galbe 0.15.4 → 0.15.6

package/bin/util.ts

@@ -1,5 +1,5 @@
 import { relative } from 'path'
-import { watch } from 'chokidar'
+import { watch } from 'fs'
 import { Galbe, type Route } from '../src'
 import { logRoute, walkRoutes } from '../src/util'
 import { GalbeProxy, type RouteMeta, defineRoutes } from '../src/routes'
@@ -47,14 +47,11 @@ export const watchDir = async (
   }) => any | Promise<any>,
   options?: { ignore?: RegExp }
 ) => {
-  let watcher = watch(path, {
-    persistent: false,
-    ignored: options?.ignore,
-    ignoreInitial: true,
-  })
-  watcher.on('all', async (eventType, filename) => {
-    if (filename.match(WATCH_IGNORE)) return
-    await callback({ path: filename.toString(), eventType })
+  watch(path, { persistent: false, recursive: true }, async (eventType, filename) => {
+    const filePath = filename?.toString() ?? null
+    if (!filePath || filePath.match(WATCH_IGNORE)) return
+    if (options?.ignore && filePath.match(options.ignore)) return
+    await callback({ path: filePath, eventType: eventType === 'change' ? 'change' : 'add' })
   })
 }
 export const instanciateRoutes = async (g: Galbe) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "galbe",
-  "version": "0.15.4",
+  "version": "0.15.6",
   "description": "Fast, lightweight and highly customizable JavaScript web framework based on Bun",
   "author": "Pierre Caillaud M (https://github.com/pierre-cm)",
   "type": "module",
@@ -34,7 +34,7 @@
   "license": "MIT",
   "scripts": {
     "test": "bun test",
-    "typecheck": "tsc --noEmit --emitDeclarationOnly false",
+    "typecheck": "tsc --noEmit --emitDeclarationOnly false -p tsconfig.json && tsc --noEmit --emitDeclarationOnly false -p tsconfig.test.json",
     "release": "bun run scripts/release.ts"
   },
   "devDependencies": {
@@ -49,7 +49,6 @@
     "@swc/wasm": "^1.4.0",
     "acorn": "^8.11.2",
     "acorn-walk": "^8.3.0",
-    "chokidar": "^3.6.0",
     "commander": "^11.1.0"
   }
 }

package/src/cookies.ts

@@ -18,15 +18,15 @@ export const parseCookie = (str: string) => {
     for (const [idx, entry] of entries.entries()) {
       const [_, key, val] = [...(entry.match(/([^=]+)(?:=(.*))?/) || [])]
       if (idx === 0) {
-        cookie.name = key
-        cookie.value = val
+        cookie.name = key ?? ''
+        cookie.value = val ?? ''
       } else {
         switch (key) {
           case 'Path':
             cookie.path = val
             break
           case 'Max-Age':
-            cookie.maxAge = parseInt(val)
+            if (val !== undefined) cookie.maxAge = parseInt(val)
             break
           case 'HttpOnly':
             cookie.httpOnly = true
@@ -44,7 +44,7 @@ export const parseCookie = (str: string) => {
             cookie.domain = val
             break
           case 'Expires':
-            cookie.expires = new Date(val)
+            if (val !== undefined) cookie.expires = new Date(val)
             break
         }
       }
@@ -81,7 +81,7 @@ export const readCookies = (cookies?: string | null) => {
   return Object.fromEntries(
     cookies.split(';').map(c => {
       const [name, ...value] = c.split('=')
-      return [name.trim(), value.join('=').trim()]
+      return [(name ?? '').trim(), value.join('=').trim()]
     })
   )
 }

