@askrjs/node 0.0.4 → 0.0.6

package/README.md

@@ -23,7 +23,7 @@ const app = createServerApp({
   routes: [{ path: "/health", handler: () => json({ status: "ok" }) }],
 });
 
-createServer(createNodeHandler(app)).listen(3000);
+createServer(createNodeHandler(app, { baseUrl: "http://localhost:3000" })).listen(3000);
 ```
 
 `createNodeHandler` also works as Connect middleware because it accepts an optional `next`
@@ -35,12 +35,33 @@ status text, and HEAD responses.
 ```ts
 import { listen } from "@askrjs/node";
 
-const server = await listen(app, { port: 3000 });
+const server = await listen(app, {
+  port: 3000,
+  requestTimeout: 120_000,
+  headersTimeout: 60_000,
+  keepAliveTimeout: 5_000,
+});
 server.close();
 ```
 
 Pass an `AbortSignal` to integrate shutdown with your process lifecycle.
 
+Enable the built-in `ws` transport with `websocket: true`. It defaults to a
+1 MiB maximum message payload with compression disabled; pass
+`websocket: { maxPayload, perMessageDeflate }` to override those settings.
+
+```ts
+router.ws("/echo", (socket) => {
+  socket.onMessage((message) => socket.send(message));
+});
+
+const server = await listen(createServerApp({ router }), { websocket: true });
+```
+
+Route matching, authentication, and middleware complete before the handshake.
+Rejected upgrades preserve the application response, and shutdown closes active
+sockets.
+
 ## Serve a production application
 
 ```ts

package/dist/index.d.ts

@@ -1,15 +1,26 @@
 import { IncomingMessage, Server, ServerResponse } from "node:http";
+import { PerMessageDeflateOptions } from "ws";
 import { ServerApp } from "@askrjs/server";
 import { AddressInfo } from "node:net";
 //#region src/contracts.d.ts
+interface NodeWebSocketOptions {
+  readonly maxPayload?: number;
+  readonly perMessageDeflate?: boolean | PerMessageDeflateOptions;
+  readonly allowedOrigins?: readonly string[];
+}
 interface NodeHandlerOptions {
   baseUrl?: string;
+  allowedHosts?: readonly string[];
 }
 interface ListenOptions {
   port?: number;
   host?: string;
   backlog?: number;
   signal?: AbortSignal;
+  requestTimeout?: number;
+  headersTimeout?: number;
+  keepAliveTimeout?: number;
+  websocket?: boolean | NodeWebSocketOptions;
 }
 interface ServeOptions extends ListenOptions {
   readonly assets?: {
@@ -39,4 +50,4 @@ declare function serve(app: ServerApp & {
   close?: () => void | Promise<void>;
 }, options?: ServeOptions): Promise<ServedApplication>;
 //#endregion
-export { ConnectNext, ListenOptions, ListeningServer, NodeHandler, NodeHandlerOptions, ServeOptions, ServedApplication, createNodeHandler, listen, serve };
+export { ConnectNext, ListenOptions, ListeningServer, NodeHandler, NodeHandlerOptions, NodeWebSocketOptions, ServeOptions, ServedApplication, createNodeHandler, listen, serve };

