@copilotkit/aimock 1.42.1 → 1.43.0

package/dist/ws-responses.js

@@ -1,8 +1,8 @@
 import { DEFAULT_TEST_ID } from "./constants.js";
 import { extractOverrides, flattenHeaders, isContentWithToolCallsResponse, isErrorResponse, isTextResponse, isToolCallResponse, resolveReasoningForModel, resolveResponse, resolveStrictMode, strictNoMatchLogLine, strictNoMatchMessage, strictOverrideField } from "./helpers.js";
-import "./journal.js";
-import { matchFixtureDiagnostic } from "./router.js";
 import { calculateDelay, delay } from "./sse-writer.js";
+import { matchFixtureDiagnostic } from "./router.js";
+import "./journal.js";
 import { createInterruptionSignal } from "./interruption.js";
 import { buildContentWithToolCallsStreamEvents, buildTextStreamEvents, buildToolCallStreamEvents, requestIncludesEncryptedReasoning, requestWantsEncryptedReasoning, responsesToCompletionRequest } from "./responses.js";
 

package/dist/ws-upstream.cjs

@@ -0,0 +1,118 @@
+const require_runtime = require('./_virtual/_rolldown/runtime.cjs');
+const require_ws_framing = require('./ws-framing.cjs');
+let node_http = require("node:http");
+node_http = require_runtime.__toESM(node_http);
+let node_crypto = require("node:crypto");
+let node_https = require("node:https");
+node_https = require_runtime.__toESM(node_https);
+
+//#region src/ws-upstream.ts
+const REFUSAL_BODY_LIMIT = 64 * 1024;
+const UPGRADE_TIMEOUT_MS = 3e4;
+const MAX_TIMER_DELAY_MS = 2147483647;
+const PROVIDER_HEADERS = new Set(["authorization"]);
+/** Connect to a provider using verified TLS, or an explicitly configured loopback test peer.
+* The caller's signal owns the session lifetime; the upgrade budget defaults to thirty seconds.
+*/
+async function connectUpstreamWebSocket(url, headers, limits, signal, upstreamTimeoutMs = UPGRADE_TIMEOUT_MS) {
+	if (!Number.isSafeInteger(upstreamTimeoutMs) || upstreamTimeoutMs <= 0) throw new RangeError("Upstream WebSocket timeout must be a positive safe integer");
+	const target = new URL(url.href);
+	const secure = target.protocol === "https:" || target.protocol === "wss:";
+	const loopback = target.hostname === "localhost" || target.hostname === "[::1]" || /^127\.(?:\d{1,3}\.){2}\d{1,3}$/.test(target.hostname);
+	if (target.username || target.password || target.hash || !secure && (!(target.protocol === "http:" || target.protocol === "ws:") || !loopback)) throw new Error("Invalid upstream WebSocket URL");
+	for (const value of [
+		limits.maxMessageBytes,
+		limits.maxBufferedBytes,
+		limits.maxWriteBytes
+	]) if (value !== void 0 && (!Number.isSafeInteger(value) || value <= 0)) throw new RangeError("WebSocket limits must be positive safe integers");
+	if (signal.aborted) throw new Error("Upstream WebSocket aborted");
+	target.protocol = secure ? "https:" : "http:";
+	const key = (0, node_crypto.randomBytes)(16).toString("base64");
+	const outgoing = {};
+	for (const [name, value] of Object.entries(headers)) if (PROVIDER_HEADERS.has(name.toLowerCase())) outgoing[name.toLowerCase()] = value;
+	Object.assign(outgoing, {
+		Upgrade: "websocket",
+		Connection: "Upgrade",
+		"Sec-WebSocket-Key": key,
+		"Sec-WebSocket-Version": "13"
+	});
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		let connection;
+		const request = (secure ? node_https : node_http).request(target, {
+			method: "GET",
+			headers: outgoing,
+			agent: false,
+			...secure ? { rejectUnauthorized: true } : {}
+		});
+		const started = performance.now();
+		const onTimeout = () => {
+			const remaining = upstreamTimeoutMs - (performance.now() - started);
+			if (remaining > 0) timer = setTimeout(onTimeout, Math.min(remaining, MAX_TIMER_DELAY_MS));
+			else fail("Upstream WebSocket upgrade timed out");
+		};
+		let timer = setTimeout(onTimeout, Math.min(upstreamTimeoutMs, MAX_TIMER_DELAY_MS));
+		const cleanup = () => {
+			clearTimeout(timer);
+			signal.removeEventListener("abort", abort);
+		};
