@jsenv/server 17.6.1 → 17.6.3

package/src/plugins/filesystem/fetch_file.js

@@ -1,12 +1,14 @@
 /*
- * This function returns response properties in a plain object like
- * { status: 200, body: "Hello world" }.
- * It is meant to be used inside "requestToResponse"
+ * Turns a request for a file into response properties: content type, client
+ * cache (etag or mtime), compression, directory listing or main file. The
+ * response is a plain object so that it composes with what the router and
+ * the plugins add.
  */
 
 import { urlIsOrIsInsideOf, urlToExtension, urlToPathname } from "@jsenv/urls";
 import { CONTENT_TYPE } from "@jsenv/utils/src/content_type/content_type.js";
-import { createReadStream, readFile, statSync } from "node:fs";
+import { createReadStream } from "node:fs";
+import { readFile, stat } from "node:fs/promises";
 
 import { pickContentEncoding } from "../../content_negotiation/pick_content_encoding.js";
 import { composeTwoResponses } from "../../internal/response_composition.js";
@@ -18,12 +20,59 @@ import {
   isFileSystemPath,
 } from "./filesystem_path_and_url.js";
 
+/**
+ * A route `fetch` serving the files of a directory. The part of the url
+ * captured by the endpoint `*` (or the whole resource when there is none) is
+ * resolved inside `directoryUrl`; a url escaping it is answered with 403.
+ *
+ * @param {string|URL} directoryUrl - `file://` url (or filesystem path) of the directory to serve.
+ * @param {Object} [options] - See {@link fetchFileSystem}.
+ * @returns {(request: Object, helpers: Object) => Promise<Object|null>}
+ *
+ * @example
+ * {
+ *   endpoint: "GET /assets/*",
+ *   fetch: createFileSystemFetch(import.meta.resolve("./assets/"), { etagEnabled: true }),
+ * }
+ */
 export const createFileSystemFetch = (directoryUrl, options) => {
   return (request, helpers) => {
     return fetchFileSystem(request, helpers, directoryUrl, options);
   };
 };
 
+/**
+ * Serve a file of `directoryUrl` for `request`. Declines (`null`) any method
+ * other than GET and HEAD. File paths appear in the status text only when the
+ * server runs with `canExposeSensitiveData`.
+ *
+ * @param {Object} request - The request given to a route `fetch`.
+ * @param {Object} [helpers] - The helpers given to a route `fetch` (used for `timing` and `canExposeSensitiveData`).
+ * @param {string|URL} directoryUrl - `file://` url (or filesystem path) of the directory to serve.
+ * @param {Object} [options]
+ * @param {string} [options.mainFileRelativeUrl] - File served for the directory itself and,
+ *   as a fallback, for extension-less urls that do not exist (client side routing).
+ * @param {boolean} [options.etagEnabled=false] - Send an `etag` (hash of the content) and
+ *   answer 304 to a matching `if-none-match`.
+ * @param {boolean} [options.etagMemory=true] - Remember etags per file (invalidated when the
+ *   file stats change) so that a file is hashed once.
+ * @param {number} [options.etagMemoryMaxSize=1000] - Files remembered at most.
+ * @param {boolean} [options.mtimeEnabled=false] - Send `last-modified` and answer 304 to
+ *   `if-modified-since` (second precision). Ignored when `etagEnabled` is set.
+ * @param {boolean} [options.compressionEnabled=false] - Compress textual files with brotli,
+ *   gzip or deflate according to `accept-encoding`.
+ * @param {number} [options.compressionSizeThreshold=1024] - Files smaller than that (bytes) are not compressed.
+ * @param {string|((request: Object) => string)} [options.cacheControl] - The `cache-control`
+ *   response header. Defaults to 30 days immutable for versioned urls (see `isVersioned`) and
+ *   `private,max-age=0,must-revalidate` otherwise. `"no-store"` disables etag and mtime.
+ * @param {(request: Object) => boolean} [options.isVersioned] - Tells if a url is versioned
+ *   (its content never changes). Defaults to "has a `v` search param".
+ * @param {boolean} [options.canReadDirectory=false] - Answer a directory with its listing
+ *   (json or html, see {@link fetchDirectory}) instead of 403.
+ * @param {() => string|URL|null} [options.ENOENTFallback] - Called when the file does not exist;
+ *   the file url it returns is served instead.
+ * @returns {Promise<Object|null>} Response properties, `null` when the method is not GET/HEAD.
+ */
 export const fetchFileSystem = async (
   request,
   helpers,
@@ -56,6 +105,9 @@ export const fetchFileSystem = async (
   if (!directoryUrlString.endsWith("/")) {
     directoryUrlString = `${directoryUrlString}/`;
   }
+  const canExposeSensitiveData = Boolean(
+    helpers && helpers.canExposeSensitiveData,
+  );
   let resource;
   if (request.params && "0" in request.params) {
     resource = request.params["0"];
@@ -106,15 +158,14 @@ export const fetchFileSystem = async (
   const serveFile = async (fileUrl) => {
     try {
       const readStatTiming = helpers?.timing("file service>read file stat");
-      const fileStat = statSync(new URL(fileUrl));
+      const fileStat = await stat(new URL(fileUrl));
       readStatTiming?.end();
 
