@server/next 0.37.1 → 0.39.0

package/index.d.ts

@@ -1,17 +1,12 @@
 import * as http from 'http';
+export { default as kv } from 'polystore';
+export { default as bucket } from 'bucket';
 
 type LimitOptions = {
     maxSize?: number | string;
     minSize?: number | string;
     fileType?: string[];
 };
-declare class UploadPipeline {
-    private _bucket;
-    private _limits;
-    constructor(bucket?: Bucket | string | null);
-    limit(options: LimitOptions): this;
-    processFile(originalName: string, data: Buffer, contentType: string): Promise<UploadedFile>;
-}
 
 type CookieOptions = string | string[] | Cookie | Cookie[] | null;
 interface ResponseData {
@@ -24,7 +19,7 @@ declare class Reply$1 {
     status(status: number): this;
     type(type?: string): this;
     download(name?: string): this;
-    headers(key: string | Record<string, string>, value?: string): this;
+    headers(key: string | Record<string, string | string[]>, value?: string | string[]): this;
     cache(value: CacheOption): this;
     cookies(key: string | Record<string, CookieOptions>, value?: CookieOptions): this;
     json(body: unknown): Response;
@@ -88,18 +83,16 @@ type Cookie = {
 };
 type RouterMethod = "*" | Method;
 type FileInfo = {
-    exists: boolean;
     size: number;
-    date: Date | null;
-    type?: string | null;
+    type: string | null;
+    modified: Date;
 };
 type BucketFile = {
     readonly path: string;
-    readonly id: string;
     readonly name: string;
     readonly type?: string;
     exists(): Promise<boolean>;
-    info?(): Promise<FileInfo>;
+    info?(): Promise<FileInfo | null>;
     write(content: string | Buffer | ReadableStream, options?: {
         type?: string;
     }): Promise<void>;
@@ -114,7 +107,6 @@ type Bucket = {
 };
 type UploadedFile = {
     name: string;
-    id: string;
     path: string;
     type: string;
     size: number;
@@ -138,6 +130,7 @@ type BasicValue = string | number | boolean | null;
 type SerializableValue = BasicValue | {
     [key: string]: SerializableValue;
 } | Array<SerializableValue>;
+type StoreSource = KVStore | Map<string, any> | string | Record<string, any>;
 type KVStore = {
     name?: string;
     prefix: (prefix?: string) => KVStore;
@@ -167,8 +160,8 @@ type AuthOption = `${Strategy}:${Provider}` | "key" | {
     strategy: Strategy;
     providers?: Provider | Provider[];
     key?: string;
-    session?: KVStore;
-    store?: KVStore;
+    session?: StoreSource;
+    store?: StoreSource;
     redirect?: string;
     cleanUser?: <T = AuthUser>(user: T) => T | Promise<T>;
 };
@@ -195,6 +188,7 @@ type SecurityOptions = {
     referrerPolicy?: boolean | string;
     hsts?: boolean | string;
     xssProtection?: boolean;
+    traversalProtection?: boolean;
     csp?: boolean | string;
     coop?: boolean | string;
     corp?: boolean | string;
@@ -202,6 +196,7 @@ type SecurityOptions = {
 };
 type SecuritySettings = {
     trustProxy: boolean;
+    traversalProtection: boolean;
     headers: Record<string, string>;
     hsts: string | null;
 };
@@ -212,10 +207,9 @@ type Options = {
     secret?: string;
     public?: string | Bucket;
     uploads?: string | Bucket | UploadOptions;
-    store?: KVStore;
-    cookies?: KVStore;
-    session?: KVStore | {
-        store: KVStore;
+    store?: StoreSource;
+    session?: StoreSource | {
+        store: StoreSource;
     };
     cors?: CorsOptions;
     auth?: AuthOption;
@@ -232,9 +226,10 @@ type Settings = {
     port: number;
     secret: string;
     public?: Bucket;
-    uploads?: Bucket | UploadPipeline;
+    uploads?: ({
+        bucket: Bucket;
+    } & LimitOptions) | null;
     store?: KVStore;
-    cookies?: KVStore;
     session?: {
         store: KVStore;
     };
@@ -506,4 +501,4 @@ declare class Server<O extends ServerConfig = {}> extends Router<O> {
 }
 declare function server<Session extends Record<string, any> = {}, User extends Record<string, any> = {}>(options?: Options): Server<ServerConfig<Session, User>>;
 
-export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type BodyMode, type BodyOption, type Bucket, type BucketFile, type BunEnv, type CacheOption, type Context, type Cookie, type CorsSettings, type ExtractPathParams, type FileInfo, type InferParamType, type InlineReply, type KVStore, type LogLevel, type Logger, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type Provider, type Route, type RouteOptions, type RouterMethod, type SecurityOptions, type SecuritySettings, type SerializableValue, Server, type ServerConfig, TypedServerError as ServerError, type Settings, type Strategy, type Time, type UploadOptions, type UploadedFile, cache, cookies, server as default, download, file, headers, json, redirect, router, send, status, type };
+export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type BodyMode, type BodyOption, type Bucket, type BucketFile, type BunEnv, type CacheOption, type Context, type Cookie, type CorsSettings, type ExtractPathParams, type FileInfo, type InferParamType, type InlineReply, type KVStore, type LogLevel, type Logger, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type Provider, type Route, type RouteOptions, type RouterMethod, type SecurityOptions, type SecuritySettings, type SerializableValue, Server, type ServerConfig, TypedServerError as ServerError, type Settings, type StoreSource, type Strategy, type Time, type UploadOptions, type UploadedFile, cache, cookies, server as default, download, file, headers, json, redirect, router, send, status, type };

package/index.js

@@ -39,6 +39,10 @@ var ServerError_default = TypedServerError;
 
 // src/errors/index.ts
 ServerError_default.extend({
+  PATH_TRAVERSAL: {
+    status: 400,
+    message: "The route param '{param}' tries to climb the path ('{value}'). If this route legitimately receives paths, set security: { traversalProtection: false }"
+  },
   NO_STORE: "You need a 'store' to write 'ctx.session'",
   NO_STORE_WRITE: "You need a 'store' to write 'ctx.session.{key}'",
   NO_STORE_READ: "You need a 'store' to read 'ctx.session.{key}'",
@@ -76,6 +80,7 @@ ServerError_default.extend({
   REGISTER_INVALID_PASSWORD: "The password you wrote is not correct",
   REGISTER_EMAIL_EXISTS: "Email is already registered"
 });
+var errors_default = ServerError_default;
 
