@nifrajs/node 3.5.0 → 4.0.0

package/dist/index.js

@@ -21,12 +21,14 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import { AsyncLocalStorage } from "node:async_hooks";
 import { constants as FS } from "node:fs";
 import { open, realpath } from "node:fs/promises";
-import { createServer, } from "node:http";
+import { createServer, STATUS_CODES, } from "node:http";
+import { createServer as createHttpsServer } from "node:https";
 import { extname, isAbsolute, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 // srvx's lazy spec-shaped Response - see nodeOutcomeToResponse for why the bridge uses it.
 import { FastResponse } from "srvx/node";
 import { NODE_BRIDGE_MARKER_KEYS } from "./generated/bridge-markers.js";
+import { hasDotSegment, resolveDotSegments } from "./generated/request-target.js";
 import { claimableWebStream, claimNodeStream } from "./node-stream.js";
 const RESOLVE_NODE_MOUNT = Symbol.for(NODE_BRIDGE_MARKER_KEYS.resolveNodeMount);
 /**
@@ -290,11 +292,21 @@ function installFastResponse() {
     globalThis.Response = DeferringResponse;
 }
 function appendCookiesToResponse(response, cookies) {
-    if (cookies !== undefined) {
+    if (cookies === undefined || cookies.length === 0)
+        return response;
+    try {
         for (const cookie of cookies)
             response.headers.append("set-cookie", cookie);
+        return response;
+    }
+    catch {
+        // Guarded `Headers` (`Response.redirect()`, a raw `fetch()` result) reject every write, so the
+        // first append throws with nothing applied and the cookies land on a mutable copy instead.
+        const clone = new Response(response.body, response);
+        for (const cookie of cookies)
+            clone.headers.append("set-cookie", cookie);
+        return clone;
     }
-    return response;
 }
 /** Early exits built outside the handler's finalizer - an `onRequest` hook's response, a mount's,
  * every framework error render. A plain-data carrier takes the `kind: "json"` lane a handler's plain
@@ -370,7 +382,11 @@ function nodeOutcomeToResponse(outcome) {
                 pairs.splice(i, 1);
         }
     }
-    const body = isBodylessStatus(outcome.status) ? null : outcome.body;
+    const body = isBodylessStatus(outcome.status) || outcome.body === null
+        ? null
+        : typeof outcome.body === "string"
+            ? outcome.body
+            : outcome.body.slice();
     const response = new FastResponse(body, {
         status: outcome.status,
         headers: pairs,
@@ -528,6 +544,14 @@ const STATIC_CONTENT_TYPES = {
     ".txt": "text/plain; charset=utf-8",
     ".webmanifest": "application/manifest+json",
 };
+function staticHeadersOf(input) {
+    if (input === undefined)
+        return undefined;
+    const headers = Object.create(null);
+    for (const [name, value] of Object.entries(input))
+        headers[name.toLowerCase()] = value;
+    return headers;
+}
 function staticStateOf(options) {
     const root = resolve(typeof options.dir === "string" ? options.dir : fileURLToPath(options.dir));
     const raw = options.prefix ?? "/assets";
@@ -543,7 +567,7 @@ function staticStateOf(options) {
         root,
         prefix,
         immutable: options.immutable !== false,
-        headers: options.headers,
+        headers: staticHeadersOf(options.headers),
         denyDotfiles: options.dotfiles !== "allow",
     };
 }
@@ -596,7 +620,80 @@ function staticMatch(state, rawUrl) {
     }
     return { file };
 }
-async function readStatic(file, state, method) {
+/** Strong validator from mtime + size (the nginx scheme): rewriting a file changes at least one. */
+function staticEtag(size, mtimeMs) {
+    return `"${Math.floor(mtimeMs).toString(16)}-${size.toString(16)}"`;
+}
+function weakEtag(value) {
+    return value.startsWith("W/") ? value.slice(2) : value;
+}
+/** `If-None-Match` uses the weak comparison (RFC 9110 section 13.1.2): a `W/` prefix is ignored. */
+function etagListMatches(header, etag) {
+    const comparable = weakEtag(etag);
+    for (const raw of header.split(",")) {
+        const candidate = raw.trim();
+        if (candidate === "*" || weakEtag(candidate) === comparable)
+            return true;
+    }
+    return false;
+}
+/** Whether the client's cached copy is current. `If-None-Match` wins over `If-Modified-Since`, whose
+ * HTTP-date only carries whole seconds. */
+function staticNotModified(headers, etag, lastModified) {
+    const ifNoneMatch = headers["if-none-match"];
+    if (typeof ifNoneMatch === "string")
+        return etagListMatches(ifNoneMatch, etag);
+    if (lastModified === undefined)
+        return false;
+    const ifModifiedSince = headers["if-modified-since"];
+    if (typeof ifModifiedSince !== "string")
+        return false;
+    const since = Date.parse(ifModifiedSince);
+    return Number.isFinite(since) && Math.floor(lastModified / 1000) * 1000 <= since;
+}
+function staticIfRangeMatches(value, etag, lastModified) {
+    const item = value.trim();
+    if (item.startsWith('"') || item.startsWith("W/")) {
+        return !item.startsWith("W/") && !etag.startsWith("W/") && item === etag;
+    }
+    // A date validator must match Last-Modified exactly (RFC 9110 section 13.1.5), not merely be later:
+    // a file swapped for one with an older mtime would otherwise splice foreign bytes into a resume.
