@fonderie/core 0.8.0 → 0.10.0

package/brain/signatures.md

@@ -136,6 +136,8 @@ new FonderieApp(config: FonderieConfig): FonderieApp
   .addRoute(method: string, path: string, ...handlers: Middleware[]): void
   .handle(request: Request): Promise<Response>
 
+const DEFAULT_MAX_BODY_BYTES: number
+
 function defineConfig(config: FonderieConfig): FonderieConfig
 
 function compose(middlewares: Middleware[]): (ctx: IFonderieContext, fallback: () => Promise<Response>) => Promise<Response>
@@ -159,7 +161,9 @@ interface FonderieConfig {
     skipProductionReadinessGate?: boolean;
     healthChecks?: boolean;
     readyProbe?: () => boolean | Promise<boolean>;
+    exposeReadyzDetails?: boolean;
     metrics?: boolean;
+    maxBodyBytes?: number;
     onError?: (err: unknown) => Response;
     onResponse?: (body: unknown, info: {
         status: number;
@@ -197,7 +201,7 @@ interface IApiError {
 
 type HttpStatus = (typeof HTTP)[keyof typeof HTTP];
 
-const HTTP: { readonly OK: 200; readonly CREATED: 201; readonly ACCEPTED: 202; readonly NO_CONTENT: 204; readonly BAD_REQUEST: 400; readonly UNAUTHORIZED: 401; readonly PAYMENT_REQUIRED: 402; readonly FORBIDDEN: 403; readonly NOT_FOUND: 404; readonly CONFLICT: 409; readonly GONE: 410; readonly UNPROCESSABLE: 422; readonly TOO_MANY_REQUESTS: 429; readonly SERVER_ERROR: 500; readonly NOT_IMPLEMENTED: 501; readonly BAD_GATEWAY: 502; readonly SERVICE_UNAVAILABLE: 503; }
+const HTTP: { readonly OK: 200; readonly CREATED: 201; readonly ACCEPTED: 202; readonly NO_CONTENT: 204; readonly BAD_REQUEST: 400; readonly UNAUTHORIZED: 401; readonly PAYMENT_REQUIRED: 402; readonly FORBIDDEN: 403; readonly NOT_FOUND: 404; readonly CONFLICT: 409; readonly GONE: 410; readonly PAYLOAD_TOO_LARGE: 413; readonly UNPROCESSABLE: 422; readonly TOO_MANY_REQUESTS: 429; readonly SERVER_ERROR: 500; readonly NOT_IMPLEMENTED: 501; readonly BAD_GATEWAY: 502; readonly SERVICE_UNAVAILABLE: 503; }
 
 function setApiResponse<T>(status: number, reason: string, explanation: string, payload?: T | undefined): Response
 

package/dist/body-parser-dk4YTT5g.d.ts

@@ -0,0 +1,19 @@
+import { Middleware } from './types.js';
+
+/**
+ * Default cap on the request body the pipeline will buffer, in bytes (5 MiB).
+ * Enforced HERE, in the body parser, so EVERY entry point inherits it — the
+ * built-in listen() server, and all adapters' buildContext()/handle() paths.
+ * (An uncapped parser was a memory-exhaustion DoS on any adapter whose
+ * transport didn't add its own cap, e.g. adapter-hono on node-server.)
+ */
+declare const DEFAULT_MAX_BODY_BYTES: number;
+/**
+ * Build the body-parsing middleware with an explicit byte cap. The core app
+ * wires this with `config.maxBodyBytes`; the bare `withBody` export below
+ * keeps the default cap for direct users.
+ */
+declare function bodyParser(maxBytes?: number): Middleware;
+declare const withBody: Middleware;
+
+export { DEFAULT_MAX_BODY_BYTES as D, bodyParser as b, withBody as w };

