@pikku/bun-server 0.12.3 → 0.12.5

package/CHANGELOG.md

@@ -1,5 +1,61 @@
 # @pikku/bun-server
 
+## 0.12.5
+
+### Patch Changes
+
+- ea8aabf: Serve `LocalContent` uploads and signed reads under Bun.
+
+  `LocalContent` hands the browser a `PUT <uploadUrlPrefix>/<key>` upload URL and a signed
+  `GET <assetUrlPrefix>/<key>` read URL, but it is a `ContentService` and cannot answer
+  either — something in the serving path has to. Only `@pikku/node-http-server` did. The
+  same project served under Bun handed out upload URLs that 404ed, with nothing naming the
+  cause: the config was accepted, the service was constructed, and the URLs looked right.
+
+  `@pikku/core` now exports `createLocalContentRequestHandler` from
+  `@pikku/core/services/local-content-request-handler` — the server half of `LocalContent`,
+  expressed in Web `Request`/`Response` so every runtime shares one implementation of the
+  signature check rather than each re-deriving it. It returns `null` for anything that is
+  not a content request, which is the caller's signal to carry on with its normal routing.
+
+  `PikkuBunServer` accepts `config.content` and a `contentSigningJWT` option, mirroring
+  `PikkuNodeHTTPServer`, and answers both prefixes ahead of static mounts and routing.
+  `BunServerRunner` was dropping `contentSigningJWT` on the floor, which silently disabled
+  signed asset reads for every Bun project even once the prefixes were served — the config
+  arrived, the service that verifies its signatures did not.
+
+  Signed reads are refused unless every claim matches, the path included: without that, a
+  signature minted for one asset would read any other.
+
+- Updated dependencies [32277d5]
+- Updated dependencies [ea8aabf]
+- Updated dependencies [33e96ab]
+- Updated dependencies [fd72e58]
+- Updated dependencies [fd72e58]
+- Updated dependencies [fd72e58]
+- Updated dependencies [894b2f8]
+- Updated dependencies [dd19aa7]
+- Updated dependencies [50ec500]
+  - @pikku/core@0.12.75
+
+## 0.12.4
+
+### Patch Changes
+
+- d4a2503: Serve the console same-origin at /console (#861). Both dev servers gain
+  `staticMounts` (prefix → directory static serving with SPA fallback and path
+  traversal protection); `pikku serve` / `pikku dev` mount the bundled console
+  app at `/console` on the API port whenever it is bundled, so auth cookies are
+  first-party and no `?server=` param is needed. The console is built with
+  `base: '/console/'` (its router already derives the basename from BASE_URL).
+  The separate `--console <port>` static server is removed; `pikku console`
+  serves the bundle under /console and redirects the root there.
+- Updated dependencies [61c9ce9]
+- Updated dependencies [f1f39f8]
+- Updated dependencies [c45e98d]
+- Updated dependencies [472a349]
+  - @pikku/core@0.12.52
+
 ## 0.12.3
 
 ### Patch Changes

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 - present Yasser Fadl and Pikku contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,32 @@
+# @pikku/bun-server
+
+Pikku server for Bun, built on `Bun.serve`. Includes a Bun-native event hub and
+optional MCP support.
+
+For Node use `@pikku/node-http-server`.
+
+## Install
+
+```bash
+bun add @pikku/bun-server
+```
+
+## Usage
+
+```typescript
+import { PikkuBunServer } from '@pikku/bun-server'
+
+import './.pikku/pikku-bootstrap.gen.js'
+
+const server = new PikkuBunServer(config, logger)
+
+await server.init()
+await server.start()
+```
+
+Pass `{ eventHub, mcpJson, mcpPath }` as the third argument to override the
+default `BunEventHubService` or enable MCP.
+
+## Docs
+
+https://pikku.dev/docs

package/dist/pikku-bun-server.d.ts

@@ -1,11 +1,19 @@
 import type { CoreConfig } from '@pikku/core';
-import type { Logger } from '@pikku/core/services';
+import type { JWTService, Logger } from '@pikku/core/services';
+import type { LocalContentConfig } from '@pikku/core/services/local-content';
 import { type RunHTTPWiringOptions } from '@pikku/core/http';
 import { BunEventHubService } from './bun-event-hub-service.js';
+export type StaticMount = {
+    urlPrefix: string;
+    directory: string;
+    spaFallback?: boolean;
+};
 export type BunServerConfig = CoreConfig & {
     port: number;
     hostname?: string;
+    staticMounts?: StaticMount[];
     healthCheckPath?: string;
+    content?: LocalContentConfig;
 };
 export type PikkuBunServerOptions = RunHTTPWiringOptions & {
     eventHub?: BunEventHubService;
@@ -15,6 +23,7 @@ export type PikkuBunServerOptions = RunHTTPWiringOptions & {
         prompts?: unknown[];
     };
     mcpPath?: string;
+    contentSigningJWT?: JWTService;
 };
 export declare class PikkuBunServer {
     private readonly config;
@@ -25,10 +34,14 @@ export declare class PikkuBunServer {
     private readonly mcpJson?;
     private readonly mcpPath;
     private mcpHandler?;
+    private readonly localContent?;
     constructor(config: BunServerConfig, logger: Logger, options?: PikkuBunServerOptions);
     init(): Promise<void>;
     private initMCP;
     start(): Promise<void>;
+    get port(): number;
+    private serveStaticMounts;
+    private resolveStaticFile;
     stop(): Promise<void>;
     enableExitOnSignals(): void;
 }

