@c9up/ream 0.2.14 → 0.2.16

package/dist/utils/objectPath.js

@@ -72,9 +72,14 @@ export function hasPath(source, path) {
  */
 export function setPath(target, path, value) {
     const segments = toSegments(path);
+    // The last segment is the one written; everything before it is walked. Split
+    // off by name rather than by index, so neither has to be read back out of
+    // the array afterwards and re-checked for existence.
+    const last = segments.pop();
+    if (last === undefined)
+        return target;
     let current = target;
-    for (let i = 0; i < segments.length - 1; i += 1) {
-        const key = segments[i];
+    for (const key of segments) {
         const next = current[key];
         if (!isIndexable(next)) {
             const created = {};
@@ -85,7 +90,7 @@ export function setPath(target, path, value) {
             current = next;
         }
     }
-    current[segments[segments.length - 1]] = value;
+    current[last] = value;
     return target;
 }
 /**
@@ -110,14 +115,17 @@ export function omitPaths(source, paths) {
     const result = structuredClone(source);
     for (const path of paths) {
         const segments = toSegments(path);
+        const last = segments.pop();
+        if (last === undefined)
+            continue;
         let current = result;
-        for (let i = 0; i < segments.length - 1; i += 1) {
+        for (const key of segments) {
             if (!isIndexable(current))
                 break;
-            current = current[segments[i]];
+            current = current[key];
         }
         if (isIndexable(current))
-            delete current[segments[segments.length - 1]];
+            delete current[last];
     }
     return result;
 }

package/dist/utils/objectPath.js.map

@@ -1 +1 @@
-{"version":3,"file":"objectPath.js","sourceRoot":"","sources":["../../src/utils/objectPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,gFAAgF;AAChF,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,OAAO,GAAG,WAAW,CAAA;IAC3B,IAAI,KAAK,GAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtD,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACvB,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,MAAe,EAAE,IAAY,EAAE,YAAsB;IAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,OAAO,GAAY,MAAM,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO,YAAY,CAAA;QAC9C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAA;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,MAAe,EAAE,IAAY;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,OAAO,GAAY,MAAM,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3E,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,MAAqB,EAAE,IAAY,EAAE,KAAc;IACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,OAAO,GAAkB,MAAM,CAAA;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAkB,EAAE,CAAA;YACjC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;YACtB,OAAO,GAAG,OAAO,CAAA;QACnB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;IAC9C,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAe,EAAE,KAAe;IACxD,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAqB,EAAE,KAAe;IAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,OAAO,GAAY,MAAM,CAAA;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;gBAAE,MAAK;YAChC,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;QAChC,CAAC;QACD,IAAI,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAe,EAAE,MAAe;IACxD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IAChG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IAChG,MAAM,GAAG,GAAkB,EAAE,GAAG,MAAM,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"objectPath.js","sourceRoot":"","sources":["../../src/utils/objectPath.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,gFAAgF;AAChF,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACvE,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,MAAM,OAAO,GAAG,WAAW,CAAA;IAC3B,IAAI,KAAK,GAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtD,OAAO,KAAK,KAAK,IAAI,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACvB,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,MAAe,EAAE,IAAY,EAAE,YAAsB;IAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,OAAO,GAAY,MAAM,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO,YAAY,CAAA;QAC9C,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAA;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,MAAe,EAAE,IAAY;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,OAAO,GAAY,MAAM,CAAA;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3E,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CAAC,MAAqB,EAAE,IAAY,EAAE,KAAc;IACzE,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IACjC,6EAA6E;IAC7E,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAA;IAC3B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IACrC,IAAI,OAAO,GAAkB,MAAM,CAAA;IACnC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,OAAO,GAAkB,EAAE,CAAA;YACjC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;YACtB,OAAO,GAAG,OAAO,CAAA;QACnB,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,IAAI,CAAA;QAChB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAA;IACrB,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAe,EAAE,KAAe;IACxD,MAAM,MAAM,GAAkB,EAAE,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;YAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IACzE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,MAAqB,EAAE,KAAe;IAC9D,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACtC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAA;QAC3B,IAAI,IAAI,KAAK,SAAS;YAAE,SAAQ;QAChC,IAAI,OAAO,GAAY,MAAM,CAAA;QAC7B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;gBAAE,MAAK;YAChC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;QACD,IAAI,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,MAAe,EAAE,MAAe;IACxD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IAChG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;IAChG,MAAM,GAAG,GAAkB,EAAE,GAAG,MAAM,EAAE,CAAA;IACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/ream",
-  "version": "0.2.14",
+  "version": "0.2.16",
   "description": "Ream — Rust-powered Node.js application framework",
   "license": "MIT",
   "type": "module",
@@ -187,6 +187,14 @@
     "./swcrc.app.json": "./swcrc.app.json",
     "./tsconfig.package.json": "./tsconfig.package.json",
     "./tsconfig.client.json": "./tsconfig.client.json",
+    "./session/config": {
+      "types": "./dist/session/config.d.ts",
+      "import": "./dist/session/config.js"
+    },
+    "./bodyparser/config": {
+      "types": "./dist/bodyparser/config.d.ts",
+      "import": "./dist/bodyparser/config.js"
+    },
     "./session_middleware": {
       "types": "./dist/session/SessionMiddleware.d.ts",
       "import": "./dist/session/SessionMiddleware.js"
@@ -228,9 +236,10 @@
     }
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.10",
+    "@biomejs/biome": "2.5.12",
     "@c9up/comet": "^0.1.0",
     "@types/node": "^22.19.15",
+    "@vitest/coverage-v8": "^4.1.6",
     "mime-db": "^1.54.0",
     "mime-types": "^3.0.2",
     "typescript": "^6.0.2",
@@ -254,9 +263,9 @@
     "build:napi": "pnpm build:rust && pnpm build:napi-types && node scripts/copy-napi.mjs",
     "test": "vitest run",
     "test:rust": "cargo test --all",
-    "lint": "biome check src/",
+    "lint": "biome check src/ tests/",
     "test:coverage": "vitest run --coverage",
     "typecheck": "tsc --noEmit",
-    "typecheck:console-tests": "tsc --noEmit -p tsconfig.tests.json"
+    "typecheck:tests": "tsc --noEmit -p tsconfig.tests.json"
   }
 }

