@c9up/ream 0.2.14 → 0.2.15

package/src/bodyparser/parseSize.ts

@@ -6,8 +6,9 @@
 export function parseSize(size: string): number {
   const match = size.match(/^(\d+)(kb|mb|gb)?$/i)
   if (!match) return 1024 * 1024 // default 1mb
-  const num = parseInt(match[1], 10)
-  switch (match[2]?.toLowerCase()) {
+  const [, digits, unit] = match
+  const num = parseInt(digits ?? '0', 10)
+  switch (unit?.toLowerCase()) {
     case 'kb':
       return num * 1024
     case 'mb':

package/src/commands/MigrateBase.ts

@@ -19,7 +19,10 @@ import type { MigrationRegistry } from '../migrations/MigrationRegistry.js'
 import type { RegisteredMigrationSource } from '../migrations/types.js'
 
 export abstract class MigrateBase extends BaseCommand {
-  static override options: CommandOptions = { startApp: true }
+  // `drivesMigrations` because these three ARE the migration run: without it the
+  // boot applies everything first, so `migrate` says "nothing to migrate" after
+  // the work is done, and `migrate:status` mutates the schema it reports on.
+  static override options: CommandOptions = { startApp: true, drivesMigrations: true }
 
   @flags.string({
     description: 'Only this migration source, by the name its package registered',

package/src/console/BaseCommand.ts

@@ -117,7 +117,7 @@ export abstract class BaseCommand {
   error?: unknown
 
   /** Assigned by the kernel — see {@link terminate}. */
-  protected declare onTerminate?: () => void | Promise<void>
+  declare protected onTerminate?: () => void | Promise<void>
 
   /**
    * Lifecycle hooks, run in this order around `run()`: `prepare`, `interact`,

package/src/console/Kernel.ts

@@ -999,6 +999,14 @@ export class Kernel {
       )
     }
 
+    // Before the boot, not after: a data package that migrates on boot for the
+    // convenience of `dev` would otherwise apply everything a moment before the
+    // command that exists to apply it runs — leaving `migrate` with nothing to
+    // report and `migrate:status` having changed what it was asked to look at.
+    if (Command.options?.drivesMigrations === true) {
+      process.env.REAM_SKIP_BOOT_MIGRATE = '1'
+    }
+
     return this.#startApp()
   }
 

package/src/console/types.ts

@@ -37,6 +37,21 @@ export interface CommandOptions {
    * default so a typo (`--warm` for `--warn`) is reported, not swallowed.
    */
   allowUnknownFlags?: boolean
+
+  /**
+   * This command drives migrations itself, so booting must not run them.
+   *
+   * A data package may migrate on boot for the convenience of `dev` — atlas
+   * does, outside production. For the commands that exist to migrate, that
+   * convenience is the bug: the boot applies everything, and then `migrate`
+   * reports "nothing to migrate" while `migrate:status`, asked only to look,
+   * has changed the schema it is reporting on.
+   *
+   * Declaring this sets `REAM_SKIP_BOOT_MIGRATE=1` before the application
+   * starts, which is the flag a data package watches for. Any package's own
+   * migration command opts in the same way; the framework names none of them.
+   */
+  drivesMigrations?: boolean
 }
 
 /** Metadata recorded by an `@args.*` decorator. */

package/src/container/Container.ts

@@ -63,7 +63,7 @@ interface ResolutionChain {
    * down. Saved and restored around each construction, so a dependency's own
    * dependencies see IT as their parent, not its parent.
    */
-  parent?: new (
+  parent?: abstract new (
     ...args: never[]
   ) => unknown
 }
@@ -91,8 +91,12 @@ export class Container {
   /** Alias key → the token it forwards to (AdonisJS `container.alias`). */
   #aliases: Map<ServiceToken, ServiceToken> = new Map()
   /** parent class → (binding key → the factory that class gets instead). */
-  #contextualBindings: Map<new (...args: never[]) => unknown, Map<ServiceToken, ServiceFactory>> =
-    new Map()
+  #contextualBindings: Map<
+    abstract new (
+      ...args: never[]
+    ) => unknown,
+    Map<ServiceToken, ServiceFactory>
+  > = new Map()
   /** token key → post-resolution callbacks (AdonisJS `container.resolving`). */
   #resolvingHooks: Map<ServiceToken, Array<(value: unknown) => void | Promise<void>>> = new Map()
   /**
@@ -625,7 +629,7 @@ export class Container {
    * 3. No params → plain `new Class()`
    */
   async #autoConstruct(
-    target: new (...args: never[]) => unknown,
+    target: abstract new (...args: never[]) => unknown,
     runtimeValues?: unknown[],
   ): Promise<unknown> {
     // Everything resolved inside is a dependency OF `target`, which is what a
@@ -642,7 +646,7 @@ export class Container {
   }
 
