send 0.18.0: send

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/send@0.18.0
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/send@0.18.0
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:0a9942008f6836be58a47be2aefb6ff14d3612543e736e4e8a7e83d21ef885db","constraints":{"executionContext":"node"},"contract":["send(req, path, { root, index: 'home.html' }) serves the custom index file when requesting a directory","send(req, path, { root, extensions: ['html', 'txt'] }) serves the file with a matching extension when omitted from the request path","send(req, path, { root, immutable: true, maxAge: 86400000 }) includes the immutable directive in the Cache-Control header","send(req, path, { root, acceptRanges: false }) omits the Accept-Ranges header and ignores Range request headers","send(req, path, { root, cacheControl: false, etag: false, lastModified: false }) suppresses Cache-Control, ETag, and Last-Modified response headers","send(req, path, { root, dotfiles: 'ignore' }) emits a 404 Not Found error when accessing dotfiles","send(req, path, { root, index: false }).on('directory', fn) emits the directory event when requesting a directory with index disabled"],"goal":"verify pkg:npm/send@0.18.0","kind":"HOW","packages":["pkg:npm/send@0.18.0"],"schemaVersion":1,"symbols":["send"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"esm","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/send@0.18.0"],"schemaVersion":1,"subject":"pkg:npm/send@0.18.0","symbols":["send"],"verifierAdapter":"node-typescript@1"}

{
  "name": "send-sample",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "send-sample",
      "version": "1.0.0",
      "dependencies": {
        "send": "0.18.0"
      }
    },
    "node_modules/debug": {
      "version": "2.6.9",
      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
      "license": "MIT",
      "dependencies": {
        "ms": "2.0.0"
      }
    },
    "node_modules/debug/node_modules/ms": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
      "license": "MIT"
    },
    "node_modules/depd": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
      }
    },
    "node_modules/destroy": {
      "version": "1.2.0",
      "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
      "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.8",
        "npm": "1.2.8000 || >= 1.4.16"
      }
    },
    "node_modules/ee-first": {
      "version": "1.1.1",
      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
      "license": "MIT"
    },
    "node_modules/encodeurl": {
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
      "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
      }
    },
    "node_modules/escape-html": {
      "version": "1.0.3",
      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
      "license": "MIT"
    },
    "node_modules/etag": {
      "version": "1.8.1",
      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
      }
    },
    "node_modules/fresh": {
      "version": "0.5.2",
      "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
      "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
      }
    },
    "node_modules/http-errors": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz",
      "integrity": "sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==",
      "license": "MIT",
      "dependencies": {
        "depd": "2.0.0",
        "inherits": "2.0.4",
        "setprototypeof": "1.2.0",
        "statuses": "2.0.1",
        "toidentifier": "1.0.1"
      },
      "engines": {
        "node": ">= 0.8"
      }
    },
    "node_modules/inherits": {
      "version": "2.0.4",
      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
      "license": "ISC"
    },
    "node_modules/mime": {
      "version": "1.6.0",
      "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
      "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
      "license": "MIT",
      "bin": {
        "mime": "cli.js"
      },
      "engines": {
        "node": ">=4"
      }
    },
    "node_modules/ms": {
      "version": "2.1.3",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
      "license": "MIT"
    },
    "node_modules/on-finished": {
      "version": "2.4.1",
      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
      "license": "MIT",
      "dependencies": {
        "ee-first": "1.1.1"
      },
      "engines": {
        "node": ">= 0.8"
      }
    },
    "node_modules/range-parser": {
      "version": "1.2.1",
      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
      "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
      }
    },
    "node_modules/send": {
      "version": "0.18.0",
      "resolved": "https://registry.npmjs.org/send/-/send-0.18.0.tgz",
      "integrity": "sha512-qqWzuOjSFOuqPjFe4NOsMLafToQQwBSOEpS+FwEt3A2V3vKubTquT3vmLTQpFgMXp8AlFWFuP1qKaJZOtPpVXg==",
      "license": "MIT",
      "dependencies": {
        "debug": "2.6.9",
        "depd": "2.0.0",
        "destroy": "1.2.0",
        "encodeurl": "~1.0.2",
        "escape-html": "~1.0.3",
        "etag": "~1.8.1",
        "fresh": "0.5.2",
        "http-errors": "2.0.0",
        "mime": "1.6.0",
        "ms": "2.1.3",
        "on-finished": "2.4.1",
        "range-parser": "~1.2.1",
        "statuses": "2.0.1"
      },
      "engines": {
        "node": ">= 0.8.0"
      }
    },
    "node_modules/setprototypeof": {
      "version": "1.2.0",
      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
      "license": "ISC"
    },
    "node_modules/statuses": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz",
      "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
      }
    },
    "node_modules/toidentifier": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
      "license": "MIT",
      "engines": {
        "node": ">=0.6"
      }
    }
  }
}

