\n        );\n        await this.startupTiming.runAsync(\n            RuntimeStartupPhase.APPLICATION_DI,\n            'provider-bindings',\n            () => this.appContainer.load(buildProviderModule()),\n        );\n\n        // Load all app modules into application container\n        // (webpiecesContainer is currently empty, reserved for future framework bindings)\n        for (const [index, module] of options.appBindings.entries()) {\n            await this.startupTiming.runAsync(\n                RuntimeStartupPhase.APPLICATION_DI,\n                `app-binding-${index}`,\n                () => this.appContainer.load(module),\n            );\n        }\n\n        // Load appOverrides LAST so they can override existing bindings\n        if (options.appOverrides) {\n            const overrides = options.appOverrides;\n            await this.startupTiming.runAsync(\n                RuntimeStartupPhase.APPLICATION_DI,\n                'app-overrides',\n                () => this.appContainer.load(overrides),\n            );\n        }\n    }\n\n    /**\n     * Wire an API prototype (with @ApiPath/@Endpoint decorators) to its controller.\n     * A class resolves eagerly. A LazyController retains metadata now and imports its implementation\n     * only after the ordinary filter chain permits an invocation.\n     */\n    addRoutes<TApi extends object, TController extends TApi>(\n        api: ClassType<TApi>,\n        controller: ClassType<TController> | LazyController<TController>,\n    ): this {\n        this.startupTiming.run(RuntimeStartupPhase.ROUTES, `${api.name}:${controller.name}`, () =>\n            new ApiRoutingFactory(api, controller).configure(this.routeBuilder),\n        );\n        return this;\n    }\n\n    /**\n     * Register a user filter (runs in-process AND over HTTP, below the auto-installed fixed\n     * LogApiFilter + AuthFilter).\n     */\n    addFilter(filter: FilterDefinition): this {\n        this.routeBuilder.addFilter(filter);\n        return this;\n    }\n\n    /**\n     * Create an in-process API client that runs the api-tier filter chain + controller\n     * with NO express/HTTP. The primary path for tests and node-only callers.\n     */\n    // webpieces-disable no-any-unknown -- abstract constructor signature requires any[] args\n    createApiClient<T>(apiPrototype: abstract new (...args: any[]) => T): T {\n        return this.apiClientFactory.createApiClient(apiPrototype);\n    }\n\n    /** Transport-only credential bridge; ordinary endpoint filters remain mandatory. */\n    // webpieces-disable no-any-unknown -- abstract API constructor signature\n    createInvocationApiClient<T>(\n        apiPrototype: abstract new (...args: any[]) => T,\n        authentication: InvocationAuthentication,\n    ): T {\n        return this.apiClientFactory.createInvocationApiClient(apiPrototype, authentication);\n    }\n\n    /**\n     * Reify the registered APIs as {@link ApiClient}s (contract + the createApiClient proxy) via\n     * the shared {@link ApiClientFactory}. This is the ONLY handoff to the express layer — the\n     * internal RouteBuilder never leaves.\n     */\n    apiClients(): ApiClient[] {\n        return this.apiClientFactory.apiClients();\n    }\n\n    authorizationService(): AuthorizationService {\n        return this.appContainer.get(AuthorizationService);\n    }\n\n    /**\n     * Warm and validate every optional implementation in a SEPARATE build/integration process with\n     * fake external providers. Never invoke this in the production entry point or from a request.\n     */\n    async validateLazyRoutesForBuild(): Promise<void> {\n        if (RequestContext.isActive())\n            throw new Error('Lazy implementation build validation cannot run inside a request.');\n        await this.routeBuilder.validateLazyRoutesForBuild();\n    }\n\n    /** The application DI container (child of the framework container). */\n    getContainer(): Container {\n        return this.appContainer;\n    }\n}\n\n/**\n * Builds a {@link WebpiecesRouter}: constructs the platform container (mirrors\n * WebpiecesServerFactory.create), RESOLVES the router from DI, then initializes its app child\n * container with the @provideSingleton auto-scan + appBindings + optional test overrides.\n */\nexport class WebpiecesRouterFactory {\n    static async create(options: WebpiecesRouterOptions): Promise<WebpiecesRouter> {\n        // Platform (framework) container — build via buildFrameworkModule so framework\n        // singletons (WebpiecesRouter, RouteBuilderImpl) come from the webpieces registry,\n        // NOT the client's global one.\n        const timing = new RuntimeStartupTiming(options.startupObserver);\n        const webpiecesContainer = new Container();\n        webpiecesContainer\n            .bind(WEBPIECES_CONFIG_TOKEN)\n            .toConstantValue(options.config ?? new WebpiecesConfig());\n        await timing.runAsync(RuntimeStartupPhase.FRAMEWORK_DI, 'platform-framework-bindings', () =>\n            webpiecesContainer.load(buildFrameworkModule()),\n        );\n\n        // Resolve the router from the container (NOT new'd) so @DocumentDesign + DI hold.\n        const router = timing.run(RuntimeStartupPhase.FRAMEWORK_DI, 'router-resolution', () =>\n            webpiecesContainer.get(WebpiecesRouter),\n        );\n        await router.initialize(webpiecesContainer, options);\n        return router;\n    }\n}\n"]}

package/src/Wiring.d.ts

@@ -1,11 +1,7 @@
 import type { AnyContextKey } from '@webpieces/core-util';
-import type { BindModule as HostBindModule, Wiring as HostWiring, AppWiring as HostAppWiring } from '@webpieces/http-client-core';
