packaton 0.0.25 → 0.0.27

package/index.d.ts

@@ -19,4 +19,5 @@ export interface Config {
 	minifyHTML?: (html: string) => Promise<string>
 	sitemapDomain?: string
 	cspMapEnabled?: boolean
+	routeHeaders?: [name: string, value: string][]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "packaton",
-	"version": "0.0.25",
+	"version": "0.0.27",
 	"type": "module",
 	"author": "Eric Fortis",
 	"license": "MIT",
@@ -18,6 +18,6 @@
 		"terser": "^5"
 	},
 	"devDependencies": {
-		"terser": "5.46.1"
+		"terser": "5.46.2"
 	}
 }

package/src/app-dev.js

@@ -3,6 +3,7 @@ import { createServer } from 'node:http'
 
 import { router } from './router.js'
 import { watchDev } from './plugins-dev/WatcherDevClient.js'
+import { ServerResponse } from './utils/HttpServerResponse.js'
 
 
 /**
@@ -16,7 +17,7 @@ export function devStaticPages(config) {
 		if (config.hotReload)
 			watchDev(config.srcPath, config.watchIgnore)
 
-		const server = createServer(router(config))
+		const server = createServer({ ServerResponse }, router(config))
 		server.on('error', reject)
 		server.listen(config.port, config.host, () => {
 			const addr = `http://${server.address().address}:${server.address().port}`

package/src/app-prod.js

@@ -6,8 +6,9 @@ import { docs } from './app.js'
 import { router } from './router.js'
 import { HtmlCompiler } from './plugins-prod/HtmlCompiler.js'
 import { sitemapPlugin } from './plugins-prod/sitemapPlugin.js'
+import { ServerResponse } from './utils/HttpServerResponse.js'
 import { reportSizesPlugin } from './plugins-prod/reportSizesPlugin.js'
-import { write, removeDir, } from './utils/fs-utils.js'
+import { write, removeDir, } from './utils/fs.js'
 import { cspNginxMapPlugin } from './plugins-prod/cspNginxMapPlugin.js'
 import { renameMediaWithHashes } from './plugins-prod/media-remaper.js'
 import { netiflyAndCloudflareHeadersPlugin } from './plugins-prod/netiflyAndCloudflareHeadersPlugin.js'
@@ -25,7 +26,7 @@ export async function buildStaticPages(config) {
 		const pDist = config.outputDir
 		const pDistAssets = join(pDist, config.assetsDir)
 
-		const server = createServer(router(config))
+		const server = createServer({ ServerResponse }, router(config))
 		server.on('error', reject)
 		server.listen(0, '127.0.0.1', async () => {
 			docs.init(config.srcPath, config.ignore)
@@ -55,6 +56,11 @@ export async function buildStaticPages(config) {
 				const pages = await crawlRoutes(server.address(), docs.routes)
 				const mediaHashes = await renameMediaWithHashes(pDist, MEDIA_REL_URL)
 
+				const headers = {
+					['/' + MEDIA_REL_URL + '/*']: [
+						['Cache-Control', 'public,max-age=31536000,immutable']
+					]
+				}
 				const cspByRoute = []
 				for (const [route, rawHtml] of pages) {
 					const doc = new HtmlCompiler(rawHtml, pSource, {
@@ -71,13 +77,19 @@ export async function buildStaticPages(config) {
 					await doc.inlineMinifiedCSS()
 					await doc.inlineMinifiedJS()
 					write(join(pDist, route + config.outputExtension), doc.html)
+
+					const r = route === '/index' ? '/' : route
+					headers[r] ??= []
+					for (const h of config.routeHeaders)
+						headers[r].push(h)
+					headers[r].push(['Content-Security-Policy', doc.csp()])
 					cspByRoute.push([route, doc.csp()])
 				}
 
 				sitemapPlugin(config, docs.routes)
 				reportSizesPlugin(config, docs.routes)
 				cspNginxMapPlugin(config, cspByRoute)
-				netiflyAndCloudflareHeadersPlugin(config, cspByRoute, MEDIA_REL_URL)
+				write(join(config.outputDir, '_headers'), netiflyAndCloudflareHeadersPlugin(headers))
 			}
 			catch (error) {
 				reject(error)

package/src/app.js

@@ -2,7 +2,7 @@ import { readdirSync } from 'node:fs'
 import { basename, join, dirname } from 'node:path'
 
 import { setup } from './config.js'
-import { isFile } from './utils/fs-utils.js'
+import { isFile } from './utils/fs.js'
 import { devStaticPages } from './app-dev.js'
 import { buildStaticPages } from './app-prod.js'
 

package/src/config.js

@@ -1,6 +1,6 @@
 import { resolve } from 'node:path'
 
