@vesk/adapter 0.2.70 → 0.2.72

package/dist/dev-server.d.ts

@@ -19,9 +19,6 @@ export interface DevHmrState {
 }
 /** Default state when no HMR provider is available (no server). */
 export declare function defaultDevHmrState(): DevHmrState;
-export declare function bodyTooLarge(maxBytes: number): Error & {
-    status: number;
-};
 export interface DevPanelResponse {
     status: number;
     headers: Record<string, string>;

package/dist/dev-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AASjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAM7C,OAAO,KAAK,EAAa,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAgBjG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;IAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB;+EAC2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAuCD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAkBD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B;;8BAE0B;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,WAAW,CAAC;IAChC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChH,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrD;AA8CD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAorBvG"}
+{"version":3,"file":"dev-server.d.ts","sourceRoot":"","sources":["../src/dev-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,MAAM,EAA6C,MAAM,WAAW,CAAC;AASjG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAO7C,OAAO,KAAK,EAAa,gBAAgB,EAAwB,MAAM,yBAAyB,CAAC;AAgBjG;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,IAAI,GAAG,WAAW,GAAG,OAAO,GAAG,MAAM,CAAC;IAC9C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxD,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB;+EAC2E;IAC3E,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,mEAAmE;AACnE,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAgDD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,QAAQ,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC7B;;8BAE0B;IAC1B,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,UAAU,GAAG,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,WAAW,CAAC;IAChC,8EAA8E;IAC9E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,wBAAwB,GAAG;IACvE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;CAChH,CAUA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAa3C;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrD;AAUD,wBAAsB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAorBvG"}

package/dist/dev-server.js

@@ -14,6 +14,7 @@ import { resolveRuntimeErrorPayload, renderDevErrorPage } from './ssr-error';
 import { renderDefaultNotFoundPage, renderDefaultErrorPage } from '@vesk/adapter/src/default-pages';
 import { buildTreeShakenRuntime, runtimeExportNames } from '@vesk/adapter/src/client-bundle';
 import { resolveWithin, installMdReadHook } from '@vesk/adapter/src/paths';
+import { makeWebRequest, bodyTooLarge } from '@vesk/adapter/src/web-request';
 import { getPluginRecords } from './plugins';
 // @vesk/agentic — optional AI plugin; gated by active state if installed
 import { createAgentRouter } from '@vesk/agentic/src/dev-api';
@@ -58,11 +59,6 @@ async function deliverResponse(res, response) {
     }
     res.end(await response.text());
 }
-export function bodyTooLarge(maxBytes) {
-    const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
-    err.status = 413;
-    return err;
-}
 function errorStatus(e, fallback) {
     const s = e?.status ?? e?.statusCode;
     return typeof s === 'number' && s >= 400 && s < 600 ? s : fallback;
@@ -149,49 +145,6 @@ export function injectDevScripts(html) {
     const scripts = '\t<script type="module" src="/_vesk/hmr.js"></script>\n' + devBootstrapScript() + '\n';
     return html.replace('</body>', scripts + '</body>');
 }
-function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
-    const parsedUrl = new URL(url, `http://${nodeReq.headers.host || 'localhost'}`);
-    const method = nodeReq.method || 'GET';
-    let _bodyBuffer = null;
-    async function getBody() {
-        if (_bodyBuffer)
-            return _bodyBuffer;
-        const chunks = [];
-        let total = 0;
-        for await (const chunk of nodeReq) {
-            total += chunk.byteLength;
-            if (total > maxBodyBytes)
-                throw bodyTooLarge(maxBodyBytes);
-            chunks.push(Buffer.from(chunk));
-        }
-        _bodyBuffer = Buffer.concat(chunks);
-        return _bodyBuffer;
-    }
-    const webRequest = new Request(parsedUrl, { method, headers: nodeReq.headers, body: null });
-    webRequest.json = async () => { try {
-        return JSON.parse((await getBody()).toString());
-    }
-    catch {
-        return null;
-    } };
-    webRequest.text = async () => (await getBody()).toString('utf-8');
-    webRequest.formData = async () => {
-        const body = await getBody();
-        const ct = String(nodeReq.headers['content-type'] || '');
-        if (ct.includes('multipart/form-data')) {
-            const temp = new Request('http://localhost', { method: 'POST', headers: nodeReq.headers, body: body });
-            return temp.formData();
-        }
-        const fd = new FormData();
-        if (ct.includes('x-www-form-urlencoded')) {
-            for (const [k, v] of new URLSearchParams(body.toString()).entries())
-                fd.append(k, v);
-        }
-        return fd;
-    };
-    webRequest.clone = () => webRequest;
-    return webRequest;
-}
 const MIME = {
     '.svg': 'image/svg+xml', '.css': 'text/css', '.js': 'application/javascript',
     '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg',

