@volter/world-core 3.0.163 → 3.0.164

package/src/pack-fetch.ts

@@ -105,7 +105,7 @@ export type LanePart = {
  *  World's scenario file for a model vendor's turns (`scenarioPath`, the runtime's `--scenario`). */
 export type PackFetchOptions = {
   root?: string; readOnly?: boolean; clock?: () => string; database?: string; scenarioPath?: string;
-  /** the application a walk stands in for (a life's `application` answers): this fetch's `ctx.ask` is answered by it */
+  /** the application a walk stands in for: this fetch's requests and declared events are answered by it */
   application?: ApplicationStandIn;
 };
 
@@ -143,7 +143,7 @@ function hostMatcher(pattern: string): (host: string) => Match | undefined {
   };
 }
 /** The host a request is for: the vendor host the World's injector names, else its own. */
-const hostOf = (request: Request): string => readHostPort(request.headers.get('x-volter-twin-original-host') ?? request.headers.get('host') ?? new URL(request.url).host)?.host ?? '';
+export const hostOf = (request: Request): string => readHostPort(request.headers.get('x-volter-twin-original-host') ?? request.headers.get('host') ?? new URL(request.url).host)?.host ?? '';
 
 /** Where a workspace asked `?show=<type>:<id>` opens the record (architecture, "Workspace"): the built workspace page
  *  that shows that type, its parameter the id; else the one that lists the type; else the workspace's home (its root
@@ -218,13 +218,26 @@ async function encoded(m: DerivedManifest, request: Request, res: Response): Pro
   return new Response(buffered, { status: res.status, statusText: res.statusText, headers });
 }
 
-/** A pack's HTTP surface, as the kernel serves it from the pack's parts. */
 /** A door's path as it is served and listed: under `/_twin/`, whether the manifest writes the prefix or not. */
 const doorPath = (path: string): string => (path.startsWith('/_twin/') ? path : `/_twin${path.startsWith('/') ? '' : '/'}${path}`);
 
+/** A declared World door, matched by the same normalized path for serving and response ownership. */
+export function worldDoorMatcher<Door extends { method: string; path: string }>(doors: ReadonlyArray<Door>): (method: string, path: string) => { door: Door; params: Record<string, string> } | undefined {
+  const routes = doors.map((door) => ({ door, method: door.method.toUpperCase(), matches: pathMatcher(doorPath(door.path), false) }));
+  return (method, path) => {
+    const at = path.replace(/\/+$/, '') || '/';
+    for (const route of routes) {
+      if (route.method !== method.toUpperCase()) continue;
+      const hit = route.matches(at);
+      if (hit) return { door: route.door, params: hit.params };
+    }
+    return undefined;
+  };
+}
+
 /** A request with its path's repeated slashes merged, as a front that merges them routes it (the manifest's
  *  `mergeSlashes`); one with none is itself. */
-function slashesMerged(request: Request): Request {
+export function slashesMerged(request: Request): Request {
   const url = new URL(request.url);
   const merged = url.pathname.replace(/\/{2,}/g, '/');
   if (merged === url.pathname) return request;
@@ -232,6 +245,58 @@ function slashesMerged(request: Request): Request {
   return new Request(url, request);
 }
 