+		const fail = (message) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			request.destroy();
+			reject(new Error(message));
+		};
+		const abort = () => {
+			if (connection) connection.destroy();
+			else fail("Upstream WebSocket aborted");
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		request.on("error", () => fail("Upstream WebSocket connection failed"));
+		request.once("response", (response) => {
+			let bytes = 0;
+			response.on("data", (chunk) => {
+				bytes += chunk.length;
+				if (bytes > REFUSAL_BODY_LIMIT) {
+					fail("Upstream WebSocket refusal body limit exceeded");
+					response.destroy();
+				}
+			});
+			response.once("end", () => fail(`Upstream WebSocket refused (HTTP ${response.statusCode ?? 0})`));
+			response.once("error", () => fail("Upstream WebSocket response failed"));
+			response.once("aborted", () => fail("Upstream WebSocket response failed"));
+		});
+		request.once("upgrade", (response, socket, head) => {
+			if (settled) {
+				socket.destroy();
+				return;
+			}
+			const tokens = (value) => value?.split(",").map((token) => token.trim().toLowerCase()) ?? [];
+			if (response.statusCode !== 101 || !tokens(response.headers.upgrade).includes("websocket") || !tokens(response.headers.connection).includes("upgrade") || response.headers["sec-websocket-accept"] !== require_ws_framing.computeAcceptKey(key) || response.headers["sec-websocket-extensions"] !== void 0 || response.headers["sec-websocket-protocol"] !== void 0) {
+				socket.destroy();
+				fail("Invalid upstream WebSocket upgrade");
+				return;
+			}
+			socket.pause();
+			connection = new require_ws_framing.WebSocketConnection(socket, {
+				maxMessageBytes: limits.maxMessageBytes ?? 1024 * 1024,
+				maxBufferedBytes: limits.maxBufferedBytes ?? 2 * 1024 * 1024,
+				maxWriteBytes: limits.maxWriteBytes ?? 1024 * 1024,
+				maskOutgoing: true
+			});
+			connection.once("close", cleanup);
+			settled = true;
+			clearTimeout(timer);
+			if (head.length) socket.unshift(head);
+			resolve(connection);
+			setImmediate(() => {
+				if (!socket.destroyed) socket.resume();
+			});
+		});
+		request.end();
+	});
+}
+
+//#endregion
+exports.connectUpstreamWebSocket = connectUpstreamWebSocket;
+//# sourceMappingURL=ws-upstream.cjs.map

package/dist/ws-upstream.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-upstream.cjs","names":["https","http","computeAcceptKey","WebSocketConnection"],"sources":["../src/ws-upstream.ts"],"sourcesContent":["import * as http from \"node:http\";\nimport * as https from \"node:https\";\nimport { randomBytes } from \"node:crypto\";\nimport { WebSocketConnection, computeAcceptKey, type WebSocketLimits } from \"./ws-framing.js\";\n\nconst REFUSAL_BODY_LIMIT = 64 * 1024;\nconst UPGRADE_TIMEOUT_MS = 30_000;\nconst MAX_TIMER_DELAY_MS = 2_147_483_647;\n// Reviewed Live startup uses Authorization plus connector-owned RFC 6455 headers.\nconst PROVIDER_HEADERS = new Set([\"authorization\"]);\n\n/** Connect to a provider using verified TLS, or an explicitly configured loopback test peer.\n * The caller's signal owns the session lifetime; the upgrade budget defaults to thirty seconds.\n */\nexport async function connectUpstreamWebSocket(\n  url: URL,\n  headers: Record<string, string>,\n  limits: WebSocketLimits,\n  signal: AbortSignal,\n  upstreamTimeoutMs = UPGRADE_TIMEOUT_MS,\n): Promise<WebSocketConnection> {\n  if (!Number.isSafeInteger(upstreamTimeoutMs) || upstreamTimeoutMs <= 0) {\n    throw new RangeError(\"Upstream WebSocket timeout must be a positive safe integer\");\n  }\n  const target = new URL(url.href);\n  const secure = target.protocol === \"https:\" || target.protocol === \"wss:\";\n  const loopback =\n    target.hostname === \"localhost\" ||\n    target.hostname === \"[::1]\" ||\n    /^127\\.(?:\\d{1,3}\\.){2}\\d{1,3}$/.test(target.hostname);\n  if (\n    target.username ||\n    target.password ||\n    target.hash ||\n    (!secure && (!