@pulse-compute/provider-node 1.0.0-beta.4 → 1.0.0-beta.6

package/README.md

@@ -2,20 +2,22 @@
 
 <!-- pulse-package-status:start -->
 > **Support tier:** Implementation/transitive surface<br>
-> **Audience:** Pulse canonical Node provider and compiler maintainers.<br>
-> **Install directly:** No for application projects; select provider: node through the CLI.<br>
-> **Supported entry points:** `@pulse-compute/provider-node/toolchain`<br>
-> **Stability:** The listed built-in toolchain entry is synchronized with the Beta bootstrap contract; other canonical Node provider interfaces remain internal.<br>
+> **Audience:** Node deployment integrators and Pulse provider maintainers.<br>
+> **Install directly:** Yes for the production Node launcher; application handlers remain provider-neutral.<br>
+> **Supported entry points:** `@pulse-compute/provider-node/toolchain`, `@pulse-compute/provider-node/server`<br>
+> **Stability:** The /server export is an explicit supported-entry-point exception within this implementation package: finite production HTTP for explicit Node Native and JavaScript builds. Forwarding, generated output, transforms, S3-body bindings and blob-specific production qualification remain separate. /toolchain serves the CLI; all other provider subpaths remain internal.<br>
 > **npm:** [`@pulse-compute/provider-node`](https://www.npmjs.com/package/@pulse-compute/provider-node)<br>
-> **Canonical replacement:** `provider: 'node' through @pulse-compute/cli`<br>
-> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.4/packages/implementation-packages/)
+> **Canonical documentation:** [Package guide](https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/)
 >
-> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.4` package policy.
+> This release-status block is generated from the synchronized `Pulse 1.0.0-beta.6` package policy.
 <!-- pulse-package-status:end -->
 
 Canonical Node provider implementation used internally when a project selects `provider: 'node'`.
 
-Application projects do not install or import this package directly. The supported entry is provider selection through `@pulse-compute/cli`.
+Deployment integrators install this package and import `@pulse-compute/provider-node/server`
+to launch a trusted `pulse build` directory. Application handlers remain provider-neutral.
+See [Node build and execution](https://pulsecompute.io/v1.0.0-beta.6/guides/deploying-node/)
+for configuration, readiness, drain, signals and restart.
 
 ## Responsibilities
 
@@ -60,4 +62,4 @@ The package exposes focused compiler and runtime modules for the synchronized
 repository, including `runtime/canonical-api-runtime`. Those exports are
 implementation interfaces, not application-author APIs.
 
-See [Contracts and providers](https://pulsecompute.io/v1.0.0-beta.4/concepts/contracts-and-providers/) and [Implementation packages](https://pulsecompute.io/v1.0.0-beta.4/packages/implementation-packages/).
+See [Contracts and providers](https://pulsecompute.io/v1.0.0-beta.6/concepts/contracts-and-providers/) and [Implementation packages](https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pulse-compute/provider-node",
-  "version": "1.0.0-beta.4",
+  "version": "1.0.0-beta.6",
   "license": "Apache-2.0",
   "engines": {
     "node": "^22.14.0 || ^24.0.0"
@@ -39,16 +39,20 @@
     "./javascript/package-effects": "./src/javascript/package-effects.js",
     "./javascript/jwt-verifier": "./src/javascript/jwt-verifier.js",
     "./javascript/grip-broadcast": "./src/javascript/grip-broadcast.js",
-    "./javascript/source-package": "./src/javascript/source-package.js"
+    "./javascript/source-package": "./src/javascript/source-package.js",
+    "./server": {
+      "types": "./src/server/index.d.ts",
+      "default": "./src/server/index.js"
+    }
   },
   "dependencies": {
-    "@pulse-compute/crypto": "1.0.0-beta.4",
-    "@pulse-compute/jwt": "1.0.0-beta.4",
-    "@pulse-compute/runtime": "1.0.0-beta.4",
-    "@pulse-compute/s3": "1.0.0-beta.4",
-    "@pulse-compute/wasm-build-support": "1.0.0-beta.4",
-    "@pulse-compute/wasm-contracts": "1.0.0-beta.4",
-    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.4"
+    "@pulse-compute/crypto": "1.0.0-beta.6",
+    "@pulse-compute/jwt": "1.0.0-beta.6",
+    "@pulse-compute/runtime": "1.0.0-beta.6",
+    "@pulse-compute/s3": "1.0.0-beta.6",
+    "@pulse-compute/wasm-build-support": "1.0.0-beta.6",
+    "@pulse-compute/wasm-contracts": "1.0.0-beta.6",
+    "@pulse-compute/wasm-host-runtime": "1.0.0-beta.6"
   },
   "publishConfig": {
     "access": "public"
@@ -64,7 +68,7 @@
     "url": "git+https://github.com/pulse-compute/pulse.git",
     "directory": "packages/provider-node"
   },
-  "homepage": "https://pulsecompute.io/v1.0.0-beta.4/packages/implementation-packages/",
+  "homepage": "https://pulsecompute.io/v1.0.0-beta.6/packages/implementation-packages/",
   "bugs": {
     "url": "https://github.com/pulse-compute/pulse/issues"
   }

