@johnhenry/letterpress 0.2.0 → 0.2.2

package/.github/workflows/ci.yml

@@ -12,3 +12,6 @@ jobs:
       node-versions: '["26"]'
       os: '["ubuntu-latest"]'
       gate-commands: npm test
+
+  workflow-lint:
+    uses: johnhenry/workflows/.github/workflows/workflow-lint.yml@v1

package/.github/workflows/publish.yml

@@ -1,25 +1,22 @@
 name: Publish to npm
 
+# Publish model: main is the release branch. A push to main publishes only if
+# package.json's version isn't on npm yet (otherwise a clean no-op), then tags
+# v<version> and creates a GitHub Release. See johnhenry/workflows' README.
 on:
-  release:
-    types: [published]
   push:
-    # Redundant with the release trigger above -- see fileable's
-    # publish.yml / johnhenry/workflows' README for the full incident
-    # writeup: creating a release very soon after a push/merge to the
-    # same commit can silently drop the release event for a job whose
-    # body is uses: <external-repo>/...@v1. This gives a second,
-    # idempotency-safe chance to fire.
-    tags:
-      - "v*"
+    branches: [main]
   workflow_dispatch: {}
 
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   publish:
     permissions:
-      contents: read
-      id-token: write # required by the reusable workflow's provenance step --
-        # see johnhenry/workflows' README for why this must be declared here too.
+      contents: write # tag + GitHub Release by-product of npm-publish.yml
+      id-token: write # npm provenance
     uses: johnhenry/workflows/.github/workflows/npm-publish.yml@v1
     with:
       node-version: "26"

package/CHANGELOG.md

@@ -6,6 +6,44 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 
 This project will adhere to [Semantic Versioning](https://semver.org/spec/v2.0.0.html) once it reaches 1.0.0.
 
+## [0.2.2] - 2026-10-14
+
+### Fixed
+
+- 🐛 **Multi-line bodies duplicated earlier lines** (#20). In
+  `utility/parse-http-text.mjs`, the line buffer was not cleared after each
+  committed body line, so a body of `a\nb\nc` came out as `a\nab\nabc`.
+  This affected `createResponse`/`createRoute`/`tagRequest`/`tagResponse`
+  (a regression since `0.2.0`; `0.0.3` was correct).
+
+## [0.2.1] - 2026-10-01
+
+### Fixed
+
+- 🐛 **A later function substitution's `context.setHeader()` stopped
+  overwriting an earlier template header line**, reversing `0.2.0`'s own
+  create-route.mjs backport. That backport resolved every function-valued
+  substitution in a pre-pass, before any template header line was
+  applied -- so a template header line always won, regardless of whether
+  a function substitution calling `setHeader` for the same name appeared
+  *after* it (originally, whichever ran later always won, matching plain
+  left-to-right template evaluation). `utility/parse-http-text.mjs` now
+  takes a `resolveSubstitution` callback invoked at the exact point the
+  scan reaches each substitution, and an `onHeaderLine` callback invoked
+  immediately per header line, instead of batching either until the whole
+  parse finishes -- restoring the original ordering while still sharing
+  one parser implementation. `tagRequest`/`tagResponse` are unaffected
+  (they have no function-substitution/side-effect concept to reorder).
+  Found by deliberately re-testing `0.2.0`'s backport against the
+  pre-refactor code's actual behavior, not by inspection.
+- A function-valued substitution returning a `Headers` object is now
+  merged directly, like a directly-substituted `Headers` object already
+  was -- previously it fell through to `.toString()`, producing the
+  literal text `"[object Headers]"` in the response body and silently
+  dropping the headers. Not separately tested before (no prior test
+  covered this combination); noted here since it's a user-visible
+  behavior difference from `0.2.0` and earlier, not just a `0.2.0` revert.
+
 ## [0.2.0] - 2026-09-30
 
 ### Added
@@ -89,7 +127,7 @@ already behaved) is the one `create-route.mjs` was always meant to have.
   carried over during the leroute -> `@johnhenry/letterpress` rename --
   it simply wasn't in the initial `@johnhenry/letterpress` source, a gap
   in that migration rather than an intentional removal. It was discovered
-  while porting a downstream consumer, `prism` (a live HTTP request
+  while porting a private downstream consumer (a live HTTP request
   inspector/proxy), whose proxy mode depends on it for rewriting proxied
   requests/responses. Ported unchanged in behavior as `rewrite.mjs`
   (`createRewriter`, plus `rewriteRequest`/`rewriteResponse`/`addRule`/
@@ -105,7 +143,7 @@ already behaved) is the one `create-route.mjs` was always meant to have.
 
