@agentmesh-p2p/sdk 0.0.0-stage → 0.1.0

package/dist/gen/datalog.js

@@ -0,0 +1,84 @@
+// Code generated by hack/gen-sdk-datalog from api/datalog.go; DO NOT EDIT.
+/** The Datalog a provider evaluates against a caller's biscuit. */
+export const BASELINE_DATALOG = {
+    "_comment": "Generated by hack/gen-sdk-datalog from api/datalog.go; do not edit.",
+    "policies": [
+        "allow if service($type, $name), granted_service_exact($type, $name)",
+        "allow if service($type, $name), granted_service_set($type, $set), $set.contains($name)",
+        "allow if service($type, $name), granted_service_prefix($type, $prefix), $name.starts_with($prefix)",
+        "allow if service($type, $name), granted_service_suffix($type, $suffix), $name.ends_with($suffix)",
+        "allow if service($type, $name), granted_service_all($type)",
+        "allow if service($type, $name), granted_service_all_types(true)"
+    ],
+    "publish_policies": [
+        "allow if publish($type, $name), granted_publish_exact($type, $name)",
+        "allow if publish($type, $name), granted_publish_set($type, $set), $set.contains($name)",
+        "allow if publish($type, $name), granted_publish_prefix($type, $prefix), $name.starts_with($prefix)",
+        "allow if publish($type, $name), granted_publish_suffix($type, $suffix), $name.ends_with($suffix)",
+        "allow if publish($type, $name), granted_publish_all($type)",
+        "allow if publish($type, $name), granted_publish_all_types(true)"
+    ],
+    "rules": [
+        "allow_network_target($fact, $val) <- target_fact($fact, $val), granted_target_exact($fact, $val)",
+        "allow_network_target($fact, $val) <- target_fact($fact, $val), granted_target_set($fact, $set), $set.contains($val)",
+        "allow_network_target($fact, $val) <- target_fact($fact, $val), granted_target_prefix($fact, $prefix), $val.starts_with($prefix)",
+        "allow_network_target($fact, $val) <- target_fact($fact, $val), granted_target_suffix($fact, $suffix), $val.ends_with($suffix)",
+        "allow_network_target($fact, $val) <- target_fact($fact, $val), granted_target_all($fact)",
+        "allow_network_target($fact, $val) <- target_fact($fact, $val), granted_target_all_facts(true)"
+    ],
+    "http_rules": [
+        "http_method_ok($t, $k) <- method($m), granted_method($t, $k, $set), $set.contains($m)",
+        "http_method_ok($t, $k) <- method($m), !($m == \"CONNECT\"), granted_method_any($t, $k)",
+        "http_path_ok($t, $k) <- path($p), granted_path_exact($t, $k, $set), $set.contains($p)",
+        "http_path_ok($t, $k) <- path($p), granted_path_prefix($t, $k, $prefix), $p.starts_with($prefix)",
+        "http_path_ok($t, $k) <- path($p), $p.starts_with(\"/\"), granted_path_any($t, $k)",
+        "granted_service_exact($t, $n) <- service($t, $n), http_granted_service_exact($t, $n), http_method_ok($t, $n), http_path_ok($t, $n)",
+        "granted_service_suffix($t, $s) <- service($t, $n), http_granted_service_suffix($t, $s), $n.ends_with($s), http_method_ok($t, $s), http_path_ok($t, $s)",
+        "granted_service_prefix($t, $p) <- service($t, $n), http_granted_service_prefix($t, $p), $n.starts_with($p), http_method_ok($t, $p), http_path_ok($t, $p)",
+        "granted_service_all($t) <- service($t, $n), http_granted_service_all($t), http_method_ok($t, \"*\"), http_path_ok($t, \"*\")",
+        "granted_service_all_types(true) <- service($t, $n), http_granted_service_all_types(true), http_method_ok(\"*\", \"*\"), http_path_ok(\"*\", \"*\")"
+    ],
+    "target_fact_rules": [
+        "target_fact(\"email\", $val) <- email($val)",
+        "target_fact(\"group\", $val) <- group($val)",
+        "target_fact(\"idp_role\", $val) <- idp_role($val)",
+        "target_fact(\"node\", $val) <- node($val)",
+        "target_fact(\"user\", $val) <- user($val)"
+    ],
+    "replay_check": "check if client_peer_id($id), connection_peer_id($id)",
