@c9up/ream 0.2.28 → 0.2.30

package/src/Codemods.ts

@@ -1,9 +1,36 @@
 import * as fs from 'node:fs'
 import * as path from 'node:path'
+import {
+  appendToLiteral,
+  findCall,
+  findExportDefaultObject,
+  isSingleExpression,
+  matchClose,
+  properties,
+  segments,
+} from './codemods/source.js'
 import { render as renderTemplate, type StubState } from './stubs/template.js'
 
 export type { StubState }
 
+/** The environments a preload (or provider) entry can be scoped to. */
+export type PreloadEnvironment = 'web' | 'console' | 'test' | 'repl'
+
+const PRELOAD_ENVIRONMENTS: readonly PreloadEnvironment[] = ['web', 'console', 'test', 'repl']
+
+/** Validation rules a configure hook adds to `start/env.ts`. */
+export interface EnvValidationNode {
+  /** Written once, as a banner comment above the rules this call adds. */
+  leadingComment?: string
+  /** Variable name → rule source, e.g. `{ REDIS_PORT: 'Env.schema.number()' }`. */
+  variables: Record<string, string>
+  /**
+   * Replace a rule the file already has. Off by default, so a rule the user
+   * edited survives a re-run; configure hooks pass their `--force` flag.
+   */
+  overwrite?: boolean
+}
+
 export interface Codemods {
   addProvider(importPath: string): Promise<void>
   addMetaFile(pattern: string, reloadServer?: boolean): Promise<void>
@@ -16,7 +43,12 @@ export interface Codemods {
     options?: { force?: boolean },
   ): Promise<GeneratedStub>
   registerCommand(importPath: string): Promise<void>
-  registerMiddleware(importPath: string, options?: { tier?: 'server' | 'router' }): Promise<void>
+  registerMiddleware(
+    importPath: string,
+    options?: { tier?: 'server' | 'router'; position?: MiddlewarePosition },
+  ): Promise<void>
+  defineEnvValidations(definition: EnvValidationNode): Promise<string[]>
+  addPreloadFile(modulePath: string, environments?: PreloadEnvironment[]): Promise<void>
 }
 
 /** What a stub may interpolate. Scalars only — a stub is text, not a program. */
@@ -102,6 +134,40 @@ function findTierBlock(
   return { start, end: start + closeMatch.index }
 }
 
+/**
+ * Where a middleware entry goes in its tier's array: at the end (`after`, the
+ * default, as the upstream assembler does) or at the head (`before`). Order is
+ * execution order, so a middleware that needs another one's work — a CSRF
+ * guard reading the session — is appended after it.
+ */
+export type MiddlewarePosition = 'before' | 'after'
+
+/**
+ * Insert `text` after the last element of the array whose contents span
+ * `block`, adding the comma the previous element may lack. A trailing line
+ * comment is stepped over so the comma never lands inside it.
+ */
+function appendToArray(
+  content: string,
+  block: { start: number; end: number },
+  text: string,
+): string {
+  const inner = content.slice(block.start, block.end)
+  const trimmed = inner.trimEnd()
+  const insertAt = block.start + trimmed.length
+  if (trimmed.trim() === '' || trimmed.endsWith(',')) {
+    return `${content.slice(0, insertAt)}${text}${content.slice(insertAt)}`
+  }
+  const lineStart = trimmed.lastIndexOf('\n') + 1
+  const commentAt = trimmed.indexOf('//', lineStart)
+  const code = (commentAt === -1 ? trimmed : trimmed.slice(0, commentAt)).trimEnd()
+  if (code.trim() === '' || code.endsWith(',')) {
+    return `${content.slice(0, insertAt)}${text}${content.slice(insertAt)}`
+  }
+  const commaAt = block.start + code.length
+  return `${content.slice(0, commaAt)},${content.slice(commaAt, insertAt)}${text}${content.slice(insertAt)}`
+}
+
 /**
  * Detect line ending (CRLF on Windows checkouts, LF elsewhere) so codemods preserve the file's existing convention.
  * Majority-based: a stray CRLF in an otherwise-LF file must not flip the whole insertion to CRLF.
@@ -128,6 +194,76 @@ function assertCanonicallyInside(root: string, filePath: string, displayName: st
   }
 }
 