       if (fileStat.isDirectory()) {
         if (canReadDirectory) {
           return fetchDirectory(fileUrl, {
             headers: request.headers,
-            canReadDirectory,
-            rootDirectoryUrl: directoryUrl,
+            rootDirectoryUrl: directoryUrlString,
           });
         }
         if (mainFileRelativeUrl && fileUrl === directoryUrlString) {
@@ -210,7 +261,9 @@ export const fetchFileSystem = async (
             ...(cacheControl ? { "cache-control": cacheControl } : {}),
           },
         },
-        convertFileSystemErrorToResponseProperties(e) || {},
+        convertFileSystemErrorToResponseProperties(e, {
+          canExposeSensitiveData,
+        }) || {},
       );
     }
   };
@@ -312,20 +365,13 @@ const computeEtag = async ({
       return etagMemoryEntry.eTag;
     }
   }
-  const fileContentAsBuffer = await new Promise((resolve, reject) => {
-    readFile(new URL(fileUrl), (error, buffer) => {
-      if (error) {
-        reject(error);
-      } else {
-        resolve(buffer);
-      }
-    });
-  });
+  const fileContentAsBuffer = await readFile(new URL(fileUrl));
   const eTag = bufferToEtag(fileContentAsBuffer);
   if (etagMemory) {
     if (ETAG_MEMORY_MAP.size >= etagMemoryMaxSize) {
-      const firstKey = Array.from(ETAG_MEMORY_MAP.keys())[0];
-      ETAG_MEMORY_MAP.delete(firstKey);
+      // a Map iterates in insertion order: the first key is the oldest entry
+      const oldestKey = ETAG_MEMORY_MAP.keys().next().value;
+      ETAG_MEMORY_MAP.delete(oldestKey);
     }
     ETAG_MEMORY_MAP.set(fileUrl, { fileStat, eTag });
   }
@@ -417,10 +463,23 @@ const fileUrlToReadableStream = (fileUrl) => {
   });
 };
 
+// Brotli's default quality (11) is meant for compressing assets once, ahead
+// of time: it is an order of magnitude slower than gzip. For compression at
+// request time, quality 4 costs about as much cpu as gzip while still
+// compressing better.
+const BROTLI_QUALITY_FOR_ON_THE_FLY_COMPRESSION = 4;
+
 const availableCompressionFormats = {
   br: async (fileReadableStream) => {
-    const { createBrotliCompress } = await import("node:zlib");
-    return fileReadableStream.pipe(createBrotliCompress());
+    const { constants, createBrotliCompress } = await import("node:zlib");
+    return fileReadableStream.pipe(
+      createBrotliCompress({
+        params: {
+          [constants.BROTLI_PARAM_QUALITY]:
+            BROTLI_QUALITY_FOR_ON_THE_FLY_COMPRESSION,
+        },
+      }),
+    );
   },
   deflate: async (fileReadableStream) => {
     const { createDeflate } = await import("node:zlib");

