@encharm/cws 4.5.3 → 4.8.0

package/CHANGELOG.md

@@ -1,3 +1,21 @@
+## Released 4.8.0
+* Prebuilt bindings now compress with zlib-ng 2.2.4 (vendored in `deps/zlib-ng`, statically linked, native `zng_` API so it cannot collide with Node's zlib). Measured on a real RPC stream: level 1 costs 2.2-2.5 us/KB vs 5.6-8 us/KB with zlib. The node-gyp fallback build keeps using Node's zlib through the same `src/Zlib.cpp` wrapper.
+* New `perMessageDeflate.level` option (default 2) and a `zlibBackend` export naming the compiled-in implementation.
+* Fix the node-gyp fallback build (`npm install` on a platform without a prebuilt binding): it lacked the vendored Node header include path, `HAVE_OPENSSL`/`NODE_WANT_INTERNALS`, and a macOS 10.15 deployment target, so it has failed silently since the Node 20 headers were introduced.
+
+## Released 4.7.0
+* permessage-deflate: messages are now compressed by default once negotiated (previously only `send(..., { compress: true })` compressed anything). New options `threshold` (minimum size to compress), `windowBits` and `memLevel` (per-socket memory tier for the sliding window, advertised as `server_max_window_bits` when below 15).
+* Remove a leftover debug `console.log` on module load.
+
+## Released 4.6.0
+* Add Node 26 support (ABI 147, V8 14.6): vendored `src/headers/26`, `MakeCallback` with explicit `async_context`, tagged internal-field reads via `BaseObject::FromJSObject`.
+* Cork writes per event-loop iteration: sends to the same socket within one tick go out in a single gathered write. Disable with `CWS_CORK=0`.
+* Binary messages are detached after the `message` handler returns. A retained `ArrayBuffer` now throws on use instead of exposing another connection's bytes (the receive buffer is shared). Copy with `slice()` if the data is needed later.
+* Fix use-after-free when a send callback closes the socket while its write queue is draining.
+* `terminate()` on an already closed socket is a no-op.
+* The `message` handler is now dispatched through `MakeCallback` like every other handler: correct AsyncLocalStorage propagation, exceptions reach `uncaughtException`, and microtasks drain after each message instead of after the whole poll phase. No measurable throughput cost.
+* Fix `send()` of a typed array that is a subarray (non-zero `byteOffset`): the bytes were read from the start of the underlying ArrayBuffer instead of the view's offset.
+
 ## Released 4.1.0
 * Add support for socket.bufferedAmount
 

