@nifrajs/core 3.5.0 → 4.0.2

package/src/server/sse.ts

@@ -106,12 +106,6 @@ function formatMessage(m: SSEMessage): string {
   return `${frame}\n` // the blank line terminates the event
 }
 
-let neverAbort: AbortSignal | undefined
-function getNeverAbort(): AbortSignal {
-  neverAbort ??= new AbortController().signal
-  return neverAbort
-}
-
 export function sse(
   c: SSEContext,
   run: (stream: SSEStream) => void | Promise<void>,
@@ -119,6 +113,9 @@ export function sse(
 ): Response {
   const encoder = new TextEncoder()
   const requestSignal: AbortSignal | undefined = c.req?.signal
+  // The producer's signal also aborts when the runtime cancels the body: a writer that finds the
+  // client gone cancels the stream, and a request signal alone may never fire.
+  const stopped = new AbortController()
   let closed = false
   let heartbeat: ReturnType<typeof setInterval> | undefined
   let onAbort: (() => void) | undefined
@@ -147,16 +144,20 @@ export function sse(
           if (!closed) controller.enqueue(encoder.encode(formatMessage(message)))
         },
         close,
-        signal: requestSignal ?? getNeverAbort(),
+        signal: stopped.signal,
       }
 
       // Stop the moment the client goes away.
       if (requestSignal !== undefined) {
         if (requestSignal.aborted) {
+          stopped.abort()
           close()
           return
         }
-        onAbort = close
+        onAbort = () => {
+          stopped.abort()
+          close()
+        }
         requestSignal.addEventListener("abort", onAbort, { once: true })
       }
 
@@ -183,6 +184,7 @@ export function sse(
       // Consumer/runtime canceled (client gone) - pending sends become no-ops.
       closed = true
       teardown()
+      stopped.abort()
     },
   })
 

package/src/server/static-headers.ts

@@ -39,6 +39,9 @@ export interface StaticResponseHeaders {
   readonly jsonHeaders: Headers
   /** `{ status: 200, headers: jsonHeaders }` - a static app's whole per-response header cost. */
   readonly jsonInit200: ResponseInit
+  /** For a group: the values its enclosing scopes declared. On the group's routes its own value of
+   * the same name replaces one of these, so the more specific scope wins. */
+  readonly inherited?: Readonly<Record<string, string>> | undefined
   /**
    * The same shape, but carrying the content-type THIS runtime's `Response.json` emits - which is not
    * always the framework init's (Deno omits the charset). Used by the lane that would otherwise call
@@ -134,8 +137,26 @@ export function mergeStaticHeaderRecord<V>(
   markLowercase = false,
 ): Record<string, V | string> {
   const merged: Record<string, V | string> = { ...statics }
+  const ownNames = Object.keys(own)
+
+  // The common Node-native route has one request-owned lower-case header (usually the request id)
+  // on top of a few static defaults. Keep the static-first property order, but avoid the generic
+  // case-folding loop and its per-name helper calls for that shape. A mixed-case name, an undefined
+  // value, or multiple names falls through to the full collision-aware path below.
+  if (ownNames.length === 1) {
+    const name = ownNames[0]!
+    const value = own[name] as V
+    if (value !== undefined && name.toLowerCase() === name) {
+      if (name === "__proto__") store(merged, name, value)
+      else merged[name] = value
+      if (markLowercase)
+        markLowercaseHeaderKeys(merged as Record<string, string | readonly string[]>)
+      return merged
+    }
+  }
+
   let allLowercase = true
-  for (const name of Object.keys(own)) {
+  for (const name of ownNames) {
     const value = own[name] as V
     if (value === undefined) continue
     const lower = name.toLowerCase()

package/src/server/transport-lane.ts

@@ -2,7 +2,7 @@
 import type { TransportCodec, TransportCodecRegistry } from "../transport-codec.ts"
 import { readBoundedBytes } from "./body.ts"
 import { jsonError } from "./http.ts"
-import { guardParsedValue, type ProtoPoisoning } from "./proto-guard.ts"
+import { guardDecodedValue, type ProtoPoisoning } from "./proto-guard.ts"
 import { isResponseResult, PRE_DECODED_BODY, type PreDecodedBody } from "./runtime-core.ts"
 import type { AnyServer, IdentityPlugin } from "./server.ts"
 
