@nifrajs/core 5.12.0 → 5.13.0

package/dist/transport-codec.d.ts

@@ -17,8 +17,8 @@ export declare class TransportCodecError extends TypeError {
 }
 /**
  * Enforce the transport byte cap on already-read text - the same limit (and the same error) the
- * streaming reader applies during a bounded read. Exported for callers that read a body through a
- * native, non-streaming path (the typed client's in-process branch) and still owe the cap contract.
+ * streaming reader applies during a bounded read. Exported for callers that need to decode text
+ * after a bounded read while preserving the text decoder's lenient UTF-8 behavior.
  */
 export declare function assertTransportTextBounded(text: string, options: TransportDecodeOptions): void;
 export declare const plainJsonCodec: TransportCodec;
@@ -46,10 +46,8 @@ export declare function readBoundedBytes(response: Response, options: TransportD
 /**
  * Decode an ALREADY-READ transport body. The counterpart to {@link decodeTransportResponse} for a
  * caller that obtained the text through its own bounded read - notably the typed client's
- * in-process path, where the response body is same-process memory that was fully resident before
- * the read, so the native `Response.text()` is safe and the streaming byte-cap loop would protect
- * nothing while costing ~23x. The byte cap is still enforced here (identical error), just after
- * the read instead of during it.
+ * in-process path, which uses this to preserve lenient UTF-8 decoding after the shared byte-cap
+ * reader has completed.
  */
 export declare function decodeTransportText(text: string, contentType: string | null, registry?: TransportCodecRegistry, options?: TransportDecodeOptions): unknown;
 export declare function decodeTransportResponse(response: Response, registry?: TransportCodecRegistry, options?: TransportDecodeOptions): Promise<unknown>;

package/dist/transport-codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport-codec.d.ts","sourceRoot":"","sources":["../src/transport-codec.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAA;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAC9B;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAkCD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAU9F;AAID,eAAO,MAAM,cAAc,EAAE,cAY3B,CAAA;AAEF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAAA;IAC1D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAAA;IAChD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAAA;CACxD;AAUD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,QAAQ,GAAE,cAA+B,GACxC,sBAAsB,CAgFxB;AAED,eAAO,MAAM,sBAAsB,EAAE,sBAEnC,CAAA;AAEF,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,cAA+B,EACtC,IAAI,GAAE,YAAiB,GACtB,QAAQ,CAKV;AAQD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAkCrB;AAcD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,QAAQ,GAAE,sBAA+C,EACzD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAQT;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,sBAA+C,EACzD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,OAAO,CAAC,CAQlB;AAQD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,cAA+B,GACrC,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,sBAA+C,EACzD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAsBT"}
+{"version":3,"file":"transport-codec.d.ts","sourceRoot":"","sources":["../src/transport-codec.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAA;IAC9B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;CAC9B;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY;CAIpD;AAkCD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAU9F;AAID,eAAO,MAAM,cAAc,EAAE,cAY3B,CAAA;AAEF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;IACjC,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAAA;IAC1D,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAAA;IAChD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAAA;CACxD;AAUD,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,SAAS,cAAc,EAAE,EACjC,QAAQ,GAAE,cAA+B,GACxC,sBAAsB,CAgFxB;AAED,eAAO,MAAM,sBAAsB,EAAE,sBAEnC,CAAA;AAEF,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,cAA+B,EACtC,IAAI,GAAE,YAAiB,GACtB,QAAQ,CAKV;AAQD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAkCrB;AAcD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,QAAQ,GAAE,sBAA+C,EACzD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAQT;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,QAAQ,EAClB,QAAQ,GAAE,sBAA+C,EACzD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,OAAO,CAAC,CAQlB;AAQD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,cAA+B,GACrC,MAAM,CAER;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,sBAA+C,EACzD,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAsBT"}

package/dist/transport-codec.js

@@ -43,8 +43,8 @@ function byteLength(text) {
 }
 /**
  * Enforce the transport byte cap on already-read text - the same limit (and the same error) the
- * streaming reader applies during a bounded read. Exported for callers that read a body through a
- * native, non-streaming path (the typed client's in-process branch) and still owe the cap contract.
+ * streaming reader applies during a bounded read. Exported for callers that need to decode text
+ * after a bounded read while preserving the text decoder's lenient UTF-8 behavior.
  */
 export function assertTransportTextBounded(text, options) {
     const maxBytes = maxBytesOf(options);
@@ -233,10 +233,8 @@ async function readBoundedText(response, options) {
 /**
  * Decode an ALREADY-READ transport body. The counterpart to {@link decodeTransportResponse} for a
  * caller that obtained the text through its own bounded read - notably the typed client's
- * in-process path, where the response body is same-process memory that was fully resident before
- * the read, so the native `Response.text()` is safe and the streaming byte-cap loop would protect
- * nothing while costing ~23x. The byte cap is still enforced here (identical error), just after
- * the read instead of during it.
+ * in-process path, which uses this to preserve lenient UTF-8 decoding after the shared byte-cap
+ * reader has completed.
  */
 export function decodeTransportText(text, contentType, registry = defaultTransportCodecs, options = {}) {
     assertBounded(text, options);

