@daloyjs/core 0.32.0 → 0.34.0

package/dist/app.js

@@ -2,7 +2,7 @@ import { Router } from "./router.js";
 import { WebSocketRegistry, normalizeWebSocketOptions, } from "./websocket.js";
 import { BadRequestError, ForbiddenError, HttpError, InternalError, MethodNotAllowedError, NotFoundError, PayloadTooLargeError, RequestTimeoutError, TooManyRequestsError, UnsupportedMediaTypeError, ValidationError, } from "./errors.js";
 import { validate } from "./schema.js";
-import { readBodyLimited, safeJsonParse, randomId, assertNoDuplicateSingletonHeaders, assertStrongSecret, timingSafeEqual } from "./security.js";
+import { readBodyLimited, safeJsonParse, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertStrongSecret, timingSafeEqual, isForbiddenObjectKey } from "./security.js";
 import { createLogger, noopLogger } from "./logger.js";
 import { generateOpenAPI, openapiToYAML, } from "./openapi.js";
 import { docsContentSecurityPolicy, scalarHtml, swaggerUiHtml, } from "./docs.js";
@@ -30,8 +30,8 @@ export function _resetCrashHandlersForTests() {
     activeCrashLogger = undefined;
 }
 /**
- * Wave 8 — once-per-process latch for the `secureDefaults: false` warning
- * log. Multiple `new App({ secureDefaults: false })` instances in the same
+ * Once-per-process latch for the `secureDefaults: false` warning log.
+ * Multiple `new App({ secureDefaults: false })` instances in the same
  * process share one log entry instead of flooding the access log with
  * duplicate warnings on every construction.
  */
@@ -41,9 +41,9 @@ export function _resetInsecureDefaultsLogForTests() {
     insecureDefaultsLoggedThisProcess = false;
 }
 /**
- * Wave 8 — list of secure-by-default surfaces disabled when
- * `secureDefaults: false` is set. Surfaced through the once-per-process
- * `error` log so the operator sees exactly which guards are off.
+ * List of secure-by-default surfaces disabled when `secureDefaults: false`
+ * is set. Surfaced through the once-per-process `error` log so the operator
+ * sees exactly which guards are off.
  */
 const DISABLED_BY_INSECURE_DEFAULTS = Object.freeze([
     "secureHeaders auto-install",
@@ -56,7 +56,7 @@ const DISABLED_BY_INSECURE_DEFAULTS = Object.freeze([
     "anonymous stateful plugin refuse-to-boot",
 ]);
 /**
- * Wave 12 item 11: the exact RFC 7231 + RFC 5789 HTTP-method allowlist.
+ * The exact RFC 7231 + RFC 5789 HTTP-method allowlist.
  * The framework refuses any other method at route-registration time so
  * `TRACE`, `CONNECT`, and WebDAV verbs (`MKCOL`, `COPY`, `PROPFIND`,
  * `MOVE`, etc.) cannot bypass the strict Content-Type / body-on-GET /
@@ -147,7 +147,7 @@ export class App {
     installedPlugins = new Set();
     closeHooks = [];
     closeHooksRun = false;
-    /** Wave 4 idle-connection close hooks (adapter-registered, sync). */
+    /** Idle-connection close hooks (adapter-registered, sync). */
     idleConnectionCloseHooks = [];
     pluginInstalledListeners = [];
     shutdownListeners = [];
@@ -168,13 +168,13 @@ export class App {
      */
     corsOriginAllows = [];
     /**
-     * Whether the Wave 3 once-only boot guard has run (session + CSRF +
-     * state-changing-route check). The check is deferred to first request
+     * Whether the once-only session + CSRF + state-changing-route boot
+     * guard has run. The check is deferred to first request
      * because route registration and `app.use(csrf(...))` can happen in any
      * order after construction; doing it on first `fetch()` is the latest
      * point we still get a 500 before any handler ever runs.
      */
-    wave3BootGuard = { checked: false };
+    bootGuard = { checked: false };
     /**
      * Latched marker stamped after the framework has reported the first
      * unconfigured-proxy request. Logged once at `warn` level so production
@@ -206,7 +206,7 @@ export class App {
         this.maybeMountDocs();
     }
     /**
-     * Wave 4 leftover: validate {@link AppOptions.disconnectStatusCode}.
