lambder 6.0.2 → 7.0.1

package/dist/core/LambderResponse.js

@@ -1,6 +1,9 @@
-import { getCrypto } from "../shared/node-polyfills.js";
-import { compressText } from "../shared/LambderCompressionCodec.js";
-export const normalizeHeaders = (headers) => Object.fromEntries(Object.entries(headers ?? {}).map(([k, v]) => [k, Array.isArray(v) ? [...v] : [v]]));
+import { LAMBDER_RESPONSE_BRAND } from "../shared/util/LambderResponseBrand.js";
+import { bytesToBase64 } from "../shared/util/LambderBase64.js";
+import { getCrypto } from "../shared/util/LambderNodeModules.js";
+import { compressText } from "../shared/wire/LambderCompressionCodec.js";
+import { getAnswerHeader, setAnswerHeader, addAnswerHeader } from "../shared/wire/LambderAnswerHeaders.js";
+const normalizeHeaders = (headers) => Object.fromEntries(Object.entries(headers ?? {}).map(([k, v]) => [k, Array.isArray(v) ? [...v] : [v]]));
 /**
  * Intermediate response object returned by all response builder methods and by
  * route/api handlers. Bodies stay uncompressed and un-encoded so hooks can
@@ -11,6 +14,7 @@ export const normalizeHeaders = (headers) => Object.fromEntries(Object.entries(h
  * the request: the thrown response becomes the response.
  */
 export class LambderResponse {
+    [LAMBDER_RESPONSE_BRAND] = true;
     statusCode;
     headers;
     body;
@@ -25,36 +29,63 @@ export class LambderResponse {
         this.compress = init.compress ?? "auto";
         this.etag = init.etag ?? "auto";
     }
+    // The three header methods are the core's own header helpers over this
+    // response's map: the case-insensitive lookup, the replace-under-any-casing
+    // and the append-under-the-existing-casing rules are one implementation,
+    // not a copy per class, so an answer and a response can never disagree
+    // about what setting a header means.
     getHeader(key) {
-        const lower = key.toLowerCase();
-        for (const [k, v] of Object.entries(this.headers)) {
-            if (k.toLowerCase() === lower)
-                return v;
-        }
-        return undefined;
+        return getAnswerHeader(this.headers, key);
     }
     setHeader(key, value) {
-        const lower = key.toLowerCase();
-        for (const k of Object.keys(this.headers)) {
-            if (k.toLowerCase() === lower)
-                delete this.headers[k];
-        }
-        this.headers[key] = Array.isArray(value) ? [...value] : [value];
+        setAnswerHeader(this.headers, key, value);
         return this;
     }
     addHeader(key, value) {
-        const lower = key.toLowerCase();
-        const existingKey = Object.keys(this.headers).find((k) => k.toLowerCase() === lower);
-        if (existingKey) {
-            this.headers[existingKey].push(value);
-        }
-        else {
-            this.headers[key] = [value];
-        }
+        addAnswerHeader(this.headers, key, value);
         return this;
     }
 }
-export const isCompressibleContentType = (contentType) => {
+/**
+ * A handler's response as a core answer: what the API pipeline stores,
+ * replays and hands back. A Buffer body travels base64-encoded and marked
+ * as such, so the idempotency engine never caches it and finalization
+ * passes it through untouched; the compress and etag flags ride along so
+ * nothing a handler asked for is lost on the way through the core.
+ */
+export const answerFromResponse = (response) => {
+    const binary = Buffer.isBuffer(response.body);
+    return {
+        statusCode: response.statusCode,
+        headers: normalizeHeaders(response.headers),
+        body: response.body === null ? "" : binary ? bytesToBase64(response.body) : String(response.body),
+        isBodyBase64: response.isBodyBase64 || binary,
+        compress: response.compress,
+        etag: response.etag,
+    };
+};
+/**
+ * An answer's status as the response model spells statuses.
