@c9up/ream 0.2.29 → 0.2.30

package/src/session/Session.ts

@@ -288,19 +288,28 @@ export class Session {
     // The store is untyped by nature, so `T` is the CALLER's claim about what
     // it put there — one assertion from `unknown`, which is what `T` means
     // here. Going through `any` first widened nothing and hid the intent.
-    if (key in this.#data) return this.#data[key] as T
+    // OWN keys only: `in` walked the prototype, so an empty session answered
+    // `get('toString')` with a function and `has('constructor')` with true.
+    if (Object.hasOwn(this.#data, key)) return this.#data[key] as T
     return defaultValue as T
   }
 
   /** Set a session value. */
   put(key: string, value: unknown): void {
-    this.#data[key] = value
+    // Defined, not assigned: `put('__proto__', x)` stores a key like any
+    // other instead of replacing the session data's prototype.
+    Object.defineProperty(this.#data, key, {
+      value,
+      writable: true,
+      enumerable: true,
+      configurable: true,
+    })
     this.#dirty = true
   }
 
   /** Check if a key exists. */
   has(key: string): boolean {
-    return key in this.#data
+    return Object.hasOwn(this.#data, key)
   }
 
   /** Get all session data. */
@@ -504,7 +513,7 @@ export class Session {
   old<T = unknown>(key: string, defaultValue?: T): T {
     // Same contract as `get`: `T` is the caller's claim about a store that is
     // untyped by nature.
-    if (key in this.#previousFlash) return this.#previousFlash[key] as T
+    if (Object.hasOwn(this.#previousFlash, key)) return this.#previousFlash[key] as T
     return defaultValue as T
   }
 

package/src/session/drivers/MemoryDriver.ts

@@ -3,6 +3,16 @@ import type { SessionDriverWithTagging, TaggedSession } from '../Session.js'
 /** Sweep expired entries once the store reaches this size. */
 const SWEEP_THRESHOLD = 1000
 
+/**
+ * At most one sweep per this many milliseconds.
+ *
+ * A sweep walks the whole store. Run on every write past the threshold, a
+ * flood of anonymous requests turned each write into a 10 000-entry scan —
+ * quadratic, and 20 000 writes took seconds. Between two sweeps the cap below
+ * still bounds the store, and a read drops the expired entry it lands on.
+ */
+const SWEEP_INTERVAL_MS = 1000
+
 /**
  * Hard cap on live sessions.
  *
@@ -25,6 +35,8 @@ export class MemoryDriver implements SessionDriverWithTagging {
   /** user id → the sessions tagged with it. */
   #tags: Map<string, Set<string>> = new Map()
   readonly #maxEntries: number
+  /** When the last sweep ran, epoch milliseconds. */
+  #lastSweep = 0
 
   constructor(options: MemoryDriverOptions = {}) {
     this.#maxEntries = Math.max(1, options.maxEntries ?? DEFAULT_MAX_ENTRIES)
@@ -40,8 +52,9 @@ export class MemoryDriver implements SessionDriverWithTagging {
   }
 
   async write(sessionId: string, data: Record<string, unknown>, ttl: number): Promise<void> {
-    if (this.#store.size >= SWEEP_THRESHOLD) {
-      const now = Date.now()
+    const now = Date.now()
+    if (this.#store.size >= SWEEP_THRESHOLD && now - this.#lastSweep >= SWEEP_INTERVAL_MS) {
+      this.#lastSweep = now
       for (const [id, entry] of this.#store) {
         if (entry.expiresAt < now) this.#store.delete(id)
       }

package/src/storage/StaticMiddleware.ts

@@ -147,7 +147,11 @@ export class StaticMiddleware {
     const method = ctx.request.method()
     if (method !== 'GET' && method !== 'HEAD') return next()
 
-    const reqPath = ctx.request.path()
+    // Outside the prefix the request is none of this middleware's business —
+    // not even a dot-file refusal, or `{ prefix: '/static', dotFiles: 'deny' }`
+    // answers 403 to an application route such as `/.well-known/...`.
+    const reqPath = this.#withinPrefix(ctx.request.path())
+    if (reqPath === null) return next()
 
