velocious 1.0.661 → 1.0.663

package/build/background-jobs/store.js

@@ -1255,7 +1255,8 @@ export default class BackgroundJobsStore extends BackgroundJobsAdapter {
           status: "handed_off",
           handed_off_at_ms: handedOffAtMs,
           handoff_id: handoffId,
-          worker_id: workerId || null
+          worker_id: workerId || null,
+          ...this._clearedChildAcceptanceData()
         },
         conditions: {concurrency_key: queuedJob.concurrencyKey, id: jobId, status: "queued"}
       })
@@ -1269,6 +1270,7 @@ export default class BackgroundJobsStore extends BackgroundJobsAdapter {
       /** @type {import("./types.js").BackgroundJobRow} */
       const handedOffJob = {
         ...queuedJob,
+        ...this._clearedChildAcceptanceRow(),
         handedOffAtMs,
         handoffId,
         status: "handed_off",
@@ -1315,6 +1317,67 @@ export default class BackgroundJobsStore extends BackgroundJobsAdapter {
     })
   }
 
+  /**
+   * Records pooled-child acceptance evidence for an active handoff: when the
+   * executing runner child received and/or started the job, plus that child's
+   * stable identity and pid. Only the fields supplied are written, so a
+   * received-then-started observation lands as two fenced partial updates. The
+   * update is fenced by the exact active handoff lease, so a report for a
+   * reclaimed or re-handed-off job is dropped instead of stamping the wrong
+   * attempt.
+   * @param {object} args - Options.
+   * @param {string} args.jobId - Job id.
+   * @param {string} [args.handoffId] - Handoff lease id.
+   * @param {string} [args.workerId] - Worker id.
+   * @param {number} [args.handedOffAtMs] - Handed off timestamp.
+   * @param {number} [args.receivedAtMs] - Epoch ms the runner child received the job.
+   * @param {number} [args.startedAtMs] - Epoch ms the job's perform started in the child.
+   * @param {string} [args.childInstanceId] - Stable pooled child identity.
+   * @param {number} [args.childPid] - Pooled child OS pid.
+   * @returns {Promise<boolean>} - Whether the fenced report was accepted.
+   */
+  async markChildAccepted({jobId, handoffId, workerId, handedOffAtMs, receivedAtMs, startedAtMs, childInstanceId, childPid}) {
+    await this.ensureReady()
+
+    return await this._serializedConnectionMutation(async (db) => {
+      const job = await this._getJobRowById(db, jobId)
+
+      if (!job) return false
+      if (!this._shouldAcceptReport({job, handoffId, workerId, handedOffAtMs})) return false
+
+      const data = {}
+      if (typeof receivedAtMs === "number") data.child_received_at_ms = receivedAtMs
+      if (typeof startedAtMs === "number") data.child_started_at_ms = startedAtMs
+      if (typeof childInstanceId === "string") data.child_instance_id = childInstanceId
+      if (typeof childPid === "number") data.child_pid = childPid
+      if (Object.keys(data).length === 0) return false
+
+      const affectedRows = await this._updateAffectedRows(db, {
+        tableName: JOBS_TABLE,
+        data,
+        conditions: this._activeHandoffConditions(job)
+      })
+
+      return affectedRows === 1
+    })
+  }
+
+  /**
+   * Returns the database data that clears pooled-child acceptance evidence.
+   * @returns {Record<string, ReturnType<typeof JSON.parse>>} - Cleared acceptance columns.
+   */
+  _clearedChildAcceptanceData() {
+    return {child_instance_id: null, child_pid: null, child_received_at_ms: null, child_started_at_ms: null}
+  }
+
+  /**
+   * Returns the row-shape counterpart of the cleared acceptance columns.
+   * @returns {Pick<import("./types.js").BackgroundJobRow, "childInstanceId" | "childPid" | "childReceivedAtMs" | "childStartedAtMs">} - Cleared acceptance fields.
+   */
+  _clearedChildAcceptanceRow() {
+    return {childInstanceId: null, childPid: null, childReceivedAtMs: null, childStartedAtMs: null}
+  }
+
   /**
    * Returns an active handoff to the queue at a caller-requested future time.
    * This is normal job control flow: it preserves failure attempts and metadata.
@@ -1345,7 +1408,8 @@ export default class BackgroundJobsStore extends BackgroundJobsAdapter {
           scheduled_at_ms: scheduledAtMs,
           handed_off_at_ms: null,
           handoff_id: null,
-          worker_id: null
+          worker_id: null,
+          ...this._clearedChildAcceptanceData()
         },
         conditions: this._activeHandoffConditions(job)
       })
@@ -1378,7 +1442,8 @@ export default class BackgroundJobsStore extends BackgroundJobsAdapter {
           scheduled_at_ms: this.clock.now(),
           handed_off_at_ms: null,
           handoff_id: null,
-          worker_id: null
+          worker_id: null,
+          ...this._clearedChildAcceptanceData()
         },
         conditions: {handoff_id: handoffId, id: jobId, status: "handed_off"}
       })
@@ -2063,6 +2128,10 @@ export default class BackgroundJobsStore extends BackgroundJobsAdapter {
     table.string("concurrency_key", {null: true, index: true})
     table.integer("max_concurrency", {null: true})
     table.bigint("timeout_ms", {null: true})
+    table.bigint("child_received_at_ms", {null: true})
+    table.bigint("child_started_at_ms", {null: true})
+    table.string("child_instance_id", {null: true})
+    table.integer("child_pid", {null: true})
 