+     * Validate {@link AppOptions.disconnectStatusCode}.
      * Refuses anything outside `[400, 499]` (except `0`, which disables the
      * rewrite). Throws at construction time so the misconfiguration cannot
      * survive past boot.
@@ -220,7 +220,7 @@ export class App {
         }
     }
     /**
-     * Wave 8 — master-flag escape-hatch enforcement. When
+     * Master-flag escape-hatch enforcement. When
      * `secureDefaults: false` is set, the framework:
      *  - refuses-to-construct in production unless
      *    `acknowledgeInsecureDefaults: true` is also set; closes the
@@ -236,7 +236,7 @@ export class App {
         const inProduction = this.isProduction();
         if (inProduction && this.options.acknowledgeInsecureDefaults !== true) {
             throw new Error("app({ secureDefaults: false }) is refused in production. " +
-                "secureDefaults turns off the entire Wave 1–7 secure-by-default " +
+                "secureDefaults turns off the entire secure-by-default " +
                 "surface (auto secureHeaders, cross-origin guard, crash-on-unhandled-rejection, " +
                 "trustProxy guard, csrf/session boot guard, weak-secret refuse-to-boot, " +
                 "cors({ origin: '*' }) refuse-to-boot, anonymous-stateful-plugin refuse-to-boot). " +
@@ -256,7 +256,7 @@ export class App {
         }
     }
     /**
-     * Install the Wave 2 secure-by-default global hooks. Currently:
+     * Install the secure-by-default global hooks. Currently:
      *  - {@link secureHeaders} as a group-level hook so every response carries
      *    the hardened baseline (HSTS, X-Frame-Options, nosniff, default CSP).
      *
@@ -278,7 +278,7 @@ export class App {
             auto[AUTO_SECURE_HEADERS_MARKER] = true;
             this.groupHooks.push(auto);
         }
-        // Wave 4 leftover: opt-in load-shedding pressure monitor.
+        // Opt-in load-shedding pressure monitor.
         if (this.options.loadShedding) {
             const lsOpts = typeof this.options.loadShedding === "object"
                 ? this.options.loadShedding
@@ -287,7 +287,7 @@ export class App {
         }
     }
     /**
-     * Wave 4 crash-on-unrecoverable-error guard. Installs Node-process-level
+     * Crash-on-unrecoverable-error guard. Installs Node-process-level
      * listeners for `unhandledRejection` and `uncaughtException` that log
      * through the pluggable logger and call `process.exit(1)`. Idempotent via
      * a module-level latch so multiple `new App()` instantiations in the same
@@ -363,7 +363,7 @@ export class App {
             process.env.NODE_ENV === "production");
     }
     /**
-     * Wave 2 cross-origin guard. Rejects state-changing requests (`POST` /
+     * Cross-origin guard. Rejects state-changing requests (`POST` /
      * `PUT` / `PATCH` / `DELETE`) that carry an `Origin` header pointing at a
      * different origin than the request URL when no {@link cors} hook is
      * registered (neither at the app level nor on the matched route). Throws
@@ -408,7 +408,7 @@ export class App {
             `app({ corsCrossOriginGuard: false }) / app({ secureDefaults: false }) to disable this guard.`);
     }
     /**
-     * Wave 3 sync boot guard. Inspects a hook layer being installed via
+     * Sync boot guard. Inspects a hook layer being installed via
      * {@link App.use} and refuses-to-boot when:
      *
      *  - `cors({ origin: "*" })` is registered while resolved environment is
@@ -451,12 +451,12 @@ export class App {
             `but security scheme "${auth.scheme}" requires payload authentication. ` +
             `Remove the route-level opt-out or use a scheme without requirePayloadAuth: true.`);
     }
-    resetWave3BootGuardCache() {
-        this.wave3BootGuard.checked = false;
-        this.wave3BootGuard.error = undefined;
+    resetBootGuardCache() {
+        this.bootGuard.checked = false;
+        this.bootGuard.error = undefined;
     }
     /**
-     * Wave 3 first-request boot guard. Verifies that the assembled hook
+     * First-request boot guard. Verifies that the assembled hook
      * chain + route table is internally consistent before any user handler
      * runs. Currently checks: when `session()` is installed and any route
      * accepts a state-changing method (`POST` / `PUT` / `PATCH` / `DELETE`),
@@ -466,13 +466,13 @@ export class App {
      * `app({ secureDefaults: false })`. Runs once per App between registration
      * changes; the result is cached so the fast path is a single boolean check.
