@nifrajs/core 4.0.2 → 5.1.0

package/src/server/sse.ts

@@ -39,7 +39,10 @@ export interface SSEMessage {
 
 /** The stream handed to the `run` callback. */
 export interface SSEStream {
-  /** Enqueue an event frame. No-op once the stream is closed. */
+  /**
+   * Enqueue an event frame. No-op once the stream is closed, including after a client that fell
+   * more than `maxBufferedBytes` behind was dropped.
+   */
   send(message: SSEMessage): void
   /** End the stream now. */
   close(): void
@@ -59,8 +62,17 @@ export interface SSEInit {
   readonly headers?: ConstructorParameters<typeof Headers>[0]
   /** Send a `: ` comment ping every N ms so idle proxies don't drop the connection. */
   readonly keepAlive?: number
+  /**
+   * Bytes of sent events one client may leave unread, default 1 MiB. Past it the client is dropped:
+   * `signal` aborts, the queued frames are released, and later sends are no-ops, so a reader that
+   * stalls cannot hold server memory without limit. Raise it for a burst larger than this sent before
+   * the client can read; `Infinity` turns the limit off.
+   */
+  readonly maxBufferedBytes?: number
 }
 
+const DEFAULT_MAX_BUFFERED_BYTES = 1024 * 1024
+
 /**
  * The stream handed to an `app.sse()` handler: `send` takes the route's TYPED event payload and
  * serializes it (JSON) into the SSE `data:` field - the compile-time half of the `sse` contract.
@@ -111,6 +123,9 @@ export function sse(
   run: (stream: SSEStream) => void | Promise<void>,
   init: SSEInit = {},
 ): Response {
+  const maxBuffered = init.maxBufferedBytes ?? DEFAULT_MAX_BUFFERED_BYTES
+  if (!(maxBuffered >= 0))
+    throw new RangeError("sse maxBufferedBytes must be a non-negative number")
   const encoder = new TextEncoder()
   const requestSignal: AbortSignal | undefined = c.req?.signal
   // The producer's signal also aborts when the runtime cancels the body: a writer that finds the
@@ -127,66 +142,80 @@ export function sse(
     }
   }
 
-  const body = new ReadableStream<Uint8Array>({
-    start(controller) {
-      const close = (): void => {
-        if (closed) return
-        closed = true
-        teardown()
-        try {
-          controller.close()
-        } catch {
-          // Already closed by the runtime's cancel() - safe to ignore.
+  const body = new ReadableStream<Uint8Array>(
+    {
+      start(controller) {
+        const close = (): void => {
+          if (closed) return
+          closed = true
+          teardown()
+          try {
+            controller.close()
+          } catch {
+            // Already closed by the runtime's cancel() - safe to ignore.
+          }
         }
-      }
-      const stream: SSEStream = {
-        send(message) {
-          if (!closed) controller.enqueue(encoder.encode(formatMessage(message)))
-        },
-        close,
-        signal: stopped.signal,
-      }
-
-      // Stop the moment the client goes away.
-      if (requestSignal !== undefined) {
-        if (requestSignal.aborted) {
-          stopped.abort()
-          close()
-          return
+        const stream: SSEStream = {
+          send(message) {
+            if (closed) return
+            // The queue only shrinks as the runtime writes to the socket, so a backlog past the cap
+            // is a client that stopped reading. Erroring the body releases the queue and the socket.
+            if ((controller.desiredSize ?? 0) < 0) {
+              closed = true
+              teardown()
+              const reason = new Error("sse_client_too_slow")
+              stopped.abort(reason)
+              controller.error(reason)
+              return
+            }
+            controller.enqueue(encoder.encode(formatMessage(message)))
+          },
+          close,
+          signal: stopped.signal,
+        }
+
+        // Stop the moment the client goes away.
+        if (requestSignal !== undefined) {
+          if (requestSignal.aborted) {
+            stopped.abort()
+            close()
+            return
+          }
+          onAbort = () => {
+            stopped.abort()
+            close()
+          }
+          requestSignal.addEventListener("abort", onAbort, { once: true })
         }
-        onAbort = () => {
-          stopped.abort()
-          close()
+
+        if (init.keepAlive !== undefined && init.keepAlive > 0) {
+          heartbeat = setInterval(() => stream.send({ comment: "" }), init.keepAlive)
+          // Don't let the ping keep a Node process alive on its own.
+          ;(heartbeat as { unref?: () => void }).unref?.()
         }
-        requestSignal.addEventListener("abort", onAbort, { once: true })
-      }
-
-      if (init.keepAlive !== undefined && init.keepAlive > 0) {
-        heartbeat = setInterval(() => stream.send({ comment: "" }), init.keepAlive)
-        // Don't let the ping keep a Node process alive on its own.
-        ;(heartbeat as { unref?: () => void }).unref?.()
-      }
-      // An async IIFE so a synchronous throw in `run` becomes a rejection we can surface.
-      ;(async () => {
-        await run(stream)
-      })().then(close, (err: unknown) => {
-        if (closed) return
+        // An async IIFE so a synchronous throw in `run` becomes a rejection we can surface.
+        ;(async () => {
+          await run(stream)
+        })().then(close, (err: unknown) => {
+          if (closed) return
+          closed = true
+          teardown()
+          try {
+            controller.error(err instanceof Error ? err : new Error("sse_producer_failed"))
+          } catch {
+            // Stream already torn down.
+          }
+        })
+      },
+      cancel() {
+        // Consumer/runtime canceled (client gone) - pending sends become no-ops.
         closed = true
         teardown()
-        try {
-          controller.error(err instanceof Error ? err : new Error("sse_producer_failed"))
-        } catch {
-          // Stream already torn down.
-        }
-      })
-    },
-    cancel() {
-      // Consumer/runtime canceled (client gone) - pending sends become no-ops.
-      closed = true
-      teardown()
-      stopped.abort()
+        stopped.abort()
+      },
     },
-  })
+    { highWaterMark: maxBuffered, size: (chunk) => chunk?.byteLength ?? 0 },
+  )
 
