@nifrajs/core 5.0.0 → 5.2.0

package/src/server/websocket.ts

@@ -233,8 +233,19 @@ export type WebSocketUpgradeOutcome =
        * `.use(websocket())` tree-shaking). `@nifrajs/workers` may import `attachWebSocket` directly instead. */
       readonly attach: WsAttach
       readonly maxPayloadBytes?: number
+      /** Builds `ws.send` over an adapter's native send, enforcing the route's {@link
+       * WebSocketHandler.validateSend}. Set on every outcome a nifra app produces; an adapter that
+       * wires its own sockets instead of calling `attach` (Node, Deno) builds `send` with it. */
+      readonly sender?: WsSender
     }
 
+/** The send-builder the upgrade outcome carries (the installed runtime's `sender`). */
+export type WsSender = (
+  handler: WebSocketHandler,
+  send: (payload: string | ArrayBufferView | ArrayBuffer) => void,
+  onError: (error: unknown) => void,
+) => (payload: string | ArrayBufferView | ArrayBuffer) => void
+
 /** The socket-wiring signature the upgrade outcome carries (the installed runtime's `attach`). */
 export type WsAttach = (
   socket: StandardWebSocket,
@@ -325,18 +336,11 @@ export function attachWebSocket<
   socket.addEventListener("message", (event: { readonly data: unknown }) => {
     const raw = event.data
     const payload: WebSocketData = typeof raw === "string" ? raw : toBinary(raw)
-    // Measuring a text frame costs a full UTF-8 encode plus the buffer it allocates, so it happens
-    // only for a route that actually declared a cap. Reading `.byteLength` off an already-decoded
-    // binary frame is free, but the branch stays under the same guard to keep one shape here.
-    if (maxPayloadBytes !== undefined) {
-      const payloadBytes =
-        typeof raw === "string"
-          ? WS_PAYLOAD_ENCODER.encode(raw).byteLength
-          : (payload as Uint8Array).byteLength
-      if (payloadBytes > maxPayloadBytes) {
-        socket.close(1009, "message too large")
-        return
-      }
+    // The runtime hands over each message whole, so this bounds what reaches the handler, not what
+    // the runtime buffered to deliver it.
+    if (maxPayloadBytes !== undefined && exceedsPayloadCap(payload, maxPayloadBytes)) {
+      socket.close(1009, "message too large")
+      return
     }
     safe(() =>
       (
@@ -363,7 +367,25 @@ export function attachWebSocket<
 }
 
 const WS_MESSAGE_DECODER = new TextDecoder()
-const WS_PAYLOAD_ENCODER = new TextEncoder()
+
+/** Whether a message is over `cap` UTF-8 bytes, without encoding a text one: each UTF-16 unit takes
+ * 1-3 bytes (a surrogate pair 4 for its 2), so only a length between those bounds is counted. */
+export function exceedsPayloadCap(
+  message: string | ArrayBuffer | Uint8Array,
+  cap: number,
+): boolean {
+  if (typeof message !== "string") return message.byteLength > cap
+  const units = message.length
+  if (units > cap) return true
+  if (units * 3 <= cap) return false
+  let bytes = 0
+  for (let i = 0; i < units; i++) {
+    const unit = message.charCodeAt(i)
+    bytes += unit < 0x80 ? 1 : unit < 0x800 || (unit >= 0xd800 && unit <= 0xdfff) ? 2 : 3
+    if (bytes > cap) return true
+  }
+  return false
+}
 
 type WebSocketSendPayload = string | ArrayBufferView | ArrayBuffer
 
@@ -448,6 +470,10 @@ export function createWebSocketSender(
   }
 }
 
+/** {@link createWebSocketSender} configured from a route's handler: the outcome's `sender`. */
+export const webSocketSender: WsSender = (handler, send, onError) =>
+  createWebSocketSender(send, handler.sendSchema, handler.validateSend, handler.transport, onError)
+
 /**
  * If the handler declares a `messageSchema`, return a copy whose `message` validates each frame -
  * parse as JSON, run the Standard Schema, then call the user's `message` with the typed value, or

package/src/server/ws-bun.ts

@@ -7,6 +7,7 @@
 
 import {
   createWebSocketSender,
+  exceedsPayloadCap,
   type NifraWebSocket,
   type TopicRegistry,
   type WebSocketData,
@@ -20,6 +21,9 @@ export interface BunWsData {
   readonly handler: WebSocketHandler
   /** Mounted/modern upgrades carry this registry; old/manual fixtures may omit it. */
   readonly pubsub?: TopicRegistry
+  /** The inbound cap of the app this socket belongs to (the upgrade outcome's). Absent, the
+   * listening app's applies. */
+  readonly maxPayloadBytes?: number | undefined
   data: unknown
   nifra?: NifraWebSocket
 }
@@ -38,6 +42,31 @@ export interface BunSocket {
   readonly data: BunWsData
 }
 