-import type { Binder } from './Binder';
+import type { Wiring as HostWiring, AppWiring as HostAppWiring } from '@webpieces/http-client-core';
+import type { BindModule } from './BindModule';
 import type { WebpiecesRouter } from './WebpiecesRouter';
-/** Named DI declaration. setupRuntime hands it the Node {@link Binder} over one Inversify load. */
-export interface BindModule extends HostBindModule<Binder> {
-    configure(binder: Binder): void | Promise<void>;
-}
 /** api -> controller routes and filters. Node-only: only a server has routes. */
 export interface RouteModule {
     configure(router: WebpiecesRouter): void;

package/src/Wiring.js.map

@@ -1 +1 @@
-{"version":3,"file":"Wiring.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/Wiring.ts"],"names":[],"mappings":";;;AAMA,kEAA0D;AAuB1D,iFAAiF;AACjF,MAAa,iBAAiB;IACjB,WAAW,CAAe;IAC1B,YAAY,CAAgB;IAErC,YAAY,GAAc;QACtB,MAAM,KAAK,GAAG,IAAI,8BAAW,CAAS,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IACpF,CAAC;CACJ;AATD,8CASC","sourcesContent":["import type { AnyContextKey } from '@webpieces/core-util';\nimport type {\n    BindModule as HostBindModule,\n    Wiring as HostWiring,\n    AppWiring as HostAppWiring,\n} from '@webpieces/http-client-core';\nimport { WiringOrder } from '@webpieces/http-client-core';\nimport type { Binder } from './Binder';\nimport type { WebpiecesRouter } from './WebpiecesRouter';\n\n/** Named DI declaration. setupRuntime hands it the Node {@link Binder} over one Inversify load. */\nexport interface BindModule extends HostBindModule<Binder> {\n    configure(binder: Binder): void | Promise<void>;\n}\n\n/** api -> controller routes and filters. Node-only: only a server has routes. */\nexport interface RouteModule {\n    configure(router: WebpiecesRouter): void;\n}\n\nexport interface Wiring extends HostWiring<BindModule> {\n    getRouteModules(): RouteModule[];\n}\n\n/** Applications retain ownership of their server context headers. */\nexport interface AppWiring extends HostAppWiring<BindModule, Wiring>, Wiring {\n    getHeaders(): AnyContextKey[];\n}\n\n/** The app's modules first, then each selected library's, in selection order. */\nexport class NodeWiringModules {\n    readonly bindModules: BindModule[];\n    readonly routeModules: RouteModule[];\n\n    constructor(app: AppWiring) {\n        const order = new WiringOrder<Wiring>(app, app.getWirings());\n        this.bindModules = order.collect((wiring: Wiring) => wiring.getBindModules());\n        this.routeModules = order.collect((wiring: Wiring) => wiring.getRouteModules());\n    }\n}\n"]}
+{"version":3,"file":"Wiring.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/Wiring.ts"],"names":[],"mappings":";;;AAEA,kEAA0D;AAkB1D,iFAAiF;AACjF,MAAa,iBAAiB;IACjB,WAAW,CAAe;IAC1B,YAAY,CAAgB;IAErC,YAAY,GAAc;QACtB,MAAM,KAAK,GAAG,IAAI,8BAAW,CAAS,GAAG,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IACpF,CAAC;CACJ;AATD,8CASC","sourcesContent":["import type { AnyContextKey } from '@webpieces/core-util';\nimport type { Wiring as HostWiring, AppWiring as HostAppWiring } from '@webpieces/http-client-core';\nimport { WiringOrder } from '@webpieces/http-client-core';\nimport type { BindModule } from './BindModule';\nimport type { WebpiecesRouter } from './WebpiecesRouter';\n\n/** api -> controller routes and filters. Node-only: only a server has routes. */\nexport interface RouteModule {\n    configure(router: WebpiecesRouter): void;\n}\n\nexport interface Wiring extends HostWiring<BindModule> {\n    getRouteModules(): RouteModule[];\n}\n\n/** Applications retain ownership of their server context headers. */\nexport interface AppWiring extends HostAppWiring<BindModule, Wiring>, Wiring {\n    getHeaders(): AnyContextKey[];\n}\n\n/** The app's modules first, then each selected library's, in selection order. */\nexport class NodeWiringModules {\n    readonly bindModules: BindModule[];\n    readonly routeModules: RouteModule[];\n\n    constructor(app: AppWiring) {\n        const order = new WiringOrder<Wiring>(app, app.getWirings());\n        this.bindModules = order.collect((wiring: Wiring) => wiring.getBindModules());\n        this.routeModules = order.collect((wiring: Wiring) => wiring.getRouteModules());\n    }\n}\n"]}

package/src/WiringCompileAssertions.d.ts

@@ -1,4 +1,5 @@
-import type { AppWiring, BindModule, RouteModule, Wiring } from './Wiring';
+import type { AppWiring, RouteModule, Wiring } from './Wiring';
+import type { BindModule } from './BindModule';
 import type { Binder } from './Binder';
 /** Checked by tsc, never invoked; vitest strips types, so these guarantees live in compiled source. */
 export declare class WiringCompileAssertions {

package/src/WiringCompileAssertions.js.map

@@ -1 +1 @@
-{"version":3,"file":"WiringCompileAssertions.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/WiringCompileAssertions.ts"],"names":[],"mappings":";;;AAEA,qCAAgE;AAEhE,MAAe,SAAS;CAEvB;AACD,MAAe,SAAS;CAEvB;AACD,MAAM,YAAa,SAAQ,SAAS;IAChC,IAAI;QACA,OAAO,OAAO,CAAC;IACnB,CAAC;CACJ;AAED,uGAAuG;AACvG,MAAa,uBAAuB;IAChC,KAAK,CAAC,OAAmB,EAAE,OAAoB;QAC3C,6DAA6D;QAC7D,MAAM,cAAc,GAAe,OAAO,CAAC;QAC3C,4DAA4D;QAC5D,MAAM,YAAY,GAAgB,OAAO,CAAC;QAC1C,KAAK,cAAc,CAAC;QACpB,KAAK,YAAY,CAAC;IACtB,CAAC;IAED,QAAQ,CAAC,MAAc,EAAE,GAAc;QACnC,+EAA+E;QAC/E,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC3B,+EAA+E;QAC/E,GAAG,CAAC,iBAAiB,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,OAAe;QAClC,MAAM,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,0BAAiB,CAAY,OAAO,CAAC,CAAC,CAAC;QAC/F,0DAA0D;QAC1D,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QACzC,kFAAkF;QAClF,MAAM,CAAC,sBAAsB,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,0BAAiB,CAAY,OAAO,CAAC,CAAC,CAAC;QAClG,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC7C,mFAAmF;QACnF,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACjD,CAAC;CACJ;AA7BD,0DA6BC","sourcesContent":["import