@c9up/ream 0.2.29 → 0.2.30

package/src/profiler/preview.ts

@@ -0,0 +1,104 @@
+/**
+ * A bounded, redacted copy of a value, for a profiler panel.
+ *
+ * What the profiler keeps crosses a wire and sits in memory for the rest of the
+ * dev session, so a payload is never stored as given: an event can carry a
+ * whole model graph, a session a megabyte of flash data, a body an upload.
+ * Depth, keys, items and string length are all capped, cycles are cut, and the
+ * value of a key that names a secret is replaced rather than shown — the
+ * profiler is the page a developer screenshares.
+ */
+
+/** A key whose value is never shown: credentials, and what carries them. */
+const SECRET_KEY =
+  /pass(word|phrase)?|secret|token|authorization|cookie|api[-_]?key|private[-_]?key|csrf|xsrf|credential/i
+
+const MAX_DEPTH = 4
+const MAX_KEYS = 40
+const MAX_ITEMS = 25
+const MAX_STRING = 400
+
+/** What a redacted value becomes. */
+export const REDACTED = '[redacted]'
+
+/** Whether a key's value is hidden. */
+export function isSecretKey(key: string): boolean {
+  return SECRET_KEY.test(key)
+}
+
+/** A JSON-safe preview of `value`. */
+export function preview(value: unknown): unknown {
+  return walk(value, 0, new WeakSet())
+}
+
+function walk(value: unknown, depth: number, seen: WeakSet<object>): unknown {
+  if (value === null || value === undefined) return value ?? null
+  switch (typeof value) {
+    case 'string':
+      return value.length > MAX_STRING
+        ? `${value.slice(0, MAX_STRING)}… (${value.length} chars)`
+        : value
+    case 'number':
+      return Number.isFinite(value) ? value : String(value)
+    case 'boolean':
+      return value
+    case 'bigint':
+      return `${value}n`
+    case 'symbol':
+      return value.toString()
+    case 'function':
+      return `[function ${value.name || 'anonymous'}]`
+  }
+  if (typeof value !== 'object') return String(value)
+  if (value instanceof Date)
+    return Number.isNaN(value.getTime()) ? 'Invalid Date' : value.toISOString()
+  if (value instanceof Error) return { name: value.name, message: value.message }
+  if (Buffer.isBuffer(value)) return `[Buffer ${value.length} bytes]`
+  if (seen.has(value)) return '[circular]'
+  if (depth >= MAX_DEPTH)
+    return Array.isArray(value) ? `[array ${value.length}]` : `[${typeName(value)}]`
+  seen.add(value)
+
+  if (Array.isArray(value)) {
+    const items = value.slice(0, MAX_ITEMS).map((item) => walk(item, depth + 1, seen))
+    if (value.length > MAX_ITEMS) items.push(`… ${value.length - MAX_ITEMS} more`)
+    return items
+  }
+  if (value instanceof Map) {
+    return walk(
+      Object.fromEntries([...value.entries()].map(([k, v]) => [String(k), v])),
+      depth,
+      seen,
+    )
+  }
+  if (value instanceof Set) return walk([...value], depth, seen)
+
+  // A model or entity usually serialises itself the way it wants to be seen.
+  const toJSON = Reflect.get(value, 'toJSON')
+  const source: unknown = typeof toJSON === 'function' ? safeCall(() => toJSON.call(value)) : value
+  if (source !== value) return walk(source, depth, seen)
+
+  const out: Record<string, unknown> = {}
+  const name = typeName(value)
+  if (name !== 'Object') out['@type'] = name
+  const keys = Object.keys(value)
+  for (const key of keys.slice(0, MAX_KEYS)) {
+    out[key] = isSecretKey(key) ? REDACTED : walk(Reflect.get(value, key), depth + 1, seen)
+  }
+  if (keys.length > MAX_KEYS) out['…'] = `${keys.length - MAX_KEYS} more keys`
+  return out
+}
+
+function typeName(value: object): string {
+  const ctor = Reflect.get(value, 'constructor')
+  const name = typeof ctor === 'function' ? Reflect.get(ctor, 'name') : undefined
+  return typeof name === 'string' && name !== '' ? name : 'Object'
+}
+
+function safeCall(fn: () => unknown): unknown {
+  try {
+    return fn()
+  } catch {
+    return '[unserialisable]'
+  }
+}