package/dist/prod-server.d.ts

@@ -1,10 +1,5 @@
 import { type Server } from 'node:http';
 import type { CompressionConfig, ProdServerOptions } from '@vesk/adapter/src/types';
-export declare function bodyTooLarge(maxBytes: number): Error & {
-    status: number;
-};
-export declare function startProdServer(outDir: string, options?: ProdServerOptions & {
-    compression?: CompressionConfig | false;
-    healthCheck?: boolean;
-}): Promise<Server>;
+export type { CompressionConfig, ProdServerOptions };
+export declare function startProdServer(outDir: string, options?: ProdServerOptions): Promise<Server>;
 //# sourceMappingURL=prod-server.d.ts.map

package/dist/prod-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAcjG,OAAO,KAAK,EAAkB,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAuFpG,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AA0FD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG;IAAE,WAAW,CAAC,EAAE,iBAAiB,GAAG,KAAK,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA6mBvK"}
+{"version":3,"file":"prod-server.d.ts","sourceRoot":"","sources":["../src/prod-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAejG,OAAO,KAAK,EAAkB,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAIpG,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;AAyHrD,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwoBlG"}

package/dist/prod-server.js

@@ -13,6 +13,7 @@ import { loadVeskConfig } from '@vesk/adapter/src/load-config';
 import { renderDefaultNotFoundPage, renderDefaultErrorPage } from '@vesk/adapter/src/default-pages';
 import { installResponsePipeline } from '@vesk/adapter/src/response-pipeline';
 import { resolveBoundaryFileForUrl } from '@vesk/adapter/src/ssr-function';
+import { makeWebRequest, bodyTooLarge } from '@vesk/adapter/src/web-request';
 import { mimeFor } from '@vesk/adapter/src/platform-output';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 async function readBody(req, maxBytes = DEFAULT_MAX_BODY_BYTES) {
@@ -102,69 +103,10 @@ function pumpRemaining(res, reader) {
         res.end();
     })();
 }
-export function bodyTooLarge(maxBytes) {
-    const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
-    err.status = 413;
-    return err;
-}
 function errorStatus(e, fallback) {
     const s = e?.status ?? e?.statusCode;
     return typeof s === 'number' && s >= 400 && s < 600 ? s : fallback;
 }
-function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
-    const parsedUrl = new URL(url, `http://${nodeReq.headers.host || 'localhost'}`);
-    const method = nodeReq.method || 'GET';
-    let _bodyBuffer = null;
-    async function getBody() {
-        if (_bodyBuffer)
-            return _bodyBuffer;
-        const chunks = [];
-        let total = 0;
-        for await (const chunk of nodeReq) {
-            total += chunk.byteLength;
-            if (total > maxBodyBytes)
-                throw bodyTooLarge(maxBodyBytes);
-            chunks.push(Buffer.from(chunk));
-        }
-        _bodyBuffer = Buffer.concat(chunks);
-        return _bodyBuffer;
-    }
-    const webRequest = new Request(parsedUrl, { method, headers: nodeReq.headers, body: null });
-    webRequest.json = async () => { try {
-        return JSON.parse((await getBody()).toString());
-    }
-    catch {
-        return null;
-    } };
-    webRequest.text = async () => (await getBody()).toString('utf-8');
-    webRequest.formData = async () => {
-        const body = await getBody();
-        const ct = String(nodeReq.headers['content-type'] || '');
-        if (ct.includes('multipart/form-data')) {
-            const temp = new Request('http://localhost', { method: 'POST', headers: nodeReq.headers, body: body });
-            return temp.formData();
-        }
-        const fd = new FormData();
-        if (ct.includes('x-www-form-urlencoded')) {
-            for (const [k, v] of new URLSearchParams(body.toString()).entries())
-                fd.append(k, v);
-        }
-        return fd;
-    };
-    webRequest.clone = () => webRequest;
-    const cookies = {};
-    for (const [k, v] of String(nodeReq.headers.cookie || '').split(';').map(s => s.trim()).filter(Boolean)) {
-        const eq = k.indexOf('=');
-        if (eq > -1)
-            cookies[k.slice(0, eq)] = decodeURIComponent(k.slice(eq + 1));
-    }
-    webRequest.cookies = cookies;