package/src/capabilities.js

@@ -3,12 +3,17 @@
 const NODE_JWT_VERIFY_CAPABILITY = 'jwt.verify';
 
 const NODE_CANONICAL_PROVIDER_CAPABILITIES = Object.freeze([
-  's3.head', 's3.getText', 's3.putText',
+  's3.head', 's3.getText', 's3.putText', 's3.getBody',
   'request',
+  'request.body.forward',
+  'response.output',
+  'request.body.transform',
   'response.json',
   'response.text',
   'response.custom',
   'fetch',
+  'time.wall-clock',
+  'crypto.digestText',
   'config.get',
   'secret.get',
   'kv.get',
@@ -19,15 +24,21 @@ const NODE_CANONICAL_PROVIDER_CAPABILITIES = Object.freeze([
   'assets.lookup',
   'grip.broadcast',
   NODE_JWT_VERIFY_CAPABILITY,
+  'jwt.sign',
   'opaque.pass-through'
 ]);
 
 const NODE_CANONICAL_PROVIDER_LOWERING = Object.freeze({
   request: 'node.http.request',
+  'request.body.forward': 'node.http.incoming-request-v1',
   'response.json': 'node.http.response.json',
   'response.text': 'node.http.response.text',
   'response.custom': 'node.http.response.custom',
+  'request.body.transform': 'node.http.bounded-text-transform-v1',
+  'response.output': 'node.http.generated-output-v1',
   fetch: 'node.fetch.dispatch',
+  'time.wall-clock': 'node.runtime.time.now',
+  'crypto.digestText': 'node.crypto.digest-text',
   'config.get': 'node.runtime.config.get',
   'secret.get': 'node.runtime.secret.get',
   'kv.get': 'node.runtime.kv.get',
@@ -40,21 +51,26 @@ const NODE_CANONICAL_PROVIDER_LOWERING = Object.freeze({
   's3.head': 'node.native.s3.head',
   's3.getText': 'node.native.s3.getText',
   's3.putText': 'node.native.s3.putText',
+  's3.getBody': 'node.s3.opaque-body',
   'assets.lookup': 'node.runtime.assets.lookup',
   'grip.broadcast': 'node.http.grip.publish',
   [NODE_JWT_VERIFY_CAPABILITY]: 'node.native.jwt.verify',
+  'jwt.sign': 'node.native.jwt.sign',
   'opaque.pass-through': 'node.http.response.stream'
 });
 
 const NODE_NATIVE_TARGET_CAPABILITIES = Object.freeze([
-  's3.head', 's3.getText', 's3.putText',
+  's3.head', 's3.getText', 's3.putText', 's3.getBody',
   NODE_JWT_VERIFY_CAPABILITY,
+  'jwt.sign',
   'jwt.verify.hs256',
   'jwt.verify.es256',
+  'jwt.verify.rs256',
   'secret.get',
   'event.ingress',
   'event.emit',
-  'time.wall-clock'
+  'time.wall-clock',
+  'crypto.digestText'
 ]);
 
 module.exports = Object.freeze({

package/src/config/s3.js

@@ -13,7 +13,7 @@ function normalizeNodeS3(input = {}) {
 }
 function validateNodeS3Operations(metadata, bindings) {
   for (const effect of metadata.providerOperations || []) {
-    if (!['s3.head', 's3.getText', 's3.putText'].includes(effect.kind)) continue;
+    if (!['s3.head', 's3.getText', 's3.putText', 's3.getBody'].includes(effect.kind)) continue;
     if (!bindings.s3 || !Object.hasOwn(bindings.s3, effect.resource && effect.resource.binding)) throw new TypeError('The required Node S3 binding is missing.');
   }
 }