package/CLAUDE.md

@@ -0,0 +1,83 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## What this is
+
+`@encharm/cws` is a native C++ WebSocket implementation for Node.js that aims to be a near drop-in replacement for the `ws` module. It is a fork of ClusterWS/cWS, which itself forked uWebSockets v0.14 (dual MIT + ZLIB license, see `LICENSE` and `src/LICENSE`). Prebuilt binaries for every supported platform/ABI are committed under `dist/bindings/` and published with the package; end users never compile.
+
+## Commands
+
+```sh
+npm run build-ts        # lint + tsc: lib/*.ts -> dist/*.js + *.d.ts (dist JS is committed)
+npm run lint            # tslint over lib/**/*.ts
+npm test                # nyc + mocha, runs tests/**/*.test.ts via ts-node (loads ../lib, not dist)
+npx mocha -r ts-node/register tests/server-client.test.ts -g "ping/pong" --exit   # single test
+npm run build-cpp       # node-gyp rebuild for the *current* Node ABI only; output goes to build_log.txt, never fails the install
+npm run clean           # deletes dist/bindings/* (all committed binaries!) -- don't run casually
+```
+
+Tests bind ports 3000 (ws) and 3001 (wss, certs in `tests/certs/`). The test file currently iterates only `['Non-SSL']`; the SSL loop is wired up but disabled. `tests/autobahn-*.js` are manual Autobahn testsuite harnesses, not part of `npm test`.
+
+### Building the release binaries (multi-ABI)
+
+`binding.gyp` is only used by `npm install` for a local build against the running Node (Node's zlib, no zlib-ng); it must carry the same include path and defines as the Makefile or it fails silently (the install script discards the exit code). Release binaries are built by the `Makefile` (macOS/Linux) and `make.bat` (Windows), which:
+
+1. Download official Node header tarballs for one pinned version per supported major into `targets/` (`VER_115`=Node 20, `VER_127`=Node 22, `VER_137`=Node 24, `VER_147`=Node 26; the number is the Node ABI / `process.versions.modules`).
+2. Compile `src/*.cpp` once per ABI with `g++`/`cl` directly, with `-I src/headers/$V` for the matching Node major.
+3. Build the vendored zlib-ng (`deps/zlib-ng`, native `zng_` API) once per OS/arch: CMake into `deps/zlib-ng/build-<OS>-<arch>/` on macOS/Linux, `nmake -f win32\Makefile.msc` on Windows. The bindings are compiled with `-DCWS_ZLIB_NG` and link it statically. `src/Zlib.cpp` is the only file that includes a zlib header; without the define (node-gyp fallback) it uses Node's zlib.
+4. Emit `dist/bindings/cws_<platform>_<arch>_node<ABI>.node`.
+
+```sh
+make                                  # all four ABIs for the host OS/arch (needs curl, cmake, g++/clang)
+./build-on-docker.sh linux/arm64      # Linux arm64 (native on Apple Silicon, ~1 min)
+./build-on-docker.sh linux/amd64      # Linux x64 (default; emulated on Apple Silicon, slower)
+make.bat                              # Windows x64; auto-detects VS 2022 (Build Tools or any edition)
+```
+
+All of it can be driven from the Mac. Docker builds mount the repo and write straight into `dist/bindings/`. The Windows build runs in the Parallels "Windows 11" VM through the shared folder (cmd refuses UNC batch paths, hence `pushd`):
+
+```sh
+prlctl resume "Windows 11"
+prlctl exec "Windows 11" cmd /c "pushd \\\\Mac\\code\\cWS && make.bat"   # 4 backslashes in zsh -> \\Mac
+prlctl suspend "Windows 11"
+```
+
+The VM is Windows on ARM: `vcvars64` still emits x64 code, so `make.bat` names outputs `win32_x64` explicitly, and testing them needs an x64 Node in the guest (an x64 zip from nodejs.org extracted under `C:\Temp` works; the guest's own ARM64 Node cannot load them). Docker base image is Ubuntu 22.04 = the minimum glibc baseline. Smoke-test a binding on its target Node with `node node_modules/mocha/bin/mocha -r ts-node/register 'tests/**/*.test.ts' --exit`, e.g. inside `node:22-bookworm` for Linux.
+
+Adding a new Node major means: add a `VER_xxx`/ABI line to `Makefile` and `make.bat`, vendor that Node version's private headers into `src/headers/<major>/`, and add a `#if NODE_MAJOR_VERSION==<major>` include block in `src/Addon.h`. Vendoring = copy every `src/**/*.h` from the Node source tarball, plus `deps/ncrypto/ncrypto.h` and any `deps/v8/include/*.h` missing from the official headers tarball, then make `ssl_` public in `crypto/crypto_tls.h` (`TLSWrapSSLGetter` needs it). For 26 there is a second edit: `MaybeStackBuffer::AllocateSufficientStorage` (primary and the concept-constrained `V8Type` partial specialization) and `ToPath` are defined in-class in `util.h` instead of out-of-line in `util-inl.h`, because MSVC `cl.exe` cannot match out-of-line member definitions once that constrained specialization exists (Node builds Windows with clang-cl, which the Parallels VM does not have). Both edits are marked with a `cWS:` comment. Node's gyp-only config macros (e.g. `HAVE_SQLITE`, `HAVE_AMARO` for 26) must be defined before the include. Expect V8 API churn in `Addon.h` on each major; 26 needed tagged internal-field reads (`BaseObject::FromJSObject`) and dropped `Object::GetIsolate` and the `MakeCallback` overload without `async_context`.
+
+## Architecture
+
+### Two layers, one binary
+