+ *
+ * LambderHttpStatusCode is an authoring surface: it exists so `res.status(...)`
+ * offers the codes an app writes and catches the typo'd one. An answer is
+ * plain data that already left that surface (a replay the idempotency store
+ * persisted, a mock's answer, a third adapter's), so its status is a number
+ * and a code outside the union is not a reason to refuse a request the app
+ * has already answered. Stated once here rather than as a bare cast at the
+ * call site, so the widening is a decision a reader can see.
+ */
+const httpStatusOfAnswer = (statusCode) => statusCode;
+/** A core answer as the response hooks, CORS and finalization work on. */
+export const responseFromAnswer = (answer) => new LambderResponse({
+    statusCode: httpStatusOfAnswer(answer.statusCode),
+    headers: answer.headers,
+    body: answer.body,
+    isBodyBase64: answer.isBodyBase64 ?? false,
+    compress: answer.compress ?? "auto",
+    etag: answer.etag ?? "auto",
+});
+const isCompressibleContentType = (contentType) => {
     if (!contentType)
         return false;
     const mime = (contentType.split(";")[0] ?? "").trim().toLowerCase();
@@ -72,7 +103,7 @@ export const isCompressibleContentType = (contentType) => {
         "application/lambder-json-stream",
     ].includes(mime);
 };
-export const acceptsEncoding = (acceptEncoding, encoding) => {
+const acceptsEncoding = (acceptEncoding, encoding) => {
     if (!acceptEncoding)
         return false;
     return acceptEncoding.split(",").some((part) => {
@@ -102,18 +133,25 @@ export const DEFAULT_FINALIZE_OPTIONS = {
     etag: true,
     maxResponseBytes: 5_500_000,
 };
-const getRequestHeader = (ctx, name) => {
-    if (!ctx?.headers)
-        return undefined;
-    const lower = name.toLowerCase();
-    for (const [k, v] of Object.entries(ctx.headers)) {
-        if (k.toLowerCase() === lower)
-            return v ?? undefined;
-    }
-    return undefined;
-};
-/** Emit the format-specific Lambda response shape. */
-const emitResponse = (format, statusCode, headers, body, isBase64Encoded) => {
+/**
+ * The headers a 304 leaves behind: they describe a body, and a 304 carries
+ * none. Everything else goes with it.
+ *
+ * A keep-list of cache headers instead of this drop-list would quietly make a
+ * revalidation the one exit of the request where the call's headers do not
+ * belong to the call: a cacheable GET that also slides a session cookie would
+ * stop refreshing it the moment the browser held the ETag, and a cross-origin
+ * revalidation would lose Access-Control-Allow-Origin, so the browser would
+ * refuse the 304 it had asked for.
+ */
+const HEADERS_DROPPED_ON_NOT_MODIFIED = ["content-type", "content-length", "content-encoding"];
+/**
+ * Emit the format-specific Lambda response shape. Exported because the
+ * last-resort crash path has to emit without finalizing (finalization may be
+ * what failed) and must still get the shape right; hand-writing it there left
+ * the v1/v2 split in four places.
+ */
+export const emitResponse = (format, statusCode, headers, body, isBase64Encoded) => {
     if (format === "v2") {
         // Payload v2 has no multiValueHeaders: multi-values are comma-joined,
         // except Set-Cookie which uses the dedicated cookies array.
@@ -135,7 +173,11 @@ const emitResponse = (format, statusCode, headers, body, isBase64Encoded) => {
  * encoding, HEAD body stripping, and Lambda payload size guard. Emits the v1
  * (REST API) or v2 (HTTP API / Function URL) response shape.
  */
-export const finalizeResponse = async (ctx, response, options, format = "v1") => {
+export const finalizeResponse = async (
+// ctx.header rather than ctx.headers: the context already carries the
+// case-insensitive lookup, and taking the raw map meant a second
+// implementation of it lived here for the two headers this reads.
