@anteros/core 0.0.38 → 0.0.40

package/database/collection.ts

@@ -131,7 +131,7 @@ async function initializeOnDatabase(collections: Collection[]) {
                             }
                         }
 
-                        // !! : field.unique peut être 1/0 (Mongo-style) → coercer en vrai booléen
+                        // !! : field.unique may be 1/0 (Mongo-style) → coerce to a real boolean
                         let isSparse = !!(field.type === 'random'
                             || (field.unique && field.required !== true));
 

package/database/db.cache.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import path from "node:path";
 import type { FindOptions, FindCallOptions } from "../types/mongo";
-import { Cache, useFilesystemCache, useMemoryCache, useRedisCache } from "../utils/cache";
+import { type Cache, useFilesystemCache, useMemoryCache, useRedisCache } from "../utils/cache";
 import { cfg } from "../server/config";
 
 /**

package/database/field.crypto.ts

@@ -128,7 +128,7 @@ export async function encryptUpdate(col: Collection | null, update: Record<strin
         const pf = pathFields.find((p) => k === p.name || k.startsWith(p.name + "."));
         if (pf) {
             const sub = k === pf.name ? null : k.slice(pf.name.length + 1);
-            // chemin exact, descendant ('zip.sub') ou à travers un index de array ('0.zip')
+            // exact path, descendant ('zip.sub') or through an array index ('0.zip')
             if (sub === null || pf.paths.some((p) => sub === p || sub.startsWith(p + ".") || sub.endsWith("." + p))) {
                 return { kind: "path", field: pf.name, sub, paths: pf.paths };
             }

package/database/mongodbadapter.ts

@@ -1144,8 +1144,8 @@ class MongoRest {
             missing: (key) => ns().missing({ key }),
             delete: (key) => ns().delete({ key }),
             deleteMany: (keys) => ns().deleteMany({ keys }),
-            pull: (key) => ns().pull(key),
-            expire: (key, ttl) => ns().expire({ key, ttl }),
+            pull: (key) => ns().pull(key) as Promise<any>, // bentocache types are stricter than the TenantCache contract
+            expire: (key) => ns().expire({ key }), // bentocache soft-expire takes { key } only (grace is a getOrSet option)
             clear: () => ns().clear(),
             namespace: (name) => cache.namespace(`app:${tenantId}:${name}`),
         };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@anteros/core",
   "module": "index.ts",
-  "version": "0.0.38",
+  "version": "0.0.40",
   "type": "module",
   "description": "Anteros Core",
   "private": false,

package/probe-cache.ts

@@ -1,9 +1,9 @@
-import { Cache } from "./utils/cache";
+import { useMemoryCache } from "./utils/cache";
 
 async function probe() {
-    const c = new Cache("memory");
+    const c = useMemoryCache();
     const v = await c.get({ key: "k" });
-    const p = await c.pull({ key: "p" });
+    const p = await c.pull("p");
     const g = await c.getOrSet({ key: "g", factory: () => 42 });
     const s = await c.set({ key: "a", value: 1 });
     const h = await c.has({ key: "a" });

package/server/api.ts

@@ -15,7 +15,7 @@ import { getTenantMiddlewares } from "../lib/middleware";
 import type { ActivityInput } from "../types/activity";
 import * as os from 'node:os';
 import { basename } from 'node:path';
-import { handleUpload, handleServe, handleDelete } from "../lib/files";
+import { handleUpload, handleServe, handleDelete, type FileResult } from "../lib/files";
 const API_PREFIX = '/api/:tenant_id/:collection/:action';
 const SERVICE_PREFIX = '/services/:tenant_id/:service/:action';
 const UPLOAD_PREFIX = '/upload/:tenant_id/:collection';
@@ -457,7 +457,9 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 throw new AppError('Content-Type must be multipart/form-data', { code: 'INVALID_CONTENT_TYPE', status: 400 });
             }
 
-            // Faille 11: reject oversized bodies BEFORE parseBody buffers them in memory
+            // Security: reject oversized bodies BEFORE parseBody buffers them in memory.
+            // `maxSize` doubles as the TOTAL request allowance → a multi-file upload must
+            // fit within it (each file is also validated individually in handleUpload).
             const contentLength = Number(c.req.header('Content-Length') ?? 0);
             const maxUploadSize = colUpload.upload?.maxSize ?? 10 * 1024 * 1024; // 10MB default
             // multipart overhead (boundaries/headers) ≈ 64KB max
@@ -467,21 +469,36 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
                 });
             }
 
-            const formData = await c.req.parseBody();
-            const fileField = formData['file'] || formData['upload'];
-            if (!fileField || !(fileField instanceof File)) {
+            const formData = await c.req.parseBody({ all: true }); // all: true → every value is an array (several files can share the same field name)
+
+            // Collect files from both accepted field names (single or multiple)
+            const files: File[] = [];
+            for (const key of ['file', 'upload']) {
+                for (const value of formData[key] ?? []) {
+                    if (value instanceof File) files.push(value);
+                }
+            }
+            if (!files.length) {
                 throw new AppError('No file provided. Use field name "file" or "upload".', { code: 'FILE_REQUIRED', status: 400 });
             }
 
+            // Metadata: non-file fields. Single value → scalar (unchanged contract),
+            // repeated under the same name → array.
             const data: Record<string, any> = {};
             for (const [key, value] of Object.entries(formData)) {
-                if (key !== 'file' && key !== 'upload' && !(value instanceof File)) {
-                    data[key] = value;
-                }
+                if (key === 'file' || key === 'upload') continue;
+                const list = (Array.isArray(value) ? value : [value]) as any[];
+                if (list.some((v) => v instanceof File)) continue;
+                data[key] = list.length === 1 ? list[0] : list;
             }
 