+/** The selected unit's request transformation, shared by serving and response judgment. */
+export function unitRequestRouter(m: Pick<DerivedManifest, 'pathPrefix' | 'basePathAlias' | 'pathFromHost' | 'hostParams' | 'headerParams'>, surface: DerivedSurface, routes: ReturnType<typeof compileSurface>): (request: Request) => Request {
+  const prefix = m.pathPrefix ? new RegExp(`^(?:${m.pathPrefix})(?=/)`) : undefined;
+  const base = surface.basePath ?? '';
+  const baseAlias = m.basePathAlias && base ? new RegExp(`^(?:${m.basePathAlias})(?=/)`) : undefined;
+  const hostPath = m.pathFromHost ? new RegExp(m.pathFromHost, 'i') : undefined;
+  const hostParams = m.hostParams ? new RegExp(m.hostParams, 'i') : undefined;
+  // each operation's spanning parameters, keyed by the operation and the parameter as the route compiles them (a whole
+  // segment's label whose name the surface or the manifest declares spanning), so one operation's spanning name never
+  // keeps another's slashes, nor a label that only part of a segment holds
+  const spanningNames = new Set(surface.spanning ?? []);
+  const spanningOf = new Set(surface.operations.flatMap((op) => ((op.basePath ?? base) + op.path).split('/').flatMap((seg) => {
+    const label = /^\{([^}]+)\}$/.exec(seg)?.[1];
+    return label !== undefined && spanningNames.has(label) ? [`${op.id}\u0000${label}`] : [];
+  })));
+  /** A path as the vendor routes it: the manifest's path prefix taken off, the spec's base in an alias's place, a host's
+   *  path label (pathFromHost) put in front. */
+  const rewritten = (pathname: string, host: string): string => {
+    let path = pathname;
+    if (prefix) path = path.replace(prefix, '') || '/';
+    // a base the vendor serves as its own: the spec's base in its place (a path already under the spec's base stays)
+    if (baseAlias && !(path === base || path.startsWith(`${base}/`))) path = path.replace(baseAlias, base);
+    const label = hostPath?.exec(host)?.[1];
+    if (label) path = `/${label}${path === '/' ? '' : path}`;
+    return path;
+  };
+  /** The request as its vendor routes it: duplicate slashes collapsed, unless the rewritten path matches an operation
+   *  through one of that operation's spanning parameters (the surface's and the manifest's), whose value keeps its
+   *  slashes; then rewritten. */
+  return (request: Request): Request => {
+    const url = new URL(request.url);
+    const host = hostOf(request);
+    const kept = rewritten(url.pathname, host);
+    const matched = matchOperation(routes, request.method, kept);
+    const spanning = matched !== undefined && Object.keys(matched.params).some((name) => spanningOf.has(`${matched.operation.id}\u0000${name}`));
+    const source = spanning ? url.pathname : url.pathname.replace(/\/{2,}/g, '/');
+    // a prefix's named groups (Jira's `/ex/jira/(?<cloudId>[^/]+)`) and the host's (E2B's envd at
+    // `49983-(?<sandboxID>…).e2b.app`) join the operation's parameters
+    const groups = { ...(prefix?.exec(source)?.groups ?? {}), ...(hostParams?.exec(host)?.groups ?? {}), ...Object.fromEntries(Object.entries(m.headerParams ?? {}).flatMap(([param, header]) => { const value = request.headers.get(header); return value === null ? [] : [[param, value]]; })) };
+    const path = spanning ? kept : rewritten(source, host);
+    if (path === url.pathname && !Object.keys(groups).length) return request;
+    // the path the client sent, which a signature over the request (SigV4's canonical URI) covers
+    const headers = new Headers(request.headers);
+    // the path as first sent: a front before this (an attach bridge) may have named the one its client signed
+    if (!headers.has(ORIGINAL_PATH_HEADER)) headers.set(ORIGINAL_PATH_HEADER, url.pathname);
+    if (Object.keys(groups).length) headers.set(PREFIX_PARAMS_HEADER, JSON.stringify(groups));
+    url.pathname = path;
+    return new Request(url, { method: request.method, headers, body: request.body, signal: request.signal, ...(request.body ? { duplex: 'half' } : {}) } as RequestInit);
+  };
+}
+
+/** A pack's HTTP surface, as the kernel serves it from the pack's parts. */
 export function createPackFetch(parts: PackParts, options: PackFetchOptions = {}): DerivedFetch {
   const m = parts.manifest;
   const scope: CoreScope = {
@@ -322,11 +387,8 @@ export function createPackFetch(parts: PackParts, options: PackFetchOptions = {}
     if (decision.kind === 'fault') return Response.json(decision.result.body, { status: decision.result.status, headers: decision.result.headers ?? {} });
     return api(withHeaders(request, new Headers([...request.headers, [SCENARIO_DECISION_HEADER, scenarioDecisionHeader(decision)]])));
   };
-  const doors = (m.doors ?? []).map((d) => {
-    const answer = parts.doors?.[d.id];
-    if (!answer) throw new Error(`${m.vendor}: the manifest declares the door ${d.id}, and semantics/doors.ts exports no ${d.id}`);
-    return { decl: d, path: pathMatcher(doorPath(d.path), false), answer };
-  });
+  for (const d of m.doors ?? []) if (!parts.doors?.[d.id]) throw new Error(`${m.vendor}: the manifest declares the door ${d.id}, and semantics/doors.ts exports no ${d.id}`);
+  const door = worldDoorMatcher(m.doors ?? []);
   const screens = (m.screens ?? []).filter((s) => s.status === 'done' && parts.screens?.[s.id]).map((s) => {
     const hosts = [s.host, ...(s.hosts ?? [])].map(hostMatcher);
     return { decl: s, host: (h: string) => hosts.map((match) => match(h)).find(Boolean), path: pathMatcher(s.path, true), answer: parts.screens![s.id]! };
@@ -355,53 +417,7 @@ export function createPackFetch(parts: PackParts, options: PackFetchOptions = {}
   };
   const refusedReadOnly = (): Response => vendorError(m, m.readOnly);
 