package/scripts/build-napi-types.mjs

@@ -7,7 +7,8 @@
  * cargo a `/tmp/...` path the native proc-macro cannot write to, so the
  * type-def file comes back empty and the build fails for no visible reason.
  *
- * One crate at a time on purpose: napi-derive APPENDS to `TYPE_DEF_TMP_PATH`
+ * One crate at a time on purpose: with napi-derive 2 the writes all went to a
+ * single `TYPE_DEF_TMP_PATH` and a parallel build interleaved them
  * while cargo compiles, and a parallel build interleaves the writes —
  * definitions go missing, silently, and the generated file comes out short.
  */
@@ -28,11 +29,11 @@ const scratch = mkdtempSync(join(tmpdir(), 'napi-types-'))
 try {
   const lines = []
   for (const crate of CRATES) {
-    const perCrate = join(scratch, `${crate}.jsonl`)
+    const perCrate = join(scratch, crate)
     writeFileSync(perCrate, '')
     execFileSync('cargo', ['build', '-p', crate], {
       cwd: packageRoot,
-      env: { ...process.env, TYPE_DEF_TMP_PATH: perCrate },
+      env: { ...process.env, NAPI_TYPE_DEF_TMP_FOLDER: scratch },
       stdio: ['ignore', 'ignore', 'inherit'],
     })
     const emitted = readFileSync(perCrate, 'utf8').split('\n').filter(Boolean)