package/dist/pikku-bun-server.js

@@ -1,8 +1,11 @@
 import { stopSingletonServices } from '@pikku/core';
+import { pikkuState } from '@pikku/core/internal';
+import { createLocalContentRequestHandler, } from '@pikku/core/services/local-content-request-handler';
 import { fetchData, PikkuFetchHTTPRequest, PikkuFetchHTTPResponse, logRoutes as logRegisterRoutes, } from '@pikku/core/http';
 import { logChannels } from '@pikku/core/channel';
 import { runLocalChannel } from '@pikku/core/channel/local';
 import { compileAllSchemas } from '@pikku/core/schema';
+import { resolve } from 'node:path';
 import { BunEventHubService } from './bun-event-hub-service.js';
 const isSerializable = (data) => !(typeof data === 'string' ||
     data instanceof ArrayBuffer ||
@@ -23,14 +26,23 @@ export class PikkuBunServer {
     mcpJson;
     mcpPath;
     mcpHandler;
+    localContent;
     constructor(config, logger, options = {}) {
         this.config = config;
         this.logger = logger;
-        const { eventHub, mcpJson, mcpPath, ...httpOptions } = options;
+        const { eventHub, mcpJson, mcpPath, contentSigningJWT, ...httpOptions } = options;
         this.eventHub = eventHub ?? new BunEventHubService();
         this.mcpJson = mcpJson;
         this.mcpPath = mcpPath ?? '/mcp';
         this.options = httpOptions;
+        this.localContent = config.content
+            ? createLocalContentRequestHandler({
+                content: config.content,
+                logger,
+                getJWT: () => contentSigningJWT ??
+                    pikkuState(null, 'package', 'singletonServices')?.jwt,
+            })
+            : undefined;
     }
     async init() {
         compileAllSchemas(this.logger);
@@ -101,6 +113,14 @@ export class PikkuBunServer {
                         return await mcpHandler(req);
                     }
                 }
+                const contentResponse = await this.localContent?.(req);
+                if (contentResponse) {
+                    return contentResponse;
+                }
+                const staticResponse = await this.serveStaticMounts(req);
+                if (staticResponse) {
+                    return staticResponse;
+                }
                 const pikkuReq = new PikkuFetchHTTPRequest(req);
                 const pikkuRes = new PikkuFetchHTTPResponse();
                 await fetchData(pikkuReq, pikkuRes, {
@@ -150,6 +170,54 @@ export class PikkuBunServer {
         eventHub.setServer(this.server);
         logger.info(`pikku-bun-server: listening on http://${config.hostname ?? 'localhost'}:${config.port}`);
     }
+    get port() {
+        return this.server?.port ?? this.config.port;
+    }
+    async serveStaticMounts(req) {
+        const mounts = this.config.staticMounts;
+        if (!mounts?.length || (req.method !== 'GET' && req.method !== 'HEAD')) {
+            return null;
+        }
+        const pathname = decodeURIComponent(new URL(req.url).pathname);
+        for (const mount of mounts) {
+            if (pathname !== mount.urlPrefix &&
+                !pathname.startsWith(`${mount.urlPrefix}/`)) {
+                continue;
+            }
+            const key = pathname.slice(mount.urlPrefix.length).replace(/^\/+/, '');
+            const file = await this.resolveStaticFile(mount, key);
+            if (file) {
+                return new Response(req.method === 'HEAD' ? null : file);
+            }
+            if (mount.spaFallback) {
+                const index = await this.resolveStaticFile(mount, 'index.html');
+                if (index) {
+                    return new Response(req.method === 'HEAD' ? null : index);
+                }
+            }
+            return new Response('Not Found', { status: 404 });
+        }
+        return null;
+    }
+    async resolveStaticFile(mount, key) {
+        const directory = resolve(mount.directory);
+        const targetPath = key === '' ? resolve(directory, 'index.html') : resolve(directory, key);
+        if (targetPath !== directory && !targetPath.startsWith(`${directory}/`)) {
+            return null;
+        }
+        let file = Bun.file(targetPath);
+        if (!(await file.exists())) {
+            const indexPath = resolve(targetPath, 'index.html');
+            if (!indexPath.startsWith(`${directory}/`)) {
+                return null;
+            }
+            file = Bun.file(indexPath);
+            if (!(await file.exists())) {
+                return null;
+            }
+        }
+        return file;
+    }
     async stop() {
         await this.server?.stop();
         this.server = null;

