effect 4.1.0 → 4.1.2

package/src/eventlog/EventLogSessionAuth.ts

@@ -16,6 +16,8 @@ import { WebCrypto } from "../crypto/WebCrypto.ts"
 import * as Data from "../Data.ts"
 import * as Effect from "../Effect.ts"
 import * as Layer from "../Layer.ts"
+import type { Identity } from "./EventLog.ts"
+import { makeGetIdentityRootSecretMaterial } from "./internal/identityRootSecretDerivation.ts"
 
 const textEncoder = new TextEncoder()
 const textDecoder = new TextDecoder("utf-8", { fatal: true })
@@ -524,3 +526,27 @@ export const verifySessionAuthenticateRequest = Effect.fnUntraced(function*(opti
     signature: options.signature
   })
 })
+
+const getIdentityRootSecretMaterial = makeGetIdentityRootSecretMaterial()
+
+/**
+ * Derives the Ed25519 signing public key an identity presents during session
+ * authentication.
+ *
+ * **When to use**
+ *
+ * Use when provisioning an identity to record its signing key, so that server
+ * authorization can reject any other key presented for the identity's
+ * `publicKey`.
+ *
+ * **Details**
+ *
+ * The key is derived from the identity's private key on the `WebCrypto`
+ * reference.
+ *
+ * @stability unstable
+ * @category signing
+ * @since 4.1.1
+ */
+export const deriveSigningPublicKey = (identity: Identity["Service"]): Effect.Effect<Uint8Array<ArrayBuffer>> =>
+  Effect.map(getIdentityRootSecretMaterial(identity), (material) => material.signingPublicKey)

package/src/graphql/GraphQLClient.ts

@@ -70,7 +70,9 @@ type ArgsWithOptions<Variables, Options> = {} extends Variables ? [variables: Va
  * `partial: false`, it returns the decoded result and fails with a
  * `ResponseError` on any `errors`. With `partial: true` it returns
  * `{ data, errors }`. `partial` must be a literal `true` or `false`, not
- * an arbitrary `boolean`.
+ * an arbitrary `boolean`. A non-2xx HTTP response never succeeds, even with
+ * `partial: true`: it fails with a `ResponseError` when it has `errors`, and
+ * with a `TransportError` otherwise.
  *
  * An operation without variables is called as `client.Viewer()` or, with
  * options, `client.Viewer(undefined, { headers })`.

package/src/graphql/GraphQLClientError.ts

@@ -6,11 +6,10 @@
  * @since 4.0.0
  */
 import type * as Duration from "../Duration.ts"
-import * as Headers from "../http/Headers.ts"
+import type * as Headers from "../http/Headers.ts"
 import type * as HttpClientError from "../http/HttpClientError.ts"
-import { HeadersSchema } from "../internal/graphqlHeaders.ts"
+import { HeadersSchema, parseRetryAfter } from "../internal/graphqlHeaders.ts"
 import { hasProperty } from "../Predicate.ts"
-import * as Result from "../Result.ts"
 import * as Schema from "../Schema.ts"
 
 const TypeId = "~effect/graphql/GraphQLClientError"
@@ -74,8 +73,9 @@ export type GraphQLError = typeof GraphQLError.Type
  * `{ partial: true }` to receive decoded `{ data, errors }` instead.
  *
  * On this error, `data` is raw. `GraphQLError.path[0]` identifies the response
- * key (or alias). Non-2xx HTTP responses with a GraphQL body also use this
- * reason rather than `TransportError`.
+ * key (or alias). Non-2xx HTTP responses with a GraphQL body and `errors`
+ * also use this reason rather than `TransportError`, even when they carry
+ * `data` and the call used `{ partial: true }`.
  *
  * `status` and `headers` are the HTTP status and response headers, as the
  * transport reported them and middleware left them. Headers use
@@ -220,27 +220,18 @@ export const isFatalCloseCode = (code: number): boolean =>
 
 const isRetryableStatus = (status: number): boolean => status === 429 || (status >= 500 && status < 600)
 