+ctx, response, options, format = "v1") => {
     const method = (ctx?.method ?? "GET").toUpperCase();
     if (response.body === null) {
         return emitResponse(format, response.statusCode, response.headers, "", false);
@@ -164,7 +206,7 @@ export const finalizeResponse = async (ctx, response, options, format = "v1") =>
             // compress: true forces compression even with it globally off, so
             // the settings fall back to the defaults rather than being absent.
             const settings = options.compression ?? DEFAULT_RESPONSE_COMPRESSION_SETTINGS;
-            const acceptEncoding = getRequestHeader(ctx, "accept-encoding");
+            const acceptEncoding = ctx?.header("accept-encoding");
             const encoding = settings.encodings.find((candidate) => acceptsEncoding(acceptEncoding, candidate));
             if (encoding) {
                 // The same codec, quality and TEXT mode a stored record gets.
@@ -173,7 +215,7 @@ export const finalizeResponse = async (ctx, response, options, format = "v1") =>
             }
         }
         if (Buffer.isBuffer(response.body) || response.getHeader("Content-Encoding")) {
-            outBody = bodyBuffer.toString("base64");
+            outBody = bytesToBase64(bodyBuffer);
             isBase64 = true;
         }
         else {
@@ -189,23 +231,28 @@ export const finalizeResponse = async (ctx, response, options, format = "v1") =>
         if (crypto) {
             const etagValue = `"${crypto.createHash("sha256").update(outBody).digest("hex").slice(0, 32)}"`;
             response.setHeader("ETag", etagValue);
-            const ifNoneMatch = getRequestHeader(ctx, "if-none-match");
+            const ifNoneMatch = ctx?.header("if-none-match");
             if (ifNoneMatch && ifNoneMatch.split(",").map((s) => s.trim()).includes(etagValue)) {
-                const preservedHeaders = {};
-                for (const key of ["ETag", "Cache-Control", "Vary", "Expires", "Last-Modified"]) {
-                    const value = response.getHeader(key);
-                    if (value)
-                        preservedHeaders[key] = value;
+                const notModifiedHeaders = {};
+                for (const [key, values] of Object.entries(response.headers)) {
+                    if (!HEADERS_DROPPED_ON_NOT_MODIFIED.includes(key.toLowerCase()))
+                        notModifiedHeaders[key] = values;
                 }
-                return emitResponse(format, 304, preservedHeaders, "", false);
+                return emitResponse(format, 304, notModifiedHeaders, "", false);
             }
         }
     }
     if (method === "HEAD") {
         return emitResponse(format, response.statusCode, response.headers, "", false);
     }
-    if (outBody.length > options.maxResponseBytes) {
-        throw new Error(`Lambder: final response body is ${outBody.length} bytes which exceeds the configured ` +
+    // What Lambda weighs is bytes. A base64 body is ASCII, so its length is
+    // its byte count; a plain UTF-8 one is not, and counting its UTF-16 code
+    // units under-reported a non-ASCII response by up to 3x, which is the one
+    // way this guard could pass a body Lambda then refuses with an opaque
+    // payload-size error and no envelope.