 // src/polyfill.ts
 globalThis.env = {};
@@ -98,191 +103,6 @@ var StatusError = class extends Error {
   }
 };
 
-// src/helpers/bucket.ts
-import * as fs from "fs";
-import * as fsp from "fs/promises";
-import * as path from "path";
-
-// src/helpers/mimes.ts
-var mimes_default = {
-  aac: "audio/aac",
-  abw: "application/x-abiword",
-  arc: "application/x-freearc",
-  avif: "image/avif",
-  avi: "video/x-msvideo",
-  azw: "application/vnd.amazon.ebook",
-  bin: "application/octet-stream",
-  bmp: "image/bmp",
-  bz: "application/x-bzip",
-  bz2: "application/x-bzip2",
-  cda: "application/x-cdf",
-  csh: "application/x-csh",
-  css: "text/css",
-  csv: "text/csv",
-  doc: "application/msword",
-  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
-  eot: "application/vnd.ms-fontobject",
-  epub: "application/epub+zip",
-  gz: "application/gzip",
-  gif: "image/gif",
-  htm: "text/html",
-  html: "text/html",
-  ico: "image/vnd.microsoft.icon",
-  ics: "text/calendar",
-  jar: "application/java-archive",
-  jpeg: "image/jpeg",
-  jpg: "image/jpeg",
-  js: "text/javascript",
-  json: "application/json",
-  jsonld: "application/ld+json",
-  md: "text/markdown",
-  mid: "audio/midi",
-  midi: "audio/midi",
-  mjs: "text/javascript",
-  mp3: "audio/mpeg",
-  mp4: "video/mp4",
-  mpeg: "video/mpeg",
-  mpkg: "application/vnd.apple.installer+xml",
-  odp: "application/vnd.oasis.opendocument.presentation",
-  ods: "application/vnd.oasis.opendocument.spreadsheet",
-  odt: "application/vnd.oasis.opendocument.text",
-  oga: "audio/ogg",
-  ogv: "video/ogg",
-  ogx: "application/ogg",
-  opus: "audio/opus",
-  otf: "font/otf",
-  png: "image/png",
-  pdf: "application/pdf",
-  php: "application/x-httpd-php",
-  ppt: "application/vnd.ms-powerpoint",
-  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
-  rar: "application/vnd.rar",
-  rtf: "application/rtf",
-  sh: "application/x-sh",
-  svg: "image/svg+xml",
-  tar: "application/x-tar",
-  text: "text/plain",
-  tif: "image/tiff",
-  tiff: "image/tiff",
-  ts: "video/mp2t",
-  ttf: "font/ttf",
-  txt: "text/plain",
-  vsd: "application/vnd.visio",
-  wav: "audio/wav",
-  weba: "audio/webm",
-  webm: "video/webm",
-  webp: "image/webp",
-  woff: "font/woff",
-  woff2: "font/woff2",
-  xhtml: "application/xhtml+xml",
-  xls: "application/vnd.ms-excel",
-  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-  xml: "application/xml",
-  xul: "application/vnd.mozilla.xul+xml",
-  zip: "application/zip",
-  "3gp": "video/3gpp",
-  "3g2": "video/3gpp2",
-  "7z": "application/x-7z-compressed"
-};
-
-// src/helpers/bucket.ts
-function localBucket(root) {
-  const base = path.resolve(root);
-  const resolveKey = (name) => {
-    if (!name) throw new Error("File name is required");
-    const full = path.resolve(base, name.replace(/^\/+/, ""));
-    if (full !== base && !full.startsWith(base + path.sep)) {
-      throw new Error(`Path "${name}" escapes the bucket root`);
-    }
-    return full;
-  };
-  const file2 = (name, win) => {
-    const full = resolveKey(name);
-    const type2 = mimes_default[path.extname(name).slice(1).toLowerCase()];
-    const read = () => {
-      let opts;
-      if (win) {
-        opts = { start: win.start };
-        if (Number.isFinite(win.end)) opts.end = Math.max(win.start, win.end - 1);
-      }
-      const nodeStream = fs.createReadStream(full, opts);
-      return new ReadableStream({
-        start(controller) {
-          nodeStream.on("data", (chunk) => controller.enqueue(chunk));
-          nodeStream.on("end", () => controller.close());
-          nodeStream.on("error", (err) => controller.error(err));
-        },
-        cancel() {
-          nodeStream.destroy();
-        }
-      });
-    };
-    return {
-      path: full,
-      id: name.replace(/^\/+/, ""),
-      name: path.basename(name),
-      type: type2,
-      async exists() {
-        const stats = await fsp.stat(full).catch(() => null);
-        return !!stats?.isFile();
-      },
-      async info() {
-        const stats = await fsp.stat(full).catch(() => null);
-        const exists = !!stats?.isFile();
-        const total = stats?.size ?? 0;
-        const size = win ? Math.max(0, Math.min(win.end, total) - win.start) : total;
-        return { exists, size, date: stats?.mtime ?? null, type: type2 };
-      },
