@vesk/adapter 0.2.70 → 0.2.71

package/dist/dev-server.d.ts

@@ -19,9 +19,6 @@ export interface DevHmrState {
 }
 /** Default state when no HMR provider is available (no server). */
 export declare function defaultDevHmrState(): DevHmrState;
-export declare function bodyTooLarge(maxBytes: number): Error & {
-    status: number;
-};
 export interface DevPanelResponse {
     status: number;
     headers: Record<string, string>;

package/dist/dev-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AASjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAM7C,OAAO,KAAK,EAAa,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAgBjG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;IAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB;+EAC2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAuCD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAkBD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B;;8BAE0B;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,WAAW,CAAC;IAChC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChH,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrD;AA8CD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAorBvG"}
+{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AASjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAO7C,OAAO,KAAK,EAAa,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAgBjG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;IAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB;+EAC2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAgDD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B;;8BAE0B;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,WAAW,CAAC;IAChC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChH,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrD;AAUD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAorBvG"}

package/dist/dev-server.js

@@ -14,6 +14,7 @@ import { resolveRuntimeErrorPayload, renderDevErrorPage } from './ssr-error';
 import { renderDefaultNotFoundPage, renderDefaultErrorPage } from '@vesk/adapter/src/default-pages';
 import { buildTreeShakenRuntime, runtimeExportNames } from '@vesk/adapter/src/client-bundle';
 import { resolveWithin, installMdReadHook } from '@vesk/adapter/src/paths';
+import { makeWebRequest, bodyTooLarge } from '@vesk/adapter/src/web-request';
 import { getPluginRecords } from './plugins';
 // @vesk/agentic — optional AI plugin; gated by active state if installed
 import { createAgentRouter } from '@vesk/agentic/src/dev-api';
@@ -58,11 +59,6 @@ async function deliverResponse(res, response) {
     }
     res.end(await response.text());
 }
-export function bodyTooLarge(maxBytes) {
-    const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
-    err.status = 413;
-    return err;
-}
 function errorStatus(e, fallback) {
     const s = e?.status ?? e?.statusCode;
     return typeof s === 'number' && s >= 400 && s < 600 ? s : fallback;
@@ -149,49 +145,6 @@ export function injectDevScripts(html) {
     const scripts = '\t<script type="module" src="/_vesk/hmr.js"></script>\n' + devBootstrapScript() + '\n';
     return html.replace('</body>', scripts + '</body>');
 }
-function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
-    const parsedUrl = new URL(url, `http://${nodeReq.headers.host || 'localhost'}`);
-    const method = nodeReq.method || 'GET';
-    let _bodyBuffer = null;
-    async function getBody() {
-        if (_bodyBuffer)
-            return _bodyBuffer;
-        const chunks = [];
-        let total = 0;
-        for await (const chunk of nodeReq) {
-            total += chunk.byteLength;
-            if (total > maxBodyBytes)
-                throw bodyTooLarge(maxBodyBytes);
-            chunks.push(Buffer.from(chunk));
-        }
-        _bodyBuffer = Buffer.concat(chunks);
-        return _bodyBuffer;
-    }
-    const webRequest = new Request(parsedUrl, { method, headers: nodeReq.headers, body: null });
-    webRequest.json = async () => { try {
-        return JSON.parse((await getBody()).toString());
-    }
-    catch {
-        return null;
-    } };
-    webRequest.text = async () => (await getBody()).toString('utf-8');
-    webRequest.formData = async () => {
-        const body = await getBody();
-        const ct = String(nodeReq.headers['content-type'] || '');
-        if (ct.includes('multipart/form-data')) {
-            const temp = new Request('http://localhost', { method: 'POST', headers: nodeReq.headers, body: body });
-            return temp.formData();
-        }
-        const fd = new FormData();
-        if (ct.includes('x-www-form-urlencoded')) {
-            for (const [k, v] of new URLSearchParams(body.toString()).entries())
-                fd.append(k, v);
-        }
-        return fd;
-    };
-    webRequest.clone = () => webRequest;
-    return webRequest;
-}
 const MIME = {
     '.svg': 'image/svg+xml', '.css': 'text/css', '.js': 'application/javascript',
     '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',

