@c9up/ream 0.2.14 → 0.2.16

package/src/env/Env.ts

@@ -108,9 +108,11 @@ export class Env<Values extends Record<string, unknown>> {
       validate(values: Record<string, string | undefined>): EnvRecord<S> {
         const failures: string[] = []
         const collected: Record<string, unknown> = {}
-        for (const key of Object.keys(schema)) {
+        // `entries` rather than `keys` plus a lookup: the validator comes back
+        // already known to be there instead of read again as maybe-missing.
+        for (const [key, node] of Object.entries(schema)) {
           try {
-            collected[key] = schema[key].validate(key, values[key])
+            collected[key] = node.validate(key, values[key])
           } catch (err) {
             failures.push(err instanceof Error ? err.message : String(err))
           }

package/src/env/interpolate.ts

@@ -46,9 +46,11 @@ export function interpolate(value: string, lookup: (name: string) => string | un
   })
 
   const prefixed = /^([A-Za-z_][A-Za-z0-9_]*):([\s\S]*)$/.exec(substituted)
-  if (prefixed) {
-    const resolver = identifiers.get(prefixed[1])
-    if (resolver) return resolver(prefixed[2])
+  // Both groups are required by the pattern, so a match carries both.
+  const [, identifier, rest] = prefixed ?? []
+  if (identifier !== undefined && rest !== undefined) {
+    const resolver = identifiers.get(identifier)
+    if (resolver) return resolver(rest)
   }
   return substituted
 }

package/src/errors/FuzzyMatcher.ts

@@ -14,23 +14,43 @@ export function levenshtein(a: string, b: string): number {
   if (m === 0) return n
   if (n === 0) return m
 
-  const dp: number[][] = Array.from({ length: m + 1 }, () => Array<number>(n + 1).fill(0))
-
-  for (let i = 0; i <= m; i++) dp[i][0] = i
-  for (let j = 0; j <= n; j++) dp[0][j] = j
+  // Two rows rather than the whole matrix: the recurrence only ever reads the
+  // row above and the cell to the left, so the rest was allocated and never
+  // looked at again.
+  let previous: number[] = Array.from({ length: n + 1 }, (_, j) => j)
 
   for (let i = 1; i <= m; i++) {
+    const current: number[] = [i]
     for (let j = 1; j <= n; j++) {
       const cost = a[i - 1] === b[j - 1] ? 0 : 1
-      dp[i][j] = Math.min(
-        dp[i - 1][j] + 1, // deletion
-        dp[i][j - 1] + 1, // insertion
-        dp[i - 1][j - 1] + cost, // substitution
+      current.push(
+        Math.min(
+          cell(previous, j) + 1, // deletion
+          cell(current, j - 1) + 1, // insertion
+          cell(previous, j - 1) + cost, // substitution
+        ),
       )
     }
+    previous = current
   }
 
-  return dp[m][n]
+  return cell(previous, n)
+}
+
+/**
+ * One cell of a row that has already been filled.
+ *
+ * Each row is built left to right and every column is written before it is
+ * read, so a miss cannot happen — and this is where that invariant is stated
+ * rather than asserted past it. Reading the row directly would have every
+ * access typed "a number, or nothing", which is not what the algorithm knows.
+ */
+function cell(row: number[], index: number): number {
+  const value = row[index]
+  if (value === undefined) {
+    throw new RangeError(`levenshtein: column ${index} was read before it was written`)
+  }
+  return value
 }
 
 /**
@@ -81,12 +101,13 @@ export function findClosestMatches(
  * @returns Formatted suggestion string, or empty string if no matches
  */
 export function didYouMean(input: string, candidates: string[]): string {
-  const matches = findClosestMatches(input, candidates)
-  if (matches.length === 0) return ''
+  const [best, ...rest] = findClosestMatches(input, candidates)
+  if (best === undefined) return ''
 
