quico 0.4.0 → 0.7.0

package/src/server_stats.js

@@ -0,0 +1,93 @@
+// ============================================================
+//  The server's counters — server.getStats()
+// ============================================================
+//
+// What an operator watches a server by: how many connections came, over what,
+// how many handshakes failed, how connections ended and with what code, what
+// 0-RTT did, how often the anti-amplification limit held the server back,
+// how many internal errors were caught. Counts only: no addresses, no names,
+// no headers, no payloads — nothing here identifies a client.
+//
+// One object per server, made by createServer and handed to each layer
+// (quic_server, quic_connection, h3_server, tcp_listener, h2_server / h2.js,
+// h1_server) in its options as `stats`; each counts where the thing happens,
+// with a plain increment. A layer used on its own (createQuicServer, an
+// H2Connection) has none and counts nothing.
+//
+// Codes are the protocol's, as hex strings ('0x0', '0x12f'): a map from code
+// to count, only for codes seen.
+
+function ServerStats() {
+  this.since = Date.now();
+  // Connections taken: QUIC, a first Initial that began a handshake; TCP, a
+  // socket accepted (before TLS).
+  this.connections = { quic: 0, tcp: 0 };
+  // TLS handshakes, as they ended: completed (the client's Finished
+  // verified) or failed (an alert either way, a timeout, the connection
+  // closed first). resumed: completed with a session ticket.
+  this.handshakes = { quic: { completed: 0, failed: 0 }, tcp: { completed: 0, failed: 0 }, resumed: 0 };
+  // Connections by the protocol they went on to speak (the ALPN agreed; over
+  // cleartext TCP, the preface read) — other: an ALPN name of the
+  // application's.
+  this.protocols = { h3: 0, h2: 0, 'http/1.1': 0, other: 0 };
+  // 0-RTT offered by the client: taken, or refused (the ticket's, the replay
+  // check, a HelloRetryRequest); tooEarly, requests answered 425 (RFC 8470).
+  this.earlyData = { accepted: 0, rejected: 0, tooEarly: 0 };
+  // How connections ended, by code:
+  //   quic   CONNECTION_CLOSE of the transport (RFC 9000 §20.1; 0x100 + a TLS
+  //          alert, RFC 9001 §4.8) — sent by us, received from the client;
+  //          silent: ended with none either way (the idle timeout, a
+  //          stateless reset, a handshake abandoned)
+  //   h3     CONNECTION_CLOSE of the application (RFC 9114 §8.1)
+  //   h2     GOAWAY (RFC 9113 §7)
+  //   http1  requests refused before the application saw them, by status
+  //          (400 a malformed request, 431 headers too large, ...)
+  this.closes = {
+    quic: { sent: {}, received: {}, silent: 0 },
+    h3: { sent: {}, received: {} },
+    h2: { sent: {}, received: {} },
+    http1: { sent: {} }
+  };
+  // Streams reset, by code: RESET_STREAM (HTTP/3) and RST_STREAM (HTTP/2),
+  // sent and received.
+  this.streamResets = { h3: { sent: {}, received: {} }, h2: { sent: {}, received: {} } };
+  // Datagrams the server held because the client's address was not yet
+  // validated and it had sent three times what it received (RFC 9000 §8.1).
+  this.amplificationBlocked = 0;
+  // Exceptions caught inside the QUIC and HTTP/3 layers: a bug of ours,
+  // never the client's (the packet dropped, or H3_INTERNAL_ERROR).
+  this.internalErrors = 0;
+}
+
+/** One more of a protocol error `code` in `map`, by its hex. */
+ServerStats.prototype.code = function (map, code) {
+  // Up to 62 bits (a QUIC varint — WebTransport's codes are past 2^32): by
+  // its value, not cut to 32 bits.
+  var k = '0x' + (typeof code === 'bigint' ? code : Number(code)).toString(16);
+  map[k] = (map[k] || 0) + 1;
+};
+
+/** One more of an HTTP status in `map`. */
+ServerStats.prototype.status = function (map, status) {
+  map[status] = (map[status] || 0) + 1;
+};
+
+/** A TLS handshake ended ('quic' or 'tcp'): completed or not, resumed. */
+ServerStats.prototype.handshake = function (transport, ok, resumed) {
+  this.handshakes[transport][ok ? 'completed' : 'failed']++;
+  if (ok && resumed) this.handshakes.resumed++;
+};
+
+/** A connection handed to the protocol it speaks. */
+ServerStats.prototype.protocol = function (name) {
+  this.protocols[name === 'h3' || name === 'h2' || name === 'http/1.1' ? name : 'other']++;
+};
+
+/** A copy, for the caller to keep or change. */
+ServerStats.prototype.snapshot = function () {
+  var copy = JSON.parse(JSON.stringify(this));
+  copy.uptime = Date.now() - this.since;
+  return copy;
+};
+
+export { ServerStats };

