@askrjs/node 0.0.7 → 0.0.9

package/README.md

@@ -28,7 +28,14 @@ createServer(createNodeHandler(app, { baseUrl: "http://localhost:3000" })).liste
 
 `createNodeHandler` also works as Connect middleware because it accepts an optional `next`
 callback. It preserves streaming bodies, repeated `Set-Cookie` headers, aborts, backpressure,
-status text, and HEAD responses.
+status text, and HEAD responses. `next` receives adapter failures; application responses, including
+`404`, remain owned by the `ServerApp` and do not fall through.
+
+Every handler must have a trusted URL boundary. Pass `baseUrl` when the external origin is fixed,
+or `allowedHosts` when the request `Host` determines the origin. Host names are canonicalized and
+compared case-insensitively; entries without a port allow that host on any port, while entries with
+a port require that exact authority. Absolute-form request targets must retain the trusted origin,
+and ambiguous network-path targets are rejected.
 
 ## Listen directly
 
@@ -48,8 +55,12 @@ Pass an `AbortSignal` to integrate shutdown with your process lifecycle.
 
 Enable the built-in `ws` transport with `websocket: true`. It defaults to a
 1 MiB maximum message payload with compression disabled; pass
-`websocket: { maxPayload, maxRejectionBodyBytes, perMessageDeflate }` to override
-those settings. Rejected upgrade bodies are capped at 64 KiB by default.
+`websocket: { closeTimeout, maxPayload, maxRejectionBodyBytes, perMessageDeflate }` to override
+those settings. Rejected upgrade bodies are capped at 64 KiB by default. Shutdown gives clients five
+seconds to complete the close handshake by default, then terminates any remaining connections.
+Upgrades require an `Origin`. The request origin is allowed by default; set
+`websocket.allowedOrigins` to a canonical allowlist when trusted browser origins differ from the
+application origin.
 
 ```ts
 router.ws("/echo", (socket) => {
@@ -77,8 +88,26 @@ await running.close();
 ```
 
 `serve` handles static assets and closes both the HTTP server and the application during shutdown.
+When an asset root is configured, extension-bearing `GET` and `HEAD` paths are reserved for static
+files: missing files return `404` without falling through to application routing, source maps are not
+served, and resolved files must remain inside the configured root. Fingerprinted files under
+`/assets/` receive immutable caching; other files receive `no-cache`.
 Both `listen` and `serve` bind to `127.0.0.1` by default. A non-loopback
-`host` also requires `allowPublicBind: true` so public exposure is explicit.
+`host` also requires `allowPublicBind: true` so public exposure is explicit. Public listeners should
+declare every external host name through `allowedHosts`; the bind host and `localhost` remain allowed
+automatically:
+
+```ts
+await serve(app, {
+  host: "0.0.0.0",
+  allowPublicBind: true,
+  allowedHosts: ["app.example.com"],
+});
+```
+
+`listen` and `serve` fail before binding when their `AbortSignal` is already aborted. Later aborts
+start shutdown. `serve().close()` is idempotent, waits for HTTP and WebSocket closure, and then closes
+the application exactly once.
 
 ## MCP over stdio
 
@@ -90,4 +119,6 @@ await connection.closed;
 ```
 
 Protocol messages use stdin/stdout; diagnostics remain isolated on stderr. Authentication may be
-provided directly or resolved from the process environment for each message.
+provided directly or resolved from the process environment for each message. Closing stdin, calling
+`connection.close()`, or aborting its signal detaches the transport, cancels active requests,
+terminates the MCP session, and prevents late protocol output.

package/dist/index.d.ts

@@ -1,19 +1,20 @@
+import { AddressInfo } from "node:net";
 import { IncomingMessage, Server, ServerResponse } from "node:http";
 import { PerMessageDeflateOptions } from "ws";
 import { ServerApp } from "@askrjs/server";
-import { AddressInfo } from "node:net";
 //#region src/contracts.d.ts
 interface NodeWebSocketOptions {
+  readonly closeTimeout?: number;
   readonly maxPayload?: number;
   readonly maxRejectionBodyBytes?: number;
   readonly perMessageDeflate?: boolean | PerMessageDeflateOptions;
   readonly allowedOrigins?: readonly string[];
 }
 interface NodeHandlerOptions {
-  baseUrl?: string;
-  allowedHosts?: readonly string[];
+  readonly baseUrl?: string;
+  readonly allowedHosts?: readonly string[];
 }
-interface ListenOptions {
+interface ListenOptions extends NodeHandlerOptions {
   port?: number;
   host?: string;
   allowPublicBind?: boolean;
@@ -39,7 +40,7 @@ type ConnectNext = (error?: unknown) => void;
 type NodeHandler = (request: IncomingMessage, response: ServerResponse, next?: ConnectNext) => void;
 //#endregion
 //#region src/handler.d.ts
-declare function createNodeHandler(app: ServerApp, options?: NodeHandlerOptions): NodeHandler;
+declare function createNodeHandler(app: ServerApp, options: NodeHandlerOptions): NodeHandler;
 //#endregion
 //#region src/listen.d.ts
 type ListeningServer = Server & {

package/dist/index.js

@@ -1,41 +1,133 @@
-import { Readable } from "node:stream";
+import { isIP } from "node:net";
+import { addAbortListener } from "node:events";
 import { createServer } from "node:http";
-import { WebSocketServer } from "ws";
+import { WebSocket, WebSocketServer } from "ws";
 import { createReadStream } from "node:fs";
 import { realpath, stat } from "node:fs/promises";
 import { extname, resolve, sep } from "node:path";
+import { pipeline } from "node:stream";
 //#region src/request.ts
 var NodeRequestError = class extends TypeError {};
+function explicitPort(authority) {
+	if (authority.startsWith("[")) {
+		const bracket = authority.indexOf("]");