   const headers = new Headers(init.headers)
   headers.set("content-type", "text/event-stream; charset=utf-8")

package/src/server/transport-lane.ts

@@ -27,7 +27,13 @@ export interface TransportRuntime {
 }
 
 export interface TransportCodecsOptions {
-  /** Maximum encoded request bytes. Keep aligned with `server({ maxBodyBytes })`. */
+  /**
+   * Maximum encoded request bytes. Default 1,000,000. Keep aligned with `server({ maxBodyBytes })`.
+   *
+   * The plugin decodes a codec body in an `onRequest` hook, before routing, so a route's own
+   * `bodyLimit` and its `authenticate()` stages run only after the decode. This cap is the only
+   * bound on that work: set it to the largest codec body any route should accept.
+   */
   readonly maxBytes?: number
   /**
    * Prototype-poisoning policy for decoded request bodies, mirroring

package/src/server/webhook.ts

@@ -19,14 +19,17 @@ const DEFAULT_MAX_BYTES = 1024 * 1024 // 1 MiB - webhook payloads are small; cap
 const DEFAULT_TOLERANCE_SECONDS = 300 // 5-min replay window for timestamped schemes (Stripe's default).
 
 export type WebhookProvider = "stripe" | "github" | "generic"
-export type SignatureEncoding = "hex" | "base64"
+export type SignatureEncoding = "hex" | "base64" | "base64url"
 
 export interface VerifyWebhookOptions {
   /** Known-provider preset. Default `"generic"` (which requires {@link header}). */
   readonly provider?: WebhookProvider
   /** Header carrying the signature. Required for `generic`; overrides the preset otherwise. */
   readonly header?: string
-  /** How the signature is encoded in the header. Default `"hex"`. */
+  /**
+   * How the signature is encoded in the header. Default `"hex"`. `"base64url"` accepts the padded and
+   * unpadded forms and nothing outside its alphabet.
+   */
   readonly encoding?: SignatureEncoding
   /** A prefix stripped from the header value before decoding, e.g. `"sha256="`. */
   readonly prefix?: string
@@ -96,10 +99,26 @@ const fromBase64 = (value: string): Uint8Array<ArrayBuffer> | null => {
   }
 }
 
+const BASE64URL = /^[A-Za-z0-9_-]+={0,2}$/
+
+const fromBase64Url = (value: string): Uint8Array<ArrayBuffer> | null => {
+  if (!BASE64URL.test(value)) return null
+  const unpadded = value.replace(/=+$/, "")
+  // Padding only ever completes the last quartet; a lone trailing character encodes no byte.
+  if (unpadded.length % 4 === 1) return null
+  if (unpadded.length !== value.length && value.length % 4 !== 0) return null
+  return fromBase64(unpadded.replaceAll("-", "+").replaceAll("_", "/"))
+}
+
 const decodeSignature = (
   value: string,
   encoding: SignatureEncoding,
-): Uint8Array<ArrayBuffer> | null => (encoding === "hex" ? fromHex(value) : fromBase64(value))
+): Uint8Array<ArrayBuffer> | null =>
+  encoding === "hex"
+    ? fromHex(value)
+    : encoding === "base64url"
+      ? fromBase64Url(value)
+      : fromBase64(value)
 
