castrum 0.9.0 → 0.9.2

package/docs/bun-builtins-decision-matrix.md

@@ -2,7 +2,7 @@
 
 > **Question this answers**: for the same workload, does a Bun native built-in
 > beat the castrum Rust op? Where it does, castrum should stop reinventing the
-> wheel and `@flux/native` should delegate to Bun; where castrum wins (or Bun
+> wheel and delegate to Bun; where castrum wins (or Bun
 > has no sync equivalent), the Rust op stands.
 
 ## Methodology
@@ -12,9 +12,8 @@
   shipped profile).
 - **Driver**: `bun run check` (CPU benchmark → `bench/results/cpu/latest.json`).
   Each pair runs on the SAME input (fixture payloads, see table).
-- **Naming**: diagnostic comparisons use `diag:` task names so
-  `scripts/check-proven.ts` never aggregates them into a `PROVEN_SURFACE`
-  entry (see `src/bench/comparisons.ts`).
+- **Naming**: diagnostic comparisons use `diag:` task names so they are kept out
+  of the shipped-op `native:`/`rust:` comparisons (see `src/bench/comparisons.ts`).
 - **Honesty guard**: every Bun API is verified to actually execute real work at
   runtime before a result is trusted. This is important — the first run
   produced false "wins" (brotli 156×, validators 3–5×) because this Bun
@@ -56,22 +55,30 @@
 
 ## Decisions
 
-### → Delegate to Bun at the `@flux/native` wrapper layer (Bun wins)
+### → Delegate to Bun at the selection layer (Bun wins)
 These rust ops lose to Bun's native implementation on the SAME workload — the
 FFI crossing cannot beat Bun's in-process C++:
 
+This table mirrors `BUILTIN_OPS` in `src/runtime/builtins.ts` (the 11 ops that
+delegate to Bun built-ins under Bun; `src/selection.ts` derives from it). `fnv1a64` is parity/either but is NOT delegated
+(`Bun.hash` is wyhash — a different algorithm — and rust `fnv1a64` stays the
+benchmarked impl).
+
 | Op | Recommendation |
 |---|---|
 | `crc32` | Prefer `Bun.hash.crc32`; keep rust as fallback (pure-TS path already exists). |
-| `xxh3` | Prefer `Bun.hash.xxHash3` (~4×); keep the rust export as the Node/non-Bun fast path. Classified `not-competitive` in `PROVEN_SURFACE`. |
-| `gzipCompress` / `gzipDecompress` | Prefer `Bun.gzipSync` / `Bun.gunzipSync`. |
+| `xxh3` | Prefer `Bun.hash.xxHash3` (~4×); keep the rust export as the Node/non-Bun fast path. The runtime adapter delegates the public `rust.xxh3` to Bun under Bun. |
+| `gzipCompress` | Prefer `Bun.gzipSync` (~2×). **`gzipDecompress` is deliberately NOT delegated** — `Bun.gunzipSync` has no decompression-bomb cap; the rust surface keeps its native 64 MiB-capped path under Bun. |
 | `randomToken` | Prefer `Bun.randomUUIDv7()` (or `crypto.getRandomValues`) for token-sized output; keep rust for byte-precise control. |
 | `hmacSha256` | Prefer `Bun.CryptoHasher("sha256", key)` (1.17× — mild; keep rust batch path, which wins on larger inputs). |
-| `fnv1a64` | Parity — either is fine; `Bun.hash` (wyhash) is a stronger algorithm, prefer it for NEW non-crypto hashing needs. |
+| `urlEncode` / `urlDecode` | Prefer `encodeURIComponent` / `decodeURIComponent` (JSC string builtins — ~11.5×, zero alloc). |
+| `base64Encode` / `base64UrlEncode` | Prefer `Buffer.toString('base64'|'base64url')`. |
+| `hexEncode` | Prefer `Buffer.toString('hex')`. |
+| `httpDate` | Prefer `Date.toUTCString()`. |
 
-**Delegation rule of thumb**: rust stays the default only where it is
-`proven` against its **Bun** baseline (not just its JS baseline). These are the
-ops where rust genuinely wins or Bun has no equivalent.
+**Delegation rule of thumb**: rust stays the default only where it beats its
+**Bun** baseline (not just its JS baseline). These are the ops where rust
+genuinely wins or Bun has no equivalent.
 
