@thoughtpivot/flight 2.0.1 → 3.0.0

package/src/bun/app.test.ts

@@ -0,0 +1,191 @@
+import { afterEach, expect, test } from 'bun:test'
+import { mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+
+import { openFlight, type FlightServer } from './app'
+import { loadConfig, type Config } from './config'
+import { safeTarget } from './static'
+
+const servers: FlightServer[] = []
+const dirs: string[] = []
+
+/**
+ * Remove temp apps and stop servers started by this file.
+ */
+afterEach(async () => {
+    while (servers.length) servers.pop()?.stop(true)
+    await Promise.all(dirs.splice(0).map((dir) => rm(dir, { recursive: true, force: true })))
+})
+
+/**
+ * Create an app root with a Koa backend, a Bun route fragment, a compiled `.backend.js`, and a tiny SPA.
+ */
+async function makeApp(): Promise<string> {
+    const dir = await mkdtemp(join(tmpdir(), 'flight-bun-'))
+    dirs.push(dir)
+    await symlink(join(import.meta.dir, '../../node_modules'), join(dir, 'node_modules'), 'dir')
+    await mkdir(join(dir, 'dist/assets'), { recursive: true })
+    await writeFile(join(dir, 'dist/index.html'), '<!doctype html><title>flight-spa</title>', 'utf8')
+    await writeFile(join(dir, 'dist/assets/app.js'), 'export const x = "asset"', 'utf8')
+    await writeFile(
+        join(dir, 'hello.backend.ts'),
+        `import Router from '@koa/router'
+const router = new Router()
+router.get('/hello', async (ctx) => {
+    ctx.body = { message: 'Hello from Flight!' }
+})
+router.post('/api/koa-echo', async (ctx) => {
+    ctx.body = { received: ctx.request.body }
+})
+export default router.routes()
+`
+    )
+    await writeFile(
+        join(dir, 'ping.backend.ts'),
+        `export default {
+    '/api/ping': { GET: () => Response.json({ ok: true }) },
+    '/api/login': {
+        POST: (req) => {
+            req.session.user = 'ada'
+            return Response.json({ ok: true })
+        }
+    },
+    '/api/me': { GET: (req) => Response.json({ user: req.session?.user ?? null }) },
+    '/api/cached': {
+        GET: () =>
+            new Response(JSON.stringify({ n: 1 }), {
+                headers: { 'content-type': 'application/json', 'cache-control': 'max-age=30' }
+            })
+    }
+}
+`
+    )
+    await writeFile(
+        join(dir, 'compiled.backend.js'),
+        `export default { '/api/from-js': { GET: () => Response.json({ from: 'js' }) } }
+`
+    )
+    return dir
+}
+
+/**
+ * Boot the Bun runtime against a throwaway app. Middleware that tests do not care about stays off.
+ */
+async function boot(env: Record<string, string>): Promise<{ server: FlightServer; url: string }> {
+    const appHome = env.FLIGHT_APP_HOME || (await makeApp())
+    const cfg: Config = loadConfig({
+        FLIGHT_MODE: 'production',
+        FLIGHT_LOGGING: 'false',
+        FLIGHT_CORS_ENABLED: 'false',
+        FLIGHT_SECURITY_ENABLED: 'false',
+        FLIGHT_COMPRESS_ENABLED: 'false',
+        FLIGHT_APP_HOME: appHome,
+        FLIGHT_DIST_PATH: join(appHome, 'dist'),
+        ...env,
+        FLIGHT_APP_HOME: env.FLIGHT_APP_HOME || appHome
+    })
+    const server = await openFlight(cfg, { port: 0, hostname: '127.0.0.1' })
+    servers.push(server)
+    return { server, url: `http://127.0.0.1:${server.port}` }
+}
+
+test('healthz, Bun routes, compiled backends, and Koa routes answer on one server', async () => {
+    const { url } = await boot({})
+
+    const health = await fetch(`${url}/healthz`)
+    expect(await health.text()).toBe('ok')
+
+    const ping = await fetch(`${url}/api/ping`, { headers: { accept: 'application/json' } })
+    expect(ping.status).toBe(200)
+    expect(await ping.json()).toEqual({ ok: true })
+
+    const fromJs = await fetch(`${url}/api/from-js`)
+    expect(await fromJs.json()).toEqual({ from: 'js' })
+
+    const hello = await fetch(`${url}/hello`)
+    expect(hello.status).toBe(200)
+    expect(await hello.json()).toEqual({ message: 'Hello from Flight!' })
+
+    const echo = await fetch(`${url}/api/koa-echo`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ name: 'ada' })
+    })
+    expect(echo.status).toBe(200)
+    expect(await echo.json()).toEqual({ received: { name: 'ada' } })
+})
+
+test('production SPA serves hashed assets and falls back to index.html', async () => {
+    const { url } = await boot({})
+