package/dist/body-parser-hOh-q32S.d.cts

@@ -0,0 +1,19 @@
+import { Middleware } from './types.cjs';
+
+/**
+ * Default cap on the request body the pipeline will buffer, in bytes (5 MiB).
+ * Enforced HERE, in the body parser, so EVERY entry point inherits it — the
+ * built-in listen() server, and all adapters' buildContext()/handle() paths.
+ * (An uncapped parser was a memory-exhaustion DoS on any adapter whose
+ * transport didn't add its own cap, e.g. adapter-hono on node-server.)
+ */
+declare const DEFAULT_MAX_BODY_BYTES: number;
+/**
+ * Build the body-parsing middleware with an explicit byte cap. The core app
+ * wires this with `config.maxBodyBytes`; the bare `withBody` export below
+ * keeps the default cap for direct users.
+ */
+declare function bodyParser(maxBytes?: number): Middleware;
+declare const withBody: Middleware;
+
+export { DEFAULT_MAX_BODY_BYTES as D, bodyParser as b, withBody as w };

package/dist/config.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config.ts"],"sourcesContent":["export interface IBillingPlan {\n\tname: string;\n\tprice: number | null; // null = custom/enterprise pricing\n\tseats: number | 'unlimited';\n\tinterval?: 'month' | 'year';\n\ttrialDays?: number;\n}\n\nexport interface ISMTPConfig {\n\thost: string;\n\tport: number;\n\tsecure: boolean; // true = TLS, false = STARTTLS\n\tuser: string;\n\tpass: string;\n}\n\nexport interface FonderieConfig {\n\tbasePath?: string; // e.g. '/v1' — prefixes all routes; defaults to ''\n\n\tdb: {\n\t\turl: string; // Standard postgres:// connection string\n\t\t// Future: adapter pattern for other vendors\n\t\t// adapter?: 'pg' | 'mysql2' | 'oracledb'  ← v2 concern\n\t};\n\n\tbilling?: {\n\t\tprovider: 'stripe';\n\t\tplans: IBillingPlan[];\n\t\tstripeSecretKey: string;\n\t};\n\n\temail?: {\n\t\tfrom: string;\n\t\t// Credentials from their .env — Fonderie never stores these\n\t\tapiKey?: string;\n\t\tsmtp?: ISMTPConfig;\n\t\tprovider: 'resend' | 'ses' | 'smtp';\n\t};\n\n\t// Fail-closed production boot gate. In production, `boot()` refuses to start\n\t// when any registered module reports an `error`-severity readiness problem\n\t// (e.g. a weak signing secret, a missing at-rest encryption key). Set this to\n\t// true only to deliberately override the gate — not recommended. Outside\n\t// production the gate never runs.\n\tskipProductionReadinessGate?: boolean;\n\n\t// Built-in health endpoints, registered on boot (unprefixed by basePath):\n\t//   GET /healthz — liveness, always 200 while the process is up\n\t//   GET /readyz  — readiness, 200 when checkProductionReadiness() is ok AND\n\t//                  readyProbe() (if provided) resolves truthy, else 503\n\t// Set false to disable. Point your platform's probes at these.\n\thealthChecks?: boolean;\n\t// Optional dependency probe for /readyz — e.g. `() => store.testConnection()`.\n\t// Throwing or returning false makes /readyz report 503.\n\treadyProbe?: () => boolean | Promise<boolean>;\n\n\t// Enable Prometheus-format metrics: counts requests by status class and\n\t// serves them at GET /metrics (unprefixed). Off by default. Access to\n\t// /metrics should be restricted at your ingress/scraper.\n\tmetrics?: boolean;\n\n\tonError?: (err: unknown) => Response;\n\n\t// Transform every JSON response body just before it is sent. Return the new\n\t// body, or `undefined` to leave that response untouched. This is the single,\n\t// adapter-agnostic seam for adapting Fonderie's `{ reason, explanation, result }`\n\t// envelope to an app's own contract (e.g. flat shapes an existing frontend\n\t// expects) WITHOUT editing handlers. Applied at the one egress point, so it\n\t// covers every route and every adapter. Status code, headers, and cookies are\n\t// preserved; only the body shape changes. Non-JSON responses pass through.\n\t// Opt-in: unset = current behaviour, unchanged.\n\tonResponse?: (body: unknown, info: { status: number; request: Request }) => unknown;\n}\n\nexport function defineConfig(config: FonderieConfig): FonderieConfig {\n\treturn config; // typed identity — same pattern as defineConfig in Vite/Nuxt\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AA0EO,SAAS,aAAa,QAAwC;AACpE,SAAO;AACR;","names":[]}
