@morojs/moro 1.8.15 → 1.8.16

package/dist/core/http/moro-engine-server.d.ts

@@ -190,6 +190,9 @@ export declare class MoroEngineServer {
     /** @internal */ _getBody: (reqId: number) => ArrayBuffer | null;
     /** @internal */ _getRemoteAddress: (reqId: number) => string | undefined;
     /** @internal */ _getMethod: (reqId: number) => string | undefined;
+    /** @internal */ _wsSend: (wsId: number, data: any, isBinary: boolean) => boolean;
+    /** @internal */ _wsClose: (wsId: number, code?: number, reason?: string) => void;
+    /** @internal */ _upgradeToWebSocket: (reqId: number) => number;
     /** @internal */ _prepareResponse?: (serverId: number, status: number, headers: string[] | null) => number;
     /** @internal */ _respondPrepared?: (reqId: number, tplId: number, body: any) => void;
     /** @internal */ _respondPreparedEmpty?: (reqId: number, tplId: number) => void;
@@ -328,6 +331,7 @@ export declare class MoroEngineServer {
     private dispatchDirectRoute;
     setNativeRouteProvider(_provider: () => Array<any>, _onError?: (...args: any[]) => any): void;
     private onRequest;
+    private dispatchRouter;
     private _armMicrotaskDrain;
     private onAborted;
     private onWritable;

package/dist/core/http/moro-engine-server.js

@@ -756,7 +756,7 @@ export class EngineResponse extends LazyEventEmitter {
         if (shouldInline(bytes, s)) {
             let compressed;
             try {
-                compressed = compressBufferSync(body, encoding, s.level);
+                compressed = compressBufferSync(body, encoding, s.level, s);
             }
             catch {
                 compressed = undefined;
@@ -773,7 +773,7 @@ export class EngineResponse extends LazyEventEmitter {
         }
         // Async path: compress, then respond (guarding against an abort that
         // raced the await - the reqId would be invalid).
-        void compressBuffer(body, encoding, s.level)
+        void compressBuffer(body, encoding, s.level, s)
             .then(compressed => {
             if (this._ended || this._server._isAborted(this._reqId))
                 return;
@@ -1480,6 +1480,11 @@ export class MoroEngineServer {
     /** @internal */ _getBody;
     /** @internal */ _getRemoteAddress;
     /** @internal */ _getMethod;
+    // The WebSocket natives, hoisted for the same reason: wsSend runs once per
+    // frame, and through the loader's Proxy every call paid the `get` trap.
+    /** @internal */ _wsSend;
+    /** @internal */ _wsClose;
+    /** @internal */ _upgradeToWebSocket;
     // Prepared response templates (engine >= 1.1.6): assigned only when the
     // engine advertises capabilities.responseTemplates AND the functions exist,
     // so a flag/binary mismatch can never put `undefined` into a hot call site.
@@ -1614,6 +1619,9 @@ export class MoroEngineServer {
         this._getBody = surface.getBody;
         this._getRemoteAddress = surface.getRemoteAddress;
         this._getMethod = surface.getMethod;
+        this._wsSend = surface.wsSend;
+        this._wsClose = surface.wsClose;
+        this._upgradeToWebSocket = surface.upgradeToWebSocket;
         if (this._capabilities?.responseTemplates === true &&
             typeof surface.prepareResponse === 'function' &&
             typeof surface.respondPrepared === 'function' &&
@@ -1935,11 +1943,11 @@ export class MoroEngineServer {
     }
     /** Send a frame on a WebSocket. Returns false on backpressure. */
     wsSend(wsId, data, isBinary) {
-        return this._engine.wsSend(wsId, data, isBinary) !== false;
+        return this._wsSend(wsId, data, isBinary) !== false;
     }
     /** Close a WebSocket (RFC 6455 close frame). */
     wsClose(wsId, code, reason) {
-        this._engine.wsClose(wsId, code, reason);
+        this._wsClose(wsId, code, reason);
     }
     // Direct router dispatch - called after global middleware without the
     // per-middleware promise machinery (mirrors MoroHttpServer.setRouterHandler)
@@ -2093,29 +2101,18 @@ export class MoroEngineServer {
             const upgrade = this._getHeader(reqId, 'upgrade');
             if (upgrade && upgrade.toLowerCase() === 'websocket') {
                 // Snapshot handshake data now - the upgrade invalidates the reqId,
-                // after which these fetchers return empty values.