package/src/javascript/fetch-adapter.js

@@ -22,6 +22,9 @@ function createNodeJavascriptFetchCapability(options = {}) {
     }
 
     try {
+      if (init.body && typeof init.body === 'object') {
+        return await runtimeHost.forwardIncomingBody(init.body, String(url), init, execution);
+      }
       const response = await implementation(String(url), {
         method: init.method,
         headers: init.headers,
@@ -29,6 +32,10 @@ function createNodeJavascriptFetchCapability(options = {}) {
         signal: execution.signal,
         redirect: 'follow'
       });
+      if (execution.signal?.aborted) {
+        if (response instanceof Response && response.body) void response.body.cancel(execution.signal.reason).catch(() => {});
+        throw execution.signal.reason;
+      }
       if (!(response instanceof Response) && !runtimeHost.isPulseFetchResponse(response)) {
         throw fetchError(
           'PULSE_FETCH_RESPONSE_INVALID',
@@ -132,6 +139,14 @@ function createNodeJavascriptFixtureFetch(fetches = {}, fallback, options = {})
     }
     await delayWithSignal(fixture.delayMs, init.signal);
 
+    // Incoming forwarding fixture transport consumes the already bounded
+    // provider stream without accumulating bytes or replaying it.
+    if (init.duplex === 'half' && init.body?.getReader) {
+      const reader = init.body.getReader();
+      try { while (!(await reader.read()).done) init.signal?.throwIfAborted(); }
+      finally { reader.releaseLock(); }
+    }
+
     const status = Number(fixture.status || 200);
     let body = null;
     let defaultContentType;
@@ -165,7 +180,7 @@ function createNodeJavascriptFixtureFetch(fetches = {}, fallback, options = {})
       && status !== 304
       && !(status >= 100 && status < 200);
     const response = new Response(bodyAllowed ? body : null, { status, headers });
-    if (options.rawResponse === true) return response;
+    if (options.rawResponse === true || init.duplex === 'half') return response;
     return runtimeHost.createOpaqueFetchResponse({ response, headers: headerPairs });
   };
 }

