@bakery-framework/core 1.2.3 → 2.0.0-alpha.11

package/src/handlers/routes/api.ts

@@ -2,6 +2,7 @@ import { Bakery } from '../../core/bakery'
 import { handlerLog } from '../../logger/serve-log'
 import { FileSystem } from '../../utils/fs'
 import { checkCsrf, response } from '../../utils/http'
+import { parsedUrl } from '../../utils/http/url'
 import type { Handler } from '../core/$base'
 import { bustInDev, DynamicHandler } from '../core/$dynamic'
 import { ErrorHandler } from '../core/$error'
@@ -29,8 +30,7 @@ export class ApiHandler extends DynamicHandler {
   static async handle(path: string, req: Request) {
     // State-changing methods must be same-origin. SameSite=Lax alone does not
     // cover this: a cross-site form POST is a CORS-simple request.
-    const url: URL = (req as any).__parsedUrl || new URL(req.url)
-    const csrf = checkCsrf(req, url)
+    const csrf = checkCsrf(req, parsedUrl(req))
     if (csrf) return response.json.error(403, csrf) as unknown as Response
 
     const info = await this.resolveRoute(path)

package/src/handlers/routes/proxy.ts

@@ -1,6 +1,7 @@
 import { Bakery } from '../../core/bakery'
 import { handlerLog } from '../../logger'
 import { response } from '../../utils/http'
+import { parsedUrl } from '../../utils/http/url'
 import { Handler } from '../core/$base'
 
 export class ProxyHandler extends Handler {
@@ -30,7 +31,7 @@ export class ProxyHandler extends Handler {
         baseTarget +
         (trailingPath.startsWith('/') ? '' : '/') +
         trailingPath +
-        ((req as any).__parsedUrl || new URL(req.url)).search
+        parsedUrl(req).search
       break
     }
 

package/src/logger/serve-log.ts

@@ -27,6 +27,12 @@ const serveMsgs = {
     'I Synced %ytsconfig.json%* paths with %yserver.config.ts%*!',
   TSCONFIG_PROJECTS_WRITTEN:
     'I Wrote %y{count}%* tsconfig project(s) to %y.cache/tsconfig/%*',
+  // One-time repair. Previous releases wired the generated projects into the
+  // app's tsconfig.json as `references`, which broke `tsc -p <app>`
+  // (TS6305/6306/6310). Named so the rewrite of a tracked file comes with a
+  // line saying why it happened.
+  TSCONFIG_REFERENCES_REMOVED:
+    'I Removed generated %yreferences%* from %ytsconfig.json%* — the %y.cache/tsconfig/%* projects are standalone, and referencing them broke %ytsc -p%*',
   // A plugin asking for a project name that is taken. Named rather than
   // silent: the symptom otherwise is one plugin's types quietly not applying,
   // discovered much later and blamed on the wrong thing.
@@ -98,6 +104,21 @@ const handlerMsgs = {
   PROXY_REQ: 'I Proxying %y{path}%* -> %b{target}%*',
   MIDDLEWARE_ERR: 'E Middleware error: %r{error}%*',
   BUNDLE_ERR: 'E Failed to bundle module (%y{file}%*): %r{error}%*',
+  // **Keep each message one unbroken string literal.** Splitting a long one into
+  // `'…' + '…'` types as `string`, so `as const` preserves nothing,
+  // `messageLogger` extracts no `{placeholder}`, and every call site fails with
+  // "Expected 0 arguments, but got 1". Wrapping the value onto its own line, as
+  // below, is fine; joining with `+` is not.
+  BUNDLE_SIDE_EFFECTS_REPAIRED:
+    'I %y{file}%* tree-shook to an empty export list because its package declares %ysideEffects: false%*; re-bundled through a re-export shim, which keeps the code.',
+  BUNDLE_EMPTY_EXPORTS:
+    'E %y{file}%* bundled to an export list with no code behind it — every name it exports is undefined, so it is rejected rather than served. The bundler reported success, and re-bundling through a re-export shim did not recover it. Import the specific module you need instead of the package root.',
+  BUNDLE_CJS_INTEROP:
+    'I Generated named exports for the CommonJS package %y{file}%*, so a named import of it works in the browser.',
+  BUNDLE_CJS_PROBED:
+    'I Could not read %y{file}%* export names statically, so they were probed by importing it in a short-lived child process.',
+  BUNDLE_CJS_DEFAULT_ONLY:
+    'W %y{file}%* assigns %ymodule.exports%* wholesale and its members could not be read, so its browser bundle exports only %ydefault%* — a named import from it fails in the browser with "does not provide an export named …", and nothing fails here. Import the default and read the property off it, or use an ESM build.',
 } as const
 