-      // Read-only view of [start, end), composed relative to the current window.
-      slice(start, end) {
-        const base2 = win?.start ?? 0;
-        const cap = win?.end ?? Number.POSITIVE_INFINITY;
-        const s = Math.min(cap, base2 + Math.max(0, start));
-        const e = end === void 0 ? cap : Math.min(cap, base2 + end);
-        return file2(name, { start: s, end: e });
-      },
-      async write(content) {
-        await fsp.mkdir(path.dirname(full), { recursive: true });
-        if (content instanceof ReadableStream) {
-          const writable = fs.createWriteStream(full);
-          for await (const chunk of content) {
-            writable.write(chunk);
-          }
-          await new Promise((resolve2, reject) => {
-            writable.on("error", reject);
-            writable.end(() => resolve2());
-          });
-          return;
-        }
-        await fsp.writeFile(full, content);
-      },
-      stream() {
-        return read();
-      },
-      async bytes() {
-        if (win) return new Uint8Array(await new Response(read()).arrayBuffer());
-        return new Uint8Array(await fsp.readFile(full));
-      },
-      async remove() {
-        await fsp.unlink(full).catch(() => {
-        });
-      }
-    };
-  };
-  return {
-    file: file2,
-    folder: (prefix) => localBucket(path.join(base, prefix))
-  };
-}
-function bucket(root) {
-  if (!root) return null;
-  if (typeof root === "string") return localBucket(root);
-  if (typeof root.file === "function") return root;
-  throw new Error(
-    "Invalid bucket: pass a directory path or a `bucket` instance (with .file())"
-  );
-}
-
 // src/helpers/createId.ts
 var alphabet = "useandom26T198340PX75pxJACKVERYMINDBUSHWOLFGQZbfghjklqvwyzrict";
 var random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
@@ -349,52 +169,36 @@ async function saveFileToBucket(originalName, data, bucket2, contentType) {
   await file2.write(data, { type: contentType });
   return {
     name: originalName,
-    id,
     path: file2.path,
     type: contentType,
     size: data.length
   };
 }
-var UploadPipeline = class {
-  _bucket;
-  _limits = {};
-  constructor(bucket2) {
-    this._bucket = bucket(bucket2 ?? void 0);
+function validateFile(originalName, data, contentType, limits) {
+  const { maxSize, minSize, fileType: fileType2 } = limits;
+  if (maxSize !== void 0 && data.length > parseBytes(maxSize)) {
+    throw new Error(
+      `File "${originalName}" is too large (${data.length} bytes, limit is ${maxSize})`
+    );
   }
-  limit(options) {
-    this._limits = { ...this._limits, ...options };
-    return this;
+  if (minSize !== void 0 && data.length < parseBytes(minSize)) {
+    throw new Error(
+      `File "${originalName}" is too small (${data.length} bytes, minimum is ${minSize})`
+    );
   }
-  async processFile(originalName, data, contentType) {
-    const { maxSize, minSize, fileType } = this._limits;
-    if (maxSize !== void 0 && data.length > parseBytes(maxSize)) {
-      throw new Error(
-        `File "${originalName}" is too large (${data.length} bytes, limit is ${maxSize})`
-      );
-    }
-    if (minSize !== void 0 && data.length < parseBytes(minSize)) {
+  if (fileType2 && fileType2.length > 0) {
+    const ext2 = getExt(originalName);
+    const mime = contentType.toLowerCase();
+    const allowed = fileType2.some(
+      (t) => t.toLowerCase() === mime || t.toLowerCase() === ext2
+    );
+    if (!allowed) {
       throw new Error(
-        `File "${originalName}" is too small (${data.length} bytes, minimum is ${minSize})`
-      );
-    }
-    if (fileType && fileType.length > 0) {
-      const ext2 = getExt(originalName);
-      const mime = contentType.toLowerCase();
-      const allowed = fileType.some(
-        (t) => t.toLowerCase() === mime || t.toLowerCase() === ext2
+        `File type not allowed for "${originalName}" (got "${contentType}", allowed: ${fileType2.join(", ")})`
       );
-      if (!allowed) {
-        throw new Error(
-          `File type not allowed for "${originalName}" (got "${contentType}", allowed: ${fileType.join(", ")})`
-        );
-      }
     }
-    if (!this._bucket) {
-      throw new Error(`No upload destination configured (missing bucket)`);
-    }
-    return saveFileToBucket(originalName, data, this._bucket, contentType);
   }
-};
+}
 