-  const prefix = m.pathPrefix ? new RegExp(`^(?:${m.pathPrefix})(?=/)`) : undefined;
-  const base = surface.basePath ?? '';
-  const baseAlias = m.basePathAlias && base ? new RegExp(`^(?:${m.basePathAlias})(?=/)`) : undefined;
-  const hostPath = m.pathFromHost ? new RegExp(m.pathFromHost, 'i') : undefined;
-  const hostParams = m.hostParams ? new RegExp(m.hostParams, 'i') : undefined;
-  // each operation's spanning parameters, keyed by the operation and the parameter as the route compiles them (a whole
-  // segment's label whose name the surface or the manifest declares spanning), so one operation's spanning name never
-  // keeps another's slashes, nor a label that only part of a segment holds
-  const spanningNames = new Set(surface.spanning ?? []);
-  const spanningOf = new Set(surface.operations.flatMap((op) => ((op.basePath ?? base) + op.path).split('/').flatMap((seg) => {
-    const label = /^\{([^}]+)\}$/.exec(seg)?.[1];
-    return label !== undefined && spanningNames.has(label) ? [`${op.id}\u0000${label}`] : [];
-  })));
-  /** A path as the vendor routes it: the manifest's path prefix taken off, the spec's base in an alias's place, a host's
-   *  path label (pathFromHost) put in front. */
-  const rewritten = (pathname: string, host: string): string => {
-    let path = pathname;
-    if (prefix) path = path.replace(prefix, '') || '/';
-    // a base the vendor serves as its own: the spec's base in its place (a path already under the spec's base stays)
-    if (baseAlias && !(path === base || path.startsWith(`${base}/`))) path = path.replace(baseAlias, base);
-    const label = hostPath?.exec(host)?.[1];
-    if (label) path = `/${label}${path === '/' ? '' : path}`;
-    return path;
-  };
-  /** The request as its vendor routes it: duplicate slashes collapsed, unless the rewritten path matches an operation
-   *  through one of that operation's spanning parameters (the surface's and the manifest's), whose value keeps its
-   *  slashes; then rewritten. */
-  const routed = (request: Request): Request => {
-    const url = new URL(request.url);
-    const host = hostOf(request);
-    const kept = rewritten(url.pathname, host);
-    const matched = matchOperation(routes, request.method, kept);
-    const spanning = matched !== undefined && Object.keys(matched.params).some((name) => spanningOf.has(`${matched.operation.id}\u0000${name}`));
-    const source = spanning ? url.pathname : url.pathname.replace(/\/{2,}/g, '/');
-    // a prefix's named groups (Jira's `/ex/jira/(?<cloudId>[^/]+)`) and the host's (E2B's envd at
-    // `49983-(?<sandboxID>…).e2b.app`) join the operation's parameters
-    const groups = { ...(prefix?.exec(source)?.groups ?? {}), ...(hostParams?.exec(host)?.groups ?? {}), ...Object.fromEntries(Object.entries(m.headerParams ?? {}).flatMap(([param, header]) => { const value = request.headers.get(header); return value === null ? [] : [[param, value]]; })) };
-    const path = spanning ? kept : rewritten(source, host);
