@server/next 0.28.6 → 0.28.8

package/index.d.ts

@@ -1,3 +1,18 @@
+type LimitOptions = {
+    maxSize?: number | string;
+    minSize?: number | string;
+    fileType?: string[];
+};
+declare class UploadPipeline {
+    private _bucket;
+    private _limits;
+    constructor(bucket?: Bucket | null);
+    limit(options: LimitOptions): this;
+    store(bucket: Bucket): this;
+    processFile(originalName: string, data: Buffer, contentType: string): Promise<UploadedFile>;
+}
+declare function upload(bucket?: Bucket | null): UploadPipeline;
+
 type Method = "get" | "post" | "put" | "patch" | "delete" | "head" | "options" | "socket";
 type ServerConfig<Session = {}, User = {}> = {
     Session?: Session;
@@ -28,6 +43,13 @@ type Bucket = {
     write: (path: string, data: string | Buffer) => Promise<void | string>;
     delete: (path: string) => Promise<boolean>;
 };
+type UploadedFile = {
+    name: string;
+    id: string;
+    path: string;
+    type: string;
+    size: number;
+};
 type CorsSettings = {
     origin: string | boolean;
     methods: string;
@@ -88,7 +110,7 @@ type Options = {
     secret?: string;
     views?: string | Bucket;
     public?: string | Bucket;
-    uploads?: string | Bucket;
+    uploads?: string | Bucket | UploadPipeline;
     store?: KVStore;
     cookies?: KVStore;
     session?: KVStore | {
@@ -104,7 +126,7 @@ type Settings = {
     secret: string;
     views?: Bucket;
     public?: Bucket;
-    uploads?: Bucket;
+    uploads?: Bucket | UploadPipeline;
     store?: KVStore;
     cookies?: KVStore;
     session?: {
@@ -402,4 +424,4 @@ declare class Server<O extends ServerConfig = {}> extends Router<O> {
 }
 declare function server<Session extends Record<string, any> = {}, User extends Record<string, any> = {}>(options?: Options): Server<ServerConfig<Session, User>>;
 
-export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type Bucket, type BunEnv, type Context, type Cookie, type CorsSettings, type EventCallback, type ExtractPathParams, type InferParamType, type InlineReply, type KVStore, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type Provider, type RouteOptions, type RouterMethod, type SerializableValue, Server, type ServerConfig, TypedServerError as ServerError, type Settings, type Strategy, type Time, cookies, server as default, download, file, headers, json, redirect, router, send, status, type };
+export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type Bucket, type BunEnv, type Context, type Cookie, type CorsSettings, type EventCallback, type ExtractPathParams, type InferParamType, type InlineReply, type KVStore, type LimitOptions, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type Provider, type RouteOptions, type RouterMethod, type SerializableValue, Server, type ServerConfig, TypedServerError as ServerError, type Settings, type Strategy, type Time, UploadPipeline, type UploadedFile, cookies, server as default, download, file, headers, json, redirect, router, send, status, type, upload };

package/index.js

@@ -197,7 +197,7 @@ var Reply = class {
   }
   download(name) {
     const ext = name?.split(".").pop();
-    if (type && ext && !this.res.headers.get("content-type")) this.type(ext);
+    if (ext && !this.res.headers.get("content-type")) this.type(ext);
     const filename = name ? `; filename="${encodeURIComponent(name)}"` : "";
     return this.headers("content-disposition", `attachment${filename}`);
   }
@@ -542,59 +542,83 @@ function createId(source, size = 16) {
   return randomId(size);
 }
 