package/src/streams.js

@@ -13,6 +13,7 @@
  */
 
 import { Readable, Writable, Duplex } from 'node:stream';
+import { validateHeaderName, validateHeaderValue, validateStatus, validateRequestTarget, headersSentError, responsePriority } from './http_common.js';
 
 
 // ============================================================
@@ -52,6 +53,8 @@ class IncomingMessage extends Readable {
     // Server-side (request)
     this.method = options.method || null;
     this.url = options.url || null;
+    // HTTP/3: the request came in 0-RTT (it may be a replay). Never over TCP.
+    this.earlyData = false;
 
     // QUIC has no TCP socket — stub so libraries don't crash
     this.socket = options.socket || _makeSocketStub();
@@ -73,13 +76,15 @@ class IncomingMessage extends Readable {
   /**
    * Called by H3 layer when a body chunk arrives.
    */
+  // push()'s answer: false once the buffer is full — the caller stops
+  // reading until _read asks for more.
   _pushData(chunk) {
-    if (this.complete) return;
+    if (this.complete) return true;
     if (typeof chunk === 'string') chunk = Buffer.from(chunk);
     if (chunk instanceof Uint8Array && !Buffer.isBuffer(chunk)) {
       chunk = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength);
     }
-    this.push(chunk);
+    return this.push(chunk);
   }
 
   /**
@@ -92,14 +97,31 @@ class IncomingMessage extends Readable {
   }
 
   /**
-   * Abort the stream (error / timeout / reset).
+   * The exchange ended before its body did — the peer reset the stream or
+   * went away, or (client side) req.destroy(). The one place this is decided,
+   * as node:http's IncomingMessage does it:
+   *
+   *   'aborted' — always, once;
+   *   'error'   — ('aborted', ECONNRESET, or the cause given) only to a
+   *               listener that asked for one: unheard, it would take the
+   *               process down, and node:http teaches 'aborted'/'close';
+   *   'close'   — and never 'end', which would say the body is whole.
+   *
+   * It ended the stream with push(null) — 'end', a cut-off upload read as a
+   * complete one — and each caller decided the 'error' question for itself,
+   * one (h1_server) not at all, so a client vanishing mid-upload threw.
+   * A body that had already arrived in full is left as it is: 'aborted', and
+   * nothing to cut.
    */
   _abort(err) {
-    if (this.complete) return;
+    if (this.aborted) return;
     this.aborted = true;
+    if (this._timeoutTimer) { clearTimeout(this._timeoutTimer); this._timeoutTimer = null; }
+    this.emit('aborted');
+    if (this.complete) return;
     this.complete = true;
-    if (err) this.destroy(err);
-    else this.push(null);
+    if (!err) { err = new Error('aborted'); err.code = 'ECONNRESET'; }
+    this.destroy(this.listenerCount('error') > 0 ? err : null);
   }
 
   setTimeout(msecs, callback) {
@@ -110,6 +132,32 @@ class IncomingMessage extends Readable {
     }
     return this;
   }
+
+  /**
+   * What destroy() by the application means on the wire, given by the
+   * transport that made this message: a request's body the server no longer
+   * wants (STOP_SENDING / RST_STREAM; over HTTP/1.1, the socket), a response
+   * the client gave up on mid-way. Not run when the stream itself ended it
+   * (_abort: the peer's reset, the connection gone); each hook decides what
+   * is left to stop (a body that arrived whole: nothing). destroy() was
+   * local only: the body kept coming, at full speed once its credit was
+   * released, into a message nobody read.
+   */
+  _onDestroy(fn) {
+    (this._destroyHooks || (this._destroyHooks = [])).push(fn);
+  }
+
+  _destroy(err, cb) {
+    if (this._timeoutTimer) { clearTimeout(this._timeoutTimer); this._timeoutTimer = null; }
+    var hooks = this._destroyHooks;
+    this._destroyHooks = null;
+    // Not after 'end': that is autoDestroy closing a body read to the end,
+    // not the application giving anything up.
+    if (hooks && !this.aborted && !this.readableEnded) {
+      for (var i = 0; i < hooks.length; i++) { try { hooks[i](err); } catch (e) {} }
+    }
+    cb(err);
+  }
 }
 