package/src/plugins/filesystem/filesystem_error_to_response.js

@@ -1,21 +1,27 @@
-export const convertFileSystemErrorToResponseProperties = (error) => {
+// The file path belongs to the server machine: it joins the status text only
+// when the server was started with canExposeSensitiveData.
+export const convertFileSystemErrorToResponseProperties = (
+  error,
+  { canExposeSensitiveData },
+) => {
+  const location = canExposeSensitiveData ? ` at ${error.path}` : "";
   // https://iojs.org/api/errors.html#errors_eacces_permission_denied
   if (isErrorWithCode(error, "EACCES")) {
     return {
       status: 403,
-      statusText: `EACCES: No permission to read file at ${error.path}`,
+      statusText: `EACCES: No permission to read file${location}`,
     };
   }
   if (isErrorWithCode(error, "EPERM")) {
     return {
       status: 403,
-      statusText: `EPERM: No permission to read file at ${error.path}`,
+      statusText: `EPERM: No permission to read file${location}`,
     };
   }
   if (isErrorWithCode(error, "ENOENT")) {
     return {
       status: 404,
-      statusText: `ENOENT: File not found at ${error.path}`,
+      statusText: `ENOENT: File not found${location}`,
     };
   }
   // file access may be temporarily blocked
@@ -23,7 +29,7 @@ export const convertFileSystemErrorToResponseProperties = (error) => {
   if (isErrorWithCode(error, "EBUSY")) {
     return {
       status: 503,
-      statusText: `EBUSY: File is busy ${error.path}`,
+      statusText: `EBUSY: File is busy${location}`,
       headers: {
         "retry-after": 0.01, // retry in 10ms
       },
@@ -42,7 +48,7 @@ export const convertFileSystemErrorToResponseProperties = (error) => {
   if (isErrorWithCode(error, "EISDIR")) {
     return {
       status: 500,
-      statusText: `EISDIR: Unexpected directory operation at ${error.path}`,
+      statusText: `EISDIR: Unexpected directory operation${location}`,
     };
   }
   return null;

package/src/plugins/request_aliases/server_plugin_request_aliases.js

@@ -1,5 +1,13 @@
 import { URL_META } from "@jsenv/url-meta";
 
+/**
+ * Server plugin rewriting request resources before routing, from url
+ * patterns to their replacement: `{ "/old/*": "/new/*", "/index": "/" }`
+ * (patterns as in @jsenv/url-meta). The search params of the request are
+ * kept unless the replacement has its own.
+ *
+ * @param {Object<string, string>} resourceAliases
+ */
 export const serverPluginRequestAliases = (resourceAliases) => {
   const aliases = {};
   Object.keys(resourceAliases).forEach((key) => {

package/src/plugins/response_acceptance_check/server_plugin_response_acceptance_check.js

@@ -1,7 +1,12 @@
-import { pickContentEncoding } from "@jsenv/server/src/content_negotiation/pick_content_encoding.js";
-import { pickContentLanguage } from "@jsenv/server/src/content_negotiation/pick_content_language.js";
-import { pickContentType } from "@jsenv/server/src/content_negotiation/pick_content_type.js";
+import { pickContentEncoding } from "../../content_negotiation/pick_content_encoding.js";
+import { pickContentLanguage } from "../../content_negotiation/pick_content_language.js";
+import { pickContentType } from "../../content_negotiation/pick_content_type.js";
 