+- **`lib/*.ts` (thin JS facade)** compiled to `dist/`. `shared.ts` loads the native addon by filename `cws_${platform}_${arch}_node${versions.modules}` and wires native group callbacks (`onConnection`, `onMessage`, `onDisconnection`, …) to per-socket `registeredEvents`. Events are single-listener: `on()` overwrites, with a console warning. `client.ts` exports `WebSocket` (used for both client sockets and server-side peers, distinguished by `options.external`), `server.ts` exports `WebSocketServer` (aliased as `WebSocket.Server`).
+- **`src/` (C++ addon)** is the uWebSockets 0.14 core (`Hub`, `Group`, `WebSocket`, `HTTPSocket`, `Networking`, `WebSocketProtocol.h`, `Extensions` for permessage-deflate) plus the V8 binding layer in `src/Addon.h` / `Addon.cpp`. `Backend.h` picks the event backend: libuv everywhere (`-DUSE_LIBUV` is always set), the epoll backend in `Epoll.*` is legacy and not compiled in by the Makefile.
+
+### How a server connection gets into C++ (the important part)
+
+cWS does **not** run its own HTTP listener. `WebSocketServer` uses a Node `http`/`https` server (user-supplied or created internally) and hooks its `'upgrade'` event. In `upgradeConnection()`:
+
+1. It grabs the raw libuv handle from the Node socket (`socket._handle`, or `_parent._handle` for TLS).
+2. For TLS it calls `native.getSSLContext(socket.ssl)` to pull the raw `SSL*` out of Node's internal `TLSWrap`. This is why `src/headers/<major>/` vendors Node **private** headers (`crypto/crypto_tls.h`, `base_object-inl.h`, etc.) and `Addon.h` defines `NODE_WANT_INTERNALS` around them: `TLSWrapSSLGetter` subclasses `node::crypto::TLSWrap` to reach the protected `ssl_` member. This is the ABI-fragile part and the reason binaries are per-Node-major.
+3. `native.transfer(fd, ssl)` creates a `Ticket` and the Node socket is destroyed. On its `'close'` event, `native.upgrade(group, ticket, secKey, extensions, protocol)` hands the fd to the uWS `Hub`, which performs the WebSocket handshake and owns the socket from then on. On Linux with Node >= 20 the fd is `dup()`ed first as a workaround for io_uring (see comment in `Addon.h`).
+
+`noServer: true` + `handleUpgrade()` follows the same path for `ws` compatibility. `path` and `verifyClient` checks happen in JS before the transfer.
+
+### Client connections
+
+The client side never touches Node sockets: `native.connect(clientGroup, url, ws)` lets the uWS `Hub` do TCP/TLS itself using a process-wide `SSL_CTX` created in `cSNode.cpp` (TLS 1.0–1.2 only). `secureProtocol = 'TLSv1_2_method'` is exported for users to pin their https server to match.
+
+### Write corking
+
+`Socket::sendTransformed` does not write when the socket is corkable (WebSockets only, plain TCP only) and `NodeData::corkState->enabled` is set. It frames the message into the socket's `messageQueue` and registers the socket in the per-loop `corkState->pending` list. `Socket::flushCorked` drains that list with one `sendmsg`/`WSASend` gather per socket from two libuv hooks registered in `registerCheck` (`src/Addon.h`): a `uv_prepare` (before the loop blocks in poll) and the existing `uv_check` (after poll and after Node's immediates). Anything that cannot be written falls through to the normal `UV_WRITABLE` drain loop in `ioHandler`. `closeSocket`/`onEnd`/`transfer` call `flushCorkedOnClose`, which unregisters the socket and pushes what it can to the kernel without invoking callbacks. `CWS_CORK=0` disables it at addon load (`corkEnabledFromEnv`). `HttpSocket` is never corkable because `Hub::upgrade` deletes it synchronously.
+
+### Things that are easy to get wrong
+
+- `dist/*.js` and `dist/bindings/*.node` are committed. Rebuild TS with `npm run build-ts` and commit the output; binaries must be rebuilt on each platform when C++ changes.
+- Binary messages reach JS as an `ArrayBuffer` that is a zero-copy view over the per-loop receive buffer shared by every socket. `onMessage` in `Addon.h` detaches it after the handler returns, so retaining it without `slice()` throws on later use rather than exposing another connection's bytes. Text frames are copied into a V8 string. Ping/pong payloads also go through the string path.
+- Every handler, including `message`, is invoked through `node::MakeCallback`, which establishes an async-context scope and drains nextTick/microtasks after the handler returns. Because that drain happens before `onMessage` detaches the binary `ArrayBuffer`, a continuation that resolves within it still sees the bytes; anything that waits on real I/O sees a detached buffer.
+- `shared.ts` currently has a leftover `console.log('log', ...)` printing the binding path on load.
+- The addon exposes one `Group` per server plus a single shared client group; `ws.external` is the C++ `WebSocket*` and is nulled on disconnect, so every native call in `client.ts` guards on it.
+- permessage-deflate: `Group` carries `deflateWindowBits`/`deflateMemLevel` (tier of the per-socket compressor allocated in the `WebSocket` ctor); the negotiator advertises `server_max_window_bits` when below 15 but ignores a smaller value requested by the client. The JS `send` decides `compress` per message: explicit option, else `compressThreshold` from the server config (undefined when deflate is off). Client-to-server inflate is one shared stream reset per message (`client_no_context_takeover` is always offered).
+- Close code defaults to 1005 when the peer sends none (matches `ws`). App-level ping uses the single byte `'9'` (`APP_PING_CODE`) for browser clients that can't see protocol pings.

