castrum 0.7.0 → 0.9.1

package/src/ingress/routes/common.ts

@@ -0,0 +1,79 @@
+// src/ingress/routes/common.ts — Shared route-handler options + helpers.
+
+import type { BakedContext, OptimizedIngressHandler } from '../types'
+import type { BakedIngressResult } from '../decode/baked-result'
+import { secondsFromMs } from '../shared'
+
+/** Options accepted by the pre-baked route factories. */
+export interface BakedHandlerOptions {
+  /** Resolve the client IP from the server object (e.g. `srv.requestIP`). */
+  getIp?: (req: Request, srv: unknown) => string | undefined
+  /** Copy body slices instead of sharing the native buffer. Default: true (safe). */
+  copyBody?: boolean
+  /** Maximum request body bytes for write/echo handlers. Default: 1 MiB. */
+  maxBodyBytes?: number
+  /**
+   * Overall deadline (ms) for reading the request body. Default: 30s
+   * (`DEFAULT_BODY_TIMEOUT_MS`). Set `0` to disable. Protects against
+   * slowloris / trickling bodies.
+   */
+  bodyTimeoutMs?: number
+  /** Fallback handler used for write error paths. Defaults to the write ingress. */
+  fallback?: OptimizedIngressHandler
+  /**
+   * When true, route the JSON-validity fallback check through the higher-order
+   * loader (`loader("jsonValid")`) instead of the direct native call —
+   * exercising the loader's dispatch + counters on the real request path.
+   * Default: false (the direct call is marginally faster for a single request;
+   * the loader pays off for same-tick bursts / bulk work, see src/integration/batch.ts).
+   */
+  enableLoader?: boolean
+}
+
+/** Resolve the client IP for a route request via the configured getter. */
+export function resolveIp(
+  req: Request,
+  srv: unknown,
+  opts: BakedHandlerOptions,
+): string | undefined {
+  return opts.getIp ? opts.getIp(req, srv) : undefined
+}
+
+/**
+ * Build the success `ResponseInit` (status + ratelimit headers) shared by
+ * every pre-baked success path. A plain function call, so the hot path keeps
+ * its single init-object allocation and nothing else.
+ *
+ * @param status Success status; defaults to 200.
+ */
+export function buildSuccessInit(
+  ingress: OptimizedIngressHandler,
+  result: BakedIngressResult,
+  ctx: BakedContext,
+  status = 200,
+): ResponseInit {
+  return {
+    status,
+    headers: ingress.responseHeaders(
+      result.headerVariant,
+      ctx.requestIdHeader,
+      ctx.origin,
+      result.rateRemaining,
+      result.rateResetMs > 0 ? secondsFromMs(result.rateResetMs) : undefined,
+    ),
+  }
+}
+
+/**
+ * Wrap a `(result, ctx) => Response` responder in the shared sync route
+ * runner: resolve the client IP once and dispatch through the native pipeline
+ * (`ingress.run` with a null body). Used by the read / head / fallback route
+ * factories whose responder never needs the request object.
+ */
+export function runBaked(
+  ingress: OptimizedIngressHandler,
+  opts: BakedHandlerOptions,
+  respond: (result: BakedIngressResult, ctx: BakedContext) => Response,
+): (req: Request, srv?: unknown) => Response {
+  return (req, srv) => ingress.run<Response>(req, resolveIp(req, srv, opts), null, respond)
+}

package/src/ingress/routes/delete.ts

@@ -0,0 +1,14 @@
+// src/ingress/routes/delete.ts — Pre-baked DELETE handler.
+
+import { readHandler } from './read'
+
+/**
+ * Pre-baked DELETE handler: DELETE is a read-style method (no request body is
+ * read), so it shares the exact pipeline flow of {@link readHandler} — it
+ * returns the ingress body JSON on success and the terminal/error responses
+ * otherwise. Reusing the read factory keeps the two handlers byte-identical
+ * and avoids a copy-pasted variant.
+ *
+ * Wire it via the `delete` key of a `BakedRoute` (see `createIngressServer`).
+ */
+export const deleteHandler = readHandler

