@fabrika/app 0.5.4 → 0.6.0

package/src/implement/dispatch.ts

@@ -13,6 +13,7 @@ import {
 	type EndpointPlan,
 	type EndpointRow,
 	type ExportDescription,
+	type FormFileArtifact,
 	isAttachmentShape,
 	type LinkTokenClaims,
 	parseEndpointHeader,
@@ -32,7 +33,15 @@ import type { DataKind } from '@fabrika/db/tables'
 import type { TokenVerifier } from '@fabrika/jwks'
 import { createHash, timingSafeEqual } from 'node:crypto'
 import { z } from 'zod/v4'
-import { BROWSER_CONFIG_FILE, joinPath, PAGE_CALLER_FILE, WEBHOOK_BINDING_PARAMETER } from '../contract/defaults'
+import {
+	BROWSER_CONFIG_FILE,
+	FORM_FILE_LIMITS,
+	FORM_INPUT_PART,
+	FORM_MULTIPART_TYPE,
+	joinPath,
+	PAGE_CALLER_FILE,
+	WEBHOOK_BINDING_PARAMETER,
+} from '../contract/defaults'
 import type { Schema } from '../contract/define'
 import {
 	BadRequestError,
@@ -45,18 +54,18 @@ import {
 	UnauthorizedError,
 } from '../errors'
 import type { RequestExecutionContext } from '../fetch'
-import type { FileCollections } from '../files/collections'
+import type { FileCollections, ReceivedFormFile } from '../files/collections'
 import { FileDownload, fileResponse, withFileTreatment } from '../files/treatment'
-import { bootstrapPath, bootstrapResponse, githubAccounts, readBoundedBody, verifyGithubSignature, withBootstrap } from './anonymous'
+import { abortedBody, bootstrapPath, bootstrapResponse, githubAccounts, readBoundedBody, verifyGithubSignature, withBootstrap } from './anonymous'
 import { attachmentResponse } from './attachment'
-import { handlerSignal } from './bounded'
+import { handlerSignal, readBoundedBytes } from './bounded'
 import type { BrowserConfig } from './browser-config'
 import { CapabilityLimitError, type CapabilityMint, RequestFrame, runInRequest } from './capability'
 import { CHALLENGE_LIMITS, type ChallengeVerifier } from './challenge'
 import { connectContext, type ImportWire } from './connect'
 import type { FailureReports } from './failures'
 import { ServerFault } from './faults'
-import { ACCEPTED_BUCKET, clientBucket, type SubmissionFields, submissionOf } from './form-admission'
+import { ACCEPTED_BUCKET, clientBucket, type Submission, type SubmissionFields, submissionOf } from './form-admission'
 import { type HeaderPolicy, withHeaderPolicy } from './headers'
 import type { ContractDatabase } from './implement'
 import { endpointData, Invocation, noFileCollections, siteData, type SiteDeclaration, undeclaredSql } from './invocation'
@@ -70,6 +79,7 @@ import {
 	type MembershipRequest,
 	type ReadDirectory,
 } from './membership'
+import { multipartBoundary, MultipartError, multipartParts, type MultipartReader } from './multipart'
 import { pageCallerOf, presentedBy, type Principal } from './principal'
 import { project, ProjectionRefusedError } from './project'
 import { deliveryKey, WEBHOOK_REPLAY_RETENTION_MS, type WebhookPrincipal, webhookSubject } from './webhook'
@@ -167,6 +177,16 @@ export type ServedEndpoint =
 		readonly site?: SiteDeclaration
 	}
 