-            const result = await handleUpload({ collection, tenant_id, file: fileField, data });
-            return c.json(result);
+            // One document per file (per-file validation: MIME, size, storage, replication).
+            // 1 file → single object (backward compatible), N files → array (SDK contract).
+            const results: FileResult[] = [];
+            for (const file of files) {
+                results.push(await handleUpload({ collection, tenant_id, file, data }));
+            }
+            return c.json(results.length === 1 ? results[0] : results);
         } catch (err: any) {
             if (cfg?.debug) console.error(err)
             return errorResponse(c, err);

package/server/boot.ts

@@ -249,7 +249,7 @@ async function bootApp(options: BootAppOptions = {} as BootAppOptions) {
 
         // DB query cache status (server.cache) — driver: memory | filesystem | redis
         const cacheCfg = cfg.server.cache;
-        // any: @colors/colors type les styles chaînés (.red.bold) comme des fonctions Color
+        // any: @colors/colors types chained styles (.red.bold) as Color functions
         let cacheInfo: any = 'Off'.red.bold;
         if (cacheCfg?.enabled) {
             const driver = cacheCfg.driver ?? 'memory';

package/tests/cache.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeEach } from "bun:test";
-import { Cache, useMemoryCache, useFilesystemCache } from "../utils/cache";
+import { type Cache, useMemoryCache, useFilesystemCache } from "../utils/cache";
 
 const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
 
@@ -12,16 +12,19 @@ describe("Cache (memory)", () => {
 
     it("set + get round-trip", async () => {
         await c.set({ key: "k", value: { id: 1 }, ttl: "5m" });
-        expect(await c.get({ key: "k" })).toEqual({ id: 1 });
+        const v = await c.get({ key: "k" });
+        expect(v).toEqual({ id: 1 });
     });
 
     it("setForever never expires", async () => {
         await c.setForever({ key: "cfg", value: { theme: "dark" } });
-        expect(await c.get({ key: "cfg" })).toEqual({ theme: "dark" });
+        const v = await c.get({ key: "cfg" });
+        expect(v).toEqual({ theme: "dark" });
     });
 
-    it("get returns null on miss", async () => {
-        expect(await c.get({ key: "nope" })).toBeUndefined();
+    it("get returns undefined on miss", async () => {
+        const v = await c.get({ key: "nope" });
+        expect(v).toBeUndefined();
     });
 
     it("has / missing", async () => {
@@ -33,9 +36,11 @@ describe("Cache (memory)", () => {
 
     it("ttl expiry (ms)", async () => {
         await c.set({ key: "x", value: 1, ttl: 50 });
-        expect(await c.get({ key: "x" })).toBe(1);
+        const v1 = await c.get({ key: "x" });
+        expect(v1).toBe(1);
         await sleep(80);
-        expect(await c.get({ key: "x" })).toBeUndefined();
+        const v2 = await c.get({ key: "x" });
+        expect(v2).toBeUndefined();
     });
 
     it("getOrSet uses factory and caches", async () => {
@@ -44,21 +49,25 @@ describe("Cache (memory)", () => {
             calls++;
             return { n: calls };
         };
-        expect(await c.getOrSet({ key: "g", factory })).toEqual({ n: 1 });
-        expect(await c.getOrSet({ key: "g", factory })).toEqual({ n: 1 });
+        const a = await c.getOrSet({ key: "g", factory });
+        expect(a).toEqual({ n: 1 });
+        const b = await c.getOrSet({ key: "g", factory });
+        expect(b).toEqual({ n: 1 });
         expect(calls).toBe(1);
     });
 
     it("getOrSetForever", async () => {
         const value = await c.getOrSetForever({ key: "f", factory: () => 42 });
         expect(value).toBe(42);
-        expect(await c.get({ key: "f" })).toBe(42);
+        const v = await c.get({ key: "f" });
+        expect(v).toBe(42);
     });
 
     it("delete removes entry", async () => {
         await c.set({ key: "d", value: 1 });
         await c.delete({ key: "d" });
-        expect(await c.get({ key: "d" })).toBeUndefined();
+        const v = await c.get({ key: "d" });
+        expect(v).toBeUndefined();
     });
 
     it("deleteMany removes several keys", async () => {
@@ -71,16 +80,20 @@ describe("Cache (memory)", () => {
 
     it("pull returns and removes", async () => {
         await c.set({ key: "p", value: 7 });
-        expect(await c.pull("p")).toBe(7);
-        expect(await c.get({ key: "p" })).toBeUndefined();
+        const p = await c.pull("p");
+        expect(p).toBe(7);
+        const v = await c.get({ key: "p" });
+        expect(v).toBeUndefined();
     });
 
     it("clear empties everything", async () => {
         await c.set({ key: "a", value: 1 });
         await c.set({ key: "b", value: 2 });
         await c.clear();
-        expect(await c.get({ key: "a" })).toBeUndefined();
-        expect(await c.get({ key: "b" })).toBeUndefined();
+        const va = await c.get({ key: "a" });
+        const vb = await c.get({ key: "b" });
+        expect(va).toBeUndefined();
+        expect(vb).toBeUndefined();
     });
 
     it("getOrSet recovers after ttl expiry (grace accepted)", async () => {
@@ -89,19 +102,22 @@ describe("Cache (memory)", () => {
         expect(v1).toBe("fresh");
 
         await sleep(60); // past ttl
-        expect(await c.get({ key: "e" })).toBeUndefined(); // expired
+        const v2 = await c.get({ key: "e" });
+        expect(v2).toBeUndefined(); // expired
 
