akanjs 3.1.1 → 3.1.2-rc.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "akanjs",
-  "version": "3.1.1",
+  "version": "3.1.2-rc.0",
   "sourceType": "module",
   "type": "module",
   "publishConfig": {
@@ -206,6 +206,11 @@
       "import": "./server/lifecycle/portInUse.ts",
       "default": "./server/lifecycle/portInUse.ts"
     },
+    "./server/lifecycle/buildEnv": {
+      "types": "./types/server/lifecycle/buildEnv.d.ts",
+      "import": "./server/lifecycle/buildEnv.ts",
+      "default": "./server/lifecycle/buildEnv.ts"
+    },
     "./server/artifact/routeSeedIndexStore": {
       "types": "./types/server/artifact/routeSeedIndexStore.d.ts",
       "import": "./server/artifact/routeSeedIndexStore.ts",
@@ -250,32 +255,31 @@
   "dependencies": {
     "@lexical/plain-text": "^0.52.0",
     "@noble/ciphers": "^2.4.0",
+    "@react-spring/web": "^10.1.2",
+    "@use-gesture/react": "^10.3.1",
     "dayjs": "^1.11.23",
     "immer": "^11.1.21",
     "lexical": "^0.52.0",
+    "react-refresh": "^0.19.0",
+    "scheduler": "^0.28.0",
     "tailwind-merge": "^3.7.0",
+    "tailwind-scrollbar": "^4.0.2",
     "tailwind-variants": "^3.3.1"
   },
   "peerDependencies": {
-    "@happy-dom/global-registrator": "^21.0.3",
+    "@happy-dom/global-registrator": "^21.0.4",
     "@playwright/test": "^1.64.1",
-    "@react-spring/web": "^10.1.2",
-    "@use-gesture/react": "^10.3.1",
     "bullmq": "^5.81.5",
     "chance": "^1.1.13",
     "firebase": "^13.0.0",
-    "happy-dom": "^21.0.3",
+    "happy-dom": "^21.0.4",
     "ioredis": "^5.11.1",
     "postgres": "^3.4.9",
     "protobufjs": "^8.8.1",
     "react": "19.3.1",
     "react-dom": "19.3.1",
     "react-icons": "^5.7.0",
-    "react-refresh": "^0.19.0",
     "react-server-dom-webpack": "19.3.1",
-    "react-spring": "^10.0.4",
-    "scheduler": "^0.28.0",
-    "tailwind-scrollbar": "^4.0.2",
     "typescript": "^6.0.3"
   },
   "peerDependenciesMeta": {
@@ -285,12 +289,6 @@
     "@playwright/test": {
       "optional": true
     },
-    "@react-spring/web": {
-      "optional": true
-    },
-    "@use-gesture/react": {
-      "optional": true
-    },
     "bullmq": {
       "optional": true
     },
@@ -321,21 +319,9 @@
     "react-icons": {
       "optional": true
     },
-    "react-refresh": {
-      "optional": true
-    },
     "react-server-dom-webpack": {
       "optional": true
     },
-    "react-spring": {
-      "optional": true
-    },
-    "scheduler": {
-      "optional": true
-    },
-    "tailwind-scrollbar": {
-      "optional": true
-    },
     "typescript": {
       "optional": true
     }