      */
-    assertWave3BootGuards() {
-        if (this.wave3BootGuard.checked) {
-            if (this.wave3BootGuard.error)
-                throw this.wave3BootGuard.error;
+    assertBootGuards() {
+        if (this.bootGuard.checked) {
+            if (this.bootGuard.error)
+                throw this.bootGuard.error;
             return;
         }
-        this.wave3BootGuard.checked = true;
+        this.bootGuard.checked = true;
         if (this.options.secureDefaults === false)
             return;
         if (this.options.csrf === "off")
@@ -489,11 +489,11 @@ export class App {
             `(${stateChanging.method} ${stateChanging.path}) but no csrf() hook is installed. ` +
             `Register csrf() via app.use(csrf({ strategy: "fetch-metadata", allowedOrigins: [...] })), ` +
             `or pass app({ csrf: "off" }) to acknowledge that this app is not browser-facing.`);
-        this.wave3BootGuard.error = err;
+        this.bootGuard.error = err;
         throw err;
     }
     /**
-     * Wave 3 per-request guard for spoofed proxy headers. When the App was
+     * Per-request guard for spoofed proxy headers. When the App was
      * constructed without an explicit {@link AppOptions.trustProxy} value
      * and a request arrives carrying an `X-Forwarded-*` header, refuse to
      * dispatch it: the rate limiter, audit log, and request-id propagation
@@ -507,7 +507,7 @@ export class App {
             return;
         if (this.options.trustProxy !== undefined)
             return;
-        // Wave 6: `behindProxy` is the declarative successor — when supplied,
+        // `behindProxy` is the declarative successor — when supplied,
         // the framework already knows how to interpret forwarded headers and
         // the legacy unconfigured-proxy guard is satisfied.
         if (this.options.behindProxy !== undefined)
@@ -701,7 +701,7 @@ export class App {
      * @returns This `App` instance for chaining.
      */
     route(def) {
-        // Wave 12 item 11: refuse non-canonical HTTP methods at runtime.
+        // Refuse non-canonical HTTP methods at runtime.
         // The TypeScript `HttpMethod` union already constrains the public
         // surface, but an unsafe cast (or a runtime caller in plain JS)
         // could bypass it. Closes the "framework silently routes WebDAV /
@@ -739,7 +739,7 @@ export class App {
             path: merged.path,
             ...securityMarkers,
         });
-        this.resetWave3BootGuardCache();
+        this.resetBootGuardCache();
         return this;
     }
     /**
@@ -757,7 +757,7 @@ export class App {
             production,
             secureDefaults,
         });
-        // Wave 11 — pre-upgrade authentication boundary. In production under
+        // Pre-upgrade authentication boundary. In production under
         // secureDefaults, a WebSocket route must either make an explicit
         // pre-upgrade decision (`beforeUpgrade`) or acknowledge that the route is
         // intentionally public. This prevents accidental auth in `open()` after
@@ -771,7 +771,25 @@ export class App {
                 "beforeUpgrade hook for authenticated routes, or pass " +
                 "{ acknowledgeUnauthenticated: true } for an intentionally public route.");
         }
-        // Wave 11 — WebSocket post-upgrade header immutability. Once the RFC
+        // Cross-Site WebSocket Hijacking (CSWSH) guard. Storybook's
+        // CVE-2026-27148 — and the Cross-Site WebSocket Hijacking class of bug
+        // in general — exploits the fact that browsers attach cookies on a WS
+        // upgrade no matter which origin opened the connection. A
+        // `beforeUpgrade` hook that only checks cookies/JWTs still accepts the
+        // attacker's handshake. Refuse-at-registration unless the route either
+        // sets an Origin allowlist or explicitly acknowledges the exposure.
