@lovrozagar/honey 0.7.3 → 1.0.0-rc.3

package/docs/regression-matrix/README.md

@@ -1,32 +0,0 @@
-# Regression matrix
-
-The deep review of `packages/core/src` at `3ab88ce` (v0.6.8) produced a list of findings. The
-files here map each finding to a test that reproduces its scenario, and record whether that test
-fails on `3ab88ce`. A test that passes on the old code guards nothing, so each one was checked
-against it. Each test carries its finding id in its name or in a `// regression: <id>` comment, so
-`grep -r "H12" packages/core/tests` finds the guard for H12.
-
-| Workstreams                                                     | Matrix                 |
-| --------------------------------------------------------------- | ---------------------- |
-| 1–3: route model, middleware finalize, request normalization    | [ws1-3.md](ws1-3.md)   |
-| 4–8: streaming, Node/WS, realtime bus, security middleware, I/O | [ws4-8.md](ws4-8.md)   |
-| 9–12: OpenAPI, codegen, client runtimes, tooling                | [ws9-12.md](ws9-12.md) |
-| Code review of the rework (`3ab88ce..HEAD`), R1–R8              | [review.md](review.md) |
-
-## Re-verify against 3ab88ce
-
-The regression tests use only APIs that already existed at `3ab88ce` where the scenario allows,
-so they run unchanged against the old source:
-
-```sh
-OLD=$(mktemp -d)
-git archive 3ab88ce packages/core | tar -x -C "$OLD"
-ln -s "$PWD/node_modules" "$OLD/node_modules"
-mkdir -p "$OLD/packages/core/tests/regression"
-cp packages/core/tests/regression/<file>.regression.test.ts "$OLD/packages/core/tests/regression/"
-(cd "$OLD/packages/core" && "$OLDPWD/node_modules/.bin/vitest" run tests/regression)
-```
-
-Every test listed as failing on `3ab88ce` must fail there, for the reason its finding describes.
-Import the package by relative path in these tests: in the extracted tree, `@lovrozagar/honey`
-resolves to the workspace (current) package.

package/docs/regression-matrix/review.md

@@ -1,44 +0,0 @@
-# Regression matrix: code review of 3ab88ce..HEAD
-
-Findings from `/code-review high 3ab88ce..HEAD`. Unlike the other matrices, these bugs were
-introduced by the rework itself, so "fails before the fix" means on HEAD before the fix commit,
-not on `3ab88ce`. Each test was written first and committed red (`it.fails`, `2e82ee1`), then
-flipped to `it` in its fix commit. Tests live in `tests/regression/review.regression.test.ts`;
-R8 runs in `tests/regression/ws9-12/polyglot.regression.test.ts` (`test:harness`).
-
-| Id  | Severity           | Bug                                                                                                                                                                       | Test                                                                                                                                                                    | Failed before the fix                                          | Fix       |
-| --- | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | --------- |
-| R1  | High (auth bypass) | A scope over a non-ASCII literal compared the decoded request segment with the still-encoded literal, so `/%c3%a9` skipped `use("/é", auth)` and reached a `/:slug` route | "R1: a scope over a non-ASCII literal guards lowercase percent-escapes too", "R1: a route literal written with lowercase escapes is covered by the scope"               | `/%c3%a9: expected 200 to be 401`                              | `27d5fb0` |
-| R2  | Medium             | A mounted realtime route kept the sub's default namespace, so `/v1/chat`, `/v2/chat` and a parent `/chat` shared topics                                                   | "R2: one sub-app mounted twice keeps two realtime namespaces", "R2: a mounted realtime route does not share topics with the parent's route…"                            | the other route's client received the message                  | `6ce2a34` |
-| R3  | Medium             | The logger's request line was written outside the try, so a throwing sink turned every request into a 500                                                                 | "R3: a log sink that throws on the request line never fails the request"                                                                                                | `expected 500 to be 200`                                       | `73e830a` |
-| R4  | Medium             | A parameterized Accept range outranked the plain range without comparing parameters (`application/json;v=2;q=0, application/json` → 406)                                  | "R4: a parameterized range does not override the plain range…"; keep-green: "R4: a parameterized range still applies to a supported type with matching parameters"      | `expected null to be 'application/json'`                       | `73e830a` |
-| R5  | Medium             | A gateway whose every own route shadowed a downstream route passed generation (the self-merge check counted routes)                                                       | "R5: a gateway whose every own route shadows a downstream route fails generation"; keep-green: "R5: a merge source built from the gateway app itself is still accepted" | `expected [Function] to throw an error`                        | `6ce2a34` |
-| R6  | Low                | A realtime frame that arrived before the socket opened was delivered after frames that arrived later                                                                      | "R6: a realtime frame that beat the open is delivered before frames that arrive later"                                                                                  | `expected [ 'B', 'A', 'C' ] to deeply equal [ 'A', 'B', 'C' ]` | `fc9e353` |
-| R7  | Low                | Output cleanup hit ENOENT on a stale manifest entry whose directory the user had deleted, aborting `honey generate`                                                       | "R7: a stale manifest entry whose directory the user deleted does not abort generation"                                                                                 | `ENOENT: no such file or directory, scandir '…/models'`        | `6d986e4` |
-| R8  | Low                | The Python SDK sent no body and no Content-Type for a multipart call with every field empty                                                                               | "R8: a multipart operation called with no fields still sends an empty multipart body"                                                                                   | `expected '' to match /^multipart\/form-data; boundary=/`      | `da43730` |
-
-The two duplication findings (D1: the proxy's copy of `searchOfUrl` and trust's copy of
-`resolveClient`; D2: the realtime server's copies of the `ws/shared.ts` helpers) are refactors with
-no behavioral red state; the existing suites guard them (`f0d4c2f`, `e66658d`).
