@nifrajs/core 5.5.1 → 5.7.0

package/src/server/install.ts

@@ -52,5 +52,8 @@ export const RESOLVE_NODE_MOUNT: unique symbol = Symbol.for(
   NODE_BRIDGE_MARKER_KEYS.resolveNodeMount,
 )
 
+/** @internal Run a server's `onStopping` or `onStop` hooks; see `Server.stop()`. */
+export const SERVER_LIFECYCLE: unique symbol = Symbol.for("@nifrajs/core/server-lifecycle")
+
 /** @internal Marker on a mounted handler that knows how to serve a native Node request/response. */
 export const NODE_NATIVE_MOUNT: unique symbol = Symbol.for("@nifrajs/core/node-native-mount")

package/src/server/json-response.ts

@@ -0,0 +1,13 @@
+import { retried } from "./json-text.ts"
+
+/** `Response.json`, with each `bigint` written as its decimal string, as `jsonText` writes it. */
+export function jsonResponse(value: unknown, init?: ResponseInit): Response {
+  try {
+    return Response.json(value, init)
+  } catch (error) {
+    const text = retried(value, error)
+    // Parsed back so the runtime's own `Response.json` still picks the content-type, and still
+    // throws for a value with no JSON form.
+    return Response.json(typeof text === "string" ? JSON.parse(text) : value, init)
+  }
+}

package/src/server/json-text.ts

@@ -0,0 +1,34 @@
+/**
+ * JSON has no `bigint`, and `JSON.stringify` throws on one, so a handler returning a database's 64-bit
+ * id answered a 500. Every plain JSON writer goes through this instead: a `bigint` is written as its
+ * decimal string, the encoding OpenAPI generators and protobuf's JSON mapping use for 64-bit integers.
+ * Only a first attempt that threw is retried, so a value without one costs nothing more. The Node
+ * adapter runs a generated copy (scripts/gen-node-outcome.ts), so this module imports nothing.
+ */
+
+const bigintAsText = (_key: string, value: unknown): unknown =>
+  typeof value === "bigint" ? value.toString() : value
+
+/**
+ * `JSON.stringify`, with each `bigint` written as its decimal string. Typed as the lib types
+ * `JSON.stringify`: a value with no JSON form (`undefined`, a function) still gives `undefined`.
+ */
+export function jsonText(value: unknown): string {
+  try {
+    return JSON.stringify(value)
+  } catch (error) {
+    return retried(value, error)
+  }
+}
+
+/** Write `value` again, each `bigint` as text, after `JSON.stringify(value)` threw `error`; any other
+ * failure rethrows `error`. */
+export function retried(value: unknown, error: unknown): string {
+  if (!(error instanceof TypeError)) throw error
+  try {
+    return JSON.stringify(value, bigintAsText)
+  } catch {
+    // A cycle or a throwing `toJSON` fails this pass too; the first error is the one to report.
+    throw error
+  }
+}

package/src/server/multipart.ts

@@ -4,6 +4,9 @@
  * A route reads JSON and urlencoded bodies by default and answers `415` to everything else. Wrapping
  * its body schema opts that one route into multipart: the parts are read under the route's
  * `bodyLimit`, bounded by count and size, collected into one record, and handed to the schema.
+ * The body is parsed here, by the Fetch standard's `multipart/form-data` parser, and not by the
+ * runtime's own `formData()`: those disagree on bare line feeds, parts with no name, escaped or
+ * percent-encoded names, and a file's default type, so one body was a different form on each runtime.
  *
  *   import { multipartBody } from "@nifrajs/core/multipart"
  *   import { t } from "@nifrajs/schema"
@@ -73,6 +76,8 @@ const MAX_FILE_NAME_LENGTH = 255
 const DASH = 45
 const CR = 13
 const LF = 10
+const COLON = 58
+const PERCENT = 37
 const QUOTE = 34
 const BACKSLASH = 92
 const SLASH = 47
@@ -82,6 +87,23 @@ const TAB = 9
 
 const INVALID = (): ResponseResult => plainError(400, "invalid_multipart")
 
