xypriss 9.12.0 → 9.12.2

package/dist/cjs/src/server/core/XHSCProtocol.js

@@ -1,410 +1,73 @@
 'use strict';
 
-var stream = require('stream');
 var http = require('http');
-var xhsc = require('../../xhsc.js');
 var SendFileHandler = require('./SendFileHandler.js');
 var XRUNTIMEHEADER = require('../const/XRUNTIME-HEADER.js');
 require('../../index.js');
+var XNullSocket = require('./XNullSocket.js');
+var xyprissSecurity = require('xypriss-security');
+require('stream');
+require('../../xhsc.js');
 var ConfigurationManager = require('../../ConfigurationManager.js');
 
 /***************************************************************************
  * XyPriss - Fast And Secure
  *
  * High-performance Request/Response implementation for XHSC Bridge.
- * This file provides REAL implementations of the XyPriss Request/Response
+ * This file provides implementations of the XyPriss Request/Response
  * objects that fulfill the Node.js HTTP contract without depending on
  * the internal Node.js http module classes.
  ***************************************************************************/
+const NULL_SOCKET = new XNullSocket.XNullSocket();
 /**
- * Real implementation of XyPriss Request for XHSC.
- * Extends Readable to support stream-based body reading.
- */
-/**
- * **XHSC High-Performance Request Object**
- *
- * A real implementation of the XyPriss HTTP Request object, built to bridge
- * binary IPC data received from the Go XHSC engine into a Node.js-compatible
- * `IncomingMessage`-like interface — without depending on the native `http`
- * module's internal classes.
+ * ### Module-level branding header cache
  *
- * ### Performance Strategy
- * Most HTTP frameworks construct all request properties eagerly on every
- * incoming request, regardless of whether the application code will ever
- * access them. For many high-throughput routes (e.g. health checks, CSRF
- * token endpoints), properties like `ip`, `hostname`, `protocol`, and
- * `cookies` are never read.
+ * `_brandingEnabled` caches the result of `Configs.get("security")?.rmXBranding`
+ * after the first call. Config lookups typically involve object traversal and
+ * optional chaining; doing that on every response under load wastes cycles.
  *
- * This class defers that work using `Object.defineProperty` lazy getters:
- * - Properties are only computed the **first time** they are accessed.
- * - Computed values are cached in closure-scoped variables (`_ip`, `_hostname`,
- *   `_cookies`, etc.) for subsequent reads at zero cost.
- * - Properties that are never accessed cost **zero CPU time** and zero
- *   extra memory beyond the closure variable declaration.
+ * The cache is intentionally a simple boolean triple-state (`undefined` = not
+ * yet read, `true` = branding disabled, `false` = branding enabled) so the
+ * fast path is a single `=== true` check with no config traversal at all.
  *
- * ### Header Parsing
- * The `decodeXbpRequest` decoder (in `xbp.ts`) already lowercases header
- * keys during binary frame parsing. The header iteration here is therefore
- * a simple structural unwrapping of the XBP `{ Single: value }` envelope,
- * with no redundant `toLowerCase()` pass.
+ * If the config can change at runtime, remove this cache or add a cache
+ * invalidation hook. In the common case (immutable startup config), this is
+ * always safe and saves one property lookup per response.
  */
-class XHSCRequest extends stream.Readable {
-    /**
-     * Creates an `XHSCRequest` from a decoded IPC payload.
-     *
-     * @param payload - The raw decoded request object from the Go XHSC engine.
-     *   Contains `method`, `url`, `id`, `headers` (XBP envelope), `query`,
-     *   `params`, `body` (base64 string or Buffer), `remote_addr`, `local_addr`,
-     *   and optionally `files` and `upload_errors`.
-     * @param socket - The underlying Unix Domain Socket connection to the Go
-     *   engine. Used to populate `req.socket` so middleware expecting a real
-     *   socket object (e.g. for `remoteAddress`) will function correctly.