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["export interface IBillingPlan {\n\tname: string;\n\tprice: number | null; // null = custom/enterprise pricing\n\tseats: number | 'unlimited';\n\tinterval?: 'month' | 'year';\n\ttrialDays?: number;\n}\n\nexport interface ISMTPConfig {\n\thost: string;\n\tport: number;\n\tsecure: boolean; // true = TLS, false = STARTTLS\n\tuser: string;\n\tpass: string;\n}\n\nexport interface FonderieConfig {\n\tbasePath?: string; // e.g. '/v1' — prefixes all routes; defaults to ''\n\n\tdb: {\n\t\turl: string; // Standard postgres:// connection string\n\t\t// Future: adapter pattern for other vendors\n\t\t// adapter?: 'pg' | 'mysql2' | 'oracledb'  ← v2 concern\n\t};\n\n\tbilling?: {\n\t\tprovider: 'stripe';\n\t\tplans: IBillingPlan[];\n\t\tstripeSecretKey: string;\n\t};\n\n\temail?: {\n\t\tfrom: string;\n\t\t// Credentials from their .env — Fonderie never stores these\n\t\tapiKey?: string;\n\t\tsmtp?: ISMTPConfig;\n\t\tprovider: 'resend' | 'ses' | 'smtp';\n\t};\n\n\t// Fail-closed production boot gate. In production, `boot()` refuses to start\n\t// when any registered module reports an `error`-severity readiness problem\n\t// (e.g. a weak signing secret, a missing at-rest encryption key). Set this to\n\t// true only to deliberately override the gate — not recommended. Outside\n\t// production the gate never runs.\n\tskipProductionReadinessGate?: boolean;\n\n\t// Built-in health endpoints, registered on boot (unprefixed by basePath):\n\t//   GET /healthz — liveness, always 200 while the process is up\n\t//   GET /readyz  — readiness, 200 when checkProductionReadiness() is ok AND\n\t//                  readyProbe() (if provided) resolves truthy, else 503\n\t// Set false to disable. Point your platform's probes at these.\n\thealthChecks?: boolean;\n\t// Optional dependency probe for /readyz — e.g. `() => store.testConnection()`.\n\t// Throwing or returning false makes /readyz report 503.\n\treadyProbe?: () => boolean | Promise<boolean>;\n\t// /readyz's `problems` list names weak secrets and placeholder tokens — a\n\t// security-posture map — so in production it is omitted unless this is\n\t// explicitly true. Probes only need the status code. Non-production always\n\t// includes details.\n\texposeReadyzDetails?: boolean;\n\n\t// Enable Prometheus-format metrics: counts requests by status class and\n\t// serves them at GET /metrics (unprefixed). Off by default. Access to\n\t// /metrics should be restricted at your ingress/scraper.\n\tmetrics?: boolean;\n\n\t// Cap on the request body the built-in `listen()` server will buffer, in\n\t// bytes. Defaults to 5 MiB (matching the adapters). Without a cap, an\n\t// unauthenticated request could stream an arbitrarily large body fully into\n\t// memory before any handler runs — a memory-exhaustion DoS. Oversize\n\t// requests get 413. Raise for large uploads (e.g. @fonderie/media images);\n\t// adapter deployments configure this on the adapter instead.\n\tmaxBodyBytes?: number;\n\n\tonError?: (err: unknown) => Response;\n\n\t// Transform every JSON response body just before it is sent. Return the new\n\t// body, or `undefined` to leave that response untouched. This is the single,\n\t// adapter-agnostic seam for adapting Fonderie's `{ reason, explanation, result }`\n\t// envelope to an app's own contract (e.g. flat shapes an existing frontend\n\t// expects) WITHOUT editing handlers. Applied at the one egress point, so it\n\t// covers every route and every adapter. Status code, headers, and cookies are\n\t// preserved; only the body shape changes. Non-JSON responses pass through.\n\t// Opt-in: unset = current behaviour, unchanged.\n\tonResponse?: (body: unknown, info: { status: number; request: Request }) => unknown;\n}\n\nexport function defineConfig(config: FonderieConfig): FonderieConfig {\n\treturn config; // typed identity — same pattern as defineConfig in Vite/Nuxt\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAuFO,SAAS,aAAa,QAAwC;AACpE,SAAO;AACR;","names":[]}