package/README.md

@@ -12,9 +12,12 @@
 
 This table is true if you run ssl directly with `cws` (`Node.js`). In case if you use proxy for example `nginx`, `cws` can be run on bigger coverage.
 
-| cWS Version | Node 24  | Node 22 | Node 20 |
-|-------------|----------|---------|----------
-| 4.5.3       |    X     |    X    |   X     |
+| cWS Version | Node 26 | Node 24  | Node 22 | Node 20 |
+|-------------|---------|----------|---------|----------
+| 4.8.0       |    X    |    X     |    X    |   X     |
+| 4.7.0       |    X    |    X     |    X    |   X     |
+| 4.6.0       |    X    |    X     |    X    |   X     |
+| 4.5.3       |         |    X     |    X    |   X     |
 
 ## Documentation
 
@@ -173,7 +176,14 @@ const wsServer = new WebSocket.Server({
    * noDelay?: boolean (set socket no delay)
    * noServer?: boolean (use this when upgrade done outside of cws)
    * maxPayload?: number 
-   * perMessageDeflate?: boolean | { serverNoContextTakeover: boolean;}
+   * perMessageDeflate?: boolean | { serverNoContextTakeover?: boolean; windowBits?: number; memLevel?: number; threshold?: number }
+   *   true = shared compressor, no context takeover. serverNoContextTakeover: false = per-socket
+   *   sliding window (streaming compression; far better on small messages). windowBits 9..15 and
+   *   memLevel 1..9 pick its memory tier: 15/8 = ~256 KB per socket (default), 12/5 = ~32 KB, 10/3 = ~8 KB.
+   *   threshold = minimum message size in bytes to compress (default 0); send(..., { compress }) overrides.
+   *   level 1..9 (default 2): deflate level of the per-socket compressor. The prebuilt bindings use zlib-ng
+   *   (see `zlibBackend` export): level 1 is its very fast "quick" strategy (~3-4x less CPU than zlib
+   *   level 1 for ~8% worse ratio), level 2 matches zlib level 1's ratio.
    * verifyClient?: (info: ConnectionInfo, next: VerifyClientNext) => void (use to allow or decline connections)
    **/ 
  }, () => {
@@ -262,6 +272,12 @@ server.on('upgrade', (request, socket, head) => {
 
 **For more information check typings (`*.d.ts`) files in [dist](https://github.com/encharm/cWS/blob/master/dist) folder**
 
+### Write corking (performance)
+
+All `send()` calls made to a socket during one event-loop iteration are framed immediately but written with a single gathered write (`writev`) when the iteration ends, instead of one syscall per `send()`. This is transparent to callers and preserves ordering; `send()` followed by `close()`/`terminate()` in the same tick still delivers the message. While writes are corked they are counted in `bufferedAmount` until the flush.
+
+Set `CWS_CORK=0` in the environment to disable it and write every message immediately (previous behaviour). Corking applies to plain TCP sockets only; TLS sockets always write immediately.
+
 ### Secure WebSocket
 You can use `wss://` with `cws` by providing `https` server to `cws` and setting `secureProtocol` on https options:
 

package/binding.gyp

@@ -12,8 +12,14 @@
                 'src/cSNode.cpp',
                 'src/WebSocket.cpp',
                 'src/HTTPSocket.cpp',
-                'src/Socket.cpp'
+                'src/Socket.cpp',
+                'src/Zlib.cpp'
             ],
+            # Node private headers vendored per major (see src/headers/); the Makefile passes the same -I.
+            'include_dirs': [
+                'src/headers/<!(node -p "parseInt(process.versions.node)")'
+            ],
+            'defines': ['HAVE_OPENSSL=1', 'NODE_WANT_INTERNALS=1'],
             'conditions': [
                 ['OS=="linux"', {
                     'cflags_cc': ['-std=c++17', '-DUSE_LIBUV'],
@@ -31,7 +37,7 @@
                 }],
                 ['OS=="mac"', {
                     'xcode_settings': {
-                        'MACOSX_DEPLOYMENT_TARGET': '10.7',
+                        'MACOSX_DEPLOYMENT_TARGET': '10.15',
                         'CLANG_CXX_LANGUAGE_STANDARD': 'c++20',
                         'CLANG_CXX_LIBRARY': 'libc++',
                         'GCC_GENERATE_DEBUGGING_SYMBOLS': 'NO',

package/dist/client.d.ts

@@ -12,6 +12,7 @@ export declare class WebSocket {
     registeredEvents: any;
     private external;
     private socketType;
+    private compressThreshold;
     constructor(url: string, options?: any);
     get bufferedAmount(): number;
     get _socket(): SocketAddress;

package/dist/client.js

@@ -4,6 +4,12 @@ exports.WebSocket = void 0;
 const server_1 = require("./server");
 const shared_1 = require("./shared");
 const clientGroup = shared_1.native.client.group.create(0, shared_1.DEFAULT_PAYLOAD_LIMIT);
+function messageByteLength(message) {
+    if (typeof message === 'string') {
+        return Buffer.byteLength(message);
+    }
+    return message && typeof message.byteLength === 'number' ? message.byteLength : 0;
+}
 shared_1.setupNative(clientGroup, 'client');
 class WebSocket {
     constructor(url, options = {}) {
@@ -23,6 +29,7 @@ class WebSocket {
         if (!this.url && this.options.external) {
             this.socketType = 'server';
             this.external = this.options.external;
+            this.compressThreshold = this.options.compressThreshold;
         }
         else {
             shared_1.native.connect(clientGroup, url, this);
@@ -76,7 +83,14 @@ class WebSocket {
             if (options && options.binary === true) {
                 opCode = shared_1.OPCODE_BINARY;
             }
-            shared_1.native[this.socketType].send(this.external, message, opCode, cb ? () => process.nextTick(cb) : null, options && options.compress);
+            let compress = false;
+            if (options && options.compress !== undefined) {
+                compress = !!options.compress;
+            }
+            else if (this.compressThreshold !== undefined) {
+                compress = messageByteLength(message) >= this.compressThreshold;
+            }
+            shared_1.native[this.socketType].send(this.external, message, opCode, cb ? () => process.nextTick(cb) : null, compress);
         }
         else if (cb) {
             cb(new Error('Socket not connected'));