package/server/akanApp.ts

@@ -1,14 +1,16 @@
 
+
+import "./lifecycle/loadBuildEnv";
 import { mkdir, readdir, rm } from "node:fs/promises";
 import path from "node:path";
-import { Logger } from "akanjs/common";
+import { Logger, TrustedProxy } from "akanjs/common";
 import type { AkanChildRole, AkanChildStatus, AkanIpcMessage, AkanMetricsReport, AkanUpstream } from "akanjs/service";
 import { getApiPrefix, getWsPrefix, normalizeRoutePrefix, resetEnvCache } from "../base/baseEnv";
 import { CrossSiteGuard } from "../signal/CrossSiteGuard";
 import { isTraceEnabled } from "../signal/trace";
 import { AKAN_CHILD_HOST, makeAkanChildProxyHeaders } from "./akanAppHeaders";
 import type { BuilderCsrReq, BuilderCsrRes, BuilderMessage, BuilderReq, BuilderRes } from "./artifact";
-import { type AssetHeaderOptions, assetHeaders } from "./assetHeaders";
+import { type AssetHeaderOptions, applySecurityHeaders, assetHeaders } from "./assetHeaders";
 import { compressResponse, compressStreamResponse, encodedFileResponse } from "./contentEncoding";
 import { isPortInUseError } from "./lifecycle/portInUse";
 import { resolveRuntimeDir } from "./lifecycle/runtimeDir";
@@ -24,6 +26,7 @@ import type { OpsRoute } from "./ops/opsRoute";
 import { StatusAccess } from "./ops/statusAccess";
 import { ProcessMetricsCollector } from "./processMetricsCollector";
 import { HostAllowlist } from "./routing/hostAllowlist";
+import { ServerLimits } from "./routing/serverLimits";
 import { WsUpgrade } from "./routing/wsUpgrade";
 import { SelfExec } from "./selfExec";
 import { resolveStaticPath } from "./staticPath";
@@ -59,6 +62,9 @@ interface SoloServer {
 interface GatewayWsData {
   childIdx: number;
   upstream: WebSocket;
+  clientIp: string | null;
+  pending: (string | ArrayBuffer)[];
+  pendingBytes: number;
 }
 
 type GatewayUpstream = {
@@ -147,6 +153,16 @@ export class AkanApp {
   #logStream: LogStreamRoute | null = null;
   #ops: OpsRoute | null = null;
   #hostAllowlist = HostAllowlist.fromEnv();
+  readonly #limits = new ServerLimits();
+  
+  static readonly #wsPendingLimitBytes = 1024 * 1024;
+  static readonly #wsUpstreamOpenTimeoutMs = 10_000;
+  readonly #wsCaps = {
+    total: AkanApp.#positiveIntEnv("AKAN_MAX_WEBSOCKETS"),
+    perIp: AkanApp.#positiveIntEnv("AKAN_MAX_WEBSOCKETS_PER_IP"),
+  };
+  #wsOpen = 0;
+  readonly #wsOpenByIp = new Map<string, number>();
   readonly #statusAccess = StatusAccess.fromEnv();
   static readonly #ansiPattern = new RegExp(`${String.fromCharCode(27)}\\[[0-?]*[ -/]*[@-~]`, "g");
   #gatewayMetrics: AkanMetricsReport = {};
@@ -600,12 +616,14 @@ export class AkanApp {
 
   #listen() {
     this.#server = Bun.serve({
-      idleTimeout: 0,
+      idleTimeout: this.#limits.idleTimeout,
+      maxRequestBodySize: this.#limits.uploadBodyBytes,
       port: this.#port,
-      hostname: process.env.AKAN_LISTEN_HOST || undefined,
-      fetch: (req, server) => this.#handleFetch(req, server),
+      hostname: ServerLimits.listenHostname(),
+      fetch: (req, server) =>
+        ServerLimits.holdOpen(server, req, this.#limits.idleTimeout, () => this.#handleFetch(req, server)),
       websocket: {
-        idleTimeout: 0,
+        idleTimeout: this.#limits.wsIdleTimeout,
         maxPayloadLength: 16 * 1024 * 1024,
         backpressureLimit: 1024 * 1024,
         closeOnBackpressureLimit: true,
@@ -620,19 +638,28 @@ export class AkanApp {
 
   async #handleFetch(req: Request, server: Bun.Server<GatewayWsData>): Promise<Response | undefined> {
     if (this.#hostAllowlist && !this.#hostAllowlist.allows(req)) return this.#hostAllowlist.refuse();
+    const oversized = this.#limits.refuseDeclared(req);
+    if (oversized) return oversized;
     const url = new URL(req.url);
-    if (url.pathname === "/_akan/app/health") return this.#statusAccess.health(req, () => this.#getHealthStatus());
-    if (url.pathname === "/_akan/app/metrics") return this.#statusAccess.metrics(req, () => this.#getMetricsStatus());
-    if (url.pathname === LogStreamRoute.path && this.#logStream) return this.#logStream.handle(req);
+    if (url.pathname === "/_akan/app/health")
+      return this.#statusAccess.health(req, () => this.#getHealthStatus(), AkanApp.#clientOf(req, server));
+    if (url.pathname === "/_akan/app/metrics")
+      return this.#statusAccess.metrics(req, () => this.#getMetricsStatus(), AkanApp.#clientOf(req, server));
+    if (url.pathname === LogStreamRoute.path && this.#logStream)
+      return this.#logStream.handle(req, AkanApp.#clientOf(req, server));
     if (url.pathname === "/_akan/bench/ping") return new Response("ok");
     if (url.pathname === AppInfo.publicPath) return AppInfo.handlePublic();
-    if (this.#ops?.matches(url.pathname)) return await this.#ops.handle(req);
+    if (this.#ops?.matches(url.pathname)) return await this.#ops.handle(req, AkanApp.#clientOf(req, server));
     if (this.#isWebSocketPath(url.pathname)) return this.#upgradeWebSocket(req, server);
     const assetResponse = await this.#serveImmutableArtifact(req, url);
     if (assetResponse) return assetResponse;
     return await this.#proxyHttp(req, server);
   }
 