package/dist/config.d.cts

@@ -31,7 +31,9 @@ interface FonderieConfig {
     skipProductionReadinessGate?: boolean;
     healthChecks?: boolean;
     readyProbe?: () => boolean | Promise<boolean>;
+    exposeReadyzDetails?: boolean;
     metrics?: boolean;
+    maxBodyBytes?: number;
     onError?: (err: unknown) => Response;
     onResponse?: (body: unknown, info: {
         status: number;

package/dist/config.d.ts

@@ -31,7 +31,9 @@ interface FonderieConfig {
     skipProductionReadinessGate?: boolean;
     healthChecks?: boolean;
     readyProbe?: () => boolean | Promise<boolean>;
+    exposeReadyzDetails?: boolean;
     metrics?: boolean;
+    maxBodyBytes?: number;
     onError?: (err: unknown) => Response;
     onResponse?: (body: unknown, info: {
         status: number;

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config.ts"],"sourcesContent":["export interface IBillingPlan {\n\tname: string;\n\tprice: number | null; // null = custom/enterprise pricing\n\tseats: number | 'unlimited';\n\tinterval?: 'month' | 'year';\n\ttrialDays?: number;\n}\n\nexport interface ISMTPConfig {\n\thost: string;\n\tport: number;\n\tsecure: boolean; // true = TLS, false = STARTTLS\n\tuser: string;\n\tpass: string;\n}\n\nexport interface FonderieConfig {\n\tbasePath?: string; // e.g. '/v1' — prefixes all routes; defaults to ''\n\n\tdb: {\n\t\turl: string; // Standard postgres:// connection string\n\t\t// Future: adapter pattern for other vendors\n\t\t// adapter?: 'pg' | 'mysql2' | 'oracledb'  ← v2 concern\n\t};\n\n\tbilling?: {\n\t\tprovider: 'stripe';\n\t\tplans: IBillingPlan[];\n\t\tstripeSecretKey: string;\n\t};\n\n\temail?: {\n\t\tfrom: string;\n\t\t// Credentials from their .env — Fonderie never stores these\n\t\tapiKey?: string;\n\t\tsmtp?: ISMTPConfig;\n\t\tprovider: 'resend' | 'ses' | 'smtp';\n\t};\n\n\t// Fail-closed production boot gate. In production, `boot()` refuses to start\n\t// when any registered module reports an `error`-severity readiness problem\n\t// (e.g. a weak signing secret, a missing at-rest encryption key). Set this to\n\t// true only to deliberately override the gate — not recommended. Outside\n\t// production the gate never runs.\n\tskipProductionReadinessGate?: boolean;\n\n\t// Built-in health endpoints, registered on boot (unprefixed by basePath):\n\t//   GET /healthz — liveness, always 200 while the process is up\n\t//   GET /readyz  — readiness, 200 when checkProductionReadiness() is ok AND\n\t//                  readyProbe() (if provided) resolves truthy, else 503\n\t// Set false to disable. Point your platform's probes at these.\n\thealthChecks?: boolean;\n\t// Optional dependency probe for /readyz — e.g. `() => store.testConnection()`.\n\t// Throwing or returning false makes /readyz report 503.\n\treadyProbe?: () => boolean | Promise<boolean>;\n\n\t// Enable Prometheus-format metrics: counts requests by status class and\n\t// serves them at GET /metrics (unprefixed). Off by default. Access to\n\t// /metrics should be restricted at your ingress/scraper.\n\tmetrics?: boolean;\n\n\tonError?: (err: unknown) => Response;\n\n\t// Transform every JSON response body just before it is sent. Return the new\n\t// body, or `undefined` to leave that response untouched. This is the single,\n\t// adapter-agnostic seam for adapting Fonderie's `{ reason, explanation, result }`\n\t// envelope to an app's own contract (e.g. flat shapes an existing frontend\n\t// expects) WITHOUT editing handlers. Applied at the one egress point, so it\n\t// covers every route and every adapter. Status code, headers, and cookies are\n\t// preserved; only the body shape changes. Non-JSON responses pass through.\n\t// Opt-in: unset = current behaviour, unchanged.\n\tonResponse?: (body: unknown, info: { status: number; request: Request }) => unknown;\n}\n\nexport function defineConfig(config: FonderieConfig): FonderieConfig {\n\treturn config; // typed identity — same pattern as defineConfig in Vite/Nuxt\n}\n"],"mappings":";AA0EO,SAAS,aAAa,QAAwC;AACpE,SAAO;AACR;","names":[]}
