tina4-nodejs 3.13.137 → 3.13.138

package/packages/core/src/mqtt.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Zero-dependency MQTT 3.1.1 client — the protocol every broker and every IoT
  * device already speaks.

package/packages/core/src/mqttMessage.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * One MQTT 3.1.1 application message as delivered by the broker.
  *

package/packages/core/src/optionalPackage.ts

@@ -0,0 +1,48 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
+/**
+ * Optional peer packages: the database drivers and service clients an
+ * APPLICATION installs, never the framework (ADR-0067).
+ *
+ * tina4-nodejs installs as exactly one package. `pg`, `mongodb`, `redis` and
+ * the `@aws-sdk` S3 client are optional peerDependencies, which npm does not
+ * install, so for most apps "missing" is the normal state. Every feature that
+ * reaches for one must therefore fail at the point of use with the exact
+ * command that fixes it - never a bare MODULE_NOT_FOUND, never a silent no-op.
+ */
+
+/** The actionable "install it" error, one wording for every optional peer. */
+export function optionalPackageMissing(feature: string, packageNames: string[]): Error {
+  const quoted = packageNames.map((name) => `'${name}'`).join(" and ");
+  const [noun, pronoun] = packageNames.length === 1 ? ["package is", "it"] : ["packages are", "them"];
+  return new Error(
+    `The ${quoted} ${noun} required for ${feature}. ` +
+      `Install ${pronoun} with: npm install ${packageNames.join(" ")}`,
+  );
+}
+
+/**
+ * Resolve an optional peer from the FRAMEWORK's location and return its module
+ * URL, or throw the actionable error. Synchronous, so a constructor can refuse
+ * immediately (parity with the Python master, which raises ImportError in the
+ * constructor) instead of leaving a rejected promise for later.
+ *
+ * Resolving from here rather than from process.cwd() is what finds the peer an
+ * app installed, wherever the server was started from.
+ *
+ * @param installTogether packages the feature needs as a set (S3 needs the
+ *   client AND the presigner), all named in the one install command.
+ */
+export function resolveOptionalPackage(packageName: string, feature: string, installTogether: string[] = [packageName]): string {
+  try {
+    return import.meta.resolve(packageName);
+  } catch {
+    throw optionalPackageMissing(feature, installTogether);
+  }
+}

package/packages/core/src/plan.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Project plan management — persistent, human-readable task state.
  *

package/packages/core/src/portTakeover.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Identity-checked port takeover, shared by the CLI and the runtime paths.
  *

package/packages/core/src/projectIndex.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Project index — lightweight, persistent "where is what" map.
  *

package/packages/core/src/projectIndexExtractors.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 import * as path from "node:path";
 import type { FileEntry, FileRoute } from "./projectIndex.js";
 

package/packages/core/src/projectIndexStorage.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 import * as fs from "node:fs";
 import * as path from "node:path";
 import * as crypto from "node:crypto";

package/packages/core/src/push.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Provider-neutral Web Push delivery using Node's built-in crypto and fetch.
  *

package/packages/core/src/queue.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 Queue — Unified job queue with pluggable backends, zero dependencies.
  *

package/packages/core/src/queueBackends/kafkaBackend.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 Kafka Queue Backend — Kafka protocol via raw TCP, zero dependencies.
  *

package/packages/core/src/queueBackends/liteBackend.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * LiteBackend — file-based queue backend for Tina4 Queue.
  * Stores jobs as JSON files on disk. Zero dependencies.

package/packages/core/src/queueBackends/mongoBackend.ts

@@ -1,5 +1,14 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
- * Tina4 MongoDB Queue Backend — uses `mongodb` npm package via dynamic import.
+ * Tina4 MongoDB Queue Backend — uses the `mongodb` npm package, which the app
+ * installs (`npm install mongodb`; an optional peer, ADR-0067).
  *
  * Implements the same interface as the file-based queue but uses MongoDB
  * for message storage and delivery. Atomic pop via findOneAndUpdate.
@@ -21,6 +30,7 @@
 import { randomUUID } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import type { QueueJob } from "../queue.js";
+import { resolveOptionalPackage } from "../optionalPackage.js";
 