-
-## Second pass
-
-Findings from the second pass (codegen, SDK runtimes, OpenAPI, tooling). Same method: each test
-was committed red (`it.fails`, `6041355`) and flipped in its fix commit. Tests live in
-`tests/regression/review2.regression.test.ts`; S3 and S4 run in
-`tests/regression/ws9-12/polyglot.regression.test.ts` (`test:harness`).
-
-| Id  | Severity               | Bug                                                                                                                               | Test                                                                                                                        | Failed before the fix                                                     | Fix       |
-| --- | ---------------------- | --------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | --------- |
-| S1  | High (credential leak) | Under `redirect: "follow"` a cross-origin hop carried per-call, function-form config and `onRequest` headers, in both TS runtimes | "createClient (function-form config.headers, per-call headers, onRequest)", "the generated TypeScript SDK (…)"              | `x-api-key: expected 'secret' to be undefined`                            | `a98452c` |
-| S2  | Medium                 | The SDK and Go CLI passes ignored `codegen.invalidate`                                                                            | "S2: codegen.invalidate "off" also covers the SDK and Go CLI passes", "S2: the missing-invalidate warning prints once …"    | `[honey:metaSpec] 1 policy error(s)`; 3 reports instead of 1              | `ecc120f` |
-| S3  | Medium                 | A Python param named `uuid` or `str` shadowed names the method body calls                                                         | poly "S3: a Python path param named uuid or str …"; guard "every global the emitted bodies evaluate is reserved"            | `AttributeError: 'str' object has no attribute 'uuid4'`                   | `44a9de0` |
-| S4  | Medium                 | NUL, controls and BOM in spec text broke generated Go, Go CLI and Python comments                                                 | poly "S4: NUL, BEL and BOM in spec text keep the generated … compiling" (Go SDK, Python SDK, Go CLI; Rust is a plain guard) | `unexpected NUL in input`; `source code string cannot contain null bytes` | `1e94711` |
-| S5  | Low                    | The Vite plugin did not ignore atomic-write `.tmp` files, so each save under a watched output generated twice                     | "S5: a temp file from an atomic write never schedules a generation"                                                         | `expected 1 to be +0`                                                     | `a7542bb` |
-| S6  | Low                    | An `openApi.path` ending in `.yml`/`.yaml` got JSON content or a JSON write before the YAML                                       | "S6: … .yml holds YAML and no sibling appears", "S6: … .yaml is written once, as YAML"                                      | `expected true to be false`; JSON written to `openapi.yaml`               | `e765833` |
-| S7  | Low                    | `buildStart` in two environments ran two generations                                                                              | "S7: buildStart in two environments runs one generation"                                                                    | `expected 2 to be 1`                                                      | `a993559` |
-| S8  | Low (perf)             | One generation built the unfiltered document up to three times                                                                    | "S8: openApi + sdk + cli build the unfiltered document once"                                                                | called 3 times instead of 2                                               | `ecc120f` |
-
-S9 (the generated TS runtime's hand-copied redirect rules) is closed by S1: both runtimes take the
-cross-origin allowlist from `client/redirect-policy.ts`. S10 (watch globs recompiled per call) is a
-refactor with no behavioral red state; the glob and plugin suites guard it (`094176a`).

package/docs/regression-matrix/ws1-3.md

@@ -1,97 +0,0 @@
-# Workstreams 1–3: route model, middleware finalize, request normalization
-
-Findings from the `3ab88ce` review (workstreams 1–3) mapped to their guards. "Fails on
-3ab88ce" was checked by running the same test file against the extracted `3ab88ce` source (see
-[README.md](README.md)); every "yes" failed there with the symptom the finding describes. Test
-files are under `packages/core/tests/regression/`:
-
-- `ws1-route-model.regression.test.ts` (WS1)
-- `ws2-middleware.regression.test.ts` (WS2)
-- `ws3-request.regression.test.ts` (WS3)
-
-## Regression found while building this matrix (fixed)
-
-**GW-OWN-ROUTES (high, fixed).** A gateway booted from a `codegen.mergeTree` tree that registers
-routes of its own threw `Route tree out of date — regenerate it` on every request: the plugin
-wrote the tree from the `mergeTree` source alone. Generation now builds the gateway's tree from
-the merged downstream tree plus the gateway app's own routes (`_gatewayTree`); its root
-wildcards stay out of the tree as the catch-all the downstream leaves delegate to, and an own
-route that is also a downstream route fails generation by name. Guarded by
-`gw-own-routes.regression.test.ts`, which runs the real `generateAndWrite` over a downstream-only
-`routes.gen.ts` (what such a gateway has committed) and fails before the fix with the error
-above; the e2e gateway app (`e2e/apps/gateway`) now has this shape on every runtime.