package/src/javascript/incoming-body.js

@@ -0,0 +1,163 @@
+'use strict';
+
+const host = require('@pulse-compute/runtime/host');
+const CHUNK_BYTES = 16 * 1024;
+const QUEUE_BYTES = 64 * 1024;
+const error = (code, message) => new host.PulseRuntimeContractError(code, message);
+
+function normalizeBodyForwarding(value, maxDurationMs) {
+  if (value === undefined) return undefined;
+  if (!value || typeof value !== 'object' || Object.keys(value).some(key => key !== 'maxBytes')
+    || !Number.isSafeInteger(value.maxBytes) || value.maxBytes <= 0
+    || !Number.isSafeInteger(maxDurationMs) || maxDurationMs < 1 || maxDurationMs > 30000) {
+    throw error('PULSE_REQUEST_FORWARDING_CONFIG_INVALID', 'node.bodyForwarding requires a positive safe integer maxBytes and node.maxDurationMs (1–30000).');
+  }
+  return Object.freeze({ maxBytes: value.maxBytes });
+}
+
+// One retained host chunk, one pending read, no whole-body accumulation. The
+// host chunk contract is checked before retaining it; slices are copied so a
+// small outgoing chunk cannot keep an oversized backing allocation alive.
+function boundedBody(source, maxBytes, signal, observe, onClose) {
+  let reader, controller, pending, failure, offset = 0, ended = false, stopped = false;
+  const metrics = { bytes: 0, maxSourceChunkBytes: 0, maxChunkBytes: 0, maxQueuedBytes: 0 };
+  const release = () => { try { reader?.releaseLock(); } catch (_) {} };
+  function stop(reason) {
+    if (stopped || ended) return;
+    failure ||= reason;
+    stopped = true; pending = undefined;
+    try { Promise.resolve(reader ? reader.cancel(reason) : source?.cancel(reason)).catch(() => {}).finally(release); } catch (_) {}
+    try { reason ? controller.error(reason) : controller.close(); } catch (_) {}
+    signal?.removeEventListener('abort', abort);
+    onClose?.();
+  }
+  const abort = () => stop(signal.reason);
+  const stream = new ReadableStream({
+    start(value) { controller = value; signal?.addEventListener('abort', abort, { once: true }); if (signal?.aborted) abort(); },
+    async pull(value) {
+      if (stopped || ended) return;
+      try {
+        signal?.throwIfAborted();
+        if (!pending) {
+          if (!source) { ended = true; value.close(); signal?.removeEventListener('abort', abort); onClose?.(); return; }
+          reader ||= source.getReader();
+          const next = await reader.read();
+          if (stopped) return;
+          signal?.throwIfAborted();
+          if (next.done) { ended = true; value.close(); release(); signal?.removeEventListener('abort', abort); onClose?.(); return; }
+          if (!(next.value instanceof Uint8Array) || next.value.byteLength > QUEUE_BYTES
+            || next.value.buffer.byteLength > QUEUE_BYTES) {
+            throw error('PULSE_REQUEST_FORWARDING_CHUNK_INVALID', 'Provider body chunks and their backing allocations must not exceed 65536 bytes.');
+          }
+          metrics.bytes += next.value.byteLength;
+          if (metrics.bytes > maxBytes) throw error('PULSE_REQUEST_BODY_TOO_LARGE', 'Forwarded body exceeds the configured transfer limit.');
+          pending = next.value; offset = 0;
+          metrics.maxSourceChunkBytes = Math.max(metrics.maxSourceChunkBytes, pending.byteLength);
+          metrics.maxQueuedBytes = Math.max(metrics.maxQueuedBytes, pending.byteLength);
+        }
+        const count = Math.min(CHUNK_BYTES, pending.byteLength - offset);
+        if (count) {
+          value.enqueue(Uint8Array.from(pending.subarray(offset, offset + count)));
+          metrics.maxChunkBytes = Math.max(metrics.maxChunkBytes, count);
+        }
+        offset += count;
+        if (offset === pending.byteLength) pending = undefined;
+        observe?.(Object.freeze({ ...metrics }));
+      } catch (cause) { stop(cause); }
+    },
+    cancel(reason) { stop(reason); }
+  }, { highWaterMark: 0 });
+  return { stream, stop, metrics, get failure() { return failure; } };
+}
+
+function createIncomingBody(request, options) {
+  if (options.bodyTransform !== undefined) return require('../runtime/body-transform.js').createTransformInput(request, options);
+  const policy = normalizeBodyForwarding(options.bodyForwarding, options.maxDurationMs);
+  if (!policy) return undefined;
+  let upload, timeoutMs, timer, responseSignal, responseTransferred = false;
+  const clearTimer = () => { if (timer !== undefined) clearTimeout(timer); timer = undefined; };
+  function validate() {
+    const length = request.headers.get('content-length');
+    if (length !== null && (!/^\d+$/.test(length) || !Number.isSafeInteger(Number(length)))) {
+      throw error('PULSE_REQUEST_FORWARDING_HEADERS_INVALID', 'Invalid incoming content length.');
+    }
+    if (length !== null && Number(length) > policy.maxBytes) throw error('PULSE_REQUEST_BODY_TOO_LARGE', 'Incoming body exceeds the configured transfer limit.');
+  }