package/dist/prod-server.d.ts

@@ -1,8 +1,5 @@
 import { type Server } from 'node:http';
 import type { CompressionConfig, ProdServerOptions } from '@vesk/adapter/src/types';
-export declare function bodyTooLarge(maxBytes: number): Error & {
-    status: number;
-};
 export declare function startProdServer(outDir: string, options?: ProdServerOptions & {
     compression?: CompressionConfig | false;
     healthCheck?: boolean;

package/dist/prod-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAcjG,OAAO,KAAK,EAAkB,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAuFpG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AA0FD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG;IAAE,WAAW,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6mBvK"}
+{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAejG,OAAO,KAAK,EAAkB,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAyHpG,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG;IAAE,WAAW,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwoBvK"}

package/dist/prod-server.js

@@ -13,6 +13,7 @@ import { loadVeskConfig } from '@vesk/adapter/src/load-config';
 import { renderDefaultNotFoundPage, renderDefaultErrorPage } from '@vesk/adapter/src/default-pages';
 import { installResponsePipeline } from '@vesk/adapter/src/response-pipeline';
 import { resolveBoundaryFileForUrl } from '@vesk/adapter/src/ssr-function';
+import { makeWebRequest, bodyTooLarge } from '@vesk/adapter/src/web-request';
 import { mimeFor } from '@vesk/adapter/src/platform-output';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 async function readBody(req, maxBytes = DEFAULT_MAX_BODY_BYTES) {
@@ -102,69 +103,10 @@ function pumpRemaining(res, reader) {
         res.end();
     })();
 }
-export function bodyTooLarge(maxBytes) {
-    const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
-    err.status = 413;
-    return err;
-}
 function errorStatus(e, fallback) {
     const s = e?.status ?? e?.statusCode;
     return typeof s === 'number' && s >= 400 && s < 600 ? s : fallback;
 }
-function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
-    const parsedUrl = new URL(url, `http://${nodeReq.headers.host || 'localhost'}`);
-    const method = nodeReq.method || 'GET';
-    let _bodyBuffer = null;
-    async function getBody() {
-        if (_bodyBuffer)
-            return _bodyBuffer;
-        const chunks = [];
-        let total = 0;
-        for await (const chunk of nodeReq) {
-            total += chunk.byteLength;
-            if (total > maxBodyBytes)
-                throw bodyTooLarge(maxBodyBytes);
-            chunks.push(Buffer.from(chunk));
-        }
-        _bodyBuffer = Buffer.concat(chunks);
-        return _bodyBuffer;
-    }
-    const webRequest = new Request(parsedUrl, { method, headers: nodeReq.headers, body: null });
-    webRequest.json = async () => { try {
-        return JSON.parse((await getBody()).toString());
-    }
-    catch {
-        return null;
-    } };
-    webRequest.text = async () => (await getBody()).toString('utf-8');
-    webRequest.formData = async () => {
-        const body = await getBody();
-        const ct = String(nodeReq.headers['content-type'] || '');
-        if (ct.includes('multipart/form-data')) {
-            const temp = new Request('http://localhost', { method: 'POST', headers: nodeReq.headers, body: body });
-            return temp.formData();
-        }
-        const fd = new FormData();
-        if (ct.includes('x-www-form-urlencoded')) {
-            for (const [k, v] of new URLSearchParams(body.toString()).entries())
-                fd.append(k, v);
-        }
-        return fd;
-    };
-    webRequest.clone = () => webRequest;
-    const cookies = {};
-    for (const [k, v] of String(nodeReq.headers.cookie || '').split(';').map(s => s.trim()).filter(Boolean)) {
-        const eq = k.indexOf('=');
-        if (eq > -1)
-            cookies[k.slice(0, eq)] = decodeURIComponent(k.slice(eq + 1));
-    }
-    webRequest.cookies = cookies;
-    const query = {};
-    for (const [k, v] of parsedUrl.searchParams.entries())
-        query[k] = v;
-    webRequest.query = query;
