fix(studio): buffer POST/PUT/PATCH body in Vercel handler to prevent timeout

The outer→inner Hono app delegation pattern passed the @hono/node-server
pseudo-Request directly to the inner app. The pseudo-Request lazily
materialises its body from the Node.js IncomingMessage via Readable.toWeb()
which can hang on Vercel's serverless runtime, causing POST/PUT/PATCH
requests to time out while GET requests work fine.

Fix: for methods with a body, eagerly buffer via arrayBuffer() while the
IncomingMessage is in a known-good state, then create a plain Request for
the inner app. GET/HEAD continue to use the direct pass-through.

Also adds POST/PUT/PATCH/DELETE body forwarding tests for the Vercel
delegation pattern (previously only GET was tested).

Agent-Logs-Url: https://github.com/objectstack-ai/framework/sessions/15d6a2bf-9777-42de-92d4-56a61b26dc77

Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com>

Author: Copilot

apps/studio/CHANGELOG.md

@@ -4,6 +4,22 @@
 
 ### Patch Changes
 
+- **Vercel deployment: Fix POST/PUT/PATCH API requests timing out**
+
+  The outer→inner Hono app delegation pattern (`inner.fetch(c.req.raw)`)
+  passed the `@hono/node-server` pseudo-Request directly to the inner
+  ObjectStack Hono app. The pseudo-Request lazily materialises its body
+  from the Node.js `IncomingMessage` via `Readable.toWeb()` the first
+  time `.json()` / `.text()` is called. On Vercel's serverless runtime
+  the `IncomingMessage` stream can be in a half-consumed state by the
+  time the inner app reads it, causing body reads to hang and the
+  function to time out — while GET requests (no body) worked fine.
+
+  Fix: for POST/PUT/PATCH/DELETE the outer handler now eagerly buffers
+  the request body with `arrayBuffer()` while the `IncomingMessage` is
+  still in a known-good state, then creates a plain `Request` for the
+  inner app. GET/HEAD requests continue to use the direct pass-through.
+
 - Remove `functions` block from `vercel.json` to fix deployment error:
   "The pattern 'api/index.js' defined in `functions` doesn't match any
   Serverless Functions inside the `api` directory."

apps/studio/server/index.ts

@@ -283,7 +283,35 @@ app.all('*', async (c) => {
 
     try {
         const inner = await ensureApp();
-        return await inner.fetch(c.req.raw);
+
+        // ── Body-safe delegation ────────────────────────────────────────
+        // `c.req.raw` is the *pseudo-Request* created by @hono/node-server.
+        // Its body is lazily materialised from the Node.js IncomingMessage
+        // via `Readable.toWeb()` the first time `.json()`, `.text()`, etc.
+        // are called.  On Vercel's serverless runtime the IncomingMessage
+        // stream can already be in a half-consumed state by the time the
+        // inner Hono app reads it, causing `.json()` to hang indefinitely
+        // and the function to time out.
+        //
+        // For GET/HEAD (no body) we can forward the pseudo-Request as-is.
+        // For every other method we eagerly buffer the body while the
+        // IncomingMessage is still in a known-good state, then construct a
+        // plain `Request` that the inner app can consume without issues.
+        // ────────────────────────────────────────────────────────────────
+        const method = c.req.method;
+
+        if (method === 'GET' || method === 'HEAD') {
+            return await inner.fetch(c.req.raw);
+        }
+
+        const rawReq = c.req.raw;
+        const body = await rawReq.arrayBuffer();
+        const forwarded = new Request(rawReq.url, {
+            method,
+            headers: rawReq.headers,
+            body,
+        });
+        return await inner.fetch(forwarded);
     } catch (err: any) {
         console.error('[Vercel] Handler error:', err?.message || err);
         return c.json(

packages/adapters/hono/src/hono.test.ts

@@ -657,6 +657,83 @@ describe('createHonoApp', () => {
       );
     });
 
+    it('POST /api/v1/data/account parses JSON body through outer→inner delegation', async () => {
+      const outerApp = createVercelApp();
+      const body = { name: 'Acme' };
+
+      const res = await outerApp.request('/api/v1/data/account', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      expect(res.status).toBe(200);
+      expect(mockDispatcher.dispatch).toHaveBeenCalledWith(
+        'POST',
+        '/data/account',
+        body,
+        expect.any(Object),
+        expect.objectContaining({ request: expect.anything() }),
+        '/api/v1',
+      );
+    });
+
+    it('PUT /api/v1/data/account parses JSON body through outer→inner delegation', async () => {
+      const outerApp = createVercelApp();
+      const body = { name: 'Updated' };
+
+      const res = await outerApp.request('/api/v1/data/account', {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      expect(res.status).toBe(200);
+      expect(mockDispatcher.dispatch).toHaveBeenCalledWith(
+        'PUT',
+        '/data/account',
+        body,
+        expect.any(Object),
+        expect.objectContaining({ request: expect.anything() }),
+        '/api/v1',
+      );
+    });
+
+    it('PATCH /api/v1/data/account parses JSON body through outer→inner delegation', async () => {
+      const outerApp = createVercelApp();
+      const body = { name: 'Patched' };
+
+      const res = await outerApp.request('/api/v1/data/account', {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      expect(res.status).toBe(200);
+      expect(mockDispatcher.dispatch).toHaveBeenCalledWith(
+        'PATCH',
+        '/data/account',
+        body,
+        expect.any(Object),
+        expect.objectContaining({ request: expect.anything() }),
+        '/api/v1',
+      );
+    });
+
+    it('DELETE /api/v1/data/account routes through outer→inner delegation', async () => {
+      const outerApp = createVercelApp();
+
+      const res = await outerApp.request('/api/v1/data/account', {
+        method: 'DELETE',
+      });
+      expect(res.status).toBe(200);
+      expect(mockDispatcher.dispatch).toHaveBeenCalledWith(
+        'DELETE',
+        '/data/account',
+        undefined,
+        expect.any(Object),
+        expect.objectContaining({ request: expect.anything() }),
+        '/api/v1',
+      );
+    });
+
     it('returns 500 with error details when inner app throws', async () => {
       const outerApp = new Hono();
 