   async #constructWithDeps(
-    target: new (...args: never[]) => unknown,
+    target: abstract new (...args: never[]) => unknown,
     runtimeValues?: unknown[],
   ): Promise<unknown> {
     const metadata = getServiceMetadata(target)
@@ -719,7 +723,12 @@ export class Container {
         )
       }
       // (d) Genuine zero-argument class.
-      const instance = new target()
+      //
+      // `Reflect.construct`, not `new target()`: a token may be an abstract
+      // class (that is what a contextual binding binds against), and `new` on
+      // one is a compile error even though the runtime constructs it happily —
+      // `abstract` exists only at compile time.
+      const instance = Reflect.construct(target, [])
       this.#cacheIfAppWide(scope, key, instance, store, readsBefore)
       return instance
     }

package/src/container/types.ts

@@ -16,7 +16,17 @@ export interface ServiceMetadata {
 /** Token used to resolve a service — class constructor, string name, or registered symbol. */
 // `never[]` accepts every constructor shape — parameters are contravariant, so
 // a rest of `never` is assignable from any concrete list.
-export type ServiceToken = (new (...args: never[]) => unknown) | string | symbol
+/**
+ * What the container accepts as a token.
+ *
+ * `abstract new`, not `new`: binding an implementation against an abstract base
+ * is the whole point of a contextual binding — `@Inject(Hash)` where `Hash` is
+ * the abstract class and `Bcrypt` is what the container provides. An abstract
+ * class has no construct signature, so spelt `new (...)` the type rejected
+ * exactly the pattern the feature exists for. `abstract new` admits concrete
+ * classes too.
+ */
+export type ServiceToken = (abstract new (...args: never[]) => unknown) | string | symbol
 
 /**
  * What a binding factory is handed so it can resolve its own dependencies

package/src/decorators/Service.ts

@@ -14,7 +14,7 @@ const INJECT_METADATA_KEY = Symbol('ream:inject')
 // `never[]` accepts every constructor shape: parameters are contravariant, so a
 // rest of `never` is assignable from any concrete list. Same spelling as the
 // router's, so a class flows between the two without an assertion.
-type AnyConstructor = new (...args: never[]) => unknown
+type AnyConstructor = abstract new (...args: never[]) => unknown
 
 /** Registry of all decorated services. */
 const serviceRegistry: Map<AnyConstructor, ServiceMetadata> = new Map()

package/src/env/Env.ts

@@ -108,9 +108,11 @@ export class Env<Values extends Record<string, unknown>> {
       validate(values: Record<string, string | undefined>): EnvRecord<S> {
         const failures: string[] = []
         const collected: Record<string, unknown> = {}
-        for (const key of Object.keys(schema)) {
+        // `entries` rather than `keys` plus a lookup: the validator comes back
+        // already known to be there instead of read again as maybe-missing.
+        for (const [key, node] of Object.entries(schema)) {
           try {
-            collected[key] = schema[key].validate(key, values[key])
+            collected[key] = node.validate(key, values[key])
           } catch (err) {
             failures.push(err instanceof Error ? err.message : String(err))
           }

package/src/env/interpolate.ts

@@ -46,9 +46,11 @@ export function interpolate(value: string, lookup: (name: string) => string | un
   })
 
