@jsenv/server 17.3.1 → 17.4.1

package/dist/formidable_index/jsenv_server_node_modules.js

@@ -297,41 +297,41 @@ var hasRequiredUtils;
 function requireUtils () {
 	if (hasRequiredUtils) return utils;
 	hasRequiredUtils = 1;
-	(function (exports$1) {
+	(function (exports) {
 		/**
 		 * Utilities for hex, bytes, CSPRNG.
 		 * @module
 		 */
 		/*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-		Object.defineProperty(exports$1, "__esModule", { value: true });
-		exports$1.wrapXOFConstructorWithOpts = exports$1.wrapConstructorWithOpts = exports$1.wrapConstructor = exports$1.Hash = exports$1.nextTick = exports$1.swap32IfBE = exports$1.byteSwapIfBE = exports$1.swap8IfBE = exports$1.isLE = void 0;
-		exports$1.isBytes = isBytes;
-		exports$1.anumber = anumber;
-		exports$1.abytes = abytes;
-		exports$1.ahash = ahash;
-		exports$1.aexists = aexists;
-		exports$1.aoutput = aoutput;
-		exports$1.u8 = u8;
-		exports$1.u32 = u32;
-		exports$1.clean = clean;
-		exports$1.createView = createView;
-		exports$1.rotr = rotr;
-		exports$1.rotl = rotl;
-		exports$1.byteSwap = byteSwap;
-		exports$1.byteSwap32 = byteSwap32;
-		exports$1.bytesToHex = bytesToHex;
-		exports$1.hexToBytes = hexToBytes;
-		exports$1.asyncLoop = asyncLoop;
-		exports$1.utf8ToBytes = utf8ToBytes;
-		exports$1.bytesToUtf8 = bytesToUtf8;
-		exports$1.toBytes = toBytes;
-		exports$1.kdfInputToBytes = kdfInputToBytes;
-		exports$1.concatBytes = concatBytes;
-		exports$1.checkOpts = checkOpts;
-		exports$1.createHasher = createHasher;
-		exports$1.createOptHasher = createOptHasher;
-		exports$1.createXOFer = createXOFer;
-		exports$1.randomBytes = randomBytes;
+		Object.defineProperty(exports, "__esModule", { value: true });
+		exports.wrapXOFConstructorWithOpts = exports.wrapConstructorWithOpts = exports.wrapConstructor = exports.Hash = exports.nextTick = exports.swap32IfBE = exports.byteSwapIfBE = exports.swap8IfBE = exports.isLE = void 0;
+		exports.isBytes = isBytes;
+		exports.anumber = anumber;
+		exports.abytes = abytes;
+		exports.ahash = ahash;
+		exports.aexists = aexists;
+		exports.aoutput = aoutput;
+		exports.u8 = u8;
+		exports.u32 = u32;
+		exports.clean = clean;
+		exports.createView = createView;
+		exports.rotr = rotr;
+		exports.rotl = rotl;
+		exports.byteSwap = byteSwap;
+		exports.byteSwap32 = byteSwap32;
+		exports.bytesToHex = bytesToHex;
+		exports.hexToBytes = hexToBytes;
+		exports.asyncLoop = asyncLoop;
+		exports.utf8ToBytes = utf8ToBytes;
+		exports.bytesToUtf8 = bytesToUtf8;
+		exports.toBytes = toBytes;
+		exports.kdfInputToBytes = kdfInputToBytes;
+		exports.concatBytes = concatBytes;
+		exports.checkOpts = checkOpts;
+		exports.createHasher = createHasher;
+		exports.createOptHasher = createOptHasher;
+		exports.createXOFer = createXOFer;
+		exports.randomBytes = randomBytes;
 		// We use WebCrypto aka globalThis.crypto, which exists in browsers and node.js 16+.
 		// node.js versions earlier than v19 don't declare it in global scope.
 		// For node.js, package.json#exports field mapping rewrites import
@@ -404,7 +404,7 @@ function requireUtils () {
 		    return (word << shift) | ((word >>> (32 - shift)) >>> 0);
 		}
 		/** Is current platform little-endian? Most are. Big-Endian platform: IBM */
-		exports$1.isLE = (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();
+		exports.isLE = (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();
 		/** The byte swap operation for uint32 */
 		function byteSwap(word) {
 		    return (((word << 24) & 0xff000000) |
@@ -413,11 +413,11 @@ function requireUtils () {
 		        ((word >>> 24) & 0xff));
 		}
 		/** Conditionally byte swap if on a big-endian platform */
-		exports$1.swap8IfBE = exports$1.isLE
+		exports.swap8IfBE = exports.isLE
 		    ? (n) => n
 		    : (n) => byteSwap(n);
 		/** @deprecated */
-		exports$1.byteSwapIfBE = exports$1.swap8IfBE;
+		exports.byteSwapIfBE = exports.swap8IfBE;
 		/** In place byte swap for Uint32Array */
 		function byteSwap32(arr) {
 		    for (let i = 0; i < arr.length; i++) {
@@ -425,7 +425,7 @@ function requireUtils () {
 		    }
 		    return arr;
 		}
-		exports$1.swap32IfBE = exports$1.isLE
+		exports.swap32IfBE = exports.isLE
 		    ? (u) => u
 		    : byteSwap32;
 		// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex
@@ -493,7 +493,7 @@ function requireUtils () {
 		 * next scheduler queue processing step and this is exactly what we need.
 		 */
 		const nextTick = async () => { };
-		exports$1.nextTick = nextTick;
+		exports.nextTick = nextTick;
 		/** Returns control to thread each 'tick' ms to avoid blocking. */
 		async function asyncLoop(iters, tick, cb) {
 		    let ts = Date.now();
@@ -503,7 +503,7 @@ function requireUtils () {
 		        const diff = Date.now() - ts;
 		        if (diff >= 0 && diff < tick)
 		            continue;
-		        await (0, exports$1.nextTick)();
+		        await (0, exports.nextTick)();
 		        ts += diff;
 		    }
 		}
@@ -569,7 +569,7 @@ function requireUtils () {
 		/** For runtime check if class implements interface */
 		class Hash {
 		}
-		exports$1.Hash = Hash;
+		exports.Hash = Hash;
 		/** Wraps hash function, creating an interface on top of it */
 		function createHasher(hashCons) {
 		    const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
@@ -595,9 +595,9 @@ function requireUtils () {
 		    hashC.create = (opts) => hashCons(opts);
 		    return hashC;
 		}
-		exports$1.wrapConstructor = createHasher;
-		exports$1.wrapConstructorWithOpts = createOptHasher;
-		exports$1.wrapXOFConstructorWithOpts = createXOFer;
+		exports.wrapConstructor = createHasher;
+		exports.wrapConstructorWithOpts = createOptHasher;
+		exports.wrapXOFConstructorWithOpts = createXOFer;
 		/** Cryptographically secure PRNG. Uses internal OS-level `crypto.getRandomValues`. */
 		function randomBytes(bytesLength = 32) {
 		    if (crypto_1.crypto && typeof crypto_1.crypto.getRandomValues === 'function') {

