@nifrajs/core 5.7.0 → 5.9.0

package/src/manifest.ts

@@ -1,6 +1,7 @@
 /** Deterministic, signed route manifest: contract × assurance × capabilities × classification. */
 
 import type { AssuranceReport } from "./assurance.ts"
+import { canonicalJson } from "./canonical-json.ts"
 import type { CapabilityAssuranceReport } from "./capabilities.ts"
 import {
   type DataClassification,
@@ -15,6 +16,8 @@ import {
 } from "./diff.ts"
 import { type ProjectEvidenceSnapshot, snapshotProjectEvidence } from "./evidence.ts"
 import { codeUnitOrder } from "./internal/code-unit-order.ts"
+import { hasControlCharacter } from "./internal/control-character.ts"
+import { sha256Hex } from "./internal/hex.ts"
 
 export interface NifraManifestAssurance {
   readonly rule?: string
@@ -70,35 +73,6 @@ export interface BuildNifraManifestInput {
 
 const encoder = new TextEncoder()
 
-function hasControlCharacter(value: string): boolean {
-  for (let index = 0; index < value.length; index++) {
-    const code = value.charCodeAt(index)
-    if (code <= 31 || code === 127) return true
-  }
-  return false
-}
-
-function canonicalValue(value: unknown): string {
-  if (value === null || typeof value === "string" || typeof value === "boolean") {
-    return JSON.stringify(value)
-  }
-  if (typeof value === "number") {
-    if (!Number.isFinite(value))
-      throw new TypeError("nifra manifest cannot encode non-finite numbers")
-    return JSON.stringify(value)
-  }
-  if (Array.isArray(value)) return `[${value.map((item) => canonicalValue(item)).join(",")}]`
-  if (typeof value === "object") {
-    const record = value as Readonly<Record<string, unknown>>
-    return `{${Object.keys(record)
-      .filter((key) => record[key] !== undefined)
-      .sort()
-      .map((key) => `${JSON.stringify(key)}:${canonicalValue(record[key])}`)
-      .join(",")}}`
-  }
-  throw new TypeError(`nifra manifest cannot encode ${typeof value}`)
-}
-
 function manifestBody(manifest: Pick<NifraManifest, "manifestVersion" | "routes">): {
   readonly manifestVersion: 1
   readonly routes: readonly NifraManifestRoute[]
@@ -110,17 +84,17 @@ function manifestBody(manifest: Pick<NifraManifest, "manifestVersion" | "routes"
 export function canonicalManifest(
   manifest: Pick<NifraManifest, "manifestVersion" | "routes">,
 ): string {
-  return canonicalValue(manifestBody(manifest))
+  return canonicalJson(manifestBody(manifest))
 }
 
 /** Byte-stable artifact serialization (including `contentHash`). */
 export function serializeNifraManifest(manifest: NifraManifest): string {
-  return canonicalValue(manifest)
+  return canonicalJson(manifest)
 }
 
 /** Byte-stable serialization for the detached signature sidecar. */
 export function serializeNifraManifestSignature(signature: NifraManifestSignature): string {
-  return canonicalValue(signature)
+  return canonicalJson(signature)
 }
 
 /** Parse the detached sidecar before selecting its operator-controlled public key. */
@@ -163,11 +137,6 @@ export function parseNifraManifestSignature(
   return Object.freeze(candidate as NifraManifestSignature)
 }
 
-async function sha256Hex(value: string): Promise<string> {
-  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value)))
-  return [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("")
-}
-
 const routeKey = (method: string, path: string): string => `${method.toUpperCase()}\n${path}`
 const sortedStrings = (values: Iterable<string>): readonly string[] =>
   Object.freeze([...new Set(values)].sort())
@@ -255,7 +224,10 @@ export async function buildNifraManifest(input: BuildNifraManifestInput): Promis
 function base64Url(bytes: Uint8Array): string {
   let binary = ""
   for (const byte of bytes) binary += String.fromCharCode(byte)
-  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "")
+  return btoa(binary)
+    .replaceAll("+", "-")
+    .replaceAll("/", "_")
+    .replace(/={1,2}$/, "")
 }
 