   const prefixed = /^([A-Za-z_][A-Za-z0-9_]*):([\s\S]*)$/.exec(substituted)
-  if (prefixed) {
-    const resolver = identifiers.get(prefixed[1])
-    if (resolver) return resolver(prefixed[2])
+  // Both groups are required by the pattern, so a match carries both.
+  const [, identifier, rest] = prefixed ?? []
+  if (identifier !== undefined && rest !== undefined) {
+    const resolver = identifiers.get(identifier)
+    if (resolver) return resolver(rest)
   }
   return substituted
 }

package/src/errors/FuzzyMatcher.ts

@@ -14,23 +14,43 @@ export function levenshtein(a: string, b: string): number {
   if (m === 0) return n
   if (n === 0) return m
 
-  const dp: number[][] = Array.from({ length: m + 1 }, () => Array<number>(n + 1).fill(0))
-
-  for (let i = 0; i <= m; i++) dp[i][0] = i
-  for (let j = 0; j <= n; j++) dp[0][j] = j
+  // Two rows rather than the whole matrix: the recurrence only ever reads the
+  // row above and the cell to the left, so the rest was allocated and never
+  // looked at again.
+  let previous: number[] = Array.from({ length: n + 1 }, (_, j) => j)
 
   for (let i = 1; i <= m; i++) {
+    const current: number[] = [i]
     for (let j = 1; j <= n; j++) {
       const cost = a[i - 1] === b[j - 1] ? 0 : 1
-      dp[i][j] = Math.min(
-        dp[i - 1][j] + 1, // deletion
-        dp[i][j - 1] + 1, // insertion
-        dp[i - 1][j - 1] + cost, // substitution
+      current.push(
+        Math.min(
+          cell(previous, j) + 1, // deletion
+          cell(current, j - 1) + 1, // insertion
+          cell(previous, j - 1) + cost, // substitution
+        ),
       )
     }
+    previous = current
   }
 
-  return dp[m][n]
+  return cell(previous, n)
+}
+
+/**
+ * One cell of a row that has already been filled.
+ *
+ * Each row is built left to right and every column is written before it is
+ * read, so a miss cannot happen — and this is where that invariant is stated
+ * rather than asserted past it. Reading the row directly would have every
+ * access typed "a number, or nothing", which is not what the algorithm knows.
+ */
+function cell(row: number[], index: number): number {
+  const value = row[index]
+  if (value === undefined) {
+    throw new RangeError(`levenshtein: column ${index} was read before it was written`)
+  }
+  return value
 }
 
 /**
@@ -81,12 +101,13 @@ export function findClosestMatches(
  * @returns Formatted suggestion string, or empty string if no matches
  */
 export function didYouMean(input: string, candidates: string[]): string {
-  const matches = findClosestMatches(input, candidates)
-  if (matches.length === 0) return ''
+  const [best, ...rest] = findClosestMatches(input, candidates)
+  if (best === undefined) return ''
 
-  if (matches.length === 1) {
-    return `Did you mean '${matches[0].candidate}'?`
+  if (rest.length === 0) {
+    return `Did you mean '${best.candidate}'?`
   }
+  const matches = [best, ...rest]
 
   const suggestions = matches.map((m) => `'${m.candidate}'`).join(', ')
   return `Did you mean one of: ${suggestions}?`

package/src/errors/PipelineStageError.ts

@@ -42,9 +42,11 @@ export function createPipelineError(
 ): ReamError {
   const total = PIPELINE_STAGES.length
   const clampedIndex = Math.max(0, Math.min(stageIndex, total - 1))
-  const stageName = PIPELINE_STAGES[clampedIndex]
+  // The index is clamped into the list just above, so the lookup lands — the
+  // fallback is what says so without asserting past the read.
+  const stageName = PIPELINE_STAGES[clampedIndex] ?? '(unknown)'
   const position = `${clampedIndex + 1}/${total}`
-  const nextStage = clampedIndex + 1 < total ? PIPELINE_STAGES[clampedIndex + 1] : '(end)'
+  const nextStage = PIPELINE_STAGES[clampedIndex + 1] ?? '(end)'
 