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/
+
+/**
+ * A module path goes between the quotes of an `import('...')`; anything that
+ * could close them, escape or end the line is refused rather than escaped.
+ */
+const SAFE_MODULE_PATH = /^[^'"`\\\r\n\u2028\u2029]+$/
+
+const BANNER_RULE = '|----------------------------------------------------------'
+
+/** The rules of `definition`, refused before anything is written when unsafe. */
+function assertEnvValidations(definition: EnvValidationNode): void {
+  const comment = definition.leadingComment
+  if (comment !== undefined && (/[\r\n\u2028\u2029]/.test(comment) || comment.includes('*/'))) {
+    throw new Error(
+      '[configure] defineEnvValidations: the leading comment must be one line without `*/`',
+    )
+  }
+  for (const [name, rule] of Object.entries(definition.variables)) {
+    if (!ENV_NAME.test(name)) {
+      throw new Error(
+        `[configure] defineEnvValidations: '${name}' is not an environment variable name`,
+      )
+    }
+    if (typeof rule !== 'string' || !isSingleExpression(rule)) {
+      throw new Error(
+        `[configure] defineEnvValidations: the rule for ${name} is not one complete expression: ${String(rule)}`,
+      )
+    }
+  }
+}
+
+/** The `{` and `}` of the schema object passed to `Env.create`. */
+function locateEnvSchema(content: string): { open: number; close: number } {
+  const paren = findCall(content, 'Env.create')
+  const parenClose = paren === -1 ? -1 : matchClose(content, paren)
+  if (paren === -1 || parenClose === -1) {
+    throw new Error(
+      '[configure] Could not find an Env.create(...) call in start/env.ts — add the validations by hand.',
+    )
+  }
+  const open = segments(content, paren + 1, parenClose)[1]?.codeStart ?? -1
+  const close = content[open] === '{' ? matchClose(content, open) : -1
+  if (close === -1) {
+    throw new Error(
+      '[configure] The second argument of Env.create in start/env.ts is not an object literal — add the validations by hand.',
+    )
+  }
+  return { open, close }
+}
+
+/** The `{` and `}` of the object `reamrc.ts` exports (through `defineConfig` or bare). */
+function locateRcObject(content: string): { open: number; close: number } | null {
+  const paren = findCall(content, 'defineConfig')
+  let open = -1
+  if (paren !== -1) {
+    const parenClose = matchClose(content, paren)
+    if (parenClose !== -1) open = segments(content, paren + 1, parenClose)[0]?.codeStart ?? -1
+  } else {
+    open = findExportDefaultObject(content)
+  }
+  const close = open !== -1 && content[open] === '{' ? matchClose(content, open) : -1
+  return close === -1 ? null : { open, close }
+}
+
+/** The module an rc array element lazily imports. */
+function importedModule(element: string): string | undefined {
+  return /import\s*\(\s*(['"])([^'"]*)\1\s*\)/.exec(element)?.[2]
+}
+
 export function createCodemods(options?: { force?: boolean; cwd?: string }): Codemods {
   const force = options?.force ?? false
   const root = path.resolve(options?.cwd ?? process.cwd())
@@ -467,8 +603,14 @@ export function createCodemods(options?: { force?: boolean; cwd?: string }): Cod
      */
     async registerMiddleware(
       importPath: string,
-      options?: { tier?: MiddlewareTier },
+      options?: { tier?: MiddlewareTier; position?: MiddlewarePosition },
     ): Promise<void> {
+      const position = options?.position ?? 'after'
+      if (position !== 'before' && position !== 'after') {
+        throw new Error(
+          `[configure] Invalid middleware position: '${String(position)}'. Expected 'before' or 'after'.`,
+        )
+      }
       const requestedTier = options?.tier ?? 'router'
       if (!isMiddlewareTier(requestedTier)) {
         throw new Error(
@@ -513,8 +655,177 @@ export function createCodemods(options?: { force?: boolean; cwd?: string }): Cod
 