package/dist/transport-codec.js.map

@@ -1 +1 @@
-{"version":3,"file":"transport-codec.js","sourceRoot":"","sources":["../src/transport-codec.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEhD,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC1C,MAAM,KAAK,GAAG,0BAA0B,CAAA;AAcxC,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAI,MAAe,EAAE,OAAe;IACxD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAA;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAA;QACrD,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACnD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA+B;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAA;IACtD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,wDAAwD,CAAC,CAAA;IAChF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AAEtC,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAA;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,OAA+B;IACtF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IACpC,4FAA4F;IAC5F,6FAA6F;IAC7F,8FAA8F;IAC9F,8CAA8C;IAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ;QAAE,OAAM;IACvC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,0BAA0B,CAAA;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAmB,MAAM,CAAC,MAAM,CAAC;IAC1D,EAAE,EAAE,MAAM;IACV,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,kBAAkB;IAC7B,MAAM,CAAC,KAAc;QACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,CAAC,CAAA;QAC1F,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,CAAC,IAAY;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;CACF,CAAC,CAAA;AASF,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACxC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,MAAiC,EACjC,WAA2B,cAAc;IAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAA;IACxF,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAA;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAA;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAA;QAC/E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC;YAC3D,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAA;QAChF,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU;YAC1E,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAA;QACvE,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAA;QAC/C,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1C,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAA;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACzB,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC3B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAEpC,MAAM,cAAc,GAAG,CAAC,WAA0B,EAAkB,EAAE;QACpE,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACtE,8FAA8F;QAC9F,+FAA+F;QAC/F,+FAA+F;QAC/F,4FAA4F;QAC5F,6CAA6C;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACtC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACrC,IAAI,WAAW,KAAK,gCAAgC,IAAI,SAAS,KAAK,SAAS;YAC7E,OAAO,SAAS,CAAA;QAClB,MAAM,SAAS,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACrC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;QACvC,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC/F,MAAM,IAAI,mBAAmB,CAAC,uCAAuC,WAAW,EAAE,CAAC,CAAA;IACrF,CAAC,CAAA;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ;QACR,cAAc;QACd,SAAS,CAAC,MAAqB;YAC7B,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAA;YACvF,MAAM,UAAU,GAAG,MAAM;iBACtB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,SAAiB,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAC9D,MAAM,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;gBACnD,OAAO;oBACL,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;oBACrF,CAAC;iBACF,CAAA;YACH,CAAC,CAAC;iBACD,MAAM,CACL,CAAC,SAAyD,EAAE,EAAE,CAC5D,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,CACtE;iBACA,IAAI,CACH,CACE,CAAiD,EACjD,CAAiD,EACjD,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACf,CAAA;YACH,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,OAAO,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,0CAA0C;gBAC5C,CAAC;YACH,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;QAChE,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,OAAe;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;YAC1C,IAAI,KAAK,KAAK,SAAS;gBACrB,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;YAChF,OAAO,KAAK,CAAA;QACd,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAA2B,4BAA4B,CAAC;IACzF,cAAc;CACf,CAAC,CAAA;AAEF,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,QAAwB,cAAc,EACtC,OAAqB,EAAE;IAEvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAmD,CAAC,CAAA;IACrF,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;IAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC9D,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,OAAsB,EAAE,IAAY;IACtD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IAC5E,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,IAAI,EAAE,CAAA;AAC9E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAkB,EAClB,OAA+B;IAE/B,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC;QAChF,+FAA+F;QAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACvC,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACxC,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI;gBAAE,MAAK;YACf,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;YACzB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrD,2FAA2F;gBAC3F,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAC/B,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;YACrE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAA;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACnC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,oGAAoG;AACpG,+EAA+E;AAC/E,MAAM,UAAU,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAE5D,KAAK,UAAU,eAAe,CAC5B,QAAkB,EAClB,OAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACvD,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,sCAAsC,CAAC,CAAA;AAC9F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,WAA0B,EAC1B,WAAmC,sBAAsB,EACzD,UAAkC,EAAE;IAEpC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC5B,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;IAClD,OAAO,aAAa,CAClB,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EACxB,sCAAsC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAClE,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAkB,EAClB,WAAmC,sBAAsB,EACzD,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACrD,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACjC,OAAO,aAAa,CAClB,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EACxB,sCAAsC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAClE,CAAA;AACH,CAAC;AAQD,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,QAAwB,cAAc;IAEtC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAClG,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,WAAmC,sBAAsB,EACzD,UAAkC,EAAE;IAEpC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC7B,MAAM,QAAQ,GAAG,aAAa,CAC5B,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACvB,2BAA2B,CACD,CAAA;IAC5B,IACE,QAAQ,KAAK,IAAI;QACjB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAClC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvC,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EACpC,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;IAChC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAiB,CAAC,CAAA;IAC7E,OAAO,aAAa,CAClB,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAC3B,+CAA+C,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAC3E,CAAA;AACH,CAAC"}
