fulmine.js 5.19.2 → 5.19.3

package/src/hot-settings.js

@@ -0,0 +1,80 @@
+/*
+Copyright 2024 dimden.dev
+Copyright 2026 Nigro Simone
+
+This file is derived from Ultimate Express and has been modified.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+const { settingsEpoch } = require("./utils.js");
+
+// The settings the hot paths read, resolved to plain fields: each read was a variadic get() whose
+// rest array escapes into createRoute, plus a dictionary miss per mount level for the json keys.
+// One shape for every router, stale when the epoch moves.
+class HotSettings {
+    /** Every field declared up front, one hidden class for every router's copy. */
+    constructor() {
+        this.epoch = 0;
+        this.xPoweredBy = false;
+        this.etagFn = undefined;
+        // null means every method, which is express's behaviour and the default
+        this.etagMethods = null;
+        this.queryParserFn = undefined;
+        this.trustProxyFn = undefined;
+        this.trustProxyProtocol = false;
+        this.jsonEscape = undefined;
+        this.jsonReplacer = undefined;
+        this.jsonSpaces = undefined;
+    }
+}
+
+/**
+ * What app.settings is wrapped in, so a write that never went through set() still bumps the epoch.
+ * Only writes are trapped, a read is the plain operation on the object.
+ *
+ * defineProperty is here for the trust proxy default marker, which set() writes that way.
+ */
+const settingsWriteTraps = {
+    /**
+     * @param {any} target the settings object itself, whose keys are the application's
+     * @param {string|symbol} key
+     * @param {any} value whatever the application is setting
+     */
+    set(target, key, value) {
+        target[key] = value;
+        settingsEpoch.n++;
+        return true;
+    },
+    /**
+     * @param {any} target the settings object itself
+     * @param {string|symbol} key
+     */
+    deleteProperty(target, key) {
+        delete target[key];
+        settingsEpoch.n++;
+        return true;
+    },
+    /**
+     * @param {any} target the settings object itself
+     * @param {string|symbol} key
+     * @param {any} descriptor
+     */
+    defineProperty(target, key, descriptor) {
+        Object.defineProperty(target, key, descriptor);
+        settingsEpoch.n++;
+        return true;
+    }
+};
+
+module.exports = { HotSettings, settingsWriteTraps };

package/src/index.js

@@ -17,8 +17,8 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-// H3App, DeclarativeResponse and _cfg all exist at runtime but are missing from the
-// declaration file the package ships, so the module is read through a loose alias
+// H3App, DeclarativeResponse and _cfg exist at runtime but are missing from the .d.ts the
+// package ships, so the module is read through a loose alias
 const uWS = require("uWebSockets.js");
 const uWSAny = /** @type {any} */ (uWS);
 const Application = require("./application.js");
@@ -36,9 +36,8 @@ try {
 }
 
 try {
-    // the compile cache, in node since 22.8: the next boot of the same code skips compiling it.
-    // Asked for here because in practice the framework is the entry point of the application
-    // using it. Respects NODE_DISABLE_COMPILE_CACHE, and booting without a cache is not an error
+    // the compile cache, node 22.8 and up: the next boot skips compiling the same code. Respects
+    // NODE_DISABLE_COMPILE_CACHE, and booting without a cache is not an error
     require("node:module").enableCompileCache?.();
 } catch (error) {
     // node below 22.8, or a disk the cache cannot be written to
@@ -47,9 +46,8 @@ try {
 // The factory doubles as a namespace, as in Express: Router, static and the body parsers hang off
 // the function that creates an app.
 //
-// Written as `module.exports.name = ...` and never through an alias: cjs-module-lexer reads this
-// file as text to decide which named exports an ESM importer gets, and it cannot see through one.
-// Nothing here is executed to find that out.
+// Always `module.exports.name = ...`, never through an alias: cjs-module-lexer reads this file as
+// text to decide the named exports an ESM importer gets, and it cannot see through an alias.
 /**
  * @type {typeof Application & {
  *   Router: Function,
@@ -69,8 +67,7 @@ try {
  */
 module.exports = /** @type {any} */ (Application);
 