package/src/ingress/routes/echo.ts

@@ -0,0 +1,107 @@
+// src/ingress/routes/echo.ts — Pre-baked echo handler.
+
+import type { OptimizedIngressHandler } from '../types'
+import { resolveIp, type BakedHandlerOptions } from './common'
+import { DEFAULT_MAX_BODY_BYTES, DEFAULT_BODY_TIMEOUT_MS, secondsFromMs } from '../shared'
+import { HV_JSON } from '../constants'
+import { ERROR_BODIES } from '../response/error-bodies'
+import { readBodyWithLimit } from '../body'
+
+/**
+ * Pre-baked echo handler: streams the request body back with the client's
+ * Content-Type, bounded by `maxBodyBytes`.
+ */
+export function echoHandler(
+  ingress: OptimizedIngressHandler,
+  opts: BakedHandlerOptions = {},
+): (req: Request, srv?: unknown) => Promise<Response> {
+  const maxBodyBytes = opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES
+  // Non-zero default: protect against slowloris / trickling bodies.
+  const bodyTimeoutMs = opts.bodyTimeoutMs ?? DEFAULT_BODY_TIMEOUT_MS
+
+  return async (req, srv) => {
+    const ip = resolveIp(req, srv, opts)
+
+    const prep = ingress.run<{
+      terminal?: Response
+      headers?: ReadonlyArray<[string, string]>
+    }>(req, ip, null, (result, ctx) => {
+      const terminal = ingress.terminalResponse(req, result, ctx)
+      if (terminal) return { terminal }
+
+      if (result.bodyTruncated) {
+        return { terminal: ingress.internalErrorResponse(ctx, result) }
+      }
+
+      const hv = result.headerVariant & ~HV_JSON
+
+      return {
+        headers: ingress.responseHeaders(
+          hv,
+          ctx.requestIdHeader,
+          ctx.origin,
+          result.rateRemaining,
+          result.rateResetMs > 0 ? secondsFromMs(result.rateResetMs) : undefined,
+        ),
+      }
+    })
+
+    if (prep.terminal) return prep.terminal
+
+    const baseHeaders: ReadonlyArray<[string, string]> = prep.headers ?? []
+
+    const requestedContentType = req.headers.get('content-type') ?? 'application/octet-stream'
+
+    const contentLengthHeader = req.headers.get('content-length')
+    const contentLength = contentLengthHeader === null ? NaN : Number(contentLengthHeader)
+
+    if (Number.isFinite(contentLength)) {
+      if (contentLength > maxBodyBytes) {
+        return new Response(ERROR_BODIES.body_too_large, {
+          status: 413,
+          headers: ingress.withContentType(baseHeaders, 'application/json'),
+        })
+      }
+
+      if (contentLength <= 0 || req.body === null) {
+        return new Response(null, {
+          status: 200,
+          headers: ingress.withContentType(baseHeaders, requestedContentType),
+        })
+      }
+
+      return new Response(req.body, {
+        status: 200,
+        headers: ingress.withContentType(baseHeaders, requestedContentType),
+      })
+    }
+
+    try {
+      // Chunked / unknown-length body: stream-read with the limit enforced
+      // WHILE reading and an overall deadline — never fully buffer an
+      // oversized or trickling body before rejecting it.
+      const bodyBytes = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs)
+
+      return new Response(bodyBytes.byteLength > 0 ? bodyBytes : null, {
+        status: 200,
+        headers: ingress.withContentType(baseHeaders, requestedContentType),
+      })
+    } catch (err) {
+      const code = (err as { code?: string } | null)?.code
+      const isTooLarge = code === 'BODY_TOO_LARGE'
+      const isTimeout = code === 'REQUEST_TIMEOUT'
+
+      return new Response(
+        isTooLarge
+          ? ERROR_BODIES.body_too_large
+          : isTimeout
+            ? ERROR_BODIES.request_timeout
+            : ERROR_BODIES.bad_request,
+        {
+          status: isTooLarge ? 413 : isTimeout ? 408 : 400,
+          headers: ingress.withContentType(baseHeaders, 'application/json'),
+        },
+      )
+    }
+  }
+}