+    const asset = await fetch(`${url}/assets/app.js`)
+    expect(asset.status).toBe(200)
+    expect(await asset.text()).toContain('export const x')
+
+    const deep = await fetch(`${url}/dashboard/deep`, { headers: { accept: 'text/html' } })
+    expect(deep.status).toBe(200)
+    expect(deep.headers.get('content-type')).toContain('text/html')
+    expect(await deep.text()).toContain('flight-spa')
+
+    const apiMiss = await fetch(`${url}/api/missing`, { headers: { accept: 'text/html' } })
+    expect(apiMiss.status).toBe(404)
+    expect(await apiMiss.text()).not.toContain('flight-spa')
+
+    const escaped = await fetch(`${url}/%2e%2e/secret.txt`)
+    expect(escaped.status).toBe(404)
+    expect(await escaped.text()).not.toContain('flight-spa')
+    expect(safeTarget('/tmp/dist', '/../secret.txt')).toBeNull()
+    expect(safeTarget('/tmp/dist', '/assets/app.js')).toBe('/tmp/dist/assets/app.js')
+})
+
+test('rate limit uses the peer address unless the proxy is trusted', async () => {
+    const shared = {
+        FLIGHT_RATE_LIMIT_MAX: '1',
+        FLIGHT_RATE_LIMIT_DURATION_MS: '60000'
+    }
+    const locked = await boot(shared)
+    const first = await fetch(`${locked.url}/api/ping`, { headers: { 'x-forwarded-for': '203.0.113.5' } })
+    const spoofed = await fetch(`${locked.url}/api/ping`, { headers: { 'x-forwarded-for': '203.0.113.9' } })
+    expect(first.status).toBe(200)
+    expect(spoofed.status).toBe(429)
+
+    const trusted = await boot({ ...shared, FLIGHT_TRUST_PROXY: '1' })
+    const fromA = await fetch(`${trusted.url}/api/ping`, { headers: { 'x-forwarded-for': '203.0.113.5' } })
+    const fromB = await fetch(`${trusted.url}/api/ping`, { headers: { 'x-forwarded-for': '203.0.113.9' } })
+    expect(fromA.status).toBe(200)
+    expect(fromB.status).toBe(200)
+})
+
+test('static assets do not consume the API rate limit', async () => {
+    const { url } = await boot({ FLIGHT_RATE_LIMIT_MAX: '1' })
+    expect((await fetch(`${url}/assets/app.js`)).status).toBe(200)
+    expect((await fetch(`${url}/assets/app.js`)).status).toBe(200)
+    expect((await fetch(`${url}/api/ping`)).status).toBe(200)
+    expect((await fetch(`${url}/api/ping`)).status).toBe(429)
+})
+
+test('sessions round-trip through memory and through Redis', async () => {
+    const cases = [{}, { FLIGHT_REDIS_URL: 'redis://127.0.0.1:6379' }]
+    for (const extra of cases) {
+        const { url } = await boot({ FLIGHT_SESSION_SECRET: 'test-secret', ...extra })
+        const login = await fetch(`${url}/api/login`, { method: 'POST' })
+        expect(login.status).toBe(200)
+        const setCookie = login.headers.get('set-cookie')
+        expect(setCookie).toBeTruthy()
+        const me = await fetch(`${url}/api/me`, { headers: { cookie: setCookie!.split(';')[0] } })
+        expect(await me.json()).toEqual({ user: 'ada' })
+        const anon = await fetch(`${url}/api/me`)
+        expect(await anon.json()).toEqual({ user: null })
+    }
+})
+
+test('opt-in response cache serves the second GET from the store', async () => {
+    const { url } = await boot({ FLIGHT_CACHE_ENABLED: 'true' })
+    const miss = await fetch(`${url}/api/cached`, { headers: { accept: 'application/json' } })
+    expect(miss.headers.get('x-flight-cache')).toBe('MISS')
+    expect(await miss.json()).toEqual({ n: 1 })
+    const hit = await fetch(`${url}/api/cached`, { headers: { accept: 'application/json' } })
+    expect(hit.headers.get('x-flight-cache')).toBe('HIT')
+    expect(await hit.json()).toEqual({ n: 1 })
+})

package/src/bun/app.ts

@@ -0,0 +1,140 @@
+import { discoverBackends, type MethodMap } from './backends'
+import { cache } from './cache'
+import type { Config } from './config'
+import { createKoaDispatcher } from './koa-compat'
+import {
+    clientKey,
+    compose,
+    compress,
+    cors,
+    logger,
+    rateLimit,
+    security,
+    type AddressServer,
+    type Handler,
+    type Middleware
+} from './middleware'
+import { session } from './session'
+import { makeStaticHandler } from './static'
+import { createStore } from './store'
+
+/** Bun server handle returned by `openFlight`. */
+export interface FlightServer extends AddressServer {
+    port: number
+    stop(closeActiveConnections?: boolean): void
+}
+
+/**
+ * Wrap discovered routes so every method runs through the middleware onion.
