@lovrozagar/honey 0.6.8 → 0.7.0

package/src/body-limit.ts

@@ -1,10 +1,15 @@
 import { namedMiddleware } from "./middleware.ts"
 import { HoneyError } from "./error.ts"
+import { parseMediaType } from "./media-type.ts"
 import type { MiddlewareFn } from "./middleware.ts"
 import { EK, SK } from "./types.ts"
 
 type BodyLimitOptions = {
-	/** Per content-type size limits (matched via startsWith against request Content-Type header) */
+	/**
+	 * Per media-type size limits. A key matches when the request's media type
+	 * (lowercased, parameters dropped) starts with it, so `"multipart/"` covers
+	 * every multipart type. The longest matching key wins.
+	 */
 	limits?: Record<string, number>
 	/** Default max body size in bytes — used when no content-type match or no limits map */
 	maxSize: number
@@ -22,112 +27,122 @@ type BodyLimitOptions = {
 
 export type { BodyLimitOptions }
 
+/* After an overflow the rest of the upload is read and discarded so the client
+ * sees the 413 instead of a reset, but only this much: past it the stream is
+ * cancelled, so a client cannot hold the connection open with an endless body. */
+const DRAIN_LIMIT = 1_048_576
+
+/* the shared parser lowercases and drops parameters; a malformed type matches no key */
+function mediaType(contentType: string | null): string | null {
+	return parseMediaType(contentType)?.essence ?? null
+}
+
+function tooLarge(): HoneyError {
+	return new HoneyError({ errorKey: EK.content_too_large, status: SK.content_too_large })
+}
+
 export function bodyLimit(opts: BodyLimitOptions): MiddlewareFn<{ req: Request }, {}> {
 	const { limits, maxSize, trustContentLength } = opts
-	const limitEntries = limits !== undefined ? Object.entries(limits) : null
+	const limitEntries =
+		limits !== undefined
+			? Object.entries(limits)
+					.map(([key, limit]) => [key.trim().toLowerCase(), limit] as const)
+					.sort((a, b) => b[0].length - a[0].length)
+			: null
 
+	const resolveMax = (req: Request): number => {
+		if (limitEntries === null) return maxSize
+		const type = mediaType(req.headers.get("content-type"))
+		if (type === null) return maxSize
+		for (const [key, limit] of limitEntries) {
+			if (type.startsWith(key)) return limit
+		}
+		return maxSize
+	}
+
+	/* every method: a DELETE or PROPFIND with a body is as large as a POST */
 	const mw: MiddlewareFn<{ req: Request }, {}> = (ctx, next) => {
 		const req = ctx.req
-		const method = req.method
-		if (method === "GET" || method === "HEAD" || method === "OPTIONS" || method === "DELETE") {
-			return next()
-		}
+		const contentLength = req.headers.get("content-length")
+		const body = req.body
+		if (body === null && contentLength === null) return next()
 
-		/* resolve max size from content-type */
-		let resolvedMax = maxSize
-		if (limitEntries !== null) {
-			const ct = req.headers.get("content-type")
-			if (ct !== null) {
-				for (const [key, limit] of limitEntries) {
-					if (ct.startsWith(key)) {
-						resolvedMax = limit
-						break
-					}
-				}
-			}
-		}
+		const limit = resolveMax(req)
 
 		/* fast path: Content-Length header present */
-		const contentLength = req.headers.get("content-length")
 		if (contentLength !== null) {
 			const len = Number.parseInt(contentLength, 10)
-			if (!Number.isNaN(len) && len > resolvedMax) {
-				throw new HoneyError({
-					errorKey: EK.content_too_large,
-					status: SK.content_too_large,
-				})
-			}
+			if (!Number.isNaN(len) && len > limit) throw tooLarge()
 			if (trustContentLength === true) return next()
 		}
 