 /** True iff `sig` is a valid HMAC-SHA256 of `payload` under any of `keys` (constant-time per check). */
 async function verifyAny(

package/src/server/websocket.ts

@@ -18,6 +18,7 @@ import type {
 import { validateStandard } from "../schema/standard.ts"
 import { decodeTransportFrame, type TransportCodecRegistry } from "../transport-codec.ts"
 import { guardDecodedValue, type ProtoPoisoning, parseJsonGuarded } from "./proto-guard.ts"
+import { isResponseResult } from "./runtime-core.ts"
 
 type MaybePromise<T> = T | Promise<T>
 
@@ -133,6 +134,7 @@ export interface WebSocketHandler<
   Env = unknown,
   Schema extends StandardSchemaV1 | undefined = undefined,
   Send extends StandardSchemaV1 | undefined = undefined,
+  Extra = unknown,
 > {
   /**
    * Cross-site WebSocket hijacking (CSWSH) guard - checked BEFORE `upgrade()`. A browser does not
@@ -150,12 +152,22 @@ export interface WebSocketHandler<
    */
   allowedOrigins?: ReadonlyArray<string> | ((origin: string | null) => boolean)
   /**
-   * Runs in the HTTP request context **before** the upgrade (and after {@link allowedOrigins}) - the
-   * place to authenticate or rate-limit. Return the initial per-connection `data` (→ `ws.data`), or a
-   * `Response` to **reject** the upgrade (the client never connects). Omit to accept with
-   * `data: undefined`. A thrown error rejects with a flat 500.
+   * The capability ids this socket's code may reach, exactly as an HTTP route's `capabilities`.
+   * `nifra capabilities check` compares them with the effects reachable from the module that
+   * registers the socket. The handshake context carries the guard, so a runtime beacon in `upgrade()`
+   * (or one that keeps `c`) fails closed on an undeclared capability.
    */
-  upgrade?(c: WebSocketContext<Env>): MaybePromise<Data | Response>
+  capabilities?: readonly string[]
+  /**
+   * Runs in the HTTP request context **before** the upgrade, last in the chain an HTTP `GET` to the
+   * same path runs: after {@link allowedOrigins}, then the `authenticate()` stages, `derive`s and
+   * `beforeHandle`s registered before this route, any of which can refuse the handshake. `c` carries
+   * what they derived. Return the initial per-connection `data` (→ `ws.data`), or a `Response` or
+   * `status(...)` to **reject** the upgrade (the client never connects). Omit to accept with
+   * `data: undefined`. A thrown `Response` rejects with it; any other throw goes to the route's
+   * `onError` hooks, then a flat 500.
+   */
+  upgrade?(c: WebSocketContext<Env> & Extra): MaybePromise<Data | Response>
   /**
    * Contract-first messages: a Standard Schema (`t`, zod, valibot, …) validating each **inbound** frame.
    * Text frames are parsed as JSON first. When set, `message` receives the validated, typed value; a
@@ -221,8 +233,19 @@ export type WebSocketUpgradeOutcome =
        * `.use(websocket())` tree-shaking). `@nifrajs/workers` may import `attachWebSocket` directly instead. */
       readonly attach: WsAttach
       readonly maxPayloadBytes?: number
+      /** Builds `ws.send` over an adapter's native send, enforcing the route's {@link
+       * WebSocketHandler.validateSend}. Set on every outcome a nifra app produces; an adapter that
+       * wires its own sockets instead of calling `attach` (Node, Deno) builds `send` with it. */
+      readonly sender?: WsSender
     }
 