-
-## WS1 — one route model, one dispatcher
-
-| Finding              | Sev | Bug                                                                                               | Guard (`ws1-route-model.regression.test.ts`)                             | Fails on 3ab88ce                                                                    | Notes                                                                                                                                             |
-| -------------------- | --- | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------ | ----------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
-| C1                   | C   | Scoped middleware skipped for every route with a loaded `routeTree`                               | `C1: path-scoped middleware still guards routes…`                        | yes (200, want 401)                                                                 | Also `tests/unit/route-tree/route-model.test.ts`, `e2e/apps/differential.ts`                                                                      |
-| NEW (shared tree)    | H   | Apps loading one generated tree share handler objects                                             | `NEW-H shared-tree: two apps loading one generated tree…`                | yes (A served B)                                                                    |                                                                                                                                                   |
-| NEW (stale meta)     | M   | Patch mode never refreshes `mt`/`ek`                                                              | `NEW-M stale-meta: a loaded tree serves the registered route's meta…`    | yes (`old`, want `new`)                                                             |                                                                                                                                                   |
-| H17                  | H   | Literal `/users/:id` request hits the param handler with `id` undefined                           | `H17: a literal /users/:id request binds the param…`                     | yes (`null`, want `:id`)                                                            |                                                                                                                                                   |
-| H18                  | H   | Shared empty-children sentinel: a runtime insert is reachable under every leaf                    | `H18: a route missing from the tree never becomes reachable…`            | yes (`/health/secret` 200)                                                          | HEAD fails loudly (stale tree)                                                                                                                    |
-| H19                  | H   | `.on([GET, POST])` patches only the first method                                                  | `H19: .on([GET, POST]) serves every method with a loaded tree`           | yes (POST 404)                                                                      |                                                                                                                                                   |
-| H20                  | H   | Internal routes (spec, docs, manifest) baked as ordinary handlers, 404 with a tree                | —                                                                        | not re-verified                                                                     | Covered by `tests/unit/openapi/serve-endpoints.test.ts` and the e2e apps booting with `routeTree`; the spec routes are covered under workstream 9 |
-| H21 (now M)          | M   | Selectors rebuilt from the tree throw `Duplicate route` for `/opt/:id?`, `/files/*`, `/a/:id/:b?` | `M-H21: optional, wildcard and trailing-slash routes boot…`              | yes (`Duplicate route`)                                                             |                                                                                                                                                   |
-| H22                  | H   | App's own root wildcard treated as unknown-path catch-all with a tree                             | `H22: the app's own root wildcard (SPA fallback)…`                       | yes (GET 404)                                                                       |                                                                                                                                                   |
-| M (HEAD catch-all)   | M   | HEAD bypasses the unknown-path guard for non-`ALL` catch-alls                                     | `M-HEAD-catchall: HEAD and GET agree…`                                   | yes (HEAD 200, GET 404)                                                             |                                                                                                                                                   |
-| backtrack (was M)    | H   | `matchRoute` never backtracks                                                                     | `H-backtrack: the router backtracks…`                                    | yes (404 for `/users/me/profile`)                                                   | Also `tests/unit/fuzz/router-encoding.fuzz.test.ts` (reference matcher)                                                                           |
-| M (gateway `/:slug`) | M   | `fn:null` fallthrough breaks with a root `/:slug`; taps read the catch-all's meta                 | `gw-own-routes.regression.test.ts`: `M-gateway-slug…`                    | fails on the pre-fix HEAD (generation throws); 3ab88ce answered `{}`, want `worker` | Runs through the real generation path. `M-gateway-catchall` guards the catch-all-only shape (passes on both)                                      |
-| M (round trip)       | M   | `toRouteTree()` → `routeTree()` drops scoped middleware                                           | `M-roundtrip: toRouteTree() → routeTree() keeps scoped middleware`       | yes (200)                                                                           |                                                                                                                                                   |
-| M (mergeInto)        | M   | `mergeInto` shares nodes and handlers between parents                                             | `M-mergeInto: two parents mounting one sub…`                             | yes (p2 serves p1's route)                                                          |                                                                                                                                                   |
-| M (normalize)        | M   | `basePath("/api/")`, `//admin/b` never match their scope                                          | `M-normalize: non-normalized route and basePath strings…`                | yes (200)                                                                           |                                                                                                                                                   |
-| M (merge conflict)   | M   | `.route(sub)` on an app booted from the full app's tree throws                                    | `M-merge-conflict: mounting a sub on an app booted…`                     | yes (`Merge conflict`)                                                              |                                                                                                                                                   |