         // getOrSet re-runs the factory after expiry
-        const v2 = await c.getOrSet({ key: "e", factory: () => "fresh2" });
-        expect(v2).toBe("fresh2");
+        const v3 = await c.getOrSet({ key: "e", factory: () => "fresh2" });
+        expect(v3).toBe("fresh2");
     });
 
     it("namespace groups keys", async () => {
         const users = c.namespace("users");
         await users.set({ key: "1", value: { name: "John" }, ttl: "5m" });
         await users.set({ key: "2", value: { name: "Jane" } });
-        expect(await users.get({ key: "1" })).toEqual({ name: "John" });
-        expect(await c.get({ key: "1" })).toBeUndefined(); // not in root
+        const u1 = await users.get({ key: "1" });
+        expect(u1).toEqual({ name: "John" });
+        const root = await c.get({ key: "1" });
+        expect(root).toBeUndefined(); // not in root
         await users.clear();
         expect(await users.missing({ key: "1" })).toBe(true);
         expect(await users.missing({ key: "2" })).toBe(true);
@@ -116,9 +132,11 @@ describe("Cache (filesystem)", () => {
         await a.disconnect();
 
         const b = useFilesystemCache({ directory: dir });
-        expect(await b.get({ key: "persist" })).toEqual({ ok: true });
+        const v = await b.get({ key: "persist" });
+        expect(v).toEqual({ ok: true });
         await b.delete({ key: "persist" });
-        expect(await b.get({ key: "persist" })).toBeUndefined();
+        const gone = await b.get({ key: "persist" });
+        expect(gone).toBeUndefined();
         await b.disconnect();
     });
 });

package/tests/crypto.test.ts

@@ -62,7 +62,7 @@ describe("crypto — symmetric AES-256-GCM", () => {
 
     it("decrypt(cipher, true, fields) decrypts the listed sub-fields inside the JSON", async () => {
         const c = useSymCrypt({ secret: "s" });
-        // json contenant des sous-champs chiffrés (convention field-level : JSON.stringify)
+        // json containing encrypted sub-fields (field-level convention: JSON.stringify)
         const encZip = await c.encrypt(JSON.stringify("75000"));
         const encPhone = await c.encrypt(JSON.stringify("0600000000"));
         const container = await c.encrypt({ city: "Paris", zip: encZip, contact: { phone: encPhone } });
@@ -72,7 +72,7 @@ describe("crypto — symmetric AES-256-GCM", () => {
         expect(dec.zip).toBe("75000");
         expect(dec.contact.phone).toBe("0600000000");
 
-        // sans les champs → sous-champs toujours chiffrés
+        // without the fields → sub-fields stay encrypted
         const raw = await c.decrypt<any>(container, true);
         expect(raw.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(raw.city).toBe("Paris");
@@ -94,7 +94,7 @@ describe("crypto — symmetric AES-256-GCM", () => {
         const json = { city: "Paris", note: "plain text", zip: await c.encrypt(JSON.stringify("75000")) };
         const dec = await c.decrypt<any>(json, true, ["zip", "note", "missing"]);
         expect(dec.city).toBe("Paris");
-        expect(dec.note).toBe("plain text"); // pas un ciphertext → inchangé
+        expect(dec.note).toBe("plain text"); // not a ciphertext → kept as-is
         expect(dec.zip).toBe("75000");
     });
 
@@ -103,7 +103,7 @@ describe("crypto — symmetric AES-256-GCM", () => {
         const encZip = await c.encrypt(JSON.stringify("69001"));
         const encOther = await c.encrypt(JSON.stringify("69002"));
 
-        // array conteneur direct (ex: doc.addresses renvoyé par une requête)
+        // direct array container (e.g. doc.addresses returned by a query)
         const arr = [
             { city: "Lyon", zip: encZip },
             { city: "Villeurbanne", zip: encOther },
@@ -111,11 +111,11 @@ describe("crypto — symmetric AES-256-GCM", () => {
         const dec = await c.decrypt<any>(arr, true, ["zip"]);
         expect(dec[0].zip).toBe("69001");
         expect(dec[1].zip).toBe("69002");
-        expect(dec[0].city).toBe("Lyon"); // non-chiffré conservé
-        expect(dec).not.toBe(arr); // copie, pas de mutation
+        expect(dec[0].city).toBe("Lyon"); // non-encrypted value kept
+        expect(dec).not.toBe(arr); // copy, no mutation
         expect(arr[0]!.zip).toMatch(/^[A-Za-z0-9+/=]+$/); // input intact
 
-        // ciphertext dont le plaintext est un array de json
+        // ciphertext whose plaintext is an array of json
         const encContainer = await c.encrypt([{ zip: encZip }, { zip: encOther }]);
         const dec2 = await c.decrypt<any>(encContainer, true, ["zip"]);
         expect(dec2[0].zip).toBe("69001");
@@ -125,10 +125,10 @@ describe("crypto — symmetric AES-256-GCM", () => {
 
 describe("crypto — key rotation (versioned secrets)", () => {
     it("decrypts old ciphertexts after rotating the secret", async () => {
-        const old = useSymCrypt({ secret: "v1-secret" }); // version 1 par défaut
+        const old = useSymCrypt({ secret: "v1-secret" }); // version 1 by default
         const enc = await old.encrypt({ apiKey: "sk-rot" });
 