-/**
- * Parses a `Retry-After` header value, either whole seconds or an HTTP date,
- * into a `Duration` measured from `now` (epoch milliseconds). Anything else,
- * such as `1.5` or `-1`, yields `undefined`.
- */
-const parseRetryAfter = (value: string | undefined, now: number): Duration.Duration | undefined => {
-  if (value === undefined) return undefined
-  const retryAfter = Headers.parseRetryAfter(value)
-  return Result.isSuccess(retryAfter) ? Headers.retryAfterDelay(retryAfter.success, now) : undefined
-}
-
 /**
  * The client could not get a GraphQL response from the server: a network
- * failure, an HTTP response that is not a GraphQL response, or a closed
- * WebSocket connection.
+ * failure, an HTTP response that is not a GraphQL response, a non-2xx HTTP
+ * response whose GraphQL body has no `errors`, or a closed WebSocket
+ * connection.
  *
  * **Details**
  *
  * - `status` and `headers` are only set for an HTTP response that is not a
- *   GraphQL response. Headers use `Headers.Headers` at runtime and encode
- *   as a plain string record; decoding restores the header collection.
+ *   GraphQL response, or a non-2xx GraphQL response without `errors`.
+ *   Headers use `Headers.Headers` at runtime and encode as a plain string
+ *   record; decoding restores the header collection.
  * - `retryAfter` comes from the `Retry-After` header (whole seconds or an
  *   HTTP date) and is encoded as milliseconds. When it is set, the error is
  *   retryable at any status, unless the close code is fatal.
@@ -360,8 +351,10 @@ export class EncodeError
  *
  * **Details**
  *
- * `data: null` without `errors` also produces a `DecodeError`, since
- * `ResponseError` requires a non-empty errors array.
+ * `data: null` without `errors` also produces a `DecodeError` for a 2xx
+ * response or a result without an HTTP status, since `ResponseError`
+ * requires a non-empty errors array. On a non-2xx response it is a
+ * `TransportError`.
  *
  * @stability experimental
  * @category errors

package/src/graphql/GraphQLProtocol.ts

@@ -522,7 +522,10 @@ export const makeHttp: {
  * (or `null`). Media types match case-insensitively. Anything else
  * is a `TransportError` with the response `status` and `headers`, and a
  * `Retry-After` header (whole seconds or an HTTP date, measured from when the
- * response arrived) becomes `retryAfter`.
+ * response arrived) becomes `retryAfter`. A non-2xx GraphQL response is passed
+ * to the client, which never treats it as a success: it fails with a
+ * `ResponseError` when the body has `errors`, and with a `TransportError`
+ * carrying the same metadata otherwise.
  *
  * A subscription is a `POST` with `Accept: text/event-stream`. Each `next`
  * event is emitted with the response headers but no status, and the stream
@@ -738,7 +741,10 @@ export const layerHttp: {
    * (or `null`). Media types match case-insensitively. Anything else
    * is a `TransportError` with the response `status` and `headers`, and a
    * `Retry-After` header (whole seconds or an HTTP date, measured from when the
-   * response arrived) becomes `retryAfter`.
+   * response arrived) becomes `retryAfter`. A non-2xx GraphQL response is passed
+   * to the client, which never treats it as a success: it fails with a
+   * `ResponseError` when the body has `errors`, and with a `TransportError`
+   * carrying the same metadata otherwise.
    *
    * A subscription is a `POST` with `Accept: text/event-stream`. Each `next`
    * event is emitted with the response headers but no status, and the stream
@@ -969,7 +975,10 @@ export const layerHttp: {
    * (or `null`). Media types match case-insensitively. Anything else
    * is a `TransportError` with the response `status` and `headers`, and a
    * `Retry-After` header (whole seconds or an HTTP date, measured from when the
-   * response arrived) becomes `retryAfter`.
+   * response arrived) becomes `retryAfter`. A non-2xx GraphQL response is passed
+   * to the client, which never treats it as a success: it fails with a
+   * `ResponseError` when the body has `errors`, and with a `TransportError`
+   * carrying the same metadata otherwise.
    *
    * A subscription is a `POST` with `Accept: text/event-stream`. Each `next`
    * event is emitted with the response headers but no status, and the stream

package/src/http/HttpClient.ts

@@ -1335,6 +1335,208 @@ export const retryTransient: {
   }
 )
 