-// a router is a function too, for the same reason an app is: it has to be callable to be usable as
-// middleware
+// a router is a function too: it has to be callable to be used as middleware
 module.exports.Router = function (options) {
     return new Router(options)._asCallable();
 };
@@ -80,18 +77,15 @@ module.exports.Route = Route;
 
 module.exports.request = Request.prototype;
 module.exports.response = Response.prototype;
-// the third of the trio: adding a method here adds it to every app, the same as express.application
+// adding a method here adds it to every app, the same as express.application
 module.exports.application = Application.Application.prototype;
 
 module.exports.static = middlewares.static;
-// what listen() decided about each route, as something a test can assert on rather than something
-// to read in a terminal. See src/testing.js
+// what listen() decided about each route, as something a test can assert on. See src/testing.js
 module.exports.testing = require("./testing.js");
-// not one of express's, since express has none: the compression module is what everyone installs
-// instead, and this is that middleware's options and behaviour without the install
+// express has none: this is the compression module's options and behaviour, without the install
 module.exports.compression = require("./compression.js");
-// Server-Timing with the routing verdict in it, which no other framework can report because no
-// other framework has two routes to tell apart. See src/server-timing.js
+// Server-Timing with the routing verdict in it. See src/server-timing.js
 module.exports.serverTiming = require("./server-timing.js");
 module.exports.json = middlewares.json;
 module.exports.urlencoded = middlewares.urlencoded;

package/src/lazy-readable.js

@@ -0,0 +1,129 @@
+/*
+Copyright 2024 dimden.dev
+Copyright 2026 Nigro Simone
+
+This file is derived from Ultimate Express and has been modified.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+const { Readable } = require("stream");
+
+// 128 KB of body buffered before uWS is asked to pause
+const READABLE_OPTIONS = { highWaterMark: 128 * 1024 };
+
+/**
+ * A Readable that has not been built yet.
+ *
+ * Every request pays for the stream and almost none use it: a GET carries no body, and the bodies
+ * that arrive are collected by uWS and handed to the parsers without touching the stream. Measured
+ * on this machine, Readable's constructor is about 90ns of the 900ns a hello-world request costs.
+ *
+ * So the chain says Readable and the constructor does not run. `Request extends LazyReadable`, and
+ * LazyReadable's prototype is Readable's, so `req instanceof Readable` stays true and every
+ * Readable method is reachable. What is missing is `_readableState`, built on the first touch.
+ *
+ * The wrapping below is generated, not written out: every own member of Readable's prototype gets a
+ * version that materialises first, so there is no list to keep in step. Missing one would be a
+ * TypeError on `undefined._readableState`, not a slow path.
+ */
+class LazyReadableBase {}
+Object.setPrototypeOf(LazyReadableBase.prototype, Readable.prototype);
+Object.setPrototypeOf(LazyReadableBase, Readable);
+
+// what the chain says at runtime, said again for the type checker, which cannot see a prototype
+// being reassigned: everything a Readable offers is reachable from a Request, and is a Readable's
+const LazyReadable = /** @type {typeof Readable} */ (/** @type {unknown} */ (LazyReadableBase));
+
+/**
+ * Builds the stream this object has been pretending to be. Idempotent: everything that can be
+ * reached from outside goes through it, so it is called far more often than it does anything.
+ *
+ * EventEmitter's init keeps an _events that is already there, so listeners added before this
+ * survive it.
+ *
+ * @param {any} stream the Request pretending to be one, before its state exists
+ */
+function materialise(stream) {
+    if (stream._readableState === undefined) {
+        Readable.call(stream, READABLE_OPTIONS);
+    }
+}
+
+for (const member of [
+    ...Object.getOwnPropertyNames(Readable.prototype),
+    ...Object.getOwnPropertySymbols(Readable.prototype)
+]) {
+    // the constructor is not a door, and `readable` is handled below because a request writes it
+    // and writing it must not build the very thing this is avoiding
+    if (member === "constructor" || member === "readable") {
+        continue;
+    }
+    const descriptor = /** @type {PropertyDescriptor} */ (Object.getOwnPropertyDescriptor(Readable.prototype, member));
+    if (typeof descriptor.value === "function") {
+        const inner = descriptor.value;
+        Object.defineProperty(LazyReadableBase.prototype, member, {
+            ...descriptor,
+            /** @this {any} @param {...any} args */
+            value: function (...args) {
+                materialise(this);
+                return inner.apply(this, args);
+            }
+        });
+    } else if (descriptor.get || descriptor.set) {
+        const innerGet = descriptor.get;
+        const innerSet = descriptor.set;
+        Object.defineProperty(LazyReadableBase.prototype, member, {
+            ...descriptor,
+            get: innerGet
+                ? /** @this {any} */ function () {
+                      materialise(this);
+                      return innerGet.call(this);
+                  }
+                : undefined,
+            set: innerSet
+                ? /** @this {any} @param {any} value */ function (value) {
+                      materialise(this);
+                      innerSet.call(this, value);
+                  }
+                : undefined
+        });
+    }
+}
+
+const nodeReadable = /** @type {PropertyDescriptor} */ (
+    Object.getOwnPropertyDescriptor(Readable.prototype, "readable")
+);
+
+// `readable` on its own: a request sets it while it is being built, and node's setter is a no-op
+// without the state anyway, so the flag is kept as a plain field until there is a stream to ask
+Object.defineProperty(LazyReadableBase.prototype, "readable", {
+    configurable: true,
+    enumerable: false,
+    /** @this {any} */
+    get: function () {
+        return this._readableState === undefined
+            ? this._readableFlag === true
+            : /** @type {any} */ (nodeReadable.get).call(this);
+    },
+    /** @this {any} @param {any} value */
+    set: function (value) {
+        if (this._readableState === undefined) {
+            this._readableFlag = !!value;
+            return;
+        }
+        /** @type {any} */ (nodeReadable.set).call(this, value);
+    }
+});
+
+module.exports = { LazyReadable, READABLE_OPTIONS };