+{"version":3,"file":"transport-codec.js","sourceRoot":"","sources":["../src/transport-codec.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAEhD,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAA;AAC1C,MAAM,KAAK,GAAG,0BAA0B,CAAA;AAcxC,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAe,EAAE,OAAsB;QACjD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACvB,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAA;IACnC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAI,MAAe,EAAE,OAAe;IACxD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAA;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAA;QACrD,MAAM,IAAI,mBAAmB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;IACnD,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA+B;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAA;IACtD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC;QACjD,MAAM,IAAI,UAAU,CAAC,wDAAwD,CAAC,CAAA;IAChF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AAEtC,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAA;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAE,OAA+B;IACtF,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IACpC,4FAA4F;IAC5F,6FAA6F;IAC7F,8FAA8F;IAC9F,8CAA8C;IAC9C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ;QAAE,OAAM;IACvC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,MAAM,aAAa,GAAG,0BAA0B,CAAA;AAEhD,MAAM,CAAC,MAAM,cAAc,GAAmB,MAAM,CAAC,MAAM,CAAC;IAC1D,EAAE,EAAE,MAAM;IACV,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,kBAAkB;IAC7B,MAAM,CAAC,KAAc;QACnB,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,CAAC,CAAA;QAC1F,OAAO,OAAO,CAAA;IAChB,CAAC;IACD,MAAM,CAAC,IAAY;QACjB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;CACF,CAAC,CAAA;AASF,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SACxC,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,MAAiC,EACjC,WAA2B,cAAc;IAEzC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAA;IACxF,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAA;IACjD,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAA;IAC9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,CAAA;QAC/E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC;YAC3D,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAA;QAChF,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU;YAC1E,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAA;QACvE,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAA;QAC/C,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1C,MAAM,IAAI,SAAS,CAAC,wCAAwC,CAAC,CAAA;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACzB,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC3B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAEpC,MAAM,cAAc,GAAG,CAAC,WAA0B,EAAkB,EAAE;QACpE,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,QAAQ,CAAA;QACtE,8FAA8F;QAC9F,+FAA+F;QAC/F,+FAA+F;QAC/F,4FAA4F;QAC5F,6CAA6C;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACtC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACrC,IAAI,WAAW,KAAK,gCAAgC,IAAI,SAAS,KAAK,SAAS;YAC7E,OAAO,SAAS,CAAA;QAClB,MAAM,SAAS,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACrC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAA;QACvC,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,kBAAkB,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC/F,MAAM,IAAI,mBAAmB,CAAC,uCAAuC,WAAW,EAAE,CAAC,CAAA;IACrF,CAAC,CAAA;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ;QACR,cAAc;QACd,SAAS,CAAC,MAAqB;YAC7B,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,KAAK;gBAAE,OAAO,QAAQ,CAAA;YACvF,MAAM,UAAU,GAAG,MAAM;iBACtB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,SAAiB,EAAE,EAAE;gBACzB,MAAM,OAAO,GAAG,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;gBAC9D,MAAM,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;gBACnD,OAAO;oBACL,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE;oBACrF,CAAC;iBACF,CAAA;YACH,CAAC,CAAC;iBACD,MAAM,CACL,CAAC,SAAyD,EAAE,EAAE,CAC5D,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC,IAAI,CAAC,CACtE;iBACA,IAAI,CACH,CACE,CAAiD,EACjD,CAAiD,EACjD,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CACf,CAAA;YACH,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,OAAO,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACP,0CAA0C;gBAC5C,CAAC;YACH,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAA;QAChE,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,OAAe;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;YAC1C,IAAI,KAAK,KAAK,SAAS;gBACrB,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;YAChF,OAAO,KAAK,CAAA;QACd,CAAC;KACF,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAA2B,4BAA4B,CAAC;IACzF,cAAc;CACf,CAAC,CAAA;AAEF,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,QAAwB,cAAc,EACtC,OAAqB,EAAE;IAEvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAmD,CAAC,CAAA;IACrF,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,SAAS,CAAC,CAAA;IAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;IAC9D,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,OAAsB,EAAE,IAAY;IACtD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IAC5E,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,IAAI,EAAE,CAAA;AAC9E,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAkB,EAClB,OAA+B;IAE/B,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,EAAE,CAAC;QAChF,+FAA+F;QAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACvC,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;IACrE,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACxC,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI;gBAAE,MAAK;YACf,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;YACzB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrD,2FAA2F;gBAC3F,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;gBAC/B,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,CAAC,CAAA;YACrE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAA;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACnC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,oGAAoG;AACpG,+EAA+E;AAC/E,MAAM,UAAU,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAE5D,KAAK,UAAU,eAAe,CAC5B,QAAkB,EAClB,OAA+B;IAE/B,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACvD,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,sCAAsC,CAAC,CAAA;AAC9F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,WAA0B,EAC1B,WAAmC,sBAAsB,EACzD,UAAkC,EAAE;IAEpC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC5B,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACjC,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAA;IAClD,OAAO,aAAa,CAClB,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EACxB,sCAAsC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAClE,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAkB,EAClB,WAAmC,sBAAsB,EACzD,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACrD,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IACjC,OAAO,aAAa,CAClB,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EACxB,sCAAsC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAClE,CAAA;AACH,CAAC;AAQD,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,QAAwB,cAAc;IAEtC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAClG,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,WAAmC,sBAAsB,EACzD,UAAkC,EAAE;IAEpC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC7B,MAAM,QAAQ,GAAG,aAAa,CAC5B,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EACvB,2BAA2B,CACD,CAAA;IAC5B,IACE,QAAQ,KAAK,IAAI;QACjB,OAAO,QAAQ,KAAK,QAAQ;QAC5B,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;QAClC,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvC,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EACpC,CAAC;QACD,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAA;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAA;IAChC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAiB,CAAC,CAAA;IAC7E,OAAO,aAAa,CAClB,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,EAC3B,+CAA+C,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,EAAE,CAC3E,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/core",
-  "version": "5.12.0",
+  "version": "5.13.0",
   "description": "Bun-native, contract-first HTTP framework - the router, server, and route descriptor.",
   "keywords": [
     "bun",

