send 1.2.1

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/send@1.2.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/send@1.2.1
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:382cfd591f9b8b887d4177a625e20d93c6ab43eb8cab206e14024e83d8835feb","constraints":{"executionContext":"node"},"contract":["send(req, path, { root }) streams the static file to the HTTP response with correct Content-Type, Content-Length, ETag, Last-Modified, and Accept-Ranges headers","send(req, path, { root }) returns HTTP 304 Not Modified for conditional GET requests when If-None-Match matches the ETag","send(req, path, { root }) returns HTTP 206 Partial Content with Content-Range header for Range byte requests","send(req, path, { root, maxAge }) sets the Cache-Control max-age header accordingly","send(req, path, { root }).on('headers', fn) invokes headers listener allowing custom response headers before streaming","send(req, path, { root }) emits an error with status 404 when the requested file does not exist","send(req, path, { root, dotfiles: 'deny' }) emits an error with status 403 when accessing dotfiles with deny option"],"goal":"verify pkg:npm/send@1.2.1","kind":"HOW","packages":["pkg:npm/send@1.2.1"],"schemaVersion":1},"contractCommand":["node","test/contract.js"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/send@1.2.1"],"schemaVersion":1,"verifierAdapter":"node-typescript@1"}

{
  "name": "sample-send",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-send",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "send": "1.2.1"
      }
    },
    "node_modules/debug": {
      "version": "4.4.3",
      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
      "license": "MIT",
      "dependencies": {
        "ms": "^2.1.3"
      },
      "engines": {
        "node": ">=6.0"
      },
      "peerDependenciesMeta": {
        "supports-color": {
          "optional": true
        }
      }
    },
    "node_modules/depd": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
      "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
      }
    },
    "node_modules/ee-first": {
      "version": "1.1.1",
      "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
      "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==",
      "license": "MIT"
    },
    "node_modules/encodeurl": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
      }
    },
    "node_modules/escape-html": {
      "version": "1.0.3",
      "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
      "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow==",
      "license": "MIT"
    },
    "node_modules/etag": {
      "version": "1.8.1",
      "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
      "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
      }
    },
    "node_modules/fresh": {
      "version": "2.0.0",
      "resolved": "https://registry.npmjs.org/fresh/-/fresh-2.0.0.tgz",
      "integrity": "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
      }
    },
    "node_modules/http-errors": {
      "version": "2.0.1",
      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
      "license": "MIT",
      "dependencies": {
        "depd": "~2.0.0",
        "inherits": "~2.0.4",
        "setprototypeof": "~1.2.0",
        "statuses": "~2.0.2",
        "toidentifier": "~1.0.1"
      },
      "engines": {
        "node": ">= 0.8"
      },
      "funding": {
        "type": "opencollective",
        "url": "https://opencollective.com/express"
      }
    },
    "node_modules/inherits": {
      "version": "2.0.4",
      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
      "license": "ISC"
    },
    "node_modules/mime-db": {
      "version": "1.54.0",
      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
      "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
      }
    },
    "node_modules/mime-types": {
      "version": "3.0.2",
      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
      "license": "MIT",
      "dependencies": {
        "mime-db": "^1.54.0"
      },
      "engines": {
        "node": ">=18"
      },
      "funding": {
        "type": "opencollective",
        "url": "https://opencollective.com/express"
      }
    },
    "node_modules/ms": {
      "version": "2.1.3",
      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
      "license": "MIT"
    },
    "node_modules/on-finished": {
      "version": "2.4.1",
      "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
      "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
      "license": "MIT",
      "dependencies": {
        "ee-first": "1.1.1"
      },
      "engines": {
        "node": ">= 0.8"
      }
    },
    "node_modules/range-parser": {
      "version": "1.3.0",
      "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.3.0.tgz",
      "integrity": "sha512-hek2mFQpPuI4E1BBKrSto+BU3e3x4xuarsbiwr3+lf7p44juvFMV0XFWQAP3xUyqXA4RrXLIoaSUGbSt056ZMw==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
      },
      "funding": {
        "type": "opencollective",
        "url": "https://opencollective.com/express"
      }
    },
    "node_modules/send": {
      "version": "1.2.1",
      "resolved": "https://registry.npmjs.org/send/-/send-1.2.1.tgz",
      "integrity": "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ==",
      "license": "MIT",
      "dependencies": {
        "debug": "^4.4.3",
        "encodeurl": "^2.0.0",
        "escape-html": "^1.0.3",
        "etag": "^1.8.1",
        "fresh": "^2.0.0",
        "http-errors": "^2.0.1",
        "mime-types": "^3.0.2",
        "ms": "^2.1.3",
        "on-finished": "^2.4.1",
        "range-parser": "^1.2.1",
        "statuses": "^2.0.2"
      },
      "engines": {
        "node": ">= 18"
      },
      "funding": {
        "type": "opencollective",
        "url": "https://opencollective.com/express"
      }
    },
    "node_modules/setprototypeof": {
      "version": "1.2.0",
      "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
      "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
      "license": "ISC"
    },
    "node_modules/statuses": {
      "version": "2.0.2",
      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.8"
      }
    },
    "node_modules/toidentifier": {
      "version": "1.0.1",
      "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
      "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
      "license": "MIT",
      "engines": {
        "node": ">=0.6"
      }
    }
  }
}

