@daloyjs/core 0.35.0 → 0.35.2

package/dist/adapters/node.js

@@ -4,30 +4,33 @@
  */
 import { createServer, } from "node:http";
 import { Readable } from "node:stream";
+import { DALOY_RAW_BODY, DALOY_RAW_STREAM, DALOY_REQUEST_RAW_BODY } from "../app.js";
 import { FrameSink, encodeFrame, encodeClosePayload, encodeSendPayload, validateUpgrade, validateSelectedSubprotocol, checkWebSocketOrigin, WS_OPCODE, WS_CLOSE_CODE, WS_READY_STATE, WS_MAX_CONTROL_PAYLOAD, WebSocketProtocolError, WebSocketPayloadTooLargeError, } from "../websocket.js";
 /** Start a Node.js HTTP (and optional WebSocket) server bound to the given {@link App}. */
 export function serve(app, opts = {}) {
     const trustProxy = opts.trustProxy === true;
-    const server = createServer({ maxHeaderSize: opts.maxHeaderBytes ?? 16 * 1024 }, async (req, res) => {
-        try {
-            const request = await toWebRequest(req, trustProxy);
-            const response = await app.fetch(request);
-            await sendWebResponse(response, res);
+    const bufferedBodyMaxBytes = typeof opts.bufferedBodyMaxBytes === "number" && opts.bufferedBodyMaxBytes >= 0
+        ? opts.bufferedBodyMaxBytes
+        : DEFAULT_BUFFERED_BODY_MAX_BYTES;
+    const server = createServer({ maxHeaderSize: opts.maxHeaderBytes ?? 16 * 1024 }, (req, res) => {
+        // GET/HEAD: no body work, dispatch directly. Keep this first so the GET
+        // hot path doesn't pay for any of the buffering bookkeeping below.
+        const method = req.method;
+        if (method === "GET" || method === "HEAD" || method === undefined) {
+            dispatchToApp(app, req, res, trustProxy, undefined);
+            return;
         }
-        catch (e) {
-            if (!res.headersSent) {
-                res.statusCode = 500;
-                res.setHeader("content-type", "application/problem+json");
-                res.end(JSON.stringify({
-                    type: "https://daloyjs.dev/errors/internal",
-                    title: "Internal Server Error",
-                    status: 500,
-                }));
-            }
-            else {
-                res.destroy(e);
-            }
+        // POST/PUT/PATCH/DELETE with a small known content-length: pre-buffer
+        // bytes from the Node socket directly so the Request constructor gets a
+        // Uint8Array body instead of `Readable.toWeb(req)`. This skips the
+        // WHATWG-stream adapter that dominates POST throughput on Node.
+        const cl = req.headers["content-length"];
+        const n = cl ? Number(cl) : NaN;
+        if (Number.isFinite(n) && n >= 0 && n <= bufferedBodyMaxBytes) {
+            bufferRequestBody(req, n).then((bytes) => dispatchToApp(app, req, res, trustProxy, bytes), (e) => writeAdapterError(res, e));
+            return;
         }
+        dispatchToApp(app, req, res, trustProxy, undefined);
     });
     server.requestTimeout = opts.connectionTimeoutMs ?? 30_000;
     server.headersTimeout = opts.connectionTimeoutMs ?? 30_000;
@@ -69,33 +72,176 @@ export function serve(app, opts = {}) {
     }
     return { server, port, close };
 }
-async function toWebRequest(req, trustProxy) {
+/**
+ * Default pre-buffer ceiling for the Node adapter. 256 KiB is a compromise:
+ * large enough that the vast majority of JSON / form requests stay on the
+ * fast (Uint8Array) path, small enough that N concurrent in-flight bodies
+ * don't pin huge amounts of memory. Override via
+ * {@link NodeServerOptions.bufferedBodyMaxBytes}. The actual security cap
+ * on body size remains `App.bodyLimitBytes`.
+ */
+const DEFAULT_BUFFERED_BODY_MAX_BYTES = 256 * 1024;
+function dispatchToApp(app, req, res, trustProxy, bufferedBody) {
+    let request;
+    try {
+        request = toWebRequest(req, trustProxy, bufferedBody);
+    }
+    catch (e) {
+        writeAdapterError(res, e);
+        return;
+    }
+    const responseOrPromise = app.fetch(request);
+    if (responseOrPromise instanceof Promise) {
+        responseOrPromise.then((response) => {
+            try {
+                const sent = sendWebResponse(response, res);
+                if (sent instanceof Promise)
+                    sent.catch((e) => writeAdapterError(res, e));
+            }
+            catch (e) {
+                writeAdapterError(res, e);
+            }
+        }, (e) => writeAdapterError(res, e));
+    }
+    else {
+        try {
+            const sent = sendWebResponse(responseOrPromise, res);
+            if (sent instanceof Promise)
+                sent.catch((e) => writeAdapterError(res, e));
+        }
+        catch (e) {
+            writeAdapterError(res, e);
+        }
+    }
+}
