@earendil-works/chord 1.3.0 → 1.5.0

package/dist/next/store/text.d.ts

@@ -0,0 +1,14 @@
+/** Compares `a` and `b` by code point: negative, zero or positive. */
+export declare function compareText(a: string, b: string): number;
+/**
+ * `text` as the store keeps it: a lone surrogate replaced by U+FFFD (copied only when one occurs), NUL refused
+ * `invalid/args` (`what` names the value). Plugin strings are a trust boundary.
+ */
+export declare function storedText(text: string, what: string): string;
+/**
+ * The smallest string above every string starting with `prefix`, in code point order: the next code point after its
+ * last, carrying past U+10FFFF; `undefined` when there is none (`""` and all-U+10FFFF prefixes). `prefix` is
+ * well-formed.
+ */
+export declare function prefixUpperBound(prefix: string): string | undefined;
+//# sourceMappingURL=text.d.ts.map

package/dist/next/store/text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.d.ts","sourceRoot":"","sources":["../../../src/next/store/text.ts"],"names":[],"mappings":"AAMA,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAQxD;AAWD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUnE"}

package/dist/next/store/text.js

@@ -0,0 +1,51 @@
+// Text in the store (decision "Text is plain UTF-8, in code point order"): Chord compares strings by code point, as
+// SQLite's BINARY collation compares their UTF-8 bytes, never by JavaScript's UTF-16 code units; every stored string
+// is well-formed and free of NUL, and a prefix becomes a range by its upper bound.
+import { invalid } from "../data/internal.js";
+/** Compares `a` and `b` by code point: negative, zero or positive. */
+export function compareText(a, b) {
+    const length = Math.min(a.length, b.length);
+    for (let i = 0; i < length; i++) {
+        const x = a.charCodeAt(i);
+        const y = b.charCodeAt(i);
+        if (x !== y)
+            return codePointRank(x) - codePointRank(y);
+    }
+    return a.length - b.length;
+}
+/**
+ * A UTF-16 code unit's rank in code point order: a surrogate starts a code point above U+FFFF, so it ranks above every
+ * unit from U+E000 on.
+ */
+function codePointRank(unit) {
+    if (unit < 0xd800)
+        return unit;
+    return unit < 0xe000 ? unit + 0x2000 : unit - 0x800;
+}
+/**
+ * `text` as the store keeps it: a lone surrogate replaced by U+FFFD (copied only when one occurs), NUL refused
+ * `invalid/args` (`what` names the value). Plugin strings are a trust boundary.
+ */
+export function storedText(text, what) {
+    if (text.includes("\0"))
+        throw invalid("args", `${what}: text may not contain NUL`);
+    return text.isWellFormed() ? text : text.toWellFormed();
+}
+/**
+ * The smallest string above every string starting with `prefix`, in code point order: the next code point after its
+ * last, carrying past U+10FFFF; `undefined` when there is none (`""` and all-U+10FFFF prefixes). `prefix` is
+ * well-formed.
+ */
+export function prefixUpperBound(prefix) {
+    const points = [...prefix];
+    while (points.length > 0) {
+        const last = points.pop().codePointAt(0);
+        if (last === 0x10ffff)
+            continue;
+        // The surrogates are no code points of well-formed text: after U+D7FF comes U+E000.
+        const next = last === 0xd7ff ? 0xe000 : last + 1;
+        return points.join("") + String.fromCodePoint(next);
+    }
+    return undefined;
+}
+//# sourceMappingURL=text.js.map

package/dist/next/store/text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../../../src/next/store/text.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qHAAqH;AACrH,mFAAmF;AAEnF,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,CAAS,EAAE,CAAS;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAY;IAClC,IAAI,IAAI,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,IAAY;IACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,4BAA4B,CAAC,CAAC;IACpF,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC9C,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,EAAG,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;QAC3C,IAAI,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChC,oFAAoF;QACpF,MAAM,IAAI,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QACjD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC","sourcesContent":["// Text in the store (decision \"Text is plain UTF-8, in code point order\"): Chord compares strings by code point, as\n// SQLite's BINARY collation compares their UTF-8 bytes, never by JavaScript's UTF-16 code units; every stored string\n// is well-formed and free of NUL, and a prefix becomes a range by its upper bound.\n\nimport { invalid } from \"../data/internal.ts\";\n\n/** Compares `a` and `b` by code point: negative, zero or positive. */\nexport function compareText(a: string, b: string): number {\n\tconst length = Math.min(a.length, b.length);\n\tfor (let i = 0; i < length; i++) {\n\t\tconst x = a.charCodeAt(i);\n\t\tconst y = b.charCodeAt(i);\n\t\tif (x !== y) return codePointRank(x) - codePointRank(y);\n\t}\n\treturn a.length - b.length;\n}\n\n/**\n * A UTF-16 code unit's rank in code point order: a surrogate starts a code point above U+FFFF, so it ranks above every\n * unit from U+E000 on.\n */\nfunction codePointRank(unit: number): number {\n\tif (unit < 0xd800) return unit;\n\treturn unit < 0xe000 ? unit + 0x2000 : unit - 0x800;\n}\n\n/**\n * `text` as the store keeps it: a lone surrogate replaced by U+FFFD (copied only when one occurs), NUL refused\n * `invalid/args` (`what` names the value). Plugin strings are a trust boundary.\n */\nexport function storedText(text: string, what: string): string {\n\tif (text.includes(\"\\0\")) throw invalid(\"args\", `${what}: text may not contain NUL`);\n\treturn text.isWellFormed() ? text : text.toWellFormed();\n}\n\n/**\n * The smallest string above every string starting with `prefix`, in code point order: the next code point after its\n * last, carrying past U+10FFFF; `undefined` when there is none (`\"\"` and all-U+10FFFF prefixes). `prefix` is\n * well-formed.\n */\nexport function prefixUpperBound(prefix: string): string | undefined {\n\tconst points = [...prefix];\n\twhile (points.length > 0) {\n\t\tconst last = points.pop()!.codePointAt(0)!;\n\t\tif (last === 0x10ffff) continue;\n\t\t// The surrogates are no code points of well-formed text: after U+D7FF comes U+E000.\n\t\tconst next = last === 0xd7ff ? 0xe000 : last + 1;\n\t\treturn points.join(\"\") + String.fromCodePoint(next);\n\t}\n\treturn undefined;\n}\n"]}