package/src/lazy-writable.js

@@ -0,0 +1,97 @@
+/*
+Copyright 2024 dimden.dev
+Copyright 2026 Nigro Simone
+
+This file is derived from Ultimate Express and has been modified.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+const { Writable } = require("stream");
+
+/**
+ * A Writable that has not built its state yet, the mirror of LazyReadable and for the same reason:
+ * a response is a Writable because middleware expects one, and the ordinary one never uses it.
+ * `send()` reaches `end()`, which is overridden here and goes straight to _finish, so the
+ * WritableState was allocated for every response and read by nobody. Only res.write(), a pipe,
+ * cork and the writableX getters need it.
+ *
+ * `Response extends LazyWritable`, whose prototype is Writable's, so `res instanceof Writable`
+ * stays true. `_writableState` is built on the first touch. Measured at 45ns a response.
+ *
+ * As on the Readable side the wrapping is generated: every own member of Writable's prototype gets
+ * a version that materialises first, so there is no list to keep in step.
+ */
+class LazyWritableBase {}
+Object.setPrototypeOf(LazyWritableBase.prototype, Writable.prototype);
+Object.setPrototypeOf(LazyWritableBase, Writable);
+
+// what the chain says at runtime, said again for the type checker, which cannot see a prototype
+// being reassigned
+const LazyWritable = /** @type {typeof Writable} */ (/** @type {unknown} */ (LazyWritableBase));
+
+/**
+ * Builds the stream this object has been pretending to be. Idempotent: everything reachable from
+ * outside goes through it, so it is called far more often than it does anything.
+ *
+ * EventEmitter's init keeps an _events that is already there, so both the shape the constructor
+ * wrote and any listener added before this survive it.
+ *
+ * @param {any} stream the Response pretending to be one, before its state exists
+ */
+function materialiseWritable(stream) {
+    if (stream._writableState === undefined) {
+        Writable.call(stream);
+    }
+}
+
+for (const member of [
+    ...Object.getOwnPropertyNames(Writable.prototype),
+    ...Object.getOwnPropertySymbols(Writable.prototype)
+]) {
+    if (member === "constructor") {
+        continue;
+    }
+    const descriptor = /** @type {PropertyDescriptor} */ (Object.getOwnPropertyDescriptor(Writable.prototype, member));
+    if (typeof descriptor.value === "function") {
+        const inner = descriptor.value;
+        Object.defineProperty(LazyWritableBase.prototype, member, {
+            ...descriptor,
+            /** @this {any} @param {...any} args */
+            value: function (...args) {
+                materialiseWritable(this);
+                return inner.apply(this, args);
+            }
+        });
+    } else if (descriptor.get || descriptor.set) {
+        const innerGet = descriptor.get;
+        const innerSet = descriptor.set;
+        Object.defineProperty(LazyWritableBase.prototype, member, {
+            ...descriptor,
+            get: innerGet
+                ? /** @this {any} */ function () {
+                      materialiseWritable(this);
+                      return innerGet.call(this);
+                  }
+                : undefined,
+            set: innerSet
+                ? /** @this {any} @param {any} value */ function (value) {
+                      materialiseWritable(this);
+                      innerSet.call(this, value);
+                  }
+                : undefined
+        });
+    }
+}
+
+module.exports = { LazyWritable };