 export const handlerLog = messageLogger(new Logger('handlers'), handlerMsgs)

package/src/plugins/types.ts

@@ -6,11 +6,13 @@ export type ValidResponses = Handler.Response
 /**
  * A TypeScript project a plugin contributes to the app.
  *
- * Written to `.cache/tsconfig/<name>.json` on every dev boot and referenced
- * from the app's root `tsconfig.json`, so the editor typechecks each file under
- * the project that owns it. Regenerated rather than committed: it is derived
- * from the plugin list and the app's config, and `.cache/` is the disposable
- * half of the two runtime directories.
+ * Written to `.cache/tsconfig/<name>.json` on every dev boot, as a standalone
+ * project invoked directly (`vue-tsc -p .cache/tsconfig/vue.json`). It is
+ * deliberately *not* referenced from the app's root `tsconfig.json` — a
+ * `references` entry to an unbuilt `noEmit` project makes `tsc -p <app>` fail
+ * (TS6305/6306/6310; see `compiler/tsconfig-sync.ts`). Regenerated rather
+ * than committed: it is derived from the plugin list and the app's config, and
+ * `.cache/` is the disposable half of the two runtime directories.
  */
 export interface PluginTsProject {
   /** File name under `.cache/tsconfig/`, and the project's identity. */

package/src/router.ts

@@ -19,6 +19,7 @@ import {
   withStatus,
 } from './utils/http'
 import { applyCors, preflightResponse } from './utils/http/cors'
+import { parsedUrl } from './utils/http/url'
 
 /**
  * Resolve a WebSocket upgrade, refusing cross-origin handshakes first.
@@ -39,7 +40,7 @@ export async function upgradeWebsocket(
   req: Request,
   path: string,
 ): Promise<boolean | undefined> {
-  const url: URL = (req as any).__parsedUrl || new URL(req.url)
+  const url = parsedUrl(req)
   const denied = checkWebSocketOrigin(req, url)
   if (denied) {
     serveLog.WEBSOCKET_ERR({
@@ -85,10 +86,9 @@ export function handleRequest(
   req: Request,
 ): Handler.Response | MixedPromise<symbol>
 export async function handleRequest(req: Request) {
-  // worker.ts parses and attaches this before calling in; the fallback keeps
-  // direct callers (tests, embedders) working.
-  const url: URL = (req as any).__parsedUrl || new URL(req.url)
-  ;(req as any).__parsedUrl = url
+  // Shared with worker.ts, which has already asked for the same parse; a
+  // direct caller (test, embedder) gets it parsed here instead.
+  const url = parsedUrl(req)
   const path = url.pathname
 
   // One read of the config getter, not three: `Bakery.serveRoot` walks

package/src/session.ts

@@ -12,9 +12,6 @@ import { DEFAULT_SESSION_PERSIST, DEFAULT_SESSION_TTL } from './utils/constants'
  */
 export const RESERVED_SESSION_PREFIX = '__bakery.'
 
-/** Marks a session as having passed the DASHPASS check. */
-export const DASHPASS_SESSION_KEY = `${RESERVED_SESSION_PREFIX}dashpass`
-
 export function isReservedSessionKey(key: string): boolean {
   return key.startsWith(RESERVED_SESSION_PREFIX)
 }

package/src/shared.d.ts

@@ -25,6 +25,13 @@ import type { MapOf } from './types'
  */
 
 declare global {
+  /**
+   * Bound by `client/utils.ts` in the browser and `core/init.ts` on the
+   * server — the same isomorphic implementation either side, so code moving
+   * between an SFC browser script and a server block keeps the name.
+   */
+  var randomId: typeof import('./utils/isomorphic/misc').randomId
+
   /** The one JSON envelope — see convention 7. */
   type JsonResponse<T = any> = {
     time: number

package/src/types.d.ts

@@ -65,6 +65,17 @@ export type Match<D extends symbol> = {
  */
 export type RouteBody<P = {}> = P & MapOf<any>
 