package/src/ingress/routes/fallback.ts

@@ -0,0 +1,23 @@
+// src/ingress/routes/fallback.ts — Pre-baked fallback handler.
+
+import type { BakedContext, OptimizedIngressHandler } from '../types'
+import type { BakedIngressResult } from '../decode/baked-result'
+import { runBaked, type BakedHandlerOptions } from './common'
+
+/**
+ * Pre-baked fallback handler: 404 for unmatched routes / OPTIONS.
+ */
+export function fallbackHandler(
+  ingress: OptimizedIngressHandler,
+  opts: BakedHandlerOptions = {},
+): (req: Request, srv?: unknown) => Response {
+  // Result→Response callback, built ONCE per handler (no per-request closure).
+  const respond = (result: BakedIngressResult, ctx: BakedContext): Response => {
+    const terminal = ingress.terminalResponse(undefined, result, ctx)
+    if (terminal) return terminal
+
+    return ingress.errorResponse(undefined, result, 404, 'not_found', 'Not found', ctx)
+  }
+
+  return runBaked(ingress, opts, respond)
+}

package/src/ingress/routes/head.ts

@@ -0,0 +1,27 @@
+// src/ingress/routes/head.ts — Pre-baked HEAD read handler.
+
+import type { BakedContext, OptimizedIngressHandler } from '../types'
+import type { BakedIngressResult } from '../decode/baked-result'
+import { buildSuccessInit, runBaked, type BakedHandlerOptions } from './common'
+
+/**
+ * Pre-baked HEAD read handler: headers only, no body.
+ */
+export function headHandler(
+  ingress: OptimizedIngressHandler,
+  opts: BakedHandlerOptions = {},
+): (req: Request, srv?: unknown) => Response {
+  // Result→Response callback, built ONCE per handler (no per-request closure).
+  const respond = (result: BakedIngressResult, ctx: BakedContext): Response => {
+    const terminal = ingress.terminalResponse(undefined, result, ctx)
+    if (terminal) return terminal
+
+    if (result.bodyTruncated) {
+      return ingress.internalErrorResponse(ctx, result)
+    }
+
+    return new Response(null, buildSuccessInit(ingress, result, ctx))
+  }
+
+  return runBaked(ingress, opts, respond)
+}

package/src/ingress/routes/index.ts

@@ -0,0 +1,11 @@
+// src/ingress/routes/index.ts — Route-handler factory composer.
+
+export * from './common'
+export * from './delete'
+export * from './echo'
+export * from './fallback'
+export * from './head'
+export * from './json-write'
+export * from './options'
+export * from './read'
+export * from './responder'