+    const outBytes = isBase64 ? outBody.length : Buffer.byteLength(outBody, "utf8");
+    if (outBytes > options.maxResponseBytes) {
+        throw new Error(`Lambder: final response body is ${outBytes} bytes which exceeds the configured ` +
             `maxResponseBytes (${options.maxResponseBytes}). Lambda caps proxy responses at ~6MB. ` +
             `Consider pagination or enabling compression.`);
     }

package/dist/core/LambderResponseBuilder.d.ts

@@ -1,13 +1,14 @@
 import type { LambderRenderContext } from "./LambderContext.js";
-import { type LambderCookieOptions, type LambderClearCookieOptions } from "./LambderCookie.js";
+import { type LambderCookieOptions, type LambderClearCookieOptions } from "../shared/wire/LambderCookie.js";
 import type { LambderFiles } from "./LambderFiles.js";
-import { LambderResponse, type HttpStatusCode, type LambderHeadersInput } from "./LambderResponse.js";
+import { LambderResponse, type LambderHeadersInput } from "./LambderResponse.js";
+import type { LambderHttpStatusCode } from "../shared/wire/LambderHttpStatus.js";
 import { LambderSafeHtml } from "../shared/LambderHtml.js";
 import type { LambderTemplateData } from "./LambderTemplatingEngine.js";
-import type { LambderApiResponseConfig } from "../shared/LambderApiContract.js";
-export type { LambderApiResponse, LambderApiResponseConfig } from "../shared/LambderApiContract.js";
+import type { LambderApiResponseConfig, LambderApiNullAnswerConfig } from "../shared/wire/LambderApiContract.js";
+export type { LambderApiEnvelopeBody, LambderApiResponseConfig } from "../shared/wire/LambderApiContract.js";
 export type LambderResponseOptions = {
-    statusCode?: HttpStatusCode;
+    statusCode?: LambderHttpStatusCode;
     headers?: LambderHeadersInput;
     /** Shorthand for the Cache-Control header. */
     cacheControl?: string;
@@ -22,14 +23,15 @@ export type LambderResponseOptions = {
  * `message`). A bare `res.api(null)` compiles only when the output type
  * itself allows null, so a success payload is always the declared output,
  * which is what lets a typed caller (LambderInvokeCaller.api) promise it.
- * Untyped resolvers (`TOutput = any`) accept anything, as before.
+ * Untyped resolvers (`TOutput = any`) accept anything, as before. This is
+ * the resolver's method type; the core's answer type is LambderApiAnswer.
  */
-export type LambderApiAnswer<TOutput, TResult> = {
+export type LambderResolverApiMethod<TOutput, TResult> = {
     (payload: TOutput, config?: LambderApiResponseConfig, options?: LambderResponseOptions): TResult;
-    (payload: null, config: LambderApiResponseConfig, options?: LambderResponseOptions): TResult;
+    (payload: null, config: LambderApiNullAnswerConfig, options?: LambderResponseOptions): TResult;
 };
 export type LambderRawResponseInit = {
-    statusCode: HttpStatusCode;
+    statusCode: LambderHttpStatusCode;
     headers?: LambderHeadersInput;
     body: string | Buffer | null;
     /** True when body is already a base64-encoded string. */
@@ -49,7 +51,9 @@ export default class LambderResponseBuilder<TResponse = any> {
     private buildResponse;
     /** The instance's file reader, which res.file and res.templateFile need. */
     private requireFiles;
+    /** Appends a response header; applied onto the response once the handler has one, in call order. */
     addHeader(key: string, value: string): void;
+    /** Replaces a response header; applied onto the response once the handler has one, in call order. */
     setHeader(key: string, value: string | string[]): void;
     /**
      * Adds a Set-Cookie header. A function-form `domain` is resolved against
@@ -64,15 +68,15 @@ export default class LambderResponseBuilder<TResponse = any> {
      * different cookie and deletes nothing.