package/src/profiler/toolbar.ts

@@ -1,106 +1,43 @@
 /**
- * The bar at the bottom of the page.
+ * The tag that loads the debug toolbar into an HTML page.
  *
- * It carries its own token inline rather than reading `X-Debug-Token` off the
- * response: a script in a page cannot see the headers of the navigation that
- * delivered it. Symfony injects the token for the same reason.
+ * A `<script src>` with the request's profile token in a data attribute, and
+ * nothing inline. The bar itself — `client/toolbar.js` and `client/toolbar.css`
+ * — is served by the profiler endpoint from the same origin, so a policy of
+ * `script-src 'self'` / `style-src 'self'` runs and styles it, and a
+ * nonce-only policy runs it through the nonce stamped here. An inline script,
+ * which is what this used to be, needed the nonce and nothing else would do.
  *
- * Everything lives in a shadow root — your stylesheet must not reach the bar,
- * and the bar must not reach your page. It fetches its numbers once, on load,
- * and then does nothing: a dev tool that polls is a dev tool that shows up in
- * its own history.
- *
- * A string rather than a stringified function, as the hot-reload script is:
- * this package compiles without the DOM library, deliberately — it is a server
- * — so browser code here is text, and its only inputs are escaped below.
- *
- * It styles its nodes through the CSSOM — `node.style.cssText` — rather than
- * with a `<style>` element. Under a CSP with `style-src 'self'` (or only a
- * `default-src`, which is the common case) a stylesheet inserted at runtime is
- * inline style and is dropped, with no error anywhere: the bar renders as a
- * stack of grey text and nothing says why. Setting properties on an element is
- * not inline style and is never blocked, which is also how the host below has
- * always been positioned.
+ * The token travels in the page rather than being read off the response: a
+ * script cannot see the headers of the navigation that delivered it. Symfony
+ * injects its token for the same reason.
  */
 
 import { PROFILER_PATH } from './Profiler.js'
 
+/** Where the toolbar's own files are served, under the profiler's path. */
+export const PROFILER_ASSETS_PATH = `${PROFILER_PATH}/_assets`
+
 /**
  * The `<script>` to append to an HTML response.
  *
  * `token` is generated by the profiler (hex) and `nonce` by the response, so
- * neither is user input; both are still put through `JSON.stringify` rather
- * than interpolated raw, because "cannot contain a quote" is an invariant that
- * holds until someone changes how one of them is made.
+ * neither is user input; both are still attribute-escaped, because "cannot
+ * contain a quote" is an invariant that holds until someone changes how one of
+ * them is made.
  */
 export function toolbarScript(token: string, nonce?: string): string {
-  const attribute = nonce === undefined ? '' : ` nonce="${nonce.replace(/"/g, '&quot;')}"`
-  const config = JSON.stringify({ token, path: PROFILER_PATH })
-  return `<script${attribute}>(${BAR})(${config})</script>`
+  const attribute = nonce === undefined ? '' : ` nonce="${escapeAttribute(nonce)}"`
+  return (
+    `<script src="${PROFILER_ASSETS_PATH}/toolbar.js" data-token="${escapeAttribute(token)}"` +
+    ` data-path="${PROFILER_PATH}"${attribute}></script>`
+  )
 }
 