+    "target_check": "check if allow_network_target($fact, $val) or target_unrestricted(true)",
+    "time_check": "check if time($time), expiration($exp), $time <= $exp",
+    "allow_if_true": "allow if true",
+    "fact_node": "node",
+    "fact_client_peer_id": "client_peer_id",
+    "fact_actor_node": "actor_node",
+    "fact_service": "service",
+    "fact_connection_peer_id": "connection_peer_id",
+    "fact_method": "method",
+    "fact_path": "path",
+    "fact_time": "time",
+    "fact_role": "role",
+    "fact_target_fact": "target_fact",
+    "fact_publish": "publish",
+    "catalog_target": "mesh.catalog",
+    "fact_tar_block": "tar_block",
+    "tar_block_source_pattern": "^tar_block\\(\"([A-Za-z0-9_-]+)\"\\);?\\s*$",
+    "http_method_syntax": "^[A-Z][A-Z0-9-]{0,31}$",
+    "max_attenuation_blocks": 8,
+    "max_tar_bytes": 4096,
+    "max_rules_per_tar": 16,
+    "max_entries_per_tar_list": 64,
+    "max_tar_name_length": 128,
+    "max_tar_description_length": 256,
+    "max_tar_resource_length": 256,
+    "marker_term": "true",
+    "system_namespace": "mesh:system",
+    "binding_member_prefixes": [
+        "email",
+        "group",
+        "idp_role",
+        "node",
+        "user"
+    ],
+    "system_authenticated_member": "mesh:system:authenticated"
+};

package/dist/host.d.ts

@@ -0,0 +1,47 @@
+import { type GossipSub } from "@libp2p/gossipsub";
+import type { Libp2p } from "@libp2p/interface";
+import type { Multiaddr } from "@multiformats/multiaddr";
+import { type Libp2pOptions } from "libp2p";
+import type { Identity } from "./identity.ts";
+export interface MeshHostOptions {
+    /**
+     * Addresses to accept direct connections on, e.g. "/ip4/0.0.0.0/tcp/0"
+     * or "/ip4/0.0.0.0/tcp/0/ws". Empty by default: an agent is reached
+     * through a router's relay.
+     */
+    listenAddrs?: string[];
+    /**
+     * Peers the control plane has banned. Consulted for every dial and every
+     * inbound connection, as agentmesh-node's connection gater; the session keeps
+     * it current from /info and the gossip events.
+     */
+    banned?: {
+        has(peerId: string): boolean;
+    };
+    /** The resolver for `/dnsaddr` and `/dns*` addresses; the system's by default. */
+    dns?: Libp2pOptions["dns"];
+}
+/** The services a mesh host runs; `services.pubsub` carries the control plane's events. */
+export type MeshHost = Libp2p<{
+    pubsub: GossipSub;
+}>;
+export declare function createMeshHost(identity: Identity, options?: MeshHostOptions): Promise<MeshHost>;
+/** The relay listener a member holds, to ask for its reservation again. */
+export interface RelayListener {
+    listen(addr: Multiaddr): Promise<void>;
+}
+/**
+ * Starts listening on a relay after the caller has authenticated with it,
+ * and returns the listener. js-libp2p reserves a relay slot when it starts
+ * listening on `<relay>/p2p-circuit`; a router refuses that until the peer
+ * has passed the auth handshake, so the listen cannot be part of the host's
+ * config. The transport manager is not on the public Libp2p interface.
+ *
+ * The reservation goes with the connection it was made on: a router that
+ * restarts or trims the connection drops it, and js-libp2p does not ask a
+ * configured relay again. Calling `listen` on the returned listener does,
+ * without registering a second listener.
+ *
+ * Upstream: libp2p/js-libp2p#3645 (listen after start), #3601 (re-reserve).
+ */
+export declare function listenThroughRelay(node: Libp2p, relayAddr: Multiaddr): Promise<RelayListener>;

package/dist/host.js

@@ -0,0 +1,109 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// The libp2p host a member joins the mesh with, configured the way
+// agentmesh-node's is (internal/node/node.go): yamux the muxer, circuit relay v2
+// for reachability through the routers. Transports and the security
+// protocol come from the runtime (platform/transports.ts): on Node TCP and
+// WebSocket with TLS, in a browser WebSocket with Noise.
