@velarscript/node 0.12.0 → 0.13.0

package/dist/http-runtime.js

@@ -144,6 +144,12 @@ function urlOf(value) {
   if (urlUsername(url) || urlPassword(url)) throw new NativeTypeError("HTTP URL credentials are not allowed; use an Authorization header");
   return urlHref(url);
 }
+// The transport owns message framing and routing, so an application header map
+// may never restate them: a caller-supplied content-length, transfer-encoding
+// or host lands on the wire beside the host's own framing and is a
+// request-smuggling primitive. Cookie and proxy credentials are ordinary
+// application headers here; they are forbidden only as secretHeader names.
+const transportOwnedHttpHeaders = setOf(["connection", "content-length", "expect", "host", "keep-alive", "proxy-connection", "te", "trailer", "transfer-encoding", "upgrade"]);
 function headersOf(value) {
   if (value == null) { requireHttpHost(); return new NativeMap(); }
   let size;
@@ -156,6 +162,9 @@ function headersOf(value) {
     if (typeof name !== "string" || typeof item !== "string" || !patternMatches(headerNamePattern, name) || patternMatches(lineBreakPattern, item)) {
       throw new NativeTypeError("HTTP headers must use valid string names and single-line values");
     }
+    if (call(nativeSetHas, transportOwnedHttpHeaders, [stringLower(name)])) {
+      throw new NativeTypeError("HTTP header '" + name + "' is transport-controlled");
+    }
     units += name.length + item.length;
     if (units > 65536) throw new NativeRangeError("HTTP headers cannot exceed 64 KiB");
     nativeReflectApply(nativeMapSet, output, [name, item]);
@@ -390,7 +399,7 @@ export class HttpTransportError extends NativeError {
     this.phase = phase;
   }
 }
-export class HttpError extends NativeError {
+export class HttpResponseError extends NativeError {
   constructor(message, status, url, body = null) {
     if (typeof message !== "string") throw new NativeTypeError("HTTP error message must be text");
     if (message.length > 65536) throw new NativeRangeError("HTTP error messages cannot exceed 64 KiB");
@@ -398,7 +407,7 @@ export class HttpError extends NativeError {
     if (typeof url !== "string") throw new NativeTypeError("HTTP error URL must be text");
     if (url.length > 2 * 1024 * 1024) throw new NativeRangeError("HTTP error URLs cannot exceed 2 MiB");
     super(message);
-    this.name = "HttpError";
+    this.name = "HttpResponseError";
     this.status = status;
     this.url = url;
     this.body = body;
@@ -409,7 +418,6 @@ class HttpResponse {
   constructor(response, request) {
     this.request = request;
     this.body = response.body;
-    this.ok = response.ok;
     this.status = response.status;
     this.statusText = response.statusText;
     this.url = response.url;
@@ -519,7 +527,7 @@ class HttpResponse {
     const text = await this.text();
     return parseJsonText(text);
   }
-  async parse(Type) { Type = runtimeHttpType(Type); return Type.parse(await this.json()); }
+  async parse(Type) { Type = runtimeHttpType(Type); return __velarJsonParseTyped(Type, await this.text(), "HTTP JSON text"); }
 }
 
 class Request {
@@ -579,12 +587,16 @@ class Request {
         const response = hostResponse(wire, this.handle);
         if (this.abortError) throw this.abortError;
         const wrapped = new HttpResponse(response, this);
-        if (!wrapped.ok) {
+        // D90 R20: the 2xx question is asked here and nowhere else. The
+        // transport snapshot still carries ok; the response an author holds
+        // does not, because by the time it is returned the answer is always
+        // yes.
+        if (!response.ok) {
           const text = await wrapped.text();
           let body = text;
           try { body = text ? parseJsonText(text) : null; } catch {}
           const errorUrl = wrapped.url || this.url;
-          throw new HttpError("HTTP " + wrapped.status + " for " + errorUrl, wrapped.status, errorUrl, body);
+          throw new HttpResponseError("HTTP " + wrapped.status + " for " + errorUrl, wrapped.status, errorUrl, body);
         }
         return wrapped;
       } catch (error) {
@@ -599,7 +611,7 @@ class Request {
   async bytes() { return (await this.response()).bytes(); }
   async json() { return (await this.response()).json(); }
   async streamText(consumer) { return (await this.response()).streamText(consumer); }
-  async parse(Type) { Type = runtimeHttpType(Type); return Type.parse(await this.json()); }
+  async parse(Type) { Type = runtimeHttpType(Type); return (await this.response()).parse(Type); }
   cancel() { this.abort("cancelled"); return null; }
 }
 

