@seanhogg/builderforce-webcontainers-core 2026.10.7 → 2026.10.8

package/src/html.ts

@@ -5,11 +5,13 @@
  *   • CRA's `%PUBLIC_URL%` placeholder is filled;
  *   • a page with no module script (CRA) gets its entry injected;
  *   • the error bridge is prepended, so runtime errors and console output reach the host;
+ *   • the WebSocket bridge follows, so `new WebSocket('ws://localhost:3000')` reaches a virtual server;
  *   • the host's preview scripts run next, before the app;
  *   • the live-reload listener is prepended, so an edit re-renders the preview;
  *   • the attribution badge is appended unless the host turned it off.
  */
 import { injectAttribution } from './attribution.js';
+import { previewSocketScript } from './previewBridge.js';
 
 export const ERROR_MESSAGE_TYPE = 'bfwc:error';
 export const CONSOLE_MESSAGE_TYPE = 'bfwc:console';
@@ -81,8 +83,8 @@ export interface HtmlOptions {
   scripts?: readonly string[];
 }
 
-/** `</script>` inside a script body would end the tag early. */
-const scriptTag = (source: string) => `<script>${source.replace(/<\/script/gi, '<\\/script')}</script>`;
+/** A host script as a tag. `</script>` inside the body would end the tag early, so it is escaped. */
+export const scriptTag = (source: string): string => `<script>${source.replace(/<\/script/gi, '<\\/script')}</script>`;
 
 export function transformHtml(html: string, options: HtmlOptions): string {
   const { base } = options;
@@ -97,7 +99,7 @@ export function transformHtml(html: string, options: HtmlOptions): string {
   }
   if (options.attribution !== false) out = injectAttribution(out);
 
-  const bridge = [errorBridgeScript(), liveReloadScript(base), ...(options.scripts ?? []).map(scriptTag)].join('\n');
+  const bridge = [errorBridgeScript(), previewSocketScript(), liveReloadScript(base), ...(options.scripts ?? []).map(scriptTag)].join('\n');
   if (/<head[^>]*>/i.test(out)) return out.replace(/<head[^>]*>/i, (head) => `${head}\n${bridge}`);
   return bridge + out;
 }

package/src/index.ts

@@ -44,7 +44,8 @@ export { rewriteImports } from './rewriteImports.js';
 export { resolveLocal, resolveAlias, isBareSpecifier, splitPackageSpecifier, resolvePackage, RESOLVE_EXTENSIONS } from './resolve.js';
 export { compileScript, compileModule, isScriptPath, mapSpecifier, moduleUrl, buildDefine } from './compileScript.js';
 export { compileComponent } from './compileComponent.js';
-export { transformHtml, errorBridgeScript, liveReloadScript, reloadChannelName, ERROR_MESSAGE_TYPE, CONSOLE_MESSAGE_TYPE, CONSOLE_MESSAGE_LIMIT } from './html.js';
+export { transformHtml, scriptTag, errorBridgeScript, liveReloadScript, reloadChannelName, ERROR_MESSAGE_TYPE, CONSOLE_MESSAGE_TYPE, CONSOLE_MESSAGE_LIMIT } from './html.js';
+export { previewSocketScript, previewCookieScript, bridgeInsertionPoint, SOCKET_MESSAGE_TYPE, COOKIE_MESSAGE_TYPE, SOCKET_CONNECT_TIMEOUT_MS } from './previewBridge.js';
 export { mimeFor } from './mime.js';
 export { attributionScript, injectAttribution, ATTRIBUTION_URL, ATTRIBUTION_LABEL } from './attribution.js';
 export type { AttributionOptions } from './attribution.js';