-// src/helpers/color.ts
-var map = {
-  reset: 0,
-  bright: 1,
-  dim: 2,
-  under: 4,
-  blink: 5,
-  reverse: 7,
-  black: 30,
-  red: 31,
-  green: 32,
-  yellow: 33,
-  blue: 34,
-  magenta: 35,
-  cyan: 36,
-  white: 37,
-  bgblack: 40,
-  bgred: 41,
-  bggreen: 42,
-  bgyellow: 43,
-  bgblue: 44,
-  bgmagenta: 45,
-  bgcyan: 46,
-  bgwhite: 47
-};
-var replace = (k) => {
-  if (process.env.NO_COLOR) return "";
-  if (!(k in map)) throw new Error(`"{${k}}" is not a valid color`);
-  return `\x1B[${map[k]}m`;
-};
-function color(str, ...vals) {
-  if (typeof str === "string") {
-    return str.replace(/\{(\w+)\}/g, (_m, k) => replace(k)).replace(/\{\/\w*\}/g, () => replace("reset"));
-  }
-  return color(str[0] + vals.map((v, i) => v + str[i + 1]).join(""));
+// src/helpers/upload.ts
+function parseBytes(value) {
+  if (typeof value === "number") return value;
+  const units = {
+    b: 1,
+    kb: 1024,
+    mb: 1024 ** 2,
+    gb: 1024 ** 3
+  };
+  const match = value.toLowerCase().match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)$/);
+  if (!match) throw new Error(`Invalid size: "${value}"`);
+  return parseFloat(match[1]) * (units[match[2]] ?? 1);
 }
-
-// src/helpers/debugInfo.ts
-var isDebug = process.argv.includes("--debug");
-function debugInfo(options, name, cb, icon = "") {
-  if (!isDebug) return;
-  if (!options[name]) {
-    console.log(color`options:${String(name)}\t→ {dim}[not set]{/}`);
-    return;
+function getExt(filename) {
+  const i = filename.lastIndexOf(".");
+  if (i <= 0) return ".bin";
+  return filename.slice(i).toLowerCase();
+}
+async function saveFileToBucket(originalName, data, bucket, contentType) {
+  const ext = getExt(originalName);
+  const id = `${createId()}${ext}`;
+  const path2 = await bucket.write(id, data);
+  return { name: originalName, id, path: path2, type: contentType, size: data.length };
+}
+var UploadPipeline = class {
+  _bucket;
+  _limits = {};
+  constructor(bucket) {
+    this._bucket = bucket ?? null;
+  }
+  limit(options) {
+    this._limits = { ...this._limits, ...options };
+    return this;
   }
-  console.log(
-    color`options:${String(name)}\t→ ${icon ? `${icon} ` : ""}${cb(options[name])}`
-  );
+  store(bucket) {
+    this._bucket = bucket;
+    return this;
+  }
+  async processFile(originalName, data, contentType) {
+    const { maxSize, minSize, fileType } = this._limits;
+    if (maxSize !== void 0 && data.length > parseBytes(maxSize)) {
+      throw new Error(
+        `File "${originalName}" is too large (${data.length} bytes, limit is ${maxSize})`
+      );
+    }
+    if (minSize !== void 0 && data.length < parseBytes(minSize)) {
+      throw new Error(
+        `File "${originalName}" is too small (${data.length} bytes, minimum is ${minSize})`
+      );
+    }
+    if (fileType && fileType.length > 0) {
+      const ext = getExt(originalName);
+      const mime = contentType.toLowerCase();
+      const allowed = fileType.some(
+        (t) => t.toLowerCase() === mime || t.toLowerCase() === ext
+      );
+      if (!allowed) {
+        throw new Error(
+          `File type not allowed for "${originalName}" (got "${contentType}", allowed: ${fileType.join(", ")})`
+        );
+      }
+    }
+    if (!this._bucket) {
+      throw new Error(
+        `No destination configured \u2014 pass a bucket to upload() or call .store()`
+      );
+    }
+    return saveFileToBucket(originalName, data, this._bucket, contentType);
+  }
+};
+function upload(bucket) {
+  return new UploadPipeline(bucket);
 }
 