 // src/helpers/bodyLimit.ts
 var INF = Number.POSITIVE_INFINITY;
@@ -416,6 +220,88 @@ var tooLarge = (max) => new StatusError(
   413
 );
 
+// src/helpers/mimes.ts
+var mimes_default = {
+  aac: "audio/aac",
+  abw: "application/x-abiword",
+  arc: "application/x-freearc",
+  avif: "image/avif",
+  avi: "video/x-msvideo",
+  azw: "application/vnd.amazon.ebook",
+  bin: "application/octet-stream",
+  bmp: "image/bmp",
+  bz: "application/x-bzip",
+  bz2: "application/x-bzip2",
+  cda: "application/x-cdf",
+  csh: "application/x-csh",
+  css: "text/css; charset=utf-8",
+  csv: "text/csv; charset=utf-8",
+  doc: "application/msword",
+  docx: "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  eot: "application/vnd.ms-fontobject",
+  epub: "application/epub+zip",
+  gz: "application/gzip",
+  gif: "image/gif",
+  htm: "text/html; charset=utf-8",
+  html: "text/html; charset=utf-8",
+  ico: "image/vnd.microsoft.icon",
+  ics: "text/calendar; charset=utf-8",
+  jar: "application/java-archive",
+  jpeg: "image/jpeg",
+  jpg: "image/jpeg",
+  js: "text/javascript; charset=utf-8",
+  json: "application/json",
+  jsonld: "application/ld+json",
+  md: "text/markdown; charset=utf-8",
+  mid: "audio/midi",
+  midi: "audio/midi",
+  mjs: "text/javascript; charset=utf-8",
+  mp3: "audio/mpeg",
+  mp4: "video/mp4",
+  mpeg: "video/mpeg",
+  mpkg: "application/vnd.apple.installer+xml",
+  odp: "application/vnd.oasis.opendocument.presentation",
+  ods: "application/vnd.oasis.opendocument.spreadsheet",
+  odt: "application/vnd.oasis.opendocument.text",
+  oga: "audio/ogg",
+  ogv: "video/ogg",
+  ogx: "application/ogg",
+  opus: "audio/opus",
+  otf: "font/otf",
+  png: "image/png",
+  pdf: "application/pdf",
+  php: "application/x-httpd-php",
+  ppt: "application/vnd.ms-powerpoint",
+  pptx: "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  rar: "application/vnd.rar",
+  rtf: "application/rtf",
+  sh: "application/x-sh",
+  svg: "image/svg+xml",
+  tar: "application/x-tar",
+  text: "text/plain; charset=utf-8",
+  tif: "image/tiff",
+  tiff: "image/tiff",
+  ts: "video/mp2t",
+  ttf: "font/ttf",
+  txt: "text/plain; charset=utf-8",
+  vsd: "application/vnd.visio",
+  wav: "audio/wav",
+  weba: "audio/webm",
+  webm: "video/webm",
+  webp: "image/webp",
+  woff: "font/woff",
+  woff2: "font/woff2",
+  xhtml: "application/xhtml+xml",
+  xls: "application/vnd.ms-excel",
+  xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  xml: "application/xml",
+  xul: "application/vnd.mozilla.xul+xml",
+  zip: "application/zip",
+  "3gp": "video/3gpp",
+  "3g2": "video/3gpp2",
+  "7z": "application/x-7z-compressed"
+};
+
 // src/helpers/parseBody.ts
 function getBoundary(header) {
   if (!header) return null;
@@ -494,15 +380,15 @@ function addField(body, name, value) {
   if (!Array.isArray(body[name])) body[name] = [body[name]];
   body[name].push(value);
 }
-function startPart(headerStr, dest) {
+function startPart(headerStr, bucket2, limits) {
   const name = getMatching(headerStr, /name="(.+?)"/).trim().replace(/\[\]$/, "");
   if (!name) return { kind: "skip" };
   const filename = getMatching(headerStr, /filename="(.+?)"/).trim();
   if (!filename) return { kind: "text", name, chunks: [] };
   const type2 = getMatching(headerStr, /Content-Type:\s*([^\r\n]+)/i).trim() || "application/octet-stream";
-  if (!dest) return { kind: "drop" };
-  if (dest instanceof UploadPipeline) {
-    return { kind: "pipefile", name, filename, type: type2, pipeline: dest, chunks: [] };
+  if (!bucket2) return { kind: "drop" };
+  if (limits) {
+    return { kind: "validated", name, filename, type: type2, bucket: bucket2, limits, chunks: [] };
   }
   const id = `${createId()}${getExt(filename)}`;
   let controller;
@@ -511,7 +397,7 @@ function startPart(headerStr, dest) {
       controller = c;
     }
   });
-  const file2 = dest.file(id);
+  const file2 = bucket2.file(id);
   return {
     kind: "file",
     name,
@@ -526,7 +412,7 @@ function startPart(headerStr, dest) {
 }
 function feedPart(part, data) {
   if (data.length === 0) return;
-  if (part.kind === "text" || part.kind === "pipefile") part.chunks.push(data);
+  if (part.kind === "text" || part.kind === "validated") part.chunks.push(data);
   else if (part.kind === "file") {
     part.controller.enqueue(data);
     part.size += data.length;
@@ -537,16 +423,16 @@ async function endPart(part, body) {
     const buf = Buffer.concat(part.chunks);
     const value = isProbablyText(buf) ? buf.toString("utf-8").trim() : buf;
     addField(body, part.name, value);
-  } else if (part.kind === "pipefile") {
+  } else if (part.kind === "validated") {
     const buf = Buffer.concat(part.chunks);
-    const ref = await part.pipeline.processFile(part.filename, buf, part.type);
+    validateFile(part.filename, buf, part.type, part.limits);
+    const ref = await saveFileToBucket(part.filename, buf, part.bucket, part.type);
     addField(body, part.name, ref);
   } else if (part.kind === "file") {
     part.controller.close();
     await part.write;
     addField(body, part.name, {
       name: part.filename,
-      id: part.id,
       path: part.file.path,
       type: part.type,
       size: part.size
@@ -554,7 +440,7 @@ async function endPart(part, body) {
   }
 }
 var BREAK = Buffer.from("\r\n\r\n");
-async function parseMultipart(stream, boundary, dest, max = INF) {
+async function parseMultipart(stream, boundary, bucket2, limits, max = INF) {
   const delim = Buffer.from(`\r
 --${boundary}`);
   const body = {};
@@ -591,7 +477,7 @@ async function parseMultipart(stream, boundary, dest, max = INF) {
       } else if (state === "headers") {
         const i = buf.indexOf(BREAK);
         if (i === -1) break;
-        part = startPart(buf.subarray(0, i).toString("utf-8"), dest);
+        part = startPart(buf.subarray(0, i).toString("utf-8"), bucket2, limits);
         buf = buf.subarray(i + BREAK.length);
         state = "body";
         advanced = true;
@@ -637,12 +523,25 @@ async function streamToBucket(stream, type2, bucket2) {
   controller.close();
   await write;
   if (!size) return void 0;
-  return { name: id, id, path: file2.path, type: type2, size };
+  return { name: id, path: file2.path, type: type2, size };
 }
 async function parseBody(input, contentType, dest, max = INF) {
   const type2 = Array.isArray(contentType) ? contentType[0] : contentType;
+  let bucket2;
+  let limits;
+  if (dest && "bucket" in dest) {
+    bucket2 = dest.bucket;
+    const { maxSize, minSize, fileType: fileType2 } = dest;
+    if (maxSize != null || minSize != null || fileType2 != null) {
+      limits = { maxSize, minSize, fileType: fileType2 };
+    }
+  } else {
+    bucket2 = dest;
+  }
   const boundary = type2 && /multipart\/form-data/i.test(type2) ? getBoundary(type2) : null;
-  if (boundary) return parseMultipart(toStream(input), boundary, dest, max);
+  if (boundary) {
+    return parseMultipart(toStream(input), boundary, bucket2, limits, max);
+  }
   if (!type2 || /^text\//i.test(type2)) {
     const buf = await toBuffer(input, max);
     return buf.length ? buf.toString("utf-8") : void 0;
@@ -655,15 +554,18 @@ async function parseBody(input, contentType, dest, max = INF) {
     const buf = await toBuffer(input, max);
     return buf.length ? parseUrlEncoded(buf.toString("utf-8")) : void 0;
   }
-  if (!dest) {
+  if (!bucket2) {
     const buf = await toBuffer(input, max);
     return buf.length ? buf : void 0;
   }
-  if (dest instanceof UploadPipeline) {
+  if (limits) {
     const buf = await toBuffer(input);
-    return buf.length ? dest.processFile(`upload${extFromType(type2)}`, buf, type2) : void 0;
+    if (!buf.length) return void 0;
+    const name = `upload${extFromType(type2)}`;
+    validateFile(name, buf, type2, limits);
+    return saveFileToBucket(name, buf, bucket2, type2);
   }
-  return streamToBucket(toStream(input), type2, dest);
+  return streamToBucket(toStream(input), type2, bucket2);
 }
 
