kreftjs 0.0.20-beta → 0.0.22-beta

package/bin/backend/shield.js

@@ -0,0 +1,266 @@
+/*
+ * Kreft Shield: automatic protection against floods and abuse from a single address.
+ *
+ *   SHIELD=true          in .env turns it on (off by default). Changes to .env apply without a restart.
+ *
+ * What it does, per visitor address (the same req.ip() that throttle uses, so TRUSTED_PROXIES applies):
+ *   1. Rate limit: more than SHIELD_MAX_REQUESTS (300) in SHIELD_WINDOW_SEC (10) seconds → 429 + Retry-After.
+ *      Responses that look like probing (401, 403, 404, 405) count SHIELD_ERROR_WEIGHT (5) times, so scanners
+ *      and password guessers hit the limit sooner than normal visitors.
+ *   2. Concurrency: more than SHIELD_MAX_CONCURRENT (60) requests of one address in flight at once → 429.
+ *   3. Ban: SHIELD_STRIKES (3) rate-limit hits within SHIELD_STRIKE_WINDOW_MIN (10) minutes → the address is
+ *      refused for SHIELD_BAN_MINUTES (15), doubling at every repeat (up to 24 hours). Banned requests are
+ *      answered with a bare 429 before any work is done.
+ *   4. Connections: more than SHIELD_MAX_CONNECTIONS (100) open sockets from one address are closed at once, which
+ *      stops slow-connection floods (slowloris) that never finish a request. Needs Shield.watch(server) (kreft does it).
+ *   5. Overload: when the event loop lags by more than SHIELD_MAX_LAG_MS (300), limits shrink to a quarter
+ *      so the server keeps answering instead of falling over.
+ *
+ * Never limited: SHIELD_ALLOW="1.2.3.4,5.6.7.8" and, unless SHIELD_LOCAL=true, this computer (127.0.0.1, ::1).
+ * Bans live in memory: a restart clears them. For a flood bigger than one process can absorb, put a firewall
+ * or CDN in front; the Shield protects the application, it does not replace network-level DDoS protection.
+ *
+ *   const { Shield } = require('kreftjs/server')
+ *   Shield.bans()  Shield.unban('1.2.3.4')  Shield.ban('1.2.3.4', 60)  Shield.status()  Shield.on('ban', fn)
+ */
+const { EventEmitter } = require('events');
+
+const events = new EventEmitter();
+const ips = new Map(); // address → { windowStart, count, struck, strikes: [ms], level, lastBanAt, bannedUntil, inflight, last }
+const MAX_ENTRIES = 100000;
+const DAY = 86400000;
+
+let cfgAt = 0;
+let cfg = null;
+let lagMonitor = null;
+let lagMs = 0;
+let timers = [];
+let warnedProxy = false;
+const conns = new Map(); // direct socket address → open connections
+const stats = { blocked: 0, limited: 0, bans: 0 };
+
+const num = (v, d) => (Number.isFinite(Number(v)) && Number(v) > 0 ? Number(v) : d);
+const flag = (v) => ['true', '1', 'on', 'yes'].includes(String(v || '').trim().toLowerCase());
+
+function config() {
+  const now = Date.now();
+  if (cfg && now - cfgAt < 2000) return cfg;
+  const e = process.env;
+  cfg = {
+    enabled: flag(e.SHIELD),
+    maxRequests: num(e.SHIELD_MAX_REQUESTS, 300),
+    windowMs: num(e.SHIELD_WINDOW_SEC, 10) * 1000,
+    errorWeight: num(e.SHIELD_ERROR_WEIGHT, 5),
+    maxConcurrent: num(e.SHIELD_MAX_CONCURRENT, 60),
+    maxConnections: num(e.SHIELD_MAX_CONNECTIONS, 100),
+    strikes: num(e.SHIELD_STRIKES, 3),
+    strikeWindowMs: num(e.SHIELD_STRIKE_WINDOW_MIN, 10) * 60000,
+    banMs: num(e.SHIELD_BAN_MINUTES, 15) * 60000,
+    maxLagMs: num(e.SHIELD_MAX_LAG_MS, 300),
+    local: flag(e.SHIELD_LOCAL),
+    allow: new Set(String(e.SHIELD_ALLOW || '').split(',').map((x) => x.trim().replace(/^::ffff:/, '')).filter(Boolean)),
+  };
+  cfgAt = now;
+  return cfg;
+}
+
+const isLoopback = (ip) => ip === '127.0.0.1' || ip === '::1' || ip === '::ffff:127.0.0.1';
+const normalize = (ip) => String(ip || '').replace(/^::ffff:/, '');
+
+// One IPv6 customer owns a whole /64 (billions of addresses): counting single addresses would let an attacker
+// rotate through them and never be limited. IPv6 visitors are counted by their /64 prefix, IPv4 by address.
+function keyOf(ip) {
+  if (!ip.includes(':')) return ip;
+  const s = ip.split('%')[0];
+  if (s.includes('.')) return ip; // an embedded IPv4 form: leave as is
+  const dbl = s.includes('::');
+  const [h, t] = s.split('::');
+  const head = h ? h.split(':') : [];
+  const tail = dbl && t ? t.split(':') : [];
+  const fill = dbl ? 8 - head.length - tail.length : 0;