+/** A form's file fields and the collections they land in: such a form reads `multipart/form-data`. */
+export interface FormFileAdmission {
+	readonly fields: ReadonlyMap<string, FormFileArtifact>
+	readonly collections: FileCollections
+	/** The bytes all the form's files may write per hour; each file reserves its collection's `maxBytes` first. */
+	readonly bytesPerHour: number
+	/** How long the whole body may take to arrive. */
+	readonly timeoutMs: number
+}
+
 /** What a form admits, decided once at boot from the approved artifact and the application's variables. */
 export interface FormAdmission {
 	/** Requests per minute from one client, admitted before the body is read. */
@@ -174,6 +194,8 @@ export interface FormAdmission {
 	/** Submissions per minute the form accepts in all: only one that passed its honeypot and its challenge counts. */
 	readonly perForm: number
 	readonly fields: SubmissionFields
+	/** The form's file fields; `null` for a form that takes none, whose body is JSON. */
+	readonly files: FormFileAdmission | null
 	/** The challenge's verifier, with the secret the application variable holds; `null` without a challenge. */
 	readonly challenge: ChallengeVerifier | null
 	/** The one token the challenge does not record, so it passes again: `fabrika app dev`'s test widget's; `null` otherwise. */
@@ -740,6 +762,10 @@ export class ContractRuntime {
 		if (!(await admissions.take(served.form, clientBucket(request), admission.perClient))) {
 			throw formRateLimited(served.row)
 		}
+		// A form with files whose every file is optional also takes the JSON body of a page that sends none.
+		if (admission.files !== null && mediaType(request.headers.get('Content-Type')) === FORM_MULTIPART_TYPE) {
+			return await this.#multipartForm(served, admission.files, request, exec)
+		}
 		const body = await readBoundedBody(request, maxBytesOf(served.row))
 		const submission = submissionOf(strictInput(served.row, served.input, parseJson(body)), admission.fields)
 		if (submission.trapped) {
@@ -760,6 +786,142 @@ export class ContractRuntime {
 		return jsonResponse({ result: { received: true } }, 200)
 	}
 