 // src/helpers/config.ts
-var env2 = globalThis.env;
 function config(options = {}) {
+  const env2 = globalThis.env;
   const settings = {
     port: options.port || env2.PORT || 3e3,
     secret: options.secret || env2.SECRET || `unsafe-${createId()}`
@@ -633,27 +657,16 @@ function config(options = {}) {
     settings.cors = cors2;
   }
   settings.views = options.views ? bucket_default(options.views) : null;
-  debugInfo(options, "views", (views) => views?.location || "true", "\u{1F4C2}");
   settings.public = options.public ? bucket_default(options.public) : null;
-  debugInfo(options, "public", (pub) => pub?.location || "true", "\u{1F4C2}");
-  settings.uploads = options.uploads ? bucket_default(options.uploads) : null;
-  debugInfo(options, "uploads", (ups) => ups?.location || "true", "\u{1F4C2}");
+  settings.uploads = options.uploads instanceof UploadPipeline ? options.uploads : options.uploads ? bucket_default(options.uploads) : null;
   settings.store = options.store ?? null;
-  debugInfo(options, "store", (store) => store?.name || "working", "\u{1F4E6}");
   settings.cookies = options.cookies ?? null;
-  debugInfo(options, "cookies", (cookies2) => cookies2?.name || "working", "\u{1F36A}");
   if (options.session) {
     settings.session = "store" in options.session ? options.session : { store: options.session };
   }
   if (options.store && !options.session) {
     settings.session = { store: options.store.prefix("session:") };
   }
-  debugInfo(
-    options,
-    "session",
-    (session2) => session2?.store?.name || "working",
-    "\u{1F510}"
-  );
   if (options.auth || env2.AUTH) {
     settings.auth = parseAuthOptions(options.auth || env2.AUTH || null, options);
   }
@@ -795,7 +808,7 @@ function getMachine() {
 
 // src/parseResponse.ts
 async function parseResponse(out, ctx) {
-  if (!out && typeof out !== "string") return;
+  if (!out && typeof out !== "string") return null;
   if (typeof out === "function") {
     out = await out(ctx);
   }
@@ -1071,12 +1084,6 @@ function getMatching(string, regex) {
   const matches = string.match(regex);
   return matches?.[1] ?? "";
 }
-var saveFile = async (name, value, bucket) => {
-  const ext = name.split(".").pop();
-  const id = `${createId()}.${ext}`;
-  await bucket.write(id, value);
-  return id;
-};
 function splitBuffer(buffer, delimiter) {
   const result = [];
   let start = 0;
@@ -1090,6 +1097,7 @@ function splitBuffer(buffer, delimiter) {
   return result;
 }
 var BREAK_BUFFER = Buffer.from("\r\n\r\n");
+var END_BUFFER = Buffer.from("--\r\n");
 function isProbablyText(buffer) {
   for (let i = 0; i < Math.min(buffer.length, 512); i++) {
     const byte = buffer[i];
@@ -1100,7 +1108,7 @@ function isProbablyText(buffer) {
 }
 async function parseBody(raw, contentType, bucket) {
   const contentTypeStr = Array.isArray(contentType) ? contentType[0] : contentType;
-  if (!raw) return {};
+  if (!raw || raw.length === 0) return {};
   if (!contentTypeStr || /^text\//.test(contentTypeStr)) {
     return raw.toString("utf-8");
   }
@@ -1113,7 +1121,7 @@ async function parseBody(raw, contentType, bucket) {
   const boundaryBuffer = Buffer.from(`--${boundary}`);
   const parts = splitBuffer(raw, boundaryBuffer);
   for (const part of parts) {
-    if (part.length === 0 || part.equals(Buffer.from("--\r\n"))) continue;
+    if (part.length === 0 || part.equals(END_BUFFER)) continue;
     const idx = part.indexOf(BREAK_BUFFER);
     if (idx === -1) continue;
     const headerStr = part.slice(0, idx).toString("utf-8");
@@ -1122,8 +1130,24 @@ async function parseBody(raw, contentType, bucket) {
     if (!name) continue;
     const filename = getMatching(headerStr, /filename="(.+?)"/).trim();
     if (filename) {
-      if (!bucket) throw new Error("Bucket is required to save files");
-      body[name] = await saveFile(filename, contentBuf, bucket);
+      const partContentType = getMatching(headerStr, /Content-Type:\s*([^\r\n]+)/i).trim() || "application/octet-stream";
+      if (!bucket) {
+        continue;
+      }
+      if (bucket instanceof UploadPipeline) {
+        body[name] = await bucket.processFile(
+          filename,
+          contentBuf,
+          partContentType
+        );
+      } else {
+        body[name] = await saveFileToBucket(
+          filename,
+          contentBuf,
+          bucket,
+          partContentType
+        );
+      }
     } else {
       const value = isProbablyText(contentBuf) ? contentBuf.toString("utf-8").trim() : contentBuf;
       if (body[name]) {
@@ -1749,9 +1773,9 @@ async function createWinter(req, app) {
 }
 