-import { isDirectory } from './utils/fs-utils.js'
+import { isDirectory } from './utils/fs.js'
 import { openInBrowser } from './plugins-dev/openInBrowser.js'
 
 import { minifyJS } from './plugins-prod/minifyJS.js'
@@ -35,6 +35,7 @@ const schema = {
 	minifyHTML: [minifyHTML, optional(Function)],
 	sitemapDomain: ['', optional(String)],
 	cspMapEnabled: [true, optional(Boolean)],
+	routeHeaders: [[], Array.isArray]
 }
 // TODO watch New Routes?
 

package/src/plugins-dev/WatcherDevClient.js

@@ -18,3 +18,29 @@ export function watchDev(rootPath, watchIgnore) {
 		devClientWatcher.emit(file)
 	})
 }
+
+export function sseDevHotReload(req, response) {
+	response.writeHead(200, {
+		'Content-Type': 'text/event-stream',
+		'Cache-Control': 'no-cache',
+		'Connection': 'keep-alive',
+	})
+	response.flushHeaders()
+
+	function onDevChange(file = '') {
+		response.write(`data: ${file}\n\n`)
+	}
+
+	devClientWatcher.subscribe(onDevChange)
+
+	const keepAlive = setInterval(() => {
+		response.write(': ping\n\n')
+	}, 10_000)
+
+	req.on('close', cleanup)
+	req.on('error', cleanup)
+	function cleanup() {
+		clearInterval(keepAlive)
+		devClientWatcher.unsubscribe(onDevChange)
+	}
+}

package/src/plugins-dev/watcherDev.js

@@ -1,47 +1,54 @@
-const WATCH_API = '/packaton/watch-dev'
-
-let conn = null
-let timer = null
-
-window.addEventListener('beforeunload', teardown)
-connect()
-function connect() {
-	if (conn)
-		return
-
-	clearTimeout(timer)
-	conn = new EventSource(WATCH_API)
-
-	conn.onmessage = function (event) {
-		const file = event.data
-		if (file.endsWith('.css'))
-			hotReloadCSS(file)
-		else if (file)
-			location.reload()
+const url = new URL(import.meta.url).searchParams.get('url')
+
+if (!url)
+	console.warn('Missing ?url=')
+else
+	init()
+
+function init() {
+	let conn = null
+	let timer = null
+
+	connect()
+	window.addEventListener('beforeunload', teardown)
+
+	function connect() {
+		if (conn) return
+
+		clearTimeout(timer)
+		conn = new EventSource(url)
+
+		conn.onmessage = function (event) {
+			const file = event.data
+			if (file.endsWith('.css'))
+				hotReloadCSS(file)
+			else if (file)
+				location.reload()
+		}
+
+		conn.onerror = function () {
+			console.error('hot reload')
+			teardown()
+			timer = setTimeout(connect, 3000)
+		}
 	}
 
-	conn.onerror = function () {
-		console.error('hot reload')
-		teardown()
-		timer = setTimeout(connect, 3000)
+	function teardown() {
+		clearTimeout(timer)
+		conn?.close()
+		conn = null
 	}
-}
 
-function teardown() {
-	clearTimeout(timer)
-	conn?.close()
-	conn = null
-}
 
-async function hotReloadCSS(file) {
-	let link = document.querySelector(`link[href^="/${file}"]`)
-	if (link) {
-		const [url] = link.getAttribute('href').split('?')
-		link.href = url + '?' + Date.now()
-	}
-	else {
-		const mod = await import(`/${file}?${Date.now()}`, { with: { type: 'css' } })
-		document.adoptedStyleSheets = [mod.default]
+	async function hotReloadCSS(file) {
+		let link = document.querySelector(`link[href^="/${file}"]`)
+		if (link) {
+			const [url] = link.getAttribute('href').split('?')
+			link.href = url + '?' + Date.now()
+		}
+		else {
+			const mod = await import(`/${file}?${Date.now()}`, { with: { type: 'css' } })
+			document.adoptedStyleSheets = [mod.default]
+		}
 	}
 }
-

package/src/plugins-prod/HtmlCompiler.js

@@ -1,7 +1,7 @@
 import { join } from 'node:path'
 import { createHash } from 'node:crypto'
 