 ### → Keep rust (rust wins or Bun has no equivalent)
 | Op | Rationale |
@@ -83,19 +90,19 @@ ops where rust genuinely wins or Bun has no equivalent.
 | `validateEmail` / `validateUuid` / `validateIpv4` / `validateIpv6` | `Bun.validators` absent in 1.4; keep rust. Re-check when Bun adds it. |
 | `jsonValid` / `jsonSumIds` / packed parsers / ingress | No Bun sync equivalent for the zero-DOM / zero-copy semantics; keep rust. |
 
-### → Add primitives that close gaps (Phase 2)
-| Gap | Plan |
+### → Implemented primitives (gaps closed)
+| Primitive | Outcome |
 |---|---|
-| Public XXH3-64 (`rust.xxh3`) | **Done** — exposed; measured Bun.hash.xxHash3 4.15× faster → classify `not-competitive`, prefer Bun under Bun. |
-| bcrypt | **Done** — `rust.passwordHashBcrypt`/`passwordVerifyBcrypt`; hash parity, verify rust 1.49×. |
-| PBKDF2 | **Done** — `rust.pbkdf2Sha256`; parity with node:crypto, only sync option in Bun. |
-| UUIDv7 | `Bun.randomUUIDv7` already wins — **do not** build a rust UUIDv7; use Bun. |
+| `rust.xxh3` (XXH3-64) | Exposed; measured `Bun.hash.xxHash3` 4.15× faster → the runtime adapter delegates the public `rust.xxh3` to Bun under Bun (Node keeps the addon). |
+| `rust.passwordHashBcrypt` / `rust.passwordVerifyBcrypt` | bcrypt `$2b$` PHC; hash parity, verify rust 1.49×. |
+| `rust.pbkdf2Sha256` | PBKDF2-HMAC-SHA256; parity with `node:crypto`, the only sync option in Bun. |
+| UUIDv7 (`uuidv7()`) | `Bun.randomUUIDv7` already wins — delegated to Bun (`crypto.randomUUID` on Node), not built in Rust. |
 
 ## Summary
 
 **The "don't reinvent the wheel" takeaway:** for non-cryptographic hashing,
 random tokens, and gzip, Bun 1.4's built-ins are already faster than any
-FFI-crossing Rust op — `@flux/native` should prefer them. Rust retains a clear,
+FFI-crossing Rust op — the selection layer should prefer them. Rust retains a clear,
 defensible moat exactly where it matters: **argon2id password hashing
 (≈1.9× vs Bun)**, the **zero-DOM / zero-copy parsers and JSON paths** (no Bun
 sync equivalent), and **brotli** (no Bun sync API).

package/index.ts

@@ -1,9 +1,15 @@
 // index.ts — castrum package entry (barrel).
 //
 // Re-exports the full public API: the flat `rust.*` FFI surface
-// (src/rust-ffi), the runtime selection hints (src/selection), the
-// performance-proven registry (src/shared/proven), and the higher-order
-// loader (src/loader). See AGENTS.md for the layout map.
+// (src/rust-ffi), the runtime selection hints (src/selection), and the
+// higher-order loader (src/loader). See AGENTS.md for the layout map.
+//
+// EAGER-DLOPEN CONTRACT: this barrel unconditionally re-exports `src/ingress`
+// → `src/ingress/constants.ts`, which is the ONE module that touches native at
+// import time (it reads the Rust binary layout and runs the bind-time
+// self-test). This is intentional — even `import { rust }` pays the eager
+// load. Do NOT add more eager-native modules; keep everything else lazy (see
+// test/unit/features/import-contract.test.ts).
 