-/**
- * The bar, as it runs in the browser.
- *
- * Kept on one indented block so what ships is readable in a page's source —
- * someone will open the inspector and find this, and a minified blob would
- * tell them nothing about where it came from.
- */
-const BAR = `function(c){
-  var host=document.createElement('div');
-  host.style.cssText='position:fixed;left:0;right:0;bottom:0;z-index:2147483000';
-  var root=host.attachShadow({mode:'closed'});
-  document.body.appendChild(host);
-  var bar=document.createElement('div');
-  bar.style.cssText='display:flex;align-items:stretch;background:#14161a;color:#e6e6e6;'
-    +'font:12px/1 ui-monospace,Menlo,monospace;border-top:1px solid #262a31;'
-    +'box-shadow:0 -2px 8px rgba(0,0,0,.4)';
-  root.appendChild(bar);
-  var page=c.path+'/'+c.token;
-  var COLOR={bad:'#ff7b72',warn:'#f0883e',ok:'#7ee787'};
-  function cell(label,value,tone,plain){
-    var node=document.createElement('div');
-    node.style.cssText='padding:7px 11px;white-space:nowrap;'
-      +(plain?'flex:1;overflow:hidden;text-overflow:ellipsis;cursor:default'
-             :'border-right:1px solid #21252c;cursor:pointer');
-    if(label){
-      var tag=document.createElement('span');
-      tag.style.cssText='color:#8b949e;margin-right:6px';
-      tag.textContent=label;
-      node.appendChild(tag);
-    }
-    var text=document.createElement('span');
-    if(tone){text.style.color=COLOR[tone];}
-    text.textContent=value;
-    node.appendChild(text);
-    if(!plain){
-      node.addEventListener('mouseenter',function(){node.style.background='#1b1f25'});
-      node.addEventListener('mouseleave',function(){node.style.background=''});
-      node.addEventListener('click',function(){window.open(page,'_blank')});
-    }
-    bar.appendChild(node);
-  }
-  function panel(data,name){
-    var value=data&&data[name];
-    return (value&&typeof value==='object')?value:null;
-  }
-  fetch(page+'.json',{headers:{accept:'application/json'}})
-    .then(function(r){return r.ok?r.json():null})
-    .then(function(p){
-      if(!p){host.remove();return}
-      var status=Number(p.status||0);
-      cell('',String(status),status>=500?'bad':status>=400?'warn':'ok');
-      cell('time',Number(p.duration||0).toFixed(1)+' ms');
-      var db=panel(p.data,'database');
-      if(db){
-        var total=Number(db.total||0);
-        cell('db',total+' \u00b7 '+Number(db.duration||0).toFixed(1)+' ms',total>=50?'warn':'');
-      }
-      var mem=panel(p.data,'memory');
-      if(mem){cell('mem',Number(mem.usedMb||0).toFixed(1)+' MB');}
-      var err=panel(p.data,'exception');
-      if(err&&typeof err.message==='string'){cell('',err.message,'bad');}
-      cell('',String(p.url||''),'',true);
-    })
-    .catch(function(){host.remove()});
-}`
+function escapeAttribute(value: string): string {
+  return value
+    .replaceAll('&', '&amp;')
+    .replaceAll('"', '&quot;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+}

package/src/profiler/types.ts

@@ -45,8 +45,13 @@ export type ProfileSummary = Omit<Profile, 'data'> & {
  */
 export interface CollectionScope {
   token: string
-  /** Called by the framework when the request is done. */
+  /** When the request arrived, epoch milliseconds. */
   readonly startedAt: number
+  /**
+   * Milliseconds since the request arrived, on the monotonic clock. What a
+   * collector stamps an entry with, so the timeline can place it.
+   */
+  elapsed(): number
 }
 
 /**

package/src/router/Router.ts

@@ -186,6 +186,12 @@ export type MatchedParams = Record<string, string | string[]>
 export interface MatchResult {
   route: RouteDefinition
   params: MatchedParams
+  /**
+   * The values a parameterised domain captured from the host —
+   * `{ tenant: 'acme' }` for `:tenant.app.test` on `acme.app.test`. Empty for
+   * an exact or wildcard domain, and for a route without one.
+   */
+  subdomains: Record<string, string>
 }
 