 function fromBase64Url(value: string): Uint8Array<ArrayBuffer> {

package/src/open-resolved.ts

@@ -0,0 +1,64 @@
+import { constants as FS } from "node:fs"
+import { type FileHandle, open, readlink, realpath, stat } from "node:fs/promises"
+
+// Darwin's open(2) flag refusing a symlink in ANY component; `O_NOFOLLOW` covers only the last one.
+const O_NOFOLLOW_ANY = 0x20000000
+// Deno's node:fs rejects flags it does not know with EINVAL; the first refusal turns the flag off.
+let noFollowAny: boolean | undefined
+
+/**
+ * Open a name `realpath` already resolved, refusing it when any component became a symlink since.
+ * A local writer inside the served tree can swap an intermediate directory for a link after the
+ * containment check; `O_NOFOLLOW` alone would follow it. Darwin refuses such a path in the kernel;
+ * Linux reads back the name the descriptor holds. Elsewhere, Windows included, no file API can open
+ * without following a middle link or name an open descriptor's path, so the check in
+ * {@link opensAt} is a platform limit: it narrows the race to repeated swaps but cannot close it.
+ */
+export async function openResolved(realFile: string): Promise<FileHandle> {
+  // Read per open, not at load: this module can sit in a client bundle graph, where `process` is
+  // undefined.
+  if (noFollowAny ?? process.platform === "darwin") {
+    try {
+      return await open(realFile, FS.O_RDONLY | O_NOFOLLOW_ANY)
+    } catch (error) {
+      if (!(error instanceof Error && "code" in error && error.code === "EINVAL")) throw error
+      noFollowAny = false
+    }
+  }
+  const handle = await open(realFile, FS.O_RDONLY | FS.O_NOFOLLOW)
+  try {
+    if (await opensAt(handle, realFile)) return handle
+  } catch {}
+  await handle.close()
+  throw Object.assign(new Error(`${realFile} moved while it was opened`), { code: "ELOOP" })
+}
+
+/** Whether `handle` is the file at `realFile` with no symlink in its path. */
+export async function opensAt(
+  handle: Pick<FileHandle, "fd" | "stat">,
+  realFile: string,
+): Promise<boolean> {
+  try {
+    return (await readlink(`/proc/self/fd/${handle.fd}`)) === realFile
+  } catch {
+    return sameFileAt(handle, realFile)
+  }
+}
+
+/**
+ * {@link opensAt} where no descriptor's path can be read. Exported for its test, which runs it on
+ * every host.
+ */
+export async function sameFileAt(
+  handle: Pick<FileHandle, "stat">,
+  realFile: string,
+): Promise<boolean> {
+  // One step after another, so passing takes a swap back and a swap again between steps: the name
+  // resolves to itself, then to the opened file, then to itself again. Identities are compared as
+  // bigints because a Windows file index can exceed 2^53.
+  if ((await realpath(realFile)) !== realFile) return false
+  const opened = await handle.stat({ bigint: true })
+  const named = await stat(realFile, { bigint: true })
+  if (opened.dev !== named.dev || opened.ino !== named.ino) return false
+  return (await realpath(realFile)) === realFile
+}

package/src/range.ts

@@ -104,7 +104,7 @@ export function parseByteRange(value: string | null, size: number): ByteRangeRes
   if (value.length > MAX_RANGE_HEADER_LENGTH) return { kind: "none" }
   const single = parseSingleRange(value, size)
   if (single !== undefined) return single
-  const match = /^bytes\s*=\s*(.+)$/i.exec(value)
+  const match = /^bytes\s*=\s*(\S.*)$/i.exec(value)
   if (match === null) return { kind: "none" }
   const source = match[1]!
   let separators = 0