-    const query = {};
-    for (const [k, v] of parsedUrl.searchParams.entries())
-        query[k] = v;
-    webRequest.query = query;
-    return webRequest;
-}
 export async function startProdServer(outDir, options) {
     const port = options?.port || 3000;
     const host = options?.host || '127.0.0.1';
@@ -253,9 +195,26 @@ export async function startProdServer(outDir, options) {
         }
     }
     const functionCache = new Map();
+    /** Import failures, kept so the same broken module is not re-imported per request. */
+    const functionFailures = new Map();
+    /**
+     * Load a generated function module.
+     *
+     * Returns null both for "no such file" and for "the file exists but could not
+     * be imported", and the caller cannot tell them apart — which turned a route
+     * with a bad import into a **404 with no diagnostic anywhere**. A missing
+     * export or an unresolvable dependency is a build bug, and the only evidence
+     * was an empty 404. `functionFailure` records what happened so the request
+     * path can answer 500 and log it, which is what a broken route is.
+     */
+    function functionFailure(funcPath) {
+        return functionFailures.get(funcPath);
+    }
     async function loadFunction(funcPath) {
         if (functionCache.has(funcPath))
             return functionCache.get(funcPath);
+        if (functionFailures.has(funcPath))
+            return null;
         const fullPath = resolve(outDir, funcPath);
         if (!existsSync(fullPath))
             return null;
@@ -264,7 +223,9 @@ export async function startProdServer(outDir, options) {
             functionCache.set(funcPath, mod);
             return mod;
         }
-        catch {
+        catch (e) {
+            console.error(`vesk start: failed to load ${funcPath}:`, e instanceof Error ? e.message : e);
+            functionFailures.set(funcPath, e);
             return null;
         }
     }
@@ -579,19 +540,27 @@ export async function startProdServer(outDir, options) {
                     const params = matchPath(route.path, url.pathname);
                     if (params) {
                         const mod = await loadFunction(route.function);
-                        if (mod) {
-                            try {
-                                const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
-                                const response = await withSecurityScope(() => mod.handle(webRequest));
-                                await deliverResponse(res, response);
-                                return;
-                            }
-                            catch (e) {
-                                const status = errorStatus(e, 500);
-                                res.writeHead(status, { 'Content-Type': 'application/json' });
-                                res.end(JSON.stringify({ error: status === 500 ? 'Internal Server Error' : e instanceof Error ? e.message : String(e) }));
+                        if (!mod) {
+                            // The route matched, so a 404 would be a lie: the handler is
+                            // there and could not be loaded.
+                            if (functionFailure(route.function)) {
+                                res.writeHead(500, { 'Content-Type': 'application/json' });
+                                res.end(JSON.stringify({ error: 'Internal Server Error' }));
                                 return;
                             }
+                            continue;
+                        }
+                        try {
+                            const webRequest = makeWebRequest(req, url.href, maxBodyBytes);
+                            const response = await withSecurityScope(() => mod.handle(webRequest));
+                            await deliverResponse(res, response);
+                            return;
+                        }
+                        catch (e) {
+                            const status = errorStatus(e, 500);
+                            res.writeHead(status, { 'Content-Type': 'application/json' });
+                            res.end(JSON.stringify({ error: status === 500 ? 'Internal Server Error' : e instanceof Error ? e.message : String(e) }));
+                            return;
                         }
                     }
                 }