+		return bracket >= 0 && authority[bracket + 1] === ":" ? authority.slice(bracket + 2) : void 0;
+	}
+	const first = authority.indexOf(":");
+	return first >= 0 && first === authority.lastIndexOf(":") ? authority.slice(first + 1) : void 0;
+}
+function parseAuthority(value, allowBareIpv6 = false) {
+	if (!value || value.trim() !== value) throw new NodeRequestError("Request host must be a non-empty HTTP authority.");
+	const bareIpv6 = isIP(value) === 6;
+	if (bareIpv6 && !allowBareIpv6) throw new NodeRequestError("IPv6 request hosts must use brackets.");
+	const authority = bareIpv6 ? `[${value}]` : value;
+	const port = explicitPort(authority);
+	let parsed;
+	try {
+		parsed = new URL(`http://${authority}`);
+	} catch {
+		throw new NodeRequestError("Request host is not a valid HTTP authority.");
+	}
+	if (parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash || port !== void 0 && !/^\d+$/u.test(port)) throw new NodeRequestError("Request host is not a valid HTTP authority.");
+	return {
+		hostname: parsed.hostname,
+		host: port === void 0 ? parsed.hostname : `${parsed.hostname}:${Number(port)}`
+	};
+}
+function prepareBaseUrl(value) {
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		throw new TypeError("Node handler baseUrl must be a valid HTTP or HTTPS origin.");
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) throw new TypeError("Node handler baseUrl must be an HTTP or HTTPS origin.");
+	return parsed.origin;
+}
+function prepareNodeHandlerOptions(options) {
+	const allowedHosts = (options.allowedHosts ?? []).map((value) => {
+		try {
+			const parsed = parseAuthority(value, true);
+			return explicitPort(isIP(value) === 6 ? `[${value}]` : value) === void 0 ? { hostname: parsed.hostname } : parsed;
+		} catch (error) {
+			throw new TypeError(`Node handler allowedHosts contains an invalid host: ${error instanceof Error ? error.message : String(error)}`);
+		}
+	});
+	const baseUrl = options.baseUrl === void 0 ? void 0 : prepareBaseUrl(options.baseUrl);
+	if (!baseUrl && allowedHosts.length === 0) throw new TypeError("Node handling requires baseUrl or an allowedHosts allowlist.");
+	return {
+		allowedHosts,
+		baseUrl,
+		hostCache: {}
+	};
+}
 function requestHeaders(request) {
 	const headers = new Headers();
-	for (const [key, value] of Object.entries(request.headers)) {
+	for (const key in request.headers) {
+		const value = request.headers[key];
 		if (value === void 0) continue;
-		headers.set(key, Array.isArray(value) ? value.join(", ") : value);
+		if (Array.isArray(value)) for (const item of value) headers.append(key, item);
+		else headers.set(key, value);
 	}
 	return headers;
 }
-function resolveNodeRequestUrl(request, options) {
+function resolveNodeRequestHref(request, options) {
 	const host = request.headers.host;
-	if (!options.baseUrl && !options.allowedHosts?.length) throw new NodeRequestError("Node handling requires baseUrl or an allowedHosts allowlist.");
 	if (!host) throw new NodeRequestError("Request Host header is required.");
-	const hostName = host.startsWith("[") ? host.slice(1, host.indexOf("]")) : host.split(":", 1)[0];
-	if (options.allowedHosts?.length && !options.allowedHosts.some((allowed) => allowed === host || allowed === hostName)) throw new NodeRequestError("Request Host header is not allowed.");
-	const base = options.baseUrl ?? `http://${host}`;
-	const target = new URL(request.url ?? "/", base);
-	if (/^https?:\/\//i.test(request.url ?? "") && target.origin !== new URL(base).origin) throw new NodeRequestError("Absolute-form request target origin is not allowed.");
-	return target;
+	let base = options.hostCache.value === host ? options.hostCache.base : void 0;
+	if (!base) {
+		const authority = parseAuthority(host);
+		if (options.allowedHosts.length > 0 && !options.allowedHosts.some((allowed) => allowed.host === void 0 ? allowed.hostname === authority.hostname : allowed.host === authority.host)) throw new NodeRequestError("Request Host header is not allowed.");
+		base = options.baseUrl ?? `http://${authority.host}`;
+		options.hostCache.value = host;
+		options.hostCache.base = base;
+	}
+	const requestTarget = request.url || "/";
+	if (requestTarget === "*") {
+		if (request.method === "OPTIONS") return `${base}/*`;
+		throw new NodeRequestError("Asterisk-form request targets require OPTIONS.");
+	}
+	if (requestTarget.startsWith("//")) throw new NodeRequestError("Network-path request targets are not allowed.");
+	if (requestTarget.startsWith("/")) {
+		if (requestTarget.includes("\\")) throw new NodeRequestError("Request targets must not contain backslashes.");
+		if (requestTarget.includes("#")) throw new NodeRequestError("Request targets must not contain fragments.");
+		return `${base}${requestTarget}`;
+	}
+	if (!/^https?:\/\//iu.test(requestTarget)) throw new NodeRequestError("Request target must use origin-form or absolute-form.");
+	let target;
+	try {
+		target = new URL(requestTarget, base);
+	} catch {
+		throw new NodeRequestError("Request target is not a valid HTTP URL.");
+	}
+	if (target.origin !== new URL(base).origin) throw new NodeRequestError("Absolute-form request target origin is not allowed.");
+	if (target.hash) throw new NodeRequestError("Request targets must not contain fragments.");
+	return target.href;
+}
+function resolveNodeRequestUrl(request, options) {
+	try {
+		return new URL(resolveNodeRequestHref(request, options));
+	} catch (error) {
+		if (error instanceof NodeRequestError) throw error;
+		throw new NodeRequestError("Request target is not a valid HTTP URL.");
+	}
 }
 function requestFromNode(request, options, signal) {
-	const target = resolveNodeRequestUrl(request, options);
+	const target = resolveNodeRequestHref(request, options);