 		/* slow path: stream-count when no Content-Length (chunked) or trustContentLength disabled.
 		 * On overflow, error the downstream consumer then drain (do not cancel) the upstream —
 		 * cancelling an undici FormData body mid-encode enqueues into a closed stream on Node 24. */
-		if (req.body !== null) {
-			let totalBytes = 0
-			let overflowed = false
-			const limit = resolvedMax
-			const reader = req.body.getReader()
-
-			const drainUpstream = (): void => {
-				void (async () => {
-					try {
-						while (true) {
-							const r = await reader.read()
-							if (r.done) break
+		if (body === null) return next()
+
+		let totalBytes = 0
+		let overflowed = false
+		const reader = body.getReader()
+
+		const drainUpstream = (): void => {
+			void (async () => {
+				let drained = 0
+				try {
+					while (true) {
+						const r = await reader.read()
+						if (r.done) break
+						drained += r.value.byteLength
+						if (drained > DRAIN_LIMIT) {
+							await reader.cancel()
+							break
 						}
-					} catch {
-						/* producer may already be done */
 					}
-				})()
-			}
+				} catch {
+					/* producer may already be done */
+				}
+			})()
+		}
 
-			const limited = new ReadableStream<Uint8Array>({
-				async cancel(reason) {
-					/* consumer aborted — still drain so undici FormData encoders can finish */
+		const limited = new ReadableStream<Uint8Array>({
+			cancel() {
+				/* consumer aborted — still drain so undici FormData encoders can finish */
+				drainUpstream()
+			},
+			async pull(controller) {
+				if (overflowed) return
+				let result: ReadableStreamReadResult<Uint8Array>
+				try {
+					result = await reader.read()
+				} catch (err) {
+					controller.error(err)
+					return
+				}
+				if (result.done) {
+					controller.close()
+					return
+				}
+				totalBytes += result.value.byteLength
+				if (totalBytes > limit) {
+					overflowed = true
+					controller.error(tooLarge())
 					drainUpstream()
-					void reason
-				},
-				async pull(controller) {
-					if (overflowed) return
-					let result: ReadableStreamReadResult<Uint8Array>
-					try {
-						result = await reader.read()
-					} catch (err) {
-						controller.error(err)
-						return
-					}
-					if (result.done) {
-						controller.close()
-						return
-					}
-					totalBytes += result.value.byteLength
-					if (totalBytes > limit) {
-						overflowed = true
-						controller.error(
-							new HoneyError({
-								errorKey: EK.content_too_large,
-								status: SK.content_too_large,
-							}),
-						)
-						drainUpstream()
-						return
-					}
-					controller.enqueue(result.value)
-				},
-			})
-
-			const replaceBody = (req as unknown as Record<symbol, unknown>)[Symbol.for("honey.replaceBody")]
-			if (typeof replaceBody === "function") {
-				;(replaceBody as (stream: ReadableStream<Uint8Array>) => void).call(req, limited)
-			} else {
-				/* duplex: "half" required by Node/undici when body is a ReadableStream */
-				const newReq = new Request(req, {
-					body: limited,
-					duplex: "half",
-				} as RequestInit)
-				Object.defineProperty(ctx, "req", { configurable: true, value: newReq })
-			}
+					return
+				}
+				controller.enqueue(result.value)
+			},
+		})
+
+		const replaceBody = (req as unknown as Record<symbol, unknown>)[Symbol.for("honey.replaceBody")]
+		if (typeof replaceBody === "function") {
+			;(replaceBody as (stream: ReadableStream<Uint8Array>) => void).call(req, limited)
+		} else {
+			/* duplex: "half" required by Node/undici when body is a ReadableStream */
+			const newReq = new Request(req, {
+				body: limited,
+				duplex: "half",
+			} as RequestInit)
+			Object.defineProperty(ctx, "req", { configurable: true, value: newReq })
 		}
 
 		return next()

package/src/build/index.ts

@@ -1,11 +1,17 @@
 import { existsSync, readFileSync } from "node:fs"
 import { builtinModules } from "node:module"
-import { resolve } from "node:path"
+import { extname, resolve } from "node:path"
+import { detectFeaturesInSource, FEATURES, featurePrelude, type HoneyFeature, scanProgram } from "../feature-detect.ts"
 