{
  "name": "sample-send",
  "version": "1.0.0",
  "private": true,
  "description": "Clean-room verification for send",
  "main": "test/contract.js",
  "scripts": {
    "test": "node test/contract.js"
  },
  "dependencies": {
    "send": "1.2.1"
  },
  "license": "MIT-0"
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/send@1.2.1",
  "kind": "HOW",
  "packages": [
    "pkg:npm/send@1.2.1"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}

const assert = require('assert/strict');
const http = require('http');
const fs = require('fs');
const path = require('path');
const os = require('os');
const send = require('send');

async function runTests() {
  const fixturesDir = path.join(os.tmpdir(), `csx-send-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
  fs.mkdirSync(fixturesDir, { recursive: true });

  const helloFile = path.join(fixturesDir, 'hello.txt');
  const jsonFile = path.join(fixturesDir, 'data.json');
  const hiddenFile = path.join(fixturesDir, '.hidden');

  fs.writeFileSync(helloFile, 'Hello, World!');
  fs.writeFileSync(jsonFile, '{"status":"ok"}');
  fs.writeFileSync(hiddenFile, 'secret content');

  try {
    // 1. Basic file streaming with headers (Content-Type, Content-Length, ETag, Last-Modified, Accept-Ranges)
    await new Promise((resolve, reject) => {
      const server = http.createServer((req, res) => {
        send(req, req.url, { root: fixturesDir }).pipe(res);
      });

      server.listen(0, '127.0.0.1', () => {
        const port = server.address().port;
        http.get(`http://127.0.0.1:${port}/hello.txt`, (res) => {
          assert.equal(res.statusCode, 200, 'Status should be 200 OK');
          assert.equal(res.headers['content-type'], 'text/plain; charset=utf-8', 'Content-Type should be text/plain; charset=utf-8');
          assert.equal(res.headers['content-length'], '13', 'Content-Length should match file size');
          assert(res.headers['etag'], 'ETag header should be present');
          assert(res.headers['last-modified'], 'Last-Modified header should be present');
          assert.equal(res.headers['accept-ranges'], 'bytes', 'Accept-Ranges should be bytes');

          let data = '';
          res.on('data', (chunk) => { data += chunk; });
          res.on('end', () => {
            assert.equal(data, 'Hello, World!', 'Body content should match file content');
            server.close(resolve);
          });
        }).on('error', reject);
      });
    });

    // 2. Conditional GET with If-None-Match returning 304 Not Modified
    await new Promise((resolve, reject) => {
      let etag = '';
      const server = http.createServer((req, res) => {
        send(req, req.url, { root: fixturesDir }).pipe(res);
      });

      server.listen(0, '127.0.0.1', () => {
        const port = server.address().port;
        http.get(`http://127.0.0.1:${port}/hello.txt`, (res1) => {
          etag = res1.headers['etag'];
          res1.resume();
          res1.on('end', () => {
            const req2 = http.get(`http://127.0.0.1:${port}/hello.txt`, {
              headers: { 'if-none-match': etag }
            }, (res2) => {
              assert.equal(res2.statusCode, 304, 'Status should be 304 Not Modified');
              assert.equal(res2.headers['etag'], etag, 'ETag should match on 304');
              server.close(resolve);
            });
            req2.on('error', reject);
          });
        }).on('error', reject);
      });
    });