+	/**
+	 * A form that takes files reads its `multipart/form-data` body as it streams, in the order of `#form`: its first part
+	 * is the input as JSON (within the form's `maxBytes`), so the input, the honeypot and the challenge are decided before
+	 * a byte of any file is read. Each file part then lands in its collection under a pending row of its own, owned by
+	 * nobody, and the inbox row that names each file's id makes them held in its own transaction. A submission that does
+	 * not commit deletes every file it received. The whole body arrives within the form's `timeoutMs`.
+	 */
+	async #multipartForm(
+		served: Extract<ServedEndpoint, { kind: 'form' }>,
+		files: FormFileAdmission,
+		request: Request,
+		exec: RequestExecutionContext | undefined,
+	): Promise<Response> {
+		const { admission } = served
+		const boundary = multipartBoundary(request.headers.get('Content-Type'))
+		if (boundary === null) {
+			throw new HttpError(400, 'admission', `'${served.row.id}' takes multipart/form-data with a boundary`)
+		}
+		// Each part is bounded on its own as it streams; a declared length past all of them together is refused unread.
+		const declaredFiles = [...files.fields.values()]
+		const limit = maxBytesOf(served.row) + declaredFiles.reduce((sum, field) => sum + files.collections.maxBytesOf(field.collection), 0)
+			+ (declaredFiles.length + 1) * MULTIPART_PART_OVERHEAD
+		const declared = Number(request.headers.get('Content-Length') ?? '')
+		if (Number.isFinite(declared) && declared > limit) {
+			throw new HttpError(413, 'too_large', `The body is larger than the ${limit} bytes the form's input and files can hold`)
+		}
+		const deadline = AbortSignal.any([request.signal, AbortSignal.timeout(files.timeoutMs)])
+		const parts = multipartParts(request.body ?? new Blob([]).stream(), boundary, { maxHeaderBytes: FORM_FILE_LIMITS.maxPartHeaderBytes })
+		const stop = () => {
+			parts.cancel().catch(() => {})
+		}
+		deadline.addEventListener('abort', stop, { once: true })
+		const received: ReceivedFormFile[] = []
+		/**
+		 * `kept` once the inbox row may have committed: an append that threw may have committed before its answer was
+		 * lost, so its files are left to the sweep, which deletes a pending row's object after an hour and never a held one.
+		 */
+		let kept = false
+		try {
+			const submission = await this.#multipartInput(served, parts)
+			if (submission.trapped) {
+				return jsonResponse({ result: { received: true } }, 200)
+			}
+			if (admission.challenge === null) {
+				// `boot` refuses a form with files and no challenge; reaching this is a composition bug.
+				throw new ServerFault('contract_inconsistent', `'${served.row.id}' takes files without a challenge`)
+			}
+			await this.#challenge(served.form, admission.challenge, submission.token, request, admission.repeatableToken)
+			const columns = new Map<string, string | null>()
+			for (let part = await parts.next(); part !== null; part = await parts.next()) {
+				const field = files.fields.get(part.name)
+				if (field === undefined || columns.has(part.name) || part.filename === null) {
+					await part.body.cancel()
+					throw new HttpError(
+						400,
+						'multipart',
+						`'${served.row.id}': a part is no file field of the form, a field arrives twice, or a file has no filename`,
+					)
+				}
+				const file = await this.#receiveFormFile(served, files, field.collection, part)
+				if (file !== null) {
+					received.push(file)
+				}
+				columns.set(part.name, file?.id ?? null)
+			}
+			const row: Record<string, unknown> = { ...submission.row }
+			for (const [name, field] of files.fields) {
+				const id = columns.get(name) ?? null
+				if (id === null && field.required) {
+					throw new HttpError(400, 'validation', `${name}: the form needs this file`, {
+						issues: [{ path: name, code: 'required', message: 'a file is required' }],
+					})
+				}
+				row[name] = id
+			}
+			const held = { files: received.map(({ id, size, sha256 }) => ({ id, size, sha256 })), holdMs: FORM_FILE_LIMITS.holdMs }
+			kept = true
+			const appended = await this.#framework().appendToInbox(served.form, row, { bucket: ACCEPTED_BUCKET, limit: admission.perForm }, held)
+			if (!appended) {
+				kept = false
+				throw formRateLimited(served.row)
+			}
+		} catch (error) {
+			throw multipartFailure(error, parts, deadline, request)
+		} finally {
+			deadline.removeEventListener('abort', stop)
+			await parts.cancel()
+			if (!kept) {
+				await files.collections.releaseFormFiles(received)
+			}
+		}
+		if (served.then !== null) {
+			// Without an execution context the kick runs detached; it never rejects.
+			const kicked = this.#parts.kick(served.then)
+			exec?.waitUntil(kicked)
+		}
+		return jsonResponse({ result: { received: true } }, 200)
+	}
+
+	/**
+	 * One file of a submission, within the form's hourly byte budget: it reserves its collection's `maxBytes` before its
+	 * first byte is written (429 when they no longer fit) and gives back what it did not use. A file that failed keeps
+	 * its reservation: its bytes may have been written.
+	 */
+	async #receiveFormFile(
+		served: Extract<ServedEndpoint, { kind: 'form' }>,
+		files: FormFileAdmission,
+		collection: string,
+		part: { readonly filename: string | null; readonly contentType: string | null; readonly body: ReadableStream<Uint8Array> },
+	): Promise<ReceivedFormFile | null> {
+		const admissions = this.#framework().forms
+		const reserved = files.collections.maxBytesOf(collection)
+		if (!(await admissions.reserveBytes(served.form, reserved, files.bytesPerHour))) {
+			await part.body.cancel()
+			throw new HttpError(429, 'rate_limited', `'${served.row.id}' takes no more files this hour; try again later`)
+		}
+		const file = await files.collections.receiveFormFile(served.form, collection, part)
+		await admissions.releaseBytes(served.form, reserved - (file?.size ?? 0))
+		return file
+	}
+
+	/** The first part of a multipart form: its input, as JSON within the form's `maxBytes`, parsed strictly. */
+	async #multipartInput(served: Extract<ServedEndpoint, { kind: 'form' }>, parts: MultipartReader): Promise<Submission> {
+		const first = await parts.next()
+		if (first === null || first.name !== FORM_INPUT_PART || first.filename !== null) {
+			await first?.body.cancel()
+			throw new HttpError(400, 'multipart', `'${served.row.id}': the first part is the input as JSON, named '${FORM_INPUT_PART}', without a filename`)
+		}
+		const limit = maxBytesOf(served.row)
+		const bytes = await readBoundedBytes(first.body, { maxBytes: limit })
+		if (bytes === null) {
+			throw new HttpError(413, 'too_large', `The input is larger than ${limit} bytes`)
+		}
+		return submissionOf(strictInput(served.row, served.input, parseJson(bytes)), served.admission.fields)
+	}
+
 	/**
 	 * The token verifies for this host and this form, and was not accepted before unless it is the `repeatable` one: a
 	 * failure is 400, an unreachable provider 503.
@@ -939,6 +1101,33 @@ function admit(row: CredentialedEndpoint, request: Request): void {
 	admitContentType(row, request)
 }
 