+const ASCII = new TextEncoder()
+// The Fetch standard reads a disposition only in this exact form, which every browser writes.
+const FORM_DATA_NAME = ASCII.encode('form-data; name="')
+const FILE_NAME = ASCII.encode('; filename="')
+const CONTENT_DISPOSITION = ASCII.encode("content-disposition")
+const CONTENT_TYPE = ASCII.encode("content-type")
+// "UTF-8 decode without BOM": a leading BOM is kept as U+FEFF, not dropped.
+const UTF8 = new TextDecoder("utf-8", { ignoreBOM: true })
+// A short ASCII name or value is read code by code: a decoder call costs more than the bytes.
+const SHORT_TEXT = 64
+
+// RFC 9110 `tchar`, by byte value.
+const TCHAR = new Uint8Array(128)
+for (const char of "!#$%&'*+-.^_`|~0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz") {
+  TCHAR[char.charCodeAt(0)] = 1
+}
+
 function limitOf(value: number | undefined, fallback: number, name: string): number {
   if (value === undefined) return fallback
   assertByteLimit(value, `multipartBody: ${name}`)
@@ -150,14 +172,10 @@ function failureTable(pattern: Uint8Array): Uint8Array {
   return table
 }
 
-/**
- * What a scan for `--boundary` found: how many, how many of them close a part with no content, and
- * whether the last one closes the body.
- */
+/** What a scan for `--boundary` found: where each one starts, and how many close an empty part. */
 interface Delimiters {
-  readonly count: number
+  readonly at: readonly number[]
   readonly empty: number
-  readonly closed: boolean
 }
 
 /** The most delimiters a scan counts: past either budget the body is refused unparsed. */
@@ -166,11 +184,6 @@ interface DelimiterLimits {
   readonly empty: number
 }
 
-/** `end` is the index after the last delimiter, or -1 when there was none. */
-function delimiters(bytes: Uint8Array, count: number, empty: number, end: number): Delimiters {
-  return { count, empty, closed: end !== -1 && bytes[end] === DASH && bytes[end + 1] === DASH }
-}
-
 /**
  * Whether the delimiter at `at` closes a part with no content: the blank line ending the part's
  * headers is followed at once by the CRLF that opens the delimiter. A part whose own content ends
@@ -196,30 +209,34 @@ function scanFrom(
   bytes: Uint8Array,
   pattern: Uint8Array,
   start: number,
-  counted: number,
+  at: number[],
   countedEmpty: number,
-  lastEnd: number,
   limits: DelimiterLimits,
 ): Delimiters {
   const table = failureTable(pattern)
   const size = pattern.length
-  let count = counted
   let empty = countedEmpty
-  let end = lastEnd
   for (let i = start, k = 0; i < bytes.length; i++) {
     const byte = bytes[i]
     while (k > 0 && byte !== pattern[k]) k = table[k - 1]!
     if (byte === pattern[k]) k++
     if (k === size) {
-      if (count > 0 && closesEmptyPart(bytes, i + 1 - size)) empty++
-      end = i + 1
-      if (overLimits(++count, empty, limits)) break
+      if (at.length > 0 && closesEmptyPart(bytes, i + 1 - size)) empty++
+      at.push(i + 1 - size)
+      if (overLimits(at.length, empty, limits)) break
       k = 0
     }
   }
-  return delimiters(bytes, count, empty, end)
+  return { at, empty }
 }
 
