@c9up/ream 0.2.14 → 0.2.15

package/src/openapi/OpenApiGenerator.ts

@@ -170,9 +170,9 @@ export class OpenApiGenerator {
     }
 
     if (route.validators.length > 0 && ['post', 'put', 'patch'].includes(method)) {
-      const validatorName = route.validators[0]
-      const schema = this.#runeSchemas.get(validatorName)
-      if (schema) {
+      const [validatorName] = route.validators
+      const schema = validatorName === undefined ? undefined : this.#runeSchemas.get(validatorName)
+      if (schema && validatorName !== undefined) {
         operation.requestBody = {
           required: true,
           content: { 'application/json': { schema: this.#runeToJsonSchema(schema) } },
@@ -197,7 +197,9 @@ export class OpenApiGenerator {
   /** Extract parameter names from path. */
   #extractPathParams(path: string): string[] {
     const matches = path.matchAll(/:(\w+)\??/g)
-    return [...matches].map((m) => m[1])
+    // Group 1 is required by the pattern, so every match carries it; the
+    // filter is how that is stated instead of asserted.
+    return [...matches].map((m) => m[1]).filter((name) => name !== undefined)
   }
 
   /** Generate a summary from route metadata. */

package/src/router/Router.ts

@@ -25,7 +25,16 @@ export interface SignedUrlOptions {
 
 // ─── Types ──────────────────────────────────────────────────
 
-export type RouteHandlerFunction = (ctx: HttpContext) => Promise<void> | void
+/**
+ * A route handler. Whatever it returns is awaited and dropped — the response
+ * is written through `ctx.response`.
+ *
+ * `unknown`, not `Promise<void> | void`: a bare `void` return type accepts a
+ * function returning anything, but a UNION containing it does not, so
+ * `router.get('/x', () => 'ok')` was a type error for returning a value the
+ * kernel already ignores.
+ */
+export type RouteHandlerFunction = (ctx: HttpContext) => unknown
 
 /**
  * Controller tuple: [ControllerClass, 'methodName'].
@@ -267,7 +276,13 @@ export class RouteBuilder extends Macroable {
 
   /** The primary definition — accessors read from it (all verbs share pattern/name). */
   #primary(): RouteDefinition {
-    return this.#routes[0]
+    const [first] = this.#routes
+    if (first === undefined) {
+      // A route is constructed with at least one verb, so this cannot happen —
+      // and this is where that is stated rather than asserted past.
+      throw new Error('Route has no definitions')
+    }
+    return first
   }
 
   /** Name this route (for URL generation and redirects). */
@@ -1557,9 +1572,13 @@ function matchPath(pattern: string, actual: string): MatchedParams | null {
     const params: MatchedParams = {}
     for (let i = 0; i < wildcardIdx; i++) {
       const part = patternParts[i]
+      const actual = actualParts[i]
+      // Both are read out of arrays whose length was checked above; naming
+      // them is what turns that check into something the compiler shares.
+      if (part === undefined || actual === undefined) return null
       if (part.startsWith(':')) {
-        params[part.substring(1)] = safeDecodeURIComponent(actualParts[i])
-      } else if (part !== actualParts[i]) {
+        params[part.substring(1)] = safeDecodeURIComponent(actual)
+      } else if (part !== actual) {
         return null
       }
     }
@@ -1579,22 +1598,22 @@ function matchPath(pattern: string, actual: string): MatchedParams | null {
 
   const params: MatchedParams = {}
 
-  for (let i = 0; i < patternParts.length; i++) {
-    const part = patternParts[i]
+  for (const [i, part] of patternParts.entries()) {
     const isOptional = part.endsWith('?')
+    const actual = actualParts[i]
 
