castrum 0.9.8 → 0.9.10

package/rust/task/runtime.rs

@@ -10,7 +10,7 @@
 
 use parking_lot::{Condvar, Mutex};
 use std::collections::VecDeque;
-use std::sync::atomic::{AtomicBool, AtomicU32, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU32, AtomicUsize, Ordering};
 use std::sync::OnceLock;
 use std::time::Duration;
 
@@ -25,6 +25,11 @@ const SPIN_ROUNDS: u32 = 64;
 /// Idle park timeout. A bounded wait (instead of an indefinite one) means a
 /// missed wakeup costs at most this much latency and can never wedge a worker.
 const PARK_TIMEOUT: Duration = Duration::from_micros(200);
+/// Default admission bound for the work queue. A submission that would exceed
+/// it is rejected (the C ABI returns `2 = overloaded`) instead of growing
+/// memory without bound. Overridable with `CASTRUM_TASK_QUEUE_MAX` (minimum 1)
+/// when the pool is first created.
+pub const DEFAULT_QUEUE_MAX: usize = 4096;
 
 /// A unit of offloaded work. Owns its input bytes (`'static`, `Send`).
 pub type Job = Box<dyn FnOnce() + Send + 'static>;
@@ -35,6 +40,9 @@ pub struct TaskPool {
     cv: Condvar,
     running: AtomicBool,
     threads: AtomicU32,
+    /// Admission bound for `queue`; read once when the pool is created (tests
+    /// override it through [`set_queue_max`]).
+    queue_max: AtomicUsize,
 }
 
 static POOL: OnceLock<TaskPool> = OnceLock::new();
@@ -46,6 +54,7 @@ impl TaskPool {
             cv: Condvar::new(),
             running: AtomicBool::new(false),
             threads: AtomicU32::new(0),
+            queue_max: AtomicUsize::new(default_queue_max()),
         }
     }
 
@@ -121,9 +130,17 @@ impl TaskPool {
         }
     }
 
-    fn enqueue(&'static self, job: Job) {
-        self.queue.lock().push_back(job);
+    /// Push `job` only while the queue is below its admission bound. Returns
+    /// `false` when full — the caller drops the job (overload).
+    fn try_enqueue(&'static self, job: Job) -> bool {
+        let mut q = self.queue.lock();
+        if q.len() >= self.queue_max.load(Ordering::Relaxed) {
+            return false;
+        }
+        q.push_back(job);
+        drop(q);
         self.cv.notify_one();
+        true
     }
 
     fn shutdown(&self) {
@@ -173,6 +190,16 @@ pub fn default_threads() -> usize {
         })
 }
 
+/// Default admission bound: `CASTRUM_TASK_QUEUE_MAX` when set to a valid value
+/// `>= 1`, else {@link DEFAULT_QUEUE_MAX}.
+fn default_queue_max() -> usize {
+    std::env::var("CASTRUM_TASK_QUEUE_MAX")
+        .ok()
+        .and_then(|v| v.parse::<usize>().ok())
+        .filter(|&n| n > 0)
+        .unwrap_or(DEFAULT_QUEUE_MAX)
+}
+
 /// Start the pool with `threads` workers (`None`/`0` → {@link default_threads}).
 ///
 /// Returns `0` when this call started the pool and `1` when it was already
@@ -190,8 +217,9 @@ pub fn init(threads: Option<u32>) -> u32 {
     0
 }
 
