@octanejs/app-core 0.0.47 → 0.0.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@octanejs/app-core",
-  "version": "0.0.47",
+  "version": "0.0.49",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -79,10 +79,10 @@
     "esbuild": "^0.28.1"
   },
   "peerDependencies": {
-    "octane": "0.1.51"
+    "octane": "^0.1.51 || ^0.2.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.3",
-    "octane": "0.1.51"
+    "octane": "0.2.4"
   }
 }

package/src/config-loader.js

@@ -14,7 +14,7 @@
 
 import fs from 'node:fs';
 import path from 'node:path';
-import { createHash } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
 import { builtinModules, createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
 
@@ -229,16 +229,36 @@ async function evaluateConfigModule(root, configPath, configuredCacheDir) {
 	const cacheDir = configuredCacheDir
 		? path.resolve(root, configuredCacheDir)
 		: path.join(root, 'node_modules/.cache/octane/config');
-	const outputPath = path.join(cacheDir, 'octane.config.mjs');
+	// A content-addressed path keeps concurrent evaluations from overwriting
+	// one another. A fresh import URL also reevaluates unchanged source when
+	// its top-level code reads a changing environment value.
+	const contentHash = createHash('sha256').update(output).digest('hex');
+	const outputPath = path.join(cacheDir, `octane.config-${contentHash}.mjs`);
 	fs.mkdirSync(cacheDir, { recursive: true });
-	if (!fs.existsSync(outputPath) || fs.readFileSync(outputPath, 'utf8') !== output) {
-		fs.writeFileSync(outputPath, output);
+	if (!fs.existsSync(outputPath)) {
+		// Publish only a complete file: another config load may import the same
+		// hash while this one writes it, including from a separate process.
+		const temporaryPath = path.join(cacheDir, `.octane.config-${contentHash}-${randomUUID()}.tmp`);
+		try {
+			fs.writeFileSync(temporaryPath, output, { flag: 'wx' });
+			try {
+				fs.renameSync(temporaryPath, outputPath);
+			} catch (error) {
+				// Windows cannot replace an existing destination with rename. If a
+				// concurrent writer won this same-hash race, its complete output is
+				// already safe to import. Preserve other publication failures.
+				if (!fs.existsSync(outputPath) || fs.readFileSync(outputPath, 'utf8') !== output) {
+					throw error;
+				}
+			}
+		} finally {
+			fs.rmSync(temporaryPath, { force: true });
+		}
 	}
-	const contentHash = createHash('sha256').update(output).digest('hex').slice(0, 16);
 	let configModule;
 	try {
 		configModule = await import(
-			/* @vite-ignore */ `${pathToFileURL(outputPath).href}?v=${contentHash}`
+			/* @vite-ignore */ `${pathToFileURL(outputPath).href}?evaluation=${randomUUID()}`
 		);
 	} catch (error) {
 		attachDependencyMetadata(error, dependencies, missingDependencies);

package/src/server/node-http.js

@@ -330,6 +330,16 @@ const MIME_TYPES = {
  * @returns {boolean} true when the request was handled as a static file
  */
 export function serveStaticFile(req, res, staticDir) {
+	return serveStaticFileFromRoot(req, res, staticDir);
+}
+
+/**
+ * @param {import('node:http').IncomingMessage} req
+ * @param {import('node:http').ServerResponse} res
+ * @param {string} staticDir
+ * @param {string} [configuredRoot] Canonical root pinned by createNodeServer
+ */
+function serveStaticFileFromRoot(req, res, staticDir, configuredRoot) {
 	const method = (req.method || 'GET').toUpperCase();
 	if (method !== 'GET' && method !== 'HEAD') return false;
 
@@ -338,49 +348,79 @@ export function serveStaticFile(req, res, staticDir) {
 	const filePath = path.normalize(path.join(staticDir, pathname));
 	if (!filePath.startsWith(path.normalize(staticDir + path.sep))) return false;
 
+	/** @type {string} */
+	let resolvedFile;
 	/** @type {fs.Stats} */
 	let stat;
+	let fd = -1;
 	try {
-		stat = fs.statSync(filePath);
+		const realRoot = configuredRoot ?? fs.realpathSync.native(staticDir);
+		resolvedFile = fs.realpathSync.native(filePath);
+		const rootPrefix = realRoot.endsWith(path.sep) ? realRoot : realRoot + path.sep;
+		if (!resolvedFile.startsWith(rootPrefix)) return false;
+
+		// Open the verified target before responding. Passing this descriptor to
+		// the stream prevents a later path swap from changing what is served.
+		// The built static tree must not be writable by an untrusted actor during
+		// serving: Node has no portable directory-relative open for ancestor swaps.
+		fd = fs.openSync(
+			resolvedFile,
+			fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0) | (fs.constants.O_NONBLOCK || 0),
+		);
+		stat = fs.fstatSync(fd);
+		if (!stat.isFile()) {
+			fs.closeSync(fd);
+			return false;
+		}
 	} catch {
+		if (fd !== -1) fs.closeSync(fd);
 		return false;
 	}
-	if (!stat.isFile()) return false;
 