+  if (fill < 0 || (!dbl && head.length !== 8)) return ip;
+  const groups = [...head, ...Array(fill).fill('0'), ...tail].map((x) => parseInt(x, 16));
+  if (groups.length !== 8 || groups.some((x) => Number.isNaN(x))) return ip;
+  return groups.slice(0, 4).map((x) => x.toString(16)).join(':') + '::/64';
+}
+
+function entry(ip, now) {
+  let e = ips.get(ip);
+  if (!e) {
+    if (ips.size >= MAX_ENTRIES) prune(true);
+    e = { windowStart: now, count: 0, struck: false, strikes: [], level: 0, lastBanAt: 0, bannedUntil: 0, inflight: 0, last: now };
+    ips.set(ip, e);
+  }
+  e.last = now;
+  return e;
+}
+
+// Drops addresses that are idle and not banned. `hard` also drops the oldest when the table is full.
+function prune(hard = false) {
+  const now = Date.now();
+  for (const [ip, e] of ips) {
+    if (e.bannedUntil > now || e.inflight > 0) continue;
+    if (now - e.last > 10 * 60000 && (!e.lastBanAt || now - e.lastBanAt > DAY)) ips.delete(ip);
+  }
+  if (hard && ips.size >= MAX_ENTRIES) {
+    for (const [ip, e] of ips) { if (e.bannedUntil <= now && e.inflight === 0) { ips.delete(ip); if (ips.size < MAX_ENTRIES * 0.9) break; } }
+  }
+}
+
+function ensureRunning() {
+  if (timers.length) return;
+  try {
+    const { monitorEventLoopDelay } = require('perf_hooks');
+    lagMonitor = monitorEventLoopDelay({ resolution: 20 });
+    lagMonitor.enable();
+  } catch (_) { lagMonitor = null; }
+  const t1 = setInterval(() => {
+    if (lagMonitor) { lagMs = lagMonitor.percentile(99) / 1e6; lagMonitor.reset(); }
+    const c = config();
+    if (c.enabled && lagMs > c.maxLagMs && !ensureRunning.warned) {
+      ensureRunning.warned = true;
+      console.warn(`  [Kreft Shield] The server is overloaded (event loop lag ${Math.round(lagMs)} ms): per-address limits are cut to a quarter.`);
+    } else if (lagMs <= c.maxLagMs) ensureRunning.warned = false;
+  }, 5000);
+  const t2 = setInterval(() => prune(), 60000);
+  timers = [t1, t2];
+  timers.forEach((t) => t.unref && t.unref());
+  try { require('./gc.js').onMemoryPressure('shield', () => { const before = ips.size; prune(true); return before - ips.size; }); } catch (_) {}
+}
+
+function banEntry(ip, e, ms, reason) {
+  const now = Date.now();
+  e.bannedUntil = now + ms;
+  e.lastBanAt = now;
+  e.level++;
+  e.strikes = [];
+  stats.bans++;
+  const info = { ip, minutes: Math.round(ms / 60000), reason, until: new Date(e.bannedUntil).toISOString(), level: e.level };
+  console.warn(`  [Kreft Shield] Banned ${ip} for ${info.minutes} min (${reason}).`);
+  events.emit('ban', info);
+  return info;
+}
+
+function refuse(res, seconds, why) {
+  stats.blocked++;
+  try {
+    res.writeHead(429, { 'Retry-After': String(Math.max(1, Math.ceil(seconds))), 'Content-Type': 'text/plain; charset=utf-8', 'Cache-Control': 'no-store', Connection: 'close' });
+    res.end(why);
+  } catch (_) { try { res.destroy(); } catch (__) {} }
+  return true;
+}
+
+/**
+ * Call first for every request. Returns true when it already answered (the request must stop there).
+ */
+function guard(req, res) {
+  const c = config();
+  if (!c.enabled) return false;
+  ensureRunning();
+  let ip;
+  try { ip = normalize(require('./http.js').Request.prototype.ip.call({ raw: req })); } catch (_) { ip = normalize(req.socket && req.socket.remoteAddress); }
+  if (!ip) return false;
+  // Behind a proxy that is not in TRUSTED_PROXIES every visitor looks like the proxy: one address (all users would
+  // share one limit and one ban) or, for a proxy on this computer, loopback (which is never limited). Say so once.
+  if (!warnedProxy && req.headers['x-forwarded-for'] && ip === normalize(req.socket && req.socket.remoteAddress)) {
+    warnedProxy = true;
+    console.warn(`  [Kreft Shield] Requests carry X-Forwarded-For, but ${ip} is not in TRUSTED_PROXIES, so the real visitor address is unknown and the Shield cannot tell visitors apart. Behind nginx, Caddy or a CDN, set TRUSTED_PROXIES in .env.`);
+  }
+  if (c.allow.has(ip) || (isLoopback(ip) && !c.local)) return false;
+
+  const now = Date.now();
+  const key = keyOf(ip);
+  const e = entry(key, now);
+
+  if (e.bannedUntil > now) return refuse(res, (e.bannedUntil - now) / 1000, 'Too many requests. Try again later.');