package/dist/jsenv_server.js

@@ -2907,6 +2907,30 @@ const trackHttp1ServerPendingRequests = (nodeServer) => {
  * But we don't really need a class so we are just returning a regular object under the hood
  */
 
+/**
+ * Return this from a route `fetch` to accept a websocket upgrade on that
+ * endpoint.
+ *
+ * @param {(websocket: import("ws").WebSocket) => void | (() => void)} webSocketHandler
+ *   Called with the raw `ws` socket once the upgrade completes. Use
+ *   `websocket.on("message", …)` / `websocket.send(…)`. If it returns a
+ *   function, that function runs as cleanup when the socket closes.
+ * @param {object} [init]
+ * @param {number} [init.status=101]
+ * @param {string} [init.statusText]
+ * @param {object} [init.headers]
+ *
+ * @example
+ * {
+ *   endpoint: "GET /chat.websocket",
+ *   fetch: () => new WebSocketResponse((websocket) => {
+ *     websocket.on("message", (data) => websocket.send(data));
+ *     return () => {
+ *       // socket closed
+ *     };
+ *   }),
+ * }
+ */
 class WebSocketResponse {
   constructor(
     webSocketHandler,
@@ -2986,7 +3010,7 @@ const getWebSocketHandler = (responseProperties) => {
  * // Use in server route
  * {
  *   endpoint: "GET /events",
- *   response: (request) => serverEvents.fetch(request)
+ *   fetch: (request) => serverEvents.fetch(request)
  * }
  */
 class ServerEvents {
@@ -3044,7 +3068,7 @@ class ServerEvents {
  * // Use in server route
  * {
  *   endpoint: "GET /events",
- *   response: (request) => events.fetch(request)
+ *   fetch: (request) => events.fetch(request)
  * }
  */
 class LazyServerEvents {

package/dist/ws/ws.js

@@ -8,6 +8,7 @@ import require$$0$2 from "node:stream";
 import require$$7 from "node:url";
 import require$$0 from "node:zlib";
 import require$$0$1 from "node:buffer";
+import require$$2 from "node:util";
 
