@server/next 0.49.0 → 0.49.2

package/index.d.ts

@@ -7,22 +7,28 @@ type FileInfo = {
     type: string | null;
     modified: Date;
 };
+type ReadOptions = {
+    signal?: AbortSignal;
+};
 type BucketFile = {
     readonly path: string;
     readonly name: string;
     readonly type?: string;
-    exists(): Promise<boolean>;
-    info?(): Promise<FileInfo | null>;
+    exists(opts?: ReadOptions): Promise<boolean>;
+    info?(opts?: ReadOptions): Promise<FileInfo | null>;
     write(content: string | Buffer | ReadableStream, options?: {
         type?: string;
-    }): Promise<void>;
-    stream(): ReadableStream;
+    } & ReadOptions): Promise<unknown>;
+    stream(opts?: ReadOptions): ReadableStream;
     slice?(start: number, end?: number): BucketFile;
-    bytes(): Promise<Uint8Array>;
-    remove(): Promise<void>;
+    bytes(opts?: ReadOptions): Promise<Uint8Array>;
+    remove(opts?: ReadOptions): Promise<unknown>;
 };
 type Bucket = {
     file(name: string): BucketFile;
+    create(content: string | Buffer | ReadableStream, options?: {
+        type?: string;
+    } & ReadOptions): Promise<BucketFile>;
     folder?(prefix: string): Bucket;
 };
 
@@ -203,6 +209,7 @@ type AuthOption = string | AuthFunction | AuthConfig<any> | AuthVerify<any> | Au
 type AuthContext = Pick<Context, "options" | "headers" | "cookies" | "platform" | "app">;
 type AuthEntry = {
     name: string;
+    providers?: string[];
     user: (ctx: AuthContext) => Promise<any>;
     routes?: () => Router;
 };
@@ -577,6 +584,10 @@ declare class Server<C extends ContextTypes = {}> extends Router<C> {
             referrerPolicy?: ReferrerPolicy;
             window?: null;
         }) => Promise<Response>;
+        readonly cookies: {
+            [k: string]: string;
+        };
+        clear: () => void;
     };
 }
 declare function server<U = AuthProfile>(options: Omit<Options, "auth"> & {