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["export interface IBillingPlan {\n\tname: string;\n\tprice: number | null; // null = custom/enterprise pricing\n\tseats: number | 'unlimited';\n\tinterval?: 'month' | 'year';\n\ttrialDays?: number;\n}\n\nexport interface ISMTPConfig {\n\thost: string;\n\tport: number;\n\tsecure: boolean; // true = TLS, false = STARTTLS\n\tuser: string;\n\tpass: string;\n}\n\nexport interface FonderieConfig {\n\tbasePath?: string; // e.g. '/v1' — prefixes all routes; defaults to ''\n\n\tdb: {\n\t\turl: string; // Standard postgres:// connection string\n\t\t// Future: adapter pattern for other vendors\n\t\t// adapter?: 'pg' | 'mysql2' | 'oracledb'  ← v2 concern\n\t};\n\n\tbilling?: {\n\t\tprovider: 'stripe';\n\t\tplans: IBillingPlan[];\n\t\tstripeSecretKey: string;\n\t};\n\n\temail?: {\n\t\tfrom: string;\n\t\t// Credentials from their .env — Fonderie never stores these\n\t\tapiKey?: string;\n\t\tsmtp?: ISMTPConfig;\n\t\tprovider: 'resend' | 'ses' | 'smtp';\n\t};\n\n\t// Fail-closed production boot gate. In production, `boot()` refuses to start\n\t// when any registered module reports an `error`-severity readiness problem\n\t// (e.g. a weak signing secret, a missing at-rest encryption key). Set this to\n\t// true only to deliberately override the gate — not recommended. Outside\n\t// production the gate never runs.\n\tskipProductionReadinessGate?: boolean;\n\n\t// Built-in health endpoints, registered on boot (unprefixed by basePath):\n\t//   GET /healthz — liveness, always 200 while the process is up\n\t//   GET /readyz  — readiness, 200 when checkProductionReadiness() is ok AND\n\t//                  readyProbe() (if provided) resolves truthy, else 503\n\t// Set false to disable. Point your platform's probes at these.\n\thealthChecks?: boolean;\n\t// Optional dependency probe for /readyz — e.g. `() => store.testConnection()`.\n\t// Throwing or returning false makes /readyz report 503.\n\treadyProbe?: () => boolean | Promise<boolean>;\n\t// /readyz's `problems` list names weak secrets and placeholder tokens — a\n\t// security-posture map — so in production it is omitted unless this is\n\t// explicitly true. Probes only need the status code. Non-production always\n\t// includes details.\n\texposeReadyzDetails?: boolean;\n\n\t// Enable Prometheus-format metrics: counts requests by status class and\n\t// serves them at GET /metrics (unprefixed). Off by default. Access to\n\t// /metrics should be restricted at your ingress/scraper.\n\tmetrics?: boolean;\n\n\t// Cap on the request body the built-in `listen()` server will buffer, in\n\t// bytes. Defaults to 5 MiB (matching the adapters). Without a cap, an\n\t// unauthenticated request could stream an arbitrarily large body fully into\n\t// memory before any handler runs — a memory-exhaustion DoS. Oversize\n\t// requests get 413. Raise for large uploads (e.g. @fonderie/media images);\n\t// adapter deployments configure this on the adapter instead.\n\tmaxBodyBytes?: number;\n\n\tonError?: (err: unknown) => Response;\n\n\t// Transform every JSON response body just before it is sent. Return the new\n\t// body, or `undefined` to leave that response untouched. This is the single,\n\t// adapter-agnostic seam for adapting Fonderie's `{ reason, explanation, result }`\n\t// envelope to an app's own contract (e.g. flat shapes an existing frontend\n\t// expects) WITHOUT editing handlers. Applied at the one egress point, so it\n\t// covers every route and every adapter. Status code, headers, and cookies are\n\t// preserved; only the body shape changes. Non-JSON responses pass through.\n\t// Opt-in: unset = current behaviour, unchanged.\n\tonResponse?: (body: unknown, info: { status: number; request: Request }) => unknown;\n}\n\nexport function defineConfig(config: FonderieConfig): FonderieConfig {\n\treturn config; // typed identity — same pattern as defineConfig in Vite/Nuxt\n}\n"],"mappings":";AAuFO,SAAS,aAAa,QAAwC;AACpE,SAAO;AACR;","names":[]}