+/**
+ * Fails requests that do not receive a response within the given duration.
+ *
+ * **When to use**
+ *
+ * Use to configure a timeout once on the client, for example when providing
+ * the `HttpClient` service, while keeping the standard `HttpClientError` error
+ * model.
+ *
+ * **Details**
+ *
+ * A timed out request is interrupted and fails with an `HttpClientError` whose
+ * reason is a `TransportError` with a `Cause.TimeoutError` cause.
+ * `retryTransient` treats it as transient. Interrupting a request aborts the
+ * underlying transport, unless the request is attached to a scope with
+ * `withScope`, in which case it stays open until the scope closes.
+ *
+ * The timer starts after request preprocessing and covers everything the
+ * wrapped client does to produce a response. For a plain client this ends when
+ * the response headers arrive, but response middleware applied before
+ * `timeout`, such as `tap` or `retryTransient`, runs inside the budget,
+ * including any body reads it performs. Composition order therefore decides
+ * how it interacts with retries: applying `timeout` before `retryTransient`
+ * gives each attempt its own budget, while applying it after bounds the whole
+ * retry loop.
+ *
+ * **Gotchas**
+ *
+ * Body reads outside the timed client are not covered, including those made
+ * by response middleware applied after `timeout` and by consumers of the
+ * `HttpClient` service. Apply a separate timeout to body reads such as
+ * `response.json` or `response.stream` when needed.
+ *
+ * **Example** (Timing out each attempt)
+ *
+ * ```ts
+ * import { Effect, Layer } from "effect"
+ * import { FetchHttpClient, HttpClient } from "effect/http"
+ *
+ * const TimedHttpClient = Layer.effect(
+ *   HttpClient.HttpClient,
+ *   Effect.map(
+ *     HttpClient.HttpClient,
+ *     HttpClient.timeout("5 seconds")
+ *   )
+ * ).pipe(Layer.provide(FetchHttpClient.layer))
+ *
+ * const program = Effect.gen(function*() {
+ *   const client = (yield* HttpClient.HttpClient).pipe(
+ *     HttpClient.retryTransient({ times: 3 })
+ *   )
+ *   return yield* client.get("https://example.com")
+ * }).pipe(Effect.provide(TimedHttpClient))
+ * ```
+ *
+ * @stability unstable
+ * @category error handling
+ * @since 4.1.0
+ */
+export const timeout: {
+  /**
+   * Fails requests that do not receive a response within the given duration.
+   *
+   * **When to use**
+   *
+   * Use to configure a timeout once on the client, for example when providing
+   * the `HttpClient` service, while keeping the standard `HttpClientError` error
+   * model.
+   *
+   * **Details**
+   *
+   * A timed out request is interrupted and fails with an `HttpClientError` whose
+   * reason is a `TransportError` with a `Cause.TimeoutError` cause.
+   * `retryTransient` treats it as transient. Interrupting a request aborts the
+   * underlying transport, unless the request is attached to a scope with
+   * `withScope`, in which case it stays open until the scope closes.
+   *
+   * The timer starts after request preprocessing and covers everything the
+   * wrapped client does to produce a response. For a plain client this ends when
+   * the response headers arrive, but response middleware applied before
+   * `timeout`, such as `tap` or `retryTransient`, runs inside the budget,
+   * including any body reads it performs. Composition order therefore decides
+   * how it interacts with retries: applying `timeout` before `retryTransient`
+   * gives each attempt its own budget, while applying it after bounds the whole
+   * retry loop.
+   *
+   * **Gotchas**
+   *
+   * Body reads outside the timed client are not covered, including those made
+   * by response middleware applied after `timeout` and by consumers of the
+   * `HttpClient` service. Apply a separate timeout to body reads such as
+   * `response.json` or `response.stream` when needed.
+   *
+   * **Example** (Timing out each attempt)
+   *
+   * ```ts
+   * import { Effect, Layer } from "effect"
+   * import { FetchHttpClient, HttpClient } from "effect/http"
+   *
+   * const TimedHttpClient = Layer.effect(
+   *   HttpClient.HttpClient,
+   *   Effect.map(
+   *     HttpClient.HttpClient,
+   *     HttpClient.timeout("5 seconds")
+   *   )
+   * ).pipe(Layer.provide(FetchHttpClient.layer))
+   *
+   * const program = Effect.gen(function*() {
+   *   const client = (yield* HttpClient.HttpClient).pipe(
+   *     HttpClient.retryTransient({ times: 3 })
+   *   )
+   *   return yield* client.get("https://example.com")
+   * }).pipe(Effect.provide(TimedHttpClient))
+   * ```
+   *
+   * @stability unstable
+   * @category error handling
