fulmine.js 5.5.0 → 5.5.2

package/README.md

@@ -26,12 +26,6 @@ npx fulmine profile             # what listen() decided about each route
 
 See [Migrating](#migrating) for what it handles and what it deliberately does not.
 
-There is a **[live demo](https://fulmine-demo.fly.dev)**, which is an ordinary Express application:
-real routes, `helmet`, `cors`, `compression`, `express-session` and `morgan` unmodified, and a
-WebSocket chat served by `app.ws()`. It links to [its own source](https://fulmine-demo.fly.dev/source),
-which is [in this repository](./demo). It shows no throughput figure on purpose: it runs on a small
-shared machine, so the number would describe the machine rather than the framework.
-
 [![npm version](https://img.shields.io/npm/v/fulmine.js)](https://www.npmjs.com/package/fulmine.js)
 [![Node.js >= 22.0.0](https://img.shields.io/badge/Node.js-%3E=22.0.0-green)](https://nodejs.org)
 [![Coverage Status](https://coveralls.io/repos/github/nigrosimone/fulmine.js/badge.svg?branch=main)](https://coveralls.io/github/nigrosimone/fulmine.js?branch=main)
@@ -147,11 +141,16 @@ as external in `angular.json`:
 ```
 
 What it is worth, measured on an Angular 22 application with each server reporting its own CPU per
-request, nine alternating rounds: **static assets 3.29x**, and **a page served from an in-process
-cache 1.90x**, but only when the cache keeps the body's ETag and length beside the bytes. A cache
-that stores the bytes alone measures level with Express, because both then hash the document again
-on every hit. The render itself is the same JavaScript on both sides and measures the same: on a
-cache miss the framework is not what your page is waiting for.
+request, nine alternating rounds: **static assets 3.29x**, and **a page served from a cache 1.50x**.
+The render itself is the same JavaScript on both sides and measures the same, so on a cache miss the
+framework is not what your page is waiting for. Which is the useful way round: an SSR application
+spends most of its traffic outside the render, and that is where the difference is.
+
+Caching those pages is [`ng-ssr-caching`](https://www.npmjs.com/package/ng-ssr-caching), a middleware
+that runs on Express and here alike, and the same measurement says a page costs 17.2ms to render and
+1.9ms to serve from it. It is worth knowing why it keeps the ETag beside the bytes: a cache that
+stores only the body makes the server hash the whole document again on every hit, and measures level
+with no cache at all on the serving side.
 
 ### When Express is somebody else's dependency
 
@@ -225,6 +224,7 @@ A single-stage `node:26-trixie-slim` image works too if you `apt-get install -y
 - `app.listen()` returns the app, not an `http.Server`. There is no node server underneath, so `server.close()`, `server.address()` and anything that attaches itself to a real `http.Server` need a look. `app.close()`, `app.address()` and `app.listening` are there and do what you would expect.
 - `x-powered-by` is disabled by default. Express sends `X-Powered-By: Express` unless you turn it off; Fulmine does not send it unless you turn it on with `app.set("x-powered-by", true)`. The header only tells anyone asking which framework is running.
 - request body is only read for POST, PUT, PATCH and QUERY requests by default. You can add additional methods by setting `body methods` to array with uppercased methods.
+- **Informational responses go nowhere.** `res.writeEarlyHints()`, `res.writeContinue()` and `res.writeProcessing()` are all there, take what node's take and throw what node's throw once the head has gone out, but nothing reaches the wire: µWebSockets.js has no API for a `1xx`. They exist so that code written for Express keeps running rather than dying on "is not a function", which is the only thing a drop-in can honestly promise here. `res.addTrailers()` is the same story, and `res.setTimeout()` and `req.setTimeout()` register the listener without changing anything, since µWS runs its own idle timeout through `uwsOptions.idleTimeout`.
 - For HTTPS, instead of doing this:
 
 ```js

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.5.0",
+    "version": "5.5.2",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "bin": {

package/src/application.js

@@ -500,31 +500,16 @@ class Application extends Router {
      * @param {any} res the uWS response
      * @param {any} req the uWS request
      */
-    async _serveGeneric(res, req) {
+    _serveGeneric(res, req) {
         const request = this.handleRequest(res, req);
         const response = request.res;
-        // armed up front here: this handler awaits, so the response outlives the callback
-        // on every path through it
+        // armed up front here: this handler can outlive the callback on every path through it
         this._armAbort(res, response);
 