+function bufferRequestBody(req, expected) {
+    return new Promise((resolve, reject) => {
+        // Pre-allocate to the declared Content-Length. The caller has already
+        // checked `expected <= BUFFERED_BODY_MAX_BYTES` (1 MiB) so this
+        // allocation is bounded and DoS-safe. Skipping the intermediate
+        // `chunks: Buffer[]` array + `Buffer.concat` avoids one full-body
+        // copy per request — significant at 1 MiB bodies under load.
+        // Use `Buffer.alloc` (zero-filled) rather than `Buffer.allocUnsafe`:
+        // the unsafe variant returns uninitialized memory and is forbidden by
+        // `verify:no-unsafe-buffer`. Any unwritten tail is sliced off below.
+        const out = expected > 0 ? Buffer.alloc(expected) : null;
+        let received = 0;
+        let settled = false;
+        const onData = (chunk) => {
+            if (settled)
+                return;
+            const next = received + chunk.length;
+            if (next > expected) {
+                settled = true;
+                cleanup();
+                req.destroy();
+                reject(new Error("Request body exceeded declared Content-Length"));
+                return;
+            }
+            // out is non-null here because next > 0 implies expected > 0.
+            chunk.copy(out, received);
+            received = next;
+        };
+        const onEnd = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            if (received === 0) {
+                resolve(new Uint8Array(0));
+                return;
+            }
+            // Trust Content-Length: if the client under-delivered we still
+            // resolve the prefix actually received (matches prior behavior).
+            const buf = received === expected ? out : out.subarray(0, received);
+            resolve(new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength));
+        };
+        const onErr = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(err);
+        };
+        const cleanup = () => {
+            req.off("data", onData);
+            req.off("end", onEnd);
+            req.off("error", onErr);
+            req.off("aborted", onErr);
+        };
+        req.on("data", onData);
+        req.on("end", onEnd);
+        req.on("error", onErr);
+        req.on("aborted", onErr);
+    });
+}
+function writeAdapterError(res, e) {
+    if (!res.headersSent) {
+        res.statusCode = 500;
+        res.setHeader("content-type", "application/problem+json");
+        res.end(JSON.stringify({
+            type: "https://daloyjs.dev/errors/internal",
+            title: "Internal Server Error",
+            status: 500,
+        }));
+    }
+    else {
+        res.destroy(e);
+    }
+}
+function toWebRequest(req, trustProxy, bufferedBody) {
+    const reqHeaders = req.headers;
     const forwardedHost = trustProxy
-        ? firstHeader(req.headers["x-forwarded-host"])
+        ? firstHeader(reqHeaders["x-forwarded-host"])
         : undefined;
-    const host = forwardedHost ?? req.headers.host ?? "localhost";
+    const host = forwardedHost ?? reqHeaders.host ?? "localhost";
     const forwardedProto = trustProxy
-        ? firstHeader(req.headers["x-forwarded-proto"])
+        ? firstHeader(reqHeaders["x-forwarded-proto"])
         : undefined;
     const proto = forwardedProto ??
         (req.socket.encrypted ? "https" : "http");
     const url = `${proto}://${host}${req.url ?? "/"}`;
-    const headers = new Headers();
-    for (const [k, v] of Object.entries(req.headers)) {
-        if (v === undefined)
+    // Build headers from `rawHeaders` (a flat [k0,v0,k1,v1,...] array) instead
+    // of the parsed `req.headers` object. This matches @hono/node-server's
+    // `newHeadersFromIncoming`: one `new Headers([[k,v],...])` constructor
+    // call rather than N `headers.set()` calls. It is also stricter for
+    // duplicate-Host smuggling — Node coalesces some singleton headers down
+    // to the first value on `req.headers`, but `rawHeaders` preserves every
+    // occurrence so `assertNoDuplicateSingletonHeaders` actually sees them.
+    // Skip HTTP/2 pseudo-headers (leading ':') defensively, even though
+    // node:http's createServer is HTTP/1.1 only today.
+    const rawHeaders = req.rawHeaders;
+    const headerPairs = [];
+    for (let i = 0; i < rawHeaders.length; i += 2) {
+        const k = rawHeaders[i];
+        if (k.charCodeAt(0) === 58 /* ':' */)
             continue;
-        if (Array.isArray(v))
-            headers.set(k, v.join(", "));
-        else
-            headers.set(k, String(v));
+        headerPairs.push([k, rawHeaders[i + 1]]);
     }
+    const headers = new Headers(headerPairs);