     // A dotfile under `deny` is answered, not passed on: falling through would
     // leak its existence through whatever the router answers next. The check
@@ -327,17 +331,22 @@ export class StaticMiddleware {
    * from the descriptor: what gets served is then the same file that passed the
    * checks, which a path re-read after the fact cannot promise.
    */
+  /**
+   * The request path below the prefix, or `null` when it lies outside it.
+   * Match only when the prefix is followed by `/` or end-of-path — otherwise
+   * `/staticx/foo.js` would be intercepted when the configured prefix is
+   * `/static`, hijacking unrelated routes.
+   */
+  #withinPrefix(reqPath: string): string | null {
+    if (this.#prefix === '') return reqPath
+    if (!(reqPath === this.#prefix || reqPath.startsWith(`${this.#prefix}/`))) return null
+    return reqPath.slice(this.#prefix.length) || '/'
+  }
+
+  /** `reqPath` is already relative to the prefix ({@link #withinPrefix}). */
   async #openServableFile(
     reqPath: string,
   ): Promise<{ handle: FileHandle; filePath: string; stat: fs.Stats } | null> {
-    if (this.#prefix !== '') {
-      // Match only when the prefix is followed by `/` or end-of-path —
-      // otherwise `/staticx/foo.js` would be intercepted when the configured
-      // prefix is `/static`, hijacking unrelated routes.
-      if (!(reqPath === this.#prefix || reqPath.startsWith(`${this.#prefix}/`))) return null
-      reqPath = reqPath.slice(this.#prefix.length) || '/'
-    }
-
     // Percent-decoding happens BEFORE any check and BEFORE resolution on
     // purpose: the dot-file policy has to see the name that will be opened
     // (`%2eenv` is `.env`), and `%2e%2e%2f` is `../`, which has to be

package/src/testing/ApiResponse.ts

@@ -78,7 +78,13 @@ export function partialMatch(actual: unknown, expected: unknown): boolean {
 
 /** Split a `Set-Cookie` header value into its individual cookie strings. */
 function splitSetCookie(setCookie: string): string[] {
-  return setCookie.split(/,(?=\s*[\w-]+=)/).map((c) => c.trim())
+  // One cookie per line, as the response parser stores them; a header folded
+  // with commas by another source is still split where a new `name=` starts.
+  return setCookie
+    .split('\n')
+    .flatMap((line) => line.split(/,(?=\s*[\w-]+=)/))
+    .map((c) => c.trim())
+    .filter((c) => c !== '')
 }
 
 /** A parsed response cookie — `name` + `value` plus any attributes present. */

package/src/testing/TestClient.ts

@@ -195,7 +195,7 @@ export class TestClient {
         m,
         p,
         { ...this.#headers, ...init.headers },
-        init.body.toString('utf8'),
+        init.body,
         init.timeoutMs,
       )
     }
@@ -288,7 +288,7 @@ async function sendRequest(
   method: string,
   path: string,
   headers: Dict,
-  body: string,
+  body: Buffer,
   timeoutMs?: number,
 ): Promise<TestResponse> {
   const { connect } = await import('node:net')
@@ -300,7 +300,10 @@ async function sendRequest(
         .map(([k, v]) => `${k}: ${v}`)
         .join('\r\n')
 
-      const contentLength = Buffer.byteLength(body, 'utf8')
+      // The body stays a Buffer end to end: a multipart upload of a PNG or a
+      // PDF is not valid UTF-8, and a round trip through a string replaced
+      // every such byte with U+FFFD before the server ever saw it.
+      const contentLength = body.length
 
       let request = `${method} ${path} HTTP/1.1\r\n`
       request += `Host: localhost:${port}\r\n`
@@ -312,9 +315,9 @@ async function sendRequest(
         request += `${headerLines}\r\n`
       }
       request += '\r\n'
-      request += body
 
       socket.write(request)
+      if (contentLength > 0) socket.write(body)
     })
 
     const chunks: Buffer[] = []
@@ -371,13 +374,19 @@ export function parseHttpResponse(raw: string | Buffer): TestResponse {
   const [, statusDigits] = statusLine.match(/HTTP\/\d+\.\d+ (\d+)/) ?? []
   const status = statusDigits === undefined ? 0 : Number.parseInt(statusDigits, 10)
 