+/**
+ * What one dynamic route segment binds: `[id]` a string, `[...rest]` and
+ * `[...rest!]` an array of the remaining segments (`[]` for the bare
+ * directory under the `!` form).
+ *
+ * Exists so a route over mixed or unknown segments can say
+ * `defineRoute<MapOf<RouteParam>>` instead of hand-writing the union — and so
+ * the union has one definition to change if it ever grows.
+ */
+export type RouteParam = string | string[]
+
 /**
  * What a route module may actually return — read off `processResponse`
  * (`router.ts`) and `ApiHandler.handle`: a `Response`, a `BunFile` (streamed

package/src/utils/fs.ts

@@ -395,6 +395,35 @@ export namespace FileSystem {
     let curr = safeResolve(pathToCheck)
     const normalizedRoot = safeResolve(root)
 
+    // A path outside `root` is forbidden, and this is the clause that says so.
+    //
+    // The walk below is bounded by `curr.startsWith(normalizedRoot)`, so an
+    // out-of-root path skipped the loop body entirely and fell through to
+    // `return false` — "not forbidden". That is a guard failing *open* on the
+    // one input it most needs to refuse, and it made every caller that relied
+    // on this for containment (all of them: `constants.ts` said so in as many
+    // words) incapable of catching an escape.
+    //
+    // Not theoretical. `$routing.ts` builds its route globs with `\*` to mean a
+    // literal asterisk; on Windows a backslash is a path *separator*, so Bun
+    // read the pattern as drive-absolute, ignored `cwd`, and matched files at
+    // `C:\`. `getRoute` resolved one, asked this function, was told "allowed",
+    // and returned an `Info` pointing six levels above the serve root. The glob
+    // is fixed too, but the glob was only how it was reached — a resolved file
+    // outside the root has to be refused here whatever produced it.
+    //
+    // The separator suffix matters: a bare `startsWith` would also accept a
+    // sibling directory whose name merely begins with the root's. A root that
+    // is already a filesystem root ends in `/` and must not gain a second one —
+    // `C://` matches nothing, which would make every path under `C:/` read as
+    // an escape. `fs.test.ts` drives both through its root corpus.
+    const rootPrefix = normalizedRoot.endsWith('/')
+      ? normalizedRoot
+      : `${normalizedRoot}/`
+    if (curr !== normalizedRoot && !curr.startsWith(rootPrefix)) {
+      return true
+    }
+
     const store = hostStore.getStore()
     const seen = store ? (store.forbiddenProbes ??= new Map()) : null
 