type { AppWiring, BindModule, RouteModule, Wiring } from './Wiring';\nimport type { Binder } from './Binder';\nimport { ClientBindOptions, PubSubBindOptions } from './Binder';\n\nabstract class StringApi {\n    abstract read(): string;\n}\nabstract class NumberApi {\n    abstract read(): number;\n}\nclass StringClient extends StringApi {\n    read(): string {\n        return 'value';\n    }\n}\n\n/** Checked by tsc, never invoked; vitest strips types, so these guarantees live in compiled source. */\nexport class WiringCompileAssertions {\n    check(binding: BindModule, routing: RouteModule): void {\n        // @ts-expect-error A route module cannot configure a binder.\n        const invalidBinding: BindModule = routing;\n        // @ts-expect-error A bind module cannot configure a router.\n        const invalidRoute: RouteModule = binding;\n        void invalidBinding;\n        void invalidRoute;\n    }\n\n    channels(wiring: Wiring, app: AppWiring): void {\n        // @ts-expect-error The getters were renamed: getBindModules / getRouteModules.\n        wiring.getBindingModules();\n        // @ts-expect-error The getters were renamed: getBindModules / getRouteModules.\n        app.getRoutingModules();\n    }\n\n    binder(binder: Binder, strings: symbol): void {\n        binder.createRpcClientAndBind(StringApi, 'strings');\n        binder.createRpcClientAndBind(StringApi, 'strings', new ClientBindOptions<StringApi>(strings));\n        // @ts-expect-error The deployment is a required argument.\n        binder.createRpcClientAndBind(StringApi);\n        // @ts-expect-error Destination wrappers were removed; pass the deployment string.\n        binder.createRpcClientAndBind(StringApi, { serviceName: 'strings' });\n        binder.createPubSubClientAndBind(StringApi, 'strings', new PubSubBindOptions<StringApi>(strings));\n        binder.bindExternal(StringApi, StringClient);\n        // @ts-expect-error The vendor implementation must implement the external contract.\n        binder.bindExternal(NumberApi, StringClient);\n    }\n}\n"]}
+{"version":3,"file":"WiringCompileAssertions.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/WiringCompileAssertions.ts"],"names":[],"mappings":";;;AAGA,qCAAgE;AAEhE,MAAe,SAAS;CAEvB;AACD,MAAe,SAAS;CAEvB;AACD,MAAM,YAAa,SAAQ,SAAS;IAChC,IAAI;QACA,OAAO,OAAO,CAAC;IACnB,CAAC;CACJ;AAED,uGAAuG;AACvG,MAAa,uBAAuB;IAChC,KAAK,CAAC,OAAmB,EAAE,OAAoB;QAC3C,6DAA6D;QAC7D,MAAM,cAAc,GAAe,OAAO,CAAC;QAC3C,4DAA4D;QAC5D,MAAM,YAAY,GAAgB,OAAO,CAAC;QAC1C,KAAK,cAAc,CAAC;QACpB,KAAK,YAAY,CAAC;IACtB,CAAC;IAED,QAAQ,CAAC,MAAc,EAAE,GAAc;QACnC,+EAA+E;QAC/E,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC3B,+EAA+E;QAC/E,GAAG,CAAC,iBAAiB,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,OAAe;QAClC,MAAM,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACpD,MAAM,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,0BAAiB,CAAY,OAAO,CAAC,CAAC,CAAC;QAC/F,0DAA0D;QAC1D,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QACzC,kFAAkF;QAClF,MAAM,CAAC,sBAAsB,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,0BAAiB,CAAY,OAAO,CAAC,CAAC,CAAC;QAClG,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC7C,mFAAmF;QACnF,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACjD,CAAC;CACJ;AA7BD,0DA6BC","sourcesContent":["import type { AppWiring, RouteModule, Wiring } from './Wiring';\nimport type { BindModule } from './BindModule';\nimport type { Binder } from './Binder';\nimport { ClientBindOptions, PubSubBindOptions } from './Binder';\n\nabstract class StringApi {\n    abstract read(): string;\n}\nabstract class NumberApi {\n    abstract read(): number;\n}\nclass StringClient extends StringApi {\n    read(): string {\n        return 'value';\n    }\n}\n\n/** Checked by tsc, never invoked; vitest strips types, so these guarantees live in compiled source. */\nexport class WiringCompileAssertions {\n    check(binding: BindModule, routing: RouteModule): void {\n        // @ts-expect-error A route module cannot configure a binder.\n        const invalidBinding: BindModule = routing;\n        // @ts-expect-error A bind module cannot configure a router.\n        const invalidRoute: RouteModule = binding;\n        void invalidBinding;\n        void invalidRoute;\n    }\n\n    channels(wiring: Wiring, app: AppWiring): void {\n        // @ts-expect-error The getters were renamed: getBindModules / getRouteModules.\n        wiring.getBindingModules();\n        // @ts-expect-error The getters were renamed: getBindModules / getRouteModules.\n        app.getRoutingModules();\n    }\n\n    binder(binder: Binder, strings: symbol): void {\n        binder.createRpcClientAndBind(StringApi, 'strings');\n        binder.createRpcClientAndBind(StringApi, 'strings', new ClientBindOptions<StringApi>(strings));\n        // @ts-expect-error The deployment is a required argument.\n        binder.createRpcClientAndBind(StringApi);\n        // @ts-expect-error Destination wrappers were removed; pass the deployment string.\n        binder.createRpcClientAndBind(StringApi, { serviceName: 'strings' });\n        binder.createPubSubClientAndBind(StringApi, 'strings', new PubSubBindOptions<StringApi>(strings));\n        binder.bindExternal(StringApi, StringClient);\n        // @ts-expect-error The vendor implementation must implement the external contract.\n        binder.bindExternal(NumberApi, StringClient);\n    }\n}\n"]}

package/src/index.d.ts

@@ -3,7 +3,8 @@ export type { AuthMode, ApiKind, HttpMethod, EndpointOperation, EndpointKind, En