-import { read } from '../utils/fs-utils.js'
+import { read } from '../utils/fs.js'
 import { remapMediaInHTML } from './media-remaper.js'
 
 

package/src/plugins-prod/cspNginxMapPlugin.js

@@ -1,4 +1,4 @@
-import { write } from '../utils/fs-utils.js'
+import { write } from '../utils/fs.js'
 import { join } from 'node:path'
 
 

package/src/plugins-prod/media-remaper.js

@@ -1,6 +1,6 @@
 import { renameSync } from 'node:fs'
 import { join, parse, relative } from 'node:path'
-import { sha1, listFiles } from '../utils/fs-utils.js'
+import { sha1, listFiles } from '../utils/fs.js'
 
 
 /**

package/src/plugins-prod/netiflyAndCloudflareHeadersPlugin.js

@@ -1,28 +1,10 @@
-import { join } from 'node:path'
-import { write } from '../utils/fs-utils.js'
-
-
-/**
- * @param {Config} config
- * @param {string} cspByRoute
- * @param {string} relMediaURL
- */
-export function netiflyAndCloudflareHeadersPlugin(config, cspByRoute, relMediaURL) {
-	const out = join(join(config.outputDir), '_headers')
-
-	const cspHeaders = cspByRoute.map(([route, csp]) => {
-		const r = route === '/index'
-			? '/'
-			: route
-		return [
-			r,
-			`  Content-Security-Policy: ${csp}`,
-			`  Cache-Control: public,max-age=60`
-		].join('\n')
-	})
-	cspHeaders.push(`/${relMediaURL}/*`)
-	cspHeaders.push('  Cache-Control: public,max-age=31536000,immutable')
-
-	write(out, cspHeaders.join('\n'))
+export function netiflyAndCloudflareHeadersPlugin(opts) {
+	let result = []
+	for (const [route, headers] of Object.entries(opts)) {
+		result.push(route)
+		for (const [h, v] of headers)
+			result.push(`  ${h}: ${v}`)
+	}
+	return result.join('\n')
 }
 

package/src/plugins-prod/reportSizesPlugin.js

@@ -1,5 +1,5 @@
 import { join } from 'node:path'
-import { read, sizeOf, sha1, saveAsJSON, isFile } from '../utils/fs-utils.js'
+import { read, sizeOf, sha1, saveAsJSON, isFile } from '../utils/fs.js'
 
 
 export function reportSizesPlugin(config, routes) {

package/src/plugins-prod/sitemapPlugin.js

@@ -1,5 +1,5 @@
 import { join } from 'node:path'
-import { write, isFile } from '../utils/fs-utils.js'
+import { write, isFile } from '../utils/fs.js'
 
 
 export function sitemapPlugin(config, routes) {

package/src/router.js

@@ -1,57 +1,82 @@
 import { join } from 'node:path'
 import { readFile } from 'node:fs/promises'
 import { randomUUID } from 'node:crypto'
+import { pathToFileURL } from 'node:url'
 
 import { docs } from './app.js'
-import { mimeFor } from './utils/mimes.js'
-import { devClientWatcher } from './plugins-dev/WatcherDevClient.js'
-import { sendError, sendJSON, servePartialContent, serveAsset } from './utils/http-response.js'
+import { mimeFor } from './utils/mime.js'
+import { sseDevHotReload } from './plugins-dev/WatcherDevClient.js'
 
+import pkgJSON from '../package.json' with { type: 'json' }
+import { resolveIn } from './utils/fs.js'
+import { hasControlChars, removeQueryStringAndFragment } from './utils/HttpIncomingMessage.js'
 
-const devtoolsWorkspaceId = randomUUID()
 
-const WATCHER_DEV = '/plugins-dev/watcherDev.js'
+const rel = f => join(import.meta.dirname, f)
 
 const API = {
-	watchDev: '/packaton/watch-dev'
+	watchHotReload: '/packaton/watch-hot-reload',
+	devToolsJson: '/.well-known/appspecific/com.chrome.devtools.json'
 }
-
+const WATCHER_DEV = `/plugins-dev/watcherDev.js`
 