-  if (matches.length === 1) {
-    return `Did you mean '${matches[0].candidate}'?`
+  if (rest.length === 0) {
+    return `Did you mean '${best.candidate}'?`
   }
+  const matches = [best, ...rest]
 
   const suggestions = matches.map((m) => `'${m.candidate}'`).join(', ')
   return `Did you mean one of: ${suggestions}?`

package/src/errors/PipelineStageError.ts

@@ -42,9 +42,11 @@ export function createPipelineError(
 ): ReamError {
   const total = PIPELINE_STAGES.length
   const clampedIndex = Math.max(0, Math.min(stageIndex, total - 1))
-  const stageName = PIPELINE_STAGES[clampedIndex]
+  // The index is clamped into the list just above, so the lookup lands — the
+  // fallback is what says so without asserting past the read.
+  const stageName = PIPELINE_STAGES[clampedIndex] ?? '(unknown)'
   const position = `${clampedIndex + 1}/${total}`
-  const nextStage = clampedIndex + 1 < total ? PIPELINE_STAGES[clampedIndex + 1] : '(end)'
+  const nextStage = PIPELINE_STAGES[clampedIndex + 1] ?? '(end)'
 
   const errorCode = originalError instanceof ReamError ? originalError.code : 'E_PIPELINE_ERROR'
 

package/src/events/Emitter.ts

@@ -23,14 +23,25 @@ const correlationStorage = new AsyncLocalStorage<string | undefined>()
  * Listener class interface — must have a handle() method.
  */
 export interface ListenerClass<T = unknown> {
-  handle(event: T): Promise<void> | void
+  handle(event: T): unknown
 }
 
 type EventConstructor<T = unknown> = new (...args: never[]) => T
 
-type ListenerFn<T = unknown> = (event: T) => Promise<void> | void
+/**
+ * A listener. Whatever it returns is awaited and dropped.
+ *
+ * `unknown`, not `Promise<void> | void`: a bare `void` return type accepts a
+ * function returning anything, but a UNION containing it does not — so
+ * `emitter.on('x', (d) => received.push(d))` was a type error for returning
+ * what `push` returns, which nothing reads.
+ */
+type ListenerFn<T = unknown> = (event: T) => unknown
 
-type ListenerConstructor<T = unknown> = new (...args: never[]) => ListenerClass<T>
+// `abstract new`: a listener bound against an abstract base is as valid a
+// registration as one bound against a concrete class, and the container builds
+// either.
+type ListenerConstructor<T = unknown> = abstract new (...args: never[]) => ListenerClass<T>
 
 type Listener<T = unknown> = ListenerFn<T> | ListenerConstructor<T>
 
@@ -41,7 +52,16 @@ type Listener<T = unknown> = ListenerFn<T> | ListenerConstructor<T>
  * satisfies it.
  */
 export interface EmitterResolver {
-  make<T>(target: new (...args: never[]) => T): Promise<T>
+  /**
+   * Build a listener.
+   *
+   * Not generic: a generic method must work for every `T`, so nothing but a
+   * real container could implement it — the fake in the tests could not, and
+   * this file's own call site reached for `as ListenerConstructor<T>` to get
+   * past it. What comes back is checked below, which is what a container's
+   * answer deserves anyway.
+   */
+  make(target: abstract new (...args: never[]) => object): Promise<object>
 }
 
 /**
@@ -327,9 +347,15 @@ export class Emitter {
         if (isListenerClass(listener)) {
           // Listener class — resolve via container for @inject() support
           const instance = this.#resolver
-            ? await this.#resolver.make(listener as ListenerConstructor<T>)
-            : new (listener as ListenerConstructor<T>)()
-          await instance.handle(event)
+            ? await this.#resolver.make(listener)
+            : Reflect.construct(listener, [])
+          const handle = Reflect.get(instance, 'handle')
+          if (typeof handle !== 'function') {
+            throw new Error(
+              `Listener ${String(Reflect.get(listener, 'name'))} resolved to something with no handle()`,
+            )
+          }
+          await handle.call(instance, event)
         } else {
           await (listener as ListenerFn<T>)(event)
         }
@@ -651,7 +677,7 @@ function classToEventName(cls: EventConstructor): string {
 }
 
 /** Check if a listener entry is a class (has prototype.handle) vs a function. */
-function isListenerClass(listener: Listener): boolean {
+function isListenerClass(listener: Listener): listener is ListenerConstructor {
   return typeof listener === 'function' && typeof listener.prototype?.handle === 'function'
 }
 

package/src/events/testing/FakeBus.ts

@@ -41,10 +41,17 @@ export type FakeBusPredicateArg = FakeBusPredicate | ((event: CapturedEmit) => b
 
 interface Subscription {
   pattern: string
-  /** Subscribers may return `void` (sync) or `PromiseLike<void>` (async).
-   *  Async rejections are logged via `console.error` to keep them from
-   *  escaping to `unhandledRejection`. */
-  callback: (eventJson: string) => void | PromiseLike<void>
+  /**
+   * Subscribers may be sync or async; whatever they return is awaited and
+   * dropped, and an async rejection is logged via `console.error` rather than
+   * escaping to `unhandledRejection`.
+   *
+   * `unknown`, not `void | PromiseLike<void>`: a bare `void` return type
+   * accepts a function returning anything, but a UNION containing it does not
+   * — so widening the native bus's `=> void` to that union made it NARROWER in
+   * practice, and `(json) => received.push(json)` stopped compiling.
+   */
+  callback: (eventJson: string) => unknown
 }
 