package/index.js

@@ -245,7 +245,8 @@ function createCookies(key, val) {
   if (val.value === null) val.expires = EXPIRED;
   const { value, path, expires, maxAge, httpOnly, secure, sameSite } = val;
   let str = `${key}=${encodeURIComponent(value ?? "")};Path=${path || "/"}`;
-  if (typeof expires !== "undefined") str += `;Expires=${normalizeExpires(expires)}`;
+  if (typeof expires !== "undefined")
+    str += `;Expires=${normalizeExpires(expires)}`;
   if (typeof maxAge === "number") str += `;Max-Age=${maxAge}`;
   if (httpOnly) str += ";HttpOnly";
   if (secure) str += ";Secure";
@@ -513,7 +514,11 @@ function serialize(body, headers2) {
     return body;
   }
   if (typeof body === "string") {
-    fill(headers2, isHtml(body) ? mimes_default.html : mimes_default.text, Buffer.byteLength(body));
+    fill(
+      headers2,
+      isHtml(body) ? mimes_default.html : mimes_default.text,
+      Buffer.byteLength(body)
+    );
     return body;
   }
   if (body instanceof Uint8Array) {
@@ -676,13 +681,22 @@ var redirect = (...args) => r().redirect(...args);
 // src/body/sniff.ts
 var ascii = (text) => [...text].map((char) => char.charCodeAt(0));
 var SIGNATURES = [
-  { type: "image/png", magic: [137, 80, 78, 71, 13, 10, 26, 10] },
+  {
+    type: "image/png",
+    magic: [137, 80, 78, 71, 13, 10, 26, 10]
+  },
   { type: "image/jpeg", magic: [255, 216, 255] },
   { type: "image/gif", magic: ascii("GIF87a") },
   { type: "image/gif", magic: ascii("GIF89a") },
   // RIFF containers: the format is at byte 8, so the whole thing is one match
-  { type: "image/webp", magic: [...ascii("RIFF"), null, null, null, null, ...ascii("WEBP")] },
-  { type: "audio/wav", magic: [...ascii("RIFF"), null, null, null, null, ...ascii("WAVE")] },
+  {
+    type: "image/webp",
+    magic: [...ascii("RIFF"), null, null, null, null, ...ascii("WEBP")]
+  },
+  {
+    type: "audio/wav",
+    magic: [...ascii("RIFF"), null, null, null, null, ...ascii("WAVE")]
+  },
   { type: "image/bmp", magic: ascii("BM") },
   { type: "image/tiff", magic: [73, 73, 42, 0] },
   { type: "image/tiff", magic: [77, 77, 0, 42] },
@@ -748,26 +762,25 @@ function resolveUploads(up) {
     maxFiles: DEFAULT_FILES
   };
 }
-function getExt(filename) {
-  const i = filename.lastIndexOf(".");
-  if (i <= 0) return ".bin";
-  return filename.slice(i).toLowerCase();
-}
 function validateFile(originalName, contentType, limits, sniffed) {
   const { fileType: fileType2 } = limits;
-  if (!fileType2 || fileType2.length === 0) return;
   if (sniffed === null && isSniffable(contentType)) {
     throw errors_default.UPLOAD_TYPE_NOT_ALLOWED({
       name: originalName,
       type: contentType,
-      allowed: fileType2
+      allowed: fileType2 ?? [contentType]
     });
   }
-  const ext = getExt(originalName);
-  const mime = contentType.toLowerCase();
-  const allowed = fileType2.some(
-    (t) => t.toLowerCase() === mime || t.toLowerCase() === ext
-  );
+  if (!fileType2 || fileType2.length === 0) return;
+  const base = (value) => value.split(";")[0].trim().toLowerCase();
+  const type2 = base(contentType);
+  const allowed = fileType2.some((one) => {
+    const entry = one.trim().toLowerCase();
+    if (entry.endsWith("/*")) return type2.startsWith(entry.slice(0, -1));
+    if (entry.includes("/")) return base(entry) === type2;
+    const mapped = mimes_default[entry.replace(/^\./, "")];
+    return Boolean(mapped) && base(mapped) === type2;
+  });
   if (!allowed) {
     throw errors_default.UPLOAD_TYPE_NOT_ALLOWED({
       name: originalName,
@@ -828,7 +841,11 @@ var Router = class _Router {
     }
     const base = method === "socket" ? [] : this.middleware;
     const fns = [...base, ...rest].filter((fn) => fn != null);
-    this.handlers[method].push({ path, options, fns });
+    this.handlers[method].push({
+      path,
+      options,
+      fns
+    });
     return this.self();
   }
   socket(pathOrMid, optionsOrMid, ...middleware) {
@@ -1018,7 +1035,9 @@ function validate(strategy, expires, config2) {
   seconds(expires);
   const { onLogin, getUser, toPublicUser } = config2;
   if (onLogin && !getUser) {
-    throw new Error("`onLogin` needs a `getUser`: something has to resolve the id it returns.");
+    throw new Error(
+      "`onLogin` needs a `getUser`: something has to resolve the id it returns."
+    );
   }
   if (isSigned(strategy)) {
     if (getUser && !toPublicUser) {
@@ -1054,7 +1073,9 @@ async function credentialPayload(config2, strategy, ctx, profile) {
   if (!isSigned(strategy)) return { sub: String(id) };
   const user = await getUser(String(id), ctx);
   if (user === void 0 || user === null) {
-    throw new Error(`getUser returned nothing for the id "${id}" that onLogin just returned`);
+    throw new Error(
+      `getUser returned nothing for the id "${id}" that onLogin just returned`
+    );
   }
   return { user: await toPublicUser(user) };
 }
@@ -1450,7 +1471,12 @@ var callbackRoute = ({ name, options, provider }, redirects, finish) => async (c
   const pending = await readState(ctx, query.state);
   if (!query.code) throw errors_default.AUTH_NO_CODE();
   try {
-    const profile = await provider.exchange(ctx, options, query.code, pending);
+    const profile = await provider.exchange(
+      ctx,
+      options,
+      query.code,
+      pending
+    );
     return spendState(await finish(ctx, profile));
   } catch (error) {
     const message = failureMessage(error, name);
@@ -1477,6 +1503,7 @@ function flowEntry(config2) {
   };
   return {
     name: "flow",
+    providers: list.map((one) => one.name),
     async user(ctx) {
       const payload = await read(ctx, strategy);
       if (!payload) return;
@@ -1489,11 +1516,16 @@ function flowEntry(config2) {
       const r2 = router();
       for (const one of list) {
         r2.get(`/auth/login/${one.name}`, SPEC, loginRoute(one));
-        r2.get(callbackPath(one.name), SPEC, callbackRoute(one, redirects, finish));
+        r2.get(
+          callbackPath(one.name),
+          SPEC,
+          callbackRoute(one, redirects, finish)
+        );
       }
       r2.post("/auth/logout", SPEC, async (ctx) => {
         const payload = await read(ctx, strategy).catch(() => void 0);
-        if (onLogout && payload?.sub) await onLogout(payload.sub, ctx);
+        const id = payload?.sub ?? payload?.user?.id;
+        if (onLogout && id != null) await onLogout(String(id), ctx);
         const to = await target(redirects.logout, "/", null, ctx);
         if (!inCookie(strategy)) return status(204);
         return cookies(NAME, { value: null }).redirect(to);
@@ -1548,7 +1580,9 @@ function keysOf(issuer, refresh = false) {
         if (!algorithm) continue;
         out.set(
           jwk.kid,
-          await crypto.subtle.importKey("jwk", jwk, algorithm, false, ["verify"])
+          await crypto.subtle.importKey("jwk", jwk, algorithm, false, [
+            "verify"
+          ])
         );
       }
       return out;
@@ -1717,7 +1751,7 @@ function toEntry(auth2) {
     if ("handler" in auth2) return instanceEntry(auth2);
   }
   throw new Error(
-    "Invalid `auth`: it takes a string, a function, `{ providers }`, `{ issuer, audience }`, a library instance, or an array of those."
+    "Invalid `auth`: it takes a string, a function, `{ providers }`, `{ issuer, audience }`, or a library instance."
   );
 }
 