     await db.createTable(table)
   }
@@ -2156,9 +2225,56 @@ export default class BackgroundJobsStore extends BackgroundJobsAdapter {
     await this._ensureQueueColumn(db)
     await this._ensureScheduleKeyColumn(db)
     await this._ensureJobTimeoutColumn(db)
+    await this._ensureChildAcceptanceColumns(db)
     await this._ensureJobsTableIndexesOnce(db)
   }
 
+  /**
+   * Idempotently adds the pooled-child acceptance evidence columns to existing
+   * job tables. They record when the executing runner child received and
+   * started a job plus that child's identity, so a handed-off job can be told
+   * apart from one whose runner never picked it up.
+   * @param {import("../database/drivers/base.js").default} db - Database connection.
+   * @returns {Promise<void>} - Resolves when ensured.
+   */
+  async _ensureChildAcceptanceColumns(db) {
+    const lockName = `${MIGRATION_SCOPE}:child_acceptance_columns`
+    const acquired = await db.acquireAdvisoryLock(lockName)
+
+    if (!acquired) throw new Error("Failed to acquire background jobs child-acceptance schema lock")
+
+    try {
+      db.clearSchemaCache()
+      const table = await db.getTableByNameOrFail(JOBS_TABLE)
+      const tableData = new TableData(JOBS_TABLE)
+      let added = false
+
+      if (!(await table.getColumnByName("child_received_at_ms"))) {
+        tableData.bigint("child_received_at_ms", {null: true})
+        added = true
+      }
+      if (!(await table.getColumnByName("child_started_at_ms"))) {
+        tableData.bigint("child_started_at_ms", {null: true})
+        added = true
+      }
+      if (!(await table.getColumnByName("child_instance_id"))) {
+        tableData.string("child_instance_id", {null: true})
+        added = true
+      }
+      if (!(await table.getColumnByName("child_pid"))) {
+        tableData.integer("child_pid", {null: true})
+        added = true
+      }
+
+      if (added) {
+        for (const sql of await db.alterTableSQLs(tableData)) await db.query(sql)
+        db.clearSchemaCache()
+      }
+    } finally {
+      await db.releaseAdvisoryLock(lockName)
+    }
+  }
+
   /**
    * Repairs secondary indexes that older add-column upgrades declared but did
    * not create on every SQL driver. The migration ledger keeps routine store
@@ -2514,6 +2630,7 @@ export default class BackgroundJobsStore extends BackgroundJobsAdapter {
     /** @type {import("./types.js").BackgroundJobRow} */
     const transitionedJob = {
       ...job,
+      ...(shouldRetry ? this._clearedChildAcceptanceRow() : {}),
       attempts: nextAttempt,
       handedOffAtMs: null,
       lastError: failureMessage,
@@ -2553,6 +2670,11 @@ export default class BackgroundJobsStore extends BackgroundJobsAdapter {
       last_error: failureMessage
     }
 