   const errorCode = originalError instanceof ReamError ? originalError.code : 'E_PIPELINE_ERROR'
 

package/src/events/Emitter.ts

@@ -23,14 +23,25 @@ const correlationStorage = new AsyncLocalStorage<string | undefined>()
  * Listener class interface — must have a handle() method.
  */
 export interface ListenerClass<T = unknown> {
-  handle(event: T): Promise<void> | void
+  handle(event: T): unknown
 }
 
 type EventConstructor<T = unknown> = new (...args: never[]) => T
 
-type ListenerFn<T = unknown> = (event: T) => Promise<void> | void
+/**
+ * A listener. Whatever it returns is awaited and dropped.
+ *
+ * `unknown`, not `Promise<void> | void`: a bare `void` return type accepts a
+ * function returning anything, but a UNION containing it does not — so
+ * `emitter.on('x', (d) => received.push(d))` was a type error for returning
+ * what `push` returns, which nothing reads.
+ */
+type ListenerFn<T = unknown> = (event: T) => unknown
 
-type ListenerConstructor<T = unknown> = new (...args: never[]) => ListenerClass<T>
+// `abstract new`: a listener bound against an abstract base is as valid a
+// registration as one bound against a concrete class, and the container builds
+// either.
+type ListenerConstructor<T = unknown> = abstract new (...args: never[]) => ListenerClass<T>
 
 type Listener<T = unknown> = ListenerFn<T> | ListenerConstructor<T>
 
@@ -41,7 +52,16 @@ type Listener<T = unknown> = ListenerFn<T> | ListenerConstructor<T>
  * satisfies it.
  */
 export interface EmitterResolver {
-  make<T>(target: new (...args: never[]) => T): Promise<T>
+  /**
+   * Build a listener.
+   *
+   * Not generic: a generic method must work for every `T`, so nothing but a
+   * real container could implement it — the fake in the tests could not, and
+   * this file's own call site reached for `as ListenerConstructor<T>` to get
+   * past it. What comes back is checked below, which is what a container's
+   * answer deserves anyway.
+   */
+  make(target: abstract new (...args: never[]) => object): Promise<object>
 }
 
 /**
@@ -327,9 +347,15 @@ export class Emitter {
         if (isListenerClass(listener)) {
           // Listener class — resolve via container for @inject() support
           const instance = this.#resolver
-            ? await this.#resolver.make(listener as ListenerConstructor<T>)
-            : new (listener as ListenerConstructor<T>)()
-          await instance.handle(event)
+            ? await this.#resolver.make(listener)
+            : Reflect.construct(listener, [])
+          const handle = Reflect.get(instance, 'handle')
+          if (typeof handle !== 'function') {
+            throw new Error(
+              `Listener ${String(Reflect.get(listener, 'name'))} resolved to something with no handle()`,
+            )
+          }
+          await handle.call(instance, event)
         } else {
           await (listener as ListenerFn<T>)(event)
         }
@@ -651,7 +677,7 @@ function classToEventName(cls: EventConstructor): string {
 }
 
 /** Check if a listener entry is a class (has prototype.handle) vs a function. */
-function isListenerClass(listener: Listener): boolean {
+function isListenerClass(listener: Listener): listener is ListenerConstructor {
   return typeof listener === 'function' && typeof listener.prototype?.handle === 'function'
 }
 

package/src/events/testing/FakeBus.ts

@@ -41,10 +41,17 @@ export type FakeBusPredicateArg = FakeBusPredicate | ((event: CapturedEmit) => b
 
 interface Subscription {
   pattern: string
-  /** Subscribers may return `void` (sync) or `PromiseLike<void>` (async).
-   *  Async rejections are logged via `console.error` to keep them from
-   *  escaping to `unhandledRejection`. */
-  callback: (eventJson: string) => void | PromiseLike<void>
+  /**
+   * Subscribers may be sync or async; whatever they return is awaited and
+   * dropped, and an async rejection is logged via `console.error` rather than
+   * escaping to `unhandledRejection`.
+   *
+   * `unknown`, not `void | PromiseLike<void>`: a bare `void` return type
+   * accepts a function returning anything, but a UNION containing it does not
+   * — so widening the native bus's `=> void` to that union made it NARROWER in
+   * practice, and `(json) => received.push(json)` stopped compiling.
+   */
+  callback: (eventJson: string) => unknown
 }
 
