redweb 0.12.0 → 0.13.0

package/src/htmx/ReactiveRenderer.js

@@ -0,0 +1,241 @@
+'use strict';
+
+const { AsyncLocalStorage } = require('async_hooks');
+
+const capture = new AsyncLocalStorage();
+const ROOT = 'root';
+const MAX_OWNERS = 1024;
+const MAX_HTML_BYTES = 1024 * 1024;
+
+function ownerId(component) {
+    return component ? `c${Buffer.from(component).toString('hex')}` : ROOT;
+}
+
+function boundary(id, html) { return `<!--rw:${id}-->${html}<!--/rw:${id}-->`; }
+
+function replaceBoundary(source, id, html) {
+    const start = `<!--rw:${id}-->`;
+    const end = `<!--/rw:${id}-->`;
+    return source.split(start).map((part, index) => index ? html + part.slice(part.indexOf(end)) : part).join(start);
+}
+
+/** One rendering history per HTTP/page session, including shared pages. Never shares request context. */
+class ReactiveRenderer {
+    constructor(page, signal, timeoutMs = 5000) {
+        this.page = page;
+        this.nodes = new Map();
+        this.dirty = new Set();
+        this.states = new Map();
+        this.socket = null;
+        this.pending = null;
+        this.running = null;
+        this.generation = 0;
+        this.disposed = false;
+        this.enabled = false;
+        this.controller = new AbortController();
+        this.connection = new AbortController();
+        this.timeoutMs = timeoutMs;
+        this.parentSignal = signal;
+        this.abort = () => this.dispose();
+        signal.addEventListener('abort', this.abort, { once: true });
+        if (signal.aborted) this.dispose();
+    }
+
+    static read(owner, name) {
+        const current = capture.getStore();
+        if (!current) return;
+        const names = current.node.dependencies.get(owner) || new Set();
+        names.add(name);
+        current.node.dependencies.set(owner, names);
+    }
+
+    static assertWritable() {
+        if (capture.getStore()) throw new Error('State cannot be modified during render().');
+    }
+
+    static jsx() {
+        const current = capture.getStore();
+        if (current) current.node.jsx = true;
+        return Boolean(current);
+    }
+
+    static key(html, value) {
+        if (!capture.getStore() || value === undefined || value === null) return html;
+        if (!['string', 'number'].includes(typeof value)) throw new TypeError('JSX keys must be strings or numbers.');
+        const key = String(value);
+        if (key.length > 256) throw new TypeError('JSX keys must be at most 256 characters.');
+        return boundary(`k${Buffer.from(key).toString('hex')}`, html);
+    }
+
+    static component(owner, component, render) {
+        const current = capture.getStore();
+        if (!current) return render();
+        const id = ownerId(component);
+        current.node.children.add(id);
+        const cached = current.stage.get(id);
+        if (cached) return boundary(id, cached.html);
+        const node = current.renderer.node(owner, id, render);
+        const html = capture.run({ ...current, node }, render);
+        current.renderer.finish(node, html, current.stage);
+        return boundary(id, html);
+    }
+
+    node(owner, id, render) {
+        return { owner, id, render, html: '', dependencies: new Map(), children: new Set(), jsx: false };
+    }
+
+    finish(node, html, stage) {
+        const retainedBytes = [...stage.values()].reduce((total, entry) => total + Buffer.byteLength(entry.html), 0);
+        if (retainedBytes + Buffer.byteLength(html) > MAX_HTML_BYTES) throw new Error('Reactive HTML exceeds the 1 MiB snapshot limit.');
+        if (stage.size >= MAX_OWNERS) throw new Error('Reactive render exceeds the 1024 owner limit.');
+        node.html = html;
+        stage.set(node.id, node);
+    }
+
+    async renderNode(previous, signal = this.controller.signal) {
+        const stage = new Map();
+        const node = this.node(previous.owner, previous.id, previous.render);
+        const work = Promise.resolve().then(() => this.withContext(() => capture.run({ renderer: this, node, stage }, node.render)));
+        let timer;
+        let abort;
+        const cancelled = new Promise((_, reject) => {
+            abort = () => reject(new Error('Reactive render was cancelled: page disconnected or server shutting down.'));
+            signal.addEventListener('abort', abort, { once: true });
+            if (signal.aborted) abort();
+            timer = setTimeout(() => reject(new Error('Reactive render exceeded its time limit.')), this.timeoutMs);
+        });
+        const html = await Promise.race([work, cancelled]).finally(() => {
+            clearTimeout(timer);
+            signal.removeEventListener('abort', abort);
+        });
+        this.finish(node, html, stage);
+        return stage;
+    }
+
+    async initialize(render, withContext) {
+        this.withContext = withContext;
+        const stage = await this.renderNode(this.node(this.page, ROOT, render));
+        if (this.disposed) throw new Error('Reactive render was cancelled.');
+        this.nodes = stage;
+        this.enabled = [...stage.values()].some(node => node.jsx);