+/**
+ * Server plugin logging a warning when a response does not honor what the
+ * request accepts (`accept`, `accept-language`, `accept-encoding`). A
+ * development aid: it changes nothing in the response.
+ */
 export const serverPluginResponseAcceptanceCheck = () => {
   return {
     name: "jsenv:response_acceptance_check",
@@ -43,9 +48,9 @@ ${requestAcceptLanguageHeader}`);
   const requestAcceptEncodingHeader = request.headers["accept-encoding"];
   const responseContentEncodingHeader = response.headers["content-encoding"];
   if (
-    requestAcceptLanguageHeader &&
-    responseContentLanguageHeader &&
-    !pickContentEncoding(request, [responseContentLanguageHeader])
+    requestAcceptEncodingHeader &&
+    responseContentEncodingHeader &&
+    !pickContentEncoding(request, [responseContentEncodingHeader])
   ) {
     warn(`response encoding is not in the request accepted encoding.
 --- response content-encoding header ---

package/src/plugins/route_inspector/server_plugin_route_inspector.js

@@ -2,6 +2,16 @@ import { readFileSync } from "node:fs";
 
 const routeInspectorHtmlFileUrl = import.meta
   .resolve("./client/route_inspector.html");
+let routeInspectorHtml;
+const readRouteInspectorHtml = () => {
+  if (routeInspectorHtml === undefined) {
+    routeInspectorHtml = readFileSync(
+      new URL(routeInspectorHtmlFileUrl),
+      "utf8",
+    );
+  }
+  return routeInspectorHtml;
+};
 
 export const serverPluginRouteInspector = ({ canExposeSensitiveData }) => {
   return {
@@ -14,11 +24,7 @@ export const serverPluginRouteInspector = ({ canExposeSensitiveData }) => {
         availableMediaTypes: ["text/html"],
         declarationSource: import.meta.url,
         fetch: () => {
-          const inspectorHtml = readFileSync(
-            new URL(routeInspectorHtmlFileUrl),
-            "utf8",
-          );
-          return new Response(inspectorHtml, {
+          return new Response(readRouteInspectorHtml(), {
             headers: { "content-type": "text/html" },
           });
         },

package/src/plugins/server_plugins_controller.js

@@ -1,22 +1,36 @@
 import { createPluginsController } from "../plugins_controller.js";
 
+// The hooks a server plugin can implement, in the order they run for a
+// request. See docs/plugins.md for what each one is meant for.
+const SERVER_PLUGIN_PROPERTIES = {
+  // ({ port }) once the server listens
+  serverListening: { type: "hook" },
+  // (request) => { resource | pathname, ...requestProperties } | null
+  redirectRequest: { type: "hook" },
+  // async (request, helpers) => { ...helpersToAdd } | null
+  augmentRouteFetchSecondArg: { type: "hook" },
+  // async (request) => ["permission", ...] | null, called lazily and at most
+  // once per request when a route declares permissions
+  grantPermissions: { type: "hook" },
+  // async (error, { request }) => response | null
+  handleError: { type: "hook" },
+  // (request, { response, warn }) to look at the response before it is sent
+  inspectResponse: { type: "hook" },
+  // (request, response) => responseToCompose | null
+  injectResponseProperties: { type: "hook" },
+  // ({ reason }) once the server is stopped
+  serverStopped: { type: "hook" },
+  // route descriptors, appended after the routes given to startServer
+  routes: {},
+};
+
 export const createServerPluginsController = async (serverPlugins) => {
-  const jsenvServerPluginsController = await createPluginsController({
+  const serverPluginsController = await createPluginsController({
     plugins: serverPlugins,
     pluginDescription: {
       name: "server plugin",
-      properties: {
-        serverListening: { type: "hook" },
-        redirectRequest: { type: "hook" },
-        augmentRouteFetchSecondArg: { type: "hook" },
-        grantPermissions: { type: "hook" },
-        handleError: { type: "hook" },
-        onResponsePush: { type: "hook" },
-        injectResponseProperties: { type: "hook" },
-        serverStopped: { type: "hook" },
-        routes: {}, // routes are handled separately (used to populate the router)
-      },
+      properties: SERVER_PLUGIN_PROPERTIES,
     },
   });
-  return jsenvServerPluginsController;
+  return serverPluginsController;
 };

package/src/progressive_response.js

@@ -1,6 +1,30 @@
 import { CONTENT_TYPE } from "@jsenv/utils/src/content_type/content_type.js";
 import { createObservable } from "./interfacing_with_node/observable.js";
 