+  static #clientOf(req: Request, server: Bun.Server<GatewayWsData>) {
+    return TrustedProxy.clientAddress(req.headers, server.requestIP(req)?.address);
+  }
+
   #isWebSocketPath(pathname: string) {
     return pathname === `${this.#prefix}${this.#websocketPrefix}` || pathname === "/_akan/hmr";
   }
@@ -672,40 +699,68 @@ export class AkanApp {
       return new Response("Forbidden", { status: 403 });
     }
     if (!WsUpgrade.isRequested(req)) return WsUpgrade.required();
+    const peer = server.requestIP(req) ?? undefined;
+    const clientIp = TrustedProxy.clientAddress(req.headers, peer?.address);
+    const refused = this.#refuseWebSocket(clientIp);
+    if (refused) return refused;
     const upstreamWs = new WebSocket(`ws://${upstream.host}:${upstream.port}${url.pathname}${url.search}`, {
-      headers: makeAkanChildProxyHeaders(req, child.idx, server.requestIP(req)),
+      headers: makeAkanChildProxyHeaders(req, child.idx, peer),
     } as unknown as string[]);
     
-    const upgraded = server.upgrade(req, { data: { childIdx: child.idx, upstream: upstreamWs } });
+    const upgraded = server.upgrade(req, {
+      data: { childIdx: child.idx, upstream: upstreamWs, clientIp, pending: [], pendingBytes: 0 },
+    });
     if (!upgraded) {
       upstreamWs.close();
       return new Response("WebSocket upgrade failed", { status: 500 });
     }
     child.metrics.activeWebSockets = (child.metrics.activeWebSockets ?? 0) + 1;
+    this.#wsOpen += 1;
+    if (clientIp) this.#wsOpenByIp.set(clientIp, (this.#wsOpenByIp.get(clientIp) ?? 0) + 1);
     return undefined;
   }
 
+  #refuseWebSocket(clientIp: string | null): Response | null {
+    const headers = { "cache-control": "no-store" };
+    if (this.#wsCaps.total && this.#wsOpen >= this.#wsCaps.total)
+      return new Response("Too many open websockets", { status: 503, headers });
+    if (this.#wsCaps.perIp && clientIp && (this.#wsOpenByIp.get(clientIp) ?? 0) >= this.#wsCaps.perIp)
+      return new Response("Too many open websockets from this address", { status: 429, headers });
+    return null;
+  }
+
+  static #positiveIntEnv(name: string): number | null {
+    const value = Number(process.env[name]);
+    return Number.isInteger(value) && value > 0 ? value : null;
+  }
+
   #handleWsOpen(ws: Bun.ServerWebSocket<GatewayWsData>) {
     const upstream = ws.data.upstream;
-    const pending: (string | ArrayBuffer)[] = [];
+    const openTimer =
+      upstream.readyState === WebSocket.CONNECTING
+        ? setTimeout(() => {
+            if (upstream.readyState === WebSocket.OPEN) return;
+            upstream.close();
+            ws.close(1013, "upstream websocket did not open");
+          }, AkanApp.#wsUpstreamOpenTimeoutMs)
+        : null;
     upstream.addEventListener("open", () => {
-      for (const message of pending.splice(0)) upstream.send(message);
+      if (openTimer) clearTimeout(openTimer);
+      for (const message of ws.data.pending.splice(0)) upstream.send(message);
+      ws.data.pendingBytes = 0;
     });
     upstream.addEventListener("message", (event) => {
       const result = ws.send(event.data as string | ArrayBuffer);
       if (result === 0) upstream.close();
     });
     upstream.addEventListener("close", (event) => {
+      if (openTimer) clearTimeout(openTimer);
       ws.close(relayableCloseCode(event.code), event.reason);
     });
     upstream.addEventListener("error", () => ws.close(1011, "upstream websocket error"));
-    Object.assign(ws.data, { pending });
   }
 
