@webpieces/http-server 0.3.293 → 0.3.297

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webpieces/http-server",
-  "version": "0.3.293",
+  "version": "0.3.297",
   "description": "WebPieces server with filter chain and dependency injection",
   "type": "commonjs",
   "main": "./src/index.js",
@@ -22,11 +22,10 @@
     "access": "public"
   },
   "dependencies": {
-    "@webpieces/core-context": "0.3.293",
-    "@webpieces/core-util": "0.3.293",
-    "@webpieces/gcp-identity": "0.3.293",
-    "@webpieces/http-filters": "0.3.293",
-    "@webpieces/http-routing": "0.3.293",
+    "@webpieces/core-context": "0.3.297",
+    "@webpieces/core-util": "0.3.297",
+    "@webpieces/gcp-identity": "0.3.297",
+    "@webpieces/http-routing": "0.3.297",
     "cors": "2.8.5",
     "express": "5.1.0",
     "inversify": "7.10.4"

package/src/WebpiecesExpressRouter.d.ts

@@ -0,0 +1,51 @@
+import { Express } from 'express';
+import { ApiFactory } from '@webpieces/http-routing';
+/** The value returned by express `app.listen(...)` (a node http.Server). */
+type HttpServer = ReturnType<Express['listen']>;
+/**
+ * WebpiecesExpressRouter - the express layer that sits ON TOP of a node-only
+ * {@link ApiFactory} (a WebpiecesRouter). It is the ONLY place express lifecycle lives.
+ *
+ * It never reaches into routing internals: it asks the ApiFactory for `apiClients()` — each
+ * an api + routeMeta + composed filter-chain→controller impl — and binds each to an express
+ * route (`app.<verb>(path, handler)`) invoked when the matching HTTP request arrives. The
+ * RouteBuilder stays hidden inside the ApiFactory.
+ *
+ * ```typescript
+ * const apiFactory = await WebpiecesRouterFactory.create(config, { appBindings });
+ * apiFactory.addRoutes(SaveApi, SaveController);
+ * const express = new WebpiecesExpressRouter(apiFactory);
+ *
+ * // legacy / side-by-side: mount onto an existing app; you own listen + your middleware
+ * express.bindExpress(existingApp);
+ *
+ * // non-legacy: add webpieces global middleware + listen for you
+ * await express.bindAndStartExpress(express(), 8080);
+ * ```
+ */
+export declare class WebpiecesExpressRouter {
+    private readonly apiFactory;
+    private readonly middleware;
+    constructor(apiFactory: ApiFactory);
+    /**
+     * Mount the webpieces routes (each fully self-contained: own body parse, RequestContext,
+     * express-tier + api-tier filter chain, error→JSON) onto the caller's express app.
+     *
+     * Adds NO global app.use() middleware, so it is safe to attach to a legacy app whose other
+     * routes must stay untouched. The caller owns app.listen() and any global middleware.
+     */
+    bindExpress(app: Express): void;
+    /**
+     * Add the webpieces global middleware (HTML error page, localhost CORS, request logging),
+     * bind the routes, then app.listen(port). Convenience for a non-legacy webpieces server
+     * where webpieces owns the whole express app. Resolves with the http.Server once listening.
+     */
+    bindAndStartExpress(app: Express, port?: number): Promise<HttpServer>;
+    /**
+     * Wrap one ApiClient's impl in an express handler (RequestContext.run, header read, manual
+     * JSON body parse, error→ProtocolError) and register it on the app for its method + path.
+     */
+    private mountApiClient;
+    private registerHandler;
+}
+export {};

package/src/WebpiecesExpressRouter.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WebpiecesExpressRouter = void 0;
+const core_util_1 = require("@webpieces/core-util");
+const WebpiecesMiddleware_1 = require("./WebpiecesMiddleware");
+const log = core_util_1.LogManager.getLogger('WebpiecesExpressRouter');
+/**
+ * WebpiecesExpressRouter - the express layer that sits ON TOP of a node-only
+ * {@link ApiFactory} (a WebpiecesRouter). It is the ONLY place express lifecycle lives.
+ *
+ * It never reaches into routing internals: it asks the ApiFactory for `apiClients()` — each
+ * an api + routeMeta + composed filter-chain→controller impl — and binds each to an express
+ * route (`app.<verb>(path, handler)`) invoked when the matching HTTP request arrives. The
+ * RouteBuilder stays hidden inside the ApiFactory.
+ *
+ * ```typescript
+ * const apiFactory = await WebpiecesRouterFactory.create(config, { appBindings });
+ * apiFactory.addRoutes(SaveApi, SaveController);
+ * const express = new WebpiecesExpressRouter(apiFactory);
+ *
+ * // legacy / side-by-side: mount onto an existing app; you own listen + your middleware
+ * express.bindExpress(existingApp);
+ *
+ * // non-legacy: add webpieces global middleware + listen for you
+ * await express.bindAndStartExpress(express(), 8080);
+ * ```
+ */
+class WebpiecesExpressRouter {
+    apiFactory;
+    middleware = new WebpiecesMiddleware_1.WebpiecesMiddleware();
+    constructor(apiFactory) {
+        this.apiFactory = apiFactory;
+    }
+    /**
+     * Mount the webpieces routes (each fully self-contained: own body parse, RequestContext,
+     * express-tier + api-tier filter chain, error→JSON) onto the caller's express app.
+     *
+     * Adds NO global app.use() middleware, so it is safe to attach to a legacy app whose other
+     * routes must stay untouched. The caller owns app.listen() and any global middleware.
+     */
+    bindExpress(app) {
+        const apiClients = this.apiFactory.apiClients();
+        for (const apiClient of apiClients) {
+            this.mountApiClient(app, apiClient);
+        }
+        log.info(`[WebpiecesExpressRouter] Mounted ${apiClients.length} webpieces route(s) onto express`);
+    }
+    /**
+     * Add the webpieces global middleware (HTML error page, localhost CORS, request logging),
+     * bind the routes, then app.listen(port). Convenience for a non-legacy webpieces server
+     * where webpieces owns the whole express app. Resolves with the http.Server once listening.
+     */
+    async bindAndStartExpress(app, port = 8080) {
+        // Global middleware layers (outermost first) — only for a webpieces-owned app.
+        app.use(this.middleware.globalErrorHandler.bind(this.middleware));
+        app.use(this.middleware.corsForLocalhost());
+        app.use(this.middleware.logNextLayer.bind(this.middleware));
+        this.bindExpress(app);
+        return new Promise((resolve, reject) => {
+            const server = app.listen(port, (error) => {
+                if (error) {
+                    log.error(`[WebpiecesExpressRouter] Failed to start on port ${port}:`, error);
+                    reject(error);
+                    return;
+                }
+                log.info(`[WebpiecesExpressRouter] Listening on http://localhost:${port}`);
+                resolve(server);
+            });
+        });
+    }
+    /**
+     * Wrap one ApiClient's impl in an express handler (RequestContext.run, header read, manual
+     * JSON body parse, error→ProtocolError) and register it on the app for its method + path.
+     */
+    mountApiClient(app, apiClient) {
+        const wrapper = this.middleware.createExpressWrapper(apiClient.impl, apiClient.routeMeta);
+        this.registerHandler(app, apiClient.routeMeta.httpMethod, apiClient.routeMeta.path, wrapper.execute.bind(wrapper));
+    }
+    registerHandler(app, httpMethod, path, expressHandler) {
+        switch (httpMethod.toLowerCase()) {
+            case 'get':
+                app.get(path, expressHandler);
+                break;
+            case 'post':
+                app.post(path, expressHandler);
+                break;
+            case 'put':
+                app.put(path, expressHandler);
+                break;
+            case 'delete':
+                app.delete(path, expressHandler);
+                break;
+            case 'patch':
+                app.patch(path, expressHandler);
+                break;
+            default:
+                log.warn(`[WebpiecesExpressRouter] Unknown HTTP method: ${httpMethod}`);
+        }
+    }
+}
+exports.WebpiecesExpressRouter = WebpiecesExpressRouter;
+//# sourceMappingURL=WebpiecesExpressRouter.js.map

package/src/WebpiecesExpressRouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"WebpiecesExpressRouter.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/WebpiecesExpressRouter.ts"],"names":[],"mappings":";;;AAEA,oDAAkD;AAClD,+DAAiF;AAEjF,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;AAK3D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAa,sBAAsB;IAGF;IAFZ,UAAU,GAAG,IAAI,yCAAmB,EAAE,CAAC;IAExD,YAA6B,UAAsB;QAAtB,eAAU,GAAV,UAAU,CAAY;IAAG,CAAC;IAEvD;;;;;;OAMG;IACH,WAAW,CAAC,GAAY;QACpB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;QAChD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACxC,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,oCAAoC,UAAU,CAAC,MAAM,kCAAkC,CAAC,CAAC;IACtG,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,OAAe,IAAI;QACvD,+EAA+E;QAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtB,OAAO,IAAI,OAAO,CACd,CAAC,OAAqC,EAAE,MAA4B,EAAE,EAAE;YACpE,MAAM,MAAM,GAAe,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC1D,IAAI,KAAK,EAAE,CAAC;oBACR,GAAG,CAAC,KAAK,CAAC,oDAAoD,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC9E,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;gBACX,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,0DAA0D,IAAI,EAAE,CAAC,CAAC;gBAC3E,OAAO,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACP,CAAC,CACJ,CAAC;IACN,CAAC;IAED;;;OAGG;IACK,cAAc,CAAC,GAAY,EAAE,SAAoB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QAC1F,IAAI,CAAC,eAAe,CAChB,GAAG,EACH,SAAS,CAAC,SAAS,CAAC,UAAU,EAC9B,SAAS,CAAC,SAAS,CAAC,IAAI,EACxB,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAChC,CAAC;IACN,CAAC;IAEO,eAAe,CACnB,GAAY,EACZ,UAAkB,EAClB,IAAY,EACZ,cAAmC;QAEnC,QAAQ,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,KAAK,KAAK;gBACN,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBAC9B,MAAM;YACV,KAAK,MAAM;gBACP,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBAC/B,MAAM;YACV,KAAK,KAAK;gBACN,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBAC9B,MAAM;YACV,KAAK,QAAQ;gBACT,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACjC,MAAM;YACV,KAAK,OAAO;gBACR,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBAChC,MAAM;YACV;gBACI,GAAG,CAAC,IAAI,CAAC,iDAAiD,UAAU,EAAE,CAAC,CAAC;QAChF,CAAC;IACL,CAAC;CACJ;AAxFD,wDAwFC","sourcesContent":["import { Express } from 'express';\nimport { ApiFactory, ApiClient } from '@webpieces/http-routing';\nimport { LogManager } from '@webpieces/core-util';\nimport { WebpiecesMiddleware, ExpressRouteHandler } from './WebpiecesMiddleware';\n\nconst log = LogManager.getLogger('WebpiecesExpressRouter');\n\n/** The value returned by express `app.listen(...)` (a node http.Server). */\ntype HttpServer = ReturnType<Express['listen']>;\n\n/**\n * WebpiecesExpressRouter - the express layer that sits ON TOP of a node-only\n * {@link ApiFactory} (a WebpiecesRouter). It is the ONLY place express lifecycle lives.\n *\n * It never reaches into routing internals: it asks the ApiFactory for `apiClients()` — each\n * an api + routeMeta + composed filter-chain→controller impl — and binds each to an express\n * route (`app.<verb>(path, handler)`) invoked when the matching HTTP request arrives. The\n * RouteBuilder stays hidden inside the ApiFactory.\n *\n * ```typescript\n * const apiFactory = await WebpiecesRouterFactory.create(config, { appBindings });\n * apiFactory.addRoutes(SaveApi, SaveController);\n * const express = new WebpiecesExpressRouter(apiFactory);\n *\n * // legacy / side-by-side: mount onto an existing app; you own listen + your middleware\n * express.bindExpress(existingApp);\n *\n * // non-legacy: add webpieces global middleware + listen for you\n * await express.bindAndStartExpress(express(), 8080);\n * ```\n */\nexport class WebpiecesExpressRouter {\n    private readonly middleware = new WebpiecesMiddleware();\n\n    constructor(private readonly apiFactory: ApiFactory) {}\n\n    /**\n     * Mount the webpieces routes (each fully self-contained: own body parse, RequestContext,\n     * express-tier + api-tier filter chain, error→JSON) onto the caller's express app.\n     *\n     * Adds NO global app.use() middleware, so it is safe to attach to a legacy app whose other\n     * routes must stay untouched. The caller owns app.listen() and any global middleware.\n     */\n    bindExpress(app: Express): void {\n        const apiClients = this.apiFactory.apiClients();\n        for (const apiClient of apiClients) {\n            this.mountApiClient(app, apiClient);\n        }\n        log.info(`[WebpiecesExpressRouter] Mounted ${apiClients.length} webpieces route(s) onto express`);\n    }\n\n    /**\n     * Add the webpieces global middleware (HTML error page, localhost CORS, request logging),\n     * bind the routes, then app.listen(port). Convenience for a non-legacy webpieces server\n     * where webpieces owns the whole express app. Resolves with the http.Server once listening.\n     */\n    async bindAndStartExpress(app: Express, port: number = 8080): Promise<HttpServer> {\n        // Global middleware layers (outermost first) — only for a webpieces-owned app.\n        app.use(this.middleware.globalErrorHandler.bind(this.middleware));\n        app.use(this.middleware.corsForLocalhost());\n        app.use(this.middleware.logNextLayer.bind(this.middleware));\n\n        this.bindExpress(app);\n\n        return new Promise<HttpServer>(\n            (resolve: (server: HttpServer) => void, reject: (err: Error) => void) => {\n                const server: HttpServer = app.listen(port, (error?: Error) => {\n                    if (error) {\n                        log.error(`[WebpiecesExpressRouter] Failed to start on port ${port}:`, error);\n                        reject(error);\n                        return;\n                    }\n                    log.info(`[WebpiecesExpressRouter] Listening on http://localhost:${port}`);\n                    resolve(server);\n                });\n            },\n        );\n    }\n\n    /**\n     * Wrap one ApiClient's impl in an express handler (RequestContext.run, header read, manual\n     * JSON body parse, error→ProtocolError) and register it on the app for its method + path.\n     */\n    private mountApiClient(app: Express, apiClient: ApiClient): void {\n        const wrapper = this.middleware.createExpressWrapper(apiClient.impl, apiClient.routeMeta);\n        this.registerHandler(\n            app,\n            apiClient.routeMeta.httpMethod,\n            apiClient.routeMeta.path,\n            wrapper.execute.bind(wrapper),\n        );\n    }\n\n    private registerHandler(\n        app: Express,\n        httpMethod: string,\n        path: string,\n        expressHandler: ExpressRouteHandler,\n    ): void {\n        switch (httpMethod.toLowerCase()) {\n            case 'get':\n                app.get(path, expressHandler);\n                break;\n            case 'post':\n                app.post(path, expressHandler);\n                break;\n            case 'put':\n                app.put(path, expressHandler);\n                break;\n            case 'delete':\n                app.delete(path, expressHandler);\n                break;\n            case 'patch':\n                app.patch(path, expressHandler);\n                break;\n            default:\n                log.warn(`[WebpiecesExpressRouter] Unknown HTTP method: ${httpMethod}`);\n        }\n    }\n}\n"]}

package/src/WebpiecesMiddleware.d.ts

@@ -1,11 +1,11 @@
 import { Request, Response, NextFunction, RequestHandler } from 'express';
 import { MethodMeta } from '@webpieces/http-routing';
 import { RouteMetadata } from '@webpieces/core-util';
-import { Service, WpResponse } from '@webpieces/http-filters';
+import { Service, WpResponse } from '@webpieces/http-routing';
 /**
  * Express route handler function type. Lives in http-server (the express adapter),
  * NOT in the node-only http-routing package, so http-routing stays express-free.
- * Used by WebpiecesRouteCreator to register handlers Express can call.
+ * Used by WebpiecesExpressRouter to register handlers Express can call.
  */
 export type ExpressRouteHandler = (req: Request, res: Response, next: NextFunction) => Promise<void>;
 export declare class ExpressWrapper {

package/src/WebpiecesMiddleware.js

@@ -46,8 +46,11 @@ class ExpressWrapper {
             // Parse JSON
             requestDto = bodyText ? JSON.parse(bodyText) : {};
         }
-        // 3. Create MethodMeta with headers and request DTO
-        const methodMeta = new http_routing_1.MethodMeta(this.routeMeta, requestHeaders, requestDto);
+        // 3. Publish the transport-neutral HttpRequest + fill the context (platform-header
+        //    transfer + request id) ABOVE the boundary — the chain reads it, never express req.
+        core_context_1.RequestContext.setRequest(new core_context_1.HttpRequest(req.method, this.routeMeta.path, requestHeaders));
+        (0, http_routing_1.fillContext)();
+        const methodMeta = new http_routing_1.MethodMeta(this.routeMeta, requestDto);
         // 4. Invoke the service (filter chain + controller)
         const wpResponse = await this.service.invoke(methodMeta);
         if (!wpResponse.response) {