+/**
+ * The largest `wsMaxPayloadBytes` among the nifra apps mounted under `app` that serve sockets, or
+ * `floor` when none declares more. Bun takes one frame limit per listener, so it has to admit every
+ * mounted app's cap. Reads each server's own mount table, as reflection does, so an app that never
+ * listens pays nothing for it; a child that is not a nifra server names no cap here.
+ */
+function mountedPayloadCeiling(app: object, floor: number, seen: Set<object>): number {
+  if (seen.has(app)) return floor
+  seen.add(app)
+  const mounts: unknown = Reflect.get(app, "fetchMounts")
+  if (!Array.isArray(mounts)) return floor
+  let ceiling = floor
+  for (const mount of mounts) {
+    const child: unknown = typeof mount === "object" && mount !== null ? mount.app : undefined
+    if (typeof child !== "object" || child === null) continue
+    const routes: unknown = Reflect.get(child, "wsRoutes")
+    const cap: unknown = Reflect.get(child, "wsMaxPayloadBytes")
+    if (Array.isArray(routes) && routes.length > 0 && typeof cap === "number" && cap > ceiling) {
+      ceiling = cap
+    }
+    ceiling = mountedPayloadCeiling(child, ceiling, seen)
+  }
+  return ceiling
+}
+
 /** Normalize a received binary frame to `Uint8Array` (Bun hands a `Buffer`, already one; an
  * `ArrayBuffer` is wrapped). Text frames stay `string`. */
 function toBinaryData(message: ArrayBuffer | Uint8Array): Uint8Array {
@@ -127,9 +156,21 @@ function dispatchWsCallback(
  * `nativePubsub` (set by `listen()` when the app has no validated-send route) makes subscriptions use
  * Bun's own pub/sub; there the registry holds nothing and Bun auto-drops native subscriptions on
  * close, so the `unsubscribeAll` sweep is skipped.
+ *
+ * `app` is the listening server. Its `wsMaxPayloadBytes` and its mounted apps' set the listener's
+ * `maxPayloadLength`; a socket whose app declares less is closed with `1009` here.
  */
-export function createBunWsHandlers(topics: TopicRegistry, nativePubsub = false): BunWsHandlers {
+export function createBunWsHandlers(
+  topics: TopicRegistry,
+  nativePubsub = false,
+  app?: object,
+): BunWsHandlers {
+  const own: unknown = app === undefined ? undefined : Reflect.get(app, "wsMaxPayloadBytes")
+  const appCap = typeof own === "number" ? own : Number.POSITIVE_INFINITY
+  const listenerCap =
+    app === undefined ? appCap : mountedPayloadCeiling(app, appCap, new Set<object>())
   return {
+    maxPayloadLength: listenerCap,
     open: (raw) => {
       const ws = raw as BunSocket
       const nifra = wrapBunSocket(ws, topics, ws.data.handler, nativePubsub)
@@ -138,6 +179,12 @@ export function createBunWsHandlers(topics: TopicRegistry, nativePubsub = false)
     },
     message: (raw, message) => {
       const ws = raw as BunSocket
+      // Only a socket whose app declares less than the listener admits pays for a size check.
+      const cap = ws.data.maxPayloadBytes ?? appCap
+      if (cap < listenerCap && exceedsPayloadCap(message, cap)) {
+        ws.close(1009, "message too large")
+        return
+      }
       const handler = ws.data.handler
       const nifra = ws.data.nifra ?? wrapBunSocket(ws, topics, handler, nativePubsub)
       const data: WebSocketData = typeof message === "string" ? message : toBinaryData(message)

package/src/server/ws-hook.ts

@@ -15,6 +15,7 @@ import type {
   TopicRegistry,
   WebSocketContext,
   WebSocketHandler,
+  WsSender,
 } from "./websocket.ts"
 