-    return webRequest;
-}
 export async function startProdServer(outDir, options) {
     const port = options?.port || 3000;
     const host = options?.host || '127.0.0.1';
@@ -253,9 +195,26 @@ export async function startProdServer(outDir, options) {
         }
     }
     const functionCache = new Map();
+    /** Import failures, kept so the same broken module is not re-imported per request. */
+    const functionFailures = new Map();
+    /**
+     * Load a generated function module.
+     *
+     * Returns null both for "no such file" and for "the file exists but could not
+     * be imported", and the caller cannot tell them apart — which turned a route
+     * with a bad import into a **404 with no diagnostic anywhere**. A missing
+     * export or an unresolvable dependency is a build bug, and the only evidence
+     * was an empty 404. `functionFailure` records what happened so the request
+     * path can answer 500 and log it, which is what a broken route is.
+     */
+    function functionFailure(funcPath) {
+        return functionFailures.get(funcPath);
+    }
     async function loadFunction(funcPath) {
         if (functionCache.has(funcPath))
             return functionCache.get(funcPath);
+        if (functionFailures.has(funcPath))
+            return null;
         const fullPath = resolve(outDir, funcPath);
         if (!existsSync(fullPath))
             return null;
@@ -264,7 +223,9 @@ export async function startProdServer(outDir, options) {
             functionCache.set(funcPath, mod);
             return mod;
         }
-        catch {
+        catch (e) {
+            console.error(`vesk start: failed to load ${funcPath}:`, e instanceof Error ? e.message : e);
+            functionFailures.set(funcPath, e);
             return null;
         }
     }
@@ -579,19 +540,27 @@ export async function startProdServer(outDir, options) {
                     const params = matchPath(route.path, url.pathname);
                     if (params) {
                         const mod = await loadFunction(route.function);
-                        if (mod) {
-                            try {
-                                const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
-                                const response = await withSecurityScope(() => mod.handle(webRequest));
-                                await deliverResponse(res, response);
-                                return;
-                            }
-                            catch (e) {
-                                const status = errorStatus(e, 500);
-                                res.writeHead(status, { 'Content-Type': 'application/json' });
-                                res.end(JSON.stringify({ error: status === 500 ? 'Internal Server Error' : e instanceof Error ? e.message : String(e) }));
+                        if (!mod) {
+                            // The route matched, so a 404 would be a lie: the handler is
+                            // there and could not be loaded.
+                            if (functionFailure(route.function)) {
+                                res.writeHead(500, { 'Content-Type': 'application/json' });
+                                res.end(JSON.stringify({ error: 'Internal Server Error' }));
                                 return;
                             }
+                            continue;
+                        }
+                        try {
+                            const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
+                            const response = await withSecurityScope(() => mod.handle(webRequest));
+                            await deliverResponse(res, response);
+                            return;
+                        }
+                        catch (e) {
+                            const status = errorStatus(e, 500);
+                            res.writeHead(status, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: status === 500 ? 'Internal Server Error' : e instanceof Error ? e.message : String(e) }));
+                            return;
                         }
                     }
                 }