package/dist/next/store/writes.d.ts

@@ -0,0 +1,5 @@
+import type { DocumentWrite } from "./engine.ts";
+import type { TableWrite } from "./table-writes.ts";
+/** One change of the store, tagged by `kind`. */
+export type StoreWrite = DocumentWrite | TableWrite;
+//# sourceMappingURL=writes.d.ts.map

package/dist/next/store/writes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"writes.d.ts","sourceRoot":"","sources":["../../../src/next/store/writes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,iDAAiD;AACjD,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,UAAU,CAAC"}

package/dist/next/store/writes.js

@@ -0,0 +1,4 @@
+// The store's write vocabulary (`StoreWrite`, slice 6a §7, §8; decision "Writes carry their versions"): one change of
+// the store each, as the outbox and archives record it.
+export {};
+//# sourceMappingURL=writes.js.map

package/dist/next/store/writes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writes.js","sourceRoot":"","sources":["../../../src/next/store/writes.ts"],"names":[],"mappings":"AAAA,sHAAsH;AACtH,wDAAwD","sourcesContent":["// The store's write vocabulary (`StoreWrite`, slice 6a §7, §8; decision \"Writes carry their versions\"): one change of\n// the store each, as the outbox and archives record it.\n\nimport type { DocumentWrite } from \"./engine.ts\";\nimport type { TableWrite } from \"./table-writes.ts\";\n\n/** One change of the store, tagged by `kind`. */\nexport type StoreWrite = DocumentWrite | TableWrite;\n"]}

package/dist/next-node/compression.d.ts

@@ -0,0 +1,7 @@
+import type { Compression } from "../next/link/index.ts";
+/**
+ * Raw deflate at level 1 (`deflateRawSync`), and inflate bounded by `maxOutputLength` (`inflateRawSync`): past the
+ * limit `too_large`, data that is no raw deflate stream `corrupt`.
+ */
+export declare const nodeCompression: Compression;
+//# sourceMappingURL=compression.d.ts.map

package/dist/next-node/compression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compression.d.ts","sourceRoot":"","sources":["../../src/next-node/compression.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,WAY7B,CAAC"}

package/dist/next-node/compression.js

@@ -0,0 +1,24 @@
+// Compression for Chord v2 hosts on Node (§22, slice 4b): the synchronous compressor `createHost({ compression })`
+// takes, over Node's zlib. Node-only, so it lives outside `src/next`, which imports no Node module.
+import { constants as buffer } from "node:buffer";
+import { deflateRawSync, inflateRawSync } from "node:zlib";
+/**
+ * Raw deflate at level 1 (`deflateRawSync`), and inflate bounded by `maxOutputLength` (`inflateRawSync`): past the
+ * limit `too_large`, data that is no raw deflate stream `corrupt`.
+ */
+export const nodeCompression = {
+    deflate: (bytes) => deflateRawSync(bytes, { level: 1 }),
+    inflate: (bytes, limit) => {
+        try {
+            // zlib refuses a bound of 0: inflate at most one byte, and one byte is past a limit of 0.
+            const inflated = inflateRawSync(bytes, { maxOutputLength: Math.max(1, Math.min(limit, buffer.MAX_LENGTH)) });
+            return inflated.byteLength > limit ? { kind: "too_large" } : { kind: "bytes", bytes: inflated };
+        }
+        catch (error) {
+            if (error.code === "ERR_BUFFER_TOO_LARGE")
+                return { kind: "too_large" };
+            return { kind: "corrupt", error };
+        }
+    },
+};
+//# sourceMappingURL=compression.js.map

package/dist/next-node/compression.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compression.js","sourceRoot":"","sources":["../../src/next-node/compression.ts"],"names":[],"mappings":"AAAA,mHAAmH;AACnH,oGAAoG;AAEpG,OAAO,EAAE,SAAS,IAAI,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAG3D;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAgB;IAC3C,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACvD,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACzB,IAAI,CAAC;YACJ,0FAA0F;YAC1F,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;YAC7G,OAAO,QAAQ,CAAC,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACjG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAK,KAAqC,CAAC,IAAI,KAAK,sBAAsB;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACzG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QACnC,CAAC;IACF,CAAC;CACD,CAAC","sourcesContent":["// Compression for Chord v2 hosts on Node (§22, slice 4b): the synchronous compressor `createHost({ compression })`\n// takes, over Node's zlib. Node-only, so it lives outside `src/next`, which imports no Node module.\n\nimport { constants as buffer } from \"node:buffer\";\nimport { deflateRawSync, inflateRawSync } from \"node:zlib\";\nimport type { Compression } from \"../next/link/index.ts\";\n\n/**\n * Raw deflate at level 1 (`deflateRawSync`), and inflate bounded by `maxOutputLength` (`inflateRawSync`): past the\n * limit `too_large`, data that is no raw deflate stream `corrupt`.\n */\nexport const nodeCompression: Compression = {\n\tdeflate: (bytes) => deflateRawSync(bytes, { level: 1 }),\n\tinflate: (bytes, limit) => {\n\t\ttry {\n\t\t\t// zlib refuses a bound of 0: inflate at most one byte, and one byte is past a limit of 0.\n\t\t\tconst inflated = inflateRawSync(bytes, { maxOutputLength: Math.max(1, Math.min(limit, buffer.MAX_LENGTH)) });\n\t\t\treturn inflated.byteLength > limit ? { kind: \"too_large\" } : { kind: \"bytes\", bytes: inflated };\n\t\t} catch (error) {\n\t\t\tif ((error as { readonly code?: unknown }).code === \"ERR_BUFFER_TOO_LARGE\") return { kind: \"too_large\" };\n\t\t\treturn { kind: \"corrupt\", error };\n\t\t}\n\t},\n};\n"]}