-        try {
-            const routed = this._routeRequest(request, response);
-            // dispatch has run its synchronous stretch inside _routeRequest by now, still
-            // under the cork uWS holds for this callback; the await below leaves it
-            response._corkNeeded = true;
-            const matchedRoute = await routed;
-            if (!matchedRoute && !response.headersSent && !response.aborted) {
-                this._endUnmatched(request, response);
-            }
-        } catch (err) {
-            // an internal throw answers 500 as express's final handler would, instead of
-            // dying as an unhandled rejection
-            if (response.aborted || response.finished) {
-                console.error(err);
-            } else {
-                this._handleError(err, null, request, response);
-            }
-        }
+        this._routeRequestDirect(request, response);
+        // the synchronous stretch has run under the cork uWS holds for this callback, and
+        // whatever comes after it is outside
+        response._corkNeeded = true;
     }
 
     /**

package/src/request.js

@@ -700,6 +700,69 @@ module.exports = class Request extends LazyReadable {
         return this.res?.finished || this.res?.aborted;
     }
 
+    /** @type {AbortController|undefined} */
+    #abortController;
+
+    /**
+     * node's `req.signal`, an AbortSignal that fires when the request is over, so work started for
+     * a visitor who has gone away can be stopped. `@angular/ssr` reads it when it builds a web
+     * Request out of this one, which is how an SSR render learns to give up.
+     *
+     * Made on the first ask rather than for every request: most requests never look at it, and an
+     * AbortController each would be an allocation nobody reads.
+     *
+     * @returns {AbortSignal}
+     */
+    get signal() {
+        if (!this.#abortController) {
+            const controller = new AbortController();
+            this.#abortController = controller;
+            const stop = () => controller.abort();
+            if (this.res?.aborted || this.res?.finished) {
+                stop();
+            } else {
+                // the request, not the response: a client abort is reported by destroying this
+                // stream and emitting "aborted" on it, and the response is never told to close
+                this.once("aborted", stop);
+                this.once("close", stop);
+            }
+        }
+
+        return this.#abortController.signal;
+    }
+
+    /**
+     * The trailing headers of a chunked request. µWebSockets.js does not surface them, so these
+     * stay empty, which is also what node hands back until the request has ended.
+     *
+     * @returns {Record<string, string>}
+     */
+    get trailers() {
+        return {};
+    }
+
+    /**
+     * @returns {Record<string, string[]>}
+     */
+    get trailersDistinct() {
+        return {};
+    }
+
+    /**
+     * node's per-request socket timeout. µWS runs its own idle timeout, set through
+     * `uwsOptions.idleTimeout`, and this cannot change it. The listener is registered as node's is.
+     *
+     * @param {number} msecs
+     * @param {() => void} [callback]
+     * @returns {this}
+     */
+    setTimeout(msecs, callback) {
+        if (typeof callback === "function") {
+            this.once("timeout", callback);
+        }
+        return this;
+    }
+
     /**
      * Readable's pull. uWS pushes the body rather than being pulled from, so all this does is
      * lift the backpressure that a full queue put on it.

package/src/response.js

@@ -51,6 +51,18 @@ const { EventEmitter } = require("events");
 const http = require("http");
 const ms = require("ms");
 
+// How much a chunked response may gather before it is handed to uWS. Measured on uWS alone with
+// 33 KB written in 500 pieces: 16.2ms handed over one piece at a time, 0.79ms in 4 KB blocks,
+// 0.43ms in 8 KB, 0.45ms in 16 KB. Past 8 KB the curve is flat, so this is the smallest size that
+// buys the whole saving, and it bounds what one response can hold back.
+const COALESCE_LIMIT = 16 * 1024;
+
+// Below which a chunk is worth gathering. Merging costs a copy, and a chunk that is already
+// substantial does not earn it back: measured at 33 KB in eight pieces, gathering them made the
+// response 28% dearer, while the same bytes in sixty-six pieces got 3.4x cheaper. Anything from
+// here up goes straight through.
+const COALESCE_BELOW = 4 * 1024;
+
 const outgoingMessage = new http.OutgoingMessage();
 const symbols = Object.getOwnPropertySymbols(outgoingMessage);
 // if a future node renames it, fall back to a private symbol rather than writing a property
@@ -208,6 +220,25 @@ module.exports = class Response extends LazyWritable {
     /** @type {((err?: Error|null) => void)|null} */
     #pendingCallback = null;
 