+        const html = stage.get(ROOT).html;
+        return this.enabled ? html : html.replace(/<!--\/?rw:c[0-9a-f]+-->/g, '');
+    }
+
+    descendants(id, target = new Set()) {
+        target.add(id);
+        for (const child of this.nodes.get(id).children) this.descendants(child, target);
+        return target;
+    }
+
+    commit(id, stage) {
+        const replaced = this.descendants(id);
+        if (this.nodes.size - replaced.size + stage.size > MAX_OWNERS) throw new Error('Reactive render exceeds the 1024 owner limit.');
+        const next = new Map([...this.nodes].filter(([key]) => !replaced.has(key)));
+        for (const [key, value] of stage) next.set(key, value);
+        if (id !== ROOT) {
+            const html = stage.get(id).html;
+            for (const [key, node] of next) if (!stage.has(key)) next.set(key, { ...node, html: replaceBoundary(node.html, id, html) });
+        }
+        const retainedBytes = [...next.values()].reduce((total, entry) => total + Buffer.byteLength(entry.html), 0);
+        if (retainedBytes > MAX_HTML_BYTES) throw new Error('Reactive HTML exceeds the 1 MiB snapshot limit.');
+        this.nodes = next;
+    }
+
+    invalidate(owner, name, payload) {
+        if (this.disposed) return;
+        for (const [id, node] of this.nodes) if (node.dependencies.get(owner)?.has(name)) this.dirty.add(id);
+        this.states.set(`${ownerId(payload.component)}:${name}`, payload);
+        this.schedule();
+    }
+
+    schedule() {
+        if (!this.socket || this.pending || this.running || this.disposed) return;
+        this.pending = setImmediate(() => {
+            this.pending = null;
+            this.flush().catch(error => {
+                // A failing application logger must not turn a contained render error into an unhandled rejection.
+                Promise.resolve().then(() => this.onError(error)).catch(() => {});
+                this.socket?.close(1011, 'Page render failed');
+            });
+        });
+    }
+
+    async attach(socket, states) {
+        this.socket = socket;
+        this.connection = new AbortController();
+        this.generation += 1;
+        for (const payload of states) this.states.set(`${ownerId(payload.component)}:${payload.name}`, payload);
+        this.dirty.add(ROOT);
+        this.snapshot = true;
+        return this.flush();
+    }
+
+    detach() {
+        this.socket = null;
+        this.connection.abort();
+        this.generation += 1;
+        clearImmediate(this.pending);
+        this.pending = null;
+        this.dirty.clear();
+        this.states.clear();
+    }
+
+    flush() {
+        if (this.running) return this.running;
+        this.running = this.performFlush().finally(() => {
+            this.running = null;
+            if (this.dirty.size || this.states.size) this.schedule();
+        });
+        return this.running;
+    }
+
+    async performFlush() {
+        const socket = this.socket;
+        const generation = this.generation;
+        const dirty = [...this.dirty];
+        const states = [...this.states.values()];
+        const snapshot = this.snapshot;
+        this.snapshot = false;
+        this.dirty.clear();
+        this.states.clear();
+        const covered = new Set();
+        const patches = [];
+        // Parents must be committed before descendants, regardless of the order their state changed.
+        dirty.sort((a, b) => a === ROOT ? -1 : b === ROOT ? 1 : a.length - b.length);
+        for (const id of dirty) {
+            if (covered.has(id) || !this.nodes.has(id)) continue;
+            for (const child of this.descendants(id)) covered.add(child);
+            const previous = this.nodes.get(id);
+            let stage;
+            try { stage = await this.renderNode(previous, this.connection.signal); }
+            catch (error) {
+                if (this.disposed || generation !== this.generation) return;
+                throw error;
+            }
+            if (this.disposed || generation !== this.generation) return;
+            const html = stage.get(id).html;
+            this.commit(id, stage);
+            if (snapshot || html !== previous.html) patches.push({ id, html: id === ROOT ? this.document(html) : html });
+        }
+        const explicit = states.filter(payload => {
+            const node = this.nodes.get(ownerId(payload.component));
+            return node && [...node.html.matchAll(/\b(?:data-rw-state|rw-bind)\s*=\s*["']([^"']+)["']/g)].some(match => match[1] === payload.name);
+        });
+        if (!this.disposed && generation === this.generation && socket && (patches.length || explicit.length)) {
+            socket.sendEvent('redweb:patch', { patches, states: explicit });
+        }
+    }
+
+    dispose() {
+        this.disposed = true;
+        this.detach();
+        this.controller.abort();
+        this.parentSignal.removeEventListener('abort', this.abort);
+        this.nodes.clear();
+        this.withContext = null;
+        this.page = null;
+    }
+}
+
+module.exports = ReactiveRenderer;