 /* ---- Public types ---- */
 
 export type HoneyBuildConfig = {
 	external?: string[]
+	/**
+	 * Force optional features on or off. Unset features are detected by scanning the app's
+	 * import graph for `.openapi()` / `.manifest()`, `.errorI18n()` and `.serve()` calls.
+	 */
+	features?: Partial<Record<HoneyFeature, boolean>>
 	minify?: boolean
 	outDir?: string
 	port?: number
@@ -22,46 +28,38 @@ type ResolvedBuildConfig = {
 
 type BuildAdapterDef = {
 	entry(config: ResolvedBuildConfig): string
+	/** Bundle every dependency. Workers have no node_modules at run time. */
+	noExternal: boolean
+	/** Features the target can never use. */
+	skipFeatures: HoneyFeature[]
 	ssrTarget: "node" | "webworker"
 }
 
 /* ---- Entry helpers ---- */
 
-function featurePrelude(appSource: string): string {
-	const lines: string[] = []
-	if (/\.openapi\s*\(|\.manifest\s*\(/.test(appSource)) {
-		lines.push('import { enableOpenApi } from "@lovrozagar/honey/openapi"', "enableOpenApi()")
-	}
-	if (/\.errorI18n\s*\(/.test(appSource)) {
-		lines.push('import { enableI18n } from "@lovrozagar/honey/i18n"', "enableI18n()")
-	}
-	if (/(?<!Bun)(?<!Deno)\.serve\s*\(/.test(appSource)) {
-		lines.push('import { enableServe } from "@lovrozagar/honey/serve"', "enableServe()")
-	}
-	return lines.length > 0 ? `${lines.join("\n")}\n` : ""
-}
-
 function importApp(entry: string, exportName: string): string {
 	if (exportName === "default") return `import app from "./${entry}"`
 	return `import { ${exportName} as app } from "./${entry}"`
 }
 
+/* server targets start through the same code path as `app.serve()`: WS adapter, env, hostname */
+function serverEntry(config: ResolvedBuildConfig, runtime: "bun" | "deno" | "node", env: string, port: string): string {
+	return [
+		'import { startHoneyServer } from "@lovrozagar/honey/serve"',
+		importApp(config.entry, config.export),
+		"",
+		`const port = Number(${port})`,
+		`await startHoneyServer(app, { env: ${env}, hostname: "0.0.0.0", port, runtime: "${runtime}" })`,
+	].join("\n")
+}
+
 /* ---- Adapter definitions ---- */
 
 const adapters: Record<HoneyBuildConfig["target"], BuildAdapterDef> = {
 	bun: {
-		entry(config) {
-			return [
-				importApp(config.entry, config.export),
-				"",
-				`const port = Number(process.env.PORT ?? ${config.port})`,
-				"Bun.serve({",
-				"  fetch: (req, server) => app.fetch(req, { server }),",
-				'  hostname: "0.0.0.0",',
-				"  port,",
-				"})",
-			].join("\n")
-		},
+		entry: (config) => serverEntry(config, "bun", "process.env", `process.env.PORT ?? ${config.port}`),
+		noExternal: false,
+		skipFeatures: [],
 		ssrTarget: "node",
 	},
 	cloudflare: {
@@ -74,33 +72,81 @@ const adapters: Record<HoneyBuildConfig["target"], BuildAdapterDef> = {
 				"}",
 			].join("\n")
 		},
+		noExternal: true,
+		/* a Worker cannot listen; serve would pull node:http into the bundle */
+		skipFeatures: ["serve"],
 		ssrTarget: "webworker",
 	},
 	deno: {
-		entry(config) {
-			return [
-				importApp(config.entry, config.export),
-				"",
-				`const port = Number(Deno.env.get("PORT") ?? "${config.port}")`,
-				'Deno.serve({ hostname: "0.0.0.0", port }, (req) => app.fetch(req, {}))',
-			].join("\n")
-		},
+		entry: (config) => serverEntry(config, "deno", "Deno.env.toObject()", `Deno.env.get("PORT") ?? "${config.port}"`),
+		noExternal: true,
+		skipFeatures: [],
 		ssrTarget: "webworker",
 	},
 	node: {
-		entry(config) {
-			return [
-				'import { serve } from "@lovrozagar/honey/node"',
-				importApp(config.entry, config.export),
-				"",
-				`const port = Number(process.env.PORT ?? ${config.port})`,
-				'serve(app, { env: process.env, hostname: "0.0.0.0", port })',
-			].join("\n")
-		},
+		entry: (config) => serverEntry(config, "node", "process.env", `process.env.PORT ?? ${config.port}`),
+		noExternal: false,
+		skipFeatures: [],
 		ssrTarget: "node",
 	},
 }
 