package/src/node/http/client.ts

@@ -3,12 +3,13 @@
  * the `fetch` global a program sees. Requests to localhost reach this runtime's
  * own virtual servers (`loopback`); everything else goes through the browser's
  * fetch, so CORS applies — a public API without CORS headers is unreachable
- * from a browser page, and no shim can change that.
+ * from a browser page, and no shim can change that. Response bodies stream:
+ * `res.on('data')` and `response.body` see chunks as the server writes them.
  */
 import { Buffer } from '../buffer.js';
 import type { EventLoop } from '../loop.js';
 import type { HttpRequestData, System } from '../../system/types.js';
-import { FakeSocket, IncomingMessage, OutgoingHeaders } from './server.js';
+import { FakeSocket, IncomingMessage, OutgoingHeaders } from './messages.js';
 
 const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '0.0.0.0', '::1', '[::1]']);
 /** Headers a browser refuses to let script set; dropping them beats a TypeError. */
@@ -70,7 +71,8 @@ export async function sendRequest(system: System, url: URL, request: HttpRequest
     const headers = new Headers();
     for (const [k, v] of Object.entries(reply.headers)) for (const item of Array.isArray(v) ? v : [v]) headers.append(k, String(item));
     const empty = reply.status === 204 || reply.status === 304 || request.method === 'HEAD';
-    return new Response(empty ? null : (reply.body as unknown as BodyInit), { status: reply.status, statusText: reply.statusText, headers });
+    if (empty) void reply.body.cancel().catch(() => undefined);
+    return new Response(empty ? null : reply.body, { status: reply.status, statusText: reply.statusText, headers });
   }
   const headers: Record<string, string> = {};
   for (const [k, v] of Object.entries(request.headers)) if (!FORBIDDEN.has(k.toLowerCase())) headers[k] = v;
@@ -92,7 +94,9 @@ export class ClientRequest extends OutgoingHeaders {
   private readonly options: RequestOptions;
 
   constructor(private readonly deps: ClientDeps, input: unknown, extra: unknown, callback: ((res: IncomingMessage) => void) | undefined, defaultProtocol: string) {
-    super({ decodeStrings: true });
+    // Not auto-destroyed on 'finish' (as in Node): the request body is done long before the
+    // response streams in, and destroy() aborts the request — which would cut that response off.
+    super({ decodeStrings: true, autoDestroy: false });
     if (typeof extra === 'function') [callback, extra] = [extra as typeof callback, undefined];
     this.options = toOptions(input, extra, defaultProtocol);
     this.method = this.options.method!;
@@ -131,6 +135,33 @@ export class ClientRequest extends OutgoingHeaders {
   setNoDelay(): void {}
   setSocketKeepAlive(): void {}
 