(target.protocol === \"http:\" || target.protocol === \"ws:\") || !loopback))\n  ) {\n    throw new Error(\"Invalid upstream WebSocket URL\");\n  }\n  for (const value of [limits.maxMessageBytes, limits.maxBufferedBytes, limits.maxWriteBytes]) {\n    if (value !== undefined && (!Number.isSafeInteger(value) || value <= 0))\n      throw new RangeError(\"WebSocket limits must be positive safe integers\");\n  }\n  if (signal.aborted) throw new Error(\"Upstream WebSocket aborted\");\n  target.protocol = secure ? \"https:\" : \"http:\";\n  const key = randomBytes(16).toString(\"base64\");\n  const outgoing: Record<string, string> = {};\n  for (const [name, value] of Object.entries(headers)) {\n    if (PROVIDER_HEADERS.has(name.toLowerCase())) outgoing[name.toLowerCase()] = value;\n  }\n  Object.assign(outgoing, {\n    Upgrade: \"websocket\",\n    Connection: \"Upgrade\",\n    \"Sec-WebSocket-Key\": key,\n    \"Sec-WebSocket-Version\": \"13\",\n  });\n  return new Promise<WebSocketConnection>((resolve, reject) => {\n    let settled = false;\n    let connection: WebSocketConnection | undefined;\n    const request = (secure ? https : http).request(target, {\n      method: \"GET\",\n      headers: outgoing,\n      agent: false,\n      ...(secure ? { rejectUnauthorized: true } : {}),\n    });\n    const started = performance.now();\n    const onTimeout = () => {\n      const remaining = upstreamTimeoutMs - (performance.now() - started);\n      if (remaining > 0) timer = setTimeout(onTimeout, Math.min(remaining, MAX_TIMER_DELAY_MS));\n      else fail(\"Upstream WebSocket upgrade timed out\");\n    };\n    // Node clamps overflowing setTimeout delays to one millisecond. Keep the\n    // full validated budget by scheduling bounded segments against elapsed time.\n    let timer = setTimeout(onTimeout, Math.min(upstreamTimeoutMs, MAX_TIMER_DELAY_MS));\n    const cleanup = () => {\n      clearTimeout(timer);\n      signal.removeEventListener(\"abort\", abort);\n    };\n    const fail = (message: string) => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      request.destroy();\n      reject(new Error(message));\n    };\n    const abort = () => {\n      if (connection) connection.destroy();\n      else fail(\"Upstream WebSocket aborted\");\n    };\n    signal.addEventListener(\"abort\", abort, { once: true });\n    request.on(\"error\", () => fail(\"Upstream WebSocket connection failed\"));\n    request.once(\"response\", (response) => {\n      let bytes = 0;\n      response.on(\"data\", (chunk: Buffer) => {\n        bytes += chunk.length;\n        if (bytes > REFUSAL_BODY_LIMIT) {\n          fail(\"Upstream WebSocket refusal body limit exceeded\");\n          response.destroy();\n        }\n      });\n      response.once(\"end\", () =>\n        fail(`Upstream WebSocket refused (HTTP ${response.statusCode ?? 0})`),\n      );\n      response.once(\"error\", () => fail(\"Upstream WebSocket response failed\"));\n      response.once(\"aborted\", () => fail(\"Upstream WebSocket response failed\"));\n    });\n    request.once(\"upgrade\", (response, socket, head) => {\n      if (settled) {\n        socket.destroy();\n        return;\n      }\n      const tokens = (value: string | undefined) =>\n        value?.split(\",\").map((token) => token.trim().toLowerCase()) ?? [];\n      if (\n        response.statusCode !== 101 ||\n        !tokens(response.headers.upgrade).includes(\"websocket\") ||\n        !tokens(response.headers.connection).includes(\"upgrade\") ||\n        response.headers[\"sec-websocket-accept\"] !== computeAcceptKey(key) ||\n        response.headers[\"sec-websocket-extensions\"] !== undefined ||\n        response.headers[\"sec-websocket-protocol\"] !== undefined\n      ) {\n        socket.destroy();\n        fail(\"Invalid upstream WebSocket upgrade\");\n        return;\n      }\n      socket.pause();\n      connection = new WebSocketConnection(socket, {\n        maxMessageBytes: limits.maxMessageBytes ?? 1024 * 1024,\n        maxBufferedBytes: limits.maxBufferedBytes ?? 