-     */
-    constructor(payload, socket) {
-        super();
-        this.files = [];
-        this.baseUrl = "";
-        this.httpVersion = "1.1";
-        this.httpVersionMajor = 1;
-        this.httpVersionMinor = 1;
-        this.subdomains = [];
-        this.fresh = true;
-        this.stale = false;
-        this.method = payload.method;
-        this.url = payload.url;
-        this.id = payload.id;
-        // Flatten and lowercase headers for Node.js compatibility
-        this.headers = {};
-        if (payload.headers) {
-            const h = payload.headers;
-            for (const key in h) {
-                const val = h[key];
-                if (val && val.Single !== undefined) {
-                    this.headers[key] = val.Single;
-                }
-                else if (val && val.Multiple !== undefined) {
-                    this.headers[key] = val.Multiple;
-                }
-                else {
-                    this.headers[key] = val;
-                }
-            }
-        }
-        this.query = payload.query || {};
-        this.params = payload.params || {};
-        this.body = null;
-        let reqPath = payload.url ? payload.url.split("?")[0] : "/";
-        if (reqPath.length > 1 && reqPath.endsWith("/")) {
-            reqPath = reqPath.slice(0, -1);
-        }
-        this.path = reqPath;
-        this.originalUrl = payload.url || "/";
-        /**
-         * ### Lazy IP Resolution
-         *
-         * Parsing `remote_addr` is non-trivial: it must handle IPv4 (`1.2.3.4:port`),
-         * IPv6 with brackets (`[::1]:port`), and comma-separated proxy chains
-         * (`X-Forwarded-For` style). This block defers that work until `req.ip`
-         * or `req.ips` is first accessed. On routes that never read the client IP
-         * (e.g. static assets, CSRF token generation), this block is never executed.
-         */
-        let _ip;
-        let _ips;
-        let _remotePort = 0;
-        Object.defineProperty(this, "ips", {
-            get: () => {
-                if (_ips)
-                    return _ips;
-                const remoteAddrStr = payload.remote_addr || "127.0.0.1:0";
-                if (remoteAddrStr.includes(",")) {
-                    _ips = remoteAddrStr
-                        .split(",")
-                        .map((i) => i.trim())
-                        .filter(Boolean);
-                    _ip = _ips[0];
-                }
-                else {
-                    const lastColon = remoteAddrStr.lastIndexOf(":");
-                    if (lastColon !== -1) {
-                        let ip = remoteAddrStr.substring(0, lastColon);
-                        if (ip.startsWith("[") && ip.endsWith("]")) {
-                            ip = ip.substring(1, ip.length - 1);
-                        }
-                        _ip = ip;
-                    }
-                    else {
-                        _ip = remoteAddrStr;
-                    }
-                    _remotePort =
-                        lastColon !== -1
-                            ? parseInt(remoteAddrStr.substring(lastColon + 1) || "0", 10)
-                            : 0;
-                    _ips = [_ip];
-                }
-                return _ips;
-            },
-            configurable: true
-        });
-        Object.defineProperty(this, "ip", {
-            get: () => {
-                if (!_ip) {
-                    this.ips;
-                }
-                return _ip;
-            },
-            configurable: true
-        });
-        /**
-         * ### Lazy Local Address Resolution
-         *
-         * The local server address (`local_addr`) is almost never needed by
-         * application code. Its parsing (IPv6 bracket stripping, port splitting)
-         * is deferred to the `socket.localAddress` getter and only executed if
-         * that property is actually read.
-         */
-        let _localAddress;
-        let _localPort = 0;
-        /**
-         * ### Lazy Hostname Resolution
-         *
-         * Parses the `Host` header to extract the bare hostname, stripping the
-         * optional port suffix and handling IPv6 bracketed addresses.
-         * Defaults to `"localhost"` if the header is absent.
-         */
-        let _hostname;
-        Object.defineProperty(this, "hostname", {
-            get: () => {
-                if (_hostname !== undefined)
-                    return _hostname;
-                if (this.headers && this.headers.host) {
-                    const host = this.headers.host;
-                    const lastHostColon = host.lastIndexOf(":");
-                    if (lastHostColon !== -1 && host.includes("]")) {
-                        // IPv6 with port: [::1]:8080 or [::1]
-                        const ClosingBracket = host.lastIndexOf("]");
-                        if (ClosingBracket !== -1 && lastHostColon > ClosingBracket) {
-                            _hostname = host.substring(0, lastHostColon);
-                        }
-                        else {
-                            _hostname = host;
-                        }
-                    }
-                    else if (lastHostColon !== -1) {
-                        // IPv4 or hostname with port: strip the port suffix
-                        _hostname = host.substring(0, lastHostColon);
-                    }
-                    else {
-                        _hostname = host;
-                    }
-                    if (_hostname.startsWith("[") && _hostname.endsWith("]")) {
-                        _hostname = _hostname.substring(1, _hostname.length - 1);
-                    }
-                }
-                else {
-                    _hostname = "localhost";
-                }
-                return _hostname;
-            },
-            configurable: true
-        });
-        /**
-         * ### Lazy Protocol Detection
-         *
-         * Reads `x-forwarded-proto` from headers. Only computed on first access.
