elysia 2.0.0-exp.50 → 2.0.0-exp.52

package/dist/adapter/bun/index.js

@@ -4,10 +4,34 @@ const require_constants = require('../../constants.js');
 const require_utils = require('../../utils.js');
 const require_adapter_web_standard_index = require('../web-standard/index.js');
 const require_generation = require('../../generation.js');
+const require_adapter_origin = require('../origin.js');
 const require_compile_handler_index = require('../../compile/handler/index.js');
 const require_route_table = require('../../route-table.js');
 
 //#region src/adapter/bun/index.ts
+/**
+* ! This may looks like it would cause race condition, but it is not
+* Bun is single-threaded and synchronous, so the `finally` block will
+* always run before the next request comes in
+* @see ../origin.ts
+*
+* Publish the request `Bun.serve` handed us so the pipeline can prove, before
+* its first suspension, that it holds the untouched original and may defer
+* materializing `request.signal`. The proof happens in `createFetchHandler`'s
+* prologue when there is a request hook, and at the compiled route's entry
+* probe otherwise — both inside the same synchronous frame.
+*
+* `finally` runs on the synchronous return of `fetch` (the returned promise is
+* not awaited), so the slot is live only for the handler's synchronous prologue.
+*/
+const withOrigin = (fetch) => (request, server) => {
+	require_adapter_origin.origin.request = request;
+	try {
+		return fetch(request, server);
+	} finally {
+		require_adapter_origin.origin.request = void 0;
+	}
+};
 const nativeStaticMethods = new Set([
 	"GET",
 	"POST",
@@ -124,7 +148,7 @@ const BunAdapter = require_adapter_index.createAdapter({
 		let built;
 		if (!needsGate) built = build();
 		if (needsGate) serve.fetch = (request, server) => ready.then(() => app.fetch(request, server));
-		else serve.fetch = built.fetch;
+		else serve.fetch = withOrigin(built.fetch);
 		const server = app.server = Bun.serve(serve);
 		const reload = () => {
 			try {
@@ -172,7 +196,7 @@ const BunAdapter = require_adapter_index.createAdapter({
 		const publish = () => {
 			if (app.server !== server) return;
 			built ??= build();
-			serve.fetch = built.fetch;
+			serve.fetch = withOrigin(built.fetch);
 			if (built.websocket) serve.websocket = built.websocket;
 			if (built.routes) serve.routes = built.routes[0];
 			if (needsGate || built.websocket || built.routes) reload();

package/dist/adapter/bun/index.mjs

@@ -3,10 +3,34 @@ import { isDynamicRegex, needEncodeRegex } from "../../constants.mjs";
 import { flattenChain, getLoosePath, nullObject } from "../../utils.mjs";
 import { WebStandardAdapter } from "../web-standard/index.mjs";
 import { frozenRootOf, resolvedWsOf } from "../../generation.mjs";
+import { origin } from "../origin.mjs";
 import { buildNativeStaticResponse } from "../../compile/handler/index.mjs";
 import { routeRow } from "../../route-table.mjs";
 
 //#region src/adapter/bun/index.ts
+/**
+* ! This may looks like it would cause race condition, but it is not
+* Bun is single-threaded and synchronous, so the `finally` block will
+* always run before the next request comes in
+* @see ../origin.ts
+*
+* Publish the request `Bun.serve` handed us so the pipeline can prove, before
+* its first suspension, that it holds the untouched original and may defer
+* materializing `request.signal`. The proof happens in `createFetchHandler`'s
+* prologue when there is a request hook, and at the compiled route's entry
+* probe otherwise — both inside the same synchronous frame.
+*
+* `finally` runs on the synchronous return of `fetch` (the returned promise is
+* not awaited), so the slot is live only for the handler's synchronous prologue.
+*/
+const withOrigin = (fetch) => (request, server) => {
+	origin.request = request;
+	try {
+		return fetch(request, server);
+	} finally {
+		origin.request = void 0;
+	}
+};
 const nativeStaticMethods = new Set([
 	"GET",
 	"POST",
@@ -123,7 +147,7 @@ const BunAdapter = createAdapter({
 		let built;
 		if (!needsGate) built = build();
 		if (needsGate) serve.fetch = (request, server) => ready.then(() => app.fetch(request, server));
-		else serve.fetch = built.fetch;
+		else serve.fetch = withOrigin(built.fetch);
 		const server = app.server = Bun.serve(serve);
 		const reload = () => {
 			try {
@@ -171,7 +195,7 @@ const BunAdapter = createAdapter({
 		const publish = () => {
 			if (app.server !== server) return;
 			built ??= build();
-			serve.fetch = built.fetch;
+			serve.fetch = withOrigin(built.fetch);
 			if (built.websocket) serve.websocket = built.websocket;
 			if (built.routes) serve.routes = built.routes[0];
 			if (needsGate || built.websocket || built.routes) reload();