-        // Rotation : nouvelle clé active v2, l'ancienne conservée en decrypt-only
+        // Rotation: new active key v2, the old one kept for decrypt-only
         const rotated = useSymCrypt({ secret: "v2-secret", version: 2, previousSecrets: { 1: "v1-secret" } });
         const dec = await rotated.decrypt<{ apiKey: string }>(enc, true);
         expect(dec.apiKey).toBe("sk-rot");
@@ -139,7 +139,7 @@ describe("crypto — key rotation (versioned secrets)", () => {
         const enc = await c.encrypt("data");
         const buf = Buffer.from(enc, "base64");
         expect(buf[0]).toBe(2);
-        // round-trip avec la même instance
+        // round-trip with the same instance
         const dec = await c.decrypt(enc);
         expect(dec).toBe("data");
     });
@@ -147,7 +147,7 @@ describe("crypto — key rotation (versioned secrets)", () => {
     it("still decrypts legacy ciphertexts (no version byte)", async () => {
         const c = useSymCrypt({ secret: "s" });
         const enc = await c.encrypt("legacy");
-        // Simule un ciphertext produit AVANT la rotation (format sans octet de version)
+        // Simulates a ciphertext produced BEFORE the rotation (format without a version byte)
         const legacy = Buffer.from(Buffer.from(enc, "base64").subarray(1)).toString("base64");
         const dec = await c.decrypt(legacy);
         expect(dec).toBe("legacy");
@@ -164,11 +164,11 @@ describe("crypto — key rotation (versioned secrets)", () => {
         const c = useSymCrypt({ secret: "s", aad: "myapp:prod" });
         const enc = await c.encrypt({ apiKey: "sk-aad" });
 
-        // même instance → OK (défaut appliqué au decrypt aussi)
+        // same instance → OK (default applied on decrypt too)
         const dec = await c.decrypt<{ apiKey: string }>(enc, true);
         expect(dec.apiKey).toBe("sk-aad");
 
-        // sans l'AAD config → échec (tag invalide)
+        // without the config AAD → fails (invalid tag)
         const other = useSymCrypt({ secret: "s" });
         await expect(other.decrypt(enc, true)).rejects.toThrow();
     });
@@ -178,15 +178,15 @@ describe("crypto — key rotation (versioned secrets)", () => {
         const enc = await c.encrypt("x", "explicit:ctx");
         const dec = await c.decrypt(enc, false, "explicit:ctx");
         expect(dec).toBe("x");
-        // le défaut ne déchiffre pas le chiffré lié à l'explicite
+        // the default cannot decrypt the ciphertext bound to the explicit AAD
         await expect(c.decrypt(enc, false, "default:ctx")).rejects.toThrow();
     });
 
     it("legacy ciphertexts (no AAD) still decrypt after a default AAD is configured", async () => {
-        const legacy = useSymCrypt({ secret: "s" }); // chiffré SANS AAD (ancien comportement)
+        const legacy = useSymCrypt({ secret: "s" }); // encrypted WITHOUT AAD (legacy behavior)
         const enc = await legacy.encrypt("old-data");
 
-        const c = useSymCrypt({ secret: "s", aad: "myapp:prod" }); // config avec AAD par défaut
+        const c = useSymCrypt({ secret: "s", aad: "myapp:prod" }); // config with a default AAD
         const dec = await c.decrypt(enc);
         expect(dec).toBe("old-data");
     });
@@ -223,7 +223,7 @@ describe("crypto — encryption mode (server.encryption.mode)", () => {
     it("resolve() returns the instance matching the configured mode", async () => {
         delete (cfg.server as any).encryption;
         formatConfig({ server: { port: 4000 }, tenants: [] });
-        const priv = await useAsymCrypt().exportPrivateKey(); // pair fraîche, pas de mode config
+        const priv = await useAsymCrypt().exportPrivateKey(); // fresh pair, no configured mode
 
         delete (cfg.server as any).encryption;
         formatConfig({ server: { port: 4000, encryption: { mode: "symmetric", secret: "cfg" } }, tenants: [] });

package/tests/field-encryption.test.ts

@@ -24,12 +24,12 @@ beforeAll(async () => {
     await syncCollections();
     (cfg as any).collections = [encCollection([
         { name: "name", type: "string" },
-        { name: "ssn", type: "string", encryption: true },           // champ chiffré
-        { name: "profile", type: "json", encryption: true },          // objet chiffré
+        { name: "ssn", type: "string", encryption: true },           // whole value encrypted
+        { name: "profile", type: "json", encryption: true },          // whole json encrypted
         { name: "age", type: "number" },
-        { name: "address", type: "json", encryptionOptions: { path: "zip" } },          // json : seul address.zip est chiffré
-        { name: "contacts", type: "json", encryptionOptions: { path: ["phone", "email"] } }, // plusieurs chemins
-        { name: "addresses", type: "json", encryptionOptions: { path: "zip" } },        // array de json
+        { name: "address", type: "json", encryptionOptions: { path: "zip" } },          // json: only address.zip encrypted
+        { name: "contacts", type: "json", encryptionOptions: { path: ["phone", "email"] } }, // several paths
+        { name: "addresses", type: "json", encryptionOptions: { path: "zip" } },        // array of json
     ])];
     rest = new useRest({ internal: false, tenant_id: TENANT });
 });
@@ -44,35 +44,35 @@ describe("field-level encryption", () => {
     it("insert stores ciphertext in Mongo but returns plaintext", async () => {
         const doc: any = await rest.insertOne("patients", { name: "John", ssn: "123-45-6789", profile: { city: "Paris", zip: 75000 }, age: 42 });
 
-        // réponse API = plaintext
+        // API response = plaintext
         expect(doc.ssn).toBe("123-45-6789");
         expect(doc.profile).toEqual({ city: "Paris", zip: 75000 });
 
-        // en base = ciphertext (version byte + IV + data)
+        // in Mongo = ciphertext (version byte + IV + data)
         const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
         expect(raw).not.toBeNull();
         expect(raw!.ssn).not.toBe("123-45-6789");
         expect(typeof raw!.ssn).toBe("string");
         expect(raw!.ssn).toMatch(/^[A-Za-z0-9+/=]+$/); // base64
         expect(raw!.profile).not.toEqual({ city: "Paris" });
-        // champ non chiffré intact
+        // non-encrypted field untouched
         expect(raw!.name).toBe("John");
         expect(raw!.age).toBe(42);
     });
 
     it("find / findOne return ciphertext (no decrypt on output)", async () => {
         const list: any = await rest.find("patients", { $match: { name: "John" } });
-        // lecture = ciphertext (jamais décrypté automatiquement)
+        // read = ciphertext (never decrypted automatically)
         expect(list[0].ssn).not.toBe("123-45-6789");
         expect(list[0].ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(list[0].profile).not.toEqual({ city: "Paris", zip: 75000 });
-        // champs non chiffrés intacts
+        // non-encrypted fields untouched
         expect(list[0].name).toBe("John");
 
         const one: any = await rest.findOne("patients", list[0]._id);
         expect(one.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
 