+ * OPTIONS is registered when CORS is on, otherwise Bun answers 405 before our middleware runs.
+ */
+function wrapRoutes(
+    routes: Record<string, Handler | MethodMap>,
+    run: (req: Request, core: Handler) => Promise<Response>,
+    corsEnabled: boolean
+): Record<string, Handler | MethodMap> {
+    const wrapped: Record<string, Handler | MethodMap> = {}
+    for (const [path, value] of Object.entries(routes)) {
+        if (typeof value === 'function') {
+            const handler = value
+            wrapped[path] = (req: Request) => run(req, () => handler(req))
+        } else {
+            const methods: MethodMap = {}
+            for (const [method, handler] of Object.entries(value)) {
+                methods[method] = (req: Request) => run(req, () => handler(req))
+            }
+            if (corsEnabled && !methods.OPTIONS) {
+                methods.OPTIONS = (req: Request) => run(req, () => new Response(null, { status: 204 }))
+            }
+            wrapped[path] = methods
+        }
+    }
+    return wrapped
+}
+
+/**
+ * Build the Fetch application: Bun routes, Koa compatibility, and the SPA fallback.
+ */
+export async function createApp(cfg: Config, server?: () => AddressServer | undefined) {
+    const discovered = await discoverBackends(cfg.appHome, cfg.excludePaths)
+    const middlewares: Middleware[] = []
+    const enabled: string[] = []
+
+    if (cfg.logging) {
+        middlewares.push(logger())
+        enabled.push('logging')
+    }
+    if (cfg.security.enabled) {
+        middlewares.push(security(cfg.security))
+        enabled.push('security')
+    }
+    if (cfg.cors.enabled) {
+        middlewares.push(cors(cfg.cors))
+        enabled.push('cors')
+    }
+    if (cfg.rateLimit.enabled) {
+        middlewares.push(rateLimit(cfg.rateLimit, (req) => clientKey(req, cfg.rateLimit.trustProxy, server?.())))
+        enabled.push(`rateLimit(${cfg.rateLimit.max}/${cfg.rateLimit.durationMs}ms)`)
+    }
+    if (cfg.compression.enabled) {
+        middlewares.push(compress(cfg.compression))
+        enabled.push('compression')
+    }
+    if (cfg.session.enabled) {
+        middlewares.push(session(cfg.session, createStore(cfg.redisUrl, 'session')))
+        enabled.push('session')
+    }
+    if (cfg.cache.enabled) {
+        middlewares.push(cache(cfg.cache, createStore(cfg.redisUrl, 'cache')))
+        enabled.push('cache')
+    }
+
+    const run = compose(middlewares)
+    const routes = wrapRoutes(discovered.routes, run, cfg.cors.enabled)
+    routes['/healthz'] = () => new Response('ok')
+
+    const koa = discovered.koa.length > 0 ? await createKoaDispatcher(discovered.koa, cfg.payloadLimit) : null
+    const serveStatic = makeStaticHandler(cfg.distPath, cfg.mode, cfg.spaDenyPrefixes)
+
+    return {
+        enabled,
+        routes,
+        fetch: async (req: Request) => {
+            return run(req, async () => {
+                const fromKoa = koa ? await koa(req) : null
+                if (fromKoa) return fromKoa
+                return (await serveStatic(req)) ?? new Response('Not Found', { status: 404 })
+            })
+        },
+        error(err: unknown) {
+            console.error('flight-bun error:', err)
+            return new Response('Internal Server Error', { status: 500 })
+        }
+    }
+}
+
+/**
+ * Listen with Bun. The peer address is visible to the rate limiter after the server exists.