package/src/extras/spec/openapi.serializer.ts

@@ -117,7 +117,7 @@ export const OpenAPISerializer = async (g: Galbe, version = '3.0.3'): Promise<Op
       if (members.length === 0) {
         s = {}
       } else if (members.length === 1) {
-        s = schemaToOpenapi(members[0]).schema
+        s = schemaToOpenapi(members[0]!).schema
       } else if (allStringLiterals && !useOneOf) {
         s = { type: 'string', enum: members.map(e => (e as STLiteral).value) }
       } else if (members.length > 1) {
@@ -132,7 +132,7 @@ export const OpenAPISerializer = async (g: Galbe, version = '3.0.3'): Promise<Op
       if (allOf.length === 0) {
         s = {}
       } else if (allOf.length === 1) {
-        s = schemaToOpenapi(allOf[0]).schema
+        s = schemaToOpenapi(allOf[0]!).schema
       } else if (allOf.length > 1) {
         s = {
           allOf: allOf.map(s => schemaToOpenapi(s).schema),
@@ -209,7 +209,7 @@ export const OpenAPISerializer = async (g: Galbe, version = '3.0.3'): Promise<Op
           securityExplicitlyEmpty = true
         } else {
           const [name, ...scopes] = trimmed.split(/\s+/)
-          security.push({ [name]: scopes })
+          security.push({ [name!]: scopes })
           if (name === 'bearerAuth' && components.securitySchemes && !components.securitySchemes.bearerAuth) {
             components.securitySchemes.bearerAuth = { type: 'http', scheme: 'bearer' }
           }
@@ -296,8 +296,8 @@ export const OpenAPISerializer = async (g: Galbe, version = '3.0.3'): Promise<Op
               content[key] = { schema: oaSchema }
               const ex = (bodySchema as any)?.examples
               const exSingle = (bodySchema as any)?.example
-              if (ex && Object.keys(ex).length) content[key].examples = ex
-              if (exSingle !== undefined) content[key].example = exSingle
+              if (ex && Object.keys(ex).length) content[key]!.examples = ex
+              if (exSingle !== undefined) content[key]!.example = exSingle
             }
             response = { description: desc, ...(Object.keys(content).length ? { content } : {}) }
           } else {
@@ -319,8 +319,8 @@ export const OpenAPISerializer = async (g: Galbe, version = '3.0.3'): Promise<Op
               const content: Record<string, { schema: typeof schema; example?: any; examples?: Record<string, any> }> = {
                 [mediaType]: { schema: { ...schema } },
               }
-              if (explicitExamples && Object.keys(explicitExamples).length) content[mediaType].examples = explicitExamples
-              if (explicitExample !== undefined) content[mediaType].example = explicitExample
+              if (explicitExamples && Object.keys(explicitExamples).length) content[mediaType]!.examples = explicitExamples
+              if (explicitExample !== undefined) content[mediaType]!.example = explicitExample
               response = {
                 description: (v as any).description || HttpStatus[s as keyof typeof HttpStatus] || 'Response',
                 content,
@@ -407,7 +407,7 @@ export const OpenAPISerializer = async (g: Galbe, version = '3.0.3'): Promise<Op
       }
     }
   }
-  const cap = (s: string) => (s ? s[0].toUpperCase() + s.slice(1) : s)
+  const cap = (s: string) => (s ? s[0]!.toUpperCase() + s.slice(1) : s)
   const promoted = new Map<string, string>() // hash -> component name
   const usedNames = new Set<string>(Object.keys(components.parameters || {}))
   for (const [hash, { count, param }] of paramHashes) {

package/src/index.ts

@@ -1,4 +1,3 @@
-import type { Server } from 'bun'
 import type { RouteFileMeta } from './routes'
 import type {
   GalbeConfig,
@@ -130,13 +129,14 @@ export class Galbe {
   stopCb: (() => void)[] = []
   errorCb: ErrorHandler[] = []
   listening: boolean = false
-  server?: Server<any>
+  server?: Awaited<ReturnType<typeof server>>
   plugins: GalbePlugin[] = []
   constructor(config?: GalbeConfig) {
     this.config = config ?? {}
     this.router = new GalbeRouter({
       prefix: this.config?.basePath || '',
       cacheEnabled: this.config?.router?.cacheEnabled,
+      cacheLimit: this.config?.router?.cacheLimit,
     })
   }
   private add(route: any) {

package/src/parser.ts

@@ -25,6 +25,16 @@ import { isIterator, inferBodyType, type ParseMode } from './util'
 const textDecoder = new TextDecoder()
 const textEncoder = new TextEncoder()
 