package/src/WebpiecesMiddleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebpiecesMiddleware.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/WebpiecesMiddleware.ts"],"names":[],"mappings":";;;;AACA,wDAAwB;AACxB,yCAAuC;AACvC,0DAAgF;AAChF,oDAc8B;AAE9B,oDAA+C;AAC/C,0DAAyD;AACzD,oDAAkD;AAElD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;AAaxD,MAAa,cAAc;IAEX;IACA;IAFZ,YACY,OAAiD,EACjD,SAAwB;QADxB,YAAO,GAAP,OAAO,CAA0C;QACjD,cAAS,GAAT,SAAS,CAAe;IAEpC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QAChE,qDAAqD;QACrD,6DAA6D;QAC7D,MAAM,6BAAc,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YAChC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACxE,8HAA8H;QAC9H,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,mBAAmB;YACnB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACpE,4CAA4C;QAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAEpD,+EAA+E;QAC/E,IAAI,UAAU,GAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,wBAAwB;YACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACjD,aAAa;YACb,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,CAAC;QAED,oDAAoD;QACpD,MAAM,UAAU,GAAG,IAAI,yBAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC;QAE9E,oDAAoD;QACpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACX,2DAA2D,IAAI,CAAC,SAAS,CAAC,mBAAmB,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAC/H,CAAC;QACN,CAAC;QAED,8EAA8E;QAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrF,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,GAAY;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAE5C,6EAA6E;QAC7E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAErC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY;QACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACrB,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,WAAW,CAAC,GAAa,EAAE,KAAc;QAC5C,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAClB,OAAO;QACX,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,yBAAa,EAAE,CAAC;QAE1C,IAAI,KAAK,YAAY,qBAAS,EAAE,CAAC;YAC7B,4CAA4C;YAC5C,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YACtC,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YACtC,aAAa,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAEhC,8DAA8D;YAC9D,IAAI,KAAK,YAAY,yBAAa,EAAE,CAAC;gBACjC,GAAG,CAAC,IAAI,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,aAAa,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAC9C,CAAC;iBAAM,IAAI,KAAK,YAAY,+BAAmB,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,aAAa,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;gBAClC,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC;YACrD,CAAC;iBAAM,IAAI,KAAK,YAAY,6BAAiB,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;iBAAM,IAAI,KAAK,YAAY,4BAAgB,EAAE,CAAC;gBAC3C,GAAG,CAAC,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,KAAK,YAAY,2BAAe,EAAE,CAAC;gBAC1C,GAAG,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7D,aAAa,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;YAClD,CAAC;iBAAM,IAAI,KAAK,YAAY,iCAAqB,EAAE,CAAC;gBAChD,GAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;iBAAM,IAAI,KAAK,YAAY,8BAAkB,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;iBAAM,IAAI,KAAK,YAAY,mCAAuB,EAAE,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,2CAA2C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;iBAAM,IAAI,KAAK,YAAY,+BAAmB,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;iBAAM,IAAI,KAAK,YAAY,mCAAuB,EAAE,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;iBAAM,CAAC;gBACJ,GAAG,CAAC,IAAI,CAAC,uCAAuC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,0DAA0D;YAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACJ,sBAAsB;YACtB,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,KAAK,CAAC,CAAC;YAC3B,aAAa,CAAC,OAAO,GAAG,uBAAuB,CAAC;YAChD,GAAG,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;CACJ;AAxKD,wCAwKC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAE5B;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CACpB,GAAY,EACZ,GAAa,EACb,IAAkB;QAElB,GAAG,CAAC,IAAI,CAAC,mDAAmD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAEtF,iHAAiH;QACjH,IAAI,CAAC;YACD,6BAA6B;YAC7B,2CAA2C;YAC3C,wDAAwD;YACxD,MAAM,IAAI,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACJ,2DAA2D,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CACtF,CAAC;QACN,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,GAAG,CAAC,KAAK,CAAC,0DAA0D,EAAE,KAAK,CAAC,CAAC;YAC7E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACnB,yEAAyE;gBACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;;;;;;;mBAOlB,KAAK,CAAC,OAAO;;;SAGvB,CAAC,CAAC;YACC,CAAC;YACD,GAAG,CAAC,IAAI,CACJ,yDAAyD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CACpF,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QAC9D,GAAG,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,IAAI,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6CAA6C,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB;QACZ,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAEvE,OAAO,IAAA,cAAI,EAAC;YACR,MAAM,EAAE,UAAU,MAAM,EAAE,QAAQ;gBAC9B,6DAA6D;gBAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACV,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACrB,OAAO;gBACX,CAAC;gBAED,+BAA+B;gBAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBACpF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACJ,GAAG,CAAC,IAAI,CAAC,0BAA0B,MAAM,6BAA6B,CAAC,CAAC;oBACxE,QAAQ,CAAC,IAAI,KAAK,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAClE,CAAC;YACL,CAAC;YACD,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;YAC7D,cAAc,EAAE,GAAG,EAAE,oBAAoB;YACzC,cAAc,EAAE,GAAG,EAAE,4CAA4C;YACjE,MAAM,EAAE,IAAI;SACf,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACH,oBAAoB,CAChB,OAAiD,EACjD,SAAwB;QAExB,OAAO,IAAI,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;CACJ,CAAA;AA/GY,kDAAmB;8BAAnB,mBAAmB;IAF/B,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;GACA,mBAAmB,CA+G/B","sourcesContent":["import { Request, Response, NextFunction, RequestHandler } from 'express';\nimport cors from 'cors';\nimport { injectable } from 'inversify';\nimport { provideFrameworkSingleton, MethodMeta } from '@webpieces/http-routing';\nimport {\n    ProtocolError,\n    HttpError,\n    HttpBadRequestError,\n    HttpVendorError,\n    HttpUserError,\n    HttpNotFoundError,\n    HttpTimeoutError,\n    HttpUnauthorizedError,\n    HttpForbiddenError,\n    HttpInternalServerError,\n    HttpBadGatewayError,\n    HttpGatewayTimeoutError,\n    RouteMetadata,\n} from '@webpieces/core-util';\nimport { Service, WpResponse } from '@webpieces/http-filters';\nimport { toError } from '@webpieces/core-util';\nimport { RequestContext } from '@webpieces/core-context';\nimport { LogManager } from '@webpieces/core-util';\n\nconst log = LogManager.getLogger('WebpiecesMiddleware');\n\n/**\n * Express route handler function type. Lives in http-server (the express adapter),\n * NOT in the node-only http-routing package, so http-routing stays express-free.\n * Used by WebpiecesRouteCreator to register handlers Express can call.\n */\nexport type ExpressRouteHandler = (\n    req: Request,\n    res: Response,\n    next: NextFunction,\n) => Promise<void>;\n\nexport class ExpressWrapper {\n    constructor(\n        private service: Service<MethodMeta, WpResponse<unknown>>,\n        private routeMeta: RouteMetadata\n    ) {\n    }\n\n    public async execute(req: Request, res: Response, next: NextFunction) {\n        // MOVED: Wrap entire request in RequestContext.run()\n        // This establishes AsyncLocalStorage context for the request\n        await RequestContext.run(async () => {\n            await this.executeTryCatch(req, res, next);\n        });\n    }\n\n    public async executeTryCatch(req: Request, res: Response, next: NextFunction): Promise<void> {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- ExpressWrapper catches errors to translate to HTTP responses\n        try {\n            await this.executeImpl(req, res, next);\n        } catch (err: unknown) {\n            const error = toError(err);\n            // 5. Handle errors\n            this.handleError(res, error);\n        }\n    }\n\n    public async executeImpl(req: Request, res: Response, next: NextFunction) {\n        // 1. Read HTTP headers from Express request\n        const requestHeaders = this.readExpressHeaders(req);\n\n        // 2. Parse JSON request body manually (SYMMETRIC with client's JSON.stringify)\n        let requestDto: unknown = {};\n        if (['POST', 'PUT', 'PATCH'].includes(req.method)) {\n            // Read raw body as text\n            const bodyText = await this.readRequestBody(req);\n            // Parse JSON\n            requestDto = bodyText ? JSON.parse(bodyText) : {};\n        }\n\n        // 3. Create MethodMeta with headers and request DTO\n        const methodMeta = new MethodMeta(this.routeMeta, requestHeaders, requestDto);\n\n        // 4. Invoke the service (filter chain + controller)\n        const wpResponse = await this.service.invoke(methodMeta);\n        if (!wpResponse.response) {\n            throw new Error(\n                `Route chain(filters & all) is not returning a response. ${this.routeMeta.controllerClassName}.${this.routeMeta.methodName}`\n            );\n        }\n\n        // 5. Serialize response DTO to JSON (SYMMETRIC with client's response.json())\n        const responseJson = JSON.stringify(wpResponse.response);\n        res.status(200).setHeader('Content-Type', 'application/json').send(responseJson);\n    }\n\n    /**\n     * Read HTTP headers from Express request.\n     * Returns Map of header name (lowercase) -> array of values.\n     *\n     * HTTP spec allows multiple values for same header name.\n     */\n    private readExpressHeaders(req: Request): Map<string, string[]> {\n        const headers = new Map<string, string[]>();\n\n        // Express stores headers in req.headers as Record<string, string | string[]>\n        for (const [name, value] of Object.entries(req.headers)) {\n            const lowerName = name.toLowerCase();\n\n            if (typeof value === 'string') {\n                headers.set(lowerName, [value]);\n            } else if (Array.isArray(value)) {\n                headers.set(lowerName, value);\n            }\n        }\n\n        return headers;\n    }\n\n    /**\n     * Read raw request body as text.\n     * Used to manually parse JSON (instead of express.json() middleware).\n     */\n    private async readRequestBody(req: Request): Promise<string> {\n        return new Promise((resolve, reject) => {\n            let body = '';\n            req.on('data', (chunk) => {\n                body += chunk.toString();\n            });\n            req.on('end', () => {\n                resolve(body);\n            });\n            req.on('error', (err) => {\n                reject(err);\n            });\n        });\n    }\n\n    /**\n     * Handle errors - translate to JSON ProtocolError (SYMMETRIC with ClientErrorTranslator).\n     * PUBLIC so wrapExpress can call it for symmetric error handling.\n     * Maps HttpError subclasses to appropriate HTTP status codes and ProtocolError response.\n     *\n     * Maps all HttpError types (must match ClientErrorTranslator.translateError()):\n     * - HttpUserError → 266 (with errorCode)\n     * - HttpBadRequestError → 400 (with field, guiAlertMessage)\n     * - HttpUnauthorizedError → 401\n     * - HttpForbiddenError → 403\n     * - HttpNotFoundError → 404\n     * - HttpTimeoutError → 408\n     * - HttpInternalServerError → 500\n     * - HttpBadGatewayError → 502\n     * - HttpGatewayTimeoutError → 504\n     * - HttpVendorError → 598 (with waitSeconds)\n     */\n    public handleError(res: Response, error: unknown): void {\n        if (res.headersSent) {\n            return;\n        }\n\n        const protocolError = new ProtocolError();\n\n        if (error instanceof HttpError) {\n            // Set common fields for all HttpError types\n            protocolError.message = error.message;\n            protocolError.subType = error.subType;\n            protocolError.name = error.name;\n\n            // Set type-specific fields (MUST match ClientErrorTranslator)\n            if (error instanceof HttpUserError) {\n                log.info(`[ExpressWrapper] User Error: ${error.message}`);\n                protocolError.errorCode = error.errorCode;\n            } else if (error instanceof HttpBadRequestError) {\n                log.info(`[ExpressWrapper] Bad Request: ${error.message}`);\n                protocolError.field = error.field;\n                protocolError.guiAlertMessage = error.guiMessage;\n            } else if (error instanceof HttpNotFoundError) {\n                log.info(`[ExpressWrapper] Not Found: ${error.message}`);\n            } else if (error instanceof HttpTimeoutError) {\n                log.error(`[ExpressWrapper] Timeout Error: ${error.message}`);\n            } else if (error instanceof HttpVendorError) {\n                log.error(`[ExpressWrapper] Vendor Error: ${error.message}`);\n                protocolError.waitSeconds = error.waitSeconds;\n            } else if (error instanceof HttpUnauthorizedError) {\n                log.info(`[ExpressWrapper] Unauthorized: ${error.message}`);\n            } else if (error instanceof HttpForbiddenError) {\n                log.info(`[ExpressWrapper] Forbidden: ${error.message}`);\n            } else if (error instanceof HttpInternalServerError) {\n                log.error(`[ExpressWrapper] Internal Server Error: ${error.message}`);\n            } else if (error instanceof HttpBadGatewayError) {\n                log.error(`[ExpressWrapper] Bad Gateway: ${error.message}`);\n            } else if (error instanceof HttpGatewayTimeoutError) {\n                log.error(`[ExpressWrapper] Gateway Timeout: ${error.message}`);\n            } else {\n                log.info(`[ExpressWrapper] Generic HttpError: ${error.message}`);\n            }\n\n            // Serialize ProtocolError to JSON (SYMMETRIC with client)\n            const responseJson = JSON.stringify(protocolError);\n            res.status(error.code).setHeader('Content-Type', 'application/json').send(responseJson);\n        } else {\n            // Unknown error - 500\n            const err = toError(error);\n            protocolError.message = 'Internal Server Error';\n            log.error('[ExpressWrapper] Unexpected error:', err);\n            const responseJson = JSON.stringify(protocolError);\n            res.status(500).setHeader('Content-Type', 'application/json').send(responseJson);\n        }\n    }\n}\n\n/**\n * WebpiecesMiddleware - Express middleware for WebPieces server.\n *\n * This class contains all Express middleware used by WebpiecesServer:\n * 1. globalErrorHandler - Outermost error handler, returns HTML 500 page\n * 2. logNextLayer - Request/response logging\n * 3. jsonTranslator - JSON Content-Type validation and error translation\n *\n * The middleware is injected into WebpiecesServerImpl and registered with Express\n * in the start() method.\n *\n * IMPORTANT: jsonTranslator does NOT dispatch routes - route dispatch happens via\n * Express's registered route handlers (created by RouteBuilder.createHandler()).\n * jsonTranslator only validates Content-Type and translates errors to JSON.\n *\n * NEW: ExpressWrapper simplified - no longer handles JSON or headers\n * - JSON parsing/serialization moved to JsonFilter\n * - Header transfer moved to ContextFilter (injects PlatformHeadersExtension directly)\n * - ExpressWrapper just creates RouterReqResp and invokes filter chain\n *\n * Extension vs Plugin pattern:\n * - Extensions (DI-level): Contribute capabilities to framework (headers, converters, etc.)\n * - Plugins (App-level): Provide complete features with modules + routes (Hibernate, Jackson, etc.)\n */\n@provideFrameworkSingleton()\n@injectable()\nexport class WebpiecesMiddleware {\n\n    /**\n     * Global error handler middleware - catches ALL unhandled errors.\n     * Returns HTML 500 error page for any errors that escape the filter chain.\n     *\n     * This is the outermost safety net - JsonTranslator catches JSON API errors,\n     * this catches everything else.\n     */\n    async globalErrorHandler(\n        req: Request,\n        res: Response,\n        next: NextFunction,\n    ): Promise<void> {\n        log.info(`🔴 [Layer 1: GlobalErrorHandler] Request START: ${req.method} ${req.path}`);\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- Global error handler IS the top-level catch-all\n        try {\n            // await next() catches BOTH:\n            // 1. Synchronous throws from next() itself\n            // 2. Rejected promises from downstream async middleware\n            await next();\n            log.info(\n                `🔴 [Layer 1: GlobalErrorHandler] Request END (success): ${req.method} ${req.path}`,\n            );\n        } catch (err: unknown) {\n            const error = toError(err);\n            log.error('🔴 [Layer 1: GlobalErrorHandler] Caught unhandled error:', error);\n            if (!res.headersSent) {\n                // Return HTML error page (not JSON - JsonTranslator handles JSON errors)\n                res.status(500).send(`\n          <!DOCTYPE html>\n          <html>\n          <head><title>Server Error</title></head>\n          <body>\n            <h1>You hit a server error</h1>\n            <p>An unexpected error occurred while processing your request.</p>\n            <pre>${error.message}</pre>\n          </body>\n          </html>\n        `);\n            }\n            log.info(\n                `🔴 [Layer 1: GlobalErrorHandler] Request END (error): ${req.method} ${req.path}`,\n            );\n        }\n    }\n\n    /**\n     * Logging middleware - logs request/response flow.\n     * Demonstrates middleware execution order.\n     * IMPORTANT: Must be async and await next() to properly chain with async middleware.\n     */\n    async logNextLayer(req: Request, res: Response, next: NextFunction): Promise<void> {\n        log.info(`🟡 [Layer 2: LogNextLayer] Before next() - ${req.method} ${req.path}`);\n        await next();\n        log.info(`🟡 [Layer 2: LogNextLayer] After next() - ${req.method} ${req.path}`);\n    }\n\n    /**\n     * CORS middleware for localhost development.\n     * Only enables CORS when request origin is localhost:*.\n     *\n     * Wide open for all headers/methods in dev mode.\n     * Non-localhost origins are blocked.\n     *\n     * @returns Express middleware handler for CORS\n     */\n    corsForLocalhost(): RequestHandler {\n        log.info('[WebpiecesMiddleware] CORS enabled for localhost:* origins');\n\n        return cors({\n            origin: function (origin, callback) {\n                // Allow requests with no origin (same-origin, Postman, curl)\n                if (!origin) {\n                    callback(null, true);\n                    return;\n                }\n\n                // Only allow localhost origins\n                if (origin.startsWith('http://localhost:') || origin.startsWith('https://localhost:')) {\n                    callback(null, true);\n                } else {\n                    log.info(`[CORS] Blocked origin: ${origin} (only localhost:* allowed)`);\n                    callback(new Error(`CORS not allowed for origin: ${origin}`));\n                }\n            },\n            credentials: true,\n            methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],\n            allowedHeaders: '*', // Wide open for dev\n            exposedHeaders: '*', // Expose all response headers to browser JS\n            maxAge: 3600,\n        });\n    }\n\n    /**\n     * Create an ExpressWrapper for a route.\n     * The wrapper handles the full request/response cycle (symmetric design).\n     *\n     * NEW: Simplified - no longer passes headers (ContextFilter handles it now)\n     *\n     * @param service - The service wrapping the filter chain and controller\n     * @param routeMeta - Route metadata for MethodMeta and DTO type\n     * @returns ExpressWrapper instance\n     */\n    createExpressWrapper(\n        service: Service<MethodMeta, WpResponse<unknown>>,\n        routeMeta: RouteMetadata,\n    ): ExpressWrapper {\n        return new ExpressWrapper(service, routeMeta);\n    }\n}\n"]}