package/src/middlewares.js

@@ -72,17 +72,18 @@ const PRECOMPRESSED = [
     { encoding: "gzip", suffix: ".gz", flag: ENCODING_GZIP }
 ];
 
+/** @typedef {import("./request.js")} Request */
+/** @typedef {import("./response.js")} Response */
+
 // The failures express.static answers by moving on to the next handler rather than by reporting
 // them, when fallthrough is on. They all mean the same thing: the request is not a file here.
 //
-// serve-static decides this by remembering whether send got as far as settling on a file, and
-// forwards everything after that point. The list is the same thing said from the other side, since
-// by the time this hands over, the file has been found and stat'ed already: what is left to fail
-// is a dotfile rule or a path that will not decode.
+// serve-static decides this by remembering whether send got as far as settling on a file. The list
+// says the same from the other side: by the time this hands over the file has been found and
+// stat'ed, so what is left to fail is a dotfile rule or a path that will not decode.
 //
-// A 412 and a 416 are not on it, and that is the point of the list. Both are about a file that
-// exists and about conditions the client itself set, and falling through swallowed them: a Range
-// Not Satisfiable came back as a 404, which tells the client its file is gone when it is not.
+// A 412 and a 416 are not on it. Both are about a file that exists and about conditions the client
+// itself set, and falling through swallowed them: a Range Not Satisfiable came back as a 404.
 const FALLTHROUGH_STATUSES = new Set([400, 403, 404]);
 