+declare const Deno: unknown
+
+// V8's TypedArray `indexOf` reads one element at a time (~0.6 ms a MiB on Node 26), where Buffer's is
+// native on Node and Bun. Deno's Buffer is a slower polyfill, and Workers have none by default.
+const bufferIndexOf =
+  typeof Deno === "undefined" && typeof Buffer === "function" ? Buffer.prototype.indexOf : undefined
+
 /**
  * Find the non-overlapping occurrences of `pattern` (which starts with a dash), stopping once the
  * count passes `limit`. Every `--boundary` is counted wherever it sits, which is at least what any
@@ -236,51 +253,199 @@ function scanDelimiters(
 ): Delimiters {
   const size = pattern.length
   const last = bytes.length - size
-  let count = 0
+  const at: number[] = []
   let empty = 0
-  let end = -1
   let work = 0
   let i = 0
   while (i <= last) {
-    i = bytes.indexOf(DASH, i)
+    i = bufferIndexOf === undefined ? bytes.indexOf(DASH, i) : bufferIndexOf.call(bytes, DASH, i)
     if (i === -1 || i > last) break
     let k = 1
     while (k < size && bytes[i + k] === pattern[k]) k++
     if (k === size) {
-      if (count > 0 && closesEmptyPart(bytes, i)) empty++
+      if (at.length > 0 && closesEmptyPart(bytes, i)) empty++
+      at.push(i)
       i += size
-      end = i
-      if (overLimits(++count, empty, limits)) break
+      if (overLimits(at.length, empty, limits)) break
       continue
     }
     work += k
-    if (work > bytes.length) return scanFrom(bytes, pattern, i, count, empty, end, limits)
+    if (work > bytes.length) return scanFrom(bytes, pattern, i, at, empty, limits)
+    i++
+  }
+  return { at, empty }
+}
+
+// What the File constructor keeps of a type: printable ASCII, lower-cased; anything else is "".
+const PRINTABLE = /^[\x20-\x7e]*$/
+
+/**
+ * `content` as a File whose type is what the standard makes of `type`. Bun's constructor appends
+ * `;charset=utf-8` to an exact lower-case `text/plain`, `text/html` or `application/json`, but not
+ * to the same type in upper case, which it lower-cases like every runtime.
+ */
+function fileOf(content: Uint8Array<ArrayBuffer>, name: string, type: string): File {
+  const wanted = PRINTABLE.test(type) ? type.toLowerCase() : ""
+  const file = new File([content], name, { type: wanted })
+  return file.type === wanted ? file : new File([content], name, { type: wanted.toUpperCase() })
+}
+
+/** One part as the parser read it: its field, its file name if it is a file, and its content. */
+interface Part {
+  readonly name: string
+  readonly filename: string | null
+  readonly type: string | null
+  readonly start: number
+  readonly end: number
+}
+
+/** The first index from `from` holding byte `a`, `b` or `c`, or the end of `bytes`. */
+function scanUntil(bytes: Uint8Array, from: number, a: number, b: number, c: number): number {
+  let i = from
+  while (i < bytes.length) {
+    const byte = bytes[i]
+    if (byte === a || byte === b || byte === c) break
     i++
   }
-  return delimiters(bytes, count, empty, end)
+  return i
 }
 