 /** Request handler may return `void` (sync, fire-and-forget after `reply`)
@@ -106,7 +113,7 @@ export class FakeBus {
     return Promise.resolve('ok')
   }
 
-  subscribe(pattern: string, callback: (eventJson: string) => void | PromiseLike<void>): number {
+  subscribe(pattern: string, callback: (eventJson: string) => unknown): number {
     const id = this.#nextSubId++
     this.#subscribers.set(id, { pattern, callback })
     return id

package/src/graphql/GraphQLEngine.ts

@@ -182,7 +182,7 @@ export interface ResolverOptions {
 interface ResolverEntry {
   typeName: string
   fieldName: string
-  handlerClass: new (...args: unknown[]) => Record<string, (...args: unknown[]) => unknown>
+  handlerClass: abstract new (...args: never[]) => object
   methodName: string
   options: ResolverOptions
 }
@@ -204,7 +204,7 @@ export interface SelectionField {
 export class GraphQLEngine {
   #schemaSource: string
   #resolvers: Map<string, ResolverEntry> = new Map()
-  #container?: { make<T>(target: new (...args: unknown[]) => T): Promise<T> }
+  #container?: { make<T>(target: abstract new (...args: never[]) => T): Promise<T> }
   readonly path: string
   #playground: boolean
   #maxQueryBytes: number
@@ -239,7 +239,9 @@ export class GraphQLEngine {
   }
 
   /** Set IoC container for resolver instantiation. */
-  useContainer(container: { make<T>(target: new (...args: unknown[]) => T): Promise<T> }): void {
+  useContainer(container: {
+    make<T>(target: abstract new (...args: never[]) => T): Promise<T>
+  }): void {
     this.#container = container
   }
 
@@ -247,7 +249,7 @@ export class GraphQLEngine {
   resolver(
     typeName: string,
     fieldName: string,
-    handlerClass: new (...args: unknown[]) => Record<string, (...args: unknown[]) => unknown>,
+    handlerClass: abstract new (...args: never[]) => object,
     methodName: string,
     options?: ResolverOptions,
   ): void {
@@ -369,11 +371,13 @@ export class GraphQLEngine {
 
     try {
       // Resolve handler via IoC or direct instantiation.
-      const instance = this.#container
+      // `Reflect.construct`, not `new`: the resolver may be an abstract class,
+      // which the runtime builds happily and `new` refuses at compile time.
+      const instance: object = this.#container
         ? await this.#container.make(entry.handlerClass)
-        : new entry.handlerClass()
+        : Reflect.construct(entry.handlerClass, [])
 
-      const handler = instance[entry.methodName]
+      const handler = Reflect.get(instance, entry.methodName)
       if (typeof handler !== 'function') {
         return {
           ok: false,

package/src/helpers/bytes.ts

@@ -18,6 +18,11 @@ const UNITS = {
 
 type Unit = keyof typeof UNITS
 
+/** A suffix the table knows. Checked, so nothing has to be asserted. */
+function isUnit(value: string): value is Unit {
+  return value in UNITS
+}
+
 const PARSE = /^((?:-|\+)?(?:\d+(?:\.\d+)?)) *(kb|mb|gb|tb|pb)$/i
 /** Trailing `.00`, or the zeros trailing a real decimal. */
 const TRAILING_ZEROS = /(?:\.0*|(\.[^0]+)0+)$/
@@ -33,10 +38,16 @@ export function parse(value: string | number): number | null {
   if (typeof value !== 'string') return null
 
   const matched = PARSE.exec(value)
-  const amount = matched ? Number.parseFloat(matched[1]) : Number.parseInt(value, 10)
+  // Both groups are required by the pattern, so a match carries both — but
+  // read as `matched[2]` the second was typed "a string, or nothing", and the
+  // `as Unit` that followed asserted past exactly that. Named, with the
+  // suffix checked against the table it indexes, nothing is asserted.
+  const [, digits, suffix] = matched ?? []
+  const amount = digits !== undefined ? Number.parseFloat(digits) : Number.parseInt(value, 10)
   if (Number.isNaN(amount)) return null
 