package/src/serve-static.ts

@@ -0,0 +1,227 @@
+/**
+ * `serveStatic()` for Bun's `listen({ static })`: files on disk under URL prefixes, with the same
+ * mounts `@nifrajs/node` and `@nifrajs/deno` take. Which request a mount takes and how it answers is
+ * `./static-file.ts`; this module only reads the file, through node:fs, which Bun runs natively.
+ *
+ * A subpath rather than part of `listen()`, so an app that serves no files bundles no file reader.
+ */
+import { createHash } from "node:crypto"
+import { type FileHandle, realpath } from "node:fs/promises"
+import { isAbsolute, relative, resolve, sep } from "node:path"
+import { Readable } from "node:stream"
+import { fileURLToPath } from "node:url"
+import { openResolved } from "./open-resolved.ts"
+import { parseByteRange } from "./range.ts"
+import { pathnameOf } from "./server/http.ts"
+import {
+  CONTENT_SNAPSHOT_MAX,
+  contentTags,
+  isHiddenPath,
+  matchStatic,
+  planStatic,
+  type ServeStaticOptions,
+  type StaticMount,
+  staticMountsOf,
+} from "./static-file.ts"
+
+export type { HashedFiles, ServeStaticOptions } from "./static-file.ts"
+export { IMMUTABLE, ONE_DAY } from "./static-file.ts"
+
+// Bun.serve drops the declared length of any stream body and sends it chunked, and a Bun.file body
+// would need this descriptor open for a send nothing reports the end of. So on Bun a body up to 1 MiB
+// is read whole: a slow client then holds ~1 MB, against ~0.6 MB through Bun's stream sink.
+const BUFFERED_BODY_MAX = typeof Bun === "undefined" ? CONTENT_SNAPSHOT_MAX : 1024 * 1024
+
+// One per process: the tag of a file served from any mount is remembered by its real path.
+const TAGS = contentTags(createHash)
+
+function rootOf(dir: string | URL): string {
+  return resolve(typeof dir === "string" ? dir : fileURLToPath(dir))
+}
+
+/** The host of an absolute URL, as `new URL(url).host` would give it, without parsing the rest. */
+function hostOf(url: string): string {
+  const start = url.indexOf("//") + 2
+  let end = start
+  while (end < url.length) {
+    const code = url.charCodeAt(end)
+    if (code === 47 /* '/' */ || code === 63 /* '?' */ || code === 35 /* '#' */) break
+    end++
+  }
+  return url.slice(start, end)
+}
+
+function refusalOf(status: 400 | 403 | 404): Response {
+  return new Response(status === 400 ? "Bad Request" : status === 403 ? "Forbidden" : "Not Found", {
+    status,
+  })
+}
+
+/** `length` bytes of `handle` from `start`; fewer when the file shrank since its stat. */
+async function readPinned(
+  handle: FileHandle,
+  start: number,
+  length: number,
+): Promise<Uint8Array<ArrayBuffer>> {
+  const bytes = new Uint8Array(length)
+  let offset = 0
+  while (offset < length) {
+    const { bytesRead } = await handle.read(bytes, offset, length - offset, start + offset)
+    if (bytesRead === 0) break
+    offset += bytesRead
+  }
+  return offset === length ? bytes : bytes.subarray(0, offset)
+}
+
+interface BunMount extends StaticMount {
+  /** The directory's real path, resolved on first use and again after a miss, so one made later serves. */
+  realRoot: Promise<string | undefined> | undefined
+}
+
+/**
+ * The answer for `rel` under `mount`, or `undefined` when the mount falls through on a file it cannot
+ * serve.
+ */
+async function readStatic(
+  mount: BunMount,
+  rel: string,
+  immutable: boolean,
+  request: Request,
+): Promise<Response | undefined> {
+  const missing = (status: 403 | 404 = 404): Response | undefined =>
+    mount.fallthrough ? undefined : refusalOf(status)
+  const file = resolve(mount.root, rel)
+  // A drive or root in the decoded name (`C:/x` on Windows) leaves the directory without a `..`.
+  const contained = relative(mount.root, file)
+  if (contained.startsWith("..") || isAbsolute(contained)) return missing(403)
+  // Containment is checked on the RESOLVED name and that name is what opens, so a link swapped inside
+  // the tree after the check cannot redirect the read; openResolved refuses a name that gained a link.
+  mount.realRoot ??= realpath(mount.root).catch(() => undefined)
+  const [realRoot, realFile] = await Promise.all([
+    mount.realRoot,
+    realpath(file).catch(() => undefined),
+  ])
+  if (realRoot === undefined) mount.realRoot = undefined
+  if (
+    realRoot === undefined ||
+    realFile === undefined ||
+    (realFile !== realRoot && !realFile.startsWith(realRoot + sep))
+  ) {