package/dist/response-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-pipeline.d.ts","sourceRoot":"","sources":["../src/response-pipeline.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAKjE,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAgC/F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAwB3E;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAWjG;AAED,MAAM,WAAW,uBAAuB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AA8BD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACtC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,uBAA4B,GACnC,IAAI,CA2ON"}
+{"version":3,"file":"response-pipeline.d.ts","sourceRoot":"","sources":["../src/response-pipeline.ts"],"names":[],"mappings":"AAgEA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAKjE,MAAM,MAAM,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,eAAe,GAAG,IAAI,CAgC/F;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAwB3E;AAED;;;;;;;GAOG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAWjG;AAED,MAAM,WAAW,uBAAuB;IACvC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,+DAA+D;IAC/D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iCAAiC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AA8BD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACtC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,uBAA4B,GACnC,IAAI,CA2ON"}

package/dist/response-pipeline.js

@@ -29,6 +29,29 @@
  * Deliberately not here: range requests, `Last-Modified`/`If-Modified-Since`
  * (the ETag covers the same revalidation need and cannot disagree with itself),
  * and compression of already-encoded bodies.
+ *
+ * ## Shape
+ *
+ * ```ts
+ * installResponsePipeline(res, req, {
+ *   compress?: boolean;        // default true
+ *   compressThreshold?: number;// default 1024
+ *   etag?: boolean;            // default true
+ *   brotliQuality?: number;    // 0-11, default 5
+ *   gzipLevel?: number;        // 1-9, default 6
+ * })
+ *
+ * // pure helpers, exported for testing and for any other transport
+ * negotiateEncoding(acceptEncoding): 'br' | 'gzip' | null
+ * isCompressibleType(contentType): boolean
+ * etagFor(body: Buffer): '"..."'
+ * ifNoneMatchSatisfied(ifNoneMatch, etag): boolean
+ * ```
+ *
+ * Install it ONCE per request, before any header is written. It is idempotent
+ * per `res` in the sense that matters — a second install would defer again —
+ * but a handler that bypasses it loses compression, `Vary`, ETag and 304 for
+ * everything it serves, silently.
  */
 import { createHash } from 'node:crypto';
 import { brotliCompress, constants as zlibConstants, createBrotliCompress, createGzip, gzip, } from 'node:zlib';

package/dist/server-only-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-only-plugin.d.ts","sourceRoot":"","sources":["../src/server-only-plugin.ts"],"names":[],"mappings":"AA0BA,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,IAAI,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAClE;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACtF;AAED,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,KAAK,EAAE;QACb,SAAS,EAAE,CACT,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,EAC5C,EAAE,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,KACtD,IAAI,CAAC;QACV,MAAM,EAAE,CACN,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAC3C,EAAE,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,KACjE,IAAI,CAAC;KACX,KAAK,IAAI,CAAC;CACZ;AAMD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CA+C1E;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAmB3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAoDxE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,iBAAiB,CAoDzF"}
+{"version":3,"file":"server-only-plugin.d.ts","sourceRoot":"","sources":["../src/server-only-plugin.ts"],"names":[],"mappings":"AA6CA,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,qEAAqE;IACrE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,KAAK,IAAI,CAAC;IACtC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAClE;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CACtF;AAED,kGAAkG;AAClG,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,CAAC,KAAK,EAAE;QACb,SAAS,EAAE,CACT,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,EAC5C,EAAE,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,KACtD,IAAI,CAAC;QACV,MAAM,EAAE,CACN,IAAI,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,EAC3C,EAAE,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,KAAK;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,KACjE,IAAI,CAAC;KACX,KAAK,IAAI,CAAC;CACZ;AAMD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CA+C1E;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAmB3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAoDxE;AAED,wBAAgB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,iBAAiB,CAoDzF"}