 export { SourceFile, ROUTING_METADATA_KEYS } from './decorators';
 export { provideSingletonDefaultForApi } from '@webpieces/core-context';
 export { provideFrameworkSingleton, provideFrameworkSingletonDefaultForApi, buildFrameworkModule, } from '@webpieces/core-context';
-export { ApiRoutingFactory, ClassType } from './ApiRoutingFactory';
+export { ApiRoutingFactory } from './ApiRoutingFactory';
+export type { ClassType } from './ClassType';
 export { Routes, RouteBuilder, RouteDefinition, FilterDefinition } from './WebAppMeta';
 export { HttpRequest, RawHttpRequest, RawRequest } from '@webpieces/core-context';
 export { WpResponse } from './WpResponse';
@@ -13,7 +14,8 @@ export { MethodMeta } from './MethodMeta';
 export { RouteHandler } from './RouteHandler';
 export { LogApiFilter } from './filters/LogApiFilter';
 export { FilterMatcher, HttpFilter } from './FilterMatcher';
-export type { Wiring, AppWiring, BindModule, RouteModule } from './Wiring';
+export type { Wiring, AppWiring, RouteModule } from './Wiring';
+export type { BindModule } from './BindModule';
 export { NodeWiringModules } from './Wiring';
 export type { Binder } from './Binder';
 export { ContainerBinder, ClientBindOptions, PubSubBindOptions } from './Binder';
@@ -32,3 +34,6 @@ export { AuthorizationHook, AuthorizationService, CanonicalUserRoles, AUTHORIZAT
 export { AuthorizedApiDocument } from './AuthorizedApiDocument';
 export type { ApiDocumentObject, ApiDocumentValue } from './AuthorizedApiDocument';
 export { WiringPolicy } from '@webpieces/http-client-core';
+export { RuntimeStartupPhase, RuntimeStartupOperation } from './RuntimeStartupTiming';
+export type { RuntimeStartupObserver, RuntimeStartupSpan } from './RuntimeStartupTiming';
+export { LazyController, LazyImplementation, LazyFeatureTimer, LazyFeatureDeadline } from './LazyController';

package/src/index.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.WRITE_IDEMPOTENT = exports.READ = exports.verbCarriesBody = exports.DELETE = exports.PATCH = exports.PUT = exports.POST = exports.GET = exports.METADATA_KEYS = exports.HttpContractMapper = exports.RouteMetadataFactory = exports.RouteMetadata = exports.AuthMeta = exports.getQueueName = exports.assertPubSubConventions = exports.assertApiKind = exports.getApiKind = exports.assertEveryEndpointHasAuthMode = exports.getAuthMeta = exports.isApiPath = exports.isRawBody = exports.isFormPost = exports.getHttpParameterDeclarations = exports.getEndpointOperation = exports.getEndpointHttpMethod = exports.getEndpointOptions = exports.getEndpoints = exports.getApiPath = exports.Queue = exports.PubSub = exports.Rpc = exports.getAuthorization = exports.AuthorizationType = exports.WpAuthorization = exports.apiKey = exports.vendorAuth = exports.sharedSecret = exports.oidcSvcs = exports.oidcSameProject = exports.jwt = exports.isLocalOnly = exports.WpLocalOnly = exports.WpAuth = exports.WpAuthPublic = exports.QueryParams = exports.QueryString = exports.QueryParam = exports.PathParam = exports.Endpoint = exports.ApiPath = void 0;
 exports.DefaultOidcVerifier = exports.UnverifiableAuthModeError = exports.VENDOR_AUTH_VERIFIER = exports.VendorAuthVerifier = exports.API_KEY_HOOK = exports.ApiKeyHook = exports.OIDC_HOOK = exports.OidcHook = exports.JWT_HOOK = exports.MintedJwt = exports.JwtHook = exports.SharedSecrets = exports.AUTHENTICATED_CALLER_KEY = exports.AuthenticatedMachineIdentity = exports.AuthenticatedCaller = exports.AUTH_CONFIG = exports.AuthConfig = exports.ApiClient = exports.PubSubBindOptions = exports.ClientBindOptions = exports.ContainerBinder = exports.NodeWiringModules = exports.FilterMatcher = exports.LogApiFilter = exports.RouteHandler = exports.MethodMeta = exports.InvocationAuthentication = exports.AuthenticatedCallerContext = exports.WpResponse = exports.RawRequest = exports.HttpRequest = exports.FilterDefinition = exports.RouteDefinition = exports.ApiRoutingFactory = exports.buildFrameworkModule = exports.provideFrameworkSingletonDefaultForApi = exports.provideFrameworkSingleton = exports.provideSingletonDefaultForApi = exports.ROUTING_METADATA_KEYS = exports.SourceFile = exports.isDocumentDesign = exports.DocumentDesign = exports.ExternalContextKeys = exports.EXTERNAL_OUTBOUND = exports.EXTERNAL_INBOUND = exports.CRON = exports.CLOUDTASKS = exports.RPC = exports.NONE = exports.WRITE = void 0;
-exports.WiringPolicy = exports.AuthorizedApiDocument = exports.VerifiedMachineCaller = exports.VERIFIED_MACHINE_CALLER = exports.AUTHORIZATION_HOOK = exports.CanonicalUserRoles = exports.AuthorizationService = exports.AuthorizationHook = exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = exports.RuntimeSetupOptions = exports.setupRuntime = exports.WebpiecesRouterFactory = exports.WebpiecesRouter = exports.DefaultJwtMintRequest = exports.DefaultJwtHook = void 0;
+exports.LazyFeatureDeadline = exports.LazyFeatureTimer = exports.LazyImplementation = exports.LazyController = exports.RuntimeStartupOperation = exports.RuntimeStartupPhase = exports.WiringPolicy = exports.AuthorizedApiDocument = exports.VerifiedMachineCaller = exports.VERIFIED_MACHINE_CALLER = exports.AUTHORIZATION_HOOK = exports.CanonicalUserRoles = exports.AuthorizationService = exports.AuthorizationHook = exports.WEBPIECES_CONFIG_TOKEN = exports.WebpiecesConfig = exports.RuntimeSetupOptions = exports.setupRuntime = exports.WebpiecesRouterFactory = exports.WebpiecesRouter = exports.DefaultJwtMintRequest = exports.DefaultJwtHook = void 0;
 // Re-export API decorators from core-util for convenience
 var core_util_1 = require("@webpieces/core-util");
