@reckona/mreact-router 0.0.203 → 0.0.205

package/src/adapters/aws-lambda.ts

@@ -1,8 +1,9 @@
-import { Buffer } from "node:buffer";
+import { Buffer, isUtf8 } from "node:buffer";
 import { createHash } from "node:crypto";
 import { access, lstat, mkdir, readFile, readlink, symlink } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
+import type { DehydrateOptions } from "@reckona/mreact-query";
 import type { AppRouterServerActionOptions } from "../actions.js";
 import type { AppRouterCache } from "../cache.js";
 import type { AppRouterImportPolicy } from "../import-policy.js";
@@ -25,10 +26,7 @@ import type { RouterInstrumentation } from "../trace.js";
 /** Re-exports cache contracts used by AWS Lambda handlers. */
 export type { AppRouterCache, AppRouterCacheEntry } from "../cache.js";
 /** Re-exports server action contracts used by AWS Lambda handlers. */
-export type {
-  AppRouterAllowedServerAction,
-  AppRouterServerActionOptions,
-} from "../actions.js";
+export type { AppRouterAllowedServerAction, AppRouterServerActionOptions } from "../actions.js";
 /** Re-exports logger contracts used by AWS Lambda handlers. */
 export type {
   AppRouterCspInlineNonceWarningLogEvent,
@@ -41,6 +39,8 @@ export type {
   AppRouterRequestStartLogEvent,
   AppRouterRequestTimingLogEvent,
   AppRouterRuntime,
+  AppRouterUpgradeErrorLogEvent,
+  AppRouterUpgradeRejectedLogEvent,
 } from "../logger.js";
 /** Re-exports response hook contracts used by AWS Lambda handlers. */
 export type { AppRouterResponseHook, AppRouterResponseHookContext } from "../render.js";
@@ -63,18 +63,15 @@ import {
   createBuiltRequestRuntime,
   preloadBuiltAppRuntime,
   resolveRequestHost,
-  warnIfImplicitHostTrust,
   type AppRouterPrerenderStore,
   type RequestHostPolicy,
   type ResponseSinkStrategy,
 } from "../serve.js";
 
+let warnedImplicitAwsLambdaHostPolicy = false;
+
 /** Re-exports request and rendering contracts used by AWS Lambda handlers. */
-export type {
-  AppRouterPrerenderStore,
-  RequestHostPolicy,
-  ResponseSinkStrategy,
-} from "../serve.js";
+export type { AppRouterPrerenderStore, RequestHostPolicy, ResponseSinkStrategy } from "../serve.js";
 
 /**
  * Represents the AWS API Gateway HTTP API v2 event consumed by buffered handlers.
@@ -120,9 +117,25 @@ export interface AwsLambdaStreamingResponseMetadata {
  */
 export interface AwsLambdaStreamingResponseStream {
   destroy?: ((error?: unknown) => void) | undefined;
+  /** Reports whether the runtime output stream has already been destroyed. */
+  destroyed?: boolean | undefined;
   end(): void;
-  once?: ((event: "drain", listener: () => void) => unknown) | undefined;
+  /** Removes a lifecycle listener when the runtime stream implements Node EventEmitter semantics. */
+  off?:
+    | ((event: "close" | "drain" | "error", listener: (error?: unknown) => void) => unknown)
+    | undefined;
+  /** Registers drain-only or full Node-compatible lifecycle listeners. */
+  once?:
+    | ((event: "drain", listener: () => void) => unknown)
+    | ((event: "close" | "drain" | "error", listener: (error?: unknown) => void) => unknown)
+    | undefined;
+  /** Removes a lifecycle listener on runtimes that expose the legacy EventEmitter API. */
+  removeListener?:
+    | ((event: "close" | "drain" | "error", listener: (error?: unknown) => void) => unknown)
+    | undefined;
   write(chunk: string | Uint8Array): boolean;
+  /** Reports whether the runtime output stream ended normally. */
+  writableEnded?: boolean | undefined;
 }
 
 /**
@@ -130,6 +143,7 @@ export interface AwsLambdaStreamingResponseStream {
  */
 export interface AwsLambdaRequestHandlerOptions {
   allowedHosts?: readonly string[] | undefined;
+  dehydrateOptions?: DehydrateOptions | undefined;
   errorHandler?:
     | ((error: unknown) => {
         body: string;
@@ -157,10 +171,7 @@ export interface AwsLambdaRequestHandlerOptions {
 /**
  * Selects how an AWS Lambda handler resolves its app-router import policy.
  */
-export type AwsLambdaImportPolicy =
-  | AppRouterImportPolicy
-  | "generated"
-  | { fromManifest: true };
+export type AwsLambdaImportPolicy = AppRouterImportPolicy | "generated" | { fromManifest: true };
 