 
@@ -128,7 +176,10 @@ class ServerResponse extends Writable {
     options = options || {};
 
     this.statusCode = 200;
-    this.statusMessage = 'OK';
+    // Unset, as node:http has it: the standard reason phrase for whatever the
+    // status ends up being. It was 'OK', so a status set without one —
+    // res.statusCode = 404, writeHead(425, headers) — went out as '404 OK'.
+    this.statusMessage = undefined;
     this.headersSent = false;
     this.finished = false;
     this._headers = {};
@@ -144,9 +195,11 @@ class ServerResponse extends Writable {
     this.socket = options.socket || _makeSocketStub();
     this.connection = this.socket;
 
+    // 'close' comes from the Writable itself (autoDestroy), once, after
+    // 'finish' — node's order. It was also emitted here, from a 'finish'
+    // listener registered first: the application saw close, finish, close.
     this.on('finish', () => {
       this.finished = true;
-      this.emit('close');
     });
 
     // Express does res.__proto__ = app.response (http.ServerResponse.prototype)
@@ -164,10 +217,49 @@ class ServerResponse extends Writable {
     this.end = this.end.bind(this);
   }
 
+  /**
+   * The peer is gone — the stream reset, the connection lost — while this
+   * response was still being written. As node:http: 'close', once; later
+   * writes are dropped without an error, so a handler mid-flight is not
+   * taken down, and a pipe() into the response stops. Without it a response
+   * whose connection died never closed, and a pipe() kept reading its source
+   * into a connection that was gone.
+   */
+  _abortResponse() {
+    if (this.writableFinished || this.destroyed) return;
+    this._aborted = true;
+    this.destroy();
+  }
+
+  /**
+   * res.destroy([err]) by the application, mid-response: the transport ends
+   * the stream so the client hears it — RESET_STREAM over HTTP/3, RST_STREAM
+   * over HTTP/2, the socket over HTTP/1.1 (as node:http) — with an internal
+   * error's code when there is an err (a failed pipeline), a cancel's
+   * otherwise. It was local only: the client waited for the rest of a
+   * response that would never come, and over HTTP/3 and HTTP/2 the stream
+   * stayed open until the connection closed. As node:http, the err is not
+   * re-emitted as 'error' to a response nobody listens to.
+   */
+  _onDestroy(fn) {
+    (this._destroyHooks || (this._destroyHooks = [])).push(fn);
+  }
+
+  _destroy(err, cb) {
+    var hooks = this._destroyHooks;
+    this._destroyHooks = null;
+    if (hooks && !this._aborted && !this.writableFinished) {
+      for (var i = 0; i < hooks.length; i++) { try { hooks[i](err); } catch (e) {} }
+    }
+    cb(err && this.listenerCount('error') > 0 ? err : null);
+  }
+
   // ---- Header management (mirrors node:http) ----
 
   setHeader(name, value) {
-    if (this.headersSent) throw new Error('Cannot set headers after they are sent to the client');
+    if (this.headersSent) throw headersSentError('set', this.req && this.req.httpVersion);
+    validateHeaderName(name);
+    validateHeaderValue(name, value);
     var lower = name.toLowerCase();
     this._headers[lower] = value;
     this._headerNames[lower] = name;
@@ -193,13 +285,32 @@ class ServerResponse extends Writable {
   }
 
   removeHeader(name) {
-    if (this.headersSent) throw new Error('Cannot remove headers after they are sent to the client');
+    if (this.headersSent) throw headersSentError('remove', this.req && this.req.httpVersion);
     var lower = name.toLowerCase();
     delete this._headers[lower];
     delete this._headerNames[lower];
     return this;
   }
 