 	const method = request.method ?? "GET";
-	const body = method === "GET" || method === "HEAD" ? void 0 : Readable.toWeb(request);
-	return new Request(target, {
-		method,
-		headers: requestHeaders(request),
-		body,
-		signal,
-		...body ? { duplex: "half" } : {}
-	});
+	if (method === "GET" || method === "HEAD") request.resume();
+	const body = method === "GET" || method === "HEAD" ? void 0 : request;
+	try {
+		return new Request(target, {
+			method,
+			headers: requestHeaders(request),
+			body,
+			signal,
+			...body ? { duplex: "half" } : {}
+		});
+	} catch {
+		throw new NodeRequestError("Node request cannot be represented as a Web Request.");
+	}
 }
 //#endregion
 //#region src/response.ts
@@ -79,7 +171,12 @@ async function writeNodeResponse(response, target, method) {
 	target.statusCode = response.status;
 	target.statusMessage = response.statusText;
 	writeHeaders(response, target);
-	if (!response.body || method === "HEAD") {
+	if (method === "HEAD") {
+		response.body?.cancel("HEAD responses do not include a body").catch(() => void 0);
+		target.end();
+		return;
+	}
+	if (!response.body) {
 		target.end();
 		return;
 	}
@@ -95,7 +192,7 @@ async function writeNodeResponse(response, target, method) {
 			if (disconnected) return;
 			const part = await reader.read();
 			if (part.done || disconnected) break;
-			if (!target.write(Buffer.from(part.value))) await waitForDrain(target);
+			if (!target.write(part.value)) await waitForDrain(target);
 		}
 		if (!disconnected) target.end();
 	} catch (error) {
@@ -104,20 +201,25 @@ async function writeNodeResponse(response, target, method) {
 		target.destroy(error instanceof Error ? error : void 0);
 	} finally {
 		target.off("close", onClose);
+		reader.releaseLock();
 	}
 }
 //#endregion
 //#region src/handler.ts
 function minimalError(response, error) {
-	if (response.headersSent) {
+	if (response.headersSent || response.destroyed) {
 		response.destroy(error instanceof Error ? error : void 0);
 		return;
 	}
-	const clientError = error instanceof NodeRequestError;
-	response.statusCode = clientError ? 400 : 500;
-	response.statusMessage = clientError ? "Bad Request" : "Internal Server Error";
-	response.setHeader("content-type", "text/plain; charset=utf-8");
-	response.end(clientError ? "Bad Request" : "Internal Server Error");
+	try {
+		const clientError = error instanceof NodeRequestError;
+		response.statusCode = clientError ? 400 : 500;
+		response.statusMessage = clientError ? "Bad Request" : "Internal Server Error";
+		response.setHeader("content-type", "text/plain; charset=utf-8");
+		response.end(clientError ? "Bad Request" : "Internal Server Error");
+	} catch {
+		response.destroy(error instanceof Error ? error : void 0);
+	}
 }
 function attachAbort(request, response, controller) {
 	const abort = () => controller.abort();
@@ -135,68 +237,136 @@ function attachAbort(request, response, controller) {
 		response.off("close", abort);
 	};
 }
-function createNodeHandler(app, options = {}) {
+async function handleNodeRequest(app, preparedOptions, request, response, signal, cleanup, next) {
+	try {
+		const webRequest = requestFromNode(request, preparedOptions, signal);
+		await writeNodeResponse(await app.fetch(webRequest), response, request.method);
+	} catch (error) {
+		if (!next) {
+			minimalError(response, error);
+			return;
+		}
+		try {
+			next(error);
+		} catch (nextError) {
+			minimalError(response, nextError);
+		}
+	} finally {
+		cleanup();
+	}
+}
+function createNodeHandler(app, options) {
+	const preparedOptions = prepareNodeHandlerOptions(options);
 	return (request, response, next) => {
 		const controller = new AbortController();
 		const cleanup = attachAbort(request, response, controller);
-		Promise.resolve().then(() => requestFromNode(request, options, controller.signal)).then((webRequest) => app.fetch(webRequest)).then((webResponse) => writeNodeResponse(webResponse, response, request.method)).catch((error) => next ? next(error) : minimalError(response, error)).finally(cleanup);
+		handleNodeRequest(app, preparedOptions, request, response, controller.signal, cleanup, next);
 	};
 }
 //#endregion
 //#region src/bind.ts
+function isLoopbackHost(host) {
+	if (host.toLowerCase() === "localhost") return true;
+	const family = isIP(host);
+	if (family === 4) return host.split(".", 1)[0] === "127";
+	if (family !== 6) return false;
+	const normalized = new URL(`http://[${host}]`).hostname;
+	return normalized === "[::1]" || normalized.startsWith("[::ffff:7f");
+}
 function resolveBindHost(options) {
 	const host = options.host ?? "127.0.0.1";
-	if (!(host === "localhost" || host === "::1" || /^127(?:\.\d{1,3}){3}$/.test(host)) && options.allowPublicBind !== true) throw new TypeError(`Refusing to bind non-loopback host ${host} without allowPublicBind: true.`);
+	if (!isLoopbackHost(host) && options.allowPublicBind !== true) throw new TypeError(`Refusing to bind non-loopback host ${host} without allowPublicBind: true.`);
 	return host;
 }
+function handlerOptionsForHost(options, host) {
+	return {
+		...options.baseUrl === void 0 ? {} : { baseUrl: options.baseUrl },
+		allowedHosts: [.../* @__PURE__ */ new Set([
+			host,
+			"localhost",
+			...options.allowedHosts ?? []
+		])]
+	};
+}
 function formatHostForUrl(host) {
 	return host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
 }
 //#endregion
+//#region src/server-options.ts
+function timeout(value, name) {
+	if (value === void 0) return void 0;
+	if (!Number.isSafeInteger(value) || value < 0) throw new TypeError(`${name} must be a non-negative safe integer.`);
+	return value;
+}
+function applyServerTimeouts(server, options) {
+	const requestTimeout = timeout(options.requestTimeout, "requestTimeout");