package/dist/web-request.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The `Request` handed to API routes and server actions.
+ *
+ * One implementation, used by both the dev and production servers. They each
+ * carried an identical copy until this existed, which is how the same defect sat
+ * in both: the shim built its `Request` with `body: null` and supplied only
+ * whole-body readers (`text()`, `json()`, `formData()`). Anything reading
+ * `request.body` — which is every streaming parser, including
+ * `@vesk/plugin-multipart` — saw no body at all and failed with `NO_BODY`.
+ * That is the difference between an upload handler that works and one that
+ * 400s on every request, so the body is now a real stream.
+ *
+ * The stream is created LAZILY, on first access to `request.body`. Attaching
+ * `data` listeners eagerly would start draining every GET body in the process,
+ * and a GET that never asked for its body would still be read.
+ *
+ * Reading is single-pass by definition, so both access patterns have to work on
+ * one socket: every byte that flows through the stream is cached, and
+ * `text()`/`json()`/`formData()` serve from that cache if the stream has already
+ * been taken. A handler that reads `request.body` and then calls
+ * `request.text()` gets the body once, not a hang.
+ */
+import type { IncomingMessage } from 'node:http';
+export interface ExtendedRequest extends Request {
+    json(): Promise<unknown>;
+    text(): Promise<string>;
+    formData(): Promise<FormData>;
+    clone(): ExtendedRequest;
+    cookies: Record<string, string>;
+    query: Record<string, string>;
+}
+export declare function bodyTooLarge(maxBytes: number): Error & {
+    status: number;
+};
+export declare function makeWebRequest(nodeReq: IncomingMessage, url: string, maxBodyBytes?: number): ExtendedRequest;
+//# sourceMappingURL=web-request.d.ts.map

package/dist/web-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-request.d.ts","sourceRoot":"","sources":["../src/web-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAIjD,MAAM,WAAW,eAAgB,SAAQ,OAAO;IAC9C,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,KAAK,IAAI,eAAe,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,EACX,YAAY,GAAE,MAA+B,GAC5C,eAAe,CAwIjB"}