+  /**
+   * node:http's res.addTrailers(headers): fields sent after the body — an
+   * object, or an array of [name, value] pairs. Over HTTP/1.1 they go in the
+   * last chunk (chunked responses only, as node); over HTTP/2 as a trailing
+   * HEADERS frame. The layers read res.trailers, but the method an application
+   * calls was missing: it threw a TypeError inside the handler, and over
+   * HTTP/2 that tore down the whole connection.
+   */
+  addTrailers(headers) {
+    if (!this.trailers) this.trailers = {};
+    var pairs = Array.isArray(headers) ? headers : Object.keys(headers || {}).map(function (k) { return [k, headers[k]]; });
+    for (var i = 0; i < pairs.length; i++) {
+      var name = pairs[i][0], value = pairs[i][1];
+      validateHeaderName(name, 'Trailer name');
+      validateHeaderValue(name, value);
+      this.trailers[String(name).toLowerCase()] = value;
+    }
+  }
+
   // ---- writeHead ----
 
   writeHead(statusCode, statusMessage, headers) {
@@ -210,6 +321,7 @@ class ServerResponse extends Writable {
       statusMessage = undefined;
     }
 
+    validateStatus(statusCode, statusMessage);
     this.statusCode = statusCode;
     if (statusMessage !== undefined) this.statusMessage = String(statusMessage);
 
@@ -259,18 +371,49 @@ class ServerResponse extends Writable {
 
   write(chunk, encoding, callback) {
     if (typeof encoding === 'function') { callback = encoding; encoding = undefined; }
+    this._wrote = true;
     return super.write(chunk, encoding, callback);
   }
 
   end(data, encoding, callback) {
     if (typeof data === 'function') { callback = data; data = undefined; encoding = undefined; }
     if (typeof encoding === 'function') { callback = encoding; encoding = undefined; }
+    // The whole body, when nothing was written before it and the head has
+    // not gone: its length, for HTTP/1.1 to send as Content-Length rather
+    // than chunk it (node:http's end() does the same). HTTP/2 and HTTP/3
+    // frame the body themselves and do not read it.
+    if (!this.headersSent && !this._wrote && !this.writableEnded) {
+      var len = data == null ? 0
+        : typeof data === 'string' ? Buffer.byteLength(data, encoding)
+        : data.byteLength;
+      if (typeof len === 'number') this._endLength = len;   // else write() rejects it
+    }
     if (data != null) this.write(data, encoding);
     return super.end(callback);
   }
 
   writeContinue() { /* HTTP/3 doesn't use 100-continue — stub */ }
 
+  /**
+   * 103 Early Hints (RFC 8297) — node:http's response.writeEarlyHints(hints[,
+   * callback]). `hints` is a header object; `link` a string or an array of
+   * them. The protocol layer that made this response replaces this with the
+   * real thing (h1_server, h2_server, h3_server); this one, on a response
+   * nothing wired, sends nothing and still calls back.
+   */
+  writeEarlyHints(hints, callback) {
+    if (typeof callback === 'function') process.nextTick(callback);
+  }
+
+  /**
+   * The response's priority, { urgency, incremental } (RFC 9218). HTTP/2 and
+   * HTTP/3 replace this with the real thing (h2_server, h3_server); over
+   * HTTP/1.1 a connection carries one response at a time, so there is
+   * nothing to order, and it does nothing. It was missing there: the same
+   * handler, reached over HTTP/1.1, threw a TypeError.
+   */
+  setPriority(priority) {}
+
   setTimeout(msecs, callback) {
     if (callback) this.once('timeout', callback);
     return this;
@@ -282,12 +425,22 @@ class ServerResponse extends Writable {
 //  ClientRequest — extends Writable
 //
 //  Wraps outgoing HTTP request on the client side.
-//  write() / pipe(req) buffers body data.
-//  _final() signals body-complete so the transport can send.
+//  The body flows as it is written, as node:http's does: held here only
+//  until a transport takes the request (_attachSink — the first of the
+//  protocols tried to be ready to send), then handed to it, with its
+//  backpressure (write() false, 'drain'). What was handed is kept, up to
+//  REPLAY_MAX, so that a request another protocol must carry after all — the
+//  first failed before the server processed it — can be sent again whole.
 //
 //  The 'response' event delivers an IncomingMessage.
 // ============================================================
 