 export * from './src/rust-ffi'
 
@@ -15,19 +21,6 @@ export * from './src/rust-ffi'
 export { opImpl, isNativeOp, opDecision } from './src/selection'
 export type { OpImpl, OpDecision } from './src/selection'
 
-// Performance-proven surface: only `rust.*` functions that beat their JS
-// baseline in benchmarks. See src/shared/proven.ts for the registry.
-export {
-  proven,
-  PROVEN_SURFACE,
-  provenStatus,
-  isProven,
-  provenSurface,
-  provenSummary,
-} from './src/rust-ffi/proven'
-export type { ProvenClient, ProvenKey } from './src/rust-ffi/proven'
-export type { PerformanceStatus, ProvenEntry } from './src/shared/proven'
-
 export { encoder, decoder } from './src/shared/bytes'
 // Bounded EWMA adaptive-estimate utility (drives BufferPool adaptive sizing
 // and reusable runtime self-optimization decisions).

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "castrum",
-    "version": "0.9.0",
+    "version": "0.9.2",
     "private": false,
     "description": "Enterprise-grade Bun + Rust runtime: Rust-accelerated FFI primitives, a production-grade HTTP ingress pipeline, validation, hashing, and JSON processing with benchmark-grade performance.",
     "type": "module",
@@ -25,6 +25,10 @@
         "type": "git",
         "url": "git+https://github.com/Axylabs/flux-rs.git"
     },
+    "homepage": "https://github.com/Axylabs/flux-rs#readme",
+    "bugs": {
+        "url": "https://github.com/Axylabs/flux-rs/issues"
+    },
     "publishConfig": {
         "access": "public"
     },
@@ -45,18 +49,21 @@
         "README.md",
         "*.node",
         "!src/bench",
-        "!src/baseline"
+        "!src/baseline",
+        "!src/data"
     ],
     "scripts": {
         "build": "napi build --release --platform",
         "build:perf": "bash scripts/build-perf.sh",
+        "build:v3": "bash scripts/build-v3.sh",
+        "build:all": "bun run build && bun run build:v3",
         "build:js": "bun run build:js:bundle && bun run build:js:types",
         "build:js:bundle": "bun build ./index.ts --target=node --format=esm --outdir=dist",
         "build:js:types": "dts-bundle-generator -o dist/index.d.ts index.ts",
         "bench": "bun run build && bun bench.ts",
         "check": "bun bench.ts",
         "test": "bun test",
-        "test:all": "bun test && bun run typecheck && bun run typecheck:test && bun run lint:ci && cargo test --lib",
+        "test:all": "bun test && bun run typecheck && bun run typecheck:test && bun run lint:ci && bun run check:clean && cargo test --lib",
         "test:coverage": "node scripts/check-coverage.mjs",
         "setup": "bun install && bun run build",
         "test:node": "node --test test/integration/node-smoke.test.mjs test/integration/node-enterprise.test.mjs",
@@ -72,38 +79,43 @@
         "deny": "cargo deny check",
         "check:version": "bun scripts/check-version.mjs",
         "check:jsdoc": "bun scripts/check-jsdoc.ts",
+        "check:selection": "bun scripts/select-native.ts --check",
+        "check:clean": "bun scripts/check-clean.ts",
+        "gen:ai-map": "bun scripts/gen-ai-map.ts",
         "audit": "bun audit",
         "publish:manual": "node scripts/publish-manual.mjs",
         "publish:manual:dry": "node scripts/publish-manual.mjs --dry-run",
         "prepublishOnly": "bun run build:js && node scripts/prepublish.mjs",
-        "check:proven": "bun scripts/check-proven.ts",
-        "check:proven:fail": "bun scripts/check-proven.ts --fail",
-        "check:annotate": "bun scripts/annotate-performance.ts",
-        "check:annotate:dry": "bun scripts/annotate-performance.ts --dry-run",
-        "check:docs": "bun run check && bun run check:annotate && bun run check:proven",
-        "bench:http": "bun run bench/run-bench.ts",
-        "bench:http:smoke": "bun run bench/run-bench.ts smoke",
-        "bench:http:stress": "bun run bench/run-bench.ts stress",