+ */
+export async function openFlight(
+    cfg: Config,
+    listen: { port?: number; hostname?: string } = {}
+): Promise<FlightServer> {
+    let server: FlightServer | undefined
+    const app = await createApp(cfg, () => server)
+    server = Bun.serve({
+        port: listen.port ?? cfg.port,
+        hostname: listen.hostname ?? cfg.hostname,
+        routes: app.routes as Record<string, Handler | MethodMap>,
+        fetch: app.fetch,
+        error: app.error
+    }) as FlightServer
+
+    const dist = cfg.mode === 'production' ? `, dist=${cfg.distPath}` : ''
+    console.log(
+        `flight-bun (${cfg.mode}) listening on :${server.port} — app_home=${cfg.appHome}${dist}\n` +
+            `flight-bun: middleware [${app.enabled.join(', ') || 'none'}]` +
+            (cfg.redisUrl ? `, redis=${cfg.redisUrl}` : ', redis=(in-memory)')
+    )
+    return server
+}

package/src/bun/backends.ts

@@ -0,0 +1,93 @@
+import { relative, sep } from 'node:path'
+
+import type { Handler } from './middleware'
+
+/** Method name to handler, as exported by a Bun-native `*.backend.ts` file. */
+export type MethodMap = Record<string, Handler>
+
+/** Path to a handler or a method map. This is the Bun-native backend contract. */
+export type RouteFragment = Record<string, Handler | MethodMap>
+
+/** Koa middleware: `(ctx, next) => Promise`. Existing Flight backends export this from `router.routes()`. */
+export type KoaMiddleware = (ctx: unknown, next: () => Promise<unknown>) => unknown
+
+/** Everything discovery found under an app root. */
+export interface DiscoveredBackends {
+    routes: Record<string, Handler | MethodMap>
+    koa: KoaMiddleware[]
+}
+
+/**
+ * True when every key is a URL path. That is the Bun route-fragment shape.
+ */
+function isRouteFragment(value: object): boolean {
+    const keys = Object.keys(value)
+    return keys.length > 0 && keys.every((key) => key.startsWith('/'))
+}
+
+/**
+ * Discover `*.backend.ts` and `*.backend.js` under `appHome`.
+ * An object whose keys are paths is the Bun contract. A function, or an object with `.routes()`,
+ * is the existing Koa contract and is kept so current apps can boot on Bun without a rewrite.
+ */
+export async function discoverBackends(appHome: string, excludePaths: string[]): Promise<DiscoveredBackends> {
+    const routes: Record<string, Handler | MethodMap> = {}
+    const koa: KoaMiddleware[] = []
+    const excluded = new Set(excludePaths)
+
+    for (const pattern of ['**/*.backend.ts', '**/*.backend.js']) {
+        const glob = new Bun.Glob(pattern)
+        for await (const abs of glob.scan({ cwd: appHome, absolute: true, onlyFiles: true })) {
+            const rel = relative(appHome, abs)
+            if (excluded.has(rel.split(sep)[0])) continue
+
+            let mod: { default?: unknown }
+            try {
+                mod = await import(abs)
+            } catch (err) {
+                console.error(`flight-bun: failed to load ${rel}:`, err)
+                continue
+            }
+
+            const exported = mod.default
+            if (!exported) {
+                console.warn(`flight-bun: ${rel} has no default export — skipping`)
+                continue
+            }
+
+            if (typeof exported === 'function') {
+                koa.push(exported as KoaMiddleware)
+                console.log(`flight-bun: mounted Koa backend ${rel}`)
+                continue
+            }
+
+            if (typeof exported === 'object') {
+                const record = exported as Record<string, unknown>
+                if (typeof record.routes === 'function' && !isRouteFragment(record)) {
+                    koa.push(record.routes() as KoaMiddleware)
+                    console.log(`flight-bun: mounted Koa router ${rel}`)
+                    continue
+                }
+                if (isRouteFragment(record)) {
+                    for (const [path, methods] of Object.entries(record)) {
+                        if (typeof methods === 'function') {
+                            routes[path] = methods as Handler
+                        } else if (methods && typeof methods === 'object') {
+                            const existing = routes[path]
+                            routes[path] = {
+                                ...(typeof existing === 'object' ? existing : {}),
+                                ...(methods as MethodMap)
+                            }
+                        }
+                    }
+                    console.log(`flight-bun: mounted backend ${rel}`)
+                    continue
+                }
+            }
+
+            console.warn(`flight-bun: ${rel} default export is not a route fragment or Koa middleware — skipping`)
+        }
+    }
+
+    return { routes, koa }
+}

package/src/bun/cache.ts

@@ -0,0 +1,56 @@
+import type { CacheConfig } from './config'
+import { withHeaders, type Middleware } from './middleware'
+import type { KVStore } from './store'
+
+/** Stored GET response. Only text and JSON bodies are kept. */
+interface CachedEntry {
+    status: number
+    headers: [string, string][]
+    body: string
+}
+
+/**
+ * Cache GET responses that opt in with `Cache-Control: max-age`.