package/dist/next-node/http/admission.d.ts

@@ -0,0 +1,63 @@
+import type { Incoming } from "./incoming.ts";
+import type { HttpRelay } from "./router.ts";
+/** Where an admitted request came from. */
+export type Provenance = {
+    readonly kind: "local";
+} | {
+    readonly kind: "remote";
+    readonly host: string;
+} | {
+    readonly kind: "relayed";
+    readonly relay: string;
+    readonly origin: string;
+};
+/** The connection a request arrived on, as its listener knows it (a mounted handler passes what it has). */
+export type Connection = {
+    readonly localAddress?: string;
+    readonly localPort?: number;
+    readonly remoteAddress?: string;
+};
+/** An admitted request: its provenance, its own origin, the origin allowed to frame it (a relay's), how it came. */
+export type Admitted = {
+    readonly provenance: Provenance;
+    readonly origin: string;
+    readonly framer: string | undefined;
+    /** The allowed host it came through: its connections end when that host leaves. */
+    readonly allowed: string | undefined;
+    /** The relay that verified it: its connections end when that relay leaves. */
+    readonly relay: HttpRelay | undefined;
+};
+/** What admission refuses, and the relay hook that threw (reported by the caller). */
+export type Refused = {
+    readonly kind: "refused";
+    readonly failed?: {
+        readonly relay: string;
+        readonly error: unknown;
+    };
+};
+/**
+ * Admits `request` arriving on `connection` with the allowed `hosts` and contributed `relays`, or refuses it (403):
+ * no or several `Host`s, a host neither loopback nor allowed, a loopback `Host` on another connection, forwarded
+ * headers no relay verifies.
+ */
+export declare function admit(request: Incoming, connection: Connection, hosts: ReadonlySet<string>, relays: readonly HttpRelay[]): Admitted | Refused;
+/** What the Fetch Metadata and `Origin` checks read: a request's headers by name. */
+export type HeaderSource = Pick<Incoming, "header">;
+/** Whether `admission` refused its request. */
+export declare function refused(admission: Admitted | Refused): admission is Refused;
+/**
+ * Whether a request is another site's (Fetch Metadata, p2's rule): `Sec-Fetch-Site` neither `same-origin` nor `none`,
+ * or a frame or embed not from this origin. A request without the headers (a script, the TUI) is not.
+ */
+export declare function isForeign(headers: HeaderSource): boolean;
+/**
+ * Whether a foreign request is a top-level navigation (a link followed to a page): `GET`, `navigate`, a `document` (or
+ * `empty`: Chrome on Android launching an installed app).
+ */
+export declare function isNavigation(method: string, headers: HeaderSource): boolean;
+/**
+ * Whether `headers`' `Origin` is acceptable for a request whose own origin is `origin`: absent or equal, and for an
+ * unsafe method from a browser (one sending Fetch Metadata) present and equal.
+ */
+export declare function originAccepted(method: string, headers: HeaderSource, origin: string): boolean;
+//# sourceMappingURL=admission.d.ts.map

package/dist/next-node/http/admission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.d.ts","sourceRoot":"","sources":["../../../src/next-node/http/admission.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,2CAA2C;AAC3C,MAAM,MAAM,UAAU,GACnB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjF,4GAA4G;AAC5G,MAAM,MAAM,UAAU,GAAG;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CAChC,CAAC;AAEF,oHAAoH;AACpH,MAAM,MAAM,QAAQ,GAAG;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;CACtC,CAAC;AAEF,sFAAsF;AACtF,MAAM,MAAM,OAAO,GAAG;IACrB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC;CACtE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,KAAK,CACpB,OAAO,EAAE,QAAQ,EACjB,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,EAC1B,MAAM,EAAE,SAAS,SAAS,EAAE,GAC1B,QAAQ,GAAG,OAAO,CAyBpB;AAED,qFAAqF;AACrF,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAEpD,+CAA+C;AAC/C,wBAAgB,OAAO,CAAC,SAAS,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,IAAI,OAAO,CAE3E;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAIxD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAK3E;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAI7F"}

package/dist/next-node/http/admission.js

@@ -0,0 +1,134 @@
+// Admission (slice 10 §2, R4; decision "The HTTP component's security baseline" (1)-(3), "Relays"): where a request
+// comes from, decided before anything else. Local only when the connection arrived on a loopback address, its `Host`
+// is a loopback name with the listening port, and it carries no forwarded header; a forwarded request on loopback only
+// when a contributed relay verifies it; otherwise only through an allowed host (https); else refused. Foreign requests
+// (another site's, by Fetch Metadata) and a foreign `Origin` are classified here; the handler applies them per route.
+/**
+ * Admits `request` arriving on `connection` with the allowed `hosts` and contributed `relays`, or refuses it (403):
+ * no or several `Host`s, a host neither loopback nor allowed, a loopback `Host` on another connection, forwarded
+ * headers no relay verifies.
+ */
+export function admit(request, connection, hosts, relays) {
+    const host = request.header("host")?.toLowerCase();
+    // Several `Host` headers arrive joined with commas.
+    if (host === undefined || host === "" || host.includes(","))
+        return REFUSED;
+    const { localAddress, localPort } = connection;
+    if (isLoopbackName(host, localPort)) {
+        if (localAddress === undefined || !isLoopbackAddress(localAddress))
+            return REFUSED;
+        if (!request.forwarded())
+            return {
+                provenance: LOCAL,
+                origin: `http://${host}`,
+                framer: undefined,
+                allowed: undefined,
+                relay: undefined,
+            };
+        return relayed(request, relays);
+    }
+    if (!hosts.has(host))
+        return REFUSED;
+    return {
+        provenance: { kind: "remote", host },
+        origin: `https://${host}`,
+        framer: undefined,
+        allowed: host,
+        relay: undefined,
+    };
+}
+/** Whether `admission` refused its request. */
+export function refused(admission) {
+    return "kind" in admission;
+}
+/**
+ * Whether a request is another site's (Fetch Metadata, p2's rule): `Sec-Fetch-Site` neither `same-origin` nor `none`,
+ * or a frame or embed not from this origin. A request without the headers (a script, the TUI) is not.
+ */
+export function isForeign(headers) {
+    const site = headers.header("sec-fetch-site");
+    if (site !== null && site !== "same-origin" && site !== "none")
+        return true;
+    return site !== "same-origin" && FRAMES.has(headers.header("sec-fetch-dest") ?? "");
+}
+/**
+ * Whether a foreign request is a top-level navigation (a link followed to a page): `GET`, `navigate`, a `document` (or
+ * `empty`: Chrome on Android launching an installed app).
+ */
+export function isNavigation(method, headers) {
+    const dest = headers.header("sec-fetch-dest");
+    return (method === "GET" && headers.header("sec-fetch-mode") === "navigate" && (dest === "document" || dest === "empty"));
+}
+/**
+ * Whether `headers`' `Origin` is acceptable for a request whose own origin is `origin`: absent or equal, and for an
+ * unsafe method from a browser (one sending Fetch Metadata) present and equal.
+ */
+export function originAccepted(method, headers, origin) {
+    const sent = headers.header("origin");
+    if (sent !== null)
+        return sent === origin;
+    return SAFE.has(method) || headers.header("sec-fetch-site") === null;
+}
+const REFUSED = { kind: "refused" };
+const LOCAL = { kind: "local" };
+const LOOPBACK_NAMES = ["127.0.0.1", "localhost", "[::1]"];
+/** Whether `host` (lowercased) names this server on loopback with `port` (without it on port 80). */
+function isLoopbackName(host, port) {
+    if (port === undefined)
+        return false;
+    for (const name of LOOPBACK_NAMES) {
+        if (host === `${name}:${port}`)
+            return true;
+        if (port === 80 && host === name)
+            return true;
+    }
+    return false;
+}
+/** Whether `address` is a loopback address: 127.0.0.0/8, ::1, or 127.x mapped into IPv6. */
+function isLoopbackAddress(address) {
+    return address === "::1" || address.startsWith("127.") || address.startsWith("::ffff:127.");
+}
+/** A forwarded request on loopback: admitted as relayed when a relay verifies it, else refused. */
+function relayed(request, relays) {
+    for (const relay of relays) {
+        let verified;
+        try {
+            verified = relay.verify(request.request());
+        }
+        catch (error) {
+            return { kind: "refused", failed: { relay: relay.name, error } };
+        }
+        if (verified === undefined)
+            continue;
+        // Its origins reach the CSP: each must be one origin and nothing else (Fable's recheck N2).
+        for (const origin of [verified.origin, verified.framer]) {
+            if (origin === undefined || isOrigin(origin))
+                continue;
+            const error = new Error(`relay ${relay.name}: ${JSON.stringify(origin)} is no origin`);
+            return { kind: "refused", failed: { relay: relay.name, error } };
+        }
+        return {
+            provenance: { kind: "relayed", relay: relay.name, origin: verified.origin },
+            origin: verified.origin,
+            framer: verified.framer,
+            allowed: undefined,
+            relay,
+        };
+    }
+    return REFUSED;
+}
+/** Whether `text` is exactly an origin (`https://host[:port]`): what the URL parser serializes it to. */
+function isOrigin(text) {
+    try {
+        const url = new URL(text);
+        return (url.protocol === "https:" || url.protocol === "http:") && url.origin === text;
+    }
+    catch {
+        return false;
+    }
+}
+/** The `Sec-Fetch-Dest` of a frame or an embed. */
+const FRAMES = new Set(["iframe", "frame", "embed", "object", "fencedframe"]);
+/** The methods that change nothing. */
+const SAFE = new Set(["GET", "HEAD", "OPTIONS"]);
+//# sourceMappingURL=admission.js.map

