patch 1.4.20

CHANGELOG.md

@@ -1,3 +1,19 @@
+# 1.4.20 - 3 Jan 2026
+Improvement:
+- add `ModelValidator.schema` for accessing raw schema
+- [#1636](https://github.com/elysiajs/elysia/issues/1636) add `subscriptions` to `Elysia.ws` context
+- [#1638](https://github.com/elysiajs/elysia/pull/1638) unref Sucrose gc
+
+Bug fix:
+- [#1649](https://github.com/elysiajs/elysia/pull/1649) add null check for object properties (t.Record)
+- [#1646](https://github.com/elysiajs/elysia/pull/1646) use constant-time comparison for signed cookie verification
+- [#1639](https://github.com/elysiajs/elysia/issues/1639) compose: ReferenceError: "_r_r is not defined" when onError returns plain object & mapResponse exists
+- [#1631](https://github.com/elysiajs/elysia/issues/1631) update Exact Mirror to 0.2.6
+- [#1630](https://github.com/elysiajs/elysia/issues/1630) enforce fetch to return MaybePromise<Response>
+
+Bug fix:
+- `Elysia.models` broke when referencing non typebox model
+
 # 1.4.19 - 13 Dec 2025
 Security:
 - reject invalid cookie signature when using cookie rotation

example/a.ts

@@ -1,11 +1,14 @@
-import { Elysia } from '../src'
+import { Elysia, t } from '../src'
+import { z } from 'zod'
+import { req } from '../test/utils'
 
-// This uses aot: true by default in 1.4 (broken on Bun)
-const app = new Elysia({ systemRouter: true })
-  .get("/", "Hello Elysia")
-  .get("/json", () => ({ message: "Hello World", timestamp: Date.now() }))
-
-Bun.serve({
-	port: 3000,
-	fetch: app.fetch
-})
+export const app = new Elysia()
+	.ws('/', {
+		open(ws) {
+			ws.subscribe('a')
+		},
+		message(a) {
+			console.log(a.subscriptions)
+		}
+	})
+	.listen(3000)

package.json

@@ -1,7 +1,7 @@
 {
 	"name": "elysia",
 	"description": "Ergonomic Framework for Human",
-	"version": "1.4.19",
+	"version": "1.4.20",
 	"author": {
 		"name": "saltyAom",
 		"url": "https://github.com/SaltyAom",
@@ -191,13 +191,13 @@
 	},
 	"dependencies": {
 		"cookie": "^1.1.1",
-		"exact-mirror": "0.2.5",
+		"exact-mirror": "^0.2.6",
 		"fast-decode-uri-component": "^1.0.1",
 		"memoirist": "^0.4.0"
 	},
 	"devDependencies": {
 		"@elysiajs/openapi": "^1.4.1",
-		"@types/bun": "^1.2.12",
+		"@types/bun": "^1.3.5",
 		"@types/cookie": "1.0.0",
 		"@types/fast-decode-uri-component": "^1.0.0",
 		"@typescript-eslint/eslint-plugin": "^8.30.1",

src/compose.ts

@@ -60,6 +60,7 @@ import type {
 	Handler,
 	HookContainer,
 	LifeCycleStore,
+	MaybePromise,
 	SchemaValidator
 } from './types'
 import { tee } from './adapter/utils'
@@ -2308,7 +2309,9 @@ export const createHoc = (app: AnyElysia, fnName = 'map') => {
 	return `return function hocMap(${adapter.parameters}){return ${handler}(${adapter.parameters})}`
 }
 
-export const composeGeneralHandler = (app: AnyElysia) => {
+export const composeGeneralHandler = (
+	app: AnyElysia
+): ((request: Request) => MaybePromise<Response>) => {
 	const adapter = app['~adapter'].composeGeneralHandler
 	app.router.http.build()
 
@@ -2658,7 +2661,7 @@ export const composeErrorHandler = (app: AnyElysia) => {
 					`return mapResponse(_r,set${adapter.mapResponseContext})}` +
 					`if(_r instanceof ElysiaCustomStatusResponse){` +
 					`error.status=error.code\n` +
-					`error.message = error.response` +
+					`error.message=error.response` +
 					`}` +
 					`if(set.status===200||!set.status)set.status=error.status\n`
 