+   * @since 4.1.0
+   */
+  (duration: Duration.Input): <E, R>(self: HttpClient.With<E, R>) => HttpClient.With<E | Error.HttpClientError, R>
+  /**
+   * Fails requests that do not receive a response within the given duration.
+   *
+   * **When to use**
+   *
+   * Use to configure a timeout once on the client, for example when providing
+   * the `HttpClient` service, while keeping the standard `HttpClientError` error
+   * model.
+   *
+   * **Details**
+   *
+   * A timed out request is interrupted and fails with an `HttpClientError` whose
+   * reason is a `TransportError` with a `Cause.TimeoutError` cause.
+   * `retryTransient` treats it as transient. Interrupting a request aborts the
+   * underlying transport, unless the request is attached to a scope with
+   * `withScope`, in which case it stays open until the scope closes.
+   *
+   * The timer starts after request preprocessing and covers everything the
+   * wrapped client does to produce a response. For a plain client this ends when
+   * the response headers arrive, but response middleware applied before
+   * `timeout`, such as `tap` or `retryTransient`, runs inside the budget,
+   * including any body reads it performs. Composition order therefore decides
+   * how it interacts with retries: applying `timeout` before `retryTransient`
+   * gives each attempt its own budget, while applying it after bounds the whole
+   * retry loop.
+   *
+   * **Gotchas**
+   *
+   * Body reads outside the timed client are not covered, including those made
+   * by response middleware applied after `timeout` and by consumers of the
+   * `HttpClient` service. Apply a separate timeout to body reads such as
+   * `response.json` or `response.stream` when needed.
+   *
+   * **Example** (Timing out each attempt)
+   *
+   * ```ts
+   * import { Effect, Layer } from "effect"
+   * import { FetchHttpClient, HttpClient } from "effect/http"
+   *
+   * const TimedHttpClient = Layer.effect(
+   *   HttpClient.HttpClient,
+   *   Effect.map(
+   *     HttpClient.HttpClient,
+   *     HttpClient.timeout("5 seconds")
+   *   )
+   * ).pipe(Layer.provide(FetchHttpClient.layer))
+   *
+   * const program = Effect.gen(function*() {
+   *   const client = (yield* HttpClient.HttpClient).pipe(
+   *     HttpClient.retryTransient({ times: 3 })
+   *   )
+   *   return yield* client.get("https://example.com")
+   * }).pipe(Effect.provide(TimedHttpClient))
+   * ```
+   *
+   * @stability unstable
+   * @category error handling
+   * @since 4.1.0
+   */
+  <E, R>(self: HttpClient.With<E, R>, duration: Duration.Input): HttpClient.With<E | Error.HttpClientError, R>
+} = dual(
+  2,
+  <E, R>(self: HttpClient.With<E, R>, duration: Duration.Input): HttpClient.With<E | Error.HttpClientError, R> => {
+    const decoded = Duration.fromInputUnsafe(duration)
+    const description = `timed out after ${Duration.format(decoded)}`
+    return transform(self, (effect, request) =>
+      Effect.timeoutOrElse(effect, {
+        duration: decoded,
+        orElse: () =>
+          Effect.fail(
+            new Error.HttpClientError({
+              reason: new Error.TransportError({
+                request,
+                cause: new Cause.TimeoutError(`Operation ${description}`),
+                description
+              })
+            })
+          )
+      }))
+  }
+)
+
 /**
  * Namespace containing configuration types for `withRateLimiter`.
  *
@@ -1680,7 +1882,7 @@ export const withRateLimiter: {
  * Namespace containing configuration types for `withCircuitBreaker`.
  *
  * @stability experimental
- * @since 4.0.6
+ * @since 4.0.7
  */
 export declare namespace WithCircuitBreaker {
   /**
@@ -1688,7 +1890,7 @@ export declare namespace WithCircuitBreaker {
    *
    * @stability experimental
    * @category circuit breaking
-   * @since 4.0.6
+   * @since 4.0.7
    */
   export interface Options<E, R2 = never> {
     /**
@@ -1703,13 +1905,10 @@ export declare namespace WithCircuitBreaker {
     readonly key?: string | ((request: HttpClientRequest.HttpClientRequest) => string) | undefined
     /**
      * Classifies the `Exit` of each request that the breaker admitted.
+     * `context.probe` is `true` when the request is the HalfOpen probe.
      * Defaults to `circuitBreakerClassifier`.
      */
-    readonly classify?:
-      | ((
-        exit: Exit.Exit<HttpClientResponse.HttpClientResponse, E>
-      ) => CircuitBreaker.Outcome | Effect.Effect<CircuitBreaker.Outcome, never, R2>)
-      | undefined
+    readonly classify?: CircuitBreaker.Classifier<HttpClientResponse.HttpClientResponse, E, R2> | undefined
   }
 }
 