package/scripts/generate-napi-types.mjs

@@ -29,27 +29,40 @@ import { readFileSync, writeFileSync } from 'node:fs'
  * entry must match, or the script fails: a stale refinement is how a hand
  * annotation quietly stops describing the Rust.
  */
+/**
+ * napi-derive 3 emits `callback: (arg: unknown) => unknown` where 2 emitted
+ * `(...args: any[]) => any` — better, since it no longer reaches for `any`,
+ * but a different string to match on. These refinements exist because the
+ * generated shape says nothing about what the callback actually receives.
+ */
 const CALLBACK_REFINEMENTS = {
   'EventBus.subscribe': {
-    from: 'callback: (...args: any[]) => any',
+    from: 'callback: (arg: unknown) => unknown',
     to: 'callback: (eventJson: string) => void',
   },
   'EventBus.onRequest': {
-    from: 'callback: (...args: any[]) => any',
+    from: 'callback: (arg: unknown) => unknown',
     to: 'callback: (eventJson: string, reply: (response: string) => void) => void',
   },
   'HyperServer.onRequest': {
-    from: 'callback: (...args: any[]) => any',
-    to: 'callback: (request: string) => Promise<string> | string',
+    // Only the argument is named. The `to` used to say
+    // `(request: string) => Promise<string> | string`, which described the
+    // boundary as it was BEFORE it stopped serialising: the Rust hands the
+    // handler a JsObject and awaits a `NapiResponse`, and napi's own output
+    // already said so. The refinement was overwriting a correct shape with a
+    // stale one, and nothing noticed because every caller of `onRequest` was
+    // outside the typecheck.
+    from: 'callback: (arg: unknown) => Promise<NapiResponse>',
+    to: 'callback: (request: Record<string, unknown>) => Promise<NapiResponse>',
   },
   'HyperServer.onStreamDisconnect': {
-    from: 'callback: (...args: any[]) => any',
+    from: 'callback: (arg: unknown) => unknown',
     to: 'callback: (streamId: string) => void',
   },
   // The Rust hands over a serialised JsTaskPayload — `{ task_name,
   // scheduled_for_ms }` renamed to camelCase by serde.
   'RustScheduler.register': {
-    from: 'callback: (...args: any[]) => any',
+    from: 'callback: (arg: unknown) => unknown',
     to: 'callback: (invocation: { taskName: string; scheduledForMs: number }) => void',
   },
 }
@@ -150,12 +163,15 @@ for (const fn of fns) {
   // napi-derive emits the whole declaration for a function, unlike a struct
   // where `def` holds only the members.
   const declaration = fn.def.trim()
-  out.push(
-    declaration.startsWith('export declare function')
-      ? `${declaration};`
-      : `export declare function ${fn.name}${declaration};`,
-    '',
-  )
+  // napi-derive 3 emits a bare `function name(...)` where 2 emitted the
+  // signature after the name; concatenating onto the former produced
+  // `function xfunction x(...)`.
+  const rendered = declaration.startsWith('export declare function')
+    ? declaration
+    : declaration.startsWith('function ')
+      ? `export declare ${declaration}`
+      : `export declare function ${fn.name}${declaration}`
+  out.push(`${rendered};`, '')
 }
 
 const stale = Object.keys(CALLBACK_REFINEMENTS).filter((k) => !used.has(k))

package/src/Application.ts

@@ -181,7 +181,12 @@ export class Application implements AppContext {
 
   /** Resolve inside one of the conventional directories. */
   #inDirectory(key: keyof DirectoriesNode, paths: string[]): string {
-    return this.makePath(this.#directories[key], ...paths)
+    // `DirectoriesNode` is an index signature, so a key nobody registered
+    // reads as undefined rather than failing to compile. Falling back to the
+    // key itself keeps the convention: `configPath()` under a node with no
+    // `config` entry resolves to `<root>/config`, which is where it would
+    // have been anyway.
+    return this.makePath(this.#directories[key] ?? String(key), ...paths)
   }
 
   /** Absolute path inside the `config/` directory. */

package/src/Ignitor.ts

@@ -210,6 +210,15 @@ export interface HyperServerLike {
 }
 
 export interface IgnitorConfig {
+  /**
+   * Bind port. Falls back to `process.env.PORT`, then to `3000`. Prefer the
+   * environment: the fallback is read when the server binds, AFTER `booting()`
+   * has loaded `#start/env`, whereas a value passed here is fixed at
+   * construction — before `.env` has been read at all.
+   *
+   * It stays available because a test harness booting several applications in
+   * one process needs to hand each one an ephemeral port it has already picked.
+   */
   port?: number
   /**
    * Bind address of the HTTP server. Falls back to `process.env.HOST`, then to
@@ -690,12 +699,31 @@ export class Ignitor {
     this.#phase = 'started'
   }
 