       const eol = detectLineEnding(content)
       const entry = `  () => import('${importPath}'),`
-      content = `${content.slice(0, targetBlock.start)}${eol}${entry}${content.slice(targetBlock.start)}`
+      content =
+        position === 'before'
+          ? `${content.slice(0, targetBlock.start)}${eol}${entry}${content.slice(targetBlock.start)}`
+          : appendToArray(content, targetBlock, `${eol}${entry}`)
       fs.writeFileSync(kernelPath, content)
     },
+
+    /**
+     * Add validation rules to the schema `start/env.ts` passes to
+     * `Env.create`, so the variables a package writes to `.env` are checked
+     * at boot like the app's own.
+     *
+     * A rule already in the file is left alone, unless `overwrite` is set:
+     * the user may have tightened it. Returns the variables kept that way
+     * with a rule different from the one asked for, so the caller can say
+     * so. The banner comment is written only when the first new rule comes
+     * before any variable the file already had.
+     */
+    async defineEnvValidations(definition: EnvValidationNode): Promise<string[]> {
+      const envPath = path.join(root, 'start', 'env.ts')
+      if (!fs.existsSync(envPath)) {
+        throw new Error(
+          `[configure] start/env.ts not found — cannot add the validations for ${Object.keys(definition.variables).join(', ')}.`,
+        )
+      }
+      assertCanonicallyInside(root, envPath, 'start/env.ts')
+      assertEnvValidations(definition)
+
+      const original = fs.readFileSync(envPath, 'utf8')
+      const eol = detectLineEnding(original)
+      let content = original
+      const schema = locateEnvSchema(content)
+      const existing = new Map(
+        properties(content, schema.open, schema.close).map((property) => [property.key, property]),
+      )
+
+      const kept: string[] = []
+      const replacements: Array<{ start: number; end: number; text: string }> = []
+      const additions: Array<[string, string]> = []
+      let shouldAddComment = true
+      let decorate = false
+      for (const [name, rule] of Object.entries(definition.variables)) {
+        const property = existing.get(name)
+        if (property === undefined) {
+          if (additions.length === 0) decorate = shouldAddComment
+          shouldAddComment = false
+          additions.push([name, rule])
+          continue
+        }
+        shouldAddComment = false
+        const current = content.slice(property.valueStart, property.valueEnd)
+        if (definition.overwrite) {
+          replacements.push({ start: property.valueStart, end: property.valueEnd, text: rule })
+        } else if (current.replace(/\s+/g, '') !== rule.replace(/\s+/g, '')) {
+          kept.push(name)
+        }
+      }
+
+      for (const { start, end, text } of replacements.sort((a, b) => b.start - a.start)) {
+        content = `${content.slice(0, start)}${text}${content.slice(end)}`
+      }
+
+      if (additions.length > 0) {
+        const { open, close } = locateEnvSchema(content)
+        const comment = definition.leadingComment
+        content = appendToLiteral(
+          content,
+          open,
+          close,
+          eol,
+          (indent) => [
+            ...(decorate && comment !== undefined
+              ? [
+                  `${indent}/*`,
+                  `${indent}${BANNER_RULE}`,
+                  `${indent}| ${comment}`,
+                  `${indent}${BANNER_RULE}`,
+                  `${indent}*/`,
+                ]
+              : []),
+            ...additions.map(([name, rule]) => `${indent}${name}: ${rule},`),
+          ],
+          decorate,
+        )
+      }
+
+      if (content !== original) fs.writeFileSync(envPath, content)
+      return kept
+    },
+
+    /**
+     * Register a preload file in `reamrc.ts`, appended to `preloads` (the
+     * array is created when absent). Listing only some environments writes
+     * a `{ file, environment }` entry; none, or all of them, a plain lazy
+     * import. A module already in `preloads` is left as it is.
+     */
+    async addPreloadFile(modulePath: string, environments?: PreloadEnvironment[]): Promise<void> {
+      if (!SAFE_MODULE_PATH.test(modulePath)) {
+        throw new Error(`[configure] Unsafe preload module path: ${JSON.stringify(modulePath)}`)
+      }
+      for (const environment of environments ?? []) {
+        if (!PRELOAD_ENVIRONMENTS.includes(environment)) {
+          throw new Error(
+            `[configure] Unknown environment '${String(environment)}' for preload ${modulePath}. Expected one of ${PRELOAD_ENVIRONMENTS.join(', ')}.`,
+          )
+        }
+      }
+
+      const rcPath = path.join(root, 'reamrc.ts')
+      if (!fs.existsSync(rcPath)) {
+        throw new Error(
+          `[configure] reamrc.ts not found — cannot register preload ${modulePath}. Run 'ream new' first.`,
+        )
+      }
+      assertCanonicallyInside(root, rcPath, 'reamrc.ts')
+
+      const content = fs.readFileSync(rcPath, 'utf8')
+      const eol = detectLineEnding(content)
+      const config = locateRcObject(content)
+      if (config === null) {
+        throw new Error(
+          `[configure] Could not find 'defineConfig({ ... })' in reamrc.ts — preload ${modulePath} not added.`,
+        )
+      }
+
+      // Scoped only when it actually leaves an environment out.
+      const scope = PRELOAD_ENVIRONMENTS.some(
+        (environment) => environments !== undefined && !environments.includes(environment),
+      )
+        ? environments
+        : undefined
+      const entry = (indent: string): string[] =>
+        scope
+          ? [
+              `${indent}{`,
+              `${indent}  file: () => import('${modulePath}'),`,
+              `${indent}  environment: [${scope.map((e) => `'${e}'`).join(', ')}],`,
+              `${indent}},`,
+            ]
+          : [`${indent}() => import('${modulePath}'),`]
+
+      const preloads = properties(content, config.open, config.close).find(
+        (property) => property.key === 'preloads',
+      )
+      if (preloads === undefined) {
+        fs.writeFileSync(
+          rcPath,
+          appendToLiteral(content, config.open, config.close, eol, (indent) => [
+            `${indent}preloads: [`,
+            ...entry(`${indent}  `),
+            `${indent}],`,
+          ]),
+        )
+        return
+      }
+
+      const arrayClose =
+        content[preloads.valueStart] === '[' ? matchClose(content, preloads.valueStart) : -1
+      if (arrayClose === -1) {
+        throw new Error(
+          `[configure] reamrc.ts declares preloads as something other than an array literal — add ${modulePath} by hand.`,
+        )
+      }
+      const registered = segments(content, preloads.valueStart + 1, arrayClose).some(
+        (element) => importedModule(content.slice(element.codeStart, element.end)) === modulePath,
+      )
+      if (registered) return
+      fs.writeFileSync(
+        rcPath,
+        appendToLiteral(content, preloads.valueStart, arrayClose, eol, entry),
+      )
+    },
   }
 }