+    // A retry starts a fresh handoff with a possibly different runner, so the
+    // previous child's acceptance evidence must not leak into the next attempt.
+    // Terminal failures keep it as historical evidence for the lost attempt.
+    if (shouldRetry) Object.assign(update, this._clearedChildAcceptanceData())
+
     this._applyOrphanedFailureUpdate({markOrphaned, now, update})
     this._applyFailureStatusUpdate({markOrphaned, now, scheduledAt, shouldRetry, update})
 
@@ -2630,7 +2752,11 @@ export default class BackgroundJobsStore extends BackgroundJobsAdapter {
       lastError: row.last_error ? String(row.last_error) : null,
       concurrencyKey: row.concurrency_key ? String(row.concurrency_key) : null,
       maxConcurrency: this._normalizeNumber(row.max_concurrency),
-      timeoutMs: this._normalizeNumber(row.timeout_ms)
+      timeoutMs: this._normalizeNumber(row.timeout_ms),
+      childReceivedAtMs: this._normalizeNumber(row.child_received_at_ms),
+      childStartedAtMs: this._normalizeNumber(row.child_started_at_ms),
+      childInstanceId: row.child_instance_id ? String(row.child_instance_id) : null,
+      childPid: this._normalizeNumber(row.child_pid)
     }
   }
 

package/build/background-jobs/types.js

@@ -169,6 +169,10 @@
  * @property {string | null} concurrencyKey - Durable concurrency key.
  * @property {number | null} maxConcurrency - Durable per-key cap.
  * @property {number | null} timeoutMs - Per-job wall-clock timeout override, or null when omitted.
+ * @property {number | null} childReceivedAtMs - Epoch ms when the executing pooled child's event loop processed the job message, or null when no runner accepted it yet.
+ * @property {number | null} childStartedAtMs - Epoch ms when the job's perform started in the pooled child, or null when it never started.
+ * @property {string | null} childInstanceId - Stable identity of the pooled child process that accepted the job, or null.
+ * @property {number | null} childPid - OS pid of the pooled child process that accepted the job, or null.
  */
 /**
  * @typedef {"queued" | "handed_off" | null} BackgroundJobReplacementPreviousStatus
@@ -219,6 +223,7 @@
  * @typedef {{type: "schedule-cancelled", jobId: string | null, outcome: BackgroundJobCancellationOutcome}} BackgroundJobScheduleCancelledMessage
  * @typedef {{type: "cancel-scheduled-error", error?: string}} BackgroundJobCancelScheduledErrorMessage
  * @typedef {{type: "job", payload: BackgroundJobPayload}} BackgroundJobJobMessage
+ * @typedef {{type: "job-accepted", jobId: string, handoffId?: string, workerId?: string, handedOffAtMs?: number, receivedAtMs?: number, startedAtMs?: number, childInstanceId?: string, childPid?: number}} BackgroundJobAcceptedMessage
  * @typedef {{type: "job-complete", jobId: string, handoffId?: string, workerId?: string, handedOffAtMs?: number}} BackgroundJobCompleteMessage
  * @typedef {{type: "job-failed", jobId: string, error?: ReturnType<typeof JSON.parse>, handoffId?: string, workerId?: string, handedOffAtMs?: number, runnerFailure?: PooledRunnerFailure}} BackgroundJobFailedMessage
  * @typedef {{type: "job-reschedule", jobId: string, delayMs: number, handoffId?: string, workerId?: string, handedOffAtMs?: number}} BackgroundJobRescheduleMessage
@@ -226,7 +231,7 @@
  * @typedef {{type: "job-update-error", jobId: string, error?: string}} BackgroundJobUpdateErrorMessage
  */
 /**
- * @typedef {BackgroundJobHelloMessage | BackgroundJobGenerationAcceptedMessage | BackgroundJobGenerationRejectedMessage | BackgroundJobReadyMessage | BackgroundJobDrainingMessage | BackgroundJobHeartbeatMessage | BackgroundJobEnqueueMessage | BackgroundJobEnqueuedMessage | BackgroundJobEnqueueErrorMessage | BackgroundJobReplaceScheduledMessage | BackgroundJobScheduleReplacedMessage | BackgroundJobReplaceScheduledErrorMessage | BackgroundJobCancelScheduledMessage | BackgroundJobScheduleCancelledMessage | BackgroundJobCancelScheduledErrorMessage | BackgroundJobJobMessage | BackgroundJobCompleteMessage | BackgroundJobFailedMessage | BackgroundJobRescheduleMessage | BackgroundJobUpdatedMessage | BackgroundJobUpdateErrorMessage} BackgroundJobSocketMessage
+ * @typedef {BackgroundJobHelloMessage | BackgroundJobGenerationAcceptedMessage | BackgroundJobGenerationRejectedMessage | BackgroundJobReadyMessage | BackgroundJobDrainingMessage | BackgroundJobHeartbeatMessage | BackgroundJobEnqueueMessage | BackgroundJobEnqueuedMessage | BackgroundJobEnqueueErrorMessage | BackgroundJobReplaceScheduledMessage | BackgroundJobScheduleReplacedMessage | BackgroundJobReplaceScheduledErrorMessage | BackgroundJobCancelScheduledMessage | BackgroundJobScheduleCancelledMessage | BackgroundJobCancelScheduledErrorMessage | BackgroundJobJobMessage | BackgroundJobAcceptedMessage | BackgroundJobCompleteMessage | BackgroundJobFailedMessage | BackgroundJobRescheduleMessage | BackgroundJobUpdatedMessage | BackgroundJobUpdateErrorMessage} BackgroundJobSocketMessage
  */
 