package/src/htmx/StaticExporter.js

@@ -36,6 +36,7 @@ async function exportStatic(pageOrPages, options = {}) {
         const metadata = getPageMetadata(PageClass);
         if (!metadata) throw new TypeError(`${PageClass.name || 'Page'} is missing @page metadata.`);
         if (metadata.live !== false) throw new Error(`Static export requires live: false on ${PageClass.name}.`);
+        if (metadata.policy) throw new Error(`Authorized pages cannot be exported: ${PageClass.name}.`);
         const file = pageFile(root, metadata.path);
         const key = path.relative(root, file).replaceAll('\\', '/').toLowerCase();
         if (pageFiles.has(key)) throw new Error(`Static page paths resolve to the same output file: ${file}`);
@@ -60,7 +61,6 @@ async function exportStatic(pageOrPages, options = {}) {
                 params: Object.freeze({}),
                 query: Object.freeze({}),
                 body: undefined,
-                get: () => undefined,
             });
             renderedPages.push({ file, content: await manager.render(record, request) });
         }

package/src/htmx/TemplateRenderer.js

@@ -13,7 +13,7 @@ const BINDING = /{{\s*([A-Za-z_$][\w$]*)\s*}}/g;
 const ATTRIBUTE_BINDING = /{{\s*[A-Za-z_$][\w$]*\s*}}/;
 const NAME = /^[A-Za-z_$][\w$]*$/;
 const DIRECTIVES = new Set(['data-rw-state', 'data-rw-html', 'rw-each']);
-const COMPONENT_DIRECTIVES = new Set(['data-rw-component', 'data-rw-state', 'rw-bind', 'rw-click', 'rw-submit']);
+const COMPONENT_DIRECTIVES = new Set(['data-rw-component', 'data-rw-state', 'rw-bind', 'rw-click', 'rw-submit', 'rw-status']);
 
 function attributes(tag, nameEnd, tracked = DIRECTIVES) {
     const found = new Map();
@@ -181,7 +181,8 @@ class TemplateRenderer {
 