@@ -14,7 +14,7 @@ interface TransportBodySource {
 
 export type TransportDecodeResult =
   | { readonly matched: false }
-  | { readonly matched: true; readonly value: unknown }
+  | { readonly matched: true; readonly value: unknown; readonly byteLength: number }
   | { readonly matched: true; readonly response: Response }
 
 export interface TransportRuntime {
@@ -36,6 +36,13 @@ export interface TransportCodecsOptions {
    * a poisoned payload answers the same flat 400 as an undecodable one.
    */
   readonly protoPoisoning?: ProtoPoisoning
+  /**
+   * Whether a decoded request body may hold a `RegExp` (the rich wire codec carries them). Default
+   * `false`: a client-supplied pattern is code, and one with catastrophic backtracking stalls the
+   * event loop the moment anything runs it. A refused body answers the same flat 400 as an
+   * undecodable one.
+   */
+  readonly acceptRegExp?: boolean
 }
 
 export function transportCodecs(
@@ -47,6 +54,7 @@ export function transportCodecs(
     throw new RangeError("transport maxBytes must be a non-negative safe integer")
   }
   const protoPoisoning = options.protoPoisoning ?? "reject"
+  const acceptRegExp = options.acceptRegExp === true
   const runtime: TransportRuntime = Object.freeze({
     responseCodec(accept: string | null): TransportCodec {
       try {
@@ -84,7 +92,8 @@ export function transportCodecs(
         // payload answers exactly like an undecodable one.
         return {
           matched: true,
-          value: guardParsedValue(codec.decode(text), protoPoisoning),
+          value: guardDecodedValue(codec.decode(text), protoPoisoning, acceptRegExp),
+          byteLength: read.bytes.byteLength,
         }
       } catch {
         return {
@@ -110,7 +119,6 @@ export function transportCodecs(
       ) {
         return undefined
       }
-      const replacement = request.clone()
       const decoded = await runtime.decodeRequest(request, contentType, maxBytes)
       if (!decoded.matched) return undefined
       if ("response" in decoded) return decoded.response
@@ -119,19 +127,19 @@ export function transportCodecs(
       // the body lane takes the stash verbatim (this lane owns the cap and poisoning policy), so
       // the placeholder body is never parsed and codec machinery stays out of the kernel.
       const headers: Record<string, string> = {}
-      replacement.headers.forEach((value, name) => {
+      request.headers.forEach((value, name) => {
         headers[name] = value
       })
       headers["content-type"] = "application/json"
       headers["content-length"] = "2"
       delete headers["transfer-encoding"]
-      const normalized = new Request(replacement.url, {
-        method: replacement.method,
+      const normalized = new Request(request.url, {
+        method: request.method,
         headers,
         body: "{}",
-        signal: replacement.signal as never,
+        signal: request.signal as never,
       })
-      const stash: PreDecodedBody = { value: decoded.value }
+      const stash: PreDecodedBody = { value: decoded.value, byteLength: decoded.byteLength }
       Object.defineProperty(normalized, PRE_DECODED_BODY, { value: stash })
       return normalized
     })

package/src/server/validation.ts

@@ -1,12 +1,18 @@
 import type { StandardIssue } from "../schema/standard.ts"
 import { type ResponseResult, status } from "./runtime-core.ts"
 
+/** The most issues a 422 body lists: a body of a million bad array items must not answer with a
+ * response many times its own size. */
+const MAX_VALIDATION_ISSUES = 100
+
 function validationIssues(issues: ReadonlyArray<StandardIssue>): {
   ok: false
   error: string
   issues: unknown[]
 } {
-  const serialized = issues.map((issue) => {
+  const listed =
+    issues.length > MAX_VALIDATION_ISSUES ? issues.slice(0, MAX_VALIDATION_ISSUES) : issues
+  const serialized = listed.map((issue) => {
     const path = issue.path?.map((seg) => String(typeof seg === "object" ? seg.key : seg))
     return path !== undefined ? { message: issue.message, path } : { message: issue.message }
   })

package/src/server/websocket.ts

@@ -17,6 +17,7 @@ import type {
 } from "../schema/standard.ts"
 import { validateStandard } from "../schema/standard.ts"
 import { decodeTransportFrame, type TransportCodecRegistry } from "../transport-codec.ts"
+import { guardDecodedValue, type ProtoPoisoning, parseJsonGuarded } from "./proto-guard.ts"
 
 type MaybePromise<T> = T | Promise<T>
 
@@ -180,6 +181,10 @@ export interface WebSocketHandler<
   transport?: {
     readonly registry: TransportCodecRegistry
     readonly maxBytes?: number
+    /** Whether an inbound frame may decode to a value holding a `RegExp`. Default `false`: a
+     * client-supplied pattern is code (catastrophic backtracking stalls the event loop), so such a
+     * frame is treated as invalid. */
+    readonly acceptRegExp?: boolean
   }
   open?(ws: NifraWebSocket<Data>): MaybePromise<void>
   message?(ws: NifraWebSocket<Data>, data: WsMessageInput<Schema>): MaybePromise<void>
@@ -223,7 +228,7 @@ export type WsAttach = (
   socket: StandardWebSocket,
   handler: WebSocketHandler,
   data: unknown,
-  options: { openNow: boolean; pubsub: TopicRegistry; maxPayloadBytes?: number },
+  options: { openNow: boolean; pubsub: TopicRegistry; maxPayloadBytes?: number | undefined },
 ) => NifraWebSocket
 