-    if (path === url.pathname && !Object.keys(groups).length) return request;
-    // the path the client sent, which a signature over the request (SigV4's canonical URI) covers
-    const headers = new Headers(request.headers);
-    // the path as first sent: a front before this (an attach bridge) may have named the one its client signed
-    if (!headers.has(ORIGINAL_PATH_HEADER)) headers.set(ORIGINAL_PATH_HEADER, url.pathname);
-    if (Object.keys(groups).length) headers.set(PREFIX_PARAMS_HEADER, JSON.stringify(groups));
-    url.pathname = path;
-    return new Request(url, { method: request.method, headers, body: request.body, signal: request.signal, ...(request.body ? { duplex: 'half' } : {}) } as RequestInit);
-  };
+  const routed = unitRequestRouter(m, surface, routes);
   const rootServes = (method: string, path: string): boolean => Boolean(matchOperation(routes, method, path));
   const lane = m.lanes ? laneRouter(m.vendor, m.lanes, parts.lanes ?? {}, rootServes) : undefined;
   // Inspect lane-owned World doors directly, without routing them back through the vendor gateway.
@@ -488,7 +504,7 @@ export function createPackFetch(parts: PackParts, options: PackFetchOptions = {}
     const own = await answerContent(arrived);
     if (own) return own;
     // Root World doors belong to the pack at every routed host, including a lane's host.
-    const rootDoor = doors.some((d) => d.decl.method.toUpperCase() === arrived.method && d.path(asked));
+    const rootDoor = door(arrived.method, asked);
     const toLane = discovery || rootDoor ? undefined : lane?.(arrived);
     if (toLane) return toLane(arrived);
     const readable = await prepared(arrived);
@@ -551,12 +567,11 @@ export function createPackFetch(parts: PackParts, options: PackFetchOptions = {}
         if (kind === 'fake') resetFakePool(m.service, options.root);
         return Response.json({ kind }, { status: 201 });
       }
-      for (const d of doors) {
-        if (d.decl.method.toUpperCase() !== request.method) continue;
-        const hit = d.path(path);
-        if (!hit) continue;
+      const hit = door(request.method, path);
+      if (hit) {
         if (readOnly && request.method !== 'GET') return refusedReadOnly();
-        return d.answer(await open(request, d.decl.id, d.decl.method, d.decl.path, hit.params));
+        const d = hit.door;
+        return parts.doors![d.id]!(await open(request, d.id, d.method, d.path, hit.params));
       }
       return gapAnswer(m, request);
     }
@@ -717,30 +732,16 @@ export function createPackFetch(parts: PackParts, options: PackFetchOptions = {}
   return derivedRequestScopes(m, Object.assign(served, { owners, ownersByUnit, serves, advanceClock: async (request: Request) => runWithStorageTenant(m.service, await selectedAccount(request), () => advanceClock(request)), workspaces, boards: Boolean(parts.board), maxRequestBodySize: m.descriptor?.maxRequestBodySize, draws: drawsUrl, contentHosts, ...(upgrade ? { upgrade } : {}), ...(ingest ? { ingest } : {}) }), options.readOnly);
 }
 