 - ✨ **`router.mount(prefix, subHandler)`**: another `leroute` capability
   (`create-lerouter.mjs`'s `router.mount`) dropped during the same rename,
-  found via the same `prism` port -- prism's own top-level router uses it
+  found via the same port -- that app's own top-level router uses it
   to mount its dashboard sub-router under `/inspect`. Delegates every
   request under `prefix` to `subHandler` with the prefix stripped from the
   forwarded request's path; `subHandler` may be a plain `(Request) =>
@@ -127,9 +165,9 @@ already behaved) is the one `create-route.mjs` was always meant to have.
   and forwarded to `defaultHandler` too. This was also present in `leroute`
   (`router(request, ctx = {})`) and dropped during the rename; brought back
   specifically so `mount()` can hand a mounted sub-router its `mountPrefix`
-  (used by `prism` to reconstruct the full request path for display in its
+  (used by that app to reconstruct the full request path for display in its
   captured-request feed, purely cosmetic but a real fidelity gap otherwise)
-  -- caught by testing `mount()` end-to-end against `prism` itself, not by
+  -- caught by testing `mount()` end-to-end against that app itself, not by
   a direct comparison against the old source this time. Existing single-arg
   `router(request)` callers are unaffected (`ctx` defaults to `{}`).
 

package/README.md

@@ -265,7 +265,7 @@ rewriter.addRule({ match: { path: "/teapot" }, action: { setStatus: 418 } });
 > This existed in `leroute` (the package letterpress was renamed from --
 > see the provenance note near the top of this README) but was dropped
 > during that rename. It's ported here, discovered missing while porting a
-> downstream consumer (`prism`, a request inspector/proxy) that relies on
+> downstream consumer (a private request inspector/proxy) that relies on
 > it for proxy-mode rewriting -- see CHANGELOG.md.
 
 ### `deconstruct`, `cook`
@@ -318,13 +318,6 @@ is designed to pair with a sibling package that does.
   `Route`-shaped function works too; `leserve` is the tested, documented
   pairing, not a hard dependency (it's a `devDependency` here, used only in
   the demo scripts).
-- **[`@johnhenry/prism`](https://github.com/johnhenry/prism)** -- a live
-  HTTP request inspector/proxy that uses `createRouter()` as its top-level
-  router. Porting it surfaced two real gaps left over from letterpress's
-  own rename from `leroute`: `router.mount()` (with the `ctx`-forwarding
-  its `mountPrefix` depends on) and `createRewriter`
-  (`@johnhenry/letterpress/rewrite`) -- both closed as part of that port,
-  see CHANGELOG.md.
 
 ## 🤝 Contributing
 

package/create-route.mjs

@@ -2,24 +2,6 @@ import { parseHttpText } from "./utility/parse-http-text.mjs";
 
 const DEFAULT_REQUEST = () => new Request("http://.");
 
-// Same rule tag-request.mjs/tag-response.mjs use: the first occurrence of
-// a header name overwrites whatever was already set (e.g. from `init`),
-// a second-or-later occurrence of the *same name* accumulates instead of
-// overwriting it. Fixes the Set-Cookie-overwrite bug this file used to
-// have (headers.set() for every line, unconditionally).
-const mergeHeaderEntries = (headers, headerEntries) => {
-  const seen = new Set();
-  for (const { name, value } of headerEntries) {
-    const key = name.toLowerCase();
-    if (seen.has(key)) {
-      headers.append(name, value);
-    } else {
-      headers.set(name, value);
-      seen.add(key);
-    }
-  }
-};
-
 export const createRoute = (initOrMiddleware) => {
   const getInit =
     typeof initOrMiddleware === "function"
@@ -49,28 +31,40 @@ export const createRoute = (initOrMiddleware) => {
         ...additionalContext,
       };
 