-  #handleWsMessage(
-    ws: Bun.ServerWebSocket<GatewayWsData & { pending?: (string | ArrayBuffer)[] }>,
-    message: string | ArrayBuffer | Uint8Array,
-  ) {
+  #handleWsMessage(ws: Bun.ServerWebSocket<GatewayWsData>, message: string | ArrayBuffer | Uint8Array) {
     const upstream = ws.data.upstream;
     const payload =
       typeof message === "string"
@@ -713,14 +768,29 @@ export class AkanApp {
         : message instanceof ArrayBuffer
           ? message
           : new Uint8Array(message).slice().buffer;
-    if (upstream.readyState === WebSocket.OPEN) upstream.send(payload);
-    else ws.data.pending?.push(payload as string | ArrayBuffer);
+    if (upstream.readyState === WebSocket.OPEN) {
+      upstream.send(payload);
+      return;
+    }
+    const size = typeof payload === "string" ? Buffer.byteLength(payload) : payload.byteLength;
+    if (ws.data.pendingBytes + size > AkanApp.#wsPendingLimitBytes) {
+      ws.data.pending.length = 0;
+      ws.close(1009, "too much data before the upstream opened");
+      return;
+    }
+    ws.data.pending.push(payload as string | ArrayBuffer);
+    ws.data.pendingBytes += size;
   }
 
   #handleWsClose(ws: Bun.ServerWebSocket<GatewayWsData>, code: number, reason: string) {
     ws.data.upstream.close(relayableCloseCode(code), reason);
     const child = this.#children.get(ws.data.childIdx);
     if (child) child.metrics.activeWebSockets = Math.max(0, (child.metrics.activeWebSockets ?? 1) - 1);
+    this.#wsOpen = Math.max(0, this.#wsOpen - 1);
+    const { clientIp } = ws.data;
+    const remaining = clientIp ? (this.#wsOpenByIp.get(clientIp) ?? 1) - 1 : 0;
+    if (clientIp && remaining > 0) this.#wsOpenByIp.set(clientIp, remaining);
+    else if (clientIp) this.#wsOpenByIp.delete(clientIp);
   }
 
   #getHealthStatus() {
@@ -779,23 +849,30 @@ export class AkanApp {
     const { socketPath } = child.upstream;
     const url = new URL(req.url);
     const upstreamUrl = `http://akan-child${url.pathname}${url.search}`;
-    const headers = makeAkanChildProxyHeaders(req, child.idx, server.requestIP(req));
+    const headers = makeAkanChildProxyHeaders(req, child.idx, server.requestIP(req) ?? undefined);
     child.metrics.activeRequests = (child.metrics.activeRequests ?? 0) + 1;
     child.metrics.totalRequests = (child.metrics.totalRequests ?? 0) + 1;
     const traced = isTraceEnabled();
     const hopStart = traced ? performance.now() : 0;
+    const chunkedLimit = req.headers.has("content-length") ? null : this.#limits.bodyLimitOf(req);
     try {
       const upstreamRes = await fetch(upstreamUrl, {
         unix: socketPath,
         method: req.method,
         headers,
-        body: req.method === "GET" || req.method === "HEAD" ? undefined : req.body,
+        body:
+          req.method === "GET" || req.method === "HEAD"
+            ? undefined
+            : chunkedLimit !== null && req.body
+              ? ServerLimits.limitBody(req.body, chunkedLimit)
+              : req.body,
         signal: req.signal,
         redirect: "manual",
         decompress: false,
       });
       return await this.#proxyResponse(req, upstreamRes);
     } catch (error) {
+      if (ServerLimits.isPayloadTooLarge(error)) return ServerLimits.payloadTooLarge();
       if (AkanApp.#isUpstreamOpenFailure(error)) {
         this.logger.error(`Child ${child.idx}/${child.role} upstream is unreachable (${socketPath}); restarting`);
         this.#scheduleChildRestart(child, child.proc, "upstream-open-failed");
@@ -844,13 +921,10 @@ export class AkanApp {
           detail,
           note: "The replica is restarting — this page reloads itself as soon as it answers.",
         }),
-        { status: 502, headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } },
+        { status: 502, headers: AkanApp.#statusHeaders("text/html; charset=utf-8") },
       );
     }
-    return new Response(detail, {
-      status: 502,
-      headers: { "content-type": "text/plain; charset=utf-8", "cache-control": "no-store" },
-    });
+    return new Response(detail, { status: 502, headers: AkanApp.#statusHeaders("text/plain; charset=utf-8") });
   }
 