+{"version":3,"file":"WebpiecesMiddleware.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/WebpiecesMiddleware.ts"],"names":[],"mappings":";;;;AACA,wDAAwB;AACxB,yCAAuC;AACvC,0DAA6F;AAC7F,oDAc8B;AAE9B,oDAA+C;AAC/C,0DAAsE;AACtE,oDAAkD;AAElD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;AAaxD,MAAa,cAAc;IAEX;IACA;IAFZ,YACY,OAAiD,EACjD,SAAwB;QADxB,YAAO,GAAP,OAAO,CAA0C;QACjD,cAAS,GAAT,SAAS,CAAe;IAEpC,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QAChE,qDAAqD;QACrD,6DAA6D;QAC7D,MAAM,6BAAc,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE;YAChC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACP,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACxE,8HAA8H;QAC9H,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,mBAAmB;YACnB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IAEM,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACpE,4CAA4C;QAC5C,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAEpD,+EAA+E;QAC/E,IAAI,UAAU,GAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,wBAAwB;YACxB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YACjD,aAAa;YACb,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,CAAC;QAED,mFAAmF;QACnF,wFAAwF;QACxF,6BAAc,CAAC,UAAU,CAAC,IAAI,0BAAW,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5F,IAAA,0BAAW,GAAE,CAAC;QACd,MAAM,UAAU,GAAG,IAAI,yBAAU,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QAE9D,oDAAoD;QACpD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACX,2DAA2D,IAAI,CAAC,SAAS,CAAC,mBAAmB,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAC/H,CAAC;QACN,CAAC;QAED,8EAA8E;QAC9E,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACzD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACrF,CAAC;IAED;;;;;OAKG;IACK,kBAAkB,CAAC,GAAY;QACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAoB,CAAC;QAE5C,6EAA6E;QAC7E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAErC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAAC,GAAY;QACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACrB,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACf,OAAO,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACP,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,WAAW,CAAC,GAAa,EAAE,KAAc;QAC5C,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YAClB,OAAO;QACX,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,yBAAa,EAAE,CAAC;QAE1C,IAAI,KAAK,YAAY,qBAAS,EAAE,CAAC;YAC7B,4CAA4C;YAC5C,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YACtC,aAAa,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YACtC,aAAa,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAEhC,8DAA8D;YAC9D,IAAI,KAAK,YAAY,yBAAa,EAAE,CAAC;gBACjC,GAAG,CAAC,IAAI,CAAC,gCAAgC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,aAAa,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;YAC9C,CAAC;iBAAM,IAAI,KAAK,YAAY,+BAAmB,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC3D,aAAa,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;gBAClC,aAAa,CAAC,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC;YACrD,CAAC;iBAAM,IAAI,KAAK,YAAY,6BAAiB,EAAE,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;iBAAM,IAAI,KAAK,YAAY,4BAAgB,EAAE,CAAC;gBAC3C,GAAG,CAAC,KAAK,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,KAAK,YAAY,2BAAe,EAAE,CAAC;gBAC1C,GAAG,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7D,aAAa,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;YAClD,CAAC;iBAAM,IAAI,KAAK,YAAY,iCAAqB,EAAE,CAAC;gBAChD,GAAG,CAAC,IAAI,CAAC,kCAAkC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;iBAAM,IAAI,KAAK,YAAY,8BAAkB,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7D,CAAC;iBAAM,IAAI,KAAK,YAAY,mCAAuB,EAAE,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,2CAA2C,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;iBAAM,IAAI,KAAK,YAAY,+BAAmB,EAAE,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,iCAAiC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,CAAC;iBAAM,IAAI,KAAK,YAAY,mCAAuB,EAAE,CAAC;gBAClD,GAAG,CAAC,KAAK,CAAC,qCAAqC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;iBAAM,CAAC;gBACJ,GAAG,CAAC,IAAI,CAAC,uCAAuC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;YAED,0DAA0D;YAC1D,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5F,CAAC;aAAM,CAAC;YACJ,sBAAsB;YACtB,MAAM,GAAG,GAAG,IAAA,mBAAO,EAAC,KAAK,CAAC,CAAC;YAC3B,aAAa,CAAC,OAAO,GAAG,uBAAuB,CAAC;YAChD,GAAG,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACrD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;CACJ;AA3KD,wCA2KC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAE5B;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CACpB,GAAY,EACZ,GAAa,EACb,IAAkB;QAElB,GAAG,CAAC,IAAI,CAAC,mDAAmD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAEtF,iHAAiH;QACjH,IAAI,CAAC;YACD,6BAA6B;YAC7B,2CAA2C;YAC3C,wDAAwD;YACxD,MAAM,IAAI,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CACJ,2DAA2D,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CACtF,CAAC;QACN,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,GAAG,CAAC,KAAK,CAAC,0DAA0D,EAAE,KAAK,CAAC,CAAC;YAC7E,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACnB,yEAAyE;gBACzE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;;;;;;;mBAOlB,KAAK,CAAC,OAAO;;;SAGvB,CAAC,CAAC;YACC,CAAC;YACD,GAAG,CAAC,IAAI,CACJ,yDAAyD,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CACpF,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QAC9D,GAAG,CAAC,IAAI,CAAC,8CAA8C,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,IAAI,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,6CAA6C,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB;QACZ,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;QAEvE,OAAO,IAAA,cAAI,EAAC;YACR,MAAM,EAAE,UAAU,MAAM,EAAE,QAAQ;gBAC9B,6DAA6D;gBAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;oBACV,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;oBACrB,OAAO;gBACX,CAAC;gBAED,+BAA+B;gBAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;oBACpF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzB,CAAC;qBAAM,CAAC;oBACJ,GAAG,CAAC,IAAI,CAAC,0BAA0B,MAAM,6BAA6B,CAAC,CAAC;oBACxE,QAAQ,CAAC,IAAI,KAAK,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAClE,CAAC;YACL,CAAC;YACD,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;YAC7D,cAAc,EAAE,GAAG,EAAE,oBAAoB;YACzC,cAAc,EAAE,GAAG,EAAE,4CAA4C;YACjE,MAAM,EAAE,IAAI;SACf,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACH,oBAAoB,CAChB,OAAiD,EACjD,SAAwB;QAExB,OAAO,IAAI,cAAc,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAClD,CAAC;CACJ,CAAA;AA/GY,kDAAmB;8BAAnB,mBAAmB;IAF/B,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;GACA,mBAAmB,CA+G/B","sourcesContent":["import { Request, Response, NextFunction, RequestHandler } from 'express';\nimport cors from 'cors';\nimport { injectable } from 'inversify';\nimport { provideFrameworkSingleton, MethodMeta, fillContext } from '@webpieces/http-routing';\nimport {\n    ProtocolError,\n    HttpError,\n    HttpBadRequestError,\n    HttpVendorError,\n    HttpUserError,\n    HttpNotFoundError,\n    HttpTimeoutError,\n    HttpUnauthorizedError,\n    HttpForbiddenError,\n    HttpInternalServerError,\n    HttpBadGatewayError,\n    HttpGatewayTimeoutError,\n    RouteMetadata,\n} from '@webpieces/core-util';\nimport { Service, WpResponse } from '@webpieces/http-routing';\nimport { toError } from '@webpieces/core-util';\nimport { RequestContext, HttpRequest } from '@webpieces/core-context';\nimport { LogManager } from '@webpieces/core-util';\n\nconst log = LogManager.getLogger('WebpiecesMiddleware');\n\n/**\n * Express route handler function type. Lives in http-server (the express adapter),\n * NOT in the node-only http-routing package, so http-routing stays express-free.\n * Used by WebpiecesExpressRouter to register handlers Express can call.\n */\nexport type ExpressRouteHandler = (\n    req: Request,\n    res: Response,\n    next: NextFunction,\n) => Promise<void>;\n\nexport class ExpressWrapper {\n    constructor(\n        private service: Service<MethodMeta, WpResponse<unknown>>,\n        private routeMeta: RouteMetadata\n    ) {\n    }\n\n    public async execute(req: Request, res: Response, next: NextFunction) {\n        // MOVED: Wrap entire request in RequestContext.run()\n        // This establishes AsyncLocalStorage context for the request\n        await RequestContext.run(async () => {\n            await this.executeTryCatch(req, res, next);\n        });\n    }\n\n    public async executeTryCatch(req: Request, res: Response, next: NextFunction): Promise<void> {\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- ExpressWrapper catches errors to translate to HTTP responses\n        try {\n            await this.executeImpl(req, res, next);\n        } catch (err: unknown) {\n            const error = toError(err);\n            // 5. Handle errors\n            this.handleError(res, error);\n        }\n    }\n\n    public async executeImpl(req: Request, res: Response, next: NextFunction): Promise<void> {\n        // 1. Read HTTP headers from Express request\n        const requestHeaders = this.readExpressHeaders(req);\n\n        // 2. Parse JSON request body manually (SYMMETRIC with client's JSON.stringify)\n        let requestDto: unknown = {};\n        if (['POST', 'PUT', 'PATCH'].includes(req.method)) {\n            // Read raw body as text\n            const bodyText = await this.readRequestBody(req);\n            // Parse JSON\n            requestDto = bodyText ? JSON.parse(bodyText) : {};\n        }\n\n        // 3. Publish the transport-neutral HttpRequest + fill the context (platform-header\n        //    transfer + request id) ABOVE the boundary — the chain reads it, never express req.\n        RequestContext.setRequest(new HttpRequest(req.method, this.routeMeta.path, requestHeaders));\n        fillContext();\n        const methodMeta = new MethodMeta(this.routeMeta, requestDto);\n\n        // 4. Invoke the service (filter chain + controller)\n        const wpResponse = await this.service.invoke(methodMeta);\n        if (!wpResponse.response) {\n            throw new Error(\n                `Route chain(filters & all) is not returning a response. ${this.routeMeta.controllerClassName}.${this.routeMeta.methodName}`\n            );\n        }\n\n        // 5. Serialize response DTO to JSON (SYMMETRIC with client's response.json())\n        const responseJson = JSON.stringify(wpResponse.response);\n        res.status(200).setHeader('Content-Type', 'application/json').send(responseJson);\n    }\n\n    /**\n     * Read HTTP headers from Express request.\n     * Returns Map of header name (lowercase) -> array of values.\n     *\n     * HTTP spec allows multiple values for same header name.\n     */\n    private readExpressHeaders(req: Request): Map<string, string[]> {\n        const headers = new Map<string, string[]>();\n\n        // Express stores headers in req.headers as Record<string, string | string[]>\n        for (const [name, value] of Object.entries(req.headers)) {\n            const lowerName = name.toLowerCase();\n\n            if (typeof value === 'string') {\n                headers.set(lowerName, [value]);\n            } else if (Array.isArray(value)) {\n                headers.set(lowerName, value);\n            }\n        }\n\n        return headers;\n    }\n\n    /**\n     * Read raw request body as text.\n     * Used to manually parse JSON (instead of express.json() middleware).\n     */\n    private async readRequestBody(req: Request): Promise<string> {\n        return new Promise((resolve, reject) => {\n            let body = '';\n            req.on('data', (chunk) => {\n                body += chunk.toString();\n            });\n            req.on('end', () => {\n                resolve(body);\n            });\n            req.on('error', (err) => {\n                reject(err);\n            });\n        });\n    }\n\n    /**\n     * Handle errors - translate to JSON ProtocolError (SYMMETRIC with ClientErrorTranslator).\n     * PUBLIC so wrapExpress can call it for symmetric error handling.\n     * Maps HttpError subclasses to appropriate HTTP status codes and ProtocolError response.\n     *\n     * Maps all HttpError types (must match ClientErrorTranslator.translateError()):\n     * - HttpUserError → 266 (with errorCode)\n     * - HttpBadRequestError → 400 (with field, guiAlertMessage)\n     * - HttpUnauthorizedError → 401\n     * - HttpForbiddenError → 403\n     * - HttpNotFoundError → 404\n     * - HttpTimeoutError → 408\n     * - HttpInternalServerError → 500\n     * - HttpBadGatewayError → 502\n     * - HttpGatewayTimeoutError → 504\n     * - HttpVendorError → 598 (with waitSeconds)\n     */\n    public handleError(res: Response, error: unknown): void {\n        if (res.headersSent) {\n            return;\n        }\n\n        const protocolError = new ProtocolError();\n\n        if (error instanceof HttpError) {\n            // Set common fields for all HttpError types\n            protocolError.message = error.message;\n            protocolError.subType = error.subType;\n            protocolError.name = error.name;\n\n            // Set type-specific fields (MUST match ClientErrorTranslator)\n            if (error instanceof HttpUserError) {\n                log.info(`[ExpressWrapper] User Error: ${error.message}`);\n                protocolError.errorCode = error.errorCode;\n            } else if (error instanceof HttpBadRequestError) {\n                log.info(`[ExpressWrapper] Bad Request: ${error.message}`);\n                protocolError.field = error.field;\n                protocolError.guiAlertMessage = error.guiMessage;\n            } else if (error instanceof HttpNotFoundError) {\n                log.info(`[ExpressWrapper] Not Found: ${error.message}`);\n            } else if (error instanceof HttpTimeoutError) {\n                log.error(`[ExpressWrapper] Timeout Error: ${error.message}`);\n            } else if (error instanceof HttpVendorError) {\n                log.error(`[ExpressWrapper] Vendor Error: ${error.message}`);\n                protocolError.waitSeconds = error.waitSeconds;\n            } else if (error instanceof HttpUnauthorizedError) {\n                log.info(`[ExpressWrapper] Unauthorized: ${error.message}`);\n            } else if (error instanceof HttpForbiddenError) {\n                log.info(`[ExpressWrapper] Forbidden: ${error.message}`);\n            } else if (error instanceof HttpInternalServerError) {\n                log.error(`[ExpressWrapper] Internal Server Error: ${error.message}`);\n            } else if (error instanceof HttpBadGatewayError) {\n                log.error(`[ExpressWrapper] Bad Gateway: ${error.message}`);\n            } else if (error instanceof HttpGatewayTimeoutError) {\n                log.error(`[ExpressWrapper] Gateway Timeout: ${error.message}`);\n            } else {\n                log.info(`[ExpressWrapper] Generic HttpError: ${error.message}`);\n            }\n\n            // Serialize ProtocolError to JSON (SYMMETRIC with client)\n            const responseJson = JSON.stringify(protocolError);\n            res.status(error.code).setHeader('Content-Type', 'application/json').send(responseJson);\n        } else {\n            // Unknown error - 500\n            const err = toError(error);\n            protocolError.message = 'Internal Server Error';\n            log.error('[ExpressWrapper] Unexpected error:', err);\n            const responseJson = JSON.stringify(protocolError);\n            res.status(500).setHeader('Content-Type', 'application/json').send(responseJson);\n        }\n    }\n}\n\n/**\n * WebpiecesMiddleware - Express middleware for WebPieces server.\n *\n * This class contains all Express middleware used by WebpiecesServer:\n * 1. globalErrorHandler - Outermost error handler, returns HTML 500 page\n * 2. logNextLayer - Request/response logging\n * 3. jsonTranslator - JSON Content-Type validation and error translation\n *\n * The middleware is injected into WebpiecesServerImpl and registered with Express\n * in the start() method.\n *\n * IMPORTANT: jsonTranslator does NOT dispatch routes - route dispatch happens via\n * Express's registered route handlers (created by RouteBuilder.createHandler()).\n * jsonTranslator only validates Content-Type and translates errors to JSON.\n *\n * NEW: ExpressWrapper simplified - no longer handles JSON or headers\n * - JSON parsing/serialization moved to JsonFilter\n * - Header transfer moved to ContextFilter (injects PlatformHeadersExtension directly)\n * - ExpressWrapper just creates RouterReqResp and invokes filter chain\n *\n * Extension vs Plugin pattern:\n * - Extensions (DI-level): Contribute capabilities to framework (headers, converters, etc.)\n * - Plugins (App-level): Provide complete features with modules + routes (Hibernate, Jackson, etc.)\n */\n@provideFrameworkSingleton()\n@injectable()\nexport class WebpiecesMiddleware {\n\n    /**\n     * Global error handler middleware - catches ALL unhandled errors.\n     * Returns HTML 500 error page for any errors that escape the filter chain.\n     *\n     * This is the outermost safety net - JsonTranslator catches JSON API errors,\n     * this catches everything else.\n     */\n    async globalErrorHandler(\n        req: Request,\n        res: Response,\n        next: NextFunction,\n    ): Promise<void> {\n        log.info(`🔴 [Layer 1: GlobalErrorHandler] Request START: ${req.method} ${req.path}`);\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- Global error handler IS the top-level catch-all\n        try {\n            // await next() catches BOTH:\n            // 1. Synchronous throws from next() itself\n            // 2. Rejected promises from downstream async middleware\n            await next();\n            log.info(\n                `🔴 [Layer 1: GlobalErrorHandler] Request END (success): ${req.method} ${req.path}`,\n            );\n        } catch (err: unknown) {\n            const error = toError(err);\n            log.error('🔴 [Layer 1: GlobalErrorHandler] Caught unhandled error:', error);\n            if (!res.headersSent) {\n                // Return HTML error page (not JSON - JsonTranslator handles JSON errors)\n                res.status(500).send(`\n          <!DOCTYPE html>\n          <html>\n          <head><title>Server Error</title></head>\n          <body>\n            <h1>You hit a server error</h1>\n            <p>An unexpected error occurred while processing your request.</p>\n            <pre>${error.message}</pre>\n          </body>\n          </html>\n        `);\n            }\n            log.info(\n                `🔴 [Layer 1: GlobalErrorHandler] Request END (error): ${req.method} ${req.path}`,\n            );\n        }\n    }\n\n    /**\n     * Logging middleware - logs request/response flow.\n     * Demonstrates middleware execution order.\n     * IMPORTANT: Must be async and await next() to properly chain with async middleware.\n     */\n    async logNextLayer(req: Request, res: Response, next: NextFunction): Promise<void> {\n        log.info(`🟡 [Layer 2: LogNextLayer] Before next() - ${req.method} ${req.path}`);\n        await next();\n        log.info(`🟡 [Layer 2: LogNextLayer] After next() - ${req.method} ${req.path}`);\n    }\n\n    /**\n     * CORS middleware for localhost development.\n     * Only enables CORS when request origin is localhost:*.\n     *\n     * Wide open for all headers/methods in dev mode.\n     * Non-localhost origins are blocked.\n     *\n     * @returns Express middleware handler for CORS\n     */\n    corsForLocalhost(): RequestHandler {\n        log.info('[WebpiecesMiddleware] CORS enabled for localhost:* origins');\n\n        return cors({\n            origin: function (origin, callback) {\n                // Allow requests with no origin (same-origin, Postman, curl)\n                if (!origin) {\n                    callback(null, true);\n                    return;\n                }\n\n                // Only allow localhost origins\n                if (origin.startsWith('http://localhost:') || origin.startsWith('https://localhost:')) {\n                    callback(null, true);\n                } else {\n                    log.info(`[CORS] Blocked origin: ${origin} (only localhost:* allowed)`);\n                    callback(new Error(`CORS not allowed for origin: ${origin}`));\n                }\n            },\n            credentials: true,\n            methods: ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],\n            allowedHeaders: '*', // Wide open for dev\n            exposedHeaders: '*', // Expose all response headers to browser JS\n            maxAge: 3600,\n        });\n    }\n\n    /**\n     * Create an ExpressWrapper for a route.\n     * The wrapper handles the full request/response cycle (symmetric design).\n     *\n     * NEW: Simplified - no longer passes headers (ContextFilter handles it now)\n     *\n     * @param service - The service wrapping the filter chain and controller\n     * @param routeMeta - Route metadata for MethodMeta and DTO type\n     * @returns ExpressWrapper instance\n     */\n    createExpressWrapper(\n        service: Service<MethodMeta, WpResponse<unknown>>,\n        routeMeta: RouteMetadata,\n    ): ExpressWrapper {\n        return new ExpressWrapper(service, routeMeta);\n    }\n}\n"]}