 export const nothing = {}

package/build/background-jobs/web/controller.js

@@ -192,6 +192,10 @@ export default class VelociousBackgroundJobsWebController extends Controller {
       args: redactArgs ? undefined : job.args,
       argsRedacted: redactArgs,
       attempts: job.attempts,
+      childInstanceId: job.childInstanceId,
+      childPid: job.childPid,
+      childReceivedAtMs: job.childReceivedAtMs,
+      childStartedAtMs: job.childStartedAtMs,
       completedAtMs: job.completedAtMs,
       createdAtMs: job.createdAtMs,
       executionMode: job.executionMode,

package/build/background-jobs/worker.js

@@ -56,6 +56,12 @@ const FORKED_RUNNER_ENTRY_PATH = fileURLToPath(new URL("./forked-runner-child.js
 const POOLED_RUNNER_ENTRY_PATH = fileURLToPath(new URL("./pooled-runner-child.js", import.meta.url))
 /** How often the worker sends a liveness heartbeat to the main. */
 const HEARTBEAT_INTERVAL_MS = 15000
+/**
+ * Max time the worker spends retrying one pooled child's acceptance report
+ * before dropping it. Acceptance evidence is diagnostic — a persistent
+ * main/DB outage must not hold runner capacity hostage.
+ */
+const CHILD_ACCEPTANCE_REPORT_MAX_DURATION_MS = 10000
 /** TCP keepalive so a half-open connection to the main surfaces as a close. */
 const SOCKET_KEEPALIVE_MS = 10000
 /**
@@ -72,6 +78,28 @@ function positiveInteger(value) {
   return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : undefined
 }
 
+/**
+ * Checks whether an IPC value is a pooled child's acceptance observation for
+ * one job. The child carries its exact handoff lease so the worker can forward
+ * the report without depending on its in-flight entry still existing.
+ * @param {ReturnType<typeof JSON.parse>} message - IPC message.
+ * @returns {message is {type: "job-received" | "job-started", jobId: string, handoffId?: string, workerId?: string, handedOffAtMs?: number, receivedAtMs?: number, startedAtMs?: number, childInstanceId?: string, childPid?: number}} - Whether this is a valid acceptance message.
+ */
+function isChildAcceptanceMessage(message) {
+  if (!message || typeof message !== "object") return false
+  const record = /** @type {Record<string, ReturnType<typeof JSON.parse>>} */ (message)
+
+  return (record.type === "job-received" || record.type === "job-started")
+    && typeof record.jobId === "string"
+    && (record.handoffId === undefined || typeof record.handoffId === "string")
+    && (record.workerId === undefined || typeof record.workerId === "string")
+    && (record.handedOffAtMs === undefined || typeof record.handedOffAtMs === "number")
+    && (record.receivedAtMs === undefined || typeof record.receivedAtMs === "number")
+    && (record.startedAtMs === undefined || typeof record.startedAtMs === "number")
+    && (record.childInstanceId === undefined || typeof record.childInstanceId === "string")
+    && (record.childPid === undefined || Number.isInteger(record.childPid))
+}
+
 /**
  * Normalizes a candidate pooled-runner resource limit.
  * @param {number | undefined} value - Candidate positive number.
@@ -1225,6 +1253,10 @@ export default class BackgroundJobsWorker {
       if (state) state.started = true
       return
     }
+    if (isChildAcceptanceMessage(message)) {
+      this._reportChildAccepted(message)
+      return
+    }
     if (record.type !== "job-outcome" || !state || state.settling || typeof record.jobId !== "string") return
     state.started = true
     const entry = state.inflight.get(record.jobId)
@@ -1258,6 +1290,33 @@ export default class BackgroundJobsWorker {
     this._terminateIfDrained(child)
   }
 