@@ -1830,7 +2029,7 @@ export declare namespace WithCircuitBreaker {
  *
  * @stability experimental
  * @category circuit breaking
- * @since 4.0.6
+ * @since 4.0.7
  */
 export const withCircuitBreaker: {
   /**
@@ -1950,7 +2149,7 @@ export const withCircuitBreaker: {
    *
    * @stability experimental
    * @category circuit breaking
-   * @since 4.0.6
+   * @since 4.0.7
    */
   <E, R2 = never>(options: WithCircuitBreaker.Options<E, R2>): <R>(
     self: HttpClient.With<E, R>
@@ -2072,7 +2271,7 @@ export const withCircuitBreaker: {
    *
    * @stability experimental
    * @category circuit breaking
-   * @since 4.0.6
+   * @since 4.0.7
    */
   <E, R, R2 = never>(self: HttpClient.With<E, R>, options: WithCircuitBreaker.Options<E, R2>): HttpClient.With<E | CircuitBreaker.CircuitBreakerError, R | R2>
 } = dual(2, <E, R, R2>(
@@ -2120,7 +2319,7 @@ const requestOrigin = (request: HttpClientRequest.HttpClientRequest): string =>
  *
  * @stability experimental
  * @category circuit breaking
- * @since 4.0.6
+ * @since 4.0.7
  */
 export const circuitBreakerClassifier = <E>(
   exit: Exit.Exit<HttpClientResponse.HttpClientResponse, E>
@@ -2467,9 +2666,11 @@ export const tapRequest: {
  * **Details**
  *
  * Response cookies are merged into the ref with `Cookies.mergeIntoArray` for
- * the response URL. Before each request, `Cookies.toRequestCookieHeader` selects
- * the cookies for the request URL and sets them as the `cookie` header. Expiry
- * uses the current `Clock`.
+ * the response URL. When a request is sent, `Cookies.toRequestCookieHeader`
+ * selects the cookies for its final URL, after later transformations such as
+ * `HttpClientRequest.prependUrl`, and sets them as the `cookie` header. With
+ * `followRedirects` applied after `withCookiesRef`, this runs for every hop.
+ * Expiry uses the current `Clock`.
  *
  * @stability unstable
  * @category cookies
@@ -2488,9 +2689,11 @@ export const withCookiesRef: {
    * **Details**
    *
    * Response cookies are merged into the ref with `Cookies.mergeIntoArray` for
-   * the response URL. Before each request, `Cookies.toRequestCookieHeader` selects
-   * the cookies for the request URL and sets them as the `cookie` header. Expiry
-   * uses the current `Clock`.
+   * the response URL. When a request is sent, `Cookies.toRequestCookieHeader`
+   * selects the cookies for its final URL, after later transformations such as
+   * `HttpClientRequest.prependUrl`, and sets them as the `cookie` header. With
+   * `followRedirects` applied after `withCookiesRef`, this runs for every hop.
+   * Expiry uses the current `Clock`.
    *
    * @stability unstable
    * @category cookies
@@ -2509,9 +2712,11 @@ export const withCookiesRef: {
    * **Details**
    *
    * Response cookies are merged into the ref with `Cookies.mergeIntoArray` for
-   * the response URL. Before each request, `Cookies.toRequestCookieHeader` selects
-   * the cookies for the request URL and sets them as the `cookie` header. Expiry
-   * uses the current `Clock`.
+   * the response URL. When a request is sent, `Cookies.toRequestCookieHeader`
+   * selects the cookies for its final URL, after later transformations such as
+   * `HttpClientRequest.prependUrl`, and sets them as the `cookie` header. With
+   * `followRedirects` applied after `withCookiesRef`, this runs for every hop.
+   * Expiry uses the current `Clock`.
    *
    * @stability unstable
    * @category cookies
@@ -2523,21 +2728,27 @@ export const withCookiesRef: {
   <E, R>(
     self: HttpClient.With<E, R>,
     ref: Ref.Ref<ReadonlyArray<Cookies.Cookie>>
-  ): HttpClient.With<E, R> =>
-    makeWith(
+  ): HttpClient.With<E, R> => {
+    const now = () => Fiber.getCurrent()!.getRef(Clock).currentTimeMillisUnsafe()
+    const addCookies = (request: HttpClientRequest.HttpClientRequest) =>
+      Effect.map(Ref.get(ref), (cookies) => {
+        const header = Cookies.toRequestCookieHeader(cookies, request.url, now())
+        if (header === undefined) return request
+        const withCookies = HttpClientRequest.setHeader(request, "cookie", header)
+        // setHeader returns a new request, so carry over the withScope controller
+        const controller = scopedRequests.get(request)
+        if (controller !== undefined) scopedRequests.set(withCookies, controller)
+        return withCookies
+      })
+    return makeWith(
       (request: Effect.Effect<HttpClientRequest.HttpClientRequest, E, R>) =>
-        Effect.tap(self.postprocess(request), (response) => {
-          const now = Fiber.getCurrent()!.getRef(Clock).currentTimeMillisUnsafe()
-          return Ref.update(ref, Cookies.mergeIntoArray(response.url, response.cookies, now))
-        }),
-      (request) =>
-        Effect.flatMap(self.preprocess(request), (request) =>
-          Effect.map(Ref.get(ref), (cookies) => {
-            const now = Fiber.getCurrent()!.getRef(Clock).currentTimeMillisUnsafe()
-            const header = Cookies.toRequestCookieHeader(cookies, request.url, now)
-            return header === undefined ? request : HttpClientRequest.setHeader(request, "cookie", header)
-          }))
+        Effect.tap(
+          self.postprocess(Effect.flatMap(request, addCookies)),
+          (response) => Ref.update(ref, Cookies.mergeIntoArray(response.url, response.cookies, now()))
+        ),
+      self.preprocess
     )
+  }
 )
 