+/** What one part adds to a multipart body beside its bytes: its delimiter and its headers, at most. */
+const MULTIPART_PART_OVERHEAD = FORM_FILE_LIMITS.maxPartHeaderBytes + 128
+
+/**
+ * What a failed multipart submission answers: a body that broke the format 400, one that did not arrive in time 408,
+ * and otherwise the failure itself, whichever step met the broken stream first.
+ */
+function multipartFailure(error: unknown, parts: MultipartReader, deadline: AbortSignal, request: Request): unknown {
+	if (isStructuralError(error) && error.httpStatus < 500) {
+		return error
+	}
+	if (request.signal.aborted) {
+		return abortedBody()
+	}
+	if (deadline.aborted) {
+		return new HttpError(408, 'timeout', 'The submission did not arrive in time')
+	}
+	const broken = error instanceof MultipartError ? error : parts.failure()
+	if (broken?.reason === 'interrupted') {
+		return abortedBody()
+	}
+	if (broken !== null) {
+		return new HttpError(400, 'multipart', `The body is not the multipart/form-data the form reads: ${broken.message}`)
+	}
+	return error
+}
+
 /** The content types an endpoint admits; an anonymous endpoint has no session, so this is its whole admission. */
 function formRateLimited(row: EndpointRow): HttpError {
 	return new HttpError(429, 'rate_limited', `'${row.id}' takes no more submissions right now; try again in a minute`)

package/src/implement/implement.ts

@@ -4,6 +4,7 @@
 import type { TablePolicyArtifact } from '@fabrika/auth-core'
 import type { DataLayer } from '@fabrika/db'
 import type { CapabilityAuthority } from '@fabrika/db/capability'
+import type { Session } from '@fabrika/db/framework'
 import type { EmailSender } from '@fabrika/email'
 import type { ConnectSnapshot } from '../contract/connect'
 import type { AnyContract } from '../contract/define'
@@ -16,8 +17,11 @@ import type { ConnectSnapshots, ExactHandlers, HandlersOf } from './types'
  */
 export interface ContractDatabase {
 	readonly tables: Readonly<Record<string, TablePolicyArtifact>>
-	/** The containers an object lies in, by dimension, or `null` when the table that owns `dimension` has no such row. */
-	locate(dimension: string, id: string): Promise<ReadonlyMap<string, string> | null>
+	/**
+	 * The containers an object lies in, by dimension, or `null` when the table that owns `dimension` has no such row.
+	 * `using` is a job's transaction, which also sees the object it wrote; a layer of the application's own ignores it.
+	 */
+	locate(dimension: string, id: string, using?: Session): Promise<ReadonlyMap<string, string> | null>
 }
 