 Object.defineProperty(exports, "ApiPath", { enumerable: true, get: function () { return core_util_1.ApiPath; } });
@@ -180,4 +180,12 @@ var AuthorizedApiDocument_1 = require("./AuthorizedApiDocument");
 Object.defineProperty(exports, "AuthorizedApiDocument", { enumerable: true, get: function () { return AuthorizedApiDocument_1.AuthorizedApiDocument; } });
 var http_client_core_1 = require("@webpieces/http-client-core");
 Object.defineProperty(exports, "WiringPolicy", { enumerable: true, get: function () { return http_client_core_1.WiringPolicy; } });
+var RuntimeStartupTiming_1 = require("./RuntimeStartupTiming");
+Object.defineProperty(exports, "RuntimeStartupPhase", { enumerable: true, get: function () { return RuntimeStartupTiming_1.RuntimeStartupPhase; } });
+Object.defineProperty(exports, "RuntimeStartupOperation", { enumerable: true, get: function () { return RuntimeStartupTiming_1.RuntimeStartupOperation; } });
+var LazyController_1 = require("./LazyController");
+Object.defineProperty(exports, "LazyController", { enumerable: true, get: function () { return LazyController_1.LazyController; } });
+Object.defineProperty(exports, "LazyImplementation", { enumerable: true, get: function () { return LazyController_1.LazyImplementation; } });
+Object.defineProperty(exports, "LazyFeatureTimer", { enumerable: true, get: function () { return LazyController_1.LazyFeatureTimer; } });
+Object.defineProperty(exports, "LazyFeatureDeadline", { enumerable: true, get: function () { return LazyController_1.LazyFeatureDeadline; } });
 //# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/index.ts"],"names":[],"mappings":";;;;;AAAA,0DAA0D;AAC1D,kDAsD8B;AArD1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,sGAAA,SAAS,OAAA;AACT,uGAAA,UAAU,OAAA;AACV,wGAAA,WAAW,OAAA;AACX,wGAAA,WAAW,OAAA;AACX,yGAAA,YAAY,OAAA;AACZ,mGAAA,MAAM,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,gGAAA,GAAG,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,qGAAA,QAAQ,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,uGAAA,UAAU,OAAA;AAAE,mGAAA,MAAM,OAAA;AAClG,4GAAA,eAAe,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AACpD,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA;AACL,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AACZ,+GAAA,kBAAkB,OAAA;AAClB,kHAAA,qBAAqB,OAAA;AACrB,iHAAA,oBAAoB,OAAA;AACpB,yHAAA,4BAA4B,OAAA;AAC5B,uGAAA,UAAU,OAAA;AACV,sGAAA,SAAS,OAAA;AACT,sGAAA,SAAS,OAAA;AACT,wGAAA,WAAW,OAAA;AACX,2HAAA,8BAA8B,OAAA;AAC9B,uGAAA,UAAU,OAAA;AACV,0GAAA,aAAa,OAAA;AACb,oHAAA,uBAAuB,OAAA;AACvB,yGAAA,YAAY,OAAA;AACZ,qGAAA,QAAQ,OAAA;AACR,0GAAA,aAAa,OAAA;AACb,iHAAA,oBAAoB,OAAA;AACpB,+GAAA,kBAAkB,OAAA;AAClB,0GAAA,aAAa,OAAA;AAEb,gGAAA,GAAG,OAAA;AACH,iGAAA,IAAI,OAAA;AACJ,gGAAA,GAAG,OAAA;AACH,kGAAA,KAAK,OAAA;AACL,mGAAA,MAAM,OAAA;AACN,4GAAA,eAAe,OAAA;AACf,iGAAA,IAAI,OAAA;AACJ,6GAAA,gBAAgB,OAAA;AAChB,kGAAA,KAAK,OAAA;AACL,iGAAA,IAAI,OAAA;AACJ,gGAAA,GAAG,OAAA;AACH,uGAAA,UAAU,OAAA;AACV,iGAAA,IAAI,OAAA;AACJ,6GAAA,gBAAgB,OAAA;AAChB,8GAAA,iBAAiB,OAAA;AACjB,gHAAA,mBAAmB,OAAA;AACnB,2EAA2E;AAC3E,oCAAoC;AACpC,2GAAA,cAAc,OAAA;AACd,6GAAA,gBAAgB,OAAA;AAYpB,+CAA+C;AAC/C,2CAAiE;AAAxD,wGAAA,UAAU,OAAA;AAAE,mHAAA,qBAAqB,OAAA;AAE1C,iFAAiF;AACjF,wDAAwE;AAA/D,6HAAA,6BAA6B,OAAA;AACtC,gGAAgG;AAChG,wDAIiC;AAH7B,yHAAA,yBAAyB,OAAA;AACzB,sIAAA,sCAAsC,OAAA;AACtC,oHAAA,oBAAoB,OAAA;AAGxB,yDAAmE;AAA1D,sHAAA,iBAAiB,OAAA;AAE1B,qBAAqB;AACrB,2CAAuF;AAAxD,6GAAA,eAAe,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AAEhE,sFAAsF;AACtF,+FAA+F;AAC/F,wDAAkF;AAAzE,2GAAA,WAAW,OAAA;AAAkB,0GAAA,UAAU,OAAA;AAEhD,+FAA+F;AAC/F,gGAAgG;AAChG,gFAAgF;AAChF,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,2EAA0E;AAAjE,wIAAA,0BAA0B,OAAA;AACnC,uEAAsE;AAA7D,oIAAA,wBAAwB,OAAA;AACjC,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,wFAAwF;AACxF,0FAA0F;AAC1F,uDAAsD;AAA7C,4GAAA,YAAY,OAAA;AAErB,oFAAoF;AACpF,sFAAsF;AAEtF,kBAAkB;AAClB,iDAA4D;AAAnD,8GAAA,aAAa,OAAA;AAItB,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAG1B,mCAAiF;AAAxE,yGAAA,eAAe,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AAI9D,yCAAwD;AAA/C,sGAAA,SAAS,OAAA;AAElB,mFAAmF;AACnF,iEAAiE;AACjE,4FAA4F;AAC5F,gGAAgG;AAChG,mGAAmG;AACnG,4FAA4F;AAC5F,2CAOsB;AANlB,wGAAA,UAAU,OAAA;AACV,yGAAA,WAAW,OAAA;AACX,iHAAA,mBAAmB,OAAA;AACnB,0HAAA,4BAA4B,OAAA;AAC5B,sHAAA,wBAAwB,OAAA;AACxB,2GAAA,aAAa,OAAA;AAEjB,yCAQqB;AAPjB,oGAAA,OAAO,OAAA;AACP,sGAAA,SAAS,OAAA;AACT,qGAAA,QAAQ,OAAA;AACR,qGAAA,QAAQ,OAAA;AACR,sGAAA,SAAS,OAAA;AACT,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AAEhB,0FAA0F;AAC1F,oFAAoF;AACpF,6FAA6F;AAC7F,wDAAmF;AAA1E,kHAAA,kBAAkB,OAAA;AAAE,oHAAA,oBAAoB,OAAA;AACjD,yEAAwE;AAA/D,sIAAA,yBAAyB,OAAA;AAClC,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAC5B,0FAA0F;AAC1F,mDAAyE;AAAhE,gHAAA,cAAc,OAAA;AAAE,uHAAA,qBAAqB,OAAA;AAE9C,kEAAkE;AAElE,0FAA0F;AAC1F,qDAAoG;AAA3F,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAEhD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAAmE;AAA1D,4GAAA,YAAY,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAE1C,uBAAuB;AACvB,qDAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAGhD,yDAAsK;AAA7J,sHAAA,iBAAiB,OAAA;AAAE,yHAAA,oBAAoB,OAAA;AAAE,uHAAA,kBAAkB,OAAA;AAAE,uHAAA,kBAAkB,OAAA;AAAE,4HAAA,uBAAuB,OAAA;AAAE,0HAAA,qBAAqB,OAAA;AACxI,iEAAgE;AAAvD,8HAAA,qBAAqB,OAAA;AAG9B,gEAA2D;AAAlD,gHAAA,YAAY,OAAA","sourcesContent":["// Re-export API decorators from core-util for convenience\nexport {\n    ApiPath,\n    Endpoint,\n    PathParam,\n    QueryParam,\n    QueryString,\n    QueryParams,\n    WpAuthPublic,\n    WpAuth, WpLocalOnly, isLocalOnly, jwt, oidcSameProject, oidcSvcs, sharedSecret, vendorAuth, apiKey,\n    WpAuthorization, AuthorizationType, getAuthorization,\n    Rpc,\n    PubSub,\n    Queue,\n    getApiPath,\n    getEndpoints,\n    getEndpointOptions,\n    getEndpointHttpMethod,\n    getEndpointOperation,\n    getHttpParameterDeclarations,\n    isFormPost,\n    isRawBody,\n    isApiPath,\n    getAuthMeta,\n    assertEveryEndpointHasAuthMode,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n    AuthMeta,\n    RouteMetadata,\n    RouteMetadataFactory,\n    HttpContractMapper,\n    METADATA_KEYS,\n    ValidateImplementation,\n    GET,\n    POST,\n    PUT,\n    PATCH,\n    DELETE,\n    verbCarriesBody,\n    READ,\n    WRITE_IDEMPOTENT,\n    WRITE,\n    NONE,\n    RPC,\n    CLOUDTASKS,\n    CRON,\n    EXTERNAL_INBOUND,\n    EXTERNAL_OUTBOUND,\n    ExternalContextKeys,\n    // @DocumentDesign moved to core-util (design-root marker, browser + Node);\n    // re-exported here for back-compat.