package/dist/http-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-runtime.js","sourceRoot":"","sources":["../src/http-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAE7H,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;EAI/C,yBAAyB;EACzB,2BAA2B;EAC3B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2lBnB,CAAC,SAAS,EAAE,CAAC"}
+{"version":3,"file":"http-runtime.js","sourceRoot":"","sources":["../src/http-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAE7H,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;EAI/C,yBAAyB;EACzB,2BAA2B;EAC3B,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAumBnB,CAAC,SAAS,EAAE,CAAC"}

package/dist/node-host-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-host-runtime.d.ts","sourceRoot":"","sources":["../src/node-host-runtime.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,uBAAuB,QAqUvB,CAAC"}
+{"version":3,"file":"node-host-runtime.d.ts","sourceRoot":"","sources":["../src/node-host-runtime.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,uBAAuB,QA4UvB,CAAC"}

package/dist/node-host-runtime.js

@@ -96,16 +96,22 @@ export class __velarNodeHostHttpTransportError extends __velarNodeHostError {
 const __velarNodeHostPathErrorClasses = __velarNodeHostObjectCreate(null);
 ${VELAR_HOST_ERROR_PATH_NAMES.map((name) => `__velarNodeHostPathErrorClasses[${JSON.stringify(name)}] = __Velar${name};`).join("\n")}
 
+// This function must never throw. Its caller runs inside the port handler,
+// whose catch latches the permanent host failure, closes the port and
+// terminates the worker, so one error record the proxy failed to enumerate
+// would brick velar/fs, velar/http and velar/serve for the whole process. An
+// unrecognised record rejects only its own request instead.
 function __velarNodeHostErrorOf(value, operation) {
-  value = __velarNodeHostRecord(value, "Node host error");
+  try { value = __velarNodeHostRecord(value, "Node host error"); }
+  catch { return new __velarNodeHostTypeError("Node host returned an invalid error"); }
   if (typeof value.message !== "string" || value.message.length === 0 || value.message.length > 65536) {
-    throw new __velarNodeHostTypeError("Node host returned an invalid error");
+    return new __velarNodeHostTypeError("Node host returned an invalid error");
   }
   if (value.name === "HttpTransportError") {
-    if ((operation !== "http.request" && operation !== "http.read")
+    if ((operation !== "http.request" && operation !== "http.read" && operation !== "http.readBytes")
       || (value.phase !== "request" && value.phase !== "response")
       || (operation === "http.request" ? value.phase !== "request" : value.phase !== "response")) {
-      throw new __velarNodeHostTypeError("Node host returned an invalid HTTP transport error");
+      return new __velarNodeHostTypeError("Node host returned an invalid HTTP transport error");
     }
     return new __velarNodeHostHttpTransportError(value.message, value.phase);
   }
@@ -115,7 +121,7 @@ function __velarNodeHostErrorOf(value, operation) {
   const pathed = __velarNodeHostPathErrorClasses[value.name];
   if (pathed) {
     if (typeof value.path !== "string" || value.path.length > 65536) {
-      throw new __velarNodeHostTypeError("Node host returned an invalid error path");
+      return new __velarNodeHostTypeError("Node host returned an invalid error path");
     }
     return new pathed(value.message, value.path.length > 0 ? value.path : null);
   }
@@ -123,7 +129,7 @@ function __velarNodeHostErrorOf(value, operation) {
   if (value.name === "RangeError") return new __velarNodeHostRangeError(value.message);
   if (value.name === "TypeError") return new __velarNodeHostTypeError(value.message);
   if (value.name === "Error") return new __velarNodeHostError(value.message);
-  throw new __velarNodeHostTypeError("Node host returned an invalid error");
+  return new __velarNodeHostTypeError("Node host returned an invalid error");
 }
 
