@bgord/bun 1.23.8 → 1.23.10

package/src/environment-loader-with-memo.adapter.ts

@@ -0,0 +1,21 @@
+import type { EnvironmentLoaderPort, EnvironmentResultType } from "./environment-loader.port";
+
+type Config<T extends object> = { inner: EnvironmentLoaderPort<T> };
+
+export class EnvironmentLoaderWithMemoAdapter<T extends object> implements EnvironmentLoaderPort<T> {
+  private memoized: Promise<Readonly<EnvironmentResultType<T>>> | null = null;
+
+  constructor(private readonly config: Config<T>) {}
+
+  async load(): Promise<Readonly<EnvironmentResultType<T>>> {
+    if (this.memoized === null) {
+      this.memoized = this.config.inner.load().catch((error) => {
+        this.memoized = null;
+
+        throw error;
+      });
+    }
+
+    return this.memoized;
+  }
+}

package/src/event-store-dispatching.adapter.ts

@@ -32,7 +32,8 @@ export class EventStoreDispatchingAdapter<Event extends GenericEvent> implements
   ): Promise<ReadonlyArray<SavedEvent>> {
     const saved = await this.deps.inner.save(events);
 
-    for (const event of saved) this.deps.EventBus.emit(event);
+    // Fire-and-forget: events are already persisted, handler errors are logged by the handler strategy.
+    for (const event of saved) this.deps.EventBus.emit(event).catch(() => {});
 
     return saved;
   }

package/src/hash-bytes-noop.strategy.ts

@@ -0,0 +1,8 @@
+import { Hash } from "./hash.vo";
+import type { HashBytesStrategy } from "./hash-bytes.strategy";
+
+export class HashBytesNoopStrategy implements HashBytesStrategy {
+  async hash(_content: ArrayBuffer): Promise<Hash> {
+    return Hash.fromString("0".repeat(64));
+  }
+}

package/src/hash-bytes-sha256.strategy.ts

@@ -0,0 +1,10 @@
+import { Hash } from "./hash.vo";
+import type { HashBytesStrategy } from "./hash-bytes.strategy";
+
+export class HashBytesSha256Strategy implements HashBytesStrategy {
+  async hash(content: ArrayBuffer): Promise<Hash> {
+    const digest = await crypto.subtle.digest("SHA-256", content);
+
+    return Hash.fromBuffer(new Uint8Array(digest));
+  }
+}

package/src/hash-bytes.strategy.ts

@@ -0,0 +1,5 @@
+import type { Hash } from "./hash.vo";
+
+export interface HashBytesStrategy {
+  hash(content: ArrayBuffer): Promise<Hash>;
+}

package/src/hash-file-sha256.adapter.ts

@@ -1,12 +1,12 @@
 import * as tools from "@bgord/tools";
 import type { FileInspectionPort } from "./file-inspection.port";
-import type { FileReaderTextPort } from "./file-reader-text.port";
-import type { HashContentStrategy } from "./hash-content.strategy";
+import type { FileReaderRawPort } from "./file-reader-raw.port";
+import type { HashBytesStrategy } from "./hash-bytes.strategy";
 import type { HashFilePort, HashFileResult } from "./hash-file.port";
 
 type Dependencies = {
-  HashContent: HashContentStrategy;
-  FileReaderText: FileReaderTextPort;
+  HashBytes: HashBytesStrategy;
+  FileReaderRaw: FileReaderRawPort;
   FileInspection: FileInspectionPort;
   MimeRegistry: tools.MimeRegistry;
 };
@@ -22,8 +22,8 @@ export class HashFileSha256Adapter implements HashFilePort {
 
     const size = await this.deps.FileInspection.size(path);
     const lastModified = await this.deps.FileInspection.lastModified(path);
-    const text = await this.deps.FileReaderText.read(path);
+    const bytes = await this.deps.FileReaderRaw.read(path);
 