package/src/edge-kit.ts

@@ -8,6 +8,7 @@
  * exposes the one lane the fused body runner already calls, so a compact server reuses it verbatim:
  *
  *   - {@link readBodyFramed}   read + cap + proto-guard + content-type framing (JSON / urlencoded / 415)
+ *   - {@link crossSiteFormRefused}   the form-origin refusal for an unsafe route that reads no body
  *   - {@link capBodyBytes}   the same byte cap on a handler's own reads of the raw request
  *   - {@link boundedJsonText}   preflight JSON output against an exact UTF-8 byte budget
  *   - {@link renderResult}     render a {@link ResponseResult} (e.g. a 413 / 415 rejection) to a `Response`
@@ -23,7 +24,7 @@
 
 export { type ErrorLogDetail, emitRequestErrorLog } from "./server/bare-error-lane.ts"
 export { assertByteLimit, capBodyBytes, DEFAULT_MAX_BODY_BYTES } from "./server/body.ts"
-export { type FormOrigins, readBodyFramed } from "./server/body-lane.ts"
+export { crossSiteFormRefused, type FormOrigins, readBodyFramed } from "./server/body-lane.ts"
 export { plainError } from "./server/http.ts"
 export { boundedJsonText, JsonByteLimitError, jsonResponse } from "./server/json-response.ts"
 export {

package/src/idempotency.ts

@@ -22,6 +22,9 @@ export const DEFAULT_IDEMPOTENCY_TTL_MS = 86_400_000
 /** Default lease on a key whose handler is still running, with a store that can renew it: 60 seconds. */
 export const DEFAULT_IDEMPOTENCY_PENDING_TTL_MS = 60_000
 
+/** Default maximum response body retained by the standalone idempotency helpers: 1 MB. */
+export const DEFAULT_IDEMPOTENCY_MAX_RESPONSE_BYTES = 1_000_000
+
 /** Canonical request header carrying the client-chosen idempotency key. */
 export const DEFAULT_IDEMPOTENCY_HEADER = "idempotency-key"
 
@@ -289,16 +292,24 @@ export class IdempotencyResponseTooLargeError extends Error {
   }
 }
 
+/**
+ * Clone and buffer a response body without exceeding the storage bound. A null body represents no
+ * bytes, even when a HEAD/304 response carries the corresponding GET representation's
+ * `Content-Length`; the body check therefore precedes the header shortcut. Oversize cancellation is
+ * intentionally fire-and-forget because a tee branch can remain pending until its sibling is read.
+ */
 async function boundedResponseBytes(response: Response, maxBytes: number): Promise<Uint8Array> {
+  const body = response.body
+  if (body === null) return new Uint8Array()
   const contentLength = response.headers.get("content-length")
   if (contentLength !== null && /^\d+$/.test(contentLength) && Number(contentLength) > maxBytes) {
     // Replaced by a terminal error, never read: a streaming producer would otherwise stay open.
-    await response.body?.cancel().catch(() => {})
+    void Promise.allSettled([body.cancel()])
     throw new IdempotencyResponseTooLargeError(maxBytes)
   }
-  const body = response.clone().body
-  if (body === null) return new Uint8Array()
-  const reader = body.getReader()
+  const cloneBody = response.clone().body
+  if (cloneBody === null) return new Uint8Array()
+  const reader = cloneBody.getReader()
   const chunks: Uint8Array[] = []
   let total = 0
   try {
@@ -311,10 +322,11 @@ async function boundedResponseBytes(response: Response, maxBytes: number): Promi
         // unread, so a streaming producer can keep the tee pending forever. This path stores no
         // response and the caller will replace it with a terminal error, so cancel both branches.
         const liveBody = response.body
-        await Promise.allSettled([
-          reader.cancel(),
-          liveBody === null ? Promise.resolve() : liveBody.cancel(),
-        ])
+        // Do not await tee cancellation: either branch can remain pending until the other branch is
+        // consumed, but the size error is already definitive and must reach the caller promptly.
+        const cancellations = [reader.cancel()]
+        if (liveBody !== null) cancellations.push(liveBody.cancel())
+        void Promise.allSettled(cancellations)
         throw new IdempotencyResponseTooLargeError(maxBytes)
       }
       chunks.push(value)
@@ -331,19 +343,21 @@ async function boundedResponseBytes(response: Response, maxBytes: number): Promi
   return bytes
 }
 
-/** Buffer a response into a storable form. Clones first so the live response body stays intact. */
+/**
+ * Buffer a response into a storable form. Clones first so the live response body stays intact on
+ * success. If the body exceeds the bound, both branches may be cancelled to stop the producer and
+ * the caller must discard or replace the response. Unless a bound is supplied, at most
+ * {@link DEFAULT_IDEMPOTENCY_MAX_RESPONSE_BYTES} are retained.
+ */
 export async function serializeResponse(
   response: Response,
   options: { readonly maxBytes?: number } = {},
 ): Promise<StoredResponse> {
-  const maxBytes = options.maxBytes
-  if (maxBytes !== undefined && (!Number.isInteger(maxBytes) || maxBytes < 0)) {
+  const maxBytes = options.maxBytes ?? DEFAULT_IDEMPOTENCY_MAX_RESPONSE_BYTES
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
     throw new RangeError("idempotency: max response bytes must be a non-negative integer")
   }
-  const bytes =
-    maxBytes === undefined
-      ? new Uint8Array(await response.clone().arrayBuffer())
-      : await boundedResponseBytes(response, maxBytes)
+  const bytes = await boundedResponseBytes(response, maxBytes)
   return {
     status: response.status,
     headers: replaySafeHeaders(response.headers),
@@ -351,7 +365,10 @@ export async function serializeResponse(
   }
 }
 