+  /**
+   * Forwards one pooled child's acceptance observation to main as a bounded
+   * diagnostic report. The child carries its exact handoff lease, so a timeout
+   * or outcome that already settled the worker's in-flight entry cannot lose
+   * the fencing. A report that never lands degrades phase diagnostics for that
+   * job only — it must never block or fail the job itself.
+   * @param {{type: "job-received" | "job-started", jobId: string, handoffId?: string, workerId?: string, handedOffAtMs?: number, receivedAtMs?: number, startedAtMs?: number, childInstanceId?: string, childPid?: number}} message - Validated child acceptance message.
+   * @returns {void}
+   */
+  _reportChildAccepted(message) {
+    if (!this.statusReporter) return
+
+    void this.statusReporter.reportChildAcceptedWithRetry({
+      jobId: message.jobId,
+      handoffId: message.handoffId,
+      workerId: message.workerId,
+      handedOffAtMs: message.handedOffAtMs,
+      receivedAtMs: message.receivedAtMs,
+      startedAtMs: message.startedAtMs,
+      childInstanceId: message.childInstanceId,
+      childPid: message.childPid,
+      maxDurationMs: CHILD_ACCEPTANCE_REPORT_MAX_DURATION_MS
+    }).catch((error) => {
+      console.error("Background job child-acceptance reporting failed:", error)
+    })
+  }
+
   /**
    * Marks a pooled child for retirement and eagerly spawns a single replacement
    * (1-for-1) so its capacity is restored immediately without waiting for it to

package/build/configuration-types.js

@@ -293,6 +293,8 @@
  * @property {boolean | HttpCompressionConfiguration} [compression] - Buffered response compression. Enabled with documented defaults when absent; false or {enabled: false} disables it globally.
  * @property {string} [host] - Hostname to bind the HTTP server to.
  * @property {boolean} [inProcess] - Run HTTP handlers in the main thread instead of worker threads.
+ * @property {number} [maxBufferedResponseBodyBytes] - Maximum UTF-8/binary byte length accepted by buffered response bodies. Unbounded when absent; streamed file responses are unaffected.
+ * @property {number} [maxRequestBodyBytes] - Maximum decoded request-body bytes accepted before routing. Unbounded when absent.
  * @property {number} [maxWorkers] - Backward-compatible alias for workers.
  * @property {number} [port] - Port to bind the HTTP server to.
  * @property {{maxPendingBytes?: number, maxPendingMessages?: number}} [websocketInboundQueue] - Per-session retained inbound WebSocket message limits.
@@ -735,7 +737,7 @@
  * @property {AttachmentsConfiguration} [attachments] - Attachment storage configuration.
  * @property {BackendProjectConfiguration[]} [backendProjects] - Backend project definitions used for frontend model generation.
  * @property {VelociousPackageConfiguration[]} [packages] - External Velocious packages that contribute models, frontend-model resources and migrations.
- * @property {{[key: string]: {[key: string]: DatabaseConfigurationType}}} database - Database configurations keyed by environment and identifier.
+ * @property {false | {[key: string]: {[key: string]: DatabaseConfigurationType}}} [database] - Database configurations keyed by environment and identifier, or false for an explicitly database-free application.
  * @property {boolean} [debug] - Enable debug logging.
  * @property {boolean | DebugEndpointConfiguration} [debugEndpoint] - Enable the built-in debug endpoint. Defaults to false.
  * @property {boolean | ApiManifestConfiguration} [apiManifest] - Enable the built-in API manifest endpoint. Defaults to false.

