Decorator Reference

Prerequisites: All decorators require TypeScript compiler options experimentalDecorators: true and emitDecoratorMetadata: true, plus import 'reflect-metadata' as the first import in your entry file.

Dependency Injection

@Injectable

Options: scope (ServiceScope.SINGLETON | ServiceScope.TRANSIENT | ServiceScope.SCOPED), providedIn (string | 'root')

@Injectable({ scope: ServiceScope.SINGLETON })
class UserService {
  constructor(private db: DatabaseService) {}
}

@Inject

Options: token (string | symbol | Function)

constructor(@Inject('API_URL') private url: string) {}

@InjectProperty

Options: token? (string | symbol | Function) — defaults to the property's reflected type

@InjectProperty('CONFIG') private config: AppConfig;

@Optional

constructor(@Optional() @Inject('CACHE') private cache?: CacheService) {}

@ComponentDecorator

Key options: selector (required), template?, templateUrl?, styles?, inputs?, outputs?, description?, tags?, aiGenerated?

@ComponentDecorator({ selector: 'user-card', template: '<div>{{name}}</div>' })
class UserCard extends BaseComponent {}

@Controller

Options: path? (string), middleware? (any[])

@Controller('/api/users')
class UsersController {
  constructor(private userService: UserService) {}
}

HTTP method decorators @Get, @Post, @Put, @Patch, @Delete accept either a path string or a RouteOptions object. The object form supports path, middleware, statusCode, summary, description, plus: body, query, params, headers (validation schemas — UDIOT ValidationSchema maps), responses (status → schema/description), tags, operationId, deprecated. Schemas drive both runtime validation (failures throw unprocessableEntity() → Problem Details JSON) and OpenAPI emit. Parameter decorators: @Param, @Query, @Body, @Header, @Req, @Res, @CurrentUser. See the API conventions guide for examples.

@Module

Key options: imports?, providers?, controllers?, components?, exports?

@Module({ providers: [UserService], controllers: [UserController], exports: [UserService] })
class UserModule {}

HTTP Controller Auth & Limits

These decorators are read by toExpressRouter() (and surfaced through createWebServer({ controllers })). They cooperate with WebServerOptions.authResolver and WebServerOptions.rateLimits configured at boot — keeping policy in app config and intent on the route, the way the rest of UDIOT splits semantics from configuration.

@RequireAuth

Options: schemes? (Array<'bearer' \| 'session-cookie' \| 'api-key' \| string>), roles? (string[]), scopes? (string[]), optional? (boolean)

@RequireAuth({ scopes: ['reports:read'] })
@Get('/reports')
async list(@CurrentUser() user: AuthenticatedUser) {
  return this.reports.list(user.id);
}

The resolver is plug-in: bring your own JWT, session, or API-key strategy. For an end-to-end example see the production composition recipe.

@CurrentUser

@RequireAuth()
@Get('/me')
me(@CurrentUser() user: AuthenticatedUser) {
  return { user };
}

@UseRateLimit

Argument: policy (string) — must match a key in rateLimits.

@UseRateLimit('checkout')
@Post('/checkout/capture')
async capture(@Body() body: CheckoutCaptureDto) {
  return this.checkout.capture(body);
}

Policy definitions accept maxRequests, windowMs, and key ('ip' | 'user' | 'userOrIp' | (req) => string); responses include Retry-After and X-RateLimit-* headers.

State Management

@ReactiveStore

Key options: name?, aiTracking?, trackHistory?, devTools?, persist?, maxHistory?

@ReactiveStore({ name: 'TodoStore', trackHistory: true })
class TodoStore extends Store<TodoState> {}

@Mutation

Key options: name?, validate?, aiTracking?, description?

@Mutation({ aiTracking: true })
addItem(item: Item): void { this.dispatch({ type: 'ADD_ITEM', payload: item }); }

@Action

Key options: name?, debounce?, throttle?, retry?, retryDelay?, cache?, cacheTTL?, aiTracking?

@Action({ retry: 3, cache: true, cacheTTL: 30000 })
async fetchUsers(): Promise<User[]> { return fetch('/api/users').then(r => r.json()); }

@Selector

Key options: deps? (string[] — names of other selector methods), name?, equalityFn?, aiTracking?

@Selector()
completedTodos(): Todo[] { return this.getState().todos.filter(t => t.completed); }

@Computed

@Computed()
get totalPrice(): number { return this.items.reduce((s, i) => s + i.price, 0); }

Component state

Use the public component/state APIs described in state. Do not assume a source-level decorator is exported from the root entry point.

@Persist

Key options: key?, storage? ('localStorage' | 'sessionStorage' | 'indexedDB' | 'memory'), debounce?, version?, migrate?, whitelist?, blacklist?, serialize?, deserialize?, autoLoad?, autoSave?

@Persist({ storage: 'localStorage', whitelist: ['items', 'filter'] })
class CartStore extends Store<CartState> {}

@AIPowered

Key options: analyzer?, optimizer?, predictor?, autoAnalyze?, autoOptimize?, logInsights?, onSuggestion?, onAnomaly?

@AIPowered({ autoAnalyze: true, logInsights: true })
class SmartStore extends Store<AppState> {}

@EnableDevTools

Key options: devTools?, inspector?, consoleLogger?, autoConnect?

@EnableDevTools({ consoleLogger: true })
class AppStore extends Store<AppState> {}

Middleware, telemetry and AI limitations

The internal middleware decorators (Middleware, Handle, Next, Pipeline, UseMiddleware, Before, After, CatchErrors, Measure, When) are not public runtime exports. Root Middleware is a type and Context is a reactive class, not a parameter decorator. Use functional composition.

AILogged, AIAlert, AIController, AIEndpoint and TenantScoped are internal decorators, not public root imports. Use telemetry functions, controller adapters and tenant scope instead.

Public experimental component decorators are documented in AI decorators. Presence in the export map is not a stable support promise; see API status.