      */
     clearCookie(name: string, options?: LambderClearCookieOptions): void;
-    logToApiResponse(input: any): void;
+    logToApiResponse(input: unknown): void;
     raw(init: LambderRawResponseInit): LambderResponse;
     json(data: Record<string, any>, options?: LambderResponseOptions): LambderResponse;
     text(data: string, options?: LambderResponseOptions): LambderResponse;
     xml(data: string | LambderSafeHtml, options?: LambderResponseOptions): LambderResponse;
     html(data: string | LambderSafeHtml, options?: LambderResponseOptions): LambderResponse;
-    status(statusCode: HttpStatusCode, body?: string, options?: LambderResponseOptions): LambderResponse;
+    status(statusCode: LambderHttpStatusCode, body?: string, options?: LambderResponseOptions): LambderResponse;
     status404(data: string, options?: LambderResponseOptions): LambderResponse;
-    redirect(url: string, statusCode?: HttpStatusCode, options?: LambderResponseOptions): LambderResponse;
+    redirect(url: string, statusCode?: LambderHttpStatusCode, options?: LambderResponseOptions): LambderResponse;
     versionExpired(options?: LambderResponseOptions): LambderResponse;
     fileBase64(fileBase64: string, mimeType: string, options?: LambderResponseOptions): LambderResponse;
     /** A file from the files source as a response; 404 when there is none. */
@@ -89,8 +93,8 @@ export default class LambderResponseBuilder<TResponse = any> {
         htmlVirtualSlots?: boolean;
     }): Promise<LambderResponse>;
     api(payload: TResponse, config?: LambderApiResponseConfig, options?: LambderResponseOptions): LambderResponse;
-    api(payload: null, config: LambderApiResponseConfig, options?: LambderResponseOptions): LambderResponse;
+    api(payload: null, config: LambderApiNullAnswerConfig, options?: LambderResponseOptions): LambderResponse;
     /** Same as api() but forces compression of the response body. */
     apiBinary(payload: TResponse, config?: LambderApiResponseConfig, options?: LambderResponseOptions): LambderResponse;
-    apiBinary(payload: null, config: LambderApiResponseConfig, options?: LambderResponseOptions): LambderResponse;
+    apiBinary(payload: null, config: LambderApiNullAnswerConfig, options?: LambderResponseOptions): LambderResponse;
 }

package/dist/core/LambderResponseBuilder.js

@@ -1,5 +1,6 @@
-import { serializeCookie, serializeClearCookie } from "./LambderCookie.js";
+import { serializeCookie, serializeClearCookie } from "../shared/wire/LambderCookie.js";
 import { LambderResponse } from "./LambderResponse.js";
+import { buildApiEnvelope } from "../api/LambderApiEnvelope.js";
 export default class LambderResponseBuilder {
     files;
     apiVersion;
@@ -29,21 +30,21 @@ export default class LambderResponseBuilder {
     /** The instance's file reader, which res.file and res.templateFile need. */
     requireFiles(method) {
         if (!this.files)
-            throw new Error(`${method} requires the files option at creation (e.g. files: new LambderLocalFileSource({ root }))`);
+            throw new Error(`Lambder: ${method} requires the files option at creation (e.g. files: new LambderLocalFileSource({ root }))`);
         return this.files;
     }
+    /** Appends a response header; applied onto the response once the handler has one, in call order. */
     addHeader(key, value) {
         if (!this.ctx)
-            throw new Error(".addHeader function is not available within this hook");
-        this.ctx._otherInternal.addHeaderFnAccumulator.push({ key, value });
+            throw new Error("Lambder: res.addHeader needs the request context, and this response builder was created without one.");
+        this.ctx.responseHeaders.add(key, value);
     }
     ;
+    /** Replaces a response header; applied onto the response once the handler has one, in call order. */
     setHeader(key, value) {
         if (!this.ctx)
-            throw new Error(".setHeader function is not available within this hook");
-        this.ctx._otherInternal.addHeaderFnAccumulator = this.ctx._otherInternal.addHeaderFnAccumulator
-            .filter((header) => header.key !== key);
-        this.ctx._otherInternal.setHeaderFnAccumulator.push({ key, value });
+            throw new Error("Lambder: res.setHeader needs the request context, and this response builder was created without one.");
+        this.ctx.responseHeaders.set(key, value);
     }
     ;
     /**
@@ -53,7 +54,7 @@ export default class LambderResponseBuilder {
      */
     setCookie(name, value, options) {
         if (!this.ctx)
-            throw new Error(".setCookie function is not available within this hook");
+            throw new Error("Lambder: res.setCookie needs the request context, and this response builder was created without one.");