+    if (lastModified === undefined)
+        return false;
+    const date = Date.parse(item);
+    return Number.isFinite(date) && Math.floor(lastModified / 1000) === Math.floor(date / 1000);
+}
+/**
+ * One `bytes=` range as inclusive offsets, `"unsatisfiable"` (416), or `undefined` to send the whole
+ * file: no header, a malformed or multi-range one (RFC 9110 lets a server ignore Range), or an
+ * `If-Range` validator that no longer matches the file.
+ */
+function staticByteRange(headers, size, etag, lastModified) {
+    const range = headers.range;
+    if (typeof range !== "string")
+        return undefined;
+    const ifRange = headers["if-range"];
+    if (typeof ifRange === "string" && !staticIfRangeMatches(ifRange, etag, lastModified)) {
+        return undefined;
+    }
+    const match = /^bytes=(\d*)-(\d*)$/.exec(range.trim());
+    if (match === null)
+        return undefined;
+    const first = match[1];
+    const last = match[2];
+    if (first === "") {
+        if (last === "")
+            return undefined;
+        const suffix = Number(last);
+        return suffix === 0 || size === 0 ? "unsatisfiable" : [Math.max(0, size - suffix), size - 1];
+    }
+    const start = Number(first);
+    if (start >= size)
+        return "unsatisfiable";
+    const end = last === "" ? size - 1 : Math.min(Number(last), size - 1);
+    return end < start ? undefined : [start, end];
+}
+async function readStatic(file, state, method, requestHeaders) {
     let handle;
     try {
         // Defense-in-depth: the lexical `..` guard in staticMatch can't catch a symlink INSIDE root that
@@ -617,26 +714,59 @@ async function readStatic(file, state, method) {
             return { kind: "response", response: new Response("Not Found", { status: 404 }) };
         }
         const headers = { ...state.headers };
+        if (state.immutable && headers["cache-control"] === undefined) {
+            headers["cache-control"] = "public, max-age=31536000, immutable";
+        }
+        headers.etag ??= staticEtag(stat.size, stat.mtimeMs);
+        headers["last-modified"] ??= stat.mtime.toUTCString();
+        // Custom validators are response headers, not decoration: compare the exact values the client saw.
+        const etag = headers.etag;
+        const parsedLastModified = Date.parse(headers["last-modified"]);
+        const lastModified = Number.isFinite(parsedLastModified) ? parsedLastModified : undefined;
+        // Revalidation: a current cached copy costs a header-only 304 instead of the whole file.
+        if (staticNotModified(requestHeaders, etag, lastModified)) {
+            await handle.close();
+            delete headers["content-length"];
+            delete headers["content-type"];
+            return { kind: "response", response: new Response(null, { status: 304, headers }) };
+        }
         headers["content-type"] =
             STATIC_CONTENT_TYPES[extname(file).toLowerCase()] ?? "application/octet-stream";
         // Never let a client sniff a served file into a more dangerous type (e.g. an .svg as active content).
         headers["x-content-type-options"] = "nosniff";
-        headers["content-length"] = String(stat.size);
-        if (state.immutable && headers["cache-control"] === undefined) {
-            headers["cache-control"] = "public, max-age=31536000, immutable";
+        headers["accept-ranges"] = "bytes";
+        // Range applies to GET only (RFC 9110 section 14.2); HEAD reports the whole representation.
+        const range = method === "GET" ? staticByteRange(requestHeaders, stat.size, etag, lastModified) : undefined;
+        if (range === "unsatisfiable") {
+            await handle.close();
+            headers["content-range"] = `bytes */${stat.size}`;
+            delete headers["content-length"];
+            delete headers["content-type"];
+            return { kind: "response", response: new Response(null, { status: 416, headers }) };
+        }
+        let status = 200;
+        if (range !== undefined) {
+            status = 206;
+            headers["content-range"] = `bytes ${range[0]}-${range[1]}/${stat.size}`;
+            headers["content-length"] = String(range[1] - range[0] + 1);
+        }
+        else {
+            headers["content-length"] = String(stat.size);
         }
         if (method === "HEAD") {
             await handle.close();
             return { kind: "response", response: new Response(null, { headers }) };
         }
-        const stream = handle.createReadStream();
+        const stream = range === undefined
+            ? handle.createReadStream()
+            : handle.createReadStream({ start: range[0], end: range[1] });
         return {
             kind: "response",
             // Claimable rather than `Readable.toWeb`: served straight from disk to the socket when this
             // response reaches the writer untouched, and read as an ordinary Web stream by anything that
             // gets to it first (a middleware that rewrites or compresses the body, say), which refuses
             // the claim and takes the conversion instead.