-/** Rebuild a live response from storage, stamping the replay marker header. */
+/**
+ * Rebuild a live response from storage, stamping the replay marker header. Unless a bound is
+ * supplied, stored bodies larger than {@link DEFAULT_IDEMPOTENCY_MAX_RESPONSE_BYTES} are rejected.
+ */
 export function responseFromStored(
   stored: StoredResponse,
   options: { readonly maxBytes?: number } = {},
@@ -360,13 +377,12 @@ export function responseFromStored(
     throw new TypeError("idempotency: corrupt stored response status")
   }
   const decodedLength = base64DecodedLength(stored.body)
-  if (options.maxBytes !== undefined) {
-    if (!Number.isSafeInteger(options.maxBytes) || options.maxBytes < 0) {
-      throw new RangeError("idempotency: max response bytes must be a non-negative safe integer")
-    }
-    if (decodedLength > options.maxBytes) {
-      throw new IdempotencyResponseTooLargeError(options.maxBytes)
-    }
+  const maxBytes = options.maxBytes ?? DEFAULT_IDEMPOTENCY_MAX_RESPONSE_BYTES
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
+    throw new RangeError("idempotency: max response bytes must be a non-negative safe integer")
+  }
+  if (decodedLength > maxBytes) {
+    throw new IdempotencyResponseTooLargeError(maxBytes)
   }
   const headers = new Headers(replaySafeHeaders(stored.headers) as [string, string][])
   headers.set(IDEMPOTENT_REPLAY_HEADER, "1")

package/src/index.ts

@@ -16,7 +16,7 @@
  * read its own package.json at runtime. `scripts/version.ts` rewrites it on every release bump and
  * `check:publish` asserts it equals `@nifrajs/core`'s package version.
  */
-export const VERSION = "5.12.0" as const
+export const VERSION = "5.13.0" as const
 
 export type Version = typeof VERSION
 

package/src/internal/route-execution.ts

@@ -325,6 +325,9 @@ export interface RouteEntry {
   readonly onError: ReadonlyArray<RawErrorHandler>
   /** Registration-specialized hook shape: a route whose only lifecycle steps are derive, before and after hooks. */
   readonly lifecycleHookLane: "hooks" | undefined
+  /** An unsafe method with no body schema: no lane reads a body to refuse a cross-site form, so the
+   * dispatchers refuse it before the lanes run. */
+  readonly formOriginGuard: boolean
   /** Wraps the matched route lifecycle. Empty for the common no-around path. */
   readonly around: ReadonlyArray<RawAround>
   /** The single immutable execution decision consumed by portable, Node-direct, and Bun-native paths. */

package/src/server/body-lane.ts

@@ -236,6 +236,41 @@ function formOriginAllowed(source: RequestSource, formOrigins: FormOrigins | und
     : formOrigins.includes(origin)
 }
 
+/** A route that needs {@link crossSiteFormRefused} ahead of its lanes: an unsafe method with no
+ * `schema.body`. A body schema reads its body through {@link readBodyFramed}, which refuses a
+ * cross-site form itself; a route without one reads nothing, so nothing else would. */
+export const guardsBodylessForm = (method: string, hasBodySchema: boolean): boolean =>
+  !hasBodySchema && !/^(?:GET|HEAD|OPTIONS|TRACE|QUERY)$/i.test(method)
+
+// Schemes a browser keeps in its HTTP-auth cache and re-attaches to a credentialed cross-site request
+// on its own, so a page can send one with no preflight. Any other `Authorization` value has to be set
+// by script, and a cross-origin script cannot set it without a preflight that CORS has judged.
+const BROWSER_MANAGED_AUTH = /^(?:basic|digest|negotiate|ntlm)\b/i
+
+/** Whether a request is a cross-site post that {@link readBodyFramed} would refuse, or one a page can
+ * send the same way: a form media type, or no content type at all (`fetch` with `no-cors`). A request
+ * with no content type that carries an `Authorization` header other than a browser-managed scheme
+ * (Basic, Digest, Negotiate, NTLM) passes: script-set, it forced a preflight, so the app's CORS policy
+ * has already judged its origin. It decides on the cheapest header first: a request without an
+ * `Origin` (any non-browser client) costs one lookup, and a browser's own-origin post stops at
+ * `Sec-Fetch-Site` before the URL is parsed. */
+export const crossSiteFormRefused = (
+  source: RequestSource,
+  formOrigins: FormOrigins | undefined,
+): boolean => {
+  const origin = headerOf(source, "origin")
+  if (origin === null || headerOf(source, "sec-fetch-site") === "same-origin") return false
+  const type = headerOf(source, "content-type") ?? ""
+  const authorization = type === "" ? headerOf(source, "authorization") : null
+  return (
+    (type === ""
+      ? authorization === null || BROWSER_MANAGED_AUTH.test(authorization)
+      : isFormMediaType(type)) &&
+    !source.url.startsWith(`${origin}/`) &&
+    !formOriginAllowed(source, formOrigins)
+  )
+}
+
 /**
  * The shared content-type dispatcher around the JSON and urlencoded lanes. A `bodySchema` branded
  * with {@link SCHEMA_BODY_READER} takes every other media type; JSON and urlencoded bodies keep

package/src/server/core-copies.ts

@@ -26,7 +26,7 @@ if (!copies.includes(here) && copies.push(here) > 1) {
 
 /** This copy's version: a literal like the package root's `VERSION` (no fs on the edge), which
  * `scripts/version.ts` rewrites on every release and `check:publish` asserts. */
-const COPY_VERSION = "5.12.0"
+const COPY_VERSION = "5.13.0"
 