+import { yamux } from "@chainsafe/libp2p-yamux";
+import { circuitRelayTransport } from "@libp2p/circuit-relay-v2";
+import { privateKeyFromProtobuf } from "@libp2p/crypto/keys";
+import { gossipsub } from "@libp2p/gossipsub";
+import { identify, identifyPush } from "@libp2p/identify";
+import { ping } from "@libp2p/ping";
+import { createLibp2p } from "libp2p";
+import { connectionEncrypters, transports } from "./platform/transports.js";
+/** The floodsub protocol, the one a member speaks (see leafPubsub). */
+const FLOODSUB_PROTOCOL = "/floodsub/1.0.0";
+/**
+ * A member is a leaf of the gossip: it speaks floodsub only, so a router
+ * delivers every control plane event to it outright and it takes no part
+ * in the routers' gossipsub mesh, its heartbeats, grafts and peer exchange.
+ * The gossipsub implementation serves as the floodsub one, told to register
+ * that protocol alone; the message envelope is the same.
+ */
+function leafPubsub() {
+    // StrictSign, as every Go component pins it: the pubsub envelope is
+    // signed by the author, and the event inside by the control plane.
+    const build = gossipsub({ globalSignaturePolicy: "StrictSign", allowPublishToZeroTopicPeers: true, emitSelf: false });
+    return (components) => {
+        const ps = build(components);
+        ps.protocols = [FLOODSUB_PROTOCOL];
+        return ps;
+    };
+}
+export async function createMeshHost(identity, options = {}) {
+    const banned = options.banned ?? { has: () => false };
+    const denyBanned = (peerId) => banned.has(peerId.toString());
+    return createLibp2p({
+        privateKey: privateKeyFromProtobuf(identity.toLibp2pPrivateKey()),
+        addresses: { listen: options.listenAddrs ?? [] },
+        ...(options.dns !== undefined ? { dns: options.dns } : {}),
+        transports: [...transports(), circuitRelayTransport()],
+        connectionEncrypters: connectionEncrypters(),
+        streamMuxers: [yamux()],
+        connectionManager: {
+            inboundConnectionThreshold: Infinity,
+        },
+        connectionGater: {
+            denyDialPeer: denyBanned,
+            denyInboundEncryptedConnection: denyBanned,
+            denyInboundRelayedConnection: (_relay, remotePeer) => denyBanned(remotePeer),
+            // The addresses dialled are the routers' as the control plane
+            // published them, and every connection is authenticated by peer ID
+            // whatever the address, so no address is refused for its shape. In a
+            // browser js-libp2p would otherwise skip loopback and plain ws://
+            // addresses, which is what agentmesh-one on the same machine advertises; a
+            // page on https cannot open ws:// anyway, the browser sees to that.
+            denyDialMultiaddr: () => false,
+        },
+        services: {
+            identify: identify(),
+            // A member's addresses change after it connects: the relay address
+            // arrives with the reservation, which follows the auth handshake.
+            // Identify alone tells a router the addresses at connect time; push
+            // tells the routers already connected, the reservation's own among
+            // them, where the member is reached now, as agentmesh-node does.
+            identifyPush: identifyPush(),
+            ping: ping(),
+            // The control plane's events reach members through the routers.
+            pubsub: leafPubsub(),
+        },
+    });
+}
+/**
+ * Starts listening on a relay after the caller has authenticated with it,
+ * and returns the listener. js-libp2p reserves a relay slot when it starts
+ * listening on `<relay>/p2p-circuit`; a router refuses that until the peer
+ * has passed the auth handshake, so the listen cannot be part of the host's
+ * config. The transport manager is not on the public Libp2p interface.
+ *
+ * The reservation goes with the connection it was made on: a router that
+ * restarts or trims the connection drops it, and js-libp2p does not ask a
+ * configured relay again. Calling `listen` on the returned listener does,
+ * without registering a second listener.
+ *
+ * Upstream: libp2p/js-libp2p#3645 (listen after start), #3601 (re-reserve).