+    return missing()
+  }
+  // A visible name linking to a dotfile inside the directory answers as a missing file does.
+  if (
+    mount.denyDotfiles &&
+    realFile !== realRoot &&
+    isHiddenPath(realFile.slice(realRoot.length + 1))
+  ) {
+    return missing()
+  }
+  let handle: FileHandle | undefined
+  try {
+    try {
+      handle = await openResolved(realFile)
+    } catch {
+      return missing()
+    }
+    const opened = handle
+    const stat = await opened.stat()
+    if (!stat.isFile()) return missing()
+    const method = request.method === "HEAD" ? "HEAD" : "GET"
+    let whole: Uint8Array<ArrayBuffer> | undefined
+    const plan = await planStatic(
+      mount,
+      immutable,
+      { method, header: (name) => request.headers.get(name) },
+      {
+        path: realFile,
+        version: stat,
+        readWhole: async () => {
+          whole = await readPinned(opened, 0, stat.size)
+          return whole
+        },
+        restat: () => opened.stat(),
+        tags: TAGS,
+        parseRange: parseByteRange,
+      },
+    )
+    if (!plan.body) return new Response(null, { status: plan.status, headers: plan.headers })
+    const { start, length, headers } = plan
+    if (length <= BUFFERED_BODY_MAX) {
+      const body =
+        whole === undefined
+          ? await readPinned(opened, start, length)
+          : whole.subarray(start, start + length)
+      headers["content-length"] = String(body.byteLength)
+      return new Response(body, { status: plan.status, headers })
+    }
+    const stream = opened.createReadStream({ start, end: start + length - 1 })
+    // createReadStream owns closing the descriptor after EOF or abort.
+    handle = undefined
+    // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: node:stream/web's ReadableStream is the global one on Bun; only the declarations differ.
+    const body = Readable.toWeb(stream) as unknown as ReadableStream<Uint8Array>
+    return new Response(body, { status: plan.status, headers })
+  } catch {
+    // Unreadable under the prefix: a 404 (not an SSR 404 page), unless the mount falls through.
+    return missing()
+  } finally {
+    try {
+      await handle?.close()
+    } catch {
+      // A close that fails changes nothing about the answer already chosen.
+    }
+  }
+}
+
+function serveFrom(
+  mounts: readonly BunMount[],
+  from: number,
+  request: Request,
+  path: string,
+  host: () => string,
+): Promise<Response | undefined> | undefined {
+  for (let i = from; i < mounts.length; i++) {
+    const mount = mounts[i]
+    if (mount === undefined) break
+    const matched = matchStatic(mount, path, host)
+    if (matched === "pass") continue
+    // matchStatic passes what a falling-through mount refuses, so a status here is always answered.
+    if ("status" in matched) return Promise.resolve(refusalOf(matched.status))
+    return readStatic(mount, matched.rel, matched.immutable, request).then(
+      (response) => response ?? serveFrom(mounts, i + 1, request, path, host),
+    )
+  }
+  return undefined
+}
+
+/**
+ * The `static` handler for files on disk, for Bun's `listen()`: each mount serves a directory under a
+ * URL prefix, and the first mount whose prefix (and `files`, when set) takes a GET or HEAD path
+ * answers it. A request no mount takes returns `undefined` synchronously and reaches the app. The
+ * same mounts work with `@nifrajs/node`'s and `@nifrajs/deno`'s `serveStatic`.
+ *
+ * Files up to 256 KiB carry a strong `ETag` from the exact bytes served. Larger files stream with no
+ * tag and a weak date, so an `If-Range` gets the whole file rather than a range spliced from two
+ * versions.
+ *
+ * @example
+ * ```ts
+ * import { serveStatic } from "@nifrajs/core/serve-static"
+ *
+ * app.listen(3000, { static: serveStatic({ dir: new URL("./assets/", import.meta.url) }) })
+ * ```
+ */
+export function serveStatic(
+  mounts: ServeStaticOptions | readonly ServeStaticOptions[],
+): (request: Request) => Promise<Response | undefined> | undefined {
+  const states: readonly BunMount[] = staticMountsOf(mounts, rootOf).map((mount) => ({
+    ...mount,
+    realRoot: undefined,
+  }))
+  return (request) => {
+    const method = request.method
+    if (method !== "GET" && method !== "HEAD") return undefined
+    const url = request.url
+    return serveFrom(states, 0, request, pathnameOf(url), () => hostOf(url))
+  }
+}