 // ─── Matchers ───────────────────────────────────────────────
@@ -868,6 +874,8 @@ export class Router extends Macroable {
   #staticIndex: Map<string, RouteDefinition> = new Map()
   /** Index: parametric routes grouped by method. */
   #paramIndex: Map<string, RouteDefinition[]> = new Map()
+  /** Index: every domain a route is scoped to, compiled, in registration order. */
+  #domains: CompiledDomain[] = []
   /** Index: named routes for O(1) URL generation. */
   #nameIndex: Map<string, RouteDefinition> = new Map()
   /** Whether the index needs rebuilding. */
@@ -1144,6 +1152,7 @@ export class Router extends Macroable {
     this.#staticIndex.clear()
     this.#paramIndex.clear()
     this.#nameIndex.clear()
+    this.#domains = []
 
     for (const route of this.#routes) {
       // Soft-deleted routes (resource .only()/.except()/.apiOnly()) never match.
@@ -1179,6 +1188,13 @@ export class Router extends Macroable {
         this.#nameIndex.set(route.name, route)
       }
 
+      if (route.domain !== undefined) {
+        const pattern = route.domain.toLowerCase()
+        if (!this.#domains.some((d) => d.pattern === pattern)) {
+          this.#domains.push(compileDomain(route.domain))
+        }
+      }
+
       const isParam = route.path.includes(':') || route.path.includes('*')
 
       if (!isParam && !route.domain) {
@@ -1221,21 +1237,27 @@ export class Router extends Macroable {
       candidates.push(path.slice(0, -1))
     }
 
+    // The domain the host belongs to decides which routes are candidates, as
+    // upstream does: only that domain's routes when one matches, with no
+    // fallback to the domain-less ones; only the domain-less ones when none
+    // does. A missing host matches no domain, so a domain-scoped route is
+    // never served to a request that simply omits its Host header.
+    const domain = host === undefined ? undefined : this.#matchingDomain(host)
+
     for (const candidatePath of candidates) {
-      // 1. Try static exact match (O(1))
-      const staticRoute =
-        this.#staticIndex.get(`${method}:${candidatePath}`) ??
-        this.#staticIndex.get(`*:${candidatePath}`)
-      if (staticRoute) {
-        if (!staticRoute.domain || !host || matchDomain(staticRoute.domain, host)) {
-          return { route: staticRoute, params: {} }
-        }
+      // 1. Try static exact match (O(1)). The index holds domain-less routes
+      // only, so it is consulted only when no domain owns the request.
+      if (domain === undefined) {
+        const staticRoute =
+          this.#staticIndex.get(`${method}:${candidatePath}`) ??
+          this.#staticIndex.get(`*:${candidatePath}`)
+        if (staticRoute) return { route: staticRoute, params: {}, subdomains: {} }
       }
 
-      // 2. Try parametric routes (only same-method candidates)
+      // 2. Try parametric and domain-scoped routes (only same-method candidates)
       const paramCandidates = this.#paramIndex.get(method) ?? []
       for (const route of paramCandidates) {
-        if (route.domain && host && !matchDomain(route.domain, host)) continue
+        if (route.domain?.toLowerCase() !== domain?.pattern) continue
 
         const params = matchPath(route.path, candidatePath)
         if (params === null) continue
@@ -1254,7 +1276,11 @@ export class Router extends Macroable {
         // handler wants — `where('id', matchers.number())` hands `params.id`
         // a NUMBER, as in AdonisJS. Ream carried only the pattern, so every
         // controller re-parsed a string the router had already validated.
-        return { route, params: applyCasts(params, effective) }
+        return {
+          route,
+          params: applyCasts(params, effective),
+          subdomains: domain?.subdomains ?? {},
+        }
       }
     }
 
@@ -1268,6 +1294,35 @@ export class Router extends Macroable {
     return undefined
   }
 