package/build/configuration.js

@@ -155,6 +155,21 @@ function positiveSafeInteger(value, name, defaultValue) {
   return value
 }
 
+/**
+ * Validates an optional positive safe integer configuration value.
+ * @param {ReturnType<typeof JSON.parse>} value - Configured positive safe integer.
+ * @param {string} name - Configuration key.
+ * @returns {number | undefined} - Validated configured value.
+ */
+function optionalPositiveSafeInteger(value, name) {
+  if (value === undefined) return undefined
+  if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) {
+    throw new TypeError(`${name} must be a positive safe integer`)
+  }
+
+  return value
+}
+
 /**
  * Validates an integer configuration value inside an inclusive range.
  * @param {ReturnType<typeof JSON.parse>} value - Configured integer.
@@ -347,6 +362,8 @@ export default class VelociousConfiguration {
     this.httpServer = {
       ...(httpServer || {}),
       compression: normalizeHttpCompression(httpServer?.compression),
+      maxBufferedResponseBodyBytes: optionalPositiveSafeInteger(httpServer?.maxBufferedResponseBodyBytes, "httpServer.maxBufferedResponseBodyBytes"),
+      maxRequestBodyBytes: optionalPositiveSafeInteger(httpServer?.maxRequestBodyBytes, "httpServer.maxRequestBodyBytes"),
       websocketInboundQueue: {
         maxPendingBytes: positiveSafeInteger(websocketInboundQueue?.maxPendingBytes, "httpServer.websocketInboundQueue.maxPendingBytes", DEFAULT_WEBSOCKET_INBOUND_MAX_PENDING_BYTES),
         maxPendingMessages: positiveSafeInteger(websocketInboundQueue?.maxPendingMessages, "httpServer.websocketInboundQueue.maxPendingMessages", DEFAULT_WEBSOCKET_INBOUND_MAX_PENDING_MESSAGES)
@@ -644,6 +661,22 @@ export default class VelociousConfiguration {
     return this.httpServer.compression
   }
 
+  /**
+   * Runs get maximum buffered response body bytes.
+   * @returns {number | undefined} - Configured byte limit, or undefined when unbounded.
+   */
+  getHttpServerMaxBufferedResponseBodyBytes() {
+    return this.httpServer.maxBufferedResponseBodyBytes
+  }
+
+  /**
+   * Runs get maximum request body bytes.
+   * @returns {number | undefined} - Configured byte limit, or undefined when unbounded.
+   */
+  getHttpServerMaxRequestBodyBytes() {
+    return this.httpServer.maxRequestBodyBytes
+  }
+
   /**
    * Runs get cookie secret.
    * @returns {string | undefined} - Cookie secret.

package/build/http-server/client/errors.js

@@ -0,0 +1,27 @@
+// @ts-check
+
+export class HttpRequestBodyTooLargeError extends Error {
+  /**
+   * Creates a request-body limit error.
+   * @param {object} args - Size details.
+   * @param {number} args.actualBytes - Declared or accumulated body size.
+   * @param {number} args.maxBytes - Configured maximum body size.
+   */
+  constructor({actualBytes, maxBytes}) {
+    super(`HTTP request body exceeds ${maxBytes} bytes (received or declared ${actualBytes})`)
+    this.name = "HttpRequestBodyTooLargeError"
+  }
+}
+
+export class HttpResponseBodyTooLargeError extends Error {
+  /**
+   * Creates a buffered-response limit error.
+   * @param {object} args - Size details.
+   * @param {number} args.actualBytes - Buffered response body size.
+   * @param {number} args.maxBytes - Configured maximum body size.
+   */
+  constructor({actualBytes, maxBytes}) {
+    super(`Buffered HTTP response body exceeds ${maxBytes} bytes (received ${actualBytes})`)
+    this.name = "HttpResponseBodyTooLargeError"
+  }
+}

package/build/http-server/client/index.js

@@ -5,6 +5,7 @@ import fs from "node:fs/promises"
 import {digg} from "diggerize"
 import {ensureError} from "typanic"
 import EventEmitter from "../../utils/event-emitter.js"
+import {HttpRequestBodyTooLargeError} from "./errors.js"
 import Logger from "../../logger.js"
 import Request from "./request.js"
 import RequestRunner from "./request-runner.js"
@@ -104,6 +105,26 @@ export default class VeoliciousHttpServerClient {
     this.events.emit("close")
   }
 