+  /** Push the body into `res` chunk by chunk; aborting the request hangs up on the server. */
+  private async streamBody(response: Response, res: IncomingMessage): Promise<void> {
+    const reader = response.body?.getReader();
+    if (reader) {
+      const stop = () => void reader.cancel().catch(() => undefined);
+      this.controller.signal.addEventListener('abort', stop);
+      try {
+        for (;;) {
+          const { value, done } = await reader.read();
+          if (done || this.controller.signal.aborted) break;
+          this.deps.loop._run(() => res.push(Buffer.from(value.buffer as ArrayBuffer, value.byteOffset, value.byteLength)));
+        }
+      } catch (error) {
+        if (this.controller.signal.aborted) return;
+        this.deps.loop._run(() => {
+          res.aborted = true;
+          res.destroy(error as Error);
+        });
+        return;
+      } finally {
+        this.controller.signal.removeEventListener('abort', stop);
+      }
+    }
+    if (this.controller.signal.aborted) return;
+    this.deps.loop._run(() => res._complete());
+  }
+
   private async perform(): Promise<void> {
     const release = this.deps.loop.hold();
     try {
@@ -144,10 +175,11 @@ export class ClientRequest extends OutgoingHeaders {
       const res = new IncomingMessage(this.socket);
       res.statusCode = response.status;
       res.statusMessage = response.statusText;
-      res._fill(headersToRecord(response.headers), new Uint8Array(await response.arrayBuffer()));
+      res._setHeaders(headersToRecord(response.headers));
       this.deps.loop._run(() => {
         if (!this.emit('response', res)) res.resume();
       });
+      await this.streamBody(response, res);
     } catch (error) {
       if (!this.aborted) this.deps.loop._run(() => this.emit('error', error));
     } finally {
@@ -165,9 +197,40 @@ export function createFetch(deps: ClientDeps): typeof fetch {
       const url = new URL(request.url);
       if (!isLocalHost(url.hostname)) return await deps.system.fetch(url.href, init ?? (typeof input === 'object' && !(input instanceof URL) ? { method: request.method, headers: request.headers, body: request.body, signal: request.signal } : undefined));
       const body = request.method === 'GET' || request.method === 'HEAD' ? null : new Uint8Array(await request.arrayBuffer());
-      return await sendRequest(deps.system, url, { method: request.method, url: url.pathname + url.search, headers: headersToRecord(request.headers), body });
+      const response = await sendRequest(deps.system, url, { method: request.method, url: url.pathname + url.search, headers: headersToRecord(request.headers), body });
+      return holdWhileReading(response, () => deps.loop.hold());
     } finally {
       release();
     }
   };
 }
+
+/**
+ * A loopback body streams from a server that may live in another process, so
+ * nothing else keeps this one alive while the program awaits the next chunk:
+ * hold the loop for each pending read — and only then, so a body nobody reads
+ * does not keep the process running.
+ */
+function holdWhileReading(response: Response, hold: () => () => void): Response {
+  if (!response.body) return response;
+  const reader = response.body.getReader();
+  const body = new ReadableStream<Uint8Array>(
+    {
+      async pull(controller) {
+        const release = hold();
+        try {
+          const { value, done } = await reader.read();
+          if (done) controller.close();
+          else controller.enqueue(value);
+        } catch (error) {
+          controller.error(error);
+        } finally {
+          release();
+        }
+      },
+      cancel: (reason) => reader.cancel(reason),
+    },
+    { highWaterMark: 0 },
+  );
+  return new Response(body, { status: response.status, statusText: response.statusText, headers: response.headers });
+}

package/src/node/http/index.ts

@@ -8,6 +8,7 @@ import { EventEmitterBase } from '../events.js';
 import { ClientRequest, createFetch, type ClientDeps } from './client.js';
 import { FakeSocket, IncomingMessage, OutgoingHeaders, Server, ServerResponse } from './server.js';
 import { METHODS, STATUS_CODES } from './status.js';
+import { textResponse } from '../../system/httpStream.js';
 
 export { createFetch };
 
@@ -74,7 +75,7 @@ export function createNetModule(deps: ClientDeps): Record<string, unknown> {
       const port = typeof first === 'object' && first ? Number((first as { port?: number }).port ?? 0) : Number(first ?? 0);
       if (callback) this.once('listening', callback);
       try {
-        this.reservation = deps.system.listen(port, async () => ({ status: 502, headers: { 'content-type': 'text/plain' }, body: new TextEncoder().encode('Not an HTTP server') }));
+        this.reservation = deps.system.listen(port, async () => textResponse(502, 'Not an HTTP server'));
       } catch (error) {
         queueMicrotask(() => this.emit('error', error));
         return this;