 /** @param {Config} config */
 export function router({ srcPath, ignore, mode }) {
+	const DEV = mode === 'development'
+	const WORKSPACE_ID = randomUUID()
 	docs.init(srcPath, ignore)
-	const isDev = mode === 'development'
+
 	return async function (req, response) {
-		let url = new URL(req.url, 'http://_').pathname
+		response.setHeader('Server', `Packaton ${pkgJSON.version}`)
+
+		let url = req.url || ''
+		if (url.length > 2048) {
+			response.uriTooLong()
+			return
+		}
+		if (hasControlChars(url)) {
+			response.badRequest()
+			return
+		}
+		if (req.method !== 'GET') {
+			response.notFound()
+			return
+		}
+
+		url = removeQueryStringAndFragment(url)
 		try {
-			if (url === '/.well-known/appspecific/com.chrome.devtools.json')
-				sendJSON(response, {
+			if (url === WATCHER_DEV)
+				response.file(rel(WATCHER_DEV))
+
+			else if (url === API.watchHotReload)
+				sseDevHotReload(req, response)
+
+			else if (url === API.devToolsJson)
+				response.json({
 					workspace: {
 						root: srcPath,
-						uuid: devtoolsWorkspaceId
+						uuid: WORKSPACE_ID
 					}
 				})
 
-			else if (url === API.watchDev)
-				sseDevHotReload(req, response)
-
-			else if (url === WATCHER_DEV)
-				serveAsset(response, join(import.meta.dirname, url))
-
 			else if (docs.hasRoute(url))
-				await serveDocument(response, docs.fileFor(url), url, isDev)
-
+				await serveDocument(response, docs.fileFor(url), url, DEV)
 			else if (docs.hasRoute(join(url, 'index')))
-				await serveDocument(response, docs.fileFor(join(url, 'index')), '', isDev)
-
-			else if (req.headers.range)
-				await servePartialContent(response, req.headers, join(srcPath, url))
-
-			else
-				serveAsset(response, join(srcPath, url))
+				await serveDocument(response, docs.fileFor(join(url, 'index')), '', DEV)
+
+			else {
+				const f = await resolveIn(srcPath, url)
+				if (!f)
+					response.forbidden('Filename path resolves outside config.srcPath')
+				else if (req.headers.range)
+					response.partialContent(f)
+				else
+					response.file(f)
+			}
 		}
-		catch (error) {
-			sendError(response, error)
+		catch (err) {
+			console.error(err)
+			response.internalServerError()
 		}
 	}
 }
@@ -59,38 +84,9 @@ export function router({ srcPath, ignore, mode }) {
 async function serveDocument(response, file, url, isDev) {
 	let html = file.endsWith('.html')
 		? await readFile(file, 'utf8')
-		: (await import(file + '?' + Date.now())).default(url)
+		: (await import(pathToFileURL(file))).default(url)
 	if (isDev)
-		html += `<script type="module" src="${WATCHER_DEV}"></script>`
-	response.setHeader('Content-Type', mimeFor('html'))
+		html += `<script type="module" src="${WATCHER_DEV}?url=${API.watchHotReload}"></script>`
+	response.setHeader('Content-Type', mimeFor('.html'))
 	response.end(html)
 }
-
-
-function sseDevHotReload(req, response) {
-	response.writeHead(200, {
-		'Content-Type': 'text/event-stream',
-		'Cache-Control': 'no-cache',
-		'Connection': 'keep-alive',
-	})
-	response.flushHeaders()
-
-	function onDevChange(file = '') {
-		response.write(`data: ${file}\n\n`)
-	}
-
-	devClientWatcher.subscribe(onDevChange)
-
-	const keepAlive = setInterval(() => {
-		response.write(': ping\n\n')
-	}, 10_000)
-
-	req.on('close', cleanup)
-	req.on('error', cleanup)
-	function cleanup() {
-		clearInterval(keepAlive)
-		devClientWatcher.unsubscribe(onDevChange)
-	}
-}
-
-

package/src/utils/HttpIncomingMessage.js

@@ -0,0 +1,23 @@
+export function removeQueryStringAndFragment(url = '') {
+	return new URL(url, 'http://_').pathname
+}
+
+
+const reControlAndDelChars = /[\x00-\x1f\x7f]/
+
+export function hasControlChars(url) {
+	try {
+		const decoded = decode(url)
+		return !decoded || reControlAndDelChars.test(decoded)
+	}
+	catch {
+		return true
+	}
+}
+
+function decode(url) {
+	const candidate = decodeURIComponent(url)
+	return candidate === decodeURIComponent(candidate)
+		? candidate
+		: '' // reject multiple encodings
+}