+  // A repeated header is never overwritten. Set-Cookie lines are joined with
+  // `\n`, the way `Response.getHeaders()` hands them to the serializer: a
+  // cookie's `Expires` holds a comma, so a comma cannot separate two of them
+  // (RFC 6265 §3). Any other field is combined with `, ` (RFC 9110 §5.3).
   const headers: Dict = {}
   for (const line of lines.slice(1)) {
     const colonIdx = line.indexOf(':')
     if (colonIdx === -1) continue
     const key = line.slice(0, colonIdx).trim().toLowerCase()
     const value = line.slice(colonIdx + 1).trim()
-    headers[key] = value
+    const existing = headers[key]
+    if (existing === undefined) headers[key] = value
+    else headers[key] = `${existing}${key === 'set-cookie' ? '\n' : ', '}${value}`
   }
 
   // RFC 7230 §4.1: when Transfer-Encoding includes `chunked`, the message body

package/src/utils/Macroable.ts

@@ -27,12 +27,12 @@ export type MacroFn = (...args: unknown[]) => unknown
 /** A getter implementation — declare `this` in your callback to type the receiver. */
 export type GetterFn = () => unknown
 
-// biome-ignore lint/complexity/noStaticOnlyClass: eight classes extend this one to inherit macro()/getter(); it is a base class, not a namespace.
+// biome-ignore lint/complexity/noStaticOnlyClass: nine classes extend this one to inherit macro()/getter(); it is a base class, not a namespace.
 export class Macroable {
   /**
    * Attach a method to every instance of THIS class (AdonisJS `macro`).
    *
-   * `this.prototype`, not `Macroable.prototype`: eight classes extend this one,
+   * `this.prototype`, not `Macroable.prototype`: nine classes extend this one,
    * and defining on the base put every macro on all of them — a
    * `Response.macro('json', …)` also landed on `Request`, `Router` and
    * `HttpContext`, and two subclasses declaring the same name clobbered each

package/scripts/build-napi-types.mjs

@@ -1,69 +0,0 @@
-#!/usr/bin/env node
-/**
- * Regenerate `src/native/generated.ts` from the Rust.
- *
- * Node rather than a shell script because this runs inside `build:napi`, and
- * that runs on the Windows prebuild runner too: a bash `mktemp` there hands
- * cargo a `/tmp/...` path the native proc-macro cannot write to, so the
- * type-def file comes back empty and the build fails for no visible reason.
- *
- * One crate at a time on purpose: with napi-derive 2 the writes all went to a
- * single `TYPE_DEF_TMP_PATH` and a parallel build interleaved them
- * while cargo compiles, and a parallel build interleaves the writes —
- * definitions go missing, silently, and the generated file comes out short.
- */
-
-import { execFileSync } from 'node:child_process'
-import { createRequire } from 'node:module'
-import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
-import { tmpdir } from 'node:os'
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const CRATES = ['ream-events-napi', 'ream-http-napi', 'ream-scheduler-napi']
-
-const packageRoot = join(dirname(fileURLToPath(import.meta.url)), '..')
-const output = join('src', 'native', 'generated.ts')
-const scratch = mkdtempSync(join(tmpdir(), 'napi-types-'))
-
-try {
-  const lines = []
-  for (const crate of CRATES) {
-    const perCrate = join(scratch, crate)
-    writeFileSync(perCrate, '')
-    execFileSync('cargo', ['build', '-p', crate], {
-      cwd: packageRoot,
-      env: { ...process.env, NAPI_TYPE_DEF_TMP_FOLDER: scratch },
-      stdio: ['ignore', 'ignore', 'inherit'],
-    })
-    const emitted = readFileSync(perCrate, 'utf8').split('\n').filter(Boolean)
-    if (emitted.length === 0) {
-      throw new Error(
-        `[napi-types] ${crate} emitted nothing — is napi-derive's "type-def" feature on?`,
-      )
-    }
-    lines.push(...emitted)
-  }
-
-  const combined = join(scratch, 'combined.jsonl')
-  writeFileSync(combined, `${lines.join('\n')}\n`)
-
-  execFileSync(
-    process.execPath,
-    [join('scripts', 'generate-napi-types.mjs'), combined, output],
-    { cwd: packageRoot, stdio: 'inherit' },
-  )
-
-  // Formatted here rather than excluded from the linter: the file is checked
-  // in, so it should read like the rest of the tree — and formatting it at
-  // generation means it never shows up as a diff someone has to fix by hand.
-  // Resolved through the package entry rather than `node_modules/.bin`, whose
-  // shim is a shell script the Windows runner cannot execute directly.
-  const biome = createRequire(import.meta.url).resolve('@biomejs/biome/bin/biome')
-  execFileSync(process.execPath, [biome, 'format', '--write', output], {
-    cwd: packageRoot,
-    stdio: ['ignore', 'ignore', 'inherit'],
-  })
-} finally {
-  rmSync(scratch, { recursive: true, force: true })
-}