 function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
@@ -987,6 +988,10 @@ function requireReceiver () {
 	   *     extensions
 	   * @param {Boolean} [options.isServer=false] Specifies whether to operate in
 	   *     client or server mode
+	   * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+	   *     buffered data chunks
+	   * @param {Number} [options.maxFragments=0] The maximum number of message
+	   *     fragments
 	   * @param {Number} [options.maxPayload=0] The maximum allowed message length
 	   * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
 	   *     not to skip UTF-8 validation for text and close messages
@@ -1001,6 +1006,8 @@ function requireReceiver () {
 	    this._binaryType = options.binaryType || BINARY_TYPES[0];
 	    this._extensions = options.extensions || {};
 	    this._isServer = !!options.isServer;
+	    this._maxBufferedChunks = options.maxBufferedChunks | 0;
+	    this._maxFragments = options.maxFragments | 0;
 	    this._maxPayload = options.maxPayload | 0;
 	    this._skipUTF8Validation = !!options.skipUTF8Validation;
 	    this[kWebSocket] = undefined;
@@ -1018,6 +1025,7 @@ function requireReceiver () {
 
 	    this._totalPayloadLength = 0;
 	    this._messageLength = 0;
+	    this._numFragments = 0;
 	    this._fragments = [];
 
 	    this._errored = false;
@@ -1036,6 +1044,22 @@ function requireReceiver () {
 	  _write(chunk, encoding, cb) {
 	    if (this._opcode === 0x08 && this._state == GET_INFO) return cb();
 
+	    if (
+	      this._maxBufferedChunks > 0 &&
+	      this._buffers.length >= this._maxBufferedChunks
+	    ) {
+	      cb(
+	        this.createError(
+	          RangeError,
+	          'Too many buffered chunks',
+	          false,
+	          1008,
+	          'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+	        )
+	      );
+	      return;
+	    }
+
 	    this._bufferedBytes += chunk.length;
 	    this._buffers.push(chunk);
 	    this.startLoop(cb);
@@ -1425,6 +1449,19 @@ function requireReceiver () {
 	      return;
 	    }
 
+	    if (this._maxFragments > 0 && ++this._numFragments > this._maxFragments) {
+	      const error = this.createError(
+	        RangeError,
+	        'Too many message fragments',
+	        false,
+	        1008,
+	        'WS_ERR_TOO_MANY_BUFFERED_PARTS'
+	      );
+
+	      cb(error);
+	      return;
+	    }
+
 	    if (this._compressed) {
 	      this._state = INFLATING;
 	      this.decompress(data, cb);
@@ -1497,6 +1534,7 @@ function requireReceiver () {
 	    this._totalPayloadLength = 0;
 	    this._messageLength = 0;
 	    this._fragmented = 0;
+	    this._numFragments = 0;
 	    this._fragments = [];
 
 	    if (this._opcode === 2) {
@@ -1665,6 +1703,9 @@ function requireSender () {
 
 	const { Duplex } = require$$0$2;
 	const { randomFillSync } = require$$1;
+	const {
+	  types: { isUint8Array }
+	} = require$$2;
 
 	const PerMessageDeflate = requirePermessageDeflate();
 	const { EMPTY_BUFFER, kWebSocket, NOOP } = requireConstants();
@@ -1861,8 +1902,10 @@ function requireSender () {
 
 	      if (typeof data === 'string') {
 	        buf.write(data, 2);
-	      } else {
+	      } else if (isUint8Array(data)) {
 	        buf.set(data, 2);
+	      } else {
+	        throw new TypeError('Second argument must be a string or a Uint8Array');
 	      }
 	    }
 