   async #pickReadyFederationChild(req: Request): Promise<ChildState | null> {
@@ -895,7 +969,7 @@ export class AkanApp {
     if (req.headers.get("accept")?.includes("text/html")) {
       return new Response(AkanApp.#statusPageHtml(page), {
         status: 503,
-        headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" },
+        headers: AkanApp.#statusHeaders("text/html; charset=utf-8"),
       });
     }
     return AkanApp.#unavailableResponse(req, page.text);
@@ -910,6 +984,11 @@ export class AkanApp {
     );
   }
 
+  static #statusHeaders(contentType: string): Headers {
+    const headers = new Headers({ "content-type": contentType, "cache-control": "no-store" });
+    return applySecurityHeaders(headers, { html: contentType.startsWith("text/html") });
+  }
+
   static #statusPageHtml({ heading, detail, note }: { heading: string; detail: string; note: string }) {
     return `<!doctype html>
 <html>

package/server/akanServer.ts

@@ -49,6 +49,7 @@ import type { AppWsData } from "./routing/appWsData";
 import { HostAllowlist } from "./routing/hostAllowlist";
 import { RoomReplay } from "./routing/roomReplay";
 import { RouteHosts } from "./routing/routeHosts";
+import { ServerLimits } from "./routing/serverLimits";
 import { createSoloAppRoutes } from "./routing/soloAppRoutes";
 import {
   getWebConfigFromEnv,
@@ -443,6 +444,7 @@ export class AkanServer {
     this.logger.verbose(`${this.name} is serving on ${unix ? `unix://${unix}` : `port ${port}`}`);
     const { routes, routeOptions, wsRoutes, builtinRoutes, renderEnvRoutes, hmrHub, webRouter, webProxyRunner } =
       this.#prepared;
+    const limits = new ServerLimits();
     const websocketHandlers = {
       ...ApiRouter.buildWebsocketHandlers({
         wsRoutes,
@@ -459,11 +461,14 @@ export class AkanServer {
         logger: this.logger,
         onDrain: () => this.#binaryPubsub.flush(),
       }),
+      idleTimeout: limits.wsIdleTimeout,
       data: {},
     } as Bun.WebSocketHandler<AppWsData | HmrWsData>;
     
     const hostAllowlist = unix ? null : HostAllowlist.fromEnv();
-    const hostname = process.env.AKAN_LISTEN_HOST || undefined;
+    const hostname = ServerLimits.listenHostname();
+    
+    const idleTimeout = unix ? 0 : limits.idleTimeout;
     const buildRoutes = (upgradeAppWs: ApiRouteInputs["upgradeAppWs"], allowlist: HostAllowlist | null) =>
       ApiRouter.buildRoutes({
         prefix: this.prefix,
@@ -475,13 +480,19 @@ export class AkanServer {
         upgradeAppWs,
         webProxyRunner,
         hostAllowlist: allowlist,
+        bodyLimits: limits,
+        countChunkedBodies: !unix,
+        idleTimeout,
       });
-    this.#server = Bun.serve({
-      idleTimeout: 0,
-      ...(unix ? { unix } : { port, hostname }),
-      routes: buildRoutes((req, data) => this.#server?.upgrade(req, { data }) ?? false, hostAllowlist),
-      websocket: websocketHandlers,
-    } as Parameters<typeof Bun.serve>[0]);
+    const serve = () =>
+      Bun.serve({
+        idleTimeout,
+        maxRequestBodySize: limits.uploadBodyBytes,
+        ...(unix ? { unix } : { port, hostname }),
+        routes: buildRoutes((req, data) => this.#server?.upgrade(req, { data }) ?? false, hostAllowlist),
+        websocket: websocketHandlers,
+      } as Parameters<typeof Bun.serve>[0]);
+    this.#server = unix ? ServerLimits.serveOwnerOnly(unix, serve) : serve();
     if (unix && process.env.AKAN_CHILD_WS_PORT) {
       const preferredWsPort = Number(process.env.AKAN_CHILD_WS_PORT);
 