+        if (production &&
+            secureDefaults &&
+            handler.allowedOrigins === undefined &&
+            handler.acknowledgeCrossOriginUpgrade !== true) {
+            throw new Error(`app.ws(${JSON.stringify(fullPath)}): production WebSocket routes must ` +
+                "guard against Cross-Site WebSocket Hijacking (CSWSH). Set " +
+                "{ allowedOrigins: \"same-origin\" } or an explicit origin allowlist, " +
+                "or pass { acknowledgeCrossOriginUpgrade: true } for an intentionally " +
+                "public route. See https://daloyjs.dev/docs/websocket " +
+                "and CVE-2026-27148 (Storybook) for the attack pattern.");
+        }
+        // WebSocket post-upgrade header immutability. Once the RFC
         // 6455 101 handshake has been sent, no further response headers can be
         // added by middleware; mounting header-mutating middleware on a path
         // that also matches a WS route is a documented misconfiguration in
@@ -801,7 +819,7 @@ export class App {
      * container orchestrator `livenessProbe` configuration — a failing
      * liveness probe restarts the container.
      *
-     * Defaults (Wave 4 secure-by-default):
+     * Defaults (secure-by-default):
      *  - path: `/healthz`
      *  - rate-limit: 60 req/min per remote IP, in-memory (per-process)
      *  - auth: opt-in via `token`. In production with `secureDefaults: true`,
@@ -860,7 +878,7 @@ export class App {
             ? null
             : { limit: 60, windowMs: 60_000, ...(opts.rateLimit ?? {}) };
         const token = opts.token;
-        // Wave 4 refuse-to-boot: unauthenticated health/ready probes in
+        // Refuse-to-boot: unauthenticated health/ready probes in
         // production are a documented info-disclosure surface (process uptime,
         // plugin-ready transitions, internal hostnames in some shops). Force
         // an explicit acknowledgement.
@@ -923,7 +941,7 @@ export class App {
         });
     }
     /**
-     * Wave 4 leftover: register a built-in receiver for CSP / Reporting API
+     * Register a built-in receiver for CSP / Reporting API
      * violation reports. Accepts `application/csp-report` and
      * `application/reports+json` payloads, rate-limits per IP (defaults: 60
      * req/min), caps body size (default 8 KiB), and forwards parsed reports
@@ -939,7 +957,7 @@ export class App {
     cspReportRoute(opts = {}) {
         const path = (opts.path ?? "/__csp-report");
         const maxBytes = opts.maxBodyBytes ?? 8192;
-        // Wave 11 — refuse a configured cap above 64 KiB so a misconfigured
+        // Refuse a configured cap above 64 KiB so a misconfigured
         // policy cannot turn the receiver into a DoS-via-report-flood amplifier.
         const HARD_MAX = 65536;
         if (!Number.isInteger(maxBytes) || maxBytes <= 0 || maxBytes > HARD_MAX) {
@@ -952,7 +970,7 @@ export class App {
             ? new Map()
             : null;
         const log = this.log;
-        // Wave 11 — only log report bodies when explicitly enabled. In
+        // Only log report bodies when explicitly enabled. In
         // production this is opt-in; in development the body is included by
         // default so violations are debuggable.
         const includeReportBody = opts.logCspReportBodies ?? !this.isProduction();
@@ -1064,7 +1082,7 @@ export class App {
         child.routes = this.routes;
         child.webSocketRoutes = this.webSocketRoutes;
         child.routeSecurityMarkers = this.routeSecurityMarkers;
-        child.wave3BootGuard = this.wave3BootGuard;
+        child.bootGuard = this.bootGuard;
         child.log = this.log;
         child.prefix = joinPath(this.prefix, prefix);
         child.groupHooks = [
@@ -1103,13 +1121,13 @@ export class App {
      * @returns This `App` instance for chaining.
      */
     use(hooks) {
-        // Wave 3 boot guards: refuse to start when the new hook layer is a
+        // Boot guards: refuse to start when the new hook layer is a
         // known-misconfigured security primitive in production. These checks
         // run synchronously at registration time so the developer sees the
         // failure during boot, not on first request.
         this.assertSecureHookConfig(hooks);
         // If the developer installs their own secureHeaders(), drop the
-        // Wave 2 auto-installed instance so the user's overrides win instead of
+        // auto-installed instance so the user's overrides win instead of
         // being shadowed (the auto one runs first and the per-header
         // "set only if absent" semantics mean the second installation would be
         // a silent no-op).