package/dist/pikku-bun-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"pikku-bun-server.js","sourceRoot":"","sources":["../src/pikku-bun-server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,sBAAsB,EACtB,SAAS,IAAI,iBAAiB,GAE/B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAiC/D,MAAM,cAAc,GAAG,CAAC,IAAa,EAAW,EAAE,CAChD,CAAC,CACC,OAAO,IAAI,KAAK,QAAQ;IACxB,IAAI,YAAY,WAAW;IAC3B,IAAI,YAAY,UAAU;IAC1B,IAAI,YAAY,SAAS;IACzB,IAAI,YAAY,WAAW;IAC3B,IAAI,YAAY,UAAU;IAC1B,IAAI,YAAY,WAAW;IAC3B,IAAI,YAAY,UAAU;IAC1B,IAAI,YAAY,YAAY;IAC5B,IAAI,YAAY,YAAY,CAC7B,CAAA;AAQH,MAAM,OAAO,cAAc;IASN;IACA;IATX,MAAM,GAA6B,IAAI,CAAA;IAC9B,QAAQ,CAAoB;IAC5B,OAAO,CAAsB;IAC7B,OAAO,CAAmC;IAC1C,OAAO,CAAQ;IACxB,UAAU,CAA0C;IAE5D,YACmB,MAAuB,EACvB,MAAc,EAC/B,UAAiC,EAAE;QAFlB,WAAM,GAAN,MAAM,CAAiB;QACvB,WAAM,GAAN,MAAM,CAAQ;QAG/B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,WAAW,EAAE,GAAG,OAAO,CAAA;QAC9D,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,kBAAkB,EAAE,CAAA;QACpD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,MAAM,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,WAAW,CAAA;IAC5B,CAAC;IAEM,KAAK,CAAC,IAAI;QACf,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9B,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9B,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACtB,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,OAAO,CAAA;QAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAClE,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;YACtE,MAAM,SAAS,GAAG,IAAI,cAAc,CAClC;gBACE,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE;oBACZ,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;oBACtC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;oBAC9C,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;iBAC3C;aACF,EACD,IAAI,CAAC,MAAM,CACZ,CAAA;YACD,MAAM,SAAS,CAAC,IAAI,EAAE,CAAA;YACtB,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACxE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAA;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAA;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QAEvE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAS;YAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YAEzB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;gBAC3B,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;oBAC9D,MAAM,QAAQ,GAAG,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAA;oBAC/C,MAAM,QAAQ,GAAG,IAAI,sBAAsB,EAAE,CAAA;oBAC7C,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC;wBAC3C,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;wBAC9B,OAAO,EAAE,QAAQ;wBACjB,QAAQ,EAAE,QAAQ;wBAClB,KAAK,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;qBACjC,CAAC,CAAA;oBACF,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;oBACnD,CAAC;oBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAA;oBAClE,IAAI,QAAQ;wBAAE,OAAO,SAAgC,CAAA;oBACrD,OAAO,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAClE,CAAC;gBAED,IACE,MAAM,CAAC,eAAe;oBACtB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,eAAe,EACpD,CAAC;oBACD,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE;wBACjC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC,CAAA;gBACJ,CAAC;gBAED,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;oBAC1C,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,CAAC;wBAC/D,OAAO,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;oBAC9B,CAAC;gBACH,CAAC;gBAED,MAAM,QAAQ,GAAG,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAA;gBAC/C,MAAM,QAAQ,GAAG,IAAI,sBAAsB,EAAE,CAAA;gBAC7C,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE;oBAClC,cAAc,EAAE,IAAI;oBACpB,GAAG,OAAO;iBACX,CAAC,CAAA;gBACF,OAAO,QAAQ,CAAC,UAAU,EAAE,CAAA;YAC9B,CAAC;YAED,SAAS,EAAE;gBACT,IAAI,EAAE,CAAC,EAA2B,EAAE,EAAE;oBACpC,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAA;oBAClC,cAAc,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE;wBACrC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAY,CAAC,CAAA;oBACtE,CAAC,CAAC,CAAA;oBACF,cAAc,CAAC,oBAAoB,CAAC,CAAC,IAAI,EAAE,EAAE;wBAC3C,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;oBACrB,CAAC,CAAC,CAAA;oBACF,cAAc,CAAC,eAAe,CAAC,GAAG,EAAE;wBAClC,EAAE,CAAC,KAAK,EAAE,CAAA;oBACZ,CAAC,CAAC,CAAA;oBACF,QAAQ,CAAC,eAAe,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;oBACtD,cAAc,CAAC,IAAI,EAAE,CAAA;gBACvB,CAAC;gBAED,OAAO,EAAE,KAAK,EAAE,EAA2B,EAAE,OAAO,EAAE,EAAE;oBACtD,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAA;oBAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAChC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;wBACpD,IAAI,MAAM;4BAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;oBAC7C,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,GACT,OAAO,YAAY,WAAW;4BAC5B,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC;4BACzB,CAAC,CAAC,IAAI,UAAU,CACZ,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,UAAU,CACnB,CAAA;wBACP,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;wBACxD,IAAI,MAAM;4BAAE,