 // ── Types ────────────────────────────────────────────────────
 
@@ -71,8 +81,17 @@ export class MongoBackend implements QueueBackend {
   private collection: string;
   private visibilityTimeout: number;
   private maxRetries: number;
+  /** Module URL of the app-installed `mongodb` driver, resolved once. */
+  private driverUrl: string;
 
   constructor(config?: MongoConfig) {
+    // Optional peer (ADR-0067), resolved HERE, on the main thread. Every
+    // operation runs in a child process that swallows its own failures, so a
+    // driver missing there used to surface as "MongoDB push failed" and a pop
+    // that silently returned nothing. The Python master raises in its
+    // constructor; so does this. Resolving from the framework's location also
+    // means the child finds the driver whatever directory the server runs in.
+    this.driverUrl = resolveOptionalPackage("mongodb", "the MongoDB queue backend");
     this.host = config?.host ?? process.env.TINA4_MONGO_HOST ?? "localhost";
     this.port = config?.port
       ?? (process.env.TINA4_MONGO_PORT ? parseInt(process.env.TINA4_MONGO_PORT, 10) : 27017);
@@ -136,13 +155,7 @@ export class MongoBackend implements QueueBackend {
   buildScript(operation: string, queue: string, data?: string): string {
     return `
       async function main() {
-        let mongodb;
-        try {
-          mongodb = await import("mongodb");
-        } catch {
-          process.stderr.write("mongodb package not installed — run: npm install mongodb");
-          process.exit(1);
-        }
+        const mongodb = await import(${JSON.stringify(this.driverUrl)});
 
         const { MongoClient } = mongodb;
         const uri = ${JSON.stringify(this.uri)};

package/packages/core/src/queueBackends/rabbitmqBackend.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 /**
  * Tina4 RabbitMQ Queue Backend — AMQP 0-9-1 via raw TCP, zero dependencies.
  *

package/packages/core/src/rateLimiter.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 import type { Middleware, Tina4Request, Tina4Response } from "./types.js";
 import { resolveClientIp } from "./trustedProxy.js";
 

package/packages/core/src/request.ts

@@ -1,8 +1,17 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 import type { IncomingMessage, IncomingHttpHeaders } from "node:http";
 import { mkdirSync, realpathSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import type { Tina4Request, UploadedFile } from "./types.js";
-import { resolveClientIp } from "./trustedProxy.js";
+import { resolveClientIp, isTrustedProxy } from "./trustedProxy.js";
+import { Log } from "./logger.js";
 
 /**
  * Wrap Node's `IncomingHttpHeaders` in a Proxy so mixed-case lookups
@@ -53,10 +62,11 @@ export function createRequest(req: IncomingMessage): Tina4Request {
     makeCaseInsensitiveHeaders(req.headers);
 
   // Resolve scheme + host honouring proxy headers — parity with PHP/Python/Ruby.
-  const xfProto = req.headers["x-forwarded-proto"];
+  const trustedPeer = isTrustedProxy(req.socket?.remoteAddress ?? "");
+  const xfProto = trustedPeer ? req.headers["x-forwarded-proto"] : undefined;
   const proto = (Array.isArray(xfProto) ? xfProto[0] : xfProto)
     ?? ((req.socket as { encrypted?: boolean })?.encrypted ? "https" : "http");
-  const xfHost = req.headers["x-forwarded-host"];
+  const xfHost = trustedPeer ? req.headers["x-forwarded-host"] : undefined;
   const host = (Array.isArray(xfHost) ? xfHost[0] : xfHost)
     ?? (req.headers.host ?? "localhost");
 
@@ -148,13 +158,50 @@ export function createRequest(req: IncomingMessage): Tina4Request {
   return tReq;
 }
 