-    return { etag: await this.deps.HashContent.hash(text), size, lastModified, mime };
+    return { etag: await this.deps.HashBytes.hash(bytes), size, lastModified, mime };
   }
 }

package/src/idempotency-store-cache.adapter.ts

@@ -7,6 +7,7 @@ type Dependencies = { CacheRepository: CacheRepositoryPort };
 export class IdempotencyStoreCacheAdapter implements IdempotencyStorePort {
   constructor(private readonly deps: Dependencies) {}
 
+  // Non-atomic get-then-set: concurrent claims of the same subject can both succeed
   async claim(subject: Hash): Promise<boolean> {
     const processed = await this.deps.CacheRepository.get(subject);
 

package/src/index.ts

@@ -49,6 +49,10 @@ export * from "./build-info.vo";
 export * from "./cache-codec.strategy";
 export * from "./cache-codec-identity.strategy";
 export * from "./cache-codec-sitemap-entries.strategy";
+export * from "./cache-control.strategy";
+export * from "./cache-control-immutable.strategy";
+export * from "./cache-control-must-revalidate.strategy";
+export * from "./cache-control-noop.strategy";
 export * from "./cache-file.service";
 export * from "./cache-repository.port";
 export * from "./cache-repository-node-cache.adapter";
@@ -115,6 +119,7 @@ export * from "./environment-loader-encrypted.adapter";
 export * from "./environment-loader-noop.adapter";
 export * from "./environment-loader-process.adapter";
 export * from "./environment-loader-process-safe.adapter";
+export * from "./environment-loader-with-memo.adapter";
 export * from "./error.handler";
 export * from "./error-classifier.strategy";
 export * from "./error-classifier-http-exception-hono.strategy";
@@ -208,6 +213,9 @@ export * from "./handler-with-logger.strategy";
 export * from "./handler-with-logger-safe.strategy";
 export * from "./hash.vo";
 export * from "./hash-bucket.vo";
+export * from "./hash-bytes.strategy";
+export * from "./hash-bytes-noop.strategy";
+export * from "./hash-bytes-sha256.strategy";
 export * from "./hash-content.strategy";
 export * from "./hash-content-noop.strategy";
 export * from "./hash-content-sha256.strategy";

package/src/job-queue.adapter.ts

@@ -34,10 +34,18 @@ export class JobQueueAdapter<Job extends GenericJob> implements JobQueuePort<Job
 
   async claim(limit: tools.IntegerPositiveType): Promise<ReadonlyArray<Job>> {
     const jobs = await this.config.claimer.claim(this.config.registry.names, limit);
+    const valid: Array<Job> = [];
 
-    return jobs
-      .map((job) => ({ ...job, payload: this.config.serializer.deserialize(job.payload) }))
-      .map((job) => this.config.registry.validate(job));
+    for (const job of jobs) {
+      try {
+        valid.push(
+          this.config.registry.validate({ ...job, payload: this.config.serializer.deserialize(job.payload) }),
+        );
+      } catch {
+        await this.config.failer.fail(job.id);
+      }
+    }
+    return valid;
   }
 
   async complete(id: GenericJob["id"]): Promise<void> {

package/src/markdown-generator.adapter.ts

@@ -2,7 +2,16 @@
 import type { MarkdownGeneratorPort } from "./markdown-generator.port";
 
 export class MarkdownGeneratorAdapter implements MarkdownGeneratorPort {
+  private static readonly ALLOWED_SCHEMES = ["http", "https", "mailto"];
+
   generate(template: string): string {
-    return Bun.markdown.html(template, { tagFilter: true, noHtmlBlocks: true, noHtmlSpans: true });
+    const html = Bun.markdown.html(template, { tagFilter: true, noHtmlBlocks: true, noHtmlSpans: true });
+
+    return html.replace(/ href="([^"]*)"/g, (attribute, url: string) => {
+      const scheme = /^([a-z][a-z0-9+.-]*):/i.exec(url)?.[1]?.toLowerCase();
+
+      if (scheme === undefined || MarkdownGeneratorAdapter.ALLOWED_SCHEMES.includes(scheme)) return attribute;
+      return ' href="#"';
+    });
   }
 }