+/**
+ * A response whose body is written over time (long polling, progress
+ * reporting). Return it from a route `fetch`: the headers are sent right away
+ * and the handler writes the body chunks whenever it wants.
+ *
+ * @param {(body: { write: (chunk: string|Uint8Array) => void, end: () => void }) => void | (() => void)} responseBodyHandler
+ *   Receives `write` and `end`. If it returns a function, that function runs
+ *   when the client disconnects before `end` was called (cleanup).
+ * @param {Object} [init]
+ * @param {number} [init.status=200]
+ * @param {string} [init.statusText]
+ * @param {Object} [init.headers] - `content-type` decides whether the first
+ *   (empty) chunk is text or binary; defaults to text/plain.
+ *
+ * @example
+ * {
+ *   endpoint: "GET /progress",
+ *   fetch: () => new ProgressiveResponse(({ write, end }) => {
+ *     const interval = setInterval(() => write("."), 100);
+ *     setTimeout(() => { clearInterval(interval); end(); }, 1000);
+ *     return () => clearInterval(interval);
+ *   }),
+ * }
+ */
 export class ProgressiveResponse {
   constructor(responseBodyHandler, { status = 200, statusText, headers } = {}) {
     const contentType = headers ? headers["content-type"] : "text/plain";

package/src/router/permissions.js

@@ -0,0 +1,52 @@
+export const permissionsSatisfy = (permissionsSet, permissionsRequired) => {
+  for (const permission of permissionsRequired) {
+    if (!permissionsSet.has(permission)) {
+      return false;
+    }
+  }
+  return true;
+};
+
+// Both helpers share one cursor over the "grantPermissions" hooks so that each
+// plugin runs at most once per request: hasPermissions stops as soon as the
+// required permissions are all granted, getAllPermissions drains the plugins
+// left.
+export const createPermissionHelpers = (serverPluginsController, request) => {
+  const permissionsSet = new Set();
+  const nextPermissionsHook = serverPluginsController.createAsyncHookIterator(
+    "grantPermissions",
+    request,
+  );
+  const drainPermissionsUntil = async (permissionsRequired) => {
+    for (;;) {
+      if (
+        permissionsRequired !== undefined &&
+        permissionsSatisfy(permissionsSet, permissionsRequired)
+      ) {
+        return true;
+      }
+      const { done, value } = await nextPermissionsHook();
+      if (done) {
+        break;
+      }
+      if (Array.isArray(value)) {
+        for (const permission of value) {
+          permissionsSet.add(permission);
+        }
+      }
+    }
+    return false;
+  };
+
+  const getAllPermissions = async () => {
+    await drainPermissionsUntil(undefined);
+    return permissionsSet;
+  };
+  const hasPermissions = async (permissionsRequired) => {
+    if (permissionsRequired.length === 0) {
+      return true;
+    }
+    return drainPermissionsUntil(permissionsRequired);
+  };
+  return { getAllPermissions, hasPermissions };
+};

package/src/router/router.js

@@ -13,6 +13,8 @@ import { pickContentEncoding } from "../content_negotiation/pick_content_encodin
 import { pickContentLanguage } from "../content_negotiation/pick_content_language.js";
 import { pickContentType } from "../content_negotiation/pick_content_type.js";
 import { pickContentVersion } from "../content_negotiation/pick_content_version.js";
+import { asReasonPhrase } from "../internal/reason_phrase.js";
+import { permissionsSatisfy } from "./permissions.js";
 
 const routeInspectorUrl = `/.internal/route_inspector`;
 
@@ -28,7 +30,7 @@ const HTTP_METHODS = [
 
 export const createRouter = (
   routeDescriptionArray,
-  { optionsFallback, logLevel, redirect = "manual" } = {},
+  { optionsFallback, logLevel } = {},
 ) => {
   const logger = createLogger({ logLevel });
   const routeSet = new Set();
@@ -285,7 +287,9 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
 