package/dist/server-only-plugin.js

@@ -19,6 +19,25 @@
  * TCP drivers are NOT stubbed. A browser bundle cannot contain one under any
  * circumstances, so a stub would ship a page that looks fine and fails at the
  * first query; they are reported and left for esbuild to reject.
+ *
+ * ## Shape
+ *
+ * ```ts
+ * serverOnlyPlugin({
+ *   onStub?:  (hit: { specifier, binding, importer }) => void,   // stubbed
+ *   onDriver?:(hit: { specifier, importer }) => void,           // refused
+ *   onEager?: (hit: { specifier, bindings: string[], importer }) => void, // module-scope: build error
+ * })
+ *
+ * // helpers, exported for testing
+ * importedNamesFor(code, specifier): string[]      // what the importer asks for
+ * referencedAtTopLevel(code, name): boolean       // module-scope use?
+ * stubFactorySource(specifier): string             // the shared throwing proxy
+ * ```
+ *
+ * `onEager` returning null (rather than a stub) is deliberate: the browser would
+ * evaluate that statement while loading the chunk, so there is no call site to
+ * throw at.
  */
 import { readFileSync } from 'node:fs';
 import { parse } from '@vesk/compiler/src/parser';

package/dist/server-only.d.ts

@@ -25,6 +25,32 @@
  *   opt-out: the alternative is discovering it in a deployment log.
  *
  * AST-only throughout. No text scanning — see the module rules.
+ *
+ * ## Shape
+ *
+ * ```ts
+ * // classification
+ * classifySpecifier(spec): 'server-only-package' | 'tcp-driver' | null
+ * isServerOnlySpecifier(spec): boolean
+ * isTcpDriverSpecifier(spec): boolean
+ *
+ * // enforcement
+ * serverOnlyStubs(notes: Array<{ specifier, binding }>): string        // from a recorded list
+ * serverOnlyImportStubs(code, classify?): string                      // scanned from source
+ * scanServerOnlyImports(files: Array<{ path, code }>): ServerOnlyViolation[]
+ * tcpDriverViolations(appDir): ServerOnlyViolation[]                  // whole app tree
+ * edgeDriverBuildError(violations): Error                             // the socketless message
+ *
+ * // target
+ * isSocketlessTarget(platform, target): boolean
+ * collectAppSources(dir, out?): string[]
+ * ```
+ *
+ * Adding to the table: extend `SERVER_ONLY_EXACT` / `TCP_DRIVERS`, and — if the
+ * package is legitimately usable on the client through a subpath — leave that
+ * subpath unmatched, as `slintorm/edge` is. See
+ * `packages/adapter/AGENTS.md` for the three outcomes the plugin must
+ * distinguish.
  */
 export type ServerOnlyKind = 'server-only-package' | 'tcp-driver';
 /**

package/dist/server-only.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-only.d.ts","sourceRoot":"","sources":["../src/server-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAsCH,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAAG,YAAY,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMrE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,MAAM,CAkB5F;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,cAAc,GAAG,IAAwB,GAAG,MAAM,CAoBjI;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAWD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,mBAAmB,EAAE,CA8BvB;AAYD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAU7E;AAYD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGlH;AAMD,sDAAsD;AACtD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CAwB3E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAUzE"}
+{"version":3,"file":"server-only.d.ts","sourceRoot":"","sources":["../src/server-only.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAsCH,MAAM,MAAM,cAAc,GAAG,qBAAqB,GAAG,YAAY,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAMrE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,MAAM,CAkB5F;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,cAAc,GAAG,IAAwB,GAAG,MAAM,CAoBjI;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAWD;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAC3C,mBAAmB,EAAE,CA8BvB;AAYD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAU7E;AAYD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGlH;AAMD,sDAAsD;AACtD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,EAAO,GAAG,MAAM,EAAE,CAwB3E;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAUzE"}