{
  "name": "send-sample",
  "version": "1.0.0",
  "description": "Verify advanced options and events for pkg:npm/send@0.18.0",
  "type": "module",
  "scripts": {
    "test": "node test/contract.mjs"
  },
  "dependencies": {
    "send": "0.18.0"
  }
}

restricted dotfile content

console.log("sample app script");

Sample documentation content for send verification.

<!DOCTYPE html>
<html><head><title>Home</title></head><body><h1>Home Page</h1></body></html>

<!DOCTYPE html>
<html><body>Subdir Index</body></html>

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/send@0.18.0",
  "kind": "HOW",
  "packages": [
    "pkg:npm/send@0.18.0"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

import http from 'node:http';
import send from 'send';

/**
 * Creates an HTTP request listener configured with send static streaming.
 *
 * @param {string} rootDir
 * @param {object} [options]
 * @returns {import('node:http').RequestListener}
 */
export function createStaticServer(rootDir, options = {}) {
  return function requestListener(req, res) {
    const url = new URL(req.url, 'http://localhost');
    const pathname = decodeURIComponent(url.pathname);
    const sendOptions = {
      root: rootDir,
      ...options
    };

    const stream = send(req, pathname, sendOptions);

    stream.on('error', (err) => {
      res.statusCode = err.status || 500;
      res.setHeader('Content-Type', 'text/plain; charset=UTF-8');
      res.end(err.message);
    });

    stream.pipe(res);
  };
}

import http from 'node:http';
import path from 'node:path';
import assert from 'node:assert/strict';
import { fileURLToPath } from 'node:url';
import send from 'send';

const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);
const PUBLIC_DIR = path.resolve(__dirname, '../public');

function request(port, pathname, headers = {}) {
  return new Promise((resolve, reject) => {
    const req = http.request(
      {
        hostname: '127.0.0.1',
        port,
        path: pathname,
        method: 'GET',
        headers
      },
      (res) => {
        let body = '';
        res.setEncoding('utf8');
        res.on('data', (chunk) => {
          body += chunk;
        });
        res.on('end', () => {
          resolve({
            statusCode: res.statusCode,
            headers: res.headers,
            body
          });
        });
      }
    );
    req.on('error', reject);
    req.end();
  });
}

const server = http.createServer((req, res) => {
  const url = new URL(req.url, 'http://localhost');
  const pathname = decodeURIComponent(url.pathname);
  const testCase = url.searchParams.get('case');

  if (testCase === 'custom-index') {
    const stream = send(req, pathname, { root: PUBLIC_DIR, index: 'home.html' });
    stream.on('error', (err) => {
      res.statusCode = err.status || 500;
      res.setHeader('Content-Type', 'text/plain; charset=UTF-8');
      res.end(err.message);
    });
    stream.pipe(res);
  } else if (testCase === 'extensions') {
    const stream = send(req, pathname, { root: PUBLIC_DIR, extensions: ['html', 'txt'] });
    stream.on('error', (err) => {
      res.statusCode = err.status || 500;
      res.setHeader('Content-Type', 'text/plain; charset=UTF-8');
      res.end(err.message);
    });
    stream.pipe(res);
  } else if (testCase === 'immutable') {
    const stream = send(req, pathname, { root: PUBLIC_DIR, immutable: true, maxAge: 86400000 });
    stream.on('error', (err) => {
      res.statusCode = err.status || 500;
      res.setHeader('Content-Type', 'text/plain; charset=UTF-8');
      res.end(err.message);
    });
    stream.pipe(res);
  } else if (testCase === 'no-ranges') {
    const stream = send(req, pathname, { root: PUBLIC_DIR, acceptRanges: false });
    stream.on('error', (err) => {
      res.statusCode = err.status || 500;
      res.setHeader('Content-Type', 'text/plain; charset=UTF-8');
      res.end(err.message);
    });
    stream.pipe(res);
  } else if (testCase === 'suppressed-headers') {
    const stream = send(req, pathname, {
      root: PUBLIC_DIR,
      cacheControl: false,
      etag: false,
      lastModified: false
    });
    stream.on('error', (err) => {
      res.statusCode = err.status || 500;
      res.setHeader('Content-Type', 'text/plain; charset=UTF-8');
      res.end(err.message);
    });
    stream.pipe(res);
  } else if (testCase === 'dotfiles-ignore') {
    const stream = send(req, pathname, { root: PUBLIC_DIR, dotfiles: 'ignore' });
    stream.on('error', (err) => {
      res.statusCode = err.status || 500;
      res.setHeader('Content-Type', 'text/plain; charset=UTF-8');
      res.end(err.message);
    });
    stream.pipe(res);
  } else if (testCase === 'directory-event') {
    const stream = send(req, pathname, { root: PUBLIC_DIR, index: false });
    stream.on('directory', () => {
      res.statusCode = 200;
      res.setHeader('X-Directory-Event', 'true');
      res.setHeader('Content-Type', 'text/plain; charset=UTF-8');
      res.end('Directory listing handled');
    });
    stream.on('error', (err) => {
      res.statusCode = err.status || 500;
      res.setHeader('Content-Type', 'text/plain; charset=UTF-8');
      res.end(err.message);
    });
    stream.pipe(res);
  } else {
    res.statusCode = 400;
    res.end('Unknown case');
  }
});