package/scripts/copy-napi.mjs

@@ -1,121 +0,0 @@
-// Copy every freshly-built Ream NAPI cdylib out of cargo's target
-// directory and into the package root with the platform-suffix naming
-// convention used by `napi-loader.ts`:
-//
-//     packages/ream/index.linux-x64-gnu.node       (ream-http-napi)
-//     packages/ream/scheduler.linux-x64-gnu.node   (ream-scheduler-napi)
-//     packages/ream/index.darwin-arm64.node
-//     ...
-//
-// The TS loader walks two upper directories from each `loadNapi` caller
-// to find these files, so the binaries MUST live at the package root
-// (not under target/) to be discovered at runtime.
-//
-// Usage:
-//
-//     pnpm --filter @c9up/ream build:rust     # cargo build --release
-//     pnpm --filter @c9up/ream build:napi     # build:rust + this script
-//
-// The package.json script chains both steps. CI / npm publish runs
-// `build:napi` once per platform during the matrix build — every
-// crate listed in `NAPI_CRATES` ships in the tarball.
-
-import { copyFileSync, existsSync } from 'node:fs'
-import { dirname, join, resolve } from 'node:path'
-import { arch, env, platform } from 'node:process'
-import { fileURLToPath } from 'node:url'
-
-const here = dirname(fileURLToPath(import.meta.url))
-const root = join(here, '..')
-
-// Rust target triple -> { suffix, os }. Set CARGO_BUILD_TARGET to cross-compile
-// (e.g. build the x86_64-apple-darwin binary on an arm64 macOS runner so we
-// don't depend on the scarce macos-13 Intel runners). When unset we fall back
-// to the host platform/arch and the default target/release dir.
-const TRIPLE_MAP = {
-  'x86_64-unknown-linux-gnu': { suffix: 'linux-x64-gnu', os: 'linux' },
-  'aarch64-unknown-linux-gnu': { suffix: 'linux-arm64-gnu', os: 'linux' },
-  'x86_64-apple-darwin': { suffix: 'darwin-x64', os: 'darwin' },
-  'aarch64-apple-darwin': { suffix: 'darwin-arm64', os: 'darwin' },
-  'x86_64-pc-windows-msvc': { suffix: 'win32-x64-msvc', os: 'win32' },
-}
-
-const HOST_SUFFIX_MAP = {
-  'linux-x64': 'linux-x64-gnu',
-  'linux-arm64': 'linux-arm64-gnu',
-  'darwin-x64': 'darwin-x64',
-  'darwin-arm64': 'darwin-arm64',
-  'win32-x64': 'win32-x64-msvc',
-}
-
-// Cargo writes its artifacts under CARGO_TARGET_DIR when that is set — a
-// shared cache, a CI mount — so they are not under this package's `target/` at
-// all. A relative value is resolved against the directory cargo ran in, which