+                // after which these fetchers return empty values. The headers stay
+                // the engine's flat [name, value, ...] list: the adapter builds the
+                // object (joining duplicates like EngineRequest.headers) the first
+                // time a handler reads socket.headers, so an upgrade whose handlers
+                // never look pays for no object at all.
                 const ip = this._getRemoteAddress(reqId) || '';
-                const headers = {};
                 const flat = this._getHeaders(reqId);
-                if (flat) {
-                    // Join duplicates exactly like the EngineRequest.headers getter -
-                    // last-wins would let a client send two X-Forwarded-For lines and
-                    // hide the earlier one from IP-based WS auth / rate-limiting.
-                    for (let i = 0; i + 1 < flat.length; i += 2) {
-                        const key = flat[i];
-                        const val = flat[i + 1];
-                        if (key === undefined || val === undefined)
-                            continue;
-                        const existing = headers[key];
-                        headers[key] =
-                            existing === undefined ? val : existing + (key === 'cookie' ? '; ' : ', ') + val;
-                    }
-                }
                 // Capture the query string too (invalidated by the upgrade like the
                 // rest), so handlers can read handshake query params (e.g. orgId).
                 const query = this._getQuery(reqId) || '';
-                this._pendingWsInfo = { ip, headers, query };
-                const wsId = this._engine.upgradeToWebSocket(reqId);
+                this._pendingWsInfo = { ip, flat, query };
+                const wsId = this._upgradeToWebSocket(reqId);
                 this._pendingWsInfo = undefined;
                 if (wsId !== -1)
                     return; // WS took over this connection
@@ -2141,40 +2138,58 @@ export class MoroEngineServer {
         }
         this.requestCounter++;
         // SYNC FAST PATH (parity with MoroHttpServer's handleRequest split): with
-        // no body to parse, no request/response hooks and no global middleware,
-        // the router dispatch runs synchronously in this frame - the async
-        // handleRequest below would allocate a promise + async context per
-        // request only to reach zero awaits. Only the framework's own frame is
-        // de-asynced: an async route handler still returns its promise through
-        // the router and is driven to completion here.
+        // no request/response hooks, the body parse, the global middleware chain
+        // and the router dispatch all run synchronously in this frame whenever
+        // they can - the async handleRequest below would allocate a promise and
+        // an async context per request only to reach zero awaits. The engine
+        // buffered the body before onRequest fired, so parsing it is synchronous;
+        // a middleware chain whose members call next() synchronously costs no
+        // promise either (executeMiddleware returns undefined then), and only a
+        // chain that genuinely goes async hands the rest of the request to a
+        // continuation. Only the framework's own frame is de-asynced: an async
+        // route handler still returns its promise through the router and is
+        // driven to completion here.