-/** The vendor's gateway over its lanes: the lane a request goes to (a door to the lane that declares it, then the first
- *  route whose conditions all hold, then the default), behind the gateway's CORS; undefined when none takes it. */
-function laneRouter(vendor: string, decl: LanesDecl, lanes: Record<string, LanePart>, rootServes: (method: string, path: string) => boolean = () => false): (request: Request) => ((request: Request) => Promise<Response>) | undefined {
-  const served = (name: string): ((request: Request) => Promise<Response>) => {
-    const part = lanes[name];
-    if (!part) throw new Error(`${vendor}: the manifest routes to the lane ${name}, and the vendor's fetch is given no ${name}`);
-    // the lane is named on the request, so a write it makes records which lane's API made it (LANE_HEADER)
-    const named = (request: Request): Promise<Response> => {
-      const headers = new Headers(request.headers);
-      headers.set(LANE_HEADER, name);
-      return part.fetch(withHeaders(request, headers));
-    };
-    return decl.cors ? withCors(decl.cors, named) : named;
-  };
-  const doors = Object.entries(lanes).flatMap(([name, part]) => (part.manifest.doors ?? []).map((d) => ({
-    name, method: d.method.toUpperCase(), matches: pathMatcher(d.path.startsWith('/_twin/') ? d.path : `/_twin/${d.path.replace(/^\//, '')}`, false),
-  })));
+/** The lane selected by the vendor gateway, shared by serving and response judgment. */
+export function laneSelector(decl: LanesDecl, lanes: Record<string, { manifest: LanePart['manifest']; fetch: Pick<LanePart['fetch'], 'serves' | 'contentHosts'> }>, rootServes: (method: string, path: string) => boolean = () => false): (request: Request) => string | undefined {
+  const door = worldDoorMatcher(Object.entries(lanes).flatMap(([name, part]) => (part.manifest.doors ?? []).map((d) => ({ ...d, name }))));
   const laneRoutes = decl.routes.map((r) => {
     const at = r.path?.replace(/\/+$/, '');
     const host = r.host !== undefined ? new RegExp(r.host, 'i') : undefined;
     const except = (r.exceptHosts ?? []).map((h) => h.toLowerCase());
     const own = lanes[r.lane]?.fetch.serves;
     return {
-      lane: served(r.lane),
+      lane: r.lane,
       holds: (request: Request, path: string, name: string): boolean =>
         (at === undefined || path === at || path.startsWith(`${at}/`))
         && (host === undefined || host.test(name))
@@ -749,21 +750,42 @@ function laneRouter(vendor: string, decl: LanesDecl, lanes: Record<string, LaneP
         && !(r.unlessOnlyRoot && rootServes(request.method, path) && !(own?.(request.method, path) ?? false)),
     };
   });
-  const fallback = decl.default !== undefined ? served(decl.default) : undefined;
   return (request) => {
     // `<base>/@<host>/<path>` at a World's place, for a host a lane's built content screen names, goes to that lane, before
     // any lane is picked by the request's host or path: its own fetch answers it by its content route, under the vendor's
     // host rules (architecture, "A page at a World's place")
     const address = request.headers.has(TWIN_PREFIX_HEADER) ? contentAddressOf(new URL(request.url).pathname) : undefined;
     const content = address && Object.keys(lanes).find((l) => lanes[l]!.fetch.contentHosts?.includes(address.host));
-    if (content) return served(content);
+    if (content) return content;
     const path = new URL(request.url).pathname.replace(/\/{2,}/g, '/');
     if (path.startsWith('/_twin/')) {
-      const door = doors.find((d) => d.method === request.method && d.matches(path));
-      if (door) return served(door.name);
+      const hit = door(request.method, path);
+      if (hit) return hit.door.name;
     }
     const name = hostOf(request);
-    return laneRoutes.find((r) => r.holds(request, path, name))?.lane ?? fallback;
+    return laneRoutes.find((r) => r.holds(request, path, name))?.lane ?? decl.default;
+  };
+}
+
+/** The vendor's gateway over its lanes: the lane a request goes to (a door to the lane that declares it, then the first
+ *  route whose conditions all hold, then the default), behind the gateway's CORS; undefined when none takes it. */
+function laneRouter(vendor: string, decl: LanesDecl, lanes: Record<string, LanePart>, rootServes: (method: string, path: string) => boolean = () => false): (request: Request) => ((request: Request) => Promise<Response>) | undefined {
+  const served = (name: string): ((request: Request) => Promise<Response>) => {
+    const part = lanes[name];
+    if (!part) throw new Error(`${vendor}: the manifest routes to the lane ${name}, and the vendor's fetch is given no ${name}`);
+    // the lane is named on the request, so a write it makes records which lane's API made it (LANE_HEADER)
+    const named = (request: Request): Promise<Response> => {
+      const headers = new Headers(request.headers);
+      headers.set(LANE_HEADER, name);
+      return part.fetch(withHeaders(request, headers));
+    };
+    return decl.cors ? withCors(decl.cors, named) : named;
+  };
+  const selected = laneSelector(decl, lanes, rootServes);
+  const handlers = new Map([...new Set([...decl.routes.map((route) => route.lane), ...(decl.default === undefined ? [] : [decl.default]), ...Object.keys(lanes)])].map((name) => [name, served(name)]));
+  return (request) => {
+    const name = selected(request);
+    return name === undefined ? undefined : handlers.get(name);
   };
 }
 