+  /**
+   * Sends a deterministic request-body limit response and closes the connection.
+   * @returns {void} - No return value.
+   */
+  _sendPayloadTooLargeResponse() {
+    const httpVersion = this.currentRequest?.httpVersion() || "1.1"
+    const body = "Payload Too Large\n"
+    const headers = [
+      `HTTP/${httpVersion} 413 Payload Too Large`,
+      "Connection: Close",
+      "Content-Type: text/plain; charset=UTF-8",
+      `Content-Length: ${Buffer.byteLength(body, "utf8")}`,
+      "",
+      body
+    ].join("\r\n")
+
+    this.events.emit("output", headers)
+    this.events.emit("close")
+  }
+
   /**
    * Runs handle bad request.
    * @param {Error} error - Error instance.
@@ -121,7 +142,11 @@ export default class VeoliciousHttpServerClient {
     this.currentRequest = undefined
     this.state = "initial"
 
-    this._sendBadRequestResponse("Bad Request")
+    if (error instanceof HttpRequestBodyTooLargeError) {
+      this._sendPayloadTooLargeResponse()
+    } else {
+      this._sendBadRequestResponse("Bad Request")
+    }
   }
 
   executeCurrentRequest = () => {

package/build/http-server/client/request-buffer/index.js

@@ -3,6 +3,7 @@
 import EventEmitter from "../../../utils/event-emitter.js"
 import FormDataPart from "./form-data-part.js"
 import Header from "./header.js"
+import {HttpRequestBodyTooLargeError} from "../errors.js"
 import {incorporate} from "incorporator"
 import Logger from "../../../logger.js"
 import ParamsToObject from "../params-to-object.js"
@@ -66,6 +67,31 @@ export default class RequestBuffer {
     this.logger = new Logger(this, {debug: false})
   }
 
+  /**
+   * Raises before buffering a request body beyond the configured bound.
+   * @param {number} actualBytes - Declared or accumulated decoded body bytes.
+   * @returns {void}
+   */
+  assertRequestBodySize(actualBytes) {
+    const maxBytes = this.configuration.getHttpServerMaxRequestBodyBytes()
+
+    if (maxBytes !== undefined && actualBytes > maxBytes) {
+      throw new HttpRequestBodyTooLargeError({actualBytes, maxBytes})
+    }
+  }
+
+  /**
+   * Records bytes consumed after request headers. Multipart parsing can accept
+   * an unframed body, so enforce its configured bound during accumulation.
+   * @param {number} bytes - Newly consumed body bytes.
+   * @returns {void}
+   */
+  recordBodyBytes(bytes) {
+    this.bodyLength += bytes
+
+    if (this.multiPartyFormData) this.assertRequestBodySize(this.bodyLength)
+  }
+
   destroy() {
     // Do nothing for now...
   }
@@ -113,7 +139,7 @@ export default class RequestBuffer {
     const newlineIndex = data.indexOf(10, index)
 
     if (newlineIndex === -1) {
-      if (this.readingBody) this.bodyLength += data.length - index
+      if (this.readingBody) this.recordBodyBytes(data.length - index)
 
       for (let dataIndex = index; dataIndex < data.length; dataIndex += 1) {
         this.data.push(data[dataIndex])
@@ -122,7 +148,7 @@ export default class RequestBuffer {
       return data.length
     }
 
-    if (this.readingBody) this.bodyLength += newlineIndex + 1 - index
+    if (this.readingBody) this.recordBodyBytes(newlineIndex + 1 - index)
 
     let line
 
@@ -157,7 +183,7 @@ export default class RequestBuffer {
     const endIndex = Math.min(data.length, index + remainingBodyBytes)
 
     this.postBodyBuffers.push(data.subarray(index, endIndex))
-    this.bodyLength += endIndex - index
+    this.recordBodyBytes(endIndex - index)
 
     if (this.contentLength && this.bodyLength >= this.contentLength) {
       this.postRequestDone()
@@ -175,7 +201,7 @@ export default class RequestBuffer {
   feedByte(data, index) {
     const char = data[index]
 