-        "bench:http:heavy": "bun run bench/run-bench.ts heavy-json",
-        "bench:http:crud": "bun run bench/run-bench.ts crud",
-        "bench:http:spike": "bun run bench/run-bench.ts spike",
-        "bench:http:soak": "bun run bench/run-bench.ts soak",
-        "bench:http:storm": "bun run bench/run-bench.ts storm",
-        "bench:http:boundary": "bun run bench/run-bench.ts boundary",
-        "bench:http:elysia": "bun run bench/run-bench.ts '' elysia",
-        "bench:http:ingress": "bun run bench/run-bench.ts '' ingress",
-        "bench:http:bun-only": "bun run bench/run-bench.ts '' bun",
-        "bench:http:all-heavy": "bun run bench/run-bench.ts 1",
+        "bench:http": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts",
+        "bench:http:smoke": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts smoke",
+        "bench:http:stress": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts stress",
+        "bench:http:heavy": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts heavy-json",
+        "bench:http:crud": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts crud",
+        "bench:http:spike": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts spike",
+        "bench:http:soak": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts soak",
+        "bench:http:storm": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts storm",
+        "bench:http:boundary": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts boundary",
+        "bench:http:elysia": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts '' elysia",
+        "bench:http:ingress": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts '' ingress",
+        "bench:http:bun-only": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts '' bun",
+        "bench:http:all-heavy": "BUN_CONFIG_MAX_HTTP_REQUESTS=65535 bun run bench/http/run-bench.ts 1",
+        "bench:http:ac": "bun bench/autocannon-stress.mjs",
+        "bench:http:stress:ac": "SCENARIO=03-stress bun bench/autocannon-stress.mjs",
         "bench:startup": "bun run bench/startup.ts",
-        "bench:ffi": "bun run bench/ffi-all.ts",
-        "bench:ffi:load": "bun run bench/ffi-load.ts",
-        "bench:ffi:public": "bun run bench/ffi-public.ts",
-        "bench:ffi:workers": "bun run bench/ffi-workers.ts",
+        "bench:load": "bun run bench/http/load-phase.ts",
+        "bench:ffi": "bun run bench/ffi/ffi-all.ts",
+        "bench:ffi:load": "bun run bench/ffi/ffi-load.ts",
+        "bench:ffi:public": "bun run bench/ffi/ffi-public.ts",
+        "bench:ffi:workers": "bun run bench/ffi/ffi-workers.ts",
+        "bench:margin": "bun run bench/ffi/ffi-margin.ts",
+        "bench:router": "bun run bench/cost/router-cost.ts",
+        "bench:ingress-cost": "bun run bench/cost/ingress-cost.ts",
+        "bench:ingress-cost:post": "bun run bench/cost/ingress-cost-post.ts",
         "verify:native:batch": "bun run scripts/verify-native-batch.ts"
     },
     "dependencies": {},
     "peerDependencies": {
-        "@types/node": ">=20"
+        "@types/node": "^26.1.2"
     },
     "peerDependenciesMeta": {
         "@types/node": {
@@ -112,14 +124,15 @@
     },
     "devDependencies": {
         "@elysia/cors": "^1.4.2",
-        "@napi-rs/cli": "^3.7.4",
+        "@napi-rs/cli": "^3.8.6",
         "@types/bun": "^1.3.14",
         "@types/mime-types": "^3.0.1",
+        "autocannon": "^8.0.0",
         "@types/validator": "^13.15.10",
         "ajv": "^8.20.0",
         "crc-32": "^1.2.2",
         "dts-bundle-generator": "^9.5.1",
-        "elysia": "^1.4.0",
+        "elysia": "^1.4.29",
         "fast-json-patch": "^3.1.1",
         "mime-types": "^3.0.2",
         "typescript": "5.9.3",

package/src/ingress/body.ts

@@ -1,8 +1,50 @@
 // src/ingress/body.ts — Streaming request-body reading for the async ingress
 // API.
 