 /**
@@ -207,10 +208,10 @@ function decodeBody(buf, encoding) {
  * Runs the caller's verify hook the way body-parser does, an empty body included; a throw becomes
  * the 403 entity.verify.failed error. Answers whether parsing may continue.
  *
- * @param {any} req
- * @param {any} res
+ * @param {Request} req
+ * @param {Response} res
  * @param {(err?: any) => void} next
- * @param {any} options
+ * @param {any} options the parser options, settled by createBodyParser
  * @param {Buffer} buf
  * @returns {boolean}
  */
@@ -236,10 +237,9 @@ function runVerify(req, res, next, options, buf) {
  * The message a strict violation gets, which is the one V8 would have produced had the body been
  * invalid JSON rather than merely not an object.
  *
- * body-parser goes to some trouble over this: it builds a string that is the body up to the
- * offending character followed by placeholder characters, asks JSON.parse to fail on that, and
- * then puts the real characters back into whatever V8 said. The point is that an application
- * showing err.message reads the same sentence either way, naming the character and its position.
+ * body-parser builds a string that is the body up to the offending character followed by
+ * placeholders, asks JSON.parse to fail on that, and puts the real characters back into what V8
+ * said, so an application showing err.message reads the same sentence either way.
  *
  * @param {string} text the body as sent
  * @param {string|undefined} char the first character that is neither whitespace nor { nor [
@@ -296,7 +296,7 @@ function bodyError(message, status, type, extra) {
  * its stack and any property the thrower put on it are all still there when the application
  * reads it.
  *
- * @param {any} err
+ * @param {any} err whatever was thrown, which need not be an Error
  * @param {number} status
  * @param {string} type body-parser's own name for the kind of failure
  * @param {object} [extra] anything else body-parser puts on that particular error
@@ -361,12 +361,12 @@ function twinsOf(filePath, ttl) {
  * The compressed twin of a file to serve in its place, or undefined when the client would rather
  * have the file itself or the twin is not there.
  *
- * The stat comes back with it, and is what sendFile then answers from: the ETag and the
- * Last-Modified of a variant are its own, which is the whole point. Two bodies sharing one ETag is
- * how a shared cache ends up handing brotli to a client that cannot read it.
+ * The stat comes back with it, and is what sendFile then answers from: the ETag and Last-Modified
+ * of a variant are its own. Two bodies sharing one ETag is how a shared cache ends up handing
+ * brotli to a client that cannot read it.
  *
- * One stat when the answer is a twin, and none at all when the last request already found there is
- * no twin to have. See twinCache above for what is remembered and what is not.
+ * One stat when the answer is a twin, none when the last request already found there is no twin.
+ * See twinCache above for what is remembered.
  *
  * @param {string} filePath absolute path of the file that was asked for
  * @param {string|undefined} accept the request's Accept-Encoding
@@ -555,12 +555,11 @@ function serveStatic(root, options) {
         // Joined against the root and not normalised on its own first, which is the difference
         // between "/mount/../package.json" being refused and being served: a ".." has to climb
         // relative to the root so the check below can see it leave, and normalizing the url alone
-        // clamps it at "/" where nothing has left anywhere. Absolute because resolvedRoot is, so
-        // nothing here resolves against the working directory per request either.
-        // and without the trailing separator join keeps and resolve does not, because statTarget
-        // below puts it back only where it belongs: linux refuses a file asked for as a directory,
-        // so a mount whose root is a file answers nothing at all if the separator stays here.
-        // Windows stats it either way, which is why only the CI said so.
+        // clamps it at "/". Absolute because resolvedRoot is, so nothing resolves against the
+        // working directory per request.
+        // Without the trailing separator join keeps and resolve does not, because statTarget below
+        // puts it back only where it belongs: linux refuses a file asked for as a directory, so a
+        // mount whose root is a file would answer nothing. Windows stats it either way
         let fullpath = path.join(resolvedRoot, url);
         if (fullpath.length > resolvedRoot.length && fullpath.endsWith(path.sep)) {
             fullpath = fullpath.slice(0, -1);
@@ -570,12 +569,11 @@ function serveStatic(root, options) {
         let filePath = fullpath;
         // What serve-static hands send is this path, except that a bare "/" under a mount the
         // request did not write with one becomes "": without that rule a mount whose root is a file
-        // would ask the disk for a directory and could never answer at all.
+        // would ask the disk for a directory and could never answer.
         //
-        // Send then stats `normalize(join(root, path))`, and both of those keep a trailing
-        // separator where `resolve` takes it off. The separator is not decoration: the disk refuses
-        // a file that is asked for as a directory, and the name inside the error carries it, which
-        // is what an error handler prints when fallthrough is off.
+        // Send then stats `normalize(join(root, path))`, and both keep a trailing separator where
+        // `resolve` takes it off. The disk refuses a file asked for as a directory, and the name
+        // inside the error carries it, which is what an error handler prints
         const mountRelative = rawPath === "/" && !req.endsWithSlash ? "" : url;
         const statTarget = mountRelative.endsWith("/") && !fullpath.endsWith(path.sep) ? fullpath + path.sep : fullpath;
         if (root && !fullpath.startsWith(resolvedRoot)) {
@@ -586,14 +584,10 @@ function serveStatic(root, options) {
         }
 