package/src/ingress/routes/json-write.ts

@@ -0,0 +1,129 @@
+// src/ingress/routes/json-write.ts — Pre-baked JSON-write handler
+// (POST/PUT/PATCH).
+
+import type { OptimizedIngressHandler } from '../types'
+import { buildSuccessInit, resolveIp, type BakedHandlerOptions } from './common'
+import { DEFAULT_MAX_BODY_BYTES, DEFAULT_BODY_TIMEOUT_MS } from '../shared'
+import { readBodyWithLimit } from '../body'
+import { getAddon } from '../../native'
+import { getBunFFI } from '../../native/ffi'
+
+/**
+ * Zero-DOM JSON-validity check — the same native fast path the ingress
+ * pipeline uses internally (`json_valid_bytes`).
+ *
+ * Used by `jsonWriteHandler` as a fallback when the pipeline skipped JSON
+ * validation because neither `requireJsonBody` nor a `schema` is configured
+ * on the ingress (see the `bodyValidJson` handling in the route).
+ *
+ * bun:ffi is primary on Bun; the napi addon is the fallback (Node, forced
+ * `CASTRUM_FFI_MODE=napi`, or a failed ffi self-test).
+ */
+function isValidJsonBytes(bytes: Uint8Array): boolean {
+  const ffi = getBunFFI()
+  return ffi ? ffi.jsonValid(bytes) : getAddon().jsonValid(bytes)
+}
+
+/**
+ * Pre-baked JSON-write handler (POST/PUT/PATCH): enforces Content-Type,
+ * content-length/body-size limits, JSON validity and (optionally) schema
+ * validation, then returns the ingress body JSON on success.
+ */
+export function jsonWriteHandler(
+  ingress: OptimizedIngressHandler,
+  opts: BakedHandlerOptions = {},
+): (req: Request, srv?: unknown) => Promise<Response> {
+  const maxBodyBytes = opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES
+  const fallback = opts.fallback ?? ingress
+  const copyBody = opts.copyBody !== false
+  // Non-zero default: protect against slowloris / trickling bodies. Set
+  // `bodyTimeoutMs: 0` to disable.
+  const bodyTimeoutMs = opts.bodyTimeoutMs ?? DEFAULT_BODY_TIMEOUT_MS
+
+  return async (req, srv) => {
+    const ip = resolveIp(req, srv, opts)
+
+    const contentType = req.headers.get('content-type') ?? ''
+    if (!contentType.includes('application/json')) {
+      return fallback.run(req, ip, null, (result, ctx) => {
+        const terminal = fallback.terminalResponse(req, result, ctx)
+        if (terminal) return terminal
+
+        return fallback.errorResponse(
+          req,
+          result,
+          415,
+          'unsupported_media_type',
+          'Content-Type must be application/json',
+          ctx,
+        )
+      })
+    }
+
+    // Content-Length / body-size enforcement happens INSIDE readBodyWithLimit
+    // (guard on): the declared length is checked before reading and re-checked
+    // after, so a client lying about Content-Length still gets a 413. Not
+    // re-reading the header here saves a per-POST headers.get on the hot path.
+    let bodyBytes: Uint8Array
+    try {
+      // Stream-read with the limit enforced WHILE reading — a body that
+      // exceeds maxBodyBytes is rejected as soon as the limit is crossed,
+      // never fully buffered first.
+      bodyBytes = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs)
+    } catch (err) {
+      const code = (err as { code?: string } | null)?.code
+      const isTooLarge = code === 'BODY_TOO_LARGE'
+      return fallback.run(req, ip, null, (result, ctx) => {
+        const terminal = fallback.terminalResponse(req, result, ctx)
+        if (terminal) return terminal
+
+        return fallback.errorResponse(
+          req,
+          result,
+          isTooLarge ? 413 : 408,
+          isTooLarge ? 'body_too_large' : 'request_timeout',
+          isTooLarge ? 'Request body is too large' : 'Request body read timed out',
+          ctx,
+        )
+      })
+    }
+
+    return ingress.run(req, ip, bodyBytes, (result, ctx) => {
+      const terminal = ingress.terminalResponse(req, result, ctx)
+      if (terminal) return terminal
+
+      if (result.bodyTruncated) {
+        return ingress.internalErrorResponse(ctx, result)
+      }
+
+      // `bodyValidJson`/`schemaValid` are only computed when the pipeline ran
+      // JSON validation — i.e. when `requireJsonBody` is set or a `schema` is
+      // configured on the ingress. When `bodyValidJson` is false here,
+      // validation was skipped entirely (a genuine validation failure already
+      // short-circuits as a terminal 400 above). In that case enforce validity
+      // with the same zero-DOM native check, and schema validation trivially
+      // passes because no schema was configured (had one been, the pipeline
+      // would have run and set the flags).
+      if (result.bodyValidJson) {
+        if (!result.schemaValid) {
+          return ingress.errorResponse(
+            req,
+            result,
+            422,
+            'schema_validation_failed',
+            'Request body failed schema validation',
+            ctx,
+          )
+        }
+      } else if (!isValidJsonBytes(bodyBytes)) {
+        return ingress.errorResponse(req, result, 400, 'invalid_json', 'Invalid JSON body', ctx)
+      }
+
+      const init = buildSuccessInit(ingress, result, ctx)
+
+      return copyBody
+        ? new Response(result.bodyJson(true), init)
+        : ingress.zeroCopyResponse(result, ctx, init)
+    })
+  }
+}

package/src/ingress/routes/options.ts

@@ -0,0 +1,26 @@
+// src/ingress/routes/options.ts — Pre-baked OPTIONS handler (CORS preflight).
+
+import type { OptimizedIngressHandler } from '../types'
+import { buildSuccessInit, resolveIp, type BakedHandlerOptions } from './common'
+
+/**
+ * Pre-baked OPTIONS handler: serves the native pipeline's CORS preflight
+ * decision — 204 when the preflight is allowed, 403 (terminal) when denied —
+ * and a plain 204 for non-preflight OPTIONS.
+ *
+ * `createIngressServer` wires this for EVERY route that has a handler, so
+ * read-only routes also answer preflights (previously OPTIONS only reached the
+ * pipeline on write routes that also configured a fallback).
+ */
+export function optionsHandler(
+  ingress: OptimizedIngressHandler,
+  opts: BakedHandlerOptions = {},
+): (req: Request, srv?: unknown) => Response {
+  return (req, srv) =>
+    ingress.run<Response>(req, resolveIp(req, srv, opts), null, (result, ctx) => {
+      const terminal = ingress.terminalResponse(req, result, ctx)
+      if (terminal) return terminal
+
+      return new Response(null, buildSuccessInit(ingress, result, ctx, 204))
+    })
+}