 /** The Bun serve `websocket` callback trio, closed over one app's `TopicRegistry`. The `ws`
@@ -24,6 +25,9 @@ export interface BunWsHandlers {
   open(ws: unknown): void
   message(ws: unknown, message: string | ArrayBuffer | Uint8Array): void
   close(ws: unknown, code: number, reason: string): void
+  /** The listener's `maxPayloadLength`: the largest `wsMaxPayloadBytes` among the app and the apps
+   * mounted on it. A socket whose app declares less checks its own cap per message. */
+  readonly maxPayloadLength: number
 }
 
 /** What `@nifrajs/core/ws` registers: everything `server.ts` and `toFetchHandler` need at runtime. */
@@ -37,8 +41,9 @@ export interface WsRuntime {
   /** One in-process pub/sub registry per app (backs `ws.subscribe` + `app.publish`). */
   createTopics(): TopicRegistry
   /** The Bun `websocket` config for `listen()` when the app has WS routes. `nativePubsub` routes
-   * `ws.subscribe` through Bun's own pub/sub (set when no route validates outbound frames). */
-  bunHandlers(topics: TopicRegistry, nativePubsub?: boolean): BunWsHandlers
+   * `ws.subscribe` through Bun's own pub/sub (set when no route validates outbound frames). `app` is
+   * the listening server, whose mount table names the payload caps the listener has to admit. */
+  bunHandlers(topics: TopicRegistry, nativePubsub?: boolean, app?: object): BunWsHandlers
   /** `attachWebSocket` - wires a standard server socket (Workers `WebSocketPair`) to a handler. */
   attach(
     socket: StandardWebSocket,
@@ -46,4 +51,6 @@ export interface WsRuntime {
     data: unknown,
     options: { openNow: boolean; pubsub: TopicRegistry },
   ): NifraWebSocket
+  /** `webSocketSender` - `ws.send` for an adapter that wires its own sockets (Node, Deno). */
+  sender: WsSender
 }

package/src/server.ts

@@ -10,7 +10,7 @@
 
 export { FrameworkError, RouteConfigError, type RouteConfigErrorCode } from "./errors.ts"
 export { FRAMEWORK_NAME, type FrameworkName } from "./internal/brand.ts"
-export { isSameOriginRequest } from "./internal/same-origin.ts"
+export { isSameOriginForm, isSameOriginRequest } from "./internal/same-origin.ts"
 export {
   ROUTE_PATTERN_OVERLAP_MAX_STATES,
   RoutePatternOverlapLimitError,

package/src/single-copy.ts

@@ -55,7 +55,7 @@
  */
 
 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs"
-import { dirname, join, relative, resolve, sep } from "node:path"
+import { dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path"
 import type { BunPlugin } from "bun"
 import { codeUnitOrder } from "./internal/code-unit-order.ts"
 
@@ -339,6 +339,26 @@ const installedCopy = (
   }
 }
 
+/** The package a bare specifier names, without its subpath: `@scope/name` or `name`. */
+const packageNameOf = (specifier: string): string =>
+  specifier
+    .split("/")
+    .slice(0, specifier.startsWith("@") ? 2 : 1)
+    .join("/")
+
+/**
+ * Whether Bun's own node_modules walk from `importer` already reaches the app's copy. Bun then keeps
+ * the package's `sideEffects: false` pruning; a path handed back from `onResolve` loses it, so the
+ * bundle reads every module the entry re-exports, `node:` imports included.
+ */
+const reachesAppCopy = (specifier: string, importer: string, root: string): boolean => {
+  if (!isAbsolute(importer)) return false
+  const name = packageNameOf(specifier)
+  const ours = installedCopy(root, name, parse(root).root)
+  if (ours === undefined) return false
+  return installedCopy(dirname(importer), name, parse(importer).root)?.root === ours.root
+}
+
 /** Every `node_modules` from the app root up to (and including) its repository root. */
 const nodeModulesDirs = (root: string): readonly string[] => {
   const boundary = repoBoundary(root)
@@ -355,6 +375,17 @@ const nodeModulesDirs = (root: string): readonly string[] => {
   return dirs
 }
 