@@ -2983,6 +3026,10 @@ function requireWebsocket () {
 	   *     multiple times in the same tick
 	   * @param {Function} [options.generateMask] The function used to generate the
 	   *     masking key
+	   * @param {Number} [options.maxBufferedChunks=0] The maximum number of
+	   *     buffered data chunks
+	   * @param {Number} [options.maxFragments=0] The maximum number of message
+	   *     fragments
 	   * @param {Number} [options.maxPayload=0] The maximum allowed message size
 	   * @param {Boolean} [options.skipUTF8Validation=false] Specifies whether or
 	   *     not to skip UTF-8 validation for text and close messages
@@ -2994,6 +3041,8 @@ function requireWebsocket () {
 	      binaryType: this.binaryType,
 	      extensions: this._extensions,
 	      isServer: this._isServer,
+	      maxBufferedChunks: options.maxBufferedChunks,
+	      maxFragments: options.maxFragments,
 	      maxPayload: options.maxPayload,
 	      skipUTF8Validation: options.skipUTF8Validation
 	    });
@@ -3422,6 +3471,10 @@ function requireWebsocket () {
 	 *     masking key
 	 * @param {Number} [options.handshakeTimeout] Timeout in milliseconds for the
 	 *     handshake request
+	 * @param {Number} [options.maxBufferedChunks=262144] The maximum number of
+	 *     buffered data chunks
+	 * @param {Number} [options.maxFragments=16384] The maximum number of message
+	 *     fragments
 	 * @param {Number} [options.maxPayload=104857600] The maximum allowed message
 	 *     size
 	 * @param {Number} [options.maxRedirects=10] The maximum number of redirects
@@ -3442,6 +3495,8 @@ function requireWebsocket () {
 	    autoPong: true,
 	    closeTimeout: CLOSE_TIMEOUT,
 	    protocolVersion: protocolVersions[1],
+	    maxBufferedChunks: 256 * 1024,
+	    maxFragments: 16 * 1024,
 	    maxPayload: 100 * 1024 * 1024,
 	    skipUTF8Validation: false,
 	    perMessageDeflate: true,
@@ -3799,6 +3854,8 @@ function requireWebsocket () {
 	    websocket.setSocket(socket, head, {
 	      allowSynchronousEvents: opts.allowSynchronousEvents,
 	      generateMask: opts.generateMask,
+	      maxBufferedChunks: opts.maxBufferedChunks,
+	      maxFragments: opts.maxFragments,
 	      maxPayload: opts.maxPayload,
 	      skipUTF8Validation: opts.skipUTF8Validation
 	    });
@@ -4480,6 +4537,10 @@ function requireWebsocketServer () {
 	   *     called
 	   * @param {Function} [options.handleProtocols] A hook to handle protocols
 	   * @param {String} [options.host] The hostname where to bind the server
+	   * @param {Number} [options.maxBufferedChunks=262144] The maximum number of
+	   *     buffered data chunks
+	   * @param {Number} [options.maxFragments=16384] The maximum number of message
+	   *     fragments
 	   * @param {Number} [options.maxPayload=104857600] The maximum allowed message
 	   *     size
 	   * @param {Boolean} [options.noServer=false] Enable no server mode
@@ -4502,6 +4563,8 @@ function requireWebsocketServer () {
 	    options = {
 	      allowSynchronousEvents: true,
 	      autoPong: true,
+	      maxBufferedChunks: 256 * 1024,
+	      maxFragments: 16 * 1024,
 	      maxPayload: 100 * 1024 * 1024,
 	      skipUTF8Validation: false,
 	      perMessageDeflate: false,
@@ -4861,6 +4924,8 @@ function requireWebsocketServer () {
 
 	    ws.setSocket(socket, head, {
 	      allowSynchronousEvents: this.options.allowSynchronousEvents,
+	      maxBufferedChunks: this.options.maxBufferedChunks,
+	      maxFragments: this.options.maxFragments,
 	      maxPayload: this.options.maxPayload,
 	      skipUTF8Validation: this.options.skipUTF8Validation
 	    });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/server",
-  "version": "17.3.1",
+  "version": "17.4.1",
   "type": "module",
   "description": "A modern Node.js HTTP server with declarative routing, content negotiation, and WebSocket support",
   "repository": {
@@ -56,9 +56,9 @@
     "@jsenv/utils": "../../tooling/utils",
     "eventsource": "4.1.0",
     "formidable": "3.5.4",
-    "playwright": "1.58.1",
-    "undici": "7.24.2",
-    "ws": "8.20.0"
+    "playwright": "1.61.1",
+    "undici": "8.8.0",
+    "ws": "8.21.1"
   },
   "publishConfig": {
     "access": "public"

package/src/server_events.js

@@ -49,7 +49,7 @@ import { WebSocketResponse } from "./web_socket_response.js";
  * // Use in server route
  * {
  *   endpoint: "GET /events",
- *   response: (request) => serverEvents.fetch(request)
+ *   fetch: (request) => serverEvents.fetch(request)
  * }
  */
 export class ServerEvents {
@@ -107,7 +107,7 @@ export class ServerEvents {
  * // Use in server route
  * {
  *   endpoint: "GET /events",
- *   response: (request) => events.fetch(request)
+ *   fetch: (request) => events.fetch(request)
  * }
  */
 export class LazyServerEvents {

package/src/web_socket_response.js

@@ -14,6 +14,30 @@
  * But we don't really need a class so we are just returning a regular object under the hood
  */
 
+/**
+ * Return this from a route `fetch` to accept a websocket upgrade on that
+ * endpoint.
+ *
+ * @param {(websocket: import("ws").WebSocket) => void | (() => void)} webSocketHandler
+ *   Called with the raw `ws` socket once the upgrade completes. Use
+ *   `websocket.on("message", …)` / `websocket.send(…)`. If it returns a
+ *   function, that function runs as cleanup when the socket closes.
+ * @param {object} [init]
+ * @param {number} [init.status=101]
+ * @param {string} [init.statusText]
+ * @param {object} [init.headers]
+ *
+ * @example
+ * {
+ *   endpoint: "GET /chat.websocket",
+ *   fetch: () => new WebSocketResponse((websocket) => {
+ *     websocket.on("message", (data) => websocket.send(data));
+ *     return () => {
+ *       // socket closed
+ *     };
+ *   }),
+ * }
+ */
 export class WebSocketResponse {
   constructor(
     webSocketHandler,