package/dist/adapter/origin.d.ts

@@ -0,0 +1,63 @@
+//#region src/adapter/origin.d.ts
+/**
+ * Provenance channel for deferred abort-signal arming.
+ *
+ * Bun materializes `Request.signal` lazily (~214ns on the first read), so
+ * Elysia only pays for it once the pipeline can actually observe an abort,
+ * that is, after it suspends. Deferring that read is only sound for the exact
+ * `Request` instance `Bun.serve` handed to `fetch`: any other request
+ * (`app.handle`, a non-Bun adapter, or a `.wrap()` HOC that substitutes the
+ * request) may carry a user-controlled signal that is already aborted at entry
+ * and therefore must be observed synchronously.
+ *
+ * The Bun adapter publishes the untouched original here for the *synchronous*
+ * prologue of `app.fetch` and, on the lane where `fetch` has no request hook
+ * to run, for the compiled route's own entry probe, which is still inside that
+ * same synchronous frame, then clears it in `finally`, so the window closes
+ * before the first suspension and cannot leak across concurrent requests.
+ * A `.wrap()` HOC that replaces the request or defers calling `next()` past a
+ * microtask simply misses the window, fetch handler falls back to eager check
+ *
+ * ## "A single shared slot that every request writes to, so a race condition?"
+ *
+ * It looks like one, but it can't be. Explained like you're five:
+ *
+ * JavaScript only ever does ONE thing at a time. When a request comes in, the
+ * adapter writes its name on the whiteboard (`origin.request = request`),
+ * walks it down the hall (`fetch(request)` the synchronous part, where the
+ * one and only identity check happens, in `fetch`'s prologue, or at the
+ * compiled route's entry when `fetch` had no hook to run first), and erases
+ * the whiteboard `finally`
+ * all in one uninterruptible turn. The next request's turn CANNOT start
+ * until this turn is completely finished, because that is how the event loop
+ * works: run-to-completion, no preemption. So request B can never see request
+ * A's name on the board, by the time B's turn starts, the board was already
+ * erased at the end of A's turn.
+ *
+ * "But the handler is async!" — the `await`s inside it run LATER, in separate
+ * turns. That is fine, because the check already happened: the verdict was
+ * copied onto that request's own context (`'~sig'`) during the synchronous
+ * part, and the code that runs after an `await` only ever reads the context,
+ * never this slot.
+ *
+ * And if any assumption here ever breaks, a runtime that re-enters, a wrap
+ * that delays, a future edit that sneaks an `await` in before the check the
+ * comparison simply MISSES and the request falls back to eager arming, which
+ * is the exact pre-optimization behavior. Every failure mode makes a request
+ * slightly slower, never incorrect
+ *
+ * Adversarial proof, not just argument: `test/core/abort-race.test.ts` storms
+ * concurrent servers, in-process `handle()` calls, request-substituting and
+ * `next()`-delaying wraps at this slot and asserts zero misclassification.
+ *
+ * Never infer the Bun runtime from `fetch`'s second argument: Cloudflare
+ * Workers pass `env` there.
+ *
+ * It's insanely stupid, but it works. As Bun is single-threaded and synchronous
+ * so the `finally` block will always run before the next request comes in.
+ */
+declare const origin: {
+  request: Request | undefined;
+};
+//#endregion
+export { origin };