-/** Maximum upload size in bytes (default 10 MB). Override via TINA4_MAX_UPLOAD_SIZE env var. */
-const TINA4_MAX_UPLOAD_SIZE = parseInt(process.env.TINA4_MAX_UPLOAD_SIZE ?? "10485760", 10);
+
+// ── Request limits (ADR-0068) ────────────────────────────────────────────────
+// Here rather than in a module of their own: request.ts sits below the server
+// and transport.ts, so both can read them without an import cycle, and the
+// core barrel's eager module graph stays one module smaller.
+
+export const DEFAULT_MAX_UPLOAD_SIZE = 10_485_760;
+
+const warnedLimits = new Set<string>();
+
+/**
+ * Read a numeric limit from the environment. A value that is not a usable
+ * number falls back to the default with a warning naming the variable (the
+ * same rule as PHP's Server::resolveLimit) - a typo must never be what
+ * disables a DoS guard.
+ */
+export function resolveLimit(name: string, fallback: number, zeroAllowed = false): number {
+  const raw = (process.env[name] ?? "").trim();
+  if (raw === "") return fallback;
+  const value = /^[0-9]+$/.test(raw) ? Number(raw) : NaN;
+  if (Number.isSafeInteger(value) && (value > 0 || (value === 0 && zeroAllowed))) return value;
+  if (!warnedLimits.has(`${name}=${raw}`)) {
+    warnedLimits.add(`${name}=${raw}`);
+    Log.warning(`${name}=${raw} is not a usable limit - using ${fallback}`);
+  }
+  return fallback;
+}
+
+/** TINA4_MAX_UPLOAD_SIZE, read when it is needed so a value from .env counts. */
+export function maxUploadSize(): number {
+  return resolveLimit("TINA4_MAX_UPLOAD_SIZE", DEFAULT_MAX_UPLOAD_SIZE);
+}
+
+/** The one 413 wording (ADR-0068 section 4). */
+export function bodyTooLargeMessage(bytes: number | bigint | string, limit: number): string {
+  return `Request body (${bytes} bytes) exceeds TINA4_MAX_UPLOAD_SIZE (${limit} bytes)`;
+}
+
+
 
 export class PayloadTooLargeError extends Error {
   public statusCode = 413;
   constructor(actual: number, limit: number) {
-    super(`Request body (${actual} bytes) exceeds TINA4_MAX_UPLOAD_SIZE (${limit} bytes)`);
+    super(bodyTooLargeMessage(actual, limit));
     this.name = "PayloadTooLargeError";
   }
 }
@@ -164,9 +211,11 @@ async function parseBody(req: Tina4Request): Promise<void> {
   if (method === "GET" || method === "HEAD" || method === "OPTIONS") return;
 
   // Check content-length header against upload size limit before reading body
+  const uploadLimit = maxUploadSize();
+
   const declaredLength = parseInt(req.headers["content-length"] ?? "0", 10);
-  if (declaredLength > TINA4_MAX_UPLOAD_SIZE) {
-    throw new PayloadTooLargeError(declaredLength, TINA4_MAX_UPLOAD_SIZE);
+  if (declaredLength > uploadLimit) {
+    throw new PayloadTooLargeError(declaredLength, uploadLimit);
   }
 
   const contentType = req.headers["content-type"] ?? "";
@@ -190,10 +239,10 @@ async function parseBody(req: Tina4Request): Promise<void> {
     req.on("data", (chunk: Buffer) => {
       if (refused) return;
       received += chunk.length;
-      if (received > TINA4_MAX_UPLOAD_SIZE) {
+      if (received > uploadLimit) {
         refused = true;
         chunks.length = 0; // drop what we have; the request is dead
-        reject(new PayloadTooLargeError(received, TINA4_MAX_UPLOAD_SIZE));
+        reject(new PayloadTooLargeError(received, uploadLimit));
         return;
       }
       chunks.push(chunk);

package/packages/core/src/response.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 import type { ServerResponse } from "node:http";
 import fs from "node:fs";
 import nodePath from "node:path";
@@ -24,6 +32,39 @@ async function closeSource(source: AsyncIterable<unknown>): Promise<void> {
   }
 }
 