package/src/server/bare-error-lane.ts

@@ -31,7 +31,8 @@ export type ErrorLogDetail = "full" | "message" | "none"
  *   - a `Response` or a `status(...)` is control flow - the app answering directly, or plain data.
  *     Either renders through the same `finalize` a RETURNED one takes, with the request's `c.set`,
  *     so a thrown one means what the return means: a `Response` ships as built, plus the cookies the
- *     request queued (the set-session-then-`throw redirect()` pattern);
+ *     request queued (the set-session-then-`throw redirect()` pattern); one whose body cannot render
+ *     is a fault like any other, never a rejected request;
  *   - a request body the app's own `c.req.json()` or `c.req.formData()` could not parse is the
  *     client's 400 (`invalid_json`, `invalid_form`);
  *   - anything else is a real fault: logged once, then a bodyless 500 (never the caller's error text).
@@ -48,7 +49,15 @@ export function renderBareError<T>(
   logError: (err: unknown, ctx: RawContext) => void,
   wrapResponse: (response: ResponseResult) => T,
 ): T {
-  if (err instanceof Response || isResponseResult(err)) return finalize(err, responseSet(ctx), ctx)
+  if (err instanceof Response || isResponseResult(err)) {
+    try {
+      return finalize(err, responseSet(ctx), ctx)
+    } catch (renderErr) {
+      // A thrown answer whose body cannot render (a `toJSON` that throws) is a fault, not control flow.
+      logError(renderErr, ctx)
+      return wrapResponse(plainError(500, "internal_error"))
+    }
+  }
   const clientCode = clientBodyErrorCode(err)
   if (clientCode !== undefined) return wrapResponse(plainError(400, clientCode))
   logError(err, ctx)

package/src/server/base64-answers.ts

@@ -10,6 +10,7 @@
  */
 import { tagStandIn } from "../internal/hook-origins.ts"
 import type { AnswerStages, JsonReplyContext } from "./answer-step.ts"
+import { define } from "./json-shared.ts"
 import { isResponseResult, status } from "./runtime-core.ts"
 
 // Deeper than any real payload.
@@ -24,11 +25,6 @@ function base64(bytes: Uint8Array): string {
   return btoa(binary)
 }
 
-function define(out: object, key: string, value: unknown): void {
-  // `out[key] = value` for "__proto__" would replace the prototype instead of adding the field.
-  Object.defineProperty(out, key, { value, enumerable: true, writable: true, configurable: true })
-}
-
 /**
  * `value` with each `Uint8Array` as base64, copying only the containers above one. A container already
  * on the walk's path is left as it is, so a cycle costs one step, as it does `JSON.stringify`, which
@@ -52,7 +48,7 @@ function encoded(value: unknown, depth: number, path: Set<object>): unknown {
       }
       return out ?? value
     }
-    let out: object | undefined
+    let out: Record<string, unknown> | undefined
     for (const key of Object.keys(value)) {
       const item: unknown = Reflect.get(value, key)
       const next = encoded(item, depth + 1, path)

package/src/server/body-lane.ts

@@ -22,16 +22,25 @@ type JsonErrorContinuation<T> = (error: unknown) => T | Promise<T>
 
 type FramedJsonSource = RequestSource & {
   readonly bytes?: () => Promise<Uint8Array>
+  readonly text?: () => Promise<string>
   readonly jsonWithByteLength?: () => Promise<{
     readonly value: unknown
     readonly byteLength: number
   }>
 }
 
+// Every lane calls `onResult` outside its parse guard: a throw from the continuation is the app's,
+// and must never come back to the client as `invalid_json`.
 const INVALID_JSON = (): ResponseResult => plainError(400, "invalid_json")
+// A parameter, not a closure over the caller's `settle`: capturing it there costs every call a scope object.
+const fromBuffer =
+  <T>(settle: (bytes: Uint8Array) => T) =>
+  (buffer: ArrayBuffer): T =>
+    settle(new Uint8Array(buffer))
 