 /** Record this copy's version beside its URL. Called by each `server()` behind the development guard,
  * so a production bundle drops it with the version; a copy that built a server has recorded one. */

package/src/server/request-context.ts

@@ -5,7 +5,7 @@
  * sits below the server module in the graph.
  */
 import type { RequestBudget } from "../budget.ts"
-import { markResidentBody } from "../mount.ts"
+import { markResidentBody, residentBodiesRecorded } from "../mount.ts"
 import { applyTransportCap, readBoundedBytes } from "./body.ts"
 import { readBoundedJsonSource } from "./body-lane.ts"
 import type { Platform } from "./context.ts"
@@ -165,6 +165,8 @@ function responseTextContentType(): string {
 /** `c.text`'s own default, unchanged: the explicit one nifra has always declared when the caller
  * passes no headers of their own. */
 const TEXT_CONTENT_TYPE = "text/plain; charset=utf-8"
+const TEXT_RESPONSE_HEADERS = { "content-type": TEXT_CONTENT_TYPE }
+const TEXT_RESPONSE_INIT: ResponseInit = { headers: TEXT_RESPONSE_HEADERS }
 
 /** Where a serving adapter that shares one platform across requests leaves its socket-peer lookup.
  * `c.clientIp` calls it with the request when a handler reads the address, so a request whose
@@ -439,13 +441,15 @@ export class RequestContext implements RawContext {
       }
     }
     // Default to text/plain; if the caller passes their own headers, they own the content-type.
-    if (i?.headers !== undefined) return markResidentBody(residentText(new Response(body, i), body))
-    return markResidentBody(
-      residentText(
-        new Response(body, { ...i, headers: { "content-type": TEXT_CONTENT_TYPE } }),
-        body,
-      ),
-    )
+    const response =
+      i?.headers !== undefined
+        ? new Response(body, i)
+        : new Response(
+            body,
+            i === undefined ? TEXT_RESPONSE_INIT : { ...i, headers: TEXT_RESPONSE_HEADERS },
+          )
+    const resident = residentText(response, body)
+    return residentBodiesRecorded ? markResidentBody(resident) : resident
   }
 
   get query(): unknown {

package/src/server/respond.ts

@@ -613,6 +613,17 @@ export function fusedRespond(
   unstamped = false,
 ): Response {
   const set = ctx[CONTEXT_SET]()
+  if (
+    set === undefined &&
+    statics === undefined &&
+    !tagResponseBody &&
+    result instanceof Response &&
+    !isResponseResult(result) &&
+    !responseBodyUsed(result)
+  ) {
+    if (!isBodylessStatus(result.status)) return result
+    return normalizeBodylessResponse(result, unstamped ? undefined : ctx[CONTEXT_REQUEST])
+  }
   const request = unstamped ? undefined : ctx[CONTEXT_REQUEST]
   if (set === undefined)
     return fusedRespondNoSet(result, tagResponseBody, statics, unstamped, request)

package/src/server/server-types.ts

@@ -64,11 +64,19 @@ export interface ServerOptions {
    */
   readonly protoPoisoning?: "reject" | "strip" | "ignore"
   /**
-   * Other sites whose HTML forms may post to a body-schema route: exact origins, or a function that
-   * receives the `Origin`. A urlencoded, multipart or `text/plain` body is one a form on any site can
-   * send with the visitor's cookies and no preflight, so one whose `Origin` names another site is
-   * refused with `403` before it is read. Same-origin posts and requests without an `Origin`, such
-   * as server-to-server calls, pass. JSON is not affected: a browser preflights it, so CORS decides.
+   * Other sites whose HTML forms may post to a route: exact origins, or a function that receives the
+   * `Origin`. A urlencoded, multipart or `text/plain` body is one a form on any site can send with the
+   * visitor's cookies and no preflight, so one whose `Origin` names another site is refused with `403`
+   * before it is read. A route without a body schema refuses the same sites' unsafe requests that carry
+   * no content type too, which `fetch` with `no-cors` sends; one with a script-set `Authorization` header
+   * passes, since a browser preflights it, but `Basic`, `Digest`, `Negotiate` and `NTLM` do not, because
+   * a browser re-sends those from its auth cache without one. Same-origin posts and requests without an `Origin`, such as
+   * server-to-server calls, pass. JSON is not affected: a browser preflights it, so CORS decides.
+   * The origins a `cors()` list or predicate and a `csrf({ origins })` list name are trusted as well,
+   * so a frontend those already allow needs no second list here; `cors()` with `"*"` adds none. That
+   * trust is for form posts to this server's own routes only: a mounted or grouped server keeps its own
+   * policy, so a parent that must accept the same sites sets them in its own `formOrigins`, and a web
+   * page action checks the origin against the backend's `allowedOrigins`, not this list.
    */
   readonly formOrigins?: ReadonlyArray<string> | ((origin: string) => boolean)
   /**
@@ -396,6 +404,8 @@ export interface RunningServer {
   readonly hostname: string
   readonly pendingRequests: number
   stop(closeActiveConnections?: boolean): void
+  /** `await using server = app.listen(3000)`: the app's graceful `stop()` with default options, not Bun's raw one. Waits for a shutdown already under way. */
+  [Symbol.asyncDispose](): Promise<void>
   /** Bun's native topic broadcast, present on the Bun `Server` handle. `app.publish` delegates to it
    * in native-pubsub mode; absent on other runtimes' running-server views. */
   publish?(topic: string, data: string | ArrayBufferView | ArrayBuffer): number

