@jaypie/express 1.2.4-rc1 → 1.2.4-rc11

package/dist/cjs/index.cjs

@@ -1,6 +1,7 @@
 'use strict';
 
 var node_stream = require('node:stream');
+var node_http = require('node:http');
 var errors = require('@jaypie/errors');
 var kit = require('@jaypie/kit');
 var expressCors = require('cors');
@@ -161,6 +162,10 @@ function createLambdaRequest(event, context) {
 //
 // Constants
 //
+// Get Node's internal kOutHeaders symbol from ServerResponse prototype.
+// This is needed for compatibility with Datadog dd-trace instrumentation,
+// which patches HTTP methods and expects this internal state to exist.
+const kOutHeaders$1 = Object.getOwnPropertySymbols(node_http.ServerResponse.prototype).find((s) => s.toString() === "Symbol(kOutHeaders)");
 const BINARY_CONTENT_TYPE_PATTERNS = [
     /^application\/octet-stream$/,
     /^application\/pdf$/,
@@ -187,10 +192,53 @@ class LambdaResponseBuffered extends node_stream.Writable {
         this.socket = {
             remoteAddress: "127.0.0.1",
         };
+        // Internal state exposed for direct manipulation by safe response methods
+        // that need to bypass dd-trace interception of stream methods
         this._chunks = [];
         this._headers = new Map();
         this._headersSent = false;
         this._resolve = null;
+        // Initialize Node's internal kOutHeaders for dd-trace compatibility.
+        // dd-trace patches HTTP methods and expects this internal state.
+        if (kOutHeaders$1) {
+            this[kOutHeaders$1] = Object.create(null);
+        }
+    }
+    //
+    // Internal bypass methods - completely avoid prototype chain lookup
+    // These directly access _headers Map, safe from dd-trace interception
+    //
+    _internalGetHeader(name) {
+        const value = this._headers.get(name.toLowerCase());
+        return value ? String(value) : undefined;
+    }
+    _internalSetHeader(name, value) {
+        if (!this._headersSent) {
+            const lowerName = name.toLowerCase();
+            this._headers.set(lowerName, value);
+            // Also sync kOutHeaders for any code that expects it
+            if (kOutHeaders$1) {
+                const outHeaders = this[kOutHeaders$1];
+                if (outHeaders) {
+                    outHeaders[lowerName] = [name, value];
+                }
+            }
+        }
+    }
+    _internalHasHeader(name) {
+        return this._headers.has(name.toLowerCase());
+    }
+    _internalRemoveHeader(name) {
+        if (!this._headersSent) {
+            const lowerName = name.toLowerCase();
+            this._headers.delete(lowerName);
+            if (kOutHeaders$1) {
+                const outHeaders = this[kOutHeaders$1];
+                if (outHeaders) {
+                    delete outHeaders[lowerName];
+                }
+            }
+        }
     }
     //
     // Promise-based API for getting final result
@@ -213,14 +261,31 @@ class LambdaResponseBuffered extends node_stream.Writable {
             // In production, log warning but don't throw to match Express behavior
             return this;
         }
-        this._headers.set(name.toLowerCase(), String(value));
+        const lowerName = name.toLowerCase();
+        this._headers.set(lowerName, String(value));
+        // Sync with kOutHeaders for dd-trace compatibility
+        // Node stores as { 'header-name': ['Header-Name', value] }
+        if (kOutHeaders$1) {
+            const outHeaders = this[kOutHeaders$1];
+            if (outHeaders) {
+                outHeaders[lowerName] = [name, String(value)];
+            }
+        }
         return this;
     }
     getHeader(name) {
         return this._headers.get(name.toLowerCase());
     }
     removeHeader(name) {
-        this._headers.delete(name.toLowerCase());
+        const lowerName = name.toLowerCase();
+        this._headers.delete(lowerName);
+        // Sync with kOutHeaders for dd-trace compatibility
+        if (kOutHeaders$1) {
+            const outHeaders = this[kOutHeaders$1];
+            if (outHeaders) {
+                delete outHeaders[lowerName];
+            }
+        }
     }
     getHeaders() {
         const headers = {};
@@ -235,6 +300,43 @@ class LambdaResponseBuffered extends node_stream.Writable {
     getHeaderNames() {
         return Array.from(this._headers.keys());
     }
+    /**
+     * Proxy for direct header access (e.g., res.headers['content-type']).
+     * Required for compatibility with middleware like helmet that access headers directly.