+ * Hits and misses are marked with `X-Flight-Cache`.
+ */
+export function cache(cfg: CacheConfig, store: KVStore): Middleware {
+    return async (req, next) => {
+        if (req.method !== 'GET' && req.method !== 'HEAD') return next()
+
+        const url = new URL(req.url)
+        const key = `cash:${url.pathname}${url.search}`
+        const hit = await store.get(key)
+        if (hit) {
+            try {
+                const entry = JSON.parse(hit) as CachedEntry
+                const headers = new Headers(entry.headers)
+                headers.set('x-flight-cache', 'HIT')
+                return new Response(req.method === 'HEAD' ? null : entry.body, {
+                    status: entry.status,
+                    headers
+                })
+            } catch {
+                // A corrupt entry is regenerated below.
+            }
+        }
+
+        const response = await next()
+        const cacheControl = response.headers.get('cache-control') || ''
+        const match = /max-age=(\d+)/.exec(cacheControl)
+        if (response.status === 200 && match && req.method === 'GET') {
+            const ttl = Math.min(Number(match[1]), cfg.maxTtl)
+            const contentType = response.headers.get('content-type') || ''
+            if (ttl > 0 && /^(text\/|application\/(json|javascript)|application\/.*\+json)/i.test(contentType)) {
+                const body = await response.clone().text()
+                const entry: CachedEntry = {
+                    status: 200,
+                    headers: [...response.headers.entries()],
+                    body
+                }
+                await store.set(key, JSON.stringify(entry), ttl)
+            }
+        }
+
+        return withHeaders(response, { 'x-flight-cache': 'MISS' })
+    }
+}

package/src/bun/config.ts

@@ -0,0 +1,163 @@
+import { join, resolve } from 'node:path'
+
+/** CORS settings for the Bun runtime. */
+export interface CorsConfig {
+    enabled: boolean
+    origin: string
+    methods: string
+    headers: string
+    credentials: boolean
+    maxAge: number
+}
+
+/** Security-header settings. Content-Security-Policy stays app-specific. */
+export interface SecurityConfig {
+    enabled: boolean
+    hsts: boolean
+    hstsMaxAge: number
+}
+
+/** Gzip settings. Bodies smaller than `threshold` are left unchanged. */
+export interface CompressionConfig {
+    enabled: boolean
+    threshold: number
+}
+
+/** Fixed-window rate limit. Off unless `max` is greater than zero. */
+export interface RateLimitConfig {
+    enabled: boolean
+    max: number
+    durationMs: number
+    trustProxy: boolean
+    skipPrefixes: string[]
+}
+
+/** Signed-cookie sessions. Disabled until a secret is set. */
+export interface SessionConfig {
+    enabled: boolean
+    secret: string
+    cookie: string
+    ttlSec: number
+}
+
+/** Opt-in response cache. Handlers opt in with `Cache-Control: max-age`. */
+export interface CacheConfig {
+    enabled: boolean
+    maxTtl: number
+}
+
+/** Resolved Flight Bun configuration. */
+export interface Config {
+    mode: string
+    port: number
+    hostname: string
+    appHome: string
+    distPath: string
+    excludePaths: string[]
+    spaDenyPrefixes: string[]
+    payloadLimit: string
+    logging: boolean
+    redisUrl?: string
+    cors: CorsConfig
+    security: SecurityConfig
+    compression: CompressionConfig
+    rateLimit: RateLimitConfig
+    session: SessionConfig
+    cache: CacheConfig
+}
+
+type Env = Record<string, string | undefined>
+
+/**
+ * Parse a boolean environment flag. Empty or missing values use the default.