 /**

package/src/http/HttpServerRequest.ts

@@ -836,32 +836,37 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
     if (this.bytesEffect) {
       return this.bytesEffect
     }
+    this.bytesEffect = Effect.withFiber((fiber) => {
+      const maxBodySize = fiber.getRef(HttpIncomingMessage.MaxBodySize)
+      return this.readBytes(maxBodySize === undefined ? undefined : Number(maxBodySize))
+    }).pipe(
+      Effect.cached,
+      Effect.runSync
+    )
+    return this.bytesEffect
+  }
+
+  private readBytes(maxBytes: number | undefined): Effect.Effect<Uint8Array, HttpServerError> {
     const body = this.source.body
-    let effect: Effect.Effect<Uint8Array, HttpServerError>
     switch (body._tag) {
       case "Empty": {
-        effect = Effect.succeed(new Uint8Array(0))
-        break
+        return Effect.succeed(new Uint8Array(0))
       }
       case "Uint8Array": {
-        effect = Effect.succeed(body.body)
-        break
+        return maxBytes !== undefined && body.body.byteLength > maxBytes
+          ? Effect.fail(bodyTooLargeError(this, new BodyTooLargeError(maxBytes)))
+          : Effect.succeed(body.body)
       }
       case "FormData": {
-        effect = bytesFromBodyInit(this, body.formData)
-        break
+        return bytesFromWeb(this, () => new Response(body.formData), maxBytes)
       }
       case "Stream": {
-        effect = Stream.mkUint8Array(this.stream)
-        break
+        return Stream.mkUint8Array(maxBytes === undefined ? this.stream : limitStream(this, this.stream, maxBytes))
       }
       case "Raw": {
-        effect = rawBodyBytes(this, body.body)
-        break
+        return rawBodyBytes(this, body.body, maxBytes)
       }
     }
-    this.bytesEffect = Effect.runSync(Effect.cached(effect))
-    return this.bytesEffect
   }
 
   get text(): Effect.Effect<string, HttpServerError> {
@@ -962,23 +967,38 @@ const rawBodyStream = (request: HttpServerRequest, body: unknown): Stream.Stream
   return Stream.fail(requestParseError(request, "Unsupported body type"))
 }
 