+/** Where a real package folder lives when only its files are links: Bun installs a `file:` folder
+ * dependency as a directory of per-file symlinks, so its imports resolve beside the linked files. */
+const fileLinkedDir = (dir: string): string | undefined => {
+  const manifest = join(dir, "package.json")
+  try {
+    return lstatSync(manifest).isSymbolicLink() ? dirname(realpathOrSelf(manifest)) : undefined
+  } catch {
+    return undefined
+  }
+}
+
 /**
  * Package directories that are symlinked OUT of this repository - the `link:` / `file:` / `npm link`
  * consumers whose own imports resolve somewhere this install does not own. Those are the only
@@ -388,9 +419,8 @@ const linkedPackageDirs = (root: string): readonly string[] => {
         } catch {
           continue
         }
-        if (!link.isSymbolicLink()) continue
-        const target = realpathOrSelf(candidate)
-        if (inside(repo, target)) continue
+        const target = link.isSymbolicLink() ? realpathOrSelf(candidate) : fileLinkedDir(candidate)
+        if (target === undefined || inside(repo, target)) continue
         found.add(target)
       }
     }
@@ -550,6 +580,7 @@ export function singleCopyPlugin(options: SingleCopyOptions = {}): SingleCopyPlu
         if (alternatives.length > 0) {
           const filter = new RegExp(`^(?:${alternatives.join("|")})$`)
           build.onResolve({ filter }, (args) => {
+            if (reachesAppCopy(args.path, args.importer, plan.root)) return undefined
             try {
               return { path: Bun.resolveSync(args.path, plan.root) }
             } catch {
@@ -635,6 +666,36 @@ const describeSkips = (name: string, skips: readonly SingleCopySkip[]): string =
   return lines.join("\n")
 }
 
+/** The `node_modules` folder a copy was installed into: `/kit/node_modules/@scope/pkg` -> `/kit/node_modules`. */
+const modulesDirOf = (copy: string): string => {
+  const marker = `${sep}node_modules${sep}`
+  const at = copy.lastIndexOf(marker)
+  return at === -1 ? dirname(copy) : copy.slice(0, at + marker.length - 1)
+}
+
+/**
+ * Version skews that share both trees and both versions, as one report: a linked repository on
+ * another release skews every declared package at once, and a block per package said the same thing
+ * eighteen times. One package keeps the per-package report.
+ */
+const describeSkewGroup = (skips: readonly SingleCopySkip[]): string => {
+  const [first] = skips
+  if (first === undefined || skips.length === 1) return describeSkips(first?.package ?? "", skips)
+  const names = skips.map((skip) => skip.package).sort(codeUnitOrder)
+  return [
+    `[nifra] single-copy: ${names.length} packages are NOT deduplicated (version-skew) - a second copy of each loads, so their module state is not shared.`,
+    copyLine(
+      "app copies",
+      first.to === undefined ? undefined : modulesDirOf(first.to),
+      first.toVersion,
+    ),
+    copyLine("linked copies", modulesDirOf(first.from), first.fromVersion),
+    `  packages: ${names.join(", ")}`,
+    `  ${first.fromVersion ?? "another version"} there, ${first.toVersion ?? "another version"} here - redirecting would serve a version those copies did not ask for`,
+    "  Fix: align the dependency ranges so both trees install one version, then reinstall. nifra never redirects across versions.",
+  ].join("\n")
+}
+
 const strictFromEnv = (): boolean => {
   const value = typeof process === "undefined" ? undefined : process.env[SINGLE_COPY_STRICT_ENV]
   return value === "1" || value === "true"
@@ -654,15 +715,15 @@ export function registerSingleCopy(options: SingleCopyOptions = {}): SingleCopyP
   const root = realpathOrSelf(resolve(options.cwd ?? process.cwd()))
   const strict = options.strict ?? (readSingleCopyStrict(root) || strictFromEnv())
   const warned = processSet(WARNED)
-  const report = (name: string, skips: readonly SingleCopySkip[]): void => {
-    const message = describeSkips(name, skips)
+  const emit = (key: string, message: string): void => {
     if (strict)
       throw new Error(`${message}\n  Strict mode is on, so this process refuses to start.`)
-    const key = `${skips[0]?.reason ?? ""}\0${name}`
     if (warned.has(key)) return
     warned.add(key)
     console.warn(message)
   }
+  const report = (name: string, skips: readonly SingleCopySkip[]): void =>
+    emit(`${skips[0]?.reason ?? ""}\0${name}`, describeSkips(name, skips))
   const plugin = singleCopyPlugin({
     ...options,
     cwd: root,
@@ -672,13 +733,33 @@ export function registerSingleCopy(options: SingleCopyOptions = {}): SingleCopyP
     },
   })
   const byPackage = new Map<string, SingleCopySkip[]>()
+  const bySkew = new Map<string, SingleCopySkip[]>()
   for (const skip of plugin.plan.skipped) {
     options.onSkip?.(skip)
-    const group = byPackage.get(skip.package) ?? []
+    const skew =
+      skip.reason === "version-skew"
+        ? [
+            modulesDirOf(skip.from),
+            skip.to === undefined ? "" : modulesDirOf(skip.to),
+            skip.fromVersion ?? "",
+            skip.toVersion ?? "",
+          ].join("\0")
+        : undefined
+    const groups = skew === undefined ? byPackage : bySkew
+    const key = skew ?? skip.package
+    const group = groups.get(key) ?? []
     group.push(skip)
-    byPackage.set(skip.package, group)
+    groups.set(key, group)
   }
   for (const [name, skips] of byPackage) report(name, skips)
+  for (const skips of bySkew.values()) {
+    if (skips.length === 1) report(skips[0]?.package ?? "", skips)
+    else
+      emit(
+        `version-skew\0${skips.map((skip) => skip.package).join("\0")}`,
+        describeSkewGroup(skips),
+      )
+  }
   // Installing twice (a preload listed twice, or an explicit call on top of the preload) would register
   // two `onLoad` hooks for the same foreign files, and two hooks both answering one file stall the
   // runtime loader. One install per root and declaration is the whole effect anyway.