package/dist/index.d.ts

@@ -21,10 +21,15 @@ export declare type ServerConfigs = {
     noServer?: boolean;
     maxPayload?: number;
     perMessageDeflate?: boolean | {
-        serverNoContextTakeover: boolean;
+        serverNoContextTakeover?: boolean;
+        windowBits?: number;
+        memLevel?: number;
+        level?: number;
+        threshold?: number;
     };
     verifyClient?: (info: ConnectionInfo, next: VerifyClientNext) => void;
 };
 export { WebSocket } from './client';
 export { WebSocketServer } from './server';
 export declare const secureProtocol: string;
+export { zlibBackend } from './shared';

package/dist/index.js

@@ -6,3 +6,5 @@ Object.defineProperty(exports, "WebSocket", { enumerable: true, get: function ()
 var server_1 = require("./server");
 Object.defineProperty(exports, "WebSocketServer", { enumerable: true, get: function () { return server_1.WebSocketServer; } });
 exports.secureProtocol = 'TLSv1_2_method';
+var shared_1 = require("./shared");
+Object.defineProperty(exports, "zlibBackend", { enumerable: true, get: function () { return shared_1.zlibBackend; } });

package/dist/server.d.ts

@@ -7,6 +7,7 @@ export declare class WebSocketServer {
     private options;
     upgradeCb: (ws: WebSocket) => void;
     upgradeReq: HTTP.IncomingMessage;
+    compressThreshold: number | undefined;
     registeredEvents: any;
     private httpServer;
     private serverGroup;

package/dist/server.js

@@ -12,13 +12,27 @@ class WebSocketServer {
             connection: shared_1.noop,
         };
         let nativeOptions = 0;
+        let windowBits = 15;
+        let memLevel = 8;
+        let level = 2;
         if (this.options.perMessageDeflate) {
             nativeOptions |= shared_1.PERMESSAGE_DEFLATE;
-            if (this.options.perMessageDeflate.serverNoContextTakeover === false) {
+            const deflate = typeof this.options.perMessageDeflate === 'object' ? this.options.perMessageDeflate : {};
+            if (deflate.serverNoContextTakeover === false) {
                 nativeOptions |= shared_1.SLIDING_DEFLATE_WINDOW;
             }
+            if (typeof deflate.windowBits === 'number') {
+                windowBits = deflate.windowBits;
+            }
+            if (typeof deflate.memLevel === 'number') {
+                memLevel = deflate.memLevel;
+            }
+            if (typeof deflate.level === 'number') {
+                level = deflate.level;
+            }
+            this.compressThreshold = typeof deflate.threshold === 'number' ? deflate.threshold : 0;
         }
-        this.serverGroup = shared_1.native.server.group.create(nativeOptions, this.options.maxPayload || shared_1.DEFAULT_PAYLOAD_LIMIT);
+        this.serverGroup = shared_1.native.server.group.create(nativeOptions, this.options.maxPayload || shared_1.DEFAULT_PAYLOAD_LIMIT, windowBits, memLevel, level);
         shared_1.setupNative(this.serverGroup, 'server', this);
         if (this.options.noServer) {
             return;

package/dist/shared.d.ts

@@ -9,4 +9,5 @@ export declare const PERMESSAGE_DEFLATE: number;
 export declare const SLIDING_DEFLATE_WINDOW: number;
 export declare const DEFAULT_PAYLOAD_LIMIT: number;
 export declare const native: any;
+export declare const zlibBackend: string;
 export declare function setupNative(group: any, type: string, wsServer?: WebSocketServer): void;

package/dist/shared.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setupNative = exports.native = exports.DEFAULT_PAYLOAD_LIMIT = exports.SLIDING_DEFLATE_WINDOW = exports.PERMESSAGE_DEFLATE = exports.APP_PING_CODE = exports.OPCODE_BINARY = exports.OPCODE_PING = exports.OPCODE_TEXT = exports.noop = void 0;
+exports.setupNative = exports.zlibBackend = exports.native = exports.DEFAULT_PAYLOAD_LIMIT = exports.SLIDING_DEFLATE_WINDOW = exports.PERMESSAGE_DEFLATE = exports.APP_PING_CODE = exports.OPCODE_BINARY = exports.OPCODE_PING = exports.OPCODE_TEXT = exports.noop = void 0;
 const client_1 = require("./client");
 exports.noop = () => { };
 exports.OPCODE_TEXT = 1;
@@ -19,11 +19,12 @@ exports.native = (() => {
         throw err;
     }
 })();
+exports.zlibBackend = exports.native.zlibBackend;
 function setupNative(group, type, wsServer) {
     exports.native.setNoop(exports.noop);
     exports.native[type].group.onConnection(group, (external) => {
         if (type === 'server' && wsServer) {
-            const socket = new client_1.WebSocket(null, { external });
+            const socket = new client_1.WebSocket(null, { external, compressThreshold: wsServer.compressThreshold });
             exports.native.setUserData(external, socket);
             if (wsServer.upgradeCb) {
                 wsServer.upgradeCb(socket);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@encharm/cws",
-  "version": "4.5.3",
+  "version": "4.8.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "description": "cWS - fast C++ WebSocket implementation for Node.js",