         this.addHeader("Set-Cookie", serializeCookie(name, value, options, this.ctx.host));
     }
     ;
@@ -65,14 +66,14 @@ export default class LambderResponseBuilder {
      */
     clearCookie(name, options) {
         if (!this.ctx)
-            throw new Error(".clearCookie function is not available within this hook");
+            throw new Error("Lambder: res.clearCookie needs the request context, and this response builder was created without one.");
         this.addHeader("Set-Cookie", serializeClearCookie(name, options, this.ctx.host));
     }
     ;
     logToApiResponse(input) {
         if (!this.ctx)
-            throw new Error(".logToApiResponse function is not available within this hook");
-        this.ctx._otherInternal.logToApiResponseAccumulator.push(input);
+            throw new Error("Lambder: res.logToApiResponse needs the request context, and this response builder was created without one.");
+        this.ctx.logList.push(input);
     }
     ;
     raw(init) {
@@ -157,19 +158,12 @@ export default class LambderResponseBuilder {
         return this.buildResponse(200, "text/html; charset=utf-8", template.render(data), options);
     }
     ;
-    api(payload, { versionExpired, sessionExpired, notAuthorized, message, errorMessage, logList, crash, } = {}, options) {
-        const finalLogList = logList || this.ctx?._otherInternal?.logToApiResponseAccumulator;
-        return this.json({
-            apiVersion: this.apiVersion,
-            payload,
-            ...(versionExpired ? { versionExpired } : {}),
-            ...(sessionExpired ? { sessionExpired } : {}),
-            ...(notAuthorized ? { notAuthorized } : {}),
-            ...(message ? { message } : {}),
-            ...(errorMessage ? { errorMessage } : {}),
-            ...(crash ? { crash } : {}),
-            ...(finalLogList?.length ? { logList: finalLogList } : {}),
-        }, options);
+    api(payload, config = {}, options) {
+        // The envelope is the core's (one writer for both the server and the
+        // mock runtime); the logList channel is what this request accumulated
+        // unless the config names its own.
+        const envelope = buildApiEnvelope(this.apiVersion, payload, { ...config, logList: config.logList || this.ctx?.logList });
+        return this.json(envelope, options);
     }
     ;
     apiBinary(payload, config = {}, options) {

package/dist/core/LambderRouting.d.ts

@@ -1,23 +1,34 @@
 import type { LambderRenderContext } from "./LambderContext.js";
-type Path = `/${string}`;
+/** A route path as an app writes it: absolute, so a matcher and the index-HTML layer agree on the shape. */
+export type LambderRoutePath = `/${string}`;
 type CutAt<S extends string, D extends string> = S extends `${infer Head}${D}${string}` ? Head : S;
 type ParamNameFrom<S extends string> = CutAt<CutAt<CutAt<CutAt<CutAt<CutAt<CutAt<S, "/">, ".">, "(">, "?">, "+">, "*">, "-">;
 type PathParamNames<T extends string> = T extends `${string}:${infer Rest}` ? (ParamNameFrom<Rest> extends "" ? never : ParamNameFrom<Rest>) | PathParamNames<Rest> : never;
-export type PathParamsOf<T extends string> = string extends T ? Record<string, string> : T extends `${string}(${string}` ? Record<string, string> : [PathParamNames<T>] extends [never] ? Record<string, string> : {
+export type LambderPathParamsOf<T extends string> = string extends T ? Record<string, string> : T extends `${string}(${string}` ? Record<string, string> : [PathParamNames<T>] extends [never] ? Record<string, string> : {
     [K in PathParamNames<T>]: string;
 };
-export type ConditionFunction = (ctx: LambderRenderContext) => boolean;
+export type LambderRouteConditionFn = (ctx: LambderRenderContext) => boolean;
 /** Structured route matcher: all provided fields must match. */
 export type LambderRouteMatcher = {
-    path?: Path | RegExp;
+    path?: LambderRoutePath | RegExp;
     host?: string | RegExp;
     /** One or more HTTP methods; HEAD requests also match GET routes. */
     method?: string | string[];
-    condition?: ConditionFunction;
+    condition?: LambderRouteConditionFn;
 };
-export type RouteCondition = Path | RegExp | ConditionFunction | LambderRouteMatcher;
+export type LambderRouteCondition = LambderRoutePath | RegExp | LambderRouteConditionFn | LambderRouteMatcher;
 /** Returns matched path params, or false when the route doesn't match. */
 export type CompiledMatcher = (ctx: LambderRenderContext) => false | Record<string, string>;
+/**
+ * Whether a request method is one the slot accepts, with HEAD folded into GET
+ * unless the list names HEAD itself: a HEAD is a GET whose body finalization
+ * strips, so an app that narrowed a slot to ["GET"] did not mean to 404 it.