+  if (e.bannedUntil && e.bannedUntil <= now) e.bannedUntil = 0;
+  if (e.level && e.lastBanAt && now - e.lastBanAt > DAY) e.level = 0;
+
+  if (now - e.windowStart >= c.windowMs) { e.windowStart = now; e.count = 0; e.struck = false; }
+  e.strikes = e.strikes.filter((t) => now - t < c.strikeWindowMs);
+
+  const overloaded = lagMs > c.maxLagMs;
+  const limit = Math.max(5, Math.floor(c.maxRequests / (overloaded ? 4 : 1)));
+  const concurrent = Math.max(3, Math.floor(c.maxConcurrent / (overloaded ? 4 : 1)));
+  e.count++;
+
+  const overRate = e.count > limit;
+  const overConc = e.inflight >= concurrent;
+  if (overRate || overConc) {
+    stats.limited++;
+    if (!e.struck) {
+      e.struck = true;
+      e.strikes.push(now);
+      if (e.strikes.length >= c.strikes) {
+        const ms = Math.min(DAY, c.banMs * 2 ** e.level);
+        banEntry(key, e, ms, `${e.strikes.length} rate-limit hits in ${Math.round(c.strikeWindowMs / 60000)} min`);
+        return refuse(res, ms / 1000, 'Too many requests. Try again later.');
+      }
+    }
+    return refuse(res, (e.windowStart + c.windowMs - now) / 1000, 'Too many requests. Slow down.');
+  }
+
+  e.inflight++;
+  let done = false;
+  const finish = () => { if (done) return; done = true; e.inflight = Math.max(0, e.inflight - 1); };
+  res.once('close', finish);
+  res.once('finish', () => {
+    // probing (wrong login, missing pages, forbidden) costs more, so scanners trip the limit early
+    const s = res.statusCode;
+    if (s === 401 || s === 403 || s === 404 || s === 405) e.count += c.errorWeight - 1;
+    finish();
+  });
+  return false;
+}
+
+const Shield = {
+  guard,
+  enabled: () => config().enabled,
+  on: (event, fn) => { events.on(event, fn); return Shield; },
+  off: (event, fn) => { events.off(event, fn); return Shield; },
+  /**
+   * Caps open connections per direct address (call once on the http.Server). Connections from this computer or from a
+   * proxy in TRUSTED_PROXIES are not capped here: they carry many visitors, and the request limits tell those apart.
+   */
+  watch(server) {
+    server.on('connection', (sock) => {
+      const c = config();
+      if (!c.enabled) return;
+      const ip = normalize(sock.remoteAddress);
+      const trusted = String(process.env.TRUSTED_PROXIES || '').split(',').map((x) => normalize(x.trim())).filter(Boolean);
+      if (!ip || c.allow.has(ip) || (isLoopback(ip) && !c.local) || trusted.includes('*') || trusted.includes(ip)) return;
+      const key = keyOf(ip);
+      const n = (conns.get(key) || 0) + 1;
+      if (n > c.maxConnections) { stats.blocked++; sock.destroy(); return; }
+      conns.set(key, n);
+      sock.once('close', () => { const m = (conns.get(key) || 1) - 1; if (m <= 0) conns.delete(key); else conns.set(key, m); });
+    });
+    return Shield;
+  },
+  /** Currently banned addresses. */
+  bans() {
+    const now = Date.now();
+    const out = [];
+    for (const [ip, e] of ips) if (e.bannedUntil > now) out.push({ ip, until: new Date(e.bannedUntil).toISOString(), level: e.level, secondsLeft: Math.ceil((e.bannedUntil - now) / 1000) });
+    return out;
+  },
+  ban(ip, minutes = 60, reason = 'manual') { const a = keyOf(normalize(ip)); return banEntry(a, entry(a, Date.now()), minutes * 60000, reason); },
+  unban(ip) {
+    const e = ips.get(keyOf(normalize(ip)));
+    if (!e) return false;
+    e.bannedUntil = 0; e.level = 0; e.strikes = []; e.count = 0; e.struck = false;
+    return true;
+  },
+  status() {
+    const c = config();
+    return { enabled: c.enabled, tracked: ips.size, banned: Shield.bans().length, ...stats, eventLoopLagMs: Math.round(lagMs), overloaded: lagMs > c.maxLagMs, limits: { maxRequests: c.maxRequests, windowSec: c.windowMs / 1000, maxConcurrent: c.maxConcurrent, strikes: c.strikes, banMinutes: c.banMs / 60000 } };
+  },
+  /** For tests: forget everything and stop the timers. */
+  reset() {
+    ips.clear(); conns.clear(); warnedProxy = false; cfg = null; lagMs = 0; stats.blocked = stats.limited = stats.bans = 0;
+    timers.forEach(clearInterval); timers = [];
+    if (lagMonitor) { try { lagMonitor.disable(); } catch (_) {} lagMonitor = null; }
+  },
+};
+
+module.exports = { Shield, _keyOf: keyOf };