 /** Request handler may return `void` (sync, fire-and-forget after `reply`)
@@ -106,7 +113,7 @@ export class FakeBus {
     return Promise.resolve('ok')
   }
 
-  subscribe(pattern: string, callback: (eventJson: string) => void | PromiseLike<void>): number {
+  subscribe(pattern: string, callback: (eventJson: string) => unknown): number {
     const id = this.#nextSubId++
     this.#subscribers.set(id, { pattern, callback })
     return id

package/src/graphql/GraphQLEngine.ts

@@ -182,7 +182,7 @@ export interface ResolverOptions {
 interface ResolverEntry {
   typeName: string
   fieldName: string
-  handlerClass: new (...args: unknown[]) => Record<string, (...args: unknown[]) => unknown>
+  handlerClass: abstract new (...args: never[]) => object
   methodName: string
   options: ResolverOptions
 }
@@ -204,7 +204,7 @@ export interface SelectionField {
 export class GraphQLEngine {
   #schemaSource: string
   #resolvers: Map<string, ResolverEntry> = new Map()
-  #container?: { make<T>(target: new (...args: unknown[]) => T): Promise<T> }
+  #container?: { make<T>(target: abstract new (...args: never[]) => T): Promise<T> }
   readonly path: string
   #playground: boolean
   #maxQueryBytes: number
@@ -239,7 +239,9 @@ export class GraphQLEngine {
   }
 
   /** Set IoC container for resolver instantiation. */
-  useContainer(container: { make<T>(target: new (...args: unknown[]) => T): Promise<T> }): void {
+  useContainer(container: {
+    make<T>(target: abstract new (...args: never[]) => T): Promise<T>
+  }): void {
     this.#container = container
   }
 
@@ -247,7 +249,7 @@ export class GraphQLEngine {
   resolver(
     typeName: string,
     fieldName: string,
-    handlerClass: new (...args: unknown[]) => Record<string, (...args: unknown[]) => unknown>,
+    handlerClass: abstract new (...args: never[]) => object,
     methodName: string,
     options?: ResolverOptions,
   ): void {
@@ -369,11 +371,13 @@ export class GraphQLEngine {
 
     try {
       // Resolve handler via IoC or direct instantiation.
-      const instance = this.#container
+      // `Reflect.construct`, not `new`: the resolver may be an abstract class,
+      // which the runtime builds happily and `new` refuses at compile time.
+      const instance: object = this.#container
         ? await this.#container.make(entry.handlerClass)
-        : new entry.handlerClass()
+        : Reflect.construct(entry.handlerClass, [])
 
-      const handler = instance[entry.methodName]
+      const handler = Reflect.get(instance, entry.methodName)
       if (typeof handler !== 'function') {
         return {
           ok: false,

package/src/helpers/bytes.ts

@@ -18,6 +18,11 @@ const UNITS = {
 
 type Unit = keyof typeof UNITS
 
+/** A suffix the table knows. Checked, so nothing has to be asserted. */
+function isUnit(value: string): value is Unit {
+  return value in UNITS
+}
+
 const PARSE = /^((?:-|\+)?(?:\d+(?:\.\d+)?)) *(kb|mb|gb|tb|pb)$/i
 /** Trailing `.00`, or the zeros trailing a real decimal. */
 const TRAILING_ZEROS = /(?:\.0*|(\.[^0]+)0+)$/
@@ -33,10 +38,16 @@ export function parse(value: string | number): number | null {
   if (typeof value !== 'string') return null
 
   const matched = PARSE.exec(value)
-  const amount = matched ? Number.parseFloat(matched[1]) : Number.parseInt(value, 10)
+  // Both groups are required by the pattern, so a match carries both — but
+  // read as `matched[2]` the second was typed "a string, or nothing", and the
+  // `as Unit` that followed asserted past exactly that. Named, with the
+  // suffix checked against the table it indexes, nothing is asserted.
+  const [, digits, suffix] = matched ?? []
+  const amount = digits !== undefined ? Number.parseFloat(digits) : Number.parseInt(value, 10)
   if (Number.isNaN(amount)) return null
 
