@nifrajs/core 5.2.0 → 5.3.0

package/src/server/respond.ts

@@ -4,6 +4,7 @@
  * spine types, so the wire-response format lives in one module distinct from the request engine.
  */
 
+import { hasResidentBody, markResidentBody, residentBodiesRecorded } from "../mount.ts"
 import { NODE_BRIDGE_MARKER_KEYS } from "./bridge-markers.ts"
 import { plainError } from "./http.ts"
 import {
@@ -227,7 +228,8 @@ const RESPONSE_BODY = Symbol.for(NODE_BRIDGE_MARKER_KEYS.responseBody)
 
 /**
  * Responses known to carry a body and take header writes: framework renders built with one, and
- * foreign ones `writableResponse` has already checked. A body is sent once, so such a response belongs
+ * foreign ones `writableResponse` has already checked. A body the framework serialized itself is
+ * recorded by `markResidentBody` instead, and counts the same. A body is sent once, so such a response belongs
  * to whichever request holds it and is written in place without reading `.body` again - on Bun that
  * read turns a string body into a stream, measured at about 6% of a request.
  */
@@ -252,10 +254,9 @@ export function rememberRenderedResponse(response: Response, hasBody: boolean):
   return response
 }
 
-/** `rememberRenderedResponse` for a Response the framework constructed with a body. */
+/** `rememberRenderedResponse` for a Response the framework built around a body it serialized. */
 function withBody(response: Response): Response {
-  WRITABLE_BODY_RESPONSES.add(response)
-  return response
+  return markResidentBody(response)
 }
 
 const HEADER_MUTABILITY_PROBE = "x-nifra-header-probe"
@@ -289,7 +290,7 @@ function headersTakeWrites(headers: Headers): boolean {
  * handed back on any other request, that copy is copied again.
  */
 export function writableResponse(response: Response, request?: Request): Response {
-  if (WRITABLE_BODY_RESPONSES.has(response)) return response
+  if (hasResidentBody(response) || WRITABLE_BODY_RESPONSES.has(response)) return response
   if (response.body === null) {
     // A 101 upgrade and the status-0 `Response.error()` cannot be constructed, and a runtime makes
     // them per request.
@@ -426,7 +427,8 @@ export function fusedRespondNoSet(
   // hook walk is empty; an app that registers ANY response hook keeps the record, because the
   // alternative is `writableResponse` reading `.body` and probing the headers of every response (each
   // one is fresh, so nothing amortizes) - the probe alone measured 19% slower than the WeakSet write.
-  // Default false: an unknown caller pays one WeakSet write rather than a probe per response.
+  // Default false: an unknown caller pays one WeakSet write rather than a probe per response. Once an
+  // in-process client exists the write is no longer dead: it reads a recorded body whole.
   if (
     unstamped &&
     (tagResponseBody === false || tagResponseBody === undefined) &&
@@ -437,7 +439,8 @@ export function fusedRespondNoSet(
     !(result instanceof Response) &&
     !isResponseResult(result)
   ) {
-    return Response.json(result)
+    const response = Response.json(result)
+    return residentBodiesRecorded ? markResidentBody(response) : response
   }
   if (
     result !== undefined &&

package/src/server/server.ts

@@ -113,7 +113,7 @@ import {
   readBodyFramed,
 } from "./request-context.ts"
 import { recordRequestReplacement } from "./request-lineage.ts"
-import { hasDotSegment, resolveDotSegments } from "./request-target.ts"
+import { needsResolving, resolveDotSegments } from "./request-target.ts"
 import {
   applyStaticResponseHeaders,
   buildStaticResponseHeaders,
@@ -583,14 +583,21 @@ export { plainValidationError } from "./validation.ts"
 // importers keep resolving `searchOf`/`queryObjectOf`/`QueryValue` from here.
 export { type QueryValue, queryObjectOf, searchOf }
 
+// Outside the printable ASCII a parsed path keeps as written: a control, space, `"`, `#`, `<`, `>`,
+// `\`, `^`, `` ` ``, `{`, `}`, or past ASCII (U+FFFD, an invalid escape, included). Bun's table reads
+// a raw `#` and what follows as path, where the parsed URL ends the path there.
+const UNROUTED_CHAR = /[^!$%&'()*+,\-./0-9:;=?@A-Z[\]_a-z|~]/
+
 /**
  * A param value Bun's native route table matched but the portable router must decide: an invalid
  * escape, or a piece of path Bun matched raw while its own parsed URL says otherwise - a `.` / `..`
- * segment (Bun hands `%2e` over decoded), or a backslash, which the parsed URL reads as `/`.
+ * segment (Bun hands `%2e` over decoded), a backslash, which the parsed URL reads as `/`, a `#`,
+ * where the parsed URL's path ends (`/a/..#/b` is `/`), or a character the parsed URL
+ * percent-encodes (`/t/<b>` is `/t/%3Cb%3E`, which a static route for that text matches). The value
+ * is decoded, so a raw `<` and a sent `%3C` look alike; both are re-routed.
  */
 const unroutedParam = (value: string | undefined): boolean =>
-  value !== undefined &&
-  (value.includes("\uFFFD") || value.includes("\\") || value === "." || value === "..")
+  value !== undefined && (value === "." || value === ".." || UNROUTED_CHAR.test(value))
 
 function hasUnroutedParam(params: Record<string, string>): boolean {
   for (const key in params) {
@@ -605,9 +612,19 @@ function hasUnroutedParam(params: Record<string, string>): boolean {
  */
 const rawRequestTargets = typeof (globalThis as { Deno?: unknown }).Deno !== "undefined"
 