@@ -2005,7 +2039,10 @@ function config(options = {}) {
   settings.onError = options.onError || defaultOnError;
   settings.onResponse = options.onResponse;
   const loc = (v) => typeof v === "string" ? v : "enabled";
-  if (settings.auth) log.message("auth", `${settings.auth.name} enabled`);
+  if (settings.auth) {
+    const { name, providers: providers2 } = settings.auth;
+    log.message("auth", `${providers2?.join(",") ?? name} enabled`);
+  }
   if (settings.public) log.message("public", loc(options.public));
   if (settings.uploads) log.message("uploads", loc(options.uploads));
   if (settings.cors) {
@@ -2109,11 +2146,11 @@ async function assets(ctx) {
   try {
     const key = ctx.url.pathname.replace(/^\/+/, "");
     const file2 = ctx.options.public.file(key);
+    const read2 = { signal: ctx.signal };
     const info = file2.info?.bind(file2);
-    const meta2 = info ? await info() : null;
-    if (info ? !meta2 : !await file2.exists()) return;
-    const ext = ctx.url.pathname.split(".").pop()?.toLowerCase();
-    const ctype = mimeOf(ctx.url.pathname) || meta2?.type || ext;
+    const meta2 = info ? await info(read2) : null;
+    if (info ? !meta2 : !await file2.exists(read2)) return;
+    const ctype = mimeOf(ctx.url.pathname) || meta2?.type || void 0;
     const headers2 = {
       "cache-control": resolveCache(ctx.options.cache) ?? DEFAULT_CACHE
     };
@@ -2142,10 +2179,10 @@ async function assets(ctx) {
           ...headers2,
           "content-range": `bytes ${start}-${end}/${meta2.size}`,
           "content-length": String(end - start + 1)
-        }).send(file2.slice(start, end + 1).stream());
+        }).send(file2.slice(start, end + 1).stream(read2));
       }
     }
-    return type(ctype).headers(headers2).send(file2.stream());
+    return type(ctype).headers(headers2).send(file2.stream(read2));
   } catch {
   }
 }
@@ -2213,7 +2250,10 @@ var generateOpenApiPaths = async (handlers, specPath) => {
         const schema = await toJsonSchema(meta2.response);
         if (schema) {
           responses = {
-            200: { description: "OK", content: { "application/json": { schema } } }
+            200: {
+              description: "OK",
+              content: { "application/json": { schema } }
+            }
           };
         }
       }
@@ -2354,70 +2394,6 @@ async function socketUser(app, headers2, cookies2) {
   return app.settings.auth.user(ctx);
 }
 