 TemplateRenderer.closingTag = closingTag;
 TemplateRenderer.openingTag = openingTag;
-TemplateRenderer.component = (source, id) => {
+// Shared lexical traversal: component scoping and read-only diagnostics see the same tags.
+TemplateRenderer.mapTags = (source, transform) => {
     let output = '';
     let position = 0;
     while (position < source.length) {
@@ -211,11 +212,7 @@ TemplateRenderer.component = (source, id) => {
         const end = tagEnd(source, start + opening[0].length);
         if (end < 0) return output + source.slice(start);
         const tag = source.slice(start, end + 1);
-        const found = attributes(tag, opening[0].length, COMPONENT_DIRECTIVES);
-        const scoped = [...COMPONENT_DIRECTIVES].some(name => name !== 'data-rw-component' && found.has(name));
-        output += scoped && !found.has('data-rw-component')
-            ? tag.replace(/\/?>(?=$)/, ` data-rw-component="${escapeHtml(id)}"$&`)
-            : tag;
+        output += transform(tag, opening[0].length, start);
         position = end + 1;
         const name = opening[1].toLowerCase();
         if (RAW_TEXT.has(name)) {
@@ -228,4 +225,13 @@ TemplateRenderer.component = (source, id) => {
     return output;
 };
 
+TemplateRenderer.attributes = attributes;
+TemplateRenderer.component = (source, id) => TemplateRenderer.mapTags(source, (tag, nameEnd) => {
+    const found = attributes(tag, nameEnd, COMPONENT_DIRECTIVES);
+    const scoped = [...COMPONENT_DIRECTIVES].some(name => name !== 'data-rw-component' && found.has(name));
+    return scoped && !found.has('data-rw-component')
+        ? tag.replace(/\/?>(?=$)/, ` data-rw-component="${escapeHtml(id)}"$&`)
+        : tag;
+});
+
 module.exports = TemplateRenderer;

package/src/htmx/browserRuntime.js

@@ -1,97 +1,6 @@
+/** The client owns rendering and transport; the server supplies page JSON. */
 function browserRuntime(clientPath) {
-    return `import { RedwebClient } from ${JSON.stringify(clientPath)};
-
-const configNode = document.getElementById('__redweb_page');
-const config = JSON.parse(configNode.textContent);
-const client = new RedwebClient(config.socketPath + '?pageId=' + encodeURIComponent(config.pageId), {
-    baseUrl: window.location.href,
-    version: config.version,
-    reconnect: { enabled: true, maxAttempts: 8 },
-    maxQueueSize: 32
-});
-
-const emit = (type, detail) => document.dispatchEvent(new CustomEvent(type, { detail }));
-let stateTargets = new Map();
-const componentOf = node => node.closest('[data-rw-component]')?.getAttribute('data-rw-component') || null;
-const stateKey = (component, name) => (component || '') + '\\0' + name;
-const indexState = () => {
-    stateTargets = new Map();
-    document.querySelectorAll('[data-rw-state]').forEach(node => {
-        const name = node.getAttribute('data-rw-state');
-        const key = stateKey(componentOf(node), name);
-        const targets = stateTargets.get(key) || [];
-        targets.push(node);
-        stateTargets.set(key, targets);
-    });
-};
-const named = (attribute, name, component) => attribute === 'data-rw-state'
-    ? (stateTargets.get(stateKey(component, name)) || [])
-    : [...document.querySelectorAll('[' + attribute + ']')].filter(node =>
-        node.getAttribute(attribute) === name && componentOf(node) === component);
-indexState();
-
-client.on('redweb:state', message => {
-    const update = message.payload;
-    const component = update.component || null;
-    named('data-rw-state', update.name, component).forEach(node => {
-        if (update.html) {
-            node.innerHTML = update.value;
-            indexState();
-        }
-        else node.textContent = update.value;
-    });
-    named('rw-bind', update.name, component).forEach(node => {
-        if (node.type === 'checkbox') node.checked = update.value === true || update.value === 'true';
-        else if (node.value !== update.value) node.value = update.value;
-    });
-});
-
-const report = error => emit('redweb:error', error);
-const send = payload => {
-    try { client.send('redweb:html', payload); }
-    catch (error) { report(error); }
-};
-const formValues = form => {
-    const values = {};
-    for (const [name, value] of new FormData(form)) {
-        if (!(name in values)) values[name] = value;
-        else values[name] = Array.isArray(values[name]) ? [...values[name], value] : [values[name], value];
-    }
-    return values;
-};
-
-document.addEventListener('click', event => {
-    const target = event.target.closest('[rw-click]');
-    if (!target) return;
-    event.preventDefault();
-    client.request('redweb:html', {
-        kind: 'action', name: target.getAttribute('rw-click'), component: componentOf(target), args: []
-    }).catch(report);
-});
-
-document.addEventListener('submit', event => {
-    const form = event.target.closest('form[rw-submit]');
-    if (!form) return;
-    event.preventDefault();
-    client.request('redweb:html', {
-        kind: 'action', name: form.getAttribute('rw-submit'), component: componentOf(form), args: [formValues(form)]
-    }).then(() => form.reset()).catch(report);
-});
-
-document.addEventListener('input', event => {
-    const target = event.target.closest('[rw-bind]');
-    if (target) send({
-        kind: 'state',
-        name: target.getAttribute('rw-bind'),
-        component: componentOf(target),
-        value: target.type === 'checkbox' ? target.checked : target.value
-    });
-});
-
-client.onError(report);
-client.onStateChange(state => emit('redweb:connection', state));
-client.connect().catch(report);
-`;
+    return `import { mountLivePage } from ${JSON.stringify(clientPath)};\nmountLivePage();\n`;
 }
 