       if (fetchReturnValue instanceof Response) {
         status = fetchReturnValue.status;
-        statusText = fetchReturnValue.statusText;
+        // a Response built without statusText has an empty one: the standard
+        // phrase for that status is used instead
+        statusText = fetchReturnValue.statusText || undefined;
         headers = Object.fromEntries(fetchReturnValue.headers);
         body = fetchReturnValue.body;
       } else if (
@@ -293,7 +297,10 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
         typeof fetchReturnValue === "object"
       ) {
         status = fetchReturnValue.status || 404;
-        statusText = fetchReturnValue.statusText;
+        statusText =
+          fetchReturnValue.statusText === undefined
+            ? undefined
+            : asReasonPhrase(fetchReturnValue.statusText);
         statusMessage = fetchReturnValue.statusMessage;
         headers = fetchReturnValue.headers || {};
         body = fetchReturnValue.body;
@@ -304,30 +311,6 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
         );
       }
 
-      if (
-        redirect === "follow" &&
-        isRedirectStatus(status) &&
-        headers["location"]
-      ) {
-        const redirectUrl = new URL(headers["location"], request.url);
-        if (redirectUrl.origin === new URL(request.url).origin) {
-          const redirectRequest = {
-            ...request,
-            url: redirectUrl.href,
-            resource:
-              redirectUrl.pathname + redirectUrl.search + redirectUrl.hash,
-            // GET for 301/302/303, preserve method for 307/308
-            method: status === 307 || status === 308 ? request.method : "GET",
-            params: {},
-          };
-          const redirectedResponse = await matchRoutes(redirectRequest);
-          onRouteMatch(route);
-          onResponseHeaders(request, route, redirectedResponse.headers || {});
-          return redirectedResponse;
-        }
-        // redirect to other origins are left to the client to handle
-      }
-
       onRouteMatch(route);
       onResponseHeaders(request, route, headers);
       return { status, statusText, statusMessage, headers, body, timing };
@@ -372,7 +355,10 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
           }
         }
         if (!route.matchMethod(request.method)) {
-          if (!route.isFallback) {
+          // a 405 asserts the resource exists with other methods: a route
+          // matching any resource ("GET *") cannot assert that, so it does
+          // not turn an unknown resource into a 405
+          if (!route.isFallback && route.resource !== "*") {
             wouldHaveMatched.methodSet.add(route.method);
           }
           continue;
@@ -650,25 +636,13 @@ It should be should be one of route.${routePropertyName}: ${availableValues.join
   return router;
 };
 
-/**
- * Adds a route to the router.
- *
- * @param {Object} params - Route configuration object
- * @param {string} params.endpoint - String in format "METHOD /resource/path" (e.g. "GET /users/:id")
- * @param {Object} [params.headers] - Optional headers pattern to match
- * @param {Array<string>} [params.availableMediaTypes=[]] - Content types this route can produce
- * @param {Array<string>} [params.availableLanguages=[]] - Languages this route can respond with
- * @param {Array<string>} [params.availableEncodings=[]] - Encodings this route supports
- * @param {Array<string>} [params.acceptedMediaTypes=[]] - Content types this route accepts (for POST/PATCH/PUT)
- * @param {Function} params.fetch - Function to generate response for matching requests
- * @throws {TypeError} If endpoint is not a string
- * @returns {void}
- */
+// Turns a route descriptor (documented on startServer's `routes` param) into
+// a route: matchers for the method, the resource and the headers, plus what
+// the inspector shows. Throws on a malformed descriptor.
 const createRoute = ({
   endpoint,
   description,
   headers,
-  service,
   serverPlugin,
   permissionsRequired,
   permissionsToSee,
@@ -680,7 +654,6 @@ const createRoute = ({
   fetch: routeFetchMethod, // rename because there is global.fetch and we want to be explicit
   clientCodeExample,
   isFallback,
-  subroutes,
   declarationSource,
 }) => {
   if (!endpoint || typeof endpoint !== "string") {
@@ -720,7 +693,6 @@ const createRoute = ({
     method,
     resource,
     description,
-    service,
     serverPlugin,
     permissionsRequired,
     permissionsToSee,
@@ -803,14 +775,10 @@ const createRoute = ({
     resourcePattern,
     isForWebSocket,
     isFallback,
-    subroutes,
   };
   return route;
 };
 