         const hookManager = this.hookManager;
         const hooksActive = hookManager &&
             (hookManager.hasHooks === undefined ||
                 hookManager.hasHooks('request') ||
                 hookManager.hasHooks('response'));
-        const needsBody = method.charCodeAt(0) === 80 && // 'P' char code
-            (method === 'POST' || method === 'PUT' || method === 'PATCH');
-        if (!needsBody && !hooksActive && this.globalMiddleware.length === 0 && this.routerHandler) {
-            let handled = true;
-            try {
-                handled = this.routerHandler(httpReq, httpRes);
+        if (!hooksActive && this.routerHandler) {
+            let proceed = true;
+            if (method.charCodeAt(0) === 80 && // 'P' char code
+                (method === 'POST' || method === 'PUT' || method === 'PATCH')) {
+                try {
+                    this.parseBody(httpReq);
+                }
+                catch (error) {
+                    proceed = false;
+                    void this.handleDispatchError(error, httpReq, httpRes);
+                }
             }
-            catch (error) {
-                // Error path owns the response from here (handled stays true)
-                void this.handleDispatchError(error, httpReq, httpRes);
-            }
-            if (handled !== true) {
-                if (handled && typeof handled.then === 'function') {
-                    handled.then(ok => {
-                        if (!ok)
-                            void this.finishUnrouted(httpReq, httpRes);
+            if (proceed && this.globalMiddleware.length > 0) {
+                let chain;
+                try {
+                    chain = this.executeMiddleware(this.globalMiddleware, httpReq, httpRes);
+                }
+                catch (error) {
+                    proceed = false;
+                    chain = undefined;
+                    void this.handleDispatchError(error, httpReq, httpRes);
+                }
+                if (chain) {
+                    // The chain went async: route once it settles, unless it answered.
+                    proceed = false;
+                    chain.then(() => {
+                        if (!httpRes.headersSent)
+                            this.dispatchRouter(httpReq, httpRes);
                     }, error => void this.handleDispatchError(error, httpReq, httpRes));
                 }
-                else {
-                    // Sync miss from the router - direct-route fallback, then 404
-                    void this.finishUnrouted(httpReq, httpRes);
+                else if (httpRes.headersSent) {
+                    proceed = false; // a middleware answered the request itself
                 }
             }
+            if (proceed)
+                this.dispatchRouter(httpReq, httpRes);
         }
         else {
             void this.handleRequest(httpReq, httpRes);
@@ -2192,6 +2207,36 @@ export class MoroEngineServer {
             this._armMicrotaskDrain();
         }
     }
+    // The router dispatch of the sync fast path, and of a global middleware
+    // chain's async continuation: the unified router, then the direct route
+    // table and the 404 behind it, with the same error shaping as handleRequest.
+    dispatchRouter(httpReq, httpRes) {
+        const routerHandler = this.routerHandler;
+        if (!routerHandler) {
+            void this.finishUnrouted(httpReq, httpRes);
+            return;
+        }
+        let handled = true;
+        try {
+            handled = routerHandler(httpReq, httpRes);
+        }
+        catch (error) {
+            // Error path owns the response from here (handled stays true)
+            void this.handleDispatchError(error, httpReq, httpRes);
+        }
+        if (handled !== true) {
+            if (handled && typeof handled.then === 'function') {
+                handled.then(ok => {
+                    if (!ok)
+                        void this.finishUnrouted(httpReq, httpRes);
+                }, error => void this.handleDispatchError(error, httpReq, httpRes));
+            }
+            else {
+                // Sync miss from the router - direct-route fallback, then 404
+                void this.finishUnrouted(httpReq, httpRes);
+            }
+        }
+    }
     // The engine invokes onRequest with a plain V8 call from its own uv
     // callback, outside a Node callback scope, so microtasks queued during
     // dispatch - an await on an already-settled promise, a .then chain, the
@@ -2357,7 +2402,11 @@ export class MoroEngineServer {
         const raw = this._getBody(httpReq._reqId);
         if (!raw || raw.byteLength === 0)
             return;
-        const contentType = httpReq.headers['content-type'] || '';
+        // One header through one crossing: materialising the header object here
+        // would cost every request with a body a string per header line.
+        const contentType = (httpReq._headers !== undefined
+            ? httpReq._headers['content-type']
+            : this._getHeader(httpReq._reqId, 'content-type')) || '';
         const isMultipart = contentType.includes('multipart/form-data');
         const maxSize = isMultipart ? this.maxUploadSize : this.maxBodySize;
         // The engine natively enforces the larger of the two limits; the tighter