 // src/helpers/body.ts
@@ -759,8 +661,8 @@ function normalizeExpires(expires) {
 }
 function createCookies(key, val) {
   if (val.value === null) val.expires = EXPIRED;
-  const { value, path: path2, expires, maxAge, httpOnly, secure, sameSite } = val;
-  let str = `${key}=${value || ""};Path=${path2 || "/"}`;
+  const { value, path, expires, maxAge, httpOnly, secure, sameSite } = val;
+  let str = `${key}=${encodeURIComponent(value ?? "")};Path=${path || "/"}`;
   if (typeof expires !== "undefined") str += `;Expires=${normalizeExpires(expires)}`;
   if (typeof maxAge === "number") str += `;Max-Age=${maxAge}`;
   if (httpOnly) str += ";HttpOnly";
@@ -823,6 +725,45 @@ function clientIp(headers2, opts = {}) {
   return normalize(remoteAddress);
 }
 
+// src/helpers/store.ts
+import kv from "polystore";
+function toStore(source) {
+  const store = source;
+  if (store && typeof store.prefix === "function" && typeof store.get === "function" && typeof store.set === "function") {
+    return store;
+  }
+  return kv(source);
+}
+
+// src/helpers/disposition.ts
+var encodeExt = (name) => encodeURIComponent(name).replace(
+  /['()*]/g,
+  (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`
+);
+function disposition(name) {
+  if (!name) return "attachment";
+  const clean = name.replace(/[\r\n]/g, "").split(/[\\/]/).pop() || "";
+  if (!clean) return "attachment";
+  const ascii = clean.replace(/[^\x20-\x7e]/g, "?");
+  const value = `attachment; filename="${ascii.replace(/["\\]/g, "\\$&")}"`;
+  if (clean === ascii) return value;
+  return `${value}; filename*=UTF-8''${encodeExt(clean)}`;
+}
+
+// src/helpers/fileType.ts
+function fileType(file2) {
+  if (file2.type) return file2.type;
+  const name = file2.path || file2.name || "";
+  const ext2 = name.split(".").pop()?.toLowerCase();
+  return ext2 ? mimes_default[ext2] : void 0;
+}
+
+// src/helpers/isHtml.ts
+var TAG = /^\s*<[a-zA-Z!/]/;
+function isHtml(body) {
+  return TAG.test(body);
+}
+
 // src/helpers/isReadableStream.ts
 function isReadableStream(obj) {
   return obj !== null && typeof obj === "object" && typeof obj.pipe === "function" && typeof obj.read === "function" && typeof obj.on === "function";
@@ -850,8 +791,7 @@ var Reply = class {
   download(name) {
     const ext2 = name?.split(".").pop();
     if (ext2 && !this.res.headers.get("content-type")) this.type(ext2);
-    const filename = name ? `; filename="${encodeURIComponent(name)}"` : "";
-    return this.headers("content-disposition", `attachment${filename}`);
+    return this.headers("content-disposition", disposition(name));
   }
   headers(key, value) {
     if (typeof key !== "string") {
@@ -859,10 +799,15 @@ var Reply = class {
       return this;
     }
     if (Array.isArray(value)) {
-      Object.values(value).map((val) => this.headers(key, val));
+      this.res.headers.delete(key);
+      for (const val of value) this.res.headers.append(key, val);
       return this;
     }
-    this.res.headers.append(key, value);
+    if (key.toLowerCase() === "set-cookie") {
+      this.res.headers.append(key, value);
+    } else {
+      this.res.headers.set(key, value);
+    }
     return this;
   }
   cache(value) {
@@ -884,25 +829,31 @@ var Reply = class {
     return this.headers("set-cookie", createCookies(key, value));
   }
   json(body) {
-    return this.headers("content-type", "application/json").send(
-      JSON.stringify(body)
-    );
+    if (body === void 0) body = null;
+    if (!this.res.headers.get("content-type")) {
+      this.res.headers.set("content-type", "application/json");
+    }
+    return this.send(JSON.stringify(body));
   }
-  redirect(path2) {
-    return this.headers("location", path2).status(302).send();
+  redirect(path) {
+    this.headers("location", path);
+    if (this.res.status == null) this.res.status = 302;
+    return this.send();
   }
-  async file(path2) {
-    if (typeof path2 !== "string") {
-      if (!await path2.exists()) return this.status(404).send();
-      return this.type(path2.type).send(path2.stream());
+  async file(path) {
+    if (typeof path !== "string") {
+      if (!await path.exists()) return this.status(404).send();
+      return this.type(fileType(path)).send(path.stream());
     }
+    if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(path)) return this.status(404).send();
     try {
-      const fs2 = await import("fs");
-      const ext2 = path2.split(".").pop();
-      const stream = fs2.createReadStream(path2);
+      const fs = await import("fs");
+      const ext2 = path.split(".").pop();
+      await fs.promises.access(path);
+      const stream = fs.createReadStream(path);
       return this.type(ext2).send(stream);
     } catch (error) {
-      if (error.code === "ENOENT") {
+      if (error.code === "ENOENT" || error.code === "EISDIR") {
         return this.status(404).send();
       }
       throw error;
@@ -913,10 +864,10 @@ var Reply = class {
     if (status2 === 101 || status2 === 204 || status2 === 205 || status2 === 304) {
       return new Response(null, { status: status2, headers: headers2 });
     }
+    if (body === null) body = "";
     if (typeof body === "string") {
       if (!headers2.get("content-type")) {
-        const isHtml = body.trim().startsWith("<");
-        headers2.set("content-type", isHtml ? "text/html" : "text/plain");
+        headers2.set("content-type", isHtml(body) ? mimes_default.html : mimes_default.text);
       }
       if (!headers2.has("content-length")) {
         headers2.set("content-length", String(Buffer.byteLength(body)));
@@ -1368,8 +1319,8 @@ var oauth = async (code) => {
       code
     })
   });
-  return (path2) => {
-    return fch(`https://api.github.com${path2}`, {
+  return (path) => {
+    return fch(`https://api.github.com${path}`, {
       headers: { Authorization: `Bearer ${res.access_token}` }
     });
   };
@@ -1504,18 +1455,30 @@ function parseAuthOptions(auth2, all) {
   if (!auth2.session && !all.store) {
     throw new Error("Need a sessionStore store for Auth");
   }
-  const store = auth2.store || all.store.prefix("user:");
-  const session2 = auth2.session || all.store.prefix("auth:");
+  const store = all.store ? toStore(all.store) : null;
+  const authStore = auth2.store ? toStore(auth2.store) : store.prefix("user:");
+  const sessionStore = auth2.session ? toStore(auth2.session) : store.prefix("auth:");
   return {
     strategy,
     providers: list,
     redirect: redirect2,
     cleanUser,
-    store,
-    session: session2
+    store: authStore,
+    session: sessionStore
   };
 }
 