@@ -2676,7 +2679,7 @@ export const composeErrorHandler = (app: AnyElysia) => {
 						)
 
 						fnLiteral +=
-							`context.response=context.responseValue=_r` +
+							`context.response=context.responseValue=_r\n` +
 							`_r=${isAsyncName(mapResponse) ? 'await ' : ''}onMapResponse[${i}](context)\n`
 
 						endUnit()

src/index.ts

@@ -467,7 +467,10 @@ export default class Elysia<
 
 		for (const name of Object.keys(this.definitions.type))
 			models[name] = getSchemaValidator(
-				this.definitions.typebox.Import(name as never)
+				this.definitions.typebox.Import(name as never),
+				{
+					models: this.definitions.type
+				}
 			)
 
 		// @ts-expect-error

src/schema.ts

@@ -18,7 +18,7 @@ import {
 
 import { t, type TypeCheck } from './type-system'
 
-import { deepClone, mergeCookie, mergeDeep, randomId } from './utils'
+import { mergeCookie, mergeDeep, randomId } from './utils'
 import { mapValueError } from './error'
 
 import type { CookieOptions } from './cookies'
@@ -28,11 +28,15 @@ import type {
 	MaybeArray,
 	StandaloneInputSchema,
 	StandardSchemaV1LikeValidate,
-UnwrapSchema
+	UnwrapSchema
 } from './types'
 
 import type { StandardSchemaV1Like } from './types'
-import { replaceSchemaTypeFromManyOptions, type ReplaceSchemaTypeOptions, stringToStructureCoercions } from './replace-schema'
+import {
+	replaceSchemaTypeFromManyOptions,
+	type ReplaceSchemaTypeOptions,
+	stringToStructureCoercions
+} from './replace-schema'
 
 type MapValueError = ReturnType<typeof mapValueError>
 
@@ -127,12 +131,12 @@ export const hasAdditionalProperties = (
 /**
  * Resolve a schema that might be a model reference (string) to the actual schema
  */
- export const resolveSchema = (
+export const resolveSchema = (
 	schema: TAnySchema | string | undefined,
 	models?: Record<string, TAnySchema | StandardSchemaV1Like>,
 	modules?: TModule<any, any>
- ): TAnySchema | StandardSchemaV1Like | undefined => {
-    if (!schema) return undefined
+): TAnySchema | StandardSchemaV1Like | undefined => {
+	if (!schema) return undefined
 	if (typeof schema !== 'string') return schema
 
 	// Check modules first (higher priority)
@@ -143,7 +147,7 @@ export const hasAdditionalProperties = (
 
 	// Then check models
 	return models?.[schema]
- }
+}
 
 export const hasType = (type: string, schema: TAnySchema): boolean => {
 	if (!schema) return false
@@ -165,7 +169,11 @@ export const hasType = (type: string, schema: TAnySchema): boolean => {
 	if (schema.allOf) return schema.allOf.some((s: TSchema) => hasType(type, s))
 
 	if (schema.type === 'array' && schema.items) {
-		if (type === 'Files' && Kind in schema.items && schema.items[Kind] === 'File') {
+		if (
+			type === 'Files' &&
+			Kind in schema.items &&
+			schema.items[Kind] === 'File'
+		) {
 			return true
 		}
 		return hasType(type, schema.items)
@@ -459,18 +467,20 @@ export const getSchemaValidator = <
 			if (!schema) return undefined as any
 		}
 
-		const hasAdditionalCoerce = Array.isArray(additionalCoerce) ?
-		                                additionalCoerce.length > 0 : !!additionalCoerce
+		const hasAdditionalCoerce = Array.isArray(additionalCoerce)
+			? additionalCoerce.length > 0
+			: !!additionalCoerce
+
 		if (Kind in schema) {
 			if (schema[Kind] === 'Import') {
 				if (!hasRef(schema.$defs[schema.$ref])) {
-					schema = schema.$defs[schema.$ref]
+					schema = schema.$defs[schema.$ref] ?? models[schema.$ref]
 
 					if (coerce || hasAdditionalCoerce) {
 						schema = replaceSchema(schema as TSchema)
-						if ('$id' in schema && !schema.$defs) {
-                            schema.$id = `${schema.$id}_coerced_${randomId()}`;
-                        }
+
+						if ('$id' in schema && !schema.$defs)
+							schema.$id = `${schema.$id}_coerced_${randomId()}`
 					}
 				}
 			} else {
@@ -493,6 +503,7 @@ export const getSchemaValidator = <
 	}
 