package/src/server/server.ts

@@ -88,7 +88,7 @@ import {
   type RawBodyReaders,
   UNLIMITED_BODY_BYTES,
 } from "./body.ts"
-import type { FormOrigins } from "./body-lane.ts"
+import { crossSiteFormRefused, type FormOrigins, guardsBodylessForm } from "./body-lane.ts"
 import {
   type ClientIpTrust,
   NIFRA_PLATFORM_CLIENT_IP_DERIVED,
@@ -261,6 +261,7 @@ export type MaybePromise<T> = T | Promise<T>
 // ordinary registered routes on its native table and send unmatched OPTIONS requests through the
 // normal fetch fallback where the hook still runs.
 const BUN_NATIVE_REQUEST_SAFE = Symbol.for("@nifrajs/core/bun-native-request-safe")
+const TRUSTED_ORIGINS = Symbol.for("nifra.trustedOrigins")
 
 /**
  * Internal request view. A real Web `Request` already satisfies this shape, so Web/edge runtimes pass
@@ -691,6 +692,17 @@ const UNROUTED_CHAR = /[^!$%&'()*+,\-./0-9:;=?@A-Z[\]_a-z|~]/
 const unroutedParam = (value: string | undefined): boolean =>
   value !== undefined && (value === "." || value === ".." || UNROUTED_CHAR.test(value))
 