 /**
  * Configures preload behavior for built app-router modules in AWS Lambda.
@@ -197,7 +208,7 @@ export type AwsLambdaStreamingRequestHandler<TContext = unknown> = (
 ) => Promise<void>;
 
 const invalidAwsLambdaHttpEventV2Diagnostic =
-  'Expected an AWS Lambda HTTP API payload format 2.0 event with rawPath and requestContext.http.method.';
+  "Expected an AWS Lambda HTTP API payload format 2.0 event with rawPath and requestContext.http.method.";
 
 function invalidAwsLambdaHttpEventV2Result(): AwsLambdaHttpResultV2 {
   return {
@@ -223,7 +234,7 @@ function invalidAwsLambdaHttpEventV2Response(): Response {
 export function createAwsLambdaRequestHandler(
   options: AwsLambdaRequestHandlerOptions,
 ): AwsLambdaRequestHandler {
-  warnIfImplicitHostTrust(options);
+  warnIfImplicitAwsLambdaHostPolicy(options);
   let handler: AwsLambdaRequestHandler | undefined;
 
   return async (event) => {
@@ -235,7 +246,11 @@ export function createAwsLambdaRequestHandler(
 
     handler ??= (() => {
       const runtimeDirPromise = prepareAwsLambdaRuntimeDir(options);
-      const runtimePreloadPromise = startAwsLambdaRuntimePreload(options, runtimeDirPromise, "middleware");
+      const runtimePreloadPromise = startAwsLambdaRuntimePreload(
+        options,
+        runtimeDirPromise,
+        "middleware",
+      );
       void runtimePreloadPromise?.catch(() => {});
       return createAwsLambdaRequestHandlerFromRuntime(
         options,
@@ -257,7 +272,7 @@ export function createAwsLambdaRequestHandler(
 export async function createPreloadedAwsLambdaRequestHandler(
   options: AwsLambdaRequestHandlerOptions,
 ): Promise<AwsLambdaRequestHandler> {
-  warnIfImplicitHostTrust(options);
+  warnIfImplicitAwsLambdaHostPolicy(options);
   let handler: AwsLambdaRequestHandler | undefined;
 
   return async (event) => {
@@ -287,10 +302,8 @@ export async function createPreloadedAwsLambdaRequestHandler(
  *
  * Call this during controlled Lambda initialization only when the extra startup work is preferable to first-valid-request latency. Request handlers always validate events before they start runtime work.
  */
-export async function warmAwsLambdaRuntime(
-  options: AwsLambdaRequestHandlerOptions,
-): Promise<void> {
-  warnIfImplicitHostTrust(options);
+export async function warmAwsLambdaRuntime(options: AwsLambdaRequestHandlerOptions): Promise<void> {
+  warnIfImplicitAwsLambdaHostPolicy(options);
   const runtimeDir = await prepareAwsLambdaRuntimeDir(options);
   await preloadAwsLambdaRuntime(options, runtimeDir);
 }
@@ -310,16 +323,18 @@ function createAwsLambdaRequestHandlerFromRuntime(
 
     const startedAt = logNow();
     const phases = createAwsLambdaTimingPhases(options);
-    const eventToRequestStartedAt = phaseStartedAt(phases);
-    const request = eventToRequest(event, options);
-    finishPhase(phases, eventToRequestStartedAt, "eventToRequestMs");
-    const logFields = requestLogFields(request, "aws-lambda");
-    emitRouterLog(options.logger, "info", {
-      ...logFields,
-      type: "router:request:start",
-    });
+    let request: Request | undefined;
+    let logFields = awsLambdaEventLogFields(event);
 