package/src/request-body.ts

@@ -1,8 +1,7 @@
-/** Compressed-request output only: Node's plain requests remain uncapped; Bun retains its own plain-body limit.
- * The default is Bun's existing largest plain body (128 MiB), so both runtimes decode the same.
+/** The shared HTTP transport and compressed-request output retain Bun's 128 MiB plain-body default.
  * Source: bun-types/serve.d.ts, ServeOptions.maxRequestBodySize (@default 1024 * 1024 * 128),
  * https://github.com/oven-sh/bun/blob/main/packages/bun-types/serve.d.ts .
- * A pack's descriptor.maxRequestBodySize overrides decoded output as it does Bun's plain-body limit. */
+ * A pack's descriptor.maxRequestBodySize overrides both the transport and decoded-output limits. */
 export const DEFAULT_MAX_DECODED_REQUEST_BODY_SIZE = 128 * 1024 * 1024;
 
 export class RequestBodyTooLargeError extends Error {

package/src/runtime.ts

@@ -16,11 +16,12 @@ export { ORIGINAL_PATH_HEADER } from './sigv4.ts';
 export { createTwinFetchFromHandler, placedCookies, TWIN_PREFIX_HEADER, TWIN_REQUEST_SCOPES, TWIN_SITES_HEADER, TWIN_SITE_HEADER, siteLabel, siteUrlOf, twinPublicBase, twinSiteUrl, twinVendorUrl, withRequestScopes } from './twin-fetch.ts';
 export { isReadOnlyRequest, READ_ONLY_REQUEST_HEADER, ReadOnlyRequestError, runAsReadOnlyRequest, runAsVendorMove, writesRefused } from './request-scope.ts';
 export { compileSurface, createDerivedFetch, matchOperation, observeDerivedDispatch } from './derived.ts';
+export { hostOf, laneSelector, slashesMerged, unitRequestRouter, worldDoorMatcher } from './pack-fetch.ts';
 export { currentTraceparent, deliveryTraceHeaders, newTraceparent, parseTraceparent, runWithRequestTrace, runWithTraceparent, TRACEPARENT_HEADER, traceparentForDelivery, validTraceparent } from './trace-context.ts';
 export type { Traceparent } from './trace-context.ts';
 export type { DerivedCall, DerivedCoreOutcome, DerivedDispatch, DerivedFetch, DerivedFetchOptions, DerivedHandler, DerivedOperation, DerivedOwner, DerivedSurface, BoardFrame } from './derived.ts';
 export { authRefusal, bindSemantics, coreFor, crossCutting, flagOf, derivedRequestScopes, observeTransitions, resourcesOfType as twinResourcesOfType, semanticsContext, stateOf, transitionFor, parseBracketForm, readParams, render as renderDerived, serveCore, sse, vendorError } from './derived-core.ts';
-export { deliverEvents, fillEnvelope, setDeliveryObserver, signEvent, signEventAll, verifyEvent } from './events.ts';
+export { deliverEvents, fillEnvelope, setDeliveryObserver, settleEventDeliveries, signEvent, signEventAll, verifyEvent } from './events.ts';
 export { equalSecrets, hmac, jwks, jwtDecode, jwtSign, jwtSignClaims, jwtVerify, jwtVerifySignature, keyId, lettersFrom, md5, sha256, SIGNING_ALGORITHMS, uuidFrom } from './signing.ts';
 export type { HandlerCrypto, Jwk, Jwks, JwtDecodeOptions, JwtSignatureOptions, JwtVerdict, JwtVerificationKey, SigningKey } from './signing.ts';
 export type { EventDelivery, EventRender, EventScheme, EventsDecl, EventTransport, EventWrite } from './events.ts';

package/src/serve-http.ts

@@ -1,7 +1,7 @@
 // The HTTP server seam of the kernel (docs/contributing/architecture.md#the-serve-seam): a fetch handler on
 // a port, in the shape every `Bun.serve` call already has, so the serve path meets the runtime in
-// ONE place. Bun-backed where Bun is the runtime; `node:http`-backed otherwise, the request rebuilt
-// as a standard Request and the handler's Response written back. Async, because binding a port is
+// ONE place. Ordinary HTTP uses `node:http`; requested WebSockets retain Bun's native backend.
+// The request is rebuilt as a standard Request and the handler's Response written back. Async, because binding a port is
 // asynchronous on Node — Bun's synchronous bind is the special case.
 //
 // Nothing here runs at module scope (the served-handler registry is made on first use), and `node:http` is reached through `process.getBuiltinModule`
@@ -10,6 +10,7 @@
 
 import type { TwinStream } from './twin-fetch.ts';
 import { worldBootAnswer } from './world-boot.ts';
+import { DEFAULT_MAX_DECODED_REQUEST_BODY_SIZE, RequestBodyTooLargeError } from './request-body.ts';
 
 /** One socket library at the host seam, shared by inbound upgrades and authenticated outbound relays. */
 const socketLibrary = () => import('ws');
@@ -41,7 +42,7 @@ export type ServeHttpOptions = {
   fetch: HttpHandler;
   /** seconds a connection may idle (Bun honors it; Node's keep-alive timeout is set from it) */
   idleTimeout?: number;
-  /** Explicit transport limit in bytes; absent, Bun retains its 128 MiB default. */
+  /** Explicit transport limit in bytes; absent, 128 MiB on both runtimes. */
   maxRequestBodySize?: number;
   /** what a thrown handler answers with; absent, a 500 carrying the error (as Bun.serve) */
   error?: (error: Error) => Response | Promise<Response>;
@@ -101,7 +102,7 @@ export async function serveHttp(options: ServeHttpOptions): Promise<HttpServer>
   const hostname = options.hostname ?? '127.0.0.1';
   const urlHost = options.hostname ?? '127.0.0.1';
   const bun = bunRuntime();
-  if (bun) {
+  if (bun && (options.upgrade !== undefined || 'websocket' in options)) {
     // the global `Bun.serve` — the request journal's wrap of it (serve.ts) applies to packs and to
     // this seam alike, so the seam never decorates twice on Bun
     const upgrade = options.upgrade;
@@ -221,7 +222,8 @@ function builtin<T>(name: string): T {
 