package/src/node/http/messages.ts

@@ -0,0 +1,150 @@
+/**
+ * The message and socket objects both halves of `http` share: the socket
+ * stand-in frameworks read connection details from, IncomingMessage (a request
+ * a server receives, or a response a client receives) and the header store
+ * behind ServerResponse and ClientRequest.
+ */
+import { EventEmitterBase } from '../events.js';
+import { Buffer } from '../buffer.js';
+import { Readable } from '../stream/readable.js';
+import { Writable } from '../stream/writable.js';
+
+/** Enough of net.Socket for frameworks that read connection details. */
+export class FakeSocket extends EventEmitterBase {
+  remoteAddress = '127.0.0.1';
+  remotePort = 50000 + Math.floor(Math.random() * 10000);
+  remoteFamily = 'IPv4';
+  localAddress = '127.0.0.1';
+  localPort: number;
+  encrypted = false;
+  readable = true;
+  writable = true;
+  destroyed = false;
+  bytesRead = 0;
+  bytesWritten = 0;
+  constructor(port = 0) {
+    super();
+    this.localPort = port;
+  }
+  setTimeout(_ms: number, cb?: () => void): this { if (cb) this.once('timeout', cb); return this; }
+  setNoDelay(): this { return this; }
+  setKeepAlive(): this { return this; }
+  address() { return { address: this.localAddress, family: 'IPv4', port: this.localPort }; }
+  ref(): this { return this; }
+  unref(): this { return this; }
+  cork(): void {}
+  uncork(): void {}
+  write(): boolean { return true; }
+  end(): this { return this; }
+  destroy(): this {
+    this.destroyed = true;
+    return this;
+  }
+}
+
+export function lowerHeaders(headers: Record<string, string>): { headers: Record<string, string | string[]>; raw: string[] } {
+  const out: Record<string, string | string[]> = {};
+  const raw: string[] = [];
+  for (const [key, value] of Object.entries(headers)) {
+    const k = key.toLowerCase();
+    raw.push(key, value);
+    out[k] = k === 'set-cookie' ? [value] : value;
+  }
+  return { headers: out, raw };
+}
+
+export class IncomingMessage extends Readable {
+  httpVersion = '1.1';
+  httpVersionMajor = 1;
+  httpVersionMinor = 1;
+  method?: string;
+  url?: string;
+  statusCode?: number;
+  statusMessage?: string;
+  headers: Record<string, string | string[]> = {};
+  rawHeaders: string[] = [];
+  trailers: Record<string, string> = {};
+  rawTrailers: string[] = [];
+  complete = false;
+  aborted = false;
+  socket: FakeSocket;
+  connection: FakeSocket;
+
+  constructor(socket: FakeSocket = new FakeSocket()) {
+    super();
+    this.socket = socket;
+    this.connection = socket;
+  }
+
+  override _read(): void {
+    // the body is pushed up front
+  }
+
+  setTimeout(_ms: number, cb?: () => void): this {
+    if (cb) this.once('timeout', cb);
+    return this;
+  }
+
+  /** Fill from wire data; `body` null means none. */
+  _fill(headers: Record<string, string>, body: Uint8Array | null): void {
+    this._setHeaders(headers);
+    if (body?.length) this.push(Buffer.from(body));
+    this._complete();
+  }
+
+  /** Headers first, for a body that streams in through `push` and ends with `_complete`. */
+  _setHeaders(headers: Record<string, string>): void {
+    const { headers: lower, raw } = lowerHeaders(headers);
+    this.headers = lower;
+    this.rawHeaders = raw;
+  }
+
+  _complete(): void {
+    this.push(null);
+    this.complete = true;
+  }
+}
+
+export class OutgoingHeaders extends Writable {
+  protected _headers = new Map<string, { name: string; value: string | string[] }>();
+  headersSent = false;
+  sendDate = true;
+
+  setHeader(name: string, value: string | number | readonly string[]): this {
+    if (this.headersSent) throw Object.assign(new Error('Cannot set headers after they are sent to the client'), { code: 'ERR_HTTP_HEADERS_SENT' });
+    this._headers.set(name.toLowerCase(), { name, value: Array.isArray(value) ? value.map(String) : String(value) });
+    return this;
+  }
+  appendHeader(name: string, value: string | readonly string[]): this {
+    const existing = this.getHeader(name);
+    const list = [...(existing === undefined ? [] : Array.isArray(existing) ? existing : [String(existing)]), ...(Array.isArray(value) ? value : [value as string])];
+    return this.setHeader(name, list);
+  }
+  getHeader(name: string): string | string[] | undefined {
+    return this._headers.get(name.toLowerCase())?.value;
+  }
+  getHeaders(): Record<string, string | string[]> {
+    const out: Record<string, string | string[]> = Object.create(null);
+    for (const [key, { value }] of this._headers) out[key] = value;
+    return out;
+  }
+  getHeaderNames(): string[] {
+    return [...this._headers.keys()];
+  }
+  getRawHeaderNames(): string[] {
+    return [...this._headers.values()].map((h) => h.name);
+  }
+  hasHeader(name: string): boolean {
+    return this._headers.has(name.toLowerCase());
+  }
+  removeHeader(name: string): void {
+    this._headers.delete(name.toLowerCase());
+  }
+  flushHeaders(): void {
+    this.headersSent = true;
+  }
+  setTimeout(_ms: number, cb?: () => void): this {
+    if (cb) this.once('timeout', cb);
+    return this;
+  }
+}