package/dist/next-node/http/admission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admission.js","sourceRoot":"","sources":["../../../src/next-node/http/admission.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,qHAAqH;AACrH,uHAAuH;AACvH,uHAAuH;AACvH,sHAAsH;AAmCtH;;;;GAIG;AACH,MAAM,UAAU,KAAK,CACpB,OAAiB,EACjB,UAAsB,EACtB,KAA0B,EAC1B,MAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACnD,oDAAoD;IACpD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC5E,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;IAC/C,IAAI,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QACrC,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC;YAAE,OAAO,OAAO,CAAC;QACnF,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;YACvB,OAAO;gBACN,UAAU,EAAE,KAAK;gBACjB,MAAM,EAAE,UAAU,IAAI,EAAE;gBACxB,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,SAAS;gBAClB,KAAK,EAAE,SAAS;aAChB,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO;QACN,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QACpC,MAAM,EAAE,WAAW,IAAI,EAAE;QACzB,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,IAAI;QACb,KAAK,EAAE,SAAS;KAChB,CAAC;AACH,CAAC;AAKD,+CAA+C;AAC/C,MAAM,UAAU,OAAO,CAAC,SAA6B;IACpD,OAAO,MAAM,IAAI,SAAS,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAqB;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAqB;IACjE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC9C,OAAO,CACN,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,UAAU,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,OAAO,CAAC,CAChH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAAqB,EAAE,MAAc;IACnF,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,KAAK,MAAM,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC;AACtE,CAAC;AAED,MAAM,OAAO,GAAY,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAE7C,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAE5C,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AAE3D,qGAAqG;AACrG,SAAS,cAAc,CAAC,IAAY,EAAE,IAAwB;IAC7D,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QACnC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,IAAI,EAAE;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,4FAA4F;AAC5F,SAAS,iBAAiB,CAAC,OAAe;IACzC,OAAO,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAC7F,CAAC;AAED,mGAAmG;AACnG,SAAS,OAAO,CAAC,OAAiB,EAAE,MAA4B;IAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,QAAyC,CAAC;QAC9C,IAAI,CAAC;YACJ,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,4FAA4F;QAC5F,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,CAAC;gBAAE,SAAS;YACvD,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,SAAS,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACvF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAClE,CAAC;QACD,OAAO;YACN,UAAU,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;YAC3E,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,SAAS;YAClB,KAAK;SACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,yGAAyG;AACzG,SAAS,QAAQ,CAAC,IAAY;IAC7B,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,mDAAmD;AACnD,MAAM,MAAM,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAEnG,uCAAuC;AACvC,MAAM,IAAI,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC","sourcesContent":["// Admission (slice 10 §2, R4; decision \"The HTTP component's security baseline\" (1)-(3), \"Relays\"): where a request\n// comes from, decided before anything else. Local only when the connection arrived on a loopback address, its `Host`\n// is a loopback name with the listening port, and it carries no forwarded header; a forwarded request on loopback only\n// when a contributed relay verifies it; otherwise only through an allowed host (https); else refused. Foreign requests\n// (another site's, by Fetch Metadata) and a foreign `Origin` are classified here; the handler applies them per route.\n\nimport type { Incoming } from \"./incoming.ts\";\nimport type { HttpRelay } from \"./router.ts\";\n\n/** Where an admitted request came from. */\nexport type Provenance =\n\t| { readonly kind: \"local\" }\n\t| { readonly kind: \"remote\"; readonly host: string }\n\t| { readonly kind: \"relayed\"; readonly relay: string; readonly origin: string };\n\n/** The connection a request arrived on, as its listener knows it (a mounted handler passes what it has). */\nexport type Connection = {\n\treadonly localAddress?: string;\n\treadonly localPort?: number;\n\treadonly remoteAddress?: string;\n};\n\n/** An admitted request: its provenance, its own origin, the origin allowed to frame it (a relay's), how it came. */\nexport type Admitted = {\n\treadonly provenance: Provenance;\n\treadonly origin: string;\n\treadonly framer: string | undefined;\n\t/** The allowed host it came through: its connections end when that host leaves. */\n\treadonly allowed: string | undefined;\n\t/** The relay that verified it: its connections end when that relay leaves. */\n\treadonly relay: HttpRelay | undefined;\n};\n\n/** What admission refuses, and the relay hook that threw (reported by the caller). */\nexport type Refused = {\n\treadonly kind: \"refused\";\n\treadonly failed?: { readonly relay: string; readonly error: unknown };\n};\n\n/**\n * Admits `request` arriving on `connection` with the allowed `hosts` and contributed `relays`, or refuses it (403):\n * no or several `Host`s, a host neither loopback nor allowed, a loopback `Host` on another connection, forwarded\n * headers no relay verifies.