-// src/http/cors.ts
-var localhost = /^https?:\/\/localhost(:\d+)?$/;
-function cors(config2, origin = "") {
-  origin = origin?.toLowerCase();
-  if (config2 === true) return origin || null;
-  if (config2 === "*") return "*";
-  if (!origin) return null;
-  if (localhost.test(origin)) return origin;
-  const arr = typeof config2 === "string" ? config2.split(/\s*,\s*/g) : [];
-  if (arr.includes(origin)) return origin;
-  console.warn(`CORS: Origin "${origin}" not allowed. Allowed "${config2}"`);
-  return null;
-}
-function applyCors(res, ctx) {
-  const settings = ctx.options.cors;
-  if (!settings) return;
-  const requestOrigin = ctx.headers.origin || "";
-  let origin = cors(settings.origin, requestOrigin);
-  if (!origin) return;
-  if (settings.credentials && origin === "*") {
-    if (!requestOrigin) return;
-    origin = requestOrigin.toLowerCase();
-  }
-  res.headers.set("Access-Control-Allow-Origin", origin);
-  res.headers.set("Access-Control-Allow-Methods", settings.methods);
-  res.headers.set("Access-Control-Allow-Headers", settings.headers);
-  if (settings.credentials) {
-    res.headers.set("Access-Control-Allow-Credentials", "true");
-  }
-  if (origin !== "*") res.headers.append("Vary", "Origin");
-  if (ctx.method === "options") {
-    res.headers.set("Access-Control-Max-Age", "86400");
-  }
-}
-
-// src/pipeline/parseResponse.ts
-async function parseResponse(out, ctx) {
-  if (!out && typeof out !== "string") return null;
-  if (typeof out === "function") {
-    out = await out(ctx);
-    if (!out && typeof out !== "string") return null;
-  }
-  if (typeof out === "number") {
-    return new Response(null, { status: out });
-  }
-  if (!(out instanceof Response) || out.url) {
-    out = await send(out);
-  }
-  return out;
-}
-async function finalize(out, ctx) {
-  applyCors(out, ctx);
-  applySecurity(out, ctx);
-  out = await applyCache(out, ctx);
-  const stale = toClear(ctx);
-  if (stale) {
-    out.headers.append("set-cookie", clearCookie(stale));
-  }
-  if (ctx.time?.times?.length > 1) {
-    out.headers.set("Server-Timing", ctx.time.headers());
-  }
-  return out;
-}
-
 // src/body/bodyParts.ts
 var asIterable = (s) => s;
 function getMatching(string, regex) {
@@ -2432,8 +2408,6 @@ function isProbablyText(buffer) {
   }
   return true;
 }
-var extByMime = {};
-for (const ext in mimes_default) extByMime[mimes_default[ext]] = ext;
 function addField(body, name, value) {
   if (body[name] === void 0) {
     body[name] = value;
@@ -2442,7 +2416,7 @@ function addField(body, name, value) {
   if (!Array.isArray(body[name])) body[name] = [body[name]];
   body[name].push(value);
 }
-function makeFilePart(name, filename, declared, bucket2, limits, budget) {
+function makeFilePart(name, filename, declared, bucket2, limits, budget, signal) {
   return {
     kind: "file",
     name,
@@ -2451,13 +2425,14 @@ function makeFilePart(name, filename, declared, bucket2, limits, budget) {
     bucket: bucket2,
     limits,
     budget,
+    signal,
     head: [],
     headSize: 0,
     opened: null,
     size: 0
   };
 }
-function startPart(headerStr, bucket2, limits, budget) {
+function startPart(headerStr, bucket2, limits, budget, signal) {
   const name = getMatching(headerStr, /name="(.+?)"/).trim().replace(/\[\]$/, "");
   if (!name) return { kind: "skip" };
   const filename = getMatching(headerStr, /filename="(.+?)"/).trim();
@@ -2470,7 +2445,7 @@ function startPart(headerStr, bucket2, limits, budget) {
   if (maxFiles != null && budget.files > maxFiles) {
     throw errors_default.UPLOAD_TOO_MANY_FILES({ limit: String(maxFiles) });
   }
-  return makeFilePart(name, filename, type2, bucket2, limits, budget);
+  return makeFilePart(name, filename, type2, bucket2, limits, budget, signal);
 }
 async function abortFile(part, error) {
   if (part.opened) {
@@ -2480,8 +2455,6 @@ async function abortFile(part, error) {
       });
     } catch {
     }
-    await part.opened.file.remove().catch(() => {
-    });
   }
   throw error;
 }
@@ -2514,16 +2487,17 @@ function openFile(part) {
   const sniffed = sniff(head);
   const type2 = resolveType(sniffed, part.declared);
   validateFile(part.filename, type2, part.limits, sniffed);
-  const ext = sniffed ? extByMime[type2] : void 0;
-  const id = `${createId()}${ext ? `.${ext}` : ""}`;
   let controller;
   const readable = new ReadableStream({
     start(c) {
       controller = c;