package/src/utils/HttpServerResponse.js

@@ -0,0 +1,92 @@
+import fs from 'node:fs'
+import http from 'node:http'
+import { pipeline } from 'node:stream/promises'
+
+import { mimeFor } from './mime.js'
+
+
+export class ServerResponse extends http.ServerResponse {
+	json(payload) {
+		this.setHeader('Content-Type', mimeFor('.json'))
+		this.end(JSON.stringify(payload))
+	}
+
+	async file(file) {
+		try {
+			const { size } = await fs.promises.stat(file)
+			this.setHeader('Content-Length', size)
+			this.setHeader('Content-Type', mimeFor(file))
+			await pipeline(fs.createReadStream(file), this)
+		}
+		catch (err) {
+			if (this.headersSent)
+				this.destroy()
+			else if (err.code === 'ENOENT')
+				this.notFound()
+			else
+				throw err
+		}
+	}
+
+	async partialContent(file) {
+		try {
+			const { size } = await fs.promises.lstat(file)
+			let [start, end] = this.req.headers.range.replace(/bytes=/, '').split('-').map(n => parseInt(n, 10))
+
+			if (isNaN(start)) {
+				start = size - end
+				end = size - 1
+			}
+			else if (isNaN(end))
+				end = size - 1
+
+			if (start < 0 || end >= size || start > end) {
+				this.statusCode = 416 // Range Not Satisfiable
+				this.setHeader('Content-Range', `bytes */${size}`)
+				this.end()
+				return
+			}
+
+			this.statusCode = 206 // Partial Content
+			this.setHeader('Accept-Ranges', 'bytes')
+			this.setHeader('Content-Range', `bytes ${start}-${end}/${size}`)
+			this.setHeader('Content-Length', (end - start) + 1)
+			this.setHeader('Content-Type', mimeFor(file))
+
+			await pipeline(fs.createReadStream(file, { start, end }), this)
+		}
+		catch (err) {
+			if (this.headersSent)
+				this.destroy()
+			else if (err.code === 'ENOENT')
+				this.notFound()
+			else
+				throw err
+		}
+	}
+	
+	badRequest() {
+		this.statusCode = 400
+		this.end()
+	}
+
+	forbidden(msg) {
+		this.statusCode = 403
+		this.end(msg)
+	}
+
+	notFound() {
+		this.statusCode = 404
+		this.end()
+	}
+
+	uriTooLong() {
+		this.statusCode = 414
+		this.end()
+	}
+
+	internalServerError() {
+		this.statusCode = 500
+		this.end()
+	}
+}

package/src/utils/HttpServerResponse.test.js

@@ -0,0 +1,101 @@
+import { describe, test, before, after } from 'node:test'
+import { mkdtempSync, writeFileSync } from 'node:fs'
+import { createServer } from 'node:http'
+import { tmpdir } from 'node:os'
+import { equal } from 'node:assert/strict'
+import { join } from 'node:path'
+import { rm } from 'node:fs/promises'
+
+import { ServerResponse } from './HttpServerResponse.js'
+
+describe('ServerResponse', () => {
+	const FILE = '0123456789'
+
+	let tmpDir, tmpFile, server, addr
+	before(async () => {
+		tmpDir = mkdtempSync(join(tmpdir(), 'response-'))
+		tmpFile = join(tmpDir, 'test.txt')
+		writeFileSync(tmpFile, FILE)
+
+		server = createServer({ ServerResponse }, (req, response) => {
+			const file = join(tmpDir, req.url)
+			if (req.headers.range)
+				response.partialContent(file)
+			else
+				response.file(file)
+		})
+
+		await new Promise(resolve => server.listen(0, () => {
+			addr = `http://127.0.0.1:${(server.address().port)}`
+			resolve()
+		}))
+	})
+
+	after(async () => {
+		server?.close()
+		await rm(tmpDir, { recursive: true, force: true })
+	})
+
+
+	describe('partialContent', () => {
+		const GET = (path, range) => fetch(addr + path, { headers: { range } })
+
+		test('404', async () => {
+			const r = await GET('/not-found', 'bytes=0-')
+			equal(r.status, 404)
+			equal(r.headers.get('content-length'), '0')
+		})
+
+		test('416 - out of bounds', async () => {
+			for (const range of ['bytes=10-12', 'bytes=5-2', 'bytes=12-', 'bytes=-15']) {
+				const r = await GET('/test.txt', range)
+				equal(r.status, 416)
+				equal(r.headers.get('content-range'), `bytes */${FILE.length}`)
+			}
+		})
+
+		test('206 - normal range', async () => {
+			const r = await GET('/test.txt', 'bytes=0-4')
+			equal(r.status, 206)
+			equal(r.headers.get('content-range'), `bytes 0-4/${FILE.length}`)
+			equal(r.headers.get('content-length'), '5')
+			equal(r.headers.get('content-type'), 'text/plain')
+			equal(await r.text(), '01234')
+		})
+
+		test('206 - suffix range', async () => {
+			const r = await GET('/test.txt', 'bytes=-3')
+			equal(r.status, 206)
+			equal(r.headers.get('content-range'), `bytes 7-9/${FILE.length}`)
+			equal(r.headers.get('content-length'), '3')
+			equal(await r.text(), '789')
+		})
+
+		test('206 - open ended range', async () => {
+			const r = await GET('/test.txt', 'bytes=5-')
+			equal(r.status, 206)
+			equal(r.headers.get('content-range'), `bytes 5-9/${FILE.length}`)
+			equal(r.headers.get('content-length'), '5')
+			equal(await r.text(), '56789')
+		})
+	})
+
+
+	describe('file', () => {
+		const GET = path => fetch(addr + path)
+
+		test('404', async () => {
+			const r = await GET('/not-found')
+			equal(r.status, 404)
+			equal(r.headers.get('content-length'), '0')
+		})
+
+		test('200', async () => {
+			const r = await GET('/test.txt')
+			equal(r.status, 200)
+			equal(r.headers.get('content-type'), 'text/plain')
+			equal(r.headers.get('content-length'), String(FILE.length))
+			equal(await r.text(), FILE)
+		})
+	})
+})

