@c9up/ream 0.2.18 → 0.2.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/ream",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "description": "Ream — Rust-powered Node.js application framework",
   "license": "MIT",
   "type": "module",
@@ -228,12 +228,12 @@
     "tsconfig.client.json"
   ],
   "dependencies": {
-    "file-type": "^22.0.1",
-    "reflect-metadata": "^0.2"
+    "file-type": "^22.0.2",
+    "reflect-metadata": "^0.2.2"
   },
   "peerDependencies": {
     "@c9up/comet": "^0.1.0",
-    "@c9up/quasar": "^0.1.0",
+    "@c9up/quasar": "^0.1.0 || ^0.2.0",
     "hot-hook": "^1.0.0"
   },
   "peerDependenciesMeta": {
@@ -250,12 +250,12 @@
   "devDependencies": {
     "@biomejs/biome": "2.5.12",
     "@c9up/comet": "^0.1.0",
-    "@types/node": "^22.19.15",
-    "@vitest/coverage-v8": "^4.1.6",
+    "@types/node": "^22.20.1",
+    "@vitest/coverage-v8": "4.1.11",
     "mime-db": "^1.54.0",
     "mime-types": "^3.0.2",
-    "typescript": "^6.0.2",
-    "vitest": "^4.1.6"
+    "typescript": "^6.0.3",
+    "vitest": "4.1.11"
   },
   "engines": {
     "node": ">=22.0.0"

package/scripts/copy-napi.mjs

@@ -21,7 +21,7 @@
 // crate listed in `NAPI_CRATES` ships in the tarball.
 
 import { copyFileSync, existsSync } from 'node:fs'
-import { dirname, join } from 'node:path'
+import { dirname, join, resolve } from 'node:path'
 import { arch, env, platform } from 'node:process'
 import { fileURLToPath } from 'node:url'
 
@@ -48,6 +48,14 @@ const HOST_SUFFIX_MAP = {
   'win32-x64': 'win32-x64-msvc',
 }
 
+// Cargo writes its artifacts under CARGO_TARGET_DIR when that is set — a
+// shared cache, a CI mount — so they are not under this package's `target/` at
+// all. A relative value is resolved against the directory cargo ran in, which
+// is this package root.
+const targetDir = env.CARGO_TARGET_DIR
+  ? resolve(root, env.CARGO_TARGET_DIR)
+  : join(root, 'target')
+
 const triple = env.CARGO_BUILD_TARGET ?? ''
 let suffix
 let os
@@ -59,11 +67,11 @@ if (triple) {
   }
   suffix = entry.suffix
   os = entry.os
-  releaseDir = join(root, 'target', triple, 'release')
+  releaseDir = join(targetDir, triple, 'release')
 } else {
   suffix = HOST_SUFFIX_MAP[`${platform}-${arch}`]
   os = platform
-  releaseDir = join(root, 'target', 'release')
+  releaseDir = join(targetDir, 'release')
   if (!suffix) {
     throw new Error(`[ream:napi] unsupported platform/arch: ${platform}-${arch}`)
   }

package/src/Application.ts

@@ -73,6 +73,21 @@ export interface ReamrcContents {
 export class Application implements AppContext {
   readonly container: Container
   readonly config: ConfigStore
+  /**
+   * Whether the inker template engine is installed (AdonisJS `usingEdgeJS`).
+   *
+   * Set by `InkerProvider`'s CONSTRUCTOR, so it is already true by the time any
+   * other provider boots. A package that wants to contribute to templates —
+   * rosetta pushing its `t()` global, say — reads this before importing
+   * `@c9up/inker`, and stays installable without it when the answer is no.
+   *
+   * A flag rather than a container lookup, and that is the whole point: the
+   * engine is a module singleton, so asking the container would mean resolving
+   * a binding whose lifecycle has to have reached the right phase. This answers
+   * the only question the caller actually has — is the package there — without
+   * one.
+   */
+  usingInker = false
   #appRoot?: URL
   #directories: DirectoriesNode = { ...defaultDirectories }
   #rcFile: ReamrcContents = {}