-/** True when `value` takes more than `max` bytes as UTF-8. */
-function exceedsUtf8(value: string, max: number): boolean {
-  const length = value.length
-  // A UTF-16 code unit is one to three UTF-8 bytes, so most values are decided without a walk.
-  if (length > max) return true
-  if (length * 3 <= max) return false
-  let bytes = 0
-  for (let i = 0; i < length; i++) {
-    const code = value.charCodeAt(i)
-    if (code < 0x80) bytes += 1
-    else if (code < 0x800) bytes += 2
-    else if (code >= 0xd800 && code <= 0xdbff && i + 1 < length) {
-      const low = value.charCodeAt(i + 1)
-      if (low >= 0xdc00 && low <= 0xdfff) {
-        bytes += 4
-        i++
-      } else bytes += 3
-    } else bytes += 3
-    if (bytes > max) return true
+function startsWith(bytes: Uint8Array, at: number, prefix: Uint8Array): boolean {
+  if (at + prefix.length > bytes.length) return false
+  for (let i = 0; i < prefix.length; i++) if (bytes[at + i] !== prefix[i]) return false
+  return true
+}
+
+/** `bytes[start, end)` as UTF-8 text. */
+function textOf(bytes: Uint8Array, start: number, end: number): string {
+  if (end - start <= SHORT_TEXT) {
+    let out = ""
+    for (let i = start; i < end; i++) {
+      const byte = bytes[i]!
+      if (byte >= 0x80) return UTF8.decode(bytes.subarray(start, end))
+      out += String.fromCharCode(byte)
+    }
+    return out
+  }
+  return UTF8.decode(bytes.subarray(start, end))
+}
+
+/** Whether `bytes[start, end)` spells `lower`, a lower-case ASCII header name, in any case. */
+function spells(bytes: Uint8Array, start: number, end: number, lower: Uint8Array): boolean {
+  if (end - start !== lower.length) return false
+  // A CR also folds onto `-`, but no header name holds one.
+  for (let i = 0; i < lower.length; i++) if ((bytes[start + i]! | 0x20) !== lower[i]) return false
+  return true
+}
+
+/** Bytes as the code points of the same values ("isomorphic decode"), for a header's value. */
+function isomorphic(bytes: Uint8Array, start: number, end: number): string {
+  let out = ""
+  for (let i = start; i < end; i += 4096) {
+    out += String.fromCharCode(...bytes.subarray(i, Math.min(end, i + 4096)))
+  }
+  return out
+}
+
+/**
+ * A quoted `name` or `filename` from the byte after its opening quote: everything up to the closing
+ * one, with `%0A`, `%0D` and `%22` restored. No backslash escapes, as the standard reads it.
+ */
+function quotedName(bytes: Uint8Array, from: number): { value: string; next: number } | undefined {
+  const close = scanUntil(bytes, from, LF, CR, QUOTE)
+  if (bytes[close] !== QUOTE) return undefined
+  let value = textOf(bytes, from, close)
+  if (bytes.subarray(from, close).includes(PERCENT)) {
+    value = value.replaceAll("%0A", "\n").replaceAll("%0D", "\r").replaceAll("%22", '"')
+  }
+  return { value, next: close + 1 }
+}
+
+/**
+ * The headers of the part whose first header line starts at `from`, up to the blank line that
+ * ends them. Undefined when a line does not parse or the part names no field.
+ */
+function partHeaders(
+  bytes: Uint8Array,
+  from: number,
+): { name: string; filename: string | null; type: string | null; next: number } | undefined {
+  let position = from
+  let name: string | null = null
+  let filename: string | null = null
+  let type: string | null = null
+  for (;;) {
+    if (bytes[position] === CR && bytes[position + 1] === LF) {
+      return name === null ? undefined : { name, filename, type, next: position + 2 }
+    }
+    const colon = scanUntil(bytes, position, LF, CR, COLON)
+    if (bytes[colon] !== COLON) return undefined
+    let start = position
+    let end = colon
+    while (start < end && isBlank(bytes[start]!)) start++
+    while (end > start && isBlank(bytes[end - 1]!)) end--
+    if (start === end) return undefined
+    for (let i = start; i < end; i++) if (TCHAR[bytes[i]!] !== 1) return undefined
+    position = colon + 1
+    while (isBlank(bytes[position] ?? 0)) position++
+    if (spells(bytes, start, end, CONTENT_DISPOSITION)) {
+      name = null
+      filename = null
+      if (!startsWith(bytes, position, FORM_DATA_NAME)) return undefined
+      const parsed = quotedName(bytes, position + FORM_DATA_NAME.length)
+      if (parsed === undefined) return undefined
+      name = parsed.value
+      position = parsed.next
+      if (startsWith(bytes, position, FILE_NAME)) {
+        const file = quotedName(bytes, position + FILE_NAME.length)
+        if (file === undefined) return undefined
+        filename = file.value
+        position = file.next
+      }
+    } else {
+      const stop = scanUntil(bytes, position, LF, CR, LF)
+      if (spells(bytes, start, end, CONTENT_TYPE)) {
+        let end = stop
+        while (end > position && isBlank(bytes[end - 1]!)) end--
+        type = isomorphic(bytes, position, end)
+      }
+      position = stop
+    }
+    if (bytes[position] !== CR || bytes[position + 1] !== LF) return undefined
+    position += 2
+  }
+}
+
+/**
+ * The parts of a body, read as the Fetch standard's `multipart/form-data` parser reads them: the
+ * body opens with `--boundary`, every part's content runs to the next CRLF `--boundary`, and the
+ * first `--boundary--` closes it. `at` holds every `--boundary` in the body; those that do not start
+ * a line are content. Undefined when the body is not such a form.
+ */
+function partsOf(bytes: Uint8Array, at: readonly number[], size: number): Part[] | undefined {
+  if (at[0] !== 0) return undefined
+  const parts: Part[] = []
+  let position = 0
+  let next = 0
+  for (;;) {
+    position += size
+    if (bytes[position] === DASH && bytes[position + 1] === DASH) return parts
+    if (bytes[position] !== CR || bytes[position + 1] !== LF) return undefined
+    const head = partHeaders(bytes, position + 2)
+    if (head === undefined) return undefined
+    position = head.next
+    let end: number
+    do end = at[++next] ?? -1
+    while (end !== -1 && (end - 2 < position || bytes[end - 2] !== CR || bytes[end - 1] !== LF))
+    if (end === -1) return undefined
+    parts.push({
+      name: head.name,
+      filename: head.filename,
+      type: head.type,
+      start: position,
+      end: end - 2,
+    })
+    position = end
   }
-  return false
 }
 