+	const headersTimeout = timeout(options.headersTimeout, "headersTimeout");
+	const keepAliveTimeout = timeout(options.keepAliveTimeout, "keepAliveTimeout");
+	if (requestTimeout !== void 0) server.requestTimeout = requestTimeout;
+	if (headersTimeout !== void 0) server.headersTimeout = headersTimeout;
+	if (keepAliveTimeout !== void 0) server.keepAliveTimeout = keepAliveTimeout;
+}
+//#endregion
 //#region src/websocket.ts
 function subscribe(socket, event, listener) {
 	socket.on(event, listener);
 	return () => socket.off(event, listener);
 }
+function notify(socket, listener, ...values) {
+	try {
+		listener(...values);
+	} catch {
+		if (socket.readyState === WebSocket.OPEN) socket.close(1011, "WebSocket listener failed");
+	}
+}
 function socketLike(socket) {
 	return {
 		send: (data) => socket.send(data),
 		close: (code, reason) => socket.close(code, reason),
 		onMessage: (listener) => subscribe(socket, "message", (data, binary) => {
-			if (!binary) listener(data.toString());
+			if (!binary) notify(socket, listener, data.toString());
 			else {
 				const buffer = Array.isArray(data) ? Buffer.concat(data) : Buffer.from(data);
-				listener(new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength));
+				notify(socket, listener, new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength));
 			}
 		}),
-		onClose: (listener) => subscribe(socket, "close", (code, reason) => listener({
+		onClose: (listener) => subscribe(socket, "close", (code, reason) => notify(socket, listener, {
 			code,
 			reason: reason.toString(),
-			wasClean: code === 1e3
+			wasClean: code !== 1006
 		})),
-		onError: (listener) => subscribe(socket, "error", listener)
+		onError: (listener) => subscribe(socket, "error", (error) => notify(socket, listener, error))
 	};
 }
+function normalizeHttpOrigin(value) {
+	const parsed = new URL(value);
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:" || parsed.username || parsed.password || parsed.pathname !== "/" || parsed.search || parsed.hash) throw new TypeError("WebSocket origins must be HTTP or HTTPS origins.");
+	return parsed.origin;
+}
 async function readRejectionBody(response, maxBytes) {
 	const lengthHeader = response.headers.get("content-length");
 	const declaredLength = lengthHeader === null ? void 0 : Number(lengthHeader);
 	if (declaredLength !== void 0 && Number.isFinite(declaredLength) && declaredLength > maxBytes) {
-		await response.body?.cancel("WebSocket rejection body exceeded maxRejectionBodyBytes");
+		await response.body?.cancel("WebSocket rejection body exceeded maxRejectionBodyBytes").catch(() => void 0);
 		return;
 	}
 	if (!response.body) return Buffer.alloc(0);
 	const reader = response.body.getReader();
 	const chunks = [];
 	let length = 0;
-	while (true) {
-		const part = await reader.read();
-		if (part.done) return Buffer.concat(chunks, length);
-		length += part.value.byteLength;
-		if (length > maxBytes) {
-			await reader.cancel("WebSocket rejection body exceeded maxRejectionBodyBytes");
-			return;
+	try {
+		while (true) {
+			const part = await reader.read();
+			if (part.done) return Buffer.concat(chunks, length);
+			length += part.value.byteLength;
+			if (length > maxBytes) {
+				await reader.cancel("WebSocket rejection body exceeded maxRejectionBodyBytes").catch(() => void 0);
+				return;
+			}
+			chunks.push(Buffer.from(part.value));
 		}
-		chunks.push(Buffer.from(part.value));
+	} finally {
+		reader.releaseLock();
 	}
 }
 async function rejectUpgrade(socket, response, maxBodyBytes) {
@@ -204,31 +374,64 @@ async function rejectUpgrade(socket, response, maxBodyBytes) {
 	if (!buffered) response = new Response("WebSocket rejection body exceeded configured limit", { status: 500 });
 	const body = buffered ?? Buffer.from(await response.arrayBuffer());
 	const lines = [`HTTP/1.1 ${response.status} ${response.statusText || "Rejected"}`];
+	const cookies = response.headers.getSetCookie();
 	response.headers.forEach((value, name) => {
-		if (name !== "content-length" && name !== "transfer-encoding") lines.push(`${name}: ${value}`);
+		if (name !== "connection" && name !== "content-length" && name !== "set-cookie" && name !== "transfer-encoding" && name !== "upgrade") lines.push(`${name}: ${value}`);
 	});
+	for (const cookie of cookies) lines.push(`set-cookie: ${cookie}`);
 	lines.push(`content-length: ${body.byteLength}`);
 	lines.push("connection: close", "", "");
 	socket.end(Buffer.concat([Buffer.from(lines.join("\r\n")), body]));
 }
-function installWebSockets(server, app, options = {}, handlerOptions = {}) {
+function installWebSockets(server, app, options, handlerOptions) {
+	const closeTimeout = options.closeTimeout ?? 5e3;
+	if (!Number.isSafeInteger(closeTimeout) || closeTimeout < 0) throw new TypeError("WebSocket closeTimeout must be a non-negative safe integer.");
 	const maxRejectionBodyBytes = options.maxRejectionBodyBytes ?? 65536;
-	if (!Number.isInteger(maxRejectionBodyBytes) || maxRejectionBodyBytes <= 0) throw new TypeError("WebSocket maxRejectionBodyBytes must be a positive integer.");
+	if (!Number.isSafeInteger(maxRejectionBodyBytes) || maxRejectionBodyBytes <= 0) throw new TypeError("WebSocket maxRejectionBodyBytes must be a positive integer.");
+	const maxPayload = options.maxPayload ?? 1048576;
+	if (!Number.isSafeInteger(maxPayload) || maxPayload < 0) throw new TypeError("WebSocket maxPayload must be a non-negative safe integer.");
+	const preparedHandlerOptions = prepareNodeHandlerOptions(handlerOptions);
+	const configuredAllowedOrigins = options.allowedOrigins?.map((origin) => {
+		try {
+			return normalizeHttpOrigin(origin);
+		} catch {
+			throw new TypeError(`WebSocket allowedOrigins contains an invalid origin: ${origin}`);