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;oBAC/C,CAAC;gBACH,CAAC;gBAED,KAAK,EAAE,CAAC,EAA2B,EAAE,EAAE;oBACrC,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAA;oBAClC,QAAQ,CAAC,eAAe,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;oBAClD,cAAc,CAAC,KAAK,EAAE,CAAA;gBACxB,CAAC;aACF;SACF,CAAC,CAAA;QAEF,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAA4B,CAAC,CAAA;QACrD,MAAM,CAAC,IAAI,CACT,yCAAyC,MAAM,CAAC,QAAQ,IAAI,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CACzF,CAAA;IACH,CAAC;IAEM,KAAK,CAAC,IAAI;QACf,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAEM,mBAAmB;QACxB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;YACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,qBAAqB,CAAC,CAAA;YAClE,IAAI,CAAC;gBACH,MAAM,qBAAqB,EAAE,CAAA;gBAC7B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YACnB,CAAC;oBAAS,CAAC;gBACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,CAAC;QACH,CAAC,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;QAChD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;IACpD,CAAC;CACF"}
+{"version":3,"file":"pikku-bun-server.js","sourceRoot":"","sources":["../src/pikku-bun-server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EACL,gCAAgC,GAEjC,MAAM,oDAAoD,CAAA;AAC3D,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,sBAAsB,EACtB,SAAS,IAAI,iBAAiB,GAE/B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAuD/D,MAAM,cAAc,GAAG,CAAC,IAAa,EAAW,EAAE,CAChD,CAAC,CACC,OAAO,IAAI,KAAK,QAAQ;IACxB,IAAI,YAAY,WAAW;IAC3B,IAAI,YAAY,UAAU;IAC1B,IAAI,YAAY,SAAS;IACzB,IAAI,YAAY,WAAW;IAC3B,IAAI,YAAY,UAAU;IAC1B,IAAI,YAAY,WAAW;IAC3B,IAAI,YAAY,UAAU;IAC1B,IAAI,YAAY,YAAY;IAC5B,IAAI,YAAY,YAAY,CAC7B,CAAA;AAQH,MAAM,OAAO,cAAc;IAUN;IACA;IAVX,MAAM,GAA6B,IAAI,CAAA;IAC9B,QAAQ,CAAoB;IAC5B,OAAO,CAAsB;IAC7B,OAAO,CAAmC;IAC1C,OAAO,CAAQ;IACxB,UAAU,CAA0C;IAC3C,YAAY,CAA6B;IAE1D,YACmB,MAAuB,EACvB,MAAc,EAC/B,UAAiC,EAAE;QAFlB,WAAM,GAAN,MAAM,CAAiB;QACvB,WAAM,GAAN,MAAM,CAAQ;QAG/B,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,WAAW,EAAE,GACrE,OAAO,CAAA;QACT,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,kBAAkB,EAAE,CAAA;QACpD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,MAAM,CAAA;QAChC,IAAI,CAAC,OAAO,GAAG,WAAW,CAAA;QAC1B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,OAAO;YAChC,CAAC,CAAC,gCAAgC,CAAC;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM;gBAGN,MAAM,EAAE,GAAG,EAAE,CACX,iBAAiB;oBACjB,UAAU,CAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,EAAE,GAAG;aACxD,CAAC;YACJ,CAAC,CAAC,SAAS,CAAA;IACf,CAAC;IAEM,KAAK,CAAC,IAAI;QACf,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9B,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9B,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACxB,MAAM,IAAI,CAAC,OAAO,EAAE,CAAA;IACtB,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC5B,IAAI,CAAC,OAAO;YAAE,OAAM;QACpB,MAAM,EAAE,KAAK,GAAG,EAAE,EAAE,SAAS,GAAG,EAAE,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,OAAO,CAAA;QAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAM;QAClE,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAA;YACtE,MAAM,SAAS,GAAG,IAAI,cAAc,CAClC;gBACE,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO;gBAChB,OAAO,EAAE,OAAO;gBAChB,YAAY,EAAE;oBACZ,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;oBACtC,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;oBAC9C,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;iBAC3C;aACF,EACD,IAAI,CAAC,MAAM,CACZ,CAAA;YACD,MAAM,SAAS,CAAC,IAAI,EAAE,CAAA;YACtB,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;YACxE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAA;YACzB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oCAAoC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAA;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gDAAgD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAA;QACH,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,KAAK;QAChB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;QAEvE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAS;YAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YAEzB,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;gBAC3B,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC;oBAC9D,MAAM,QAAQ,GAAG,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAA;oBAC/C,MAAM,QAAQ,GAAG,IAAI,sBAAsB,EAAE,CAAA;oBAC7C,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC;wBAC3C,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;wBAC9B,OAAO,EAAE,QAAQ;wBACjB,QAAQ,EAAE,QAAQ;wBAClB,KAAK,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;qBACjC,CAAC,CAAA;oBACF,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;oBACnD,CAAC;oBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,CAAC,CAAA;oBAClE,IAAI,QAAQ;wBAAE,OAAO,SAAgC,CAAA;oBACrD,OAAO,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAClE,CAAC;gBAED,IACE,MAAM,CAAC,eAAe;oBACtB,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,eAAe,EACpD,CAAC;oBACD,OAAO,IAAI,QAAQ,CAAC,aAAa,EAAE;wBACjC