 // `Deno.serve`'s own `Request.json()` keeps a leading UTF-8 byte order mark that its `text()` and every
-// other runtime's `json()` drop, so it refuses a body they parse. Deno decodes the bytes itself below.
+// other runtime's `json()` drop, so it refuses a body they parse. Deno uses `text()` for an
+// untouched, runtime-framed request, or decodes the checked bytes below for other sources.
 const nativeJsonKeepsBom = "Deno" in globalThis
 
 /** Read a JSON source with the declared-length precheck, delivered-byte recheck, streaming cap, and
@@ -76,17 +85,39 @@ export function readBoundedJsonSource<T>(
         ? Promise.resolve(plainError(413, "payload_too_large"))
         : Promise.resolve(plainError(413, "payload_too_large")).then(onResult)
 
+    // A trusted runtime frame makes Content-Length the byte bound. Wrapped or untrusted sources
+    // must keep the delivered-byte check below, and chunked bodies must keep the streaming cap.
+    if (
+      nativeJsonKeepsBom &&
+      raw === req &&
+      hasTrustedBodyFraming(req) &&
+      raw.text !== undefined &&
+      headerOf(req, "transfer-encoding") === null
+    ) {
+      return raw.text().then(
+        (text) => {
+          let parsed: unknown
+          try {
+            parsed = parseJsonGuarded(text, protoPoisoning)
+          } catch {
+            parsed = INVALID_JSON()
+          }
+          return onResult === undefined ? parsed : onResult(parsed)
+        },
+        () => (onResult === undefined ? INVALID_JSON() : onResult(INVALID_JSON())),
+      )
+    }
+
     if (hasTrustedBodyFraming(req) && !nativeJsonKeepsBom) {
       return raw.json().then(
         (parsed) => {
+          let guarded: unknown
           try {
-            const guarded = guardParsedValue(parsed, protoPoisoning)
-            return onResult === undefined ? guarded : onResult(guarded)
+            guarded = guardParsedValue(parsed, protoPoisoning)
           } catch {
-            return onResult === undefined
-              ? plainError(400, "invalid_json")
-              : onResult(plainError(400, "invalid_json"))
+            guarded = INVALID_JSON()
           }
+          return onResult === undefined ? guarded : onResult(guarded)
         },
         () => (onResult === undefined ? INVALID_JSON() : onResult(INVALID_JSON())),
       )
@@ -102,60 +133,36 @@ export function readBoundedJsonSource<T>(
                 ? plainError(413, "payload_too_large")
                 : onResult(plainError(413, "payload_too_large"))
             }
+            let guarded: unknown
             try {
-              const guarded = guardParsedValue(value, protoPoisoning)
-              return onResult === undefined ? guarded : onResult(guarded)
+              guarded = guardParsedValue(value, protoPoisoning)
             } catch {
-              return onResult === undefined
-                ? plainError(400, "invalid_json")
-                : onResult(plainError(400, "invalid_json"))
+              guarded = INVALID_JSON()
             }
+            return onResult === undefined ? guarded : onResult(guarded)
           },
           () => (onResult === undefined ? INVALID_JSON() : onResult(INVALID_JSON())),
         )
       }
 