-      // Resolve every function-valued substitution up front -- this is
-      // create-route's one feature the shared parser doesn't (and
-      // shouldn't) know about: a substitution can run arbitrary async
-      // work and mutate `context` (headers/status) as a side effect, in
-      // addition to contributing a value to the template. `null`/
-      // `undefined` are preserved (parseHttpText already treats either as
-      // "contributes nothing," matching ordinary JS template semantics).
-      const resolvedSubstitutions = [];
-      for (const sub of substitutions) {
-        resolvedSubstitutions.push(
-          typeof sub === "function" ? await sub(request, context) : sub
-        );
-      }
-
-      const { startLine, headerEntries, body } = parseHttpText(
-        strings,
-        resolvedSubstitutions,
-        {
-          isStartLine: (line) => line.startsWith("HTTP/"),
-          trimBodyLines: true,
+      // Same rule tag-request.mjs/tag-response.mjs use: the first
+      // occurrence of a header name overwrites whatever was already set
+      // (e.g. from `init`), a second-or-later occurrence of the *same
+      // name* accumulates instead of overwriting it. Applied immediately
+      // per header line (via onHeaderLine below), not batched until the
+      // whole parse finishes -- a *later* function substitution's
+      // context.setHeader() call must still be able to overwrite an
+      // earlier template header line, exactly like the original
+      // chunk-by-chunk implementation did.
+      const seenHeaderNames = new Set();
+      const applyHeaderLine = (name, value) => {
+        const key = name.toLowerCase();
+        if (seenHeaderNames.has(key)) {
+          headers.append(name, value);
+        } else {
+          headers.set(name, value);
+          seenHeaderNames.add(key);
         }
-      );
+      };
+
+      const { startLine, body } = await parseHttpText(strings, substitutions, {
+        isStartLine: (line) => line.startsWith("HTTP/"),
+        trimBodyLines: true,
+        onHeaderLine: applyHeaderLine,
+        // Function-valued substitutions are create-route's one feature
+        // the shared parser doesn't (and shouldn't) know about on its
+        // own: a substitution can run arbitrary async work and mutate
+        // `context` (headers/status) as a side effect, in addition to
+        // contributing a value to the template. Resolved inline, at the
+        // exact point the scan reaches it, so its side effects land in
+        // the same left-to-right order as the template text itself.
+        resolveSubstitution: (sub) =>
+          typeof sub === "function" ? sub(request, context) : sub,
+      });
 
       if (startLine !== null) {
         const [, statusCodeText, ...statusTextParts] = startLine.split(" ");
@@ -81,8 +75,6 @@ export const createRoute = (initOrMiddleware) => {
         }
       }
 
-      mergeHeaderEntries(headers, headerEntries);
-
       let responseBody = body;
       const isBinaryBody = typeof responseBody !== "string";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@johnhenry/letterpress",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "A tagged-template-string HTTP routing library for defining and matching request handlers with plain JavaScript syntax.",
   "main": "index.mjs",
   "types": "types.d.ts",

package/rewrite.mjs

@@ -8,7 +8,7 @@
  * see the README's provenance note) as `createRewriter`, but was dropped
  * during the leroute -> @johnhenry/letterpress rename. It's ported here
  * unchanged in behavior, discovered missing while porting a downstream
- * consumer (`prism`, a request inspector/proxy) that relies on it for
+ * consumer (a private request inspector/proxy) that relies on it for
  * proxy-mode rewriting.
  *
  * Rules format:

package/tag-request.mjs

@@ -45,7 +45,7 @@ export const tagRequest = (defaults = {}) => {
   }
 
   return async function (strings, ...substitutions) {
-    const { startLine, headerEntries, body } = parseHttpText(
+    const { startLine, headerEntries, body } = await parseHttpText(
       strings,
       substitutions
     );

package/tag-response.mjs

@@ -26,7 +26,7 @@ const mergeHeaderEntries = (headerEntries) => {
 };
 
 export const tagResponse = async function (strings, ...substitutions) {
-  const { startLine, headerEntries, body } = parseHttpText(
+  const { startLine, headerEntries, body } = await parseHttpText(
     strings,
     substitutions
   );

package/test/route.mjs

@@ -124,6 +124,27 @@ ${"body text"}`;
     assert.strictEqual(await response.text(), "body text");
   });
 
+  it("should apply a later function substitution's setHeader() after an earlier template header line (ordering regression)", async () => {
+    // Regression test: the first version of the create-route.mjs/
+    // parse-http-text.mjs backport resolved every function-valued
+    // substitution in a pre-pass, before any template header line was
+    // parsed -- so a context.setHeader() call from a function appearing
+    // *later* in the template always lost to an earlier template header
+    // line, reversing the original left-to-right "last write wins"
+    // ordering. Substitutions must now be resolved (and header lines
+    // applied) at the exact point the scan reaches them.
+    const route = createRoute()`HTTP/1.1 200 OK
+X-Foo: from-template-line
+Content-Type: text/plain
+
+${async (_, { response }) => {
+  response.headers.set("X-Foo", "from-function-side-effect");
+  return "body";
+}}`;
+    const response = await route(new Request("https://example.com"));
+    assert.strictEqual(response.headers.get("X-Foo"), "from-function-side-effect");
+  });
+
   it("should handle streaming responses", async () => {
     const route = createRoute({ streaming: true })`
       ${async (_, { response }) => {