package/dist/web-request.js

@@ -0,0 +1,165 @@
+import { Buffer } from 'node:buffer';
+import { DEFAULT_MAX_BODY_BYTES } from '@vesk/compiler/src/server-codegen';
+export function bodyTooLarge(maxBytes) {
+    const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
+    err.status = 413;
+    return err;
+}
+export function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
+    const parsedUrl = new URL(url, `http://${nodeReq.headers.host || 'localhost'}`);
+    const method = nodeReq.method || 'GET';
+    let cachedBody = null;
+    let streamTaken = false;
+    let streamEnded = false;
+    const endWaiters = [];
+    const settleEnd = (body) => {
+        if (body !== null)
+            cachedBody = body;
+        streamEnded = true;
+        for (const resolve of endWaiters.splice(0))
+            resolve();
+    };
+    function createBodyStream() {
+        streamTaken = true;
+        const cache = [];
+        let total = 0;
+        return new ReadableStream({
+            start(controller) {
+                nodeReq.on('data', (chunk) => {
+                    total += chunk.length;
+                    if (total > maxBodyBytes) {
+                        // Same cap the buffered readers enforce, checked as the bytes arrive
+                        // so an oversized upload is refused mid-body rather than after the
+                        // last byte has been read and held in memory.
+                        settleEnd(Buffer.concat(cache));
+                        cache.length = 0;
+                        try {
+                            controller.error(bodyTooLarge(maxBodyBytes));
+                        }
+                        catch { /* already settled */ }
+                        nodeReq.destroy();
+                        return;
+                    }
+                    cache.push(chunk);
+                    try {
+                        controller.enqueue(new Uint8Array(chunk));
+                    }
+                    catch { /* consumer cancelled */ }
+                });
+                nodeReq.on('end', () => {
+                    settleEnd(Buffer.concat(cache));
+                    cache.length = 0;
+                    try {
+                        controller.close();
+                    }
+                    catch { /* errored */ }
+                });
+                nodeReq.on('error', (e) => {
+                    settleEnd(Buffer.concat(cache));
+                    cache.length = 0;
+                    try {
+                        controller.error(e);
+                    }
+                    catch { /* already settled */ }
+                });
+            },
+        });
+    }
+    async function getBody() {
+        if (cachedBody)
+            return cachedBody;
+        if (streamTaken) {
+            // The stream is the reader now. Everything it has seen is in the cache,
+            // and it settles on 'end' — so wait rather than racing an empty read.
+            while (!streamEnded)
+                await new Promise(r => endWaiters.push(r));
+            return cachedBody || Buffer.alloc(0);
+        }
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of nodeReq) {
+            total += chunk.byteLength;
+            if (total > maxBodyBytes)
+                throw bodyTooLarge(maxBodyBytes);
+            chunks.push(Buffer.from(chunk));
+        }
+        cachedBody = Buffer.concat(chunks);
+        return cachedBody;
+    }
+    const webRequest = new Request(parsedUrl, {
+        method,
+        headers: nodeReq.headers,
+        body: null,
+    });
+    // Shadow the prototype's `body` getter with a lazily-created stream over the
+    // Node request. An own accessor on the instance wins over the prototype one,
+    // which is the only reason this works without a Node-specific Request class.
+    let bodyStream = null;
+    Object.defineProperty(webRequest, 'body', {
+        configurable: true,
+        enumerable: false,
+        get: () => {
+            if (bodyStream)
+                return bodyStream;
+            // `new Request(..., { body: null })` reports null for GET/HEAD, which is
+            // correct; only a request that can carry a body needs a stream.
+            if (method === 'GET' || method === 'HEAD')
+                return null;
+            bodyStream = createBodyStream();
+            return bodyStream;
+        },
+    });
+    webRequest.json = async () => { try {
+        return JSON.parse((await getBody()).toString());
+    }
+    catch {
+        return null;
+    } };
+    webRequest.text = async () => (await getBody()).toString('utf-8');
+    webRequest.formData = async () => {
+        const body = await getBody();
+        const ct = String(nodeReq.headers['content-type'] || '');
+        if (ct.includes('multipart/form-data')) {
+            const temp = new Request('http://localhost', { method: 'POST', headers: nodeReq.headers, body: body });
+            return temp.formData();
+        }
+        const fd = new FormData();
+        if (ct.includes('x-www-form-urlencoded')) {
+            for (const [k, v] of new URLSearchParams(body.toString()).entries())
+                fd.append(k, v);
+        }
+        return fd;
+    };
+    webRequest.clone = () => webRequest;
+    const cookies = {};
+    // Iterate the pieces, do NOT destructure them. `cookie.split(';')` yields an
+    // array of STRINGS, and a string is iterable, so `for (const [k, v] of …)`
+    // bound `k` to the first CHARACTER of the pair ('s' of "session=…"),
+    // `indexOf('=')` was always -1, and the loop never populated anything.
+    // `request.cookies` has therefore been `{}` in every production request that
+    // ever read it. The `[k, v]` form is right for `searchParams.entries()`,
+    // which really does yield pairs — which is why the bug survived next to
+    // working code.
+    for (const part of String(nodeReq.headers.cookie || '').split(';')) {
+        const eq = part.indexOf('=');
+        if (eq === -1)
+            continue;
+        const name = part.slice(0, eq).trim();
+        if (!name)
+            continue;
+        const raw = part.slice(eq + 1).trim();
+        try {
+            cookies[name] = decodeURIComponent(raw);
+        }
+        catch {
+            // A malformed percent-escape must not lose the whole cookie jar.
+            cookies[name] = raw;
+        }
+    }
+    webRequest.cookies = cookies;
+    const query = {};
+    for (const [k, v] of parsedUrl.searchParams.entries())
+        query[k] = v;
+    webRequest.query = query;
+    return webRequest;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vesk/adapter",
-  "version": "0.2.70",
+  "version": "0.2.71",
   "type": "module",
   "description": "Vesk adapter — builds deployable .vesk/ output for Deno and Node serverless",
   "main": "./dist/index.js",
@@ -23,9 +23,9 @@
     "sharp": "^0.35.3"
   },
   "dependencies": {
-    "@vesk/compiler": "^0.2.70",
-    "@vesk/runtime": "^0.2.70",
-    "@vesk/types": "^0.2.70"
+    "@vesk/compiler": "^0.2.71",
+    "@vesk/runtime": "^0.2.71",
+    "@vesk/types": "^0.2.71"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",