2 * 1024 * 1024,\n        maxWriteBytes: limits.maxWriteBytes ?? 1024 * 1024,\n        maskOutgoing: true,\n      });\n      connection.once(\"close\", cleanup);\n      settled = true;\n      clearTimeout(timer);\n      // Pause until the promise consumer can register its message/error listeners.\n      // unshift preserves ordering between upgrade head and subsequent socket bytes.\n      if (head.length) socket.unshift(head);\n      resolve(connection);\n      setImmediate(() => {\n        if (!socket.destroyed) socket.resume();\n      });\n    });\n    request.end();\n  });\n}\n"],"mappings":";;;;;;;;;AAKA,MAAM,qBAAqB,KAAK;AAChC,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAE3B,MAAM,mBAAmB,IAAI,IAAI,CAAC,gBAAgB,CAAC;;;;AAKnD,eAAsB,yBACpB,KACA,SACA,QACA,QACA,oBAAoB,oBACU;AAC9B,KAAI,CAAC,OAAO,cAAc,kBAAkB,IAAI,qBAAqB,EACnE,OAAM,IAAI,WAAW,6DAA6D;CAEpF,MAAM,SAAS,IAAI,IAAI,IAAI,KAAK;CAChC,MAAM,SAAS,OAAO,aAAa,YAAY,OAAO,aAAa;CACnE,MAAM,WACJ,OAAO,aAAa,eACpB,OAAO,aAAa,WACpB,iCAAiC,KAAK,OAAO,SAAS;AACxD,KACE,OAAO,YACP,OAAO,YACP,OAAO,QACN,CAAC,WAAW,EAAE,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU,CAAC,UAE7E,OAAM,IAAI,MAAM,iCAAiC;AAEnD,MAAK,MAAM,SAAS;EAAC,OAAO;EAAiB,OAAO;EAAkB,OAAO;EAAc,CACzF,KAAI,UAAU,WAAc,CAAC,OAAO,cAAc,MAAM,IAAI,SAAS,GACnE,OAAM,IAAI,WAAW,kDAAkD;AAE3E,KAAI,OAAO,QAAS,OAAM,IAAI,MAAM,6BAA6B;AACjE,QAAO,WAAW,SAAS,WAAW;CACtC,MAAM,mCAAkB,GAAG,CAAC,SAAS,SAAS;CAC9C,MAAM,WAAmC,EAAE;AAC3C,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,CACjD,KAAI,iBAAiB,IAAI,KAAK,aAAa,CAAC,CAAE,UAAS,KAAK,aAAa,IAAI;AAE/E,QAAO,OAAO,UAAU;EACtB,SAAS;EACT,YAAY;EACZ,qBAAqB;EACrB,yBAAyB;EAC1B,CAAC;AACF,QAAO,IAAI,SAA8B,SAAS,WAAW;EAC3D,IAAI,UAAU;EACd,IAAI;EACJ,MAAM,WAAW,SAASA,aAAQC,WAAM,QAAQ,QAAQ;GACtD,QAAQ;GACR,SAAS;GACT,OAAO;GACP,GAAI,SAAS,EAAE,oBAAoB,MAAM,GAAG,EAAE;GAC/C,CAAC;EACF,MAAM,UAAU,YAAY,KAAK;EACjC,MAAM,kBAAkB;GACtB,MAAM,YAAY,qBAAqB,YAAY,KAAK,GAAG;AAC3D,OAAI,YAAY,EAAG,SAAQ,WAAW,WAAW,KAAK,IAAI,WAAW,mBAAmB,CAAC;OACpF,MAAK,uCAAuC;;EAInD,IAAI,QAAQ,WAAW,WAAW,KAAK,IAAI,mBAAmB,mBAAmB,CAAC;EAClF,MAAM,gBAAgB;AACpB,gBAAa,MAAM;AACnB,UAAO,oBAAoB,SAAS,MAAM;;EAE5C,MAAM,QAAQ,YAAoB;AAChC,OAAI,QAAS;AACb,aAAU;AACV,YAAS;AACT,WAAQ,SAAS;AACjB,UAAO,IAAI,MAAM,QAAQ,CAAC;;EAE5B,MAAM,cAAc;AAClB,OAAI,WAAY,YAAW,SAAS;OAC/B,MAAK,6BAA6B;;AAEzC,SAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,MAAM,CAAC;AACvD,UAAQ,GAAG,eAAe,KAAK,uCAAuC,CAAC;AACvE,UAAQ,KAAK,aAAa,aAAa;GACrC,IAAI,QAAQ;AACZ,YAAS,GAAG,SAAS,UAAkB;AACrC,aAAS,MAAM;AACf,QAAI,QAAQ,oBAAoB;AAC9B,UAAK,iDAAiD;AACtD,cAAS,SAAS;;KAEpB;AACF,YAAS,KAAK,aACZ,KAAK,oCAAoC,SAAS,cAAc,EAAE,GAAG,CACtE;AACD,YAAS,KAAK,eAAe,KAAK,qCAAqC,CAAC;AACxE,YAAS,KAAK,iBAAiB,KAAK,qCAAqC,CAAC;IAC1E;AACF,UAAQ,KAAK,YAAY,UAAU,QAAQ,SAAS;AAClD,OAAI,SAAS;AACX,WAAO,SAAS;AAChB;;GAEF,MAAM,UAAU,UACd,OAAO,MAAM,IAAI,CAAC,KAAK,UAAU,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE;AACpE,OACE,SAAS,eAAe,OACxB,CAAC,OAAO,SAAS,QAAQ,QAAQ,CAAC,SAAS,YAAY,IACvD,CAAC,OAAO,SAAS,QAAQ,WAAW,CAAC,SAAS,UAAU,IACxD,SAAS,QAAQ,4BAA4BC,oCAAiB,IAAI,IAClE,SAAS,QAAQ,gCAAgC,UACjD,SAAS,QAAQ,8BAA8B,QAC/C;AACA,WAAO,SAAS;AAChB,SAAK,qCAAqC;AAC1C;;AAEF,UAAO,OAAO;AACd,gBAAa,IAAIC,uCAAoB,QAAQ;IAC3C,iBAAiB,OAAO,mBAAmB,OAAO;IAClD,kBAAkB,OAAO,oBAAoB,IAAI,OAAO;IACxD,eAAe,OAAO,iBAAiB,OAAO;IAC9C,cAAc;IACf,CAAC;AACF,cAAW,KAAK,SAAS,QAAQ;AACjC,aAAU;AACV,gBAAa,MAAM;AAGnB,OAAI,KAAK,OAAQ,QAAO,QAAQ,KAAK;AACrC,WAAQ,WAAW;AACnB,sBAAmB;AACjB,QAAI,CAAC,OAAO,UAAW,QAAO,QAAQ;KACtC;IACF;AACF,UAAQ,KAAK;GACb"}

package/dist/ws-upstream.js

@@ -0,0 +1,115 @@
+import { WebSocketConnection, computeAcceptKey } from "./ws-framing.js";
+import * as http$1 from "node:http";
+import { randomBytes } from "node:crypto";
+import * as https from "node:https";
+
+//#region src/ws-upstream.ts
+const REFUSAL_BODY_LIMIT = 64 * 1024;
+const UPGRADE_TIMEOUT_MS = 3e4;
+const MAX_TIMER_DELAY_MS = 2147483647;
+const PROVIDER_HEADERS = new Set(["authorization"]);
+/** Connect to a provider using verified TLS, or an explicitly configured loopback test peer.