+    /**
+     * Chunks written but not yet handed to uWS, and their total size.
+     *
+     * uWS charges for a write against everything already buffered behind it, so a chunked response
+     * written in many small pieces costs quadratically once it passes the socket's own buffer:
+     * measured on uWS alone, 500 writes of 66 bytes take 13ms against 0.06ms for 100 of them.
+     * Handing it the same bytes in blocks costs 0.4ms. Nothing here changes what goes on the wire,
+     * only how many calls it takes to put it there.
+     * Null until the first chunked write, since a res.send never queues anything.
+     * @type {Buffer[]|null}
+     */
+    #queued = null;
+
+    /** How many bytes {@link #queued} holds, kept alongside so the flush does not add them up. */
+    #queuedBytes = 0;
+
+    /** Whether a flush is already booked for the end of this turn. */
+    #flushBooked = false;
+
     /** @type {any} */
     #outHeaders = null;
 
@@ -400,10 +431,58 @@ module.exports = class Response extends LazyWritable {
         return this.#socket;
     }
 
+    /**
+     * Hands everything queued to uWS as one write, which is where the saving is, and keeps the
+     * backpressure the single write used to do.
+     *
+     * @param {((err?: Error|null) => void)|null} callback the stream's, when there is one waiting
+     */
+    #flushQueued(callback) {
+        if (this.#queued === null || this.#queuedBytes === 0) {
+            if (callback) callback(null);
+            return;
+        }
+        const body = this.#queued.length === 1 ? this.#queued[0] : Buffer.concat(this.#queued, this.#queuedBytes);
+        this.#queued = null;
+        this.#queuedBytes = 0;
+
+        const ok = this._res.write(body);
+        if (ok) {
+            this.writingChunk = false;
+            if (callback) callback(null);
+            else this.emit("drain");
+        } else if (callback) {
+            this.#pendingCallback = callback;
+            this._res.onWritable(() => {
+                if (this.aborted || this.finished) return true;
+                const cb = this.#pendingCallback;
+                this.#pendingCallback = null;
+                this.writingChunk = false;
+                if (cb) cb(null);
+                return true;
+            });
+        } else {
+            // nothing is waiting on this one: uWS drains it and the next write finds out
+            this.writingChunk = false;
+        }
+    }
+
+    /**
+     * The booked flush. Static, so a response that never writes in pieces allocates nothing for it:
+     * nextTick forwards the receiver as an argument.
+     *
+     * @param {any} res
+     */
+    static #flushOnTick(res) {
+        res.#flushBooked = false;
+        if (res.aborted || res.finished || res.#queuedBytes === 0) return;
+        res._res.cork(() => res.#flushQueued(null));
+    }
+
     /**
      * Writable's sink. Sends the headers if they have not gone yet, then hands the chunk to uWS,
-     * either as a chunk of a chunked response or through tryEnd when a Content-Length said how
-     * much there would be. Backpressure comes back as onWritable, which is what defers the
+     * either through the queue above for a chunked response or through tryEnd when a Content-Length
+     * said how much there would be. Backpressure comes back as onWritable, which is what defers the
      * callback rather than dropping the chunk.
      *
      * @param {any} chunk
@@ -441,20 +520,23 @@ module.exports = class Response extends LazyWritable {
             }
 