-            response: new Response(claimableWebStream(stream), { headers }),
+            response: new Response(claimableWebStream(stream), { status, headers }),
         };
     }
     catch {
@@ -684,6 +814,26 @@ function activateAsyncContextFrame() {
     asyncContextFrameActivated = true;
     new AsyncLocalStorage();
 }
+const ACTIVE_RESPONSE_STATE = Symbol("nifra.node.active-response-state");
+const ACTIVE_RESPONSE_RELEASED = Symbol("nifra.node.active-response-released");
+const ACTIVE_SOCKET_STATE = Symbol("nifra.node.active-socket-state");
+/** Shared finish/close listener - response state carries the per-response release bit. */
+function releaseActiveResponse() {
+    const response = this;
+    const state = response[ACTIVE_RESPONSE_STATE];
+    if (state === undefined || response[ACTIVE_RESPONSE_RELEASED])
+        return;
+    response[ACTIVE_RESPONSE_RELEASED] = true;
+    state.active -= 1;
+    if (state.parserError && state.active === 0 && !state.socket.destroyed) {
+        state.socket.destroy();
+    }
+}
+function clearActiveResponseState() {
+    const state = this[ACTIVE_SOCKET_STATE];
+    if (state !== undefined)
+        state.active = 0;
+}
 export function serve(app, options) {
     activateAsyncContextFrame();
     enableNodeDirect(app);
@@ -691,33 +841,29 @@ export function serve(app, options) {
         installFastResponse();
     let inFlight = 0;
     let closed = false;
-    const protocol = protocolResolver(options.protocol);
+    // Upgrade sockets an HTTP route answers instead: Node's server no longer tracks them, so stop()
+    // drains and closes them itself.
+    const answering = new Set();
+    const protocol = protocolResolver(options.protocol ?? (options.tls === undefined ? undefined : "https"));
     const hostPolicy = hostPolicyOf(options);
     const staticState = options.static !== undefined ? staticStateOf(options.static) : undefined;
     // Node otherwise destroys a socket as soon as its HTTP parser emits `clientError`. That can
     // discard the response for an already-dispatched request when an understated Content-Length
     // leaves surplus bytes that look like a malformed pipelined request. Keep the parser error
     // connection-scoped and close only after active responses finish, preserving response ordering.
-    const activeResponses = new WeakMap();
-    const parserErrorSockets = new WeakSet();
-    const server = createServer((nodeReq, nodeRes) => {
+    const onRequest = (nodeReq, nodeRes) => {
         const socket = nodeReq.socket;
-        let responses = activeResponses.get(socket);
-        if (responses === undefined) {
-            responses = new Set();
-            activeResponses.set(socket, responses);
-        }
-        responses.add(nodeRes);
-        const releaseResponse = () => {
-            const current = activeResponses.get(socket);
-            if (current === undefined)
-                return;
-            current.delete(nodeRes);
-            if (current.size === 0)
-                activeResponses.delete(socket);
-        };
-        nodeRes.once("finish", releaseResponse);
-        nodeRes.once("close", releaseResponse);
+        let responseState = socket[ACTIVE_SOCKET_STATE];
+        if (responseState === undefined) {
+            responseState = { socket, active: 0, parserError: false };
+            socket[ACTIVE_SOCKET_STATE] = responseState;
+            socket.once("close", clearActiveResponseState);
+        }
+        responseState.active += 1;
+        nodeRes[ACTIVE_RESPONSE_STATE] = responseState;
+        nodeRes[ACTIVE_RESPONSE_RELEASED] = false;
+        nodeRes.once("finish", releaseActiveResponse);
+        nodeRes.once("close", releaseActiveResponse);
         inFlight += 1;
         try {
             const handled = handle(app, nodeReq, nodeRes, protocol, staticState, hostPolicy);
@@ -739,27 +885,22 @@ export function serve(app, options) {
             failWrite(nodeRes);
             inFlight -= 1;
         }
-    });
+    };
+    const resolveWs = app.resolveWebSocketUpgrade?.bind(app);
+    // Only a WebSocket handshake leaves the HTTP parser; any other `Upgrade` (curl's h2c offer) is an
+    // ordinary request. Node versions without the option send every upgrade to the `upgrade` event.
+    const upgradeOptions = resolveWs === undefined ? {} : { shouldUpgradeCallback: isWebSocketUpgrade };
+    const server = options.tls === undefined
+        ? createServer(upgradeOptions, onRequest)
+        : createHttpsServer({ ...options.tls, ...upgradeOptions }, onRequest);
     server.on("clientError", (_error, socket) => {
         if (socket.destroyed)
             return;
-        const responses = activeResponses.get(socket);
-        if (responses !== undefined && responses.size > 0) {
-            if (parserErrorSockets.has(socket))
+        const responseState = socket[ACTIVE_SOCKET_STATE];
+        if (responseState !== undefined && responseState.active > 0) {
+            if (responseState.parserError)
                 return;
-            parserErrorSockets.add(socket);
-            const closeWhenDrained = () => {
-                const current = activeResponses.get(socket);
-                if (current === undefined || current.size === 0)
-                    socket.destroy();
-            };
-            for (const response of responses) {
-                if (response.writableEnded || response.destroyed)
-                    closeWhenDrained();
-                else
-                    response.once("finish", closeWhenDrained);
-                response.once("close", closeWhenDrained);
-            }
+            responseState.parserError = true;
             return;
         }
         const body = "Bad Request";
@@ -768,11 +909,10 @@ export function serve(app, options) {
     // WebSocket upgrades (a nifra app exposing the seam): handled on the http server's `upgrade` event via
     // the optional `ws` package - lazy-imported (and the server lazily built) on the FIRST real WS
     // upgrade, so a non-WS Node app never loads `ws`.