+// How much of a request body is kept, once handed to a transport, for
+// sending again over another — what a request refused unprocessed (REFUSED_
+// STREAM, H3_REQUEST_REJECTED, past a GOAWAY) or whose first protocol failed
+// may need. Past it, the body streams without a copy.
+var REPLAY_MAX = 64 * 1024;
+
 class ClientRequest extends Writable {
 
   constructor(options) {
@@ -309,6 +462,11 @@ class ClientRequest extends Writable {
 
     options = options || {};
 
+    // node:http throws these from http.request() itself: the path (no CR, LF,
+    // space or other control character — CVE-2018-12116 was a request split
+    // through it) and the method (a token).
+    validateRequestTarget(options.path, options.method);
+
     this.method = (options.method || 'GET').toUpperCase();
     this.path = options.path || '/';
     this.host = options.hostname || options.host || 'localhost';
@@ -327,8 +485,17 @@ class ClientRequest extends Writable {
       for (var name in options.headers) this.setHeader(name, options.headers[name]);
     }
 
-    // Body buffer — accumulated via write/pipe, sent when _final fires
+    // The body: held until a transport takes the request, then streamed to it.
     this._bodyChunks = [];
+    this._bodyBuffered = 0;
+    this._pendingWriteCb = null;   // a write held for room (before a transport)
+    this._sink = null;             // the transport request carrying the body
+    this._sinkWaitCb = null;       // a write waiting for the sink's 'drain'
+    this._replay = [];             // what the sink was handed, while ≤ REPLAY_MAX
+    this._replayBytes = 0;
+    this._replayable = true;
+    this._trailers = null;         // addTrailers()
+    this._priority = null;         // setPriority()
 
     // H3 internals — set by unified client after protocol selection
     this._h3 = null;
@@ -346,11 +513,49 @@ class ClientRequest extends Writable {
 
     this._timeoutTimer = null;
     this._timeoutMs = 0;
+
+    // The response, once there is one (node:http's req.res), and how to stop
+    // each transport attempt that carries this request (see _destroy).
+    this.res = null;
+    this._cancels = [];
+  }
+
+  // ---- Cancellation ----
+  //
+  // destroy() / abort() stop the exchange where it is carried, as node:http's
+  // do by destroying the socket. Without this they only marked the request:
+  // the transport went on, and the response kept downloading in the
+  // background. Each transport attempt registers how to stop itself — over
+  // HTTP/3 and HTTP/2 that is the request's stream, not the (shared)
+  // connection; over HTTP/1.1, the socket, which cannot be reused mid-exchange.
+
+  _onCancel(fn) {
+    if (this.destroyed) { fn(); return; }
+    this._cancels.push(fn);
+  }
+
+  // node:http: destroyed before a response, the request fails with 'socket
+  // hang up' (ECONNRESET) unless given its own error.
+  destroy(err) {
+    if (this.destroyed) return this;
+    if (!err && !this.res && !this.aborted) { err = new Error('socket hang up'); err.code = 'ECONNRESET'; }
+    return super.destroy(err);
+  }
+
+  _destroy(err, cb) {
+    var cancels = this._cancels;
+    this._cancels = [];
+    for (var i = 0; i < cancels.length; i++) { try { cancels[i](); } catch (e) {} }
+    if (this._timeoutTimer) { clearTimeout(this._timeoutTimer); this._timeoutTimer = null; }
+    if (this.res && !this.res.complete) this.res._abort(err && err.code !== 'ECONNRESET' ? err : null);
+    cb(err);
   }
 
   // ---- Header management ----
 
   setHeader(name, value) {
+    validateHeaderName(name);
+    validateHeaderValue(name, value);
     var lower = name.toLowerCase();
     this._headers[lower] = value;
     this._headerNames[lower] = name;
@@ -388,16 +593,93 @@ class ClientRequest extends Writable {
     if (Buffer.isBuffer(chunk)) {
       chunk = new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength);
     }
+    if (this._sink) { this._toSink(chunk, callback); return; }
+    // No transport yet (still connecting): held — and the writer told to wait
+    // past the high-water mark, as a socket not yet connected would.
     this._bodyChunks.push(chunk);
-    callback();
+    this._bodyBuffered += chunk.byteLength;
+    if (this._bodyBuffered < this.writableHighWaterMark) callback();
+    else this._pendingWriteCb = callback;
   }
 