-| M (proto segments)   | M   | Segments named `constructor`, `toString`, … crash tree codegen                                    | `M-proto-segments: tree codegen handles segments…`                       | yes (TypeError)                                                                     |                                                                                                                                                   |
-| M (intern)           | M   | Meta interning merges `NaN`/`null`, drops `Date`, `RegExp`                                        | `M-intern: tree codegen rejects non-JSON meta…`                          | yes (no throw; values merged)                                                       | HEAD rejects non-JSON meta                                                                                                                        |
-| L (late routeTree)   | L   | `routeTree()` after routes are registered serves a mix, no error                                  | `L-late-routeTree: routeTree() after routes are registered fails loudly` | yes                                                                                 |                                                                                                                                                   |
-| L (perf)             | L   | `matchWsRoute` on every non-upgrade request                                                       | —                                                                        | —                                                                                   | Perf; `bun run bench:hotpath` gates the request hot path                                                                                          |
-
-## WS2 — resolve middleware once, at finalize
-
-| Finding             | Sev | Bug                                                                                                    | Guard (`ws2-middleware.regression.test.ts`)                               | Fails on 3ab88ce                    | Notes                                                                       |
-| ------------------- | --- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------- | ----------------------------------- | --------------------------------------------------------------------------- |
-| H10                 | H   | `_compiled` cached on the shared handler: serving the sub first skips the parent's auth                | `H10: serving a sub on its own first…`                                    | yes (200)                           | Also `tests/unit/middleware/finalized-chain.test.ts`                        |
-| H11                 | H   | Chain middleware applied to `.get()` but not to `.route(sub)`                                          | `H11: routes mounted through an authed chain handle…`                     | yes (200)                           |                                                                             |
-| H12                 | H   | Scopes match the registered pattern string, not request paths                                          | `H12: scopes guard request paths…`                                        | yes (200)                           |                                                                             |
-| H13                 | H   | Chain/scoped order inverts when the sub is mounted                                                     | `H13: chain middleware runs before scoped middleware…`                    | yes (500: `ctx.user` undefined)     |                                                                             |
-| H14 (now M)         | M   | 404/405 contexts lack `ctx.errors`; `ctx.path` is `""`                                                 | `M-H14: 404 runs middleware with ctx.errors and the real ctx.path`        | yes (404, want 401)                 |                                                                             |
-| H15                 | H   | Chain middleware runs twice for routes registered before a later `.use()`                              | `H15: a route registered before a later use()…`                           | yes (`a, auth, a`)                  |                                                                             |
-| H16                 | H   | Errors thrown by middleware skip outer post-`next()` code                                              | `H16: outer middleware post-next code runs…`                              | yes (no `x-outer`)                  | Also `tests/unit/middleware/ctx-error.test.ts`                              |
-| M (sub config)      | M   | Mounted subs lose `errorFactory` and `.context()` values                                               | `M-sub-config: a mounted sub keeps its errorFactory and context values`   | yes (`{}`)                          | Pin `tests/unit/core/context.test.ts:179` reversed                          |
-| preflight (was M)   | H   | Preflight ignores scoped `cors` and uses the GET route's chain                                         | `H-preflight: a preflight runs the scoped cors…`                          | yes (no ACAO)                       |                                                                             |
-| M (preflight twice) | M   | A non-short-circuited preflight runs the chain twice                                                   | `M-preflight-twice…`                                                      | yes (2 runs)                        |                                                                             |
-| M (forbidden key)   | M   | csrf/ipRestrict 403 becomes 500 under `errorFactory().defaultErrors()`                                 | `M-forbidden: csrf rejection under errorFactory().defaultErrors() is 403` | yes (500)                           |                                                                             |
-| M (chain errors)    | M   | Chain-level `.use(mw)` never adds `mw.errors`                                                          | `M-chain-errors: chain-level use(mw) contributes…`                        | yes (500)                           |                                                                             |
-| M (default keys)    | M   | Internal routes alias the default error set; scoped back-fill mutates it                               | `M-default-keys: a scoped middleware's errors never leak…`                | yes (`/public` documents 403)       |                                                                             |
-| M (perf, mount)     | M   | `route()` re-walks the whole tree per scoped entry per mount                                           | `M-mount-perf: mounting 200 sub-apps…`                                    | yes (5.6 s, bound 3 s; HEAD ~50 ms) |                                                                             |
-| bare `use` (was M)  | H   | `app.use(mw)` as a statement installs nothing                                                          | `H-bare-use: a bare app.use(mw) statement never leaves…`                  | yes (200)                           | HEAD throws at finalize                                                     |