     try {
+      const eventToRequestStartedAt = phaseStartedAt(phases);
+      request = eventToRequest(event, options);
+      finishPhase(phases, eventToRequestStartedAt, "eventToRequestMs");
+      logFields = requestLogFields(request, "aws-lambda");
+      emitRouterLog(options.logger, "info", {
+        ...logFields,
+        type: "router:request:start",
+      });
       const runtimeDirStartedAt = phaseStartedAt(phases);
       const runtimeDir = await runtimeDirPromise;
       finishPhase(phases, runtimeDirStartedAt, "runtimeDirMs");
@@ -337,12 +352,9 @@ function createAwsLambdaRequestHandlerFromRuntime(
         outDir: options.outDir,
         runtimeDir,
       });
-      const preload = awsLambdaRenderPreload(
-        options,
-        runtimePreloadPromise,
-        defaultPreloadMode,
-      );
+      const preload = awsLambdaRenderPreload(options, runtimePreloadPromise, defaultPreloadMode);
       const response = await builtRuntime.render(request, {
+        dehydrateOptions: options.dehydrateOptions,
         instrumentation: options.instrumentation,
         logger: awsLambdaRenderLogger(options),
         onResponse: options.onResponse,
@@ -401,7 +413,7 @@ function createAwsLambdaRequestHandlerFromRuntime(
 export function createAwsLambdaStreamingRequestHandler<TContext = unknown>(
   options: AwsLambdaRequestHandlerOptions,
 ): AwsLambdaStreamingRequestHandler<TContext> {
-  warnIfImplicitHostTrust(options);
+  warnIfImplicitAwsLambdaHostPolicy(options);
   const runtime = awsLambdaRuntime();
   let handler: AwsLambdaStreamingRequestHandler<TContext> | undefined;
 
@@ -409,17 +421,17 @@ export function createAwsLambdaStreamingRequestHandler<TContext = unknown>(
     try {
       validateAwsLambdaHttpEventV2(event);
     } catch {
-      await streamResponseToLambda(
-        invalidAwsLambdaHttpEventV2Response(),
-        responseStream,
-        runtime,
-      );
+      await streamResponseToLambda(invalidAwsLambdaHttpEventV2Response(), responseStream, runtime);
       return;
     }
 
     handler ??= (() => {
       const runtimeDirPromise = prepareAwsLambdaRuntimeDir(options);
-      const runtimePreloadPromise = startAwsLambdaRuntimePreload(options, runtimeDirPromise, "middleware");
+      const runtimePreloadPromise = startAwsLambdaRuntimePreload(
+        options,
+        runtimeDirPromise,
+        "middleware",
+      );
       void runtimePreloadPromise?.catch(() => {});
       return createAwsLambdaStreamingRequestHandlerFromRuntime(
         options,
@@ -442,7 +454,7 @@ export function createAwsLambdaStreamingRequestHandler<TContext = unknown>(
 export async function createPreloadedAwsLambdaStreamingRequestHandler<TContext = unknown>(
   options: AwsLambdaRequestHandlerOptions,
 ): Promise<AwsLambdaStreamingRequestHandler<TContext>> {
-  warnIfImplicitHostTrust(options);
+  warnIfImplicitAwsLambdaHostPolicy(options);
   const runtime = awsLambdaRuntime();
   let handler: AwsLambdaStreamingRequestHandler<TContext> | undefined;
 
@@ -450,11 +462,7 @@ export async function createPreloadedAwsLambdaStreamingRequestHandler<TContext =
     try {
       validateAwsLambdaHttpEventV2(event);
     } catch {
-      await streamResponseToLambda(
-        invalidAwsLambdaHttpEventV2Response(),
-        responseStream,
-        runtime,
-      );
+      await streamResponseToLambda(invalidAwsLambdaHttpEventV2Response(), responseStream, runtime);
       return;
     }
 
@@ -596,8 +604,12 @@ async function readGeneratedAwsLambdaImportPolicy(outDir: string): Promise<AppRo
   return await promise;
 }
 
-async function readGeneratedAwsLambdaImportPolicyInner(outDir: string): Promise<AppRouterImportPolicy> {
-  const policy = JSON.parse(await readFile(join(outDir, "server", "import-policy.json"), "utf8")) as {
+async function readGeneratedAwsLambdaImportPolicyInner(
+  outDir: string,
+): Promise<AppRouterImportPolicy> {
+  const policy = JSON.parse(
+    await readFile(join(outDir, "server", "import-policy.json"), "utf8"),
+  ) as {
     runtimePackages?: readonly string[] | undefined;
   };
 