async function runContractTests() {
  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
  const port = server.address().port;

  try {
    // 1. send(req, path, { root, index: 'home.html' }) serves the custom index file when requesting a directory
    {
      const res = await request(port, '/?case=custom-index');
      assert.equal(res.statusCode, 200, 'Expected 200 OK for custom index');
      assert.match(res.body, /Home Page/, 'Body must match home.html');
      assert.equal(res.headers['content-type'], 'text/html; charset=UTF-8');
    }

    // 2. send(req, path, { root, extensions: ['html', 'txt'] }) serves the file with a matching extension when omitted from the request path
    {
      const res = await request(port, '/docs?case=extensions');
      assert.equal(res.statusCode, 200, 'Expected 200 OK for extension match');
      assert.match(res.body, /Sample documentation content/, 'Body must match docs.txt');
      assert.equal(res.headers['content-type'], 'text/plain; charset=UTF-8');
    }

    // 3. send(req, path, { root, immutable: true, maxAge: 86400000 }) includes the immutable directive in the Cache-Control header
    {
      const res = await request(port, '/app.js?case=immutable');
      assert.equal(res.statusCode, 200, 'Expected 200 OK for immutable resource');
      assert.equal(res.headers['cache-control'], 'public, max-age=86400, immutable', 'Cache-Control must have immutable directive');
    }

    // 4. send(req, path, { root, acceptRanges: false }) omits the Accept-Ranges header and ignores Range request headers
    {
      const res = await request(port, '/docs.txt?case=no-ranges', { range: 'bytes=0-5' });
      assert.equal(res.statusCode, 200, 'Expected 200 OK when range request is ignored');
      assert.equal(res.headers['accept-ranges'], undefined, 'Accept-Ranges must be omitted');
      assert.match(res.body, /Sample documentation content/, 'Full content must be returned');
    }

    // 5. send(req, path, { root, cacheControl: false, etag: false, lastModified: false }) suppresses Cache-Control, ETag, and Last-Modified response headers
    {
      const res = await request(port, '/docs.txt?case=suppressed-headers');
      assert.equal(res.statusCode, 200, 'Expected 200 OK');
      assert.equal(res.headers['cache-control'], undefined, 'Cache-Control header must be omitted');
      assert.equal(res.headers['etag'], undefined, 'ETag header must be omitted');
      assert.equal(res.headers['last-modified'], undefined, 'Last-Modified header must be omitted');
    }

    // 6. send(req, path, { root, dotfiles: 'ignore' }) emits a 404 Not Found error when accessing dotfiles
    {
      const res = await request(port, '/.secret?case=dotfiles-ignore');
      assert.equal(res.statusCode, 404, 'Expected 404 Not Found for ignored dotfile');
    }

    // 7. send(req, path, { root, index: false }).on('directory', fn) emits the directory event when requesting a directory with index disabled
    {
      const res = await request(port, '/subdir?case=directory-event');
      assert.equal(res.statusCode, 200, 'Expected 200 OK handled by directory event');
      assert.equal(res.headers['x-directory-event'], 'true', 'Custom directory header must be present');
      assert.equal(res.body, 'Directory listing handled');
    }

    console.log('All 7 contract assertions passed.');
  } finally {
    server.close();
  }
}

runContractTests().catch((err) => {
  console.error('Contract test failed:', err);
  process.exit(1);
});