+  /**
+   * Whether this process should bind an HTTP server.
+   *
+   * Not the same question as "is the environment 'web'". A test harness needs
+   * the HTTP surface — it passes a `serverFactory` precisely to get one — but
+   * it also needs to declare itself as `test`, because that is what an
+   * environment-scoped provider entry reads. Tying the two together forced a
+   * test bootstrap to call `httpServer()`, which set the environment to
+   * `'web'`, so `{ environment: ['web'] }` excluded nothing from a test run and
+   * a scheduled task fired in the middle of the suite.
+   *
+   * A test process that passes no factory still gets no server, and no error.
+   */
+  #servesHttp(): boolean {
+    const environment = this.#app.getEnvironment()
+    if (environment === 'web') return true
+    return environment === 'test' && this.#config.serverFactory !== undefined
+  }
+
   async #phaseReady(): Promise<void> {
     // Boot the Server (resolves lazy error handler etc.)
     await this.#server.boot()
 
-    // Start HTTP server if in web mode
-    if (this.#app.getEnvironment() === 'web' && this.#config.serverFactory) {
+    // Start HTTP server if this process serves one
+    if (this.#servesHttp() && this.#config.serverFactory) {
       // Build the HttpKernel with server middleware + router middleware.
       // The streaming backend is resolved lazily — the HyperServer is
       // created a few lines down, after the kernel — so the kernel
@@ -737,7 +765,18 @@ export class Ignitor {
         },
       })
 
-      const desiredPort = this.#config.port ?? 3000
+      // Read HERE, not at construction: `#start/env` runs in `booting()`, so a
+      // PORT living in `.env` does not exist in `process.env` until this point.
+      // Reading it early bound 3000 while every later reader — the boot banner
+      // included — saw 3007 and said so. Same lazy rule as `host` below.
+      const desiredPort = this.#config.port ?? Number(process.env.PORT || 3000)
+      if (!Number.isInteger(desiredPort) || desiredPort < 0 || desiredPort > 65535) {
+        throw new ReamError(
+          'E_IGNITOR_INVALID_PORT',
+          `PORT must be an integer between 0 and 65535, received '${process.env.PORT}'.`,
+          { hint: 'Set PORT in .env, or pass { port } to the Ignitor.' },
+        )
+      }
       // Port-scan fallback (+1..+19) is a DEV convenience only. In production
       // a silent drift to :3001 while the LB targets :3000 is an outage —
       // bind the configured port and let EADDRINUSE fail loudly. The probe

package/src/Provider.ts

@@ -7,12 +7,31 @@
  *   register() → boot() → start() → ready() → ... → shutdown()
  */
 
-import type { ConfigStore } from './ConfigLoader.js'
 import type { Container } from './container/Container.js'
 
+/**
+ * The config a provider reads, as a CONTRACT rather than as the class.
+ *
+ * `ConfigStore` satisfies it, so nothing that holds a real one changes. But
+ * typed as the class, `AppContext` demanded a private `#tree` no one outside
+ * `ConfigLoader` can produce — so a test could not substitute a config, and an
+ * independently-published package could not describe an `AppContext` at all
+ * without importing `@c9up/ream`, which is the coupling the comment below this
+ * one exists to avoid. bay, station and blackhole each re-declared their own
+ * for exactly that reason.
+ *
+ * `get` and `set` are what providers actually use; a `ConfigStore`'s other
+ * methods stay reachable on the concrete type.
+ */
+export interface ConfigReader {
+  get<T = unknown>(key: string): T | undefined
+  get<T = unknown>(key: string, defaultValue: T): T
+  set(key: string, value: unknown): void
+}
+
 export interface AppContext {
   container: Container
-  config: ConfigStore
+  config: ConfigReader
 }
 