@@ -624,26 +636,27 @@ function createAwsLambdaStreamingRequestHandlerFromRuntime<TContext = unknown>(
     try {
       validateAwsLambdaHttpEventV2(event);
     } catch {
-      await streamResponseToLambda(
-        invalidAwsLambdaHttpEventV2Response(),
-        responseStream,
-        runtime,
-      );
+      await streamResponseToLambda(invalidAwsLambdaHttpEventV2Response(), responseStream, runtime);
       return;
     }
 
     const startedAt = logNow();
     const phases = createAwsLambdaTimingPhases(options);
-    const eventToRequestStartedAt = phaseStartedAt(phases);
-    const request = eventToRequest(event, options);
-    finishPhase(phases, eventToRequestStartedAt, "eventToRequestMs");
-    const logFields = requestLogFields(request, "aws-lambda");
-    emitRouterLog(options.logger, "info", {
-      ...logFields,
-      type: "router:request:start",
-    });
+    const requestAbortController = new AbortController();
+    let request: Request | undefined;
+    let requestLifecycle: ReturnType<typeof observeLambdaStreamFailure> | undefined;
+    let logFields = awsLambdaEventLogFields(event);
 
     try {
+      const eventToRequestStartedAt = phaseStartedAt(phases);
+      request = eventToRequest(event, options, requestAbortController.signal);
+      requestLifecycle = observeLambdaStreamFailure(responseStream, requestAbortController);
+      finishPhase(phases, eventToRequestStartedAt, "eventToRequestMs");
+      logFields = requestLogFields(request, "aws-lambda");
+      emitRouterLog(options.logger, "info", {
+        ...logFields,
+        type: "router:request:start",
+      });
       const runtimeDirStartedAt = phaseStartedAt(phases);
       const runtimeDir = await runtimeDirPromise;
       finishPhase(phases, runtimeDirStartedAt, "runtimeDirMs");
@@ -661,12 +674,9 @@ function createAwsLambdaStreamingRequestHandlerFromRuntime<TContext = unknown>(
         outDir: options.outDir,
         runtimeDir,
       });
-      const preload = awsLambdaRenderPreload(
-        options,
-        runtimePreloadPromise,
-        defaultPreloadMode,
-      );
+      const preload = awsLambdaRenderPreload(options, runtimePreloadPromise, defaultPreloadMode);
       const response = await builtRuntime.render(request, {
+        dehydrateOptions: options.dehydrateOptions,
         instrumentation: options.instrumentation,
         logger: awsLambdaRenderLogger(options),
         onResponse: options.onResponse,
@@ -678,7 +688,13 @@ function createAwsLambdaStreamingRequestHandlerFromRuntime<TContext = unknown>(
       });
       finishPhase(phases, renderStartedAt, "renderMs");
       const responseStreamingStartedAt = phaseStartedAt(phases);
-      await streamResponseToLambda(response, responseStream, runtime, phases);
+      await streamResponseToLambda(
+        response,
+        responseStream,
+        runtime,
+        phases,
+        requestAbortController,
+      );
       finishPhase(phases, responseStreamingStartedAt, "responseStreamingMs");
       emitRouterLog(options.logger, "info", {
         ...logFields,
@@ -695,6 +711,10 @@ function createAwsLambdaStreamingRequestHandlerFromRuntime<TContext = unknown>(
         type: "router:request:error",
       });
 
+      if (requestAbortController.signal.aborted) {
+        return;
+      }
+
       const payload = options.errorHandler
         ? options.errorHandler(error)
         : { body: "Internal Server Error", status: 500 };
@@ -710,7 +730,15 @@ function createAwsLambdaStreamingRequestHandlerFromRuntime<TContext = unknown>(
         request,
       );
 
-      await streamResponseToLambda(response, responseStream, runtime, phases);
+      await streamResponseToLambda(
+        response,
+        responseStream,
+        runtime,
+        phases,
+        requestAbortController,
+      );
+    } finally {
+      requestLifecycle?.dispose();
     }
   });
 }
@@ -718,8 +746,12 @@ function createAwsLambdaStreamingRequestHandlerFromRuntime<TContext = unknown>(
 async function applyAwsLambdaResponseHook(
   response: Response,
   options: Pick<AwsLambdaRequestHandlerOptions, "onResponse">,
-  request: Request,
+  request: Request | undefined,
 ): Promise<Response> {
+  if (request === undefined) {
+    return response;
+  }
+
   const hooked = await options.onResponse?.(response, { request });
 