-const rawBodyBytes = (request: HttpServerRequest, body: unknown): Effect.Effect<Uint8Array, HttpServerError> => {
+const rawBodyBytes = (
+  request: HttpServerRequest,
+  body: unknown,
+  maxBytes: number | undefined
+): Effect.Effect<Uint8Array, HttpServerError> => {
   if (body instanceof Request) {
-    return Effect.tryPromise({
-      try: () => body.arrayBuffer().then((buffer) => new Uint8Array(buffer)),
-      catch: (cause) => requestParseError(request, undefined, cause)
-    })
+    return bytesFromWeb(request, () => body, maxBytes)
   }
   if (isBodyInit(body)) {
-    return bytesFromBodyInit(request, body)
+    return bytesFromWeb(request, () => new Response(body), maxBytes)
   }
   return Effect.fail(requestParseError(request, "Unsupported body type"))
 }
 
-const bytesFromBodyInit = (request: HttpServerRequest, body: BodyInit): Effect.Effect<Uint8Array, HttpServerError> =>
+const bytesFromWeb = (
+  request: HttpServerRequest,
+  // Evaluated inside `try`, as wrapping an unreadable body in a `Response` throws.
+  evaluate: () => Request | Response,
+  maxBytes: number | undefined
+): Effect.Effect<Uint8Array, HttpServerError> =>
   Effect.tryPromise({
-    try: () => new Response(body).arrayBuffer().then((buffer) => new Uint8Array(buffer)),
-    catch: (cause) => requestParseError(request, undefined, cause)
+    try: async (signal) => {
+      const source = evaluate()
+      const buffer = maxBytes === undefined
+        ? await source.arrayBuffer()
+        : await readArrayBufferLimited(source, maxBytes, signal)
+      return new Uint8Array(buffer)
+    },
+    catch: (cause) =>
+      cause instanceof BodyTooLargeError
+        ? bodyTooLargeError(request, cause)
+        : requestParseError(request, undefined, cause)
   })
 
 const streamFromReadable = (
@@ -1005,6 +1025,24 @@ const requestParseError = (
     })
   })
 
+const limitStream = (
+  request: HttpServerRequest,
+  stream: Stream.Stream<Uint8Array, HttpServerError>,
+  maxBytes: number
+): Stream.Stream<Uint8Array, HttpServerError> =>
+  Stream.suspend(() => {
+    let bytes = 0
+    return Stream.mapEffect(stream, (chunk) => {
+      bytes += chunk.byteLength
+      return bytes > maxBytes
+        ? Effect.fail(bodyTooLargeError(request, new BodyTooLargeError(maxBytes)))
+        : Effect.succeed(chunk)
+    })
+  })
+
+const bodyTooLargeError = (request: HttpServerRequest, cause: BodyTooLargeError) =>
+  new HttpServerError({ reason: new RequestParseError({ request, reason: "BodyTooLarge", cause }) })
+
 const formDataToParts = (formData: FormData): Array<Multipart.Part> => {
   const parts: Array<Multipart.Part> = []
   for (const [key, value] of formData.entries()) {
@@ -1102,7 +1140,7 @@ class BodyTooLargeError extends Error {
 }
 
 const readArrayBufferLimited = async (
-  source: Request,
+  source: Request | Response,
   maxBytes: number,
   signal: AbortSignal
 ): Promise<ArrayBuffer> => {

package/src/http/internal/mimeTypes.ts

@@ -1,5 +1,6 @@
 /**
- * Standard MIME type data copied from mime 4.1.0.
+ * Standard MIME type data copied from mime 4.1.0, plus `text/x-python` and
+ * `text/x-shellscript` for `py` and `sh` scripts.
  *
  * MIT License
  *
@@ -370,6 +371,8 @@ const types = {
   "text/vcard": ["vcard"],
   "text/vtt": ["vtt"],
   "text/wgsl": ["wgsl"],
+  "text/x-python": ["py"],
+  "text/x-shellscript": ["sh"],
   "text/xml": ["*xml"],
   "text/yaml": ["yaml", "yml"],
   "video/3gpp": ["3gp", "3gpp"],

package/src/http-api/HttpApiSchema.ts

@@ -600,7 +600,7 @@ export const StreamSse: {
 }): StreamSse<Sse.EventCodec, Schema.Top, unknown> => {
   const events = options.events ?? (options.data === undefined ? undefined : Schema.Struct({
     ...Sse.EventEncoded.fields,
-    data: Schema.fromJsonString(options.data)
+    data: Schema.fromJsonString(Schema.toCodecJson(options.data))
   }))
   if (events === undefined) {
     throw new Error("StreamSse requires either an events schema or a data schema")