     if (part.startsWith(':')) {
       const paramName = isOptional ? part.slice(1, -1) : part.substring(1)
-      if (i < actualParts.length) {
+      if (actual !== undefined) {
         // Percent-decode the captured segment (query strings already are) so
         // `/users/Jos%C3%A9` yields `José` and matchers test the real value.
         // safeDecode falls back to the raw segment on malformed input.
-        params[paramName] = safeDecodeURIComponent(actualParts[i])
+        params[paramName] = safeDecodeURIComponent(actual)
       }
       // Optional param with no actual part — skip (param not set)
-    } else if (i < actualParts.length && part !== actualParts[i]) {
+    } else if (actual !== undefined && part !== actual) {
       return null
-    } else if (i >= actualParts.length && !isOptional) {
+    } else if (actual === undefined && !isOptional) {
       return null
     }
   }
@@ -1612,7 +1631,8 @@ function matchPath(pattern: string, actual: string): MatchedParams | null {
  * Comparing them verbatim sends that request to a fallback, or to a 404.
  */
 function matchDomain(pattern: string, host: string): boolean {
-  const actualHost = host.split(':')[0].toLowerCase() // strip port
+  const [hostname = ''] = host.split(':') // strip port
+  const actualHost = hostname.toLowerCase()
   const wanted = pattern.toLowerCase()
   if (wanted === actualHost) return true
   if (wanted.startsWith('*.')) {

package/src/rpc/RpcRouter.ts

@@ -30,7 +30,7 @@ export type RpcHandler = (ctx: HttpContext, params: unknown) => Promise<unknown>
  * the shared `'middleware'` registry, and `validator:<name>` schemas.
  */
 interface RpcContainer {
-  make<T>(target: new (...args: unknown[]) => T): Promise<T>
+  make<T>(target: abstract new (...args: never[]) => T): Promise<T>
   resolve<T>(token: string): Promise<T>
   has(token: string): boolean
 }
@@ -151,11 +151,21 @@ export class RpcRouter {
     return new RpcMethodBuilder(def)
   }
 
-  /** Register methods from a controller — auto-registers all public methods. */
-  namespace(
-    prefix: string,
-    controller: new (...args: unknown[]) => Record<string, (...args: unknown[]) => unknown>,
-  ): void {
+  /**
+   * Register methods from a controller — auto-registers all public methods.
+   *
+   * The parameter used to demand
+   * `new (...args: unknown[]) => Record<string, (...args: unknown[]) => unknown>`,
+   * which NO real controller satisfies: a class with any non-method property
+   * fails the `Record`, and a method declared `bump(): number` fails the
+   * `unknown[]` parameters, which are compared contravariantly. So the
+   * documented call — `rpc.namespace('task', TaskController)` — did not
+   * typecheck, and nothing noticed because the tests were outside `tsc`.
+   *
+   * Any class, then. The body already checks that what it found is callable
+   * and names the method when it is not.
+   */
+  namespace(prefix: string, controller: abstract new (...args: never[]) => object): void {
     const proto = controller.prototype
     const methods = Object.getOwnPropertyNames(proto).filter(
       (m) => m !== 'constructor' && typeof proto[m] === 'function',
@@ -164,8 +174,18 @@ export class RpcRouter {
       this.method(`${prefix}.${methodName}`, async (ctx, params) => {
         // Resolve through the container on every call (fresh DI per request,
         // like GraphQLEngine), falling back to a bare `new` when unset.
-        const instance = this.#container ? await this.#container.make(controller) : new controller()
-        return instance[methodName](ctx, params)
+        // `Reflect.construct`, not `new controller()`: the token may be an
+        // abstract class, which the runtime builds happily and `new` refuses.
+        const instance: object = this.#container
+          ? await this.#container.make(controller)
+          : Reflect.construct(controller, [])
+        const handler = Reflect.get(instance, methodName)
+        if (typeof handler !== 'function') {
+          throw new Error(
+            `RPC method '${prefix}.${methodName}' is not a function on ${controller.name}`,
+          )
+        }
+        return handler.call(instance, ctx, params)
       })
     }
   }
@@ -199,6 +219,16 @@ export class RpcRouter {
 
     // Batch support (max 50 to prevent DoS)
     if (Array.isArray(body)) {
+      // §6: "If the batch rpc call itself fails to be recognized as an valid
+      // JSON or as an Array with at least one value, the response from the
+      // Server MUST be a single Response object." An empty batch answered with
+      // 204 No Content, which is what this replies when every call in a batch
+      // was a notification — so a client that sent nothing was told its calls
+      // had run.
+      if (body.length === 0) {
+        ctx.response.status(200).json(rpcError(-32600, 'Invalid Request', null))
+        return
+      }
       if (body.length > 50) {
         ctx.response.status(400).json(rpcError(-32600, 'Batch too large (max 50)', null))
         return