+ */
+export async function listenThroughRelay(node, relayAddr) {
+    const internals = node;
+    const manager = internals.components.transportManager;
+    const before = new Set(manager.getListeners());
+    await manager.listen([relayAddr.encapsulate("/p2p-circuit")]);
+    const listener = manager.getListeners().find((l) => !before.has(l));
+    if (listener === undefined) {
+        throw new Error("libp2p registered no listener for the relay address");
+    }
+    return listener;
+}

package/dist/http1.d.ts

@@ -0,0 +1,68 @@
+import type { Stream } from "@libp2p/interface";
+/** Longest request or response head (start line and headers) accepted. */
+export declare const MAX_HEAD_BYTES: number;
+/** Where bytes come from: a chunk, or null when no more will arrive. */
+export interface ByteSource {
+    read(): Promise<Uint8Array | null>;
+}
+/** Reads a libp2p stream, holding the remote back while nobody is reading. */
+export declare function streamSource(stream: Stream): ByteSource;
+/** Sends to a libp2p stream, waiting for the remote when the send buffer is full. */
+export declare function sendAll(stream: Stream, data: Uint8Array): Promise<void>;
+export declare class HTTPParseError extends Error {
+    constructor(message: string);
+}
+/** Bytes from a source with lookahead: lines and exact counts. */
+export declare class ByteReader {
+    #private;
+    constructor(source: ByteSource);
+    /** One CRLF-terminated line without its terminator, at most limit bytes; null at end of input before any byte. */
+    readLine(limit: number): Promise<string | null>;
+    /** Exactly n bytes, or throws at end of input. */
+    readExactly(n: number): Promise<Uint8Array>;
+    /** Whatever is available next, at most n bytes; null at end of input. */
+    readSome(n: number): Promise<Uint8Array | null>;
+}
+export interface RequestHead {
+    method: string;
+    target: string;
+    headers: Headers;
+}
+export interface ResponseHead {
+    status: number;
+    statusText: string;
+    headers: Headers;
+}
+/** The request line and headers, as a server reads them. */
+export declare function readRequestHead(reader: ByteReader): Promise<RequestHead | null>;
+/** The status line and headers, as a client reads them. */
+export declare function readResponseHead(reader: ByteReader): Promise<ResponseHead>;
+/** How the bytes after a head are delimited. */
+export type BodyFraming = {
+    kind: "none";
+} | {
+    kind: "length";
+    length: number;
+} | {
+    kind: "chunked";
+} | {
+    kind: "until-close";
+};
+/** A request body without Content-Length or Transfer-Encoding is empty (RFC 9112 section 6.3). */
+export declare function requestBodyFraming(head: RequestHead): BodyFraming;
+/** A response body ends where the sender says, or with the stream. */
+export declare function responseBodyFraming(method: string, head: ResponseHead): BodyFraming;
+/** The body bytes, as the framing delimits them, in the pieces they arrive. */
+export declare function bodyChunks(reader: ByteReader, framing: BodyFraming): AsyncGenerator<Uint8Array>;
+/** A whole body, refused past the limit. */
+export declare function readBody(reader: ByteReader, framing: BodyFraming, limit: number): Promise<Uint8Array<ArrayBuffer>>;
+/** The body as a web stream; onDone runs once it is drained, failed or cancelled. */
+export declare function bodyStream(reader: ByteReader, framing: BodyFraming, onDone: (err?: Error) => void): ReadableStream<Uint8Array>;
+/** A request head on the wire. */
+export declare function encodeRequestHead(method: string, target: string, headers: Headers): Uint8Array;
+/** A response head on the wire. */
+export declare function encodeResponseHead(status: number, statusText: string, headers: Headers): Uint8Array;
+/** One chunk of a chunked body. */
+export declare function encodeChunk(data: Uint8Array): Uint8Array;
+/** The end of a chunked body. */
+export declare const LAST_CHUNK: Uint8Array<ArrayBuffer>;

package/dist/http1.js

@@ -0,0 +1,371 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+import { concatBytes } from "./bytes.js";
+/** Longest request or response head (start line and headers) accepted. */
+export const MAX_HEAD_BYTES = 64 * 1024;
+const MAX_CHUNK_LINE_BYTES = 1024;
+const CR = 0x0d;
+const LF = 0x0a;
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+/** Reads a libp2p stream, holding the remote back while nobody is reading. */
+export function streamSource(stream) {
+    const queue = [];
+    let ended = false;
+    let waiter;
+    const wake = () => {
+        waiter?.();
+        waiter = undefined;
+    };
+    stream.addEventListener("message", (evt) => {
+        queue.push(evt.data.subarray());
+        stream.pause();
+        wake();
+    });
+    const end = () => {
+        ended = true;
+        wake();
+    };
+    // 'end' fires once the read buffer has drained after the remote closed its
+    // writable end; 'remoteCloseWrite' can fire while data is still buffered.