-        // décryptage MANUEL explicite (utils.crypt.resolve())
+        // explicit MANUAL decryption (utils.crypt.resolve())
         const cipher = resolve();
         const dec = await cipher.decrypt<string>(one.ssn, true);
         expect(dec).toBe("123-45-6789");
@@ -82,10 +82,10 @@ describe("field-level encryption", () => {
         const doc: any = await rest.findOne("patients", (await rest.find("patients", { $match: { name: "John" } }))[0]!._id);
         const updated: any = await rest.updateOne("patients", doc._id, { $set: { ssn: "987-65-4321" } });
 
-        // retour = ciphertext (plus de décryptage automatique)
+        // response = ciphertext (no automatic decryption anymore)
         expect(updated.ssn).not.toBe("987-65-4321");
         expect(updated.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
-        // base = nouveau ciphertext
+        // stored = new ciphertext
         const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
         expect(raw).not.toBeNull();
         expect(raw!.ssn).not.toBe("987-65-4321");
@@ -99,17 +99,17 @@ describe("field-level encryption", () => {
         const raw = await rest.db.collection("patients").find({ name: { $in: ["A", "B"] } }).toArray();
         for (const r of raw) expect(r.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
         const list: any = await rest.find("patients", { $match: { name: { $in: ["A", "B"] } } });
-        // lecture = ciphertext, décrypté manuellement
+        // read = ciphertext, decrypted manually
         for (const d of list) expect(d.ssn).toMatch(/^[A-Za-z0-9+/=]+$/);
     });
 
     it("rejects operators that cannot work on ciphertext ($inc on an encrypted field)", async () => {
         const doc: any = await rest.findOne("patients", (await rest.find("patients", { $match: { name: "John" } }))[0]!._id);
         await expect(
-            rest.updateOne("patients", doc._id, { $set: { ssn: "x" }, $inc: { age: 1 } }) // $inc sur age (non chiffré) OK
+            rest.updateOne("patients", doc._id, { $set: { ssn: "x" }, $inc: { age: 1 } }) // $inc on age (not encrypted) OK
         ).resolves.toBeTruthy();
         await expect(
-            rest.updateOne("patients", doc._id, { $set: { ssn: "y" }, $inc: { ssn: 1 } as any }) // $inc sur champ chiffré → rejeté
+            rest.updateOne("patients", doc._id, { $set: { ssn: "y" }, $inc: { ssn: 1 } as any }) // $inc on an encrypted field → rejected
         ).rejects.toThrow(/ENCRYPTED_FIELD_OPERATOR|not supported/);
     });
 
@@ -119,7 +119,7 @@ describe("field-level encryption", () => {
         await expect(rest.insertOne("patients", { name: "NoCfg", ssn: "000-00-0000" }))
             .rejects.toThrow(/ENCRYPTION_NOT_CONFIGURED|server\.encryption/);
 
-        // restore config pour les tests suivants
+        // restore the config for the following tests
         formatConfig({ server: { port: 4000, encryption: { mode: "symmetric", secret: "field-enc-secret" } }, tenants: [] });
     });
 });
@@ -130,22 +130,22 @@ describe("field-level encryption — encryptionOptions.path (json sub-paths)", (
             name: "Alice",
             address: { street: "Rue X", city: "Paris", zip: "75000" },
         });
-        // réponse = plaintext partout
+        // response = plaintext everywhere
         expect(doc.address.zip).toBe("75000");
         expect(doc.address.city).toBe("Paris");
 
-        // en base : seul zip est ciphertext, le reste est en clair
+        // in Mongo: only zip is ciphertext, the rest stays in clear
         const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
         expect(raw!.address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(raw!.address.city).toBe("Paris");
         expect(raw!.address.street).toBe("Rue X");
 
-        // lecture rest = ciphertext au path, plaintext ailleurs
+        // rest read = ciphertext at the path, plaintext elsewhere
         const list: any = await rest.find("patients", { $match: { name: "Alice" } });
         expect(list[0].address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(list[0].address.city).toBe("Paris");
 
-        // décryptage manuel
+        // manual decryption
         const cipher = resolve();
         const zip = await cipher.decrypt<string>(list[0].address.zip, true);
         expect(zip).toBe("75000");
@@ -158,10 +158,10 @@ describe("field-level encryption — encryptionOptions.path (json sub-paths)", (
             addresses: [{ zip: "69001" }, { zip: "69002", city: "Lyon" }],
         });
         const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });
-        // array de json : chaque élément chiffré sur son zip
+        // array of json: every element encrypted on its zip
         expect(raw!.addresses[0].zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(raw!.addresses[1].zip).toMatch(/^[A-Za-z0-9+/=]+$/);
-        expect(raw!.addresses[1].city).toBe("Lyon"); // non-chiffré intact
+        expect(raw!.addresses[1].city).toBe("Lyon"); // non-encrypted value untouched
         // multiple paths
         expect(raw!.contacts.phone).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(raw!.contacts.email).toMatch(/^[A-Za-z0-9+/=]+$/);
@@ -171,12 +171,12 @@ describe("field-level encryption — encryptionOptions.path (json sub-paths)", (
     it("encrypts the path on $set replacement and dot-notation $set", async () => {
         const doc: any = await rest.findOne("patients", (await rest.find("patients", { $match: { name: "Alice" } }))[0]!._id);
 