@@ -1123,7 +1141,7 @@ export class App {
         if (hooks[CORS_HOOK_MARKER] === true) {
             this.corsOriginAllows = corsOriginAllowsFromHooks(this.groupHooks);
         }
-        this.resetWave3BootGuardCache();
+        this.resetBootGuardCache();
         return this;
     }
     /**
@@ -1151,7 +1169,7 @@ export class App {
      * @returns This `App` instance for chaining.
      */
     /**
-     * Apply an ordered list of plugin extensions (Wave 6 item 10) to the
+     * Apply an ordered list of plugin extensions to the
      * group-level hook chain. Each extension's `handler` is wrapped into a
      * single-event {@link Hooks} bundle so subsequent route registrations
      * pick it up via the normal hook composition path.
@@ -1166,7 +1184,7 @@ export class App {
     decorate(key, value, opts = {}) {
         if (Object.prototype.hasOwnProperty.call(this.decorations, key) &&
             opts.override !== true) {
-            // Wave 6 item 9: namespace-protected decorators. Refuse to silently
+            // Namespace-protected decorators. Refuse to silently
             // shadow an existing decoration; emit a once-per-process warn naming
             // both decorators on the explicit-override path.
             throw new Error(`decorate(): key "${key}" is already decorated. ` +
@@ -1216,22 +1234,22 @@ export class App {
     /**
      * Encapsulated plugin registration (Fastify-style). Receives a child App;
      * routes/hooks declared on the child are scoped to the plugin by default
-     * (Wave 6 item 15 \u2014 encapsulation default `local`).
+     * (encapsulation default `local`).
      *
-     * Wave 6 (`0.24.0`) additions on the plugin descriptor object:
+     * Plugin descriptor object fields (since `0.24.0`):
      *
      * - `dependencies: string[]` \u2014 prerequisite plugin names; the framework
      *   refuses-to-boot at registration time when any declared dependency has
-     *   not been installed first (item 8).
+     *   not been installed first.
      * - `seed: string` \u2014 differentiator for parameterized instances of the
-     *   same plugin (item 16). Dedup key becomes `${name}#${seed}`.
+     *   same plugin. Dedup key becomes `${name}#${seed}`.
      * - `stateful: boolean` \u2014 when `true` AND `name` is absent AND the app is
      *   in production with `secureDefaults` on, registration refuses-to-boot
      *   so silent double-installs of global-state-mutating plugins are caught
-     *   loud (item 16).
+     *   loud.
      * - `extensions: [{ event, handler, before?, after? }]` \u2014 declarative
-     *   lifecycle-hook ordering with topological-sort + cycle detection
-     *   (item 10). Refuses-at-registration on cycles.
+     *   lifecycle-hook ordering with topological-sort + cycle detection.
+     *   Refuses-at-registration on cycles.
      */
     register(plugin, config = {}) {
         const fn = typeof plugin === "function" ? plugin : (plugin.register ?? (() => { }));
@@ -1258,7 +1276,7 @@ export class App {
             this.installedPlugins.add(dedupKey);
         }
         if (descriptor?.extensions && descriptor.extensions.length > 0) {
-            // Wave 6 item 10: topological sort with cycle detection.
+            // Topological sort with cycle detection.
             const ordered = topoSortExtensions(descriptor.extensions);
             this.applyExtensions(ordered);
         }
@@ -1363,7 +1381,7 @@ export class App {
         const response = await this.dispatch(request);
         // In-flight responses that finish during draining advertise
         // `Connection: close` so HTTP/1.1 load balancers stop re-using the
-        // socket for new requests. Wave 4 connection-draining.
+        // socket for new requests (connection-draining).
         if (this.draining && !response.headers.has("connection")) {
             response.headers.set("connection", "close");
         }
@@ -1394,7 +1412,7 @@ export class App {
                     "retry-after": "5",
                     // Tell HTTP/1.1 load balancers to close the keep-alive socket
                     // immediately so the next request lands on a healthy instance
-                    // rather than coming back to a dying one. Wave 4.
+                    // rather than coming back to a dying one.
                     connection: "close",
                 },
             });
@@ -1414,8 +1432,9 @@ export class App {
         let activeSendHook = globalHooks.onSend;
         try {
             assertNoDuplicateSingletonHeaders(request.headers);
+            assertNoReservedInternalHeaders(request.headers);
             this.assertTrustProxyConfigured(request);
-            this.assertWave3BootGuards();
+            this.assertBootGuards();
             await globalHooks.onRequest?.(request);
             const url = new URL(request.url);
             const method = request.method;
@@ -1534,7 +1553,7 @@ export class App {
                     onResponse: activeResponseHook,
                 }, stripFingerprint);
             }
-            // Wave 4 leftover: when the client has already disconnected, classify
+            // When the client has already disconnected, classify
             // the request at `disconnectStatusCode` (default 499) instead of
             // letting an AbortError bubble up as a generic 5xx. Logged at `info`
             // so disconnect storms do not look like service incidents.