-| M (mw meta)         | M   | Middleware meta missing on mounted routes                                                              | `M-mw-meta: meta contributed by the mounting chain…`                      | yes (`null`)                        |                                                                             |
-| NEW (WS order)      | H   | WS routes run scoped before chain                                                                      | `NEW-H ws-order: WS routes run chain before scoped middleware`            | yes (`scoped, chain`)               |                                                                             |
-| L (telemetry)       | L   | `onResponse` fires twice for handler-thrown errors                                                     | `L-telemetry: onResponse fires once…`                                     | yes (2)                             |                                                                             |
-| L (reserved keys)   | L   | `context({ searchAll })` breaks every request; `path`/`meta` silently overridden                       | `L-reserved: context() with a framework key is rejected…`                 | yes                                 |                                                                             |
-| L (status key)      | L   | Unknown status key answers 200                                                                         | `L-status-key: an unknown status key never answers 200`                   | yes                                 |                                                                             |
-| L (no handler)      | L   | A route builder without `.handler()` registers nothing silently                                        | `L-no-handler: a route builder without .handler() is reported`            | yes                                 |                                                                             |
-| L (perf ×3)         | L   | Scoped entry disables compiled chains; per-request `errorFactory` subset; `.input()` routes uncompiled | —                                                                         | —                                   | `bench:hotpath` scenario "route under 51 scopes"; `finalized-chain.test.ts` |
-
-## WS3 — request normalization and trust boundary
-
-| Finding              | Sev | Bug                                                                   | Guard (`ws3-request.regression.test.ts`)                                                                                 | Fails on 3ab88ce                               | Notes                                                                                                              |
-| -------------------- | --- | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| M (`ctx.path`)       | M   | Router normalizes but `ctx.path` stays raw (`//admin/secret`)         | `M-ctx-path: ctx.path is the normalized path the router matched`                                                         | yes (200, guard bypassed)                      | Also `tests/integration/request-target/` (Node, Bun, Deno)                                                         |
-| Node URL (was M)     | H   | Node builds the URL by concatenating `Host`; routes on `Host`         | `H-node-host: Node routes on the request target…` (4 tests: Host injection, absolute form, malformed Host, dot segments) | yes (all four)                                 | Also `tests/unit/request/node-request-url.test.ts`                                                                 |
-| M (redirect)         | M   | Trailing-slash 308 builds an absolute `Location` from the request URL | `M-redirect: trailing-slash redirects send a relative Location`                                                          | yes                                            |                                                                                                                    |
-| M (proto query)      | M   | `?__proto__=` and friends make `ctx.search` throw → 500               | `M-proto-query: prototype-named query keys never turn into 500s`                                                         | yes (500)                                      | Also `tests/unit/request/prototype-keys.test.ts`                                                                   |
-| L (validated search) | L   | `?__proto__=x` replaces the validated search object's prototype       | `L-proto-validated…`                                                                                                     | yes (400 `validation_failed` on a valid query) |                                                                                                                    |
-| L (issue path)       | L   | A validation issue on a prototype-named field turns 400 into 500      | `L-proto-issue…`                                                                                                         | yes (500)                                      |                                                                                                                    |
-| L (header view)      | L   | `HoneyOutHeaders.get("constructor")` returns a function               | `L-proto-headers…` (through Node `serve()`)                                                                              | yes (`function`)                               |                                                                                                                    |
-| L (i18n keys)        | L   | i18n `select` on `constructor`, `fe.path` set to a function           | —                                                                                                                        | not re-verified                                | `tests/unit/request/prototype-keys.test.ts` ("field-name translation…", "errorI18n with a prototype-named query…") |
-
-## Decisions and WS13 items in scope
-
-- Registration after finalize (epoch): guarded by `L-late-routeTree` and by
-  `tests/unit/route-tree/route-model.test.ts`.
-- `use()` semantics: `H-bare-use`, `H11`, `H15`.
-- Scope semantics: `H12`, `M-normalize`.
-- Error conversion at `next()`: `H16`.
-- WS13 gaps "scoped middleware with routeTree", "two apps from one tree", "middleware order on WS
-  routes": `C1`, `NEW-H shared-tree`, `NEW-H ws-order`.

package/docs/regression-matrix/ws4-8.md

@@ -1,107 +0,0 @@
-# Regression matrix: workstreams 4–8
-
-Streaming, Node adapter and WebSockets, the realtime bus, security middleware, input and output.
-Tests live in `packages/core/tests/regression/ws4-8/`:
-
-- `node-adapter.regression.test.ts` drives `node-fixture.ts` under plain `node` through the real
-  Node adapter (`serve()`). Crash findings assert that the fixture process is still alive.
-- `in-process.regression.test.ts` runs through `app.fetch`, or a Node server inside the test
-  process, and a real `node:http` upstream for the proxy findings.
-
-Every test below fails on `3ab88ce` and passes on HEAD; each was run against both trees. Where a test
-bundles several sub-cases of one finding, each sub-case was checked against `3ab88ce` on its own.
-To re-run them against `3ab88ce`, copy the whole `ws4-8/` directory (the fixture and the harness
-come with it), following the [README](README.md).
-
-Scope: Critical, High and Medium findings, plus one cheap Low. Findings in the unexported realtime
-protocol modules were deleted with those modules under the realtime decision and are out of scope.
-
-`in-process` = `in-process.regression.test.ts`, `node` = `node-adapter.regression.test.ts`.