   return hooked instanceof Response ? hooked : response;
@@ -798,6 +830,7 @@ function isNodeErrorCode(error: unknown, code: string): boolean {
 function eventToRequest(
   event: AwsLambdaHttpEventV2,
   options: AwsLambdaRequestHandlerOptions,
+  signal?: AbortSignal,
 ): Request {
   validateAwsLambdaHttpEventV2(event);
   const headers = eventHeaders(event);
@@ -808,21 +841,67 @@ function eventToRequest(
     hostPolicy: lambdaHostPolicy(options),
     rawHost: rawHost ?? undefined,
   });
-  const protocol = lambdaRequestProtocol(event, headers, options);
-  const rawPath = event.rawPath;
-  const rawQueryString = event.rawQueryString === "" ? "" : `?${event.rawQueryString}`;
+  const protocol = lambdaRequestProtocol(headers, options);
   const method = event.requestContext.http.method;
   const init: RequestInit = {
     headers,
     method,
+    ...(signal === undefined ? {} : { signal }),
   };
 
   if (method !== "GET" && method !== "HEAD" && event.body !== undefined) {
-    init.body =
-      event.isBase64Encoded === true ? Buffer.from(event.body, "base64") : event.body;
+    init.body = event.isBase64Encoded === true ? Buffer.from(event.body, "base64") : event.body;
+  }
+
+  return new Request(lambdaRequestUrl(protocol, host, event.rawPath, event.rawQueryString), init);
+}
+
+function lambdaRequestUrl(
+  protocol: "http" | "https",
+  host: string,
+  rawPath: string,
+  rawQueryString: string,
+): URL {
+  if (hasInvalidLambdaRequestAuthorityCharacter(host)) {
+    throw new TypeError("AWS Lambda request Host is not a valid URL authority");
+  }
+
+  const url = new URL(`${protocol}://${host}`);
+  if (
+    url.protocol !== `${protocol}:` ||
+    url.host === "" ||
+    url.username !== "" ||
+    url.password !== "" ||
+    url.pathname !== "/" ||
+    url.search !== "" ||
+    url.hash !== ""
+  ) {
+    throw new TypeError("AWS Lambda request Host is not a valid URL authority");
+  }
+
+  url.pathname = rawPath;
+  url.search = rawQueryString;
+  return url;
+}
+
+function hasInvalidLambdaRequestAuthorityCharacter(host: string): boolean {
+  for (const character of host) {
+    const codePoint = character.codePointAt(0) ?? 0;
+    if (
+      character === "/" ||
+      character === "?" ||
+      character === "#" ||
+      character === "\\" ||
+      character === "@" ||
+      character.trim() === "" ||
+      codePoint < 0x20 ||
+      codePoint === 0x7f
+    ) {
+      return true;
+    }
   }
 
-  return new Request(`${protocol}://${host}${rawPath}${rawQueryString}`, init);
+  return false;
 }
 
 function validateAwsLambdaHttpEventV2(event: AwsLambdaHttpEventV2): void {
@@ -837,10 +916,12 @@ function validateAwsLambdaHttpEventV2(event: AwsLambdaHttpEventV2): void {
     typeof (candidate as { rawQueryString?: unknown }).rawQueryString !== "string" ||
     typeof (candidate as { requestContext?: unknown }).requestContext !== "object" ||
     (candidate as { requestContext?: unknown }).requestContext === null ||
-    typeof ((candidate as { requestContext: { http?: unknown } }).requestContext.http) !== "object" ||
+    typeof (candidate as { requestContext: { http?: unknown } }).requestContext.http !== "object" ||
     (candidate as { requestContext: { http?: unknown } }).requestContext.http === null ||
-    typeof ((candidate as { requestContext: { http: { method?: unknown } } }).requestContext.http.method) !== "string" ||
-    (candidate as { requestContext: { http: { method: string } } }).requestContext.http.method === ""
+    typeof (candidate as { requestContext: { http: { method?: unknown } } }).requestContext.http
+      .method !== "string" ||
+    (candidate as { requestContext: { http: { method: string } } }).requestContext.http.method ===
+      ""
   ) {
     throw new Error(invalidAwsLambdaHttpEventV2Diagnostic);
   }
@@ -857,14 +938,27 @@ function lambdaRequestHost(
   return headers.get("host");
 }
 
-function lambdaHostPolicy(
-  options: AwsLambdaRequestHandlerOptions,
-): RequestHostPolicy | undefined {
+function lambdaHostPolicy(options: AwsLambdaRequestHandlerOptions): RequestHostPolicy | undefined {
   return options.hostPolicy ?? (process.env.NODE_ENV === "production" ? "strict" : undefined);
 }
 