+/** Native query-schema routes can pass this search substring into RequestContext directly instead of
+ * building both pathname and search with the portable URL helper. Keep fragment handling identical
+ * to `urlPartsOf`; in-process Requests can retain a fragment even though network request targets do not. */
+function searchOfNativeRequest(url: string): string {
+  const question = url.indexOf("?")
+  const fragment = url.indexOf("#")
+  return question < 0 || (fragment >= 0 && question > fragment)
+    ? ""
+    : url.slice(question, fragment < 0 ? undefined : fragment)
+}
+
 function hasUnroutedParam(params: Record<string, string>): boolean {
   for (const key in params) {
     if (unroutedParam(params[key])) return true
@@ -1488,7 +1500,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     | undefined
   private readonly maxBodyBytes: number
   private readonly protoPoisoning: "reject" | "strip" | "ignore"
-  private readonly formOrigins: FormOrigins | undefined
+  private formOrigins: FormOrigins | undefined
   /** `trustBodyFraming`: mark every `app.fetch` request as runtime-framed (see ServerOptions). */
   private readonly trustBodyFraming: boolean
   private readonly validateHost: boolean
@@ -1538,6 +1550,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   /** App-wide validation-error fallback; a route's own `schema.onValidationError` takes precedence. */
   private readonly defaultOnValidationError?: RouteSchema["onValidationError"]
   private bunServer: RunningServer | undefined
+  // The shutdown `stop()` last began, so a handle disposed mid-shutdown waits for it rather than for nothing.
+  private stopRun: Promise<void> | undefined
   // Bun's `pendingRequests` leaves out upgraded sockets, so `stop()` closes these itself.
   private bunSockets: Set<{ close(code?: number): void }> | undefined
   private signalHandler: (() => void) | undefined
@@ -2322,6 +2336,15 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       }
       this[INSTALL_RESPONSE_OBSERVER](responseObserver as ResponseObserverRuntime)
     }
+    // `cors()` and `csrf()` name the origins they trust; a form post from one of them is the app's own
+    // frontend, so it joins `formOrigins` rather than being listed twice.
+    const trusted: unknown = Reflect.get(arg, TRUSTED_ORIGINS)
+    if (typeof trusted === "function") {
+      const listed = this.formOrigins
+      this.formOrigins = (origin) =>
+        (typeof listed === "function" ? listed(origin) : listed?.includes(origin)) === true ||
+        trusted(origin) === true
+    }
     if (arg.onRequest !== undefined) {
       this.assertConfigurable("onRequest()")
       this.onRequestHooks.push(arg.onRequest as RawOnRequest)
@@ -2823,6 +2846,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     handler: (context: never) => unknown,
   ): CatalogRoute {
     const staticResponse = staticResponseDefinition(handler)
+    // A handler carrying this marker checks the Origin itself (web page actions), so the default stays out.
+    const ownsFormOrigin = Reflect.get(handler, Symbol.for("nifra.route.ownsFormOrigin")) === true
     schema = withTextSlots(schema)
     // Route provenance for the CLI's capability walk, which sets NIFRA_ROUTE_SITES while it loads the
     // app: the module that registered the route, read where a static scan cannot see the path.
@@ -2982,6 +3007,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       afterHandle: aftersSnapshot,
       onError: onErrorSnapshot,
       lifecycleHookLane: lanes.lifecycleHookLane,
+      formOriginGuard: !ownsFormOrigin && guardsBodylessForm(method, schema?.body !== undefined),
       around: [...this.aroundHooks],
       execution,
       program,
@@ -4807,6 +4833,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     onTimeout: () => T,
     webFast: boolean,
   ): MaybePromise<T> {
+    if (entry.formOriginGuard && crossSiteFormRefused(source, this.formOrigins)) {
+      return wrapResponse(plainError(403, "forbidden_origin"))
+    }
     // The route's transport byte cap: one property write here; the capped shadowing of direct
     // `c.req` body readers happens lazily at `c.req` access (`applyTransportCap`), so a route that
     // never direct-reads pays nothing. Framework readers bypass the shadow (`rawBodySourceOf`) and
@@ -7335,10 +7364,11 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       entry.schema?.body === undefined || entry.program.authBeforeValidation
         ? entry.bodyLimit
         : undefined
+    const hasQuerySchema = entry.schema?.query !== undefined
     // The complete plan already preserves general validation, hooks, recovery, around, and ledgers.
     // When native admission is safe, use it directly even if the route has no closed-shape fusion.
     // Idempotency still needs runMatched's request preparation and is excluded from the table.
-    const inner: FusedWebRunner | undefined =
+    const unguarded: FusedWebRunner | undefined =
       fused ??
       (signal && budget
         ? (source, params, search, activeSignal, activeBudget, platform, nativeContext) =>
@@ -7356,6 +7386,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
               this.wrapWebResponse,
             )
         : undefined)
+    const inner: FusedWebRunner | undefined =
+      unguarded === undefined || !entry.formOriginGuard
+        ? unguarded
+        : (source, params, search, fusedSignal, fusedBudget, platform, nativeContext) =>
+            crossSiteFormRefused(source, this.formOrigins)
+              ? this.wrapWebResponse(plainError(403, "forbidden_origin"))
+              : unguarded(source, params, search, fusedSignal, fusedBudget, platform, nativeContext)
     // The cap is never marked on a GET or HEAD, the only methods a GET or HEAD slot is handed, so those
     // slots skip the wrapper and its read of the method on every request.
     const capped: FusedWebRunner | undefined =
@@ -7377,7 +7414,15 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     ): MaybePromise<Response> => {
       let outcome: MaybePromise<Response>
       try {
-        outcome = capped!(request, params, undefined, signal!, budget!, peer, true)
+        outcome = capped!(
+          request,
+          params,
+          hasQuerySchema ? searchOfNativeRequest(request.url) : undefined,
+          signal!,
+          budget!,
+          peer,
+          true,
+        )
       } catch (err) {
         // A synchronous render throw, as in runMatchedLanes.
         outcome = this.contextlessBareError(
@@ -7599,7 +7644,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       if (
         mayUseStaticResponse &&
         staticResponse !== undefined &&
-        (method === "GET" || method === "HEAD") &&
+        (method === "GET" || method === "HEAD" || method === "POST") &&
         // Bun 1.3 can misframe null-body status codes in its native static table.
         staticResponse.status !== 204 &&
         staticResponse.status !== 205 &&
@@ -7882,6 +7927,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
           },
         })) as unknown as RunningServer
     this.bunServer = running
+    running[Symbol.asyncDispose] = () =>
+      this.bunServer === running ? this.stop() : (this.stopRun ?? Promise.resolve())
     // Bind `app.publish` to Bun's native broadcast now that the server handle exists. Guarded on the
     // method's presence so a runtime whose handle lacks it simply keeps the registry path. Cleared
     // first: a mounted app may have gained a WebSocket route since an earlier `listen()`.
@@ -7910,7 +7957,17 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    * hooks after the drain. Open WebSockets get a 1001 close when the drain starts and the same
    * window to finish it; a socket opened after `stop()` began is closed at once.
    */
-  async stop({ drainMs = DEFAULT_DRAIN_MS, delayMs = 0 }: StopOptions = {}): Promise<void> {
+  stop(options: StopOptions = {}): Promise<void> {
+    const owns = this.bunServer !== undefined
+    const run = this.stopListener(options)
+    if (owns) this.stopRun = run
+    return run
+  }
+
+  private async stopListener({
+    drainMs = DEFAULT_DRAIN_MS,
+    delayMs = 0,
+  }: StopOptions): Promise<void> {
     const onSignal = this.signalHandler
     if (onSignal !== undefined) {
       this.signalHandler = undefined

package/src/transport-codec.ts

@@ -61,8 +61,8 @@ function byteLength(text: string): number {
 
 /**
  * Enforce the transport byte cap on already-read text - the same limit (and the same error) the
- * streaming reader applies during a bounded read. Exported for callers that read a body through a
- * native, non-streaming path (the typed client's in-process branch) and still owe the cap contract.
+ * streaming reader applies during a bounded read. Exported for callers that need to decode text
+ * after a bounded read while preserving the text decoder's lenient UTF-8 behavior.
  */
 export function assertTransportTextBounded(text: string, options: TransportDecodeOptions): void {
   const maxBytes = maxBytesOf(options)
@@ -278,10 +278,8 @@ async function readBoundedText(
 /**
  * Decode an ALREADY-READ transport body. The counterpart to {@link decodeTransportResponse} for a
  * caller that obtained the text through its own bounded read - notably the typed client's
- * in-process path, where the response body is same-process memory that was fully resident before
- * the read, so the native `Response.text()` is safe and the streaming byte-cap loop would protect
- * nothing while costing ~23x. The byte cap is still enforced here (identical error), just after
- * the read instead of during it.
+ * in-process path, which uses this to preserve lenient UTF-8 decoding after the shared byte-cap
+ * reader has completed.
  */
 export function decodeTransportText(
   text: string,