package/src/wire.ts

@@ -43,6 +43,11 @@ export interface WireDecodeLimits {
   readonly maxCollectionEntries?: number
   /** Maximum UTF-8 string plus decoded binary bytes materialized. Default 16 MiB. */
   readonly maxDecodedBytes?: number
+  /**
+   * Maximum decimal digits in one `bigint`. Default 4,096 (past 8192-bit integers). Parsing grows
+   * faster than the digit count, so one long token would cost seconds of CPU under the byte limit.
+   */
+  readonly maxBigIntDigits?: number
 }
 
 export const DEFAULT_WIRE_DECODE_LIMITS: Readonly<Required<WireDecodeLimits>> = Object.freeze({
@@ -50,6 +55,7 @@ export const DEFAULT_WIRE_DECODE_LIMITS: Readonly<Required<WireDecodeLimits>> =
   maxDepth: 256,
   maxCollectionEntries: 100_000,
   maxDecodedBytes: 16 * 1024 * 1024,
+  maxBigIntDigits: 4096,
 })
 
 /** Thrown by {@link encode} for a value it will not encode (a function or a symbol). */
@@ -223,6 +229,11 @@ export function decode(wire: Wire, limits: WireDecodeLimits = {}): unknown {
     DEFAULT_WIRE_DECODE_LIMITS.maxDecodedBytes,
     "maxDecodedBytes",
   )
+  const maxBigIntDigits = decodeLimit(
+    limits.maxBigIntDigits,
+    DEFAULT_WIRE_DECODE_LIMITS.maxBigIntDigits,
+    "maxBigIntDigits",
+  )
   if (nodes.length > maxNodes) throw new WireDecodeError("wire node limit exceeded")
   const built = new Map<number, unknown>()
   let collectionEntries = 0
@@ -279,6 +290,9 @@ export function decode(wire: Wire, limits: WireDecodeLimits = {}): unknown {
         if (typeof record.v !== "string" || !/^-?(?:0|[1-9][0-9]*)$/u.test(record.v)) {
           throw new WireDecodeError("malformed bigint token")
         }
+        if (record.v.length - (record.v.charCodeAt(0) === 45 ? 1 : 0) > maxBigIntDigits) {
+          throw new WireDecodeError("wire bigint digit limit exceeded")
+        }
         chargeString(record.v)
         return BigInt(record.v)
       }

package/src/ws.ts

@@ -25,6 +25,7 @@ import {
   attachWebSocket,
   handshakeUpgradeStep,
   TopicRegistry,
+  webSocketSender,
   wrapWebSocketMessageValidation,
 } from "./server/websocket.ts"
 import { createBunWsHandlers } from "./server/ws-bun.ts"
@@ -37,6 +38,7 @@ const WS_RUNTIME: WsRuntime = {
   createTopics: () => new TopicRegistry(),
   bunHandlers: createBunWsHandlers,
   attach: attachWebSocket,
+  sender: webSocketSender,
 }
 
 /** The install seam a server exposes so the `websocket()` plugin can hand it the runtime. */