\n    DocumentDesign,\n    isDocumentDesign,\n} from '@webpieces/core-util';\nexport type {\n    AuthMode,\n    ApiKind,\n    HttpMethod,\n    EndpointOperation,\n    EndpointKind,\n    EndpointOptions,\n    EndpointResponseType,\n} from '@webpieces/core-util';\n\n// Server-side routing decorators and utilities\nexport { SourceFile, ROUTING_METADATA_KEYS } from './decorators';\n\n// DI provider decorators moved to core-context; re-exported here for back-compat\nexport { provideSingletonDefaultForApi } from '@webpieces/core-context';\n// Framework-only DI registry (packages/** framework classes use these; see frameworkProvide.ts)\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonDefaultForApi,\n    buildFrameworkModule,\n} from '@webpieces/core-context';\n\nexport { ApiRoutingFactory, ClassType } from './ApiRoutingFactory';\n\n// Core routing types\nexport { Routes, RouteBuilder, RouteDefinition, FilterDefinition } from './WebAppMeta';\n\n// The transport-neutral request type (defined in core-context; this is http-routing's\n// public request — a transport adapter builds one and the chain reads it from RequestContext).\nexport { HttpRequest, RawHttpRequest, RawRequest } from '@webpieces/core-context';\n\n// The INBOUND chain's response type. `Filter`, `Service` and `FilterChain` are NOT re-exported\n// here: they moved to @webpieces/core-util so the outbound client chain is the SAME abstraction\n// rather than a second spelling of it. Import them from '@webpieces/core-util'.\nexport { WpResponse } from './WpResponse';\nexport { AuthenticatedCallerContext } from './AuthenticatedCallerContext';\nexport { InvocationAuthentication } from './InvocationAuthentication';\nexport { MethodMeta } from './MethodMeta';\nexport { RouteHandler } from './RouteHandler';\n\n// LogApiFilter: the fixed OUTERMOST framework filter (auto-installed at 1,000,000 above\n// AuthFilter). Exported for reference/testing only — apps must NOT install it themselves.\nexport { LogApiFilter } from './filters/LogApiFilter';\n\n// RouteBuilderImpl (the route table + chain composer) is now INTERNAL — it is never\n// handed to upper layers. The express layer consumes ApiFactory.apiClients() instead.\n\n// Filter matching\nexport { FilterMatcher, HttpFilter } from './FilterMatcher';\n\n// The app's server-surface declaration: DI bind modules + route groups + headers.\nexport type { Wiring, AppWiring, BindModule, RouteModule } from './Wiring';\nexport { NodeWiringModules } from './Wiring';\n// The Node binder every BindModule.configure receives.\nexport type { Binder } from './Binder';\nexport { ContainerBinder, ClientBindOptions, PubSubBindOptions } from './Binder';\n\n// The public API-surface abstraction: declare routes/filters, get them back as ApiClient[].\nexport { ApiFactory } from './ApiFactory';\nexport { ApiClient, ApiClientProxy } from './ApiClient';\n\n// Auth: the app-provided, container-bound pieces the framework AuthFilter injects.\n//  - AuthConfig: shared-secret STATE (sharedSecret(...) values).\n//  - JwtHook / OidcHook / VendorAuthVerifier / ApiKeyHook: OPTIONAL verification mechanisms\n//    (bind only what your served routes declare; a served route declaring a mode whose piece is\n//    unbound FAILS STARTUP with UnverifiableAuthModeError naming the binding, never open — #1362).\n//  - DefaultOidcVerifier: the built-in Google OIDC verifier used when no OidcHook is bound.\nexport {\n    AuthConfig,\n    AUTH_CONFIG,\n    AuthenticatedCaller,\n    AuthenticatedMachineIdentity,\n    AUTHENTICATED_CALLER_KEY,\n    SharedSecrets,\n} from './AuthConfig';\nexport {\n    JwtHook,\n    MintedJwt,\n    JWT_HOOK,\n    OidcHook,\n    OIDC_HOOK,\n    ApiKeyHook,\n    API_KEY_HOOK,\n} from './AuthHooks';\n// vendorAuth(name), INBOUND role: the verifier this server's AuthFilter calls. Defined in\n// @webpieces/core-context beside its OUTBOUND twin VendorAuthMinter (re-exported by\n// @webpieces/http-client-node); the two are independent DI roles, never one binding (#1358).\nexport { VendorAuthVerifier, VENDOR_AUTH_VERIFIER } from '@webpieces/core-context';\nexport { UnverifiableAuthModeError } from './UnverifiableAuthModeError';\nexport { DefaultOidcVerifier } from './DefaultOidcVerifier';\n// DefaultJwtHook: batteries-included HS256 JwtHook — `new DefaultJwtHook(secret)` and go.\nexport { DefaultJwtHook, DefaultJwtMintRequest } from './DefaultJwtHook';\n\n// Above-boundary context setup shared by every transport adapter.\n\n// Node-only router (the express-free heart: container + filter chain + in-process client)\nexport { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';\n\n// The ONE transport-free startup sequence (headers → logging → router → routes) → ApiFactory.\n// Reusable by any company/app and any framework adapter; a company wraps it with its own headers.