+import { isBun } from '../shared/runtime'
+
 const EMPTY_BODY = new Uint8Array(0)
 
+/**
+ * Read the request body as bytes. Bun's `req.bytes()` returns a `Uint8Array`
+ * directly (no `ArrayBuffer` → view wrapper and no copy) — feature-detected so
+ * Node (which lacks `Response.bytes()` on some versions) falls back to
+ * `arrayBuffer()` + a zero-copy view. This is the hot-path body read for every
+ * write route.
+ */
+async function readBodyBytes(req: Request): Promise<Uint8Array> {
+  const bytes = (req as { bytes?: () => Promise<Uint8Array> }).bytes
+  if (typeof bytes === 'function') {
+    return bytes.call(req)
+  }
+  return new Uint8Array(await req.arrayBuffer())
+}
+
+/**
+ * Bun-only synchronous peek of an already-buffered body.
+ *
+ * Under Bun a body fully received during HTTP parsing resolves `req.bytes()`
+ * IMMEDIATELY — `Bun.peek` hands back the `Uint8Array` without awaiting, so a
+ * declared-Content-Length write route can read the body with no deadline race,
+ * no watchdog entry and no microtask turn (the common small-body case).
+ *
+ * Returns:
+ * - `{ bytes }` — already buffered; the caller reads it synchronously and
+ *   must NOT pay the deadline race (the body is already here).
+ * - `Promise<Uint8Array>` — the read is still pending (slow/trickling body);
+ *   the caller MUST still enforce its deadline against this promise.
+ * - `false` — no `req.bytes()` on this runtime (Node); the caller falls back
+ *   to the async `readBodyBytes` + race as before.
+ */
+function peekBufferedBody(req: Request): { bytes: Uint8Array } | Promise<Uint8Array> | false {
+  const bytes = (req as { bytes?: () => Promise<Uint8Array> }).bytes
+  if (typeof bytes !== 'function') return false
+  const pending = bytes.call(req)
+  if (!isBun()) return pending
+  const peeked = Bun.peek(pending)
+  return peeked instanceof Promise ? peeked : { bytes: peeked }
+}
+
 /** Read the request body once, enforcing the size guard when enabled. */
 export function readRequestBodyOnce(
   req: Request,
@@ -23,6 +65,77 @@ function bodyTooLargeError(): Error & { code?: string } {
   return err
 }
 