+/** The send-builder the upgrade outcome carries (the installed runtime's `sender`). */
+export type WsSender = (
+  handler: WebSocketHandler,
+  send: (payload: string | ArrayBufferView | ArrayBuffer) => void,
+  onError: (error: unknown) => void,
+) => (payload: string | ArrayBufferView | ArrayBuffer) => void
+
 /** The socket-wiring signature the upgrade outcome carries (the installed runtime's `attach`). */
 export type WsAttach = (
   socket: StandardWebSocket,
@@ -313,18 +336,11 @@ export function attachWebSocket<
   socket.addEventListener("message", (event: { readonly data: unknown }) => {
     const raw = event.data
     const payload: WebSocketData = typeof raw === "string" ? raw : toBinary(raw)
-    // Measuring a text frame costs a full UTF-8 encode plus the buffer it allocates, so it happens
-    // only for a route that actually declared a cap. Reading `.byteLength` off an already-decoded
-    // binary frame is free, but the branch stays under the same guard to keep one shape here.
-    if (maxPayloadBytes !== undefined) {
-      const payloadBytes =
-        typeof raw === "string"
-          ? WS_PAYLOAD_ENCODER.encode(raw).byteLength
-          : (payload as Uint8Array).byteLength
-      if (payloadBytes > maxPayloadBytes) {
-        socket.close(1009, "message too large")
-        return
-      }
+    // The runtime hands over each message whole, so this bounds what reaches the handler, not what
+    // the runtime buffered to deliver it.
+    if (maxPayloadBytes !== undefined && exceedsPayloadCap(payload, maxPayloadBytes)) {
+      socket.close(1009, "message too large")
+      return
     }
     safe(() =>
       (
@@ -351,7 +367,25 @@ export function attachWebSocket<
 }
 
 const WS_MESSAGE_DECODER = new TextDecoder()
-const WS_PAYLOAD_ENCODER = new TextEncoder()
+
+/** Whether a message is over `cap` UTF-8 bytes, without encoding a text one: each UTF-16 unit takes
+ * 1-3 bytes (a surrogate pair 4 for its 2), so only a length between those bounds is counted. */
+export function exceedsPayloadCap(
+  message: string | ArrayBuffer | Uint8Array,
+  cap: number,
+): boolean {
+  if (typeof message !== "string") return message.byteLength > cap
+  const units = message.length
+  if (units > cap) return true
+  if (units * 3 <= cap) return false
+  let bytes = 0
+  for (let i = 0; i < units; i++) {
+    const unit = message.charCodeAt(i)
+    bytes += unit < 0x80 ? 1 : unit < 0x800 || (unit >= 0xd800 && unit <= 0xdfff) ? 2 : 3
+    if (bytes > cap) return true
+  }
+  return false
+}
 
 type WebSocketSendPayload = string | ArrayBufferView | ArrayBuffer
 
@@ -436,6 +470,10 @@ export function createWebSocketSender(
   }
 }
 
+/** {@link createWebSocketSender} configured from a route's handler: the outcome's `sender`. */
+export const webSocketSender: WsSender = (handler, send, onError) =>
+  createWebSocketSender(send, handler.sendSchema, handler.validateSend, handler.transport, onError)
+
 /**
  * If the handler declares a `messageSchema`, return a copy whose `message` validates each frame -
  * parse as JSON, run the Standard Schema, then call the user's `message` with the typed value, or
@@ -444,6 +482,33 @@ export function createWebSocketSender(
  * `protoPoisoning` is the app's body policy: a frame with a `__proto__` key gets what a JSON body
  * with one gets, and under `"reject"` reads as invalid JSON.
  */
+/** `upgrade()`'s acceptance, wrapped so a handshake's route chain tells it from an early result such
+ * as a guard's `Response` or a rejected auth stage. */
+class HandshakeAccepted {
+  readonly data: unknown
+  constructor(data: unknown) {
+    this.data = data
+  }
+}
+
+const acceptHandshake = (value: unknown): unknown =>
+  value instanceof Response || isResponseResult(value) ? value : new HandshakeAccepted(value)
+
+/** The step a handshake's route chain ends in: the route's `upgrade()`, or an acceptance without data. */
+export function handshakeUpgradeStep(
+  handler: WebSocketHandler,
+): (ctx: WebSocketContext) => unknown {
+  return (ctx) => {
+    const data = handler.upgrade?.(ctx)
+    return data instanceof Promise ? data.then(acceptHandshake) : acceptHandshake(data)
+  }
+}
+
+/** The acceptance a handshake's route chain ended in, or `undefined` when the chain refused it. */
+export function acceptedHandshake(result: unknown): { readonly data: unknown } | undefined {
+  return result instanceof HandshakeAccepted ? result : undefined
+}
+
 export function wrapWebSocketMessageValidation(
   handler: WebSocketHandler,
   protoPoisoning: ProtoPoisoning = "reject",

