@c9up/ream 0.2.0 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/ream",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Ream — Rust-powered Node.js application framework",
   "license": "MIT",
   "type": "module",
@@ -11,6 +11,14 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
+    "./types": {
+      "types": "./dist/types/container.d.ts",
+      "import": "./dist/types/container.js"
+    },
+    "./exceptions": {
+      "types": "./dist/http/Exception.d.ts",
+      "import": "./dist/http/Exception.js"
+    },
     "./console": {
       "types": "./dist/console/index.d.ts",
       "import": "./dist/console/index.js"
@@ -43,10 +51,42 @@
       "types": "./dist/session/SessionMiddleware.d.ts",
       "import": "./dist/session/SessionMiddleware.js"
     },
+    "./helpers": {
+      "types": "./dist/helpers/index.d.ts",
+      "import": "./dist/helpers/index.js"
+    },
+    "./helpers/string": {
+      "types": "./dist/helpers/string.d.ts",
+      "import": "./dist/helpers/string.js"
+    },
+    "./helpers/is": {
+      "types": "./dist/helpers/is.d.ts",
+      "import": "./dist/helpers/is.js"
+    },
+    "./helpers/base64": {
+      "types": "./dist/helpers/base64.d.ts",
+      "import": "./dist/helpers/base64.js"
+    },
+    "./helpers/types": {
+      "types": "./dist/helpers/types.d.ts",
+      "import": "./dist/helpers/types.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/TestClient.d.ts",
+      "import": "./dist/testing/TestClient.js"
+    },
+    "./bootstrap": {
+      "types": "./dist/bootstrap/hyper-server.d.ts",
+      "import": "./dist/bootstrap/hyper-server.js"
+    },
     "./events": {
       "types": "./dist/events/index.d.ts",
       "import": "./dist/events/index.js"
     },
+    "./health": {
+      "types": "./dist/health/index.d.ts",
+      "import": "./dist/health/index.js"
+    },
     "./events/provider": {
       "types": "./dist/events/EventsProvider.d.ts",
       "import": "./dist/events/EventsProvider.js"
@@ -95,36 +135,18 @@
       "types": "./dist/events/configure.d.ts",
       "import": "./dist/events/configure.js"
     },
-    "./helpers": {
-      "types": "./dist/helpers/index.d.ts",
-      "import": "./dist/helpers/index.js"
-    },
-    "./helpers/string": {
-      "types": "./dist/helpers/string.d.ts",
-      "import": "./dist/helpers/string.js"
-    },
-    "./helpers/is": {
-      "types": "./dist/helpers/is.d.ts",
-      "import": "./dist/helpers/is.js"
-    },
-    "./helpers/base64": {
-      "types": "./dist/helpers/base64.d.ts",
-      "import": "./dist/helpers/base64.js"
-    },
-    "./helpers/types": {
-      "types": "./dist/helpers/types.d.ts",
-      "import": "./dist/helpers/types.js"
-    },
-    "./testing": {
-      "types": "./dist/testing/TestClient.d.ts",
-      "import": "./dist/testing/TestClient.js"
-    },
-    "./bootstrap": {
-      "types": "./dist/bootstrap/hyper-server.d.ts",
-      "import": "./dist/bootstrap/hyper-server.js"
-    },
     "./tsconfig.app.json": "./tsconfig.app.json",
-    "./swcrc.app.json": "./swcrc.app.json"
+    "./swcrc.app.json": "./swcrc.app.json",
+    "./tsconfig.package.json": "./tsconfig.package.json",
+    "./tsconfig.client.json": "./tsconfig.client.json",
+    "./session_middleware": {
+      "types": "./dist/session/SessionMiddleware.d.ts",
+      "import": "./dist/session/SessionMiddleware.js"
+    },
+    "./bodyparser_middleware": {
+      "types": "./dist/bodyparser/BodyParserMiddleware.d.ts",
+      "import": "./dist/bodyparser/BodyParserMiddleware.js"
+    }
   },
   "files": [
     "LICENSE",

package/src/Ignitor.ts

@@ -142,14 +142,6 @@ export interface TestsConfig {
    * `tests/bootstrap.ts`; that stays the default here, and this overrides it.
    */
   bootstrap?: string
-  /**
-   * Point `@japa/runner/core` at helix's shim in every worker, so official Japa
-   * plugins (`@japa/assert`, …) instrument the runner that is actually running.
-   *
-   * Off by default: redirecting a package specifier is not something to do
-   * behind a user's back, and a project with no Japa plugin gains nothing.
-   */
-  japaPlugins?: boolean
 }
 