-  const unit = (matched ? matched[2].toLowerCase() : 'b') as Unit
+  const unit = suffix === undefined ? 'b' : suffix.toLowerCase()
+  if (!isUnit(unit)) return null
   return Math.floor(UNITS[unit] * amount)
 }
 

package/src/helpers/string.ts

@@ -214,9 +214,9 @@ export function pluralize(word: string, count?: number): string {
  * @example humanize('user_name') // 'User name'
  */
 export function humanize(s: string): string {
-  const words = splitWords(s)
-  if (words.length === 0) return ''
-  return [words[0]?.charAt(0).toUpperCase() + words[0]?.slice(1), ...words.slice(1)].join(' ')
+  const [first, ...rest] = splitWords(s)
+  if (first === undefined) return ''
+  return [first.charAt(0).toUpperCase() + first.slice(1), ...rest].join(' ')
 }
 
 // ---------------------------------------------------------------------------

package/src/http/Exception.ts

@@ -315,8 +315,10 @@ export class ExceptionHandler extends Macroable {
   #expandStatusPages(): Record<number, StatusPageRenderer> {
     if (!this.#expandedStatusPages) {
       const expanded: Record<number, StatusPageRenderer> = {}
-      for (const range of Object.keys(this.statusPages)) {
-        Object.assign(expanded, parseStatusRange(range, this.statusPages[range]))
+      // `entries` rather than `keys` plus a lookup: the value comes back
+      // already known to be there, instead of read again as maybe-missing.
+      for (const [range, renderer] of Object.entries(this.statusPages)) {
+        Object.assign(expanded, parseStatusRange(range, renderer))
       }
       this.#expandedStatusPages = expanded
     }
@@ -440,13 +442,17 @@ export class ExceptionHandler extends Macroable {
   /**
    * Pick a renderer by content negotiation.
    *
-   * DEVIATION (named): ream lists `json` FIRST, so a request with no or `*` /`*`
-   * Accept defaults to JSON (API-first). AdonisJS lists `html` first
-   * (full-stack default). Explicit `text/html` / `vnd.api+json` are honoured
-   * identically.
+   * `html` is listed first, as AdonisJS does, so a request that states no
+   * preference — no `Accept` at all, or `*` /`*` — gets the error page rather
+   * than a JSON body. A browser always sends `text/html` and an API client
+   * always asks for JSON, so the order only decides for the clients in
+   * between: curl, a health probe, a proxy that stripped the header. For a
+   * framework that ships a view layer, a page is the better answer there.
+   *
+   * The fallback stays JSON, for a client that accepts none of the three.
    */
   async renderError(error: HttpError, ctx: HttpContext): Promise<void> {
-    switch (ctx.request.accepts(['json', 'html', 'application/vnd.api+json'])) {
+    switch (ctx.request.accepts(['html', 'json', 'application/vnd.api+json'])) {
       case 'application/vnd.api+json':
         return this.renderErrorAsJSONAPI(error, ctx)
       case 'html':
@@ -458,7 +464,7 @@ export class ExceptionHandler extends Macroable {
 
   /** Pick a validation renderer by content negotiation. */
   async renderValidationError(error: HttpError, ctx: HttpContext): Promise<void> {
-    switch (ctx.request.accepts(['json', 'html', 'application/vnd.api+json'])) {
+    switch (ctx.request.accepts(['html', 'json', 'application/vnd.api+json'])) {
       case 'application/vnd.api+json':
         return this.renderValidationErrorAsJSONAPI(error, ctx)
       case 'html':

