@nifrajs/core 5.4.0 → 5.5.1

package/src/router/router.ts

@@ -10,8 +10,18 @@ import {
   mixedSegmentShape,
 } from "./pattern.ts"
 
-/** The standard HTTP methods: the ones with a builder on the server and a call on the typed client. */
-export const METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"] as const
+/** The standard HTTP methods: the ones the typed registry and the typed client know. Each has a server
+ * builder except `QUERY` (RFC 9110's safe, idempotent read with a body), which `method()` registers. */
+export const METHODS = [
+  "GET",
+  "POST",
+  "PUT",
+  "PATCH",
+  "DELETE",
+  "HEAD",
+  "OPTIONS",
+  "QUERY",
+] as const
 
 export type Method = (typeof METHODS)[number]
 
@@ -37,6 +47,8 @@ export function isRegistrableMethod(method: string): boolean {
 const SLASH = 47
 export const EMPTY_PARAMS: Record<string, string> = Object.freeze({})
 const DYNAMIC_MATCH_CACHE_MAX = 2048
+// The client picks every key, so their length is bounded too: 2048 paths of 8 KiB held 16 MiB.
+const DYNAMIC_MATCH_CACHE_CHARS = 256 * 1024
 
 /**
  * Result of {@link Router.find}. The `found: false` cases deliberately separate
@@ -67,6 +79,8 @@ interface DynamicMatchCacheEntry<T> {
 
 interface DynamicMatchCacheState<T> {
   cache: Map<string, DynamicMatchCacheEntry<T>> | undefined
+  /** Total length of the cached paths. */
+  chars: number
   pendingPath: string | undefined
 }
 
@@ -79,6 +93,7 @@ function dynamicMatchCacheStateFor<T>(owner: object): DynamicMatchCacheState<T>
   }
   const state: DynamicMatchCacheState<T> = {
     cache: undefined,
+    chars: 0,
     pendingPath: undefined,
   }
   DYNAMIC_MATCH_CACHES.set(owner, state as DynamicMatchCacheState<unknown>)
@@ -476,13 +491,19 @@ export class Router<T> {
       cache = new Map<string, DynamicMatchCacheEntry<T>>()
       state.cache = cache
     }
-    if (cache.size >= DYNAMIC_MATCH_CACHE_MAX) {
-      const oldest = cache.keys().next().value
-      if (oldest !== undefined) cache.delete(oldest)
+    for (const oldest of cache.keys()) {
+      if (
+        cache.size < DYNAMIC_MATCH_CACHE_MAX &&
+        state.chars + path.length <= DYNAMIC_MATCH_CACHE_CHARS
+      )
+        break
+      cache.delete(oldest)
+      state.chars -= oldest.length
     }
     cache.set(path, {
       terminal,
       values: values.slice(0, terminal.paramNames.length),
     })
+    state.chars += path.length
   }
 }

package/src/security/baseline.ts

@@ -41,9 +41,10 @@ export interface SecurityBaselineOptions {
   readonly requireRuntimeProvenance?: boolean
 }
 
-/** A mutation is every method these leave out: POST, PUT, PATCH, DELETE and any custom method. */
-const NOT_MUTATING: readonly (Method | "WS")[] = ["GET", "HEAD", "OPTIONS", "WS"]
-const READING = ["GET", "HEAD"] as const
+/** A mutation is every method these leave out: POST, PUT, PATCH, DELETE and any custom method. QUERY
+ * reads, with a body that the generic body rule still bounds. */
+const NOT_MUTATING: readonly (Method | "WS")[] = ["GET", "HEAD", "OPTIONS", "QUERY", "WS"]
+const READING = ["GET", "HEAD", "QUERY"] as const
 /** The classification threshold above which the baseline demands authentication. */
 const SENSITIVE = "pii" as const
 