package/src/server/ws-bun.ts

@@ -7,6 +7,7 @@
 
 import {
   createWebSocketSender,
+  exceedsPayloadCap,
   type NifraWebSocket,
   type TopicRegistry,
   type WebSocketData,
@@ -20,6 +21,9 @@ export interface BunWsData {
   readonly handler: WebSocketHandler
   /** Mounted/modern upgrades carry this registry; old/manual fixtures may omit it. */
   readonly pubsub?: TopicRegistry
+  /** The inbound cap of the app this socket belongs to (the upgrade outcome's). Absent, the
+   * listening app's applies. */
+  readonly maxPayloadBytes?: number | undefined
   data: unknown
   nifra?: NifraWebSocket
 }
@@ -38,6 +42,31 @@ export interface BunSocket {
   readonly data: BunWsData
 }
 
+/**
+ * The largest `wsMaxPayloadBytes` among the nifra apps mounted under `app` that serve sockets, or
+ * `floor` when none declares more. Bun takes one frame limit per listener, so it has to admit every
+ * mounted app's cap. Reads each server's own mount table, as reflection does, so an app that never
+ * listens pays nothing for it; a child that is not a nifra server names no cap here.
+ */
+function mountedPayloadCeiling(app: object, floor: number, seen: Set<object>): number {
+  if (seen.has(app)) return floor
+  seen.add(app)
+  const mounts: unknown = Reflect.get(app, "fetchMounts")
+  if (!Array.isArray(mounts)) return floor
+  let ceiling = floor
+  for (const mount of mounts) {
+    const child: unknown = typeof mount === "object" && mount !== null ? mount.app : undefined
+    if (typeof child !== "object" || child === null) continue
+    const routes: unknown = Reflect.get(child, "wsRoutes")
+    const cap: unknown = Reflect.get(child, "wsMaxPayloadBytes")
+    if (Array.isArray(routes) && routes.length > 0 && typeof cap === "number" && cap > ceiling) {
+      ceiling = cap
+    }
+    ceiling = mountedPayloadCeiling(child, ceiling, seen)
+  }
+  return ceiling
+}
+
 /** Normalize a received binary frame to `Uint8Array` (Bun hands a `Buffer`, already one; an
  * `ArrayBuffer` is wrapped). Text frames stay `string`. */
 function toBinaryData(message: ArrayBuffer | Uint8Array): Uint8Array {
@@ -127,9 +156,21 @@ function dispatchWsCallback(
  * `nativePubsub` (set by `listen()` when the app has no validated-send route) makes subscriptions use
  * Bun's own pub/sub; there the registry holds nothing and Bun auto-drops native subscriptions on
  * close, so the `unsubscribeAll` sweep is skipped.
+ *
+ * `app` is the listening server. Its `wsMaxPayloadBytes` and its mounted apps' set the listener's
+ * `maxPayloadLength`; a socket whose app declares less is closed with `1009` here.
  */
-export function createBunWsHandlers(topics: TopicRegistry, nativePubsub = false): BunWsHandlers {
+export function createBunWsHandlers(
+  topics: TopicRegistry,
+  nativePubsub = false,
+  app?: object,
+): BunWsHandlers {
+  const own: unknown = app === undefined ? undefined : Reflect.get(app, "wsMaxPayloadBytes")
+  const appCap = typeof own === "number" ? own : Number.POSITIVE_INFINITY
+  const listenerCap =
+    app === undefined ? appCap : mountedPayloadCeiling(app, appCap, new Set<object>())
   return {
+    maxPayloadLength: listenerCap,
     open: (raw) => {
       const ws = raw as BunSocket
       const nifra = wrapBunSocket(ws, topics, ws.data.handler, nativePubsub)
@@ -138,6 +179,12 @@ export function createBunWsHandlers(topics: TopicRegistry, nativePubsub = false)
     },
     message: (raw, message) => {
       const ws = raw as BunSocket
+      // Only a socket whose app declares less than the listener admits pays for a size check.
+      const cap = ws.data.maxPayloadBytes ?? appCap
+      if (cap < listenerCap && exceedsPayloadCap(message, cap)) {
+        ws.close(1009, "message too large")
+        return
+      }
       const handler = ws.data.handler
       const nifra = ws.data.nifra ?? wrapBunSocket(ws, topics, handler, nativePubsub)
       const data: WebSocketData = typeof message === "string" ? message : toBinaryData(message)

package/src/server/ws-hook.ts

@@ -13,7 +13,9 @@ import type {
   NifraWebSocket,
   StandardWebSocket,
   TopicRegistry,
+  WebSocketContext,
   WebSocketHandler,
+  WsSender,
 } from "./websocket.ts"
 
