@invisibleloop/pulse 0.21.6 → 0.22.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@invisibleloop/pulse",
-  "version": "0.21.6",
+  "version": "0.22.0",
   "type": "module",
   "description": "AI-first frontend framework. The spec is the source of truth.",
   "license": "MIT",

package/public/.pulse-ui-version

@@ -1 +1 @@
-0.21.6
+0.22.0

package/src/agent/guide-server.md

@@ -295,7 +295,7 @@ await ctx.formData()  // URL-encoded body → plain object | null — NOT a Form
 await ctx.buffer()    // raw Buffer
 ```
 
-Bodies larger than `maxBody` (default 1 MB, configurable in `createServer`) are rejected with a 413 response before the handler runs.
+Bodies larger than the limit are rejected with a 413 when the handler reads them. The limit is `maxBody` in `createServer` (default 1 MB); set `maxBody` on a spec to override it for that route only, e.g. `maxBody: 6 * 1024 * 1024` on an image-upload route. Prefer a per-route limit to raising the global one, and authenticate in `guard` first: the framework reads the body only after the guard runs (unless your guard reads it itself), so an unauthenticated caller never gets the larger buffer. A `submit` route with CSRF is the exception to rely on: the body is read before the CSRF check, so give a public form only the limit it needs.
 
 **`ctx.formData()` returns a plain object, not a browser `FormData`.** Read fields directly — `data?.email`, not `data.get('email')` — the latter throws `TypeError: data.get is not a function`. This trips people up because client-side action code (`actions.*.run(state, serverState, formData)`) receives a real `FormData` object with a `.get()` method — same method name, different context, different shape. If you're writing `spec.submit` and reach for `.get()`, that's the tell you've copied the client-side pattern by mistake.
 

package/src/server/index.js

@@ -1054,7 +1054,7 @@ export async function createServer(entries, options = {}) {
       const nonce = crypto.randomBytes(16).toString('base64url')
 
       // Build request context passed to guard, server data fetchers, and render
-      const ctx  = buildContext(req, url, match.params, nonce, maxBody)
+      const ctx  = buildContext(req, url, match.params, nonce, match.spec.maxBody ?? maxBody)
 
       // Brand resolution — attach ctx.brand before guard or server data runs
       if (resolveBrand) {
@@ -1793,13 +1793,14 @@ function buildContext(req, url, params, nonce = '', maxBody = 1024 * 1024) {
   function _readBody() {
     if (_bodyPromise) return _bodyPromise
     _bodyPromise = new Promise((resolve, reject) => {
+      const tooLarge = () => reject(Object.assign(new Error(`Request body exceeds ${maxBody} bytes`), { status: 413 }))
+      // An honest Content-Length over the limit is refused without reading the body.
+      if (Number(req.headers['content-length']) > maxBody) return tooLarge()
       const chunks = []
       let size = 0
       req.on('data', chunk => {
         size += chunk.length
-        if (size > maxBody) {
-          return reject(Object.assign(new Error(`Request body exceeds ${maxBody} bytes`), { status: 413 }))
-        }
+        if (size > maxBody) { chunks.length = 0; return tooLarge() }
         chunks.push(chunk)
       })
       req.on('end',   () => resolve(Buffer.concat(chunks)))

package/src/spec/schema.js

@@ -384,6 +384,13 @@ export function validateSpec(spec) {
     }
   }
 
+  // maxBody — per-route request body limit in bytes
+  if (spec.maxBody !== undefined) {
+    if (!Number.isFinite(spec.maxBody) || spec.maxBody <= 0) {
+      errors.push('spec.maxBody must be a positive number (bytes)')
+    }
+  }
+
   // guard — per-route authorization check
   if (spec.guard !== undefined) {
     if (typeof spec.guard !== 'function') {

package/types/schema.d.ts

@@ -253,6 +253,9 @@ export interface PulseSpec<S extends object = Record<string, unknown>> {
   /** Timeout in ms for all server fetchers on this page. Overrides createServer fetcherTimeout. */
   serverTimeout?: number
 
+  /** Request body limit in bytes for this route. Overrides createServer maxBody (default 1 MB), up or down. */
+  maxBody?: number
+
   /**
    * Fallback renderer called when view() throws at runtime.
    * Return an HTML string to display instead of the default error message.