@@ -1669,7 +1688,7 @@ export class App {
                 }
             }
         }
-        // Wave 4: kill idle keep-alive connections immediately so they cannot
+        // Kill idle keep-alive connections immediately so they cannot
         // be re-used for a new request that would race with the drain. Adapters
         // (Node) register a hook here. In-flight requests are unaffected.
         for (const hook of this.idleConnectionCloseHooks) {
@@ -1752,7 +1771,7 @@ function corsOriginAllowsFromHooks(layers) {
     return allows;
 }
 /**
- * Wave 11 — detect header-mutating middleware on a WebSocket route's
+ * Detect header-mutating middleware on a WebSocket route's
  * effective hook stack. Returns a list of human-readable names for any
  * middleware that would otherwise lose its headers to the post-upgrade
  * RFC 6455 frame stream.
@@ -1778,7 +1797,7 @@ function detectHeaderMutatingMiddleware(layers) {
     return Array.from(new Set(found));
 }
 /**
- * Topological sort of plugin extensions (Wave 6 item 10). Refuses-at-call
+ * Topological sort of plugin extensions. Refuses-at-call
  * on cyclic ordering with a structured error naming the cycle.
  * @internal
  */
@@ -1831,7 +1850,7 @@ export function topoSortExtensions(exts) {
         const remaining = Array.from(byName.keys()).filter((n) => !out.some((e) => e.name === n));
         throw new Error(`Plugin extension cycle detected among: ${remaining.map((n) => JSON.stringify(n)).join(", ")}.`);
     }
-    // Wave 11 — refuse pairs of extensions that mutate the same response
+    // Refuse pairs of extensions that mutate the same response
     // header without declaring a before/after ordering relative to each
     // other. The resulting header value would otherwise depend on plugin
     // registration order.
@@ -2055,6 +2074,12 @@ function headersToObject(h) {
 function queryToObject(s) {
     const o = {};
     for (const key of new Set(s.keys())) {
+        // Spring4Shell-style defense: never bind attacker-controlled keys named
+        // __proto__ / constructor / prototype as own properties on the parsed
+        // query object — they would survive downstream `{...query}` spreads and
+        // shallow merges. See isForbiddenObjectKey in src/security.ts.
+        if (isForbiddenObjectKey(key))
+            continue;
         const all = s.getAll(key);
         o[key] = all.length > 1 ? all : all[0];
     }
@@ -2077,7 +2102,16 @@ async function readBody(req, ct, limit, multipart) {
     }
     if (ct.includes("application/x-www-form-urlencoded")) {
         const bytes = await readBodyLimited(req, limit);
-        return Object.fromEntries(new URLSearchParams(new TextDecoder().decode(bytes)));
+        const params = new URLSearchParams(new TextDecoder().decode(bytes));
+        // Same Spring4Shell-class defense as queryToObject: Object.fromEntries
+        // would set __proto__ / constructor / prototype as own properties.
+        const out = {};
+        for (const [k, v] of params) {
+            if (isForbiddenObjectKey(k))
+                continue;
+            out[k] = v;
+        }
+        return out;
     }
     if (ct.includes("multipart/form-data")) {
         // Multipart: rely on platform parser, but enforce content-length first.
@@ -2102,6 +2136,12 @@ async function readBody(req, ct, limit, multipart) {
                     throw new PayloadTooLargeError(multipart.maxFileBytes);
                 }
             }
+            // Spring4Shell-class defense (see isForbiddenObjectKey): drop fields
+            // whose name would land on a prototype-pollution sink. They still count
+            // toward the maxFields / maxFiles limits above so an attacker can't use
+            // them to bypass DoS caps.
+            if (isForbiddenObjectKey(k))
+                return;
             out[k] = v;
         });
         if (multipart?.maxFields !== undefined && fields > multipart.maxFields) {