-/** `req` as Bun or workerd would have delivered it: the same request, its URL's dot segments resolved. */
+/** `req` as Bun or workerd would have delivered it: the same request, its URL resolved as they parse it. */
 const withResolvedTarget = (req: Request): Request => new Request(resolveDotSegments(req.url), req)
 
+// A Host as RFC 9110 allows it: a reg-name or an IP literal, then an optional port. Deno builds
+// `Request.url` by appending the target to the Host as received, so `Host: x/admin#` turned a
+// request for `/public` into one for `/admin`. Node refuses such a Host before routing; so does this.
+const HOST_AUTHORITY = /^(?:\[[0-9a-f:.%]+\]|[\w.-]+)(?::\d{1,5})?$/i
+
+const invalidHost = (req: Request): boolean => {
+  const host = req.headers.get("host")
+  return host !== null && !HOST_AUTHORITY.test(host)
+}
+
 function normalizeMountPrefix(path: string): string {
   if (!path.startsWith("/") || path.includes("?") || path.includes("#")) {
     throw new TypeError("mountFetch path must be an absolute pathname without a query or hash")
@@ -3159,7 +3176,10 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   fetch(req: Request, platform?: Platform<EnvOf<Ctx>>): MaybePromise<Response> {
     // Deno's `Request.url` is the target as sent; Bun, workerd and every `new Request()` parse it.
     // Route what the parsed URL says, so `/users/../admin` is `/admin` on every runtime.
-    if (rawRequestTargets && hasDotSegment(req.url)) req = withResolvedTarget(req)
+    if (rawRequestTargets) {
+      if (invalidHost(req)) return jsonError(400, "invalid_host")
+      if (needsResolving(req.url)) req = withResolvedTarget(req)
+    }
     // An edge deployment whose only ingress is this method declares its requests runtime-framed at
     // construction; everything else stays on the delivered-byte check (see `trustBodyFraming`).
     if (this.trustBodyFraming) markTrustedBodyFraming(req)
@@ -3654,8 +3674,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     if (req.method !== "GET") return WS_PASS
     // The adapter answers a pass by handing this same object to `fetch`.
     const received = req
-    // The handshake routes the path `fetch` would: dot segments resolved (see `fetch`).
-    if (rawRequestTargets && hasDotSegment(req.url)) req = withResolvedTarget(req)
+    // The handshake routes the path `fetch` would: Host checked, dot segments resolved (see `fetch`).
+    if (rawRequestTargets) {
+      if (invalidHost(req)) {
+        return { kind: "reject", response: this.wrapWebResponse(jsonError(400, "invalid_host")) }
+      }
+      if (needsResolving(req.url)) req = withResolvedTarget(req)
+    }
     // The handshake's caller is the one `fetch` derives: hooks and `upgrade()` see the trusted IP.
     platform = this.trustedPlatform(req, platform)
 

package/src/server/websocket.ts

@@ -60,6 +60,9 @@ export class TopicRegistry {
   private readonly memberships = new WeakMap<NifraWebSocket, Set<string>>()
 
   subscribe(topic: string, ws: NifraWebSocket): void {
+    // CLOSING or CLOSED: close has run, or is about to run, `unsubscribeAll`, so an async handler's
+    // late subscribe would hold the dead socket for good.
+    if (ws.readyState >= 2) return
     let subs = this.topics.get(topic)
     if (subs === undefined) {
       subs = new Set()

package/src/tool-contract.ts

@@ -469,8 +469,9 @@ export async function executeTool<Input, Output>(
       await options.idempotency?.abandon(reservationInput(reservation))
     } catch {}
   }
-  // Once the executor has run, the reservation is never released: a retry would repeat a side effect
-  // that may have committed. A store that throws on completion counts as one that refused it.
+  // Once the executor has started, the reservation is never released, even when it throws: a retry
+  // would repeat a side effect that may have committed. A store that throws on completion counts as
+  // one that refused it.
   let executed = false
   const complete = async (): Promise<boolean> => {
     if (reservation === undefined) return true
@@ -660,6 +661,7 @@ export async function executeTool<Input, Output>(
       record("execution", "dry-run")
       return finish({ ok: true, dryRun })
     }
+    executed = true
     const output = await tool.execute(validatedInput.value, {
       effectId,
       signal,
@@ -667,7 +669,6 @@ export async function executeTool<Input, Output>(
       dryRun,
       ...(tool.policy === undefined ? {} : { policy: tool.policy }),
     })
-    executed = true
     record("execution", "committed")
     const validatedOutput = await validateStandard(tool.output, output)
     if (!validatedOutput.ok) {
@@ -699,7 +700,9 @@ export async function executeTool<Input, Output>(
     }
     return finish({ ok: true, dryRun, output: validatedOutput.value })
   } catch (error) {
-    if (!executed) await abandon()
+    // A completion the store refuses still leaves the key pending until its lease lapses.
+    if (executed) await complete()
+    else await abandon()
     const code = signal.aborted || isAbortError(error) ? "cancelled" : "execution_failed"
     record("execution", "failed", code)
     return finish({ ok: false, dryRun, error: { code, stage: "execution" } })

package/src/transport-codec.ts

@@ -228,8 +228,11 @@ export async function readBoundedBytes(
 ): Promise<Uint8Array> {
   const maxBytes = maxBytesOf(options)
   const declared = response.headers.get("content-length")
-  if (declared !== null && /^\d+$/u.test(declared) && Number(declared) > maxBytes)
+  if (declared !== null && /^\d+$/u.test(declared) && Number(declared) > maxBytes) {
+    // Refused unread, the body would otherwise hold its connection open until the sender gives up.
+    response.body?.cancel().catch(() => {})
     throw new TransportCodecError("transport payload exceeds maxBytes")
+  }
   if (response.body === null) return new Uint8Array(0)
   const reader = response.body.getReader()
   const chunks: Uint8Array[] = []