-         * Drives `req.secure` (whether the original connection was HTTPS)
-         * without requiring an additional property lookup.
-         */
-        Object.defineProperty(this, "protocol", {
-            get: () => {
-                return (this.headers && this.headers["x-forwarded-proto"]) || "http";
-            },
-            configurable: true
-        });
-        Object.defineProperty(this, "secure", {
-            get: () => {
-                return this.protocol === "https";
-            },
-            configurable: true
-        });
+let _brandingEnabled;
+class XHSCResponse extends http.ServerResponse {
+    constructor(req, onFinalize) {
+        // Pass a no-op NullSocket instead of the IPC socket.
+        // See NullSocket JSDoc above for the full rationale.
+        super({ socket: NULL_SOCKET, connection: NULL_SOCKET });
+        this.locals = {};
         /**
-         * ### Lazy XHR Detection
+         * ### Response body accumulation: pre-allocated array with byte counter
          *
-         * Checks the `x-requested-with` header for `XMLHttpRequest`.
-         * Deferred because the vast majority of requests are not XHR,
-         * and checking this header costs a string comparison.
-         */
-        Object.defineProperty(this, "xhr", {
-            get: () => {
-                return (this.headers && (this.headers["x-requested-with"] || "").toLowerCase() === "xmlhttprequest");
-            },
-            configurable: true
-        });
-        /**
-         * ### Lazy Cookie Parsing
+         * The previous implementation used a plain `Buffer[]` array and called
+         * `Buffer.concat(this._capturedData)` at `end()` time with no size hint.
+         * `Buffer.concat` without a `totalLength` argument iterates the array once
+         * to compute the total length, then copies. For large bodies (e.g. 100MB
+         * streaming responses broken into many chunks) this means two full passes.
          *
-         * `Cookie` header parsing (splitting on `;`, decoding URI components)
-         * is one of the more expensive string operations per request.
-         * It is deferred until `req.cookies` is first accessed and cached
-         * for all subsequent reads within the same request lifecycle.
+         * Optimization: we maintain a running `_capturedLength` counter, incremented
+         * on every `write()`. `Buffer.concat` is then called with the pre-computed
+         * total, turning it into a single-pass copy with no extra iteration.
          */
-        let _cookies;
-        Object.defineProperty(this, "cookies", {
-            get: () => {
-                if (_cookies)
-                    return _cookies;
-                if (this.headers && this.headers.cookie) {
-                    _cookies = this.parseCookies(this.headers.cookie);
-                }
-                else {
-                    _cookies = {};
-                }
-                return _cookies;
-            },
-            configurable: true
-        });
+        this._capturedData = [];
+        this._capturedLength = 0;
         /**
-         * ### Socket Property Masking
-         *
-         * The underlying socket is the Unix Domain Socket connecting Node.js to the
-         * Go XHSC engine. We must mask its properties (`remoteAddress`, `localPort`,
-         * etc.) to expose the **client's** network address rather than the IPC pipe
-         * address, so that downstream middleware (rate limiters, loggers, etc.)
-         * sees correct values.
+         * ### _brandingDone flag: prevents double _injectBranding()
          *
-         * All socket properties are also lazy: they delegate to the same
-         * closure-scoped variables above, ensuring a single parse for both
-         * `req.ip` and `req.socket.remoteAddress`.
+         * `_injectBranding` is called from both `writeHead()` and `end()` to
+         * handle the case where application code calls either without the other.
+         * The previous implementation relied on `this.headersSent` as a guard,
+         * but `headersSent` in our NullSocket-backed response is only set after
+         * `super.writeHead()` — which we may bypass. A dedicated boolean flag is
+         * more explicit and avoids any reliance on the parent class's internal state.