 /** C0 controls, DEL, line separators, and the characters that reorder or hide text in a label. */
@@ -326,21 +491,6 @@ function safeFileName(raw: string): string {
   return name === "" || name === "." || name === ".." ? FALLBACK_FILE_NAME : name
 }
 
-/** `part` as a `File` called `name`, keeping its bytes, type, and timestamp. */
-function renamedFile(part: Blob, name: string): File {
-  const modified = (part as Partial<File>).lastModified
-  const options: FilePropertyBag =
-    modified === undefined ? { type: part.type } : { type: part.type, lastModified: modified }
-  let file = new File([part], name, options)
-  // A runtime may hand back the single source part with its own name when nothing else changes;
-  // a second, empty part forces a new file.
-  if (file.name !== name) file = new File([part, ""], name, options)
-  if (file.name !== name || file.size !== part.size) {
-    throw new Error("multipartBody: this runtime did not apply a file name")
-  }
-  return file
-}
-
 function createReader(
   limits: MultipartLimits,
   inner: SchemaBodyReader | undefined,
@@ -368,65 +518,47 @@ function createReader(
     if (boundary === null) return INVALID()
 
     const read = await readBoundedBytes(source, maxBodyBytes)
-    if (!read.ok) {
-      return read.status === 413
-        ? plainError(413, "payload_too_large")
-        : plainError(400, "invalid_content_length")
-    }
+    if (!read.ok) return plainError(read.status, read.error)
     const bytes = read.bytes
 
-    // Counted on the raw bytes: the platform parser allocates per part, so a body of many tiny
-    // parts must be refused before it is parsed, not after.
+    // Counted on the raw bytes: the parser allocates per part, so a body of many tiny parts must be
+    // refused before it is parsed, not after.
     const delimiter = new Uint8Array(boundary.length + 2)
     delimiter[0] = DASH
     delimiter[1] = DASH
     for (let i = 0; i < boundary.length; i++) delimiter[i + 2] = boundary.charCodeAt(i)
     const found = scanDelimiters(bytes, delimiter, delimiterLimits)
-    if (overLimits(found.count, found.empty, delimiterLimits)) {
+    if (overLimits(found.at.length, found.empty, delimiterLimits)) {
       return plainError(413, "too_many_parts")
     }
-    // A body is over when `--boundary--` says so. One that stops short is refused here, because a
-    // parser that tolerates it hands back the parts it saw as if they were the whole form.
-    if (!found.closed) return INVALID()
-
-    // The parser is given the boundary this reader extracted, never the request's own header: two
-    // readings of one header (a repeated or oddly quoted parameter) would let a body be counted
-    // under one boundary and parsed under another.
-    const canonical = `${MEDIA_TYPE}; boundary=${TOKEN.test(boundary) ? boundary : `"${boundary}"`}`
-    // Typed by what is read from it: the global `FormData` and `BodyInit` names do not resolve to
-    // the same declarations under every lib config.
-    let form: Iterable<[string, string | Blob]>
-    try {
-      form = (await new Response(bytes as ConstructorParameters<typeof Response>[0], {
-        headers: { "content-type": canonical },
-      }).formData()) as unknown as Iterable<[string, string | Blob]>
-    } catch {
-      return INVALID()
-    }
+    // A body that stops before `--boundary--` is refused with the rest, because a reader that
+    // tolerated it would hand back the parts it saw as if they were the whole form.
+    const parts = partsOf(bytes, found.at, delimiter.length)
+    if (parts === undefined) return INVALID()
 