+// own-property schema lookup: field names come from the request and would
+// otherwise hit Object.prototype members (constructor, toString, …)
+const getProp = <T extends Record<string, any>>(props: T | undefined, key: string): T[string] | undefined =>
+  props && Object.hasOwn(props, key) ? props[key] : undefined
+
+// application/x-www-form-urlencoded encodes spaces as `+`, which
+// decodeURIComponent leaves untouched — translate first (a literal plus
+// arrives percent-encoded as %2B)
+const decodeFormComponent = (raw: string) => decodeURIComponent(raw.replace(/\+/g, ' '))
+
 async function* rsToAsyncIterator(readableStream: ReadableStream) {
   try {
     for await (const chunk of readableStream) yield chunk
@@ -201,7 +211,12 @@ export const requestBodyParser = async (
   }
 }
 async function* $streamToString(body: ReadableStream) {
-  for await (const chunk of body) yield textDecoder.decode(chunk)
+  // per-call decoder: streaming decode is stateful (multibyte code points can
+  // straddle chunks), so the shared module-level decoder must not be used here
+  const decoder = new TextDecoder()
+  for await (const chunk of body) yield decoder.decode(chunk, { stream: true })
+  const tail = decoder.decode()
+  if (tail) yield tail
 }
 const streamToString = async (body: ReadableStream, schema?: STBodyValue): Promise<any> => {
   let res = ''
@@ -228,11 +243,11 @@ async function* $streamToUrlForm(
         bV.set(rest)
         bV.set(chunk.slice(start, i), rest.length)
         let [key, val]: [string, any] = [
-          decodeURIComponent(textDecoder.decode(bK)),
-          decodeURIComponent(textDecoder.decode(bV)),
+          decodeFormComponent(textDecoder.decode(bK)),
+          decodeFormComponent(textDecoder.decode(bV)),
         ]
         try {
-          const propSchema = schema?.props?.[key]
+          const propSchema = getProp(schema?.props, key)
           let s = propSchema?.[Kind] === 'array' ? (propSchema as STArray).items : propSchema
           val = s ? paramParser(val, s) : val
         } catch (error) {
@@ -260,11 +275,11 @@ async function* $streamToUrlForm(
     }
   }
   let [key, val]: [string, any] = [
-    decodeURIComponent(textDecoder.decode(bK)),
-    decodeURIComponent(textDecoder.decode(rest)),
+    decodeFormComponent(textDecoder.decode(bK)),
+    decodeFormComponent(textDecoder.decode(rest)),
   ]
   try {
-    const propSchema = schema?.props?.[key]
+    const propSchema = getProp(schema?.props, key)
     let s = propSchema?.[Kind] === 'array' ? (propSchema as STArray).items : propSchema
     val = s ? paramParser(val, s) : val
   } catch (error) {
@@ -290,20 +305,21 @@ const streamToUrlForm = async (body: ReadableStream<Uint8Array>, schema?: STObje
   const required = Object.fromEntries(
     Object.entries(schema?.props || {}).filter(([_, v]: [string, any]) => !v?.[Optional])
   )
-  let errors: Record<string, any> = {}
+  let errors: Record<string, any> = Object.create(null)
   for await (const chunk of $streamToUrlForm(body)) entries.push(chunk)
-  const object: Record<string, any> = {}
+  const object: Record<string, any> = Object.create(null)
   for (let e of entries.filter(([k]) => k)) {
     if (e[0] in object) {
       if (Array.isArray(object[e[0]])) object[e[0]].push(e[1])
       else object[e[0]] = [object[e[0]], e[1]]
-    } else object[e[0]] = schema?.props?.[e[0]]?.[Kind] === 'array' ? [e[1]] : e[1]
+    } else object[e[0]] = getProp(schema?.props, e[0])?.[Kind] === 'array' ? [e[1]] : e[1]
   }
   if (schema?.props)
     for (let [k, v] of Object.entries(object)) {
       delete required[k]
       try {
-        object[k] = schema?.props && k in schema?.props ? paramParser(v, schema?.props[k]) : v
+        const propSchema = getProp(schema.props, k)
+        object[k] = propSchema ? paramParser(v, propSchema) : v
       } catch (error) {
         errors[k] = k in errors ? [...errors[k], error] : error
       }
@@ -425,14 +441,14 @@ const parseMultipartHeader = (header: string): { name: string; [key: string]: st
     ...header.matchAll(/\s*([\w-]+)\s*:\s*([^;]*);?/g),
     ...header.matchAll(/;?\s*(\w+)\s*=\s*\"([^"]*)\";?/g),
   ].reduce((acc: Record<string, string>, v: string[]) => {
-    const key = v[1].toLowerCase().replace(/^content-/, '')
+    const key = (v[1] ?? '').toLowerCase().replace(/^content-/, '')
     if (key === 'disposition') {
-      disposition = v[2]
+      disposition = v[2] ?? 'form-data'
       return acc
     }
-    acc[key] = v[2]
+    acc[key] = v[2] ?? ''
     return acc
-  }, {})
+  }, Object.create(null))
   if (disposition !== 'form-data') return null
   //@ts-ignore
   return multipartHeader
@@ -446,17 +462,18 @@ const parseMultipartContent = (
   let result: any = content
   if (type === 'text/plain') {
     const str = textDecoder.decode(content).trim()
-    let s = schema?.props?.[headers.name]
+    let s = getProp(schema?.props, headers.name)
     return s ? paramParser(str, s?.[Kind] === 'array' ? s?.items : s) : str
   } else if (type === 'application/json') {
-    if (!schema?.props || !(headers.name in schema?.props)) {
+    if (!schema?.props || !Object.hasOwn(schema.props, headers.name)) {
       try {
         result = JSON.parse(textDecoder.decode(content).trim())
       } catch (err: any) {
         throw new RequestError({ status: 400, payload: { body: { [headers.name]: err?.message || 'Parsing error' } } })
       }
     } else if (schema?.props) {
-      if (schema?.props[headers.name][Kind] === 'object') {
+      const prop = schema.props[headers.name]!
+      if (prop[Kind] === 'object') {
         try {
           result = JSON.parse(textDecoder.decode(content).trim())
         } catch (err: any) {
@@ -466,67 +483,76 @@ const parseMultipartContent = (
           })
         }
         try {
-          validate(result, schema?.props[headers.name])
+          validate(result, prop)
+        } catch (err) {
+          throw new RequestError({ status: 400, payload: { body: { [headers.name]: err } } })
+        }
+      } else if (prop[Kind] === 'byteArray') {
+        try {
+          return validate(content, prop)
         } catch (err) {
           throw new RequestError({ status: 400, payload: { body: { [headers.name]: err } } })
         }
-      } else if (schema?.props[headers.name][Kind] === 'byteArray') {
-        return content
-      } else if (schema?.props[headers.name][Kind] === 'string') {
+      } else if (prop[Kind] === 'string') {
         result = textDecoder.decode(content).trim()
       } else {
         throw new RequestError({
           status: 400,
-          payload: { body: { [headers.name]: `Expected ${schema?.props[headers.name][Kind]} found json` } },
+          payload: { body: { [headers.name]: `Expected ${prop[Kind]} found json` } },
         })
       }
     }
-  } else if (schema?.props?.[headers.name]) {
-    try {
-      let s = schema?.props[headers.name]
-      validate(result, s?.[Kind] === 'array' ? s?.items : s)
-    } catch (err) {
-      throw new RequestError({ status: 400, payload: { body: { [headers.name]: err } } })
+  } else {
+    const s = getProp(schema?.props, headers.name)
+    if (s) {
+      try {
+        validate(result, s[Kind] === 'array' ? s.items : s)
+      } catch (err) {
+        throw new RequestError({ status: 400, payload: { body: { [headers.name]: err } } })
+      }
     }
   }
   return result
 }
 const streamToMultipartForm = async (data: ReadableStream<Uint8Array>, boundary: string, schema?: STMultipartForm) => {
-  const res: Record<string, MultipartFormData> = {}
-  const errors: Record<string, any> = {}
+  const res: Record<string, MultipartFormData> = Object.create(null)
+  const errors: Record<string, any> = Object.create(null)
   const required = Object.fromEntries(
     Object.entries(schema?.props || {}).filter(([_, v]: [string, any]) => !v?.[Optional])
   )
   for await (const chunk of $streamToMultipartForm(data, boundary)) {
-    if (chunk.headers.name in res) {
-      if (!Array.isArray(res[chunk.headers.name].content))
-        res[chunk.headers.name].content = [res[chunk.headers.name].content]
-      res[chunk.headers.name].content.push(chunk.content)
+    const name = chunk.headers.name
+    if (name in res) {
+      const existing = res[name]!
+      if (!Array.isArray(existing.content)) existing.content = [existing.content]
+      existing.content.push(chunk.content)
     } else {
-      if (schema?.props?.[chunk.headers.name]?.[Kind] === 'array')
-        res[chunk.headers.name] = { ...chunk, content: [chunk.content] }
-      else res[chunk.headers.name] = chunk
+      if (getProp(schema?.props, name)?.[Kind] === 'array')
+        res[name] = { ...chunk, content: [chunk.content] }
+      else res[name] = chunk
     }
-    delete required[chunk.headers.name]
+    delete required[name]
 