-    const resolveWs = app.resolveWebSocketUpgrade?.bind(app);
     if (resolveWs !== undefined) {
         let wssPromise;
         server.on("upgrade", (nodeReq, socket, head) => {
-            void handleUpgrade(resolveWs, protocol, hostPolicy, nodeReq, socket, head, (maxPayloadBytes) => {
+            void handleUpgrade(app, answering, resolveWs, protocol, hostPolicy, nodeReq, socket, head, (maxPayloadBytes) => {
                 wssPromise ??= loadWsServer(maxPayloadBytes);
                 return wssPromise;
             });
@@ -794,10 +934,12 @@ export function serve(app, options) {
         }
         server.close(); // stop accepting new connections; existing requests continue
         const deadline = Date.now() + drainMs;
-        while (inFlight > 0 && Date.now() < deadline) {
+        while ((inFlight > 0 || answering.size > 0) && Date.now() < deadline) {
             await new Promise((r) => setTimeout(r, DRAIN_POLL_MS));
         }
         server.closeAllConnections(); // force-close stragglers + idle keep-alive sockets
+        for (const socket of answering)
+            socket.destroy();
     }
     return new Promise((resolve) => {
         // Do not pass an explicit `undefined` hostname. Node accepts it, but Bun's Node-compatible
@@ -835,7 +977,7 @@ function runNodeSource(app, source, nodeReq, nodeRes, protocol, host, platform)
             return;
         }
     }
-    const request = toWebRequest(nodeReq, protocol, host);
+    const request = toWebRequest(nodeReq, protocol, host, nodeRes);
     const resolveNode = app.resolveNode;
     if (typeof resolveNode === "function") {
         try {
@@ -861,7 +1003,33 @@ function runNodeSource(app, source, nodeReq, nodeRes, protocol, host, platform)
         return;
     }
 }
+/**
+ * Resolve the target's `.` / `..` segments and backslashes in place, before anything reads it. Node
+ * keeps the target as the client sent it, where Bun and workerd deliver it parsed; resolving it here
+ * routes `/users/../admin` to `/admin` on every runtime, and every later reader - static files,
+ * mounts, the app, `c.req.url` - sees the one path.
+ */
+const ABSOLUTE_FORM = /^[a-z][a-z\d+.-]*:\/\//i;
+function resolveTarget(nodeReq) {
+    let target = nodeReq.url;
+    if (target === undefined)
+        return;
+    // Absolute-form (`GET http://host/path`, RFC 9112 section 3.2.2) is routed as its origin-form path
+    // with the Host header, as Bun does. Kept whole, hooks saw `http://hosthttp://...` while the
+    // router matched the full URL against a `/*` route.
+    if (target.charCodeAt(0) !== 47 && ABSOLUTE_FORM.test(target)) {
+        let end = target.indexOf("//") + 2;
+        while (end < target.length && target[end] !== "/" && target[end] !== "?")
+            end++;
+        const rest = target.slice(end);
+        target = rest.charCodeAt(0) === 47 ? rest : `/${rest}`;
+        nodeReq.url = target;
+    }
+    if (hasDotSegment(target))
+        nodeReq.url = resolveDotSegments(target);
+}
 function handle(app, nodeReq, nodeRes, getProtocol, staticState, hostPolicy) {
+    resolveTarget(nodeReq);
     const host = requestHost(nodeReq, hostPolicy);
     if (host === undefined) {
         writeBadRequest(nodeRes);
@@ -895,7 +1063,7 @@ function handle(app, nodeReq, nodeRes, getProtocol, staticState, hostPolicy) {
         if (matched !== "pass") {
             if ("reject" in matched)
                 return writeResponseSafely(matched.reject, nodeRes, nodeReq.method);
-            return readStatic(matched.file, staticState, nodeReq.method ?? "GET").then((outcome) => writeOutcomeSafely(outcome, nodeRes, nodeReq.method), () => failWrite(nodeRes));
+            return readStatic(matched.file, staticState, nodeReq.method ?? "GET", nodeReq.headers).then((outcome) => writeOutcomeSafely(outcome, nodeRes, nodeReq.method), () => failWrite(nodeRes));
         }
     }
     // A mounted handler may advertise a native Node lane. Core has already checked route precedence
@@ -905,7 +1073,7 @@ function handle(app, nodeReq, nodeRes, getProtocol, staticState, hostPolicy) {
     const resolveNodeSource = app.resolveNodeSource;
     const resolveNodeMount = app[RESOLVE_NODE_MOUNT];
     if (typeof resolveNodeSource === "function" || typeof resolveNodeMount === "function") {
-        const nodeSource = toNodeRequestSource(nodeReq, protocol, host);
+        const nodeSource = toNodeRequestSource(nodeReq, protocol, host, nodeRes);
         if (typeof resolveNodeMount === "function") {
             let selection;
             try {
@@ -942,7 +1110,7 @@ function handle(app, nodeReq, nodeRes, getProtocol, staticState, hostPolicy) {
         }
         return runNodeSource(app, nodeSource, nodeReq, nodeRes, protocol, host, platform);
     }
-    const request = toWebRequest(nodeReq, protocol, host);
+    const request = toWebRequest(nodeReq, protocol, host, nodeRes);
     const resolveNode = app.resolveNode;
     if (typeof resolveNode === "function") {
         try {
@@ -1053,6 +1221,60 @@ function allHeaderKeysLowercase(record) {
     }
     return true;
 }
+/**
+ * Store one wire header on a literal record. A literal `__proto__` name must not go through plain
+ * assignment - the inherited setter would silently swallow it - so it is defined as an own data
+ * property instead; every other name takes the fast plain store. Same guard core's portable header
+ * view makes over the same record, so a hook-set `__proto__` header round-trips to the wire
+ * exactly as it did through the old normalization copy.