package/dist/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  DEFAULT_MAX_BODY_BYTES: () => DEFAULT_MAX_BODY_BYTES,
   FonderieApp: () => FonderieApp,
   HTTP: () => HTTP,
   MIN_SECRET_LENGTH: () => MIN_SECRET_LENGTH,
@@ -133,6 +134,7 @@ var HTTP = {
   NOT_FOUND: 404,
   CONFLICT: 409,
   GONE: 410,
+  PAYLOAD_TOO_LARGE: 413,
   UNPROCESSABLE: 422,
   TOO_MANY_REQUESTS: 429,
   SERVER_ERROR: 500,
@@ -154,25 +156,75 @@ function notFoundMiddleware() {
 }
 
 // src/middlewares/body-parser.ts
-var withBody = async (ctx, next) => {
-  const method = ctx.request.method.toUpperCase();
-  if (method === "GET" || method === "HEAD") {
-    return next();
+var DEFAULT_MAX_BODY_BYTES = 5 * 1024 * 1024;
+var PayloadTooLargeError = class extends Error {
+  fonderiePayloadTooLarge = true;
+};
+async function readTextCapped(req, maxBytes) {
+  const declared = Number(req.headers.get("content-length"));
+  if (Number.isFinite(declared) && declared > maxBytes) {
+    throw new PayloadTooLargeError();
   }
-  const ct = ctx.request.headers.get("content-type") ?? "";
-  try {
-    if (ct.includes("application/json")) {
-      const text = (await ctx.request.clone().text()).trim();
-      ctx.meta.body = text ? JSON.parse(text) : {};
-    } else if (ct.includes("application/x-www-form-urlencoded")) {
-      const text = await ctx.request.clone().text();
-      ctx.meta.body = Object.fromEntries(new URLSearchParams(text));
+  if (!req.body) return null;
+  const reader = req.body.getReader();
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > maxBytes) {
+      await reader.cancel().catch(() => void 0);
+      throw new PayloadTooLargeError();
     }
-  } catch {
-    return setApiResponse(HTTP.BAD_REQUEST, "INVALID_REQUEST", "Invalid request body");
+    chunks.push(value);
   }
-  return next();
-};
+  const merged = new Uint8Array(total);
+  let offset = 0;
+  for (const c of chunks) {
+    merged.set(c, offset);
+    offset += c.byteLength;
+  }
+  return new TextDecoder().decode(merged);
+}
+function bodyParser(maxBytes = DEFAULT_MAX_BODY_BYTES) {
+  return async (ctx, next) => {
+    const method = ctx.request.method.toUpperCase();
+    if (method === "GET" || method === "HEAD") {
+      return next();
+    }
+    const ct = ctx.request.headers.get("content-type") ?? "";
+    try {
+      if (ct.includes("application/json") || ct.includes("application/x-www-form-urlencoded")) {
+        const raw = await readTextCapped(ctx.request, maxBytes);
+        if (raw !== null) {
+          ctx.request = new Request(ctx.request.url, {
+            method: ctx.request.method,
+            headers: ctx.request.headers,
+            body: raw.length > 0 ? raw : null
+          });
+        }
+        if (ct.includes("application/json")) {
+          const text = raw?.trim() ?? "";
+          ctx.meta.body = text ? JSON.parse(text) : {};
+        } else {
+          ctx.meta.body = Object.fromEntries(new URLSearchParams(raw ?? ""));
+        }
+      }
+    } catch (err) {
+      if (err?.fonderiePayloadTooLarge) {
+        return setApiResponse(
+          HTTP.PAYLOAD_TOO_LARGE,
+          "PAYLOAD_TOO_LARGE",
+          "Request body too large"
+        );
+      }
+      return setApiResponse(HTTP.BAD_REQUEST, "INVALID_REQUEST", "Invalid request body");
+    }
+    return next();
+  };
+}
+var withBody = bodyParser();
 
 // src/middlewares/security-headers.ts
 function withSecurityHeaders(options = {}) {
@@ -268,6 +320,14 @@ function withMetrics(registry) {
 }
 