package/src/ingress/routes/read.ts

@@ -0,0 +1,35 @@
+// src/ingress/routes/read.ts — Pre-baked GET read handler.
+
+import type { BakedContext, OptimizedIngressHandler } from '../types'
+import type { BakedIngressResult } from '../decode/baked-result'
+import { buildSuccessInit, runBaked, type BakedHandlerOptions } from './common'
+
+/**
+ * Pre-baked GET read handler: returns the ingress body JSON on success.
+ */
+export function readHandler(
+  ingress: OptimizedIngressHandler,
+  opts: BakedHandlerOptions = {},
+): (req: Request, srv?: unknown) => Response {
+  const copyBody = opts.copyBody !== false
+
+  // Result→Response callback, built ONCE per handler (it depends only on the
+  // ingress handle + config, never on the per-request `req`), so the hot path
+  // allocates no fresh closure per request.
+  const respond = (result: BakedIngressResult, ctx: BakedContext): Response => {
+    const terminal = ingress.terminalResponse(undefined, result, ctx)
+    if (terminal) return terminal
+
+    if (result.bodyTruncated) {
+      return ingress.internalErrorResponse(ctx, result)
+    }
+
+    const init = buildSuccessInit(ingress, result, ctx)
+
+    return copyBody
+      ? new Response(result.bodyJson(true), init)
+      : ingress.zeroCopyResponse(result, ctx, init)
+  }
+
+  return runBaked(ingress, opts, respond)
+}