-    if (schema?.props && chunk?.headers?.name in schema.props) {
+    if (schema?.props && Object.hasOwn(schema.props, name)) {
       try {
-        if (Array.isArray(res[chunk.headers.name].content) && schema?.props?.[chunk.headers.name]?.[Kind] !== 'array')
+        const prop = schema.props[name]!
+        const entry = res[name]!
+        if (Array.isArray(entry.content) && prop[Kind] !== 'array')
           throw `Multiple values found`
-        res[chunk.headers.name].content = validate(res[chunk.headers.name].content, schema?.props[chunk.headers.name], {
+        entry.content = validate(entry.content, prop, {
           parse: true,
         })
-        if (schema.props[chunk.headers.name][Kind] === 'array')
-          for (let [k, v] of Object.entries(res[chunk.headers.name].content)) {
+        if (prop[Kind] === 'array')
+          for (let [k, v] of Object.entries(entry.content)) {
             try {
               //@ts-ignore
-              res[chunk.headers.name].content[k] = paramParser(v, schema.props[chunk.headers.name].items)
+              entry.content[k] = paramParser(v, prop.items)
             } catch (error) {
-              errors[chunk.headers.name] = chunk.headers.name in errors ? [...errors[chunk.headers.name], error] : error
+              errors[name] = name in errors ? [...errors[name], error] : error
             }
           }
       } catch (err) {
-        errors[chunk.headers.name] = err
+        errors[name] = err
       }
     }
   }
@@ -711,7 +737,23 @@ export const responseParser = (response: any, ctx: Context, cookies: string[], s
       value.forEach(v => details.headers.append(key, v))
     } else details.headers.set(key, value)
   }
-  if (response instanceof Response) return response
+  if (response instanceof Response) {
+    // Merge cookies and ctx.set.headers into the raw Response without
+    // clobbering headers the user already set on it. `set-cookie` is always
+    // appended; other headers are only set when absent on the Response.
+    const existing = response.headers
+    for (const [key, value] of Object.entries(ctx.set.headers)) {
+      if (key.toLowerCase() === 'set-cookie') {
+        if (Array.isArray(value)) value.forEach(v => existing.append('set-cookie', v))
+        else if (value) existing.append('set-cookie', value as string)
+      } else if (!existing.has(key)) {
+        if (Array.isArray(value)) value.forEach(v => existing.append(key, v))
+        else existing.set(key, value as string)
+      }
+    }
+    for (const cookie of cookies) existing.append('set-cookie', cookie)
+    return response
+  }
   else if (typeof response === 'string') {
     if (!details?.headers?.has('content-type')) {
       const statusEntry: any = schema?.[details.status]
@@ -720,7 +762,7 @@ export const responseParser = (response: any, ctx: Context, cookies: string[], s
         : statusEntry?.['application/json'] && !statusEntry?.['text/plain']
       if (isJson) {
         details?.headers?.set('content-type', 'application/json')
-        response = `"${response}"`
+        response = JSON.stringify(response)
       } else details?.headers?.set('content-type', 'text/plain')
     }
     return new Response(response, details)