+		}
+	});
 	const webSockets = new WebSocketServer({
 		noServer: true,
-		maxPayload: options.maxPayload ?? 1048576,
+		maxPayload,
 		perMessageDeflate: options.perMessageDeflate ?? false
 	});
-	server.on("upgrade", (request, socket, head) => {
+	const pending = /* @__PURE__ */ new Map();
+	let closing;
+	const onUpgrade = (request, socket, head) => {
+		if (closing) {
+			socket.destroy();
+			return;
+		}
 		const controller = new AbortController();
+		const abort = () => controller.abort();
+		const cleanupPending = () => {
+			pending.delete(socket);
+			socket.off("close", abort);
+			socket.off("end", abort);
+			socket.off("error", abort);
+		};
+		pending.set(socket, controller);
+		socket.once("close", abort);
+		socket.once("end", abort);
+		socket.once("error", abort);
 		let accepted;
-		Promise.resolve().then(() => requestFromNode(request, handlerOptions, controller.signal)).then(async (webRequest) => {
+		let upgraded = false;
+		Promise.resolve().then(() => requestFromNode(request, preparedHandlerOptions, controller.signal)).then(async (webRequest) => {
+			if (controller.signal.aborted) return;
 			const originHeader = request.headers.origin;
 			const origin = Array.isArray(originHeader) ? void 0 : originHeader;
-			const allowedOrigins = options.allowedOrigins ?? [new URL(webRequest.url).origin];
+			const allowedOrigins = configuredAllowedOrigins ?? [new URL(webRequest.url).origin];
 			let normalizedOrigin;
 			try {
-				normalizedOrigin = origin ? new URL(origin).origin : void 0;
+				normalizedOrigin = origin ? normalizeHttpOrigin(origin) : void 0;
 			} catch {
 				normalizedOrigin = void 0;
 			}
@@ -251,44 +454,92 @@ function installWebSockets(server, app, options = {}, handlerOptions = {}) {
 				return;
 			}
 			webSockets.handleUpgrade(request, socket, head, (webSocket) => {
+				upgraded = true;
+				cleanupPending();
+				webSocket.on("error", () => void 0);
 				webSocket.once("close", () => controller.abort());
-				Promise.resolve(accepted.handler(socketLike(webSocket), accepted.context)).catch(() => webSocket.close(1011, "WebSocket handler failed"));
+				Promise.resolve().then(() => accepted.handler(socketLike(webSocket), accepted.context)).catch(() => webSocket.close(1011, "WebSocket handler failed"));
 			});
-		}).catch(() => socket.destroy());
-	});
+		}).catch(() => socket.destroy()).finally(() => {
+			if (!upgraded) {
+				cleanupPending();
+				controller.abort();
+			}
+		});
+	};
+	server.on("upgrade", onUpgrade);
 	return { close() {
-		for (const socket of webSockets.clients) socket.close(1001, "Server shutting down");
-		webSockets.close();
+		return closing ??= new Promise((resolve, reject) => {
+			let settled = false;
+			let forceClose;
+			const complete = (error) => {
+				if (settled) return;
+				settled = true;
+				if (forceClose) clearTimeout(forceClose);
+				if (error) reject(error);
+				else resolve();
+			};
+			server.off("upgrade", onUpgrade);
+			for (const [socket, controller] of pending) {
+				controller.abort();
+				socket.destroy();
+			}
+			pending.clear();
+			for (const socket of webSockets.clients) socket.close(1001, "Server shutting down");
+			if (webSockets.clients.size > 0) {
+				forceClose = setTimeout(() => {
+					for (const socket of webSockets.clients) socket.terminate();
+					complete();
+				}, closeTimeout);
+				forceClose.unref();
+			}
+			webSockets.close(complete);
+		});
 	} };
 }
 //#endregion
 //#region src/listen.ts
 function listen(app, options = {}) {
+	options.signal?.throwIfAborted();
 	const host = resolveBindHost(options);
-	const handlerOptions = { allowedHosts: [host, "localhost"] };
+	const handlerOptions = handlerOptionsForHost(options, host);
 	const server = createServer(createNodeHandler(app, handlerOptions));
-	if (options.requestTimeout !== void 0) server.requestTimeout = options.requestTimeout;
-	if (options.headersTimeout !== void 0) server.headersTimeout = options.headersTimeout;
-	if (options.keepAliveTimeout !== void 0) server.keepAliveTimeout = options.keepAliveTimeout;
+	applyServerTimeouts(server, options);
 	const webSockets = options.websocket ? installWebSockets(server, app, options.websocket === true ? {} : options.websocket, handlerOptions) : void 0;
 	if (webSockets) {
 		const nativeClose = server.close.bind(server);
 		server.close = ((callback) => {
-			webSockets.close();
-			return nativeClose(callback);
+			let remaining = 2;
+			let closeError;
+			const complete = (error) => {
+				closeError ??= error;
+				remaining -= 1;
+				if (remaining === 0) callback?.(closeError);
+			};
+			nativeClose(complete);
+			webSockets.close().then(() => complete(), complete);
+			return server;
 		});
 	}
 	const close = () => server.close();
-	options.signal?.addEventListener("abort", close, { once: true });
-	server.once("close", () => options.signal?.removeEventListener("abort", close));
+	const abortListener = options.signal ? addAbortListener(options.signal, close) : void 0;
+	const disposeAbortListener = () => abortListener?.[Symbol.dispose]();
+	server.once("close", disposeAbortListener);
 	return new Promise((resolve, reject) => {
+		const onClose = () => {
+			server.off("error", onError);
+			reject(options.signal?.reason ?? /* @__PURE__ */ new Error("Node server closed before it started listening."));
+		};
 		const onError = (error) => {
-			options.signal?.removeEventListener("abort", close);
+			server.off("close", onClose);
+			disposeAbortListener();
 			reject(error);
 		};
 		server.once("error", onError);
+		server.once("close", onClose);
 		server.listen(options.port ?? 0, host, options.backlog, () => {
 			server.off("error", onError);
+			server.off("close", onClose);