 /** defineConfig helper — like AdonisJS defineConfig(). */
@@ -269,6 +261,9 @@ export class Ignitor {
     // registry" and say something useful in each case.
     this.app.container.singleton('migrations', () => this.migrations)
     this.app.container.singleton('app', () => this.app)
+    // AdonisJS binds the config store too, so code that only needs settings can
+    // resolve `config` instead of taking the whole application.
+    this.app.container.singleton('config', () => this.app.config)
     // The HttpContext CLASS, so an integration provider can extend it the way
     // AdonisJS does — `HttpContext.getter('view', …)` is how the view layer
     // attaches `ctx.view`. Exported from the barrel too, but a provider that
@@ -733,7 +728,18 @@ export class Ignitor {
     for (const file of files) {
       const key = basename(file).replace(/\.(ts|js)$/, '')
       const mod = await import(pathToFileURL(join(configDir, file)).href)
-      this.app.config.set(key, mod.default ?? mod)
+      // A config file that declares `export default` owns the value it exports,
+      // even when that value is `undefined` — that is how a module says "I am
+      // not configured", and a provider's `if (!config) return` guard has to be
+      // able to see it. Testing the binding rather than the value is what keeps
+      // that readable; `mod.default ?? mod` turns the absent value back into the
+      // truthy namespace and makes the guard unreachable.
+      //
+      // Without a `default` binding, the named exports become the config, which
+      // is what AdonisJS does (`fsImportAll`). Spread rather than stored as-is:
+      // an ESM namespace is sealed and null-prototype, so a later merge into
+      // this entry would fail on it.
+      this.app.config.set(key, 'default' in mod ? mod.default : { ...mod })
     }
   }
 

package/src/bodyparser/MultipartFile.ts

@@ -19,22 +19,49 @@ export class MultipartFile {
   readonly clientName: string
 
   /**
-   * The PRIMARY mime type from the Content-Type header — `image` for
-   * `image/png`. Pair it with {@link subtype}, as AdonisJS does.
+   * The PRIMARY mime type — `image` for `image/png`. Pair it with
+   * {@link subtype}, as AdonisJS does.
    *
-   * BREAKING as of this version: it used to hold the whole `image/png`. The
-   * change aligns the field with upstream, and TypeScript cannot catch a
-   * comparison against a full mime string — `file.type === 'image/png'` now
-   * simply never matches. Use `file.subtype` or {@link detectedType}.
+   * DERIVED FROM THE MAGIC BYTES when they can be read, and only from the
+   * Content-Type header when they cannot — upstream's precedence, and the one
+   * that matters: the header is written by the client, so a `.exe` announced as
+   * `image/png` would otherwise sail through a mime allowlist. A renamed file
+   * reports what it actually is.
    *
-   * ATTACKER-CONTROLLED — never trust it for security decisions or as a
-   * response Content-Type. Prefer {@link detectedType}, which is fingerprinted
-   * from the file's magic bytes.
+   * BREAKING as of 0.2.0: it used to hold the whole `image/png`. TypeScript
+   * cannot catch a comparison against a full mime string — `file.type ===
+   * 'image/png'` still compiles and simply never matches. Use {@link mime}.
    */
-  readonly type?: string
+  get type(): string | undefined {
+    return this.#mimeParts()[0]
+  }
+
+  /** The mime SUBTYPE — `png` for `image/png`. Same source as {@link type}. */
+  get subtype(): string | undefined {
+    return this.#mimeParts()[1]
+  }
+
+  /**
+   * The full mime to validate against — `image/png`.
+   *
+   * What an allowlist wants, and the reason this exists: splitting the mime for
+   * upstream parity left every caller re-joining it by hand, and a caller that
+   * forgot got a filter that silently matched nothing. Same trustworthy source
+   * as {@link type}.
+   */
+  get mime(): string | undefined {
+    const [type, subtype] = this.#mimeParts()
+    if (!type) return undefined
+    return subtype ? `${type}/${subtype}` : type
+  }
 