-      const bytesReader = raw.bytes
-      if (bytesReader !== undefined) {
-        return bytesReader.call(raw).then(
-          (bytes) => {
-            if (bytes.byteLength > length || bytes.byteLength > maxBytes) {
-              return onResult === undefined
-                ? plainError(413, "payload_too_large")
-                : onResult(plainError(413, "payload_too_large"))
-            }
-            try {
-              const parsed = parseJsonGuarded(TEXT_DECODER.decode(bytes), protoPoisoning)
-              return onResult === undefined ? parsed : onResult(parsed)
-            } catch {
-              return onResult === undefined
-                ? plainError(400, "invalid_json")
-                : onResult(plainError(400, "invalid_json"))
-            }
-          },
-          () => (onResult === undefined ? INVALID_JSON() : onResult(INVALID_JSON())),
-        )
+      const settle = (bytes: Uint8Array) => {
+        if (bytes.byteLength > length || bytes.byteLength > maxBytes) {
+          return onResult === undefined
+            ? plainError(413, "payload_too_large")
+            : onResult(plainError(413, "payload_too_large"))
+        }
+        let parsed: unknown
+        try {
+          parsed = parseJsonGuarded(TEXT_DECODER.decode(bytes), protoPoisoning)
+        } catch {
+          parsed = INVALID_JSON()
+        }
+        return onResult === undefined ? parsed : onResult(parsed)
       }
-
-      return raw.arrayBuffer().then(
-        (buffer) => {
-          const bytes = new Uint8Array(buffer)
-          if (bytes.byteLength > length || bytes.byteLength > maxBytes) {
-            return onResult === undefined
-              ? plainError(413, "payload_too_large")
-              : onResult(plainError(413, "payload_too_large"))
-          }
-          try {
-            const parsed = parseJsonGuarded(TEXT_DECODER.decode(bytes), protoPoisoning)
-            return onResult === undefined ? parsed : onResult(parsed)
-          } catch {
-            return onResult === undefined
-              ? plainError(400, "invalid_json")
-              : onResult(plainError(400, "invalid_json"))
-          }
-        },
-        () => (onResult === undefined ? INVALID_JSON() : onResult(INVALID_JSON())),
-      )
+      const refuse = () => (onResult === undefined ? INVALID_JSON() : onResult(INVALID_JSON()))
+      const bytesReader = raw.bytes
+      if (bytesReader !== undefined) return bytesReader.call(raw).then(settle, refuse)
+      return raw.arrayBuffer().then(fromBuffer(settle), refuse)
     }
   }
 

package/src/server/body.ts

@@ -8,6 +8,7 @@
  */
 
 import { jsonError } from "./http.ts"
+import { carryToCopy } from "./request-local.ts"
 
 interface BodySource {
   readonly headers: Pick<Headers, "get">
@@ -277,7 +278,9 @@ export function capBodyBytes(request: Request, maxBytes: number): Request {
     ),
     duplex: "half",
   }
-  return new Request(request, init)
+  const capped = new Request(request, init)
+  carryToCopy(request, capped)
+  return capped
 }
 
 /** First matching own-or-inherited descriptor, so instance shadows and prototype accessors both resolve. */

package/src/server/bridge-markers.ts

@@ -4,7 +4,7 @@
  * Each entry names a symbol looked up with `Symbol.for(...)`, so the two packages agree ONLY by the
  * string. A rename on one side and not the other is a silent protocol break - no type error, just a
  * symbol that never matches and a body that stops taking the direct-write lane. This module is the
- * single source: core defines its own symbols from these literals, and `scripts/gen-node-outcome.ts`
+ * single source: core defines its own symbols from these literals, and `scripts/gen-vendored.ts`
  * copies the map verbatim into the adapter's generated contract, so @nifrajs/node reads the identical
  * strings without a runtime dependency on core (the same deployment shape the generated outcome type
  * preserves).

package/src/server/cookies.ts

@@ -247,7 +247,10 @@ const toBase64Url = (buf: ArrayBuffer): string => {
   let bin = ""
   const bytes = new Uint8Array(buf)
   for (let i = 0; i < bytes.length; i++) bin += String.fromCharCode(bytes[i]!)
-  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
+  return btoa(bin)
+    .replace(/\+/g, "-")
+    .replace(/\//g, "_")
+    .replace(/={1,2}$/, "")
 }
 
 const BASE64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"

package/src/server/core-copies.ts

@@ -26,7 +26,7 @@ if (!copies.includes(here) && copies.push(here) > 1) {
 
 /** This copy's version: a literal like the package root's `VERSION` (no fs on the edge), which
  * `scripts/version.ts` rewrites on every release and `check:publish` asserts. */
-const COPY_VERSION = "5.7.0"
+const COPY_VERSION = "5.9.0"
 
 /** Record this copy's version beside its URL. Called by each `server()` behind the development guard,
  * so a production bundle drops it with the version; a copy that built a server has recorded one. */