 function __velarNodeHostUpdateReference() {
@@ -300,7 +306,8 @@ export function __velarNodeHostInvoke(operation, args) {
   if (__velarNodeHostFailure) return new __velarNodeHostPromise((_resolve, reject) => reject(__velarNodeHostFailure));
   const id = __velarNodeHostRequestId();
   return new __velarNodeHostPromise((resolve, reject) => {
-    const handle = operation === "http.request" || operation === "http.read" || operation === "http.cancel" || operation === "http.close"
+    const handle = operation === "http.request" || operation === "http.read" || operation === "http.readBytes"
+      || operation === "http.cancel" || operation === "http.close"
       || operation === "fs.watchNext" || operation === "fs.watchClose"
       ? args[0]
       : null;

package/dist/node-host-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-host-runtime.js","sourceRoot":"","sources":["../src/node-host-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAExI,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,GAAG,CAAA;WACtC,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,gCAAgC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4FhJ,2BAA2B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwOnI,CAAC,SAAS,EAAE,CAAC"}
+{"version":3,"file":"node-host-runtime.js","sourceRoot":"","sources":["../src/node-host-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAExI,8EAA8E;AAC9E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC,GAAG,CAAA;WACtC,sBAAsB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,gCAAgC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4FhJ,2BAA2B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mCAAmC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+OnI,CAAC,SAAS,EAAE,CAAC"}

package/dist/node-host-worker-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node-host-worker-runtime.d.ts","sourceRoot":"","sources":["../src/node-host-worker-runtime.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,6BAA6B,QAqgD7B,CAAC"}
+{"version":3,"file":"node-host-worker-runtime.d.ts","sourceRoot":"","sources":["../src/node-host-worker-runtime.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,6BAA6B,QAiiD7B,CAAC"}

package/dist/node-host-worker-runtime.js

@@ -7,7 +7,7 @@ import { createReadStream, watch as watchNode } from "node:fs";
 import { appendFile, copyFile, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { createServer, request as createHttpRequest } from "node:http";
 import { request as createHttpsRequest } from "node:https";
-import { basename, dirname, extname, isAbsolute, relative, resolve } from "node:path";
+import { basename, dirname, extname, isAbsolute, relative, resolve, sep } from "node:path";
 import { URL as NodeURL } from "node:url";
 import { brotliCompress as brotliCompressNode, gzip as gzipNode } from "node:zlib";
 import { promisify } from "node:util";
@@ -87,10 +87,18 @@ function advanceHandle(handle) {
   return handle >= Number.MAX_SAFE_INTEGER ? 1 : handle + 1;
 }
 
+// Exhausting the aggregate budget is a temporary load condition, not a server
+// fault: admission already answers it with 503 at rejectIncomingRequest, and a
+// response that cannot be reserved now gets the same answer instead of the
+// opaque 500 that every other late failure gets. The identity is a class rather
+// than the message so the send path can tell it apart from a genuine fault.
+class ServeBudgetError extends RangeError {
+  constructor() { super("Node serve aggregate byte budget is exhausted"); }
+}
+
 function reserveServeBytes(task, bytes) {
-  if (!Number.isSafeInteger(bytes) || bytes < 0 || reservedServeBytes + bytes > maxServeAggregateBytes) {
-    throw new RangeError("Node serve aggregate byte budget is exhausted");
-  }
+  if (!Number.isSafeInteger(bytes) || bytes < 0) throw new RangeError("Node serve byte reservation must be a non-negative integer");
+  if (reservedServeBytes + bytes > maxServeAggregateBytes) throw new ServeBudgetError();
   reservedServeBytes += bytes;
   task.reservedBytes += bytes;
 }
@@ -104,9 +112,8 @@ function releaseServeBytes(task, bytes = task.reservedBytes) {
 }
 
 function reserveTransientServeBytes(bytes) {
-  if (!Number.isSafeInteger(bytes) || bytes < 0 || reservedServeBytes + bytes > maxServeAggregateBytes) {
-    throw new RangeError("Node serve aggregate byte budget is exhausted");
-  }
+  if (!Number.isSafeInteger(bytes) || bytes < 0) throw new RangeError("Node serve byte reservation must be a non-negative integer");
+  if (reservedServeBytes + bytes > maxServeAggregateBytes) throw new ServeBudgetError();
   reservedServeBytes += bytes;
 }
 