-/// Enqueue `job`, auto-starting the pool on first use. Always accepted in v1
-/// (the queue is unbounded; admission/backpressure is a later milestone).
+/// Enqueue `job`, auto-starting the pool on first use. Returns `false` (the C
+/// ABI's `2 = overloaded`) when the bounded work queue is full — admission is
+/// capped by `CASTRUM_TASK_QUEUE_MAX` (default {@link DEFAULT_QUEUE_MAX}).
 pub fn submit<F>(job: F) -> bool
 where
     F: FnOnce() + Send + 'static,
@@ -201,8 +229,28 @@ where
         let n = default_threads();
         p.start(n);
     }
-    p.enqueue(Box::new(job));
-    true
+    p.try_enqueue(Box::new(job))
+}
+
+/// Jobs queued but not yet started (monitoring / tests).
+pub fn queue_depth() -> usize {
+    POOL.get_or_init(TaskPool::new).queue.lock().len()
+}
+
+/// Configured admission bound for the work queue (monitoring / tests).
+pub fn queue_max() -> usize {
+    POOL.get_or_init(TaskPool::new)
+        .queue_max
+        .load(Ordering::Relaxed)
+}
+
+/// Override the admission bound. TEST ONLY: production reads
+/// `CASTRUM_TASK_QUEUE_MAX` once when the pool is created.
+#[cfg(test)]
+pub fn set_queue_max(max: usize) {
+    POOL.get_or_init(TaskPool::new)
+        .queue_max
+        .store(max.max(1), Ordering::Relaxed);
 }
 
 /// Configured worker count (0 before the pool starts).

package/rust/task/tests.rs

@@ -5,7 +5,9 @@
 // threads.
 
 use parking_lot::Mutex;
-use std::sync::atomic::{AtomicU32, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU32, AtomicUsize, Ordering};
+use std::sync::Arc;
+use std::time::Duration;
 
 use super::completion::{self, Completion};
 use super::ops::{
@@ -259,3 +261,98 @@ fn pool_starts_with_a_nonzero_thread_count() {
     runtime::init(None);
     assert!(runtime::threads() >= 1);
 }
+
+/// Block until `counter` reaches `target` (10 s guard).
+fn wait_for_counter(counter: &AtomicUsize, target: usize) {
+    let deadline = std::time::Instant::now() + Duration::from_secs(10);
+    while counter.load(Ordering::SeqCst) < target {
+        assert!(
+            std::time::Instant::now() < deadline,
+            "counter never reached {target}"
+        );
+        std::thread::sleep(Duration::from_millis(1));
+    }
+}
+
+/// Block until the admission queue is empty (10 s guard).
+fn wait_for_drained_queue() {
+    let deadline = std::time::Instant::now() + Duration::from_secs(10);
+    while runtime::queue_depth() != 0 {
+        assert!(std::time::Instant::now() < deadline, "queue never drained");
+        std::thread::sleep(Duration::from_millis(1));
+    }
+}
+
+/// The queue is a hard-bounded admission gate: once every worker is occupied
+/// and the queue holds `queue_max` jobs, further submits are rejected rather
+/// than growing memory; releasing the workers restores capacity.
+#[test]
+fn queue_admission_is_bounded_and_recovers() {
+    let _g = LOCK.lock();
+    completion::clear();
+    runtime::init(None);
+    let workers = runtime::threads().max(1) as usize;
+
+    const CAP: usize = 4;
+    runtime::set_queue_max(CAP);
+
+    let started = Arc::new(AtomicUsize::new(0));
+    let finished = Arc::new(AtomicUsize::new(0));
+    let release = Arc::new(AtomicBool::new(false));
+
+    let make_blocker = || {
+        let started = Arc::clone(&started);
+        let finished = Arc::clone(&finished);
+        let release = Arc::clone(&release);
+        move || {
+            started.fetch_add(1, Ordering::SeqCst);
+            while !release.load(Ordering::SeqCst) {
+                std::thread::sleep(Duration::from_millis(1));
+            }
+            finished.fetch_add(1, Ordering::SeqCst);
+        }
+    };
+
+    // Occupy every worker, one submission at a time, waiting for each to START
+    // so it has left the queue. (Submitting them all at once would let one
+    // worker batch-pop several, which still occupies it but muddies the depth
+    // arithmetic this test asserts.)
+    for i in 0..workers {
+        assert!(
+            runtime::submit(make_blocker()),
+            "worker {i} submit rejected"
+        );
+        wait_for_counter(&started, i + 1);
+    }
+    assert_eq!(runtime::queue_depth(), 0);
+    assert_eq!(runtime::queue_max(), CAP);
+
+    // Every worker is busy: fill the queue to the cap.
+    for i in 0..CAP {
+        assert!(
+            runtime::submit(make_blocker()),
+            "queued submit {i} rejected"
+        );
+    }
+    assert_eq!(runtime::queue_depth(), CAP);
+
+    // The cap is a HARD bound — the next submit is rejected, not queued.
+    assert!(
+        !runtime::submit(make_blocker()),
+        "submit accepted at the cap"
+    );
+    assert_eq!(runtime::queue_depth(), CAP);
+
+    // Release: the queue drains and admission recovers.
+    release.store(true, Ordering::SeqCst);
+    wait_for_counter(&finished, workers + CAP);
+    wait_for_drained_queue();
+    assert!(
+        runtime::submit(make_blocker()),
+        "capacity did not recover after drain"
+    );
+    wait_for_counter(&finished, workers + CAP + 1);
+
+    // Restore the default bound so a later test cannot inherit the tiny cap.
+    runtime::set_queue_max(4096);
+}