+  validate();
+  return host.createIncomingBodyOwnership({
+    get responseSignal() { return responseSignal; },
+    validate(init) {
+      validate();
+      if (init.method !== 'POST') throw error('PULSE_FETCH_BODY_METHOD_UNSUPPORTED', 'Incoming forwarding requires an outbound POST.');
+      for (const [name] of init.headers) if (/^(host|content-length|transfer-encoding|connection|keep-alive|te|trailer|upgrade|proxy-connection)$/i.test(name)) {
+        throw error('PULSE_REQUEST_FORWARDING_HEADERS_INVALID', 'The provider owns forwarding framing and hop-by-hop headers.');
+      }
+      if (typeof options.fetchImplementation !== 'function') throw error('PULSE_FETCH_IMPLEMENTATION_UNAVAILABLE', 'Incoming forwarding requires provider-owned network transport.');
+      timeoutMs = init.timeoutMs;
+    },
+    async forward(url, init, execution) {
+      // The ordinary fetch effect settles at headers. Keep its shorter budget
+      // through response-body completion for this single-use transfer.
+      const timeout = new AbortController();
+      if (timeoutMs !== undefined) timer = setTimeout(() => timeout.abort(error('PULSE_FETCH_TIMEOUT', 'Incoming forwarding exceeded its fetch timeout.')), Math.min(timeoutMs, options.maxDurationMs));
+      const signal = AbortSignal.any([execution.signal, options.signal, timeout.signal].filter(Boolean));
+      responseSignal = signal;
+      upload = boundedBody(request.body, policy.maxBytes, signal, options.onBodyForwardingObservation);
+      let response;
+      try {
+        response = await options.fetchImplementation(url, {
+          method: 'POST', headers: init.headers, body: upload.stream,
+          signal, duplex: 'half', redirect: 'manual'
+        });
+      } catch (cause) { clearTimer(); throw upload.failure || cause; }
+      finally { upload.stop(); }
+      if (signal.aborted) {
+        clearTimer();
+        try { void response?.body?.cancel(signal.reason).catch(() => {}); } catch (_) {}
+        signal.throwIfAborted();
+      }
+      if (!(response instanceof Response)) throw error('PULSE_FETCH_RESPONSE_INVALID', 'Forwarding transport must return a Web Response.');
+      if (response.status >= 300 && response.status < 400) {
+        try { void response.body?.cancel().catch(() => {}); } catch (_) {}
+        throw error('PULSE_REQUEST_FORWARDING_REDIRECT', 'Single-use incoming bodies cannot be replayed on redirects.');
+      }
+      const responseBody = response.body && boundedBody(response.body, policy.maxBytes, signal, options.onBodyForwardingObservation,
+        () => { if (!options.responseWriterOwnsCompletion) clearTimer(); });
+      responseTransferred = Boolean(responseBody);
+      if (!responseBody && !options.responseWriterOwnsCompletion) clearTimer();
+      // Headers and status remain provider-owned. No incoming request headers
+      // are copied implicitly; the response bytes retain their ordinary form.
+      return new Response(responseBody ? responseBody.stream : null, { status: response.status, statusText: response.statusText, headers: response.headers });
+    },
+    cancel(reason) {
+      if (!responseTransferred || options.responseWriterOwnsCompletion) clearTimer();
+      upload?.stop(reason);
+      if (!upload && request.body && !request.body.locked) void request.body.cancel(reason).catch(() => {});
+      // Response ownership has transferred separately to the HTTP writer.
+    }
+  });
+}
+
+// Adapt IncomingMessage without switching it into flowing mode. Node's own
+// transport buffer is separate from the Pulse queue and stays at most 64 KiB.
+function nodeIncomingStream(request) {
+  if (request.readableHighWaterMark > QUEUE_BYTES) throw error('PULSE_REQUEST_FORWARDING_CHUNK_INVALID', 'Incoming Node transport high-water mark exceeds 65536 bytes.');
+  let stopped = false, wake;
+  const notify = () => { wake?.(); wake = undefined; };
+  for (const event of ['readable', 'end', 'error', 'aborted']) request.on(event, notify);
+  function cleanup() { for (const event of ['readable', 'end', 'error', 'aborted']) request.removeListener(event, notify); }
+  return new ReadableStream({
+    async pull(controller) {
+      while (!stopped) {
+        if (request.errored || request.aborted) { cleanup(); throw request.errored || error('PULSE_NODE_REQUEST_READ_FAILED', 'Incoming request was aborted.'); }
+        const chunk = request.read(Math.min(request.readableLength || CHUNK_BYTES, CHUNK_BYTES));
+        if (chunk) { controller.enqueue(Uint8Array.from(chunk)); return; }
+        if (request.readableEnded) { cleanup(); controller.close(); return; }
+        await new Promise(resolve => { wake = resolve; });
+      }
+    },
+    cancel() { stopped = true; request.pause(); cleanup(); notify(); }
+  }, { highWaterMark: 0 });
+}
+
+module.exports = { normalizeBodyForwarding, boundedBody, createIncomingBody, nodeIncomingStream };