package/src/http/Request.ts

@@ -272,7 +272,10 @@ export class Request extends Macroable {
   host(): string | null {
     if (this.#trustProxy) {
       const forwarded = this.#raw.headers['x-forwarded-host']
-      if (forwarded) return forwarded.split(',')[0].trim()
+      // The first hop in the list, named rather than indexed: `split` always
+      // yields one element, and saying so beats being told it might not.
+      const [first] = forwarded?.split(',') ?? []
+      if (first !== undefined) return first.trim()
     }
     return this.#raw.headers.host ?? null
   }
@@ -285,7 +288,8 @@ export class Request extends Macroable {
   protocol(): string {
     if (this.#trustProxy) {
       const forwarded = this.#raw.headers['x-forwarded-proto']
-      if (forwarded) return forwarded.split(',')[0].trim().toLowerCase()
+      const [first] = forwarded?.split(',') ?? []
+      if (first !== undefined) return first.trim().toLowerCase()
     }
     return this.#raw.scheme ?? 'http'
   }
@@ -900,9 +904,8 @@ export class Request extends Macroable {
     fieldName: string,
     options?: import('../bodyparser/MultipartFile.js').FileValidationOptions,
   ): import('../bodyparser/MultipartFile.js').MultipartFile | null {
-    const files = this.#files.get(fieldName)
-    if (!files || files.length === 0) return null
-    const file = files[0]
+    const [file] = this.#files.get(fieldName) ?? []
+    if (file === undefined) return null
     if (options) file.validate(options)
     return file
   }

package/src/http/mime.ts

@@ -1317,7 +1317,8 @@ const CHARSETS: Record<string, string> = {
 
 /** The charset for a type, or `undefined` when it carries none. */
 function charsetFor(type: string): string | undefined {
-  const base = type.split(';')[0].trim().toLowerCase()
+  const [head = ''] = type.split(';')
+  const base = head.trim().toLowerCase()
   const declared = CHARSETS[base]
   if (declared !== undefined) return declared
   return base.startsWith('text/') ? 'utf-8' : undefined

package/src/index.ts

@@ -254,7 +254,7 @@ export { ConsoleKernel, defineConfig, Ignitor, prettyPrintError } from './Ignito
 // ─── Providers ──────────────────────────────────────────────
 
 export { errors } from './errors/aggregate.js'
-export type { AppContext, ProviderContract } from './Provider.js'
+export type { AppContext, ConfigReader, ProviderContract } from './Provider.js'
 export { Provider } from './Provider.js'
 export type {
   AuthenticatorName,
@@ -378,4 +378,4 @@ export {
   StatsTracker,
 } from './scheduler/index.js'
 
-export const VERSION = '0.2.14'
+export const VERSION = '0.2.16'

package/src/native/generated.ts

@@ -87,8 +87,14 @@ export declare class HyperServer {
    * the safe default for a dev machine.
    */
   constructor(port?: number | undefined | null, host?: string | undefined | null)
-  /** Register the request handler. Callback receives JSON request string, must return JSON response string. */
-  onRequest(callback: (request: string) => Promise<string> | string): void
+  /**
+   * Register the request handler.
+   *
+   * The request arrives as an OBJECT (`serde_json::Value` → `JsObject`) and
+   * the handler answers with a `NapiResponse` object — not the JSON strings
+   * this comment described until the boundary stopped carrying them.
+   */
+  onRequest(callback: (request: Record<string, unknown>) => Promise<NapiResponse>): void
   /**
    * Configure the trusted-proxy CIDR list used by `request.ip` resolution.
    * Must be called BEFORE `listen()`. Empty list = legacy permissive mode
@@ -155,12 +161,10 @@ export declare class HyperServer {
    */
   writeStreamBytes(streamId: string, chunk: Uint8Array): Promise<boolean>
   /**
-  * Close a stream from the server side. The matching response body
-  * finishes cleanly (hyper writes the final chunk + `0
-  
-  ` for
-  * HTTP/1.1 chunked encoding). Idempotent.
-  */
+   * Close a stream from the server side. The matching response body
+   * finishes cleanly (hyper writes the final chunk + `0\r\n\r\n` for
+   * HTTP/1.1 chunked encoding). Idempotent.
+   */
   closeStream(streamId: string): Promise<boolean>
   /**
    * Install a one-shot callback fired the moment the matching stream

package/src/openapi/OpenApiGenerator.ts

@@ -170,9 +170,9 @@ export class OpenApiGenerator {
     }
 
     if (route.validators.length > 0 && ['post', 'put', 'patch'].includes(method)) {
-      const validatorName = route.validators[0]
-      const schema = this.#runeSchemas.get(validatorName)
-      if (schema) {
+      const [validatorName] = route.validators
+      const schema = validatorName === undefined ? undefined : this.#runeSchemas.get(validatorName)
+      if (schema && validatorName !== undefined) {
         operation.requestBody = {
           required: true,
           content: { 'application/json': { schema: this.#runeToJsonSchema(schema) } },
@@ -197,7 +197,9 @@ export class OpenApiGenerator {
   /** Extract parameter names from path. */
   #extractPathParams(path: string): string[] {
     const matches = path.matchAll(/:(\w+)\??/g)
-    return [...matches].map((m) => m[1])
+    // Group 1 is required by the pattern, so every match carries it; the
+    // filter is how that is stated instead of asserted.
+    return [...matches].map((m) => m[1]).filter((name) => name !== undefined)
   }
 