package/rust/util/text.rs

@@ -14,23 +14,50 @@ use napi_derive::napi;
 /// [`regex_escape_write`].
 const REGEX_META: &[u8; 14] = b"\\.*+?^${}()|[]";
 
+/// 256-entry membership lookup for [`REGEX_META`] — one table load per byte.
+/// The previous per-byte `REGEX_META.contains(&c)` did a linear 14-element
+/// scan PER byte (O(n·14)); a 16KB payload took ~100µs (~160MB/s) and the
+/// win margin vs JS regex-replace collapsed with size. The LUT makes the hot
+/// loop branch-predictable (~1 load/byte), and safe runs are copied in bulk
+/// (memcpy) instead of one push per byte.
+const REGEX_META_LUT: [u8; 256] = {
+    let mut t = [0u8; 256];
+    let mut i = 0usize;
+    while i < REGEX_META.len() {
+        t[REGEX_META[i] as usize] = 1;
+        i += 1;
+    }
+    t
+};
+
+#[inline(always)]
+fn is_meta(b: u8) -> bool {
+    REGEX_META_LUT[b as usize] != 0
+}
+
 /// Append the RegExp-escaped form of `input` to `out`. ASCII-only transform
 /// (backslash before metachar bytes) — multi-byte UTF-8 sequences pass
 /// through byte-exact because no UTF-8 continuation byte is a metachar.
+/// Safe runs are bulk-copied (memcpy) between metachars, so throughput scales
+/// with memory bandwidth, not the metachar-set size.
 pub fn regex_escape_into(input: &[u8], out: &mut Vec<u8>) {
-    for &c in input {
-        if REGEX_META.contains(&c) {
+    let mut run_start = 0usize;
+    for (i, &c) in input.iter().enumerate() {
+        if is_meta(c) {
+            out.extend_from_slice(&input[run_start..i]);
             out.push(b'\\');
+            out.push(c);
+            run_start = i + 1;
         }
-        out.push(c);
     }
+    out.extend_from_slice(&input[run_start..]);
 }
 
 /// Exact escaped length (metachar count + input length) — lets callers size
 /// output buffers without running the escape twice.
 #[inline]
 pub fn regex_escape_len(input: &[u8]) -> usize {
-    input.len() + input.iter().filter(|b| REGEX_META.contains(b)).count()
+    input.len() + input.iter().filter(|&&b| is_meta(b)).count()
 }
 
 /// Write the escaped form of `input` into `out` (which must be at least
@@ -38,15 +65,21 @@ pub fn regex_escape_len(input: &[u8]) -> usize {
 /// written.
 pub fn regex_escape_write(input: &[u8], out: &mut [u8]) -> usize {
     let mut pos = 0usize;
-    for &c in input {
-        if REGEX_META.contains(&c) {
+    let mut run_start = 0usize;
+    for (i, &c) in input.iter().enumerate() {
+        if is_meta(c) {
+            let run = &input[run_start..i];
+            out[pos..pos + run.len()].copy_from_slice(run);
+            pos += run.len();
             out[pos] = b'\\';
-            pos += 1;
+            out[pos + 1] = c;
+            pos += 2;
+            run_start = i + 1;
         }
-        out[pos] = c;
-        pos += 1;
     }
-    pos
+    let tail = &input[run_start..];
+    out[pos..pos + tail.len()].copy_from_slice(tail);
+    pos + tail.len()
 }
 