 	let schema = mapSchema(s)
+	// console.log([s, schema])
 	let _validators = validators
 
 	if (
@@ -696,19 +707,19 @@ export const getSchemaValidator = <
 		)
 			schema.additionalProperties = additionalProperties
 		else
-    		schema = replaceSchemaTypeFromManyOptions(schema, {
-                onlyFirst: "object",
-                from: t.Object({}),
-                to(schema) {
-                    if (!schema.properties) return schema;
-                    if ("additionalProperties" in schema) return schema;
-
-                    return t.Object(schema.properties, {
-                        ...schema,
-                        additionalProperties: false,
-                    });
-                }
-            });
+			schema = replaceSchemaTypeFromManyOptions(schema, {
+				onlyFirst: 'object',
+				from: t.Object({}),
+				to(schema) {
+					if (!schema.properties) return schema
+					if ('additionalProperties' in schema) return schema
+
+					return t.Object(schema.properties, {
+						...schema,
+						additionalProperties: false
+					})
+				}
+			})
 	}
 
 	if (dynamic) {
@@ -1098,7 +1109,10 @@ export const mergeObjectSchemas = (
 				...newSchema.properties,
 				...schema.properties
 			},
-			required: [...(newSchema?.required ?? []), ...(schema.required ?? [])]
+			required: [
+				...(newSchema?.required ?? []),
+				...(schema.required ?? [])
+			]
 		} as TObject
 	}
 

src/types.ts

@@ -545,7 +545,7 @@ export interface UnwrapRoute<
 	query: UnwrapSchema<Schema['query'], Definitions>
 	params: {} extends Schema['params']
 		? ResolvePath<Path>
-		: InputSchema<never> extends Schema
+		: {} extends Schema
 			? ResolvePath<Path>
 			: UnwrapSchema<Schema['params'], Definitions>
 	cookie: UnwrapSchema<Schema['cookie'], Definitions>
@@ -2355,6 +2355,7 @@ export interface ModelValidatorError extends ValueError {
 
 // @ts-ignore trust me bro
 export interface ModelValidator<T> extends TypeCheck<T> {
+	schema: T
 	parse(a: T): T
 	safeParse(a: T):
 		| { success: true; data: T; error: null }

src/utils.ts

@@ -1,6 +1,5 @@
 import type { Sucrose } from './sucrose'
 import type { TraceHandler } from './trace'
-import { timingSafeEqual } from 'crypto'
 
 import type {
 	LifeCycleStore,
@@ -686,21 +685,23 @@ export const signCookie = async (val: string, secret: string | null) => {
 	)
 }
 
-const constantTimeEqual = (a: string, b: string) => {
-	// Compare as UTF-8 bytes; timingSafeEqual requires equal length
-	const ab = Buffer.from(a, 'utf8')
-	const bb = Buffer.from(b, 'utf8')
+const constantTimeEqual =
+	typeof crypto?.timingSafeEqual === 'function'
+		? (a: string, b: string) => {
+				// Compare as UTF-8 bytes; timingSafeEqual requires equal length
+				const ab = Buffer.from(a, 'utf8')
+				const bb = Buffer.from(b, 'utf8')
 
-	if (ab.length !== bb.length) return false
-	return timingSafeEqual(ab, bb)
-}
+				if (ab.length !== bb.length) return false
+				return crypto.timingSafeEqual(ab, bb)
+			}
+		: (a: string, b: string) => a === b
 
 export const unsignCookie = async (input: string, secret: string | null) => {
 	if (typeof input !== 'string')
 		throw new TypeError('Signed cookie string must be provided.')
 
-	if (secret === null)
-		throw new TypeError('Secret key must be provided.')
+	if (secret === null) throw new TypeError('Secret key must be provided.')
 
 	const dot = input.lastIndexOf('.')
 	if (dot <= 0) return false

src/ws/bun.ts

@@ -236,6 +236,16 @@ export interface ServerWebSocket<T = undefined> {
 	 */
 	isSubscribed(topic: string): boolean
 
+	/**
+	 * Returns an array of all topics the client is currently subscribed to.
+	 *
+	 * @example
+	 * ws.subscribe("chat");
+	 * ws.subscribe("notifications");
+	 * console.log(ws.subscriptions); // ["chat", "notifications"]
+	 */
+	readonly subscriptions: string[]
+
 	/**
 	 * Batches `send()` and `publish()` operations, which makes it faster to send data.
 	 *