   /** Generate a summary from route metadata. */

package/src/router/Router.ts

@@ -25,7 +25,16 @@ export interface SignedUrlOptions {
 
 // ─── Types ──────────────────────────────────────────────────
 
-export type RouteHandlerFunction = (ctx: HttpContext) => Promise<void> | void
+/**
+ * A route handler. Whatever it returns is awaited and dropped — the response
+ * is written through `ctx.response`.
+ *
+ * `unknown`, not `Promise<void> | void`: a bare `void` return type accepts a
+ * function returning anything, but a UNION containing it does not, so
+ * `router.get('/x', () => 'ok')` was a type error for returning a value the
+ * kernel already ignores.
+ */
+export type RouteHandlerFunction = (ctx: HttpContext) => unknown
 
 /**
  * Controller tuple: [ControllerClass, 'methodName'].
@@ -267,7 +276,13 @@ export class RouteBuilder extends Macroable {
 
   /** The primary definition — accessors read from it (all verbs share pattern/name). */
   #primary(): RouteDefinition {
-    return this.#routes[0]
+    const [first] = this.#routes
+    if (first === undefined) {
+      // A route is constructed with at least one verb, so this cannot happen —
+      // and this is where that is stated rather than asserted past.
+      throw new Error('Route has no definitions')
+    }
+    return first
   }
 
   /** Name this route (for URL generation and redirects). */
@@ -1557,9 +1572,13 @@ function matchPath(pattern: string, actual: string): MatchedParams | null {
     const params: MatchedParams = {}
     for (let i = 0; i < wildcardIdx; i++) {
       const part = patternParts[i]
+      const actual = actualParts[i]
+      // Both are read out of arrays whose length was checked above; naming
+      // them is what turns that check into something the compiler shares.
+      if (part === undefined || actual === undefined) return null
       if (part.startsWith(':')) {
-        params[part.substring(1)] = safeDecodeURIComponent(actualParts[i])
-      } else if (part !== actualParts[i]) {
+        params[part.substring(1)] = safeDecodeURIComponent(actual)
+      } else if (part !== actual) {
         return null
       }
     }
@@ -1579,22 +1598,22 @@ function matchPath(pattern: string, actual: string): MatchedParams | null {
 
   const params: MatchedParams = {}
 
-  for (let i = 0; i < patternParts.length; i++) {
-    const part = patternParts[i]
+  for (const [i, part] of patternParts.entries()) {
     const isOptional = part.endsWith('?')
+    const actual = actualParts[i]
 
     if (part.startsWith(':')) {
       const paramName = isOptional ? part.slice(1, -1) : part.substring(1)
-      if (i < actualParts.length) {
+      if (actual !== undefined) {
         // Percent-decode the captured segment (query strings already are) so
         // `/users/Jos%C3%A9` yields `José` and matchers test the real value.
         // safeDecode falls back to the raw segment on malformed input.
-        params[paramName] = safeDecodeURIComponent(actualParts[i])
+        params[paramName] = safeDecodeURIComponent(actual)
       }
       // Optional param with no actual part — skip (param not set)
-    } else if (i < actualParts.length && part !== actualParts[i]) {
+    } else if (actual !== undefined && part !== actual) {
       return null
-    } else if (i >= actualParts.length && !isOptional) {
+    } else if (actual === undefined && !isOptional) {
       return null
     }
   }
@@ -1612,7 +1631,8 @@ function matchPath(pattern: string, actual: string): MatchedParams | null {
  * Comparing them verbatim sends that request to a fallback, or to a 404.
  */
 function matchDomain(pattern: string, host: string): boolean {
-  const actualHost = host.split(':')[0].toLowerCase() // strip port
+  const [hostname = ''] = host.split(':') // strip port
+  const actualHost = hostname.toLowerCase()
   const wanted = pattern.toLowerCase()
   if (wanted === actualHost) return true
   if (wanted.startsWith('*.')) {