 async function serveOnNode(options: ServeHttpOptions & { hostname: string; urlHost: string }): Promise<HttpServer> {
   const http = builtin<NodeHttp>('node:http');
-  const { Readable } = builtin<NodeStream>('node:stream');
+  const { Readable, Transform } = builtin<NodeStream>('node:stream');
+  const requestLimit = options.maxRequestBodySize ?? DEFAULT_MAX_DECODED_REQUEST_BODY_SIZE;
   if ('websocket' in options) throw new Error('serveHttp: use the portable upgrade callbacks for WebSocket support on Node');
   const protocol = options.tls ? 'https' : 'http';
   const factory = (handler: import('node:http').RequestListener) => options.tls
@@ -245,23 +247,35 @@ async function serveOnNode(options: ServeHttpOptions & { hostname: string; urlHo
     } catch { /* hostile thrown values are still reported by stage */ }
     try { process.stderr.write(`serveHttp ${stage}: ${detail.slice(0, 512)}\n`); } catch { /* stderr is best-effort */ }
   };
-  const active = new Set<AbortController>();
+  const active = new Set<() => void>();
   // Node's Request signal is dependent on the source signal. Neither a pending
   // handler nor a streaming response necessarily keeps the Request alive, so
   // retain it until the whole HTTP response path (including body cleanup) ends.
   const activeRequests = new Set<Request>();
   const server = factory((req: import('node:http').IncomingMessage, res: import('node:http').ServerResponse) => {
     const controller = new AbortController();
-    active.add(controller);
-    const abort = () => { if (!controller.signal.aborted) controller.abort(); };
+    const socket = req.socket;
+    const hasInputBody = req.headers['transfer-encoding'] !== undefined || Number(req.headers['content-length']) > 0;
+    let incoming: import('node:stream').Transform | undefined;
+    let flushingBodyRefusal = false;
+    const abort = () => {
+      if (!controller.signal.aborted) controller.abort();
+      incoming?.destroy(controller.signal.reason);
+      if (!flushingBodyRefusal) {
+        req.destroy();
+        if (!res.writableFinished) res.destroy();
+        socket.destroy();
+      }
+    };
+    active.add(abort);
     const onRequestClose = () => { if (!req.complete) abort(); };
-    const onResponseClose = () => { if (!res.writableFinished) abort(); };
+    const onResponseClose = () => { if (!res.writableFinished) { flushingBodyRefusal = false; abort(); } };
     const onSocketClose = () => { if (!res.writableFinished) abort(); };
     req.on('aborted', abort);
     req.on('close', onRequestClose);
     req.on('error', abort);
-    req.socket.on('close', onSocketClose);
-    req.socket.on('error', abort);
+    socket.on('close', onSocketClose);
+    socket.on('error', abort);
     res.on('close', onResponseClose);
     res.on('error', abort);
     const disconnected = () => controller.signal.aborted || res.destroyed;
@@ -288,17 +302,50 @@ async function serveOnNode(options: ServeHttpOptions & { hostname: string; urlHo
       if (disconnected()) closed();
     });
     let request: Request | undefined;
+    let bodyTooLarge = false;
+    const rejectBody = () => {
+      if (bodyTooLarge) return;
+      bodyTooLarge = true;
+      const error = new RequestBodyTooLargeError();
+      if (incoming) req.unpipe(incoming);
+      req.pause();
+      if (!res.headersSent && !res.destroyed) {
+        for (const name of res.getHeaderNames()) res.removeHeader(name);
+        flushingBodyRefusal = true;
+        res.writeHead(413, { 'connection': 'close', 'content-type': 'text/plain', 'content-length': Buffer.byteLength(error.message) });
+        res.once('finish', () => { flushingBodyRefusal = false; req.destroy(); });
+        res.end(error.message);
+      } else if (!res.destroyed) res.destroy(error);
+      abort();
+    };
+    const inputSettled = new Promise<void>((resolve) => {
+      const settled = () => { req.off('end', settled); req.off('close', settled); resolve(); };
+      req.once('end', settled);
+      req.once('close', settled);
+    });
     const handle = async () => {
       const method = req.method ?? 'GET';
+      if (Number(req.headers['content-length']) > requestLimit) { rejectBody(); return; }
       let response: Response;
       try {
         const headers = new Headers();