-
-## Workstream 4: streaming and cancellation
-
-| Finding | Sev | Bug                                                                                                                               | Test                                                                                              | Fails on 3ab88ce?                                                              | Notes                                                                                                |
-| ------- | --- | --------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------- |
-| H3      | H   | Unawaited SSE `writer.close()`: the README `finally { s.close() }` crashes Node on disconnect                                     | node: "H3: the README `finally { s.close() }` SSE shape survives a client disconnect"             | Yes: the fixture process exits, and the next fetch fails                       | The `defaultRetry` half was never reproduced (TODO marks it [P])                                     |
-| H7      | H   | HEAD falls back to GET and drops the body without cancelling; producers run forever                                               | in-process: "H7: HEAD on an SSE route leaves no producer running"                                 | Yes: 5 producers started, 0 finished                                           |                                                                                                      |
-| NEW     | L   | HEAD on Node drops `Content-Length`                                                                                               | node: "NEW (L): HEAD keeps Content-Length on Node"                                                | Yes: `content-length` is null                                                  |                                                                                                      |
-| H8      | H   | `etag()` buffers SSE and `generate()` bodies, so an endless stream never answers                                                  | in-process: "H8: etag() answers an SSE route instead of buffering the endless body"               | Yes: times out                                                                 |                                                                                                      |
-| H9      | H   | Node buffers a text-type body of unknown length                                                                                   | node: "H9: a text/plain generate() of unknown length streams its first chunk without buffering"   | Yes: first byte after about 1.5 s                                              |                                                                                                      |
-| H26     | H   | Header middleware sets headers in place on immutable responses, giving a 500                                                      | in-process: "H26: header middleware over an immutable Response.redirect() does not 500"           | Yes: 500 for each of `secureHeaders`, `requestId`, `poweredBy`, `serverTiming` | The `static.ts` half is covered by the WS7 staticFiles tests; the README proxy example is a doc item |
-| M       | M   | `res.stream()` hangs when the callback throws while holding the writer (`response.ts:287-303`)                                    | in-process: "M: res.stream() settles when the callback throws while holding the writer"           | Yes: times out                                                                 |                                                                                                      |
-| M       | M   | `generate()` has no `cancel()`, and a mid-stream throw becomes a clean EOF (`response.ts:261-285`)                                | in-process: "M: generate() runs the generator's finally on cancel and errors the body on a throw" | Yes, both halves: `finally` does not run, and the body resolves                |                                                                                                      |
-| M       | M   | `etag()` returns a consumed Response for a zero-length body (`etag.ts:45-46`)                                                     | in-process: "M: etag() over a zero-length body answers 200 (it returned a consumed Response)"     | Yes: "Body has already been read"                                              | Reproduces under Node too, not only on Bun                                                           |
-| M       | M   | The request signal is wired only to `'aborted'`, so a disconnect after the body was read never aborts (`node-request.ts:134-140`) | node: "M: a disconnect after the body was read aborts the request signal"                         | Yes: `postAborted` is 0                                                        |                                                                                                      |
-
-## Workstream 5: Node adapter and WebSockets
-
-| Finding | Sev | Bug                                                                                                                                                                        | Test                                                                                                   | Fails on 3ab88ce?                                               | Notes                                                                                                                                                        |
-| ------- | --- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| C2      | C   | No `'error'` listener on the upgrade socket: a TCP reset while the app awaits crashes Node                                                                                 | node: "C2: a reset upgrade socket while the handler awaits does not crash the process"                 | Yes: `Error: read ECONNRESET`, and the process exits            | Covers `Upgrade: x` on an HTTP route and a WS route behind an async middleware. Also covered by `tests/integration/hostile-client/`                          |
-| H1      | H   | Realtime callbacks are neither awaited nor caught                                                                                                                          | node: "H1: a rejecting realtime message handler does not crash the process"                            | Yes: the process exits on `TypeError … 'trim'`                  | The TODO's exact handler and frame                                                                                                                           |
-| H2      | H   | WS `onOpen` / `onClose` are called without await or catch                                                                                                                  | node: "H2: a rejecting async onOpen and a throwing onClose do not crash the process"                   | Yes: the process exits on "onOpen rejects"                      |                                                                                                                                                              |
-| H5      | H   | An SSE route reached with `Upgrade: x` is drained with `text()`; the client gets 0 bytes                                                                                   | node: "H5: an SSE route reached with `Upgrade: x` streams instead of buffering forever"                | Yes: nothing is received                                        |                                                                                                                                                              |
-| H6      | H   | The hand-rolled upgrade writer drops headers and forces a JSON content type                                                                                                | node: "H6: a non-WebSocket upgrade keeps the route's status, headers and content type"                 | Yes: `HTTP/1.1 200 \r\ncontent-type: application/json`          |                                                                                                                                                              |
-| H29     | H   | `cors()` rebuilds 101 responses, so a 500 is written into an upgraded socket                                                                                               | node: "H29: cors() in front of a WebSocket route lets the socket open and exchange frames"             | Yes: client error "Invalid WebSocket frame: RSV1 must be clear" | Listed under WS4 in the TODO                                                                                                                                 |
-| NEW     | M   | A sync throw in `onOpen` makes the adapter write a raw `HTTP/1.1 500` after the 101                                                                                        | node: "NEW (M): a sync throw in onOpen never writes an HTTP 500 onto the upgraded socket"              | Yes: `HTTP/1.1 500` after the handshake                         |                                                                                                                                                              |