 			resolve(server);
 		});
 	});
@@ -296,7 +547,9 @@ function listen(app, options = {}) {
 //#endregion
 //#region src/serve.ts
 const mimeTypes = {
+	".avif": "image/avif",
 	".css": "text/css; charset=utf-8",
+	".gif": "image/gif",
 	".html": "text/html; charset=utf-8",
 	".ico": "image/x-icon",
 	".jpeg": "image/jpeg",
@@ -304,8 +557,14 @@ const mimeTypes = {
 	".js": "text/javascript; charset=utf-8",
 	".json": "application/json; charset=utf-8",
 	".mjs": "text/javascript; charset=utf-8",
+	".mp4": "video/mp4",
+	".pdf": "application/pdf",
 	".png": "image/png",
 	".svg": "image/svg+xml",
+	".txt": "text/plain; charset=utf-8",
+	".wasm": "application/wasm",
+	".webm": "video/webm",
+	".webmanifest": "application/manifest+json; charset=utf-8",
 	".webp": "image/webp",
 	".woff": "font/woff",
 	".woff2": "font/woff2"
@@ -318,12 +577,15 @@ function isWithinRoot(root, candidate) {
 	return candidate === root || candidate.startsWith(prefix);
 }
 async function serve(app, options = {}) {
+	options.signal?.throwIfAborted();
 	const host = resolveBindHost(options);
 	const root = options.assets ? await realpath(resolve(options.assets.root)) : void 0;
-	const handlerOptions = { allowedHosts: [host, "localhost"] };
+	const handlerOptions = handlerOptionsForHost(options, host);
+	const preparedHandlerOptions = prepareNodeHandlerOptions(handlerOptions);
 	const applicationHandler = createNodeHandler({ async fetch(request, dispatchOptions) {
 		const result = await app.fetch(request, dispatchOptions);
-		if (!result.headers.has("cache-control") && result.headers.get("content-type")?.includes("text/html")) {
+		const contentType = result.headers.get("content-type");
+		if (!result.headers.has("cache-control") && contentType !== null && /^text\/html(?:;|$)/iu.test(contentType)) {
 			const headers = new Headers(result.headers);
 			headers.set("cache-control", "no-cache");
 			return new Response(result.body, {
@@ -335,25 +597,29 @@ async function serve(app, options = {}) {
 		return result;
 	} }, handlerOptions);
 	const server = createServer(async (request, response) => {
+		if (!root) {
+			applicationHandler(request, response);
+			return;
+		}
 		let pathname;
 		try {
-			pathname = decodeURIComponent(resolveNodeRequestUrl(request, handlerOptions).pathname);
+			pathname = decodeURIComponent(resolveNodeRequestUrl(request, preparedHandlerOptions).pathname);
 		} catch {
 			response.writeHead(400, { "content-type": "text/plain; charset=utf-8" }).end("Bad Request");
 			return;
 		}
 		const method = request.method ?? "GET";
-		if (root && (method === "GET" || method === "HEAD") && isAssetPath(pathname)) {
+		if ((method === "GET" || method === "HEAD") && isAssetPath(pathname)) {
 			const extension = extname(pathname).toLowerCase();
 			const unresolvedCandidate = resolve(root, `.${pathname}`);
 			const inside = isWithinRoot(root, unresolvedCandidate);
 			let candidate;
 			let file;
 			if (inside && extension !== ".map") try {
-				const resolvedCandidate = await realpath(unresolvedCandidate);
+				const [resolvedCandidate, candidateFile] = await Promise.all([realpath(unresolvedCandidate), stat(unresolvedCandidate)]);
 				if (isWithinRoot(root, resolvedCandidate)) {
 					candidate = resolvedCandidate;
-					file = await stat(candidate);
+					file = candidateFile;
 				}
 			} catch {
 				candidate = void 0;
@@ -373,47 +639,64 @@ async function serve(app, options = {}) {
 				"x-content-type-options": "nosniff"
 			});
 			if (method === "HEAD") response.end();
-			else createReadStream(candidate).pipe(response);
+			else pipeline(createReadStream(candidate), response, () => void 0);
 			return;
 		}
 		applicationHandler(request, response);
 	});
-	if (options.requestTimeout !== void 0) server.requestTimeout = options.requestTimeout;
-	if (options.headersTimeout !== void 0) server.headersTimeout = options.headersTimeout;
-	if (options.keepAliveTimeout !== void 0) server.keepAliveTimeout = options.keepAliveTimeout;
+	applyServerTimeouts(server, options);
 	const webSockets = options.websocket ? installWebSockets(server, app, options.websocket === true ? {} : options.websocket, handlerOptions) : void 0;
 	let closing;
+	let serverClosed = false;
+	server.once("close", () => {
+		serverClosed = true;
+	});
 	const signals = options.signals === false ? [] : options.signals ?? ["SIGINT", "SIGTERM"];
+	let abortListener;
 	const removeListeners = () => {
-		options.signal?.removeEventListener("abort", shutdown);
+		abortListener?.[Symbol.dispose]();
 		for (const signal of signals) process.removeListener(signal, shutdown);
 	};
-	const close = () => closing ??= new Promise((resolveClose, rejectClose) => {
+	const close = () => closing ??= (async () => {
 		removeListeners();
-		webSockets?.close();
-		const finish = async (serverError) => {
-			try {
-				await app.close?.();
-				if (serverError) rejectClose(serverError);
-				else resolveClose();
-			} catch (error) {
-				rejectClose(error);
+		const closeServer = new Promise((resolveClose, rejectClose) => {
+			if (serverClosed) {
+				resolveClose();
+				return;
 			}
-		};
-		if (!server.listening) finish();
-		else server.close((error) => void finish(error));
-	});
+			server.close((error) => error ? rejectClose(error) : resolveClose());
+		});
+		const errors = (await Promise.allSettled([closeServer, webSockets?.close()])).filter((result) => result.status === "rejected").map((result) => result.reason);
+		try {
+			await app.close?.();
+		} catch (error) {
+			errors.push(error);
+		}
+		if (errors.length === 1) throw errors[0];
+		if (errors.length > 1) throw new AggregateError(errors, "Failed to close served application.");
+	})();
 	const shutdown = () => void close().catch(() => void 0);