package/src/filters/LogApiFilter.d.ts

@@ -1,5 +1,5 @@
 import { MethodMeta } from '@webpieces/http-routing';
-import { Filter, WpResponse, Service } from '@webpieces/http-filters';
+import { Filter, WpResponse, Service } from '@webpieces/http-routing';
 export declare class LogApiFilter extends Filter<MethodMeta, WpResponse<unknown>> {
     private logApiCall;
     private headerMethods;

package/src/filters/LogApiFilter.js

@@ -4,7 +4,7 @@ exports.LogApiFilter = void 0;
 const tslib_1 = require("tslib");
 const inversify_1 = require("inversify");
 const http_routing_1 = require("@webpieces/http-routing");
-const http_filters_1 = require("@webpieces/http-filters");
+const http_routing_2 = require("@webpieces/http-routing");
 const core_util_1 = require("@webpieces/core-util");
 const core_util_2 = require("@webpieces/core-util");
 /**
@@ -24,7 +24,7 @@ const core_util_2 = require("@webpieces/core-util");
  * because they are expected behavior from the server's perspective.
  */
 const log = core_util_1.LogManager.getLogger('LogApiFilter');
-let LogApiFilter = class LogApiFilter extends http_filters_1.Filter {
+let LogApiFilter = class LogApiFilter extends http_routing_2.Filter {
     logApiCall;
     headerMethods = new core_util_2.HeaderMethods();
     loggedKeys;
@@ -46,7 +46,7 @@ let LogApiFilter = class LogApiFilter extends http_filters_1.Filter {
             return wpResponse.response;
         };
         const response = await this.logApiCall.execute("SVR", meta.routeMeta, meta.requestDto, headers, method);
-        return new http_filters_1.WpResponse(response);
+        return new http_routing_2.WpResponse(response);
     }
 };
 exports.LogApiFilter = LogApiFilter;

package/src/filters/LogApiFilter.js.map

@@ -1 +1 @@
-{"version":3,"file":"LogApiFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/LogApiFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAAuC;AACvC,0DAAoG;AACpG,0DAAsE;AACtE,oDAAkD;AAClD,oDAK8B;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;AAI1C,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,qBAAuC;IAC7D,UAAU,CAAa;IACvB,aAAa,GAAG,IAAI,yBAAa,EAAE,CAAC;IACpC,UAAU,CAAe;IAEjC;QACI,KAAK,EAAE,CAAC;QAER,4EAA4E;QAC5E,4DAA4D;QAC5D,IAAI,CAAC,UAAU,GAAG,0BAAc,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;QAEvD,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,MAAM,0CAA0C,CAAC,CAAC;QAEnG,IAAI,CAAC,UAAU,GAAG,IAAI,sBAAU,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CACR,IAAgB,EAChB,UAAoD;QAEpD,gFAAgF;QAChF,MAAM,aAAa,GAAG,IAAI,mCAAoB,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAEzF,+DAA+D;QAC/D,MAAM,MAAM,GAAG,KAAK,IAAsB,EAAE;YACxC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxG,OAAO,IAAI,yBAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;CACJ,CAAA;AAlCY,oCAAY;uBAAZ,YAAY;IAFxB,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;;GACA,YAAY,CAkCxB","sourcesContent":["import { injectable } from 'inversify';\nimport {provideFrameworkSingleton, MethodMeta, RequestContextReader} from '@webpieces/http-routing';\nimport { Filter, WpResponse, Service } from '@webpieces/http-filters';\nimport { LogManager } from '@webpieces/core-util';\nimport {\n    ContextKey,\n    HeaderMethods,\n    HeaderRegistry,\n    LogApiCall,\n} from '@webpieces/core-util';\n\n/**\n * LogApiFilter - Structured API logging for all requests/responses.\n * Priority: 1800 (after ContextFilter at 2000, before custom filters)\n *\n * Logging patterns (via LogApiCall):\n * - [API-SVR-req] Class.method /url request={...} headers={...}\n * - [API-SVR-resp-SUCCESS] Class.method response={...}\n * - [API-SVR-resp-FAIL] Class.method error=... (server errors: 500, 502, 504)\n * - [API-SVR-resp-OTHER] Class.method errorType=... (user errors: 400, 401, 403, 404, 266)\n *\n * Headers are read from RequestContext (NOT from meta.requestHeaders which is undefined\n * after ContextFilter runs at priority 2000).\n *\n * User errors (HttpBadRequestError, etc.) are logged as OTHER, not FAIL,\n * because they are expected behavior from the server's perspective.\n */\nconst log = LogManager.getLogger('LogApiFilter');\n\n@provideFrameworkSingleton()\n@injectable()\nexport class LogApiFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    private logApiCall: LogApiCall;\n    private headerMethods = new HeaderMethods();\n    private loggedKeys: ContextKey[];\n\n    constructor() {\n        super();\n\n        // The global registry is the single source of truth (configured at startup,\n        // duplicate-validated). Log map keys off each key's `name`.\n        this.loggedKeys = HeaderRegistry.get().getLoggedKeys();\n\n        log.info(`[LogApiFilter] Using ${this.loggedKeys.length} logged context keys from HeaderRegistry`);\n\n        this.logApiCall = new LogApiCall();\n    }\n\n    async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        // Build log map from RequestContext (keys already transferred by ContextFilter)\n        const contextReader = new RequestContextReader();\n        const headers = this.headerMethods.buildSecureMapForLogs(this.loggedKeys, contextReader);\n\n        // Wrap nextFilter.invoke in a method that returns the response\n        const method = async (): Promise<unknown> => {\n            const wpResponse = await nextFilter.invoke(meta);\n            return wpResponse.response;\n        };\n\n        const response = await this.logApiCall.execute(\"SVR\", meta.routeMeta, meta.requestDto, headers, method);\n        return new WpResponse(response);\n    }\n}\n"]}
+{"version":3,"file":"LogApiFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/LogApiFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAAuC;AACvC,0DAAoG;AACpG,0DAAsE;AACtE,oDAAkD;AAClD,oDAK8B;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;AAI1C,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,qBAAuC;IAC7D,UAAU,CAAa;IACvB,aAAa,GAAG,IAAI,yBAAa,EAAE,CAAC;IACpC,UAAU,CAAe;IAEjC;QACI,KAAK,EAAE,CAAC;QAER,4EAA4E;QAC5E,4DAA4D;QAC5D,IAAI,CAAC,UAAU,GAAG,0BAAc,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;QAEvD,GAAG,CAAC,IAAI,CAAC,wBAAwB,IAAI,CAAC,UAAU,CAAC,MAAM,0CAA0C,CAAC,CAAC;QAEnG,IAAI,CAAC,UAAU,GAAG,IAAI,sBAAU,EAAE,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,MAAM,CACR,IAAgB,EAChB,UAAoD;QAEpD,gFAAgF;QAChF,MAAM,aAAa,GAAG,IAAI,mCAAoB,EAAE,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAEzF,+DAA+D;QAC/D,MAAM,MAAM,GAAG,KAAK,IAAsB,EAAE;YACxC,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjD,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACxG,OAAO,IAAI,yBAAU,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;CACJ,CAAA;AAlCY,oCAAY;uBAAZ,YAAY;IAFxB,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;;GACA,YAAY,CAkCxB","sourcesContent":["import { injectable } from 'inversify';\nimport {provideFrameworkSingleton, MethodMeta, RequestContextReader} from '@webpieces/http-routing';\nimport { Filter, WpResponse, Service } from '@webpieces/http-routing';\nimport { LogManager } from '@webpieces/core-util';\nimport {\n    ContextKey,\n    HeaderMethods,\n    HeaderRegistry,\n    LogApiCall,\n} from '@webpieces/core-util';\n\n/**\n * LogApiFilter - Structured API logging for all requests/responses.\n * Priority: 1800 (after ContextFilter at 2000, before custom filters)\n *\n * Logging patterns (via LogApiCall):\n * - [API-SVR-req] Class.method /url request={...} headers={...}\n * - [API-SVR-resp-SUCCESS] Class.method response={...}\n * - [API-SVR-resp-FAIL] Class.method error=... (server errors: 500, 502, 504)\n * - [API-SVR-resp-OTHER] Class.method errorType=... (user errors: 400, 401, 403, 404, 266)\n *\n * Headers are read from RequestContext (NOT from meta.requestHeaders which is undefined\n * after ContextFilter runs at priority 2000).\n *\n * User errors (HttpBadRequestError, etc.) are logged as OTHER, not FAIL,\n * because they are expected behavior from the server's perspective.\n */\nconst log = LogManager.getLogger('LogApiFilter');\n\n@provideFrameworkSingleton()\n@injectable()\nexport class LogApiFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    private logApiCall: LogApiCall;\n    private headerMethods = new HeaderMethods();\n    private loggedKeys: ContextKey[];\n\n    constructor() {\n        super();\n\n        // The global registry is the single source of truth (configured at startup,\n        // duplicate-validated). Log map keys off each key's `name`.\n        this.loggedKeys = HeaderRegistry.get().getLoggedKeys();\n\n        log.info(`[LogApiFilter] Using ${this.loggedKeys.length} logged context keys from HeaderRegistry`);\n\n        this.logApiCall = new LogApiCall();\n    }\n\n    async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        // Build log map from RequestContext (keys already transferred by ContextFilter)\n        const contextReader = new RequestContextReader();\n        const headers = this.headerMethods.buildSecureMapForLogs(this.loggedKeys, contextReader);\n\n        // Wrap nextFilter.invoke in a method that returns the response\n        const method = async (): Promise<unknown> => {\n            const wpResponse = await nextFilter.invoke(meta);\n            return wpResponse.response;\n        };\n\n        const response = await this.logApiCall.execute(\"SVR\", meta.routeMeta, meta.requestDto, headers, method);\n        return new WpResponse(response);\n    }\n}\n"]}

package/src/filters/RecordingFilter.d.ts

@@ -1,5 +1,5 @@
 import { MethodMeta, WebpiecesConfig } from '@webpieces/http-routing';
-import { Filter, WpResponse, Service } from '@webpieces/http-filters';
+import { Filter, WpResponse, Service } from '@webpieces/http-routing';
 /**
  * RecordingFilter - Records a request as a replayable test case (port of Java
  * RecordingFilter).

package/src/filters/RecordingFilter.js

@@ -5,7 +5,7 @@ const tslib_1 = require("tslib");
 const inversify_1 = require("inversify");
 const http_routing_1 = require("@webpieces/http-routing");
 const core_context_1 = require("@webpieces/core-context");
-const http_filters_1 = require("@webpieces/http-filters");
+const http_routing_2 = require("@webpieces/http-routing");
 const core_util_1 = require("@webpieces/core-util");
 const TestCaseRecorderImpl_1 = require("../recorder/TestCaseRecorderImpl");
 /**
@@ -26,7 +26,7 @@ const TestCaseRecorderImpl_1 = require("../recorder/TestCaseRecorderImpl");
  * Recording NEVER alters the response - failures inside the recorder are
  * caught and logged.
  */
-let RecordingFilter = class RecordingFilter extends http_filters_1.Filter {
+let RecordingFilter = class RecordingFilter extends http_routing_2.Filter {
     config;
     headerMethods = new core_util_1.HeaderMethods();
     constructor(config) {

package/src/filters/RecordingFilter.js.map

@@ -1 +1 @@
-{"version":3,"file":"RecordingFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/RecordingFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAA+C;AAC/C,0DAMiC;AACjC,0DAAyD;AACzD,0DAAsE;AACtE,oDAQ8B;AAE9B,2EAAwE;AAExE;;;;;;;;;;;;;;;;;GAiBG;AAII,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,qBAAuC;IAI5B;IAHpC,aAAa,GAAG,IAAI,yBAAa,EAAE,CAAC;IAE5C,YAC4C,MAAuB;QAE/D,KAAK,EAAE,CAAC;QAFgC,WAAM,GAAN,MAAM,CAAiB;IAGnE,CAAC;IAED,sGAAsG;IACtG,KAAK,CAAC,MAAM,CACR,IAAgB,EAChB,UAAoD;QAEpD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC/B,OAAO,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,2CAAoB,EAAE,CAAC;QAC5C,6BAAc,CAAC,SAAS,CAAC,wBAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE1D,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAEtD,4HAA4H;QAC5H,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/C,cAAc,CAAC,eAAe,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACnD,OAAO,QAAQ,CAAC;QACpB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,cAAc,CAAC,eAAe,GAAG,IAAI,yBAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9E,MAAM,GAAG,CAAC;QACd,CAAC;gBAAS,CAAC;YACP,6BAAc,CAAC,MAAM,CAAC,wBAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClD,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAEO,oBAAoB;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,4EAA4E;QAC5E,OAAO,6BAAc,CAAC,SAAS,CAAC,gCAAoB,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAEO,mBAAmB,CAAC,IAAgB;QACxC,8EAA8E;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,0BAAc,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,EAAE,IAAI,mCAAoB,EAAE,CAAC,CAAC;QAC1H,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACnC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;QAC1E,OAAO,IAAI,4BAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1F,CAAC;CACJ,CAAA;AAzDY,0CAAe;0BAAf,eAAe;IAH3B,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IACb,sGAAsG;;IAK7F,mBAAA,IAAA,kBAAM,EAAC,qCAAsB,CAAC,CAAA;6CAAiB,8BAAe;GAJ1D,eAAe,CAyD3B","sourcesContent":["import { inject, injectable } from 'inversify';\nimport {\n    provideFrameworkSingleton,\n    MethodMeta,\n    RequestContextReader,\n    WebpiecesConfig,\n    WEBPIECES_CONFIG_TOKEN,\n} from '@webpieces/http-routing';\nimport { RequestContext } from '@webpieces/core-context';\nimport { Filter, WpResponse, Service } from '@webpieces/http-filters';\nimport {\n    HeaderMethods,\n    HeaderRegistry,\n    RecordedEndpoint,\n    RecordedError,\n    RecorderKeys,\n    WebpiecesCoreHeaders,\n    toError,\n} from '@webpieces/core-util';\n\nimport { TestCaseRecorderImpl } from '../recorder/TestCaseRecorderImpl';\n\n/**\n * RecordingFilter - Records a request as a replayable test case (port of Java\n * RecordingFilter).\n *\n * Suggested priority: 1850 (after ContextFilter 2000 so the RECORDING header\n * has been transferred to the context, after AuthFilter 1900 so only real\n * authorized flows are recorded, before LogApiFilter 1800).\n *\n * Activates when WebpiecesConfig.recordingAlwaysOn is set OR the request\n * carries WebpiecesCoreHeaders.RECORDING (x-webpieces-recording). While\n * active, a TestCaseRecorderImpl travels in the RequestContext under\n * RecorderKeys.RECORDER; the http-client proxy and recordable() wrappers add\n * every downstream call. On completion the fixture + generated spec are\n * logged (and written to config.recordingDir when set).\n *\n * Recording NEVER alters the response - failures inside the recorder are\n * caught and logged.\n */\n@provideFrameworkSingleton()\n@injectable()\n// webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\nexport class RecordingFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    private headerMethods = new HeaderMethods();\n\n    constructor(\n        @inject(WEBPIECES_CONFIG_TOKEN) private config: WebpiecesConfig,\n    ) {\n        super();\n    }\n\n    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\n    async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        if (!this.isRecordingRequested()) {\n            return await nextFilter.invoke(meta);\n        }\n\n        const recorder = new TestCaseRecorderImpl();\n        RequestContext.putHeader(RecorderKeys.RECORDER, recorder);\n\n        const serverEndpoint = this.buildServerEndpoint(meta);\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- capture failure into the recording, then rethrow unchanged\n        try {\n            const response = await nextFilter.invoke(meta);\n            serverEndpoint.successResponse = response.response;\n            return response;\n        } catch (err: unknown) {\n            const error = toError(err);\n            serverEndpoint.failureResponse = new RecordedError(error.name, error.message);\n            throw err;\n        } finally {\n            RequestContext.remove(RecorderKeys.RECORDER.name);\n            recorder.spitOutTestCase(serverEndpoint, this.config.recordingDir);\n        }\n    }\n\n    private isRecordingRequested(): boolean {\n        if (this.config.recordingAlwaysOn) {\n            return true;\n        }\n        // ContextFilter (priority 2000) already transferred the header into context\n        return RequestContext.hasHeader(WebpiecesCoreHeaders.RECORDING);\n    }\n\n    private buildServerEndpoint(meta: MethodMeta): RecordedEndpoint {\n        // Masked snapshot of the magic context (secured values masked, keyed by name)\n        const logMap = this.headerMethods.buildSecureMapForLogs(HeaderRegistry.get().getLoggedKeys(), new RequestContextReader());\n        const ctxSnapshot: Record<string, string> = {};\n        for (const entry of logMap.entries()) {\n            ctxSnapshot[entry[0]] = entry[1];\n        }\n\n        const apiName = meta.routeMeta.controllerClassName ?? 'UnknownController';\n        return new RecordedEndpoint(apiName, meta.methodName, [meta.requestDto], ctxSnapshot);\n    }\n}\n"]}
+{"version":3,"file":"RecordingFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/RecordingFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAA+C;AAC/C,0DAMiC;AACjC,0DAAyD;AACzD,0DAAsE;AACtE,oDAQ8B;AAE9B,2EAAwE;AAExE;;;;;;;;;;;;;;;;;GAiBG;AAII,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,qBAAuC;IAI5B;IAHpC,aAAa,GAAG,IAAI,yBAAa,EAAE,CAAC;IAE5C,YAC4C,MAAuB;QAE/D,KAAK,EAAE,CAAC;QAFgC,WAAM,GAAN,MAAM,CAAiB;IAGnE,CAAC;IAED,sGAAsG;IACtG,KAAK,CAAC,MAAM,CACR,IAAgB,EAChB,UAAoD;QAEpD,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;YAC/B,OAAO,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,2CAAoB,EAAE,CAAC;QAC5C,6BAAc,CAAC,SAAS,CAAC,wBAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE1D,MAAM,cAAc,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAEtD,4HAA4H;QAC5H,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/C,cAAc,CAAC,eAAe,GAAG,QAAQ,CAAC,QAAQ,CAAC;YACnD,OAAO,QAAQ,CAAC;QACpB,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,MAAM,KAAK,GAAG,IAAA,mBAAO,EAAC,GAAG,CAAC,CAAC;YAC3B,cAAc,CAAC,eAAe,GAAG,IAAI,yBAAa,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9E,MAAM,GAAG,CAAC;QACd,CAAC;gBAAS,CAAC;YACP,6BAAc,CAAC,MAAM,CAAC,wBAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAClD,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAEO,oBAAoB;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,4EAA4E;QAC5E,OAAO,6BAAc,CAAC,SAAS,CAAC,gCAAoB,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAEO,mBAAmB,CAAC,IAAgB;QACxC,8EAA8E;QAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,qBAAqB,CAAC,0BAAc,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,EAAE,IAAI,mCAAoB,EAAE,CAAC,CAAC;QAC1H,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACnC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;QAC1E,OAAO,IAAI,4BAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1F,CAAC;CACJ,CAAA;AAzDY,0CAAe;0BAAf,eAAe;IAH3B,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IACb,sGAAsG;;IAK7F,mBAAA,IAAA,kBAAM,EAAC,qCAAsB,CAAC,CAAA;6CAAiB,8BAAe;GAJ1D,eAAe,CAyD3B","sourcesContent":["import { inject, injectable } from 'inversify';\nimport {\n    provideFrameworkSingleton,\n    MethodMeta,\n    RequestContextReader,\n    WebpiecesConfig,\n    WEBPIECES_CONFIG_TOKEN,\n} from '@webpieces/http-routing';\nimport { RequestContext } from '@webpieces/core-context';\nimport { Filter, WpResponse, Service } from '@webpieces/http-routing';\nimport {\n    HeaderMethods,\n    HeaderRegistry,\n    RecordedEndpoint,\n    RecordedError,\n    RecorderKeys,\n    WebpiecesCoreHeaders,\n    toError,\n} from '@webpieces/core-util';\n\nimport { TestCaseRecorderImpl } from '../recorder/TestCaseRecorderImpl';\n\n/**\n * RecordingFilter - Records a request as a replayable test case (port of Java\n * RecordingFilter).\n *\n * Suggested priority: 1850 (after ContextFilter 2000 so the RECORDING header\n * has been transferred to the context, after AuthFilter 1900 so only real\n * authorized flows are recorded, before LogApiFilter 1800).\n *\n * Activates when WebpiecesConfig.recordingAlwaysOn is set OR the request\n * carries WebpiecesCoreHeaders.RECORDING (x-webpieces-recording). While\n * active, a TestCaseRecorderImpl travels in the RequestContext under\n * RecorderKeys.RECORDER; the http-client proxy and recordable() wrappers add\n * every downstream call. On completion the fixture + generated spec are\n * logged (and written to config.recordingDir when set).\n *\n * Recording NEVER alters the response - failures inside the recorder are\n * caught and logged.\n */\n@provideFrameworkSingleton()\n@injectable()\n// webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\nexport class RecordingFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    private headerMethods = new HeaderMethods();\n\n    constructor(\n        @inject(WEBPIECES_CONFIG_TOKEN) private config: WebpiecesConfig,\n    ) {\n        super();\n    }\n\n    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\n    async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        if (!this.isRecordingRequested()) {\n            return await nextFilter.invoke(meta);\n        }\n\n        const recorder = new TestCaseRecorderImpl();\n        RequestContext.putHeader(RecorderKeys.RECORDER, recorder);\n\n        const serverEndpoint = this.buildServerEndpoint(meta);\n\n        // eslint-disable-next-line @webpieces/no-unmanaged-exceptions -- capture failure into the recording, then rethrow unchanged\n        try {\n            const response = await nextFilter.invoke(meta);\n            serverEndpoint.successResponse = response.response;\n            return response;\n        } catch (err: unknown) {\n            const error = toError(err);\n            serverEndpoint.failureResponse = new RecordedError(error.name, error.message);\n            throw err;\n        } finally {\n            RequestContext.remove(RecorderKeys.RECORDER.name);\n            recorder.spitOutTestCase(serverEndpoint, this.config.recordingDir);\n        }\n    }\n\n    private isRecordingRequested(): boolean {\n        if (this.config.recordingAlwaysOn) {\n            return true;\n        }\n        // ContextFilter (priority 2000) already transferred the header into context\n        return RequestContext.hasHeader(WebpiecesCoreHeaders.RECORDING);\n    }\n\n    private buildServerEndpoint(meta: MethodMeta): RecordedEndpoint {\n        // Masked snapshot of the magic context (secured values masked, keyed by name)\n        const logMap = this.headerMethods.buildSecureMapForLogs(HeaderRegistry.get().getLoggedKeys(), new RequestContextReader());\n        const ctxSnapshot: Record<string, string> = {};\n        for (const entry of logMap.entries()) {\n            ctxSnapshot[entry[0]] = entry[1];\n        }\n\n        const apiName = meta.routeMeta.controllerClassName ?? 'UnknownController';\n        return new RecordedEndpoint(apiName, meta.methodName, [meta.requestDto], ctxSnapshot);\n    }\n}\n"]}