 /// Escape JS RegExp metacharacters in a string → a pattern that matches the
@@ -127,4 +160,73 @@ mod tests {
         let escaped = String::from_utf8(out).expect("utf8");
         assert_eq!(escaped, r"a\.c");
     }
+
+    /// Reference escape (the previous per-byte `REGEX_META.contains` loop).
+    fn ref_escape(input: &[u8]) -> Vec<u8> {
+        const META: &[u8] = b"\\.*+?^${}()|[]";
+        let mut out = Vec::new();
+        for &c in input {
+            if META.contains(&c) {
+                out.push(b'\\');
+            }
+            out.push(c);
+        }
+        out
+    }
+
+    #[test]
+    fn regex_escape_matches_reference_for_all_lengths() {
+        // Every length 0..=96 plus larger payloads: the LUT + run-copy core
+        // (bulk memcpy between metachars) must be byte-identical to the naive
+        // per-byte reference. Lengths 15/16/17… straddle no SIMD chunk here
+        // (the transform is scalar), but the sweep locks positional behavior:
+        // a run-copy off-by-one (dropping or duplicating a safe byte) surfaces.
+        let mut lens: Vec<usize> = (0..=96).collect();
+        lens.extend([128, 512, 16 * 1024, 256 * 1024]);
+        for n in lens {
+            let input: Vec<u8> = (0..n).map(|i| (i.wrapping_mul(31) + 5) as u8).collect();
+            let expect = ref_escape(&input);
+            // allocating path
+            let mut out = Vec::new();
+            regex_escape_into(&input, &mut out);
+            assert_eq!(out, expect, "len {n}");
+            // len formula
+            assert_eq!(regex_escape_len(&input), expect.len(), "len {n}");
+            // write path (exact-size buffer, like the C-ABI caller)
+            let mut buf = vec![0u8; expect.len()];
+            let written = regex_escape_write(&input, &mut buf);
+            assert_eq!(written, expect.len(), "len {n}");
+            assert_eq!(&buf[..written], &expect[..], "len {n}");
+        }
+    }
+
+    #[test]
+    fn regex_escape_large_payload_edges() {
+        // Three 256 KiB extremes: every byte a metachar (no bulk runs — the
+        // worst case for the run-copy core), no metachars at all (pure bulk
+        // copy), and a dense alternating pattern. All must match the reference
+        // and the exact-length contract.
+        let all_meta: Vec<u8> = (0..256 * 1024)
+            .map(|i| b"\\.*+?^${}()|[]"[i % 14])
+            .collect();
+        let none: Vec<u8> = (0..256 * 1024).map(|i| b"abcXYZ0123_-/"[i % 13]).collect();
+        let dense: Vec<u8> = (0..256 * 1024)
+            .map(|i| if i % 2 == 0 { b'.' } else { b'a' })
+            .collect();
+        for input in [all_meta, none, dense] {
+            let expect = ref_escape(&input);
+            let mut out = Vec::new();
+            regex_escape_into(&input, &mut out);
+            assert_eq!(out, expect);
+            assert_eq!(regex_escape_len(&input), expect.len());
+            let mut buf = vec![0u8; expect.len()];
+            let written = regex_escape_write(&input, &mut buf);
+            assert_eq!(written, expect.len());
+            assert_eq!(&buf[..written], &expect[..]);
+        }
+        // All-metachar bound: escaped length is exactly 2x (every byte gets a
+        // backslash); all-safe bound: escaped length equals input length.
+        assert_eq!(regex_escape_len(&vec![b'.'; 1024]), 2048);
+        assert_eq!(regex_escape_len(&vec![b'a'; 1024]), 1024);
+    }
 }

package/rust/util/validation.rs

@@ -317,6 +317,40 @@ mod tests {
         assert!(!validate_uuid_bytes(b"550e8400e29b41d4a716446655440000")); // no dashes
     }
 