             if (this.chunkedTransfer) {
-                const ok = this._res.write(chunk);
-                if (ok) {
+                // Held back rather than written, and handed over in one piece at the end of this
+                // turn or once it is big enough to be worth a call. A stream that writes once per
+                // turn, an SSE feed for instance, still leaves on its own turn: the queue only ever
+                // gathers what was written without yielding in between.
+                (this.#queued ??= []).push(/** @type {Buffer} */ (chunk));
+                this.#queuedBytes += /** @type {Buffer} */ (chunk).byteLength;
+                // a chunk that is already big enough to be worth its own call leaves with whatever
+                // was waiting in front of it, rather than paying for a copy it does not need
+                if (this.#queuedBytes >= COALESCE_LIMIT || /** @type {Buffer} */ (chunk).byteLength >= COALESCE_BELOW) {
+                    this.#flushQueued(callback);
+                } else {
+                    if (!this.#flushBooked) {
+                        this.#flushBooked = true;
+                        process.nextTick(Response.#flushOnTick, this);
+                    }
                     this.writingChunk = false;
                     callback(null);
-                } else {
-                    this.#pendingCallback = callback;
-                    this._res.onWritable(() => {
-                        if (this.aborted || this.finished) return true;
-                        const cb = this.#pendingCallback;
-                        this.#pendingCallback = null;
-                        this.writingChunk = false;
-                        if (cb) cb(null);
-                        return true;
-                    });
                 }
             } else {
                 const lastOffset = this._res.getWriteOffset();
@@ -684,6 +766,8 @@ module.exports = class Response extends LazyWritable {
         } else if (!data && contentLength) {
             this._res.endWithoutBody(contentLength.toString());
         } else if (headWasAlreadyOut && this.chunkedTransfer) {
+            // whatever is still queued goes first: end() must not overtake the body written before it
+            this.#flushQueued(null);
             // The head has already gone out without a length, which is what flushHeaders() and the
             // first res.write() both do, so this response is committed to chunked framing and a
             // length can no longer describe it. node is committed the same way: after a flush,
@@ -1249,11 +1333,16 @@ module.exports = class Response extends LazyWritable {
     }
 
     /**
-     * Sends the status line and the headers now, without waiting for a body, which is node's
+     * Hands the status line and the headers over now, without waiting for a body, which is node's
      * flushHeaders(). Callers use it to let the client start on the head while the body is still
      * being produced, and one of them is `@angular/ssr`'s writeResponseToNodeResponse, which calls
      * it before streaming a rendered page.
      *
+     * **The head does not reach the wire here.** uWS holds it until the first body chunk, so a
+     * client sees nothing until then, where express answers at once. `beginWrite` is uWS's API for
+     * this and is unusable: it emits a stray CRLF before the first chunk size, which node's parser
+     * rejects as HPE_INVALID_CHUNK_SIZE. Checked against v20.69.0, the latest release.
+     *
      * A second call does nothing, as node's does. Nothing is written for a response already
      * finished or aborted: uWS has let go of it by then.
      *
@@ -1276,6 +1365,195 @@ module.exports = class Response extends LazyWritable {
         });
     }
 