package/bin/backend/stream.js

@@ -0,0 +1,74 @@
+// Sending a file the way a video player needs it: byte ranges (206), so the browser can seek and Safari plays at all.
+const fs = require('fs');
+const path = require('path');
+
+const MEDIA_TYPES = {
+  '.mp4': 'video/mp4', '.m4v': 'video/mp4', '.webm': 'video/webm', '.ogv': 'video/ogg', '.mov': 'video/quicktime', '.mkv': 'video/x-matroska',
+  '.mp3': 'audio/mpeg', '.m4a': 'audio/mp4', '.aac': 'audio/aac', '.ogg': 'audio/ogg', '.oga': 'audio/ogg', '.wav': 'audio/wav', '.opus': 'audio/ogg', '.flac': 'audio/flac',
+  '.m3u8': 'application/vnd.apple.mpegurl', '.ts': 'video/mp2t', '.m4s': 'video/iso.segment', '.mpd': 'application/dash+xml', '.vtt': 'text/vtt',
+};
+
+// "bytes=0-99", "bytes=100-", "bytes=-500" -> { start, end } | null (no range) | false (cannot be satisfied)
+function parseRange(header, size) {
+  if (!header) return null;
+  const m = /^bytes=(\d*)-(\d*)$/.exec(String(header).trim()); // one range only; several ranges are answered with the whole file
+  if (!m || (m[1] === '' && m[2] === '')) return null;
+  let start, end;
+  if (m[1] === '') { // the last N bytes
+    const n = Number(m[2]);
+    if (n === 0) return false;
+    start = Math.max(0, size - n); end = size - 1;
+  } else {
+    start = Number(m[1]);
+    end = m[2] === '' ? size - 1 : Math.min(Number(m[2]), size - 1);
+  }
+  if (!Number.isFinite(start) || !Number.isFinite(end) || start > end || start >= size) return false;
+  return { start, end };
+}
+
+// sendFile(req, res, file, { type, headers, status, download })
+function sendFile(req, res, file, opts = {}) {
+  req = req || res.req;
+  let stat;
+  try { stat = fs.statSync(file); if (!stat.isFile()) throw new Error('not a file'); } catch (_) {
+    if (!res.headersSent) res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
+    return res.end('Not found');
+  }
+  const size = stat.size;
+  const type = opts.type || MEDIA_TYPES[path.extname(file).toLowerCase()] || 'application/octet-stream';
+  const etag = `W/"${size.toString(16)}-${Math.floor(stat.mtimeMs).toString(16)}"`;
+  const headers = {
+    'Content-Type': type,
+    'Accept-Ranges': 'bytes',
+    'Last-Modified': stat.mtime.toUTCString(),
+    ETag: etag,
+    'X-Content-Type-Options': 'nosniff',
+    ...(opts.download ? { 'Content-Disposition': `attachment; filename*=UTF-8''${encodeURIComponent(path.basename(file))}` } : {}),
+    ...(opts.headers || {}),
+  };
+  const method = (req && req.method) || 'GET';
+  const h = (req && req.headers) || {};
+
+  if (h['if-none-match'] === etag && !h.range) { res.writeHead(304, headers); return res.end(); }
+
+  let range = parseRange(h.range, size);
+  // If-Range: only honor the range when the file is still the one the client started with
+  if (range && h['if-range'] && h['if-range'] !== etag && h['if-range'] !== headers['Last-Modified']) range = null;
+  if (range === false) {
+    res.writeHead(416, { 'Content-Range': `bytes */${size}`, 'Content-Type': 'text/plain; charset=utf-8' });
+    return res.end('Range not satisfiable');
+  }
+
+  let status = opts.status || 200, start = 0, end = size - 1;
+  if (range) { status = 206; ({ start, end } = range); headers['Content-Range'] = `bytes ${start}-${end}/${size}`; }
+  headers['Content-Length'] = size === 0 ? 0 : end - start + 1;
+  res.writeHead(status, headers);
+  if (method === 'HEAD' || size === 0) return res.end();
+
+  const stream = fs.createReadStream(file, { start, end });
+  stream.on('error', () => res.destroy());
+  res.on('close', () => stream.destroy()); // the viewer seeked or left: stop reading
+  stream.pipe(res);
+}
+
+module.exports = { sendFile, parseRange, MEDIA_TYPES };

