The /api/v1/user routes move out of src/http/api.ts into src/http/api/user.ts, unchanged #7451

All /api/v1/user… routes move from src/http/api.ts into the new src/http/api/user.ts as userRoutes(router), laid out like src/http/api/labels.ts. That is the 26 named routes plus the live-browse routes under /api/v1/user/origins/:id/browse/:owner/:name. apiRoutes calls userRoutes(router) once, where GET /api/v1/user was registered. No route, status, body or header changes. api.ts goes from 5,751 to 5,013 lines, 738 shorter; user.ts is 741 lines.

What moved where

• Routes: six blocks scattered through api.ts, kept in their original order:

- profile, email verification and password - orgs and SSH keys - the whole origins section, with its local helpers callbackUri, browse, read and BROWSE, through to the mirror-job stream - pins GET/PUT - GET /api/v1/user/assigned - pins DELETE

• Helpers used only by these routes: whereJson and sourceFailure move with them. The comment in src/contract/openapi/shared.ts that names where sourceFailure lives now points to http/api/user.ts; this is the only line changed outside the two files.
• Shared helpers: originFacts, jobJson, editFilesFrom, contributionJson and contributeFailure are still used elsewhere in api.ts. They stay where they are, gain export, and are imported. loadRepo, keyedPage/keyedWindow, originJson, remoteRepoJson, connectMessage and oauthCallbackUri were already exported and are imported the same way.
• Imports: the ones api.ts no longer uses are removed.

Why gathering the routes into one block is safe: the router takes the first pattern that matches, in the order routes were added. No other pattern can match a /api/v1/user/… path, so changing where these routes are registered changes nothing. The tests that walk the route table (security-floor-routes, cross-origin-mutations, usage-report) compare sets, not order.

To review it as a move: run git show --color-moved HEAD. Comparing the removed and added lines of the commit, the only lines in user.ts that were not removed from api.ts are the header comment, the imports and the function wrapper. The only other change in api.ts is the added export on the five shared helpers.

Checks: bun x tsc --noEmit is clean. scripts/fast.ts named 935 files, too many to run locally, so I picked the 120 that cover this move: every test that reads src/http/api.ts or src/http/api/ as text, the OpenAPI and route-table tests, and every test that calls a /api/v1/user route. They pass, 1,230 tests with 10 skipped, and no test was changed.

Not done: the /api/v1/users… routes (account sign-up, profiles, sign-ins, sessions) stay in api.ts. The issue counts 26 /api/v1/user… routes, which is exactly the /user routes.

🤖 Generated with Claude Code

Closes #7444

All /api/v1/user… routes move from src/http/api.ts into the new src/http/api/user.ts as userRoutes(router), laid out like src/http/api/labels.ts. That is the 26 named routes plus the live-browse routes under /api/v1/user/origins/:id/browse/:owner/:name. apiRoutes calls userRoutes(router) once, where GET /api/v1/user was registered. No route, status, body or header changes. api.ts goes from 5,751 to 5,013 lines, 738 shorter; user.ts is 741 lines.

What moved where

• Routes: six blocks scattered through api.ts, kept in their original order:

- profile, email verification and password - orgs and SSH keys - the whole origins section, with its local helpers callbackUri, browse, read and BROWSE, through to the mirror-job stream - pins GET/PUT - GET /api/v1/user/assigned - pins DELETE

• Helpers used only by these routes: whereJson and sourceFailure move with them. The comment in src/contract/openapi/shared.ts that names where sourceFailure lives now points to http/api/user.ts; this is the only line changed outside the two files.
• Shared helpers: originFacts, jobJson, editFilesFrom, contributionJson and contributeFailure are still used elsewhere in api.ts. They stay where they are, gain export, and are imported. loadRepo, keyedPage/keyedWindow, originJson, remoteRepoJson, connectMessage and oauthCallbackUri were already exported and are imported the same way.
• Imports: the ones api.ts no longer uses are removed.

Why gathering the routes into one block is safe: the router takes the first pattern that matches, in the order routes were added. No other pattern can match a /api/v1/user/… path, so changing where these routes are registered changes nothing. The tests that walk the route table (security-floor-routes, cross-origin-mutations, usage-report) compare sets, not order.

To review it as a move: run git show --color-moved HEAD. Comparing the removed and added lines of the commit, the only lines in user.ts that were not removed from api.ts are the header comment, the imports and the function wrapper. The only other change in api.ts is the added export on the five shared helpers.

Checks: bun x tsc --noEmit is clean. scripts/fast.ts named 935 files, too many to run locally, so I picked the 120 that cover this move: every test that reads src/http/api.ts or src/http/api/ as text, the OpenAPI and route-table tests, and every test that calls a /api/v1/user route. They pass, 1,230 tests with 10 skipped, and no test was changed.

Not done: the /api/v1/users… routes (account sign-up, profiles, sign-ins, sessions) stay in api.ts. The issue counts 26 /api/v1/user… routes, which is exactly the /user routes.

🤖 Generated with Claude Code