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;qBAChD,CAAC,CAAA;gBACJ,CAAC;gBAED,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;oBAC1C,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,EAAE,CAAC;wBAC/D,OAAO,MAAM,UAAU,CAAC,GAAG,CAAC,CAAA;oBAC9B,CAAC;gBACH,CAAC;gBAKD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC,GAAG,CAAC,CAAA;gBACtD,IAAI,eAAe,EAAE,CAAC;oBACpB,OAAO,eAAe,CAAA;gBACxB,CAAC;gBAED,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAA;gBACxD,IAAI,cAAc,EAAE,CAAC;oBACnB,OAAO,cAAc,CAAA;gBACvB,CAAC;gBAED,MAAM,QAAQ,GAAG,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAA;gBAC/C,MAAM,QAAQ,GAAG,IAAI,sBAAsB,EAAE,CAAA;gBAC7C,MAAM,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE;oBAClC,cAAc,EAAE,IAAI;oBACpB,GAAG,OAAO;iBACX,CAAC,CAAA;gBACF,OAAO,QAAQ,CAAC,UAAU,EAAE,CAAA;YAC9B,CAAC;YAED,SAAS,EAAE;gBACT,IAAI,EAAE,CAAC,EAA2B,EAAE,EAAE;oBACpC,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAA;oBAClC,cAAc,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE;wBACrC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAY,CAAC,CAAA;oBACtE,CAAC,CAAC,CAAA;oBACF,cAAc,CAAC,oBAAoB,CAAC,CAAC,IAAI,EAAE,EAAE;wBAC3C,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;oBACrB,CAAC,CAAC,CAAA;oBACF,cAAc,CAAC,eAAe,CAAC,GAAG,EAAE;wBAClC,EAAE,CAAC,KAAK,EAAE,CAAA;oBACZ,CAAC,CAAC,CAAA;oBACF,QAAQ,CAAC,eAAe,CAAC,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;oBACtD,cAAc,CAAC,IAAI,EAAE,CAAA;gBACvB,CAAC;gBAED,OAAO,EAAE,KAAK,EAAE,EAA2B,EAAE,OAAO,EAAE,EAAE;oBACtD,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAA;oBAClC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;wBAChC,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;wBACpD,IAAI,MAAM;4BAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;oBAC7C,CAAC;yBAAM,CAAC;wBACN,MAAM,KAAK,GACT,OAAO,YAAY,WAAW;4BAC5B,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC;4BACzB,CAAC,CAAC,IAAI,UAAU,CACZ,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,UAAU,CACnB,CAAA;wBACP,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,aAAa,CAAC,KAAK,CAAC,CAAA;wBACxD,IAAI,MAAM;4BAAE,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;oBAC/C,CAAC;gBACH,CAAC;gBAED,KAAK,EAAE,CAAC,EAA2B,EAAE,EAAE;oBACrC,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAA;oBAClC,QAAQ,CAAC,eAAe,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;oBAClD,cAAc,CAAC,KAAK,EAAE,CAAA;gBACxB,CAAC;aACF;SACF,CAAC,CAAA;QAEF,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,MAA4B,CAAC,CAAA;QACrD,MAAM,CAAC,IAAI,CACT,yCAAyC,MAAM,CAAC,QAAQ,IAAI,WAAW,IAAI,MAAM,CAAC,IAAI,EAAE,CACzF,CAAA;IACH,CAAC;IAED,IAAW,IAAI;QACb,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;IAC9C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,GAAY;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAA;QACvC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;YACvE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAA;QAE9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IACE,QAAQ,KAAK,KAAK,CAAC,SAAS;gBAC5B,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,SAAS,GAAG,CAAC,EAC3C,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACrD,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAC1D,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;gBAC/D,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBAC3D,CAAC;YACH,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACnD,CAAC;QAED,OAAO,IAAI,CAAA;IACb,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,KAAkB,EAClB,GAAW;QAEX,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QAC1C,MAAM,UAAU,GACd,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAA;QACzE,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC/B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAA;YACnD,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;gBAC3C,OAAO,IAAI,CAAA;YACb,CAAC;YACD,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAEM,KAAK,CAAC,IAAI;QACf,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;QACzB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAEM,mBAAmB;QACxB,MAAM,QAAQ,GAAG,KAAK,EAAE,MAAc,EAAE,EAAE;YACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,qBAAqB,CAAC,CAAA;YAClE,IAAI,CAAC;gBACH,MAAM,qBAAqB,EAAE,CAAA;gBAC7B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YACnB,CAAC;oBAAS,CAAC;gBACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACjB,CAAC;QACH,CAAC,CAAA;QACD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAA;QAChD,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAA;IACpD,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/bun-server",
-  "version": "0.12.3",
+  "version": "0.12.5",
   "description": "Pikku server adapter for Bun (Bun.serve)",
   "license": "MIT",
   "author": "yasser.fadl@gmail.com",
@@ -16,7 +16,7 @@
     "prepublishOnly": "bun run build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.44",
+    "@pikku/core": "^0.12.75",
     "@pikku/modelcontextprotocol": "^0.12.6"
   },
   "peerDependenciesMeta": {