package/src/HttpKernel.ts

@@ -200,7 +200,7 @@ export function createHttpKernel(
           // read decorator metadata via Reflect. Absent for inline-arrow
           // route handlers — that's intentional, decorators only apply
           // to controller methods.
-          controller: match.route.controller?.target.prototype as object | undefined,
+          controller: controllerPrototype(match.route.controller?.target),
           action: match.route.controller?.method,
         }
       : { pattern: '', middleware: [] }
@@ -212,6 +212,7 @@ export function createHttpKernel(
     //    value bound for this request cannot be seen by any other.
     const resolver = config.container?.createResolver()
     const ctx = new HttpContext(correlationId, reqData, match?.params ?? {}, routeInfo, resolver)
+    ctx.subdomains = match?.subdomains ?? {}
     // What Adonis binds on every request's resolver: the context itself, so a
     // controller or service can take `HttpContext` as a constructor dependency.
     resolver?.bindValue(HttpContext, ctx)
@@ -453,18 +454,25 @@ function createControllerHandler(
     // `HttpContext` as a dependency must get this request's, not a stale one.
     const resolve = ctx.containerResolver ?? container
     const instance = resolve ? await resolve.make(controller.target) : new controller.target()
-    const method = (instance as Record<string, (ctx: HttpContext) => Promise<void> | void>)[
-      controller.method
-    ]
+    const method: unknown =
+      typeof instance === 'object' && instance !== null
+        ? Reflect.get(instance, controller.method)
+        : undefined
     if (typeof method !== 'function') {
       throw new Error(
         `Controller method '${controller.method}' not found on ${controller.target.name}`,
       )
     }
-    await method.call(instance, ctx)
+    await Reflect.apply(method, instance, [ctx])
   }
 }
 
+/** A controller class's prototype, where its decorators keep their metadata. */
+function controllerPrototype(target: AnyConstructor | undefined): object | undefined {
+  const prototype: unknown = target?.prototype
+  return typeof prototype === 'object' && prototype !== null ? prototype : undefined
+}
+
 /**
  * Read @Guard, @Role, @Permission metadata from a controller method.
  * Returns empty arrays if no decorators are present.
@@ -554,8 +562,10 @@ function reconcileRepresentation(
 /**
  * Append the development script to an HTML body.
  *
- * Only HTML, and never a stream: appending to an SSE or a download would
- * corrupt it, and a page is the only thing that can act on the script anyway.
+ * Only HTML, and never a stream or a base64-encoded body (`sendBuffer`, a
+ * buffered download): appending to any of them corrupts it — Rust fails to
+ * decode the base64 and the client receives the encoded text — and a page is
+ * the only thing that can act on the script anyway.
  * Before `</body>` when there is one, so the script is inside the document
  * rather than trailing after it.
  */
@@ -567,6 +577,7 @@ function withDevScript(
 ): string {
   if (script === undefined || streamId !== undefined || body === '') return body
   if (!(headers['content-type'] ?? '').includes('text/html')) return body
+  if (headers['x-ream-body-encoding'] === 'base64') return body
   const closing = body.lastIndexOf('</body>')
   return closing === -1 ? body + script : body.slice(0, closing) + script + body.slice(closing)
 }