 // src/app.ts
+var PayloadTooLargeError2 = class extends Error {
+  fonderiePayloadTooLarge = true;
+};
+function payloadTooLarge(res) {
+  res.statusCode = 413;
+  res.setHeader("content-type", "application/json");
+  res.end(JSON.stringify({ reason: "PAYLOAD_TOO_LARGE", explanation: "Request body too large" }));
+}
 var FonderieApp = class {
   config;
   prefix;
@@ -278,7 +338,7 @@ var FonderieApp = class {
   constructor(config) {
     this.config = config;
     this.prefix = (config.basePath ?? "").replace(/\/$/, "");
-    this.middlewares = [withBody, withSecurityHeaders()];
+    this.middlewares = [bodyParser(config.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES), withSecurityHeaders()];
     if (config.metrics) this.middlewares.push(withMetrics(this.metrics));
   }
   listen(port, options = {}) {
@@ -288,41 +348,81 @@ var FonderieApp = class {
       env = process.env["NODE_ENV"] ?? "development",
       quiet = false
     } = options;
+    const maxBodyBytes = this.config.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
     const server = (0, import_node_http.createServer)(async (req, res) => {
-      const host = req.headers.host ?? "localhost";
-      const url = `http://${host}${req.url ?? "/"}`;
-      const headers = new Headers();
-      for (const [key, value] of Object.entries(req.headers)) {
-        if (!value) {
-          continue;
+      try {
+        const host = req.headers.host ?? "localhost";
+        const url = `http://${host}${req.url ?? "/"}`;
+        const headers = new Headers();
+        for (const [key, value] of Object.entries(req.headers)) {
+          if (!value) {
+            continue;
+          }
+          if (Array.isArray(value)) {
+            for (const v of value) headers.append(key, v);
+          } else {
+            headers.set(key, value);
+          }
         }
-        if (Array.isArray(value)) {
-          for (const v of value) headers.append(key, v);
-        } else {
-          headers.set(key, value);
+        const method = req.method ?? "GET";
+        const hasBody = !["GET", "HEAD"].includes(method.toUpperCase());
+        const declared = Number(req.headers["content-length"]);
+        if (hasBody && Number.isFinite(declared) && declared > maxBodyBytes) {
+          payloadTooLarge(res);
+          res.once("close", () => req.destroy());
+          return;
+        }
+        let body;
+        try {
+          body = await new Promise((resolve, reject) => {
+            const chunks = [];
+            let total = 0;
+            req.on("data", (chunk) => {
+              total += chunk.length;
+              if (total > maxBodyBytes) {
+                reject(new PayloadTooLargeError2());
+                req.destroy();
+                return;
+              }
+              chunks.push(chunk);
+            });
+            req.on("end", () => resolve(Buffer.concat(chunks)));
+            req.on("error", reject);
+          });
+        } catch (err) {
+          if (err instanceof PayloadTooLargeError2) {