package/src/scheduler/Schedule.ts

@@ -90,7 +90,14 @@ export function Schedule(cronExpr: string): MethodDecorator {
  * none). Returns a shallow copy so callers cannot mutate the stored
  * metadata by accident.
  */
-export function getScheduleMetadata(target: Constructor): ScheduleMetadata[] {
+/**
+ * `abstract new`, not `Constructor`: reading metadata off a class never
+ * constructs it, and the service registry holds abstract ones too since a
+ * contextual binding binds against an abstract base.
+ */
+export function getScheduleMetadata(
+  target: abstract new (...args: never[]) => unknown,
+): ScheduleMetadata[] {
   const stored: ScheduleMetadata[] = Reflect.getOwnMetadata(SCHEDULE_METADATA_KEY, target) ?? []
   return [...stored]
 }

package/src/security/CookieSigner.ts

@@ -225,12 +225,22 @@ export class CookieSigner {
   }
 
   decrypt<T = string>(encrypted: string, purpose?: string): T | null {
-    const parts = encrypted.split('.')
-    if (parts.length !== 3) return null
+    // Destructured rather than indexed, and `extra` is what keeps the old
+    // length check honest: three names bind on a four-part string too, so the
+    // fourth has to be looked at to reject it.
+    const [ivPart, dataPart, tagPart, extra] = encrypted.split('.')
+    if (
+      ivPart === undefined ||
+      dataPart === undefined ||
+      tagPart === undefined ||
+      extra !== undefined
+    ) {
+      return null
+    }
     try {
-      const iv = Buffer.from(parts[0], 'base64url')
-      const data = Buffer.from(parts[1], 'base64url')
-      const tag = Buffer.from(parts[2], 'base64url')
+      const iv = Buffer.from(ivPart, 'base64url')
+      const data = Buffer.from(dataPart, 'base64url')
+      const tag = Buffer.from(tagPart, 'base64url')
       const decipher = createDecipheriv('aes-256-gcm', this.#keyBuffer, iv)
       decipher.setAuthTag(tag)
       const raw = Buffer.concat([decipher.update(data), decipher.final()]).toString('utf8')

package/src/security/SignedUrl.ts

@@ -55,8 +55,9 @@ function parseExpiry(value: string | number): number {
   if (typeof value === 'number') return value
   const match = value.match(/^(\d+)(s|m|h|d)$/)
   if (!match) return 3600
-  const num = parseInt(match[1], 10)
-  switch (match[2]) {
+  const [, digits, unit] = match
+  const num = parseInt(digits ?? '0', 10)
+  switch (unit) {
     case 's':
       return num
     case 'm':

package/src/session/drivers/DatabaseDriver.ts

@@ -8,10 +8,28 @@ import type { SessionDriverWithTagging, TaggedSession } from '../Session.js'
  * app's own wrapper.
  */
 export interface SessionDbConnection {
-  query<T = Record<string, unknown>>(sql: string, params?: unknown[]): Promise<T[]>
+  /**
+   * Rows, as rows: `Record<string, unknown>`, not a shape the caller names.
+   *
+   * `query<T>` let this driver ASSERT what a SELECT returned — a promise the
+   * database never made and the connection cannot keep. It also made the
+   * interface unimplementable by anything but a real driver: a generic method
+   * must work for every `T`, so no fake could satisfy it, and this file's tests
+   * sat outside the typecheck because of it.
+   *
+   * The columns are read through {@link textColumn} below instead, which is
+   * what a row from a database deserves.
+   */
+  query(sql: string, params?: unknown[]): Promise<Array<Record<string, unknown>>>
   execute(sql: string, params?: unknown[]): Promise<{ rowsAffected: number }>
 }
 
+/** A column that must be text to be usable, or `null`. */
+function textColumn(row: Record<string, unknown>, name: string): string | null {
+  const value = row[name]
+  return typeof value === 'string' ? value : null
+}
+
 export interface DatabaseDriverOptions {
   connection: SessionDbConnection
   /** Table holding the sessions. Default `sessions`. */
@@ -71,17 +89,20 @@ export class DatabaseDriver implements SessionDriverWithTagging {
   }
 