+// ── Shared body-read deadline watchdog ──────────────────────────────────────
+// One interval timer sweeps ALL in-flight body reads that carry a deadline,
+// replacing a per-request `setTimeout` + `clearTimeout` + `timer.unref` on
+// every write-route body read (that per-request timer alloc is measurable in
+// the POST micro-bench — ~800ns of the ~2.3µs body read). Abort semantics are
+// unchanged: a read that outlives its deadline rejects with REQUEST_TIMEOUT.
+// Entries are removed on completion or when the deadline fires; the interval
+// only runs while at least one read is pending.
+const bodyWatchdog = (() => {
+  const inflight = new Set<WatchdogEntry>()
+  let timer: ReturnType<typeof setInterval> | null = null
+  const SWEEP_MS = 250
+
+  function sweep() {
+    const now = Date.now()
+    for (const entry of inflight) {
+      if (entry.settled) {
+        inflight.delete(entry)
+        continue
+      }
+      if (now >= entry.deadlineWall) {
+        entry.settled = true
+        inflight.delete(entry)
+        entry.reject(timeoutError())
+      }
+    }
+    if (inflight.size === 0 && timer !== null) {
+      clearInterval(timer)
+      timer = null
+    }
+  }
+
+  function track(entry: WatchdogEntry) {
+    inflight.add(entry)
+    if (timer === null) {
+      timer = setInterval(sweep, SWEEP_MS)
+    }
+  }
+
+  function untrack(entry: WatchdogEntry) {
+    entry.settled = true
+    inflight.delete(entry)
+    if (inflight.size === 0 && timer !== null) {
+      clearInterval(timer)
+      timer = null
+    }
+  }
+
+  return { track, untrack }
+})()
+
+interface WatchdogEntry {
+  deadlineWall: number
+  settled: boolean
+  reject: (err: Error) => void
+}
+
+/** Create a deadline tracked by the shared watchdog (no per-read setTimeout). */
+function createDeadline(deadlineMs: number): { promise: Promise<never>; cancel: () => void } {
+  const entry: WatchdogEntry = {
+    deadlineWall: Date.now() + deadlineMs,
+    settled: false,
+    reject: () => {},
+  }
+  const promise = new Promise<never>((_resolve, reject) => {
+    entry.reject = reject
+  })
+  bodyWatchdog.track(entry)
+  return { promise, cancel: () => bodyWatchdog.untrack(entry) }
+}
+
 /**
  * Stream-read the request body, enforcing the size guard when enabled and an
  * optional overall deadline.
@@ -39,30 +152,16 @@ export async function readBodyWithLimit(
   guard: boolean,
   timeoutMs?: number,
 ): Promise<Uint8Array> {
-  const body = req.body
-
-  if (!body) {
-    return EMPTY_BODY
-  }
-
   const deadline = timeoutMs && timeoutMs > 0 ? timeoutMs : 0
-  let timer: ReturnType<typeof setTimeout> | undefined
-  const timeout = new Promise<never>((_resolve, reject) => {
-    if (deadline <= 0) return
-    timer = setTimeout(() => reject(timeoutError()), deadline)
-    // Don't let a pending body timeout keep the event loop alive once the
-    // request has otherwise completed (Node; a no-op under Bun).
-    timer.unref?.()
-  })
 
   // Fast path: a declared Content-Length lets us PROVE the body fits the
-  // guard before reading, so one native `arrayBuffer()` read replaces the
-  // reader + per-chunk `Promise.race` + `concatUint8Arrays` churn (the bench
-  // POSTs are single-shot bodies — this removes ~4-6 allocations per write
-  // request). The deadline (when set) is still enforced with a single race,
-  // not one per chunk. `req.arrayBuffer()` is bounded by the server's
-  // `maxRequestBodySize`, and the post-read length re-check catches a client
-  // that lies about Content-Length.
+  // guard before reading, so one native `bytes()`/`arrayBuffer()` read
+  // replaces the reader + per-chunk `Promise.race` + `concatUint8Arrays`
+  // churn (the bench POSTs are single-shot bodies — this removes ~4-6
+  // allocations per write request). The deadline (when set) is still enforced
+  // with a single race, not one per chunk. The read is bounded by the
+  // server's `maxRequestBodySize`, and the post-read length re-check catches
+  // a client that lies about Content-Length.
   const declared = req.headers.get('content-length')
   if (declared !== null) {
     const declaredLen = Number(declared)
@@ -70,20 +169,60 @@ export async function readBodyWithLimit(
       if (guard && declaredLen > maxBytes) {
         throw bodyTooLargeError()
       }
+      // `req.body` (the stream getter) is deliberately NOT touched on this
+      // path — `req.bytes()` (Bun) / `arrayBuffer()` (Node) read the buffered
+      // body directly, avoiding a lazily-constructed stream per write request.
+      if (deadline <= 0) {
+        const bytes = await readBodyBytes(req)
+        if (guard && bytes.byteLength > maxBytes) {
+          throw bodyTooLargeError()
+        }
+        return bytes
+      }
+      // Deadline path. Under Bun, a small declared-length body is usually
+      // already buffered — `Bun.peek` returns the bytes synchronously, so we
+      // skip the deadline race + watchdog + microtask entirely for the common
+      // case. Only a genuinely pending read (slow/trickling body) pays the
+      // race; non-Bun runtimes keep the previous behavior.
+      const buffered = peekBufferedBody(req)
+      if (buffered === false) {
+        const dl = createDeadline(deadline)
+        try {
+          const bytes = await Promise.race([readBodyBytes(req), dl.promise])
+          if (guard && bytes.byteLength > maxBytes) {
+            throw bodyTooLargeError()
+          }
+          return bytes
+        } finally {
+          dl.cancel()
+        }
+      }
+      if ('bytes' in buffered) {
+        if (guard && buffered.bytes.byteLength > maxBytes) {
+          throw bodyTooLargeError()
+        }
+        return buffered.bytes
+      }
+      const dl = createDeadline(deadline)
       try {
-        const buf =
-          deadline > 0 ? await Promise.race([req.arrayBuffer(), timeout]) : await req.arrayBuffer()
-        const bytes = new Uint8Array(buf)
+        const bytes = await Promise.race([buffered, dl.promise])
         if (guard && bytes.byteLength > maxBytes) {
           throw bodyTooLargeError()
         }
         return bytes
       } finally {
-        clearTimeout(timer)
+        dl.cancel()
       }
     }
   }
 