         for (const [k, v] of Object.entries(req.headers)) { if (v === undefined) continue; if (Array.isArray(v)) for (const one of v) headers.append(k, one); else headers.set(k, v); }
         const url = `${protocol}://${req.headers.host ?? `${options.hostname}:${(server.address() as { port: number } | null)?.port ?? 0}`}${req.url ?? '/'}`;
         const withBody = method !== 'GET' && method !== 'HEAD';
-        const init: RequestInit & { duplex?: 'half' } = { method, headers, signal: controller.signal, ...(withBody ? { body: Readable.toWeb(req) as unknown as ReadableStream, duplex: 'half' } : {}) };
+        let received = 0;
+        incoming = new Transform({ transform(chunk: Buffer, _encoding, callback) {
+          received += chunk.byteLength;
+          if (received > requestLimit) { rejectBody(); callback(new RequestBodyTooLargeError()); }
+          else callback(null, chunk);
+        } });
+        const inputClosed = () => { if (!req.readableEnded) abort(); };
+        incoming.on('error', inputClosed);
+        incoming.once('close', inputClosed);
+        const init: RequestInit & { duplex?: 'half' } = { method, headers, signal: controller.signal, ...(withBody ? { body: Readable.toWeb(incoming) as unknown as ReadableStream, duplex: 'half' } : {}) };
         request = new Request(url, init);
         activeRequests.add(request);
+        req.pipe(incoming);
+        if (!withBody) incoming.resume();
         response = await options.fetch(request);
       } catch (error) {
         if (disconnected()) return;
@@ -340,6 +387,7 @@ async function serveOnNode(options: ServeHttpOptions & { hostname: string; urlHo
         if (disconnected()) { await cancelOwnedReader(); return; }
         res.statusCode = response.status;
         for (const [k, v] of response.headers) { if (k !== 'set-cookie') res.setHeader(k, v); }
+        res.strictContentLength = response.headers.has('content-length');
         const cookies = response.headers.getSetCookie?.() ?? [];
         if (cookies.length) res.setHeader('set-cookie', cookies);
         if (reader) {
@@ -382,12 +430,18 @@ async function serveOnNode(options: ServeHttpOptions & { hostname: string; urlHo
       if (!res.destroyed) res.destroy(error instanceof Error ? error : new Error(String(error)));
     }).then(async () => {
       await responseSettled;
-      active.delete(controller);
+      // A runtime may retire its native body forwarding when the response ends.
+      // Close unfinished input after the response flushes; a consumed upload keeps its connection.
+      if (hasInputBody && !incoming?.readableEnded) abort();
+      else incoming?.resume();
+      await inputSettled;
+      if (incoming) { req.unpipe(incoming); incoming.destroy(); }
+      active.delete(abort);
       req.off('aborted', abort);
       req.off('close', onRequestClose);
       req.off('error', abort);
-      req.socket.off('close', onSocketClose);
-      req.socket.off('error', abort);
+      socket.off('close', onSocketClose);
+      socket.off('error', abort);
       res.off('close', onResponseClose);
       res.off('error', abort);
     });
@@ -415,7 +469,7 @@ async function serveOnNode(options: ServeHttpOptions & { hostname: string; urlHo
   const port = (server.address() as { port: number }).port;
   return {
     hostname: options.hostname, port, url: new URL(`${protocol}://${options.urlHost}:${port}/`),
-    stop: (closeActive = true) => new Promise<void>((resolve) => { if (closeActive) { for (const controller of active) controller.abort(); for (const peer of socketServer?.clients ?? []) peer.terminate(); } socketServer?.close(); server.close(() => { if (closeActive && active.size) reportCleanup('forced stop left pending handler cleanup', `${active.size} request(s)`); resolve(); }); if (closeActive) server.closeAllConnections(); }),
+    stop: (closeActive = true) => new Promise<void>((resolve) => { if (closeActive) { for (const abort of active) abort(); for (const peer of socketServer?.clients ?? []) peer.terminate(); } socketServer?.close(); server.close(() => { if (closeActive && active.size) reportCleanup('forced stop left pending handler cleanup', `${active.size} request(s)`); resolve(); }); if (closeActive) server.closeAllConnections(); }),
   };
 }