 /** The Bun serve `websocket` callback trio, closed over one app's `TopicRegistry`. The `ws`
@@ -23,17 +25,25 @@ export interface BunWsHandlers {
   open(ws: unknown): void
   message(ws: unknown, message: string | ArrayBuffer | Uint8Array): void
   close(ws: unknown, code: number, reason: string): void
+  /** The listener's `maxPayloadLength`: the largest `wsMaxPayloadBytes` among the app and the apps
+   * mounted on it. A socket whose app declares less checks its own cap per message. */
+  readonly maxPayloadLength: number
 }
 
 /** What `@nifrajs/core/ws` registers: everything `server.ts` and `toFetchHandler` need at runtime. */
 export interface WsRuntime {
   /** `wrapWebSocketMessageValidation` - applied once at `app.ws()` registration. */
   wrapHandler(handler: WebSocketHandler, protoPoisoning: ProtoPoisoning): WebSocketHandler
+  /** `handshakeUpgradeStep` - the step a handshake's route chain ends in. */
+  upgradeStep(handler: WebSocketHandler): (ctx: WebSocketContext) => unknown
+  /** `acceptedHandshake` - the acceptance a chain ended in, `undefined` when it refused. */
+  accepted(result: unknown): { readonly data: unknown } | undefined
   /** One in-process pub/sub registry per app (backs `ws.subscribe` + `app.publish`). */
   createTopics(): TopicRegistry
   /** The Bun `websocket` config for `listen()` when the app has WS routes. `nativePubsub` routes
-   * `ws.subscribe` through Bun's own pub/sub (set when no route validates outbound frames). */
-  bunHandlers(topics: TopicRegistry, nativePubsub?: boolean): BunWsHandlers
+   * `ws.subscribe` through Bun's own pub/sub (set when no route validates outbound frames). `app` is
+   * the listening server, whose mount table names the payload caps the listener has to admit. */
+  bunHandlers(topics: TopicRegistry, nativePubsub?: boolean, app?: object): BunWsHandlers
   /** `attachWebSocket` - wires a standard server socket (Workers `WebSocketPair`) to a handler. */
   attach(
     socket: StandardWebSocket,
@@ -41,4 +51,6 @@ export interface WsRuntime {
     data: unknown,
     options: { openNow: boolean; pubsub: TopicRegistry },
   ): NifraWebSocket
+  /** `webSocketSender` - `ws.send` for an adapter that wires its own sockets (Node, Deno). */
+  sender: WsSender
 }

package/src/server.ts

@@ -10,7 +10,7 @@
 
 export { FrameworkError, RouteConfigError, type RouteConfigErrorCode } from "./errors.ts"
 export { FRAMEWORK_NAME, type FrameworkName } from "./internal/brand.ts"
-export { isSameOriginRequest } from "./internal/same-origin.ts"
+export { isSameOriginForm, isSameOriginRequest } from "./internal/same-origin.ts"
 export {
   ROUTE_PATTERN_OVERLAP_MAX_STATES,
   RoutePatternOverlapLimitError,
@@ -42,6 +42,8 @@ export {
   type AuthHeaders,
   type AuthMaybePromise,
   authenticated,
+  isAuthenticatedRequest,
+  markAuthenticatedRequest,
   rejected,
 } from "./server/auth.ts"
 export type {
@@ -104,6 +106,7 @@ export type {
   RouteInfoFor,
 } from "./server/registry.ts"
 export { replacedRequestOf } from "./server/request-lineage.ts"
+export { writableResponse } from "./server/respond.ts"
 export {
   type PlainRender,
   type ResponseResult,
@@ -115,6 +118,7 @@ export {
   type AdmissionDecision,
   type AnyServer,
   type ContextPlugin,
+  type DeclaredMountRoute,
   type DefinePluginResult,
   defineContextPlugin,
   defineIdentityPlugin,
@@ -137,6 +141,7 @@ export {
   type NodeResponseHook,
   type NodeServeOutcome,
   type OnRequestResult,
+  type OpaqueMountDeclaration,
   type PluginTypeCollapsed,
   type PromptArgument,
   type PromptMessage,