-  const unit = (matched ? matched[2].toLowerCase() : 'b') as Unit
+  const unit = suffix === undefined ? 'b' : suffix.toLowerCase()
+  if (!isUnit(unit)) return null
   return Math.floor(UNITS[unit] * amount)
 }
 

package/src/helpers/string.ts

@@ -214,9 +214,9 @@ export function pluralize(word: string, count?: number): string {
  * @example humanize('user_name') // 'User name'
  */
 export function humanize(s: string): string {
-  const words = splitWords(s)
-  if (words.length === 0) return ''
-  return [words[0]?.charAt(0).toUpperCase() + words[0]?.slice(1), ...words.slice(1)].join(' ')
+  const [first, ...rest] = splitWords(s)
+  if (first === undefined) return ''
+  return [first.charAt(0).toUpperCase() + first.slice(1), ...rest].join(' ')
 }
 
 // ---------------------------------------------------------------------------

package/src/http/Exception.ts

@@ -315,8 +315,10 @@ export class ExceptionHandler extends Macroable {
   #expandStatusPages(): Record<number, StatusPageRenderer> {
     if (!this.#expandedStatusPages) {
       const expanded: Record<number, StatusPageRenderer> = {}
-      for (const range of Object.keys(this.statusPages)) {
-        Object.assign(expanded, parseStatusRange(range, this.statusPages[range]))
+      // `entries` rather than `keys` plus a lookup: the value comes back
+      // already known to be there, instead of read again as maybe-missing.
+      for (const [range, renderer] of Object.entries(this.statusPages)) {
+        Object.assign(expanded, parseStatusRange(range, renderer))
       }
       this.#expandedStatusPages = expanded
     }
@@ -440,13 +442,17 @@ export class ExceptionHandler extends Macroable {
   /**
    * Pick a renderer by content negotiation.
    *
-   * DEVIATION (named): ream lists `json` FIRST, so a request with no or `*` /`*`
-   * Accept defaults to JSON (API-first). AdonisJS lists `html` first
-   * (full-stack default). Explicit `text/html` / `vnd.api+json` are honoured
-   * identically.
+   * `html` is listed first, as AdonisJS does, so a request that states no
+   * preference — no `Accept` at all, or `*` /`*` — gets the error page rather
+   * than a JSON body. A browser always sends `text/html` and an API client
+   * always asks for JSON, so the order only decides for the clients in
+   * between: curl, a health probe, a proxy that stripped the header. For a
+   * framework that ships a view layer, a page is the better answer there.
+   *
+   * The fallback stays JSON, for a client that accepts none of the three.
    */
   async renderError(error: HttpError, ctx: HttpContext): Promise<void> {
-    switch (ctx.request.accepts(['json', 'html', 'application/vnd.api+json'])) {
+    switch (ctx.request.accepts(['html', 'json', 'application/vnd.api+json'])) {
       case 'application/vnd.api+json':
         return this.renderErrorAsJSONAPI(error, ctx)
       case 'html':
@@ -458,7 +464,7 @@ export class ExceptionHandler extends Macroable {
 
   /** Pick a validation renderer by content negotiation. */
   async renderValidationError(error: HttpError, ctx: HttpContext): Promise<void> {
-    switch (ctx.request.accepts(['json', 'html', 'application/vnd.api+json'])) {
+    switch (ctx.request.accepts(['html', 'json', 'application/vnd.api+json'])) {
       case 'application/vnd.api+json':
         return this.renderValidationErrorAsJSONAPI(error, ctx)
       case 'html':