+// src/helpers/bucket.ts
+import FileSystem from "bucket/fs";
+function bucket(root) {
+  if (!root) return null;
+  if (typeof root === "string") return FileSystem(root);
+  if (typeof root.file === "function") return root;
+  throw new Error(
+    "Invalid bucket: pass a directory path or a `bucket` instance (with .file())"
+  );
+}
+
 // src/helpers/color.ts
 var map = {
   reset: 0,
@@ -1605,14 +1568,14 @@ function createLogger(level) {
   const request = (ctx, res) => {
     if (!enabled) return;
     const method = ctx.method.toUpperCase();
-    const path2 = ctx.url.pathname;
+    const path = ctx.url.pathname;
     const reqLen = Number(ctx.headers["content-length"]) || 0;
     const resLen = Number(res.headers.get("content-length")) || 0;
     const status2 = res.status;
     const text = STATUS_TEXT[status2] || "";
     const reqSize = reqLen ? ` ${formatBytes(reqLen)}` : "";
     const resSize = resLen ? ` ${formatBytes(resLen)}` : "";
-    let line = `${method} ${path2}${reqSize} \u2192 ${status2}${text ? ` ${text}` : ""}${resSize}`;
+    let line = `${method} ${path}${reqSize} \u2192 ${status2}${text ? ` ${text}` : ""}${resSize}`;
     const location = res.headers.get("location");
     if (location) line += ` \u2192 ${location}`;
     message("api", line);
@@ -1651,10 +1614,23 @@ function resolveSecurity(security) {
   }
   return {
     trustProxy: o.trustProxy ?? true,
+    traversalProtection: off ? false : o.traversalProtection !== false,
     headers: headers2,
     hsts: off ? null : val(o.hsts, "max-age=15552000; includeSubDomains")
   };
 }
+var CLIMBS = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
+var ABSOLUTE = /^(?:[\\/]|[a-zA-Z]:)/;
+function checkTraversal(params, ctx) {
+  if (!ctx.options.security?.traversalProtection) return;
+  for (const param in params) {
+    const value = params[param];
+    if (typeof value !== "string") continue;
+    if (CLIMBS.test(value) || ABSOLUTE.test(value)) {
+      throw errors_default.PATH_TRAVERSAL({ param, value });
+    }
+  }
+}
 function applySecurity(res, ctx) {
   const security = ctx.options.security;
   if (!security) return;
@@ -1726,21 +1702,22 @@ function config(options = {}) {
   if (!up) {
     settings.uploads = null;
   } else if (typeof up === "object" && "bucket" in up) {
-    const { bucket: bucket2, maxSize, minSize, fileType } = up;
-    const hasLimits = maxSize != null || minSize != null || fileType != null;
-    settings.uploads = hasLimits ? new UploadPipeline(bucket2).limit({ maxSize, minSize, fileType }) : bucket(bucket2);
+    const { bucket: bucket2, maxSize, minSize, fileType: fileType2 } = up;
+    if (maxSize != null) parseBytes(maxSize);
+    if (minSize != null) parseBytes(minSize);
+    settings.uploads = { bucket: bucket(bucket2), maxSize, minSize, fileType: fileType2 };
   } else {
-    settings.uploads = bucket(up);
+    settings.uploads = { bucket: bucket(up) };
   }
   const favicon2 = options.favicon || env2.FAVICON;
   if (favicon2) settings.favicon = favicon2;
-  settings.store = options.store ?? null;
-  settings.cookies = options.cookies ?? null;
+  settings.store = options.store ? toStore(options.store) : null;
   if (options.session) {
-    settings.session = "store" in options.session ? options.session : { store: options.session };
+    const store = typeof options.session === "object" && "store" in options.session ? options.session.store : options.session;
+    settings.session = { store: toStore(store) };
   }
-  if (options.store && !options.session) {
-    settings.session = { store: options.store.prefix("session:") };
+  if (settings.store && !options.session) {
+    settings.session = { store: settings.store.prefix("session:") };
   }
   if (options.auth || env2.AUTH) {
     settings.auth = parseAuthOptions(options.auth || env2.AUTH || null, options);
@@ -1893,9 +1870,10 @@ async function parseResponse(out, ctx) {
     if (!await out.exists()) {
       out = new Response(null, { status: 404 });
     } else {
+      const type2 = fileType(out);
       out = new Response(
         out.stream(),
-        out.type ? { headers: { "content-type": out.type } } : void 0
+        type2 ? { headers: { "content-type": type2 } } : void 0
       );
     }
   }
@@ -1909,7 +1887,7 @@ async function parseResponse(out, ctx) {
     out = new Response(void 0, { status: out });
   }
   if (typeof out === "string") {
-    const type2 = /^\s*</.test(out) ? "text/html" : "text/plain";
+    const type2 = isHtml(out) ? mimes_default.html : mimes_default.text;
     out = new Response(out, {
       headers: {
         "content-type": type2,
@@ -1964,13 +1942,6 @@ async function parseResponse(out, ctx) {
     }
     ctx.options.session.store.set(id, ctx.session);
   }
-  if (ctx.options.cookies) {
-    if (Object.keys(ctx.res?.cookies || {}).length) {
-      for (const cookie of Object.values(ctx.res.cookies)) {
-        ctx.res.headers.append("set-cookie", cookie);
-      }
-    }
-  }
   if (ctx?.res?.headers) {
     for (const key in ctx.res.headers) {
       out.headers[key] = ctx.res.headers[key];
@@ -1980,14 +1951,14 @@ async function parseResponse(out, ctx) {
 }
 