     const method = req.method ?? "GET";
-    const init = { method, headers };
-    if (method !== "GET" && method !== "HEAD") {
-        init.body = Readable.toWeb(req);
-        init.duplex = "half";
+    if (method === "GET" || method === "HEAD") {
+        return new Request(url, { method, headers });
+    }
+    if (bufferedBody !== undefined) {
+        const req2 = new Request(url, {
+            method,
+            headers,
+            body: bufferedBody,
+        });
+        // Stash the validated bytes so readBodyLimited (and any other internal
+        // body reader) can skip the WHATWG ReadableStream reader loop. The
+        // adapter has already enforced BUFFERED_BODY_MAX_BYTES + Content-Length
+        // here; readBodyLimited re-checks against the caller's limit.
+        req2[DALOY_REQUEST_RAW_BODY] = bufferedBody;
+        return req2;
     }
-    return new Request(url, init);
+    return new Request(url, {
+        method,
+        headers,
+        body: Readable.toWeb(req),
+        duplex: "half",
+    });
 }
 function firstHeader(v) {
     if (v === undefined)
@@ -106,22 +252,79 @@ function firstHeader(v) {
     const comma = raw.indexOf(",");
     return (comma === -1 ? raw : raw.slice(0, comma)).trim() || undefined;
 }
-async function sendWebResponse(res, out) {
+function sendWebResponse(res, out) {
     out.statusCode = res.status;
     res.headers.forEach((v, k) => out.setHeader(k, v));
+    // Fast-path: response was produced by serializeResult and carries the raw
+    // body bytes via the DALOY_RAW_BODY Symbol. Skip arrayBuffer() and the
+    // reader-loop microtask churn entirely for buffer-backed responses.
+    const raw = res[DALOY_RAW_BODY];
+    if (raw !== undefined) {
+        if (raw === null) {
+            out.end();
+        }
+        else {
+            out.end(raw);
+        }
+        return;
+    }
+    // Fast-path: handler returned a raw stream. Check before `!res.body` —
+    // a Node Readable is stashed alongside a null Response body, and the
+    // `new Response(null)` constructor also auto-sets `content-length: 0`
+    // which we must strip so Node falls back to chunked transfer-encoding.
+    const rawStream = res[DALOY_RAW_STREAM];
+    if (rawStream !== undefined) {
+        if (typeof rawStream.pipe === "function" && !(rawStream instanceof ReadableStream)) {
+            // Node `Readable` from the handler: skip the Web-stream bridge entirely
+            // and `.pipe(out)` like Fastify/Koa/Express do.
+            out.removeHeader("content-length");
+            return new Promise((resolve, reject) => {
+                const r = rawStream;
+                const onError = (err) => {
+                    r.destroy();
+                    reject(err);
+                };
+                r.once("error", onError);
+                out.once("error", onError);
+                out.once("finish", () => resolve());
+                r.pipe(out);
+            });
+        }
+        return pumpBody(rawStream, out);
+    }
     if (!res.body) {
         out.end();
         return;
     }
-    const reader = res.body.getReader();
-    while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        if (value)
-            out.write(value);
+    const ct = out.getHeader("content-type");
+    const isStream = ct && typeof ct === "string" && ct.startsWith("text/event-stream");
+    const rawLength = out.getHeader("content-length");
+    const contentLength = typeof rawLength === "number"
+        ? rawLength
+        : typeof rawLength === "string"
+            ? Number(rawLength)
+            : Number.NaN;
+    if (!isStream && Number.isFinite(contentLength) && contentLength <= 64 * 1024) {
+        return res.arrayBuffer().then((ab) => {
+            out.end(Buffer.from(ab));
+        });
     }
-    out.end();
+    return pumpBody(res.body, out);
+}
+function pumpBody(body, out) {
+    // Delegate to Node's native pipe: it honors backpressure and avoids the
+    // per-chunk microtask overhead of an explicit `await reader.read()` loop.
+    return new Promise((resolve, reject) => {
+        const readable = Readable.fromWeb(body);
+        const onError = (err) => {
+            readable.destroy();
+            reject(err);
+        };
+        readable.once("error", onError);
+        out.once("error", onError);
+        out.once("finish", () => resolve());
+        readable.pipe(out);
+    });
 }
 // ---------- WebSocket upgrade ----------
 async function handleUpgrade(app, req, socket, head, trustProxy) {
@@ -390,4 +593,3 @@ class NodeWebSocketConnection {
         }
     }
 }
-//# sourceMappingURL=node.js.map