package/dist/index.js

@@ -1,9 +1,11 @@
 import { Readable } from "node:stream";
 import { createServer } from "node:http";
+import { WebSocketServer } from "ws";
 import { createReadStream } from "node:fs";
 import { stat } from "node:fs/promises";
 import { extname, resolve, sep } from "node:path";
 //#region src/request.ts
+var NodeRequestError = class extends TypeError {};
 function requestHeaders(request) {
 	const headers = new Headers();
 	for (const [key, value] of Object.entries(request.headers)) {
@@ -13,10 +15,17 @@ function requestHeaders(request) {
 	return headers;
 }
 function requestFromNode(request, options, signal) {
-	const base = options.baseUrl ?? `http://${request.headers.host ?? "localhost"}`;
+	const host = request.headers.host;
+	if (!options.baseUrl && !options.allowedHosts?.length) throw new NodeRequestError("Node handling requires baseUrl or an allowedHosts allowlist.");
+	if (!host) throw new NodeRequestError("Request Host header is required.");
+	const hostName = host.startsWith("[") ? host.slice(1, host.indexOf("]")) : host.split(":", 1)[0];
+	if (options.allowedHosts?.length && !options.allowedHosts.some((allowed) => allowed === host || allowed === hostName)) throw new NodeRequestError("Request Host header is not allowed.");
+	const base = options.baseUrl ?? `http://${host}`;
+	const target = new URL(request.url ?? "/", base);
+	if (/^https?:\/\//i.test(request.url ?? "") && target.origin !== new URL(base).origin) throw new NodeRequestError("Absolute-form request target origin is not allowed.");
 	const method = request.method ?? "GET";
 	const body = method === "GET" || method === "HEAD" ? void 0 : Readable.toWeb(request);
-	return new Request(new URL(request.url ?? "/", base), {
+	return new Request(target, {
 		method,
 		headers: requestHeaders(request),
 		body,
@@ -100,10 +109,11 @@ function minimalError(response, error) {
 		response.destroy(error instanceof Error ? error : void 0);
 		return;
 	}
-	response.statusCode = 500;
-	response.statusMessage = "Internal Server Error";
+	const clientError = error instanceof NodeRequestError;
+	response.statusCode = clientError ? 400 : 500;
+	response.statusMessage = clientError ? "Bad Request" : "Internal Server Error";
 	response.setHeader("content-type", "text/plain; charset=utf-8");
-	response.end("Internal Server Error");
+	response.end(clientError ? "Bad Request" : "Internal Server Error");
 }
 function attachAbort(request, response, controller) {
 	const abort = () => controller.abort();
@@ -129,9 +139,102 @@ function createNodeHandler(app, options = {}) {
 	};
 }
 //#endregion
+//#region src/websocket.ts
+function subscribe(socket, event, listener) {
+	socket.on(event, listener);
+	return () => socket.off(event, listener);
+}
+function socketLike(socket) {
+	return {
+		send: (data) => socket.send(data),
+		close: (code, reason) => socket.close(code, reason),
+		onMessage: (listener) => subscribe(socket, "message", (data, binary) => {
+			if (!binary) listener(data.toString());
+			else {
+				const buffer = Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data);
+				listener(new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength));
+			}
+		}),
+		onClose: (listener) => subscribe(socket, "close", (code, reason) => listener({
+			code,
+			reason: reason.toString(),
+			wasClean: code === 1e3
+		})),
+		onError: (listener) => subscribe(socket, "error", listener)
+	};
+}
+async function rejectUpgrade(socket, response) {
+	const body = Buffer.from(await response.arrayBuffer());
+	const lines = [`HTTP/1.1 ${response.status} ${response.statusText || "Rejected"}`];
+	response.headers.forEach((value, name) => lines.push(`${name}: ${value}`));
+	if (!response.headers.has("content-length")) lines.push(`content-length: ${body.byteLength}`);
+	lines.push("connection: close", "", "");
+	socket.end(Buffer.concat([Buffer.from(lines.join("\r\n")), body]));
+}
+function installWebSockets(server, app, options = {}, handlerOptions = {}) {
+	const webSockets = new WebSocketServer({
+		noServer: true,
+		maxPayload: options.maxPayload ?? 1048576,
+		perMessageDeflate: options.perMessageDeflate ?? false
+	});
+	server.on("upgrade", (request, socket, head) => {
+		const controller = new AbortController();
+		let accepted;
+		Promise.resolve().then(() => requestFromNode(request, handlerOptions, controller.signal)).then(async (webRequest) => {