 /**
@@ -263,7 +268,7 @@ export function attachWebSocket<
   socket: StandardWebSocket,
   handler: WebSocketHandler<Data, Env, Schema, Send>,
   data: unknown,
-  options: { openNow: boolean; pubsub: TopicRegistry; maxPayloadBytes?: number },
+  options: { openNow: boolean; pubsub: TopicRegistry; maxPayloadBytes?: number | undefined },
 ): NifraWebSocket<Data> {
   const { pubsub } = options
   let ws!: NifraWebSocket<Data>
@@ -436,8 +441,13 @@ export function createWebSocketSender(
  * parse as JSON, run the Standard Schema, then call the user's `message` with the typed value, or
  * `onInvalidMessage` on failure. Returns the handler unchanged when no schema is set. Called once at
  * `app.ws()` registration, so every adapter dispatches validated messages with no per-adapter code.
+ * `protoPoisoning` is the app's body policy: a frame with a `__proto__` key gets what a JSON body
+ * with one gets, and under `"reject"` reads as invalid JSON.
  */
-export function wrapWebSocketMessageValidation(handler: WebSocketHandler): WebSocketHandler {
+export function wrapWebSocketMessageValidation(
+  handler: WebSocketHandler,
+  protoPoisoning: ProtoPoisoning = "reject",
+): WebSocketHandler {
   const schema = handler.messageSchema
   if (schema === undefined) return handler
   // The handler is type-erased here; the user's `message` really accepts the schema's validated output
@@ -452,12 +462,16 @@ export function wrapWebSocketMessageValidation(handler: WebSocketHandler): WebSo
       const text = typeof raw === "string" ? raw : WS_MESSAGE_DECODER.decode(raw)
       parsed =
         handler.transport === undefined
-          ? JSON.parse(text)
-          : decodeTransportFrame(text, handler.transport.registry, {
-              ...(handler.transport.maxBytes === undefined
-                ? {}
-                : { maxBytes: handler.transport.maxBytes }),
-            })
+          ? parseJsonGuarded(text, protoPoisoning)
+          : guardDecodedValue(
+              decodeTransportFrame(text, handler.transport.registry, {
+                ...(handler.transport.maxBytes === undefined
+                  ? {}
+                  : { maxBytes: handler.transport.maxBytes }),
+              }),
+              protoPoisoning,
+              handler.transport.acceptRegExp === true,
+            )
     } catch {
       return onInvalid?.(ws, [{ message: "invalid JSON" }], raw)
     }

package/src/server/ws-bun.ts

@@ -18,6 +18,8 @@ import type { BunWsHandlers } from "./ws-hook.ts"
  * `upgrade()`-seeded user data, and the memoized portable {@link NifraWebSocket} wrapper. */
 export interface BunWsData {
   readonly handler: WebSocketHandler
+  /** Mounted/modern upgrades carry this registry; old/manual fixtures may omit it. */
+  readonly pubsub?: TopicRegistry
   data: unknown
   nifra?: NifraWebSocket
 }
@@ -57,6 +59,9 @@ function wrapBunSocket(
   nativePubsub: boolean,
 ): NifraWebSocket {
   let ws!: NifraWebSocket
+  // Mounted child apps carry their own TopicRegistry in the upgrade outcome. Keep the argument as a
+  // fallback for old/manual Bun upgrades, but use the per-connection registry for composed mounts.
+  const pubsub = raw.data.pubsub ?? topics
   const reportError = (error: unknown): void => reportWsError(error, ws, handler)
   const send = createWebSocketSender(
     (data) => {
@@ -75,10 +80,10 @@ function wrapBunSocket(
     },
     subscribe: nativePubsub
       ? (topic) => raw.subscribe(topic)
-      : (topic) => topics.subscribe(topic, ws),
+      : (topic) => pubsub.subscribe(topic, ws),
     unsubscribe: nativePubsub
       ? (topic) => raw.unsubscribe(topic)
-      : (topic) => topics.unsubscribe(topic, ws),
+      : (topic) => pubsub.unsubscribe(topic, ws),
     get data() {
       return raw.data.data
     },
@@ -151,7 +156,7 @@ export function createBunWsHandlers(topics: TopicRegistry, nativePubsub = false)
       const nifra = ws.data.nifra ?? wrapBunSocket(ws, topics, ws.data.handler, nativePubsub)
       // Registry mode: drop topic subscriptions so it never holds a dead socket. Native mode: Bun
       // unsubscribes the socket from every topic on close, so there is nothing to sweep here.
-      if (!nativePubsub) topics.unsubscribeAll(nifra)
+      if (!nativePubsub) (ws.data.pubsub ?? topics).unsubscribeAll(nifra)
       dispatchWsCallback(() => ws.data.handler.close?.(nifra, code, reason), nifra, ws.data.handler)
     },
   }

package/src/server/ws-hook.ts

@@ -8,6 +8,7 @@
  * Only type declarations below - this module must stay weightless, it is always in the base bundle.
  */
 