     }
   });
-  const file2 = part.bucket.file(id);
-  part.opened = { type: type2, file: file2, controller, write: file2.write(readable, { type: type2 }) };
+  part.opened = {
+    type: type2,
+    controller,
+    write: part.bucket.create(readable, { type: type2, signal: part.signal })
+  };
 }
 async function feedPart(part, data) {
   if (data.length === 0) return;
@@ -2566,10 +2540,10 @@ async function endPart(part, body) {
   }
   const opened = part.opened;
   opened.controller.close();
-  await opened.write;
+  const file2 = await opened.write;
   const { minSize } = part.limits;
   if (minSize != null && part.size < parseBytes(minSize)) {
-    await opened.file.remove().catch(() => {
+    await file2.remove().catch(() => {
     });
     throw errors_default.UPLOAD_TOO_SMALL({
       name: part.filename,
@@ -2579,7 +2553,7 @@ async function endPart(part, body) {
   }
   addField(body, part.name, {
     name: part.filename,
-    path: opened.file.path,
+    path: file2.path,
     type: opened.type,
     size: part.size
   });
@@ -2599,7 +2573,7 @@ function getBoundary(header) {
   return null;
 }
 var BREAK = Buffer.from("\r\n\r\n");
-async function parseMultipart(stream, boundary, bucket2, limits, max = INF) {
+async function parseMultipart(stream, boundary, bucket2, limits, max = INF, signal) {
   const budget = { used: 0, max: INF, files: 0 };
   const delim = Buffer.from(`\r
 --${boundary}`);
@@ -2637,7 +2611,13 @@ async function parseMultipart(stream, boundary, bucket2, limits, max = INF) {
       } else if (state === "headers") {
         const i = buf.indexOf(BREAK);
         if (i === -1) break;
-        part = startPart(buf.subarray(0, i).toString("utf-8"), bucket2, limits, budget);
+        part = startPart(
+          buf.subarray(0, i).toString("utf-8"),
+          bucket2,
+          limits,
+          budget,
+          signal
+        );
         buf = buf.subarray(i + BREAK.length);
         state = "body";
         advanced = true;
@@ -2700,12 +2680,16 @@ function parseUrlEncoded(text) {
   }
   return out;
 }
-async function streamRawToBucket(stream, type2, bucket2, limits) {
-  const part = makeFilePart("body", "upload", type2, bucket2, limits, {
-    used: 0,
-    max: INF,
-    files: 0
-  });
+async function streamRawToBucket(stream, type2, bucket2, limits, signal) {
+  const part = makeFilePart(
+    "body",
+    "upload",
+    type2,
+    bucket2,
+    limits,
+    { used: 0, max: INF, files: 0 },
+    signal
+  );
   for await (const chunk of asIterable(stream)) {
     await feedPart(part, Buffer.from(chunk));
   }
@@ -2713,7 +2697,7 @@ async function streamRawToBucket(stream, type2, bucket2, limits) {
   await endPart(part, body);
   return part.size ? body.body : void 0;
 }
-async function parseBody(input, contentType, dest, max = INF, length) {
+async function parseBody(input, contentType, dest, max = INF, length, signal) {
   const type2 = Array.isArray(contentType) ? contentType[0] : contentType;
   let bucket2;
   let limits = {};
@@ -2727,7 +2711,14 @@ async function parseBody(input, contentType, dest, max = INF, length) {
   if (type2 && /multipart\/form-data/i.test(type2)) {
     const boundary = getBoundary(type2);
     if (!boundary) throw errors_default.BODY_INVALID_MULTIPART();
-    return parseMultipart(toStream(input), boundary, bucket2, limits, max);
+    return parseMultipart(
+      toStream(input),
+      boundary,
+      bucket2,
+      limits,
+      max,
+      signal
+    );
   }
   if (!type2 || /^text\//i.test(type2)) {
     const buf = await toBuffer(input, max);
@@ -2745,7 +2736,8 @@ async function parseBody(input, contentType, dest, max = INF, length) {
     const buf = await toBuffer(input, max);
     return buf.length ? buf : void 0;
   }
-  if (!bucket2) throw errors_default.UPLOAD_NOT_CONFIGURED({ name: "the request body" });
+  if (!bucket2)
+    throw errors_default.UPLOAD_NOT_CONFIGURED({ name: "the request body" });
   const { maxFileSize } = limits;
   if (length != null && maxFileSize != null && length > parseBytes(maxFileSize)) {
     throw errors_default.UPLOAD_TOO_LARGE({
@@ -2754,7 +2746,7 @@ async function parseBody(input, contentType, dest, max = INF, length) {
       limit: String(maxFileSize)
     });
   }
-  return streamRawToBucket(toStream(input), type2, bucket2, limits);
+  return streamRawToBucket(toStream(input), type2, bucket2, limits, signal);
 }
 