   async read(sessionId: string): Promise<Record<string, unknown> | null> {
-    const rows = await this.#db.query<{ data: string; expires_at: number | string }>(
-      `SELECT data, expires_at FROM ${this.#table} WHERE id = ?`,
-      [sessionId],
-    )
+    const rows = await this.#db.query(`SELECT data, expires_at FROM ${this.#table} WHERE id = ?`, [
+      sessionId,
+    ])
     const row = rows[0]
     if (!row) return null
     if (Number(row.expires_at) < Date.now()) {
       await this.destroy(sessionId)
       return null
     }
-    return parseData(row.data)
+    const data = textColumn(row, 'data')
+    // A row whose payload is not text is not a session — the same outcome as a
+    // row that will not parse.
+    if (data === null) return null
+    return parseData(data)
   }
 
   async write(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<void> {
@@ -157,11 +178,18 @@ export class DatabaseDriver implements SessionDriverWithTagging {
 
   /** Every non-expired session this user holds — their active devices. */
   async tagged(userId: string | number): Promise<TaggedSession[]> {
-    const rows = await this.#db.query<{ id: string; data: string }>(
+    const rows = await this.#db.query(
       `SELECT id, data FROM ${this.#table} WHERE user_id = ? AND expires_at >= ?`,
       [String(userId), Date.now()],
     )
-    return rows.map((row) => ({ id: row.id, data: parseData(row.data) }))
+    const sessions: TaggedSession[] = []
+    for (const row of rows) {
+      const id = textColumn(row, 'id')
+      const data = textColumn(row, 'data')
+      if (id === null || data === null) continue
+      sessions.push({ id, data: parseData(data) })
+    }
+    return sessions
   }
 
   /** Delete every expired row — for a scheduled job, since nothing else does. */

package/src/session/drivers/RedisDriver.ts

@@ -67,11 +67,19 @@ export class RedisDriver implements SessionDriverWithTagging {
     }
     if (!this.#pending) {
       const resolver = this.#source
-      this.#pending = Promise.resolve(resolver()).then((client) => {
-        this.#resolved = client
-        this.#pending = undefined
-        return client
-      })
+      // `finally`, not the success path: clearing it only on success left a
+      // REJECTED promise in the slot, and every later call returned that same
+      // rejection. One refused connection at boot — Redis still starting, a
+      // network blip — and the driver never tried again for the life of the
+      // process. Bay and echo already clear it this way.
+      this.#pending = Promise.resolve(resolver())
+        .then((client) => {
+          this.#resolved = client
+          return client
+        })
+        .finally(() => {
+          this.#pending = undefined
+        })
     }
     return this.#pending
   }

package/src/testing/ApiResponse.ts

@@ -149,15 +149,14 @@ function parseMultipartResponse(
     // Trim the trailing CRLF before the next boundary.
     let content = part.subarray(headerEnd + 4)
     if (content.subarray(-2).toString('binary') === '\r\n') content = content.subarray(0, -2)
-    const nameMatch = headerText.match(/name="([^"]*)"/i)
-    if (!nameMatch) continue
-    const name = nameMatch[1]
-    const fileMatch = headerText.match(/filename="([^"]*)"/i)
-    if (fileMatch) {
+    const [, name] = headerText.match(/name="([^"]*)"/i) ?? []
+    if (name === undefined) continue
+    const [, filename] = headerText.match(/filename="([^"]*)"/i) ?? []
+    if (filename !== undefined) {
       const typeMatch = headerText.match(/content-type:\s*([^\r\n]+)/i)
       files[name] = {
         fieldName: name,
-        filename: fileMatch[1],
+        filename,
         type: typeMatch?.[1]?.trim() ?? 'application/octet-stream',
         size: content.length,
         content,
@@ -355,8 +354,8 @@ export class ApiResponse {
   /** Charset from `Content-Type`, if any — helix `charset()`. */
   charset(): string | undefined {
     const ct = this.#raw.headers['content-type'] ?? ''
-    const m = ct.match(/charset=([^;]+)/i)
-    return m ? m[1].trim() : undefined
+    const [, charset] = ct.match(/charset=([^;]+)/i) ?? []
+    return charset?.trim()
   }
 