package/src/utils/{fs-utils.js → fs.js}

@@ -1,7 +1,8 @@
-import { readdir } from 'node:fs/promises'
 import { createHash } from 'node:crypto'
-import { join, dirname } from 'node:path'
-import { rmSync, lstatSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { readdir, realpath } from 'node:fs/promises'
+import { join, dirname, sep, resolve } from 'node:path'
+import { rmSync, mkdirSync, readFileSync, writeFileSync, lstatSync } from 'node:fs'
+
 
 
 export const read = f => readFileSync(f, 'utf8')
@@ -47,3 +48,17 @@ export const replaceExt = (f, ext) => {
 	parts.push(ext)
 	return parts.join('.')
 }
+
+/** @returns {string | null} absolute path if it’s within `baseDir` */
+export async function resolveIn(baseDir, file) {
+	try {
+		const parent = await realpath(baseDir)
+		const child = resolve(join(parent, file))
+		return child.startsWith(join(parent, sep))
+			? child
+			: null
+	}
+	catch {
+		return null
+	}
+}

package/src/utils/fs.test.js

@@ -0,0 +1,49 @@
+import { join } from 'node:path'
+import { equal } from 'node:assert/strict'
+import { tmpdir } from 'node:os'
+import { after, describe, test } from 'node:test'
+import { mkdtempSync, rmSync, realpathSync } from 'node:fs'
+
+import { replaceExt, resolveIn } from './fs.js'
+
+
+describe('replaceExt', () => {
+	test('replaces a simple extension', () =>
+		equal(replaceExt('file.txt', 'md'), 'file.md'))
+
+	test('replaces a multi-part extension', () =>
+		equal(replaceExt('archive.tar.gz', 'zip'), 'archive.tar.zip'))
+
+	test('adds extension when none exists', () =>
+		equal(replaceExt('README', 'md'), 'README.md'))
+
+	test('handles empty filename', () =>
+		equal(replaceExt('', 'ext'), '.ext'))
+
+	test('handles dot-files', () =>
+		equal(replaceExt('.env', 'txt'), '.env.txt'))
+})
+
+
+describe('resolveIn', () => {
+	const isNull = v => equal(v, null)
+	const baseDir = mkdtempSync(join(tmpdir(), '_resolveIn'))
+	const baseParentDir = join(baseDir, '..')
+	after(() => rmSync(baseDir, { recursive: true, force: true }))
+
+	test('null when baseDir does not exist', async () =>
+		isNull(await resolveIn(join(baseParentDir, 'missing'), 'file.json')))
+
+	test('null when relative path escapes baseDir', async () =>
+		isNull(await resolveIn(baseDir, '../outside.json')))
+
+
+	const realBaseDir = realpathSync(baseDir)
+	const onReal = f => join(realBaseDir, f)
+
+	test('resolves a relative file within baseDir', async () =>
+		equal(await resolveIn(baseDir, 'file.json'), onReal('file.json')))
+
+	test('resolves file starting with /', async () =>
+		equal(await resolveIn(baseDir, '/file.json'), onReal('file.json')))
+})

package/src/utils/{mimes.js → mime.js}

@@ -1,22 +1,22 @@
+import { MIMEType } from 'node:util'
+
+
 // Generated with:
 // https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types/Common_types
 // m = {}
 // for (const row of tbody.children)
 //  m[row.children[0].querySelector('code').innerText] = row.children[2].querySelector('code').innerText
 