     const record = Object.create(null) as Record<string, MultipartValue>
     let fields = 0
     let files = 0
-    for (const [name, part] of form) {
+    for (const part of parts) {
+      const name = part.name
       if (name === "__proto__" && protoPoisoning !== "ignore") {
         if (protoPoisoning === "reject") return INVALID()
         continue
       }
+      const size = part.end - part.start
       let value: string | File
-      if (typeof part === "string") {
+      if (part.filename === null) {
         if (++fields > maxFields) return plainError(413, "too_many_fields")
-        if (exceedsUtf8(part, maxFieldBytes)) return plainError(413, "field_too_large")
-        value = part
+        if (size > maxFieldBytes) return plainError(413, "field_too_large")
+        value = textOf(bytes, part.start, part.end)
       } else {
-        // A file input left empty still submits a part with no bytes. Runtimes disagree on whether
-        // a named empty file keeps its name, so every empty file is treated as that input.
-        if (part.size === 0) continue
-        const rawName = (part as Partial<File>).name
-        const clientName = typeof rawName === "string" ? rawName : ""
+        // A file input left empty still submits a part with no bytes, so an empty file is that input.
+        if (size === 0) continue
         if (++files > maxFiles) return plainError(413, "too_many_files")
-        if (part.size > maxFileBytes) return plainError(413, "file_too_large")
-        const name = safeFileName(clientName)
-        value = part instanceof File && part.name === name ? part : renamedFile(part, name)
+        if (size > maxFileBytes) return plainError(413, "file_too_large")
+        // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: readBoundedBytes allocates its own ArrayBuffer, never a shared one.
+        const content = bytes.subarray(part.start, part.end) as Uint8Array<ArrayBuffer>
+        value = fileOf(content, safeFileName(part.filename), part.type ?? "text/plain")
       }
       const existing = record[name]
       if (existing === undefined) record[name] = value

package/src/server/node-outcome.ts

@@ -3,6 +3,8 @@
  * conversion. Mirrors `respond.ts` but skips the undici `Response` build where the adapter can write a
  * plain-data render straight to the socket. Imports only runtime-core + respond + the spine types.
  */
+
+import { jsonText } from "./json-text.ts"
 import {
   applySetToResponse,
   applyStaticResponseHeaders,
@@ -88,7 +90,7 @@ export function toNodeOutcome(result: HandlerResult, set: CtxSet): NodeServeOutc
     return nodeOutcomeFromResponse(applySetToResponse(normalizeBodylessResponse(result), set))
   }
   const status = set.status ?? (result === undefined ? 204 : 200)
-  const body = result === undefined || isBodylessStatus(status) ? null : JSON.stringify(result)
+  const body = result === undefined || isBodylessStatus(status) ? null : jsonText(result)
   return {
     kind: "json",
     status,
@@ -109,10 +111,7 @@ export function plainNodeOutcome(plain: PlainRender, set: CtxSet): NodeServeOutc
     status: plain.status,
     headers: plainRenderHeaders(plain, set),
     cookies: set._cookies,
-    body:
-      plain.body === undefined || isBodylessStatus(plain.status)
-        ? null
-        : JSON.stringify(plain.body),
+    body: plain.body === undefined || isBodylessStatus(plain.status) ? null : jsonText(plain.body),
   }
 }
 

package/src/server/proto-guard.ts

@@ -49,12 +49,37 @@ export function guardParsedValue(value: unknown, policy: ProtoPoisoning): unknow
  */
 /** Reused walk stack - `sweep` is synchronous and single-threaded, and a thrown rejection can
  * leave residue, so each entry clears it. Saves one array allocation per swept request. */
-const STACK: unknown[] = []
+const STORAGE: unknown[] = []
+// Reuse at most 1,024 logical slots between requests; larger walks use the existing full reset.
+const MAX_REUSED_STACK = 1024
+// JSC keeps native Array.pop on this hot path; a JS cursor lets it inline the stack operations.
+// Select once so V8 keeps its faster native array stack, with one shared security walk below.
+const INDEXED_STACK = typeof Bun !== "undefined"
+const STACK = !INDEXED_STACK
+  ? STORAGE
+  : {
+      length: 0,
+      push(value: unknown): void {
+        STORAGE[this.length++] = value
+      },
+      pop(): unknown {
+        const index = --this.length
+        const value = STORAGE[index]
+        STORAGE[index] = undefined
+        return value
+      },
+    }
 
