Function onUpstreamData

src/recorder.ts:1162–1288

(chunk: Buffer)

          );
        };
        const onUpstreamData = (chunk: Buffer) => {
          totalBytes += chunk.length;
          // Trip truncation on EITHER bytes OR frame count. The byte cap alone
          // never bounds `frameTimestamps` (count-indexed, not byte-sized) nor a
          // never-completing parse buffer, so a long-lived / never-ending stream
          // would otherwise grow per-frame state forever. `frameTimestamps.length`
          // is the running complete-frame count. `>=` (not `>`) so we never
          // retain MORE than `maxBufferFrames` frames — see the "maximum N
          // frames retained" contract on DEFAULT_MAX_PROXY_BUFFER_FRAMES.
          if (!bufferTruncated && bufferedBytes + chunk.length > maxBufferBytes) {
            tripTruncation("byte");
          } else if (!bufferTruncated && frameTimestamps.length >= maxBufferFrames) {
            tripTruncation("frame");
          }
          // Buffer the raw bytes. Under cap: always. Over cap on a progressive
          // stream: never (bytes are already teed live; chunks was freed). Over
          // cap on a NON-progressive response: keep buffering for the relay —
          // it has no live tee, so `chunks` is the only copy the client can get
          // — but hard-cap it at HARD_CEILING (well under V8's max string
          // length) so the eventual rawBuffer.toString() relay can never throw
          // RangeError: Invalid string length.
          if (!bufferTruncated) {
            chunks.push(chunk);
            bufferedBytes += chunk.length;
          } else if (!isProgressiveStream) {
            if (bufferedBytes + chunk.length <= hardCeiling) {
              chunks.push(chunk);
              bufferedBytes += chunk.length;
            } else {
              // The non-progressive relay copy would exceed the hard ceiling.
              // We CANNOT relay the full body (it can't be buffered safely) and
              // MUST NOT relay the partial buffer as a success — flag it so the
              // caller fails loud (502) instead of presenting a truncated 2xx.
              hardCeilingExceeded = true;
            }
          }

          // Capture per-frame timestamps for SSE/NDJSON streams. Gated on
          // !bufferTruncated so per-frame parse/timing state stops growing once
          // the cap trips (the byte/frame guard above already freed it).
          // TCP data events don't align with SSE frames — buffer and
          // split on the protocol delimiter to timestamp each complete frame.
          if (!bufferTruncated && (isSSE || isNDJSON)) {
            frameBuffer += frameDecoder.write(chunk);
            // Split on the protocol delimiter, tolerating CRLF line endings.
            // The SSE spec permits CRLF, and some upstreams/proxies emit
            // \r\n\r\n (SSE) or \r\n (NDJSON) frame boundaries. An LF-only
            // split would see the whole CRLF stream as a single frame and
            // lose per-frame timing. The last split element (a partial frame
            // tail) stays buffered, exactly as with a string delimiter.
            const delimiter = isNDJSON ? /\r?\n/ : /\r?\n\r?\n/;
            const parts = frameBuffer.split(delimiter);
            // All complete frames (everything except the last part which
            // may be incomplete). Enforce the frame cap PER-FRAME: a single
            // coalesced chunk can carry many complete frames, so checking only
            // at the top of the callback would let one event push them all and
            // overshoot the cap unbounded. Trip + bail mid-loop instead.
            for (let fi = 0; fi < parts.length - 1; fi++) {