package/src/node/http/server.ts

@@ -1,205 +1,23 @@
 /**
  * `http.createServer` on a virtual port. `listen(port)` registers a handler with
  * the system; each request arrives as plain data (from the preview service
- * worker, or `loopback` from inside the runtime), becomes an IncomingMessage /
- * ServerResponse pair for the app, and the finished response goes back as data.
- * Responses are buffered: streaming (SSE, long-polling) arrives in one piece.
+ * worker, or `loopback` from inside the runtime) and becomes an IncomingMessage /
+ * ServerResponse pair for the app. The response streams back as it is written
+ * (see serverResponse.ts). Requests that ask to upgrade (WebSockets) go to the
+ * `upgrade` listeners with a socket over the raw connection (upgradeSocket.ts).
  */
 import { EventEmitterBase } from '../events.js';
 import { Buffer } from '../buffer.js';
-import { Readable } from '../stream/readable.js';
-import { Writable } from '../stream/writable.js';
 import type { EventLoop } from '../loop.js';
-import type { HttpRequestData, HttpResponseData, System } from '../../system/types.js';
-import { STATUS_CODES } from './status.js';
+import type { ByteChannel, HttpRequestData, HttpStreamResponse, System } from '../../system/types.js';
+import { pushStream } from '../../system/httpStream.js';
+import { FakeSocket, IncomingMessage } from './messages.js';
+import { ServerResponse } from './serverResponse.js';
+import { UpgradeSocket } from './upgradeSocket.js';
 