@@ -425,6 +432,15 @@ const forbiddenHttpSecretHeaders = new Set([
   "connection", "content-length", "cookie", "cookie2", "host", "proxy-authorization",
   "te", "trailer", "transfer-encoding", "upgrade",
 ]);
+// Framing and routing belong to the transport, not to the caller. An
+// application that could set these beside Node's own framing could put two
+// disagreeing lengths, a second encoding, or a forged authority on the wire.
+// Credential names stay legal here: they are the caller's to send, and remain
+// forbidden only for the secret-header path above.
+const transportOwnedHttpHeaders = new Set([
+  "connection", "content-length", "expect", "host", "keep-alive", "proxy-connection",
+  "te", "trailer", "transfer-encoding", "upgrade",
+]);
 
 function httpMethod(value) {
   if (typeof value !== "string") throw new TypeError("HTTP method must be text");
@@ -458,6 +474,7 @@ function httpHeaderRecord(value) {
       || !httpHeaderNamePattern.test(pair[0]) || httpLineBreakPattern.test(pair[1])) {
       throw new TypeError("HTTP headers must use valid string names and single-line values");
     }
+    if (transportOwnedHttpHeaders.has(pair[0].toLowerCase())) throw new TypeError("HTTP header '" + pair[0] + "' is transport-controlled");
     units += pair[0].length + pair[1].length;
     if (units > 65536) throw new RangeError("HTTP headers cannot exceed 64 KiB");
     headers[pair[0].toLowerCase()] = pair[1];
@@ -732,8 +749,12 @@ function requestPath(value) {
 }
 
 function inside(root, target) {
+  // relative() emits ".." only as a whole segment, so the escape test compares
+  // whole segments too: a prefix test also rejects an ordinary top-level file
+  // whose own name begins with two dots. The separator is the platform's,
+  // because relative() writes an escape with a backslash on Windows.
   const path = relative(root, target);
-  return path === "" || !path.startsWith("..") && !isAbsolute(path);
+  return path === "" || path !== ".." && !path.startsWith(".." + sep) && !isAbsolute(path);
 }
 
 async function staticFile(rootValue, pathValue, fallbackValue) {
@@ -864,6 +885,15 @@ function responseHasNoBody(task, status) {
   return task.request.method === "HEAD" || status >= 100 && status < 200 || status === 204 || status === 304;
 }
 