+/** RFC 9110 `token`: one or more `tchar`. */
+const HEADER_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+
+/**
+ * The caller's name as a JSON string literal with non-ASCII escaped, byte-
+ * identical to Python's json.dumps (ADR-0068), so a name that is itself broken
+ * cannot break the error message or the log line carrying it.
+ */
+export function quoteHeaderName(name: string): string {
+  return JSON.stringify(name).replace(/[\u007f-\uffff]/g, (c) => "\\u" + c.charCodeAt(0).toString(16).padStart(4, "0"));
+}
+
+/** A TypeError carrying node:http's own error code, as setHeader() throws natively. */
+function headerRefusal(message: string, code: string): TypeError {
+  return Object.assign(new TypeError(message), { code });
+}
+
+/**
+ * Refuse a response header whose name is not an HTTP token or whose value
+ * carries CR, LF or NUL, with the exact ADR-0068 wording. node:http refuses
+ * these too, but names a broken header raw (a CR/LF in the name reaches the
+ * log line) - this is the ADR's form, checked first.
+ */
+export function assertSafeHeader(name: string, value: unknown): void {
+  if (!HEADER_TOKEN.test(name)) {
+    throw headerRefusal(`Header name must be a valid HTTP token [${quoteHeaderName(name)}]`, "ERR_INVALID_HTTP_TOKEN");
+  }
+  const values = Array.isArray(value) ? value : [value];
+  if (values.some((item) => /[\r\n\0]/.test(String(item)))) {
+    throw headerRefusal(`Invalid character in header content [${quoteHeaderName(name)}]`, "ERR_INVALID_CHAR");
+  }
+}
+
 /** Cache Frond instances by template directory to avoid repeated instantiation. */
 const _frondCache = new Map<string, InstanceType<any>>();
 
@@ -147,10 +188,24 @@ export function createResponse(res: ServerResponse): Tina4Response {
       res.end(chunk, encoding);
     }
   };
+  // Every header this Response sets goes through here, so every one is
+  // checked (ADR-0068) - even after the headers are sent, since an unsafe
+  // value is a bug in the code that built it either way.
   const safeSetHeader = (name: string, value: string | number | readonly string[]) => {
+    assertSafeHeader(name, value);
     if (!res.headersSent) res.setHeader(name, value);
   };
 
+  // True once the route set Content-Type with header(); response(data) then
+  // keeps it instead of detecting one (ADR-0072, #144).
+  let contentTypeFromHeader = false;
+  const setDetectedContentType = (contentType: string) => {
+    if (!contentTypeFromHeader) safeSetHeader("Content-Type", contentType);
+  };
+  const noteContentTypeHeader = (name: string) => {
+    if (name.toLowerCase() === "content-type") contentTypeFromHeader = true;
+  };
+
   // ── The callable: response(data, status, contentType) ──
   const response = function (data?: unknown, statusCode?: number, contentType?: string): Tina4Response {
     if (res.headersSent) return response;
@@ -158,6 +213,10 @@ export function createResponse(res: ServerResponse): Tina4Response {
     // Normalise ORM models / collections / query results so handlers can
     // `return response(model)` without serialising by hand.
     data = toJsonable(data);
+    // Any byte array is a binary body: view it as a Buffer (no copy) so every branch below writes it as bytes.
+    if (data instanceof Uint8Array && !Buffer.isBuffer(data)) {
+      data = Buffer.from(data.buffer, data.byteOffset, data.byteLength);
+    }
 