+/* ---- Feature detection over the import graph ---- */
+
+const SCANNED_EXT = /\.(?:[cm]?[jt]sx?)$/
+
+type ParseContext = {
+	parse?: (code: string, options?: { lang?: "js" | "jsx" | "ts" | "tsx" }) => unknown
+	resolve?: (source: string, importer?: string) => Promise<{ external?: unknown; id: string } | null>
+}
+
+function langOf(file: string): "js" | "jsx" | "ts" | "tsx" {
+	const ext = extname(file)
+	if (ext === ".tsx") return "tsx"
+	if (ext === ".jsx") return "jsx"
+	return /^\.[cm]?ts$/.test(ext) ? "ts" : "js"
+}
+
+/**
+ * Walks the app's own modules (never node_modules) from `entry`, following static and dynamic
+ * imports, and collects feature calls. Comments and strings do not count.
+ */
+async function detectGraphFeatures(ctx: ParseContext, entry: string): Promise<Set<HoneyFeature>> {
+	const features = new Set<HoneyFeature>()
+	const seen = new Set<string>()
+	const queue = [entry]
+	while (queue.length > 0) {
+		const file = queue.pop() as string
+		if (seen.has(file)) continue
+		seen.add(file)
+		if (!SCANNED_EXT.test(file) || file.includes("node_modules") || !existsSync(file)) continue
+		const code = readFileSync(file, "utf-8")
+
+		let imports: string[] = []
+		let program: unknown
+		try {
+			program = ctx.parse?.(code, { lang: langOf(file) })
+		} catch {
+			program = undefined
+		}
+		if (program) {
+			const scanned = scanProgram(program)
+			for (const f of scanned.features) features.add(f)
+			imports = scanned.imports
+		} else {
+			for (const f of detectFeaturesInSource(code)) features.add(f)
+		}
+
+		if (!ctx.resolve) continue
+		for (const source of imports) {
+			const resolved = await ctx.resolve(source, file).catch(() => null)
+			if (!resolved || resolved.external || resolved.id.startsWith("\0")) continue
+			queue.push(resolved.id.split("?")[0] as string)
+		}
+	}
+	return features
+}
+
 /* ---- Virtual module constants ---- */
 
 const VIRTUAL_BUILD_ENTRY = "virtual:honey-build-entry"
@@ -135,7 +181,8 @@ export function createBuildPlugin(buildConfig: HoneyBuildConfig, shared: { entry
 					ssr: true,
 				},
 				ssr: {
-					noExternal: true,
+					/* node and bun install dependencies next to the bundle; inlining them would also inline native addons */
+					...(adapter.noExternal ? { noExternal: true } : {}),
 					target: adapter.ssrTarget,
 				},
 			}
@@ -145,16 +192,19 @@ export function createBuildPlugin(buildConfig: HoneyBuildConfig, shared: { entry
 			root = cfg.root
 		},
 
-		load(id: string): { code: string; moduleType: string } | undefined {
-			if (id === RESOLVED_BUILD_ENTRY) {
-				const appPath = resolve(root || ".", shared.entry)
-				const appSource = existsSync(appPath) ? readFileSync(appPath, "utf-8") : ""
-				return {
-					code: `${featurePrelude(appSource)}${adapter.entry(resolvedConfig)}`,
-					moduleType: "js",
-				}
+		async load(this: ParseContext | undefined, id: string): Promise<{ code: string; moduleType: string } | undefined> {
+			if (id !== RESOLVED_BUILD_ENTRY) return undefined
+			const appPath = resolve(root || ".", shared.entry)
+			const detected = await detectGraphFeatures(this ?? {}, appPath)
+			const features = FEATURES.filter((feature) => {
+				if (adapter.skipFeatures.includes(feature)) return false
+				return buildConfig.features?.[feature] ?? detected.has(feature)
+			})
+			const prelude = featurePrelude(features)
+			return {
+				code: `${prelude ? `${prelude}\n` : ""}${adapter.entry(resolvedConfig)}`,
+				moduleType: "js",
 			}
-			return undefined
 		},
 