package/server/assetHeaders.ts

@@ -7,10 +7,29 @@ export interface AssetHeaderOptions {
 export const applySecurityHeaders = (headers: Headers, { html = false } = {}): Headers => {
   headers.set("X-Content-Type-Options", "nosniff");
   headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-  if (html) headers.set("X-Frame-Options", "SAMEORIGIN");
+  if (!html) return headers;
+  headers.set("X-Frame-Options", "SAMEORIGIN");
+  const policy = htmlContentSecurityPolicy();
+  if (policy) headers.set("Content-Security-Policy", policy);
   return headers;
 };
 
+export const isOff = (value: string) => ["off", "false", "0", "none"].includes(value.toLowerCase());
+
+export const DEFAULT_HTML_CONTENT_SECURITY_POLICY = "frame-ancestors 'self'; base-uri 'self'";
+
+export const htmlContentSecurityPolicy = (raw = process.env.AKAN_CONTENT_SECURITY_POLICY?.trim()): string | null => {
+  if (!raw || /[\r\n]/.test(raw)) return DEFAULT_HTML_CONTENT_SECURITY_POLICY;
+  return isOff(raw) ? null : raw;
+};
+
+export const DEFAULT_STRICT_TRANSPORT_SECURITY = "max-age=31536000";
+
+export const strictTransportSecurity = (raw = process.env.AKAN_HSTS?.trim()): string | null => {
+  if (!raw || /[\r\n]/.test(raw)) return DEFAULT_STRICT_TRANSPORT_SECURITY;
+  return isOff(raw) ? null : raw;
+};
+
 export const assetHeaders = ({ contentType, cacheControl, anyOrigin }: AssetHeaderOptions): Headers => {
   const headers = new Headers({ "Content-Type": contentType });
   if (cacheControl) headers.set("Cache-Control", cacheControl);

package/server/cachePolicy.ts

@@ -1,5 +1,6 @@
 import { CookieJar, originFromRequest } from "akanjs/common";
 import type { AkanDynamicUsage, AkanRequestPolicy } from "akanjs/fetch";
+import { isOff } from "./assetHeaders";
 
 export const DEFAULT_ROUTE_CACHE_TTL_SECONDS = 30;
 
@@ -88,14 +89,26 @@ export function getClientFacingOrigin(request: Request, url = new URL(request.ur
   return originFromRequest(request.headers, url);
 }
 
-export function isPublicRouteCacheableRequest(request: Request): boolean {
-  if (request.method !== "GET") return false;
-  if (request.headers.has("authorization")) return false;
+export function carriesCredentials(request: Request): boolean {
+  if (request.headers.has("authorization")) return true;
   const cookie = request.headers.get("cookie");
-  if (!cookie) return true;
+  if (!cookie) return false;
   return CookieJar.parse(cookie)
     .names()
-    .every((name) => name === "theme");
+    .some((name) => name !== "theme");
+}
+
+export function isPublicRouteCacheableRequest(request: Request): boolean {
+  return request.method === "GET" && !carriesCredentials(request);
+}
+
+export function resolveHtmlCacheControl(
+  request: Request,
+  raw = process.env.AKAN_HTML_CACHE_CONTROL?.trim(),
+): string | null {
+  if (raw && isOff(raw)) return null;
+  if (carriesCredentials(request)) return "private, no-cache";
+  return raw && !/[\r\n]/.test(raw) ? raw : "no-cache";
 }
 
 const isAtOrUnder = (value: string, prefix: string) =>

package/server/devtools/depsSerializer.ts

@@ -1,4 +1,5 @@
 import { type BaseEnv, INJECT_META } from "akanjs/base";
+import { modelNames } from "akanjs/common";
 import type { AdaptorCls, InjectInfo, ServiceCls } from "akanjs/service";
 import type { DiLifecycle } from "../di/diLifecycle";
 import type { DepEdge, DepEdgeKind, DepNode, DepNodeKind, DepsData } from "./types";
@@ -126,7 +127,7 @@ export class DepsSerializer {
     const kind = injectInfo.type as DepEdgeKind;
     switch (kind) {
       case "database":
-        return { from, to: this.#node("adaptor", `${injectInfo.parentRefName}Model`), kind, prop };
+        return { from, to: this.#node("adaptor", modelNames(injectInfo.parentRefName).modelModel), kind, prop };
       case "service":
         return prop.endsWith("Service")
           ? { from, to: this.#node("service", prop.slice(0, -"Service".length)), kind, prop }