+* The caller's signal owns the session lifetime; the upgrade budget defaults to thirty seconds.
+*/
+async function connectUpstreamWebSocket(url, headers, limits, signal, upstreamTimeoutMs = UPGRADE_TIMEOUT_MS) {
+	if (!Number.isSafeInteger(upstreamTimeoutMs) || upstreamTimeoutMs <= 0) throw new RangeError("Upstream WebSocket timeout must be a positive safe integer");
+	const target = new URL(url.href);
+	const secure = target.protocol === "https:" || target.protocol === "wss:";
+	const loopback = target.hostname === "localhost" || target.hostname === "[::1]" || /^127\.(?:\d{1,3}\.){2}\d{1,3}$/.test(target.hostname);
+	if (target.username || target.password || target.hash || !secure && (!(target.protocol === "http:" || target.protocol === "ws:") || !loopback)) throw new Error("Invalid upstream WebSocket URL");
+	for (const value of [
+		limits.maxMessageBytes,
+		limits.maxBufferedBytes,
+		limits.maxWriteBytes
+	]) if (value !== void 0 && (!Number.isSafeInteger(value) || value <= 0)) throw new RangeError("WebSocket limits must be positive safe integers");
+	if (signal.aborted) throw new Error("Upstream WebSocket aborted");
+	target.protocol = secure ? "https:" : "http:";
+	const key = randomBytes(16).toString("base64");
+	const outgoing = {};
+	for (const [name, value] of Object.entries(headers)) if (PROVIDER_HEADERS.has(name.toLowerCase())) outgoing[name.toLowerCase()] = value;
+	Object.assign(outgoing, {
+		Upgrade: "websocket",
+		Connection: "Upgrade",
+		"Sec-WebSocket-Key": key,
+		"Sec-WebSocket-Version": "13"
+	});
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		let connection;
+		const request = (secure ? https : http$1).request(target, {
+			method: "GET",
+			headers: outgoing,
+			agent: false,
+			...secure ? { rejectUnauthorized: true } : {}
+		});
+		const started = performance.now();
+		const onTimeout = () => {
+			const remaining = upstreamTimeoutMs - (performance.now() - started);
+			if (remaining > 0) timer = setTimeout(onTimeout, Math.min(remaining, MAX_TIMER_DELAY_MS));
+			else fail("Upstream WebSocket upgrade timed out");
+		};
+		let timer = setTimeout(onTimeout, Math.min(upstreamTimeoutMs, MAX_TIMER_DELAY_MS));
+		const cleanup = () => {
+			clearTimeout(timer);
+			signal.removeEventListener("abort", abort);
+		};
+		const fail = (message) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			request.destroy();
+			reject(new Error(message));
+		};
+		const abort = () => {
+			if (connection) connection.destroy();
+			else fail("Upstream WebSocket aborted");
+		};
+		signal.addEventListener("abort", abort, { once: true });
+		request.on("error", () => fail("Upstream WebSocket connection failed"));
+		request.once("response", (response) => {
+			let bytes = 0;
+			response.on("data", (chunk) => {
+				bytes += chunk.length;
+				if (bytes > REFUSAL_BODY_LIMIT) {
+					fail("Upstream WebSocket refusal body limit exceeded");
+					response.destroy();
+				}
+			});
+			response.once("end", () => fail(`Upstream WebSocket refused (HTTP ${response.statusCode ?? 0})`));
+			response.once("error", () => fail("Upstream WebSocket response failed"));
+			response.once("aborted", () => fail("Upstream WebSocket response failed"));
+		});
+		request.once("upgrade", (response, socket, head) => {
+			if (settled) {
+				socket.destroy();
+				return;
+			}
+			const tokens = (value) => value?.split(",").map((token) => token.trim().toLowerCase()) ?? [];