+function warnIfImplicitAwsLambdaHostPolicy(options: AwsLambdaRequestHandlerOptions): void {
+  if (
+    process.env.NODE_ENV !== "production" ||
+    options.allowedHosts !== undefined ||
+    options.hostPolicy !== undefined ||
+    warnedImplicitAwsLambdaHostPolicy
+  ) {
+    return;
+  }
+
+  warnedImplicitAwsLambdaHostPolicy = true;
+  console.error(
+    '[mreact] AWS Lambda Host handling defaults to strict because neither allowedHosts nor hostPolicy is configured. Unlisted Host headers use the configured hostname or lambda.local. Set allowedHosts for public deployments or hostPolicy: "trusted-proxy" when a trusted reverse proxy normalizes Host.',
+  );
+}
+
 function lambdaRequestProtocol(
-  event: AwsLambdaHttpEventV2,
   headers: Headers,
   options: AwsLambdaRequestHandlerOptions,
 ): "http" | "https" {
@@ -872,7 +966,7 @@ function lambdaRequestProtocol(
     return normalizeRequestProtocol(firstForwardedValue(headers.get("x-forwarded-proto")));
   }
 
-  return normalizeRequestProtocol(event.requestContext?.http?.protocol);
+  return "https";
 }
 
 function normalizeRequestProtocol(value: string | undefined): "http" | "https" {
@@ -880,8 +974,15 @@ function normalizeRequestProtocol(value: string | undefined): "http" | "https" {
     return "https";
   }
 
-  const normalized = value.toLowerCase();
-  return normalized === "http" || normalized.startsWith("http/") ? "http" : "https";
+  return value.toLowerCase() === "http" ? "http" : "https";
+}
+
+function awsLambdaEventLogFields(event: AwsLambdaHttpEventV2): RouterRequestLogFields {
+  return {
+    method: event.requestContext.http.method,
+    path: event.rawPath,
+    runtime: "aws-lambda",
+  };
 }
 
 function eventHeaders(event: AwsLambdaHttpEventV2): Headers {
@@ -929,7 +1030,7 @@ async function responseToLambdaResult(
 
   const bodyEncodeStartedAt = phaseStartedAt(phases);
   const contentType = response.headers.get("content-type");
-  const text = isTextContentType(contentType);
+  const text = isUtf8TextContentType(contentType) && isUtf8(bytes);
   const result = {
     body: text ? bytes.toString("utf8") : bytes.toString("base64"),
     ...(cookies.length === 0 ? {} : { cookies }),
@@ -1055,12 +1156,21 @@ async function streamResponseToLambda(
   responseStream: AwsLambdaStreamingResponseStream,
   runtime: AwsLambdaRuntime,
   phases?: Record<string, number> | undefined,
+  requestAbortController?: AbortController,
 ): Promise<void> {
+  if (isLambdaStreamingAborted(requestAbortController)) {
+    return;
+  }
+
   const stream = runtime.HttpResponseStream.from(
     responseStream,
     responseStreamingMetadata(response),
   );
 
+  if (isLambdaStreamingAborted(requestAbortController)) {
+    return;
+  }
+
   try {
     if (response.body === null) {
       stream.end();
@@ -1068,22 +1178,46 @@ async function streamResponseToLambda(
     }
 
     const reader = response.body.getReader();
+    const lifecycle = observeLambdaStreamFailure(stream, requestAbortController);
 
-    while (true) {
-      const streamWaitStartedAt = phaseStartedAt(phases);
-      const result = await reader.read();
-      addPhaseDuration(phases, streamWaitStartedAt, "streamWaitMs");
-
-      if (result.done) {
-        break;
+    try {
+      while (true) {
+        const streamWaitStartedAt = phaseStartedAt(phases);
+        const result = await readLambdaBodyWithAbort(reader, lifecycle.signal);
+        addPhaseDuration(phases, streamWaitStartedAt, "streamWaitMs");
+
+        if (lifecycle.signal.aborted) {
+          throw lambdaAbortReason(lifecycle.signal);
+        }
+
+        if (result.done) {
+          break;
+        }
+
+        const streamWriteStartedAt = phaseStartedAt(phases);
+        await writeStreamingChunk(stream, result.value, lifecycle.signal);
+        addPhaseDuration(phases, streamWriteStartedAt, "streamWriteMs");
       }
 