package/src/utils/http/authorize.ts

@@ -0,0 +1,136 @@
+/**
+ * The request-predicate half of plugin authorization.
+ *
+ * One implementation, deliberately in core, for the same reason
+ * `credential.ts` is here: the dashboard, db-explorer and analytics plugins
+ * each need this guard, and per-plugin copies of security code drift. These
+ * three had already drifted — one coerced its predicate's return with
+ * `Boolean`, one gated on `!DEV` where the others read `PROD`, one swallowed a
+ * `getClientIp` throw into an empty string and carried on. Each divergence is
+ * resolved below toward the fail-closed reading, and each is marked as a
+ * decision rather than left to look like a style choice.
+ *
+ * It owns *only* the predicate — no logins, no sessions, no backoff. The shared
+ * key path is `credential.ts`; a plugin that offers both doors composes them.
+ *
+ * `getClientIp` is imported from `./ip` directly, never through this
+ * directory's barrel or `@bakery-framework/core`: a core module that reaches for a
+ * barrel closes an import cycle, which is how 67 tests once failed with
+ * `ReferenceError: Cannot access 'Logger' before initialization`.
+ */
+
+import { getClientIp } from './ip'
+
+/**
+ * A host application's access predicate. Returning `true` admits; returning
+ * anything else, or throwing, denies (convention 2).
+ *
+ * The framework authenticates nobody. The application, which already knows who
+ * its users are, supplies this.
+ */
+export type AuthorizeFn = (req: Request) => boolean | Promise<boolean>
+
+/**
+ * Addresses only, never hostnames. Module-private: neither plugin copy
+ * exported it, and the membership test is the whole of the useful surface.
+ *
+ * `'localhost'` used to be a member, back when the request's *hostname* was
+ * compared against this set as well. A peer address is never the string
+ * `localhost`, and accepting it meant `X-Forwarded-For: localhost` counted as
+ * loopback under `trustProxy` — and, worse, that `new URL(req.url).hostname`
+ * did too. Bun builds that from the client's own `Host` header and
+ * `DEFAULT_HOST` is 0.0.0.0, so any peer on the LAN could send
+ * `Host: localhost` and be handed a database browser.
+ */
+const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1'])
+
+/** True when the request came from this machine. */
+export function isLoopback(req: Request): boolean {
+  // The peer address is the only evidence here the client does not choose.
+  //
+  // DECISION (divergence 3): a throw returns `false` immediately rather than
+  // falling through with `ip = ''`. `getClientIp` reads config and the live
+  // server, either of which may be absent (tests, early boot). The two spell
+  // the same answer today, because `LOOPBACK.has('')` is false — but only by
+  // coincidence, and the fall-through invites a later edit that adds a second
+  // source of evidence below this line and silently consults it on the
+  // indeterminate path. Returning here says the answer is settled: no address
+  // means no evidence, and per convention 2 an indeterminate answer is a
+  // denial, not a reason to ask something the requester controls.
+  try {
+    return LOOPBACK.has(getClientIp(req))
+  } catch {
+    return false
+  }
+}
+
+/**
+ * The default when an application configures no predicate: loopback in
+ * development, nobody in production. Forgetting to configure a plugin
+ * therefore cannot expose it to the internet.
+ */
+export function defaultAuthorize(req: Request): boolean {
+  // DECISION (divergence 2): gate on `PROD`, not `!DEV`, and read it at call
+  // time — the mode flags are accessors on `process.env` (`core/init.ts`), so
+  // they are process state and tests flip them.
+  //
+  // The two spellings look interchangeable because `init.ts` derives them as
+  // complements (`PROD = !isDev && !--dev-worker`). They are not, because they
+  // are *independently settable* accessors and the test fixtures set them one
+  // at a time: `asDev` flips `DEV` alone and leaves the ambient `PROD` — which
+  // under `bun test` is `true` — in place. In that state `!DEV` admits a
+  // loopback caller and `PROD` denies, so `PROD` is both the fail-closed
+  // reading and the one that literally names the condition it means, rather
+  // than inferring production from the absence of development.
+  //
+  // Hence a test for the *positive* development marker rather than a truthiness
+  // test on `PROD`, which is the one place a bare `PROD` gate would be weaker
+  // than `!DEV`. The flags do not exist until `core/init.ts` has run, and
+  // `if (undefined)` falls straight through to the loopback check — so an
+  // uninitialised process would open the door an initialised production one
+  // keeps shut. Unset is not evidence of development; it is no evidence at all.
+  //
+  // This read `PROD !== false` while the flags were real booleans. Bun 1.4
+  // rejects accessor descriptors on `process.env`, so they are `'1'`/`''`
+  // strings now (see `core/init.ts`) — and `!== false` is true for *every*
+  // string, including the `''` a development server sets, so the gate would
+  // have denied on loopback in development while still looking correct.
+  // `DEV === '1'` is the same statement in the encoding that survives: only a
+  // booted development server sets it, and production (`''`) and never-booted
+  // (`undefined`) both fail it.
+  //
+  // `isLoopback` would very likely deny on its own there, having no config or
+  // server to read an address from. That is a second line of defence, not this
+  // one's excuse: a guard should not depend on another guard's failure mode.
+  if (import.meta.env.DEV !== '1') return false
+  return isLoopback(req)
+}
+
+/** The configured predicate, or the fail-closed default. */
+export function resolveAuthorize(fn?: AuthorizeFn): AuthorizeFn {
+  return fn ?? defaultAuthorize
+}
+
+/**
+ * Run a predicate without letting a broken one grant access. Guard semantics
+ * per convention 2: the *authorizer* may throw or answer nonsense, and the
+ * answer to any indeterminate state is denial.
+ */
+export async function isAuthorized(
+  authorize: AuthorizeFn,
+  req: Request,
+): Promise<boolean> {
+  try {
+    // DECISION (divergence 1): `=== true`, never `Boolean(...)`. The predicate
+    // comes from application code and `AuthorizeFn`'s return type is only
+    // advice — an untyped, transpiled or `as any` predicate can hand back
+    // anything. `Boolean` admits every truthy non-boolean, so a check that
+    // answers with a status string denies on `""` and *grants* on `"no"`, and
+    // one that answers with a count grants on any non-zero. Admission is the
+    // expensive direction to get wrong; require the exact affirmative.
+    return (await authorize(req)) === true
+  } catch {
+    // A predicate that throws is indeterminate, and indeterminate is denied.
+    return false
+  }
+}