+			const originHeader = request.headers.origin;
+			const origin = Array.isArray(originHeader) ? void 0 : originHeader;
+			const allowedOrigins = options.allowedOrigins ?? [new URL(webRequest.url).origin];
+			let normalizedOrigin;
+			try {
+				normalizedOrigin = origin ? new URL(origin).origin : void 0;
+			} catch {
+				normalizedOrigin = void 0;
+			}
+			if (!normalizedOrigin || !allowedOrigins.includes(normalizedOrigin)) {
+				await rejectUpgrade(socket, new Response("Forbidden", { status: 403 }));
+				return;
+			}
+			let marker;
+			const response = await app.fetch(webRequest, { websocket: { upgrade: (_request, handler, context) => {
+				marker = new Response(null, { status: 200 });
+				accepted = {
+					handler,
+					context,
+					response: marker
+				};
+				return marker;
+			} } });
+			if (!accepted || response !== accepted.response) {
+				await rejectUpgrade(socket, response);
+				return;
+			}
+			webSockets.handleUpgrade(request, socket, head, (webSocket) => {
+				webSocket.once("close", () => controller.abort());
+				Promise.resolve(accepted.handler(socketLike(webSocket), accepted.context)).catch(() => webSocket.close(1011, "WebSocket handler failed"));
+			});
+		}).catch(() => socket.destroy());
+	});
+	return { close() {
+		for (const socket of webSockets.clients) socket.close(1001, "Server shutting down");
+		webSockets.close();
+	} };
+}
+//#endregion
 //#region src/listen.ts
 function listen(app, options = {}) {
-	const server = createServer(createNodeHandler(app));
+	const handlerOptions = { allowedHosts: [options.host ?? "127.0.0.1", "localhost"] };
+	const server = createServer(createNodeHandler(app, handlerOptions));
+	if (options.requestTimeout !== void 0) server.requestTimeout = options.requestTimeout;
+	if (options.headersTimeout !== void 0) server.headersTimeout = options.headersTimeout;
+	if (options.keepAliveTimeout !== void 0) server.keepAliveTimeout = options.keepAliveTimeout;
+	const webSockets = options.websocket ? installWebSockets(server, app, options.websocket === true ? {} : options.websocket, handlerOptions) : void 0;
+	if (webSockets) {
+		const nativeClose = server.close.bind(server);
+		server.close = ((callback) => {
+			webSockets.close();
+			return nativeClose(callback);
+		});
+	}
 	const close = () => server.close();
 	options.signal?.addEventListener("abort", close, { once: true });
 	server.once("close", () => options.signal?.removeEventListener("abort", close));
@@ -169,8 +272,9 @@ function isAssetPath(pathname) {
 }
 async function serve(app, options = {}) {
 	const root = options.assets ? resolve(options.assets.root) : void 0;
-	const applicationHandler = createNodeHandler({ async fetch(request) {
-		const result = await app.fetch(request);
+	const handlerOptions = { allowedHosts: [options.host ?? "127.0.0.1", "localhost"] };
+	const applicationHandler = createNodeHandler({ async fetch(request, dispatchOptions) {
+		const result = await app.fetch(request, dispatchOptions);
 		if (!result.headers.has("cache-control") && result.headers.get("content-type")?.includes("text/html")) {
 			const headers = new Headers(result.headers);
 			headers.set("cache-control", "no-cache");
@@ -181,7 +285,7 @@ async function serve(app, options = {}) {
 			});
 		}
 		return result;
-	} });
+	} }, handlerOptions);
 	const server = createServer(async (request, response) => {
 		let pathname;
 		try {
@@ -220,6 +324,10 @@ async function serve(app, options = {}) {
 		}
 		applicationHandler(request, response);
 	});
+	if (options.requestTimeout !== void 0) server.requestTimeout = options.requestTimeout;
+	if (options.headersTimeout !== void 0) server.headersTimeout = options.headersTimeout;
+	if (options.keepAliveTimeout !== void 0) server.keepAliveTimeout = options.keepAliveTimeout;
+	const webSockets = options.websocket ? installWebSockets(server, app, options.websocket === true ? {} : options.websocket, handlerOptions) : void 0;
 	let closing;
 	const signals = options.signals === false ? [] : options.signals ?? ["SIGINT", "SIGTERM"];
 	const removeListeners = () => {
@@ -228,6 +336,7 @@ async function serve(app, options = {}) {
 	};
 	const close = () => closing ??= new Promise((resolveClose, rejectClose) => {
 		removeListeners();
+		webSockets?.close();
 		const finish = async (serverError) => {
 			try {
 				await app.close?.();