-/** Enough of net.Socket for frameworks that read connection details. */
-export class FakeSocket extends EventEmitterBase {
-  remoteAddress = '127.0.0.1';
-  remotePort = 50000 + Math.floor(Math.random() * 10000);
-  remoteFamily = 'IPv4';
-  localAddress = '127.0.0.1';
-  localPort: number;
-  encrypted = false;
-  readable = true;
-  writable = true;
-  destroyed = false;
-  bytesRead = 0;
-  bytesWritten = 0;
-  constructor(port = 0) {
-    super();
-    this.localPort = port;
-  }
-  setTimeout(_ms: number, cb?: () => void): this { if (cb) this.once('timeout', cb); return this; }
-  setNoDelay(): this { return this; }
-  setKeepAlive(): this { return this; }
-  address() { return { address: this.localAddress, family: 'IPv4', port: this.localPort }; }
-  ref(): this { return this; }
-  unref(): this { return this; }
-  cork(): void {}
-  uncork(): void {}
-  write(): boolean { return true; }
-  end(): this { return this; }
-  destroy(): this {
-    this.destroyed = true;
-    return this;
-  }
-}
-
-function lowerHeaders(headers: Record<string, string>): { headers: Record<string, string | string[]>; raw: string[] } {
-  const out: Record<string, string | string[]> = {};
-  const raw: string[] = [];
-  for (const [key, value] of Object.entries(headers)) {
-    const k = key.toLowerCase();
-    raw.push(key, value);
-    out[k] = k === 'set-cookie' ? [value] : value;
-  }
-  return { headers: out, raw };
-}
-
-export class IncomingMessage extends Readable {
-  httpVersion = '1.1';
-  httpVersionMajor = 1;
-  httpVersionMinor = 1;
-  method?: string;
-  url?: string;
-  statusCode?: number;
-  statusMessage?: string;
-  headers: Record<string, string | string[]> = {};
-  rawHeaders: string[] = [];
-  trailers: Record<string, string> = {};
-  rawTrailers: string[] = [];
-  complete = false;
-  aborted = false;
-  socket: FakeSocket;
-  connection: FakeSocket;
-
-  constructor(socket: FakeSocket = new FakeSocket()) {
-    super();
-    this.socket = socket;
-    this.connection = socket;
-  }
-
-  override _read(): void {
-    // the body is pushed up front
-  }
-
-  setTimeout(_ms: number, cb?: () => void): this {
-    if (cb) this.once('timeout', cb);
-    return this;
-  }
-
-  /** Fill from wire data; `body` null means none. */
-  _fill(headers: Record<string, string>, body: Uint8Array | null): void {
-    const { headers: lower, raw } = lowerHeaders(headers);
-    this.headers = lower;
-    this.rawHeaders = raw;
-    if (body?.length) this.push(Buffer.from(body));
-    this.push(null);
-    this.complete = true;
-  }
-}
-
-export class OutgoingHeaders extends Writable {
-  protected _headers = new Map<string, { name: string; value: string | string[] }>();
-  headersSent = false;
-  sendDate = true;
-
-  setHeader(name: string, value: string | number | readonly string[]): this {
-    if (this.headersSent) throw Object.assign(new Error('Cannot set headers after they are sent to the client'), { code: 'ERR_HTTP_HEADERS_SENT' });
-    this._headers.set(name.toLowerCase(), { name, value: Array.isArray(value) ? value.map(String) : String(value) });
-    return this;
-  }
-  appendHeader(name: string, value: string | readonly string[]): this {
-    const existing = this.getHeader(name);
-    const list = [...(existing === undefined ? [] : Array.isArray(existing) ? existing : [String(existing)]), ...(Array.isArray(value) ? value : [value as string])];
-    return this.setHeader(name, list);
-  }
-  getHeader(name: string): string | string[] | undefined {
-    return this._headers.get(name.toLowerCase())?.value;
-  }
-  getHeaders(): Record<string, string | string[]> {
-    const out: Record<string, string | string[]> = Object.create(null);
-    for (const [key, { value }] of this._headers) out[key] = value;
-    return out;
-  }
-  getHeaderNames(): string[] {
-    return [...this._headers.keys()];
-  }
-  getRawHeaderNames(): string[] {
-    return [...this._headers.values()].map((h) => h.name);
-  }
-  hasHeader(name: string): boolean {
-    return this._headers.has(name.toLowerCase());
-  }
-  removeHeader(name: string): void {
-    this._headers.delete(name.toLowerCase());
-  }
-  flushHeaders(): void {
-    this.headersSent = true;
-  }
-  setTimeout(_ms: number, cb?: () => void): this {
-    if (cb) this.once('timeout', cb);
-    return this;
-  }
-}
-
-export class ServerResponse extends OutgoingHeaders {
-  statusCode = 200;
-  statusMessage = '';
-  req: IncomingMessage;
-  socket: FakeSocket;
-  connection: FakeSocket;
-  chunkedEncoding = false;
-  shouldKeepAlive = false;
-  private readonly chunks: Uint8Array[] = [];
-
-  constructor(req: IncomingMessage, private readonly onDone: (response: HttpResponseData) => void) {
-    super({ decodeStrings: true });
-    this.req = req;
-    this.socket = req.socket;
-    this.connection = req.socket;
-  }
-
-  get finished(): boolean {
-    return this.writableEnded;
-  }
-
-  writeHead(status: number, message?: string | Record<string, unknown> | unknown[], headers?: Record<string, unknown> | unknown[]): this {
-    if (typeof message !== 'string') [headers, message] = [message, undefined];
-    this.statusCode = status;
-    if (message) this.statusMessage = message;
-    if (Array.isArray(headers)) {
-      for (let i = 0; i + 1 < headers.length; i += 2) this.setHeader(String(headers[i]), headers[i + 1] as string);
-    } else if (headers) {
-      for (const [k, v] of Object.entries(headers)) if (v !== undefined) this.setHeader(k, v as string);
-    }
-    this.headersSent = true;
-    return this;
-  }
-  writeContinue(): void {}
-  writeProcessing(): void {}
-  writeEarlyHints(): void {}
-  addTrailers(): void {}
-  assignSocket(): void {}
-  detachSocket(): void {}
-
-  override _write(chunk: Uint8Array, _encoding: string, callback: () => void): void {
-    this.headersSent = true;
-    this.chunks.push(chunk);
-    callback();
-  }
-
-  override _final(callback: () => void): void {
-    this.headersSent = true;
-    const headers: Record<string, string | string[]> = {};
-    for (const { name, value } of this._headers.values()) headers[name] = value;
-    const body = Buffer.concat(this.chunks);
-    if (this.req.method === 'HEAD') this.chunks.length = 0;
-    this.onDone({ status: this.statusCode, statusText: this.statusMessage || STATUS_CODES[this.statusCode] || '', headers, body: this.req.method === 'HEAD' ? new Uint8Array() : body });
-    callback();
-  }
-}
+export { FakeSocket, IncomingMessage, OutgoingHeaders } from './messages.js';
+export { ServerResponse } from './serverResponse.js';
+export { UpgradeSocket } from './upgradeSocket.js';
 