-      const streamWriteStartedAt = phaseStartedAt(phases);
-      await writeStreamingChunk(stream, result.value);
-      addPhaseDuration(phases, streamWriteStartedAt, "streamWriteMs");
+      if (lifecycle.signal.aborted) {
+        throw lambdaAbortReason(lifecycle.signal);
+      }
+      stream.end();
+    } catch (error) {
+      const reason = error instanceof Error ? error : new Error(String(error));
+      requestAbortController?.abort(reason);
+      try {
+        await reader.cancel(reason);
+      } catch {
+        // The response body may already be errored or cancelled.
+      }
+      if (stream.destroyed !== true) {
+        stream.destroy?.(reason);
+      }
+    } finally {
+      lifecycle.dispose();
+      reader.releaseLock();
     }
-
-    stream.end();
   } catch (error) {
     if (typeof stream.destroy === "function") {
       stream.destroy(error);
@@ -1094,9 +1228,11 @@ async function streamResponseToLambda(
   }
 }
 
-function responseStreamingMetadata(
-  response: Response,
-): AwsLambdaStreamingResponseMetadata {
+function isLambdaStreamingAborted(controller: AbortController | undefined): boolean {
+  return controller?.signal.aborted === true;
+}
+
+function responseStreamingMetadata(response: Response): AwsLambdaStreamingResponseMetadata {
   const headers: Record<string, string> = {};
   response.headers.forEach((value, key) => {
     if (key !== "set-cookie") {
@@ -1116,8 +1252,18 @@ function responseStreamingMetadata(
 async function writeStreamingChunk(
   stream: AwsLambdaStreamingResponseStream,
   chunk: Uint8Array,
+  signal: AbortSignal,
 ): Promise<void> {
-  if (stream.write(chunk) !== false) {
+  if (signal.aborted) {
+    throw lambdaAbortReason(signal);
+  }
+
+  const accepted = stream.write(chunk);
+  if (signal.aborted) {
+    throw lambdaAbortReason(signal);
+  }
+
+  if (accepted !== false) {
     return;
   }
 
@@ -1125,11 +1271,131 @@ async function writeStreamingChunk(
     return;
   }
 
-  await new Promise<void>((resolve) => {
-    stream.once?.("drain", resolve);
+  await new Promise<void>((resolve, reject) => {
+    const dispose = (): void => {
+      removeLambdaStreamListener(stream, "drain", onDrain);
+      signal.removeEventListener("abort", onAbort);
+    };
+    const onDrain = (): void => {
+      dispose();
+      resolve();
+    };
+    const onAbort = (): void => {
+      dispose();
+      reject(lambdaAbortReason(signal));
+    };
+    addLambdaStreamListener(stream, "drain", onDrain);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+function observeLambdaStreamFailure(
+  stream: AwsLambdaStreamingResponseStream,
+  abortController: AbortController = new AbortController(),
+): {
+  dispose(): void;
+  signal: AbortSignal;
+} {
+  let disposed = false;
+
+  const dispose = (): void => {
+    if (disposed) {
+      return;
+    }
+    disposed = true;
+    removeLambdaStreamListener(stream, "close", onClose);
+    removeLambdaStreamListener(stream, "error", onError);
+  };
+  const abort = (reason: Error): void => {
+    abortController.abort(reason);
+    dispose();
+  };
+  const onClose = (): void => {
+    if (stream.writableEnded === true) {
+      dispose();
+      return;
+    }
+    abort(new Error("The AWS Lambda response stream closed during streaming."));
+  };
+  const onError = (error?: unknown): void => {
+    abort(error instanceof Error ? error : new Error(String(error ?? "AWS Lambda stream error")));
+  };
+
+  const canRemoveListeners =
+    typeof stream.off === "function" || typeof stream.removeListener === "function";
+  if (canRemoveListeners) {
+    addLambdaStreamListener(stream, "close", onClose);
+    addLambdaStreamListener(stream, "error", onError);
+  }
+  if (abortController.signal.aborted) {
+    dispose();
+  } else if (stream.destroyed === true && stream.writableEnded !== true) {
+    onClose();
+  }
+
+  return { dispose, signal: abortController.signal };
+}
+
+function readLambdaBodyWithAbort(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  signal: AbortSignal,
+): Promise<ReadableStreamReadResult<Uint8Array>> {
+  if (signal.aborted) {
+    return Promise.reject(lambdaAbortReason(signal));
+  }
+
+  return new Promise((resolve, reject) => {
+    const onAbort = (): void => {
+      signal.removeEventListener("abort", onAbort);
+      reject(lambdaAbortReason(signal));
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    void reader.read().then(
+      (result) => {
+        signal.removeEventListener("abort", onAbort);
+        resolve(result);
+      },
+      (error: unknown) => {
+        signal.removeEventListener("abort", onAbort);
+        reject(error);
+      },
+    );
   });
 }
 