+     */
+    get headers() {
+        return new Proxy({}, {
+            deleteProperty: (_target, prop) => {
+                this.removeHeader(String(prop));
+                return true;
+            },
+            get: (_target, prop) => {
+                if (typeof prop === "symbol")
+                    return undefined;
+                return this.getHeader(String(prop));
+            },
+            getOwnPropertyDescriptor: (_target, prop) => {
+                if (this.hasHeader(String(prop))) {
+                    return {
+                        configurable: true,
+                        enumerable: true,
+                        value: this.getHeader(String(prop)),
+                    };
+                }
+                return undefined;
+            },
+            has: (_target, prop) => {
+                return this.hasHeader(String(prop));
+            },
+            ownKeys: () => {
+                return this.getHeaderNames();
+            },
+            set: (_target, prop, value) => {
+                this.setHeader(String(prop), value);
+                return true;
+            },
+        });
+    }
     writeHead(statusCode, statusMessageOrHeaders, headers) {
         this.statusCode = statusCode;
         let headersToSet;
@@ -262,6 +364,25 @@ class LambdaResponseBuffered extends node_stream.Writable {
     //
     // Express compatibility methods
     //
+    /**
+     * Express-style alias for getHeader().
+     * Used by middleware like decorateResponse that use res.get().
+     * Note: Directly accesses _headers to avoid prototype chain issues with bundled code.
+     */
+    get(name) {
+        return this._headers.get(name.toLowerCase());
+    }
+    /**
+     * Express-style alias for setHeader().
+     * Used by middleware like decorateResponse that use res.set().
+     * Note: Directly accesses _headers to avoid prototype chain issues with bundled code.
+     */
+    set(name, value) {
+        if (!this._headersSent) {
+            this._headers.set(name.toLowerCase(), String(value));
+        }
+        return this;
+    }
     status(code) {
         this.statusCode = code;
         return this;
@@ -278,6 +399,26 @@ class LambdaResponseBuffered extends node_stream.Writable {
         this.end(body);
         return this;
     }
+    /**
+     * Add a field to the Vary response header.
+     * Used by CORS middleware to indicate response varies by Origin.
+     */
+    vary(field) {
+        const existing = this.getHeader("vary");
+        if (!existing) {
+            this.setHeader("vary", field);
+        }
+        else {
+            // Append to existing Vary header if field not already present
+            const fields = String(existing)
+                .split(",")
+                .map((f) => f.trim().toLowerCase());
+            if (!fields.includes(field.toLowerCase())) {
+                this.setHeader("vary", `${existing}, ${field}`);
+            }
+        }
+        return this;
+    }
     //
     // Writable stream implementation
     //
@@ -301,7 +442,8 @@ class LambdaResponseBuffered extends node_stream.Writable {
     //
     buildResult() {
         const body = Buffer.concat(this._chunks);
-        const contentType = this.getHeader("content-type") || "";
+        // Use direct _headers access to bypass dd-trace interception
+        const contentType = this._headers.get("content-type") || "";
         // Determine if response should be base64 encoded
         const isBase64Encoded = this.isBinaryContentType(contentType);
         // Build headers object
@@ -338,6 +480,14 @@ class LambdaResponseBuffered extends node_stream.Writable {
     }
 }
 
+//
+//
+// Constants
+//
+// Get Node's internal kOutHeaders symbol from ServerResponse prototype.
+// This is needed for compatibility with Datadog dd-trace instrumentation,
+// which patches HTTP methods and expects this internal state to exist.
+const kOutHeaders = Object.getOwnPropertySymbols(node_http.ServerResponse.prototype).find((s) => s.toString() === "Symbol(kOutHeaders)");
 //
 //
 // LambdaResponseStreaming Class
@@ -355,11 +505,54 @@ class LambdaResponseStreaming extends node_stream.Writable {
         this.socket = {
             remoteAddress: "127.0.0.1",
         };
+        // Internal state exposed for direct manipulation by safe response methods
+        // that need to bypass dd-trace interception
         this._headers = new Map();
         this._headersSent = false;
         this._pendingWrites = [];
         this._wrappedStream = null;
         this._responseStream = responseStream;
+        // Initialize Node's internal kOutHeaders for dd-trace compatibility.
+        // dd-trace patches HTTP methods and expects this internal state.