@@ -680,6 +757,153 @@ describe('createHonoApp', () => {
     });
   });
 
+  describe('Body-safe Vercel delegation (buffered body forwarding)', () => {
+    /**
+     * Validates the body-safe delegation pattern used in
+     * `apps/studio/server/index.ts` where the outer handler buffers
+     * POST/PUT/PATCH bodies and creates a fresh `Request` for the inner app.
+     * This avoids @hono/node-server's lazy body materialisation which can
+     * hang on Vercel when the IncomingMessage stream state has changed.
+     */
+    function createBodySafeVercelApp() {
+      const innerApp = createHonoApp({ kernel: mockKernel, prefix: '/api/v1' });
+      const outerApp = new Hono();
+
+      outerApp.all('*', async (c) => {
+        const method = c.req.method;
+
+        // GET/HEAD have no body — pass through directly
+        if (method === 'GET' || method === 'HEAD') {
+          return innerApp.fetch(c.req.raw);
+        }
+
+        // Buffer body and create a fresh Request
+        const rawReq = c.req.raw;
+        const body = await rawReq.arrayBuffer();
+        const forwarded = new Request(rawReq.url, {
+          method,
+          headers: rawReq.headers,
+          body,
+        });
+        return innerApp.fetch(forwarded);
+      });
+
+      return outerApp;
+    }
+
+    it('GET requests work without body buffering', async () => {
+      const outerApp = createBodySafeVercelApp();
+
+      const res = await outerApp.request('/api/v1/data/account');
+      expect(res.status).toBe(200);
+      expect(mockDispatcher.dispatch).toHaveBeenCalledWith(
+        'GET',
+        '/data/account',
+        undefined,
+        expect.any(Object),
+        expect.objectContaining({ request: expect.anything() }),
+        '/api/v1',
+      );
+    });
+
+    it('POST body is forwarded correctly via buffered delegation', async () => {
+      const outerApp = createBodySafeVercelApp();
+      const body = { name: 'Acme Corp' };
+
+      const res = await outerApp.request('/api/v1/data/account', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      expect(res.status).toBe(200);
+      expect(mockDispatcher.dispatch).toHaveBeenCalledWith(
+        'POST',
+        '/data/account',
+        body,
+        expect.any(Object),
+        expect.objectContaining({ request: expect.anything() }),
+        '/api/v1',
+      );
+    });
+
+    it('PUT body is forwarded correctly via buffered delegation', async () => {
+      const outerApp = createBodySafeVercelApp();
+      const body = { name: 'Updated Corp' };
+
+      const res = await outerApp.request('/api/v1/data/account', {
+        method: 'PUT',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      expect(res.status).toBe(200);
+      expect(mockDispatcher.dispatch).toHaveBeenCalledWith(
+        'PUT',
+        '/data/account',
+        body,
+        expect.any(Object),
+        expect.objectContaining({ request: expect.anything() }),
+        '/api/v1',
+      );
+    });
+
+    it('PATCH body is forwarded correctly via buffered delegation', async () => {
+      const outerApp = createBodySafeVercelApp();
+      const body = { status: 'active' };
+
+      const res = await outerApp.request('/api/v1/data/account', {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      });
+      expect(res.status).toBe(200);
+      expect(mockDispatcher.dispatch).toHaveBeenCalledWith(
+        'PATCH',
+        '/data/account',
+        body,
+        expect.any(Object),
+        expect.objectContaining({ request: expect.anything() }),
+        '/api/v1',
+      );
+    });
+
+    it('DELETE without body works via buffered delegation', async () => {
+      const outerApp = createBodySafeVercelApp();
+
+      const res = await outerApp.request('/api/v1/data/account', {
+        method: 'DELETE',
+      });
+      expect(res.status).toBe(200);
+      expect(mockDispatcher.dispatch).toHaveBeenCalledWith(
+        'DELETE',
+        '/data/account',
+        undefined,
+        expect.any(Object),
+        expect.objectContaining({ request: expect.anything() }),
+        '/api/v1',
+      );
+    });
+
+    it('POST with empty body defaults to {} via buffered delegation', async () => {
+      const outerApp = createBodySafeVercelApp();
+
+      const res = await outerApp.request('/api/v1/data/account', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: '',
+      });
+      expect(res.status).toBe(200);
+      // Empty body falls back to {} via .catch(() => ({})) in the adapter
+      expect(mockDispatcher.dispatch).toHaveBeenCalledWith(
+        'POST',
+        '/data/account',
+        {},
+        expect.any(Object),
+        expect.objectContaining({ request: expect.anything() }),
+        '/api/v1',
+      );
+    });
+  });
+
   describe('Vercel deployment endpoint smoke tests', () => {
     /**
      * These tests validate that the two key deployment-health endpoints