package/dist/server-only.js

@@ -25,6 +25,32 @@
  *   opt-out: the alternative is discovering it in a deployment log.
  *
  * AST-only throughout. No text scanning — see the module rules.
+ *
+ * ## Shape
+ *
+ * ```ts
+ * // classification
+ * classifySpecifier(spec): 'server-only-package' | 'tcp-driver' | null
+ * isServerOnlySpecifier(spec): boolean
+ * isTcpDriverSpecifier(spec): boolean
+ *
+ * // enforcement
+ * serverOnlyStubs(notes: Array<{ specifier, binding }>): string        // from a recorded list
+ * serverOnlyImportStubs(code, classify?): string                      // scanned from source
+ * scanServerOnlyImports(files: Array<{ path, code }>): ServerOnlyViolation[]
+ * tcpDriverViolations(appDir): ServerOnlyViolation[]                  // whole app tree
+ * edgeDriverBuildError(violations): Error                             // the socketless message
+ *
+ * // target
+ * isSocketlessTarget(platform, target): boolean
+ * collectAppSources(dir, out?): string[]
+ * ```
+ *
+ * Adding to the table: extend `SERVER_ONLY_EXACT` / `TCP_DRIVERS`, and — if the
+ * package is legitimately usable on the client through a subpath — leave that
+ * subpath unmatched, as `slintorm/edge` is. See
+ * `packages/adapter/AGENTS.md` for the three outcomes the plugin must
+ * distinguish.
  */
 import { parse } from '@vesk/compiler/src/parser';
 import { readFileSync, readdirSync, statSync } from 'node:fs';

package/dist/web-request.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The `Request` handed to API routes and server actions.
+ *
+ * One implementation, used by both the dev and production servers. They each
+ * carried an identical copy until this existed, which is how the same defect sat
+ * in both: the shim built its `Request` with `body: null` and supplied only
+ * whole-body readers (`text()`, `json()`, `formData()`). Anything reading
+ * `request.body` — which is every streaming parser, including
+ * `@vesk/plugin-multipart` — saw no body at all and failed with `NO_BODY`.
+ * That is the difference between an upload handler that works and one that
+ * 400s on every request, so the body is now a real stream.
+ *
+ * The stream is created LAZILY, on first access to `request.body`. Attaching
+ * `data` listeners eagerly would start draining every GET body in the process,
+ * and a GET that never asked for its body would still be read.
+ *
+ * Reading is single-pass by definition, so both access patterns have to work on
+ * one socket: every byte that flows through the stream is cached, and
+ * `text()`/`json()`/`formData()` serve from that cache if the stream has already
+ * been taken. A handler that reads `request.body` and then calls
+ * `request.text()` gets the body once, not a hang.
+ *
+ * ## Shape
+ *
+ * ```ts
+ * makeWebRequest(nodeReq, url, maxBodyBytes?): ExtendedRequest
+ *
+ * interface ExtendedRequest extends Request {
+ *   body: ReadableStream<Uint8Array> | null;   // lazy; null for GET/HEAD
+ *   text(): Promise<string>;
+ *   json(): Promise<unknown>;
+ *   formData(): Promise<FormData>;
+ *   clone(): ExtendedRequest;                  // same object — one socket, one read
+ *   cookies: Record<string, string>;
+ *   query: Record<string, string>;
+ * }
+ *
+ * bodyTooLarge(maxBytes): Error & { status: 413 }   // re-exported by prod-server
+ * ```
+ *
+ * One instance per request. Do not attach string-keyed properties to it — that is
+ * a public name the framework has to reserve forever, with no type for it. Use a
+ * private `Symbol` (see `AUTO_PARSED` in `@vesk/plugin-multipart`).
+ */
+import type { IncomingMessage } from 'node:http';
+export interface ExtendedRequest extends Request {
+    json(): Promise<unknown>;
+    text(): Promise<string>;
+    formData(): Promise<FormData>;
+    clone(): ExtendedRequest;
+    cookies: Record<string, string>;
+    query: Record<string, string>;
+}
+export declare function bodyTooLarge(maxBytes: number): Error & {
+    status: number;
+};
+export declare function makeWebRequest(nodeReq: IncomingMessage, url: string, maxBodyBytes?: number): ExtendedRequest;
+//# sourceMappingURL=web-request.d.ts.map