 // src/pathPattern.ts
-function pathPattern(pattern, path2) {
-  if (pattern === "*" && path2 === "/") return {};
+function pathPattern(pattern, path) {
+  if (pattern === "*" && path === "/") return {};
   pattern = `/${pattern.replace(/^\//, "")}`;
   pattern = pattern.replace(/\/$/, "") || "/";
-  path2 = path2.replace(/\/$/, "") || "/";
-  if (pattern === path2) return {};
+  path = path.replace(/\/$/, "") || "/";
+  if (pattern === path) return {};
   const params = {};
-  const pathParts = path2.split("/").slice(1).map((u) => decodeURIComponent(u));
+  const pathParts = path.split("/").slice(1).map((u) => decodeURIComponent(u));
   const pattParts = pattern.split("/").slice(1);
   let allSame = true;
   for (let i = 0; i < Math.max(pathParts.length, pattParts.length); i++) {
@@ -2046,7 +2017,7 @@ function validate(ctx, schema) {
   } catch (error) {
     if (error.name === "ZodError" || error.constructor.name === "ZodError") {
       const message = error.issues.map(
-        ({ path: path2, message: message2 }) => `[${base}.${path2.join(".")}]: ${message2}`
+        ({ path, message: message2 }) => `[${base}.${path.join(".")}]: ${message2}`
       ).sort().join("\n");
       throw new StatusError(message, 422);
     }
@@ -2075,6 +2046,7 @@ async function getResponse(app, ctx) {
       if (Object.keys(route.options).length) {
         ctx.options = { ...app.settings, ...route.options };
       }
+      checkTraversal(params, ctx);
       ctx.body = await resolveBody(ctx, ctx.options.body);
       for (const cb of route.fns) {
         if (typeof cb === "function") {
@@ -2174,7 +2146,12 @@ function parseCookies(cookies2) {
   return Object.fromEntries(
     cookieStr.split(/;\s*/).map((part) => {
       const [key, ...rest] = part.split("=");
-      return [key, decodeURIComponent(rest.join("="))];
+      const value = rest.join("=");
+      try {
+        return [key, decodeURIComponent(value)];
+      } catch {
+        return [key, value];
+      }
     })
   );
 }
@@ -2236,7 +2213,7 @@ async function verify(password, hash3) {
   const [, variant, , memory, passes, parallelism, saltB64, hashB64] = match;
   const nonce = Buffer.from(saltB64, "base64");
   const expected = Buffer.from(hashB64, "base64");
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     crypto3.argon2(
       `argon2${variant}`,
       {
@@ -2250,9 +2227,9 @@ async function verify(password, hash3) {
       (err, derivedKey) => {
         if (err) return reject(err);
         if (derivedKey.length === expected.length && timingSafeEqual(derivedKey, expected)) {
-          resolve2(true);
+          resolve(true);
         } else {
-          resolve2(false);
+          resolve(false);
         }
       }
     );
@@ -2444,17 +2421,18 @@ async function assets(ctx) {
   try {
     const key = ctx.url.pathname.replace(/^\/+/, "");
     const file2 = ctx.options.public.file(key);
-    const meta = file2.info ? await file2.info() : null;
-    if (meta ? !meta.exists : !await file2.exists()) return;
-    const ext2 = ctx.url.pathname.split(".").pop();
-    const ctype = meta?.type || ext2;
+    const info = file2.info?.bind(file2);
+    const meta = info ? await info() : null;
+    if (info ? !meta : !await file2.exists()) return;
+    const ext2 = ctx.url.pathname.split(".").pop()?.toLowerCase();
+    const ctype = ext2 && mimes_default[ext2] || meta?.type || ext2;
     const headers2 = { "cache-control": CACHE_CONTROL };
     let tag;
     if (meta) {
-      const stamp = meta.date ? meta.date.getTime() : 0;
+      const stamp = meta.modified ? meta.modified.getTime() : 0;
       tag = `W/"${meta.size.toString(16)}-${stamp.toString(16)}"`;
       headers2.etag = tag;
-      if (meta.date) headers2["last-modified"] = meta.date.toUTCString();
+      if (meta.modified) headers2["last-modified"] = meta.modified.toUTCString();
     }
     const canRange = !!(meta && file2.slice);
     if (canRange) headers2["accept-ranges"] = "bytes";
@@ -2510,7 +2488,7 @@ async function favicon(ctx) {
 }
 