package/dist/adapter/origin.js

@@ -0,0 +1,64 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/adapter/origin.ts
+/**
+* Provenance channel for deferred abort-signal arming.
+*
+* Bun materializes `Request.signal` lazily (~214ns on the first read), so
+* Elysia only pays for it once the pipeline can actually observe an abort,
+* that is, after it suspends. Deferring that read is only sound for the exact
+* `Request` instance `Bun.serve` handed to `fetch`: any other request
+* (`app.handle`, a non-Bun adapter, or a `.wrap()` HOC that substitutes the
+* request) may carry a user-controlled signal that is already aborted at entry
+* and therefore must be observed synchronously.
+*
+* The Bun adapter publishes the untouched original here for the *synchronous*
+* prologue of `app.fetch` and, on the lane where `fetch` has no request hook
+* to run, for the compiled route's own entry probe, which is still inside that
+* same synchronous frame, then clears it in `finally`, so the window closes
+* before the first suspension and cannot leak across concurrent requests.
+* A `.wrap()` HOC that replaces the request or defers calling `next()` past a
+* microtask simply misses the window, fetch handler falls back to eager check
+*
+* ## "A single shared slot that every request writes to, so a race condition?"
+*
+* It looks like one, but it can't be. Explained like you're five:
+*
+* JavaScript only ever does ONE thing at a time. When a request comes in, the
+* adapter writes its name on the whiteboard (`origin.request = request`),
+* walks it down the hall (`fetch(request)` the synchronous part, where the
+* one and only identity check happens, in `fetch`'s prologue, or at the
+* compiled route's entry when `fetch` had no hook to run first), and erases
+* the whiteboard `finally`
+* all in one uninterruptible turn. The next request's turn CANNOT start
+* until this turn is completely finished, because that is how the event loop
+* works: run-to-completion, no preemption. So request B can never see request
+* A's name on the board, by the time B's turn starts, the board was already
+* erased at the end of A's turn.
+*
+* "But the handler is async!" — the `await`s inside it run LATER, in separate
+* turns. That is fine, because the check already happened: the verdict was
+* copied onto that request's own context (`'~sig'`) during the synchronous
+* part, and the code that runs after an `await` only ever reads the context,
+* never this slot.
+*
+* And if any assumption here ever breaks, a runtime that re-enters, a wrap
+* that delays, a future edit that sneaks an `await` in before the check the
+* comparison simply MISSES and the request falls back to eager arming, which
+* is the exact pre-optimization behavior. Every failure mode makes a request
+* slightly slower, never incorrect
+*
+* Adversarial proof, not just argument: `test/core/abort-race.test.ts` storms
+* concurrent servers, in-process `handle()` calls, request-substituting and
+* `next()`-delaying wraps at this slot and asserts zero misclassification.
+*
+* Never infer the Bun runtime from `fetch`'s second argument: Cloudflare
+* Workers pass `env` there.
+*
+* It's insanely stupid, but it works. As Bun is single-threaded and synchronous
+* so the `finally` block will always run before the next request comes in.
+*/
+const origin = { request: void 0 };
+
+//#endregion
+exports.origin = origin;

package/dist/adapter/origin.mjs

@@ -0,0 +1,62 @@
+//#region src/adapter/origin.ts
+/**
+* Provenance channel for deferred abort-signal arming.
+*
+* Bun materializes `Request.signal` lazily (~214ns on the first read), so
+* Elysia only pays for it once the pipeline can actually observe an abort,
+* that is, after it suspends. Deferring that read is only sound for the exact
+* `Request` instance `Bun.serve` handed to `fetch`: any other request
+* (`app.handle`, a non-Bun adapter, or a `.wrap()` HOC that substitutes the
+* request) may carry a user-controlled signal that is already aborted at entry
+* and therefore must be observed synchronously.
+*
+* The Bun adapter publishes the untouched original here for the *synchronous*
+* prologue of `app.fetch` and, on the lane where `fetch` has no request hook
+* to run, for the compiled route's own entry probe, which is still inside that
+* same synchronous frame, then clears it in `finally`, so the window closes
+* before the first suspension and cannot leak across concurrent requests.
+* A `.wrap()` HOC that replaces the request or defers calling `next()` past a
+* microtask simply misses the window, fetch handler falls back to eager check
+*
+* ## "A single shared slot that every request writes to, so a race condition?"
+*
+* It looks like one, but it can't be. Explained like you're five:
+*
+* JavaScript only ever does ONE thing at a time. When a request comes in, the
+* adapter writes its name on the whiteboard (`origin.request = request`),
+* walks it down the hall (`fetch(request)` the synchronous part, where the
+* one and only identity check happens, in `fetch`'s prologue, or at the
+* compiled route's entry when `fetch` had no hook to run first), and erases
+* the whiteboard `finally`
+* all in one uninterruptible turn. The next request's turn CANNOT start
+* until this turn is completely finished, because that is how the event loop
+* works: run-to-completion, no preemption. So request B can never see request
+* A's name on the board, by the time B's turn starts, the board was already
+* erased at the end of A's turn.
+*
+* "But the handler is async!" — the `await`s inside it run LATER, in separate
+* turns. That is fine, because the check already happened: the verdict was
+* copied onto that request's own context (`'~sig'`) during the synchronous
+* part, and the code that runs after an `await` only ever reads the context,
+* never this slot.
+*
+* And if any assumption here ever breaks, a runtime that re-enters, a wrap
+* that delays, a future edit that sneaks an `await` in before the check the
+* comparison simply MISSES and the request falls back to eager arming, which
+* is the exact pre-optimization behavior. Every failure mode makes a request
+* slightly slower, never incorrect
+*
+* Adversarial proof, not just argument: `test/core/abort-race.test.ts` storms
+* concurrent servers, in-process `handle()` calls, request-substituting and
+* `next()`-delaying wraps at this slot and asserts zero misclassification.
+*
+* Never infer the Bun runtime from `fetch`'s second argument: Cloudflare
+* Workers pass `env` there.
+*
+* It's insanely stupid, but it works. As Bun is single-threaded and synchronous
+* so the `finally` block will always run before the next request comes in.
+*/
+const origin = { request: void 0 };
+
+//#endregion
+export { origin };