package/bin/build.js

@@ -25,7 +25,7 @@ const path = require('path');
 const Kreftjs = require('../kreftjs.js');
 
 const { expandBlocks, prepareTemplate, splitKreft, splitInterp, exactBrace, stripBrace, interpToExpr, quoteBraceAttrs, expandSelfClosing,
-  scopeCss, hashString, propType, simplePathRE, fnExpRE, forAliasRE, stripTypeScript } = Kreftjs.__internal;
+  scopeCss, hashString, propType, typeCheck, caseCond, simplePathRE, fnExpRE, forAliasRE, stripTypeScript } = Kreftjs.__internal;
 
 const deps = require('./deps.js');
 // component files: .kreft, or .kreftjs in a project from the 0.0.x betas
@@ -329,12 +329,16 @@ function compileFile(file, rel, root) {
 
   // props: keep the default as a function so every instance gets its own copy
   const props = Object.entries(sp.props).map(([p, expr]) => {
-    if (expr == null) return `${JSON.stringify(p)}: {}`;
+    // `prop size: 'sm' | 'lg'`: the type text is kept, so the built app warns about a wrong value too
+    const ti = sp.propTypes && sp.propTypes[p];
+    const simple = ti && { string: 'String', number: 'Number', boolean: 'Boolean' }[ti.type.trim()];
+    const typed = ti ? `, typeText: ${JSON.stringify(ti.type)}, check: Kreftjs.__typeCheck(${JSON.stringify(ti.type)})${ti.required ? ', required: true' : ''}` : '';
+    if (expr == null) return `${JSON.stringify(p)}: { ${simple ? `type: ${simple}` : ''}${typed} }`.replace('{ , ', '{ ').replace('{  }', '{}');
     let sample;
     try { sample = new Function(`return (${expr})`)(); } catch (_) { /* uses something only known at runtime */ }
-    if (typeof sample === 'function') return `${JSON.stringify(p)}: { type: Function, default: (${expr}) }`;
+    if (typeof sample === 'function') return `${JSON.stringify(p)}: { type: Function, default: (${expr})${typed} }`;
     const type = propType(sample);
-    return `${JSON.stringify(p)}: { ${type ? `type: ${type.name}, ` : ''}default: function () { return (${expr}); } }`;
+    return `${JSON.stringify(p)}: { ${type ? `type: ${type.name}, ` : ''}default: function () { return (${expr}); }${typed} }`;
   });
 
   // imports: other .kreft files become component references; .js modules load with import()
@@ -439,12 +443,15 @@ function addRouterTemplates(fns) {
   addHandler(fns, 'navigate($event)');
 }
 
-const STRUCTURAL = new Set(['if', 'elif', 'else', 'each', 'key', 'ref', 'skip', 'cloak', 'slot', 'empty', 'once', 'animate', 'waiting', 'failed']);
+const STRUCTURAL = new Set(['match', 'case', 'default', 'if', 'elif', 'else', 'each', 'key', 'ref', 'skip', 'cloak', 'slot', 'empty', 'once', 'animate', 'waiting', 'failed']);
 
 function collectExpressions(template, fns) {
   const html = prepareTemplate(template);
+  const subjects = []; // k-match subjects seen so far: a k-case is compared with one of them
   scanHtml(html, {
     attr(name, value) {
+      if (name === 'k-match') { const v = stripBrace(value); subjects.push(v); return addEval(fns, v); }
+      if (name === 'k-case') { const raw = stripBrace(value); for (const sub of subjects) addEval(fns, caseCond(sub, raw)); return; }
       if (name[0] === ':' || name === 'k-bind' || name.startsWith('k-bind:')) return addEval(fns, value);
       if (name[0] === '@' || name.startsWith('k-on:')) return addHandler(fns, stripBrace(value));
       if (name.startsWith('k-')) {