 // src/middle/openapi.ts
-import * as fsp2 from "fs/promises";
+import * as fsp from "fs/promises";
 var entities = {
   "&": "&amp;",
   "<": "&lt;",
@@ -2556,7 +2534,7 @@ function zodToSchema(schema) {
   }
   return { type: type2 };
 }
-var pkgProm = fsp2.readFile("package.json", "utf-8").then((data) => JSON.parse(data)).catch(() => ({}));
+var pkgProm = fsp.readFile("package.json", "utf-8").then((data) => JSON.parse(data)).catch(() => ({}));
 var getTag = (name, fn) => {
   const found = fn.toString().split("\n").filter((l) => /\s+\/\/\s/.test(l)).map((l) => l.trim().replace("// ", "")).find((l) => l.startsWith(name));
   if (!found) return "";
@@ -2568,14 +2546,14 @@ var generateOpenApiPaths = (handlers) => {
   const paths = {};
   for (const [method, routes] of Object.entries(handlers)) {
     for (const route of routes) {
-      const path2 = route.path;
+      const path = route.path;
       const fn = route.fns.find((p) => typeof p === "function");
       const meta = route.fns.find((p) => typeof p === "object");
       const config2 = getConfig(route.options);
-      if (typeof path2 !== "string" || path2 === "*" || path2 === "/docs" || !fn) {
+      if (typeof path !== "string" || path === "*" || path === "/docs" || !fn) {
         continue;
       }
-      const normalizedPath = path2.replace(/\(\w+\)/gi, "").replace(/:([a-zA-Z0-9_]+)/g, "{$1}");
+      const normalizedPath = path.replace(/\(\w+\)/gi, "").replace(/:([a-zA-Z0-9_]+)/g, "{$1}");
       if (!paths[normalizedPath]) {
         paths[normalizedPath] = {};
       }
@@ -2602,7 +2580,7 @@ var generateOpenApiPaths = (handlers) => {
         };
       }
       const parameters = [];
-      const matched = Array.from(path2.matchAll(/:[\w()]+/gi));
+      const matched = Array.from(path.matchAll(/:[\w()]+/gi));
       matched.forEach((match) => {
         const [name, type2 = "string"] = match[0].slice(1).replace(/\)/, "").split("(");
         parameters.push({
@@ -2941,18 +2919,18 @@ async function createNode(req, app) {
   const cookies2 = parseCookies(headers2.cookie);
   const scheme = req.socket instanceof TLSSocket ? "https" : "http";
   const host = headers2.host || `localhost:${app.settings.port}`;
-  const path2 = (req.url || "/").replace(/\/$/, "") || "/";
+  const path = (req.url || "/").replace(/\/$/, "") || "/";
   const baseUrl = `${scheme}://${host}`;
-  const url = new URL(path2, baseUrl);
+  const url = new URL(path, baseUrl);
   define(
     url,
     "query",
     (url2) => Object.fromEntries(url2.searchParams.entries())
   );
   const source = {
-    getBuffer: () => new Promise((resolve2, reject) => {
+    getBuffer: () => new Promise((resolve, reject) => {
       const chunks2 = [];
-      req.on("data", (chunk) => chunks2.push(chunk)).on("end", () => resolve2(Buffer.concat(chunks2))).on("error", reject);
+      req.on("data", (chunk) => chunks2.push(chunk)).on("end", () => resolve(Buffer.concat(chunks2))).on("error", reject);
     }),
     getStream: () => toWeb(req)
   };
@@ -3104,9 +3082,9 @@ var Router = class _Router {
   // functions into a single flat `fns` list. A plain options object may sit
   // between the path and the handlers, and it's pulled out here.
   handle(method, pathOrFn, ...rest) {
-    let path2 = "*";
+    let path = "*";
     if (typeof pathOrFn === "string") {
-      path2 = pathOrFn;
+      path = pathOrFn;
     } else if (pathOrFn != null) {
       rest.unshift(pathOrFn);
     }
@@ -3116,7 +3094,7 @@ var Router = class _Router {
     }
     const base = method === "socket" ? [] : this.middleware;
     const fns = [...base, ...rest].filter((fn) => fn != null);
-    this.handlers[method].push({ path: path2, options, fns });
+    this.handlers[method].push({ path, options, fns });
     return this.self();
   }
   socket(pathOrMid, optionsOrMid, ...middleware) {
@@ -3181,31 +3159,33 @@ function isSerializable(body) {
 }
 function ServerTest(app) {
   const port = app.settings.port;
-  const fetch2 = async (method, path2, options = {}) => {
+  const fetch2 = async (method, path, options = {}) => {
     if (!options.headers) options.headers = {};
     if (isSerializable(options.body)) {
       options.headers["content-type"] = "application/json";
       options.body = JSON.stringify(options.body);
     }
     return await app.fetch(
-      new Request(`http://localhost:${port}${path2}`, {
+      new Request(`http://localhost:${port}${path}`, {
         method,
         ...options
       })
     );
   };
   return {
-    get: (path2, options) => fetch2("get", path2, options),
-    head: (path2, options) => fetch2("head", path2, options),
-    post: (path2, body, options) => fetch2("post", path2, { body, ...options }),
-    put: (path2, body, options) => fetch2("put", path2, { body, ...options }),
-    patch: (path2, body, options) => fetch2("patch", path2, { body, ...options }),
-    delete: (path2, options) => fetch2("delete", path2, options),
-    options: (path2, options) => fetch2("options", path2, options)
+    get: (path, options) => fetch2("get", path, options),
+    head: (path, options) => fetch2("head", path, options),
+    post: (path, body, options) => fetch2("post", path, { body, ...options }),
+    put: (path, body, options) => fetch2("put", path, { body, ...options }),
+    patch: (path, body, options) => fetch2("patch", path, { body, ...options }),
+    delete: (path, options) => fetch2("delete", path, options),
+    options: (path, options) => fetch2("options", path, options)
   };
 }
 
 // src/index.ts
+import { default as default2 } from "polystore";
+import { default as default3 } from "bucket";
 var Server = class extends Router {
   settings;
   platform;
@@ -3273,6 +3253,7 @@ function server(options) {
 export {
   Server,
   ServerError_default as ServerError,
+  default3 as bucket,
   cache,
   cookies,
   server as default,
@@ -3280,6 +3261,7 @@ export {
   file,
   headers,
   json,
+  default2 as kv,
   redirect,
   router,
   send,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.37.1",
+  "version": "0.39.0",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",
@@ -44,18 +44,37 @@
     "home": "./docs/index.html",
     "menu": {
       "Documentation": "/documentation",
+      "Tutorials": "/tutorials",
       "Github": "https://github.com/franciscop/server-next"
-    }
+    },
+    "documentation": {
+      "Documentation": [
+        "docs/0. Documentation.md",
+        "docs/1. Getting Started.md"
+      ],
+      "Guides": "docs/2. Guides.md",
+      "Options": "docs/3. Options.md",
+      "Router": "docs/4. Router.md",
+      "Context": "docs/5. Context.md",
+      "Reply": "docs/6. Reply.md",
+      "Authentication": "docs/7. Authentication.md",
+      "Testing": "docs/8. Testing.md",
+      "Platforms": "docs/9. Platforms.md",
+      "FAQ": "docs/A. FAQ.md"
+    },
+    "tutorials": "docs/tutorials"
+  },
+  "dependencies": {
+    "bucket": "^0.6.0",
+    "polystore": "^0.23.2"
   },
   "devDependencies": {
     "@types/bun": "^1.3.0",
     "@types/jest": "^30.0.0",
     "@types/node": "^24.10.0",
-    "bucket": "^0.4.0",
     "bun": "^1.3.13",
     "check-dts": "^0.8.2",
     "jest": "^29.7.0",
-    "polystore": "^0.21.1",
     "tsup": "^8.5.1",
     "typescript": "^6.0.2"
   },

package/readme.md

@@ -1 +1,29 @@
 # Server JS [![@server/next](https://img.shields.io/npm/v/@server/next?label=@server/next&color=greenlime)](https://www.npmjs.com/package/@server/next) [![tests](https://github.com/franciscop/server-next/workflows/tests/badge.svg)](https://github.com/franciscop/server-next/actions)
+
+A modern web server for Bun and Node, with routing, authentication, uploads, WebSockets and testing built in.
+
+```bash
+npm install @server/next
+```
+
+```js
+import server from '@server/next';
+
+export default server({ store: new Map(), uploads: './uploads' })
+  .get('/', () => 'Hello world')
+  .get('/users/:id', (ctx) => db.users.find(ctx.url.params.id))
+  .post('/avatar', (ctx) => ctx.body.avatar.path);
+```
+
+Key-value stores and file storage come included, so `store` takes a plain `Map` and `uploads` takes a folder path. For Redis, S3 and the rest, `kv` and `bucket` are exported too:
+
+```js
+import server, { kv, bucket } from '@server/next';
+
+const store = kv(createClient({ url }).connect());
+const uploads = bucket.S3('my-bucket', { id, key });
+
+export default server({ store, uploads });
+```
+
+See the [full documentation](https://serverjs.io/documentation).