-	options.signal?.addEventListener("abort", shutdown, { once: true });
+	if (options.signal) abortListener = addAbortListener(options.signal, shutdown);
 	for (const signal of signals) process.once(signal, shutdown);
 	await new Promise((resolveListen, rejectListen) => {
-		server.once("error", rejectListen);
+		const onError = (error) => {
+			server.off("close", onClose);
+			rejectListen(error);
+		};
+		const onClose = () => {
+			server.off("error", onError);
+			rejectListen(options.signal?.reason ?? /* @__PURE__ */ new Error("Node server closed before it started listening."));
+		};
+		server.once("error", onError);
+		server.once("close", onClose);
 		server.listen(options.port ?? 0, host, options.backlog, () => {
-			server.removeListener("error", rejectListen);
+			server.off("error", onError);
+			server.off("close", onClose);
 			resolveListen();
 		});
-	}).catch((error) => {
+	}).catch(async (error) => {
 		removeListeners();
+		await close().catch(() => void 0);
 		throw error;
 	});
 	const address = server.address();

package/dist/mcp.js

@@ -1,3 +1,5 @@
+import { addAbortListener } from "node:events";
+import { randomUUID } from "node:crypto";
 //#region src/mcp.ts
 const anonymous = Object.freeze({
 	authenticated: false,
@@ -10,7 +12,7 @@ function connectMcpStdio(mcp, options) {
 	const output = options.output ?? process.stdout;
 	const diagnostics = options.diagnostics ?? process.stderr;
 	const controllers = /* @__PURE__ */ new Map();
-	const sessionId = crypto.randomUUID();
+	const sessionId = randomUUID();
 	let finish;
 	const closed = new Promise((resolve) => {
 		finish = resolve;
@@ -18,31 +20,73 @@ function connectMcpStdio(mcp, options) {
 	let ended = false;
 	const maxLineBytes = options.maxLineBytes ?? 1048576;
 	const maxConcurrency = options.maxConcurrency ?? 16;
-	if (!Number.isInteger(maxLineBytes) || maxLineBytes <= 0) throw new TypeError("MCP maxLineBytes must be a positive integer.");
-	if (!Number.isInteger(maxConcurrency) || maxConcurrency <= 0) throw new TypeError("MCP maxConcurrency must be a positive integer.");
+	if (!Number.isSafeInteger(maxLineBytes) || maxLineBytes <= 0) throw new TypeError("MCP maxLineBytes must be a positive integer.");
+	if (!Number.isSafeInteger(maxConcurrency) || maxConcurrency <= 0) throw new TypeError("MCP maxConcurrency must be a positive integer.");
 	let active = 0;
-	let cleanupInput = () => void 0;
-	const write = (message) => new Promise((resolve, reject) => {
-		output.write(`${JSON.stringify(message)}\n`, (error) => error ? reject(error) : resolve());
-	});
+	let abortListener;
+	let cleanupTransport = () => void 0;
+	const report = (error) => {
+		try {
+			diagnostics.write(`MCP stdio error: ${error instanceof Error ? error.message : String(error)}\n`);
+		} catch {}
+	};
+	const write = (message) => {
+		if (ended) return Promise.reject(/* @__PURE__ */ new Error("MCP stdio connection is closed."));
+		return new Promise((resolve, reject) => {
+			output.write(`${JSON.stringify(message)}\n`, (error) => error ? reject(error) : resolve());
+		});
+	};
 	const close = async () => {
 		if (ended) return closed;
 		ended = true;
-		cleanupInput();
-		for (const controller of controllers.values()) controller.abort();
+		cleanupTransport();
+		abortListener?.[Symbol.dispose]();
+		for (const values of controllers.values()) for (const controller of values) controller.abort();
 		controllers.clear();
-		mcp.terminateSession(sessionId);
-		finish();
+		try {
+			mcp.terminateSession(sessionId);
+		} catch (error) {
+			report(error);
+		} finally {
+			finish();
+		}
 		return closed;
 	};
-	options.signal?.addEventListener("abort", () => void close(), { once: true });
+	if (options.signal) abortListener = addAbortListener(options.signal, () => void close());
+	const writeProtocolError = (code, message) => write({
+		jsonrpc: "2.0",
+		id: null,
+		error: {
+			code,
+			message
+		}
+	});
 	const handleLine = (line) => {
+		if (ended) return;
+		let message;
+		try {
+			message = JSON.parse(line);
+		} catch {
+			writeProtocolError(-32700, "Parse error").catch(() => void close());
+			return;
+		}
+		if (!message || typeof message !== "object" || Array.isArray(message)) {
+			writeProtocolError(-32600, "Invalid Request").catch(() => void close());
+			return;
+		}
+		const value = message;
+		if (value.method === "notifications/cancelled" && value.params && typeof value.params === "object") {
+			const requestId = value.params.requestId;
+			if (typeof requestId === "string" || typeof requestId === "number") for (const controller of controllers.get(requestId) ?? []) controller.abort();
+			return;
+		}
+		const id = value.id;
 		if (active >= maxConcurrency) {
-			write({
+			if (typeof id === "string" || typeof id === "number") write({
 				jsonrpc: "2.0",
-				id: null,
+				id,
 				error: {
-					code: -32600,
+					code: -32e3,
 					message: "Too many concurrent requests"
 				}
 			}).catch(() => void close());
@@ -50,51 +94,52 @@ function connectMcpStdio(mcp, options) {
 		}
 		active += 1;
 		(async () => {
-			let message;
+			const controller = typeof id === "string" || typeof id === "number" ? new AbortController() : void 0;
+			if (controller && (typeof id === "string" || typeof id === "number")) {
+				const values = controllers.get(id) ?? /* @__PURE__ */ new Set();
+				values.add(controller);
+				controllers.set(id, values);
+			}
 			try {
-				message = JSON.parse(line);
-			} catch {
-				await write({
-					jsonrpc: "2.0",
-					id: null,
-					error: {
-						code: -32700,
-						message: "Parse error"
-					}
+				const environment = options.environment ?? process.env;