-const mimes = {
-	css: 'text/css; charset=utf8',
-	html: 'text/html; charset=utf8',
-	js: 'application/javascript; charset=utf8',
-	json: 'application/json; charset=utf8',
-	svg: 'image/svg+xml; charset=utf8',
-	txt: 'text/plain; charset=utf8', // e.g., robots.txt when running lighthouse
-
+const extToMime = {
 	'3g2': 'video/3gpp2',
 	'3gp': 'video/3gpp',
+	'3mf': 'model/3mf',
 	'7z': 'application/x-7z-compressed',
 	aac: 'audio/aac',
 	abw: 'application/x-abiword',
+	aif: 'audio/aiff',
+	aifc: 'audio/aiff',
+	aiff: 'audio/aiff',
 	apng: 'image/apng',
 	arc: 'application/x-freearc',
 	avi: 'video/x-msvideo',
@@ -29,27 +29,48 @@ const mimes = {
 	cda: 'application/x-cdf',
 	cjs: 'text/javascript',
 	csh: 'application/x-csh',
+	css: 'text/css',
 	csv: 'text/csv',
+	dae: 'model/vnd.collada+xml',
 	doc: 'application/msword',
 	docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+	drc: 'model/vnd.draco',
+	eml: 'message/rfc822',
 	eot: 'application/vnd.ms-fontobject',
 	epub: 'application/epub+zip',
+	exe: 'application/vnd.microsoft.portable-executable',
+	fbx: 'application/octet-stream',
+	flac: 'audio/flac',
 	gif: 'image/gif',
+	glb: 'model/gltf-binary',
+	gltf: 'model/gltf+json',
 	gz: 'application/gzip',
+	heic: 'image/heic',
+	heif: 'image/heif',
 	htm: 'text/html',
+	html: 'text/html',
 	ico: 'image/vnd.microsoft.icon',
 	ics: 'text/calendar',
 	jar: 'application/java-archive',
 	jpeg: 'image/jpeg',
 	jpg: 'image/jpeg',
+	js: 'application/javascript',
+	json: 'application/json',
 	jsonld: 'application/ld+json',
+	lz: 'application/x-lzip',
+	m4a: 'audio/mp4',
+	md: 'text/markdown',
 	mid: 'audio/midi',
 	midi: 'audio/midi',
 	mjs: 'text/javascript',
+	mkv: 'video/x-matroska',
+	mov: 'video/quicktime',
 	mp3: 'audio/mpeg',
 	mp4: 'video/mp4',
 	mpeg: 'video/mpeg',
 	mpkg: 'application/vnd.apple.installer+xml',
+	mtl: 'text/plain',
+	obj: 'text/plain',
 	odp: 'application/vnd.oasis.opendocument.presentation',
 	ods: 'application/vnd.oasis.opendocument.spreadsheet',
 	odt: 'application/vnd.oasis.opendocument.text',
@@ -60,17 +81,24 @@ const mimes = {
 	otf: 'font/otf',
 	pdf: 'application/pdf',
 	php: 'application/x-httpd-php',
+	ply: 'application/octet-stream',
 	png: 'image/png',
 	ppt: 'application/vnd.ms-powerpoint',
 	pptx: 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
 	rar: 'application/vnd.rar',
 	rtf: 'application/rtf',
 	sh: 'application/x-sh',
+	stl: 'model/stl',
+	svg: 'image/svg+xml',
 	tar: 'application/x-tar',
 	tif: 'image/tiff',
 	ts: 'video/mp2t',
 	ttf: 'font/ttf',
+	txt: 'text/plain',
+	usd: 'model/vnd.usd',
+	usdz: 'model/vnd.usdz+zip',
 	vsd: 'application/vnd.visio',
+	wasm: 'application/wasm',
 	wav: 'audio/wav',
 	weba: 'audio/webm',
 	webm: 'video/webm',
@@ -82,18 +110,44 @@ const mimes = {
 	xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
 	xml: 'application/xml',
 	xul: 'application/vnd.mozilla.xul+xml',
+	xz: 'application/x-xz',
 	yaml: 'application/yaml',
 	yml: 'application/yaml',
-	zip: 'application/zip'
+	zip: 'application/zip',
+	zst: 'application/zstd'
 }
 