 /**

package/src/bodyparser/BodyParserMiddleware.ts

@@ -6,6 +6,7 @@
  * Configured via config/bodyparser.ts.
  */
 
+import { readModuleConfig } from '../config/moduleConfig.js'
 import { Exception } from '../http/Exception.js'
 import type { HttpContext } from '../http/HttpContext.js'
 import { hydrateMultipartPayload } from './MultipartFile.js'
@@ -98,7 +99,17 @@ const DEFAULT_CONFIG: ResolvedBodyParserConfig = {
 export default class BodyParserMiddleware {
   #config: ResolvedBodyParserConfig
 
-  constructor(config?: BodyParserConfig) {
+  constructor(explicitConfig: BodyParserConfig | undefined = undefined) {
+    // The default value is load-bearing: an OPTIONAL parameter still counts
+    // toward `Function.length`, and the container refuses to auto-construct a
+    // class that declares parameters it has no metadata for. A parameter with a
+    // default counts for nothing, which is what lets
+    // `router.use([() => import('…')])` build this middleware.
+    // Nothing is passed when the container builds this middleware from
+    // `router.use([() => import('@c9up/ream/bodyparser_middleware')])`, so the
+    // settings come from `config/bodyparser.ts` — the file this class's own
+    // documentation has always named.
+    const config = explicitConfig ?? readModuleConfig<BodyParserConfig>('bodyparser')
     assertNoEnabledFlag(config)
     this.#config = {
       allowedMethods: config?.allowedMethods ?? DEFAULT_CONFIG.allowedMethods,

package/src/bodyparser/MultipartFile.ts

@@ -125,7 +125,10 @@ export class MultipartFile {
   #mimeParts(): [string | undefined, string | undefined] {
     const source = this.#detected?.mime ?? this.#headerMime
     if (!source) return [undefined, undefined]
-    const [type, subtype] = source.split(';')[0].trim().split('/')
+    // `split` always yields a first element; naming it is how that stops
+    // being something the compiler has to be told.
+    const [head = ''] = source.split(';')
+    const [type, subtype] = head.trim().split('/')
     return [type || undefined, subtype || undefined]
   }
 
@@ -432,8 +435,9 @@ function isSafeFilename(name: string): boolean {
 function parseFileSize(size: string): number {
   const match = size.match(/^(\d+)(kb|mb|gb)?$/i)
   if (!match) return 1024 * 1024
-  const num = parseInt(match[1], 10)
-  switch (match[2]?.toLowerCase()) {
+  const [, digits, unit] = match
+  const num = parseInt(digits ?? '0', 10)
+  switch (unit?.toLowerCase()) {
     case 'kb':
       return num * 1024
     case 'mb':

package/src/bodyparser/config.ts

@@ -0,0 +1,18 @@
+/**
+ * `config/bodyparser.ts` — body-parsing limits and types, in the file the
+ * config loader reads (`config/<name>.ts` → `config.get('<name>')`).
+ *
+ * @example
+ *   // config/bodyparser.ts
+ *   import { defineConfig } from '@c9up/ream/bodyparser/config'
+ *
+ *   export default defineConfig({
+ *     multipart: { limit: '20mb' },
+ *   })
+ */
+
+import type { BodyParserConfig } from './BodyParserMiddleware.js'
+
+export function defineConfig(config: BodyParserConfig): BodyParserConfig {
+  return config
+}

package/src/bodyparser/parseSize.ts

@@ -6,8 +6,9 @@
 export function parseSize(size: string): number {
   const match = size.match(/^(\d+)(kb|mb|gb)?$/i)
   if (!match) return 1024 * 1024 // default 1mb
-  const num = parseInt(match[1], 10)
-  switch (match[2]?.toLowerCase()) {
+  const [, digits, unit] = match
+  const num = parseInt(digits ?? '0', 10)
+  switch (unit?.toLowerCase()) {
     case 'kb':
       return num * 1024
     case 'mb':

package/src/commands/MigrateBase.ts

@@ -19,7 +19,10 @@ import type { MigrationRegistry } from '../migrations/MigrationRegistry.js'
 import type { RegisteredMigrationSource } from '../migrations/types.js'
 
 export abstract class MigrateBase extends BaseCommand {
-  static override options: CommandOptions = { startApp: true }
+  // `drivesMigrations` because these three ARE the migration run: without it the
+  // boot applies everything first, so `migrate` says "nothing to migrate" after
+  // the work is done, and `migrate:status` mutates the schema it reports on.
+  static override options: CommandOptions = { startApp: true, drivesMigrations: true }
 