package/src/Addon.cpp

@@ -3,7 +3,7 @@
 #include "Addon.h"
 
 void Initialize(Local<Object> exports) {
-  Isolate *isolate = exports->GetIsolate();
+  Isolate *isolate = Isolate::GetCurrent();
   exports->Set(isolate->GetCurrentContext(), String::NewFromUtf8(isolate, "server").ToLocalChecked(),
               Namespace<cWS::SERVER>(isolate).object);
   exports->Set(isolate->GetCurrentContext(), String::NewFromUtf8(isolate, "client").ToLocalChecked(),
@@ -20,6 +20,9 @@ void Initialize(Local<Object> exports) {
   NODE_SET_METHOD(exports, "upgrade", upgrade);
   NODE_SET_METHOD(exports, "connect", connect);
   NODE_SET_METHOD(exports, "setNoop", setNoop);
+  exports->Set(isolate->GetCurrentContext(), String::NewFromUtf8(isolate, "zlibBackend").ToLocalChecked(),
+               String::NewFromUtf8(isolate, cWS::zlib::backend()).ToLocalChecked()).Check();
+  hub.getNodeData()->corkState->enabled = corkEnabledFromEnv();
   registerCheck(isolate);
 }
 

package/src/Addon.h

@@ -24,6 +24,19 @@
   #include "headers/24/base_object-inl.h"
 #endif
 
+#if NODE_MAJOR_VERSION==26
+  // Build-configuration macros normally supplied by Node's own gyp build;
+  // official binaries are built with both enabled.
+  #ifndef HAVE_SQLITE
+    #define HAVE_SQLITE 1
+  #endif
+  #ifndef HAVE_AMARO
+    #define HAVE_AMARO 1
+  #endif
+  #include "headers/26/crypto/crypto_tls.h"
+  #include "headers/26/base_object-inl.h"
+#endif
+
 #include <tcp_wrap.h>
 
 using BaseObject = node::BaseObject;
@@ -64,8 +77,14 @@ using namespace v8;
 
 cWS::Hub hub(0, true);
 uv_check_t check;
+uv_prepare_t corkPrepare;
 Persistent<Function> noop;
 
+// Corked writes are flushed twice per loop iteration: in the prepare phase
+// (right before the loop blocks in poll, so sends made from timers/nextTick/
+// microtasks go out without waiting for I/O) and in the check phase (after
+// poll and after Node's setImmediate callbacks, so sends made from I/O
+// callbacks go out in the same iteration).
 void registerCheck(Isolate *isolate) {
   uv_check_init((uv_loop_t *)hub.getLoop(), &check);
   check.data = isolate;
@@ -73,9 +92,29 @@ void registerCheck(Isolate *isolate) {
     Isolate *isolate = (Isolate *)check->data;
     HandleScope hs(isolate);
     node::MakeCallback(isolate, isolate->GetCurrentContext()->Global(),
-                       Local<Function>::New(isolate, noop), 0, nullptr);
+                       Local<Function>::New(isolate, noop), 0, nullptr, node::async_context{0, 0});
+    cS::Socket::flushCorked(hub.getNodeData());
   });
   uv_unref((uv_handle_t *)&check);
+
+  uv_prepare_init((uv_loop_t *)hub.getLoop(), &corkPrepare);
+  uv_prepare_start(&corkPrepare, [](uv_prepare_t *) {
+    cS::Socket::flushCorked(hub.getNodeData());
+  });
+  uv_unref((uv_handle_t *)&corkPrepare);
+}
+
+// CWS_CORK=0 (or "false"/"off") disables write corking; anything else enables.
+bool corkEnabledFromEnv() {
+  const char *value = getenv("CWS_CORK");
+  if (!value) {
+    return true;
+  }
+  std::string v(value);
+  for (char &c : v) {
+    c = (char) tolower((unsigned char) c);
+  }
+  return !(v == "0" || v == "false" || v == "off" || v == "no");
 }
 