+    stream.addEventListener("end", end);
+    stream.addEventListener("close", end);
+    if (stream.readableEnded) {
+        ended = true;
+    }
+    return {
+        async read() {
+            for (;;) {
+                const next = queue.shift();
+                if (next !== undefined) {
+                    if (queue.length === 0 && !ended) {
+                        stream.resume();
+                    }
+                    return next;
+                }
+                if (ended) {
+                    return null;
+                }
+                stream.resume();
+                await new Promise((resolve) => {
+                    waiter = resolve;
+                });
+            }
+        },
+    };
+}
+/** Sends to a libp2p stream, waiting for the remote when the send buffer is full. */
+export async function sendAll(stream, data) {
+    if (data.length === 0) {
+        return;
+    }
+    if (!stream.send(data)) {
+        await stream.onDrain();
+    }
+}
+export class HTTPParseError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "HTTPParseError";
+    }
+}
+/** Bytes from a source with lookahead: lines and exact counts. */
+export class ByteReader {
+    #source;
+    #buf = new Uint8Array(0);
+    #eof = false;
+    constructor(source) {
+        this.#source = source;
+    }
+    async #fill() {
+        if (this.#eof) {
+            return false;
+        }
+        const next = await this.#source.read();
+        if (next === null) {
+            this.#eof = true;
+            return false;
+        }
+        this.#buf = this.#buf.length === 0 ? next : concatBytes(this.#buf, next);
+        return true;
+    }
+    /** One CRLF-terminated line without its terminator, at most limit bytes; null at end of input before any byte. */
+    async readLine(limit) {
+        for (;;) {
+            const lf = this.#buf.indexOf(LF);
+            if (lf !== -1) {
+                const end = lf > 0 && this.#buf[lf - 1] === CR ? lf - 1 : lf;
+                if (end > limit) {
+                    throw new HTTPParseError(`line exceeds ${limit} bytes`);
+                }
+                const line = decoder.decode(this.#buf.subarray(0, end));
+                this.#buf = this.#buf.subarray(lf + 1);
+                return line;
+            }
+            // Room for the CRLF of a line exactly at the limit.
+            if (this.#buf.length > limit + 2) {
+                throw new HTTPParseError(`line exceeds ${limit} bytes`);
+            }
+            if (!(await this.#fill())) {
+                if (this.#buf.length === 0) {
+                    return null;
+                }
+                throw new HTTPParseError("unexpected end of input in a line");
+            }
+        }
+    }
+    /** Exactly n bytes, or throws at end of input. */
+    async readExactly(n) {
+        while (this.#buf.length < n) {
+            if (!(await this.#fill())) {
+                throw new HTTPParseError(`unexpected end of input after ${this.#buf.length} of ${n} bytes`);
+            }
+        }
+        const out = this.#buf.slice(0, n);
+        this.#buf = this.#buf.subarray(n);
+        return out;
+    }
+    /** Whatever is available next, at most n bytes; null at end of input. */
+    async readSome(n) {
+        if (this.#buf.length === 0 && !(await this.#fill())) {
+            return null;
+        }
+        const take = Math.min(n, this.#buf.length);
+        const out = this.#buf.slice(0, take);
+        this.#buf = this.#buf.subarray(take);
+        return out;
+    }
+}
+const TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+async function readHeaders(reader, budget) {
+    const headers = new Headers();
+    for (;;) {
+        const line = await reader.readLine(budget);
+        if (line === null) {
+            throw new HTTPParseError("unexpected end of input in headers");
+        }
+        if (line === "") {
+            return headers;
+        }
+        budget -= line.length + 2;
+        if (budget < 0) {