package/src/utils/http/body.ts

@@ -1,4 +1,5 @@
 import type { MapOf } from '../../types'
+import { parsedUrl } from './url'
 
 export async function processBody(req: Request): Promise<MapOf<any>> {
   const getParsedBody = async (): Promise<MapOf<any>> => {
@@ -18,8 +19,7 @@ export async function processBody(req: Request): Promise<MapOf<any>> {
 }
 
 function getBodyFromURI(req: Request): MapOf<any> {
-  const url = (req as any).__parsedUrl || new URL(req.url)
-  const searchParams = url.searchParams
+  const searchParams = parsedUrl(req).searchParams
   return Object.fromEntries(searchParams.entries())
 }
 

package/src/utils/http/credential.ts

@@ -0,0 +1,70 @@
+/**
+ * Shared-credential check for plugin surfaces (`plugin({ credential:
+ * import.meta.env.SOME_KEY })`).
+ *
+ * One implementation, deliberately in core: the db-explorer and analytics
+ * plugins each need it and per-plugin copies of security code drift. It owns
+ * *only* the comparison — no logins, no sessions, no backoff.
+ *
+ * A credential is presented three ways, in this order of preference:
+ *
+ *   - `x-<name>` header (scriptable, never logged by default)
+ *   - `Authorization: Bearer <credential>`
+ *   - `?<name>=<credential>` query, for a human opening a URL in a browser
+ *     who cannot set a header — the caller is expected to strip it from the
+ *     URL client-side; it *does* reach server logs, which is documented, and
+ *     the header forms exist for anything automated.
+ *
+ * An empty or missing configured credential **disables** this path rather
+ * than matching everything: `credential: import.meta.env.KEY` with the
+ * variable unset must mean "off", not "open".
+ *
+ * The compare is constant-time. A plain `===` on a secret is a timing oracle,
+ * and `timingSafeEqual` costs one line — but it throws on length mismatch, so
+ * the length is checked first (which leaks only the length, never the bytes).
+ */
+
+import { timingSafeEqual } from 'node:crypto'
+
+export function credentialMatches(
+  configured: string | undefined,
+  presented: string | null | undefined,
+): boolean {
+  if (!configured || !presented) return false
+
+  const a = Buffer.from(configured)
+  const b = Buffer.from(presented)
+  if (a.length !== b.length) return false
+  return timingSafeEqual(a, b)
+}
+
+/**
+ * Pull a presented credential off a request: the `x-<name>` header, a Bearer
+ * token, or the `<name>` query parameter, in that order. Returns `null` when
+ * none is present. `name` is the header/query key — `db-key`, `analytics-key`.
+ */
+export function readCredential(req: Request, name: string): string | null {
+  const header = req.headers.get(`x-${name}`)
+  if (header) return header
+
+  const bearer = req.headers
+    .get('authorization')
+    ?.replace(/^Bearer\s+/i, '')
+    .trim()
+  if (bearer) return bearer
+
+  return new URL(req.url).searchParams.get(name)
+}
+
+/**
+ * The whole check in one call: does the request present `configured` under
+ * `name`? `false` for an unset credential or an absent presentation.
+ */
+export function requestHasCredential(
+  req: Request,
+  configured: string | undefined,
+  name: string,
+): boolean {
+  if (!configured) return false
+  return credentialMatches(configured, readCredential(req, name))
+}

package/src/utils/http/dom.ts

@@ -1,3 +1,4 @@
+import { readdir } from 'node:fs/promises'
 import { LRUCache } from '../../cache/lru'
 import { Bakery, hostStore } from '../../core/bakery'
 import type { MapOf } from '../../types'
@@ -16,16 +17,6 @@ export function clearHeadBodyCache() {
 
 export { headBodyCache }
 
-type PackageJson = {
-  name: string
-  version: string
-  main?: string
-  module?: string
-  browser?: string | MapOf<string>
-  dependencies?: MapOf<string>
-  devDependencies?: MapOf<string>
-}
-
 let depMap = ''
 
