@stacksjs/bun-router 0.1.4 → 0.1.6

package/dist/types/registry.d.ts

@@ -5,7 +5,23 @@ import type { BuiltInMiddleware } from '../types';
  * `../index`, which is the module an application can name in a
  * `declare module '@stacksjs/bun-router'` augmentation - see the note there.
  */
-export type FromRegistry<TKey extends string, TFallback> = TKey extends keyof RouterTypeRegistry ? (RouterTypeRegistry[TKey] extends TFallback ? RouterTypeRegistry[TKey] : TFallback) : TFallback;
+/**
+ * Read a key out of the registry, or fall back.
+ *
+ * `TKey extends keyof RouterTypeRegistry` is false while the interface is
+ * empty, which is what makes every fallback the default.
+ *
+ * `TShape` is checked separately from `TFallback`, and the distinction is
+ * load-bearing. It used to test the declared value against the fallback itself,
+ * which sounds like the same thing and is not: the fallback for an action path
+ * is the loose pattern `Actions/${string}Action`, and a real application's
+ * action list contains names like `'Actions/Dashboard/Library/GetFunctions'`
+ * that do not match it. So a correct, complete declaration failed the guard and
+ * fell back to the pattern - the feature looked wired up and checked nothing.
+ * The guard is meant to catch `actions: number`, so it asks whether the
+ * declared value is a string, and nothing more.
+ */
+export type FromRegistry<TKey extends string, TShape, TFallback> = TKey extends keyof RouterTypeRegistry ? (RouterTypeRegistry[TKey] extends TShape ? RouterTypeRegistry[TKey] : TFallback) : TFallback;
 /**
  * The action paths this application has, or the shape of one when it has not
  * said.
@@ -14,7 +30,7 @@ export type FromRegistry<TKey extends string, TFallback> = TKey extends keyof Ro
  * ending in `Action`, or a `Controller@method` reference. It catches a shape
  * mistake and nothing else, which is why declaring the real set is worth doing.
  */
-export type KnownActionPath = FromRegistry<'actions', `Actions/${string}Action` | `actions/${string}Action` | `${string}Controller@${string}`>;
+export type KnownActionPath = FromRegistry<'actions', string, `Actions/${string}Action` | `actions/${string}Action` | `${string}Controller@${string}`>;
 /**
  * The middleware aliases this application registers, or any string.
  *
@@ -23,7 +39,7 @@ export type KnownActionPath = FromRegistry<'actions', `Actions/${string}Action`
  * to the group - so the union has to contain both or the group form stops
  * type-checking the moment anything is declared.
  */
-export type KnownMiddlewareName = FromRegistry<'middleware', string>;
+export type KnownMiddlewareName = FromRegistry<'middleware', string, string>;
 /**
  * A middleware reference: an alias, or an alias with parameters.
  *
@@ -38,7 +54,7 @@ export type KnownMiddlewareName = FromRegistry<'middleware', string>;
  */
 export type MiddlewareReference = BuiltInMiddleware | `${BuiltInMiddleware}:${string}` | KnownMiddlewareName | `${KnownMiddlewareName}:${string}`;
 /** The named routes this application registers, as `name → path`. */
-export type KnownRoutes = FromRegistry<'routes', Record<string, string>>;
+export type KnownRoutes = FromRegistry<'routes', Record<string, string>, Record<string, string>>;
 /** The names of those routes, or any string when none are declared. */
 export type KnownRouteName = keyof KnownRoutes extends never ? string : Extract<keyof KnownRoutes, string>;
 /** The path a declared route name resolves to, or any path when it is not declared. */

package/dist/utils/decode-param.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Path params, decoded — once.
+ *
+ * The matchers took the raw path segment, so `/f/{name}` given
+ * `/f/caf%C3%A9` handed the handler the literal `caf%C3%A9`, and a space
+ * arrived as `%20`. Every consumer had to decode, which means every consumer
+ * that forgot had a bug, and the one framework that remembered
+ * (`@stacksjs/router`) had to do it in a wrapper.
+ *
+ * Doing it here rather than in a wrapper is what makes it exactly once. Two
+ * layers each calling `decodeURIComponent` turn `%2520` into a space, and a
+ * double decode is how a filter that rejects `../` gets walked past.
+ *
+ * Note for handlers: a decoded param CAN contain `/` (from `%2F`) — that is
+ * the point of encoding it — so anything joining a param into a filesystem
+ * path still has to sanitise. Decoding makes the value correct, not safe.
+ */
+export declare function decodeParam(value: string): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stacksjs/bun-router",
   "type": "module",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "A fast, type-safe router for Bun.",
   "author": "Chris Breuer <chris@stacksjs.org>",
   "license": "MIT",