-// is this package root.
-const targetDir = env.CARGO_TARGET_DIR
-  ? resolve(root, env.CARGO_TARGET_DIR)
-  : join(root, 'target')
-
-const triple = env.CARGO_BUILD_TARGET ?? ''
-let suffix
-let os
-let releaseDir
-if (triple) {
-  const entry = TRIPLE_MAP[triple]
-  if (!entry) {
-    throw new Error(`[ream:napi] unsupported CARGO_BUILD_TARGET: ${triple}`)
-  }
-  suffix = entry.suffix
-  os = entry.os
-  releaseDir = join(targetDir, triple, 'release')
-} else {
-  suffix = HOST_SUFFIX_MAP[`${platform}-${arch}`]
-  os = platform
-  releaseDir = join(targetDir, 'release')
-  if (!suffix) {
-    throw new Error(`[ream:napi] unsupported platform/arch: ${platform}-${arch}`)
-  }
-}
-
-// Every NAPI crate shipped from the @c9up/ream package. `crateLib` is the
-// underscore-suffixed name cargo produces under `target/release/`;
-// `targetName` is what `loadNapi({ binaryName })` expects at the package
-// root (see `napi-loader.ts` — the binary lookup prefix matches the
-// `binaryName` option passed by each TS consumer).
-const NAPI_CRATES = [
-  { crateLib: 'ream_http_napi', targetName: 'index' },
-  { crateLib: 'ream_scheduler_napi', targetName: 'scheduler' },
-  { crateLib: 'ream_events_napi', targetName: 'events' },
-]
-
-// `crate-type = ["cdylib"]` settles on the platform-conventional file
-// name. Linux + macOS prepend `lib`; Windows drops the prefix and uses
-// `.dll`. Check both Windows shapes so we degrade gracefully if upstream
-// cargo ever switches naming.
-function buildCandidates(crateLib) {
-  if (os === 'win32') {
-    return [
-      join(releaseDir, `${crateLib}.dll`),
-      join(releaseDir, `lib${crateLib}.dll`),
-    ]
-  }
-  if (os === 'darwin') {
-    return [join(releaseDir, `lib${crateLib}.dylib`)]
-  }
-  return [join(releaseDir, `lib${crateLib}.so`)]
-}
-
-for (const { crateLib, targetName } of NAPI_CRATES) {
-  const candidates = buildCandidates(crateLib)
-  const source = candidates.find((candidate) => existsSync(candidate))
-  if (!source) {
-    throw new Error(
-      `[ream:napi] native library for '${crateLib}' not found. Looked for:\n${candidates
-        .map((p) => `- ${p}`)
-        .join('\n')}\nRun 'pnpm --filter @c9up/ream build:rust' first.`,
-    )
-  }
-  const target = join(root, `${targetName}.${suffix}.node`)
-  copyFileSync(source, target)
-  console.log(`[ream:napi] copied ${source} -> ${target}`)
-}