package/dist/web-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"web-request.d.ts","sourceRoot":"","sources":["../src/web-request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAIjD,MAAM,WAAW,eAAgB,SAAQ,OAAO;IAC9C,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IACxB,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,KAAK,IAAI,eAAe,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAIzE;AAED,wBAAgB,cAAc,CAC5B,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,EACX,YAAY,GAAE,MAA+B,GAC5C,eAAe,CAwIjB"}

package/dist/web-request.js

@@ -0,0 +1,165 @@
+import { Buffer } from 'node:buffer';
+import { DEFAULT_MAX_BODY_BYTES } from '@vesk/compiler/src/server-codegen';
+export function bodyTooLarge(maxBytes) {
+    const err = new Error(`Request body exceeds limit (${maxBytes} bytes)`);
+    err.status = 413;
+    return err;
+}
+export function makeWebRequest(nodeReq, url, maxBodyBytes = DEFAULT_MAX_BODY_BYTES) {
+    const parsedUrl = new URL(url, `http://${nodeReq.headers.host || 'localhost'}`);
+    const method = nodeReq.method || 'GET';
+    let cachedBody = null;
+    let streamTaken = false;
+    let streamEnded = false;
+    const endWaiters = [];
+    const settleEnd = (body) => {
+        if (body !== null)
+            cachedBody = body;
+        streamEnded = true;
+        for (const resolve of endWaiters.splice(0))
+            resolve();
+    };
+    function createBodyStream() {
+        streamTaken = true;
+        const cache = [];
+        let total = 0;
+        return new ReadableStream({
+            start(controller) {
+                nodeReq.on('data', (chunk) => {
+                    total += chunk.length;
+                    if (total > maxBodyBytes) {
+                        // Same cap the buffered readers enforce, checked as the bytes arrive
+                        // so an oversized upload is refused mid-body rather than after the
+                        // last byte has been read and held in memory.
+                        settleEnd(Buffer.concat(cache));
+                        cache.length = 0;
+                        try {
+                            controller.error(bodyTooLarge(maxBodyBytes));
+                        }
+                        catch { /* already settled */ }
+                        nodeReq.destroy();
+                        return;
+                    }
+                    cache.push(chunk);
+                    try {
+                        controller.enqueue(new Uint8Array(chunk));
+                    }
+                    catch { /* consumer cancelled */ }
+                });
+                nodeReq.on('end', () => {
+                    settleEnd(Buffer.concat(cache));
+                    cache.length = 0;
+                    try {
+                        controller.close();
+                    }
+                    catch { /* errored */ }
+                });
+                nodeReq.on('error', (e) => {
+                    settleEnd(Buffer.concat(cache));
+                    cache.length = 0;
+                    try {
+                        controller.error(e);
+                    }
+                    catch { /* already settled */ }
+                });
+            },
+        });
+    }
+    async function getBody() {
+        if (cachedBody)
+            return cachedBody;
+        if (streamTaken) {
+            // The stream is the reader now. Everything it has seen is in the cache,
+            // and it settles on 'end' — so wait rather than racing an empty read.
+            while (!streamEnded)
+                await new Promise(r => endWaiters.push(r));
+            return cachedBody || Buffer.alloc(0);
+        }
+        const chunks = [];
+        let total = 0;
+        for await (const chunk of nodeReq) {
+            total += chunk.byteLength;
+            if (total > maxBodyBytes)
