@nifrajs/core 3.1.0 → 3.2.0

package/src/server/respond.ts

@@ -122,6 +122,8 @@ function staticJsonResponse(
       contentType,
     )
   }
+  // lgtm [js/stack-trace-exposure] `body` is already serialized; ordinary thrown errors are replaced
+  // with the fixed internal-error envelope before reaching this response boundary.
   return new Response(body, init)
 }
 
@@ -160,6 +162,7 @@ function withStaticHeaderInit(
 // portable constructor path there and select the Deno-specific shape only for Web responses that
 // carry a plain record. The first request lazily probes Deno's native JSON content-type so this
 // preserves the runtime's Response.json contract instead of baking in Bun's charset suffix.
+const IS_BUN = typeof (globalThis as { Bun?: unknown }).Bun !== "undefined"
 const IS_DENO = typeof (globalThis as { Deno?: unknown }).Deno !== "undefined"
 let denoJsonContentType: string | undefined
 
@@ -176,6 +179,8 @@ function denoResponseWithJsonBody(
   headers: Record<string, string>,
   defaultContentType = responseJsonContentType(),
 ): Response {
+  // lgtm [js/stack-trace-exposure] this body is serialized data; ordinary thrown errors are replaced
+  // with the fixed internal-error envelope before reaching this response boundary.
   const response = new Response(body, { status })
   let hasContentType = false
   for (const [name, value] of Object.entries(headers)) {
@@ -188,6 +193,24 @@ function denoResponseWithJsonBody(
   return response
 }
 
+/**
+ * Render a JSON value with caller-owned headers on the runtimes where mutating the response is
+ * cheaper than asking the Response constructor to ingest a record. Node deliberately stays on the
+ * record path: its undici implementation is a little faster there, and its production HTTP adapter
+ * normally uses the direct node outcome anyway. The two operations are equivalent at the Web
+ * boundary: Response.json supplies the same default content type, then the caller's headers override
+ * it exactly as `withJsonContentType` did.
+ */
+function jsonResponseWithOwnHeaders(
+  result: object,
+  status: number,
+  headers: Record<string, string>,
+): Response {
+  const response = status === 200 ? Response.json(result) : Response.json(result, { status })
+  for (const name of Object.keys(headers)) response.headers.set(name, headers[name]!)
+  return stamped(response)
+}
+
 // The framework-buffered-body marker shared with the Node adapter: a Response carrying it exposes
 // its already-serialized bytes without draining. On the Web serving paths it exists ONLY when a
 // registered body/raw hook needs it, so hook-less apps pay nothing.
@@ -438,6 +461,24 @@ export function toResponse(
   if (status === 204 || status === 205 || status === 304) {
     return stamped(new Response(null, headers === undefined ? { status } : { status, headers }))
   }
+  // Bun and Deno both make a JSON response first and then accept a few header mutations more cheaply
+  // than ingesting the same plain record in the constructor. This is the common dynamic-header
+  // shape (`c.set.headers`) after all cookies/static-header/tagging cases have been excluded. Keep the
+  // Node record path unchanged: its Web constructor wins by a small margin, and the native Node
+  // adapter's normal route finalizer does not build this Response in the first place.
+  if (
+    own !== undefined &&
+    !(own instanceof Headers) &&
+    statics === undefined &&
+    (set._cookies === undefined || set._cookies.length === 0) &&
+    (IS_BUN || IS_DENO) &&
+    !tagResponseBody &&
+    result !== undefined &&
+    typeof result === "object" &&
+    result !== null
+  ) {
+    return jsonResponseWithOwnHeaders(result, status, own)
+  }
   if (own === undefined && result !== undefined) {
     // Fast respond (profiled ~50 ns/req faster on every plain-JSON return): `JSON.stringify` + a
     // prebuilt init beats `Response.json`'s internal init handling. Output is byte-identical -
@@ -451,7 +492,8 @@ export function toResponse(
           : { status, headers: jsonCtHeaders }
       return tagged(
         statics === undefined
-          ? new Response(body, init)
+          ? // lgtm [js/stack-trace-exposure] the serialized body is not a caught error stack.
+            new Response(body, init)
           : staticJsonResponse(body, status, statics, JSON_CONTENT_TYPE, init),
         body,
         tagResponseBody,
@@ -471,7 +513,8 @@ export function toResponse(
               headers as Record<string, string>,
               JSON_CT_HEADERS.get("content-type") ?? "application/json;charset=utf-8",
             )
-          : new Response(body, { status, headers: withJsonContentType(headers) })
+          : // lgtm [js/stack-trace-exposure] the serialized body is not a caught error stack.
+            new Response(body, { status, headers: withJsonContentType(headers) })
       return tagged(
         response,
         body,

package/src/server/runtime-core.ts

@@ -64,6 +64,22 @@ export interface ResponseResult {
   readonly plain?: PlainRender
 }
 
+/**
+ * Type-only metadata carried by {@link status}. The symbol is declared, not created, so this brand
+ * adds no runtime property and no per-response allocation. It lets the registry distinguish a typed
+ * early response from an ordinary handler value while preserving the existing ResponseResult marker.
+ */
+export declare const STATUS_RESPONSE_TYPE: unique symbol
+
+/** A status-bearing response whose code and body remain visible to TypeScript. */
+export interface StatusResponse<Code extends number = number, Body = unknown>
+  extends ResponseResult {
+  readonly [STATUS_RESPONSE_TYPE]: {
+    readonly code: Code
+    readonly body: Body
+  }
+}
+
 export function isResponseResult(value: unknown): value is ResponseResult {
   return (
     typeof value === "object" &&
@@ -114,11 +130,21 @@ export function plainRenderHeaders(
  * The body is serialized by the lane that renders it, exactly like a handler's plain return, so the
  * response carries a `content-length` rather than falling to chunked, and queued cookies still apply.
  */
+export function status<const Code extends number>(
+  code: Code,
+  body?: undefined,
+  init?: { readonly headers?: Readonly<Record<string, string>> },
+): StatusResponse<Code, undefined>
+export function status<const Code extends number, const Body>(
+  code: Code,
+  body: Body,
+  init?: { readonly headers?: Readonly<Record<string, string>> },
+): StatusResponse<Code, Body>
 export function status(
   code: number,
   body?: unknown,
   init?: { readonly headers?: Readonly<Record<string, string>> },
-): ResponseResult {
+): StatusResponse<number, unknown> {
   // The range `Response` accepts, enforced HERE so the plain lane cannot outrun it. A plain render
   // is written straight to the socket by the Node adapter, where `writeHead` takes 100-999 - so a
   // status this rejects would otherwise ship on Node and throw on every Web runtime, from the same
@@ -141,7 +167,7 @@ export function status(
       headers["content-type"] ??= "application/json;charset=utf-8"
       return new Response(JSON.stringify(body), { status: code, headers })
     },
-  }
+  } as StatusResponse<number, unknown>
 }
 
 /** The concrete `Request` for a source - itself when a real `Request` was passed (the Web path), or the

package/src/server/server-types.ts

@@ -256,6 +256,9 @@ export interface RunningServer {
   readonly hostname: string
   readonly pendingRequests: number
   stop(closeActiveConnections?: boolean): void
+  /** Bun's native topic broadcast, present on the Bun `Server` handle. `app.publish` delegates to it
+   * in native-pubsub mode; absent on other runtimes' running-server views. */
+  publish?(topic: string, data: string | ArrayBufferView | ArrayBuffer): number
 }
 
 /**