   _final(callback) {
     this.finished = true;
-    this.emit('_bodyReady');
+    if (this._sink) this._sink.end(null, this._trailers);
     callback();
   }
 
+  // node:http's addTrailers(): fields sent after the body (a HEADERS frame
+  // over HTTP/2 and HTTP/3; with chunked encoding over HTTP/1.1). An object,
+  // or a list of [name, value] pairs.
+  addTrailers(headers) {
+    var t = this._trailers || (this._trailers = {});
+    var pairs = Array.isArray(headers) ? headers : Object.keys(headers || {}).map(function (k) { return [k, headers[k]]; });
+    for (var i = 0; i < pairs.length; i++) {
+      var name = pairs[i][0], value = pairs[i][1];
+      validateHeaderName(name);
+      validateHeaderValue(name, value);
+      t[String(name).toLowerCase()] = value;
+    }
+  }
+
+  // The request's priority (RFC 9218): { urgency: 0-7 (3), incremental
+  // (false) } — the `priority` header while the request has not gone, a
+  // PRIORITY_UPDATE after it (HTTP/2, HTTP/3), as res.setPriority is the
+  // server's. Normalized the same way.
+  setPriority(p) {
+    this._priority = responsePriority(p);
+    if (this._sink && typeof this._sink.setPriority === 'function') this._sink.setPriority(this._priority);
+    return this;
+  }
+
+  // ---- The transport that carries the body (client.js) ----
+
+  // `sink` (a transport's request: write → more?, 'drain', end(chunk,
+  // trailers)) takes the request: what is held goes to it, and from now on
+  // every write.
+  _attachSink(sink) {
+    var self = this;
+    this._sink = sink;
+    if (this._priority && typeof sink.setPriority === 'function') sink.setPriority(this._priority);
+    sink.on('drain', function () {
+      if (self._sink !== sink || !self._sinkWaitCb) return;
+      var cb = self._sinkWaitCb; self._sinkWaitCb = null; cb();
+    });
+    var held = this._bodyChunks, more = true;
+    this._bodyChunks = []; this._bodyBuffered = 0;
+    for (var i = 0; i < held.length; i++) { this._remember(held[i]); more = sink.write(held[i]); }
+    if (this._pendingWriteCb) {
+      var cb = this._pendingWriteCb; this._pendingWriteCb = null;
+      if (more) cb(); else this._sinkWaitCb = cb;
+    }
+    if (this.finished) sink.end(null, this._trailers);
+  }
+
+  // The transport failed before the server processed the request: the body
+  // back here, whole, for the next — or false if it cannot be (more than
+  // REPLAY_MAX was handed over: not kept).
+  _detachSink() {
+    if (!this._replayable) return false;
+    this._sink = null;
+    this._bodyChunks = this._replay; this._bodyBuffered = this._replayBytes;
+    this._replay = []; this._replayBytes = 0;
+    if (this._sinkWaitCb) { this._pendingWriteCb = this._sinkWaitCb; this._sinkWaitCb = null; }
+    return true;
+  }
+
+  _toSink(chunk, callback) {
+    this._remember(chunk);
+    if (this._sink.write(chunk)) callback();
+    else this._sinkWaitCb = callback;
+  }
+
+  _remember(chunk) {
+    if (!this._replayable) return;
+    this._replayBytes += chunk.byteLength;
+    if (this._replayBytes > REPLAY_MAX) { this._replayable = false; this._replay = []; this._replayBytes = 0; return; }
+    this._replay.push(chunk);
+  }
+
   // ---- Convenience overrides ----
 
   write(chunk, encoding, callback) {
@@ -412,9 +694,13 @@ class ClientRequest extends Writable {
     return super.end(callback);
   }
 