+    /**
+     * node's `writeEarlyHints`, which sends a `103` carrying the resources the page will want, so a
+     * browser can start fetching them while the server is still rendering.
+     *
+     * **Nothing is sent here.** µWebSockets.js has no API for an informational response, so the
+     * hints cannot reach the wire, and this exists so that code written for Express keeps running
+     * rather than dying on "res.writeEarlyHints is not a function". The callback is still called,
+     * because node calls it once the hints are out and a caller may be waiting on it.
+     *
+     * `writeContinue` and `writeProcessing` below are the same story with `100` and `102`.
+     *
+     * @param {Record<string, string|string[]>} [hints]
+     * @param {() => void} [callback]
+     * @returns {void}
+     */
+
+    /**
+     *
+     */
+    writeEarlyHints(hints, callback) {
+        this.#refuseInformationAfterHead();
+        // node writes the hints first and calls back after, so a caller that sequences work on it
+        // gets the same order here
+        if (typeof callback === "function") {
+            process.nextTick(callback);
+        }
+    }
+
+    /**
+     * node's `writeContinue`, the `100` that answers an `Expect: 100-continue`. Nothing is sent:
+     * see {@link Response#writeEarlyHints}.
+     *
+     * @returns {void}
+     */
+    writeContinue() {
+        this.#refuseInformationAfterHead();
+    }
+
+    /**
+     * node's `writeProcessing`, the `102`. Nothing is sent: see {@link Response#writeEarlyHints}.
+     *
+     * @returns {void}
+     */
+    writeProcessing() {
+        this.#refuseInformationAfterHead();
+    }
+
+    /**
+     * node throws from all three of the above once the head has gone out, since an informational
+     * response can only come before it, and an application may well be relying on that throw.
+     *
+     * @returns {void}
+     */
+    #refuseInformationAfterHead() {
+        if (this.headersSent) {
+            /** @type {NodeJS.ErrnoException} */
+            const err = new Error("Cannot write headers after they are sent to the client");
+            err.code = "ERR_HTTP_HEADERS_SENT";
+            throw err;
+        }
+    }
+
+    /**
+     * node's `addTrailers`, the headers that follow a chunked body. µWebSockets.js cannot send
+     * them, so nothing is written and the response is otherwise unaffected.
+     *
+     * @param {Record<string, string>|[string, string][]} [headers]
+     * @returns {void}
+     */
+    addTrailers(headers) {}
+
+    /**
+     * node's per-response socket timeout. µWS runs its own idle timeout, set through
+     * `uwsOptions.idleTimeout`, and this cannot change it. The callback is registered on "timeout"
+     * as node's does, so nothing is lost by calling it, and nothing happens either.
+     *
+     * @param {number} msecs
+     * @param {() => void} [callback]
+     * @returns {this}
+     */
+    setTimeout(msecs, callback) {
+        if (typeof callback === "function") {
+            this.once("timeout", callback);
+        }
+        return this;
+    }
+
+    /**
+     * node's `assignSocket` and `detachSocket`, which the http server uses when a response is
+     * handed a raw socket. There is no such socket here.
+     *
+     * @param {any} [socket]
+     * @returns {void}
+     */
+    assignSocket(socket) {}
+
+    /**
+     * @param {any} [socket]
+     * @returns {void}
+     */
+    detachSocket(socket) {}
+
+    /**
+     * node's `statusMessage`, the reason phrase. It is held as `statusText` here, and the two are
+     * the same thing: this is the name node and Express use, so code that sets it keeps working.
+     *
+     * @returns {string|undefined}
+     */
+    get statusMessage() {
+        return this.statusText;
+    }
+
+    set statusMessage(value) {
+        this.statusText = value;
+    }
+
+    /**
+     * Whether a header has been set on this response, which is node's `hasHeader`. Names are
+     * compared lowercased, as node compares them.
+     *
+     * @param {string} name
+     * @returns {boolean}
+     */
+    hasHeader(name) {
+        return this.headers[name.toLowerCase()] !== undefined;
+    }
+
+    /**
+     * The names of the headers set so far, lowercased, which is node's `getHeaderNames`.
+     *
+     * @returns {string[]}
+     */
+    getHeaderNames() {
+        return Object.keys(this.headers);
+    }
+
+    /**
+     * node's `getRawHeaderNames`, which returns the names in the case they were set in. Header
+     * names are held lowercased here, so this returns what {@link Response#getHeaderNames} does.
+     *
+     * @returns {string[]}
+     */
+    getRawHeaderNames() {
+        return Object.keys(this.headers);
+    }
+
+    /**
+     * Adds a value to a header without replacing what is there, which is node's `appendHeader`.
+     * A header that already has one value becomes a list, as node makes it.
+     *
+     * @param {string} name
+     * @param {string|readonly string[]} value
+     * @returns {this}
+     */
+    appendHeader(name, value) {
+        const key = name.toLowerCase();
+        const current = this.headers[key];
+        if (current === undefined) {
+            return this.setHeader(name, /** @type {any} */ (value));
+        }
+        const merged = [].concat(/** @type {any} */ (current), /** @type {any} */ (value));
+        return this.setHeader(name, /** @type {any} */ (merged));
+    }
+
+    /**
+     * Sets several headers at once from a Headers or a Map, which is node's `setHeaders`. A
+     * `Headers` gives `set-cookie` back through getSetCookie, so those stay separate values rather
+     * than one folded string.
+     *
+     * @param {Headers|Map<string, string|readonly string[]>} headers
+     * @returns {this}
+     */
+    setHeaders(headers) {
+        if (typeof Headers === "function" && headers instanceof Headers) {
+            for (const name of new Set([...headers.keys()])) {
+                if (name === "set-cookie") {
+                    this.setHeader(name, /** @type {any} */ (headers.getSetCookie()));
+                } else {
+                    this.setHeader(name, /** @type {any} */ (headers.get(name)));
+                }
+            }
+            return this;
+        }
+        for (const [name, value] of headers) {
+            this.setHeader(name, /** @type {any} */ (value));
+        }
+        return this;
+    }
+
     /**
      * Node asks this before validating a header value, and answering true keeps it permissive.
      * Only reached through code that goes down node's own header path.
@@ -1720,12 +1998,6 @@ module.exports = class Response extends LazyWritable {
         return this.set("content-type", ct);
     }
 