-        // $set du json complet → zip re-chiffré dans le remplacement
+        // $set of the whole json → zip re-encrypted inside the replacement
         const up1: any = await rest.updateOne("patients", doc._id, { $set: { address: { city: "Nice", zip: "06000" } } });
         expect(up1.address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         expect(up1.address.city).toBe("Nice");
 
-        // dot-notation $set sur le path exact → valeur chiffrée
+        // dot-notation $set on the exact path → value encrypted
         const up2: any = await rest.updateOne("patients", doc._id, { $set: { "address.zip": "06100" } });
         expect(up2.address.zip).toMatch(/^[A-Za-z0-9+/=]+$/);
         const raw = await rest.db.collection("patients").findOne({ _id: new ObjectId(doc._id) });

package/tests/fixtures/index-tenant/collections/variants.model.ts

@@ -1,8 +1,8 @@
 import { define } from "../../../../index";
 
 // Reproduces the Mongo error `sparse: null is not convertible to bool`:
-// `indexOptions.sparse` explicit à null doit être ignoré (jamais envoyé à Mongo),
-// et `unique` accepte le style Mongo 1/0 (coercé en vrai booléen).
+// an explicit `indexOptions.sparse: null` must be ignored (never sent to Mongo),
+// and `unique` accepts the Mongo 1/0 style (coerced to a real boolean).
 export default define.Collection({
     slug: "variants",
     fields: [

package/tests/index-spec.test.ts

@@ -7,8 +7,8 @@ const TENANT = "idx-test";
 const DIR = "packages/core/tests/fixtures/index-tenant";
 const DB = "mongodb://localhost:27017/_DB_IDX_TEST";
 
-// initializeOnDatabase est fire-and-forget dans syncCollections — on attend
-// que les index existent réellement en base.
+// initializeOnDatabase is fire-and-forget inside syncCollections — wait until the
+// indexes really exist in the database.
 async function waitForIndexes(colName: string): Promise<any[]> {
     const db = cfg.tenants?.[0]?.database?.db as any;
     const col = db.collection(colName);
@@ -40,13 +40,13 @@ describe("index spec construction", () => {
     it("drops null/undefined options and coerces Mongo-style 1/0 booleans", async () => {
         const idxs = await waitForIndexes("variants");
 
-        // name : indexOptions.sparse = null → ignoré (pas de sparse:null), index créé
+        // name: indexOptions.sparse = null → ignored (no sparse:null sent), index created
         const nameIdx = idxs.find((i) => i.name === "name_1");
         expect(nameIdx).toBeDefined();
         expect(nameIdx!.sparse).not.toBe(null);
-        expect(nameIdx!.sparse).not.toBe(true); // false / undefined — jamais null
+        expect(nameIdx!.sparse).not.toBe(true); // false / undefined — never null
 
-        // sku : unique: 1 (Mongo-style) → index unique réel
+        // sku: unique: 1 (Mongo-style) → a real unique index
         const skuIdx = idxs.find((i) => i.name === "sku_1");
         expect(skuIdx).toBeDefined();
         expect(skuIdx!.unique).toBe(true);