package/scripts/generate-mime.mjs

@@ -1,119 +0,0 @@
-/**
- * Regenerate `src/http/mime.ts` from mime-db.
- *
- * The table is data, not logic, and hand-maintaining it is how `.yaml` and
- * `.sql` went missing. `mime-types` reads the same two fields out of mime-db —
- * the resolved extension map and the per-type `charset` — so generating from
- * there keeps `contentType()` answering exactly what the package answered.
- *
- * mime-db and mime-types are dev-only: they are read HERE, at generation time,
- * and never imported by the framework.
- *
- *     node scripts/generate-mime.mjs
- */
-
-import { createRequire } from 'node:module'
-import { writeFile } from 'node:fs/promises'
-import { fileURLToPath } from 'node:url'
-import { dirname, join } from 'node:path'
-
-const require = createRequire(import.meta.url)
-const mimeTypes = require('mime-types')
-const db = require('mime-db')
-const dbVersion = require('mime-db/package.json').version
-
-const here = dirname(fileURLToPath(import.meta.url))
-const target = join(here, '..', 'src', 'http', 'mime.ts')
-
-/**
- * Emitted in the package's own style — single quotes, no semicolons — so a
- * regenerated file is already what `biome check` wants and the diff after a
- * regeneration is the data that changed, nothing else.
- */
-const quote = (value) => `'${value.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`
-/** An identifier when it is one, a quoted key otherwise (`7z`, `3gp`…). */
-const key = (ext) => (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(ext) ? ext : quote(ext))
-
-const extensions = Object.keys(mimeTypes.types).sort()
-const rows = extensions.map((e) => `  ${key(e)}: ${quote(mimeTypes.types[e])},`).join('\n')
-
-const charsets = Object.entries(db)
-  .filter(([, entry]) => entry.charset)
-  .sort(([a], [b]) => a.localeCompare(b))
-  .map(([type, entry]) => `  ${quote(type)}: ${quote(entry.charset.toLowerCase())},`)
-  .join('\n')
-
-await writeFile(target, render({ rows, charsets, dbVersion, count: extensions.length }))
-process.stdout.write(`mime.ts: ${extensions.length} extensions from mime-db ${dbVersion}\n`)
-
-function render({ rows, charsets, dbVersion, count }) {
-  return `/**
- * Content types for a response, resolved here rather than pulled in.
- *
- * \`response.type("txt")\` has to become \`text/plain; charset=utf-8\`, which is a
- * lookup table and one charset rule — the same job \`@c9up/archive\` already
- * does in its own table, so the framework was carrying a dependency for work
- * the ecosystem already owned.
- *
- * A hand-written table is what made that a regression rather than a saving:
- * it knew the extensions someone thought of, so \`.yaml\`, \`.sql\`, \`.opus\` and
- * \`.xhtml\` fell through and the caller's own string went out as the content
- * type. The tables below are GENERATED from mime-db instead, which is where
- * \`mime-types\` reads them too, so the resolution is the same one and stays
- * the same one.
- *
- * Regenerate with:
- *
- *     node scripts/generate-mime.mjs
- *
- * Do not edit {@link TYPES} or {@link CHARSETS} by hand.
- *
- * @generated from mime-db ${dbVersion} (${count} extensions)
- */
-
-/** Extension → type. No leading dot; lowercase. */
-const TYPES: Record<string, string> = {
-${rows}
-}
-
-/**
- * Types that declare a charset of their own, lowercased.
- *
- * Everything else under \`text/\` defaults to utf-8; everything else has none.
- * That is mime-db's \`charset\` field plus \`mime-types\`' \`text/*\` fallback.
- */
-const CHARSETS: Record<string, string> = {
-${charsets}
-}
-
-/** The charset for a type, or \`undefined\` when it carries none. */
-function charsetFor(type: string): string | undefined {
-  const base = type.split(';')[0].trim().toLowerCase()
-  const declared = CHARSETS[base]
-  if (declared !== undefined) return declared
-  return base.startsWith('text/') ? 'utf-8' : undefined
-}
-
-/** The type for a bare extension, or \`undefined\` when it is not one we know. */
-export function lookupType(extension: string): string | undefined {
-  const ext = extension.replace(/^.*\\./, '').toLowerCase()
-  return TYPES[ext]
-}
-
-/**
- * A full \`Content-Type\` for an extension or a type (\`mime-types.contentType\`).
- *
- * Returns \`false\` for something it cannot resolve, as the package did, so the
- * caller keeps its existing fallback rather than writing \`content-type: false\`.
- */
-export function contentType(input: string): string | false {
-  if (input.length === 0) return false
-  // Already a type — possibly with parameters the caller set itself.
-  const type = input.includes('/') ? input : lookupType(input)
-  if (type === undefined) return false
-  if (type.includes('charset=')) return type
-  const charset = charsetFor(type)
-  return charset === undefined ? type : \`\${type}; charset=\${charset}\`
-}
-`
-}