+ *
+ * The three places that gate on a method (a route matcher's `method`,
+ * servePublicFiles and serveIndexHtml) share this one rule, so neighbouring
+ * slots cannot disagree about what a method means.
+ */
+export declare const allowsRequestMethod: (methods: ReadonlySet<string>, requestMethod: string) => boolean;
 /** Compile a route condition once at registration time. */
-export declare const compileRouteMatcher: (condition: RouteCondition) => CompiledMatcher;
+export declare const compileRouteMatcher: (condition: LambderRouteCondition) => CompiledMatcher;
 export {};

package/dist/core/LambderRouting.js

@@ -27,6 +27,21 @@ const compilePathMatcher = (path) => {
         return params;
     };
 };
+/**
+ * Whether a request method is one the slot accepts, with HEAD folded into GET
+ * unless the list names HEAD itself: a HEAD is a GET whose body finalization
+ * strips, so an app that narrowed a slot to ["GET"] did not mean to 404 it.
+ *
+ * The three places that gate on a method (a route matcher's `method`,
+ * servePublicFiles and serveIndexHtml) share this one rule, so neighbouring
+ * slots cannot disagree about what a method means.
+ */
+export const allowsRequestMethod = (methods, requestMethod) => {
+    const method = requestMethod.toUpperCase();
+    if (methods.has(method))
+        return true;
+    return method === "HEAD" && methods.has("GET");
+};
 /** Compile a route condition once at registration time. */
 export const compileRouteMatcher = (condition) => {
     if (typeof condition === "string" || condition instanceof RegExp) {
@@ -42,13 +57,8 @@ export const compileRouteMatcher = (condition) => {
         ? new Set((Array.isArray(matcher.method) ? matcher.method : [matcher.method]).map((m) => m.toUpperCase()))
         : null;
     return (ctx) => {
-        if (methods) {
-            let requestMethod = ctx.method.toUpperCase();
-            if (requestMethod === "HEAD" && !methods.has("HEAD"))
-                requestMethod = "GET";
-            if (!methods.has(requestMethod))
-                return false;
-        }
+        if (methods && !allowsRequestMethod(methods, ctx.method))
+            return false;
         if (matcher.host !== undefined) {
             if (typeof matcher.host === "string") {
                 if (ctx.host.toLowerCase() !== matcher.host.toLowerCase())

package/dist/core/LambderTemplatingEngine.d.ts

@@ -1,66 +1,4 @@
 import { type LambderHtmlValue } from "../shared/LambderHtml.js";
-/**
- * LambderTemplatingEngine: a comment-only HTML template engine.
- *
- * Fully standalone: it has no dependency on Lambder routing or file serving,
- * and can template any HTML: app shells, emails, error pages. res.templateFile
- * uses it internally to render HTML files from the files source per request.
- *
- * Every construct is an HTML comment. That is the whole point: templates
- * survive HTML build pipelines (e.g. Vite) untouched, and are invisible in the
- * browser during frontend development, where the default content between the
- * markers renders as-is.