+        if (kOutHeaders) {
+            this[kOutHeaders] = Object.create(null);
+        }
+    }
+    //
+    // Internal bypass methods - completely avoid prototype chain lookup
+    // These directly access _headers Map, safe from dd-trace interception
+    //
+    _internalGetHeader(name) {
+        const value = this._headers.get(name.toLowerCase());
+        return value ? String(value) : undefined;
+    }
+    _internalSetHeader(name, value) {
+        if (!this._headersSent) {
+            const lowerName = name.toLowerCase();
+            this._headers.set(lowerName, value);
+            // Also sync kOutHeaders for any code that expects it
+            if (kOutHeaders) {
+                const outHeaders = this[kOutHeaders];
+                if (outHeaders) {
+                    outHeaders[lowerName] = [name, value];
+                }
+            }
+        }
+    }
+    _internalHasHeader(name) {
+        return this._headers.has(name.toLowerCase());
+    }
+    _internalRemoveHeader(name) {
+        if (!this._headersSent) {
+            const lowerName = name.toLowerCase();
+            this._headers.delete(lowerName);
+            if (kOutHeaders) {
+                const outHeaders = this[kOutHeaders];
+                if (outHeaders) {
+                    delete outHeaders[lowerName];
+                }
+            }
+        }
     }
     //
     // Header management
@@ -370,7 +563,16 @@ class LambdaResponseStreaming extends node_stream.Writable {
             // Headers cannot be changed after body starts
             return this;
         }
-        this._headers.set(name.toLowerCase(), String(value));
+        const lowerName = name.toLowerCase();
+        this._headers.set(lowerName, String(value));
+        // Sync with kOutHeaders for dd-trace compatibility
+        // Node stores as { 'header-name': ['Header-Name', value] }
+        if (kOutHeaders) {
+            const outHeaders = this[kOutHeaders];
+            if (outHeaders) {
+                outHeaders[lowerName] = [name, String(value)];
+            }
+        }
         return this;
     }
     getHeader(name) {
@@ -378,7 +580,15 @@ class LambdaResponseStreaming extends node_stream.Writable {
     }
     removeHeader(name) {
         if (!this._headersSent) {
-            this._headers.delete(name.toLowerCase());
+            const lowerName = name.toLowerCase();
+            this._headers.delete(lowerName);
+            // Sync with kOutHeaders for dd-trace compatibility
+            if (kOutHeaders) {
+                const outHeaders = this[kOutHeaders];
+                if (outHeaders) {
+                    delete outHeaders[lowerName];
+                }
+            }
         }
     }
     getHeaders() {
@@ -394,6 +604,43 @@ class LambdaResponseStreaming extends node_stream.Writable {
     getHeaderNames() {
         return Array.from(this._headers.keys());
     }
+    /**
+     * Proxy for direct header access (e.g., res.headers['content-type']).
+     * Required for compatibility with middleware like helmet that access headers directly.
+     */
+    get headers() {
+        return new Proxy({}, {
+            deleteProperty: (_target, prop) => {
+                this.removeHeader(String(prop));
+                return true;
+            },
+            get: (_target, prop) => {
+                if (typeof prop === "symbol")
+                    return undefined;
+                return this.getHeader(String(prop));
+            },
+            getOwnPropertyDescriptor: (_target, prop) => {
+                if (this.hasHeader(String(prop))) {
+                    return {
+                        configurable: true,
+                        enumerable: true,
+                        value: this.getHeader(String(prop)),
+                    };
+                }
+                return undefined;
+            },
+            has: (_target, prop) => {
+                return this.hasHeader(String(prop));
+            },
+            ownKeys: () => {
+                return this.getHeaderNames();
+            },
+            set: (_target, prop, value) => {
+                this.setHeader(String(prop), value);
+                return true;
+            },
+        });
+    }
     writeHead(statusCode, statusMessageOrHeaders, headers) {
         if (this._headersSent) {
             return this;
@@ -445,6 +692,25 @@ class LambdaResponseStreaming extends node_stream.Writable {
     //
     // Express compatibility methods
     //
+    /**
+     * Express-style alias for getHeader().
+     * Used by middleware like decorateResponse that use res.get().
+     * Note: Directly accesses _headers to avoid prototype chain issues with bundled code.
+     */
+    get(name) {
+        return this._headers.get(name.toLowerCase());
+    }
+    /**
+     * Express-style alias for setHeader().
+     * Used by middleware like decorateResponse that use res.set().
+     * Note: Directly accesses _headers to avoid prototype chain issues with bundled code.
+     */
+    set(name, value) {
+        if (!this._headersSent) {
+            this._headers.set(name.toLowerCase(), String(value));
+        }
+        return this;
+    }
     status(code) {
         this.statusCode = code;
         return this;
@@ -461,6 +727,26 @@ class LambdaResponseStreaming extends node_stream.Writable {
         this.end(body);
         return this;
     }
+    /**
+     * Add a field to the Vary response header.