 // src/body/body.ts
@@ -2796,7 +2788,8 @@ async function resolveBody(ctx, mode = "parse", max = resolveMax(void 0)) {
     ctx.headers["content-type"],
     ctx.options.uploads,
     max,
-    Number.isFinite(declared) ? declared : void 0
+    Number.isFinite(declared) ? declared : void 0,
+    ctx.signal
   );
   if (size && !ctx.headers["content-length"]) {
     ctx.headers["content-length"] = String(size);
@@ -2804,6 +2797,21 @@ async function resolveBody(ctx, mode = "parse", max = resolveMax(void 0)) {
   return parsed;
 }
 
+// src/context/isValidMethod.ts
+var methods = [
+  "get",
+  "post",
+  "put",
+  "patch",
+  "delete",
+  "head",
+  "options",
+  "socket"
+];
+function isValidMethod(method) {
+  return methods.includes(method);
+}
+
 // src/util/define.ts
 function define(obj, key, cb) {
   Object.defineProperty(obj, key, {
@@ -2820,6 +2828,70 @@ function define(obj, key, cb) {
   });
 }
 
+// src/http/cors.ts
+var localhost = /^https?:\/\/localhost(:\d+)?$/;
+function cors(config2, origin = "") {
+  origin = origin?.toLowerCase();
+  if (config2 === true) return origin || null;
+  if (config2 === "*") return "*";
+  if (!origin) return null;
+  if (localhost.test(origin)) return origin;
+  const arr = typeof config2 === "string" ? config2.split(/\s*,\s*/g) : [];
+  if (arr.includes(origin)) return origin;
+  console.warn(`CORS: Origin "${origin}" not allowed. Allowed "${config2}"`);
+  return null;
+}
+function applyCors(res, ctx) {
+  const settings = ctx.options.cors;
+  if (!settings) return;
+  const requestOrigin = ctx.headers.origin || "";
+  let origin = cors(settings.origin, requestOrigin);
+  if (!origin) return;
+  if (settings.credentials && origin === "*") {
+    if (!requestOrigin) return;
+    origin = requestOrigin.toLowerCase();
+  }
+  res.headers.set("Access-Control-Allow-Origin", origin);
+  res.headers.set("Access-Control-Allow-Methods", settings.methods);
+  res.headers.set("Access-Control-Allow-Headers", settings.headers);
+  if (settings.credentials) {
+    res.headers.set("Access-Control-Allow-Credentials", "true");
+  }
+  if (origin !== "*") res.headers.append("Vary", "Origin");
+  if (ctx.method === "options") {
+    res.headers.set("Access-Control-Max-Age", "86400");
+  }
+}
+
+// src/pipeline/parseResponse.ts
+async function parseResponse(out, ctx) {
+  if (!out && typeof out !== "string") return null;
+  if (typeof out === "function") {
+    out = await out(ctx);
+    if (!out && typeof out !== "string") return null;
+  }
+  if (typeof out === "number") {
+    return new Response(null, { status: out });
+  }
+  if (!(out instanceof Response) || out.url) {
+    out = await send(out);
+  }
+  return out;
+}
+async function finalize(out, ctx) {
+  applyCors(out, ctx);
+  applySecurity(out, ctx);
+  out = await applyCache(out, ctx);
+  const stale = toClear(ctx);
+  if (stale) {
+    out.headers.append("set-cookie", clearCookie(stale));
+  }
+  if (ctx.time?.times?.length > 1) {
+    out.headers.set("Server-Timing", ctx.time.headers());
+  }
+  return out;
+}
+
 // src/errors/ValidationError.ts
 var ValidationError = class extends errors_default {
   source;
@@ -2862,21 +2934,6 @@ function replace2(target2, values) {
   Object.assign(target2, values);
 }
 