 /** `scoped(tables)` of `@fabrika/db`, which `boot` binds, or a `ContractDatabase` of the application's own. */

package/src/implement/invocation.ts

@@ -267,6 +267,7 @@ export class Invocation {
 			check: boundTo(this.#frame, () => transaction.ended, 'ctx.files'),
 			session: () => transaction.session(),
 			readOnly: kind === 'mutation' && !transaction.readOnly ? null : 'a query reads only; remove files in a mutation',
+			attaches: false,
 		}
 	}
 

package/src/implement/multipart.ts

@@ -0,0 +1,332 @@
+// A `multipart/form-data` body read part by part as it streams (RFC 7578): what a form that takes files receives. The
+// reader never buffers a part's body: each part's bytes are a stream of their own, which the caller consumes to the
+// end before it asks for the next part, so a form reads its input and checks its challenge before a file's first byte
+// is read. It is strict where browsers are: no preamble, a CRLF or `--` after each delimiter, headers within a bound.
+// Anything else is a `MultipartError`, which the form answers 400.
+
+import { Buffer } from 'node:buffer'
+
+/**
+ * A body that is not the `multipart/form-data` a form reads (`malformed`), or one whose stream failed before its end
+ * (`interrupted`: the client closed the connection). Its message names what is wrong, never a byte of it.
+ */
+export class MultipartError extends Error {
+	override readonly name = 'MultipartError'
+	readonly reason: 'malformed' | 'interrupted'
+
+	constructor(message: string, reason: 'malformed' | 'interrupted' = 'malformed') {
+		super(message)
+		this.reason = reason
+	}
+}
+
+export interface MultipartPart {
+	/** The `name` of its `Content-Disposition`. */
+	readonly name: string
+	/** Its `filename`, as sent; `null` when the part has none, which is a plain field. */
+	readonly filename: string | null
+	/** The media type of its `Content-Type`, lower-cased and without parameters; `null` when it has none. */
+	readonly contentType: string | null
+	/** Its bytes. Read it to the end, or cancel it, before the next part. */
+	readonly body: ReadableStream<Uint8Array>
+}
+
+export interface MultipartReader {
+	/** The next part, or `null` after the closing delimiter. Rejects while the previous part's body is unread. */
+	next(): Promise<MultipartPart | null>
+	/** Stops reading the body. */
+	cancel(): Promise<void>
+	/** Why the body broke the format, wherever the break was met (a part's body included); `null` while it did not. */
+	failure(): MultipartError | null
+}
+
+/** RFC 2046: 1 to 70 characters of a closed set, the last not a space. */
+const BOUNDARY = /^[0-9A-Za-z'()+_,\-./:=? ]{0,69}[0-9A-Za-z'()+_,\-./:=?]$/
+const CRLF = Buffer.from('\r\n')
+const HEADERS_END = Buffer.from('\r\n\r\n')
+
+/** The boundary of a `multipart/form-data` `Content-Type`, or `null` when it is another type or names none. */
+export function multipartBoundary(contentType: string | null): string | null {
+	const [type, ...parameters] = splitParameters(contentType ?? '')
+	if (type?.toLowerCase() !== 'multipart/form-data') {
+		return null
+	}
+	for (const parameter of parameters) {
+		const equals = parameter.indexOf('=')
+		if (equals > 0 && parameter.slice(0, equals).trim().toLowerCase() === 'boundary') {
+			const value = unquote(parameter.slice(equals + 1).trim())
+			return value !== null && BOUNDARY.test(value) ? value : null
+		}
+	}
+	return null
+}
+
+/** `a; b="c;d"; e` → `['a', 'b="c;d"', 'e']`: semicolons inside a quoted string do not split. */
+function splitParameters(value: string): string[] {
+	const parts: string[] = []
+	let current = ''
+	let quoted = false
+	for (let index = 0; index < value.length; index++) {
+		const char = value[index] ?? ''
+		if (quoted && char === '\\') {
+			current += char + (value[index + 1] ?? '')
+			index++
+		} else if (char === '"') {
+			quoted = !quoted
+			current += char
+		} else if (char === ';' && !quoted) {
+			parts.push(current.trim())
+			current = ''
+		} else {
+			current += char
+		}
+	}
+	parts.push(current.trim())
+	return parts
+}
+
+/** A parameter value: a token as it is, a quoted string without its quotes and escapes; `null` when malformed. */