+ */
+function storeWireHeader(headers, name, value) {
+    if (name === "__proto__") {
+        Object.defineProperty(headers, name, {
+            value,
+            writable: true,
+            enumerable: true,
+            configurable: true,
+        });
+        return;
+    }
+    headers[name] = value;
+}
+/** True when an existing header slot can be replaced without throwing or invoking an accessor. */
+function canReplaceHeaderSlot(record, name) {
+    const descriptor = Object.getOwnPropertyDescriptor(record, name);
+    return descriptor === undefined || ("writable" in descriptor && descriptor.writable === true);
+}
+/**
+ * A proven lowercase record can stay on the Node hot path when the writer only has to append its
+ * own framing headers. Non-default framing names and explicit lengths take the copy path: the old
+ * writer moved those names to the end of the record, and retaining that order keeps raw HTTP/1.1
+ * snapshots stable. Core's default JSON type is the one exception - it appends that value before
+ * this writer runs, so recognizing it lets the common hooked route retain the record and append
+ * length in place. An application that explicitly supplies the same default value is indistinguishable
+ * here and follows that same semantics-preserving fast path.
+ */
+function canWriteJsonHeadersInPlace(source, cookies) {
+    try {
+        if (!Object.isExtensible(source))
+            return false;
+        if (Object.hasOwn(source, "content-length"))
+            return false;
+        if (Object.hasOwn(source, "content-type") && source["content-type"] !== JSON_CONTENT_TYPE) {
+            return false;
+        }
+        if (cookies !== undefined &&
+            cookies.length > 0 &&
+            !canReplaceHeaderSlot(source, "set-cookie")) {
+            return false;
+        }
+        return true;
+    }
+    catch {
+        // A proxy or a hostile descriptor should use the same isolated fallback as mixed-case input.
+        return false;
+    }
+}
 /**
  * Serialize a node-direct JSON outcome straight to the socket - no undici `Response`, no stream drain.
  * Mirrors `Response.json(data, { status, headers })` byte-for-byte: user headers are lowercased to
@@ -1062,31 +1284,34 @@ function allHeaderKeysLowercase(record) {
 function writeJsonOutcome(outcome, nodeRes, isHead = false) {
     // The outcome's record is the request's own (`c.set.headers`, already mutated by any native
     // response hooks), and its writers - middleware twins and the framework's own additions - emit
-    // lowercase names. Confirmed either by core's mark (the native response walk already looked at
-    // these keys, so re-walking them here is the same pass twice) or, when the record never went
-    // through that walk, by the scan below. Either way the record is then used as-is and the additions
-    // below mutate it in place; nothing reads it after the write. Only a mixed-case key (a user's
-    // hand-set `X-Foo`) pays the normalization copy, keeping the wire byte-identical to undici's
-    // `Headers` lowercasing on every other runtime.
-    let headers;
+    // lowercase names. Whether a name needs folding is answered either by core's mark (the native
+    // response walk already looked at these keys, so re-walking them here is the same pass twice)
+    // or, when the record never went through that walk, by the scan below.
+    //
+    // A proven lowercase, extensible record is owned by this request. Keep it in place and append
+    // lowercase framing names directly; the old uppercase rename paid two deletes and demoted the
+    // record to dictionary mode. Mixed-case, frozen, and explicitly framed records take an isolated
+    // copy below, preserving the old source order and protecting caller-owned objects.
     const source = outcome.headers;
-    if (source === undefined) {
-        // A route that set no headers gets a record the FRAMEWORK alone fills - content-type,
-        // content-length, set-cookie - so no attacker-influenced name can reach it and the
-        // null-prototype guard the normalization branch needs buys nothing here. It does cost: a
-        // null-prototype object never enters V8's fast property mode, and Node's `_storeHeader` walks
-        // this record key by key on every response (measured at over twice fastify's share of the same
-        // frame on a bare route). A literal keeps it in fast mode.