+			if (response.statusCode !== 101 || !tokens(response.headers.upgrade).includes("websocket") || !tokens(response.headers.connection).includes("upgrade") || response.headers["sec-websocket-accept"] !== computeAcceptKey(key) || response.headers["sec-websocket-extensions"] !== void 0 || response.headers["sec-websocket-protocol"] !== void 0) {
+				socket.destroy();
+				fail("Invalid upstream WebSocket upgrade");
+				return;
+			}
+			socket.pause();
+			connection = new WebSocketConnection(socket, {
+				maxMessageBytes: limits.maxMessageBytes ?? 1024 * 1024,
+				maxBufferedBytes: limits.maxBufferedBytes ?? 2 * 1024 * 1024,
+				maxWriteBytes: limits.maxWriteBytes ?? 1024 * 1024,
+				maskOutgoing: true
+			});
+			connection.once("close", cleanup);
+			settled = true;
+			clearTimeout(timer);
+			if (head.length) socket.unshift(head);
+			resolve(connection);
+			setImmediate(() => {
+				if (!socket.destroyed) socket.resume();
+			});
+		});
+		request.end();
+	});
+}
+
+//#endregion
+export { connectUpstreamWebSocket };
+//# sourceMappingURL=ws-upstream.js.map

package/dist/ws-upstream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws-upstream.js","names":["http"],"sources":["../src/ws-upstream.ts"],"sourcesContent":["import * as http from \"node:http\";\nimport * as https from \"node:https\";\nimport { randomBytes } from \"node:crypto\";\nimport { WebSocketConnection, computeAcceptKey, type WebSocketLimits } from \"./ws-framing.js\";\n\nconst REFUSAL_BODY_LIMIT = 64 * 1024;\nconst UPGRADE_TIMEOUT_MS = 30_000;\nconst MAX_TIMER_DELAY_MS = 2_147_483_647;\n// Reviewed Live startup uses Authorization plus connector-owned RFC 6455 headers.\nconst PROVIDER_HEADERS = new Set([\"authorization\"]);\n\n/** Connect to a provider using verified TLS, or an explicitly configured loopback test peer.\n * The caller's signal owns the session lifetime; the upgrade budget defaults to thirty seconds.\n */\nexport async function connectUpstreamWebSocket(\n  url: URL,\n  headers: Record<string, string>,\n  limits: WebSocketLimits,\n  signal: AbortSignal,\n  upstreamTimeoutMs = UPGRADE_TIMEOUT_MS,\n): Promise<WebSocketConnection> {\n  if (!Number.isSafeInteger(upstreamTimeoutMs) || upstreamTimeoutMs <= 0) {\n    throw new RangeError(\"Upstream WebSocket timeout must be a positive safe integer\");\n  }\n  const target = new URL(url.href);\n  const secure = target.protocol === \"https:\" || target.protocol === \"wss:\";\n  const loopback =\n    target.hostname === \"localhost\" ||\n    target.hostname === \"[::1]\" ||\n    /^127\\.(?:\\d{1,3}\\.){2}\\d{1,3}$/.test(target.hostname);\n  if (\n    target.username ||\n    target.password ||\n    target.hash ||\n    (!secure && (!(target.protocol === \"http:\" || target.protocol === \"ws:\") || !loopback))\n  ) {\n    throw new Error(\"Invalid upstream WebSocket URL\");\n  }\n  for (const value of [limits.maxMessageBytes, limits.maxBufferedBytes, limits.maxWriteBytes]) {\n    if (value !