+    /// Byte-for-byte pins the accept set: replacing ANY single hex position
+    /// (0..7, 9..12, 15..17, 20..22, 24..35) with a non-hex digit must reject,
+    /// and every one of the 32 hex positions must accept uppercase + lowercase
+    /// digits. Guards against a future rewrite (e.g. SIMD/run-split) silently
+    /// dropping or mis-scoping a position — measured perf-neutral, kept as a
+    /// spec-lock regression net.
+    #[test]
+    fn validate_uuid_hex_run_coverage() {
+        let dash = |i: usize| matches!(i, 8 | 13 | 18 | 23);
+        for pos in 0..36 {
+            let valid = b"550e8400-e29b-41d4-a716-446655440000";
+            if dash(pos) {
+                continue; // dash positions are pinned by their own check
+            }
+            // every non-dash position is a hex position (version/variant cols
+            // included — 14 must stay '4', 19 must stay in 8/9/a/b set)
+            if valid[pos].is_ascii_hexdigit() {
+                let mut upper = *valid;
+                upper[pos] = valid[pos].to_ascii_uppercase();
+                assert!(validate_uuid_bytes(&upper), "uppercase at {pos}");
+            }
+            let mut bad = *valid;
+            bad[pos] = b'g'; // 'g' is not a hex digit
+            assert!(!validate_uuid_bytes(&bad), "g at {pos}");
+        }
+        // and the version / variant columns still reject wrong values
+        let mut v = *b"550e8400-e29b-41d4-a716-446655440000";
+        v[14] = b'5';
+        assert!(!validate_uuid_bytes(&v));
+        v = *b"550e8400-e29b-41d4-a716-446655440000";
+        v[19] = b'c';
+        assert!(!validate_uuid_bytes(&v));
+    }
+
     #[test]
     fn validate_ipv4_cases() {
         assert!(validate_ipv4_bytes(b"192.168.0.1"));

package/src/ingress/abort.ts

@@ -0,0 +1,48 @@
+// src/ingress/abort.ts — PURE request-cancellation helpers.
+//
+// The async ingress reads `Request.signal` (fired when the client disconnects)
+// at its genuine async boundaries. A body read or a route wrapper that observes
+// an abort returns the cancelled-client response instead of running more work.
+// PURE: no addon / pool imports — safe for the route factories.
+
+/**
+ * The `err.code` value a body read carries when it is rejected because the
+ * client disconnected (`Request.signal` aborted).
+ */
+export const ABORT_CODE = 'REQUEST_ABORTED'
+
+/**
+ * Whether a thrown value is the cancellation error produced when `req.signal`
+ * aborts during a body read (see `readBodyWithLimit` in `./body`).
+ *
+ * @param err - The caught value.
+ * @returns `true` when `err.code === 'REQUEST_ABORTED'`.
+ * @example
+ * ```ts
+ * try {
+ *   await readBodyWithLimit(req, 1 << 20, true)
+ * } catch (err) {
+ *   if (isAbortError(err)) return abortResponse()
+ *   throw err
+ * }
+ * ```
+ */
+export function isAbortError(err: unknown): boolean {
+  return (err as { code?: unknown } | null | undefined)?.code === ABORT_CODE
+}
+
+/**
+ * Build the cancelled-client response: status **499** ("Client Closed
+ * Request", a de-facto nginx status) with no body. This is the only new
+ * outcome added by cancellation — it never replaces an existing success or
+ * error status.
+ *
+ * @returns A bodyless `Response` with status 499.
+ * @example
+ * ```ts
+ * if (req.signal?.aborted) return abortResponse()
+ * ```
+ */
+export function abortResponse(): Response {
+  return new Response(null, { status: 499 })
+}

package/src/ingress/body.ts

@@ -2,6 +2,7 @@
 // API.
 
 import { isBun } from '../shared/runtime'
+import { ABORT_CODE } from './abort'
 
 const EMPTY_BODY = new Uint8Array(0)
 