-        headers = {};
-    }
-    else if (source[LOWERCASE_HEADER_KEYS] === true ||
-        allHeaderKeysLowercase(source)) {
-        headers = source;
-    }
-    else {
-        headers = Object.create(null);
-        for (const [key, value] of Object.entries(source)) {
-            headers[key.toLowerCase()] = value;
+    const lowercase = source === undefined ||
+        source[LOWERCASE_HEADER_KEYS] === true ||
+        allHeaderKeysLowercase(source);
+    const inPlace = source === undefined || (lowercase && canWriteJsonHeadersInPlace(source, outcome.cookies));
+    const headers = inPlace && source !== undefined ? source : {};
+    let contentType;
+    let hasLength = false;
+    if (!inPlace && source !== undefined) {
+        for (const key of Object.keys(source)) {
+            const lower = lowercase ? key : key.toLowerCase();
+            if (lower === "content-type") {
+                contentType = source[key];
+                continue;
+            }
+            if (lower === "content-length") {
+                hasLength = true;
+                continue;
+            }
+            storeWireHeader(headers, lower, source[key]);
         }
     }
     // A `null` body is a 204/no-content render - `new Response(null)` carries no Content-Type, so we add
@@ -1095,28 +1320,27 @@ function writeJsonOutcome(outcome, nodeRes, isHead = false) {
     // without it Node falls back to chunked framing, which costs extra wire bytes and client parsing
     // on every response (and no other runtime chunks a buffered JSON body).
     if (outcome.body !== null) {
-        if (headers["content-type"] === undefined)
-            headers["Content-Type"] = JSON_CONTENT_TYPE;
+        if (inPlace) {
+            if (!Object.hasOwn(headers, "content-type"))
+                headers["content-type"] = JSON_CONTENT_TYPE;
+            headers["content-length"] = String(Buffer.byteLength(outcome.body));
+        }
         else {
-            headers["Content-Type"] = headers["content-type"];
-            delete headers["content-type"];
+            storeWireHeader(headers, "content-type", contentType ?? JSON_CONTENT_TYPE);
+            storeWireHeader(headers, "content-length", String(Buffer.byteLength(outcome.body)));
         }
-        headers["Content-Length"] = String(Buffer.byteLength(outcome.body));
-        delete headers["content-length"];
     }
     else if (isBodylessStatus(outcome.status)) {
-        // 204/205/304 never carry a payload; discard a user/native-hook length even when the body is
-        // already represented as null so the direct writer cannot advertise bytes that will not ship.
-        delete headers["content-length"];
-        delete headers["Content-Length"];
+        // 204/205/304 never carry a payload; a user/native-hook length is dropped rather than copied,
+        // so the direct writer cannot advertise bytes that will not ship.
     }
-    else if (!isHead && headers["content-length"] === undefined) {
+    else if (!isHead && !hasLength) {
         // A body-less render at a status that MAY carry a body - a `redirect()`, above all. Node frames
         // a `writeHead` + bare `end()` as chunked, so the shortest response the framework emits went out
         // with a chunk terminator and no length, where every Web-native runtime sends `content-length: 0`.
         // Declared here so the wire matches them. HEAD is excluded: its length describes the GET's body,
         // which this lane does not know.
-        headers["Content-Length"] = "0";
+        headers["content-length"] = "0";
     }
     if (outcome.cookies !== undefined && outcome.cookies.length > 0) {
         headers["set-cookie"] = [...outcome.cookies];
@@ -1184,16 +1408,16 @@ function normalizeProtocol(value) {
         return value;
     throw new Error(`@nifrajs/node: protocol must be "http" or "https" (got ${JSON.stringify(value)})`);
 }
-function toWebRequest(req, protocol, host) {
+function toWebRequest(req, protocol, host, res) {
     const url = `${protocol}://${host}${req.url ?? "/"}`;
     const method = req.method ?? "GET";
-    return makeWebRequest(req, method, url, headerRecordFromNode(req.headers));
+    return makeWebRequest(req, method, url, headerRecordFromNode(req.headers), undefined, res);
 }
-function toNodeRequestSource(req, protocol, host) {
+function toNodeRequestSource(req, protocol, host, res) {
     const method = req.method ?? "GET";
     return method === "GET" || method === "HEAD"
-        ? new LeanNodeGetSource(req, method, protocol, host)
-        : new LazyNodeRequestSource(req, method, protocol, host);
+        ? new LeanNodeGetSource(req, method, protocol, host, res)
+        : new LazyNodeRequestSource(req, method, protocol, host, res);
 }
 function stripNodeMountPrefix(url, prefix) {
     if (prefix === "/")
@@ -1269,11 +1493,13 @@ class LazyNodeRequestSource {
     nodeReq;
     protocol;
     host;
-    constructor(nodeReq, method, protocol, host) {
+    nodeRes;
+    constructor(nodeReq, method, protocol, host, nodeRes) {
         this.nodeReq = nodeReq;
         this.method = method;
         this.protocol = protocol;
         this.host = host;
+        this.nodeRes = nodeRes;
     }
     /** The absolute URL, built only when something reads it - routing uses `urlParts` instead. */
     get url() {
@@ -1353,12 +1579,24 @@ class LazyNodeRequestSource {
     rawBodyBytes() {
         if (this.consumedBody !== undefined)
             return Promise.resolve(this.consumedBody);
-        const handed = this.bodyValue;
+        const handed = this.handedBody();
         if (handed != null) {
             return new Response(handed).arrayBuffer().then((buffer) => new Uint8Array(buffer));
         }
         return this.readNodeBody();
     }
+    /**
+     * The stream the Web `Request` was built on, or - once a hook's `req.clone()` teed it (which locks
+     * the original) - the branch that request kept. Reading the locked original threw, so a middleware
+     * that peeked at the body through a clone turned every downstream body read into a 500.