package/src/local-content.test.ts

@@ -0,0 +1,193 @@
+import { describe, test, before, after } from 'node:test'
+import assert from 'node:assert/strict'
+import {
+  mkdtempSync,
+  mkdirSync,
+  writeFileSync,
+  readFileSync,
+  rmSync,
+} from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { setSingletonServices } from '@pikku/core'
+import { resetPikkuState } from '@pikku/core/internal'
+import { LocalContent } from '@pikku/core/services/local-content'
+import type { JWTService, Logger } from '@pikku/core/services'
+import { PikkuBunServer } from './pikku-bun-server.js'
+
+const noopLogger = {
+  info: () => {},
+  error: () => {},
+  warn: () => {},
+  debug: () => {},
+  trace: () => {},
+  setLevel: () => {},
+} as unknown as Logger
+
+/**
+ * Signs and verifies with a plain base64 round-trip. The point of these tests is
+ * that the server checks the SAME claims the signer wrote, not that any
+ * particular algorithm is used — a real JWT here would only slow them down.
+ */
+const fakeJWT = {
+  encode: async (_expiry: string, payload: unknown) =>
+    Buffer.from(JSON.stringify(payload)).toString('base64url'),
+  decode: async (token: string) =>
+    JSON.parse(Buffer.from(token, 'base64url').toString()),
+} as unknown as JWTService
+
+describe('PikkuBunServer local content', () => {
+  let server: PikkuBunServer
+  let content: LocalContent
+  let tmpDir: string
+  let origin: string
+
+  before(async () => {
+    resetPikkuState()
+    setSingletonServices({
+      logger: noopLogger,
+      schema: {
+        compileSchema: () => {},
+        getSchemaNames: () => new Set<string>(),
+      },
+    } as any)
+    tmpDir = mkdtempSync(join(tmpdir(), 'pikku-bun-content-'))
+    mkdirSync(join(tmpDir, 'bucket'), { recursive: true })
+    writeFileSync(join(tmpDir, 'bucket', 'existing.bin'), 'already here')
+
+    const contentConfig = {
+      localFileUploadPath: tmpDir,
+      uploadUrlPrefix: '/upload',
+      assetUrlPrefix: '/assets',
+      sizeLimit: '1mb',
+    }
+    // The service under test on the client side: the URLs it hands out are
+    // exactly what the server must answer, so they are not hand-written here.
+    content = new LocalContent(contentConfig, noopLogger, fakeJWT)
+
+    server = new PikkuBunServer(
+      {
+        port: 0,
+        hostname: '127.0.0.1',
+        content: contentConfig,
+      } as any,
+      noopLogger,
+      { contentSigningJWT: fakeJWT }
+    )
+    await server.init()
+    await server.start()
+    origin = `http://127.0.0.1:${server.port}`
+  })
+
+  after(async () => {
+    await server.stop()
+    rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  test('answers the upload URL the content service hands out', async () => {
+    const { uploadUrl } = await content.getUploadURL({
+      bucket: 'bucket',
+      fileKey: 'nested/file.bin',
+      contentType: 'application/octet-stream',
+    } as any)
+
+    const response = await fetch(`${origin}${uploadUrl}`, {
+      method: 'PUT',
+      body: 'uploaded bytes',
+    })
+
+    assert.equal(response.status, 200)
+    assert.equal(
+      readFileSync(join(tmpDir, 'bucket', 'nested', 'file.bin'), 'utf8'),
+      'uploaded bytes'
+    )
+  })
+
+  test('serves an asset through the signed URL the content service produces', async () => {
+    const signed = await content.signContentKey({
+      bucket: 'bucket',
+      contentKey: 'existing.bin',
+      dateLessThan: new Date(Date.now() + 60_000),
+    } as any)
+
+    const response = await fetch(`${origin}${signed}`)
+    assert.equal(response.status, 200)
+    assert.equal(await response.text(), 'already here')
+  })
+
+  test('refuses an unsigned asset read', async () => {
+    const response = await fetch(`${origin}/assets/bucket/existing.bin`)
+    assert.equal(response.status, 403)
+  })
+
+  test('refuses a signature minted for a different asset', async () => {
+    // The signature is valid and unexpired — only the path differs. Without the
+    // path claim being checked, one signed URL would read the whole bucket.
+    const signed = await content.signContentKey({
+      bucket: 'bucket',
+      contentKey: 'existing.bin',
+      dateLessThan: new Date(Date.now() + 60_000),
+    } as any)
+    writeFileSync(join(tmpDir, 'bucket', 'other.bin'), 'other')
+
+    const query = signed.slice(signed.indexOf('?'))
+    const response = await fetch(`${origin}/assets/bucket/other.bin${query}`)
+    assert.equal(response.status, 403)
+  })
+
+  test('refuses an expired signature', async () => {
+    const signed = await content.signContentKey({
+      bucket: 'bucket',
+      contentKey: 'existing.bin',
+      dateLessThan: new Date(Date.now() - 1_000),
+    } as any)
+
+    const response = await fetch(`${origin}${signed}`)
+    assert.equal(response.status, 403)
+  })
+
+  // `fetch` normalises `..` out of the path before the request leaves the
+  // client, so this cannot drive the guard itself — that is covered directly in
+  // core's local-content-request-handler.test.ts. What it does prove is that
+  // nothing in the server path un-normalises it back into a write.
+  test('does not write outside the content directory', async () => {
+    writeFileSync(join(tmpDir, '..', 'pikku-bun-content-secret.txt'), 'secret')
+    try {
+      const response = await fetch(
+        `${origin}/upload/%2e%2e/pikku-bun-content-secret.txt`,
+        { method: 'PUT', body: 'overwritten' }
+      )
+      assert.notEqual(response.status, 200)
+      assert.equal(
+        readFileSync(
+          join(tmpDir, '..', 'pikku-bun-content-secret.txt'),
+          'utf8'
+        ),
+        'secret'
+      )
+    } finally {
+      rmSync(join(tmpDir, '..', 'pikku-bun-content-secret.txt'), {
+        force: true,
+      })
+    }
+  })
+
+  test('rejects an upload over the size limit', async () => {
+    const { uploadUrl } = await content.getUploadURL({
+      bucket: 'bucket',
+      fileKey: 'too-big.bin',
+      contentType: 'application/octet-stream',
+    } as any)
+
+    const response = await fetch(`${origin}${uploadUrl}`, {
+      method: 'PUT',
+      body: Buffer.alloc(1024 * 1024 + 1),
+    })
+    assert.equal(response.status, 413)
+  })
+
+  test('leaves non-content paths to the router', async () => {
+    const response = await fetch(`${origin}/uploadsomething`)
+    assert.equal(response.status, 404)
+  })
+})