 		name: "honey:build",

package/src/cli-args.ts

@@ -0,0 +1,123 @@
+/** Argument parsing for the `honey` CLI. Not a package export. */
+
+export const USAGE = `Usage: honey generate [options]
+       honey init [--cf] [--force]
+
+generate options:
+  --config <path>          Vite config holding honey() (default: vite.config.{ts,mts,js,mjs,…})
+  --plugin <n>             Which honey() plugin in the config, 0-based (when there are several)
+  --app <path>             App entry; overrides the config's app, or replaces the config
+  --watch                  Regenerate when files next to the app change
+  --tree --types --manifest --sdk
+                           Turn on an output
+  --merge-tree <path>      Route tree source for a gateway
+  --cli --cli-out <dir> --cli-binary-name <name> [--cli-config-name <name>]
+      [--cli-default-base-url <url>] [--cli-env-prefix <prefix>] [--cli-module-path <path>]
+      [--cli-sdk-module-path <path>]
+                           Generate the Go CLI
+  -h, --help               Show this help`
+
+export class UsageError extends Error {}
+
+export type CliFlags = {
+	app?: string
+	cli?: boolean
+	cliBinaryName?: string
+	cliConfigName?: string
+	cliDefaultBaseUrl?: string
+	cliEnvPrefix?: string
+	cliModulePath?: string
+	cliOut?: string
+	cliSdkModulePath?: string
+	config?: string
+	help?: boolean
+	manifest?: boolean
+	mergeTree?: string
+	plugin?: number
+	sdk?: boolean
+	tree?: boolean
+	types?: boolean
+	watch?: boolean
+}
+
+const BOOLEAN_FLAGS: Record<string, keyof CliFlags> = {
+	cli: "cli",
+	help: "help",
+	manifest: "manifest",
+	sdk: "sdk",
+	tree: "tree",
+	types: "types",
+	watch: "watch",
+}
+
+const VALUE_FLAGS: Record<string, keyof CliFlags> = {
+	app: "app",
+	"cli-binary-name": "cliBinaryName",
+	"cli-config-name": "cliConfigName",
+	"cli-default-base-url": "cliDefaultBaseUrl",
+	"cli-env-prefix": "cliEnvPrefix",
+	"cli-module-path": "cliModulePath",
+	"cli-out": "cliOut",
+	"cli-sdk-module-path": "cliSdkModulePath",
+	config: "config",
+	"merge-tree": "mergeTree",
+	plugin: "plugin",
+}
+
+/** Strict: unknown flags, stray positionals and missing values are errors. Accepts `--k v` and `--k=v`. */
+export function parseGenerateArgs(args: string[]): CliFlags {
+	const flags: Record<string, unknown> = {}
+	for (let i = 0; i < args.length; i++) {
+		const arg = args[i] as string
+		if (arg === "-h") {
+			flags.help = true
+			continue
+		}
+		if (!arg.startsWith("--") || arg === "--") throw new UsageError(`unexpected argument: ${arg}`)
+		const eq = arg.indexOf("=")
+		const name = eq === -1 ? arg.slice(2) : arg.slice(2, eq)
+		const inline = eq === -1 ? undefined : arg.slice(eq + 1)
+
+		const bool = BOOLEAN_FLAGS[name]
+		if (bool) {
+			if (inline === undefined || inline === "true") flags[bool] = true
+			else if (inline === "false") flags[bool] = false
+			else throw new UsageError(`--${name} takes no value (got "${inline}")`)
+			continue
+		}
+
+		const key = VALUE_FLAGS[name]
+		if (!key) throw new UsageError(`unknown option: --${name}`)
+		let value = inline
+		if (value === undefined) {
+			const next = args[i + 1]
+			if (next === undefined || next.startsWith("--")) throw new UsageError(`--${name} requires a value`)
+			value = next
+			i++
+		}
+		if (value === "") throw new UsageError(`--${name} requires a value`)
+		if (key === "plugin") {
+			if (!/^\d+$/.test(value)) throw new UsageError(`--plugin takes a non-negative integer (got "${value}")`)
+			flags.plugin = Number(value)
+		} else {
+			flags[key] = value
+		}
+	}
+	return flags as CliFlags
+}
+
+/** `honey init` flags. `--cloudflare` is an alias of `--cf`. */
+export type InitFlags = {
+	cf: boolean
+	force: boolean
+}
+
+export function parseInitFlags(args: string[]): InitFlags {
+	const flags: InitFlags = { cf: false, force: false }
+	for (const arg of args) {
+		if (arg === "--cf" || arg === "--cloudflare") flags.cf = true
+		else if (arg === "--force") flags.force = true
+		else throw new UsageError(arg.startsWith("-") ? `unknown option: ${arg}` : `unexpected argument: ${arg}`)
+	}
+	return flags
+}