package/src/router.ts

@@ -3,6 +3,16 @@ import { MethodNotAllowedError, NotFoundError } from './types'
 
 const ROUTE_REGEX = /^(\/(\*|:?\d+|:?\w+|:?[\w\d.][\w-.]+[\w\d]))*\/?$/
 
+// null-prototype map: segments are looked up with `in`, a plain {} would collide
+// with Object.prototype members (constructor, __proto__, toString, …)
+const newChildren = (): Record<string, RouteNode> => Object.create(null)
+
+// trailing slashes are ignored when matching: /tail and /tail/ resolve to the
+// same route regardless of how the route was declared ('/' itself excepted)
+const normalizePath = (path: string) => (path.length > 1 ? path.replace(/\/+$/g, '') || '/' : path)
+
+const DEFAULT_CACHE_LIMIT = 1024
+
 const walk = (path: string[], node: RouteNode, index: number = 0): RouteNode => {
   if (index === path.length - 1) {
     if (node.routes && !!Object.keys(node.routes).length) return node
@@ -16,9 +26,9 @@ const walk = (path: string[], node: RouteNode, index: number = 0): RouteNode =>
   const nextSegment = path[index + 1]
 
   // 1. Exact Match
-  if (node.children && nextSegment in node.children) {
+  if (node.children && nextSegment !== undefined && nextSegment in node.children) {
     try {
-      return walk(path, node.children[nextSegment], index + 1)
+      return walk(path, node.children[nextSegment]!, index + 1)
     } catch (error) {
       if (!(error instanceof NotFoundError)) throw error
     }
@@ -54,21 +64,39 @@ export class GalbeRouter {
   routes: RouteNode
   prefix: string
   cacheEnabled: boolean
+  cacheLimit: number
   cachedRoutes: Map<string, Route | null>
-  constructor(options?: { prefix?: string; cacheEnabled?: boolean }) {
+  constructor(options?: { prefix?: string; cacheEnabled?: boolean; cacheLimit?: number }) {
     this.routes = { routes: {} }
     let prefix = options?.prefix || ''
     if (prefix && !prefix.match(/^\//)) prefix = `/${prefix}`
     this.prefix = prefix
     this.cachedRoutes = new Map()
     this.cacheEnabled = options?.cacheEnabled ?? false
+    this.cacheLimit = options?.cacheLimit ?? DEFAULT_CACHE_LIMIT
+  }
+  // bounded LRU: gets refresh recency, sets evict the oldest entry once past
+  // cacheLimit, so a flood of distinct lookups (including cached misses) can't
+  // grow the map without bound
+  private cacheGet(key: string): Route | null | undefined {
+    if (!this.cachedRoutes.has(key)) return undefined
+    const route = this.cachedRoutes.get(key) as Route | null
+    this.cachedRoutes.delete(key)
+    this.cachedRoutes.set(key, route)
+    return route
+  }
+  private cacheSet(key: string, route: Route | null) {
+    if (this.cachedRoutes.has(key)) this.cachedRoutes.delete(key)
+    this.cachedRoutes.set(key, route)
+    while (this.cachedRoutes.size > this.cacheLimit)
+      this.cachedRoutes.delete(this.cachedRoutes.keys().next().value as string)
   }
   add(route: Route) {
     route.path = route?.path?.[0] === '/' ? route.path : `/${route.path}`
     if (!route.path.match(ROUTE_REGEX)) throw new SyntaxError(`${route.path} is not a valid route path.`)
     const isStatic = !route.path.match(/(:[\w\d-]+|\*)/)
     route.path = `${this.prefix || ''}${route.path}`
-    if (isStatic) this.cachedRoutes.set(`[${route.method}]${route.path}`, route)
+    if (isStatic) this.cacheSet(`[${route.method}]${normalizePath(route.path)}`, route)
     let path = route.path.replace(/^\/+|\/+$/g, '').split('/')
     if (path[0] === '') path.shift()
     let r = this.routes
@@ -83,35 +111,36 @@ export class GalbeRouter {
             if (!r.param) r.param = { routes: {} }
             r.param.routes[route.method] = route
           } else {
-            if (!r.children) r.children = {}
+            if (!r.children) r.children = newChildren()
             if (!(p in r.children)) r.children[p] = { routes: {} }
-            r.children[p].routes[route.method] = route
+            r.children[p]!.routes[route.method] = route
           }
         } else {
           if (p.match(/^:/)) {
             if (!r.param) r.param = { routes: {} }
             r = r.param
           } else {
-            if (!r.children) r.children = {}
+            if (!r.children) r.children = newChildren()
             if (!(p in r.children)) r.children[p] = { routes: {} }
-            r = r.children[p]
+            r = r.children[p]!
           }
         }
       }
     }
   }
   find(method: Method, path: string): Route {
-    const staticRoute = this.cachedRoutes.get(`[${method}]${path}`)
+    path = normalizePath(path)
+    const staticRoute = this.cacheGet(`[${method}]${path}`)
     if (staticRoute === null) throw new NotFoundError()
     if (staticRoute !== undefined) return staticRoute
     let parts = path === '/' ? [''] : path.split('/')
     let r = walk(parts, this.routes)
     if (!r || !Object.keys(r.routes).length) {
-      if (this.cacheEnabled) this.cachedRoutes.set(`[${method}]${path}`, null)
+      if (this.cacheEnabled) this.cacheSet(`[${method}]${path}`, null)
       throw new NotFoundError()
     } else if (!(method in r.routes)) throw new MethodNotAllowedError()
     const route = r.routes[method] as Route
-    if (this.cacheEnabled) this.cachedRoutes.set(`[${method}]${path}`, route)
+    if (this.cacheEnabled) this.cacheSet(`[${method}]${path}`, route)
     return route
   }
 }