-export function mimeFor(filename) {
-	return mimes[extname(filename)] || ''
+const mimeToExt = {
+	data: mapMimeToExt(extToMime)
+}
+
+export function registerMimes(obj) {
+	Object.assign(extToMime, obj)
+	mimeToExt.data = mapMimeToExt(extToMime)
+}
+
+function mapMimeToExt(e2m) {
+	const m = {}
+	for (const [ext, mime] of Object.entries(e2m))
+		m[mime] = ext
+	return m
 }
 
+export function mimeFor(filename) {
+	const ext = extname(filename).toLowerCase()
+	return extToMime[ext] || ''
+}
 function extname(filename) {
-	const ext = filename
-		.split('.').at(-1)
-		.split('?').at(0)
-	return ext
+	const i = filename.lastIndexOf('.')
+	return i === -1
+		? ''
+		: filename.slice(i + 1)
 }
+
+
+export function extFor(mime) {
+	return mime
+		? mimeToExt.data[new MIMEType(mime).essence]
+		: ''
+}
+

package/src/utils/mime.test.js

@@ -0,0 +1,21 @@
+import { test } from 'node:test'
+import { equal } from 'node:assert/strict'
+import { extFor, mimeFor } from './mime.js'
+
+
+test('extFor', () => {
+	[
+		'text/html',
+		'Text/html',
+		'text/Html; charset=UTF-16'
+	].map(input =>
+		equal(extFor(input), 'html'))
+})
+
+test('mimeFor', () => {
+	[
+		'file.html',
+		'file.HTmL'
+	].map(input =>
+		equal(mimeFor(input), 'text/html'))
+})

package/src/utils/fs-utils.test.js

@@ -1,21 +0,0 @@
-import test, { describe } from 'node:test'
-import { equal } from 'node:assert/strict'
-import { replaceExt } from './fs-utils.js'
-
-
-describe('replaceExt', () => {
-	test('replaces a simple extension', () =>
-		equal(replaceExt('file.txt', 'md'), 'file.md'))
-
-	test('replaces a multi-part extension', () =>
-		equal(replaceExt('archive.tar.gz', 'zip'), 'archive.tar.zip'))
-
-	test('adds extension when none exists', () =>
-		equal(replaceExt('README', 'md'), 'README.md'))
-
-	test('handles empty filename', () =>
-		equal(replaceExt('', 'ext'), '.ext'))
-
-	test('handles dot-files', () =>
-		equal(replaceExt('.env', 'txt'), '.env.txt'))
-})

package/src/utils/http-response.js

@@ -1,46 +0,0 @@
-import fs from 'node:fs'
-import { mimeFor } from './mimes.js'
-
-
-export function sendError(response, error) {
-	response.statusCode = error?.code === 'ENOENT'
-		? 404
-		: 500
-	console.error(error.message)
-	response.end()
-}
-
-export function sendJSON(response, payload) {
-	response.setHeader('Content-Type', 'application/json')
-	response.end(JSON.stringify(payload))
-}
-
-export function serveAsset(response, file) {
-	response.setHeader('Content-Type', mimeFor(file))
-	const reader = fs.createReadStream(file)
-	reader.on('open', function () { this.pipe(response) })
-	reader.on('error', function (error) { sendError(response, error) })
-}
-
-
-export async function servePartialContent(response, headers, file) {
-	const { size } = await fs.promises.lstat(file)
-	let [start, end] = headers.range.replace(/bytes=/, '').split('-').map(n => parseInt(n, 10))
-	if (isNaN(end)) end = size - 1
-	if (isNaN(start)) start = size - end
-
-	if (start < 0 || start > end || start >= size || end >= size) {
-		response.statusCode = 416 // Range Not Satisfiable
-		response.setHeader('Content-Range', `bytes */${size}`)
-		response.end()
-	}
-	else {
-		response.statusCode = 206 // Partial Content
-		response.setHeader('Accept-Ranges', 'bytes')
-		response.setHeader('Content-Range', `bytes ${start}-${end}/${size}`)
-		response.setHeader('Content-Type', mimeFor(file))
-		const reader = fs.createReadStream(file, { start, end })
-		reader.on('open', function () { this.pipe(response) })
-		reader.on('error', function (error) { sendError(response, error) })
-	}
-}