-	const ext = path.extname(filePath).toLowerCase();
-	const headers = new Headers({
-		'Content-Type': MIME_TYPES[ext] || 'application/octet-stream',
-		'Content-Length': String(stat.size),
-		'Cache-Control':
-			pathname.startsWith('/assets/') || pathname.startsWith('/static/')
-				? 'public, max-age=31536000, immutable'
-				: 'public, max-age=0, must-revalidate',
-	});
-	const gzip = shouldGzip(req, 200, headers, method !== 'HEAD');
-	if (gzip) {
-		headers.set('Content-Encoding', 'gzip');
-		headers.delete('Content-Length');
-	}
-
-	res.statusCode = 200;
-	res.setHeader('Content-Type', /** @type {string} */ (headers.get('Content-Type')));
-	const contentLength = headers.get('Content-Length');
-	if (contentLength !== null) res.setHeader('Content-Length', contentLength);
-	res.setHeader('Cache-Control', /** @type {string} */ (headers.get('Cache-Control')));
-	const contentEncoding = headers.get('Content-Encoding');
-	if (contentEncoding !== null) res.setHeader('Content-Encoding', contentEncoding);
-	const vary = headers.get('Vary');
-	if (vary !== null) res.setHeader('Vary', vary);
-	if (method === 'HEAD') {
-		res.end();
-	} else if (gzip) {
-		pipeline(fs.createReadStream(filePath), createGzip(), res, (error) => {
-			if (error && !res.destroyed) res.destroy(error);
+	try {
+		const ext = path.extname(filePath).toLowerCase();
+		const headers = new Headers({
+			'Content-Type': MIME_TYPES[ext] || 'application/octet-stream',
+			'Content-Length': String(stat.size),
+			'Cache-Control':
+				pathname.startsWith('/assets/') || pathname.startsWith('/static/')
+					? 'public, max-age=31536000, immutable'
+					: 'public, max-age=0, must-revalidate',
 		});
-	} else {
-		fs.createReadStream(filePath).pipe(res);
+		const gzip = shouldGzip(req, 200, headers, method !== 'HEAD');
+		if (gzip) {
+			headers.set('Content-Encoding', 'gzip');
+			headers.delete('Content-Length');
+		}
+
+		res.statusCode = 200;
+		res.setHeader('Content-Type', /** @type {string} */ (headers.get('Content-Type')));
+		const contentLength = headers.get('Content-Length');
+		if (contentLength !== null) res.setHeader('Content-Length', contentLength);
+		res.setHeader('Cache-Control', /** @type {string} */ (headers.get('Cache-Control')));
+		const contentEncoding = headers.get('Content-Encoding');
+		if (contentEncoding !== null) res.setHeader('Content-Encoding', contentEncoding);
+		const vary = headers.get('Vary');
+		if (vary !== null) res.setHeader('Vary', vary);
+		if (method === 'HEAD') {
+			res.end();
+		} else {
+			const source = fs.createReadStream(resolvedFile, { fd, autoClose: true });
+			fd = -1; // The stream now owns and closes the descriptor.
+			if (gzip) {
+				pipeline(source, createGzip(), res, (error) => {
+					if (error && !res.destroyed) res.destroy(error);
+				});
+			} else {
+				pipeline(source, res, (error) => {
+					if (error && !res.destroyed) res.destroy(error);
+				});
+			}
+		}
+		return true;
+	} finally {
+		if (fd !== -1) fs.closeSync(fd);
 	}
-	return true;
 }
 
 /**
@@ -394,10 +434,24 @@ export function serveStaticFile(req, res, staticDir) {
  */
 export function createNodeServer(handler, options = {}) {
 	const staticDir = options.staticDir;
+	/** @type {string | null} */
+	let configuredRoot = null;
+	try {
+		if (staticDir) configuredRoot = fs.realpathSync.native(staticDir);
+	} catch {
+		// A missing root must remain unavailable for this server's lifetime.
+		// Otherwise it could appear later as a symlink to a private directory.
+	}
 
 	const server = http.createServer((req, res) => {
 		(async () => {
-			if (staticDir && serveStaticFile(req, res, staticDir)) return;
+			if (
+				staticDir &&
+				configuredRoot &&
+				serveStaticFileFromRoot(req, res, staticDir, configuredRoot)
+			) {
+				return;
+			}
 			const response = await handler(nodeRequestToWebRequest(req));
 			await sendWebResponseForRequest(res, response, req);
 		})().catch((error) => {

package/src/server/router.js

@@ -17,6 +17,7 @@
  * @property {string | RegExp} pattern
  * @property {string[]} paramNames
  * @property {number} specificity - Higher = more specific (static > param > catch-all)
+ * @property {number} order - Specificity-desc index; breaks equal-spec ties
  */
 