package/src/ingress/routes/responder.ts

@@ -0,0 +1,159 @@
+// src/ingress/routes/responder.ts — JS responder bridge over the native
+// pipeline ("native decides, JS formats the 2xx").
+//
+// The responder bridge is the castrum foundation for delegating a WHOLE
+// request to the per-route native `IngressInner` while keeping the 2xx body in
+// JS: the native pipeline runs parse/validate/CORS/rate-limit/limits and either
+// produces a terminal (rejection) response — in the configured envelope style —
+// or hands a decoded snapshot to a `NativeResponder` that builds the 2xx.
+//
+// The sync/async boundary is deliberate: `OptimizedIngressHandler.run()` is
+// SYNC-only (`assertSyncCallback` rejects thenables), so the factory captures
+// the decoded snapshot (requestId/query/cookies/body/verdicts) INSIDE the sync
+// callback and calls the async `responder` OUTSIDE it, after the pooled output
+// buffer has been released. `result.body` is the caller-provided request body
+// (never the pooled output buffer), so the snapshot's `body` is safe to hold.
+
+import { decoder } from '../../shared/bytes'
+import { generateRequestId } from '../../shared/request-id'
+import { readBodyWithLimit } from '../body'
+import type { BakedIngressResult } from '../decode/baked-result'
+import { errorCodeName, errorMessage } from '../errors'
+import type { RouteHandler } from '../server'
+import { DEFAULT_BODY_TIMEOUT_MS, DEFAULT_MAX_BODY_BYTES } from '../shared'
+import { safeTerminalStatus } from '../status'
+import type {
+  BakedContext,
+  NativeRequestContext,
+  NativeResponder,
+  OptimizedIngressHandler,
+  TerminalStyle,
+} from '../types'
+import { type BakedHandlerOptions, resolveIp } from './common'
+
+/** Options for {@link nativeResponderRoute}. */
+export interface ResponderRouteOptions extends BakedHandlerOptions {
+  /** Terminal envelope style. Default: `'castrum'` (the pre-baked wire). */
+  terminalStyle?: TerminalStyle
+  /**
+   * Read the request body and pass it to the native pipeline for validation
+   * (`requireJsonBody`/schema). Default `false` — the framework owns the body
+   * (the responder reads it via `ctx.body`); native only needs the bytes when
+   * a body stage is enabled in the route's `IngressHandlerOptions`.
+   */
+  readBody?: boolean
+}
+
+/** ignex framework security posture for terminal responses. */
+const IGNGEX_SECURITY_HEADERS: [string, string][] = [
+  ['x-frame-options', 'DENY'],
+  ['x-content-type-options', 'nosniff'],
+  ['referrer-policy', 'no-referrer'],
+]
+
+/** Build the ignex-framework terminal envelope (`{error,status,code}` + security headers). */
+function buildIgngexTerminal(result: BakedIngressResult, _ctx: BakedContext): Response {
+  const preflightAllowed = result.isPreflight && result.corsAllowed
+  if (preflightAllowed) {
+    return new Response(null, { status: 204, headers: IGNGEX_SECURITY_HEADERS })
+  }
+  const status = safeTerminalStatus(result)
+  const body = JSON.stringify({
+    error: errorMessage(status, result.errorCode),
+    status,
+    code: errorCodeName(result.errorCode),
+  })
+  const headers = new Headers(IGNGEX_SECURITY_HEADERS)
+  headers.set('content-type', 'application/json; charset=utf-8')
+  return new Response(body, { status, headers })
+}
+
+/** Parse a `queryJson()`/`cookiesJson()` section into an object (empty on failure). */
+function parseSection(json: string): Record<string, unknown> {
+  try {
+    const v: unknown = JSON.parse(json)
+    return v !== null && typeof v === 'object' && !Array.isArray(v)
+      ? (v as Record<string, unknown>)
+      : {}
+  } catch {
+    return {}
+  }
+}
+
+/**
+ * Build a responder route: native pipeline decides + rejects (terminal
+ * response in the chosen style); on success the JS `responder` builds the 2xx.
+ * Returns an async `RouteHandler` (`(req, srv?, params?) => Promise<Response>`).
+ */
+export function nativeResponderRoute(
+  ingress: OptimizedIngressHandler,
+  responder: NativeResponder,
+  opts: ResponderRouteOptions = {},
+): RouteHandler {
+  const terminalStyle: TerminalStyle = opts.terminalStyle ?? 'castrum'
+  const readBody = opts.readBody ?? false
+  const maxBodyBytes = opts.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES
+  const bodyTimeoutMs = opts.bodyTimeoutMs ?? DEFAULT_BODY_TIMEOUT_MS
+
+  return async (req, srv, _params) => {
+    const ip = resolveIp(req, srv, opts)
+    // The request-id the framework surfaces (same source as the pre-baked path's
+    // `ctx.requestIdHeader`): the baked result does not carry it, so generate it
+    // here — the native pipeline uses the same rid for its internal frame.
+    const requestId = decoder.decode(generateRequestId())
+    // Read the body ONLY when native validation needs it (the framework owns
+    // the body otherwise). A `BODY_TOO_LARGE`/`REQUEST_TIMEOUT` throw becomes
+    // a terminal 413/408 from the native path.
+    let body: Uint8Array | null = null
+    if (readBody) {
+      try {
+        body = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs)
+      } catch (err) {
+        const code = (err as Error & { code?: string }).code
+        const status = code === 'REQUEST_TIMEOUT' ? 408 : code === 'BODY_TOO_LARGE' ? 413 : 400
+        const payload = JSON.stringify({ error: 'Bad Request', status, code: 'BAD_REQUEST' })
+        const headers = new Headers(IGNGEX_SECURITY_HEADERS)
+        headers.set('content-type', 'application/json; charset=utf-8')
+        return new Response(payload, { status, headers })
+      }
+    }
+
+    let terminal: Response | null = null
+    let snapshot: NativeRequestContext | null = null
+
+    // Sync callback (never returns a thenable). Captures the decoded snapshot
+    // or the terminal response, then the async responder runs outside `run()`.
+    ingress.run<null>(req, ip, body, (result, ctx) => {
+      if (result.terminal || !result.ok) {
+        terminal =
+          terminalStyle === 'ignex'
+            ? buildIgngexTerminal(result, ctx)
+            : ingress.terminalResponse(req, result, ctx)
+        return null
+      }
+      const query = parseSection(result.queryJson())
+      const cookies = parseSection(result.cookiesJson())
+      snapshot = {
+        requestId,
+        status: result.status,
+        rateLimited: result.rateLimited,
+        retryAfterMs: result.retryAfterMs,
+        query: query as Record<string, string | string[]>,
+        cookies: cookies as Record<string, string>,
+        body: body ?? new Uint8Array(0),
+        ip,
+        req,
+      }
+      return null
+    })
+
+    if (terminal !== null) {
+      return terminal
+    }
+    if (snapshot === null) {
+      // Native internal error (setInternalError) — the result was never OK.
+      return ingress.internalErrorResponse({ requestIdHeader: null, origin: null })
+    }
+    return responder(snapshot)
+  }
+}