package/src/pikku-bun-server.ts

@@ -2,7 +2,13 @@ import type { Server as BunServer, ServerWebSocket } from 'bun'
 
 import type { CoreConfig } from '@pikku/core'
 import { stopSingletonServices } from '@pikku/core'
-import type { Logger } from '@pikku/core/services'
+import type { JWTService, Logger } from '@pikku/core/services'
+import { pikkuState } from '@pikku/core/internal'
+import type { LocalContentConfig } from '@pikku/core/services/local-content'
+import {
+  createLocalContentRequestHandler,
+  type LocalContentRequestHandler,
+} from '@pikku/core/services/local-content-request-handler'
 import {
   fetchData,
   PikkuFetchHTTPRequest,
@@ -15,12 +21,28 @@ import type { PikkuLocalChannelHandler } from '@pikku/core/channel/local'
 import { runLocalChannel } from '@pikku/core/channel/local'
 import { compileAllSchemas } from '@pikku/core/schema'
 
+import { resolve } from 'node:path'
+
 import { BunEventHubService } from './bun-event-hub-service.js'
 
+export type StaticMount = {
+  urlPrefix: string
+  directory: string
+  spaFallback?: boolean
+}
+
 export type BunServerConfig = CoreConfig & {
   port: number
   hostname?: string
+  staticMounts?: StaticMount[]
   healthCheckPath?: string
+  /**
+   * Serve the `LocalContent` upload and asset prefixes. Pass the same config the
+   * `LocalContent` service was built from — it is that service which hands the
+   * browser these URLs, and a prefix that disagrees produces a 404 naming
+   * nothing. Mirrors `PikkuNodeHTTPServerConfig.content`.
+   */
+  content?: LocalContentConfig
 }
 
 export type PikkuBunServerOptions = RunHTTPWiringOptions & {
@@ -44,6 +66,14 @@ export type PikkuBunServerOptions = RunHTTPWiringOptions & {
    * Path the MCP server is mounted at when `mcpJson` is provided. Default `/mcp`.
    */
   mcpPath?: string
+  /**
+   * The JWT service `LocalContent` signs asset URLs with. Required to serve
+   * `config.content`'s asset prefix: without it every signed read is refused,
+   * since an unverifiable signature is no signature. Falls back to
+   * `singletonServices.jwt`. Mirrors
+   * `PikkuNodeHTTPServerOptions.contentSigningJWT`.
+   */
+  contentSigningJWT?: JWTService
 }
 
 type WsData = { channelHandler: PikkuLocalChannelHandler }
@@ -75,17 +105,30 @@ export class PikkuBunServer {
   private readonly mcpJson?: PikkuBunServerOptions['mcpJson']
   private readonly mcpPath: string
   private mcpHandler?: (request: Request) => Promise<Response>
+  private readonly localContent?: LocalContentRequestHandler
 
   constructor(
     private readonly config: BunServerConfig,
     private readonly logger: Logger,
     options: PikkuBunServerOptions = {}
   ) {
-    const { eventHub, mcpJson, mcpPath, ...httpOptions } = options
+    const { eventHub, mcpJson, mcpPath, contentSigningJWT, ...httpOptions } =
+      options
     this.eventHub = eventHub ?? new BunEventHubService()
     this.mcpJson = mcpJson
     this.mcpPath = mcpPath ?? '/mcp'
     this.options = httpOptions
+    this.localContent = config.content
+      ? createLocalContentRequestHandler({
+          content: config.content,
+          logger,
+          // Resolved per request: `singletonServices` is populated after the
+          // server is constructed, so reading it here would always miss.
+          getJWT: () =>
+            contentSigningJWT ??
+            pikkuState(null, 'package', 'singletonServices')?.jwt,
+        })
+      : undefined
   }
 
   public async init(): Promise<void> {
@@ -167,6 +210,19 @@ export class PikkuBunServer {
           }
         }
 
+        // Ahead of static mounts and routing: these prefixes belong to the
+        // content service, and `fetchData` would answer them with a 404 since
+        // no wiring claims them.
+        const contentResponse = await this.localContent?.(req)
+        if (contentResponse) {
+          return contentResponse
+        }
+
+        const staticResponse = await this.serveStaticMounts(req)
+        if (staticResponse) {
+          return staticResponse
+        }
+
         const pikkuReq = new PikkuFetchHTTPRequest(req)
         const pikkuRes = new PikkuFetchHTTPResponse()
         await fetchData(pikkuReq, pikkuRes, {
@@ -225,6 +281,65 @@ export class PikkuBunServer {
     )
   }
 