package/src/redactor-key.vo.ts

@@ -0,0 +1,15 @@
+export class RedactorKey {
+  private constructor(private readonly value: string) {}
+
+  static fromString(candidate: string): RedactorKey {
+    return new RedactorKey(candidate.toLowerCase().replace(/[_-]/g, ""));
+  }
+
+  get(): string {
+    return this.value;
+  }
+
+  matches(another: RedactorKey): boolean {
+    return this.value === another.value;
+  }
+}

package/src/redactor-mask.strategy.ts

@@ -1,22 +1,27 @@
 /* cspell:disable */
 import * as tools from "@bgord/tools";
 import type { RedactorStrategy } from "./redactor.strategy";
+import { RedactorKey } from "./redactor-key.vo";
 
 export class RedactorMask implements RedactorStrategy {
   static readonly DEFAULT_KEYS: ReadonlyArray<string> = [
     "authorization",
+    "proxy-authorization",
     "cookie",
     "set-cookie",
     "x-api-key",
+    "x-auth-token",
     "apikey",
     "token",
     "accesstoken",
     "refreshtoken",
+    "idtoken",
     "password",
     "currentpassword",
     "newpassword",
     "passwordconfirmation",
     "clientsecret",
+    "privatekey",
     "secret",
     "otp",
     "code",
@@ -25,12 +30,14 @@ export class RedactorMask implements RedactorStrategy {
   private readonly keys: Set<string>;
 
   constructor(keys?: ReadonlyArray<string>) {
-    this.keys = new Set((keys?.length ? keys : RedactorMask.DEFAULT_KEYS).map((key) => key.toLowerCase()));
+    this.keys = new Set(
+      (keys?.length ? keys : RedactorMask.DEFAULT_KEYS).map((key) => RedactorKey.fromString(key).get()),
+    );
   }
 
   redact<T>(input: T): T {
     return tools.deepCloneWith(input, (_value, key) =>
-      typeof key === "string" && this.keys.has(key.toLowerCase()) ? "***" : undefined,
+      typeof key === "string" && this.keys.has(RedactorKey.fromString(key).get()) ? "***" : undefined,
     );
   }
 }

package/src/redactor-url-query.strategy.ts

@@ -1,12 +1,15 @@
 import * as tools from "@bgord/tools";
 import type { RedactorStrategy } from "./redactor.strategy";
+import { RedactorKey } from "./redactor-key.vo";
 import { RedactorMask } from "./redactor-mask.strategy";
 
 export class RedactorUrlQuery implements RedactorStrategy {
   private readonly keys: Set<string>;
 
   constructor(keys?: ReadonlyArray<string>) {
-    this.keys = new Set((keys?.length ? keys : RedactorMask.DEFAULT_KEYS).map((key) => key.toLowerCase()));
+    this.keys = new Set(
+      (keys?.length ? keys : RedactorMask.DEFAULT_KEYS).map((key) => RedactorKey.fromString(key).get()),
+    );
   }
 
   redact<T>(input: T): T {
@@ -24,7 +27,7 @@ export class RedactorUrlQuery implements RedactorStrategy {
     const masked = new URLSearchParams(
       Array.from(new URLSearchParams(query), ([key, value]) => [
         key,
-        this.keys.has(key.toLowerCase()) ? "***" : value,
+        this.keys.has(RedactorKey.fromString(key).get()) ? "***" : value,
       ]),
     );
 

package/src/shield-body-limit.strategy.ts

@@ -12,6 +12,7 @@ export class ShieldBodyLimitStrategy {
   evaluate(context: HasRequestHeader): boolean {
     const header = context.request.header("content-length");
 