package/src/routes.ts

@@ -132,14 +132,16 @@ const parseComment = (comment: string): Record<string, string | string[]> => {
     ...(head ? { head } : {}),
     ...[...tagsSrc.matchAll(new RegExp(`^\\s*\\*\\s*@([a-zA-Z_][0-9a-zA-Z_]*)(?:$|\\s+([^\\n]*)\\s*$)`, 'gm'))].reduce(
       (acc, n) => {
+        const tag = n[1]!
+        const val = n[2] ?? true
         return {
           ...acc,
-          [n[1]]:
-            n[1] in acc ? [...(typeof acc[n[1]] === 'string' ? [acc[n[1]]] : acc[n[1]]), n[2] ?? true] : n[2] ?? true
+          [tag]:
+            tag in acc ? [...(typeof acc[tag] === 'string' ? [acc[tag]] : acc[tag]), val] : val
         }
       },
       {} as Record<string, any>
-    )
+    ),
   }
   return refs
 }
@@ -188,7 +190,7 @@ export const metaAnalysis = async (filePath: string): Promise<RoutesMeta> => {
         else if (HIDE_COMMENT_RGX.test(text)) {
           hideLines.add(locEnd.line + 1)
         }
-        else comments[locEnd.line][locEnd.column] = text
+        else comments[locEnd.line]![locEnd.column] = text
       }
     }
   })
@@ -196,7 +198,7 @@ export const metaAnalysis = async (filePath: string): Promise<RoutesMeta> => {
     ExportDefaultDeclaration(node) {
       const headerLine = node.loc?.start.line || -1
       const headerCol = node.loc?.start.column || -1
-      const headerCom = comments?.[headerLine]?.[headerCol - 1] ? comments[headerLine][headerCol - 1] : ''
+      const headerCom = comments?.[headerLine]?.[headerCol - 1] ?? ''
       const hide = hideLines.has(headerLine)
       if (hide) meta.hide = true
       if (ignoredLines.has(headerLine)) {
@@ -222,10 +224,10 @@ export const metaAnalysis = async (filePath: string): Promise<RoutesMeta> => {
             const method = node.callee.property.name as Method
             const line = node.loc?.start.line || -1
             const col = node.loc?.start.column || -1
-            const com = comments?.[line]?.[col - 1] ? comments[line][col - 1] : ''
+            const com = comments?.[line]?.[col - 1] ?? ''
             const routeRefs = ignoredLines.has(line) ? { ignore: true } : { ...parseComment(com), ...(hide || hideLines.has(line) ? { hide: true } : {}) }
             if (!(path in meta.routes)) meta.routes[path] = {}
-            if (!(method in meta.routes[path])) meta.routes[path][method] = routeRefs as RouteMeta
+            if (!(method in meta.routes[path]!)) meta.routes[path]![method] = routeRefs as RouteMeta
           }
         }
       })