-// src/context/isValidMethod.ts
-var methods = [
-  "get",
-  "post",
-  "put",
-  "patch",
-  "delete",
-  "head",
-  "options",
-  "socket"
-];
-function isValidMethod(method) {
-  return methods.includes(method);
-}
-
 // src/pipeline/handleRequest.ts
 async function handleRequest(app, ctx) {
   let res = await getResponse(app, ctx);
@@ -2943,6 +3000,7 @@ async function getResponse(app, ctx) {
     if (ctx.platform.provider === "netlify") return;
     throw errors_default.NOT_FOUND();
   } catch (error) {
+    if (ctx.signal.aborted) return;
     return ctx.options.onError(error, ctx);
   }
 }
@@ -2984,6 +3042,11 @@ var parseHeaders_default = (raw) => {
 
 // src/context/writeResponse.ts
 async function writeResponse(out, response) {
+  if (response.destroyed || response.writableEnded) {
+    out.body?.cancel().catch(() => {
+    });
+    return;
+  }
   response.writeHead(out.status || 200, parseHeaders_default(out.headers));
   try {
     if (out.body instanceof ReadableStream) {
@@ -3240,7 +3303,14 @@ function forwarded(url, headers2, trustProxy) {
 }
 
 // src/context/create.ts
-function createContext(app, { method: rawMethod, headers: rawHeaders, url: rawUrl, signal, remoteAddress, source }) {
+function createContext(app, {
+  method: rawMethod,
+  headers: rawHeaders,
+  url: rawUrl,
+  signal,
+  remoteAddress,
+  source
+}) {
   const init = performance.now();
   const method = rawMethod?.toLowerCase() || "get";
   const headers2 = parseHeaders_default(rawHeaders);
@@ -3354,7 +3424,8 @@ var Node = async (app) => {
         response.end("Server Error");
         return;
       }
-      await writeResponse(out, response);
+      if (out) await writeResponse(out, response);
+      else if (!response.destroyed) response.destroy();
     }
   );
   await attachWebsocket(server2, app);
@@ -3384,8 +3455,27 @@ function isSerializable(body) {
   if (body instanceof URLSearchParams) return false;
   return true;
 }
+var deletes = (attrs) => attrs.some((attr) => {
+  const [rawKey, value = ""] = attr.split("=");
+  const key = rawKey.trim().toLowerCase();
+  if (key === "max-age") return Number(value) <= 0;
+  if (key === "expires")
+    return new Date(value.trim()).getTime() <= Date.now();
+  return false;
+});
 function ServerTest(app) {
   const port = app.settings.port;
+  const jar = /* @__PURE__ */ new Map();
+  const keep = (res) => {
+    for (const line of res.headers.getSetCookie?.() ?? []) {
+      const [pair, ...attrs] = line.split(";");
+      const eq = pair.indexOf("=");
+      if (eq === -1) continue;
+      const name = pair.slice(0, eq).trim();
+      if (deletes(attrs)) jar.delete(name);
+      else jar.set(name, pair.slice(eq + 1).trim());
+    }
+  };
   const fetch2 = async (method, path, options = {}) => {
     const headers2 = new Headers(options.headers);
     let body = options.body;
@@ -3393,13 +3483,17 @@ function ServerTest(app) {
       headers2.set("content-type", "application/json");
       body = JSON.stringify(body);
     }
+    if (jar.size && !headers2.has("cookie")) {
+      const sent = [...jar].map(([name, value]) => `${name}=${value}`);
+      headers2.set("cookie", sent.join("; "));
+    }
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path) && !/^https?:\/\//i.test(path)) {
       throw new Error(
         `Only http(s) URLs can be tested, received "${path}". Pass a path, or the full URL of the host the request should hit.`
       );
     }
     const url = /^https?:\/\//i.test(path) ? path : `http://localhost:${port}${path}`;
-    return await app.fetch(
+    const res = await app.fetch(
       new Request(url, {
         ...options,
         method,
@@ -3407,6 +3501,8 @@ function ServerTest(app) {
         body
       })
     );
+    if (res) keep(res);
+    return res;
   };
   return {
     get: (path, options) => fetch2("get", path, options),
@@ -3415,7 +3511,12 @@ function ServerTest(app) {
     put: (path, body, options) => fetch2("put", path, { body, ...options }),
     patch: (path, body, options) => fetch2("patch", path, { body, ...options }),
     delete: (path, options) => fetch2("delete", path, options),
-    options: (path, options) => fetch2("options", path, options)
+    options: (path, options) => fetch2("options", path, options),
+    // The cookies the app has set so far, and a fresh session on demand
+    get cookies() {
+      return Object.fromEntries(jar);
+    },
+    clear: () => jar.clear()
   };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.49.0",
+  "version": "0.49.2",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",
@@ -14,11 +14,11 @@
   ],
   "scripts": {
     "build": "bunx tsup src/index.ts --format esm --dts --out-dir . --target node24 --external zod --external @valibot/to-json-schema",
-    "prepare": "mkdir -p node_modules/@server && ln -sfn ../.. node_modules/@server/next",
+    "postinstall": "mkdir -p node_modules/@server && ln -sfn ../.. node_modules/@server/next",
     "start": "bun test --watch",
-    "lint": "npx tsc --noEmit && npx @biomejs/biome lint ./src --error-on-warnings",
-    "test": "npm run test:bun && npm run lint",
-    "test:bun": "bun test src demo"
+    "lint": "npm run prettier && npx tsc --noEmit && npx @biomejs/biome lint ./src --error-on-warnings",
+    "prettier": "prettier --write ./src",
+    "test": "bun test src demo"
   },
   "main": "index.js",
   "type": "module",
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "antarctic": "^0.6.0",
-    "bucket": "^0.7.1"
+    "bucket": "^0.10.1"
   },
   "devDependencies": {
     "@types/bun": "^1.3.0",
@@ -75,6 +75,7 @@
     "arktype": "^2.2.3",
     "bun": "^1.3.13",
     "check-dts": "^0.8.2",
+    "prettier": "^3.9.6",
     "tsup": "^8.5.1",
     "typescript": "^6.0.2",
     "valibot": "^1.4.2",