-  /** The mime SUBTYPE — `png` for `image/png`. Attacker-controlled, like {@link type}. */
-  readonly subtype?: string
+  /** Split the trustworthy mime once, detected bytes first, header second. */
+  #mimeParts(): [string | undefined, string | undefined] {
+    const source = this.#detected?.mime ?? this.#headerMime
+    if (!source) return [undefined, undefined]
+    const [type, subtype] = source.split(';')[0].trim().split('/')
+    return [type || undefined, subtype || undefined]
+  }
 
   /**
    * The part's headers.
@@ -78,6 +105,9 @@ export class MultipartFile {
   /** Rules set through `sizeLimit` / `allowedExtensions`, used by a bare `validate()`. */
   #validationOptions: FileValidationOptions = {}
 
+  /** The Content-Type the client sent — attacker-controlled, the fallback only. */
+  readonly #headerMime: string
+
   /** Magic-byte fingerprint — set by {@link detectType}; absent for content `file-type` can't detect (text: txt/csv/svg/json). */
   #detected?: { ext: string; mime: string }
 
@@ -90,9 +120,7 @@ export class MultipartFile {
     this.fieldName = options.fieldName
     this.clientName = options.clientName
     this.headers = { 'content-type': options.type }
-    const [type, subtype] = options.type.split(';')[0].trim().split('/')
-    this.type = type || undefined
-    this.subtype = subtype || undefined
+    this.#headerMime = options.type
     this.content = options.content
     this.size = options.content.length
     const segments = options.clientName.split('.')

package/src/errors/aggregate.ts

@@ -0,0 +1,33 @@
+/**
+ * The framework's exceptions, in one bag.
+ *
+ * AdonisJS exposes `import { errors } from '@adonisjs/core'` (and one bag per
+ * module) so an app can branch on `error instanceof errors.E_ROUTE_NOT_FOUND`
+ * without importing each class by name. The flat named exports stay — this is
+ * the shape a migrating app already writes.
+ */
+
+import { EnvValidationException } from '../env/Env.js'
+import {
+  E_FORBIDDEN,
+  E_HTTP_EXCEPTION,
+  E_HTTP_REQUEST_ABORTED,
+  E_ROUTE_NOT_FOUND,
+  E_ROW_NOT_FOUND,
+  E_UNAUTHORIZED,
+  E_VALIDATION_ERROR,
+} from '../http/Exception.js'
+import { E_INSECURE_APP_KEY, E_MISSING_APP_KEY } from '../security/CookieSigner.js'
+
+export const errors = {
+  E_FORBIDDEN,
+  E_HTTP_EXCEPTION,
+  E_HTTP_REQUEST_ABORTED,
+  E_INSECURE_APP_KEY,
+  E_INVALID_ENV_VARIABLES: EnvValidationException,
+  E_MISSING_APP_KEY,
+  E_ROUTE_NOT_FOUND,
+  E_ROW_NOT_FOUND,
+  E_UNAUTHORIZED,
+  E_VALIDATION_ERROR,
+} as const

package/src/events/services/main.ts

@@ -9,6 +9,7 @@
  * Populated by `EventsProvider.boot()`.
  */
 
+import { createServiceProxy } from '../../services/createServiceProxy.js'
 import type { Emitter } from '../Emitter.js'
 
 let instance: Emitter | undefined
@@ -23,17 +24,10 @@ export function getEmitter(): Emitter | undefined {
   return instance
 }
 
-const emitter: Emitter = new Proxy({} as Emitter, {
-  get(_target, prop) {
-    if (!instance) {
-      throw new Error(
-        '[ream:events] Emitter singleton accessed before EventsProvider.boot() ran. ' +
-          'Check that `@c9up/ream/events/provider` is listed in your reamrc.ts providers.',
-      )
-    }
-    const value = Reflect.get(instance, prop, instance)
-    return typeof value === 'function' ? value.bind(instance) : value
-  },
-})
+const emitter: Emitter = createServiceProxy<Emitter>(
+  () => instance,
+  '[ream:events] Emitter singleton accessed before EventsProvider.boot() ran. ' +
+    'Check that `@c9up/ream/events/provider` is listed in your reamrc.ts providers.',
+)
 
 export default emitter