+    // Header-only check: bodies without Content-Length (chunked/streamed) are bounded by Bun.serve's maxRequestBodySize instead.
     if (header === undefined) return true;
 
     const contentLength = v.safeParse(tools.SizeBytes, Number(header));

package/src/static-files-hono.service.ts

@@ -1,22 +1,14 @@
 // [BUN DEPENDENCY]
 // cspell:ignore nosniff
-import type * as tools from "@bgord/tools";
-import { type Context, Hono } from "hono";
+import { Hono } from "hono";
 import { serveStatic } from "hono/bun";
 import { etag } from "hono/etag";
 import { secureHeaders } from "hono/secure-headers";
+import type { CacheControlStrategy } from "./cache-control.strategy";
+import { RequestContextHonoAdapter } from "./request-context-hono.adapter";
 
 const noop = async () => {};
 
-type StaticFilesStrategy = (path: string, context: Context) => Promise<void> | void;
-
-export const StaticFileStrategyNoop: StaticFilesStrategy = () => {};
-
-export const StaticFileStrategyMustRevalidate: (duration: tools.Duration) => StaticFilesStrategy =
-  (duration) => (_, c) => {
-    c.header("Cache-Control", `public, max-age=${duration.seconds}, must-revalidate`);
-  };
-
 const staticAssetHeaders = secureHeaders({
   crossOriginResourcePolicy: "same-origin",
   crossOriginOpenerPolicy: "same-origin",
@@ -61,7 +53,7 @@ const staticDocumentHeaders = secureHeaders({
 type StaticFilesOptions = { root?: string };
 
 export class StaticFilesHono {
-  static handle(path: string, strategy: StaticFilesStrategy, options?: StaticFilesOptions) {
+  static handle(path: string, strategy: CacheControlStrategy, options?: StaticFilesOptions) {
     // Stryker disable all
     const root = options?.root ?? "./";
     // Stryker restore all
@@ -78,7 +70,15 @@ export class StaticFilesHono {
           else await staticAssetHeaders(context, noop);
         },
         etag(),
-        serveStatic({ root, precompressed: true, onFound: strategy }),
+        serveStatic({
+          root,
+          precompressed: true,
+          onFound: (_, context) => {
+            const value = strategy.resolve(new RequestContextHonoAdapter(context));
+
+            if (value) context.header("Cache-Control", value);
+          },
+        }),
       ).fetch,
     };
   }

package/src/trailing-slash.middleware.ts

@@ -1,22 +1,20 @@
-import type { HasRequestPath } from "./request-context.port";
+import type { HasRequestUrl } from "./request-context.port";
 
 export type TrailingSlashResult = { redirect: false } | { redirect: true; pathname: string; status: 308 };
 
-const TRAILING_SLASHES = /\/+$/;
-const LEADING_SLASHES = /^\/+/;
+const EDGE_SLASHES = /^\/+|\/+$/g;
 
 export class TrailingSlashMiddleware {
   // RFC 7231 6.4.7 - 308 preserves the request method and body, unlike 301.
   static readonly STATUS = 308;
 
-  evaluate(context: HasRequestPath): TrailingSlashResult {
-    if (!context.request.path.endsWith("/")) return { redirect: false };
-    if (context.request.path === "/") return { redirect: false };
+  evaluate(context: HasRequestUrl): TrailingSlashResult {
+    const path = new URL(context.request.url()).pathname;
 
-    const pathname = (context.request.path.replace(TRAILING_SLASHES, "") || "/").replace(
-      LEADING_SLASHES,
-      "/",
-    );
+    if (!path.endsWith("/")) return { redirect: false };
+    if (path === "/") return { redirect: false };
+
+    const pathname = `/${path.replace(EDGE_SLASHES, "")}`;
 
     return { redirect: true, pathname, status: TrailingSlashMiddleware.STATUS };
   }