+  /**
+   * The registered domain `host` belongs to — its lowercased pattern and the
+   * values its parameters captured — or `undefined` when none covers it.
+   *
+   * NAMED DEVIATION — upstream takes the first registered pattern that
+   * matches, so a wildcard declared before `admin.example.com` swallows the
+   * admin host and its routes become unreachable. Here the most specific kind
+   * wins whatever the order: an exact domain, then a parameterised one (each
+   * parameter fills exactly one label), then a wildcard (any depth). Within a
+   * kind, the first registered still wins.
+   */
+  #matchingDomain(
+    host: string,
+  ): { pattern: string; subdomains: Record<string, string> } | undefined {
+    if (this.#domains.length === 0) return undefined
+    const hostname = hostnameOf(host)
+    const exact = this.#domains.find((d) => d.kind === 'exact' && d.pattern === hostname)
+    if (exact) return { pattern: exact.pattern, subdomains: {} }
+    for (const domain of this.#domains) {
+      if (domain.kind !== 'param') continue
+      const subdomains = matchParamDomain(domain.labels, hostname)
+      if (subdomains) return { pattern: domain.pattern, subdomains }
+    }
+    const wildcard = this.#domains.find(
+      (d) => d.kind === 'wildcard' && matchDomain(d.pattern, host),
+    )
+    return wildcard ? { pattern: wildcard.pattern, subdomains: {} } : undefined
+  }
+
   // ─── URL generation ───────────────────────────────────────
 
   /**
@@ -1637,6 +1692,75 @@ function matchPath(pattern: string, actual: string): MatchedParams | null {
   return params
 }
 
+/** A route domain, compiled once when the index is built. */
+interface CompiledDomain {
+  /** The pattern lowercased: what a route's own `domain` is compared to. */
+  pattern: string
+  kind: 'exact' | 'param' | 'wildcard'
+  /**
+   * A parameterised domain's labels: static ones lowercased, `:name` ones
+   * kept as written so the parameter keeps the name the route gave it.
+   */
+  labels: string[]
+}
+
+/** What one parameter accepts: a single DNS label, lowercased. */
+const DOMAIN_PARAM_VALUE = /^[a-z0-9_-]+$/
+
+function compileDomain(domain: string): CompiledDomain {
+  const pattern = domain.toLowerCase()
+  if (pattern.startsWith('*.')) return { pattern, kind: 'wildcard', labels: [] }
+  const labels = domain
+    .split('.')
+    .map((label) => (label.startsWith(':') ? label : label.toLowerCase()))
+  if (!labels.some((label) => label.startsWith(':'))) return { pattern, kind: 'exact', labels }
+  const names = new Set<string>()
+  for (const label of labels) {
+    if (!label.startsWith(':')) continue
+    const name = label.slice(1)
+    if (name === '' || names.has(name)) {
+      throw new Error(
+        `[E_INVALID_ROUTE_DOMAIN] The route domain "${domain}" has ${name === '' ? 'a parameter without a name' : `the parameter "${name}" twice`}.`,
+      )
+    }
+    names.add(name)
+  }
+  return { pattern, kind: 'param', labels }
+}
+
+/**
+ * The values `hostname` gives a parameterised domain's labels, or `null` when
+ * it does not fit them.
+ *
+ * NAMED DEVIATION — upstream's matcher fills a parameter with everything in
+ * front of the static suffix, so `:tenant.app.test` took `a.b.app.test` as the
+ * tenant `a.b` and `.app.test` as an empty one, and a parameter could only
+ * open the domain. Here each parameter is exactly one non-empty label of
+ * letters, digits, `-` or `_`, in any position (`api.:tenant.test`,
+ * `:tenant.:region.app.test`).
+ */
+function matchParamDomain(labels: string[], hostname: string): Record<string, string> | null {
+  const hostLabels = hostname.split('.')
+  if (hostLabels.length !== labels.length) return null
+  const values: Record<string, string> = {}
+  for (const [index, label] of labels.entries()) {
+    const value = hostLabels[index] ?? ''
+    if (label.startsWith(':')) {
+      if (!DOMAIN_PARAM_VALUE.test(value)) return null
+      values[label.slice(1)] = value
+    } else if (label !== value) {
+      return null
+    }
+  }
+  return values
+}
+
+/** The request's host without its port, lowercased (RFC 4343). */
+function hostnameOf(host: string): string {
+  const [hostname = ''] = host.split(':')
+  return hostname.toLowerCase()
+}
+
 /**
  * Match a domain pattern against the request's host. Supports wildcards like
  * `*.example.com`.
@@ -1647,8 +1771,7 @@ function matchPath(pattern: string, actual: string): MatchedParams | null {
  * Comparing them verbatim sends that request to a fallback, or to a 404.
  */
 function matchDomain(pattern: string, host: string): boolean {
-  const [hostname = ''] = host.split(':') // strip port
-  const actualHost = hostname.toLowerCase()
+  const actualHost = hostnameOf(host)
   const wanted = pattern.toLowerCase()
   if (wanted === actualHost) return true
   if (wanted.startsWith('*.')) {