         // Before the stat, because send judges the path before it looks at the disk: a hidden
-        // segment anywhere in a path that does not exist answers what the dotfiles rule says and
-        // not the ENOENT the disk would have given. sendFile applies the same rule below, and
-        // reaches it only for paths that do exist.
-        // normalized first, as send normalizes before it judges: a ".." segment is not a hidden
-        // file, and resolving it away is what tells the two apart
-        // and these are the segments path.normalize(url) would have produced, taken off the joined
-        // path rather than walked again: the check above has just proved it starts with the root,
-        // so what follows the root is the url in normal form
+        // segment in a path that does not exist answers what the dotfiles rule says and not the
+        // ENOENT the disk would have given. Normalized first, as send normalizes before it judges:
+        // a ".." segment is not a hidden file. These are the segments path.normalize(url) would
+        // have produced, taken off the joined path rather than walked again
         if (containsDotFile(fullpath.slice(resolvedRoot.length).split(/[\\/]/))) {
             const refusal = options.dotfiles === "deny" ? 403 : options.dotfiles === "allow" ? 0 : 404;
             if (refusal !== 0 && !(options.dotfiles === "ignore_files" && !path.basename(url).startsWith("."))) {
@@ -689,13 +683,11 @@ function serveStatic(root, options) {
         if (stat.isDirectory() || req.endsWithSlash) {
             if (!req.endsWithSlash) {
                 if (options.redirect) {
-                    // The query goes along, and the leading slashes are collapsed. Both were
-                    // wrong: "/docs?page=3" redirected to "/docs/" and lost the page, and a
-                    // request for "//assets" answered "Location: //assets/", which a browser
-                    // reads as a protocol-relative URL and follows to the host "assets". A
-                    // redirect that leaves this server is not a redirect this server meant.
-                    // serve-static locks its redirect page down the way it locks an error page:
-                    // the body names the target, and the target came from the request
+                    // The query goes along and the leading slashes are collapsed. Both were wrong:
+                    // "/docs?page=3" redirected to "/docs/" and lost the page, and "//assets"
+                    // answered "Location: //assets/", which a browser reads as protocol-relative
+                    // and follows to the host "assets". serve-static locks its redirect page down
+                    // the way it locks an error page: the body names a target the request supplied
                     res.setHeader("Content-Security-Policy", "default-src 'none'");
                     res.setHeader("X-Content-Type-Options", "nosniff");
                     return res.redirect(301, collapseLeadingSlashes(req._originalPath + "/") + req.urlQuery, true);
@@ -813,10 +805,9 @@ function createInflate(contentEncoding) {
 }
 
 /**
- * Builds one of the body parsers. All four share the same work, which is deciding whether this
- * request has a body worth reading, collecting it within the size limit, decompressing it and
- * handing the bytes over; they differ only in the content type they claim by default and in what
- * they turn the bytes into.
+ * Builds one of the body parsers. All four share the same work: deciding whether this request has
+ * a body worth reading, collecting it within the size limit, decompressing it and handing the
+ * bytes over. They differ in the content type they claim and in what they turn the bytes into.
  *
  * @param {string} defaultType the type matched when the caller names none
  * @param {(...args: any[]) => any} beforeReturn turns the collected bytes into req.body. Called
@@ -881,12 +872,12 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
         // Whether a content-type is one this parser claims, remembered per parser.
         //
         // Only reached when the caller asked for a wildcard or a list, since a plain type takes the
-        // simpleType shortcut above and never calls type-is at all. For those callers type-is was
-        // 513 ns to reach the same answer about the same string on every request, against 4 ns for
-        // an answer already worked out. The header is the client's, so the memo needs its ceiling.
+        // simpleType shortcut above. For those callers type-is was 513ns to reach the same answer
+        // about the same string on every request, against 4ns for one already worked out. The
+        // header is the client's, so the memo needs its ceiling.
         //
         // typeis.is and not typeis(req, ...): the request form first checks that there is a body,
-        // and the caller below has established that already.
+        // which the caller below has established.
         const claimsType = memoizeByString(
             (contentType) => !!typeis.is(contentType, /** @type {string[]} */ (options.type))
         );
@@ -908,12 +899,10 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             }
 