package/tests/upload.test.ts

@@ -0,0 +1,138 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { createApp } from "../server/hono";
+import { formatConfig, cfg } from "../server/config";
+import { syncTenants } from "../database/tenant";
+import { getFileCollection } from "../database/file";
+import { useRest } from "../database/rest";
+
+const TENANT = "up-test";
+const DB = "mongodb://localhost:27017/_DB_UP_TEST";
+const SLUG = "photos";
+
+let rest: InstanceType<typeof useRest>;
+let server: any;
+let url = "";
+
+beforeAll(async () => {
+    formatConfig({
+        server: { port: 4000 },
+        tenants: [{ id: TENANT, dir: "up-tenant", database: { uri: DB } }],
+    });
+    await syncTenants();
+
+    // File collection (disk storage) — no syncing from disk, declared directly
+    (cfg as any).fileCollections = [{
+        _tenant_: TENANT,
+        _isFileCollection_: true,
+        slug: SLUG,
+        fields: [{ name: "label", type: "string" }],
+        upload: { allowedMimeTypes: ["image/png", "text/plain"], maxSize: 5 * 1024 * 1024 },
+        storage: { driver: "disk" },
+        api: { access: { "*": true } },
+    }];
+
+    rest = new useRest({ internal: false, tenant_id: TENANT });
+    const app = createApp();
+    server = Bun.serve({ port: 0, fetch: app.fetch });
+    url = server.url.href.replace(/\/$/, "");
+});
+
+afterAll(async () => {
+    try { await rest.db.collection(SLUG).drop(); } catch {}
+    // clean the uploaded files
+    try {
+        const fs = await import("node:fs/promises");
+        await fs.rm(`${process.cwd()}/storage/${TENANT}/${SLUG}`, { recursive: true, force: true });
+    } catch {}
+    try { server.stop(true); } catch {}
+});
+
+function pngFile(name: string) {
+    // minimal valid PNG (1x1) so content detection sees a real image
+    const bytes = Buffer.from(
+        "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8BQDwAEhQGAhKmMIQAAAABJRU5ErkJggg==",
+        "base64"
+    );
+    return new File([bytes], name, { type: "image/png" });
+}
+
+describe("upload — single file (unchanged contract)", () => {
+    it("returns a single object", async () => {
+        const form = new FormData();
+        form.append("file", pngFile("one.png"));
+        form.append("label", "single");
+
+        const res = await fetch(`${url}/upload/${TENANT}/${SLUG}`, { method: "POST", body: form });
+        expect(res.status).toBe(200);
+
+        const body: any = await res.json();
+        expect(Array.isArray(body)).toBe(false);          // ← object, not an array
+        expect(body._id).toBeString();
+        expect(body._file.name).toBe("one.png");
+        expect(body._file.mimetype).toBe("image/png");
+        expect(body._file.url).toContain(`/files/${TENANT}/${SLUG}/`);
+
+        // metadata persisted on the document
+        const doc: any = await rest.findOne(SLUG, body._id);
+        expect(doc.label).toBe("single");
+    });
+
+    it("accepts the 'upload' field name too", async () => {
+        const form = new FormData();
+        form.append("upload", pngFile("alt.png"));
+
+        const res = await fetch(`${url}/upload/${TENANT}/${SLUG}`, { method: "POST", body: form });
+        expect(res.status).toBe(200);
+        const body: any = await res.json();
+        expect(Array.isArray(body)).toBe(false);
+        expect(body._file.name).toBe("alt.png");
+    });
+});
+
+describe("upload — multiple files", () => {
+    it("returns an array and creates one document per file", async () => {
+        const form = new FormData();
+        form.append("file", pngFile("a.png"));
+        form.append("file", pngFile("b.png"));
+        form.append("file", pngFile("c.png"));
+        form.append("label", "batch");
+
+        const res = await fetch(`${url}/upload/${TENANT}/${SLUG}`, { method: "POST", body: form });
+        expect(res.status).toBe(200);
+
+        const body: any = await res.json();
+        expect(Array.isArray(body)).toBe(true);
+        expect(body.length).toBe(3);
+        expect(body.map((f: any) => f._file.name).sort()).toEqual(["a.png", "b.png", "c.png"]);
+
+        // every file is its own document, all ids distinct, metadata shared
+        const ids = body.map((f: any) => f._id);
+        expect(new Set(ids).size).toBe(3);
+        for (const id of ids) {
+            const doc: any = await rest.findOne(SLUG, id);
+            expect(doc.label).toBe("batch");
+            expect(doc._file.url).toContain(`/files/${TENANT}/${SLUG}/`);
+        }
+    });
+
+    it("still rejects a request without any file", async () => {
+        const form = new FormData();
+        form.append("label", "nofile");
+
+        const res = await fetch(`${url}/upload/${TENANT}/${SLUG}`, { method: "POST", body: form });
+        expect(res.status).toBe(400);
+        const body: any = await res.json();
+        expect(body.code).toBe("FILE_REQUIRED");
+    });
+
+    it("rejects the whole batch on an invalid file (per-file validation)", async () => {
+        const form = new FormData();
+        form.append("file", pngFile("ok.png"));
+        form.append("file", new File([Buffer.from("nope")], "bad.exe", { type: "application/x-msdownload" }));
+
+        const res = await fetch(`${url}/upload/${TENANT}/${SLUG}`, { method: "POST", body: form });
+        expect(res.status).toBe(400);
+        const body: any = await res.json();
+        expect(body.code).toBe("MIMETYPE_NOT_ALLOWED");
+    });
+});

package/utils/cache.ts

@@ -3,11 +3,9 @@ import { memoryDriver } from "bentocache/drivers/memory";
 import { redisDriver } from "bentocache/drivers/redis";
 import { fileDriver } from "bentocache/drivers/file";
 import path from "path";
-const drivers = {
-    memoryDriver,
-    redisDriver,
-    fileDriver,
-}
+
+/** The underlying BentoCache instance — full provider API, with autocompletion */
+export type Cache = InstanceType<typeof BentoCache>;
 
 type Driver = 'memory' | 'redis' | 'filesystem';
 
@@ -25,50 +23,27 @@ type CacheOptions = {
     pruneInterval?: string;
 }
 
-class Cache {
-    #cache: InstanceType<typeof BentoCache>;
-    constructor(driver: Driver, options?: CacheOptions) {
-        let store = bentostore().useL1Layer(memoryDriver({
-        }))
-
-        if (driver == 'filesystem') {
-            store = store.useL2Layer(fileDriver({
-                directory: options?.filesystem?.directory ?? path.join(process.cwd(), '.cache'),
-                pruneInterval: options?.pruneInterval ?? '1h'
-            }))
-        }
+function createCache(driver: Driver, options?: CacheOptions): Cache {
+    let store = bentostore().useL1Layer(memoryDriver({}))
 
-        if (driver == 'redis' && options?.redis?.connection) {
-            store = store.useL2Layer(redisDriver({
-                connection: options.redis.connection
-            }))
-        }
-        this.#cache = new BentoCache({
-            default: driver,
-            stores: {
-                [driver]: store,
-            }
-        })
+    if (driver == 'filesystem') {
+        store = store.useL2Layer(fileDriver({
+            directory: options?.filesystem?.directory ?? path.join(process.cwd(), '.cache'),
+            pruneInterval: options?.pruneInterval ?? '1h'
+        }))
     }
 
-    // ─── BentoCache provider API (delegated to the underlying instance) ───
-
-    set(options: any): Promise<boolean> { return this.#cache.set(options); }
-    setForever(options: any): Promise<boolean> { return this.#cache.setForever(options); }
-    get(options: any): Promise<unknown> { return this.#cache.get(options); }
-    getOrSet(options: any): Promise<unknown> { return this.#cache.getOrSet(options); }
-    getOrSetForever(options: any): Promise<unknown> { return this.#cache.getOrSetForever(options); }
-    has(options: any): Promise<boolean> { return this.#cache.has(options); }
-    missing(options: any): Promise<boolean> { return this.#cache.missing(options); }
-    pull(key: string): Promise<unknown> { return this.#cache.pull(key); }
-    delete(options: any): Promise<boolean> { return this.#cache.delete(options); }
-    deleteMany(options: any): Promise<boolean> { return this.#cache.deleteMany(options); }
-    deleteByTag(options: any): Promise<boolean> { return this.#cache.deleteByTag(options); }
-    expire(options: any): Promise<boolean> { return this.#cache.expire(options); }
-    clear(options?: any): Promise<void> { return this.#cache.clear(options); }
-    prune(): Promise<void> { return this.#cache.prune(); }
-    namespace(namespace: string): any { return this.#cache.namespace(namespace); }
-    disconnect(): Promise<void> { return this.#cache.disconnect(); }
+    if (driver == 'redis' && options?.redis?.connection) {
+        store = store.useL2Layer(redisDriver({
+            connection: options.redis.connection
+        }))
+    }
+    return new BentoCache({
+        default: driver,
+        stores: {
+            [driver]: store,
+        }
+    })
 }
 