+  // node:http: 'abort', then 'close' — no error.
   abort() {
+    if (this.aborted || this.destroyed) return;
     this.aborted = true;
-    this.destroy(new Error('Request aborted'));
+    var self = this;
+    process.nextTick(function () { self.emit('abort'); });
+    this.destroy();
   }
 
   setTimeout(msecs, callback) {
@@ -426,24 +712,6 @@ class ClientRequest extends Writable {
     }
     return this;
   }
-
-  /**
-   * Collect all buffered body chunks into one Uint8Array.
-   * Returns null if nothing was written (GET / HEAD).
-   */
-  _getBody() {
-    if (this._bodyChunks.length === 0) return null;
-    if (this._bodyChunks.length === 1) return this._bodyChunks[0];
-    var total = 0;
-    for (var i = 0; i < this._bodyChunks.length; i++) total += this._bodyChunks[i].byteLength;
-    var merged = new Uint8Array(total);
-    var off = 0;
-    for (var i = 0; i < this._bodyChunks.length; i++) {
-      merged.set(this._bodyChunks[i], off);
-      off += this._bodyChunks[i].byteLength;
-    }
-    return merged;
-  }
 }
 
 
@@ -452,6 +720,64 @@ class ClientRequest extends Writable {
 //  Must be a real Stream so Node's eos() / Express don't crash.
 // ============================================================
 
+/**
+ * Make an Express application (or anything built the same way) run on these
+ * streams.
+ *
+ * Express does not use the req and res it is handed as they are: on every
+ * request it swaps their prototype for its own (Object.setPrototypeOf(req,
+ * app.request)), and that chain ends in node:http's IncomingMessage and
+ * ServerResponse. Every method of these classes is gone after that — a
+ * request body arrived through _pushData, which no longer existed, and the
+ * server fell over on the first POST. The response survived only because its
+ * methods are also bound onto each instance (see the constructor), and even
+ * so it ran on node:http's getters for its state.
+ *
+ * So the chain is re-parented instead, once per application:
+ *
+ *   before   app.response → express's response methods → http.ServerResponse
+ *   after    app.response → a copy of those methods    → quico ServerResponse
+ *
+ * Express's methods — req.get, res.json, res.send, res.cookie,
+ * express.static — sit on top and call the ones below, which are now ours:
+ * the same object, on HTTP/1.1, HTTP/2 and HTTP/3.
+ *
+ * A COPY, because the object holding Express's methods is shared by every
+ * Express application in the process: re-parenting it would move them all,
+ * including any served by node:http. The copy belongs to this application
+ * alone. A sub-application inherits from its parent's objects when it is
+ * mounted, so the root is the only one that needs it.
+ *
+ * Recognised by shape — a function with `request` and `response` objects —
+ * not by name; left alone when already adopted or not that shape. Returns
+ * the handler, for chaining.
+ */
+function adoptApp(handler) {
+  if (typeof handler !== 'function') return handler;
+  reparent(handler.request, IncomingMessage);
+  reparent(handler.response, ServerResponse);
+  return handler;
+}
+
+// Put `Base` under obj's prototype chain in place of the class it ends in: the
+// objects between obj and the first class prototype (one owning a
+// `constructor`) are copied, the last copy inheriting from Base.prototype.
+function reparent(obj, Base) {
+  if (!obj || typeof obj !== 'object' || obj instanceof Base) return;
+  var between = [];
+  var p = Object.getPrototypeOf(obj);
+  while (p && !Object.prototype.hasOwnProperty.call(p, 'constructor')) {
+    between.push(p);
+    p = Object.getPrototypeOf(p);
+  }
+  if (!p || p === Object.prototype) return;   // not a class chain: not ours to change
+  var top = Base.prototype;
+  for (var i = between.length - 1; i >= 0; i--) {
+    top = Object.create(top, Object.getOwnPropertyDescriptors(between[i]));
+  }
+  Object.setPrototypeOf(obj, top);
+}
+
 function _makeSocketStub() {
   var sock = new Duplex({
     read(_size) { /* no-op — no data from QUIC socket */ },
@@ -482,4 +808,4 @@ function _makeSocketStub() {
 }
 
 
-export { IncomingMessage, ServerResponse, ClientRequest, _makeSocketStub };
+export { IncomingMessage, ServerResponse, ClientRequest, _makeSocketStub, adoptApp };