             // The property goes on the request before anything is decided, and its value stays
-            // undefined: body-parser's read() does exactly this, and the two halves both matter.
-            // Undefined, so a handler can still tell "nothing parsed this" from "the body was
-            // empty", which seeding an empty object would lose. Present, because `"body" in req`
-            // is how a library asks whether a parser has run at all: Apollo's express middleware
-            // refuses the request with a 500 when the property is missing, and tRPC's adapter
-            // reads the body itself when it is, so getting either half wrong breaks one of them.
+            // undefined: body-parser's read() does the same, and both halves matter. Undefined, so
+            // a handler can tell "nothing parsed this" from "the body was empty". Present, because
+            // `"body" in req` is how a library asks whether a parser has run: Apollo's express
+            // middleware answers 500 when it is missing, and tRPC's adapter reads the body itself
             if (!("body" in req)) {
                 req.body = undefined;
             }
@@ -1013,7 +1002,6 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                 return next();
             }
 
-            const abs = [];
             let inflate;
             let totalSize = 0;
             const rawContentEncoding = req._rawHeader("content-encoding");
@@ -1047,11 +1035,9 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             next = bindContext(next);
 
             // with nothing to decompress, uWS can collect the whole body in native code: one
-            // callback instead of one per chunk, the limit enforced before any byte reaches JS,
-            // and no copy at all - the parsers turn the bytes into req.body before the callback
-            // returns, so a view over uWS's own memory is enough. A declared length was the
-            // original case; a chunked body accumulates in the same native vector and only loses
-            // the length check, since there is no declaration to hold it to
+            // callback instead of one per chunk, the limit enforced before any byte reaches JS, and
+            // no copy at all, since the parsers turn the bytes into req.body before the callback
+            // returns. A chunked body uses the same native vector and only loses the length check
             const declared = lengthNumber;
             const declaresLength = !Number.isNaN(declared) && declared > 0;
             if (!req.receivedData && !inflate && req._res.collectBody && (declaresLength || isNaN(declared))) {
@@ -1093,12 +1079,11 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             }
 
             // uWS neuters its ArrayBuffer after the callback, so every chunk has to be copied out of
-            // it - and then Buffer.concat copied the whole body a second time. when content-length is
-            // known and we aren't inflating, the final size is known up front, so chunks can go
-            // straight into one buffer and the body is copied once.
-            // the cap means a client that declares a body and never sends it costs no more than one
-            // that actually sends a body that size, and content-length above limit was
-            // already rejected above
+            // it, and then Buffer.concat copied the whole body a second time. When content-length is
+            // known and we are not inflating, the final size is known up front, so chunks go
+            // straight into one buffer and the body is copied once. The cap means a client that
+            // declares a body and never sends it costs no more than one that sends it
+            const abs = [];
             const declaredLength = inflate ? -1 : Number(length);
             let target =
                 declaredLength > 0 && declaredLength <= MAX_PREALLOCATED_BODY
@@ -1116,11 +1101,10 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             /**
              * A zlib throw becomes the 400 body-parser answers a corrupt body with.
              *
-             * zlib reports it twice: process() throws, and the stream emits 'error' a tick
-             * later. fast-zlib removes its own listeners on the way out, so that second one
-             * lands on nothing, and an unhandled 'error' event ends the process: a corrupt
-             * gzip body was enough to take the server down. The listener goes on after the
-             * throw, since process() would have removed it.
+             * zlib reports it twice: process() throws, and the stream emits 'error' a tick later.
+             * fast-zlib removes its own listeners on the way out, so that second one lands on
+             * nothing, and an unhandled 'error' event ends the process. The listener goes on after
+             * the throw, since process() would have removed it.
              *
              * @param {any} err what inflate.process threw
              */