\nexport { setupRuntime, RuntimeSetupOptions } from './setupRuntime';\n\n// Server configuration\nexport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\n\n\nexport { AuthorizationHook, AuthorizationService, CanonicalUserRoles, AUTHORIZATION_HOOK, VERIFIED_MACHINE_CALLER, VerifiedMachineCaller } from './AuthorizationHook';\nexport { AuthorizedApiDocument } from './AuthorizedApiDocument';\nexport type { ApiDocumentObject, ApiDocumentValue } from './AuthorizedApiDocument';\n\nexport { WiringPolicy } from '@webpieces/http-client-core';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-routing/src/index.ts"],"names":[],"mappings":";;;;;AAAA,0DAA0D;AAC1D,kDAsD8B;AArD1B,oGAAA,OAAO,OAAA;AACP,qGAAA,QAAQ,OAAA;AACR,sGAAA,SAAS,OAAA;AACT,uGAAA,UAAU,OAAA;AACV,wGAAA,WAAW,OAAA;AACX,wGAAA,WAAW,OAAA;AACX,yGAAA,YAAY,OAAA;AACZ,mGAAA,MAAM,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,gGAAA,GAAG,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,qGAAA,QAAQ,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,uGAAA,UAAU,OAAA;AAAE,mGAAA,MAAM,OAAA;AAClG,4GAAA,eAAe,OAAA;AAAE,8GAAA,iBAAiB,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AACpD,gGAAA,GAAG,OAAA;AACH,mGAAA,MAAM,OAAA;AACN,kGAAA,KAAK,OAAA;AACL,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AACZ,+GAAA,kBAAkB,OAAA;AAClB,kHAAA,qBAAqB,OAAA;AACrB,iHAAA,oBAAoB,OAAA;AACpB,yHAAA,4BAA4B,OAAA;AAC5B,uGAAA,UAAU,OAAA;AACV,sGAAA,SAAS,OAAA;AACT,sGAAA,SAAS,OAAA;AACT,wGAAA,WAAW,OAAA;AACX,2HAAA,8BAA8B,OAAA;AAC9B,uGAAA,UAAU,OAAA;AACV,0GAAA,aAAa,OAAA;AACb,oHAAA,uBAAuB,OAAA;AACvB,yGAAA,YAAY,OAAA;AACZ,qGAAA,QAAQ,OAAA;AACR,0GAAA,aAAa,OAAA;AACb,iHAAA,oBAAoB,OAAA;AACpB,+GAAA,kBAAkB,OAAA;AAClB,0GAAA,aAAa,OAAA;AAEb,gGAAA,GAAG,OAAA;AACH,iGAAA,IAAI,OAAA;AACJ,gGAAA,GAAG,OAAA;AACH,kGAAA,KAAK,OAAA;AACL,mGAAA,MAAM,OAAA;AACN,4GAAA,eAAe,OAAA;AACf,iGAAA,IAAI,OAAA;AACJ,6GAAA,gBAAgB,OAAA;AAChB,kGAAA,KAAK,OAAA;AACL,iGAAA,IAAI,OAAA;AACJ,gGAAA,GAAG,OAAA;AACH,uGAAA,UAAU,OAAA;AACV,iGAAA,IAAI,OAAA;AACJ,6GAAA,gBAAgB,OAAA;AAChB,8GAAA,iBAAiB,OAAA;AACjB,gHAAA,mBAAmB,OAAA;AACnB,2EAA2E;AAC3E,oCAAoC;AACpC,2GAAA,cAAc,OAAA;AACd,6GAAA,gBAAgB,OAAA;AAYpB,+CAA+C;AAC/C,2CAAiE;AAAxD,wGAAA,UAAU,OAAA;AAAE,mHAAA,qBAAqB,OAAA;AAE1C,iFAAiF;AACjF,wDAAwE;AAA/D,6HAAA,6BAA6B,OAAA;AACtC,gGAAgG;AAChG,wDAIiC;AAH7B,yHAAA,yBAAyB,OAAA;AACzB,sIAAA,sCAAsC,OAAA;AACtC,oHAAA,oBAAoB,OAAA;AAGxB,yDAAwD;AAA/C,sHAAA,iBAAiB,OAAA;AAG1B,qBAAqB;AACrB,2CAAuF;AAAxD,6GAAA,eAAe,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AAEhE,sFAAsF;AACtF,+FAA+F;AAC/F,wDAAkF;AAAzE,2GAAA,WAAW,OAAA;AAAkB,0GAAA,UAAU,OAAA;AAEhD,+FAA+F;AAC/F,gGAAgG;AAChG,gFAAgF;AAChF,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,2EAA0E;AAAjE,wIAAA,0BAA0B,OAAA;AACnC,uEAAsE;AAA7D,oIAAA,wBAAwB,OAAA;AACjC,2CAA0C;AAAjC,wGAAA,UAAU,OAAA;AACnB,+CAA8C;AAArC,4GAAA,YAAY,OAAA;AAErB,wFAAwF;AACxF,0FAA0F;AAC1F,uDAAsD;AAA7C,4GAAA,YAAY,OAAA;AAErB,oFAAoF;AACpF,sFAAsF;AAEtF,kBAAkB;AAClB,iDAA4D;AAAnD,8GAAA,aAAa,OAAA;AAKtB,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAG1B,mCAAiF;AAAxE,yGAAA,eAAe,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AAAE,2GAAA,iBAAiB,OAAA;AAI9D,yCAAwD;AAA/C,sGAAA,SAAS,OAAA;AAElB,mFAAmF;AACnF,iEAAiE;AACjE,4FAA4F;AAC5F,gGAAgG;AAChG,mGAAmG;AACnG,4FAA4F;AAC5F,2CAOsB;AANlB,wGAAA,UAAU,OAAA;AACV,yGAAA,WAAW,OAAA;AACX,iHAAA,mBAAmB,OAAA;AACnB,0HAAA,4BAA4B,OAAA;AAC5B,sHAAA,wBAAwB,OAAA;AACxB,2GAAA,aAAa,OAAA;AAEjB,yCAQqB;AAPjB,oGAAA,OAAO,OAAA;AACP,sGAAA,SAAS,OAAA;AACT,qGAAA,QAAQ,OAAA;AACR,qGAAA,QAAQ,OAAA;AACR,sGAAA,SAAS,OAAA;AACT,uGAAA,UAAU,OAAA;AACV,yGAAA,YAAY,OAAA;AAEhB,0FAA0F;AAC1F,oFAAoF;AACpF,6FAA6F;AAC7F,wDAAmF;AAA1E,kHAAA,kBAAkB,OAAA;AAAE,oHAAA,oBAAoB,OAAA;AACjD,yEAAwE;AAA/D,sIAAA,yBAAyB,OAAA;AAClC,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAC5B,0FAA0F;AAC1F,mDAAyE;AAAhE,gHAAA,cAAc,OAAA;AAAE,uHAAA,qBAAqB,OAAA;AAE9C,kEAAkE;AAElE,0FAA0F;AAC1F,qDAAoG;AAA3F,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAEhD,8FAA8F;AAC9F,kGAAkG;AAClG,+CAAmE;AAA1D,4GAAA,YAAY,OAAA;AAAE,mHAAA,mBAAmB,OAAA;AAE1C,uBAAuB;AACvB,qDAA4E;AAAnE,kHAAA,eAAe,OAAA;AAAE,yHAAA,sBAAsB,OAAA;AAGhD,yDAAsK;AAA7J,sHAAA,iBAAiB,OAAA;AAAE,yHAAA,oBAAoB,OAAA;AAAE,uHAAA,kBAAkB,OAAA;AAAE,uHAAA,kBAAkB,OAAA;AAAE,4HAAA,uBAAuB,OAAA;AAAE,0HAAA,qBAAqB,OAAA;AACxI,iEAAgE;AAAvD,8HAAA,qBAAqB,OAAA;AAG9B,gEAA2D;AAAlD,gHAAA,YAAY,OAAA;AAErB,+DAAsF;AAA7E,2HAAA,mBAAmB,OAAA;AAAE,+HAAA,uBAAuB,OAAA;AAGrD,mDAA6G;AAApG,gHAAA,cAAc,OAAA;AAAE,oHAAA,kBAAkB,OAAA;AAAE,kHAAA,gBAAgB,OAAA;AAAE,qHAAA,mBAAmB,OAAA","sourcesContent":["// Re-export API decorators from core-util for convenience\nexport {\n    ApiPath,\n    Endpoint,\n    PathParam,\n    QueryParam,\n    QueryString,\n    QueryParams,\n    WpAuthPublic,\n    WpAuth, WpLocalOnly, isLocalOnly, jwt, oidcSameProject, oidcSvcs, sharedSecret, vendorAuth, apiKey,\n    WpAuthorization, AuthorizationType, getAuthorization,\n    Rpc,\n    PubSub,\n    Queue,\n    getApiPath,\n    getEndpoints,\n    getEndpointOptions,\n    getEndpointHttpMethod,\n    getEndpointOperation,\n    getHttpParameterDeclarations,\n    isFormPost,\n    isRawBody,\n    isApiPath,\n    getAuthMeta,\n    assertEveryEndpointHasAuthMode,\n    getApiKind,\n    assertApiKind,\n    assertPubSubConventions,\n    getQueueName,\n    AuthMeta,\n    RouteMetadata,\n    RouteMetadataFactory,\n    HttpContractMapper,\n    METADATA_KEYS,\n    ValidateImplementation,\n    GET,\n    POST,\n    PUT,\n    PATCH,\n    DELETE,\n    verbCarriesBody,\n    READ,\n    WRITE_IDEMPOTENT,\n    WRITE,\n    NONE,\n    RPC,\n    CLOUDTASKS,\n    CRON,\n    EXTERNAL_INBOUND,\n    EXTERNAL_OUTBOUND,\n    ExternalContextKeys,\n    // @DocumentDesign moved to core-util (design-root marker, browser + Node);\n    // re-exported here for back-compat.