package/bin/db-api.js

@@ -16,10 +16,14 @@
  * Which tables, and what each allows, comes from `tables` (kreftjs.config.json):
  *   { "posts": true, "users": { "write": false, "hidden": ["password"] }, "logs": false }
  * `kreft dev` shows every table unless you list them; `kreft serve` shows only the tables you list.
+ * Credential-looking columns (password, token, secret, hash, …) are hidden by default ("show": ["token"] opens one), and
+ * tables of sessions, tokens and jobs are only opened when named in the list.
  */
 const { validate } = require('../kreftjs.js'); // the same rules as Kreftjs.validate in the browser
 const MAX_BODY = 1024 * 1024;
 const MAX_ROWS = 1000;
+const SECRET_COL_RE = /(password|passwd|secret|token|api_?key|private_?key|recovery_?code|remember|two_factor|salt|hash)/i;
+const SECRET_TABLE_RE = /^(personal_access_tokens|password_reset_tokens|password_resets|sessions|failed_jobs|jobs|job_batches|cache|cache_locks)$/i;
 
 function createDbApi(db, { tables: allow = null, production = false, prefix = '/api', log = console } = {}) {
   const isProd = Boolean(production || process.env.APP_ENV === 'production' || process.env.NODE_ENV === 'production');
@@ -29,13 +33,17 @@ function createDbApi(db, { tables: allow = null, production = false, prefix = '/
     const out = new Map();
     for (const t of all) {
       if (t.name === 'kreft_migrations') continue;
+      // tables that hold logins, tokens or queued payloads are never shown by default, even by `kreft dev` with no list:
+      // only a table named in kreftjs.config.json is opened
+      if (SECRET_TABLE_RE.test(t.name) && !(allow && allow[t.name] != null && allow[t.name] !== false)) continue;
       let rules = allow ? allow[t.name] : true;
       if (rules == null || rules === false) continue;
       if (rules === true) rules = {};
       const write = rules.write === undefined ? true : rules.write;
       out.set(t.name, {
         ...t,
-        hidden: new Set(rules.hidden || []),
+        // columns that look like credentials are hidden unless "show": ["token"] lists them (a "hidden" list adds to them)
+        hidden: new Set([...t.columns.map((c) => c.name).filter((n) => SECRET_COL_RE.test(n) && !(rules.show || []).includes(n)), ...(rules.hidden || [])]),
         rules: rules.rules || null, // { "title": "required|min:3", "email": "required|email" }
         can: {
           read: rules.read !== false,