+  // No (usable) Content-Length: fall back to the streaming reader. `req.body`
+  // is only touched here — the declared-length fast path never needs it.
+  const body = req.body
+  if (!body) {
+    return EMPTY_BODY
+  }
+
   const reader = body.getReader()
   const chunks: Uint8Array[] = []
   let total = 0
@@ -91,11 +230,12 @@ export async function readBodyWithLimit(
   // already closed, so the `cancel()` in `finally` is a wasted async round-trip
   // per request. It is still required when the loop exits early (timeout/error).
   let completed = false
+  const dl = deadline > 0 ? createDeadline(deadline) : null
 
   try {
     for (;;) {
       const { done, value } =
-        deadline > 0 ? await Promise.race([reader.read(), timeout]) : await reader.read()
+        dl !== null ? await Promise.race([reader.read(), dl.promise]) : await reader.read()
 
       if (done) {
         completed = true
@@ -112,7 +252,7 @@ export async function readBodyWithLimit(
       chunks.push(value)
     }
   } finally {
-    clearTimeout(timer)
+    dl?.cancel()
     // Release the underlying stream. Cancelling while a read() is still
     // pending (the timeout case) can resolve that pending read() as `done`
     // and RACE the timeout rejection — so reject first, cancel only AFTER

package/src/ingress/decode/result-base.ts

@@ -110,8 +110,16 @@ export abstract class IngressResultBase {
    */
   protected setRateWindow(rateLimit: number, rateLimited: boolean, view: DataView): void {
     if (rateLimit > 0 || rateLimited) {
-      this.rateResetMs = Number(view.getBigUint64(OUT_RATE_RESET, true))
-      this.retryAfterMs = Number(view.getBigUint64(OUT_RETRY_AFTER, true))
+      // i64 LE read as two u32 halves (lo + hi * 2^32) instead of
+      // `getBigUint64` — avoids the per-read BigInt boxing (measured ~10ns
+      // per read on the hot path). Bit-identical to `Number(getBigUint64(..))`
+      // for the unsigned interpretation and exact for epoch-ms (< 2^53).
+      const resetLo = view.getUint32(OUT_RATE_RESET, true)
+      const resetHi = view.getUint32(OUT_RATE_RESET + 4, true)
+      this.rateResetMs = resetLo + resetHi * 4294967296
+      const retryLo = view.getUint32(OUT_RETRY_AFTER, true)
+      const retryHi = view.getUint32(OUT_RETRY_AFTER + 4, true)
+      this.retryAfterMs = retryLo + retryHi * 4294967296
     } else {
       this.rateResetMs = 0
       this.retryAfterMs = 0