== undefined && (!Number.isSafeInteger(value) || value <= 0))\n      throw new RangeError(\"WebSocket limits must be positive safe integers\");\n  }\n  if (signal.aborted) throw new Error(\"Upstream WebSocket aborted\");\n  target.protocol = secure ? \"https:\" : \"http:\";\n  const key = randomBytes(16).toString(\"base64\");\n  const outgoing: Record<string, string> = {};\n  for (const [name, value] of Object.entries(headers)) {\n    if (PROVIDER_HEADERS.has(name.toLowerCase())) outgoing[name.toLowerCase()] = value;\n  }\n  Object.assign(outgoing, {\n    Upgrade: \"websocket\",\n    Connection: \"Upgrade\",\n    \"Sec-WebSocket-Key\": key,\n    \"Sec-WebSocket-Version\": \"13\",\n  });\n  return new Promise<WebSocketConnection>((resolve, reject) => {\n    let settled = false;\n    let connection: WebSocketConnection | undefined;\n    const request = (secure ? https : http).request(target, {\n      method: \"GET\",\n      headers: outgoing,\n      agent: false,\n      ...(secure ? { rejectUnauthorized: true } : {}),\n    });\n    const started = performance.now();\n    const onTimeout = () => {\n      const remaining = upstreamTimeoutMs - (performance.now() - started);\n      if (remaining > 0) timer = setTimeout(onTimeout, Math.min(remaining, MAX_TIMER_DELAY_MS));\n      else fail(\"Upstream WebSocket upgrade timed out\");\n    };\n    // Node clamps overflowing setTimeout delays to one millisecond. Keep the\n    // full validated budget by scheduling bounded segments against elapsed time.\n    let timer = setTimeout(onTimeout, Math.min(upstreamTimeoutMs, MAX_TIMER_DELAY_MS));\n    const cleanup = () => {\n      clearTimeout(timer);\n      signal.removeEventListener(\"abort\", abort);\n    };\n    const fail = (message: string) => {\n      if (settled) return;\n      settled = true;\n      cleanup();\n      request.destroy();\n      reject(new Error(message));\n    };\n    const abort = () => {\n      if (connection) connection.destroy();\n      else fail(\"Upstream WebSocket aborted\");\n    };\n    signal.addEventListener(\"abort\", abort, { once: true });\n    request.on(\"error\", () => fail(\"Upstream WebSocket connection failed\"));\n    request.once(\"response\", (response) => {\n      let bytes = 0;\n      response.on(\"data\", (chunk: Buffer) => {\n        bytes += chunk.length;\n        if (bytes > REFUSAL_BODY_LIMIT) {\n          fail(\"Upstream WebSocket refusal body limit exceeded\");\n          response.destroy();\n        }\n      });\n      response.once(\"end\", () =>\n        fail(`Upstream WebSocket refused (HTTP ${response.statusCode ?? 0})`),\n      );\n      response.once(\"error\", () => fail(\"Upstream WebSocket response failed\"));\n      response.once(\"aborted\", () => fail(\"Upstream WebSocket response failed\"));\n    });\n    request.once(\"upgrade\", (response, socket, head) => {\n      if (settled) {\n        socket.destroy();\n        return;\n      }\n      const tokens = (value: string | undefined) =>\n        value?.split(\",\").map((token) => token.trim().toLowerCase()) ?? [];\n      if (\n        response.statusCode !== 101 ||\n        !tokens(response.headers.upgrade).includes(\"websocket\") ||\n        !tokens(response.headers.connection).includes(\"upgrade\") ||\n        response.headers[\"sec-websocket-accept\"] !== computeAcceptKey(key) ||\n        response.headers[\"sec-websocket-extensions\"] !== undefined ||\n        response.headers[\"sec-websocket-protocol\"] !== undefined\n      ) {\n        socket.destroy();\n        fail(\"Invalid upstream WebSocket upgrade\");\n        return;\n      }\n      socket.pause();\n      connection = new WebSocketConnection(socket, {\n        maxMessageBytes: limits.maxMessageBytes ?? 1024 * 1024,\n        maxBufferedBytes: limits.maxBufferedBytes ?? 