\n */\nexport function admit(\n\trequest: Incoming,\n\tconnection: Connection,\n\thosts: ReadonlySet<string>,\n\trelays: readonly HttpRelay[],\n): Admitted | Refused {\n\tconst host = request.header(\"host\")?.toLowerCase();\n\t// Several `Host` headers arrive joined with commas.\n\tif (host === undefined || host === \"\" || host.includes(\",\")) return REFUSED;\n\tconst { localAddress, localPort } = connection;\n\tif (isLoopbackName(host, localPort)) {\n\t\tif (localAddress === undefined || !isLoopbackAddress(localAddress)) return REFUSED;\n\t\tif (!request.forwarded())\n\t\t\treturn {\n\t\t\t\tprovenance: LOCAL,\n\t\t\t\torigin: `http://${host}`,\n\t\t\t\tframer: undefined,\n\t\t\t\tallowed: undefined,\n\t\t\t\trelay: undefined,\n\t\t\t};\n\t\treturn relayed(request, relays);\n\t}\n\tif (!hosts.has(host)) return REFUSED;\n\treturn {\n\t\tprovenance: { kind: \"remote\", host },\n\t\torigin: `https://${host}`,\n\t\tframer: undefined,\n\t\tallowed: host,\n\t\trelay: undefined,\n\t};\n}\n\n/** What the Fetch Metadata and `Origin` checks read: a request's headers by name. */\nexport type HeaderSource = Pick<Incoming, \"header\">;\n\n/** Whether `admission` refused its request. */\nexport function refused(admission: Admitted | Refused): admission is Refused {\n\treturn \"kind\" in admission;\n}\n\n/**\n * Whether a request is another site's (Fetch Metadata, p2's rule): `Sec-Fetch-Site` neither `same-origin` nor `none`,\n * or a frame or embed not from this origin. A request without the headers (a script, the TUI) is not.\n */\nexport function isForeign(headers: HeaderSource): boolean {\n\tconst site = headers.header(\"sec-fetch-site\");\n\tif (site !== null && site !== \"same-origin\" && site !== \"none\") return true;\n\treturn site !== \"same-origin\" && FRAMES.has(headers.header(\"sec-fetch-dest\") ?? \"\");\n}\n\n/**\n * Whether a foreign request is a top-level navigation (a link followed to a page): `GET`, `navigate`, a `document` (or\n * `empty`: Chrome on Android launching an installed app).\n */\nexport function isNavigation(method: string, headers: HeaderSource): boolean {\n\tconst dest = headers.header(\"sec-fetch-dest\");\n\treturn (\n\t\tmethod === \"GET\" && headers.header(\"sec-fetch-mode\") === \"navigate\" && (dest === \"document\" || dest === \"empty\")\n\t);\n}\n\n/**\n * Whether `headers`' `Origin` is acceptable for a request whose own origin is `origin`: absent or equal, and for an\n * unsafe method from a browser (one sending Fetch Metadata) present and equal.\n */\nexport function originAccepted(method: string, headers: HeaderSource, origin: string): boolean {\n\tconst sent = headers.header(\"origin\");\n\tif (sent !== null) return sent === origin;\n\treturn SAFE.has(method) || headers.header(\"sec-fetch-site\") === null;\n}\n\nconst REFUSED: Refused = { kind: \"refused\" };\n\nconst LOCAL: Provenance = { kind: \"local\" };\n\nconst LOOPBACK_NAMES = [\"127.0.0.1\", \"localhost\", \"[::1]\"];\n\n/** Whether `host` (lowercased) names this server on loopback with `port` (without it on port 80). */\nfunction isLoopbackName(host: string, port: number | undefined): boolean {\n\tif (port === undefined) return false;\n\tfor (const name of LOOPBACK_NAMES) {\n\t\tif (host === `${name}:${port}`) return true;\n\t\tif (port === 80 && host === name) return true;\n\t}\n\treturn false;\n}\n\n/** Whether `address` is a loopback address: 127.0.0.0/8, ::1, or 127.x mapped into IPv6. */\nfunction isLoopbackAddress(address: string): boolean {\n\treturn address === \"::1\" || address.startsWith(\"127.\") || address.startsWith(\"::ffff:127.\");\n}\n\n/** A forwarded request on loopback: admitted as relayed when a relay verifies it, else refused. */\nfunction relayed(request: Incoming, relays: readonly HttpRelay[]): Admitted | Refused {\n\tfor (const relay of relays) {\n\t\tlet verified: ReturnType<HttpRelay[\"verify\"]>;\n\t\ttry {\n\t\t\tverified = relay.verify(request.request());\n\t\t} catch (error) {\n\t\t\treturn { kind: \"refused\", failed: { relay: relay.name, error } };\n\t\t}\n\t\tif (verified === undefined) continue;\n\t\t// Its origins reach the CSP: each must be one origin and nothing else (Fable's recheck N2).\n\t\tfor (const origin of [verified.origin, verified.framer]) {\n\t\t\tif (origin === undefined || isOrigin(origin)) continue;\n\t\t\tconst error = new Error(`relay ${relay.name}: ${JSON.stringify(origin)} is no origin`);\n\t\t\treturn { kind: \"refused\", failed: { relay: relay.name, error } };\n\t\t}\n\t\treturn {\n\t\t\tprovenance: { kind: \"relayed\", relay: relay.name, origin: verified.origin },\n\t\t\torigin: verified.origin,\n\t\t\tframer: verified.framer,\n\t\t\tallowed: undefined,\n\t\t\trelay,\n\t\t};\n\t}\n\treturn REFUSED;\n}\n\n/** Whether `text` is exactly an origin (`https://host[:port]`): what the URL parser serializes it to. */\nfunction isOrigin(text: string): boolean {\n\ttry {\n\t\tconst url = new URL(text);\n\t\treturn (url.protocol === \"https:\" || url.protocol === \"http:\") && url.origin === text;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/** The `Sec-Fetch-Dest` of a frame or an embed. */\nconst FRAMES: ReadonlySet<string> = new Set([\"iframe\", \"frame\", \"embed\", \"object\", \"fencedframe\"]);\n\n/** The methods that change nothing. */\nconst SAFE: ReadonlySet<string> = new Set([\"GET\", \"HEAD\", \"OPTIONS\"]);\n"]}