package/src/http/Request.ts

@@ -272,7 +272,10 @@ export class Request extends Macroable {
   host(): string | null {
     if (this.#trustProxy) {
       const forwarded = this.#raw.headers['x-forwarded-host']
-      if (forwarded) return forwarded.split(',')[0].trim()
+      // The first hop in the list, named rather than indexed: `split` always
+      // yields one element, and saying so beats being told it might not.
+      const [first] = forwarded?.split(',') ?? []
+      if (first !== undefined) return first.trim()
     }
     return this.#raw.headers.host ?? null
   }
@@ -285,7 +288,8 @@ export class Request extends Macroable {
   protocol(): string {
     if (this.#trustProxy) {
       const forwarded = this.#raw.headers['x-forwarded-proto']
-      if (forwarded) return forwarded.split(',')[0].trim().toLowerCase()
+      const [first] = forwarded?.split(',') ?? []
+      if (first !== undefined) return first.trim().toLowerCase()
     }
     return this.#raw.scheme ?? 'http'
   }
@@ -900,9 +904,8 @@ export class Request extends Macroable {
     fieldName: string,
     options?: import('../bodyparser/MultipartFile.js').FileValidationOptions,
   ): import('../bodyparser/MultipartFile.js').MultipartFile | null {
-    const files = this.#files.get(fieldName)
-    if (!files || files.length === 0) return null
-    const file = files[0]
+    const [file] = this.#files.get(fieldName) ?? []
+    if (file === undefined) return null
     if (options) file.validate(options)
     return file
   }

package/src/http/mime.ts

@@ -1317,7 +1317,8 @@ const CHARSETS: Record<string, string> = {
 
 /** The charset for a type, or `undefined` when it carries none. */
 function charsetFor(type: string): string | undefined {
-  const base = type.split(';')[0].trim().toLowerCase()
+  const [head = ''] = type.split(';')
+  const base = head.trim().toLowerCase()
   const declared = CHARSETS[base]
   if (declared !== undefined) return declared
   return base.startsWith('text/') ? 'utf-8' : undefined

package/src/index.ts

@@ -254,7 +254,7 @@ export { ConsoleKernel, defineConfig, Ignitor, prettyPrintError } from './Ignito
 // ─── Providers ──────────────────────────────────────────────
 
 export { errors } from './errors/aggregate.js'
-export type { AppContext, ProviderContract } from './Provider.js'
+export type { AppContext, ConfigReader, ProviderContract } from './Provider.js'
 export { Provider } from './Provider.js'
 export type {
   AuthenticatorName,
@@ -378,4 +378,4 @@ export {
   StatsTracker,
 } from './scheduler/index.js'
 
-export const VERSION = '0.2.14'
+export const VERSION = '0.2.15'

package/src/native/generated.ts

@@ -87,8 +87,14 @@ export declare class HyperServer {
    * the safe default for a dev machine.
    */
   constructor(port?: number | undefined | null, host?: string | undefined | null)
-  /** Register the request handler. Callback receives JSON request string, must return JSON response string. */
-  onRequest(callback: (request: string) => Promise<string> | string): void
+  /**
+   * Register the request handler.
+   *
+   * The request arrives as an OBJECT (`serde_json::Value` → `JsObject`) and
+   * the handler answers with a `NapiResponse` object — not the JSON strings
+   * this comment described until the boundary stopped carrying them.
+   */
+  onRequest(callback: (request: Record<string, unknown>) => Promise<NapiResponse>): void
   /**
    * Configure the trusted-proxy CIDR list used by `request.ip` resolution.
    * Must be called BEFORE `listen()`. Empty list = legacy permissive mode
@@ -155,12 +161,10 @@ export declare class HyperServer {
    */
   writeStreamBytes(streamId: string, chunk: Uint8Array): Promise<boolean>
   /**
-  * Close a stream from the server side. The matching response body
-  * finishes cleanly (hyper writes the final chunk + `0
-  
-  ` for
-  * HTTP/1.1 chunked encoding). Idempotent.
-  */
+   * Close a stream from the server side. The matching response body
+   * finishes cleanly (hyper writes the final chunk + `0\r\n\r\n` for
+   * HTTP/1.1 chunked encoding). Idempotent.
+   */
   closeStream(streamId: string): Promise<boolean>
   /**
    * Install a one-shot callback fired the moment the matching stream