+                throw bodyTooLarge(maxBodyBytes);
+            chunks.push(Buffer.from(chunk));
+        }
+        cachedBody = Buffer.concat(chunks);
+        return cachedBody;
+    }
+    const webRequest = new Request(parsedUrl, {
+        method,
+        headers: nodeReq.headers,
+        body: null,
+    });
+    // Shadow the prototype's `body` getter with a lazily-created stream over the
+    // Node request. An own accessor on the instance wins over the prototype one,
+    // which is the only reason this works without a Node-specific Request class.
+    let bodyStream = null;
+    Object.defineProperty(webRequest, 'body', {
+        configurable: true,
+        enumerable: false,
+        get: () => {
+            if (bodyStream)
+                return bodyStream;
+            // `new Request(..., { body: null })` reports null for GET/HEAD, which is
+            // correct; only a request that can carry a body needs a stream.
+            if (method === 'GET' || method === 'HEAD')
+                return null;
+            bodyStream = createBodyStream();
+            return bodyStream;
+        },
+    });
+    webRequest.json = async () => { try {
+        return JSON.parse((await getBody()).toString());
+    }
+    catch {
+        return null;
+    } };
+    webRequest.text = async () => (await getBody()).toString('utf-8');
+    webRequest.formData = async () => {
+        const body = await getBody();
+        const ct = String(nodeReq.headers['content-type'] || '');
+        if (ct.includes('multipart/form-data')) {
+            const temp = new Request('http://localhost', { method: 'POST', headers: nodeReq.headers, body: body });
+            return temp.formData();
+        }
+        const fd = new FormData();
+        if (ct.includes('x-www-form-urlencoded')) {
+            for (const [k, v] of new URLSearchParams(body.toString()).entries())
+                fd.append(k, v);
+        }
+        return fd;
+    };
+    webRequest.clone = () => webRequest;
+    const cookies = {};
+    // Iterate the pieces, do NOT destructure them. `cookie.split(';')` yields an
+    // array of STRINGS, and a string is iterable, so `for (const [k, v] of …)`
+    // bound `k` to the first CHARACTER of the pair ('s' of "session=…"),
+    // `indexOf('=')` was always -1, and the loop never populated anything.
+    // `request.cookies` has therefore been `{}` in every production request that
+    // ever read it. The `[k, v]` form is right for `searchParams.entries()`,
+    // which really does yield pairs — which is why the bug survived next to
+    // working code.
+    for (const part of String(nodeReq.headers.cookie || '').split(';')) {
+        const eq = part.indexOf('=');
+        if (eq === -1)
+            continue;
+        const name = part.slice(0, eq).trim();
+        if (!name)
+            continue;
+        const raw = part.slice(eq + 1).trim();
+        try {
+            cookies[name] = decodeURIComponent(raw);
+        }
+        catch {
+            // A malformed percent-escape must not lose the whole cookie jar.
+            cookies[name] = raw;
+        }
+    }
+    webRequest.cookies = cookies;
+    const query = {};
+    for (const [k, v] of parsedUrl.searchParams.entries())
+        query[k] = v;
+    webRequest.query = query;
+    return webRequest;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vesk/adapter",
-  "version": "0.2.70",
+  "version": "0.2.72",
   "type": "module",
   "description": "Vesk adapter — builds deployable .vesk/ output for Deno and Node serverless",
   "main": "./dist/index.js",
@@ -23,9 +23,9 @@
     "sharp": "^0.35.3"
   },
   "dependencies": {
-    "@vesk/compiler": "^0.2.70",
-    "@vesk/runtime": "^0.2.70",
-    "@vesk/types": "^0.2.70"
+    "@vesk/compiler": "^0.2.72",
+    "@vesk/runtime": "^0.2.72",
+    "@vesk/types": "^0.2.72"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1",