package/src/index.d.ts

@@ -1,15 +1,11 @@
-export { WebpiecesExpress } from './WebpiecesExpress';
+export { WebpiecesExpressRouter } from './WebpiecesExpressRouter';
 export { WebpiecesMiddleware } from './WebpiecesMiddleware';
-export { WebpiecesRouteCreator } from './WebpiecesRouteCreator';
-export { InProcessApiClientFactory } from '@webpieces/http-routing';
-export { ContextFilter } from './filters/ContextFilter';
 export { LogApiFilter } from './filters/LogApiFilter';
 export { RecordingFilter } from './filters/RecordingFilter';
-export { ServiceAuthFilter } from './filters/ServiceAuthFilter';
 export { TestCaseRecorderImpl } from './recorder/TestCaseRecorderImpl';
 export { SpecGenerator } from './recorder/SpecGenerator';
 export { recordable } from './recorder/recordable';
 export { WebpiecesCoreHeaders } from './headers/WebpiecesCoreHeaders';
 export { HeaderRegistry } from '@webpieces/core-util';
-export { RouteHandler, MethodMeta, RouteBuilderImpl, RouteHandlerWithMeta, FilterWithMeta, HttpFilter, FilterMatcher, FilterDefinition, } from '@webpieces/http-routing';
+export { RouteHandler, MethodMeta, HttpFilter, FilterMatcher, FilterDefinition, ApiFactory, ApiClient, HttpRequest, AuthConfig, Principal, } from '@webpieces/http-routing';
 export { ExpressRouteHandler } from './WebpiecesMiddleware';

package/src/index.js

@@ -1,24 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FilterDefinition = exports.FilterMatcher = exports.FilterWithMeta = exports.RouteHandlerWithMeta = exports.RouteBuilderImpl = exports.MethodMeta = exports.RouteHandler = exports.HeaderRegistry = exports.WebpiecesCoreHeaders = exports.recordable = exports.SpecGenerator = exports.TestCaseRecorderImpl = exports.ServiceAuthFilter = exports.RecordingFilter = exports.LogApiFilter = exports.ContextFilter = exports.InProcessApiClientFactory = exports.WebpiecesRouteCreator = exports.WebpiecesMiddleware = exports.WebpiecesExpress = void 0;
-// Express adapter (the only place express lifecycle lives) over the node-only WebpiecesRouter
-var WebpiecesExpress_1 = require("./WebpiecesExpress");
-Object.defineProperty(exports, "WebpiecesExpress", { enumerable: true, get: function () { return WebpiecesExpress_1.WebpiecesExpress; } });
+exports.Principal = exports.AuthConfig = exports.HttpRequest = exports.ApiClient = exports.FilterDefinition = exports.FilterMatcher = exports.MethodMeta = exports.RouteHandler = exports.HeaderRegistry = exports.WebpiecesCoreHeaders = exports.recordable = exports.SpecGenerator = exports.TestCaseRecorderImpl = exports.RecordingFilter = exports.LogApiFilter = exports.WebpiecesMiddleware = exports.WebpiecesExpressRouter = void 0;
+// Express adapter (the only place express lifecycle lives) over the node-only ApiFactory
+var WebpiecesExpressRouter_1 = require("./WebpiecesExpressRouter");
+Object.defineProperty(exports, "WebpiecesExpressRouter", { enumerable: true, get: function () { return WebpiecesExpressRouter_1.WebpiecesExpressRouter; } });
 var WebpiecesMiddleware_1 = require("./WebpiecesMiddleware");
 Object.defineProperty(exports, "WebpiecesMiddleware", { enumerable: true, get: function () { return WebpiecesMiddleware_1.WebpiecesMiddleware; } });
-var WebpiecesRouteCreator_1 = require("./WebpiecesRouteCreator");
-Object.defineProperty(exports, "WebpiecesRouteCreator", { enumerable: true, get: function () { return WebpiecesRouteCreator_1.WebpiecesRouteCreator; } });
-// InProcessApiClientFactory moved to node-only http-routing; re-export for back-compat
-var http_routing_1 = require("@webpieces/http-routing");
-Object.defineProperty(exports, "InProcessApiClientFactory", { enumerable: true, get: function () { return http_routing_1.InProcessApiClientFactory; } });
-var ContextFilter_1 = require("./filters/ContextFilter");
-Object.defineProperty(exports, "ContextFilter", { enumerable: true, get: function () { return ContextFilter_1.ContextFilter; } });
 var LogApiFilter_1 = require("./filters/LogApiFilter");
 Object.defineProperty(exports, "LogApiFilter", { enumerable: true, get: function () { return LogApiFilter_1.LogApiFilter; } });
 var RecordingFilter_1 = require("./filters/RecordingFilter");
 Object.defineProperty(exports, "RecordingFilter", { enumerable: true, get: function () { return RecordingFilter_1.RecordingFilter; } });
-var ServiceAuthFilter_1 = require("./filters/ServiceAuthFilter");
-Object.defineProperty(exports, "ServiceAuthFilter", { enumerable: true, get: function () { return ServiceAuthFilter_1.ServiceAuthFilter; } });
 // Test-case recording (contract lives in @webpieces/core-util)
 var TestCaseRecorderImpl_1 = require("./recorder/TestCaseRecorderImpl");
 Object.defineProperty(exports, "TestCaseRecorderImpl", { enumerable: true, get: function () { return TestCaseRecorderImpl_1.TestCaseRecorderImpl; } });
@@ -31,14 +22,14 @@ var WebpiecesCoreHeaders_1 = require("./headers/WebpiecesCoreHeaders");
 Object.defineProperty(exports, "WebpiecesCoreHeaders", { enumerable: true, get: function () { return WebpiecesCoreHeaders_1.WebpiecesCoreHeaders; } });
 var core_util_1 = require("@webpieces/core-util");
 Object.defineProperty(exports, "HeaderRegistry", { enumerable: true, get: function () { return core_util_1.HeaderRegistry; } });
-// Re-export from http-routing for backward compatibility
-// (FilterDefinition re-exported for one-import adapter ergonomics)
-var http_routing_2 = require("@webpieces/http-routing");
-Object.defineProperty(exports, "RouteHandler", { enumerable: true, get: function () { return http_routing_2.RouteHandler; } });
-Object.defineProperty(exports, "MethodMeta", { enumerable: true, get: function () { return http_routing_2.MethodMeta; } });
-Object.defineProperty(exports, "RouteBuilderImpl", { enumerable: true, get: function () { return http_routing_2.RouteBuilderImpl; } });
-Object.defineProperty(exports, "RouteHandlerWithMeta", { enumerable: true, get: function () { return http_routing_2.RouteHandlerWithMeta; } });
-Object.defineProperty(exports, "FilterWithMeta", { enumerable: true, get: function () { return http_routing_2.FilterWithMeta; } });
-Object.defineProperty(exports, "FilterMatcher", { enumerable: true, get: function () { return http_routing_2.FilterMatcher; } });
-Object.defineProperty(exports, "FilterDefinition", { enumerable: true, get: function () { return http_routing_2.FilterDefinition; } });
+// Re-export from http-routing for one-import adapter ergonomics
+var http_routing_1 = require("@webpieces/http-routing");
+Object.defineProperty(exports, "RouteHandler", { enumerable: true, get: function () { return http_routing_1.RouteHandler; } });
+Object.defineProperty(exports, "MethodMeta", { enumerable: true, get: function () { return http_routing_1.MethodMeta; } });
+Object.defineProperty(exports, "FilterMatcher", { enumerable: true, get: function () { return http_routing_1.FilterMatcher; } });
+Object.defineProperty(exports, "FilterDefinition", { enumerable: true, get: function () { return http_routing_1.FilterDefinition; } });
+Object.defineProperty(exports, "ApiClient", { enumerable: true, get: function () { return http_routing_1.ApiClient; } });
+Object.defineProperty(exports, "HttpRequest", { enumerable: true, get: function () { return http_routing_1.HttpRequest; } });
+Object.defineProperty(exports, "AuthConfig", { enumerable: true, get: function () { return http_routing_1.AuthConfig; } });
+Object.defineProperty(exports, "Principal", { enumerable: true, get: function () { return http_routing_1.Principal; } });
 //# sourceMappingURL=index.js.map

package/src/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/index.ts"],"names":[],"mappings":";;;AAAA,8FAA8F;AAC9F,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AACzB,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAC5B,iEAAgE;AAAvD,8HAAA,qBAAqB,OAAA;AAC9B,uFAAuF;AACvF,wDAAoE;AAA3D,yHAAA,yBAAyB,OAAA;AAClC,yDAAwD;AAA/C,8GAAA,aAAa,OAAA;AACtB,uDAAsD;AAA7C,4GAAA,YAAY,OAAA;AACrB,6DAA4D;AAAnD,kHAAA,eAAe,OAAA;AACxB,iEAAgE;AAAvD,sHAAA,iBAAiB,OAAA;AAE1B,+DAA+D;AAC/D,wEAAuE;AAA9D,4HAAA,oBAAoB,OAAA;AAC7B,0DAAyD;AAAhD,8GAAA,aAAa,OAAA;AACtB,oDAAmD;AAA1C,wGAAA,UAAU,OAAA;AAEnB,mEAAmE;AACnE,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,kDAAsD;AAA7C,2GAAA,cAAc,OAAA;AAEvB,yDAAyD;AACzD,mEAAmE;AACnE,wDASiC;AAR7B,4GAAA,YAAY,OAAA;AACZ,0GAAA,UAAU,OAAA;AACV,gHAAA,gBAAgB,OAAA;AAChB,oHAAA,oBAAoB,OAAA;AACpB,8GAAA,cAAc,OAAA;AAEd,6GAAA,aAAa,OAAA;AACb,gHAAA,gBAAgB,OAAA","sourcesContent":["// Express adapter (the only place express lifecycle lives) over the node-only WebpiecesRouter\nexport { WebpiecesExpress } from './WebpiecesExpress';\nexport { WebpiecesMiddleware } from './WebpiecesMiddleware';\nexport { WebpiecesRouteCreator } from './WebpiecesRouteCreator';\n// InProcessApiClientFactory moved to node-only http-routing; re-export for back-compat\nexport { InProcessApiClientFactory } from '@webpieces/http-routing';\nexport { ContextFilter } from './filters/ContextFilter';\nexport { LogApiFilter } from './filters/LogApiFilter';\nexport { RecordingFilter } from './filters/RecordingFilter';\nexport { ServiceAuthFilter } from './filters/ServiceAuthFilter';\n\n// Test-case recording (contract lives in @webpieces/core-util)\nexport { TestCaseRecorderImpl } from './recorder/TestCaseRecorderImpl';\nexport { SpecGenerator } from './recorder/SpecGenerator';\nexport { recordable } from './recorder/recordable';\n\n// Context keys + registry (the global magic-context header system)\nexport { WebpiecesCoreHeaders } from './headers/WebpiecesCoreHeaders';\nexport { HeaderRegistry } from '@webpieces/core-util';\n\n// Re-export from http-routing for backward compatibility\n// (FilterDefinition re-exported for one-import adapter ergonomics)\nexport {\n    RouteHandler,\n    MethodMeta,\n    RouteBuilderImpl,\n    RouteHandlerWithMeta,\n    FilterWithMeta,\n    HttpFilter,\n    FilterMatcher,\n    FilterDefinition,\n} from '@webpieces/http-routing';\n// ExpressRouteHandler now lives in http-server (express adapter), not node-only http-routing\nexport { ExpressRouteHandler } from './WebpiecesMiddleware';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/index.ts"],"names":[],"mappings":";;;AAAA,yFAAyF;AACzF,mEAAkE;AAAzD,gIAAA,sBAAsB,OAAA;AAC/B,6DAA4D;AAAnD,0HAAA,mBAAmB,OAAA;AAC5B,uDAAsD;AAA7C,4GAAA,YAAY,OAAA;AACrB,6DAA4D;AAAnD,kHAAA,eAAe,OAAA;AAExB,+DAA+D;AAC/D,wEAAuE;AAA9D,4HAAA,oBAAoB,OAAA;AAC7B,0DAAyD;AAAhD,8GAAA,aAAa,OAAA;AACtB,oDAAmD;AAA1C,wGAAA,UAAU,OAAA;AAEnB,mEAAmE;AACnE,uEAAsE;AAA7D,4HAAA,oBAAoB,OAAA;AAC7B,kDAAsD;AAA7C,2GAAA,cAAc,OAAA;AAEvB,gEAAgE;AAChE,wDAWiC;AAV7B,4GAAA,YAAY,OAAA;AACZ,0GAAA,UAAU,OAAA;AAEV,6GAAA,aAAa,OAAA;AACb,gHAAA,gBAAgB,OAAA;AAEhB,yGAAA,SAAS,OAAA;AACT,2GAAA,WAAW,OAAA;AACX,0GAAA,UAAU,OAAA;AACV,yGAAA,SAAS,OAAA","sourcesContent":["// Express adapter (the only place express lifecycle lives) over the node-only ApiFactory\nexport { WebpiecesExpressRouter } from './WebpiecesExpressRouter';\nexport { WebpiecesMiddleware } from './WebpiecesMiddleware';\nexport { LogApiFilter } from './filters/LogApiFilter';\nexport { RecordingFilter } from './filters/RecordingFilter';\n\n// Test-case recording (contract lives in @webpieces/core-util)\nexport { TestCaseRecorderImpl } from './recorder/TestCaseRecorderImpl';\nexport { SpecGenerator } from './recorder/SpecGenerator';\nexport { recordable } from './recorder/recordable';\n\n// Context keys + registry (the global magic-context header system)\nexport { WebpiecesCoreHeaders } from './headers/WebpiecesCoreHeaders';\nexport { HeaderRegistry } from '@webpieces/core-util';\n\n// Re-export from http-routing for one-import adapter ergonomics\nexport {\n    RouteHandler,\n    MethodMeta,\n    HttpFilter,\n    FilterMatcher,\n    FilterDefinition,\n    ApiFactory,\n    ApiClient,\n    HttpRequest,\n    AuthConfig,\n    Principal,\n} from '@webpieces/http-routing';\n// ExpressRouteHandler now lives in http-server (express adapter), not node-only http-routing\nexport { ExpressRouteHandler } from './WebpiecesMiddleware';\n"]}