package/src/Provider.ts

@@ -32,6 +32,21 @@ export interface ConfigReader {
 export interface AppContext {
   container: Container
   config: ConfigReader
+  /**
+   * Whether the inker template engine is installed — see
+   * `Application#usingInker`. Optional here because a host that is not ream
+   * satisfies this contract structurally and has no such flag; a provider
+   * reading it treats `undefined` as "no engine".
+   */
+  usingInker?: boolean
+  /**
+   * Absolute path to the application's `public/` directory — see
+   * `Application#publicPath`. Optional for the same reason as the flag above:
+   * a host that is not ream satisfies this contract structurally and has no
+   * directory layout. A provider that needs it falls back to a relative
+   * `'public'`, resolved against the working directory.
+   */
+  publicPath?(...paths: string[]): string
 }
 
 /**

package/src/http/Request.ts

@@ -384,9 +384,19 @@ export class Request extends Macroable {
    * `defaultValue` (or null) when absent OR when the signature is invalid
    * (tampered / not signed).
    *
-   * NAMED DEVIATION — the fallback is `??`, where AdonisJS writes `||`. A
-   * cookie legitimately holding `0`, `false` or `""` is a value, not an
-   * absence, and upstream hands back the default for all three. Kept.
+   * NAMED DEVIATION — the fallback is `??`, where upstream writes `||`
+   * (`@adonisjs/http-server@9.3.0`: `return this.#cookieParser.unsign(key) ||
+   * defaultValue`).
+   *
+   * The case that matters is the EMPTY STRING. A signed cookie carries a
+   * string — {@link Response.cookie} takes `value: string` — so `""` is the one
+   * falsy value this accessor can actually hold, and it is a value someone
+   * wrote, not an absence. `||` hands back the default for it; `??` does not.
+   *
+   * Upstream's own doc-comment on that line says the default is returned "when
+   * actual value is undefined" — which is what `??` does and `||` does not. So
+   * this follows the contract upstream documents, and differs only from what it
+   * happens to execute. Kept.
    */
   cookie(name: string): string | null
   cookie(name: string, defaultValue: string): string

package/src/index.ts

@@ -148,8 +148,8 @@ export { ApiResource } from './resources/ApiResource.js'
 
 // ─── Static Files ───────────────────────────────────────────
 
-export type { StaticConfig } from './storage/StaticMiddleware.js'
-export { StaticMiddleware } from './storage/StaticMiddleware.js'
+export type { DotFilesPolicy, StaticConfig } from './storage/StaticMiddleware.js'
+export { defineStaticConfig, StaticMiddleware } from './storage/StaticMiddleware.js'
 export type { StaticProviderOptions } from './storage/StaticProvider.js'
 export { StaticProvider } from './storage/StaticProvider.js'
 
@@ -385,4 +385,4 @@ export {
   StatsTracker,
 } from './scheduler/index.js'
 
-export const VERSION = '0.2.18'
+export const VERSION = '0.2.19'

package/src/router/Router.ts

@@ -1,5 +1,5 @@
 /**
- * Fluent Router — AdonisJS v6 compatible routing with controllers, resources, and groups.
+ * Fluent Router — AdonisJS-compatible routing with controllers, resources, and groups.
  *
  * @implements FR24, FR25, FR26, FR27, FR28
  */

package/src/security/CookieSigner.ts

@@ -159,8 +159,9 @@ export class CookieSigner {
   /**
    * The cipher in use (AdonisJS `Encryption.algorithm`).
    *
-   * `aes-256-gcm`, not upstream's `aes-256-cbc` — see the deviation at the top
-   * of this file.
+   * `aes-256-gcm`, which is what upstream configures by default now; the CBC
+   * construction lives on there as the `legacy` driver. See the note at the top
+   * of this file for what that means for a cookie written by an older app.
    */
   get algorithm(): 'aes-256-gcm' {
     return 'aes-256-gcm'