-    if (this.readingBody) this.bodyLength += 1
+    if (this.readingBody) this.recordBodyBytes(1)
 
     switch(this.state) {
       case "chunked-data": {
@@ -414,6 +440,12 @@ export default class RequestBuffer {
         this.readingBody = true
         this.bodyLength = 0
 
+        if (this.contentLength !== undefined) {
+          if (Number.isNaN(this.contentLength)) throw new Error("Content length is invalid")
+
+          this.assertRequestBodySize(this.contentLength)
+        }
+
         const match = this.getHeader("content-type")?.value?.match(/^multipart\/form-data;\s*boundary=(.+)$/i)
 
         if (match) {
@@ -425,8 +457,6 @@ export default class RequestBuffer {
           this.setState("multi-part-form-data")
         } else if (this.contentLength === 0 || this.contentLength === undefined) {
           this.completeRequest()
-        } else if (Number.isNaN(this.contentLength)) {
-          throw new Error("Content length is invalid")
         } else {
           /**
            * Narrows the runtime value to the documented type.
@@ -521,6 +551,8 @@ export default class RequestBuffer {
       return
     }
 
+    this.assertRequestBodySize((this.chunkedBodyChars?.length || 0) + size)
+
     this.currentChunkSize = size
     this.currentChunkBytesRead = 0
     this.setState("chunked-data")

package/build/http-server/client/request-runner.js

@@ -3,6 +3,7 @@
 import {ensureError} from "typanic"
 import BacktraceCleaner from "../../utils/backtrace-cleaner-node.js"
 import EventEmitter from "../../utils/event-emitter.js"
+import {HttpResponseBodyTooLargeError} from "./errors.js"
 import Logger from "../../logger.js"
 import RequestTiming from "./request-timing.js"
 import Response from "./response.js"
@@ -304,7 +305,13 @@ export default class VelociousHttpServerClientRequestRunner {
       })
 
       response.setStatus(500)
-      response.setErrorBody(error)
+      try {
+        response.setErrorBody(error)
+      } catch (responseError) {
+        if (!(responseError instanceof HttpResponseBodyTooLargeError)) throw responseError
+
+        response.setBody("")
+      }
     }
 
     await this.logger.debug(() => ["Request runner done", {

package/build/http-server/client/response.js

@@ -1,5 +1,7 @@
 // @ts-check
 
+import {HttpResponseBodyTooLargeError} from "./errors.js"
+
 /**
  * Named status aliases.
  * @type {Record<string, number>} */
@@ -226,6 +228,15 @@ export default class VelociousHttpServerClientResponse {
   setBody(value) {
     this.filePath = null
     this.fileOnFinished = null
+
+    const actualBytes = typeof value === "string" ? Buffer.byteLength(value, "utf8") : value.byteLength
+    const maxBytes = this.configuration.getHttpServerMaxBufferedResponseBodyBytes()
+
+    if (maxBytes !== undefined && actualBytes > maxBytes) {
+      this.body = ""
+      throw new HttpResponseBodyTooLargeError({actualBytes, maxBytes})
+    }
+
     this.body = value
   }
 

package/build/routes/resolver.js

@@ -92,7 +92,7 @@ export default class VelociousRoutesResolver {
     }
 
     const routeResolverHookMatch = await this.resolveRouteResolverHooks(currentPath, {hasMatchingCustomRoute})
-    let skipControllerConnections = routeResolverHookMatch?.skipControllerConnections === true
+    let skipControllerConnections = this.configuration.database === false || routeResolverHookMatch?.skipControllerConnections === true
     let skipAbilityResolution = routeResolverHookMatch?.skipAbilityResolution === true
     let skipTenantResolution = routeResolverHookMatch?.skipTenantResolution === true
     const matchResult = routeResolverHookMatch || !currentRoute ? undefined : this.matchPathWithRoutes(currentRoute, currentPath)