 function sweep(root: unknown, policy: "reject" | "strip"): unknown {
   if (root === null || typeof root !== "object") return root
   const stack = STACK
-  stack.length = 0
+  // Keep V8's native-array reset: skipping it regresses the deep-chain control. Bun only needs
+  // a reset after an unexpected custom-source throw; ordinary pops already cleared every slot.
+  if (!INDEXED_STACK) stack.length = 0
+  else if (stack.length > 0) {
+    stack.length = 0
+    STORAGE.length = 0
+  }
   stack.push(root)
   while (stack.length > 0) {
     const node = stack.pop() as object
@@ -95,7 +120,11 @@ function sweep(root: unknown, policy: "reject" | "strip"): unknown {
       // + first-code-unit guards avoid a full string comparison for the overwhelming majority of
       // fields while preserving exact equality for the two security-sensitive names.
       if (key.length === 9 && key.charCodeAt(0) === 95 /* _ */ && key === "__proto__") {
-        if (policy === "reject") throw POISONED
+        if (policy === "reject") {
+          stack.length = 0
+          STORAGE.length = 0
+          throw POISONED
+        }
         // biome-ignore lint/complexity/useLiteralKeys: bracket access keeps the guarded key an explicit string, never a prototype walk
         delete record["__proto__"]
         continue
@@ -107,7 +136,11 @@ function sweep(root: unknown, policy: "reject" | "strip"): unknown {
         nested &&
         Object.hasOwn(value, "prototype")
       ) {
-        if (policy === "reject") throw POISONED
+        if (policy === "reject") {
+          stack.length = 0
+          STORAGE.length = 0
+          throw POISONED
+        }
         // biome-ignore lint/complexity/useLiteralKeys: bracket access keeps the guarded key an explicit string, never a prototype walk
         delete record["constructor"]
         continue
@@ -115,6 +148,8 @@ function sweep(root: unknown, policy: "reject" | "strip"): unknown {
       if (nested) stack.push(value)
     }
   }
+  // Bun pops clear their references immediately, so ordinary requests can reuse the empty buffer.
+  if (INDEXED_STACK && STORAGE.length > MAX_REUSED_STACK) STORAGE.length = 0
   return root
 }
 

package/src/server/query.ts

@@ -64,12 +64,11 @@ function setQueryValue(out: Record<string, QueryValue>, rawKey: string, value: s
 }
 
 function queryObjectFallback(search: string): Record<string, QueryValue> {
-  // Manual iteration instead of Object.fromEntries: repeated keys must promote to arrays
-  // (fromEntries is last-wins), and __proto__ needs the same own-property guard.
+  // Native forEach avoids iterator/pair arrays while preserving repeated-key order and safe keys.
   const out: Record<string, QueryValue> = Object.create(null) as Record<string, QueryValue>
-  for (const [key, value] of new URLSearchParams(search)) {
+  new URLSearchParams(search).forEach((value, key) => {
     setQueryValue(out, key, value)
-  }
+  })
   return out
 }
 
@@ -87,10 +86,9 @@ export function queryObjectOf(search: string): Record<string, QueryValue> {
   const start = search.charCodeAt(0) === 63 /* ? */ ? 1 : 0
   if (start >= search.length) return EMPTY_QUERY
 
-  for (let i = start; i < search.length; i++) {
-    const c = search.charCodeAt(i)
-    if (c === 37 /* % */ || c === 43 /* + */) return queryObjectFallback(search)
-  }
+  // Native single-character searches avoid a JS pass over every unencoded value byte.
+  if (search.indexOf("+", start) !== -1 || search.indexOf("%", start) !== -1)
+    return queryObjectFallback(search)
 
   const out: Record<string, QueryValue> = Object.create(null) as Record<string, QueryValue>
   let pos = start
@@ -191,11 +189,7 @@ export async function readBoundedForm(
   maxBytes: number,
 ): Promise<Record<string, QueryValue> | ResponseResult> {
   const read = await readBoundedBytes(req, maxBytes)
-  if (!read.ok) {
-    return read.status === 413
-      ? plainError(413, "payload_too_large")
-      : plainError(400, "invalid_content_length")
-  }
+  if (!read.ok) return plainError(read.status, read.error)
   const out: Record<string, QueryValue> = Object.create(null) as Record<string, QueryValue>
   // URLSearchParams owns the format's quirks (`+` as space, percent-decoding, empty keys);
   // it never throws on junk input, so no try/catch is needed here.