+ */
+function bool(value: string | undefined, fallback: boolean): boolean {
+    if (value === undefined || value === '') return fallback
+    return value === '1' || value === 'true' || value === 'yes'
+}
+
+/**
+ * Parse a finite number. Empty or invalid values use the default.
+ */
+function num(value: string | undefined, fallback: number): number {
+    if (value === undefined || value === '') return fallback
+    const parsed = Number(value)
+    return Number.isFinite(parsed) ? parsed : fallback
+}
+
+/**
+ * Split a comma-separated prefix list and ensure each entry starts with `/`.
+ */
+function prefixes(value: string | undefined, fallback: string): string[] {
+    const raw = (value ?? fallback).trim()
+    if (!raw) return []
+    return raw
+        .split(',')
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .map((part) => (part.startsWith('/') ? part : `/${part}`))
+}
+
+/**
+ * Build a config object from an environment map.
+ * Defaults keep sessions, caching, and rate limiting off so a load test is not throttled by surprise.
+ */
+export function loadConfig(env: Env = process.env): Config {
+    const mode = env.FLIGHT_MODE || 'production'
+    const appHome = resolve(env.FLIGHT_APP_HOME || '.')
+    const sessionSecret = env.FLIGHT_SESSION_SECRET || ''
+    const rateMax = num(env.FLIGHT_RATE_LIMIT_MAX, 0)
+
+    return {
+        mode,
+        port: num(env.FLIGHT_PORT, 3000),
+        hostname: env.FLIGHT_HOSTNAME || '0.0.0.0',
+        appHome,
+        distPath: env.FLIGHT_DIST_PATH ? resolve(env.FLIGHT_DIST_PATH) : join(appHome, 'dist'),
+        excludePaths: (env.FLIGHT_EXCLUDE_PATHS || 'node_modules,dist')
+            .split(',')
+            .map((part) => part.trim())
+            .filter(Boolean),
+        spaDenyPrefixes: prefixes(env.FLIGHT_SPA_DENY_PREFIXES, '/api,/health,/healthz'),
+        payloadLimit: env.FLIGHT_PAYLOAD_LIMIT || '1mb',
+        logging: bool(env.FLIGHT_LOGGING, mode === 'development'),
+        redisUrl: env.FLIGHT_REDIS_URL || undefined,
+        cors: {
+            enabled: bool(env.FLIGHT_CORS_ENABLED, true),
+            origin: env.FLIGHT_CORS_ORIGIN || '*',
+            methods: env.FLIGHT_CORS_METHODS || 'GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS',
+            headers: env.FLIGHT_CORS_HEADERS || '',
+            credentials: bool(env.FLIGHT_CORS_CREDENTIALS, false),
+            maxAge: num(env.FLIGHT_CORS_MAX_AGE, 86400)
+        },
+        security: {
+            enabled: bool(env.FLIGHT_SECURITY_ENABLED, true),
+            hsts: bool(env.FLIGHT_HSTS, false),
+            hstsMaxAge: num(env.FLIGHT_HSTS_MAX_AGE, 15552000)
+        },
+        compression: {
+            enabled: bool(env.FLIGHT_COMPRESS_ENABLED, true),
+            threshold: num(env.FLIGHT_COMPRESS_THRESHOLD, 1024)
+        },
+        rateLimit: {
+            enabled: !bool(env.FLIGHT_RATE_LIMIT_DISABLE, false) && rateMax > 0,
+            max: rateMax,
+            durationMs: num(env.FLIGHT_RATE_LIMIT_DURATION_MS, 60000),
+            trustProxy: bool(env.FLIGHT_TRUST_PROXY, false),
+            skipPrefixes: [
+                ...prefixes(env.FLIGHT_STATIC_PREFIXES, '/assets,/fonts'),
+                ...prefixes(env.FLIGHT_RATE_LIMIT_EXCLUDE_PREFIXES, '')
+            ]
+        },
+        session: {
+            enabled: sessionSecret.length > 0,
+            secret: sessionSecret,
+            cookie: env.FLIGHT_SESSION_COOKIE || 'flight.sid',
+            ttlSec: num(env.FLIGHT_SESSION_TTL, 86400)
+        },
+        cache: {
+            enabled: bool(env.FLIGHT_CACHE_ENABLED, false),
+            maxTtl: num(env.FLIGHT_CACHE_MAX_TTL, 3600)
+        }
+    }
+}