package/src/javascript/jwt-verifier.js

@@ -1,10 +1,12 @@
 'use strict';
 
 const {
+  normalizeJwtSignEffect,
   normalizeJwtVerifyEffect
 } = require('@pulse-compute/wasm-contracts/jwt/contracts');
 const {
   CRYPTO_ES256_RUNTIME_BUILTIN_IMPLEMENTATION,
+  CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION,
   CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION
 } = require('@pulse-compute/wasm-contracts/crypto/contracts');
 
@@ -16,6 +18,7 @@ const NODE_JAVASCRIPT_JWT_REALIZATIONS = Object.freeze({
     implementation: CRYPTO_RUNTIME_BUILTIN_IMPLEMENTATION,
     automaticFallback: false
   }),
+  RS256: Object.freeze({ algorithm: 'RS256', realization: 'runtime-builtin', implementation: CRYPTO_RS256_RUNTIME_BUILTIN_IMPLEMENTATION, automaticFallback: false }),
   ES256: Object.freeze({
     algorithm: 'ES256',
     realization: 'runtime-builtin',
@@ -83,12 +86,19 @@ function createNodeJavascriptJwtVerify(options = {}) {
   return async function verifyNodeJavascriptJwt(effect, execution) {
     const { jwtProvider, cryptoProvider } = await loadRuntimeModules();
     assertRequestActive(execution, jwtProvider);
-    const input = normalizeJwtVerifyEffect(effect);
-    if (execution && typeof execution.registerRedactionValue === 'function') {
+    const signing = effect.operation === 'sign';
+    const input = signing ? normalizeJwtSignEffect(effect) : normalizeJwtVerifyEffect(effect);
+    if (!signing && execution && typeof execution.registerRedactionValue === 'function') {
       execution.registerRedactionValue(input.token);
     }
     assertRequestActive(execution, jwtProvider);
-    const selectedCrypto = assertRuntimeBuiltin(cryptoProvider, jwtProvider);
+    const selectedCrypto = signing
+      ? (input.options.algorithm === 'RS256'
+        ? require('@pulse-compute/crypto/provider').bindJavascriptRs256Signer()
+        : input.options.algorithm === 'ES256'
+        ? require('@pulse-compute/crypto/provider').bindJavascriptEs256Signer()
+        : require('@pulse-compute/crypto/provider').bindJavascriptDigestMac(['HMAC-SHA256']))
+      : assertRuntimeBuiltin(cryptoProvider, jwtProvider);
     const host = {
       async captureWallClock() {
         assertRequestActive(execution, jwtProvider);
@@ -118,7 +128,7 @@ function createNodeJavascriptJwtVerify(options = {}) {
         return result;
       };
     }
-    const result = await jwtProvider.verifyJwtWithCrypto(
+    const result = await (signing ? jwtProvider.signJwtWithCrypto : jwtProvider.verifyJwtWithCrypto)(
       input,
       Object.freeze(host),
       selectedCrypto

package/src/javascript/lifecycle.js

@@ -6,6 +6,7 @@ const { createNodeJavascriptHandler } = require('./node-adapter.js');
 const NODE_JAVASCRIPT_LIFECYCLE_VERSION = 'pulse.node-javascript-lifecycle.v1';
 
 function statusForError(error) {
+  if (['PULSE_REQUEST_DEADLINE_EXCEEDED', 'PULSE_REQUEST_CLOCK_INVALID'].includes(error?.code)) return 504;
   if (error && error.code === 'PULSE_REQUEST_BODY_TOO_LARGE') return 413;
   if (error && error.code === 'PULSE_NODE_REQUEST_READ_FAILED') return 400;
   return 500;
@@ -13,12 +14,13 @@ function statusForError(error) {
 
 function writeSafeError(response, error) {
   if (response.headersSent) {
-    if (!response.writableEnded) response.end();
+    if (!response.writableEnded) response.destroy(error);
     return;
   }
   response.statusCode = statusForError(error);
   response.setHeader('content-type', 'text/plain; charset=utf-8');
-  response.end(response.statusCode === 413 ? 'Payload Too Large' : (response.statusCode === 400 ? 'Bad Request' : 'Internal Server Error'));
+  if (response.statusCode === 504) response.setHeader('connection', 'close');
+  response.end(response.statusCode === 504 ? 'Gateway Timeout' : response.statusCode === 413 ? 'Payload Too Large' : (response.statusCode === 400 ? 'Bad Request' : 'Internal Server Error'));
 }
 
 function createNodeJavascriptServer(application, options = {}) {