package/src/Ignitor.ts

@@ -14,6 +14,7 @@
  */
 
 import { Application } from './Application.js'
+import type { BodyParserConfig } from './bodyparser/BodyParserMiddleware.js'
 import type { Console } from './console/Console.js'
 import type { CommandLoader, Kernel as ConsoleKernelInstance } from './console/Kernel.js'
 import { type CommandClass, isCommandClass } from './console/types.js'
@@ -51,13 +52,20 @@ import {
 import { Router } from './router/Router.js'
 import { CookieSigner } from './security/CookieSigner.js'
 import { SignedUrl } from './security/SignedUrl.js'
-import { type GrpcHandler, Server } from './server/Server.js'
+import { cancellableGrpc, type NativeGrpcHandler } from './server/nativeGrpc.js'
+import {
+  type NativeBodyLimits,
+  type NativeConnectionConfig,
+  nativeBodyLimits,
+  nativeConnectionConfig,
+} from './server/nativeLimits.js'
+import { type GrpcLimits, Server } from './server/Server.js'
 import { clearApp, setApp } from './services/app.js'
 import { clearEncryption, setEncryption } from './services/encryption.js'
 import { clearLogger, setLogger } from './services/logger.js'
 import { clearRouter, setRouter } from './services/router.js'
 import { clearServer, setServer } from './services/server.js'
-import { registerSessionTemplateTags } from './session/templateTags.js'
+import { installSessionTemplateTags } from './session/templateTags.js'
 
 /** Application environment. */
 /**
@@ -269,7 +277,9 @@ export function defineConfig(config: ReamrcConfig): ReamrcConfig {
 export interface HyperServerLike {
   onRequest(callback: (request: HttpKernelRequest) => Promise<HttpKernelResponse>): void
   /** Optional — present on the real `HyperServer`; required once `server.grpc()` is used. */
-  onGrpc?(callback: GrpcHandler): void
+  onGrpc?(callback: NativeGrpcHandler, limits?: GrpcLimits): void
+  /** Optional — reports the calls a client gave up on; without it no call's signal aborts. */
+  onGrpcCancel?(callback: (id: number) => void): void
   /**
    * Optional — present on the real `HyperServer` (Rust-backed), absent on
    * trivial test mocks. Ignitor only calls it when a shield config is set.
@@ -279,6 +289,10 @@ export interface HyperServerLike {
   configureTrustedProxies?(cidrs: string[]): void
   /** Optional — same lifecycle as `configureShield`. */
   configureRateLimit?(config: { max: number; windowSecs: number } | null): void
+  /** Optional — same lifecycle as `configureShield`. */
+  configureBodyLimits?(config: NativeBodyLimits): void
+  /** Optional — same lifecycle as `configureShield`. */
+  configureConnections?(config: NativeConnectionConfig): void
   listen(): Promise<void>
   port(): Promise<number>
   close(): Promise<void>
@@ -287,6 +301,11 @@ export interface HyperServerLike {
   // a clean `STREAMING_UNSUPPORTED` error when called on such a host.
   registerStream?(streamId: string): Promise<boolean>
   writeStream?(streamId: string, chunk: string): Promise<boolean>
+  /**
+   * Byte-exact writes. Without it a download, `response.stream()` or a static
+   * file is buffered whole and shipped base64-encoded in one response.
+   */
+  writeStreamBytes?(streamId: string, chunk: Uint8Array): Promise<boolean>
   closeStream?(streamId: string): Promise<boolean>
   onStreamDisconnect?(streamId: string, callback: () => void): void
 }
@@ -684,26 +703,12 @@ export class Ignitor {
 