package/src/server/body-lane.ts

@@ -11,8 +11,7 @@ import { isJsonMediaType, isUrlEncodedForm, readBoundedForm } from "./query.ts"
 import {
   headerOf,
   isResponseResult,
-  PRE_DECODED_BODY,
-  type PreDecodedBody,
+  preDecodedBody,
   type ResponseResult,
   TEXT_DECODER,
 } from "./runtime-core.ts"
@@ -52,7 +51,7 @@ export function readBoundedJsonSource<T>(
   onResult?: JsonResultContinuation<T>,
   onError?: JsonErrorContinuation<T>,
 ): Promise<unknown | ResponseResult | T> {
-  const preDecoded = (req as { [PRE_DECODED_BODY]?: PreDecodedBody })[PRE_DECODED_BODY]
+  const preDecoded = preDecodedBody(req)
   if (preDecoded !== undefined) {
     const value =
       preDecoded.byteLength > maxBytes ? plainError(413, "payload_too_large") : preDecoded.value
@@ -237,7 +236,8 @@ export function readBodyFramed<T>(
   formOrigins?: FormOrigins,
 ): Promise<T> {
   const contentType = headerOf(source, "content-type") ?? ""
-  if (!isJsonMediaType(contentType)) {
+  // A body a transport codec decoded keeps its media type; the JSON lane below takes its value.
+  if (!isJsonMediaType(contentType) && preDecodedBody(source) === undefined) {
     // JSON needs a preflight, so CORS judges it; a form body reaches here from any site with cookies.
     if (isFormMediaType(contentType) && !formOriginAllowed(source, formOrigins)) {
       return Promise.resolve(wrapResponse(plainError(403, "forbidden_origin")))

package/src/server/body.ts

@@ -462,6 +462,12 @@ export function markTransportCap(source: object, maxBytes: number): void {
   ;(source as { [TRANSPORT_CAP]?: number })[TRANSPORT_CAP] = maxBytes
 }
 
+/** The cap {@link markTransportCap} set on `source`, for a copy that must keep it. */
+export function transportCapOf(source: object): number | undefined {
+  const cap: unknown = Reflect.get(source, TRANSPORT_CAP)
+  return typeof cap === "number" ? cap : undefined
+}
+
 /**
  * Enforce a marked source's transport byte cap on **direct user reads** of its request
  * (`c.req.json()`, `c.req.arrayBuffer()`, the raw `body` stream, `clone()`, ...), without swapping

package/src/server/cookies.ts

@@ -78,6 +78,9 @@ export function parseCookies(header: string | null | undefined): Record<string,
   if (!header) return out
   const len = header.length
   let pos = 0
+  // The first "=" at or after the segment, kept while it lies in a later one, so a run of bare
+  // segments does not rescan the rest of the header each time. -1: none left.
+  let eq = header.indexOf("=")
   while (pos < len) {
     let end = header.indexOf(";", pos)
     if (end === -1) end = len
@@ -86,7 +89,7 @@ export function parseCookies(header: string | null | undefined): Record<string,
     while (start < end && header.charCodeAt(start) === 32) start++
     let stop = end
     while (stop > start && header.charCodeAt(stop - 1) === 32) stop--
-    const eq = header.indexOf("=", start)
+    if (eq !== -1 && eq < start) eq = header.indexOf("=", start)
     if (eq > start && eq < stop) {
       // name: trim trailing spaces before '='; value: trim leading spaces after it
       let nameEnd = eq
@@ -125,6 +128,8 @@ export function hasDuplicateCookie(header: string | null | undefined, targetName
   let found = false
   const len = header.length
   let pos = 0
+  // Kept across segments as in parseCookies.
+  let eq = header.indexOf("=")
   while (pos < len) {
     let end = header.indexOf(";", pos)
     if (end === -1) end = len
@@ -132,7 +137,7 @@ export function hasDuplicateCookie(header: string | null | undefined, targetName
     while (start < end && header.charCodeAt(start) === 32) start++
     let stop = end
     while (stop > start && header.charCodeAt(stop - 1) === 32) stop--
-    const eq = header.indexOf("=", start)
+    if (eq !== -1 && eq < start) eq = header.indexOf("=", start)
     if (eq > start && eq < stop) {
       let nameEnd = eq
       while (nameEnd > start && header.charCodeAt(nameEnd - 1) === 32) nameEnd--

package/src/server/core-copies.ts

@@ -23,7 +23,7 @@ if (!copies.includes(here) && copies.push(here) > 1) {
 
 /** This copy's version: a literal like the package root's `VERSION` (no fs on the edge), which
  * `scripts/version.ts` rewrites on every release and `check:publish` asserts. */
-const COPY_VERSION = "5.4.0"
+const COPY_VERSION = "5.5.1"
 
 /** Record this copy's version beside its URL. Called by each `server()` behind the development guard,
  * so a production bundle drops it with the version; a copy that built a server has recorded one. */