package/bin/kreftjs.js

@@ -583,6 +583,30 @@ function copyFolder(from, to) {
 }
 
 /* ------------------------------------------------------------------ kreft vscode */
+/* VS Code only loads extensions listed in extensions.json, and after "Uninstall" it keeps the folder in .obsolete and
+   deletes it on the next start. Copying the folder is not enough after an uninstall: list it again and clear .obsolete. */
+function registerExtension(dir, folder, version) {
+  const id = 'kreft.kreftjs';
+  const location = path.join(dir, folder);
+  try {
+    const file = path.join(dir, 'extensions.json');
+    let list = [];
+    if (fs.existsSync(file)) { try { list = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { list = []; } }
+    if (!Array.isArray(list)) list = [];
+    list = list.filter((e) => !(e && e.identifier && /^kreft\.kreft(js)?$/.test(e.identifier.id)));
+    list.push({ identifier: { id }, version, location: { $mid: 1, fsPath: location, external: 'file://' + location, path: location, scheme: 'file' }, relativeLocation: folder, metadata: { installedTimestamp: Date.now(), pinned: false, source: 'resource', isApplicationScoped: false, isMachineScoped: false, isBuiltin: false, targetPlatform: 'undefined' } });
+    fs.writeFileSync(file, JSON.stringify(list));
+  } catch {}
+  try {
+    const file = path.join(dir, '.obsolete');
+    if (fs.existsSync(file)) {
+      const o = JSON.parse(fs.readFileSync(file, 'utf8'));
+      for (const k of Object.keys(o)) if (k.startsWith('kreft.kreftjs-') || k.startsWith('kreft.kreft-')) delete o[k];
+      fs.writeFileSync(file, JSON.stringify(o));
+    }
+  } catch {}
+}
+
 function installVscode() {
   const os = require('os');
   const from = path.join(__dirname, '..', 'editors', 'vscode');
@@ -595,6 +619,7 @@ function installVscode() {
     fs.mkdirSync(dir, { recursive: true });
     fs.readdirSync(dir).filter((n) => n.startsWith('kreft.kreftjs-') || n.startsWith('kreft.kreft-')) /* the older extensions go too */.forEach((n) => fs.rmSync(path.join(dir, n), { recursive: true, force: true }));
     copyFolder(from, path.join(dir, `kreft.kreftjs-${ext.version}`));
+    registerExtension(dir, `kreft.kreftjs-${ext.version}`, ext.version);
     console.log(`  Installed in ${path.join(dir, `kreft.kreftjs-${ext.version}`)}`);
   }
   // Ensure current project .vscode/settings.json maps .kreft files to Kreft and configures formatter
@@ -615,7 +640,7 @@ function installVscode() {
 /* ------------------------------------------------------------------ kreft dev */
 async function devServer(args, { production = false } = {}) {
   const isProd = Boolean(production || process.env.APP_ENV === 'production' || process.env.NODE_ENV === 'production');
-  let port = production ? Number(process.env.PORT) || 8000 : 8000, folder = production ? 'dist' : '.', apiFile = null, delay = 0, saveApi = true, hot = !production, dbUrl = null, migrations = null, serverFolder = null, backendFolder = null, seedNew = false;
+  let port = production ? Number(process.env.PORT) || 8000 : 8000, folder = production ? 'dist' : '.', apiFile = null, delay = 0, saveApi = true, hot = !production, dbUrl = null, migrations = null, serverFolder = null, backendFolder = null, seedNew = false, force = false;
   // kreft dev only answers this computer; --host 0.0.0.0 shares it on your network.
   // kreft serve answers everyone (HOST in the environment can narrow it).
   let host = production ? process.env.HOST || '0.0.0.0' : '127.0.0.1';
@@ -630,6 +655,7 @@ async function devServer(args, { production = false } = {}) {
     else if (args[i] === '--server') serverFolder = path.resolve(args[++i]);
     else if (args[i] === '--backend') backendFolder = path.resolve(args[++i]);
     else if (args[i] === '--seed') seedNew = true;
+    else if (args[i] === '--force') force = true;
     else if (args[i] === '--host') host = args[++i];
     else if (/^\d+$/.test(args[i])) port = Number(args[i]);
     else folder = args[i];
@@ -655,6 +681,16 @@ async function devServer(args, { production = false } = {}) {
   const backendDir = backendFolder || (lay.split ? lay.backend : envDir);
   const apiRoutesFile = require('./backend/typescript.js').findFile(path.join(backendDir, 'routes', 'api')); // api.js or api.ts
   const hasBackend = Boolean(apiRoutesFile);
+  // Not a Kreft project and nothing to show: do not start a server on whatever folder this happens to be (an empty
+  // one, or your home folder). --force serves it anyway.
+  if (!force && !dbUrl && !apiFile && !serverFolder && !hasBackend && !lay.split) {
+    const names = (() => { try { return fs.readdirSync(root); } catch (_) { return []; } })();
+    const isSite = names.includes('index.html') || names.some((n) => /\.kreft$/.test(n)) || fs.existsSync(path.join(root, 'demo', 'index.html')) || fs.existsSync(path.join(config.dir || root, 'kreftjs.config.json'));
+    if (!isSite) {
+      console.error(`  ${path.resolve(root)} is not a Kreft project: there is no index.html, no frontend/ folder and no .kreft pages.\n\n  Make one:                  kreft new my-app   (then: cd my-app, kreft dev)\n  Or go into your project:   cd path/to/your-app\n  To serve this folder anyway: kreft ${production ? 'serve' : 'dev'} ${folder === '.' ? '' : folder + ' '}--force`);
+      process.exit(1);
+    }
+  }
   // kreftjs serve: the backend must not sit inside the folder that is served, or its files could be downloaded
   if (production && hasBackend && (backendDir === root || backendDir.startsWith(root + path.sep))) {
     console.error(`  The backend (${backendDir}) is inside the folder being served (${root}).\n  Serve the built site instead: kreft build, then kreft serve dist`);
@@ -736,7 +772,7 @@ async function devServer(args, { production = false } = {}) {
     '.html': 'text/html', '.js': 'text/javascript', '.mjs': 'text/javascript', '.kreft': 'text/plain', '.kreftjs': 'text/plain',
     '.css': 'text/css', '.json': 'application/json', '.svg': 'image/svg+xml', '.png': 'image/png',
     '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif', '.webp': 'image/webp',
-    '.ico': 'image/x-icon', '.woff2': 'font/woff2', '.woff': 'font/woff', '.txt': 'text/plain', '.md': 'text/markdown',
+    '.ico': 'image/x-icon', ...(({ '.ts': _ts, ...media }) => media)(require('./backend/stream.js').MEDIA_TYPES), '.woff2': 'font/woff2', '.woff': 'font/woff', '.txt': 'text/plain', '.md': 'text/markdown',
   };
   const isFile = (p) => { try { return fs.statSync(p).isFile(); } catch (_) { return false; } };
 