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-const isRedirectStatus = (status) => REDIRECT_STATUSES.has(status);
-
 // Returns a denied response if the request does not satisfy route access/visible config.
 // Returns null if access is granted.
 const checkRouteAccess = async (
@@ -847,15 +815,6 @@ const checkRouteAccess = async (
   return createRouteNotFoundResponse(request);
 };
 
-const permissionsSatisfy = (permissionsSet, permissionsRequired) => {
-  for (const p of permissionsRequired) {
-    if (!permissionsSet.has(p)) {
-      return false;
-    }
-  }
-  return true;
-};
-
 const createForbiddenResponse = () => {
   return {
     status: 403,
@@ -931,7 +890,6 @@ const createNotAcceptableResponse = (
 ) => {
   const unsupported = [];
   const headers = {};
-  const data = {};
 
   if (availableMediaTypes.length) {
     const requestAcceptHeader = request.headers["accept"];
@@ -939,11 +897,6 @@ const createNotAcceptableResponse = (
     // Use a non-standard but semantic header name
     headers["available-media-types"] = availableMediaTypes.join(", ");
 
-    Object.assign(data, {
-      requestAcceptHeader,
-      availableMediaTypes,
-    });
-
     unsupported.push({
       type: "content-type",
       message: `The server cannot produce a response in any of the media types accepted by the request: "${requestAcceptHeader}".
@@ -956,11 +909,6 @@ Available media types: ${availableMediaTypes.join(", ")}.`,
     // Use a non-standard but semantic header name
     headers["available-languages"] = availableLanguages.join(", ");
 
-    Object.assign(data, {
-      requestAcceptLanguageHeader,
-      availableLanguages,
-    });
-
     unsupported.push({
       type: "language",
       message: `The server cannot produce a response in any of the languages accepted by the request: "${requestAcceptLanguageHeader}".
@@ -973,11 +921,6 @@ Available languages: ${availableLanguages.join(", ")}.`,
     // Use a non-standard but semantic header name
     headers["available-versions"] = availableVersions.join(", ");
 
-    Object.assign(data, {
-      requestAcceptVersionHeader,
-      availableLanguages,
-    });
-
     unsupported.push({
       type: "version",
       message: `The server cannot produce a response in any of the versions accepted by the request: "${requestAcceptVersionHeader}".
@@ -990,11 +933,6 @@ Available versions: ${availableVersions.join(", ")}.`,
     // Use a non-standard but semantic header name
     headers["available-encodings"] = availableEncodings.join(", ");
 
-    Object.assign(data, {
-      requestAcceptEncodingHeader,
-      availableEncodings,
-    });
-
     unsupported.push({
       type: "encoding",
       message: `The server cannot encode the response in any of the encodings accepted by the request: "${requestAcceptEncodingHeader}".
@@ -1031,7 +969,7 @@ const createMethodNotAllowedResponse = (
   return {
     status: 405,
     statusText: "Method Not Allowed",
-    statusmessage: `The HTTP method "${request.method}" is not supported for this resource.
+    statusMessage: `The HTTP method "${request.method}" is not supported for this resource.
 Allowed methods: ${allowedMethods.join(", ")}`,
     headers: {
       allow: allowedMethods.join(", "),

package/src/server_events.js

@@ -311,7 +311,9 @@ const createServerEvents = ({
     if (history) {
       addEventToHistory(event);
     }
-    logger.debug(`send "${event.type}" event to ${clientArray.size} client(s)`);
+    logger.debug(
+      `send "${event.type}" event to ${clientArray.length} client(s)`,
+    );
     for (const client of clientArray) {
       client.sendEvent(event);
     }

package/src/server_timing/timing_header.js

@@ -1,7 +1,7 @@
 import {
   parseMultipleHeader,
   stringifyMultipleHeader,
-} from "../internal/multiple-header.js";
+} from "../internal/multiple_header.js";
 
 // to predict order in chrome devtools we should put a,b,c,d,e or something
 // because in chrome dev tools they are shown in alphabetic order