+            throw new HTTPParseError(`head exceeds ${MAX_HEAD_BYTES} bytes`);
+        }
+        const colon = line.indexOf(":");
+        if (colon <= 0 || line[0] === " " || line[0] === "\t") {
+            throw new HTTPParseError(`malformed header line ${JSON.stringify(line)}`);
+        }
+        const name = line.slice(0, colon);
+        if (!TOKEN.test(name)) {
+            throw new HTTPParseError(`malformed header name ${JSON.stringify(name)}`);
+        }
+        headers.append(name, line.slice(colon + 1).trim());
+    }
+}
+/** The request line and headers, as a server reads them. */
+export async function readRequestHead(reader) {
+    const line = await reader.readLine(MAX_HEAD_BYTES);
+    if (line === null) {
+        return null;
+    }
+    const parts = line.split(" ");
+    if (parts.length !== 3 || !TOKEN.test(parts[0]) || parts[1] === "" || !/^HTTP\/1\.[01]$/.test(parts[2])) {
+        throw new HTTPParseError(`malformed request line ${JSON.stringify(line)}`);
+    }
+    const headers = await readHeaders(reader, MAX_HEAD_BYTES - line.length - 2);
+    return { method: parts[0], target: parts[1], headers };
+}
+/** The status line and headers, as a client reads them. */
+export async function readResponseHead(reader) {
+    const line = await reader.readLine(MAX_HEAD_BYTES);
+    if (line === null) {
+        throw new HTTPParseError("no response");
+    }
+    const m = /^HTTP\/1\.[01] (\d{3})(?: (.*))?$/.exec(line);
+    if (m === null) {
+        throw new HTTPParseError(`malformed status line ${JSON.stringify(line)}`);
+    }
+    const headers = await readHeaders(reader, MAX_HEAD_BYTES - line.length - 2);
+    return { status: Number(m[1]), statusText: m[2] ?? "", headers };
+}
+function framingOf(headers, whenUnframed) {
+    const te = headers.get("transfer-encoding");
+    if (te !== null) {
+        const codings = te.split(",").map((c) => c.trim().toLowerCase());
+        if (codings.at(-1) !== "chunked" || codings.length !== 1) {
+            throw new HTTPParseError(`unsupported transfer-encoding ${JSON.stringify(te)}`);
+        }
+        return { kind: "chunked" };
+    }
+    const cl = headers.get("content-length");
+    if (cl !== null) {
+        const values = new Set(cl.split(",").map((v) => v.trim()));
+        if (values.size !== 1 || !/^\d{1,15}$/.test(cl.split(",")[0]?.trim() ?? "")) {
+            throw new HTTPParseError(`malformed content-length ${JSON.stringify(cl)}`);
+        }
+        const length = Number(values.values().next().value);
+        return length === 0 ? { kind: "none" } : { kind: "length", length };
+    }
+    return whenUnframed;
+}
+/** A request body without Content-Length or Transfer-Encoding is empty (RFC 9112 section 6.3). */
+export function requestBodyFraming(head) {
+    return framingOf(head.headers, { kind: "none" });
+}
+/** A response body ends where the sender says, or with the stream. */
+export function responseBodyFraming(method, head) {
+    if (method === "HEAD" || head.status === 204 || head.status === 304 || (head.status >= 100 && head.status < 200)) {
+        return { kind: "none" };
+    }
+    return framingOf(head.headers, { kind: "until-close" });
+}
+async function* chunkedBody(reader) {
+    for (;;) {
+        const line = await reader.readLine(MAX_CHUNK_LINE_BYTES);
+        if (line === null) {
+            throw new HTTPParseError("unexpected end of input in chunked body");
+        }
+        // The whole size token must be hex, else "5g" would read as 5 and the
+        // two ends would disagree on where the chunk ends. Eight digits bound
+        // the size to 4 GiB, well within what parseInt represents exactly.
+        const sizeText = line.split(";")[0].trim();
+        if (!/^[0-9A-Fa-f]{1,8}$/.test(sizeText)) {
+            throw new HTTPParseError(`malformed chunk size ${JSON.stringify(line)}`);
+        }
+        const size = parseInt(sizeText, 16);
+        if (size === 0) {
+            // Trailer fields, then the empty line that ends the message.