package/src/WebpiecesExpress.d.ts

@@ -1,44 +0,0 @@
-import { Express } from 'express';
-import { WebpiecesRouter } from '@webpieces/http-routing';
-/** The value returned by express `app.listen(...)` (a node http.Server). */
-type HttpServer = ReturnType<Express['listen']>;
-/**
- * WebpiecesExpress - the express adapter (the ONLY place express lifecycle lives).
- *
- * Wraps a node-only {@link WebpiecesRouter} and binds its routes + filter chain onto an
- * express app that the CALLER owns. Webpieces never constructs express and (except for the
- * opt-in bindAndStartExpress) never calls listen — so a webpieces app can run side-by-side
- * inside a legacy express server.
- *
- * ```typescript
- * const router = await WebpiecesRouterFactory.create(config, { modules });
- * router.addRoutes(SaveApi, SaveController);
- * const server = new WebpiecesExpress(router);
- *
- * // legacy / side-by-side: mount onto an existing app; you own listen + your middleware
- * server.bindExpress(existingApp);
- *
- * // non-legacy: add webpieces global middleware + listen for you
- * await server.bindAndStartExpress(express(), 8080);
- * ```
- */
-export declare class WebpiecesExpress {
-    private readonly router;
-    private readonly middleware;
-    constructor(router: WebpiecesRouter);
-    /**
-     * Mount the webpieces routes (each fully self-contained: own body parse, RequestContext,
-     * express-tier + api-tier filter chain, error->JSON) onto the caller's express app.
-     *
-     * Adds NO global app.use() middleware, so it is safe to attach to a legacy app whose
-     * other routes must stay untouched. The caller owns app.listen() and any global middleware.
-     */
-    bindExpress(app: Express): void;
-    /**
-     * Add the webpieces global middleware (HTML error page, localhost CORS, request logging),
-     * bind the routes, then app.listen(port). Convenience for a non-legacy webpieces server
-     * where webpieces owns the whole express app. Resolves with the http.Server once listening.
-     */
-    bindAndStartExpress(app: Express, port?: number): Promise<HttpServer>;
-}
-export {};

package/src/WebpiecesExpress.js

@@ -1,71 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.WebpiecesExpress = void 0;
-const WebpiecesMiddleware_1 = require("./WebpiecesMiddleware");
-const WebpiecesRouteCreator_1 = require("./WebpiecesRouteCreator");
-const core_util_1 = require("@webpieces/core-util");
-const log = core_util_1.LogManager.getLogger('WebpiecesExpress');
-/**
- * WebpiecesExpress - the express adapter (the ONLY place express lifecycle lives).
- *
- * Wraps a node-only {@link WebpiecesRouter} and binds its routes + filter chain onto an
- * express app that the CALLER owns. Webpieces never constructs express and (except for the
- * opt-in bindAndStartExpress) never calls listen — so a webpieces app can run side-by-side
- * inside a legacy express server.
- *
- * ```typescript
- * const router = await WebpiecesRouterFactory.create(config, { modules });
- * router.addRoutes(SaveApi, SaveController);
- * const server = new WebpiecesExpress(router);
- *
- * // legacy / side-by-side: mount onto an existing app; you own listen + your middleware
- * server.bindExpress(existingApp);
- *
- * // non-legacy: add webpieces global middleware + listen for you
- * await server.bindAndStartExpress(express(), 8080);
- * ```
- */
-class WebpiecesExpress {
-    router;
-    middleware = new WebpiecesMiddleware_1.WebpiecesMiddleware();
-    constructor(router) {
-        this.router = router;
-    }
-    /**
-     * Mount the webpieces routes (each fully self-contained: own body parse, RequestContext,
-     * express-tier + api-tier filter chain, error->JSON) onto the caller's express app.
-     *
-     * Adds NO global app.use() middleware, so it is safe to attach to a legacy app whose
-     * other routes must stay untouched. The caller owns app.listen() and any global middleware.
-     */
-    bindExpress(app) {
-        const creator = new WebpiecesRouteCreator_1.WebpiecesRouteCreator(app, this.router.getContainer(), this.router.getRouteBuilder(), this.middleware);
-        const count = creator.mountRegisteredRoutes();
-        log.info(`[WebpiecesExpress] Mounted ${count} webpieces route(s) onto express`);
-    }
-    /**
-     * Add the webpieces global middleware (HTML error page, localhost CORS, request logging),
-     * bind the routes, then app.listen(port). Convenience for a non-legacy webpieces server
-     * where webpieces owns the whole express app. Resolves with the http.Server once listening.
-     */
-    async bindAndStartExpress(app, port = 8080) {
-        // Global middleware layers (outermost first) — only for a webpieces-owned app.
-        app.use(this.middleware.globalErrorHandler.bind(this.middleware));
-        app.use(this.middleware.corsForLocalhost());
-        app.use(this.middleware.logNextLayer.bind(this.middleware));
-        this.bindExpress(app);
-        return new Promise((resolve, reject) => {
-            const server = app.listen(port, (error) => {
-                if (error) {
-                    log.error(`[WebpiecesExpress] Failed to start on port ${port}:`, error);
-                    reject(error);
-                    return;
-                }
-                log.info(`[WebpiecesExpress] Listening on http://localhost:${port}`);
-                resolve(server);
-            });
-        });
-    }
-}
-exports.WebpiecesExpress = WebpiecesExpress;
-//# sourceMappingURL=WebpiecesExpress.js.map

package/src/WebpiecesExpress.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"WebpiecesExpress.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/WebpiecesExpress.ts"],"names":[],"mappings":";;;AAEA,+DAA4D;AAC5D,mEAAgE;AAChE,oDAAkD;AAElD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;AAKrD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAa,gBAAgB;IAGI;IAFZ,UAAU,GAAG,IAAI,yCAAmB,EAAE,CAAC;IAExD,YAA6B,MAAuB;QAAvB,WAAM,GAAN,MAAM,CAAiB;IAAG,CAAC;IAExD;;;;;;OAMG;IACH,WAAW,CAAC,GAAY;QACpB,MAAM,OAAO,GAAG,IAAI,6CAAqB,CACrC,GAAG,EACH,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,EAC1B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,EAC7B,IAAI,CAAC,UAAU,CAClB,CAAC;QACF,MAAM,KAAK,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,8BAA8B,KAAK,kCAAkC,CAAC,CAAC;IACpF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,GAAY,EAAE,OAAe,IAAI;QACvD,+EAA+E;QAC/E,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAE5D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAEtB,OAAO,IAAI,OAAO,CACd,CAAC,OAAqC,EAAE,MAA4B,EAAE,EAAE;YACpE,MAAM,MAAM,GAAe,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC1D,IAAI,KAAK,EAAE,CAAC;oBACR,GAAG,CAAC,KAAK,CAAC,8CAA8C,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;oBACxE,MAAM,CAAC,KAAK,CAAC,CAAC;oBACd,OAAO;gBACX,CAAC;gBACD,GAAG,CAAC,IAAI,CAAC,oDAAoD,IAAI,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACP,CAAC,CACJ,CAAC;IACN,CAAC;CACJ;AAlDD,4CAkDC","sourcesContent":["import { Express } from 'express';\nimport { WebpiecesRouter } from '@webpieces/http-routing';\nimport { WebpiecesMiddleware } from './WebpiecesMiddleware';\nimport { WebpiecesRouteCreator } from './WebpiecesRouteCreator';\nimport { LogManager } from '@webpieces/core-util';\n\nconst log = LogManager.getLogger('WebpiecesExpress');\n\n/** The value returned by express `app.listen(...)` (a node http.Server). */\ntype HttpServer = ReturnType<Express['listen']>;\n\n/**\n * WebpiecesExpress - the express adapter (the ONLY place express lifecycle lives).\n *\n * Wraps a node-only {@link WebpiecesRouter} and binds its routes + filter chain onto an\n * express app that the CALLER owns. Webpieces never constructs express and (except for the\n * opt-in bindAndStartExpress) never calls listen — so a webpieces app can run side-by-side\n * inside a legacy express server.\n *\n * ```typescript\n * const router = await WebpiecesRouterFactory.create(config, { modules });\n * router.addRoutes(SaveApi, SaveController);\n * const server = new WebpiecesExpress(router);\n *\n * // legacy / side-by-side: mount onto an existing app; you own listen + your middleware\n * server.bindExpress(existingApp);\n *\n * // non-legacy: add webpieces global middleware + listen for you\n * await server.bindAndStartExpress(express(), 8080);\n * ```\n */\nexport class WebpiecesExpress {\n    private readonly middleware = new WebpiecesMiddleware();\n\n    constructor(private readonly router: WebpiecesRouter) {}\n\n    /**\n     * Mount the webpieces routes (each fully self-contained: own body parse, RequestContext,\n     * express-tier + api-tier filter chain, error->JSON) onto the caller's express app.\n     *\n     * Adds NO global app.use() middleware, so it is safe to attach to a legacy app whose\n     * other routes must stay untouched. The caller owns app.listen() and any global middleware.\n     */\n    bindExpress(app: Express): void {\n        const creator = new WebpiecesRouteCreator(\n            app,\n            this.router.getContainer(),\n            this.router.getRouteBuilder(),\n            this.middleware,\n        );\n        const count = creator.mountRegisteredRoutes();\n        log.info(`[WebpiecesExpress] Mounted ${count} webpieces route(s) onto express`);\n    }\n\n    /**\n     * Add the webpieces global middleware (HTML error page, localhost CORS, request logging),\n     * bind the routes, then app.listen(port). Convenience for a non-legacy webpieces server\n     * where webpieces owns the whole express app. Resolves with the http.Server once listening.\n     */\n    async bindAndStartExpress(app: Express, port: number = 8080): Promise<HttpServer> {\n        // Global middleware layers (outermost first) — only for a webpieces-owned app.\n        app.use(this.middleware.globalErrorHandler.bind(this.middleware));\n        app.use(this.middleware.corsForLocalhost());\n        app.use(this.middleware.logNextLayer.bind(this.middleware));\n\n        this.bindExpress(app);\n\n        return new Promise<HttpServer>(\n            (resolve: (server: HttpServer) => void, reject: (err: Error) => void) => {\n                const server: HttpServer = app.listen(port, (error?: Error) => {\n                    if (error) {\n                        log.error(`[WebpiecesExpress] Failed to start on port ${port}:`, error);\n                        reject(error);\n                        return;\n                    }\n                    log.info(`[WebpiecesExpress] Listening on http://localhost:${port}`);\n                    resolve(server);\n                });\n            },\n        );\n    }\n}\n"]}

package/src/WebpiecesRouteCreator.d.ts

@@ -1,52 +0,0 @@
-import { Express } from 'express';
-import { Container } from 'inversify';
-import { ClassType, FilterDefinition, RouteBuilderImpl } from '@webpieces/http-routing';
-import { WebpiecesMiddleware } from './WebpiecesMiddleware';
-export declare class WebpiecesRouteCreator {
-    private app;
-    private routeBuilder;
-    private middleware;
-    private clientFactory;
-    /** Locks wireFilters() once the first wireApi() has composed a filter chain. */
-    private apisWired;
-    /**
-     * @param app - The Express app to mount routes on (yours - never taken over)
-     * @param container - Inversify container used to resolve controllers and filters
-     * @param routeBuilder - Internal: WebpiecesExpress passes its DI singleton; standalone users omit
-     * @param middleware - Internal: WebpiecesExpress passes its DI singleton; standalone users omit
-     */
-    constructor(app: Express, container: Container, routeBuilder?: RouteBuilderImpl, middleware?: WebpiecesMiddleware);
-    /**
-     * Register filters that wrap every matching route (glob pattern vs controller filepath).
-     * Must be called before the first wireApi() - filter chains are composed per-route.
-     */
-    wireFilters(...defs: FilterDefinition[]): void;
-    /**
-     * Wire an API prototype class (with @ApiPath/@Endpoint decorators) to its
-     * controller, mounting one Express route per endpoint with the full filter
-     * chain. The controller is resolved from the Inversify container.
-     */
-    wireApi<TApi, TController extends TApi>(apiPrototype: ClassType<TApi>, controllerClass: ClassType<TController>): void;
-    /**
-     * Mount every route currently registered on the RouteBuilder.
-     * Used by WebpiecesExpress (the full-server path) where routes were registered
-     * up front on the shared RouteBuilder.
-     *
-     * @returns Number of routes mounted
-     */
-    mountRegisteredRoutes(): number;
-    /**
-     * Create an in-process API client (full filter chain + controller, no HTTP).
-     * Same testing story as WebpiecesServer.createApiClient().
-     */
-    createApiClient<T>(apiPrototype: abstract new (...args: any[]) => T): T;
-    /**
-     * Escape hatch for advanced wiring (e.g. addRoute with a hand-built RouteDefinition).
-     */
-    getRouteBuilder(): RouteBuilderImpl;
-    /**
-     * Compose the filter chain for one route and register it on the Express app.
-     */
-    private mountRoute;
-    private registerHandler;
-}

package/src/WebpiecesRouteCreator.js

@@ -1,160 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.WebpiecesRouteCreator = void 0;
-const http_routing_1 = require("@webpieces/http-routing");
-const WebpiecesMiddleware_1 = require("./WebpiecesMiddleware");
-const core_util_1 = require("@webpieces/core-util");
-/**
- * WebpiecesRouteCreator - Embeddable adapter that mounts the webpieces
- * api -> filters -> controller pipeline onto ANY existing Express app.
- *
- * Legacy Express apps can adopt webpieces incrementally: existing routes and
- * middleware keep working untouched; each wired webpieces route is fully
- * self-contained (own body parsing, own RequestContext, own error->JSON mapping).
- * This class never calls app.use() - it only registers per-route handlers.
- *
- * Usage (the legacy-server example app builds the container via the shared
- * setupCompanyRuntime + router.getContainer(); a bare standalone user can also
- * assemble one directly):
- * ```typescript
- * const app = express();                       // your existing legacy app
- * const container = new Container();
- * await container.load(buildFrameworkModule()); // webpieces framework classes (ContextFilter, ...)
- * await container.load(buildProviderModule());  // your @provideSingleton controllers/filters
- *
- * const creator = new WebpiecesRouteCreator(app, container);
- * creator.wireFilters(
- *     new FilterDefinition(2000, ContextFilter, '*'),
- *     new FilterDefinition(1900, AuthFilter, 'src/controllers/admin/**'),
- * );
- * creator.wireApi(SaveApi, SaveController);    // controller resolved from container
- * creator.wireApi(PublicApi, PublicController);
- * app.listen(8080);
- * ```
- *
- * Notes:
- * - ALL wireFilters() calls must come BEFORE the first wireApi() call. Filter
- *   chains are composed per-route at wireApi time, so late filters would be
- *   silently ignored - we throw instead.
- * - Scoped filter glob patterns match the controller filepath from the
- *   @SourceFile decorator, falling back to the pattern `**\/{ClassName}.ts`.
- * - Want webpieces' localhost CORS? Opt in yourself:
- *   `app.use(new WebpiecesMiddleware().corsForLocalhost())`.
- *
- * This same class is used internally by WebpiecesExpress (the full-server express
- * adapter), so the full server and the embeddable adapter share one code path.
- */
-const log = core_util_1.LogManager.getLogger('WebpiecesRouteCreator');
-class WebpiecesRouteCreator {
-    app;
-    routeBuilder;
-    middleware;
-    clientFactory;
-    /** Locks wireFilters() once the first wireApi() has composed a filter chain. */
-    apisWired = false;
-    /**
-     * @param app - The Express app to mount routes on (yours - never taken over)
-     * @param container - Inversify container used to resolve controllers and filters
-     * @param routeBuilder - Internal: WebpiecesExpress passes its DI singleton; standalone users omit
-     * @param middleware - Internal: WebpiecesExpress passes its DI singleton; standalone users omit
-     */
-    constructor(app, container, routeBuilder, middleware) {
-        this.app = app;
-        this.routeBuilder = routeBuilder ?? new http_routing_1.RouteBuilderImpl();
-        this.routeBuilder.setContainer(container);
-        this.middleware = middleware ?? new WebpiecesMiddleware_1.WebpiecesMiddleware();
-        this.clientFactory = new http_routing_1.InProcessApiClientFactory(this.routeBuilder);
-    }
-    /**
-     * Register filters that wrap every matching route (glob pattern vs controller filepath).
-     * Must be called before the first wireApi() - filter chains are composed per-route.
-     */
-    wireFilters(...defs) {
-        if (this.apisWired) {
-            throw new Error('wireFilters() must be called before wireApi() - filter chains are composed per-route at wireApi time, so filters added later would never run.');
-        }
-        for (const def of defs) {
-            this.routeBuilder.addFilter(def);
-        }
-    }
-    /**
-     * Wire an API prototype class (with @ApiPath/@Endpoint decorators) to its
-     * controller, mounting one Express route per endpoint with the full filter
-     * chain. The controller is resolved from the Inversify container.
-     */
-    wireApi(apiPrototype, controllerClass) {
-        this.apisWired = true;
-        // Reuses all existing validation: @ApiPath present, controller extends
-        // api prototype, every endpoint implemented + has @Authentication.
-        const factory = new http_routing_1.ApiRoutingFactory(apiPrototype, controllerClass);
-        // Mount only the routes added by THIS call
-        const routesBefore = this.routeBuilder.getRoutes().length;
-        factory.configure(this.routeBuilder);
-        const routes = this.routeBuilder.getRoutes();
-        for (let i = routesBefore; i < routes.length; i++) {
-            this.mountRoute(routes[i]);
-        }
-    }
-    /**
-     * Mount every route currently registered on the RouteBuilder.
-     * Used by WebpiecesExpress (the full-server path) where routes were registered
-     * up front on the shared RouteBuilder.
-     *
-     * @returns Number of routes mounted
-     */
-    mountRegisteredRoutes() {
-        const routes = this.routeBuilder.getRoutes();
-        for (const routeWithMeta of routes) {
-            this.mountRoute(routeWithMeta);
-        }
-        return routes.length;
-    }
-    /**
-     * Create an in-process API client (full filter chain + controller, no HTTP).
-     * Same testing story as WebpiecesServer.createApiClient().
-     */
-    // webpieces-disable no-any-unknown -- abstract constructor signature requires any[] args
-    createApiClient(apiPrototype) {
-        return this.clientFactory.createApiClient(apiPrototype);
-    }
-    /**
-     * Escape hatch for advanced wiring (e.g. addRoute with a hand-built RouteDefinition).
-     */
-    getRouteBuilder() {
-        return this.routeBuilder;
-    }
-    /**
-     * Compose the filter chain for one route and register it on the Express app.
-     */
-    mountRoute(routeWithMeta) {
-        const service = this.routeBuilder.createRouteHandler(routeWithMeta);
-        const routeMeta = routeWithMeta.definition.routeMeta;
-        // ExpressWrapper handles the full request/response cycle per route:
-        // RequestContext.run, header read, manual JSON body parse, error->ProtocolError
-        const wrapper = this.middleware.createExpressWrapper(service, routeMeta);
-        this.registerHandler(routeMeta.httpMethod, routeMeta.path, wrapper.execute.bind(wrapper));
-    }
-    registerHandler(httpMethod, path, expressHandler) {
-        switch (httpMethod.toLowerCase()) {
-            case 'get':
-                this.app.get(path, expressHandler);
-                break;
-            case 'post':
-                this.app.post(path, expressHandler);
-                break;
-            case 'put':
-                this.app.put(path, expressHandler);
-                break;
-            case 'delete':
-                this.app.delete(path, expressHandler);
-                break;
-            case 'patch':
-                this.app.patch(path, expressHandler);
-                break;
-            default:
-                log.warn(`[WebpiecesRouteCreator] Unknown HTTP method: ${httpMethod}`);
-        }
-    }
-}
-exports.WebpiecesRouteCreator = WebpiecesRouteCreator;
-//# sourceMappingURL=WebpiecesRouteCreator.js.map