 
@@ -79,8 +54,8 @@ function useRedisCache(options: {
         password: string;
     };
     pruneInterval?: string;
-}) {
-    return new Cache('redis', {
+}): Cache {
+    return createCache('redis', {
         redis: {
             connection: options.connection,
         },
@@ -88,15 +63,15 @@ function useRedisCache(options: {
     });
 }
 
-function useMemoryCache() {
-    return new Cache('memory');
+function useMemoryCache(): Cache {
+    return createCache('memory');
 }
 
 function useFilesystemCache(options: {
     directory: string;
     pruneInterval?: string;
-}) {
-    return new Cache('filesystem', {
+}): Cache {
+    return createCache('filesystem', {
         filesystem: {
             directory: options.directory,
         },
@@ -106,9 +81,8 @@ function useFilesystemCache(options: {
 
 
 
-export default Cache;
 export {
-    Cache,
+
     useFilesystemCache,
     useMemoryCache,
     useRedisCache

package/bench-cache.ts

@@ -1,70 +0,0 @@
-// Scratch benchmark — `bun run bench-cache.ts` (depuis packages/core)
-// Vérifie que useCache fonctionne vraiment et mesure les ms (miss vs hit vs sans cache).
-import { useRest } from "./database/rest";
-import { formatConfig, cfg } from "./server/config";
-import { syncTenants } from "./database/tenant";
-import { syncCollections } from "./database/collection";
-
-const TENANT = "bench";
-const DB = "mongodb://localhost:27017/_DB_BENCH";
-const N = 10000; // docs seedés
-
-async function main() {
-    formatConfig({
-        server: { port: 4000, cache: { enabled: true, driver: "memory" } },
-        tenants: [{ id: TENANT, dir: "bench-tenant", database: { uri: DB } }],
-    });
-    await syncTenants();
-    await syncCollections();
-
-    (cfg as any).collections = [
-        { _tenant_: TENANT, slug: "items", fields: [{ name: "title", type: "string" }, { name: "count", type: "number" }], api: { access: { "*": true } } },
-    ];
-    const rest = new useRest({ internal: false, tenant_id: TENANT });
-    const col = rest.db.collection("items");
-
-    // Seed
-    console.log(`Seeding ${N} docs…`);
-    const batch = [];
-    for (let i = 0; i < N; i++) batch.push({ title: `item-${i % 100}`, count: i });
-    for (let i = 0; i < batch.length; i += 1000) await col.insertMany(batch.slice(i, i + 1000));
-    console.log("Seeded ✓");
-
-    const params = { $match: { count: { $gte: 1000, $lte: 9000 } }, $sort: { count: -1 }, $limit: 50 };
-
-    // 1. Sans cache — moyenne sur 100 requêtes
-    const t0 = performance.now();
-    const ITERS = 100;
-    for (let i = 0; i < ITERS; i++) await rest.find("items", params);
-    const noCacheAvg = (performance.now() - t0) / ITERS;
-
-    // 2. Avec cache — 1er appel (MISS → requête DB) puis hits
-    const tMiss = performance.now();
-    const r1 = await rest.find("items", params, { useCache: true });
-    const missMs = performance.now() - tMiss;
-    console.log(`MISS: ${r1.length} docs retournés (requête DB réelle)`);
-
-    const tHits = performance.now();
-    for (let i = 0; i < ITERS; i++) await rest.find("items", params, { useCache: true });
-    const hitAvg = (performance.now() - tHits) / ITERS;
-
-    // 3. Preuve que le hit sert BIEN depuis le cache (pas la DB) :
-    //    on mute DIRECTEMENT en DB (bypass framework) un doc présent dans le résultat.
-    await col.updateMany({ count: 9000 }, { $set: { title: "MUTATED-DIRECT-DB" } });
-    const cached = await rest.find("items", params, { useCache: true });
-    const dbFresh = await rest.find("items", params);
-    const stale = cached.some((d: any) => d.title === "MUTATED-DIRECT-DB");
-    const fresh = dbFresh.some((d: any) => d.title === "MUTATED-DIRECT-DB");
-
-    console.log("\n─── RÉSULTATS (driver memory, Mongo local) ───");
-    console.log(`Sans cache  : ${noCacheAvg.toFixed(3)} ms/requête  (${ITERS} requêtes)`);
-    console.log(`MISS (cache): ${missMs.toFixed(3)} ms  (1er appel → requête DB, résultat mis en cache)`);
-    console.log(`HIT (cache) : ${hitAvg.toFixed(3)} ms/requête  (${ITERS} requêtes)`);
-    console.log(`Gain        : ${(noCacheAvg / hitAvg).toFixed(0)}× plus rapide`);
-    console.log(`Preuve cache: cache sert ${stale ? "la VALEUR MUTÉE (bug! cache pas servi)" : "l'ANCIENNE valeur (cache servi ✓)"}, requête fraîche = ${fresh ? "nouvelle valeur (DB bien mutée ✓)" : "?"}`);
-
-    await col.drop();
-    process.exit(0);
-}
-
-main().catch((e) => { console.error(e); process.exit(1); });