 // src/context/handlers.ts
-var Winter = async (app, request, env3) => {
-  if (env3?.upgrade(request)) return;
-  Object.assign(globalThis.env, env3);
+var Winter = async (app, request, env2) => {
+  if (env2?.upgrade(request)) return;
+  Object.assign(globalThis.env, env2);
   const ctx = await createWinter(request, app);
   const res = await handleRequest(app.handlers, ctx);
   ctx.events.trigger("finish", { ...ctx, res, end: performance.now() });
@@ -1965,8 +1989,8 @@ var Server = class extends Router {
   node() {
     return Node(this);
   }
-  fetch(request, env3) {
-    return Winter(this, request, env3);
+  fetch(request, env2) {
+    return Winter(this, request, env2);
   }
   callback(request, context) {
     return Netlify(this, request, context);
@@ -1991,5 +2015,6 @@ export {
   router,
   send,
   status,
-  type
+  type,
+  upload
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.28.6",
+  "version": "0.28.8",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "https://github.com/franciscop/server-next.git",

package/src/jsx/jsx-runtime.js

@@ -27,13 +27,13 @@ const altAttrs = {
 const isValidChild = (child) =>
   child != null && child !== false && child !== true;
 
-// CSS helpers
-const escapeCSS = (value) => String(value).replace(/[<>&"'`]/g, "\\$&");
-
 const minifyCss = (str) =>
   str
-    .replace(/\s+/g, " ")
     .replace(/\/\*[\s\S]*?\*\//g, "")
+    .replace(/\s+/g, " ")
+    .replace(/\s*([{}:;,>~+])\s*/g, "$1")
+    .replace(/;}/g, "}")
+    .replace(/<\/style>/gi, "<\\/style>")
     .trim();
 
 // React element detection (safe for custom objects too)
@@ -104,9 +104,9 @@ const jsx = (tag, { children, ...props } = {}) => {
     children = raw(content);
   }
 
-  // style: minified + escaped raw content
+  // style: minified raw content
   if (tag === "style" && typeof children === "string") {
-    children = raw(minifyCss(escapeCSS(children)));
+    children = raw(minifyCss(children));
   }
 
   // dangerouslySetInnerHTML

package/src/jsx/jsx-runtime.test.jsx

@@ -299,20 +299,50 @@ describe("script tag", () => {
 describe("style tag", () => {
   it("renders style content", () => {
     expect(<style>{"body { color: red; }"}</style>).toRender(
-      "<style>body { color: red; }</style>",
+      "<style>body{color:red}</style>",
     );
   });
 
   it("minifies whitespace in style content", () => {
     expect(
       <style>{"body {\n  color:   red;\n  margin: 0;\n}"}</style>,
-    ).toRender("<style>body { color: red; margin: 0; }</style>");
+    ).toRender("<style>body{color:red;margin:0}</style>");
   });
 
   it("strips CSS comments", () => {
     expect(
       <style>{"/* reset */ body { margin: 0; } /* end */"}</style>,
-    ).toRender("<style>body { margin: 0; }</style>");
+    ).toRender("<style>body{margin:0}</style>");
+  });
+
+  it("preserves child combinator in selectors", () => {
+    expect(
+      <style>{":not(pre) > code { background: none; }"}</style>,
+    ).toRender("<style>:not(pre)>code{background:none}</style>");
+  });
+
+  it("preserves sibling combinators in selectors", () => {
+    expect(
+      <style>{"h2 + p { margin: 0; } h2 ~ p { color: red; }"}</style>,
+    ).toRender("<style>h2+p{margin:0}h2~p{color:red}</style>");
+  });
+
+  it("removes spaces around braces, colons, and semicolons", () => {
+    expect(
+      <style>{"a { color : red ; font-size : 1em ; }"}</style>,
+    ).toRender("<style>a{color:red;font-size:1em}</style>");
+  });
+
+  it("removes trailing semicolon before closing brace", () => {
+    expect(
+      <style>{"p { margin: 0; padding: 0; }"}</style>,
+    ).toRender("<style>p{margin:0;padding:0}</style>");
+  });
+
+  it("does not break </style> injection", () => {
+    expect(
+      <style>{"a { content: '</style>'; }"}</style>,
+    ).toRender("<style>a{content:'<\\/style>'}</style>");
   });
 });