+     */
+    handedBody() {
+        const handed = this.bodyValue;
+        if (handed == null || !handed.locked)
+            return handed ?? undefined;
+        const owner = this.requestValue;
+        return owner?._real?.body ?? handed;
+    }
     /**
      * The raw body stream, never routed back through `this.request` - post-cap that getter is the
      * shadowed one, which reads back through these very readers. An already-consumed body replays
@@ -1371,18 +1609,18 @@ class LazyNodeRequestSource {
         if (consumed !== undefined)
             return streamOfBytes(consumed);
         this.bodyValue ??= claimableWebStream(this.nodeReq, "drain");
-        return this.bodyValue;
+        return this.handedBody() ?? this.bodyValue;
     }
     get request() {
         this.requestValue ??= new LazyWebRequest(this.method, this.url, () => this.headersValue ?? headerRecordFromNode(this.nodeReq.headers), (headers) => {
             if (this.consumedBody !== undefined) {
-                const real = makeWebRequest(this.nodeReq, this.method, this.url, headers, this.consumedBody);
+                const real = makeWebRequest(this.nodeReq, this.method, this.url, headers, this.consumedBody, this.nodeRes);
                 // Preserve one-shot body semantics if user code asks for `c.req` after nifra already
                 // consumed it.
                 void real.arrayBuffer().catch(() => { });
                 return real;
             }
-            return makeWebRequest(this.nodeReq, this.method, this.url, headers, this.body);
+            return makeWebRequest(this.nodeReq, this.method, this.url, headers, this.body, this.nodeRes);
         });
         return this.requestValue;
     }
@@ -1452,11 +1690,13 @@ class LeanNodeGetSource {
     nodeReq;
     protocol;
     host;
-    constructor(nodeReq, method, protocol, host) {
+    nodeRes;
+    constructor(nodeReq, method, protocol, host, nodeRes) {
         this.nodeReq = nodeReq;
         this.method = method;
         this.protocol = protocol;
         this.host = host;
+        this.nodeRes = nodeRes;
     }
     /** The absolute URL, built only when something reads it - routing uses `urlParts` instead. */
     get url() {
@@ -1486,7 +1726,7 @@ class LeanNodeGetSource {
         return Promise.reject(new SyntaxError("Unexpected end of JSON input"));
     }
     get request() {
-        this.requestValue ??= new LazyWebRequest(this.method, this.url, () => this.headersValue ?? headerRecordFromNode(this.nodeReq.headers), (headers) => makeWebRequest(this.nodeReq, this.method, this.url, headers, null));
+        this.requestValue ??= new LazyWebRequest(this.method, this.url, () => this.headersValue ?? headerRecordFromNode(this.nodeReq.headers), (headers) => makeWebRequest(this.nodeReq, this.method, this.url, headers, null, this.nodeRes));
         return this.requestValue;
     }
 }
@@ -1509,11 +1749,25 @@ function headerRecordFromNode(input) {
     }
     return record;
 }
-function makeWebRequest(req, method, url, headers, body) {
+function makeWebRequest(req, method, url, headers, body, res) {
     const init = { method, headers };
+    if (res !== undefined) {
+        // `signal` aborts when the client goes away before the response finished, as on Bun and Deno.
+        const disconnect = new AbortController();
+        init.signal = disconnect.signal;
+        const onClose = () => {
+            if (!res.writableFinished)
+                disconnect.abort();
+        };
+        if (res.closed)
+            onClose();
+        else
+            res.once("close", onClose);
+    }
     if (method !== "GET" && method !== "HEAD") {
         // Stream the body in; `duplex: "half"` is required for a streamed request body.
-        init.body = body ?? claimableWebStream(req, "drain");
+        init.body =
+            body instanceof Uint8Array ? body.slice() : (body ?? claimableWebStream(req, "drain"));
         init.duplex = "half";
     }
     return new Request(url, init);
@@ -1653,6 +1907,9 @@ function writeNodeResponse(response, nodeRes, method) {
     if (isHead) {
         nodeRes.writeHead(response.status);
         nodeRes.end();
+        // Nothing reads a HEAD answer's body. Cancelled, its source learns the exchange is over, as on
+        // Bun and Deno; left alone, a streaming route's producer runs on with no reader.
+        response.body?.cancel().catch(() => { });
         return;
     }
     const directBody = nodeResponseBody(response);
@@ -1749,6 +2006,22 @@ function pipeNodeResponseBody(body, nodeRes) {
  */
 async function writeNodeResponseBody(response, nodeRes, canDeclareLength) {
     const reader = response.body.getReader();
+    // A client that leaves while the stream is idle never fails a write. Its departure cancels the
+    // stream, as on Bun and Deno, so a producer waiting to send learns the exchange is over.