+async function shedServeResponse(task) {
+  task.response.statusCode = 503;
+  task.response.setHeader("Retry-After", "1");
+  task.response.setHeader("Content-Type", "application/json; charset=utf-8");
+  await endServeResponse(task, responseHasNoBody(task, 503) ? undefined : '{"error":"outbound_budget_exhausted"}');
+  completeRequest(task);
+  return null;
+}
+
 async function endServeResponse(task, value) {
   await new Promise((resolveEnd, rejectEnd) => {
     let settled = false;
@@ -893,27 +923,19 @@ function rawBodyOf(task, maximum) {
         return {data: null, bytes: maximum, tooLarge: true};
       }
     }
-    if (declared !== null) {
-      const output = Buffer.allocUnsafe(declared);
-      reserveServeBytes(task, declared);
-      let offset = 0;
-      try {
-        for await (const chunk of task.request) {
-          const data = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
-          if (offset + data.byteLength > declared) { task.request.resume(); releaseServeBytes(task, declared); return {data: null, bytes: maximum, tooLarge: true}; }
-          data.copy(output, offset);
-          offset += data.byteLength;
-        }
-        if (offset !== declared) throw new TypeError("Request body length does not match Content-Length");
-        return {data: output, bytes: declared, tooLarge: false};
-      } catch (error) { if (task.reservedBytes >= declared) releaseServeBytes(task, declared); throw error; }
-    }
+    // A declared Content-Length is a client claim, not a delivered body, so it
+    // buys no allocation and no budget reservation up front: a header-only
+    // socket that declares 16 MiB and sends nothing would otherwise spend the
+    // process-global aggregate budget for the whole request timeout. The
+    // declaration is only the effective ceiling; the bytes that actually arrive
+    // are charged as they arrive.
+    const limit = declared === null ? maximum : declared;
     const chunks = [];
     let total = 0;
     try {
       for await (const chunk of task.request) {
         const data = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
-        if (total + data.byteLength > maximum) {
+        if (total + data.byteLength > limit) {
           task.request.resume();
           releaseServeBytes(task, total);
           return {data: null, bytes: maximum, tooLarge: true};
@@ -922,6 +944,7 @@ function rawBodyOf(task, maximum) {
         total += data.byteLength;
         chunks.push(data);
       }
+      if (declared !== null && total !== declared) throw new TypeError("Request body length does not match Content-Length");
       reserveTransientServeBytes(total);
       try { return {data: Buffer.concat(chunks, total), bytes: total, tooLarge: false}; }
       finally { releaseTransientServeBytes(total); }
@@ -1354,14 +1377,19 @@ async function dispatch(operation, args) {
       if (compression !== null && compression !== "gzip" && compression !== "br") throw new TypeError("ServeResponse compression is invalid");
       const suppressBody = responseHasNoBody(task, status);
       let output = body;
-      if (!suppressBody && compression !== null) {
-        const inputBytes = Buffer.byteLength(body, "utf8");
-        reserveTransientServeBytes(inputBytes * 2);
-        try { output = await (compression === "br" ? brotliCompress(body) : gzip(body)); }
-        finally { releaseTransientServeBytes(inputBytes * 2); }
-        if (output.byteLength > maxServeBodyBytes) throw new RangeError("Compressed ServeResponse exceeds 16 MiB");
+      try {
+        if (!suppressBody && compression !== null) {
+          const inputBytes = Buffer.byteLength(body, "utf8");
+          reserveTransientServeBytes(inputBytes * 2);
+          try { output = await (compression === "br" ? brotliCompress(body) : gzip(body)); }
+          finally { releaseTransientServeBytes(inputBytes * 2); }
+          if (output.byteLength > maxServeBodyBytes) throw new RangeError("Compressed ServeResponse exceeds 16 MiB");
+        }
+        if (!suppressBody) reserveServeBytes(task, typeof output === "string" ? Buffer.byteLength(output, "utf8") : output.byteLength);
+      } catch (error) {
+        if (!(error instanceof ServeBudgetError)) throw error;
+        return await shedServeResponse(task);
       }
-      if (!suppressBody) reserveServeBytes(task, typeof output === "string" ? Buffer.byteLength(output, "utf8") : output.byteLength);
       task.response.statusCode = status;
       setHeaders(task.response, headers, cookies);
       if (!task.response.hasHeader("Content-Type") && (task.request.method === "HEAD" || !suppressBody)) {

package/dist/node-host-worker-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"node-host-worker-runtime.js","sourceRoot":"","sources":["../src/node-host-worker-runtime.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,iFAAiF;AACjF,yEAAyE;AACzE,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqgDtD,CAAC,SAAS,EAAE,CAAC"}
+{"version":3,"file":"node-host-worker-runtime.js","sourceRoot":"","sources":["../src/node-host-worker-runtime.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,iFAAiF;AACjF,yEAAyE;AACzE,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiiDtD,CAAC,SAAS,EAAE,CAAC"}

package/dist/project-config.d.ts

@@ -1,5 +1,5 @@
 export interface VelarNodeConfig {
-    /** Exported ServeApp value in the project entry module. */
+    /** Exported ServeApp or checked WebSocket startup function in the project entry module. */
     readonly app: string;
     readonly host: string;
     readonly port: number;

package/dist/project-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-config.d.ts","sourceRoot":"","sources":["../src/project-config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;KAC9B,CAAC;CACH;AAED,eAAO,MAAM,qBAAqB;;;iBAGnB,OAAO,gBAAgB,MAAM,GAAG,eAAe;EAG5D,CAAC"}
+{"version":3,"file":"project-config.d.ts","sourceRoot":"","sources":["../src/project-config.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,2FAA2F;IAC3F,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;KAC9B,CAAC;CACH;AAED,eAAO,MAAM,qBAAqB;;;iBAGnB,OAAO,gBAAgB,MAAM,GAAG,eAAe;EAG5D,CAAC"}