   @flags.string({
     description: 'Only this migration source, by the name its package registered',

package/src/config/moduleConfig.ts

@@ -0,0 +1,24 @@
+/**
+ * Reading a module's own `config/<name>.ts` entry without demanding one.
+ *
+ * A middleware constructed by the container gets nothing passed to it — the
+ * resolver calls `make(Class)`, which is what makes `router.use([() =>
+ * import('…/session_middleware')])` possible. The configuration therefore has
+ * to come from the config store, the way it does everywhere else.
+ *
+ * The read is deliberately forgiving. The same classes are also constructed
+ * directly (`new BodyParserMiddleware()`) in tests and in embedding hosts that
+ * never boot an Application, and there the store does not exist. Throwing there
+ * would trade a working default for a crash.
+ */
+
+import { getApp } from '../services/app.js'
+
+export function readModuleConfig<T extends object>(key: string): T | undefined {
+  const store = getApp()?.config
+  if (store === undefined || !store.has(key)) return undefined
+  const value = store.get<T>(key)
+  // A config file exporting something that is not an object (a stray
+  // `export default 42`) is ignored rather than spread over the defaults.
+  return typeof value === 'object' && value !== null ? value : undefined
+}

package/src/console/BaseCommand.ts

@@ -117,7 +117,7 @@ export abstract class BaseCommand {
   error?: unknown
 
   /** Assigned by the kernel — see {@link terminate}. */
-  protected declare onTerminate?: () => void | Promise<void>
+  declare protected onTerminate?: () => void | Promise<void>
 
   /**
    * Lifecycle hooks, run in this order around `run()`: `prepare`, `interact`,

package/src/console/Kernel.ts

@@ -999,6 +999,14 @@ export class Kernel {
       )
     }
 
+    // Before the boot, not after: a data package that migrates on boot for the
+    // convenience of `dev` would otherwise apply everything a moment before the
+    // command that exists to apply it runs — leaving `migrate` with nothing to
+    // report and `migrate:status` having changed what it was asked to look at.
+    if (Command.options?.drivesMigrations === true) {
+      process.env.REAM_SKIP_BOOT_MIGRATE = '1'
+    }
+
     return this.#startApp()
   }
 

package/src/console/cliui.ts

@@ -750,7 +750,8 @@ function pad(text: string, width: number): string {
   return text + ' '.repeat(Math.max(0, width - visibleWidth(text)))
 }
 
-function stripAnsi(text: string): string {
+/** Removes the SGR escape sequences `colors` writes, leaving the visible text. */
+export function stripAnsi(text: string): string {
   // biome-ignore lint/suspicious/noControlCharactersInRegex: matching ANSI escapes is the point
   return text.replace(/\u001B\[[0-9;]*m/g, '')
 }

package/src/console/types.ts

@@ -37,6 +37,21 @@ export interface CommandOptions {
    * default so a typo (`--warm` for `--warn`) is reported, not swallowed.
    */
   allowUnknownFlags?: boolean
+
+  /**
+   * This command drives migrations itself, so booting must not run them.
+   *
+   * A data package may migrate on boot for the convenience of `dev` — atlas
+   * does, outside production. For the commands that exist to migrate, that
+   * convenience is the bug: the boot applies everything, and then `migrate`
+   * reports "nothing to migrate" while `migrate:status`, asked only to look,
+   * has changed the schema it is reporting on.
+   *
+   * Declaring this sets `REAM_SKIP_BOOT_MIGRATE=1` before the application
+   * starts, which is the flag a data package watches for. Any package's own
+   * migration command opts in the same way; the framework names none of them.
+   */
+  drivesMigrations?: boolean
 }
 