+            for (let t = await reader.readLine(MAX_HEAD_BYTES); t !== ""; t = await reader.readLine(MAX_HEAD_BYTES)) {
+                if (t === null) {
+                    throw new HTTPParseError("unexpected end of input in trailers");
+                }
+            }
+            return;
+        }
+        let remaining = size;
+        while (remaining > 0) {
+            const part = await reader.readSome(remaining);
+            if (part === null) {
+                throw new HTTPParseError("unexpected end of input in a chunk");
+            }
+            remaining -= part.length;
+            yield part;
+        }
+        if ((await reader.readLine(2)) !== "") {
+            throw new HTTPParseError("chunk data not followed by CRLF");
+        }
+    }
+}
+/** The body bytes, as the framing delimits them, in the pieces they arrive. */
+export async function* bodyChunks(reader, framing) {
+    switch (framing.kind) {
+        case "none":
+            return;
+        case "length": {
+            let remaining = framing.length;
+            while (remaining > 0) {
+                const part = await reader.readSome(remaining);
+                if (part === null) {
+                    throw new HTTPParseError(`body ended ${remaining} bytes short of content-length`);
+                }
+                remaining -= part.length;
+                yield part;
+            }
+            return;
+        }
+        case "chunked":
+            yield* chunkedBody(reader);
+            return;
+        case "until-close":
+            for (let part = await reader.readSome(64 * 1024); part !== null; part = await reader.readSome(64 * 1024)) {
+                yield part;
+            }
+            return;
+    }
+}
+/** A whole body, refused past the limit. */
+export async function readBody(reader, framing, limit) {
+    if (framing.kind === "length" && framing.length > limit) {
+        throw new HTTPParseError(`body of ${framing.length} bytes exceeds ${limit}`);
+    }
+    const parts = [];
+    let size = 0;
+    for await (const part of bodyChunks(reader, framing)) {
+        size += part.length;
+        if (size > limit) {
+            throw new HTTPParseError(`body exceeds ${limit} bytes`);
+        }
+        parts.push(part);
+    }
+    return concatBytes(...parts);
+}
+/** The body as a web stream; onDone runs once it is drained, failed or cancelled. */
+export function bodyStream(reader, framing, onDone) {
+    const chunks = bodyChunks(reader, framing);
+    let done = false;
+    const finish = (err) => {
+        if (!done) {
+            done = true;
+            onDone(err);
+        }
+    };
+    return new ReadableStream({
+        async pull(controller) {
+            try {
+                const next = await chunks.next();
+                if (next.done) {
+                    controller.close();
+                    finish();
+                }
+                else {
+                    controller.enqueue(next.value);
+                }
+            }
+            catch (err) {
+                const e = err instanceof Error ? err : new Error(String(err));
+                controller.error(e);
+                finish(e);
+            }
+        },
+        async cancel(reason) {
+            // The stream is torn down first, so a read the generator is blocked on ends.
+            finish(reason instanceof Error ? reason : new Error(String(reason)));
+            await chunks.return(undefined).catch(() => { });
+        },
+    });
+}
+function headerLines(headers) {
+    let out = "";
+    headers.forEach((value, name) => {
+        if (/[\r\n]/.test(value)) {
+            throw new HTTPParseError(`header ${name} contains a line break`);
+        }
+        out += `${name}: ${value}\r\n`;
+    });
+    return out;
+}
+/** A request head on the wire. */
+export function encodeRequestHead(method, target, headers) {
+    return encoder.encode(`${method} ${target} HTTP/1.1\r\n${headerLines(headers)}\r\n`);
+}
+/** A response head on the wire. */
+export function encodeResponseHead(status, statusText, headers) {
+    return encoder.encode(`HTTP/1.1 ${status} ${statusText.replace(/[\r\n]/g, " ")}\r\n${headerLines(headers)}\r\n`);
+}
+/** One chunk of a chunked body. */
+export function encodeChunk(data) {
+    return concatBytes(encoder.encode(`${data.length.toString(16)}\r\n`), data, encoder.encode("\r\n"));
+}
+/** The end of a chunked body. */
+export const LAST_CHUNK = encoder.encode("0\r\n\r\n");