@@ -754,12 +790,15 @@ async function devServer(args, { production = false } = {}) {
       }
     }
     const type = types[path.extname(file).toLowerCase()] || 'application/octet-stream';
-    res.writeHead(opts.status || 200, {
+    const fileHeaders = {
       'Content-Type': type + (type.startsWith('text/') || type.endsWith('json') ? '; charset=utf-8' : ''),
       'Cache-Control': isProd ? 'no-cache' : 'no-store', // dev: always pick up your latest changes
       'X-Content-Type-Options': 'nosniff',
       ...prodHeaders,
-    });
+    };
+    // everything but pages is sent with byte ranges (video and audio seek, Safari plays)
+    if (type !== 'text/html') return require('./backend/stream.js').sendFile(res.req, res, file, { status: opts.status, type: fileHeaders['Content-Type'], headers: fileHeaders });
+    res.writeHead(opts.status || 200, fileHeaders);
     if (!production && type === 'text/html') {
       let html = fs.readFileSync(file, 'utf8');
       // PUBLIC_ values from .env, as Kreftjs.env (kreft build puts them in app.js)
@@ -794,12 +833,9 @@ async function devServer(args, { production = false } = {}) {
       return res.end(opts.seo ? require('./backend/seo-pages.js').inject(html, opts.seo) : html);
     }
     if (type === 'text/html' && opts.seo) return res.end(require('./backend/seo-pages.js').inject(fs.readFileSync(file, 'utf8'), opts.seo));
-    const stream = fs.createReadStream(file);
-    stream.on('error', () => {
-      if (!res.headersSent) res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
-      res.end('Not found');
-    });
-    stream.pipe(res);
+    const page = fs.createReadStream(file); // a page in production: headers are written, send it whole
+    page.on('error', () => res.end('Not found'));
+    page.pipe(res);
   }
 
   // ----- hot reload: watch the folder, tell open pages what changed -----
@@ -1035,6 +1071,8 @@ async function devServer(args, { production = false } = {}) {
 
   const server = http.createServer(async (req, res) => {
     try {
+      // SHIELD=true in .env: rate limits, bans and load shedding per visitor address (see backend/shield.js)
+      if (require('./backend/shield.js').Shield.guard(req, res)) return;
       if (loopbackBind && !isLocalName(hostOnly(req.headers.host)) && !allowedHosts.has(hostOnly(req.headers.host))) {
         res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
         return res.end(`Blocked: this server only answers localhost. To reach it by the name "${hostOnly(req.headers.host)}", start it with KREFT_ALLOWED_HOSTS=${hostOnly(req.headers.host)} (or --host 0.0.0.0 to share it on your network).`);
@@ -1109,8 +1147,7 @@ async function devServer(args, { production = false } = {}) {
         const realPub = real(pub), realF = real(f);
         if ((f.startsWith(pub + path.sep)) && !secret(urlPath) && isFile(f) && realPub && realF && realF.startsWith(realPub + path.sep)) {
           const type = types[path.extname(f).toLowerCase()] || 'application/octet-stream';
-          res.writeHead(200, { 'Content-Type': type, 'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': "default-src 'none'; img-src 'self'; style-src 'unsafe-inline'; sandbox", 'Cache-Control': 'public, max-age=3600' });
-          return fs.createReadStream(f).pipe(res);
+          return require('./backend/stream.js').sendFile(req, res, f, { type, headers: { 'Content-Security-Policy': "default-src 'none'; img-src 'self'; media-src 'self'; style-src 'unsafe-inline'; sandbox", 'Cache-Control': /\.(m3u8|mpd)$/i.test(f) ? 'no-cache' : 'public, max-age=3600' } }); // a live playlist changes every few seconds
         }
         res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
         return res.end('Not found: ' + urlPath);
@@ -1153,6 +1190,7 @@ async function devServer(args, { production = false } = {}) {
 
   // if the port is taken (another server is still running), try the next one
   let tries = 0;
+  require('./backend/shield.js').Shield.watch(server); // SHIELD=true: caps open connections per address
   server.on('error', (err) => {
     if (err.code === 'EADDRINUSE' && tries < 20) {
       console.log(`  Port ${port + tries} is already in use by another program, trying ${port + tries + 1}…`);