 class NativeString {
@@ -102,7 +141,9 @@ class NativeString {
 #if NODE_MAJOR_VERSION >= 18
       length = arrayBufferView->ByteLength();
       auto store = arrayBufferView->Buffer()->GetBackingStore();
-      data = reinterpret_cast<char*>(store->Data());
+      // A typed array may be a window into a larger ArrayBuffer (subarray);
+      // honour its offset or we would send bytes from the start of the pool.
+      data = reinterpret_cast<char*>(store->Data()) + arrayBufferView->ByteOffset();
 #else
       ArrayBuffer::Contents contents = arrayBufferView->Buffer()->GetContents();
       length = contents.ByteLength();
@@ -144,8 +185,17 @@ struct GroupData {
 
 template <bool isServer>
 void createGroup(const FunctionCallbackInfo<Value> &args) {
+  int windowBits = args.Length() > 2 && args[2]->IsNumber() ? (int) args[2].As<Integer>()->Value() : 15;
+  int memLevel = args.Length() > 3 && args[3]->IsNumber() ? (int) args[3].As<Integer>()->Value() : 8;
+  if (windowBits < 9) windowBits = 9;
+  if (windowBits > 15) windowBits = 15;
+  if (memLevel < 1) memLevel = 1;
+  if (memLevel > 9) memLevel = 9;
+  int level = args.Length() > 4 && args[4]->IsNumber() ? (int) args[4].As<Integer>()->Value() : 1;
+  if (level < 1) level = 1;
+  if (level > 9) level = 9;
   cWS::Group<isServer> *group = hub.createGroup<isServer>(
-      args[0].As<Integer>()->Value(), args[1].As<Integer>()->Value());
+      args[0].As<Integer>()->Value(), args[1].As<Integer>()->Value(), windowBits, memLevel, level);
   group->setUserData(new GroupData);
   args.GetReturnValue().Set(External::New(args.GetIsolate(), group));
 }
@@ -271,7 +321,7 @@ void sendCallback(cWS::WebSocket<isServer> *webSocket, void *data,
     HandleScope hs(sc->isolate);
     node::MakeCallback(sc->isolate, sc->isolate->GetCurrentContext()->Global(),
                        Local<Function>::New(sc->isolate, sc->jsCallback), 0,
-                       nullptr);
+                       nullptr, node::async_context{0, 0});
   }
   sc->jsCallback.Reset();
   delete sc;
@@ -358,11 +408,15 @@ void transfer(const FunctionCallbackInfo<Value> &args) {
     Isolate* isolate = args.GetIsolate();
     Local<Context> context = isolate->GetCurrentContext();
     auto arg_0 = args[0]->ToObject(context).ToLocalChecked();
+#if NODE_MAJOR_VERSION >= 26
+    // V8 14 tags internal-field pointers; Node's own reader knows the tag.
+    // The BaseObject* is the start of the TCPWrap (single inheritance chain).
+    void *handleWrap = node::BaseObject::FromJSObject(arg_0);
+#else
     auto field_to_get = arg_0->InternalFieldCount() > 3 ? 1 : 0;
-
-    uv_fileno((handle = getTcpHandle(
-                   arg_0->GetAlignedPointerFromInternalField(field_to_get))),
-              (uv_os_fd_t *)&ticket->fd);
+    void *handleWrap = arg_0->GetAlignedPointerFromInternalField(field_to_get);
+#endif
+    uv_fileno((handle = getTcpHandle(handleWrap)), (uv_os_fd_t *)&ticket->fd);
   } else {
     ticket->fd = args[0].As<Integer>()->Value();
   }
@@ -400,7 +454,7 @@ void onConnection(const FunctionCallbackInfo<Value> &args) {
         Local<Value> argv[] = {wrapSocket(webSocket, isolate)};
         node::MakeCallback(isolate, isolate->GetCurrentContext()->Global(),
                            Local<Function>::New(isolate, *connectionCallback),
-                           1, argv);
+                           1, argv, node::async_context{0, 0});
       });
 }
 
@@ -424,8 +478,19 @@ void onMessage(const FunctionCallbackInfo<Value> &args) {
       HandleScope hs(isolate);
       Local<Value> argv[] = {wrapMessage(message, length, opCode, isolate),
                             getDataV8(webSocket, isolate)};
-      Local<Function>::New(isolate, *messageCallback)
-          ->Call(isolate->GetCurrentContext(), Null(isolate), 2, argv);
+      node::MakeCallback(isolate, isolate->GetCurrentContext()->Global(),
+                         Local<Function>::New(isolate, *messageCallback), 2, argv, node::async_context{0, 0});
+      // Binary messages are zero-copy views over the shared per-loop receive
+      // buffer, which the next socket read overwrites. Detach the ArrayBuffer
+      // once the handler returns so a retained reference reads as empty and
+      // throws on use, instead of silently exposing another connection's data.
+      // Handlers that need the bytes after returning must copy them (slice()).
+      if (opCode == cWS::OpCode::BINARY) {
+        Local<ArrayBuffer> arrayBuffer = argv[0].template As<ArrayBuffer>();
+        if (arrayBuffer->IsDetachable()) {
+          arrayBuffer->Detach();
+        }
+      }
     }
   });
 }
@@ -446,7 +511,7 @@ void onPing(const FunctionCallbackInfo<Value> &args) {
         wrapMessage(message, length, cWS::OpCode::PING, isolate),
         getDataV8(webSocket, isolate)};
     node::MakeCallback(isolate, isolate->GetCurrentContext()->Global(),
-                       Local<Function>::New(isolate, *pingCallback), 2, argv);
+                       Local<Function>::New(isolate, *pingCallback), 2, argv, node::async_context{0, 0});
   });
 }
 