 /**
@@ -37,7 +38,7 @@ function compilePath(path) {
 	// Escape special regex characters except our param syntax
 	const regexString = path
 		.split('/')
-		.map((segment) => {
+		.map(function (segment) {
 			if (!segment) return '';
 
 			// Catch-all param: *slug
@@ -68,6 +69,53 @@ function compilePath(path) {
 	return { pattern, paramNames, specificity };
 }
 
+/**
+ * Last static segment of a dynamic route pattern. Positions skip empty
+ * segments so they line up with a leading-slash pathname split.
+ * A static token after a catch-all is not at a fixed index (`(.+)` can
+ * consume several segments), so those patterns stay on the linear remainder.
+ *
+ * @param {string} path
+ * @returns {{ pos: number, value: string } | null}
+ */
+function lastStaticSegment(path) {
+	const raw = path.split('/');
+	let pos = -1;
+	let value = '';
+	let index = 0;
+	let sawCatchAll = false;
+	for (let i = 0; i < raw.length; i++) {
+		const segment = raw[i];
+		if (!segment) continue;
+		const first = segment.charCodeAt(0);
+		if (first === 42 /* * */) {
+			sawCatchAll = true;
+		} else if (first !== 58 /* : */) {
+			if (sawCatchAll) return null;
+			pos = index;
+			value = segment;
+		}
+		index++;
+	}
+	if (pos === -1) return null;
+	return { pos, value };
+}
+
+/**
+ * Non-empty pathname segments, matching lastStaticSegment positions.
+ *
+ * @param {string} pathname
+ * @returns {string[]}
+ */
+function pathnameSegments(pathname) {
+	const raw = pathname.split('/');
+	const parts = [];
+	for (let i = 0; i < raw.length; i++) {
+		if (raw[i]) parts.push(raw[i]);
+	}
+	return parts;
+}
+
 /**
  * Escape special regex characters
  * @param {string} str
@@ -77,6 +125,32 @@ function escapeRegex(str) {
 	return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 }
 
+/**
+ * @param {CompiledRoute} compiled
+ * @param {string} method
+ * @param {string} pathname
+ * @param {string | undefined} normalizedMethod
+ * @returns {RouteMatch | null}
+ */
+function matchCompiled(compiled, method, pathname, normalizedMethod) {
+	const route = compiled.route;
+	if (route.type === 'server') {
+		const methods = /** @type {ServerRoute} */ (route).methods;
+		if (normalizedMethod === undefined) normalizedMethod = method.toUpperCase();
+		if (!methods.includes(normalizedMethod)) return null;
+	}
+
+	const match = /** @type {RegExp} */ (compiled.pattern).exec(pathname);
+	if (match === null) return null;
+	const paramNames = compiled.paramNames;
+	/** @type {Record<string, string>} */
+	const params = {};
+	for (let p = 0; p < paramNames.length; p++) {
+		params[paramNames[p]] = decodeURIComponent(match[p + 1]);
+	}
+	return { route, params };
+}
+
 /**
  * Create a router from a list of routes
  * @param {Route[]} routes
@@ -84,13 +158,60 @@ function escapeRegex(str) {
  */
 export function createRouter(routes) {
 	/** @type {CompiledRoute[]} */
-	const compiledRoutes = routes.map((route) => {
-		const { pattern, paramNames, specificity } = compilePath(route.path);
-		return { route, pattern, paramNames, specificity };
-	});
+	const compiledRoutes = [];
+	for (let i = 0; i < routes.length; i++) {
+		const route = routes[i];
+		const compiled = compilePath(route.path);
+		compiledRoutes.push({
+			route,
+			pattern: compiled.pattern,
+			paramNames: compiled.paramNames,
+			specificity: compiled.specificity,
+			order: i,
+		});
+	}
 