package/src/schema.ts

@@ -228,7 +228,7 @@ function _Object<T extends STProps>(properties?: T, options: Options = {}): STOb
   const propertyKeys = globalThis.Object.getOwnPropertyNames(properties)
   const optionalKeys = propertyKeys.filter(key => properties[key]?.[Optional])
   const requiredKeys = propertyKeys.filter(name => !optionalKeys.includes(name))
-  const clonedProperties = propertyKeys.reduce((acc, key) => ({ ...acc, [key]: { ...properties[key] } }), {} as STProps)
+  const clonedProperties = propertyKeys.reduce<STProps>((acc, key) => ({ ...acc, [key]: { ...properties[key]! } }), {})
   return (requiredKeys.length > 0
     ? { ...options, [Kind]: 'object', props: clonedProperties, required: requiredKeys }
     : { ...options, [Kind]: 'object', props: clonedProperties }) as unknown as STObject<T>
@@ -273,7 +273,7 @@ function _MultipartForm<T extends STProps>(properties?: T, options: Options = {}
   const propertyKeys = globalThis.Object.getOwnPropertyNames(properties)
   const optionalKeys = propertyKeys.filter(key => properties[key]?.[Optional])
   const requiredKeys = propertyKeys.filter(name => !optionalKeys.includes(name))
-  const clonedProperties = propertyKeys.reduce((acc, key) => ({ ...acc, [key]: { ...properties[key] } }), {} as STProps)
+  const clonedProperties = propertyKeys.reduce<STProps>((acc, key) => ({ ...acc, [key]: { ...properties[key]! } }), {})
   return (requiredKeys.length > 0
     ? { ...options, [Kind]: 'multipartForm', props: clonedProperties, required: requiredKeys }
     : { ...options, [Kind]: 'multipartForm', props: clonedProperties }) as unknown as STMultipartForm<T>

package/src/server.ts

@@ -5,7 +5,7 @@ import { parseEntry, requestBodyParser, requestPathParser, responseParser } from
 import { Galbe } from './index'
 import { validateResponse } from './validator'
 const normalizeContentType = (ct: string | null): string | undefined =>
-  ct ? ct.split(';')[0].trim() || undefined : undefined
+  ct ? (ct.split(';')[0] ?? '').trim() || undefined : undefined
 import { readCookies, stringifyCookie } from './cookies'
 
 type MakeOptional<T, K extends keyof T> = Omit<T, K> & Partial<Pick<T, K>>
@@ -31,11 +31,19 @@ export default async (galbe: Galbe, port?: number, hostname?: string) => {
     galbe.config.basePath = `/${galbe?.config?.basePath}`
   let pluginsCb = setupPluginCallbacks(galbe)
 
+  // config.server is passed through to Bun.serve; port/fetch/error are owned by
+  // Galbe and the dedicated config keys (port, hostname, reusePort, tls) win
+  const serverOptions: Record<string, any> = { ...galbe.config?.server }
+  delete serverOptions.port
+  delete serverOptions.fetch
+  delete serverOptions.error
+
   const server = Bun.serve({
+    ...serverOptions,
     port: port || galbe.config?.port || 3000,
-    reusePort: galbe?.config?.reusePort,
-    hostname: hostname || galbe.config?.hostname || 'localhost',
-    tls: galbe.config?.tls,
+    reusePort: galbe?.config?.reusePort ?? serverOptions.reusePort,
+    hostname: hostname || galbe.config?.hostname || serverOptions.hostname || 'localhost',
+    tls: galbe.config?.tls ?? serverOptions.tls,
 
     async fetch(req) {
       if (!METHODS.includes(req.method)) return new Response('', { status: 501 })
@@ -79,9 +87,11 @@ export default async (galbe: Galbe, port?: number, hostname?: string) => {
 
         // parse request
         const schema = route.schema
-        const inHeaders: Record<string, any> = {}
+        // null-prototype maps: keys are untrusted, a plain {} would collide with
+        // Object.prototype members (constructor, __proto__, toString, …)
+        const inHeaders: Record<string, any> = Object.create(null)
         for (let [k, v] of req.headers) inHeaders[k] = v
-        let inQuery: Record<string, any> = {}
+        let inQuery: Record<string, any> = Object.create(null)
         for (let [k, v] of url.searchParams) {
           if (k in inQuery) {
             const cur = inQuery[k]
@@ -150,7 +160,7 @@ export default async (galbe: Galbe, port?: number, hostname?: string) => {
               if (nextCalled) console.error('Hook already called - ignored')
               else {
                 nextCalled = true
-                return await callChain[idx + 1].call()
+                return await callChain[idx + 1]!.call()
               }
             }
             let r = await hook(context as Context, next)
@@ -164,7 +174,7 @@ export default async (galbe: Galbe, port?: number, hostname?: string) => {
             context.set.status = response instanceof Response ? response.status : context.set.status || 200
           },
         })
-        const r = await callChain[0].call()
+        const r = await callChain[0]!.call()
         if (r) response = r
         if (context.set.status === undefined)
           context.set.status = response instanceof Response ? response.status : 200
@@ -184,8 +194,12 @@ export default async (galbe: Galbe, port?: number, hostname?: string) => {
       } catch (error) {
         context.set.status = error instanceof RequestError ? error.status : 500
         let customError
-        for (let eh of galbe.errorCb)
-          customError = responseParser(eh(error, context as Context), context as Context, cookies)
+        for (let eh of galbe.errorCb) {
+          const result = await eh(error, context as Context)
+          if (result === undefined) continue
+          customError = responseParser(result, context as Context, cookies)
+          break
+        }
         if (customError) return customError
         if (error instanceof InternalServerError) {
           let internalPayload = 'Internal Server Error'
@@ -196,7 +210,21 @@ export default async (galbe: Galbe, port?: number, hostname?: string) => {
           })
         } else if (error instanceof RequestError) {
           let payload = error.payload
-          let headers = new Headers({ ...context.set.headers, ...error?.headers })
+          // append semantics: context.set.headers always carries the
+          // 'set-cookie': [] sentinel and may hold array values, which the
+          // Headers constructor would stringify ('set-cookie: ""', 'a,b').
+          // Cookies queued via ctx.set.cookie() are merged like on the
+          // success path.
+          let headers = new Headers()
+          const mergeHeaders = (h?: Record<string, string | string[]>) => {
+            for (const [k, v] of Object.entries(h ?? {})) {
+              if (Array.isArray(v)) v.forEach(x => headers.append(k, x))
+              else if (v) headers.set(k, v)
+            }
+          }
+          mergeHeaders(context.set.headers)
+          mergeHeaders(error?.headers)
+          for (const cookie of cookies) headers.append('set-cookie', cookie)
           if (!headers.has('content-type')) {
             if (typeof error.payload === 'string') headers.set('content-type', 'text/plain')
             else {