package/dist/mcp.d.ts

@@ -10,6 +10,8 @@ interface McpStdioOptions<Dependencies = undefined> {
   signal?: AbortSignal;
   auth?: AuthContext | ((environment: NodeJS.ProcessEnv) => AuthContext | Promise<AuthContext>);
   environment?: NodeJS.ProcessEnv;
+  maxLineBytes?: number;
+  maxConcurrency?: number;
 }
 interface McpStdioConnection {
   readonly closed: Promise<void>;

package/dist/mcp.js

@@ -22,6 +22,11 @@ function connectMcpStdio(mcp, options) {
 		finish = resolve;
 	});
 	let ended = false;
+	const maxLineBytes = options.maxLineBytes ?? 1048576;
+	const maxConcurrency = options.maxConcurrency ?? 16;
+	if (!Number.isInteger(maxLineBytes) || maxLineBytes <= 0) throw new TypeError("MCP maxLineBytes must be a positive integer.");
+	if (!Number.isInteger(maxConcurrency) || maxConcurrency <= 0) throw new TypeError("MCP maxConcurrency must be a positive integer.");
+	let active = 0;
 	const write = (message) => new Promise((resolve, reject) => {
 		output.write(`${JSON.stringify(message)}\n`, (error) => error ? reject(error) : resolve());
 	});
@@ -37,6 +42,29 @@ function connectMcpStdio(mcp, options) {
 	};
 	options.signal?.addEventListener("abort", () => void close(), { once: true });
 	lines.on("line", (line) => {
+		if (Buffer.byteLength(line) > maxLineBytes) {
+			write({
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32600,
+					message: "Request line exceeds the configured limit"
+				}
+			}).catch(() => void close());
+			return;
+		}
+		if (active >= maxConcurrency) {
+			write({
+				jsonrpc: "2.0",
+				id: null,
+				error: {
+					code: -32600,
+					message: "Too many concurrent requests"
+				}
+			}).catch(() => void close());
+			return;
+		}
+		active += 1;
 		(async () => {
 			let message;
 			try {
@@ -78,7 +106,9 @@ function connectMcpStdio(mcp, options) {
 					if (controller && id !== void 0) controllers.delete(id);
 				}
 			}
-		})().catch((error) => diagnostics.write(`MCP stdio error: ${error instanceof Error ? error.message : String(error)}\n`));
+		})().catch((error) => diagnostics.write(`MCP stdio error: ${error instanceof Error ? error.message : String(error)}\n`)).finally(() => {
+			active -= 1;
+		});
 	});
 	lines.once("close", () => {
 		if (!ended) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askrjs/node",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "Node http adapter for @askrjs/server",
   "keywords": [
     "askr",
@@ -56,10 +56,13 @@
   },
   "dependencies": {
     "@askrjs/auth": ">=0.0.1 <0.1.0",
-    "@askrjs/server": ">=0.0.1 <0.1.0"
+    "@askrjs/server": ">=0.0.5 <0.1.0",
+    "ws": "^8.21.1"
   },
   "devDependencies": {
+    "@askrjs/schema": ">=0.0.2 <0.1.0",
     "@types/node": "^26.0.0",
+    "@types/ws": "^8.18.1",
     "publint": "^0.3.21",
     "typescript": "^6.0.0",
     "vite-plus": "^0.2.4",