 /** Metadata recorded by an `@args.*` decorator. */

package/src/container/Container.ts

@@ -63,7 +63,7 @@ interface ResolutionChain {
    * down. Saved and restored around each construction, so a dependency's own
    * dependencies see IT as their parent, not its parent.
    */
-  parent?: new (
+  parent?: abstract new (
     ...args: never[]
   ) => unknown
 }
@@ -91,8 +91,12 @@ export class Container {
   /** Alias key → the token it forwards to (AdonisJS `container.alias`). */
   #aliases: Map<ServiceToken, ServiceToken> = new Map()
   /** parent class → (binding key → the factory that class gets instead). */
-  #contextualBindings: Map<new (...args: never[]) => unknown, Map<ServiceToken, ServiceFactory>> =
-    new Map()
+  #contextualBindings: Map<
+    abstract new (
+      ...args: never[]
+    ) => unknown,
+    Map<ServiceToken, ServiceFactory>
+  > = new Map()
   /** token key → post-resolution callbacks (AdonisJS `container.resolving`). */
   #resolvingHooks: Map<ServiceToken, Array<(value: unknown) => void | Promise<void>>> = new Map()
   /**
@@ -625,7 +629,7 @@ export class Container {
    * 3. No params → plain `new Class()`
    */
   async #autoConstruct(
-    target: new (...args: never[]) => unknown,
+    target: abstract new (...args: never[]) => unknown,
     runtimeValues?: unknown[],
   ): Promise<unknown> {
     // Everything resolved inside is a dependency OF `target`, which is what a
@@ -642,7 +646,7 @@ export class Container {
   }
 
   async #constructWithDeps(
-    target: new (...args: never[]) => unknown,
+    target: abstract new (...args: never[]) => unknown,
     runtimeValues?: unknown[],
   ): Promise<unknown> {
     const metadata = getServiceMetadata(target)
@@ -719,7 +723,12 @@ export class Container {
         )
       }
       // (d) Genuine zero-argument class.
-      const instance = new target()
+      //
+      // `Reflect.construct`, not `new target()`: a token may be an abstract
+      // class (that is what a contextual binding binds against), and `new` on
+      // one is a compile error even though the runtime constructs it happily —
+      // `abstract` exists only at compile time.
+      const instance = Reflect.construct(target, [])
       this.#cacheIfAppWide(scope, key, instance, store, readsBefore)
       return instance
     }

package/src/container/types.ts

@@ -16,7 +16,17 @@ export interface ServiceMetadata {
 /** Token used to resolve a service — class constructor, string name, or registered symbol. */
 // `never[]` accepts every constructor shape — parameters are contravariant, so
 // a rest of `never` is assignable from any concrete list.
-export type ServiceToken = (new (...args: never[]) => unknown) | string | symbol
+/**
+ * What the container accepts as a token.
+ *
+ * `abstract new`, not `new`: binding an implementation against an abstract base
+ * is the whole point of a contextual binding — `@Inject(Hash)` where `Hash` is
+ * the abstract class and `Bcrypt` is what the container provides. An abstract
+ * class has no construct signature, so spelt `new (...)` the type rejected
+ * exactly the pattern the feature exists for. `abstract new` admits concrete
+ * classes too.
+ */
+export type ServiceToken = (abstract new (...args: never[]) => unknown) | string | symbol
 
 /**
  * What a binding factory is handed so it can resolve its own dependencies

package/src/decorators/Service.ts

@@ -14,7 +14,7 @@ const INJECT_METADATA_KEY = Symbol('ream:inject')
 // `never[]` accepts every constructor shape: parameters are contravariant, so a
 // rest of `never` is assignable from any concrete list. Same spelling as the
 // router's, so a class flows between the two without an assertion.
-type AnyConstructor = new (...args: never[]) => unknown
+type AnyConstructor = abstract new (...args: never[]) => unknown
 
 /** Registry of all decorated services. */
 const serviceRegistry: Map<AnyConstructor, ServiceMetadata> = new Map()