   /**
    * Give the template engine `@error` / `@errors` / `@inputError` /
-   * `@flashMessage`, as AdonisJS's session plugin does.
-   *
-   * The engine is duck-typed out of the container so ream carries no dependency
-   * on it, and an app with no template layer simply skips this.
+   * `@flashMessage`, as AdonisJS's session plugin does — through the engine
+   * package's module singleton, guarded by `usingInker` (see
+   * `installSessionTemplateTags`). An app with no template layer skips this.
    */
   async #registerSessionTemplateTags(): Promise<void> {
-    for (const token of ['inker', 'view']) {
-      if (!this.#app.container.has(token)) continue
-      const binding: unknown = await this.#app.container.resolve(token)
-      for (const candidate of [binding, Reflect.get(Object(binding), '_templates')]) {
-        const register = Reflect.get(Object(candidate), 'registerTag')
-        if (typeof register !== 'function') continue
-        registerSessionTemplateTags({
-          registerTag: (tag) => {
-            register.call(candidate, tag)
-          },
-        })
-        return
-      }
-    }
+    await installSessionTemplateTags(this.#app.usingInker === true)
   }
 
   async #phaseRegister(): Promise<void> {
@@ -874,6 +879,12 @@ export class Ignitor {
             return {
               registerStream: server.registerStream.bind(server),
               writeStream: server.writeStream.bind(server),
+              // The byte channel is what lets a download be streamed rather
+              // than read whole into memory; a host without it still gets SSE.
+              writeStreamBytes:
+                typeof server.writeStreamBytes === 'function'
+                  ? server.writeStreamBytes.bind(server)
+                  : undefined,
               closeStream: server.closeStream.bind(server),
               onStreamDisconnect: server.onStreamDisconnect.bind(server),
             }
@@ -914,7 +925,9 @@ export class Ignitor {
             { hint: 'Use the native HyperServer, or a test server that implements onGrpc().' },
           )
         }
-        this.#_httpServer.onGrpc(grpc)
+        const calls = cancellableGrpc(grpc)
+        this.#_httpServer.onGrpcCancel?.(calls.onCancel)
+        this.#_httpServer.onGrpc(calls.onCall, this.#server.getGrpcLimits())
       }
       // Pre-resolve client IPs in Rust from the trusted-proxy CIDRs before
       // listen. Security filtering itself lives in @c9up/blackhole.
@@ -925,6 +938,19 @@ export class Ignitor {
       ) {
         this.#_httpServer.configureTrustedProxies([...trustedProxies])
       }
+      // Body limits from `config/bodyparser.ts`, enforced while the native
+      // server reads a body: nothing past them is ever buffered.
+      const bodyparser = this.#app.config.get<BodyParserConfig>('bodyparser')
+      if (bodyparser && typeof this.#_httpServer.configureBodyLimits === 'function') {
+        this.#_httpServer.configureBodyLimits(nativeBodyLimits(bodyparser))
+      }
+      // AdonisJS `config/app.ts` → `http: { headersTimeout, requestTimeout,
+      // keepAliveTimeout }`, plus `maxConnections`.
+      if (typeof this.#_httpServer.configureConnections === 'function') {
+        this.#_httpServer.configureConnections(
+          nativeConnectionConfig(this.#app.config.get<unknown>('app.http')),
+        )
+      }
       await this.#_httpServer.listen()
 
       // Whoever opened the socket closes it. `app.terminate()` runs the
@@ -1006,7 +1032,7 @@ export class Ignitor {
               'File change detected — a process restart is required to apply it (`ream dev` restarts automatically).',
             severity: 'info',
             timestamp: new Date().toISOString(),
-          } as ErrorEvent)
+          })
         },
         logger: {
           info: (msg) =>
@@ -1016,7 +1042,7 @@ export class Ignitor {
               message: msg,
               severity: 'info',
               timestamp: new Date().toISOString(),
-            } as ErrorEvent),
+            }),
         },
       })
     }
@@ -1399,7 +1425,13 @@ export class Ignitor {
     const events = this.#app.container.has('events')
       ? await this.#app.container.resolve<Emitter>('events')
       : { on: () => undefined }
-    this.#profiler = createProfiler(events)
+    // Imported here, at start, rather than at the top: the barrel imports this
+    // module, and its `VERSION` is what the release bump rewrites.
+    const { VERSION } = await import('./index.js')
+    this.#profiler = createProfiler(events, [], {
+      version: VERSION,
+      environment: process.env.REAM_ENV ?? process.env.NODE_ENV ?? 'development',
+    })
   }
 
   #profiler?: Profiler
@@ -1453,7 +1485,7 @@ export class Ignitor {
       message,
       severity: kind === 'error' ? 'critical' : 'info',
       timestamp: new Date().toISOString(),
-    } as ErrorEvent)
+    })
   }
 }