\n    DocumentDesign,\n    isDocumentDesign,\n} from '@webpieces/core-util';\nexport type {\n    AuthMode,\n    ApiKind,\n    HttpMethod,\n    EndpointOperation,\n    EndpointKind,\n    EndpointOptions,\n    EndpointResponseType,\n} from '@webpieces/core-util';\n\n// Server-side routing decorators and utilities\nexport { SourceFile, ROUTING_METADATA_KEYS } from './decorators';\n\n// DI provider decorators moved to core-context; re-exported here for back-compat\nexport { provideSingletonDefaultForApi } from '@webpieces/core-context';\n// Framework-only DI registry (packages/** framework classes use these; see frameworkProvide.ts)\nexport {\n    provideFrameworkSingleton,\n    provideFrameworkSingletonDefaultForApi,\n    buildFrameworkModule,\n} from '@webpieces/core-context';\n\nexport { ApiRoutingFactory } from './ApiRoutingFactory';\nexport type { ClassType } from './ClassType';\n\n// Core routing types\nexport { Routes, RouteBuilder, RouteDefinition, FilterDefinition } from './WebAppMeta';\n\n// The transport-neutral request type (defined in core-context; this is http-routing's\n// public request — a transport adapter builds one and the chain reads it from RequestContext).\nexport { HttpRequest, RawHttpRequest, RawRequest } from '@webpieces/core-context';\n\n// The INBOUND chain's response type. `Filter`, `Service` and `FilterChain` are NOT re-exported\n// here: they moved to @webpieces/core-util so the outbound client chain is the SAME abstraction\n// rather than a second spelling of it. Import them from '@webpieces/core-util'.\nexport { WpResponse } from './WpResponse';\nexport { AuthenticatedCallerContext } from './AuthenticatedCallerContext';\nexport { InvocationAuthentication } from './InvocationAuthentication';\nexport { MethodMeta } from './MethodMeta';\nexport { RouteHandler } from './RouteHandler';\n\n// LogApiFilter: the fixed OUTERMOST framework filter (auto-installed at 1,000,000 above\n// AuthFilter). Exported for reference/testing only — apps must NOT install it themselves.\nexport { LogApiFilter } from './filters/LogApiFilter';\n\n// RouteBuilderImpl (the route table + chain composer) is now INTERNAL — it is never\n// handed to upper layers. The express layer consumes ApiFactory.apiClients() instead.\n\n// Filter matching\nexport { FilterMatcher, HttpFilter } from './FilterMatcher';\n\n// The app's server-surface declaration: DI bind modules + route groups + headers.\nexport type { Wiring, AppWiring, RouteModule } from './Wiring';\nexport type { BindModule } from './BindModule';\nexport { NodeWiringModules } from './Wiring';\n// The Node binder every BindModule.configure receives.\nexport type { Binder } from './Binder';\nexport { ContainerBinder, ClientBindOptions, PubSubBindOptions } from './Binder';\n\n// The public API-surface abstraction: declare routes/filters, get them back as ApiClient[].\nexport { ApiFactory } from './ApiFactory';\nexport { ApiClient, ApiClientProxy } from './ApiClient';\n\n// Auth: the app-provided, container-bound pieces the framework AuthFilter injects.\n//  - AuthConfig: shared-secret STATE (sharedSecret(...) values).\n//  - JwtHook / OidcHook / VendorAuthVerifier / ApiKeyHook: OPTIONAL verification mechanisms\n//    (bind only what your served routes declare; a served route declaring a mode whose piece is\n//    unbound FAILS STARTUP with UnverifiableAuthModeError naming the binding, never open — #1362).\n//  - DefaultOidcVerifier: the built-in Google OIDC verifier used when no OidcHook is bound.\nexport {\n    AuthConfig,\n    AUTH_CONFIG,\n    AuthenticatedCaller,\n    AuthenticatedMachineIdentity,\n    AUTHENTICATED_CALLER_KEY,\n    SharedSecrets,\n} from './AuthConfig';\nexport {\n    JwtHook,\n    MintedJwt,\n    JWT_HOOK,\n    OidcHook,\n    OIDC_HOOK,\n    ApiKeyHook,\n    API_KEY_HOOK,\n} from './AuthHooks';\n// vendorAuth(name), INBOUND role: the verifier this server's AuthFilter calls. Defined in\n// @webpieces/core-context beside its OUTBOUND twin VendorAuthMinter (re-exported by\n// @webpieces/http-client-node); the two are independent DI roles, never one binding (#1358).\nexport { VendorAuthVerifier, VENDOR_AUTH_VERIFIER } from '@webpieces/core-context';\nexport { UnverifiableAuthModeError } from './UnverifiableAuthModeError';\nexport { DefaultOidcVerifier } from './DefaultOidcVerifier';\n// DefaultJwtHook: batteries-included HS256 JwtHook — `new DefaultJwtHook(secret)` and go.\nexport { DefaultJwtHook, DefaultJwtMintRequest } from './DefaultJwtHook';\n\n// Above-boundary context setup shared by every transport adapter.\n\n// Node-only router (the express-free heart: container + filter chain + in-process client)\nexport { WebpiecesRouter, WebpiecesRouterFactory, WebpiecesRouterOptions } from './WebpiecesRouter';\n\n// The ONE transport-free startup sequence (headers → logging → router → routes) → ApiFactory.\n// Reusable by any company/app and any framework adapter; a company wraps it with its own headers.\nexport { setupRuntime, RuntimeSetupOptions } from './setupRuntime';\n\n// Server configuration\nexport { WebpiecesConfig, WEBPIECES_CONFIG_TOKEN } from './WebpiecesConfig';\n\n\nexport { AuthorizationHook, AuthorizationService, CanonicalUserRoles, AUTHORIZATION_HOOK, VERIFIED_MACHINE_CALLER, VerifiedMachineCaller } from './AuthorizationHook';\nexport { AuthorizedApiDocument } from './AuthorizedApiDocument';\nexport type { ApiDocumentObject, ApiDocumentValue } from './AuthorizedApiDocument';\n\nexport { WiringPolicy } from '@webpieces/http-client-core';\n\nexport { RuntimeStartupPhase, RuntimeStartupOperation } from './RuntimeStartupTiming';\nexport type { RuntimeStartupObserver, RuntimeStartupSpan } from './RuntimeStartupTiming';\n\nexport { LazyController, LazyImplementation, LazyFeatureTimer, LazyFeatureDeadline } from './LazyController';\n"]}