@@ -65,6 +66,59 @@ function bodyTooLargeError(): Error & { code?: string } {
   return err
 }
 
+function abortError(): Error & { code?: string } {
+  const err = new Error(ABORT_CODE) as Error & { code?: string }
+  err.code = ABORT_CODE
+  return err
+}
+
+/** Reject when `signal` is already aborted (the entry guard for every path). */
+function throwIfAborted(signal: AbortSignal | undefined): void {
+  if (signal?.aborted) throw abortError()
+}
+
+/** A reusable rejection promise + listener-cleanup pair for a read race. */
+interface ReadGuard {
+  promise: Promise<never>
+  cancel: () => void
+}
+
+/**
+ * Track `req.signal` as a rejection racer: settles with a `REQUEST_ABORTED`
+ * error when the client disconnects. Returns `null` when the request carries no
+ * signal, so runtimes without `Request.signal` are unaffected. The
+ * `{ once: true }` listener self-removes when it fires; `cancel()` detaches it
+ * on the read-completed-first path so no listener outlives the read.
+ */
+function createAbortGuard(signal: AbortSignal | undefined): ReadGuard | null {
+  if (!signal) return null
+  if (signal.aborted) {
+    return { promise: Promise.reject(abortError()), cancel: () => {} }
+  }
+  let listener: (() => void) | null = null
+  const promise = new Promise<never>((_resolve, reject) => {
+    listener = () => reject(abortError())
+    signal.addEventListener('abort', listener, { once: true })
+  })
+  return {
+    promise,
+    cancel: () => {
+      if (listener !== null) {
+        signal.removeEventListener('abort', listener)
+        listener = null
+      }
+    },
+  }
+}
+
+/** Race a read against guard rejections (a plain await when there are none). */
+function raceRead<T>(read: Promise<T>, guards: ReadonlyArray<ReadGuard>): Promise<T> {
+  if (guards.length === 0) return read
+  const racers: Promise<unknown>[] = [read]
+  for (const guard of guards) racers.push(guard.promise)
+  return Promise.race(racers) as Promise<T>
+}
+
 // ── Shared body-read deadline watchdog ──────────────────────────────────────
 // One interval timer sweeps ALL in-flight body reads that carry a deadline,
 // replacing a per-request `setTimeout` + `clearTimeout` + `timer.unref` on
@@ -145,6 +199,9 @@ function createDeadline(deadlineMs: number): { promise: Promise<never>; cancel:
  *   (thrown as soon as the limit is crossed — the body is never fully
  *   buffered first, which is the slowloris/large-body protection).
  * - `REQUEST_TIMEOUT` when `timeoutMs` elapses before the body completes.
+ * - `REQUEST_ABORTED` when `req.signal` aborts (client disconnect) before the
+ *   read settles — including an already-aborted signal at entry. The race's
+ *   abort listener is removed once the read settles.
  */
 export async function readBodyWithLimit(
   req: Request,
@@ -152,6 +209,10 @@ export async function readBodyWithLimit(
   guard: boolean,
   timeoutMs?: number,
 ): Promise<Uint8Array> {
+  // Client disconnect before any read work: reject immediately (also covers an
+  // already-aborted signal on every downstream path).
+  throwIfAborted(req.signal)
+
   const deadline = timeoutMs && timeoutMs > 0 ? timeoutMs : 0
 