package/src/cli-go/auth.go

@@ -1,7 +1,10 @@
 // Code generated by honey. DO NOT EDIT.
 package cli
 
-import "errors"
+import (
+	"errors"
+	"net/http"
+)
 
 // ErrMissingAPIKey is returned when no API key can be found via flags, env, or config file.
 var ErrMissingAPIKey = errors.New("api key required: set --api-key, env var, or config file")
@@ -13,3 +16,11 @@ func ResolveAPIKey(cfg Config) (string, error) {
 	}
 	return "", ErrMissingAPIKey
 }
+
+// ApplyAuth sets the auth header for apiKey: prefix + key under headerName.
+func ApplyAuth(h http.Header, headerName, prefix, apiKey string) {
+	if apiKey == "" {
+		return
+	}
+	h.Set(headerName, prefix+apiKey)
+}

package/src/cli-go/config.go

@@ -2,10 +2,13 @@
 package cli
 
 import (
+	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
 	"path/filepath"
+	"runtime"
 
 	"github.com/pelletier/go-toml/v2"
 	"github.com/spf13/pflag"
@@ -44,21 +47,30 @@ func LoadConfig(flags *pflag.FlagSet, envPrefix, configName string) (Config, err
 	var cfg Config
 
 	cfgPath := ""
+	explicit := false
 	if flags.Changed("config") {
 		v, _ := flags.GetString("config")
 		cfgPath = v
+		explicit = true
 	} else if v := os.Getenv(envPrefix + "_CONFIG"); v != "" {
 		cfgPath = v
+		explicit = true
 	} else {
 		cfgPath = defaultConfigPath(configName)
 	}
 
 	var fromFile tomlConfig
 	if cfgPath != "" {
-		if data, err := os.ReadFile(cfgPath); err == nil {
+		data, err := os.ReadFile(cfgPath)
+		switch {
+		case err == nil:
 			if err := toml.Unmarshal(data, &fromFile); err != nil {
-				return cfg, fmt.Errorf("parse config %s: %w", cfgPath, err)
+				return cfg, Usage(fmt.Errorf("parse config %s: %w", cfgPath, err))
 			}
+			warnIfReadableByOthers(cfgPath, fromFile.APIKey != "")
+		case explicit || !errors.Is(err, fs.ErrNotExist):
+			/* a config the user named must exist; only the default path may be absent */
+			return cfg, Usage(fmt.Errorf("read config %s: %w", cfgPath, err))
 		}
 	}
 	cfg.ConfigPath = cfgPath
@@ -113,6 +125,21 @@ func LoadConfig(flags *pflag.FlagSet, envPrefix, configName string) (Config, err
 	return cfg, nil
 }
 
+// warnIfReadableByOthers warns when a config file holding an API key can be
+// read by group or other users.
+func warnIfReadableByOthers(path string, hasKey bool) {
+	if !hasKey || runtime.GOOS == "windows" {
+		return
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		return
+	}
+	if info.Mode().Perm()&0o077 != 0 {
+		fmt.Fprintf(os.Stderr, "warning: %s holds an API key and is readable by other users; run: chmod 600 %s\n", path, path)
+	}
+}
+
 func defaultConfigPath(configName string) string {
 	if configName == "" {
 		return ""