2 * 1024 * 1024,\n        maxWriteBytes: limits.maxWriteBytes ?? 1024 * 1024,\n        maskOutgoing: true,\n      });\n      connection.once(\"close\", cleanup);\n      settled = true;\n      clearTimeout(timer);\n      // Pause until the promise consumer can register its message/error listeners.\n      // unshift preserves ordering between upgrade head and subsequent socket bytes.\n      if (head.length) socket.unshift(head);\n      resolve(connection);\n      setImmediate(() => {\n        if (!socket.destroyed) socket.resume();\n      });\n    });\n    request.end();\n  });\n}\n"],"mappings":";;;;;;AAKA,MAAM,qBAAqB,KAAK;AAChC,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAE3B,MAAM,mBAAmB,IAAI,IAAI,CAAC,gBAAgB,CAAC;;;;AAKnD,eAAsB,yBACpB,KACA,SACA,QACA,QACA,oBAAoB,oBACU;AAC9B,KAAI,CAAC,OAAO,cAAc,kBAAkB,IAAI,qBAAqB,EACnE,OAAM,IAAI,WAAW,6DAA6D;CAEpF,MAAM,SAAS,IAAI,IAAI,IAAI,KAAK;CAChC,MAAM,SAAS,OAAO,aAAa,YAAY,OAAO,aAAa;CACnE,MAAM,WACJ,OAAO,aAAa,eACpB,OAAO,aAAa,WACpB,iCAAiC,KAAK,OAAO,SAAS;AACxD,KACE,OAAO,YACP,OAAO,YACP,OAAO,QACN,CAAC,WAAW,EAAE,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU,CAAC,UAE7E,OAAM,IAAI,MAAM,iCAAiC;AAEnD,MAAK,MAAM,SAAS;EAAC,OAAO;EAAiB,OAAO;EAAkB,OAAO;EAAc,CACzF,KAAI,UAAU,WAAc,CAAC,OAAO,cAAc,MAAM,IAAI,SAAS,GACnE,OAAM,IAAI,WAAW,kDAAkD;AAE3E,KAAI,OAAO,QAAS,OAAM,IAAI,MAAM,6BAA6B;AACjE,QAAO,WAAW,SAAS,WAAW;CACtC,MAAM,MAAM,YAAY,GAAG,CAAC,SAAS,SAAS;CAC9C,MAAM,WAAmC,EAAE;AAC3C,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,QAAQ,CACjD,KAAI,iBAAiB,IAAI,KAAK,aAAa,CAAC,CAAE,UAAS,KAAK,aAAa,IAAI;AAE/E,QAAO,OAAO,UAAU;EACtB,SAAS;EACT,YAAY;EACZ,qBAAqB;EACrB,yBAAyB;EAC1B,CAAC;AACF,QAAO,IAAI,SAA8B,SAAS,WAAW;EAC3D,IAAI,UAAU;EACd,IAAI;EACJ,MAAM,WAAW,SAAS,QAAQA,QAAM,QAAQ,QAAQ;GACtD,QAAQ;GACR,SAAS;GACT,OAAO;GACP,GAAI,SAAS,EAAE,oBAAoB,MAAM,GAAG,EAAE;GAC/C,CAAC;EACF,MAAM,UAAU,YAAY,KAAK;EACjC,MAAM,kBAAkB;GACtB,MAAM,YAAY,qBAAqB,YAAY,KAAK,GAAG;AAC3D,OAAI,YAAY,EAAG,SAAQ,WAAW,WAAW,KAAK,IAAI,WAAW,mBAAmB,CAAC;OACpF,MAAK,uCAAuC;;EAInD,IAAI,QAAQ,WAAW,WAAW,KAAK,IAAI,mBAAmB,mBAAmB,CAAC;EAClF,MAAM,gBAAgB;AACpB,gBAAa,MAAM;AACnB,UAAO,oBAAoB,SAAS,MAAM;;EAE5C,MAAM,QAAQ,YAAoB;AAChC,OAAI,QAAS;AACb,aAAU;AACV,YAAS;AACT,WAAQ,SAAS;AACjB,UAAO,IAAI,MAAM,QAAQ,CAAC;;EAE5B,MAAM,cAAc;AAClB,OAAI,WAAY,YAAW,SAAS;OAC/B,MAAK,6BAA6B;;AAEzC,SAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,MAAM,CAAC;AACvD,UAAQ,GAAG,eAAe,KAAK,uCAAuC,CAAC;AACvE,UAAQ,KAAK,aAAa,aAAa;GACrC,IAAI,QAAQ;AACZ,YAAS,GAAG,SAAS,UAAkB;AACrC,aAAS,MAAM;AACf,QAAI,QAAQ,oBAAoB;AAC9B,UAAK,iDAAiD;AACtD,cAAS,SAAS;;KAEpB;AACF,YAAS,KAAK,aACZ,KAAK,oCAAoC,SAAS,cAAc,EAAE,GAAG,CACtE;AACD,YAAS,KAAK,eAAe,KAAK,qCAAqC,CAAC;AACxE,YAAS,KAAK,iBAAiB,KAAK,qCAAqC,CAAC;IAC1E;AACF,UAAQ,KAAK,YAAY,UAAU,QAAQ,SAAS;AAClD,OAAI,SAAS;AACX,WAAO,SAAS;AAChB;;GAEF,MAAM,UAAU,UACd,OAAO,MAAM,IAAI,CAAC,KAAK,UAAU,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE;AACpE,OACE,SAAS,eAAe,OACxB,CAAC,OAAO,SAAS,QAAQ,QAAQ,CAAC,SAAS,YAAY,IACvD,CAAC,OAAO,SAAS,QAAQ,WAAW,CAAC,SAAS,UAAU,IACxD,SAAS,QAAQ,4BAA4B,iBAAiB,IAAI,IAClE,SAAS,QAAQ,gCAAgC,UACjD,SAAS,QAAQ,8BAA8B,QAC/C;AACA,WAAO,SAAS;AAChB,SAAK,qCAAqC;AAC1C;;AAEF,UAAO,OAAO;AACd,gBAAa,IAAI,oBAAoB,QAAQ;IAC3C,iBAAiB,OAAO,mBAAmB,OAAO;IAClD,kBAAkB,OAAO,oBAAoB,IAAI,OAAO;IACxD,eAAe,OAAO,iBAAiB,OAAO;IAC9C,cAAc;IACf,CAAC;AACF,cAAW,KAAK,SAAS,QAAQ;AACjC,aAAU;AACV,gBAAa,MAAM;AAGnB,OAAI,KAAK,OAAQ,QAAO,QAAQ,KAAK;AACrC,WAAQ,WAAW;AACnB,sBAAmB;AACjB,QAAI,CAAC,OAAO,UAAW,QAAO,QAAQ;KACtC;IACF;AACF,UAAQ,KAAK;GACb"}