package/src/types.ts

@@ -1,4 +1,4 @@
-import type { Serve, SocketAddress, TLSOptions } from 'bun'
+import type { SocketAddress, TLSOptions } from 'bun'
 import type {
   STAny,
   STArray,
@@ -140,10 +140,11 @@ export type GalbeConfig = {
   basePath?: string
   /** Enable or disable TLS support. */
   tls?: TLSOptions
-  server?: Exclude<Serve.Options<any>, 'port'> | TLSOptions
+  /** Extra options passed through to `Bun.serve` (e.g. `maxRequestBodySize`, `idleTimeout`). `port`, `fetch` and `error` are ignored, and the dedicated `hostname`, `reusePort` and `tls` config keys take precedence. */
+  server?: Partial<Omit<Parameters<typeof Bun.serve>[0], 'port' | 'fetch' | 'error'>> | TLSOptions
   /** A Glob Pattern or a list of Glob patterns defining the route files to be analyzed by the Automatic Route Analyzer. */
   routes?: boolean | string | string[]
-  router?: { cacheEnabled: boolean }
+  router?: { cacheEnabled: boolean; cacheLimit?: number }
   /** A property that can be used by plugins to add plugin's specific configuration. */
   plugin?: Record<string, any>
   /** Enable or disable the request schema validation.*/

package/src/util.ts

@@ -12,6 +12,11 @@ const METHOD_COLOR: Record<string, string> = {
 }
 const ansiRegex = /[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]/g
 
+/**
+ * Deep-merges `override` into `base` **in place** — `base` is mutated and
+ * returned, so treat config merging as destructive. Plain objects merge
+ * recursively; arrays, `null` and primitives replace the base value wholesale.
+ */
 export const softMerge = <T>(base: T, override: T): T => {
   for (const key in override) {
     if (override[key] instanceof Object && !(override[key] instanceof Array)) {

package/src/validator.ts

@@ -7,6 +7,7 @@ import type {
   STJson,
   STLiteral,
   STArray,
+  STByteArray,
   STNumber,
   STInteger,
   STString,
@@ -84,6 +85,7 @@ export const validate = (elt: any, schema: STSchema, opt?: { parse?: boolean }):
     if (opt?.parse && typeof elt === 'string') elt = Uint8Array.from(elt, c => c.charCodeAt(0))
     else if (opt?.parse && Array.isArray(elt)) elt = new Uint8Array(elt)
     if (!(elt instanceof Uint8Array)) throw 'Not a valid byteArray'
+    schemaValidation(elt, schema)
   } else if (schema[Kind] === 'anyOf' || schema[Kind] === 'oneOf') {
     const union = Object.values((schema as STUnion).members)
     let valid = false
@@ -161,6 +163,12 @@ const schemaValidation = (value: any, schema: STSchema) => {
       errors.push(`Length is too large (${str.maxLength} char max)`)
     if (str.pattern !== undefined && !(value as string).match(str.pattern))
       errors.push(`Does not match pattern ${str.pattern}`)
+  } else if (schema[Kind] === 'byteArray') {
+    const ba = schema as STByteArray
+    if (ba.minLength !== undefined && (value as Uint8Array).length < ba.minLength)
+      errors.push(`Length is too small (${ba.minLength} bytes min)`)
+    if (ba.maxLength !== undefined && (value as Uint8Array).length > ba.maxLength)
+      errors.push(`Length is too large (${ba.maxLength} bytes max)`)
   } else if (schema[Kind] === 'array') {
     const arr = schema as STArray
     if (arr.minLength !== undefined && (value as any[]).length < arr.minLength)