+  public get port(): number {
+    return this.server?.port ?? this.config.port
+  }
+
+  private async serveStaticMounts(req: Request): Promise<Response | null> {
+    const mounts = this.config.staticMounts
+    if (!mounts?.length || (req.method !== 'GET' && req.method !== 'HEAD')) {
+      return null
+    }
+    const pathname = decodeURIComponent(new URL(req.url).pathname)
+
+    for (const mount of mounts) {
+      if (
+        pathname !== mount.urlPrefix &&
+        !pathname.startsWith(`${mount.urlPrefix}/`)
+      ) {
+        continue
+      }
+      const key = pathname.slice(mount.urlPrefix.length).replace(/^\/+/, '')
+      const file = await this.resolveStaticFile(mount, key)
+      if (file) {
+        return new Response(req.method === 'HEAD' ? null : file)
+      }
+      if (mount.spaFallback) {
+        const index = await this.resolveStaticFile(mount, 'index.html')
+        if (index) {
+          return new Response(req.method === 'HEAD' ? null : index)
+        }
+      }
+      return new Response('Not Found', { status: 404 })
+    }
+
+    return null
+  }
+
+  private async resolveStaticFile(
+    mount: StaticMount,
+    key: string
+  ): Promise<ReturnType<typeof Bun.file> | null> {
+    const directory = resolve(mount.directory)
+    const targetPath =
+      key === '' ? resolve(directory, 'index.html') : resolve(directory, key)
+    if (targetPath !== directory && !targetPath.startsWith(`${directory}/`)) {
+      return null
+    }
+    let file = Bun.file(targetPath)
+    if (!(await file.exists())) {
+      const indexPath = resolve(targetPath, 'index.html')
+      if (!indexPath.startsWith(`${directory}/`)) {
+        return null
+      }
+      file = Bun.file(indexPath)
+      if (!(await file.exists())) {
+        return null
+      }
+    }
+    return file
+  }
+
   public async stop(): Promise<void> {
     await this.server?.stop()
     this.server = null

package/src/static-mount.test.ts

@@ -0,0 +1,108 @@
+import { describe, test, before, after } from 'node:test'
+import assert from 'node:assert/strict'
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { setSingletonServices } from '@pikku/core'
+import { resetPikkuState } from '@pikku/core/internal'
+import type { Logger } from '@pikku/core/services'
+import { PikkuBunServer } from './pikku-bun-server.js'
+
+const noopLogger = {
+  info: () => {},
+  error: () => {},
+  warn: () => {},
+  debug: () => {},
+  trace: () => {},
+  setLevel: () => {},
+} as unknown as Logger
+
+describe('PikkuBunServer static mounts', () => {
+  let server: PikkuBunServer
+  let tmpDir: string
+  let origin: string
+
+  before(async () => {
+    resetPikkuState()
+    setSingletonServices({
+      logger: noopLogger,
+      schema: {
+        compileSchema: () => {},
+        getSchemaNames: () => new Set<string>(),
+      },
+    } as any)
+    tmpDir = mkdtempSync(join(tmpdir(), 'pikku-bun-static-'))
+    writeFileSync(
+      join(tmpDir, 'index.html'),
+      '<!doctype html><title>console</title>'
+    )
+    mkdirSync(join(tmpDir, 'assets'))
+    writeFileSync(join(tmpDir, 'assets', 'app.js'), 'console.log("app")')
+
+    server = new PikkuBunServer(
+      {
+        port: 0,
+        hostname: '127.0.0.1',
+        staticMounts: [
+          { urlPrefix: '/console', directory: tmpDir, spaFallback: true },
+        ],
+      } as any,
+      noopLogger
+    )
+    await server.init()
+    await server.start()
+    origin = `http://127.0.0.1:${server.port}`
+  })
+
+  after(async () => {
+    await server.stop()
+    rmSync(tmpDir, { recursive: true, force: true })
+  })
+
+  test('serves files under the prefix with a content type', async () => {
+    const response = await fetch(`${origin}/console/assets/app.js`)
+    assert.equal(response.status, 200)
+    assert.match(response.headers.get('content-type') ?? '', /javascript/)
+    assert.equal(await response.text(), 'console.log("app")')
+  })
+
+  test('serves index.html at the mount root, with and without trailing slash', async () => {
+    for (const path of ['/console', '/console/']) {
+      const response = await fetch(`${origin}${path}`)
+      assert.equal(response.status, 200)
+      assert.match(await response.text(), /<title>console<\/title>/)
+    }
+  })
+
+  test('SPA fallback serves index.html for unknown paths under the prefix', async () => {
+    const response = await fetch(`${origin}/console/scenarios?id=x`)
+    assert.equal(response.status, 200)
+    assert.match(await response.text(), /<title>console<\/title>/)
+  })
+
+  test('does not intercept paths outside the prefix', async () => {
+    const response = await fetch(`${origin}/consolerelated`)
+    assert.equal(response.status, 404)
+  })
+
+  test('does not intercept non-GET methods', async () => {
+    const response = await fetch(`${origin}/console/assets/app.js`, {
+      method: 'POST',
+    })
+    assert.equal(response.status, 404)
+  })
+
+  test('blocks path traversal out of the mount directory', async () => {
+    writeFileSync(join(tmpDir, '..', 'pikku-bun-static-secret.txt'), 'secret')
+    try {
+      const response = await fetch(
+        `${origin}/console/%2e%2e/pikku-bun-static-secret.txt`
+      )
+      assert.notEqual(response.status, 200)
+    } finally {
+      rmSync(join(tmpDir, '..', 'pikku-bun-static-secret.txt'), {
+        force: true,
+      })
+    }
+  })
+})