 module.exports = browserRuntime;

package/src/htmx/metadata.js

@@ -12,6 +12,9 @@ const PAGE_STYLESHEET_ROOTS = new WeakMap();
 const COMPONENT_CLASSES = new WeakSet();
 const { decoratorDirectory } = require('./sourceRoot');
 const synchronous = require('./synchronous');
+const { ActionDefinition } = require('./ActionDefinition');
+const { AccessPolicy } = require('../access/AccessPolicy');
+const dataProperty = require('../dataProperty');
 let metadataVersion = 0;
 
 function assertDecoratorTarget(target, label) {
@@ -40,7 +43,6 @@ function registerState(PageClass, property, config) {
 
 function registerAction(PageClass, method, implementation) {
     const methods = new Map(ACTION_METADATA.get(PageClass) || []);
-    if (methods.get(method) === implementation) return;
     methods.set(method, implementation);
     ACTION_METADATA.set(PageClass, methods);
     metadataVersion += 1;
@@ -80,8 +82,8 @@ function resolvedAction(PageClass) {
     const value = new Map();
     hierarchy(PageClass).forEach(CurrentClass => {
         const own = new Map(ACTION_METADATA.get(CurrentClass) || []);
-        STANDARD_ACTIONS.get(CurrentClass)?.forEach((implementation, method) => {
-            if (CurrentClass.prototype[method] === implementation) own.set(method, implementation);
+        STANDARD_ACTIONS.get(CurrentClass)?.forEach((entry, method) => {
+            if (dataProperty(CurrentClass.prototype, method) === entry.implementation) own.set(method, entry);
         });
         value.forEach((_implementation, method) => {
             if (Object.prototype.hasOwnProperty.call(CurrentClass.prototype, method) && !own.has(method)) value.delete(method);
@@ -180,6 +182,8 @@ function page(routePath, options = {}) {
     if (layout !== undefined && typeof layout !== 'function') throw new TypeError('Page layout must be a function.');
     const head = pageHead(options.head);
     const cache = pageCache(options.cache, live);
+    const policy = new AccessPolicy(options.authorize, options.authorizationTimeoutMs);
+    if (policy.authorize && scope === 'shared') throw new TypeError('Authorized pages require connection scope; shared state is not private.');
     return PageClass => {
         if (typeof PageClass !== 'function') throw new TypeError('page() must decorate a class.');
         PAGE_METADATA.set(PageClass, Object.freeze({
@@ -191,6 +195,7 @@ function page(routePath, options = {}) {
             ...(cache && { cache }),
             ...(stylesheets && { css: Object.freeze(stylesheets) }),
             ...(layout && { layout }),
+            ...(policy.authorize && { policy }),
         }));
         PAGE_ROOTS.set(PageClass, templateRoot);
         return PageClass;
@@ -241,14 +246,16 @@ function state(options = {}) {
     };
 }
 