-    /**
-     * express carries both names for the same method, and middleware reaches for either.
-     * @type {(type: string) => any}
-     */
-    contentType = this.type;
-
     /**
      * Adds a field to Vary, without repeating one already there.
      * @param {string|string[]} field
@@ -1755,3 +2027,7 @@ module.exports = class Response extends LazyWritable {
         return this.finished;
     }
 };
+
+// res.contentType is res.type under express's other name. On the prototype rather than an instance
+// field, which wrote one own property per response in the constructor.
+/** @type {any} */ (module.exports.prototype).contentType = module.exports.prototype.type;

package/src/router.js

@@ -446,7 +446,7 @@ class Walk {
             return this.step(undefined);
         }
         if (kind === CALLBACK_ROUTER) {
-            if (callback.constructor.name === "Application") {
+            if (callback._isApplication) {
                 rememberApp(this, route, req);
                 useApp(req, callback);
             }
@@ -616,10 +616,15 @@ function nativeFail(err) {
  * @returns {number}
  */
 function mountPrefixLength(route, req) {
-    const path = req._opPath;
+    // a use with no path is EMPTY_REGEX, which matches "" at 0 whatever the path is. Answered
+    // without the exec, since this runs per hop and most middleware is pathless
+    if (route.pattern === EMPTY_REGEX) {
+        return 0;
+    }
     if (typeof route.pattern === "string") {
         return route.pattern.length;
     }
+    const path = req._opPath;
     const matched = route.pattern.exec(path === "" ? "/" : path);
     return matched ? Math.min(matched[0].length, path.length) : 0;
 }
@@ -1057,7 +1062,7 @@ function guardsInside(router, mount, pathPrefix, chain, inherited) {
  * @param {any} req
  */
 function rememberApp(walk, route, req) {
-    if (walk.router._isApplication && route.callbacks[0]?.constructor.name === "Application") {
+    if (walk.router._isApplication && route.callbacks[0]?._isApplication) {
         (req._appStack ??= []).push(route, req.app);
     }
 }
@@ -2536,6 +2541,24 @@ module.exports = class Router extends EventEmitter {
         });
     }
 
+    /**
+     * The same walk without the promise pair, for a uWS handler that never awaited it. nativeDone
+     * and nativeFail defer their epilogues to the microtask the await used to resume on, so the
+     * visible order holds.
+     *
+     * @param {any} req
+     * @param {any} res
+     */
+    _routeRequestDirect(req, res) {
+        const walk = new Walk(this, req, res, this._routes, false, undefined, nativeDone, nativeFail);
+        try {
+            walk.dispatch(0);
+        } catch (err) {
+            // what a throw inside a promise executor did: reject, once
+            nativeFail.call(walk, err);
+        }
+    }
+
     /**
      * Mounts middleware, or a whole router, at a path. The path is optional, and a mount matches
      * everything under it, which is what separates it from all(). Mounting a Router sets its

package/src/utils.js

@@ -1102,6 +1102,11 @@ function createETagGenerator(options) {
         if (body instanceof Stats) {
             return statTag(body, options.weak);
         }
+        // crypto.hash reads a string as the utf8 bytes Buffer.from would have produced, so the tag
+        // is the same one without copying the whole body first
+        if (typeof body === "string" && (encoding === undefined || encoding === "utf8" || encoding === "utf-8")) {
+            return entityTag(body, options.weak);
+        }
         const buf = !Buffer.isBuffer(body) ? Buffer.from(body, encoding) : body;
         return entityTag(buf, options.weak);
     };