          */
-        this.socket = socket || {
-            destroy: () => { },
-            end: () => { },
-        };
-        if (socket) {
-            Object.defineProperties(this.socket, {
-                remoteAddress: { get: () => this.ip, configurable: true },
-                remotePort: { get: () => { this.ips; return _remotePort; }, configurable: true },
-                localAddress: { get: () => {
-                        if (!_localAddress) {
-                            const localAddr = payload.local_addr || "127.0.0.1:0";
-                            const lastLocalColon = localAddr.lastIndexOf(":");
-                            if (lastLocalColon !== -1) {
-                                _localAddress = localAddr.substring(0, lastLocalColon);
-                                if (_localAddress.startsWith("[") && _localAddress.endsWith("]")) {
-                                    _localAddress = _localAddress.substring(1, _localAddress.length - 1);
-                                }
-                                _localPort = parseInt(localAddr.substring(lastLocalColon + 1) || "0", 10);
-                            }
-                            else {
-                                _localAddress = localAddr;
-                            }
-                        }
-                        return _localAddress;
-                    }, configurable: true },
-                localPort: { get: () => { this.socket.localAddress; return _localPort; }, configurable: true },
-                encrypted: { get: () => this.secure, configurable: true },
-            });
-        }
-        if (payload.body) {
-            // Go serializes []byte as Base64 in JSON. We must decode it.
-            try {
-                if (typeof payload.body === "string") {
-                    const buf = Buffer.from(payload.body, "base64");
-                    this.push(buf);
-                    // Also try to parse as JSON for req.body if it's not a stream-only use case
-                    const contentType = this.headers["content-type"] || "";
-                    if (contentType.includes("application/json") ||
-                        contentType.includes("application/x-www-form-urlencoded") ||
-                        contentType.includes("multipart/form-data")) {
-                        try {
-                            this.body = JSON.parse(buf.toString());
-                        }
-                        catch (e) {
-                            this.body = buf.toString();
-                        }
-                    }
-                }
-                else {
-                    const buf = Buffer.from(payload.body);
-                    this.push(buf);
-                    this.body = buf;
-                }
-            }
-            catch (e) {
-                const buf = Buffer.from(payload.body);
-                this.push(buf);
-                this.body = buf;
-            }
-        }
-        // Handle native Go uploads
-        if (payload.files && Array.isArray(payload.files)) {
-            this.files = payload.files.map((file) => ({
-                fieldname: file.fieldname,
-                originalname: file.originalname,
-                encoding: "7bit",
-                mimetype: file.mimetype,
-                destination: xhsc.__sys__.path.dirname(file.path),
-                filename: xhsc.__sys__.path.basename(file.path),
-                path: file.path,
-                size: file.size,
-                // Buffer is not provided as Go already saved it to disk
-            }));
-            // XyPriss convention: also expose single file if present
-            if (this.files.length > 0) {
-                this.file = this.files[0];
-            }
-        }
-        if (payload.upload_errors) {
-            this.uploadErrors = payload.upload_errors;
-        }
-        this.push(null); // End stream
-    }
-    _read() { }
-    async getApp() {
-        return this.app;
-    }
-    destroy(error) {
-        super.destroy(error);
-        return this;
-    }
-    setTimeout(msecs, callback) {
-        if (callback)
-            callback();
-        return this;
-    }
-    get(name) {
-        const lcName = name.toLowerCase();
-        return this.headers[lcName];
-    }
-    header(name) {
-        return this.get(name);
-    }
-    parseCookies(cookieHeader) {
-        const cookies = {};
-        cookieHeader.split(";").forEach((pair) => {
-            const [key, value] = pair.split("=").map((s) => s.trim());
-            if (key && value) {
-                cookies[key] = decodeURIComponent(value);
-            }
-        });
-        return cookies;
-    }
-}
-/**
- * Real implementation of XyPriss Response for XHSC.
- * Extends ServerResponse to fulfill the Node.js HTTP contract.
- */
-class XHSCResponse extends http.ServerResponse {
-    constructor(req, onFinalize) {
-        // Pass the request to ServerResponse constructor (it expects a socket or similar)
-        super({
-            socket: req.socket,
-            connection: req.socket,
-        });
-        this.locals = {};
-        this._headersMap = {};
-        this._capturedData = [];
+        this._brandingDone = false;
         this._onFinalize = onFinalize;
-        // Compatibility with middleware that expects these properties
         this.req = req;
     }
     status(code) {
@@ -457,12 +120,24 @@ class XHSCResponse extends http.ServerResponse {
         return this;
     }
     write(chunk, encoding, callback) {
+        /**
+         * ### write(): Buffer detection via Buffer.isBuffer before Buffer.from
+         *
+         * `Buffer.isBuffer` is a very cheap type check (single property lookup).
+         * If the chunk is already a Buffer — the common case for binary/large
+         * payloads — we skip `Buffer.from` entirely and push the reference
+         * directly. This avoids an unnecessary copy for every chunk.