package/dist/next-node/http/authenticate.d.ts

@@ -0,0 +1,21 @@
+import type { Context } from "../../context/index.ts";
+import type { Principal } from "../../next/data/index.ts";
+import { type RegistryTable } from "../../next/registries/index.ts";
+import type { HttpRequest } from "./request.ts";
+/** Who `request` is, or `undefined` (anonymous here, maybe another authenticator knows). */
+export type Authenticator = (request: HttpRequest, context: Context) => Principal | undefined | Promise<Principal | undefined>;
+/** An authenticator with its plugin, as the component asks it. */
+export type AuthenticatorEntry = {
+    readonly plugin: string;
+    readonly authenticate: Authenticator;
+};
+/** The registry of authenticators (served by `http.facet`). */
+export declare const Authenticators: import("../../next/registries/registry.ts").Registry<Authenticator, readonly AuthenticatorEntry[]>;
+/** Composes `Authenticators`: every contribution in contributor order. */
+export declare function composeAuthenticators(table: RegistryTable<Authenticator>): readonly AuthenticatorEntry[];
+/**
+ * The principal of `request`: the first one an authenticator returns, in order; one that throws is reported through
+ * `failed` and skipped; none: `undefined` (anonymous). Once `context` is aborted no further authenticator starts.
+ */
+export declare function authenticate(authenticators: readonly AuthenticatorEntry[], request: HttpRequest, failed: (plugin: string, error: unknown) => void, context: Context): Promise<Principal | undefined>;
+//# sourceMappingURL=authenticate.d.ts.map

package/dist/next-node/http/authenticate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.d.ts","sourceRoot":"","sources":["../../../src/next-node/http/authenticate.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,4FAA4F;AAC5F,MAAM,MAAM,aAAa,GAAG,CAC3B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,OAAO,KACZ,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;AAE5D,kEAAkE;AAClE,MAAM,MAAM,kBAAkB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAA;CAAE,CAAC;AAEnG,+DAA+D;AAC/D,eAAO,MAAM,cAAc,oGAK1B,CAAC;AAEF,0EAA0E;AAC1E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,GAAG,SAAS,kBAAkB,EAAE,CAExG;AAED;;;GAGG;AACH,wBAAsB,YAAY,CACjC,cAAc,EAAE,SAAS,kBAAkB,EAAE,EAC7C,OAAO,EAAE,WAAW,EACpB,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,IAAI,EAChD,OAAO,EAAE,OAAO,GACd,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAYhC"}

package/dist/next-node/http/authenticate.js

@@ -0,0 +1,34 @@
+// Who someone is (decision "The HTTP server is a native object", replacing the `authenticate` option): the registry
+// `Authenticators`, one function per contributor, asked in contributor order (plugin name: an order with no meaning, so
+// an app needing precedence between credentials contributes one authenticator that decides); the first principal
+// returned wins, a throwing one is reported and skipped.
+import { defineRegistry } from "../../next/registries/index.js";
+/** The registry of authenticators (served by `http.facet`). */
+export const Authenticators = defineRegistry("chord.http.authenticators", {
+    version: 1,
+});
+/** Composes `Authenticators`: every contribution in contributor order. */
+export function composeAuthenticators(table) {
+    return table.map(({ plugin, value }) => ({ plugin, authenticate: value }));
+}
+/**
+ * The principal of `request`: the first one an authenticator returns, in order; one that throws is reported through
+ * `failed` and skipped; none: `undefined` (anonymous). Once `context` is aborted no further authenticator starts.
+ */
+export async function authenticate(authenticators, request, failed, context) {
+    for (const { plugin, authenticate } of authenticators) {
+        // A request gone or sealed starts no new work (Sol's second recheck C).
+        if (context.abortSignal?.aborted)
+            return undefined;
+        try {
+            const principal = await authenticate(request, context);
+            if (principal !== undefined)
+                return principal;
+        }
+        catch (error) {
+            failed(plugin, error);
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=authenticate.js.map