package/src/rpc/RpcRouter.ts

@@ -141,10 +141,10 @@ export interface RpcRouterOptions {
  * Returns the JSON-RPC error code+message to reject with, or undefined when the
  * caller is authorized.
  */
-function checkRpcAuthorization(
+async function checkRpcAuthorization(
   ctx: HttpContext,
   def: RpcMethodDefinition,
-): { code: number; message: string } | undefined {
+): Promise<{ code: number; message: string } | undefined> {
   const needsAuth = def.guards.length > 0 || def.roles.length > 0 || def.permissions.length > 0
   if (needsAuth && !ctx.auth?.isAuthenticated) {
     return { code: -32003, message: 'Unauthorized' }
@@ -159,7 +159,7 @@ function checkRpcAuthorization(
   }
   // A token-authenticated call also needs the token to allow each permission.
   if (def.permissions.length > 0) {
-    if (!holdsPermissions(ctx.auth, def.permissions)) {
+    if (!(await holdsPermissions(ctx.auth, def.permissions))) {
       return { code: -32003, message: 'Insufficient permissions' }
     }
   }
@@ -381,7 +381,7 @@ export class RpcRouter {
     if (!def) return rpcError(-32601, 'Method not found', id)
 
     try {
-      const denied = checkRpcAuthorization(ctx, def)
+      const denied = await checkRpcAuthorization(ctx, def)
       if (denied) return rpcError(denied.code, denied.message, id)
 
       // Run declared named middleware (e.g. guards) — they throw to deny, mapped

package/src/scheduler/Scheduler.ts

@@ -144,7 +144,7 @@ function loadNative(): NativeModule {
  * so scheduler context is never lost.
  */
 function translateNativeError(e: unknown): ReamError {
-  const asError = e as Error
+  const asError = e instanceof Error ? e : new Error(String(e))
   const parsed = ReamError.fromNapi(asError)
   // `fromNapi` returns an `E_UNKNOWN`-coded error when the message is not
   // a JSON payload. Preserve that context under a scheduler-specific

package/src/security/CookieSigner.ts

@@ -125,14 +125,22 @@ export class CookieSigner {
       return null
     }
     if (typeof parsed !== 'object' || parsed === null) return null
-    const envelope = parsed as Envelope
     // The KEY must be there, whatever it holds — that is what distinguishes an
     // envelope from an arbitrary JSON document, and a signed `null` or `0` is a
     // legitimate payload.
-    if (!('m' in envelope)) return null
-    if (envelope.e !== undefined && envelope.e < Date.now()) return null
-    if ((envelope.p ?? undefined) !== purpose) return null
-    return envelope.m
+    if (!('m' in parsed)) return null
+    // Each field checked for the type `#seal` writes before it is compared: an
+    // expiry that is not a number (`"e": "9999"`, `"e": null`) or a purpose
+    // that is not a string must not slip past the comparisons below.
+    const expiry: unknown = 'e' in parsed ? parsed.e : undefined
+    if (expiry !== undefined) {
+      if (typeof expiry !== 'number' || !Number.isFinite(expiry)) return null
+      if (expiry < Date.now()) return null
+    }
+    const sealedFor: unknown = 'p' in parsed ? parsed.p : undefined
+    if (sealedFor !== undefined && typeof sealedFor !== 'string') return null
+    if (sealedFor !== purpose) return null
+    return parsed.m
   }
 