   // Fast path: a declared Content-Length lets us PROVE the body fits the
@@ -173,11 +234,34 @@ export async function readBodyWithLimit(
       // path — `req.bytes()` (Bun) / `arrayBuffer()` (Node) read the buffered
       // body directly, avoiding a lazily-constructed stream per write request.
       if (deadline <= 0) {
-        const bytes = await readBodyBytes(req)
-        if (guard && bytes.byteLength > maxBytes) {
-          throw bodyTooLargeError()
+        // No deadline: use the same buffered fast path as the deadline branch.
+        // Under Bun a small declared-length body is usually already buffered —
+        // `Bun.peek` returns the bytes synchronously, so the common case skips
+        // the abort race + microtask entirely. Only a genuinely pending read
+        // (slow/trickling body) or a runtime without `req.bytes()` (Node) pays
+        // the abort race.
+        const buffered = peekBufferedBody(req)
+        if (buffered !== false && 'bytes' in buffered) {
+          throwIfAborted(req.signal)
+          if (guard && buffered.bytes.byteLength > maxBytes) {
+            throw bodyTooLargeError()
+          }
+          return buffered.bytes
+        }
+        const abort = createAbortGuard(req.signal)
+        try {
+          const bytes = await raceRead(
+            buffered === false ? readBodyBytes(req) : buffered,
+            abort !== null ? [abort] : [],
+          )
+          throwIfAborted(req.signal)
+          if (guard && bytes.byteLength > maxBytes) {
+            throw bodyTooLargeError()
+          }
+          return bytes
+        } finally {
+          abort?.cancel()
         }
-        return bytes
       }
       // Deadline path. Under Bun, a small declared-length body is usually
       // already buffered — `Bun.peek` returns the bytes synchronously, so we
@@ -187,31 +271,38 @@ export async function readBodyWithLimit(
       const buffered = peekBufferedBody(req)
       if (buffered === false) {
         const dl = createDeadline(deadline)
+        const abort = createAbortGuard(req.signal)
         try {
-          const bytes = await Promise.race([readBodyBytes(req), dl.promise])
+          const bytes = await raceRead(readBodyBytes(req), abort !== null ? [dl, abort] : [dl])
+          throwIfAborted(req.signal)
           if (guard && bytes.byteLength > maxBytes) {
             throw bodyTooLargeError()
           }
           return bytes
         } finally {
           dl.cancel()
+          abort?.cancel()
         }
       }
       if ('bytes' in buffered) {
+        throwIfAborted(req.signal)
         if (guard && buffered.bytes.byteLength > maxBytes) {
           throw bodyTooLargeError()
         }
         return buffered.bytes
       }
       const dl = createDeadline(deadline)
+      const abort = createAbortGuard(req.signal)
       try {
-        const bytes = await Promise.race([buffered, dl.promise])
+        const bytes = await raceRead(buffered, abort !== null ? [dl, abort] : [dl])
+        throwIfAborted(req.signal)
         if (guard && bytes.byteLength > maxBytes) {
           throw bodyTooLargeError()
         }
         return bytes
       } finally {
         dl.cancel()
+        abort?.cancel()
       }
     }
   }
@@ -220,6 +311,7 @@ export async function readBodyWithLimit(
   // is only touched here — the declared-length fast path never needs it.
   const body = req.body
   if (!body) {
+    throwIfAborted(req.signal)
     return EMPTY_BODY
   }
 
@@ -231,11 +323,14 @@ export async function readBodyWithLimit(
   // per request. It is still required when the loop exits early (timeout/error).
   let completed = false
   const dl = deadline > 0 ? createDeadline(deadline) : null
+  const abort = createAbortGuard(req.signal)
+  const guards: ReadGuard[] = []
+  if (dl !== null) guards.push(dl)
+  if (abort !== null) guards.push(abort)
 
   try {
     for (;;) {
-      const { done, value } =
-        dl !== null ? await Promise.race([reader.read(), dl.promise]) : await reader.read()
+      const { done, value } = await raceRead(reader.read(), guards)
 
       if (done) {
         completed = true
@@ -253,6 +348,7 @@ export async function readBodyWithLimit(
     }
   } finally {
     dl?.cancel()
+    abort?.cancel()
     // Release the underlying stream. Cancelling while a read() is still
     // pending (the timeout case) can resolve that pending read() as `done`
     // and RACE the timeout rejection — so reject first, cancel only AFTER

package/src/ingress/handlers.ts

@@ -94,6 +94,7 @@ export type {
   CreateIngressServerOptions,
   GracefulShutdownOptions,
   ServerHandle,
+  StaticRoute,
 } from './server'
 export { createIngressServer, gracefulShutdown } from './server'
 export type { RouteHandler as IngressNodeRouteHandler } from './server-node'