-| M       | M   | `WSRouteBuilder.input()` is stored but never validated (`index.ts:3626-3633`)                                                                                              | node: "M: WS `.input()` is validated before the upgrade"                                               | Yes: the socket opens without a token                           |                                                                                                                                                              |
-| M       | M   | No `maxPayload`, so a 100 MiB default lets a 64 MiB frame through (`ws/node.ts:52`)                                                                                        | node: "M: a WebSocket frame over the default maxPayload is refused, not delivered"                     | Yes: a 2 MiB frame is delivered, with no 1009                   |                                                                                                                                                              |
-| H       | H   | `Origin` is never checked on WS upgrades (cross-site WebSocket hijacking)                                                                                                  | node: "H: a cross-origin WebSocket upgrade carrying cookies is refused"                                | Yes: the socket opens                                           |                                                                                                                                                              |
-| M       | M   | No backpressure handling on WS and realtime sends                                                                                                                          | `tests/unit/ws/ws-containment.test.ts`: "over the backpressure limit: closes with 1013, or drops"      | Old API cannot express it                                       | 3ab88ce has no `backpressureLimit` / `backpressurePolicy`                                                                                                    |
-| M       | M   | Shutdown: WebSockets survive `close()`, and an idle keep-alive client stalls it (`node.ts:188-208`)                                                                        | in-process: "M: shutdown closes open WebSockets and does not wait on idle keep-alive clients"          | Yes: the WebSocket never closes                                 |                                                                                                                                                              |
-| M       | M   | `startHoneyServer` replaces a user-set `wsAdapter` (`serve.ts:56,78,110`)                                                                                                  | in-process: "M: startHoneyServer keeps a user-set wsAdapter"                                           | Yes: the user's adapter is never called                         |                                                                                                                                                              |
-| M       | M   | `ws` is not a declared dependency (`ws/node.ts:50`)                                                                                                                        | in-process: "M: `ws` is declared as an optional peer dependency"                                       | Yes: no `peerDependencies.ws`                                   | The "clear error when missing" half: `tests/unit/ws/ws-missing.test.ts` (old API cannot express)                                                             |
-| M       | M   | NodeRequest: empty `json()` returns null, a second `text()` returns `""`, `headers.get("authorization")` changes after iteration, and `req.body` is locked after `clone()` | node: "M: NodeRequest follows Fetch: clone() does not lock, a second read throws, empty json() throws" | Yes, each sub-case on its own                                   | `new Request(ctx.req)` / `fetch(ctx.req)` became `toFetchRequest()`; the old API cannot express it. Covered by `tests/unit/node/request-conformance.test.ts` |
-| M       | M   | `curlLogger({ body: true })` before `bodyLimit` gives a 500 on Node                                                                                                        | node: "M: curlLogger({ body: true }) before bodyLimit answers the POST instead of 500"                 | Yes: 500                                                        |                                                                                                                                                              |
-
-## Workstream 6: realtime bus (the shipped bus only)
-
-| Finding | Sev | Bug                                                                                      | Test                                                                                                  | Fails on 3ab88ce? | Notes                                                                                                        |
-| ------- | --- | ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ----------------- | ------------------------------------------------------------------------------------------------------------ |
-| M       | M   | Documented no-ops: `reconnectBuffer` is stored and never read                            | in-process: "M: the documented-but-ignored reconnectBuffer option is rejected, not silently accepted" | Yes: no throw     | `conn.userId` through `identify()` is new API (old API cannot express it); covered in `tests/unit/realtime/` |
-| M       | M   | Wire format is asymmetric: inbound must be `{t:"msg",data}`                              | node: "M: the wire format is symmetric — a client sends the payload itself and gets JSON back"        | Yes: no reply     |                                                                                                              |
-| M       | M   | A realtime route shadows the HTTP route on the same path with 426 (`index.ts:1902-1907`) | in-process: "M: a realtime route does not shadow an HTTP route on the same path"                      | Yes: 426          |                                                                                                              |
-| M       | M   | A throwing close handler skips `unsubscribeAll`, leaving a ghost in `presence()`         | node: "M: a throwing close handler still unsubscribes the connection (no ghost in presence)"          | Yes               | On 3ab88ce the throwing close handler crashes the Node process (the H2 class) before presence can be read    |
-
-## Workstream 7: security middleware
-
-| Finding | Sev | Bug                                                                                                                            | Test                                                                                                                   | Fails on 3ab88ce?                                  | Notes                                                                                                           |
-| ------- | --- | ------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
-| C3      | C   | `ipRestrict` trusts a client-sent `cf-connecting-ip`, and a deny-only config is bypassed by omitting it                        | in-process: "C3: ipRestrict does not trust a client-sent cf-connecting-ip, and deny-only fails closed"                 | Yes: 200 for both                                  |                                                                                                                 |
-| H23     | H   | CSRF check skipped when Content-Type is absent                                                                                 | in-process: "H23: csrf rejects a cross-site POST that has no Content-Type"                                             | Yes: 200                                           |                                                                                                                 |
-| H24     | H   | `credentials: true` with a wildcard or undefined origin reflects any Origin, including `null`                                  | in-process: "H24: credentialed CORS never reflects an arbitrary or null Origin"                                        | Yes, for both configs and both origins             |                                                                                                                 |
-| H27     | H   | A decoded upstream body is returned with the upstream `content-encoding`; on Node, a stale `content-length` desyncs keep-alive | node: "H27: a gzip upstream body over 256 KB arrives intact and the keep-alive socket stays in sync"                   | Yes: `TypeError: terminated`                       | Real gzip upstream, 400 KB body. Also covered by `tests/integration/proxy-upstream/`                            |