+     * Used by CORS middleware to indicate response varies by Origin.
+     */
+    vary(field) {
+        const existing = this.getHeader("vary");
+        if (!existing) {
+            this.setHeader("vary", field);
+        }
+        else {
+            // Append to existing Vary header if field not already present
+            const fields = String(existing)
+                .split(",")
+                .map((f) => f.trim().toLowerCase());
+            if (!fields.includes(field.toLowerCase())) {
+                this.setHeader("vary", `${existing}, ${field}`);
+            }
+        }
+        return this;
+    }
     //
     // Writable stream implementation
     //
@@ -917,6 +1203,73 @@ function getCurrentInvokeUuid(req) {
     return getWebAdapterUuid();
 }
 
+//
+//
+// Helpers
+//
+/**
+ * Safely get a header value from response.
+ * Handles both Express Response and Lambda adapter responses.
+ * Defensive against dd-trace instrumentation issues.
+ */
+function safeGetHeader(res, name) {
+    try {
+        // Try internal method first (completely bypasses dd-trace)
+        if (typeof res._internalGetHeader === "function") {
+            return res._internalGetHeader(name);
+        }
+        // Fall back to _headers Map access (Lambda adapter, avoids dd-trace)
+        if (res._headers instanceof Map) {
+            const value = res._headers.get(name.toLowerCase());
+            return value ? String(value) : undefined;
+        }
+        // Fall back to getHeader (more standard than get)
+        if (typeof res.getHeader === "function") {
+            const value = res.getHeader(name);
+            return value ? String(value) : undefined;
+        }
+        // Last resort: try get
+        if (typeof res.get === "function") {
+            const value = res.get(name);
+            return value ? String(value) : undefined;
+        }
+    }
+    catch {
+        // Silently fail - caller will handle missing value
+    }
+    return undefined;
+}
+/**
+ * Safely set a header value on response.
+ * Handles both Express Response and Lambda adapter responses.
+ * Defensive against dd-trace instrumentation issues.
+ */
+function safeSetHeader(res, name, value) {
+    try {
+        // Try internal method first (completely bypasses dd-trace)
+        if (typeof res._internalSetHeader === "function") {
+            res._internalSetHeader(name, value);
+            return;
+        }
+        // Fall back to _headers Map access (Lambda adapter, avoids dd-trace)
+        if (res._headers instanceof Map) {
+            res._headers.set(name.toLowerCase(), value);
+            return;
+        }
+        // Fall back to setHeader (more standard than set)
+        if (typeof res.setHeader === "function") {
+            res.setHeader(name, value);
+            return;
+        }
+        // Last resort: try set
+        if (typeof res.set === "function") {
+            res.set(name, value);
+        }
+    }
+    catch {
+        // Silently fail - header just won't be set
+    }
+}
 //
 //
 // Main
@@ -933,36 +1286,37 @@ const decorateResponse = (res, { handler = "", version = process.env.PROJECT_VER
         log.warn("decorateResponse called but response is not an object");
         return;
     }
+    const extRes = res;
     try {
         //
         //
         // Decorate Headers
         //
         // X-Powered-By, override "Express" but nothing else
-        if (!res.get(kit.HTTP.HEADER.POWERED_BY) ||
-            res.get(kit.HTTP.HEADER.POWERED_BY) === "Express") {
-            res.set(kit.HTTP.HEADER.POWERED_BY, kit.JAYPIE.LIB.EXPRESS);
+        const currentPoweredBy = safeGetHeader(extRes, kit.HTTP.HEADER.POWERED_BY);
+        if (!currentPoweredBy || currentPoweredBy === "Express") {
+            safeSetHeader(extRes, kit.HTTP.HEADER.POWERED_BY, kit.JAYPIE.LIB.EXPRESS);
         }
         // X-Project-Environment
         if (process.env.PROJECT_ENV) {
-            res.set(kit.HTTP.HEADER.PROJECT.ENVIRONMENT, process.env.PROJECT_ENV);
+            safeSetHeader(extRes, kit.HTTP.HEADER.PROJECT.ENVIRONMENT, process.env.PROJECT_ENV);
         }
         // X-Project-Handler
         if (handler) {
-            res.set(kit.HTTP.HEADER.PROJECT.HANDLER, handler);
+            safeSetHeader(extRes, kit.HTTP.HEADER.PROJECT.HANDLER, handler);
         }
         // X-Project-Invocation
         const currentInvoke = getCurrentInvokeUuid();
         if (currentInvoke) {
-            res.set(kit.HTTP.HEADER.PROJECT.INVOCATION, currentInvoke);
+            safeSetHeader(extRes, kit.HTTP.HEADER.PROJECT.INVOCATION, currentInvoke);
         }
         // X-Project-Key
         if (process.env.PROJECT_KEY) {
-            res.set(kit.HTTP.HEADER.PROJECT.KEY, process.env.PROJECT_KEY);
+            safeSetHeader(extRes, kit.HTTP.HEADER.PROJECT.KEY, process.env.PROJECT_KEY);
         }
         // X-Project-Version
         if (version) {
-            res.set(kit.HTTP.HEADER.PROJECT.VERSION, version);
+            safeSetHeader(extRes, kit.HTTP.HEADER.PROJECT.VERSION, version);
         }
         //
         //
@@ -1022,6 +1376,76 @@ function summarizeResponse(res, extras) {
 
 // Cast logger to extended interface for runtime features not in type definitions
 const logger$1 = logger$2.log;
+//
+//
+// Helpers - Safe response methods to bypass dd-trace interception
+//
+/**
+ * Check if response is a Lambda mock response with direct internal access.