+            payloadTooLarge(res);
+            return;
+          }
+          res.statusCode = 400;
+          res.end();
+          return;
+        }
+        const request = new Request(url, {
+          method,
+          headers,
+          body: hasBody && body.length > 0 ? new Uint8Array(body) : null
+        });
+        const response = await this.handle(request);
+        res.statusCode = response.status;
+        const setCookies = response.headers.getSetCookie?.() ?? [];
+        if (setCookies.length) res.setHeader("Set-Cookie", setCookies);
+        response.headers.forEach((v, k) => {
+          if (k.toLowerCase() !== "set-cookie") res.setHeader(k, v);
+        });
+        res.end(Buffer.from(await response.arrayBuffer()));
+      } catch (err) {
+        console.error("[fonderie] request handling failed:", err?.message);
+        try {
+          if (!res.headersSent) {
+            res.statusCode = 400;
+            res.setHeader("content-type", "application/json");
+          }
+          res.end(JSON.stringify({ reason: "BAD_REQUEST", explanation: "Malformed request" }));
+        } catch {
+          req.destroy();
         }
       }
-      const body = await new Promise((resolve, reject) => {
-        const chunks = [];
-        req.on("data", (chunk) => chunks.push(chunk));
-        req.on("end", () => resolve(Buffer.concat(chunks)));
-        req.on("error", reject);
-      });
-      const method = req.method ?? "GET";
-      const hasBody = !["GET", "HEAD"].includes(method.toUpperCase());
-      const request = new Request(url, {
-        method,
-        headers,
-        body: hasBody && body.length > 0 ? new Uint8Array(body) : null
-      });
-      const response = await this.handle(request);
-      res.statusCode = response.status;
-      const setCookies = response.headers.getSetCookie?.() ?? [];
-      if (setCookies.length) res.setHeader("Set-Cookie", setCookies);
-      response.headers.forEach((v, k) => {
-        if (k.toLowerCase() !== "set-cookie") res.setHeader(k, v);
-      });
-      res.end(Buffer.from(await response.arrayBuffer()));
     }).listen(port, () => {
       if (quiet) return;
       const ip = getLocalIPv4();
@@ -405,8 +505,13 @@ var FonderieApp = class {
             }
           }
           const ready = report.ok && dependencies;
+          const exposeDetails = process.env["NODE_ENV"] !== "production" || this.config.exposeReadyzDetails === true;
           return Response.json(
-            { status: ready ? "ready" : "not_ready", dependencies, problems: report.problems },
+            {
+              status: ready ? "ready" : "not_ready",
+              dependencies,
+              ...exposeDetails ? { problems: report.problems } : {}
+            },
             { status: ready ? 200 : 503 }
           );
         }
@@ -579,6 +684,7 @@ function decodeKeysetCursor(cursor) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  DEFAULT_MAX_BODY_BYTES,
   FonderieApp,
   HTTP,
   MIN_SECRET_LENGTH,