+    const onClose = () => {
+        reader.cancel().catch(() => { });
+    };
+    nodeRes.once("close", onClose);
+    if (nodeRes.destroyed)
+        onClose();
+    try {
+        await writeNodeResponseChunks(reader, response, nodeRes, canDeclareLength);
+    }
+    finally {
+        nodeRes.removeListener("close", onClose);
+    }
+}
+async function writeNodeResponseChunks(reader, response, nodeRes, canDeclareLength) {
     let first;
     try {
         first = await reader.read();
@@ -1871,8 +2144,13 @@ const WS_STATUS_TEXT = {
 };
 /** Resolve a Node `upgrade` event: run the nifra upgrade guard, then either reject (write an HTTP error
  * to the raw socket) or perform the `ws` upgrade and wire the socket to the handler. */
-async function handleUpgrade(resolveWs, getProtocol, hostPolicy, nodeReq, socket, head, getWss) {
+async function handleUpgrade(app, answering, resolveWs, getProtocol, hostPolicy, nodeReq, socket, head, getWss) {
+    // A peer can reset the socket while the guard is awaited; with no listener that error ends the process.
+    socket.on("error", ignoreSocketError);
+    resolveTarget(nodeReq);
     let outcome;
+    let request;
+    let platform;
     try {
         const host = requestHost(nodeReq, hostPolicy);
         if (host === undefined) {
@@ -1880,15 +2158,38 @@ async function handleUpgrade(resolveWs, getProtocol, hostPolicy, nodeReq, socket
             return;
         }
         const peerAddress = nodeReq.socket.remoteAddress;
-        const platform = peerAddress === undefined ? undefined : { clientIp: peerAddress };
-        outcome = await resolveWs(toWebRequest(nodeReq, getProtocol(nodeReq), host), platform);
+        platform = peerAddress === undefined ? undefined : { clientIp: peerAddress };
+        // Its signal follows the socket, so a route answered below stops when the client leaves.
+        request = toWebRequest(nodeReq, getProtocol(nodeReq), host, socket);
+        outcome = await resolveWs(request, platform);
     }
     catch {
         writeUpgradeRejection(socket, 500, "internal_error");
         return;
     }
     if (outcome.kind === "pass") {
-        writeUpgradeRejection(socket, 404, "not_found"); // upgrade to a path with no WS route
+        // No WS route here: the HTTP route answers, as on Bun. Only a bodiless request can be served from
+        // an upgrade socket - Node parses no body for one, so a POST here (Node without
+        // `shouldUpgradeCallback`) keeps the 404.
+        if (nodeReq.method !== "GET" && nodeReq.method !== "HEAD") {
+            writeUpgradeRejection(socket, 404, "not_found");
+            return;
+        }
+        let response;
+        try {
+            response = await app.fetch(request, platform);
+        }
+        catch {
+            writeUpgradeRejection(socket, 500, "internal_error");
+            return;
+        }
+        answering.add(socket);
+        socket.once("close", () => answering.delete(socket));
+        // Detached from Node's HTTP handling, the socket comes paused and nothing ends it on the client's
+        // FIN. Reading it and ending on `end`, as Node's server does, lets a departure reach the signal.
+        socket.once("end", () => socket.end());
+        socket.resume();
+        await writeSocketResponse(socket, response, nodeReq.method);
         return;
     }
     if (outcome.kind === "reject") {
@@ -1953,6 +2254,11 @@ function attachNodeWebSocket(ws, handler, data, pubsub) {
     ws.on("error", (error) => reportError(error));
     safe(() => handler.open?.(nifra)); // open: the socket is already established here
 }
+function ignoreSocketError() { }
+function isWebSocketUpgrade(nodeReq) {
+    // A handshake is a GET (RFC 6455 section 4.1); any other method is an ordinary request with a body.
+    return nodeReq.method === "GET" && /\bwebsocket\b/i.test(nodeReq.headers.upgrade ?? "");
+}
 /** Write a minimal JSON error response to a raw upgrade socket, then close it. */
 function writeUpgradeRejection(socket, status, error) {
     const body = JSON.stringify({ ok: false, error });
@@ -1974,4 +2280,37 @@ async function writeRejectionResponse(socket, response) {
     socket.write(head + body);
     socket.destroy();
 }
+/** Answer an upgrade socket with an ordinary response: the body streams as produced, paced by the
+ * socket's backpressure and delimited by the close (RFC 9112 section 6.3), never buffered whole. */
+async function writeSocketResponse(socket, response, method) {
+    let head = `HTTP/1.1 ${response.status} ${response.statusText || STATUS_CODES[response.status] || "Unknown"}\r\n`;
+    response.headers.forEach((value, key) => {
+        if (key !== "connection" && key !== "keep-alive" && key !== "transfer-encoding") {
+            head += `${key}: ${value}\r\n`;
+        }
+    });
+    socket.write(`${head}Connection: close\r\n\r\n`);
+    if (response.body === null || method === "HEAD") {
+        await response.body?.cancel().catch(() => { });
+        socket.end();
+        return;
+    }
+    const reader = response.body.getReader();
+    try {
+        for (;;) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            if (!socket.write(chunk.value) && !(await waitForDrain(socket))) {
+                await reader.cancel();
+                return;
+            }
+        }
+        socket.end();
+    }
+    catch {
+        socket.destroy();
+        await reader.cancel().catch(() => { });
+    }
+}
 //# sourceMappingURL=index.js.map