 export interface ServerDeps {
   system: System;
@@ -228,7 +46,7 @@ export class Server extends EventEmitterBase {
     const port = typeof first === 'object' && first ? Number((first as { port?: number }).port ?? 0) : Number(first ?? 0);
     if (callback) this.once('listening', callback);
     try {
-      this.registration = this.deps.system.listen(port, (request) => this.handle(request));
+      this.registration = this.deps.system.listen(port, (request) => this.handle(request), (request, socket) => this.upgrade(request, socket));
     } catch (error) {
       queueMicrotask(() => this.emit('error', error));
       return this;
@@ -278,20 +96,29 @@ export class Server extends EventEmitterBase {
     cb(null, 0);
   }
 
-  private handle(request: HttpRequestData): Promise<HttpResponseData> {
+  private toIncoming(request: HttpRequestData, socket: FakeSocket, headers: Record<string, string>, body: Uint8Array | null): IncomingMessage {
+    const req = new IncomingMessage(socket);
+    req.method = request.method.toUpperCase();
+    req.url = request.url;
+    req._fill(headers, body);
+    return req;
+  }
+
+  private handle(request: HttpRequestData): Promise<HttpStreamResponse> {
     return new Promise((resolve) => {
-      const socket = new FakeSocket(this.registration?.port ?? 0);
-      const req = new IncomingMessage(socket);
-      req.method = request.method.toUpperCase();
-      req.url = request.url;
       // Body parsers (body-parser/type-is) only read a body announced by
       // content-length or transfer-encoding; a browser-originated request
       // relayed by the service worker carries neither.
       const headers = { ...request.headers };
       const announced = Object.keys(headers).some((k) => /^(content-length|transfer-encoding)$/i.test(k));
       if (!announced && request.body?.length) headers['content-length'] = String(request.body.length);
-      req._fill(headers, request.body);
-      const res = new ServerResponse(req, resolve);
+      const req = this.toIncoming(request, new FakeSocket(this.registration?.port ?? 0), headers, request.body);
+      const body = pushStream(() => this.deps.loop._run(() => res._hangUp()));
+      const res: ServerResponse = new ServerResponse(req, {
+        head: (head) => resolve({ ...head, body: body.stream }),
+        chunk: (data) => body.push(data),
+        end: () => body.end(),
+      });
       this.deps.loop._run(() => {
         try {
           this.emit('request', req, res);
@@ -305,4 +132,12 @@ export class Server extends EventEmitterBase {
       });
     });
   }
+
+  /** A connection asking to upgrade: Node destroys it when nobody listens for `upgrade`. */
+  private upgrade(request: HttpRequestData, channel: ByteChannel): void {
+    if (!this.listenerCount('upgrade')) return channel.close();
+    const socket = new UpgradeSocket(channel, this.registration?.port ?? 0, () => this.deps.loop.hold());
+    const req = this.toIncoming(request, socket as unknown as FakeSocket, request.headers, null);
+    this.deps.loop._run(() => this.emit('upgrade', req, socket, Buffer.alloc(0)));
+  }
 }