package/server/devtools/devtoolsRouter.ts

@@ -1,6 +1,7 @@
 import type { BaseEnv } from "akanjs/base";
 import { Logger } from "akanjs/common";
 import { DictionaryRegistry, type RootDictionary } from "akanjs/dictionary";
+import { isLocalDevRuntime } from "../../signal/trace";
 import type { DiLifecycle } from "../di/diLifecycle";
 import type { HttpRoutes } from "../types";
 import { ConstantSerializer } from "./constantSerializer";
@@ -24,12 +25,12 @@ export class DevtoolsRouter {
   static readonly basePath = "/_akan";
   static readonly logger = new Logger("DevtoolsRouter");
 
-  /** Local-only unless `AKAN_DEVTOOLS` ("true"/"1", "false"/"0") overrides it, e.g. to debug a deployed env. */
+  /** A local dev runtime only, unless `AKAN_DEVTOOLS` ("true"/"1", "false"/"0") overrides it, e.g. to debug a deployed env. */
   static isEnabled(env: BaseEnv): boolean {
     const override = process.env.AKAN_DEVTOOLS;
     if (override === "false" || override === "0") return false;
     if (override === "true" || override === "1") return true;
-    return env.environment === "local";
+    return isLocalDevRuntime(env);
   }
 
   readonly #context: DevtoolsRouterContext;

package/server/devtools/signalSerializer.ts

@@ -6,7 +6,7 @@ import {
   type PrimitiveScalar,
   SLICE_META,
 } from "akanjs/base";
-import { capitalize } from "akanjs/common";
+import { sliceNames } from "akanjs/common";
 import { ConstantRegistry, type ConstantType } from "akanjs/constant";
 import type {
   ArgInfo,
@@ -148,10 +148,10 @@ export class SignalSerializer {
   static #sliceDerivedKeys(refName: string, sliceCls: SliceCls | undefined): Set<string> {
     const sliceMeta = (sliceCls?.[SLICE_META] ?? {}) as Record<string, SliceInfo>;
     return new Set(
-      Object.keys(sliceMeta).flatMap((key) => [
-        `${refName}List${capitalize(key)}`,
-        `${refName}Insight${capitalize(key)}`,
-      ]),
+      Object.keys(sliceMeta).flatMap((key) => {
+        const { list, insight } = sliceNames(refName, key).endpoint;
+        return [list, insight];
+      }),
     );
   }
 

package/server/hmr/clientReport.ts

@@ -15,7 +15,8 @@ export class ClientReport {
   static readonly #fieldLimit = 4_000;
   static readonly #stackLines = 6;
 
-  static readonly #controlChars = /[\u0000-\u0008\u000b-\u001f\u007f]/g;
+  static readonly #controlChars = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
+  static readonly #lineBreaks = /[\n\u2028\u2029]/g;
 
   static parse(value: unknown): HmrClientReport | null {
     if (!value || typeof value !== "object") return null;
@@ -27,12 +28,12 @@ export class ClientReport {
     return {
       type: "client-report",
       kind: report.kind,
-      message: ClientReport.#clean(report.message),
-      href: ClientReport.#clean(report.href),
+      message: ClientReport.#line(report.message),
+      href: ClientReport.#line(report.href),
       client: report.client,
       ...(typeof report.stack === "string" && report.stack ? { stack: ClientReport.#clean(report.stack) } : {}),
-      ...(typeof report.platform === "string" ? { platform: ClientReport.#clean(report.platform) } : {}),
-      ...(typeof report.target === "string" ? { target: ClientReport.#clean(report.target) } : {}),
+      ...(typeof report.platform === "string" ? { platform: ClientReport.#line(report.platform) } : {}),
+      ...(typeof report.target === "string" ? { target: ClientReport.#line(report.target) } : {}),
     };
   }
 
@@ -67,4 +68,8 @@ export class ClientReport {
   static #clean(text: string) {
     return Logger.stripAnsi(text).replace(ClientReport.#controlChars, "").slice(0, ClientReport.#fieldLimit);
   }
+
+  static #line(text: string) {
+    return ClientReport.#clean(text).replace(ClientReport.#lineBreaks, "\\n");
+  }
 }