 const hostDepMaps = new Map<string, string>()
@@ -34,22 +25,14 @@ const hostDepMaps = new Map<string, string>()
  * Normalise one import-map entry, for both the process-level map and the
  * per-host maps.
  *
- * There used to be two copies of this, and they had drifted into disagreeing
- * about *what* they tested: `initHostImportMaps` switched on the entry key,
- * `initImportMap` tested the entry value. `{ foo: './.server/client/utils' }`
- * was rewritten by one path and silently left alone by the other. One helper,
- * two callers, so they cannot disagree again.
+ * One helper, two callers, deliberately: they used to be separate copies that
+ * had drifted into testing different things — one switched on the entry key,
+ * the other on the entry value — so the same input normalised two ways
+ * depending on which path saw it.
  *
- * The `.server/client/utils` special cases both copies carried are gone rather
- * than reconciled. `.server/` is the pre-split layout: those two string
- * literals were the last references to it anywhere in `packages`, `apps`,
- * `docs` or `tests`, and the directory they name no longer exists, so a value
- * pointing at it is a broken path either way. It normalises as an ordinary
- * relative specifier now.
- *
- * `@client/utils` stays, and stays keyed on the *key*: it is a live alias — it
- * is the default `importMap` entry in `core/config.ts` — and the browser
- * runtime is served from a fixed URL, so the target is not the app's to choose.
+ * `@client/utils` is keyed on the *key*: it is a live alias, the default
+ * `importMap` entry in `core/config.ts`, and the browser runtime is served from
+ * a fixed URL, so the target is not the app's to choose.
  */
 function normalizeImportEntry(key: string, value: unknown): [string, string] {
   const cleanKey = key.replace(/\*$/, '')
@@ -85,53 +68,79 @@ export function initHostImportMaps() {
   }
 }
 
-function resolveDepModule(pkgData: PackageJson, baseMod: string): string {
-  if (is.string(pkgData.browser)) return pkgData.browser as string
+let installedCache: Promise<string[]> | null = null
 
-  if (is.object(pkgData.browser)) {
-    const cleanBase = baseMod.replace(/^\.\//, '')
-    const browserField = pkgData.browser as MapOf<string>
-    const lookupKeys = [baseMod, `./${cleanBase}`, cleanBase]
-    const matchedOverride = lookupKeys.find(key => browserField[key])
+/**
+ * Every installed package, top level and scoped, as `name` and `name/`.
+ *
+ * Read from `node_modules` rather than from `dependencies`, and the difference
+ * is the whole point: a package can be installed and imported without being
+ * declared — a transitive one, or a dependency someone forgot to add — and the
+ * browser's failure for a specifier the map misses names its own rule rather
+ * than the missing entry: *"Failed to resolve module specifier 'pkg'. Relative
+ * references must start with either "/", "./", or "../"."*
+ *
+ * Cheap — one `readdir` per scope, no `package.json` reads — and memoised per
+ * process besides: the import map reads it at boot, `bundleModule` on every
+ * bundle (as its `external` list), and a `readdir` sweep per bundle is pure
+ * waste. A dev restart is a new process, so an install still shows up.
+ */
+export function installedPackages(): Promise<string[]> {
+  installedCache ??= readInstalledPackages()
+  return installedCache
+}
+
+async function readInstalledPackages(): Promise<string[]> {
+  const root = fs.resolve(fs.cwd, 'node_modules')
+  const [err, entries] = await Try.catch(() => readdir(root))
+  if (err || !entries) return []
+
+  const names: string[] = []
+  for (const entry of entries) {
+    // `.bin`, `.cache` and friends are not packages.
+    if (entry.startsWith('.')) continue
 
-    return matchedOverride ? browserField[matchedOverride] : baseMod
+    if (!entry.startsWith('@')) {
+      names.push(entry)
+      continue
+    }
+
+    const [scopeErr, scoped] = await Try.catch(() =>
+      readdir(`${root}/${entry}`),
+    )
+    if (scopeErr || !scoped) continue
+    for (const name of scoped) {
+      if (!name.startsWith('.')) names.push(`${entry}/${name}`)
+    }
   }
 