    // 3. Partial Content with Range header returning 206
    await new Promise((resolve, reject) => {
      const server = http.createServer((req, res) => {
        send(req, req.url, { root: fixturesDir }).pipe(res);
      });

      server.listen(0, '127.0.0.1', () => {
        const port = server.address().port;
        const req = http.get(`http://127.0.0.1:${port}/hello.txt`, {
          headers: { 'range': 'bytes=0-4' }
        }, (res) => {
          assert.equal(res.statusCode, 206, 'Status should be 206 Partial Content');
          assert.equal(res.headers['content-range'], 'bytes 0-4/13', 'Content-Range should indicate 0-4/13');
          assert.equal(res.headers['content-length'], '5', 'Content-Length should be 5');
          let data = '';
          res.on('data', (chunk) => { data += chunk; });
          res.on('end', () => {
            assert.equal(data, 'Hello', 'Partial body should match requested range');
            server.close(resolve);
          });
        });
        req.on('error', reject);
      });
    });

    // 4. Cache-Control with maxAge option
    await new Promise((resolve, reject) => {
      const server = http.createServer((req, res) => {
        send(req, req.url, { root: fixturesDir, maxAge: '2h' }).pipe(res);
      });

      server.listen(0, '127.0.0.1', () => {
        const port = server.address().port;
        http.get(`http://127.0.0.1:${port}/hello.txt`, (res) => {
          assert.equal(res.statusCode, 200);
          assert(res.headers['cache-control'].includes('max-age=7200'), 'Cache-Control header should reflect maxAge');
          res.resume();
          res.on('end', () => {
            server.close(resolve);
          });
        }).on('error', reject);
      });
    });

    // 5. Custom headers event listener
    await new Promise((resolve, reject) => {
      const server = http.createServer((req, res) => {
        send(req, req.url, { root: fixturesDir })
          .on('headers', (res, filepath, stat) => {
            res.setHeader('X-Custom-Header', 'custom-value');
          })
          .pipe(res);
      });

      server.listen(0, '127.0.0.1', () => {
        const port = server.address().port;
        http.get(`http://127.0.0.1:${port}/data.json`, (res) => {
          assert.equal(res.statusCode, 200);
          assert.equal(res.headers['content-type'], 'application/json; charset=utf-8');
          assert.equal(res.headers['x-custom-header'], 'custom-value', 'Custom header should be set via headers event');
          let data = '';
          res.on('data', (chunk) => { data += chunk; });
          res.on('end', () => {
            assert.equal(data, '{"status":"ok"}');
            server.close(resolve);
          });
        }).on('error', reject);
      });
    });

    // 6. 404 Error event when requested file does not exist
    await new Promise((resolve, reject) => {
      const server = http.createServer((req, res) => {
        const stream = send(req, req.url, { root: fixturesDir });
        stream.on('error', (err) => {
          res.statusCode = err.status || 500;
          res.end(`Handled Error: ${err.message}`);
        });
        stream.pipe(res);
      });

      server.listen(0, '127.0.0.1', () => {
        const port = server.address().port;
        http.get(`http://127.0.0.1:${port}/missing-file.txt`, (res) => {
          assert.equal(res.statusCode, 404, 'Status should be 404 for missing file');
          let data = '';
          res.on('data', (chunk) => { data += chunk; });
          res.on('end', () => {
            assert(data.includes('Handled Error: ENOENT'), 'Response body should contain handled ENOENT message');
            server.close(resolve);
          });
        }).on('error', reject);
      });
    });

    // 7. Dotfiles deny option returning 403 Forbidden
    await new Promise((resolve, reject) => {
      const server = http.createServer((req, res) => {
        const stream = send(req, req.url, { root: fixturesDir, dotfiles: 'deny' });
        stream.on('error', (err) => {
          res.statusCode = err.status || 500;
          res.end(`Status: ${err.status}`);
        });
        stream.pipe(res);
      });

      server.listen(0, '127.0.0.1', () => {
        const port = server.address().port;
        http.get(`http://127.0.0.1:${port}/.hidden`, (res) => {
          assert.equal(res.statusCode, 403, 'Status should be 403 for dotfile with dotfiles: deny');
          let data = '';
          res.on('data', (chunk) => { data += chunk; });
          res.on('end', () => {
            assert.equal(data, 'Status: 403');
            server.close(resolve);
          });
        }).on('error', reject);
      });
    });

    console.log('All send contract assertions passed successfully.');
  } finally {
    fs.rmSync(fixturesDir, { recursive: true, force: true });
  }
}

runTests().catch((err) => {
  console.error('Contract test failed:', err);
  process.exit(1);
});