+function removeLambdaStreamListener(
+  stream: AwsLambdaStreamingResponseStream,
+  event: "close" | "drain" | "error",
+  listener: (error?: unknown) => void,
+): void {
+  if (typeof stream.off === "function") {
+    stream.off(event, listener);
+    return;
+  }
+  stream.removeListener?.(event, listener);
+}
+
+function addLambdaStreamListener(
+  stream: AwsLambdaStreamingResponseStream,
+  event: "close" | "drain" | "error",
+  listener: (error?: unknown) => void,
+): void {
+  const once = stream.once as
+    | ((event: "close" | "drain" | "error", listener: (error?: unknown) => void) => unknown)
+    | undefined;
+  try {
+    once?.call(stream, event, listener);
+  } catch {
+    // A structurally compatible drain-only stream may reject lifecycle event names.
+  }
+}
+
+function lambdaAbortReason(signal: AbortSignal): Error {
+  return signal.reason instanceof Error
+    ? signal.reason
+    : new Error("AWS Lambda response streaming was aborted.");
+}
+
 interface AwsLambdaRuntime {
   HttpResponseStream: {
     from(
@@ -1143,8 +1409,7 @@ interface AwsLambdaRuntime {
 }
 
 function awsLambdaRuntime(): AwsLambdaRuntime {
-  const runtime = (globalThis as { awslambda?: Partial<AwsLambdaRuntime> | undefined })
-    .awslambda;
+  const runtime = (globalThis as { awslambda?: Partial<AwsLambdaRuntime> | undefined }).awslambda;
 
   if (
     typeof runtime?.streamifyResponse !== "function" ||
@@ -1202,13 +1467,14 @@ function splitSetCookieHeader(header: string): string[] {
   return cookies.filter((cookie) => cookie.length > 0);
 }
 
-function isTextContentType(contentType: string | null): boolean {
+function isUtf8TextContentType(contentType: string | null): boolean {
   if (contentType === null) {
-    return true;
+    return false;
   }
 
-  const type = contentType.toLowerCase().split(";")[0]?.trim() ?? "";
-  return (
+  const [rawType = "", ...parameters] = contentType.split(";");
+  const type = rawType.trim().toLowerCase();
+  const textual =
     type.startsWith("text/") ||
     type === "application/json" ||
     type === "application/javascript" ||
@@ -1216,6 +1482,51 @@ function isTextContentType(contentType: string | null): boolean {
     type === "application/xml" ||
     type === "application/x-www-form-urlencoded" ||
     type.endsWith("+json") ||
-    type.endsWith("+xml")
+    type.endsWith("+xml");
+  if (!textual) {
+    return false;
+  }
+
+  let hasCharset = false;
+  for (const parameter of parameters) {
+    const equals = parameter.indexOf("=");
+    const name = (equals === -1 ? parameter : parameter.slice(0, equals)).trim().toLowerCase();
+    if (name !== "charset") {
+      continue;
+    }
+
+    hasCharset = true;
+    if (equals === -1) {
+      return false;
+    }
+
+    const value = unquoteContentTypeParameter(parameter.slice(equals + 1).trim()).toLowerCase();
+    if (value !== "utf-8" && value !== "utf8") {
+      return false;
+    }
+  }
+
+  if (hasCharset) {
+    return true;
+  }
+
+  return (
+    type === "application/json" ||
+    type === "application/javascript" ||
+    type === "application/x-javascript" ||
+    type === "text/javascript" ||
+    type.endsWith("+json")
   );
 }
+
+function unquoteContentTypeParameter(value: string): string {
+  if (value.length < 2) {
+    return value;
+  }
+
+  const first = value[0];
+  const last = value.at(-1);
+  return (first === '"' && last === '"') || (first === "'" && last === "'")
+    ? value.slice(1, -1)
+    : value;
+}