-  return baseMod
+  return names
 }
 
+/**
+ * Build the browser import map.
+ *
+ * **Resolution happens at the other end of the URL, and rewriting happens
+ * nowhere.** An entry maps a package to `/_nm/<name>`; `NMHandler` hands that to
+ * `Bun.build`, which applies real browser resolution — `exports` maps,
+ * conditions, the `browser` field. Naming an entry file here instead would mean
+ * reimplementing all of that, badly.
+ *
+ * Covering every installed package is what removes the need for a compile-time
+ * rewrite of bare specifiers, and the map reaches code the compiler never sees:
+ * an inline `<script type="module">` in an `.html` page arrives at the browser
+ * with its imports intact.
+ *
+ * App-declared `importMap` entries are applied last and win. One of them,
+ * `@client/utils`, does not point into `node_modules` at all.
+ */
 export async function initImportMap() {
-  const pkgContent = await Try(() =>
-    Bun.file(fs.resolve(fs.cwd, 'package.json')).json(),
-  )
-  const pkg: any = pkgContent || {}
   const map = Bakery.config.importMap || {}
-  const deps = pkg.dependencies || {}
-
   const resolvedMap: MapOf<string> = {}
 
-  const imports = await Promise.all(
-    Object.keys(deps).map(async dep => {
-      const pkgData = await Try(
-        Bun.file(`./node_modules/${dep}/package.json`).json(),
-      )
-
-      return { dep, pkgData: pkgData as PackageJson | null }
-    }),
-  )
-
-  for (const { dep, pkgData } of imports) {
-    if (!pkgData) continue
-
-    const actualName = pkgData.name || dep
-    resolvedMap[`${actualName}/`] = `/_nm/${actualName}/`
-
-    const baseMod = pkgData.module || pkgData.main || 'index.js'
-    const mod = resolveDepModule(pkgData, baseMod)
-
-    const finalMod = typeof mod === 'string' ? mod : 'index.js'
-    resolvedMap[actualName] =
-      `/_nm/${actualName}/${finalMod.replace(/^\.\//, '')}`
+  for (const name of await installedPackages()) {
+    resolvedMap[`${name}/`] = `/_nm/${name}/`
+    resolvedMap[name] = `/_nm/${name}`
   }
 
   for (const [k, v] of Object.entries(map)) {
@@ -149,8 +158,8 @@ export namespace DOMTools {
     return `<script type="importmap">${map}</script>`
   }
 
-  export function params(params: MapOf<string>) {
-    const newParams: MapOf<string> = {}
+  export function params(params: MapOf<unknown>) {
+    const newParams: MapOf<unknown> = {}
 
     for (const [k, v] of Object.entries(params)) {
       if (k.startsWith('$$')) continue

package/src/utils/http/etag.ts

@@ -231,6 +231,33 @@ export namespace ETag {
       if (conditionalRes) return conditionalRes
     }
 
+    // Range handling itself lives in Bun.serve, not here: any Response whose
+    // body is a *path-backed* BunFile is sliced by the runtime — 206 with
+    // Content-Range on a satisfiable single range, 416 past EOF — including
+    // the negotiated compressed variants above (the range then addresses the
+    // encoded bytes, which is what RFC 9110 says a range means). What the
+    // runtime does not do is advertise: a plain 200 or a HEAD said nothing,
+    // so players that probe HEAD for `Accept-Ranges` before attempting seeks
+    // never tried. Advertised here because this is the one funnel every
+    // file-serving handler's BunFile passes through, and only here — an
+    // in-memory Blob or a `sendText` string body ignores Range entirely
+    // (served whole, 200), which is why `.name` gates the claim.
+    //
+    // Skipped when Bun's own range path is about to answer (a GET carrying
+    // `Range`): that path appends its own `Accept-Ranges: bytes` to the
+    // 206/416, and setting it here too emitted `bytes, bytes`. The trade,
+    // measured on Bun 1.4.0: a GET whose Range is malformed or multipart is
+    // served whole with no advertisement from either side — acceptable,
+    // since a client that already sent `Range` is not the one this probe
+    // header exists for. HEAD ignores `Range` and gets the header even when
+    // one is present.
+    if (
+      resolvedFile.name &&
+      !(req && req.method === 'GET' && req.headers.has('range'))
+    ) {
+      headers['Accept-Ranges'] = 'bytes'
+    }
+
     return new Response(resolvedFile, { headers })
   }