package/test/tag-req-res.mjs

@@ -1,6 +1,6 @@
 import { test } from "node:test";
 import { strict as assert } from "node:assert";
-import { tagRequest, tagResponse } from "../index.mjs";
+import { tagRequest, tagResponse, createResponse } from "../index.mjs";
 
 const createReadableStream = (data) =>
   new ReadableStream({
@@ -251,3 +251,34 @@ hello`;
     assert.equal(auto.headers.get("content-length"), "5");
   });
 });
+
+test("multi-line bodies are not duplicated (issue #20)", async (t) => {
+  await t.test("tagResponse", async () => {
+    const response = await tagResponse`HTTP/1.1 200 OK
+
+a
+b
+c`;
+    assert.equal(await response.text(), "a\nb\nc");
+  });
+
+  await t.test("tagRequest", async () => {
+    const request = await tagRequest()`POST /x HTTP/1.1
+
+a
+b
+c`;
+    assert.equal(await request.text(), "a\nb\nc");
+  });
+
+  await t.test("createResponse with substitution in a later line", async () => {
+    const name = "x";
+    const response = await createResponse`HTTP/1.1 200 OK
+Content-Type: text/plain
+
+line1
+line2 ${name}
+line3`;
+    assert.equal(await response.text(), "line1\nline2 x\nline3");
+  });
+});

package/utility/parse-http-text.mjs

@@ -39,8 +39,27 @@ const BINARY_BODY_TYPES = (value) =>
 // this -- body content there is literal, preserved exactly as written,
 // since trimming could corrupt meaningful whitespace in a text body.
 // Defaults to false (the strict behavior); create-route.mjs passes true.
-export const parseHttpText = (strings, substitutions, options = {}) => {
-  const { isStartLine = () => true, trimBodyLines = false } = options;
+// options.resolveSubstitution(value, index): called (and awaited) for
+// each substitution at the exact point the scan reaches it -- not
+// pre-resolved up front -- so a caller like create-route.mjs can run a
+// function-valued substitution's side effects (context.setHeader, etc.)
+// in the same left-to-right order the original chunk-by-chunk processor
+// used. Defaults to the identity function.
+// options.onHeaderLine(name, value): called immediately as each header
+// line (or Headers-object substitution) is parsed, interleaved with
+// resolveSubstitution calls in the same left-to-right order -- lets
+// create-route.mjs apply a template header line to its live `headers`
+// object right away, so a *later* function substitution's
+// context.setHeader() call still overwrites it (matching the original
+// implementation's ordering), rather than only being visible once the
+// whole parse finishes.
+export const parseHttpText = async (strings, substitutions, options = {}) => {
+  const {
+    isStartLine = () => true,
+    trimBodyLines = false,
+    resolveSubstitution = (value) => value,
+    onHeaderLine = null,
+  } = options;
 
   const stringsArr = [...strings];
   stringsArr[0] = stringsArr[0].replace(/^[ \t\r\n]+/, "");
@@ -107,10 +126,10 @@ export const parseHttpText = (strings, substitutions, options = {}) => {
       } else {
         const colonIndex = lineBuffer.indexOf(":");
         if (colonIndex > 0) {
-          headerEntries.push({
-            name: lineBuffer.slice(0, colonIndex).trim(),
-            value: lineBuffer.slice(colonIndex + 1).trim(),
-          });
+          const name = lineBuffer.slice(0, colonIndex).trim();
+          const value = lineBuffer.slice(colonIndex + 1).trim();
+          headerEntries.push({ name, value });
+          if (onHeaderLine) onHeaderLine(name, value);
         }
       }
     }
@@ -123,6 +142,7 @@ export const parseHttpText = (strings, substitutions, options = {}) => {
       if (p > 0) {
         if (zone === "body") {
           commitBodyLine(lineBuffer, false);
+          lineBuffer = "";
         } else {
           flushLine();
         }
@@ -131,9 +151,12 @@ export const parseHttpText = (strings, substitutions, options = {}) => {
     }
 
     if (i < substitutions.length) {
-      const sub = substitutions[i];
+      const sub = await resolveSubstitution(substitutions[i], i);
       if (sub instanceof Headers) {
-        for (const [name, value] of sub) headerEntries.push({ name, value });
+        for (const [name, value] of sub) {
+          headerEntries.push({ name, value });
+          if (onHeaderLine) onHeaderLine(name, value);
+        }
       } else if (zone !== "headers" && BINARY_BODY_TYPES(sub)) {
         if (pendingBinary) {
           throw new TypeError(