+ */
+function isLambdaMockResponse(res) {
+    const mock = res;
+    return (mock._headers instanceof Map &&
+        Array.isArray(mock._chunks) &&
+        typeof mock.buildResult === "function");
+}
+/**
+ * Safely send a JSON response, avoiding dd-trace interception.
+ * For Lambda mock responses, directly manipulates internal state instead of
+ * using stream methods (write/end) which dd-trace intercepts.
+ */
+function safeSendJson(res, statusCode, data) {
+    if (isLambdaMockResponse(res)) {
+        // Use internal method to set header (completely bypasses dd-trace)
+        if (typeof res._internalSetHeader === "function") {
+            res._internalSetHeader("content-type", "application/json");
+        }
+        else {
+            // Fall back to direct _headers manipulation
+            res._headers.set("content-type", "application/json");
+        }
+        res.statusCode = statusCode;
+        // Directly push to chunks array instead of using stream write/end
+        const chunk = Buffer.from(JSON.stringify(data));
+        res._chunks.push(chunk);
+        res._headersSent = true;
+        // Signal completion if a promise is waiting
+        if (res._resolve) {
+            res._resolve(res.buildResult());
+        }
+        return;
+    }
+    // Fall back to standard Express methods for real responses
+    res.status(statusCode).json(data);
+}
+/**
+ * Safely send a response body, avoiding dd-trace interception.
+ * For Lambda mock responses, directly manipulates internal state instead of
+ * using stream methods (write/end) which dd-trace intercepts.
+ */
+function safeSend(res, statusCode, body) {
+    if (isLambdaMockResponse(res)) {
+        // Direct internal state manipulation - bypasses dd-trace completely
+        res.statusCode = statusCode;
+        if (body !== undefined) {
+            const chunk = Buffer.from(body);
+            res._chunks.push(chunk);
+        }
+        res._headersSent = true;
+        // Signal completion if a promise is waiting
+        if (res._resolve) {
+            res._resolve(res.buildResult());
+        }
+        return;
+    }
+    // Fall back to standard Express methods for real responses
+    if (body !== undefined) {
+        res.status(statusCode).send(body);
+    }
+    else {
+        res.status(statusCode).send();
+    }
+}
 function expressHandler(handlerOrOptions, optionsOrHandler) {
     /* eslint-enable no-redeclare */
     let handler;
@@ -1238,30 +1662,30 @@ function expressHandler(handlerOrOptions, optionsOrHandler) {
                     if (typeof response === "object") {
                         if (typeof response.json ===
                             "function") {
-                            res.json(response.json());
+                            safeSendJson(res, status, response.json());
                         }
                         else {
-                            res.status(status).json(response);
+                            safeSendJson(res, status, response);
                         }
                     }
                     else if (typeof response === "string") {
                         try {
-                            res.status(status).json(JSON.parse(response));
+                            safeSendJson(res, status, JSON.parse(response));
                         }
                         catch {
-                            res.status(status).send(response);
+                            safeSend(res, status, response);
                         }
                     }
                     else if (response === true) {
-                        res.status(kit.HTTP.CODE.CREATED).send();
+                        safeSend(res, kit.HTTP.CODE.CREATED);
                     }
                     else {
-                        res.status(status).send(response);
+                        safeSend(res, status, response);
                     }
                 }
                 else {
                     // No response
-                    res.status(kit.HTTP.CODE.NO_CONTENT).send();
+                    safeSend(res, kit.HTTP.CODE.NO_CONTENT);
                 }
             }
             else {