package/dist/next-node/http/authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../../src/next-node/http/authenticate.ts"],"names":[],"mappings":"AAAA,oHAAoH;AACpH,wHAAwH;AACxH,iHAAiH;AACjH,yDAAyD;AAIzD,OAAO,EAAE,cAAc,EAAsB,MAAM,gCAAgC,CAAC;AAYpF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAC3C,2BAA2B,EAC3B;IACC,OAAO,EAAE,CAAC;CACV,CACD,CAAC;AAEF,0EAA0E;AAC1E,MAAM,UAAU,qBAAqB,CAAC,KAAmC;IACxE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,cAA6C,EAC7C,OAAoB,EACpB,MAAgD,EAChD,OAAgB;IAEhB,KAAK,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,cAAc,EAAE,CAAC;QACvD,wEAAwE;QACxE,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QACnD,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC","sourcesContent":["// Who someone is (decision \"The HTTP server is a native object\", replacing the `authenticate` option): the registry\n// `Authenticators`, one function per contributor, asked in contributor order (plugin name: an order with no meaning, so\n// an app needing precedence between credentials contributes one authenticator that decides); the first principal\n// returned wins, a throwing one is reported and skipped.\n\nimport type { Context } from \"../../context/index.ts\";\nimport type { Principal } from \"../../next/data/index.ts\";\nimport { defineRegistry, type RegistryTable } from \"../../next/registries/index.ts\";\nimport type { HttpRequest } from \"./request.ts\";\n\n/** Who `request` is, or `undefined` (anonymous here, maybe another authenticator knows). */\nexport type Authenticator = (\n\trequest: HttpRequest,\n\tcontext: Context,\n) => Principal | undefined | Promise<Principal | undefined>;\n\n/** An authenticator with its plugin, as the component asks it. */\nexport type AuthenticatorEntry = { readonly plugin: string; readonly authenticate: Authenticator };\n\n/** The registry of authenticators (served by `http.facet`). */\nexport const Authenticators = defineRegistry<Authenticator, readonly AuthenticatorEntry[]>(\n\t\"chord.http.authenticators\",\n\t{\n\t\tversion: 1,\n\t},\n);\n\n/** Composes `Authenticators`: every contribution in contributor order. */\nexport function composeAuthenticators(table: RegistryTable<Authenticator>): readonly AuthenticatorEntry[] {\n\treturn table.map(({ plugin, value }) => ({ plugin, authenticate: value }));\n}\n\n/**\n * The principal of `request`: the first one an authenticator returns, in order; one that throws is reported through\n * `failed` and skipped; none: `undefined` (anonymous). Once `context` is aborted no further authenticator starts.\n */\nexport async function authenticate(\n\tauthenticators: readonly AuthenticatorEntry[],\n\trequest: HttpRequest,\n\tfailed: (plugin: string, error: unknown) => void,\n\tcontext: Context,\n): Promise<Principal | undefined> {\n\tfor (const { plugin, authenticate } of authenticators) {\n\t\t// A request gone or sealed starts no new work (Sol's second recheck C).\n\t\tif (context.abortSignal?.aborted) return undefined;\n\t\ttry {\n\t\t\tconst principal = await authenticate(request, context);\n\t\t\tif (principal !== undefined) return principal;\n\t\t} catch (error) {\n\t\t\tfailed(plugin, error);\n\t\t}\n\t}\n\treturn undefined;\n}\n"]}

package/dist/next-node/http/cookies.d.ts

@@ -0,0 +1,24 @@
+import type { HttpRequest } from "./request.ts";
+/** What `cookie` takes besides the name and the value. */
+export type CookieOptions = {
+    /** The key it is signed with (HMAC-SHA256). */
+    readonly secret: string;
+    /** The request it answers: a remote one gets `Secure`. */
+    readonly request: HttpRequest;
+    /** `Strict` by default; `Lax` lets a top-level navigation from another site carry it. */
+    readonly sameSite?: "Strict" | "Lax";
+    /** Seconds until it expires; none: a session cookie. */
+    readonly maxAge?: number;
+};
+/**
+ * A signed `Set-Cookie` value for `name` and `value` (put it in a response's `headers`, `Set-Cookie`). With `maxAge`
+ * its expiry is signed with it: a copy read back later is refused (Opus's recheck R3); without, it holds until the
+ * secret changes.
+ */
+export declare function cookie(name: string, value: string, options: CookieOptions): string;
+/**
+ * The value of cookie `name` on `request` when its signature with `secret` holds and its signed expiry has not passed;
+ * `undefined` otherwise.
+ */
+export declare function readCookie(request: HttpRequest, name: string, secret: string): string | undefined;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/next-node/http/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/next-node/http/cookies.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,0DAA0D;AAC1D,MAAM,MAAM,aAAa,GAAG;IAC3B,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IACrC,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAalF;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAsBjG"}

package/dist/next-node/http/cookies.js

@@ -0,0 +1,62 @@
+// Cookies (decision "The HTTP component's security baseline" (5)): `cookie` makes a signed `Set-Cookie` value with the
+// safe defaults (`HttpOnly`, `Path=/`, `SameSite=Strict`, `Secure` on a remote origin), `readCookie` reads one back,
+// its signature checked in constant time.
+import { createHmac, timingSafeEqual } from "node:crypto";
+/**
+ * A signed `Set-Cookie` value for `name` and `value` (put it in a response's `headers`, `Set-Cookie`). With `maxAge`
+ * its expiry is signed with it: a copy read back later is refused (Opus's recheck R3); without, it holds until the
+ * secret changes.
+ */
+export function cookie(name, value, options) {
+    const encoded = encodeURIComponent(value);
+    const expires = options.maxAge === undefined ? "" : String(Math.floor(Date.now() / 1000 + options.maxAge));
+    const payload = `${encoded}.${expires}`;
+    const parts = [
+        `${name}=${payload}.${signature(name, payload, options.secret)}`,
+        "HttpOnly",
+        "Path=/",
+        `SameSite=${options.sameSite ?? "Strict"}`,
+    ];
+    if (options.request.provenance.kind !== "local")
+        parts.push("Secure");
+    if (options.maxAge !== undefined)
+        parts.push(`Max-Age=${Math.floor(options.maxAge)}`);
+    return parts.join("; ");
+}
+/**
+ * The value of cookie `name` on `request` when its signature with `secret` holds and its signed expiry has not passed;
+ * `undefined` otherwise.
+ */
+export function readCookie(request, name, secret) {
+    for (const pair of (request.headers.get("cookie") ?? "").split(";")) {
+        const equals = pair.indexOf("=");
+        if (equals < 0 || pair.slice(0, equals).trim() !== name)
+            continue;
+        const signed = pair.slice(equals + 1).trim();
+        // From the right: the value may hold dots, the expiry and the signature never do.
+        const dot = signed.lastIndexOf(".");
+        const payload = signed.slice(0, dot);
+        const expiresAt = payload.lastIndexOf(".");
+        if (dot < 0 || expiresAt < 0)
+            return undefined;
+        const given = Buffer.from(signed.slice(dot + 1));
+        const expected = Buffer.from(signature(name, payload, secret));
+        if (given.length !== expected.length || !timingSafeEqual(given, expected))
+            return undefined;
+        const expires = payload.slice(expiresAt + 1);
+        if (expires !== "" && Number(expires) * 1000 <= Date.now())
+            return undefined;
+        try {
+            return decodeURIComponent(payload.slice(0, expiresAt));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+/** The signature of a cookie's name and payload (its encoded value and expiry). */
+function signature(name, payload, secret) {
+    return createHmac("sha256", secret).update(`${name}=${payload}`).digest("base64url");
+}
+//# sourceMappingURL=cookies.js.map