+         *
+         * `_capturedLength` is updated here so `end()` always has an accurate
+         * total without needing to re-iterate `_capturedData`.
+         */
         const buffer = Buffer.isBuffer(chunk)
             ? chunk
             : Buffer.from(chunk, (typeof encoding === "string"
                 ? encoding
                 : "utf8"));
         this._capturedData.push(buffer);
+        this._capturedLength += buffer.length;
         if (typeof encoding === "function")
             callback = encoding;
         if (typeof callback === "function")
@@ -477,26 +152,38 @@ class XHSCResponse extends http.ServerResponse {
      * terminate the response.
      *
      * ### Optimization Notes
-     * - **Guard clause first**: the `headersSent` check is performed at the very
-     *   top to bail out immediately on double-calls (e.g. when `writeHead` is
-     *   called before `end`). This avoids any config lookup in the hot path.
-     * - **Conditional branching instead of iteration**: the previous implementation
-     *   built a `const XBHeaders = { ... }` object literal on every call and then
-     *   iterated over it with a `for...in` loop. This allocates a new object and
-     *   a closure per response. The refactored version uses a flat `if/else` with
-     *   direct `setHeader` / `removeHeader` calls \u2014 no object, no loop, no GC.
-     * - **`hasHeader` guard on set**: headers are only written if they are not
-     *   already present, allowing application code to override branding headers
+     * - **`_brandingDone` guard**: a dedicated boolean flag (faster than
+     *   checking `headersSent`, which has inheritance overhead) ensures this
+     *   method is a no-op after the first call, making double-call cost
+     *   effectively zero.
+     * - **Module-level config cache**: `_brandingEnabled` is resolved once at
+     *   server startup and cached at module scope. Subsequent calls skip the
+     *   `Configs.get` traversal entirely.
+     * - **Conditional branching instead of iteration**: flat `if/else` with
+     *   direct `setHeader` / `removeHeader` calls — no object literal, no loop,
+     *   no per-response GC pressure.
+     * - **`hasHeader` guard on set**: headers are only written if not already
+     *   present, allowing application code to override branding headers
      *   (e.g. a custom `Server:` header) without being silently overwritten.
      *
      * Branding can be disabled globally via `security.rmXBranding: true` in
      * the server configuration.
      */
     _injectBranding() {
-        if (this.headersSent)
+        if (this._brandingDone)
             return;
-        const RMXB = ConfigurationManager.CM.get("security")?.rmXBranding;
-        if (RMXB) {
+        this._brandingDone = true;
+        /**
+         * ### Lazy config cache: read once, reuse forever
+         *
+         * The first call resolves `Configs.get("security")?.rmXBranding` and
+         * stores it in the module-level `_brandingEnabled` variable. All
+         * subsequent responses read the cached value at near-zero cost.
+         */
+        if (_brandingEnabled === undefined) {
+            _brandingEnabled = ConfigurationManager.CM.get("security")?.rmXBranding ?? false;
+        }
+        if (_brandingEnabled) {
             this.removeHeader("Server");
             this.removeHeader("X-XyPriss-Runtime");
             this.removeHeader("X-Powered-By");
@@ -513,7 +200,34 @@ class XHSCResponse extends http.ServerResponse {
                 this.setHeader("X-Runtime", "XyPriss - Hyper-System Core (XHSC)");
         }
     }
+    /**
+     * Finalizes the response and signals the Go engine via `_onFinalize`.
+     *
+     * ### Architecture
+     * `XHSCResponse` uses a `NullSocket` as its underlying socket, so
+     * `super.end()` (the Node.js `ServerResponse` finalizer) would write
+     * HTTP-framed bytes into a no-op buffer — harmless but unnecessary.
+     * We bypass `super.end()` entirely and mark the stream as ended via
+     * `Object.defineProperty`, which is the minimal correct operation.
+     *
+     * ### Why no `process.nextTick`
+     * The previous implementation scheduled `this.emit("finish")` via
+     * `process.nextTick`. Under 100+ concurrent requests, 100 nextTicks
+     * queue up simultaneously, stalling the event loop for entire seconds
+     * (observable as "0 req/s" samples in benchmarks). Emitting `finish`
+     * synchronously is safe here because no downstream consumer depends on
+     * async drain completion — the I/O is handled by the Go engine.