@@ -466,7 +531,7 @@ void onPong(const FunctionCallbackInfo<Value> &args) {
         wrapMessage(message, length, cWS::OpCode::PONG, isolate),
         getDataV8(webSocket, isolate)};
     node::MakeCallback(isolate, isolate->GetCurrentContext()->Global(),
-                       Local<Function>::New(isolate, *pongCallback), 2, argv);
+                       Local<Function>::New(isolate, *pongCallback), 2, argv, node::async_context{0, 0});
   });
 }
 
@@ -492,7 +557,7 @@ void onDisconnection(const FunctionCallbackInfo<Value> &args) {
         getDataV8(webSocket, isolate)};
     node::MakeCallback(isolate, isolate->GetCurrentContext()->Global(),
                        Local<Function>::New(isolate, *disconnectionCallback), 4,
-                       argv);
+                       argv, node::async_context{0, 0});
   });
 }
 
@@ -510,7 +575,7 @@ void onError(const FunctionCallbackInfo<Value> &args) {
     Local<Value> argv[] = {
         Local<Value>::New(isolate, *(Persistent<Value> *)user)};
     node::MakeCallback(isolate, isolate->GetCurrentContext()->Global(),
-                       Local<Function>::New(isolate, *errorCallback), 1, argv);
+                       Local<Function>::New(isolate, *errorCallback), 1, argv, node::async_context{0, 0});
 
     ((Persistent<Value> *)user)->Reset();
     delete (Persistent<Value> *)user;

package/src/Extensions.cpp

@@ -76,7 +76,7 @@ ExtensionsParser::ExtensionsParser(const char *data, size_t length) {
 }
 
 template <bool isServer>
-ExtensionsNegotiator<isServer>::ExtensionsNegotiator(int wantedOptions) {
+ExtensionsNegotiator<isServer>::ExtensionsNegotiator(int wantedOptions, int serverMaxWindowBits) : serverMaxWindowBits(serverMaxWindowBits) {
     options = wantedOptions;
 }
 
@@ -100,6 +100,12 @@ std::string ExtensionsNegotiator<isServer>::generateOffer() {
         if (options & Options::SERVER_NO_CONTEXT_TAKEOVER) {
             //extensionsOffer += "; server_no_context_takeover";
         }
+
+        // Tell the peer our LZ77 window is smaller than the default so it can
+        // size its inflate window accordingly (RFC 7692 section 7.1.2.1).
+        if (isServer && serverMaxWindowBits < 15) {
+            extensionsOffer += "; server_max_window_bits=" + std::to_string(serverMaxWindowBits);
+        }
     }
 
     return extensionsOffer;

package/src/Extensions.h

@@ -18,8 +18,9 @@ template <bool isServer>
 class ExtensionsNegotiator {
 protected:
     int options;
+    int serverMaxWindowBits;
 public:
-    ExtensionsNegotiator(int wantedOptions);
+    ExtensionsNegotiator(int wantedOptions, int serverMaxWindowBits = 15);
     std::string generateOffer();
     void readOffer(std::string offer);
     int getNegotiatedOptions();

package/src/Group.cpp

@@ -114,7 +114,7 @@ void Group<isServer>::removeWebSocket(WebSocket<isServer> *webSocket) {
 }
 
 template <bool isServer>
-Group<isServer>::Group(int extensionOptions, unsigned int maxPayload, Hub *hub, cS::NodeData *nodeData) : cS::NodeData(*nodeData), maxPayload(maxPayload), hub(hub), extensionOptions(extensionOptions) {
+Group<isServer>::Group(int extensionOptions, unsigned int maxPayload, Hub *hub, cS::NodeData *nodeData, int deflateWindowBits, int deflateMemLevel, int deflateLevel) : cS::NodeData(*nodeData), maxPayload(maxPayload), hub(hub), extensionOptions(extensionOptions), deflateWindowBits(deflateWindowBits), deflateMemLevel(deflateMemLevel), deflateLevel(deflateLevel) {
     connectionHandler = [](WebSocket<isServer> *, HttpRequest) {};
     transferHandler = [](WebSocket<isServer> *) {};
     messageHandler = [](WebSocket<isServer> *, char *, size_t, OpCode) {};