package/src/WebpiecesRouteCreator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"WebpiecesRouteCreator.js","sourceRoot":"","sources":["../../../../../packages/http/http-server/src/WebpiecesRouteCreator.ts"],"names":[],"mappings":";;;AAEA,0DAOiC;AACjC,+DAAiF;AACjF,oDAAkD;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;AAE1D,MAAa,qBAAqB;IAelB;IAdJ,YAAY,CAAmB;IAC/B,UAAU,CAAsB;IAChC,aAAa,CAA4B;IAEjD,gFAAgF;IACxE,SAAS,GAAG,KAAK,CAAC;IAE1B;;;;;OAKG;IACH,YACY,GAAY,EACpB,SAAoB,EACpB,YAA+B,EAC/B,UAAgC;QAHxB,QAAG,GAAH,GAAG,CAAS;QAKpB,IAAI,CAAC,YAAY,GAAG,YAAY,IAAI,IAAI,+BAAgB,EAAE,CAAC;QAC3D,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI,IAAI,yCAAmB,EAAE,CAAC;QAC1D,IAAI,CAAC,aAAa,GAAG,IAAI,wCAAyB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1E,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,GAAG,IAAwB;QACnC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACX,+IAA+I,CAClJ,CAAC;QACN,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,OAAO,CACH,YAA6B,EAC7B,eAAuC;QAEvC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QAEtB,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,OAAO,GAAG,IAAI,gCAAiB,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAErE,2CAA2C;QAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;QAC1D,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAE7C,KAAK,IAAI,CAAC,GAAG,YAAY,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB;QACjB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;QAC7C,KAAK,MAAM,aAAa,IAAI,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,yFAAyF;IACzF,eAAe,CAAI,YAAgD;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,eAAe;QACX,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,aAAmC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QAErD,oEAAoE;QACpE,gFAAgF;QAChF,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEzE,IAAI,CAAC,eAAe,CAChB,SAAS,CAAC,UAAU,EACpB,SAAS,CAAC,IAAI,EACd,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAChC,CAAC;IACN,CAAC;IAEO,eAAe,CAAC,UAAkB,EAAE,IAAY,EAAE,cAAmC;QACzF,QAAQ,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/B,KAAK,KAAK;gBACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnC,MAAM;YACV,KAAK,MAAM;gBACP,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACpC,MAAM;YACV,KAAK,KAAK;gBACN,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACnC,MAAM;YACV,KAAK,QAAQ;gBACT,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACtC,MAAM;YACV,KAAK,OAAO;gBACR,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACrC,MAAM;YACV;gBACI,GAAG,CAAC,IAAI,CAAC,gDAAgD,UAAU,EAAE,CAAC,CAAC;QAC/E,CAAC;IACL,CAAC;CACJ;AAxID,sDAwIC","sourcesContent":["import { Express } from 'express';\nimport { Container } from 'inversify';\nimport {\n    ApiRoutingFactory,\n    ClassType,\n    FilterDefinition,\n    RouteBuilderImpl,\n    RouteHandlerWithMeta,\n    InProcessApiClientFactory,\n} from '@webpieces/http-routing';\nimport { WebpiecesMiddleware, ExpressRouteHandler } from './WebpiecesMiddleware';\nimport { LogManager } from '@webpieces/core-util';\n\n/**\n * WebpiecesRouteCreator - Embeddable adapter that mounts the webpieces\n * api -> filters -> controller pipeline onto ANY existing Express app.\n *\n * Legacy Express apps can adopt webpieces incrementally: existing routes and\n * middleware keep working untouched; each wired webpieces route is fully\n * self-contained (own body parsing, own RequestContext, own error->JSON mapping).\n * This class never calls app.use() - it only registers per-route handlers.\n *\n * Usage (the legacy-server example app builds the container via the shared\n * setupCompanyRuntime + router.getContainer(); a bare standalone user can also\n * assemble one directly):\n * ```typescript\n * const app = express();                       // your existing legacy app\n * const container = new Container();\n * await container.load(buildFrameworkModule()); // webpieces framework classes (ContextFilter, ...)\n * await container.load(buildProviderModule());  // your @provideSingleton controllers/filters\n *\n * const creator = new WebpiecesRouteCreator(app, container);\n * creator.wireFilters(\n *     new FilterDefinition(2000, ContextFilter, '*'),\n *     new FilterDefinition(1900, AuthFilter, 'src/controllers/admin/**'),\n * );\n * creator.wireApi(SaveApi, SaveController);    // controller resolved from container\n * creator.wireApi(PublicApi, PublicController);\n * app.listen(8080);\n * ```\n *\n * Notes:\n * - ALL wireFilters() calls must come BEFORE the first wireApi() call. Filter\n *   chains are composed per-route at wireApi time, so late filters would be\n *   silently ignored - we throw instead.\n * - Scoped filter glob patterns match the controller filepath from the\n *   @SourceFile decorator, falling back to the pattern `**\\/{ClassName}.ts`.\n * - Want webpieces' localhost CORS? Opt in yourself:\n *   `app.use(new WebpiecesMiddleware().corsForLocalhost())`.\n *\n * This same class is used internally by WebpiecesExpress (the full-server express\n * adapter), so the full server and the embeddable adapter share one code path.\n */\nconst log = LogManager.getLogger('WebpiecesRouteCreator');\n\nexport class WebpiecesRouteCreator {\n    private routeBuilder: RouteBuilderImpl;\n    private middleware: WebpiecesMiddleware;\n    private clientFactory: InProcessApiClientFactory;\n\n    /** Locks wireFilters() once the first wireApi() has composed a filter chain. */\n    private apisWired = false;\n\n    /**\n     * @param app - The Express app to mount routes on (yours - never taken over)\n     * @param container - Inversify container used to resolve controllers and filters\n     * @param routeBuilder - Internal: WebpiecesExpress passes its DI singleton; standalone users omit\n     * @param middleware - Internal: WebpiecesExpress passes its DI singleton; standalone users omit\n     */\n    constructor(\n        private app: Express,\n        container: Container,\n        routeBuilder?: RouteBuilderImpl,\n        middleware?: WebpiecesMiddleware,\n    ) {\n        this.routeBuilder = routeBuilder ?? new RouteBuilderImpl();\n        this.routeBuilder.setContainer(container);\n        this.middleware = middleware ?? new WebpiecesMiddleware();\n        this.clientFactory = new InProcessApiClientFactory(this.routeBuilder);\n    }\n\n    /**\n     * Register filters that wrap every matching route (glob pattern vs controller filepath).\n     * Must be called before the first wireApi() - filter chains are composed per-route.\n     */\n    wireFilters(...defs: FilterDefinition[]): void {\n        if (this.apisWired) {\n            throw new Error(\n                'wireFilters() must be called before wireApi() - filter chains are composed per-route at wireApi time, so filters added later would never run.',\n            );\n        }\n        for (const def of defs) {\n            this.routeBuilder.addFilter(def);\n        }\n    }\n\n    /**\n     * Wire an API prototype class (with @ApiPath/@Endpoint decorators) to its\n     * controller, mounting one Express route per endpoint with the full filter\n     * chain. The controller is resolved from the Inversify container.\n     */\n    wireApi<TApi, TController extends TApi>(\n        apiPrototype: ClassType<TApi>,\n        controllerClass: ClassType<TController>,\n    ): void {\n        this.apisWired = true;\n\n        // Reuses all existing validation: @ApiPath present, controller extends\n        // api prototype, every endpoint implemented + has @Authentication.\n        const factory = new ApiRoutingFactory(apiPrototype, controllerClass);\n\n        // Mount only the routes added by THIS call\n        const routesBefore = this.routeBuilder.getRoutes().length;\n        factory.configure(this.routeBuilder);\n        const routes = this.routeBuilder.getRoutes();\n\n        for (let i = routesBefore; i < routes.length; i++) {\n            this.mountRoute(routes[i]);\n        }\n    }\n\n    /**\n     * Mount every route currently registered on the RouteBuilder.\n     * Used by WebpiecesExpress (the full-server path) where routes were registered\n     * up front on the shared RouteBuilder.\n     *\n     * @returns Number of routes mounted\n     */\n    mountRegisteredRoutes(): number {\n        const routes = this.routeBuilder.getRoutes();\n        for (const routeWithMeta of routes) {\n            this.mountRoute(routeWithMeta);\n        }\n        return routes.length;\n    }\n\n    /**\n     * Create an in-process API client (full filter chain + controller, no HTTP).\n     * Same testing story as WebpiecesServer.createApiClient().\n     */\n    // webpieces-disable no-any-unknown -- abstract constructor signature requires any[] args\n    createApiClient<T>(apiPrototype: abstract new (...args: any[]) => T): T {\n        return this.clientFactory.createApiClient(apiPrototype);\n    }\n\n    /**\n     * Escape hatch for advanced wiring (e.g. addRoute with a hand-built RouteDefinition).\n     */\n    getRouteBuilder(): RouteBuilderImpl {\n        return this.routeBuilder;\n    }\n\n    /**\n     * Compose the filter chain for one route and register it on the Express app.\n     */\n    private mountRoute(routeWithMeta: RouteHandlerWithMeta): void {\n        const service = this.routeBuilder.createRouteHandler(routeWithMeta);\n        const routeMeta = routeWithMeta.definition.routeMeta;\n\n        // ExpressWrapper handles the full request/response cycle per route:\n        // RequestContext.run, header read, manual JSON body parse, error->ProtocolError\n        const wrapper = this.middleware.createExpressWrapper(service, routeMeta);\n\n        this.registerHandler(\n            routeMeta.httpMethod,\n            routeMeta.path,\n            wrapper.execute.bind(wrapper),\n        );\n    }\n\n    private registerHandler(httpMethod: string, path: string, expressHandler: ExpressRouteHandler): void {\n        switch (httpMethod.toLowerCase()) {\n            case 'get':\n                this.app.get(path, expressHandler);\n                break;\n            case 'post':\n                this.app.post(path, expressHandler);\n                break;\n            case 'put':\n                this.app.put(path, expressHandler);\n                break;\n            case 'delete':\n                this.app.delete(path, expressHandler);\n                break;\n            case 'patch':\n                this.app.patch(path, expressHandler);\n                break;\n            default:\n                log.warn(`[WebpiecesRouteCreator] Unknown HTTP method: ${httpMethod}`);\n        }\n    }\n}\n"]}

package/src/filters/ContextFilter.d.ts

@@ -1,23 +0,0 @@
-import { MethodMeta } from '@webpieces/http-routing';
-import { Filter, WpResponse, Service } from '@webpieces/http-filters';
-export declare class ContextFilter extends Filter<MethodMeta, WpResponse<unknown>> {
-    private transferredKeys;
-    constructor();
-    filter(meta: MethodMeta, nextFilter: Service<MethodMeta, WpResponse<unknown>>): Promise<WpResponse<unknown>>;
-    /**
-     * Transfer transferred keys from MethodMeta.requestHeaders to RequestContext.
-     * A key is transferred when it has an httpHeader (wire name); the value is read
-     * from the incoming request under that httpHeader and stored under the key's name.
-     */
-    private transferHeaders;
-    /**
-     * Ensure REQUEST_ID is set in RequestContext.
-     * Generates one if not present.
-     */
-    private ensureRequestId;
-    /**
-     * Generate a unique request ID.
-     * Format: req-{timestamp}-{random}
-     */
-    private generateRequestId;
-}

package/src/filters/ContextFilter.js

@@ -1,102 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ContextFilter = void 0;
-const tslib_1 = require("tslib");
-const inversify_1 = require("inversify");
-const http_routing_1 = require("@webpieces/http-routing");
-const core_context_1 = require("@webpieces/core-context");
-const http_filters_1 = require("@webpieces/http-filters");
-const core_util_1 = require("@webpieces/core-util");
-const WebpiecesCoreHeaders_1 = require("../headers/WebpiecesCoreHeaders");
-const ContextKeys_1 = require("../headers/ContextKeys");
-const core_util_2 = require("@webpieces/core-util");
-/**
- * ContextFilter - Transfers platform headers and stores request metadata in RequestContext.
- * Priority: 2000 (executes first in filter chain)
- *
- * NEW: Now handles header transfer from RouterRequest to RequestContext
- * - Injects PlatformHeadersExtension instances via @multiInject (safe because filter created after modules load)
- * - Reads headers from RouterRequest (Express-independent)
- * - Transfers only headers marked with isWantTransferred=true
- * - Generates REQUEST_ID if not present
- *
- * RequestContext lifecycle:
- * 1. ExpressWrapper.execute() calls RequestContext.run() (establishes context)
- * 2. ExpressWrapper creates RouterReqResp and MethodMeta
- * 3. Filter chain executes, starting with ContextFilter
- * 4. ContextFilter transfers headers from RouterRequest to RequestContext
- * 5. ContextFilter stores metadata (METHOD_META, REQUEST_PATH, HTTP_METHOD)
- * 6. Downstream filters and controller can access headers + metadata
- * 7. Context auto-clears when RequestContext.run() completes
- */
-const log = core_util_2.LogManager.getLogger('ContextFilter');
-let ContextFilter = class ContextFilter extends http_filters_1.Filter {
-    transferredKeys;
-    constructor() {
-        super();
-        // The global registry is the single source of truth (configured at startup,
-        // duplicate-validated). No DI — HeaderRegistry.configure(...) ran first.
-        const registry = core_util_1.HeaderRegistry.get();
-        this.transferredKeys = registry.getTransferredKeys();
-        log.info(`[ContextFilter] Using ${registry.getKeys().length} context keys from HeaderRegistry (${this.transferredKeys.length} transferred)`);
-    }
-    async filter(meta, nextFilter) {
-        // Transfer platform headers from MethodMeta.requestHeaders to RequestContext
-        this.transferHeaders(meta);
-        // Store request metadata in context for other filters/controllers to access
-        core_context_1.RequestContext.putHeader(ContextKeys_1.ContextKeys.METHOD_META, meta);
-        core_context_1.RequestContext.putHeader(ContextKeys_1.ContextKeys.REQUEST_PATH, meta.path);
-        core_context_1.RequestContext.putHeader(ContextKeys_1.ContextKeys.HTTP_METHOD, meta.httpMethod);
-        // Execute next filter/controller
-        return await nextFilter.invoke(meta);
-        // RequestContext is auto-cleared by ExpressWrapper when request completes
-    }
-    /**
-     * Transfer transferred keys from MethodMeta.requestHeaders to RequestContext.
-     * A key is transferred when it has an httpHeader (wire name); the value is read
-     * from the incoming request under that httpHeader and stored under the key's name.
-     */
-    transferHeaders(meta) {
-        if (!meta.requestHeaders) {
-            // No headers in test mode (createApiClient creates context but not headers)
-            this.ensureRequestId();
-            return;
-        }
-        // Transfer each key to RequestContext (read by wire name, store by key name).
-        for (const key of this.transferredKeys) {
-            // Get values from requestHeaders (case-insensitive lookup by wire name)
-            const values = meta.requestHeaders.get(key.httpHeader.toLowerCase());
-            if (values && values.length > 0) {
-                core_context_1.RequestContext.putHeader(key, values[0]);
-            }
-        }
-        // Clear request headers from MethodMeta - MUST FORCE USAGE of RequestContext!!!
-        meta.requestHeaders = undefined;
-        // Generate REQUEST_ID if not present (first service in chain)
-        this.ensureRequestId();
-    }
-    /**
-     * Ensure REQUEST_ID is set in RequestContext.
-     * Generates one if not present.
-     */
-    ensureRequestId() {
-        if (!core_context_1.RequestContext.hasHeader(WebpiecesCoreHeaders_1.WebpiecesCoreHeaders.REQUEST_ID)) {
-            const requestId = this.generateRequestId();
-            core_context_1.RequestContext.putHeader(WebpiecesCoreHeaders_1.WebpiecesCoreHeaders.REQUEST_ID, requestId);
-        }
-    }
-    /**
-     * Generate a unique request ID.
-     * Format: req-{timestamp}-{random}
-     */
-    generateRequestId() {
-        return `svrGenReqId-${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;
-    }
-};
-exports.ContextFilter = ContextFilter;
-exports.ContextFilter = ContextFilter = tslib_1.__decorate([
-    (0, http_routing_1.provideFrameworkSingleton)(),
-    (0, inversify_1.injectable)(),
-    tslib_1.__metadata("design:paramtypes", [])
-], ContextFilter);
-//# sourceMappingURL=ContextFilter.js.map