package/dist/adapters/vercel.d.ts

@@ -43,4 +43,3 @@ export declare const toEdgeHandler: typeof toWebHandler;
  */
 export declare function toRouteHandlers(app: App): RouteHandlers;
 export {};
-//# sourceMappingURL=vercel.d.ts.map

package/dist/adapters/vercel.js

@@ -23,4 +23,3 @@ export function toRouteHandlers(app) {
         out[method] = handler;
     return out;
 }
-//# sourceMappingURL=vercel.js.map

package/dist/app.d.ts

@@ -471,6 +471,34 @@ export interface IntrospectedRoute {
      */
     meta?: import("./types.js").RouteMeta;
 }
+/**
+ * Internal Symbol used to stash the raw Uint8Array (or null) body on a
+ * `Response` produced by {@link serializeResult}. Adapters that want to
+ * avoid the cost of `await response.arrayBuffer()` for buffer-backed
+ * responses can read this property and write the bytes directly. The
+ * Symbol is intentionally module-private (not exported) to keep this an
+ * implementation detail — userland code should never depend on it.
+ */
+export declare const DALOY_RAW_BODY: unique symbol;
+/**
+ * Internal Symbol used by adapters to stash a pre-buffered request body on
+ * the `Request` instance. When set, {@link readBodyLimited} skips the
+ * `ReadableStream` reader loop and returns the cached bytes directly after
+ * re-checking them against the caller-supplied limit. Adapters MUST only
+ * attach bytes they have already validated against the configured
+ * {@link AppOptions.bodyLimitBytes}; the limit re-check in
+ * `readBodyLimited` is defense-in-depth, not the primary cap. Module-public
+ * so first-party adapters can opt in; not part of the userland API surface.
+ */
+export declare const DALOY_REQUEST_RAW_BODY: unique symbol;
+/**
+ * Internal Symbol set by handlers/serializers to attach a raw stream
+ * (Node `Readable` or Web `ReadableStream`) to a `Response`. The Node
+ * adapter pipes the stream straight to the socket, skipping the
+ * Web-stream reader bridge. Module-public so first-party adapters can
+ * opt in; userland code should not depend on it.
+ */
+export declare const DALOY_RAW_STREAM: unique symbol;
 /**
  * Contract-first HTTP application.
  *
@@ -526,6 +554,14 @@ export declare class App {
     /** Public registry: enables OpenAPI gen, typed-client gen, dead-route detection. */
     readonly routes: RouteDefinition<any, any, any, any>[];
     private router;
+    /**
+     * Memoized result of `isProduction()`. The inputs (`options.env`,
+     * `options.production`, `process.env.NODE_ENV`) cannot change between
+     * the moment a route is dispatched and the moment its error is rendered,
+     * so reading `process.env.NODE_ENV` on every error response is wasted
+     * work in the hot path. Computed lazily on first read.
+     */
+    private _productionCache;
     /** WebSocket route registry. Adapters look up handlers via `app.webSocketRoutes.find()`. */
     readonly webSocketRoutes: WebSocketRegistry;
     private prefix;
@@ -536,6 +572,13 @@ export declare class App {
     private routeSecurityMarkers;
     /** Decorator bag merged into ctx.state on every request. */
     private decorations;
+    /**
+     * Count of own keys on {@link decorations}. Tracked alongside the bag so the
+     * dispatch hot path can take a `count === 0` fast path and skip the
+     * `Object.assign` spread on the common case (no `app.decorate()` calls).
+     * Updated only when {@link decorate} mutates the bag.
+     */
+    private decorationsCount;
     private installedPlugins;
     private closeHooks;
     private closeHooksRun;
@@ -570,6 +613,15 @@ export declare class App {
      * dashboards see the misconfiguration without flooding on every retry.
      */
     private trustProxyWarned;
+    /**
+    * Cached merge of `options.hooks` only. Used on the cold 404/405 path
+    * and as the baseline for cross-origin guard decisions when no route
+    * matches.
+     */
+    private _globalHooksCache;
+    private _globalCorsAllowsCache;
+    private get globalHooks();
+    private get globalCorsAllows();
     constructor(options?: AppOptions);
     /**
      * Validate {@link AppOptions.disconnectStatusCode}.
@@ -1058,4 +1110,3 @@ export declare function createApp(options?: AppOptions): App;
  * @internal
  */
 export declare function _resetPackageJsonCacheForTests(): void;
-//# sourceMappingURL=app.d.ts.map