 	// Sort by specificity (higher first) for correct matching order
-	compiledRoutes.sort((a, b) => b.specificity - a.specificity);
+	compiledRoutes.sort(function (a, b) {
+		if (b.specificity !== a.specificity) return b.specificity - a.specificity;
+		return a.order - b.order;
+	});
+	for (let i = 0; i < compiledRoutes.length; i++) {
+		compiledRoutes[i].order = i;
+	}
+
+	// Exact static paths are O(1). A matching static always out-scores a param
+	// or catch-all that could match the same pathname, so the map is consulted
+	// first. After a method miss, matching falls through to the dynamic index.
+	/** @type {Map<string, CompiledRoute[]>} */
+	const staticByPath = new Map();
+	/** @type {Array<Map<string, CompiledRoute[]> | undefined>} */
+	const dynamicByPos = [];
+	/** @type {CompiledRoute[]} */
+	const dynamicNoStatic = [];
+
+	for (let i = 0; i < compiledRoutes.length; i++) {
+		const compiled = compiledRoutes[i];
+		if (typeof compiled.pattern === 'string') {
+			const existing = staticByPath.get(compiled.pattern);
+			if (existing === undefined) staticByPath.set(compiled.pattern, [compiled]);
+			else existing.push(compiled);
+			continue;
+		}
+		const last = lastStaticSegment(compiled.route.path);
+		if (last === null) {
+			dynamicNoStatic.push(compiled);
+			continue;
+		}
+		let bucketMap = dynamicByPos[last.pos];
+		if (bucketMap === undefined) {
+			bucketMap = new Map();
+			dynamicByPos[last.pos] = bucketMap;
+		}
+		const existing = bucketMap.get(last.value);
+		if (existing === undefined) bucketMap.set(last.value, [compiled]);
+		else existing.push(compiled);
+	}
 
 	return {
 		/**
@@ -99,31 +220,57 @@ export function createRouter(routes) {
 		 * @param {string} pathname
 		 * @returns {RouteMatch | null}
 		 */
-		match(method, pathname) {
+		match: function (method, pathname) {
 			let normalizedMethod;
-			for (const { route, pattern, paramNames } of compiledRoutes) {
-				// Check method for ServerRoute
-				if (route.type === 'server') {
-					const methods = /** @type {ServerRoute} */ (route).methods;
-					normalizedMethod ??= method.toUpperCase();
-					if (!methods.includes(normalizedMethod)) {
-						continue;
+			const staticMatches = staticByPath.get(pathname);
+			if (staticMatches !== undefined) {
+				for (let i = 0; i < staticMatches.length; i++) {
+					const route = staticMatches[i].route;
+					if (route.type === 'server') {
+						const methods = /** @type {ServerRoute} */ (route).methods;
+						if (normalizedMethod === undefined) normalizedMethod = method.toUpperCase();
+						if (!methods.includes(normalizedMethod)) continue;
 					}
+					return { route, params: {} };
 				}
+			}
 
-				if (typeof pattern === 'string') {
-					if (pathname === pattern) return { route, params: {} };
-					continue;
+			const parts = pathnameSegments(pathname);
+			/** @type {CompiledRoute | null} */
+			let first = null;
+			/** @type {CompiledRoute[] | null} */
+			let extra = null;
+			for (let p = 0; p < parts.length; p++) {
+				const bucketMap = dynamicByPos[p];
+				if (bucketMap === undefined) continue;
+				const bucket = bucketMap.get(parts[p]);
+				if (bucket === undefined) continue;
+				for (let b = 0; b < bucket.length; b++) {
+					if (first === null) first = bucket[b];
+					else if (extra === null) extra = [bucket[b]];
+					else extra.push(bucket[b]);
 				}
+			}
+			for (let r = 0; r < dynamicNoStatic.length; r++) {
+				if (first === null) first = dynamicNoStatic[r];
+				else if (extra === null) extra = [dynamicNoStatic[r]];
+				else extra.push(dynamicNoStatic[r]);
+			}
+
+			if (first === null) return null;
+			if (extra === null) return matchCompiled(first, method, pathname, normalizedMethod);
 
-				const match = pathname.match(pattern);
-				if (!match) continue;
-				/** @type {Record<string, string>} */
-				const params = {};
-				for (let i = 0; i < paramNames.length; i++) {
-					params[paramNames[i]] = decodeURIComponent(match[i + 1]);
+			const candidates = extra;
+			candidates.push(first);
+			candidates.sort(function (a, b) {
+				return a.order - b.order;
+			});
+			for (let c = 0; c < candidates.length; c++) {
+				const hit = matchCompiled(candidates[c], method, pathname, normalizedMethod);
+				if (hit !== null) return hit;
+				if (candidates[c].route.type === 'server' && normalizedMethod === undefined) {
+					normalizedMethod = method.toUpperCase();
 				}
-				return { route, params };
 			}
 			return null;
 		},

package/src/server/server-route.js

@@ -35,9 +35,9 @@ export async function handleServerRoute(route, context, globalMiddlewares) {
 	} catch (error) {
 		console.error('[octane] API route error:', error);
 
-		// Return error response
-		const message = error instanceof Error ? error.message : 'Internal Server Error';
-		return new Response(JSON.stringify({ error: message }), {
+		// Thrown messages can contain credentials or internal details. The server
+		// log above retains the original error for diagnostics.
+		return new Response(JSON.stringify({ error: 'Internal Server Error' }), {
 			status: 500,
 			headers: {
 				'Content-Type': 'application/json',