     if (statusCode !== undefined) {
       res.statusCode = statusCode;
@@ -166,21 +225,23 @@ export function createResponse(res: ServerResponse): Tina4Response {
     if (contentType) {
       // Explicit content type
       safeSetHeader("Content-Type", contentType);
-      if (typeof data === "object" && data !== null && !Buffer.isBuffer(data)) {
+      if (Buffer.isBuffer(data)) {
+        safeEnd(data);
+      } else if (typeof data === "object" && data !== null) {
         safeEnd(JSON.stringify(data));
       } else {
         safeEnd(data == null ? "" : String(data));
       }
     } else if (typeof data === "object" && data !== null && !Buffer.isBuffer(data)) {
       // dict/array → auto JSON
-      safeSetHeader("Content-Type", "application/json");
+      setDetectedContentType("application/json");
       safeEnd(JSON.stringify(data));
     } else if (typeof data === "string") {
       const trimmed = data.trim();
       if (trimmed.startsWith("<") && trimmed.endsWith(">")) {
-        safeSetHeader("Content-Type", "text/html; charset=utf-8");
+        setDetectedContentType("text/html; charset=utf-8");
       } else {
-        safeSetHeader("Content-Type", "text/plain; charset=utf-8");
+        setDetectedContentType("text/plain; charset=utf-8");
       }
       safeEnd(data);
     } else if (Buffer.isBuffer(data)) {
@@ -191,7 +252,7 @@ export function createResponse(res: ServerResponse): Tina4Response {
     } else if (data == null) {
       safeEnd("");
     } else {
-      safeSetHeader("Content-Type", "text/plain; charset=utf-8");
+      setDetectedContentType("text/plain; charset=utf-8");
       safeEnd(String(data));
     }
 
@@ -246,6 +307,7 @@ export function createResponse(res: ServerResponse): Tina4Response {
 
   response.header = function (name: string, value: string | number | readonly string[]): Tina4Response {
     safeSetHeader(name, value);
+    noteContentTypeHeader(name);
     return response;
   };
 
@@ -254,9 +316,11 @@ export function createResponse(res: ServerResponse): Tina4Response {
    */
   response.addHeader = function (name: string, value: string): void {
     safeSetHeader(name, value);
+    noteContentTypeHeader(name);
   };
 
   response.redirect = function (url: string, code?: number): Tina4Response {
+    assertSafeHeader("Location", url); // before the status changes
     if (res.headersSent) return response;
     res.statusCode = code ?? 302;
     safeSetHeader("Location", url);
@@ -265,6 +329,15 @@ export function createResponse(res: ServerResponse): Tina4Response {
   };
 
   response.cookie = function (name: string, value: string, options?: CookieOptions): Tina4Response {
+    // The name and value are percent-encoded below, so they cannot carry CR,
+    // LF, NUL or ';' to the wire and keep being encoded (ADR-0068). Attribute
+    // values are written as given, so one carrying those is refused: a ';'
+    // would add an attribute (say Domain=) the application never set.
+    for (const attribute of [options?.path, options?.domain, options?.sameSite, options?.maxAge]) {
+      if (attribute !== undefined && /[\r\n\0;]/.test(String(attribute))) {
+        throw headerRefusal(`Invalid character in cookie content [${quoteHeaderName(name)}]`, "ERR_INVALID_CHAR");
+      }
+    }
     const parts = [`${encodeURIComponent(name)}=${encodeURIComponent(value)}`];
     if (options?.maxAge !== undefined) parts.push(`Max-Age=${options.maxAge}`);
     if (options?.expires) parts.push(`Expires=${options.expires.toUTCString()}`);
@@ -419,6 +492,7 @@ export function createResponse(res: ServerResponse): Tina4Response {
     source: AsyncIterable<string | Buffer>,
     contentType: string = "text/event-stream",
   ): Promise<Tina4Response> {
+    assertSafeHeader("Content-Type", contentType);
     if (res.headersSent) return response;
     res.writeHead(200, {
       "Content-Type": contentType,

package/packages/core/src/routeDiscovery.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 import { readdirSync, statSync, mkdirSync, writeFileSync, existsSync } from "node:fs";
 import { join, relative, basename, extname } from "node:path";
 import type { RouteDefinition, RouteHandler, RouteMeta } from "./types.js";

package/packages/core/src/router.ts

@@ -1,3 +1,11 @@
+/*
+Copyright (c) 2026 Code Infinity
+SPDX-License-Identifier: MPL-2.0
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, You can obtain one at https://mozilla.org/MPL/2.0/.
+*/
+
 import type { RouteHandler, RouteDefinition, RouteMeta, Middleware, MiddlewareSpec, Tina4Request, Tina4Response, WebSocketRouteHandler, WebSocketRouteDefinition } from "./types.js";
 import { isTruthy } from "./dotenv.js";
 import { MiddlewareRunner, isMiddlewareClass } from "./middleware.js";