package/dist/next-node/http/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../../src/next-node/http/cookies.ts"],"names":[],"mappings":"AAAA,uHAAuH;AACvH,qHAAqH;AACrH,0CAA0C;AAE1C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAe1D;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAa,EAAE,OAAsB;IACzE,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3G,MAAM,OAAO,GAAG,GAAG,OAAO,IAAI,OAAO,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG;QACb,GAAG,IAAI,IAAI,OAAO,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;QAChE,UAAU;QACV,QAAQ;QACR,YAAY,OAAO,CAAC,QAAQ,IAAI,QAAQ,EAAE;KAC1C,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,OAAoB,EAAE,IAAY,EAAE,MAAc;IAC5E,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,kFAAkF;QAClF,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,GAAG,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QAC7E,IAAI,CAAC;YACJ,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,MAAc;IAC/D,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACtF,CAAC","sourcesContent":["// Cookies (decision \"The HTTP component's security baseline\" (5)): `cookie` makes a signed `Set-Cookie` value with the\n// safe defaults (`HttpOnly`, `Path=/`, `SameSite=Strict`, `Secure` on a remote origin), `readCookie` reads one back,\n// its signature checked in constant time.\n\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\nimport type { HttpRequest } from \"./request.ts\";\n\n/** What `cookie` takes besides the name and the value. */\nexport type CookieOptions = {\n\t/** The key it is signed with (HMAC-SHA256). */\n\treadonly secret: string;\n\t/** The request it answers: a remote one gets `Secure`. */\n\treadonly request: HttpRequest;\n\t/** `Strict` by default; `Lax` lets a top-level navigation from another site carry it. */\n\treadonly sameSite?: \"Strict\" | \"Lax\";\n\t/** Seconds until it expires; none: a session cookie. */\n\treadonly maxAge?: number;\n};\n\n/**\n * A signed `Set-Cookie` value for `name` and `value` (put it in a response's `headers`, `Set-Cookie`). With `maxAge`\n * its expiry is signed with it: a copy read back later is refused (Opus's recheck R3); without, it holds until the\n * secret changes.\n */\nexport function cookie(name: string, value: string, options: CookieOptions): string {\n\tconst encoded = encodeURIComponent(value);\n\tconst expires = options.maxAge === undefined ? \"\" : String(Math.floor(Date.now() / 1000 + options.maxAge));\n\tconst payload = `${encoded}.${expires}`;\n\tconst parts = [\n\t\t`${name}=${payload}.${signature(name, payload, options.secret)}`,\n\t\t\"HttpOnly\",\n\t\t\"Path=/\",\n\t\t`SameSite=${options.sameSite ?? \"Strict\"}`,\n\t];\n\tif (options.request.provenance.kind !== \"local\") parts.push(\"Secure\");\n\tif (options.maxAge !== undefined) parts.push(`Max-Age=${Math.floor(options.maxAge)}`);\n\treturn parts.join(\"; \");\n}\n\n/**\n * The value of cookie `name` on `request` when its signature with `secret` holds and its signed expiry has not passed;\n * `undefined` otherwise.\n */\nexport function readCookie(request: HttpRequest, name: string, secret: string): string | undefined {\n\tfor (const pair of (request.headers.get(\"cookie\") ?? \"\").split(\";\")) {\n\t\tconst equals = pair.indexOf(\"=\");\n\t\tif (equals < 0 || pair.slice(0, equals).trim() !== name) continue;\n\t\tconst signed = pair.slice(equals + 1).trim();\n\t\t// From the right: the value may hold dots, the expiry and the signature never do.\n\t\tconst dot = signed.lastIndexOf(\".\");\n\t\tconst payload = signed.slice(0, dot);\n\t\tconst expiresAt = payload.lastIndexOf(\".\");\n\t\tif (dot < 0 || expiresAt < 0) return undefined;\n\t\tconst given = Buffer.from(signed.slice(dot + 1));\n\t\tconst expected = Buffer.from(signature(name, payload, secret));\n\t\tif (given.length !== expected.length || !timingSafeEqual(given, expected)) return undefined;\n\t\tconst expires = payload.slice(expiresAt + 1);\n\t\tif (expires !== \"\" && Number(expires) * 1000 <= Date.now()) return undefined;\n\t\ttry {\n\t\t\treturn decodeURIComponent(payload.slice(0, expiresAt));\n\t\t} catch {\n\t\t\treturn undefined;\n\t\t}\n\t}\n\treturn undefined;\n}\n\n/** The signature of a cookie's name and payload (its encoded value and expiry). */\nfunction signature(name: string, payload: string, secret: string): string {\n\treturn createHmac(\"sha256\", secret).update(`${name}=${payload}`).digest(\"base64url\");\n}\n"]}

package/dist/next-node/http/file.d.ts

@@ -0,0 +1,23 @@
+import type { HttpResponse } from "./response.ts";
+/** What `fileResponse` takes besides the path. */
+export type FileResponseOptions = {
+    /** Saved under this name. */
+    readonly download?: string;
+    /** Shown in the browser instead of saved (an image, a video), with a `sandbox` CSP. */
+    readonly inline?: true;
+    /**
+     * The directory the file must lie in once its symbolic links are resolved: one outside it (a link out) is refused
+     * 403. Without it the path is trusted (a plugin's own file).
+     */
+    readonly root?: string;
+    /** Whether a single range is answered 206 (audio and video seek with it). */
+    readonly ranges?: boolean;
+    /** The type; by default from the extension (text, images, audio, video), else `application/octet-stream`. */
+    readonly mime?: string;
+};
+/**
+ * The file at `path` as a `bytes` response; `HttpFailure` 404 for a missing one (anyone may ask for one: no failure
+ * of the route, Fable's recheck N1), 403 for one outside `root`; throws what else `stat` throws.
+ */
+export declare function fileResponse(given: string, options?: FileResponseOptions): Promise<HttpResponse>;
+//# sourceMappingURL=file.d.ts.map

package/dist/next-node/http/file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../../src/next-node/http/file.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,kDAAkD;AAClD,MAAM,MAAM,mBAAmB,GAAG;IACjC,6BAA6B;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,6GAA6G;IAC7G,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,YAAY,CAAC,CA6B1G"}