package/src/filters/ContextFilter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ContextFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/ContextFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAAuC;AACvC,0DAAgF;AAChF,0DAAyD;AACzD,0DAAsE;AACtE,oDAAkE;AAClE,0EAAqE;AACrE,wDAAmD;AACnD,oDAAkD;AAElD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;AAI3C,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,qBAAuC;IAC9D,eAAe,CAAe;IAEtC;QACI,KAAK,EAAE,CAAC;QAER,4EAA4E;QAC5E,yEAAyE;QACzE,MAAM,QAAQ,GAAG,0BAAc,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QAErD,GAAG,CAAC,IAAI,CAAC,yBAAyB,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,sCAAsC,IAAI,CAAC,eAAe,CAAC,MAAM,eAAe,CAAC,CAAC;IACjJ,CAAC;IAED,KAAK,CAAC,MAAM,CACR,IAAgB,EAChB,UAAoD;QAEpD,6EAA6E;QAC7E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAE3B,4EAA4E;QAC5E,6BAAc,CAAC,SAAS,CAAC,yBAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACxD,6BAAc,CAAC,SAAS,CAAC,yBAAW,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,6BAAc,CAAC,SAAS,CAAC,yBAAW,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAEnE,iCAAiC;QACjC,OAAO,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,0EAA0E;IAC9E,CAAC;IAED;;;;OAIG;IACK,eAAe,CAAC,IAAgB;QACpC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACvB,4EAA4E;YAC5E,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO;QACX,CAAC;QAED,8EAA8E;QAC9E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,wEAAwE;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,UAAW,CAAC,WAAW,EAAE,CAAC,CAAC;YACtE,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,6BAAc,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,CAAC;QACL,CAAC;QAED,gFAAgF;QAChF,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,8DAA8D;QAC9D,IAAI,CAAC,eAAe,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACK,eAAe;QACnB,IAAI,CAAC,6BAAc,CAAC,SAAS,CAAC,2CAAoB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3C,6BAAc,CAAC,SAAS,CAAC,2CAAoB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACzE,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,iBAAiB;QACrB,OAAO,eAAe,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACtF,CAAC;CACJ,CAAA;AA7EY,sCAAa;wBAAb,aAAa;IAFzB,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;;GACA,aAAa,CA6EzB","sourcesContent":["import { injectable } from 'inversify';\nimport { provideFrameworkSingleton, MethodMeta } from '@webpieces/http-routing';\nimport { RequestContext } from '@webpieces/core-context';\nimport { Filter, WpResponse, Service } from '@webpieces/http-filters';\nimport { ContextKey, HeaderRegistry } from '@webpieces/core-util';\nimport {WebpiecesCoreHeaders} from \"../headers/WebpiecesCoreHeaders\";\nimport {ContextKeys} from \"../headers/ContextKeys\";\nimport { LogManager } from '@webpieces/core-util';\n\n/**\n * ContextFilter - Transfers platform headers and stores request metadata in RequestContext.\n * Priority: 2000 (executes first in filter chain)\n *\n * NEW: Now handles header transfer from RouterRequest to RequestContext\n * - Injects PlatformHeadersExtension instances via @multiInject (safe because filter created after modules load)\n * - Reads headers from RouterRequest (Express-independent)\n * - Transfers only headers marked with isWantTransferred=true\n * - Generates REQUEST_ID if not present\n *\n * RequestContext lifecycle:\n * 1. ExpressWrapper.execute() calls RequestContext.run() (establishes context)\n * 2. ExpressWrapper creates RouterReqResp and MethodMeta\n * 3. Filter chain executes, starting with ContextFilter\n * 4. ContextFilter transfers headers from RouterRequest to RequestContext\n * 5. ContextFilter stores metadata (METHOD_META, REQUEST_PATH, HTTP_METHOD)\n * 6. Downstream filters and controller can access headers + metadata\n * 7. Context auto-clears when RequestContext.run() completes\n */\nconst log = LogManager.getLogger('ContextFilter');\n\n@provideFrameworkSingleton()\n@injectable()\nexport class ContextFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n    private transferredKeys: ContextKey[];\n\n    constructor() {\n        super();\n\n        // The global registry is the single source of truth (configured at startup,\n        // duplicate-validated). No DI — HeaderRegistry.configure(...) ran first.\n        const registry = HeaderRegistry.get();\n        this.transferredKeys = registry.getTransferredKeys();\n\n        log.info(`[ContextFilter] Using ${registry.getKeys().length} context keys from HeaderRegistry (${this.transferredKeys.length} transferred)`);\n    }\n\n    async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        // Transfer platform headers from MethodMeta.requestHeaders to RequestContext\n        this.transferHeaders(meta);\n\n        // Store request metadata in context for other filters/controllers to access\n        RequestContext.putHeader(ContextKeys.METHOD_META, meta);\n        RequestContext.putHeader(ContextKeys.REQUEST_PATH, meta.path);\n        RequestContext.putHeader(ContextKeys.HTTP_METHOD, meta.httpMethod);\n\n        // Execute next filter/controller\n        return await nextFilter.invoke(meta);\n        // RequestContext is auto-cleared by ExpressWrapper when request completes\n    }\n\n    /**\n     * Transfer transferred keys from MethodMeta.requestHeaders to RequestContext.\n     * A key is transferred when it has an httpHeader (wire name); the value is read\n     * from the incoming request under that httpHeader and stored under the key's name.\n     */\n    private transferHeaders(meta: MethodMeta): void {\n        if (!meta.requestHeaders) {\n            // No headers in test mode (createApiClient creates context but not headers)\n            this.ensureRequestId();\n            return;\n        }\n\n        // Transfer each key to RequestContext (read by wire name, store by key name).\n        for (const key of this.transferredKeys) {\n            // Get values from requestHeaders (case-insensitive lookup by wire name)\n            const values = meta.requestHeaders.get(key.httpHeader!.toLowerCase());\n            if (values && values.length > 0) {\n                RequestContext.putHeader(key, values[0]);\n            }\n        }\n\n        // Clear request headers from MethodMeta - MUST FORCE USAGE of RequestContext!!!\n        meta.requestHeaders = undefined;\n\n        // Generate REQUEST_ID if not present (first service in chain)\n        this.ensureRequestId();\n    }\n\n    /**\n     * Ensure REQUEST_ID is set in RequestContext.\n     * Generates one if not present.\n     */\n    private ensureRequestId(): void {\n        if (!RequestContext.hasHeader(WebpiecesCoreHeaders.REQUEST_ID)) {\n            const requestId = this.generateRequestId();\n            RequestContext.putHeader(WebpiecesCoreHeaders.REQUEST_ID, requestId);\n        }\n    }\n\n    /**\n     * Generate a unique request ID.\n     * Format: req-{timestamp}-{random}\n     */\n    private generateRequestId(): string {\n        return `svrGenReqId-${Date.now()}-${Math.random().toString(36).substring(2, 15)}`;\n    }\n}\n\n"]}

package/src/filters/ServiceAuthFilter.d.ts

@@ -1,19 +0,0 @@
-import { Filter, WpResponse, Service, MethodMeta } from '@webpieces/http-filters';
-/**
- * ServiceAuthFilter - framework filter that enforces the SERVICE-to-service auth modes
- * (@AuthOidc, @AuthSharedSecret). Priority 1950: runs right after ContextFilter (2000)
- * so the credential headers are already in RequestContext, and before app filters.
- *
- * This is what secures Cloud Tasks delivery: a @PubSub endpoint marked @AuthOidc only
- * accepts a request carrying a valid Google OIDC token from an allowed caller SA. The
- * `public` and `jwt` modes are NOT this filter's job (jwt stays in the app AuthFilter).
- */
-export declare class ServiceAuthFilter extends Filter<MethodMeta, WpResponse<unknown>> {
-    filter(meta: MethodMeta, nextFilter: Service<MethodMeta, WpResponse<unknown>>): Promise<WpResponse<unknown>>;
-    /** Verify a Google OIDC bearer token from an allowed caller service account. */
-    private enforceOidc;
-    /** Constant-time compare of the shared-secret header against process.env[secretEnv]. */
-    private enforceSharedSecret;
-    private stripBearer;
-    private constantTimeEquals;
-}

package/src/filters/ServiceAuthFilter.js

@@ -1,83 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ServiceAuthFilter = void 0;
-const tslib_1 = require("tslib");
-const inversify_1 = require("inversify");
-const crypto_1 = require("crypto");
-const core_context_1 = require("@webpieces/core-context");
-const http_filters_1 = require("@webpieces/http-filters");
-const core_util_1 = require("@webpieces/core-util");
-const gcp_identity_1 = require("@webpieces/gcp-identity");
-const core_util_2 = require("@webpieces/core-util");
-const log = core_util_2.LogManager.getLogger('ServiceAuthFilter');
-/**
- * ServiceAuthFilter - framework filter that enforces the SERVICE-to-service auth modes
- * (@AuthOidc, @AuthSharedSecret). Priority 1950: runs right after ContextFilter (2000)
- * so the credential headers are already in RequestContext, and before app filters.
- *
- * This is what secures Cloud Tasks delivery: a @PubSub endpoint marked @AuthOidc only
- * accepts a request carrying a valid Google OIDC token from an allowed caller SA. The
- * `public` and `jwt` modes are NOT this filter's job (jwt stays in the app AuthFilter).
- */
-let ServiceAuthFilter = class ServiceAuthFilter extends http_filters_1.Filter {
-    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility
-    async filter(meta, nextFilter) {
-        const authMeta = meta.authMeta;
-        if (authMeta) {
-            const mode = authMeta.mode;
-            if (mode.kind === 'oidc') {
-                await this.enforceOidc(mode.callers);
-            }
-            else if (mode.kind === 'shared-secret') {
-                this.enforceSharedSecret(mode.secretEnv);
-            }
-        }
-        return nextFilter.invoke(meta);
-    }
-    /** Verify a Google OIDC bearer token from an allowed caller service account. */
-    async enforceOidc(callers) {
-        const header = core_context_1.RequestContext.getHeader(core_util_1.WebpiecesCoreHeaders.AUTHORIZATION);
-        const token = this.stripBearer(header);
-        if (!token) {
-            throw new core_util_1.HttpUnauthorizedError('Missing OIDC bearer token for @AuthOidc endpoint');
-        }
-        const result = await (0, gcp_identity_1.verifyOidcFromCallers)(token, callers);
-        if (!result.ok) {
-            throw new core_util_1.HttpUnauthorizedError(`OIDC auth failed: ${result.reason ?? 'unknown'}`);
-        }
-        log.debug(`OIDC caller verified: ${result.email}`);
-    }
-    /** Constant-time compare of the shared-secret header against process.env[secretEnv]. */
-    enforceSharedSecret(secretEnv) {
-        const expected = process.env[secretEnv];
-        if (!expected) {
-            throw new core_util_1.HttpUnauthorizedError(`Shared secret env '${secretEnv}' is not configured`);
-        }
-        const provided = core_context_1.RequestContext.getHeader(core_util_1.WebpiecesCoreHeaders.SHARED_SECRET);
-        if (!provided || !this.constantTimeEquals(provided, expected)) {
-            throw new core_util_1.HttpUnauthorizedError('Invalid shared secret for @AuthSharedSecret endpoint');
-        }
-    }
-    stripBearer(header) {
-        if (!header) {
-            return undefined;
-        }
-        const prefix = 'Bearer ';
-        return header.startsWith(prefix) ? header.substring(prefix.length) : header;
-    }
-    constantTimeEquals(a, b) {
-        const bufA = Buffer.from(a, 'utf8');
-        const bufB = Buffer.from(b, 'utf8');
-        if (bufA.length !== bufB.length) {
-            return false;
-        }
-        return (0, crypto_1.timingSafeEqual)(bufA, bufB);
-    }
-};
-exports.ServiceAuthFilter = ServiceAuthFilter;
-exports.ServiceAuthFilter = ServiceAuthFilter = tslib_1.__decorate([
-    (0, core_context_1.provideFrameworkSingleton)(),
-    (0, inversify_1.injectable)()
-    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility
-], ServiceAuthFilter);
-//# sourceMappingURL=ServiceAuthFilter.js.map

package/src/filters/ServiceAuthFilter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ServiceAuthFilter.js","sourceRoot":"","sources":["../../../../../../packages/http/http-server/src/filters/ServiceAuthFilter.ts"],"names":[],"mappings":";;;;AAAA,yCAAuC;AACvC,mCAAyC;AACzC,0DAAoF;AACpF,0DAAkF;AAClF,oDAAmF;AACnF,0DAAgE;AAChE,oDAAkD;AAElD,MAAM,GAAG,GAAG,sBAAU,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;AAEtD;;;;;;;;GAQG;AAII,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,qBAAuC;IAE1E,sGAAsG;IAC7F,KAAK,CAAC,MAAM,CACjB,IAAgB,EAChB,UAAoD;QAEpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBACvC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7C,CAAC;QACL,CAAC;QACD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,WAAW,CAAC,OAAiB;QACvC,MAAM,MAAM,GAAG,6BAAc,CAAC,SAAS,CAAC,gCAAoB,CAAC,aAAa,CAAuB,CAAC;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,iCAAqB,CAAC,kDAAkD,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAA,oCAAqB,EAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,iCAAqB,CAAC,qBAAqB,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,wFAAwF;IAChF,mBAAmB,CAAC,SAAiB;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,MAAM,IAAI,iCAAqB,CAAC,sBAAsB,SAAS,qBAAqB,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,QAAQ,GAAG,6BAAc,CAAC,SAAS,CAAC,gCAAoB,CAAC,aAAa,CAAuB,CAAC;QACpG,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,iCAAqB,CAAC,sDAAsD,CAAC,CAAC;QAC5F,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,MAA0B;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC;QACzB,OAAO,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAChF,CAAC;IAEO,kBAAkB,CAAC,CAAS,EAAE,CAAS;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;CACJ,CAAA;AA7DY,8CAAiB;4BAAjB,iBAAiB;IAH7B,IAAA,wCAAyB,GAAE;IAC3B,IAAA,sBAAU,GAAE;IACb,sGAAsG;GACzF,iBAAiB,CA6D7B","sourcesContent":["import { injectable } from 'inversify';\nimport { timingSafeEqual } from 'crypto';\nimport { provideFrameworkSingleton, RequestContext } from '@webpieces/core-context';\nimport { Filter, WpResponse, Service, MethodMeta } from '@webpieces/http-filters';\nimport { HttpUnauthorizedError, WebpiecesCoreHeaders } from '@webpieces/core-util';\nimport { verifyOidcFromCallers } from '@webpieces/gcp-identity';\nimport { LogManager } from '@webpieces/core-util';\n\nconst log = LogManager.getLogger('ServiceAuthFilter');\n\n/**\n * ServiceAuthFilter - framework filter that enforces the SERVICE-to-service auth modes\n * (@AuthOidc, @AuthSharedSecret). Priority 1950: runs right after ContextFilter (2000)\n * so the credential headers are already in RequestContext, and before app filters.\n *\n * This is what secures Cloud Tasks delivery: a @PubSub endpoint marked @AuthOidc only\n * accepts a request carrying a valid Google OIDC token from an allowed caller SA. The\n * `public` and `jwt` modes are NOT this filter's job (jwt stays in the app AuthFilter).\n */\n@provideFrameworkSingleton()\n@injectable()\n// webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\nexport class ServiceAuthFilter extends Filter<MethodMeta, WpResponse<unknown>> {\n\n    // webpieces-disable no-any-unknown -- Filter generic params use unknown for response type flexibility\n    override async filter(\n        meta: MethodMeta,\n        nextFilter: Service<MethodMeta, WpResponse<unknown>>,\n    ): Promise<WpResponse<unknown>> {\n        const authMeta = meta.authMeta;\n        if (authMeta) {\n            const mode = authMeta.mode;\n            if (mode.kind === 'oidc') {\n                await this.enforceOidc(mode.callers);\n            } else if (mode.kind === 'shared-secret') {\n                this.enforceSharedSecret(mode.secretEnv);\n            }\n        }\n        return nextFilter.invoke(meta);\n    }\n\n    /** Verify a Google OIDC bearer token from an allowed caller service account. */\n    private async enforceOidc(callers: string[]): Promise<void> {\n        const header = RequestContext.getHeader(WebpiecesCoreHeaders.AUTHORIZATION) as string | undefined;\n        const token = this.stripBearer(header);\n        if (!token) {\n            throw new HttpUnauthorizedError('Missing OIDC bearer token for @AuthOidc endpoint');\n        }\n        const result = await verifyOidcFromCallers(token, callers);\n        if (!result.ok) {\n            throw new HttpUnauthorizedError(`OIDC auth failed: ${result.reason ?? 'unknown'}`);\n        }\n        log.debug(`OIDC caller verified: ${result.email}`);\n    }\n\n    /** Constant-time compare of the shared-secret header against process.env[secretEnv]. */\n    private enforceSharedSecret(secretEnv: string): void {\n        const expected = process.env[secretEnv];\n        if (!expected) {\n            throw new HttpUnauthorizedError(`Shared secret env '${secretEnv}' is not configured`);\n        }\n        const provided = RequestContext.getHeader(WebpiecesCoreHeaders.SHARED_SECRET) as string | undefined;\n        if (!provided || !this.constantTimeEquals(provided, expected)) {\n            throw new HttpUnauthorizedError('Invalid shared secret for @AuthSharedSecret endpoint');\n        }\n    }\n\n    private stripBearer(header: string | undefined): string | undefined {\n        if (!header) {\n            return undefined;\n        }\n        const prefix = 'Bearer ';\n        return header.startsWith(prefix) ? header.substring(prefix.length) : header;\n    }\n\n    private constantTimeEquals(a: string, b: string): boolean {\n        const bufA = Buffer.from(a, 'utf8');\n        const bufB = Buffer.from(b, 'utf8');\n        if (bufA.length !== bufB.length) {\n            return false;\n        }\n        return timingSafeEqual(bufA, bufB);\n    }\n}\n"]}