+     *
+     * ### Buffer.concat with pre-computed totalLength
+     *
+     * `_capturedLength` is maintained incrementally in `write()`, so we pass
+     * it directly to `Buffer.concat`. This avoids the internal length-scanning
+     * pass that `Buffer.concat` would otherwise perform, saving one full
+     * iteration over `_capturedData` for every response that used `write()`.
+     */
     end(chunk, encoding, callback) {
+        if (this.writableEnded)
+            return this;
         this._injectBranding();
         if (chunk && typeof chunk !== "function") {
             const buffer = Buffer.isBuffer(chunk)
@@ -522,33 +236,45 @@ class XHSCResponse extends http.ServerResponse {
                     ? encoding
                     : "utf8"));
             this._capturedData.push(buffer);
+            this._capturedLength += buffer.length;
         }
-        const finalBody = this._capturedData.length > 0
-            ? Buffer.concat(this._capturedData)
-            : null;
-        // If statusCode is 0, it means the request was delegated (e.g. XStatic).
-        // Mark the response as ended BEFORE calling super.end() so that middleware
-        // watchdogs (like MiddlewareManager's 5s timeout) see the correct state
-        // immediately and do not fire a spurious timeout error.
-        if (this.statusCode === 0) {
-            Object.defineProperty(this, "writableEnded", {
-                value: true,
-                configurable: true,
-            });
-            Object.defineProperty(this, "finished", {
-                value: true,
-                configurable: true,
-            });
+        /**
+         * ### Final body assembly: single Buffer.concat with pre-computed size
+         *
+         * When `_capturedData` has exactly one entry (the most common case for
+         * small JSON responses, redirects, or simple `res.send` calls), we skip
+         * `Buffer.concat` entirely and use the Buffer directly. This eliminates
+         * the concat overhead (and the extra allocation it would cause) for the
+         * hot path.
+         */
+        let finalBody;
+        if (this._capturedData.length === 0) {
+            finalBody = null;
         }
-        // Notify Go with status 0 so it waits for the delegation signal.
-        this._onFinalize(finalBody, this.statusCode, this.getHeaders());
-        super.end();
-        // Ensure finish is emitted because mock socket might not drain and trigger it natively
-        process.nextTick(() => {
-            if (!this.writableFinished) {
-                this.emit("finish");
-            }
+        else if (this._capturedData.length === 1) {
+            finalBody = this._capturedData[0];
+        }
+        else {
+            finalBody = Buffer.concat(this._capturedData, this._capturedLength);
+        }
+        // Mark stream as ended immediately (bypassing super.end() which is
+        // unnecessary — the NullSocket absorbs any bytes it would write).
+        Object.defineProperty(this, "writableEnded", {
+            value: true,
+            configurable: true,
+        });
+        Object.defineProperty(this, "finished", {
+            value: true,
+            configurable: true,
+        });
+        Object.defineProperty(this, "writableFinished", {
+            value: true,
+            configurable: true,
         });
+        // Signal Go engine (status=0 means static delegation, >0 is a normal response).
+        this._onFinalize(finalBody, this.statusCode, this.getHeaders());
+        // Emit finish synchronously — no drain needed on NullSocket.
+        this.emit("finish");
         const actualCallback = typeof chunk === "function"
             ? chunk
             : typeof encoding === "function"
@@ -558,9 +284,22 @@ class XHSCResponse extends http.ServerResponse {
             actualCallback();
         return this;
     }
+    /**
+     * ### json(): set Content-Length alongside Content-Type
+     *
+     * Serializing to a string first lets us compute `byteLength` before
+     * calling `end()`. Setting `Content-Length` avoids chunked transfer
+     * encoding overhead and lets clients and proxies handle the response
+     * more efficiently (connection reuse, progress indicators, etc.).
+     *
+     * `Buffer.byteLength` is used (not `str.length`) because multi-byte
+     * UTF-8 characters make `str.length` an unreliable byte count.
+     */
     json(data) {
+        const str = xyprissSecurity.XStringify(data);
         this.setHeader("Content-Type", "application/json");
-        this.end(JSON.stringify(data));
+        this.setHeader("Content-Length", Buffer.byteLength(str));
+        this.end(str);
     }
     success(message, data) {
         this.json({ success: true, message, data });
@@ -619,6 +358,5 @@ class XHSCResponse extends http.ServerResponse {
     }
 }
 
-exports.XHSCRequest = XHSCRequest;
 exports.XHSCResponse = XHSCResponse;
 //# sourceMappingURL=XHSCProtocol.js.map