   /** All response cookies, parsed from `Set-Cookie` — helix `cookies()`. */
@@ -380,8 +379,8 @@ export class ApiResponse {
     if (!link) return {}
     const out: Record<string, string> = {}
     for (const part of link.split(',')) {
-      const m = part.match(/<([^>]+)>\s*;\s*rel="?([^";]+)"?/)
-      if (m) out[m[2]] = m[1]
+      const [, url, rel] = part.match(/<([^>]+)>\s*;\s*rel="?([^";]+)"?/) ?? []
+      if (url !== undefined && rel !== undefined) out[rel] = url
     }
     return out
   }

package/src/testing/TestClient.ts

@@ -368,15 +368,15 @@ export function parseHttpResponse(raw: string | Buffer): TestResponse {
 
   const lines = headerSection.split('\r\n')
   const statusLine = lines[0] ?? ''
-  const statusMatch = statusLine.match(/HTTP\/\d+\.\d+ (\d+)/)
-  const status = statusMatch ? Number.parseInt(statusMatch[1], 10) : 0
+  const [, statusDigits] = statusLine.match(/HTTP\/\d+\.\d+ (\d+)/) ?? []
+  const status = statusDigits === undefined ? 0 : Number.parseInt(statusDigits, 10)
 
   const headers: Dict = {}
-  for (let i = 1; i < lines.length; i++) {
-    const colonIdx = lines[i].indexOf(':')
+  for (const line of lines.slice(1)) {
+    const colonIdx = line.indexOf(':')
     if (colonIdx === -1) continue
-    const key = lines[i].slice(0, colonIdx).trim().toLowerCase()
-    const value = lines[i].slice(colonIdx + 1).trim()
+    const key = line.slice(0, colonIdx).trim().toLowerCase()
+    const value = line.slice(colonIdx + 1).trim()
     headers[key] = value
   }
 

package/src/utils/Macroable.ts

@@ -38,7 +38,11 @@ export class Macroable {
    * `HttpContext`, and two subclasses declaring the same name clobbered each
    * other silently.
    */
-  static macro(this: typeof Macroable, name: string, fn: MacroFn): void {
+  // `{ prototype: object }`, not `typeof Macroable`: a subclass whose
+  // constructor takes arguments — `Request`, say — has a different static side,
+  // so `Request.macro(...)` was "the 'this' context of type 'typeof Request' is
+  // not assignable". What this needs from `this` is the prototype it defines on.
+  static macro(this: { prototype: object }, name: string, fn: MacroFn): void {
     Object.defineProperty(this.prototype, name, {
       value: fn,
       writable: true,
@@ -51,7 +55,7 @@ export class Macroable {
    * `getter`). With `singleton`, the value is computed once per instance and
    * cached.
    */
-  static getter(this: typeof Macroable, name: string, fn: GetterFn, singleton = false): void {
+  static getter(this: { prototype: object }, name: string, fn: GetterFn, singleton = false): void {
     if (!singleton) {
       Object.defineProperty(this.prototype, name, { get: fn, configurable: true })
       return

package/src/utils/objectPath.ts

@@ -77,9 +77,13 @@ export function hasPath(source: unknown, path: string): boolean {
  */
 export function setPath(target: UnknownRecord, path: string, value: unknown): UnknownRecord {
   const segments = toSegments(path)
+  // The last segment is the one written; everything before it is walked. Split
+  // off by name rather than by index, so neither has to be read back out of
+  // the array afterwards and re-checked for existence.
+  const last = segments.pop()
+  if (last === undefined) return target
   let current: UnknownRecord = target
-  for (let i = 0; i < segments.length - 1; i += 1) {
-    const key = segments[i]
+  for (const key of segments) {
     const next = current[key]
     if (!isIndexable(next)) {
       const created: UnknownRecord = {}
@@ -89,7 +93,7 @@ export function setPath(target: UnknownRecord, path: string, value: unknown): Un
       current = next
     }
   }
-  current[segments[segments.length - 1]] = value
+  current[last] = value
   return target
 }
 
@@ -115,12 +119,14 @@ export function omitPaths(source: UnknownRecord, paths: string[]): UnknownRecord
   const result = structuredClone(source)
   for (const path of paths) {
     const segments = toSegments(path)
+    const last = segments.pop()
+    if (last === undefined) continue
     let current: unknown = result
-    for (let i = 0; i < segments.length - 1; i += 1) {
+    for (const key of segments) {
       if (!isIndexable(current)) break
-      current = current[segments[i]]
+      current = current[key]
     }
-    if (isIndexable(current)) delete current[segments[segments.length - 1]]
+    if (isIndexable(current)) delete current[last]
   }
   return result
 }