package/dist/route-shape.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Folds a route path's pre-split segments into its shape: every `{name:type}`
+ * capture collapses to `{}` and every literal segment stays itself, so two
+ * paths share a shape exactly when a request cannot tell them apart by
+ * position. The body uses only indexed access, `.length` and primitive string
+ * concatenation — no method lookups — because the serve runtime embeds this
+ * exact source inside its hardened primordial Realm, where prototypes are
+ * assumed hostile. Callers split on "/" themselves with whatever split they
+ * trust.
+ */
+export declare function routeShapeFromSegments(segments: readonly string[]): string;
+/**
+ * The same definition as JavaScript source, for the serve runtime template.
+ * Deriving it from the compiled function keeps the rule written once: editing
+ * `routeShapeFromSegments` edits both referees.
+ */
+export declare const ROUTE_SHAPE_FROM_SEGMENTS_SOURCE: string;
+/** The shape of a full route path, for callers outside the hardened Realm. */
+export declare function routeShape(path: string): string;
+//# sourceMappingURL=route-shape.d.ts.map

package/dist/route-shape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-shape.d.ts","sourceRoot":"","sources":["../src/route-shape.ts"],"names":[],"mappings":"AAOA;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAQ1E;AAED;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,MAA0C,CAAC;AAE1F,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE/C"}

package/dist/route-shape.js

@@ -0,0 +1,36 @@
+// D90 R19(c): the shape of a route — its method-independent collision key — is
+// one concept, so it has exactly one definition. The static analyzer imports
+// the function below; the velar/serve runtime interpolates its source into the
+// emitted module. Two referees, one rule: a shape the compiler and the
+// assembly check disagree about is the defect class this file exists to
+// prevent.
+/**
+ * Folds a route path's pre-split segments into its shape: every `{name:type}`
+ * capture collapses to `{}` and every literal segment stays itself, so two
+ * paths share a shape exactly when a request cannot tell them apart by
+ * position. The body uses only indexed access, `.length` and primitive string
+ * concatenation — no method lookups — because the serve runtime embeds this
+ * exact source inside its hardened primordial Realm, where prototypes are
+ * assumed hostile. Callers split on "/" themselves with whatever split they
+ * trust.
+ */
+export function routeShapeFromSegments(segments) {
+    let shape = "";
+    for (let index = 0; index < segments.length; index += 1) {
+        const segment = segments[index];
+        const capture = segment !== undefined && segment[0] === "{" && segment[segment.length - 1] === "}";
+        shape += (index === 0 ? "" : "/") + (capture ? "{}" : segment);
+    }
+    return shape;
+}
+/**
+ * The same definition as JavaScript source, for the serve runtime template.
+ * Deriving it from the compiled function keeps the rule written once: editing
+ * `routeShapeFromSegments` edits both referees.
+ */
+export const ROUTE_SHAPE_FROM_SEGMENTS_SOURCE = routeShapeFromSegments.toString();
+/** The shape of a full route path, for callers outside the hardened Realm. */
+export function routeShape(path) {
+    return routeShapeFromSegments(path.split("/"));
+}
+//# sourceMappingURL=route-shape.js.map

package/dist/route-shape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-shape.js","sourceRoot":"","sources":["../src/route-shape.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,uEAAuE;AACvE,wEAAwE;AACxE,WAAW;AAEX;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAA2B;IAChE,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;QACnG,KAAK,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAW,sBAAsB,CAAC,QAAQ,EAAE,CAAC;AAE1F,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/serve-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve-runtime.d.ts","sourceRoot":"","sources":["../src/serve-runtime.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,wBAAwB,QAknGxB,CAAC"}
+{"version":3,"file":"serve-runtime.d.ts","sourceRoot":"","sources":["../src/serve-runtime.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,wBAAwB,QAq3GxB,CAAC"}