+import type { ProtoPoisoning } from "./proto-guard.ts"
 import type {
   NifraWebSocket,
   StandardWebSocket,
@@ -27,7 +28,7 @@ export interface BunWsHandlers {
 /** What `@nifrajs/core/ws` registers: everything `server.ts` and `toFetchHandler` need at runtime. */
 export interface WsRuntime {
   /** `wrapWebSocketMessageValidation` - applied once at `app.ws()` registration. */
-  wrapHandler(handler: WebSocketHandler): WebSocketHandler
+  wrapHandler(handler: WebSocketHandler, protoPoisoning: ProtoPoisoning): WebSocketHandler
   /** One in-process pub/sub registry per app (backs `ws.subscribe` + `app.publish`). */
   createTopics(): TopicRegistry
   /** The Bun `websocket` config for `listen()` when the app has WS routes. `nativePubsub` routes

package/src/server.ts

@@ -11,7 +11,18 @@
 export { FrameworkError, RouteConfigError, type RouteConfigErrorCode } from "./errors.ts"
 export { FRAMEWORK_NAME, type FrameworkName } from "./internal/brand.ts"
 export { isSameOriginRequest } from "./internal/same-origin.ts"
-export { METHODS, type Method, Router, type RouterMatch } from "./router/router.ts"
+export {
+  ROUTE_PATTERN_OVERLAP_MAX_STATES,
+  RoutePatternOverlapLimitError,
+  routePatternOverlap,
+} from "./router/overlap.ts"
+export {
+  METHODS,
+  type Method,
+  type RouteMethod,
+  Router,
+  type RouterMatch,
+} from "./router/router.ts"
 export type {
   InferInput,
   InferOutput,
@@ -21,11 +32,24 @@ export type {
   StandardTypes,
   ValidationOutcome,
 } from "./schema/standard.ts"
+export {
+  type AuthenticationFailure,
+  type AuthenticationFailureReason,
+  type AuthenticationInput,
+  type AuthenticationResult,
+  type AuthenticationStage,
+  type AuthenticationSuccess,
+  type AuthHeaders,
+  type AuthMaybePromise,
+  authenticated,
+  rejected,
+} from "./server/auth.ts"
 export type {
   Context,
   Params,
   Platform,
   Prettify,
+  RequestPath,
   ResponseControls,
   RouteSchema,
 } from "./server/context.ts"
@@ -71,7 +95,15 @@ export {
   toVercelHandler,
   type VercelHandler,
 } from "./server/platform-adapters.ts"
-export type { Registry, ResponseMapFor, RouteInfo, RouteInfoFor } from "./server/registry.ts"
+export type {
+  JoinRoutePath,
+  PrefixRegistry,
+  Registry,
+  ResponseMapFor,
+  RouteInfo,
+  RouteInfoFor,
+} from "./server/registry.ts"
+export { replacedRequestOf } from "./server/request-lineage.ts"
 export {
   type PlainRender,
   type ResponseResult,
@@ -90,9 +122,13 @@ export {
   defineRouterPlugin,
   type Handler,
   type IdentityPlugin,
+  type ListenTlsOptions,
   type McpPromptDescriptor,
   type McpResourceDescriptor,
   type Middleware,
+  type MountableApp,
+  type MountFetchOptions,
+  type MountOptions,
   type NifraFeatureVersion,
   type NifraPlugin,
   type NodeRequestContext,

package/src/single-copy-register.ts

@@ -18,6 +18,11 @@
  *
  * `nifra check` reads this specifier out of `bunfig.toml` as the proof that the runtime arm is armed,
  * so the string above is a contract rather than a suggestion.
+ *
+ * A declared package that cannot be collapsed (two versions, or a file with no counterpart in the
+ * app's copy) prints one warning per package naming both copies. Set
+ * `"singleCopy": { "packages": [...], "strict": true }` in package.json, or `NIFRA_SINGLE_COPY_STRICT=1`,
+ * to make the preload throw instead.
  */
 import { registerSingleCopy } from "./single-copy"