- *
- * Syntax:
- *
- *   <!--slot:name-->default content<!--/slot:name-->    replaceable region;
- *                                                       default kept when the
- *                                                       data omits "name"
- *   <!--slot:name/-->                                   insert-only point
- *   <!--if:name--> ... <!--else--> ... <!--/if:name-->  conditional block,
- *                                                       shown when data.name
- *                                                       is truthy
- *   <!--if:!name--> ... <!--/if:!name-->                negated conditional
- *
- * Blocks nest freely (ifs in slots, slots in ifs). There are intentionally no
- * loops or inline expressions: dynamic lists are built server-side with the
- * html`...` tagged template and passed in as a slot value. Attribute-position
- * values (e.g. <html lang="...">) are handled with if/else around whole-tag
- * variants.
- *
- * Data is dynamically typed: one Record<string, LambderHtmlValue> shared by
- * slots and conditions.
- *   - strings/numbers are HTML-escaped on insertion (XSS-safe by default)
- *   - html`...` / raw() / jsonScript() values are inserted verbatim
- *   - arrays are flattened; null/undefined/false render the slot default
- *   - unknown data keys are ignored, so one data object can serve several
- *     templates with different slots
- *
- * Templates are parsed once (construction throws on unclosed or mismatched
- * blocks with a descriptive message); render() is a cheap tree walk, safe to
- * call per request. Discovered names are exposed on `slotNames` and
- * `conditionNames` for runtime validation.
- *
- * @example
- * ```typescript
- * import { LambderTemplatingEngine, html } from "lambder";
- *
- * const template = new LambderTemplatingEngine(`
- *     <title><!--slot:title-->My Site<!--/slot:title--></title>
- *     <!--if:isBeta--><meta name="robots" content="noindex" /><!--/if:isBeta-->
- *     <!--slot:head/-->
- * `);
- *
- * template.render({
- *     title: userInput,                                      // escaped
- *     isBeta: stage === "beta",
- *     head: html`<link rel="canonical" href="${canonical}" />`, // verbatim
- * });
- *
- * // Or load from disk (compile once, render many times):
- * const emailTemplate = await LambderTemplatingEngine.fromFile("./templates/welcome.html");
- * ```
- */
 export type LambderTemplateData = Record<string, LambderHtmlValue>;
 export type LambderTemplatingEngineOptions = {
     /**

package/dist/core/LambderTemplatingEngine.js

@@ -1,4 +1,4 @@
-import { getFS } from "../shared/node-polyfills.js";
+import { getFS } from "../shared/util/LambderNodeModules.js";
 import { renderHtmlValue } from "../shared/LambderHtml.js";
 const TOKEN_PATTERN = /<!--\s*(?:(slot:([\w-]+)\s*\/)|(slot:([\w-]+))|(\/slot:([\w-]+))|(if:(!?)([\w-]+))|(else)|(\/if:(!?)([\w-]+)))\s*-->/g;
 /**
@@ -92,7 +92,11 @@ const renderNodes = (nodes, data) => {
             out += value === undefined ? renderNodes(node.defaultNodes, data) : renderHtmlValue(value);
         }
         else {
-            const condition = !!data[node.name] !== node.negated;
+            // Own properties only, the same lookup the slot branch uses:
+            // through the prototype, <!--if:toString--> was unconditionally
+            // true on every render.
+            const value = Object.prototype.hasOwnProperty.call(data, node.name) ? data[node.name] : undefined;
+            const condition = !!value !== node.negated;
             out += renderNodes(condition ? node.thenNodes : node.elseNodes, data);
         }
     }
@@ -130,7 +134,7 @@ export class LambderTemplatingEngine {
     static async fromFile(filePath, options = {}) {
         const fs = await getFS();
         if (!fs)
-            throw new Error("LambderTemplatingEngine.fromFile requires a Node.js environment.");
+            throw new Error("Lambder: LambderTemplatingEngine.fromFile requires a Node.js environment.");
         const source = await fs.promises.readFile(filePath, "utf8");
         return new LambderTemplatingEngine(source, options);
     }