-function action() {
+function action(options) {
+    const definition = new ActionDefinition(options);
     return (target, method, descriptor) => {
         if (method?.kind === 'method') {
             if (method.static || method.private || typeof method.name !== 'string' || !method.name || typeof target !== 'function') {
                 throw new TypeError('action() requires a public instance method with a string name.');
             }
+            const entry = Object.freeze({ implementation: target, definition });
             method.addInitializer(function registerStandardActionInitializer() {
-                if (this[method.name] === target) registerStandardAction(this.constructor, method.name, target);
+                if (this[method.name] === target) registerStandardAction(this.constructor, method.name, entry);
             });
             return target;
         }
@@ -256,7 +263,7 @@ function action() {
         if (typeof method !== 'string' || !method || typeof descriptor?.value !== 'function') {
             throw new TypeError('action() must decorate a method.');
         }
-        registerAction(PageClass, method, descriptor.value);
+        registerAction(PageClass, method, Object.freeze({ implementation: descriptor.value, definition }));
         return descriptor;
     };
 }
@@ -315,7 +322,11 @@ function forEachState(PageClass, callback) {
 }
 
 function getActionImplementation(PageClass, method) {
-    return resolvedAction(PageClass).get(method);
+    return resolvedAction(PageClass).get(method)?.implementation;
+}
+
+function getActionDefinition(PageClass, method) {
+    return resolvedAction(PageClass).get(method).definition;
 }
 
 function getViewImplementation(PageClass, stateName) {
@@ -331,6 +342,7 @@ module.exports = {
     component,
     forEachState,
     getActionImplementation,
+    getActionDefinition,
     getActionMetadata,
     getPageMetadata,
     getPageStylesheetRoots,

package/src/validation/ActionInputError.js

@@ -0,0 +1,12 @@
+'use strict';
+const codes = require('../access/failure-codes.json');
+
+class ActionInputError extends Error {
+    constructor(code = 'ACTION_INVALID_INPUT') {
+        const safeCode = typeof code === 'string' && code.startsWith('ACTION_') && Object.hasOwn(codes, code) ? code : 'ACTION_INVALID_INPUT';
+        super(codes[safeCode].message);
+        this.code = safeCode;
+    }
+}
+
+module.exports = ActionInputError;

package/src/validation/SchemaValidator.js

@@ -0,0 +1,38 @@
+'use strict';
+const { BoundedOperation, OperationInterrupted } = require('../async/BoundedOperation');
+
+class ValidationFailure extends Error {
+    constructor(reason) {
+        super('Schema validation did not complete successfully.');
+        this.reason = reason;
+    }
+}
+
+/** One bounded Standard Schema path for socket contracts and browser actions. */
+class SchemaValidator {
+    constructor(schema, timeoutMs = 5000) {
+        const standard = schema?.['~standard'];
+        if (standard?.version !== 1 || typeof standard.validate !== 'function') throw new TypeError('A Standard Schema v1 validator is required.');
+        this.validateValue = standard.validate.bind(standard);
+        this.boundary = new BoundedOperation(timeoutMs);
+        Object.freeze(this);
+    }
+
+    async parse(input, signal) {
+        try {
+            return await this.boundary.run(async () => {
+                const result = await this.validateValue(input);
+                if (!result || typeof result !== 'object' || Array.isArray(result)) throw new ValidationFailure('validator');
+                if (result.issues !== undefined) throw new ValidationFailure(Array.isArray(result.issues) ? 'input' : 'validator');
+                if (!Object.hasOwn(result, 'value')) throw new ValidationFailure('validator');
+                return await result.value;
+            }, signal);
+        } catch (error) {
+            if (error instanceof ValidationFailure) throw error;
+            if (error instanceof OperationInterrupted) throw new ValidationFailure(error.reason);
+            throw new ValidationFailure('validator');
+        }
+    }
+}
+
+module.exports = { SchemaValidator, ValidationFailure };

package/src/ws/AdmissionPolicy.js

@@ -1,6 +1,8 @@
 const ADMISSION_CONTEXT = Symbol('redweb.admissionContext');
 const PLACEMENT_REDIRECT = Symbol('redweb.placementRedirect');
 const ADMISSION_SETTLEMENT = Symbol('redweb.admissionSettlement');
+const { BoundedOperation, OperationInterrupted } = require('../async/BoundedOperation');
+const { RequestFailure, UPGRADE_REJECTION } = require('../access/RequestFailure');
 