+				const auth = typeof options.auth === "function" ? await options.auth(environment) : options.auth ?? anonymous;
+				const result = await mcp.handle(message, {
+					dependencies: options.dependencies,
+					auth,
+					transport: "stdio",
+					sessionId,
+					supportsPush: true,
+					signal: controller?.signal ?? options.signal,
+					send: write
 				});
-				return;
-			}
-			if (message && typeof message === "object") {
-				const value = message;
-				if (value.method === "notifications/cancelled" && value.params && typeof value.params === "object") {
-					const requestId = value.params.requestId;
-					if (typeof requestId === "string" || typeof requestId === "number") controllers.get(requestId)?.abort();
-				}
-				const id = value.id;
-				const controller = typeof id === "string" || typeof id === "number" ? new AbortController() : void 0;
-				if (controller && (typeof id === "string" || typeof id === "number")) controllers.set(id, controller);
-				try {
-					const environment = options.environment ?? process.env;
-					const auth = typeof options.auth === "function" ? await options.auth(environment) : options.auth ?? anonymous;
-					const result = await mcp.handle(message, {
-						dependencies: options.dependencies,
-						auth,
-						transport: "stdio",
-						sessionId,
-						supportsPush: true,
-						signal: controller?.signal ?? options.signal,
-						send: write
+				if (result !== void 0 && !ended) await write(result);
+			} catch (error) {
+				if (!ended) {
+					report(error);
+					if (typeof id === "string" || typeof id === "number") await write({
+						jsonrpc: "2.0",
+						id,
+						error: {
+							code: -32603,
+							message: "Internal error"
+						}
 					});
-					if (result !== void 0) await write(result);
-				} finally {
-					if (controller && id !== void 0) controllers.delete(id);
+				}
+			} finally {
+				if (controller && (typeof id === "string" || typeof id === "number")) {
+					const values = controllers.get(id);
+					values?.delete(controller);
+					if (values?.size === 0) controllers.delete(id);
 				}
 			}
-		})().catch((error) => diagnostics.write(`MCP stdio error: ${error instanceof Error ? error.message : String(error)}\n`)).finally(() => {
+		})().catch((error) => {
+			if (!ended) report(error);
+		}).finally(() => {
 			active -= 1;
 		});
 	};
 	const lineBuffer = Buffer.allocUnsafe(maxLineBytes);
+	const decoder = new TextDecoder("utf-8", { fatal: true });
 	let lineBytes = 0;
 	let discardingOversizedLine = false;
 	const rejectOversizedLine = () => {
@@ -108,6 +153,7 @@ function connectMcpStdio(mcp, options) {
 		}).catch(() => void close());
 	};
 	const onData = (chunk) => {
+		if (ended) return;
 		const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 		let offset = 0;
 		while (offset < bytes.byteLength) {
@@ -127,29 +173,39 @@ function connectMcpStdio(mcp, options) {
 			if (newline < 0) break;
 			if (!discardingOversizedLine) {
 				const length = lineBytes > 0 && lineBuffer[lineBytes - 1] === 13 ? lineBytes - 1 : lineBytes;
-				handleLine(lineBuffer.subarray(0, length).toString("utf8"));
+				try {
+					handleLine(decoder.decode(lineBuffer.subarray(0, length)));
+				} catch {
+					writeProtocolError(-32700, "Parse error").catch(() => void close());
+				}
 			}
 			lineBytes = 0;
 			discardingOversizedLine = false;
 			offset = newline + 1;
 		}
 	};
-	const finishInput = () => {
-		if (!ended) {
-			if (!discardingOversizedLine && lineBytes > 0) handleLine(lineBuffer.subarray(0, lineBytes).toString("utf8"));
-			ended = true;
-			cleanupInput();
-			finish();
-		}
+	const finishInput = () => void close();
+	const inputError = (error) => {
+		report(error);
+		close();
+	};
+	const outputError = (error) => {
+		report(error);
+		close();
 	};
 	input.on("data", onData);
 	input.once("end", finishInput);
 	input.once("close", finishInput);
-	cleanupInput = () => {
+	input.once("error", inputError);
+	output.once("error", outputError);
+	cleanupTransport = () => {
 		input.off("data", onData);
 		input.off("end", finishInput);
 		input.off("close", finishInput);
+		input.off("error", inputError);
+		output.off("error", outputError);
 	};
+	if (input.readableEnded || input.destroyed || output.destroyed) close();
 	return {
 		closed,
 		close

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@askrjs/node",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "description": "Node http adapter for @askrjs/server",
   "keywords": [
     "askr",
@@ -43,10 +43,12 @@
     "access": "public"
   },
   "scripts": {
+    "bench": "vitest bench --run",
+    "bench:http": "vitest bench --run benches/http.bench.ts",
     "build": "vp pack",
     "fmt": "vp fmt .",
     "lint": "vp lint .",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json --noEmit",
     "test": "vp test run",
     "test:publint": "publint",
     "pack:check": "node tests/package-artifacts.js",
@@ -55,20 +57,21 @@
     "prepublishOnly": "npm run check"
   },
   "dependencies": {
-    "@askrjs/auth": ">=0.0.1 <0.1.0",
-    "@askrjs/server": ">=0.0.5 <0.1.0",
-    "ws": "^8.21.1"
+    "@askrjs/auth": ">=0.0.8 <0.1.0",
+    "@askrjs/server": ">=0.0.11 <0.1.0",
+    "@types/ws": "^8.18.1",
+    "ws": "^8.21.3"
   },
   "devDependencies": {
-    "@askrjs/schema": ">=0.0.2 <0.1.0",
-    "@types/node": "^26.0.0",
-    "@types/ws": "^8.18.1",
-    "publint": "^0.3.21",
-    "typescript": "^6.0.0",
-    "vite-plus": "^0.2.4",
-    "vitest": "^4.0.0"
+    "@askrjs/schema": ">=0.0.5 <0.1.0",
+    "@types/node": "^26.2.0",
+    "publint": "^0.3.23",
+    "typescript": "^7.0.2",
+    "vite-plus": "^0.2.8",
+    "vitest": "^4.1.10"
   },
   "engines": {
-    "node": ">=18"
-  }
+    "node": ">=24.0.0"
+  },
+  "packageManager": "npm@12.0.1"
 }