   /**

package/src/security/SignedUrl.ts

@@ -3,6 +3,7 @@
  * Uses Rust NAPI via crypto facade when available.
  */
 
+import { durationToSeconds } from '../helpers/duration.js'
 import { constantTimeEq, hmacSign } from './crypto.js'
 
 export interface SignedUrlConfig {
@@ -56,22 +57,17 @@ export class SignedUrl {
   }
 }
 
+/**
+ * The lifetime of a signed URL in seconds. Read with the duration grammar
+ * used everywhere else (`'30 minutes'`, `'1 week'`, `'2h'`), and refused when
+ * it cannot be read: signing with a default instead turned "one week" into
+ * one hour without a word.
+ */
 function parseExpiry(value: string | number): number {
-  if (typeof value === 'number') return value
-  const match = value.match(/^(\d+)(s|m|h|d)$/)
-  if (!match) return 3600
-  const [, digits, unit] = match
-  const num = parseInt(digits ?? '0', 10)
-  switch (unit) {
-    case 's':
-      return num
-    case 'm':
-      return num * 60
-    case 'h':
-      return num * 3600
-    case 'd':
-      return num * 86400
-    default:
-      return 3600
+  if (typeof value === 'number' && !Number.isFinite(value)) {
+    throw new Error(
+      `Cannot read ${value} as a signed URL expiry: it must be a finite number of seconds.`,
+    )
   }
+  return durationToSeconds(value, 'a signed URL expiry')
 }

package/src/server/Server.ts

@@ -39,7 +39,10 @@ export interface GrpcCall {
   path: string
   /**
    * Request metadata: the request headers, every value of a repeated one in
-   * order, names lowercased. Never the client's trailers.
+   * order, names lowercased. Never the client's trailers. A `-bin` value is
+   * the base64 text that arrived: this is the HTTP/2 header layer, and the
+   * gRPC package that registers the handler decodes it, as a gRPC library's
+   * metadata class does over Node's HTTP/2 headers.
    */
   metadata: Record<string, string[]>
   /** The request message, still encoded. */

package/src/server/nativeLimits.ts

@@ -29,12 +29,21 @@ export interface NativeBodyLimit {
   types?: string[]
 }
 
+/**
+ * The multipart section, with the part counts the native parser enforces
+ * while it parses: it stops at the first field or file past its bound.
+ */
+export interface NativeMultipartLimit extends NativeBodyLimit {
+  maxFields?: number
+  maxFiles?: number
+}
+
 /** Body limits per body-parser section; an omitted section keeps its default. */
 export interface NativeBodyLimits {
   json?: NativeBodyLimit
   form?: NativeBodyLimit
   raw?: NativeBodyLimit
-  multipart?: NativeBodyLimit
+  multipart?: NativeMultipartLimit
 }
 
 /** Timeouts in milliseconds (`0` disables one) and the connection cap (`0` = unbounded). */
@@ -58,6 +67,14 @@ export function nativeBodyLimits(config: BodyParserConfig): NativeBodyLimits {
     if (given.types !== undefined) native.types = [...given.types]
     limits[section] = native
   }
+  const multipart = config.multipart
+  if (multipart) {
+    limits.multipart = {
+      ...limits.multipart,
+      ...(multipart.maxFields !== undefined && { maxFields: multipart.maxFields }),
+      ...(multipart.maxFiles !== undefined && { maxFiles: multipart.maxFiles }),
+    }
+  }
   return limits
 }