package/readme.md

@@ -7,7 +7,7 @@ npm install @server/next
 ```
 
 ```js
-import server from '@server/next';
+import server from "@server/next";
 
 export default server({ uploads: './uploads' })
   .get('/', () => 'Hello world')
@@ -15,24 +15,26 @@ export default server({ uploads: './uploads' })
   .post('/avatar', (ctx) => ctx.body.avatar.path);
 ```
 
-Key-value stores and file storage come included, so logins work out of the box and `uploads` takes a folder path. For Redis, S3 and the rest, pass the client straight in:
+File storage comes included, so `uploads` takes a folder path or any bucket. Auth stores nothing of its own: two callbacks put the user wherever you already keep data.
 
 ```js
-import server, { bucket, kv } from '@server/next';
-import { createClient } from 'redis';
+import server, { bucket } from "@server/next";
+import { createClient } from "redis";
 
-const redis = kv(createClient({ url }));
-const uploads = bucket.S3('my-bucket', { id, key });
+const redis = await createClient({ url }).connect();
+const uploads = bucket.S3('my-bucket', { id, secret });
 
 export default server({
   uploads,
   auth: {
-    strategy: 'cookie',
     providers: ['github'],
-    users: redis.prefix('user:'),
-    sessions: redis.prefix('session:'),
+    onLogin: async (profile) => {
+      await redis.set(`user:${profile.id}`, JSON.stringify(profile));
+      return profile.id;
+    },
+    getUser: async (id) => JSON.parse(await redis.get(`user:${id}`)),
   },
 });
 ```
 
-See the [full documentation](https://serverjs.io/documentation).
+See the [full documentation](https://server-js.com/documentation).

package/src/jsx/jsx-runtime.js

@@ -47,18 +47,20 @@ const minifyCss = (str) => {
   // squeezed, then put back. Comments go first and unconditionally, so one
   // written inside a string is stripped along with the rest.
   const quoted = [];
-  return str
-    .replace(/\/\*[\s\S]*?\*\//g, "")
-    .replace(
-      /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g,
-      (match) => `\0${quoted.push(match) - 1}\0`,
-    )
-    .replace(/\s+/g, " ")
-    // `+` is left out on purpose for `calc(100% + 10px)`
-    .replace(/\s*([{}:;,>~])\s*/g, "$1")
-    .replace(/;}/g, "}")
-    .replace(/\0(\d+)\0/g, (_, i) => quoted[i])
-    .trim();
+  return (
+    str
+      .replace(/\/\*[\s\S]*?\*\//g, "")
+      .replace(
+        /"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g,
+        (match) => `\0${quoted.push(match) - 1}\0`,
+      )
+      .replace(/\s+/g, " ")
+      // `+` is left out on purpose for `calc(100% + 10px)`
+      .replace(/\s*([{}:;,>~])\s*/g, "$1")
+      .replace(/;}/g, "}")
+      .replace(/\0(\d+)\0/g, (_, i) => quoted[i])
+      .trim()
+  );
 };
 
 // React element detection (safe for custom objects too)