-| H28     | H   | Hop-by-hop headers are not stripped; both `transfer-encoding` and `content-length` reach the client                            | node: "H28: hop-by-hop upstream headers are stripped and never sent with both framings"                                | Yes                                                |                                                                                                                 |
-| H4      | H   | `curlLogger` starts `buildCurlLogData()` before `next()`; a downstream throw leaves a floating rejection                       | in-process: "H4: curlLogger never leaves a floating rejection when a downstream middleware throws"                     | Yes: unhandled "redact failed"                     |                                                                                                                 |
-| NEW     | M   | `curlLogger` with a malformed `Host` on Node turns every request into a 500                                                    | node: "NEW (M): curlLogger on Node with a malformed Host never turns the request into a 500"                           | Yes: 500                                           | HEAD answers 400 at the adapter                                                                                 |
-| M       | M   | Proxy timeout stays armed for the whole response body (`proxy.ts:130`)                                                         | in-process: "M: proxy timeout covers the wait for headers, not the whole streamed body"                                | Yes: the SSE body is cut off                       |                                                                                                                 |
-| M       | M   | Proxy drops bodies for methods other than POST, PUT and PATCH (`proxy.ts:4,124`)                                               | in-process: "M: proxy forwards the body of a DELETE"                                                                   | Yes: the upstream receives an empty body           |                                                                                                                 |
-| M       | M   | Client `Expect` / `Upgrade` headers give a 502 on Node (`proxy.ts:100-107`)                                                    | in-process: "M: proxy does not fail on client `Expect` / `Upgrade` headers (502 on Node)"                              | Yes: 502                                           | The client-`Host`-on-Bun half is Bun-only; covered by `tests/unit/proxy/proxy-security.test.ts`                 |
-| M       | M   | WebSocket detection is case-sensitive (`proxy.ts:87`)                                                                          | in-process: "M: proxy detects a WebSocket upgrade case-insensitively"                                                  | Yes: `connection` is dropped                       |                                                                                                                 |
-| M       | M   | `destination` can receive `//host`, and `..%2f` is forwarded verbatim (`proxy.ts:95-97`)                                       | in-process: "M: destination never receives a `//host` URL or an encoded traversal"                                     | Yes: got `//evil.example/x` and `/..%2f..%2fadmin` |                                                                                                                 |
-| M       | M   | `ipRestrict` does no canonicalization: v4-mapped, case, port, `10.0.0.1abc`, `/33`, `allowList: []`                            | in-process: "M: ipRestrict canonicalizes addresses and rejects invalid rules"                                          | Yes, each sub-case on its own                      |                                                                                                                 |
-| M       | M   | `staticFiles` prefix match has no segment boundary (`static.ts:34-37`)                                                         | in-process: "M: staticFiles matches its prefix on a segment boundary"                                                  | Yes: resolve got `-private/secret.txt`             |                                                                                                                 |
-| M       | M   | `staticFiles` traversal guard only matches `../`, and resolve gets the undecoded path (`static.ts:11,40-44`)                   | in-process: "M: staticFiles never hands resolve a path with a `..` segment"                                            | Yes: `..%5c..%5csecret` reaches resolve            | A raw-target Node variant passed on 3ab88ce (its Node adapter normalized through WHATWG URL), so it was dropped |
-| M       | M   | `curlLogger` logs `authorization`, `cookie` and token query params verbatim                                                    | in-process: "M: curlLogger redacts credentials and token query params by default"                                      | Yes                                                | The method-quoting half: `tests/unit/request-to-curl/request-to-curl.test.ts`                                   |
-| M       | M   | No `Vary: Origin` when the origin is disallowed or absent (`cors.ts:36-45`)                                                    | in-process: "M: cors adds Vary: Origin when the Origin is disallowed or absent"                                        | Yes, both cases                                    |                                                                                                                 |
-| M       | M   | otel: the root span never ends on preflight, `http.route` is the raw path, and `http.url` includes the query                   | in-process: "M: otel ends the root span on short-circuited preflights and records the route pattern without the query" | Yes: a span is left un-ended                       |                                                                                                                 |
-| M       | M   | Docs UIs load unpinned CDN scripts with no SRI, CSP or `nosniff`                                                               | in-process: "M: the Swagger docs page pins its assets with SRI and sends CSP + nosniff"                                | Yes                                                | Scalar: `tests/unit/openapi/docs-ui-security.test.ts`                                                           |
-
-## Workstream 8: input and output
-
-| Finding | Sev | Bug                                                                                  | Test                                                                                                 | Fails on 3ab88ce?                 | Notes                                                |
-| ------- | --- | ------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------- | --------------------------------- | ---------------------------------------------------- |
-| H30     | H   | Malformed JSON or multipart gives a 500                                              | in-process: "H30: malformed JSON is a 400, not a 500"                                                | Yes: 500                          |                                                      |
-| M       | M   | A declared `json` / `form` schema is skipped for DELETE (`validation.ts:49,251`)     | in-process: "M: a declared json schema is validated on DELETE"                                       | Yes: 200, and the handler runs    |                                                      |
-| M       | M   | Content-type matching is case-sensitive and prefix-based (`validation.ts:39-45,268`) | in-process: "M: content-type matching is case-insensitive, accepts +json, and is not a prefix match" | Yes, each of the three types      |                                                      |
-| M       | M   | Cookie values with `%` do not round-trip (`cookie.ts:16-33`)                         | in-process: "M: cookie values containing `%` round-trip"                                             | Yes: `%41` → `A`, `a%2Fb` → `a/b` | The `100%` sub-case already round-tripped on 3ab88ce |
-| M       | M   | `verify()` throws on a malformed signature (`cookie-sign.ts:19-27,41`)               | in-process: "M: verify() returns null for a malformed signature instead of throwing"                 | Yes: `InvalidCharacterError`      |                                                      |
-| M       | M   | Form duplicates collapse to the last value (`validation.ts:195-212`)                 | in-process: "M: form duplicates give a scalar field its first value"                                 | Yes: `admin`                      |                                                      |
-
-## Counts
-
-54 tests in this file, all newly written and all failing on `3ab88ce`. Three findings point instead
-to existing tests, because the old API cannot express them: backpressure, the missing-`ws` error,
-and `toFetchRequest` / `identify`.
-
-Findings not fixed on HEAD: none found. Every scenario above passes on HEAD.