 class AdmissionPolicy {
     constructor(options) {
@@ -48,41 +50,37 @@ class AdmissionPolicy {
         this.origins = origins;
         this.place = place;
         this.timeoutMs = timeoutMs;
+        this.boundary = new BoundedOperation(timeoutMs);
         this.allowInsecurePlacement = allowInsecurePlacement;
     }
 
     async authorize(request, rawSocket, route, externalSignal) {
         const controller = new AbortController();
         const onClose = () => controller.abort();
-        const onExternalAbort = () => controller.abort();
         rawSocket.once('close', onClose);
-        if (externalSignal?.aborted) controller.abort();
-        else externalSignal?.addEventListener('abort', onExternalAbort, { once: true });
-        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
-        timer.unref();
+        if (rawSocket.destroyed || externalSignal?.aborted) controller.abort();
+        else externalSignal?.addEventListener('abort', onClose, { once: true });
         try {
-            const evaluation = Promise.resolve().then(() => this.evaluate(request, route, controller.signal));
-            request[ADMISSION_SETTLEMENT] = evaluation.then(() => undefined, () => undefined);
-            const cancelled = new Promise((_, reject) => {
-                controller.signal.addEventListener('abort', () => reject(new Error('Admission cancelled.')), { once: true });
-            });
-            const result = await Promise.race([
-                evaluation,
-                cancelled,
-            ]);
-            if (result === false || rawSocket.destroyed || controller.signal.aborted) return false;
+            const result = await this.boundary.run((signal, checkpoint) => {
+                const evaluation = this.evaluate(request, route, signal, checkpoint);
+                request[ADMISSION_SETTLEMENT] = evaluation.then(() => undefined, () => undefined);
+                return evaluation;
+            }, controller.signal);
+            if (rawSocket.destroyed || controller.signal.aborted) throw new RequestFailure('ADMISSION_CANCELLED');
             if (result.redirect) {
                 request[PLACEMENT_REDIRECT] = result.redirect;
                 return false;
             }
             request[ADMISSION_CONTEXT] = { principal: result.principal };
             return true;
-        } catch {
+        } catch (error) {
+            request[UPGRADE_REJECTION] = (error instanceof OperationInterrupted
+                ? new RequestFailure(error.reason === 'timeout' ? 'ADMISSION_TIMEOUT' : 'ADMISSION_CANCELLED')
+                : RequestFailure.from(error)).rejection;
             return false;
         } finally {
-            clearTimeout(timer);
             rawSocket.off?.('close', onClose);
-            externalSignal?.removeEventListener?.('abort', onExternalAbort);
+            externalSignal?.removeEventListener?.('abort', onClose);
         }
     }
 
@@ -114,20 +112,23 @@ class AdmissionPolicy {
         }
     }
 
-    async evaluate(request, route, signal) {
-        if (!await this.acceptsOrigin(request)) return false;
+    async evaluate(request, route, signal, checkpoint) {
+        if (!await this.acceptsOrigin(request)) throw new RequestFailure('ORIGIN_DENIED');
+        checkpoint();
         const context = {
             signal,
             networkIdentity: route.resolveRemoteAddress(request),
             route,
         };
         const principal = this.authenticate ? await this.authenticate(request, context) : undefined;
-        if (principal === false) return false;
+        if (principal === false) throw new RequestFailure('AUTHENTICATION_REQUIRED');
+        checkpoint();
         if (!this.place) return { principal };
         const placement = await this.place(principal, request, context);
-        if (placement === false) return false;
+        if (placement === false) throw new RequestFailure('PLACEMENT_DENIED');
         if (typeof placement === 'string') {
-            return this.isSafeRedirect(placement) ? { redirect: placement } : false;
+            if (!this.isSafeRedirect(placement)) throw new RequestFailure('PLACEMENT_INVALID');
+            return { redirect: placement };
         }
         return { principal };
     }