+function unquote(value: string): string | null {
+	if (!value.startsWith('"')) {
+		return value === '' || value.includes('"') ? null : value
+	}
+	if (value.length < 2 || !value.endsWith('"')) {
+		return null
+	}
+	let text = ''
+	for (let index = 1; index < value.length - 1; index++) {
+		const char = value[index] ?? ''
+		if (char === '\\') {
+			index++
+			text += value[index] ?? ''
+		} else if (char === '"') {
+			return null
+		} else {
+			text += char
+		}
+	}
+	return text
+}
+
+interface PartHeaders {
+	readonly name: string
+	readonly filename: string | null
+	readonly contentType: string | null
+}
+
+function partHeaders(block: Buffer): PartHeaders {
+	let disposition: string | null = null
+	let contentType: string | null = null
+	for (const line of new TextDecoder('utf-8', { fatal: false }).decode(block).split('\r\n')) {
+		const colon = line.indexOf(':')
+		if (colon <= 0) {
+			throw new MultipartError('a part header is not a name and a value')
+		}
+		const header = line.slice(0, colon).trim().toLowerCase()
+		const value = line.slice(colon + 1).trim()
+		if (header === 'content-disposition') {
+			if (disposition !== null) {
+				throw new MultipartError('a part has two Content-Disposition headers')
+			}
+			disposition = value
+		} else if (header === 'content-type') {
+			contentType = value.split(';')[0]?.trim().toLowerCase() || null
+		}
+	}
+	const [kind, ...parameters] = splitParameters(disposition ?? '')
+	if (kind?.toLowerCase() !== 'form-data') {
+		throw new MultipartError('a part is not form-data (Content-Disposition: form-data; name="…")')
+	}
+	let name: string | null = null
+	let filename: string | null = null
+	for (const parameter of parameters) {
+		const equals = parameter.indexOf('=')
+		const key = equals > 0 ? parameter.slice(0, equals).trim().toLowerCase() : ''
+		const value = equals > 0 ? unquote(parameter.slice(equals + 1).trim()) : null
+		if (key === 'name' || key === 'filename') {
+			if (value === null || (key === 'name' ? name : filename) !== null) {
+				throw new MultipartError(`a part's ${key} is malformed or given twice`)
+			}
+			if (key === 'name') {
+				name = value
+			} else {
+				filename = value
+			}
+		}
+	}
+	if (name === null || name === '') {
+		throw new MultipartError('a part has no name')
+	}
+	return { name, filename, contentType }
+}
+
+/**
+ * Reads `body` as `multipart/form-data` with `boundary`. A part's headers hold at most `maxHeaderBytes`; its body is
+ * as long as the sender makes it, so the caller bounds what it reads of each.
+ */
+export function multipartParts(body: ReadableStream<Uint8Array>, boundary: string, options: { readonly maxHeaderBytes: number }): MultipartReader {
+	const source = body.getReader()
+	const delimiter = Buffer.from(`\r\n--${boundary}`)
+	// The body starts with the first delimiter, without the CRLF that precedes every later one.
+	let buffer: Buffer = Buffer.from(CRLF)
+	let ended = false
+	/** A part's body is being read: the next part waits until it ended. */
+	let reading = false
+	/** The closing delimiter was read: there is no further part. */
+	let finished = false
+	/** Reading stopped before the closing delimiter: no further part can be told from a missing one. */
+	let cancelled = false
+	let failed: MultipartError | null = null
+
+	/** A break of the format; once reading was cancelled, the end it meets is the cancellation's, not the sender's. */
+	const fail = (message: string, reason: 'malformed' | 'interrupted' = 'malformed'): never => {
+		if (cancelled) {
+			throw new MultipartError('the body was not read to its end')
+		}
+		failed = new MultipartError(message, reason)
+		throw failed
+	}
+
+	/** Reads more of the body into the buffer; `false` once the body ended. */
+	async function fill(): Promise<boolean> {
+		if (ended) {
+			return false
+		}
+		let next: Awaited<ReturnType<typeof source.read>>
+		try {
+			next = await source.read()
+		} catch {
+			// A closed connection, or a body stream that failed: the sender's, never the application's.
+			return fail('the body could not be read to its end', 'interrupted')
+		}
+		if (next.done) {
+			ended = true
+			return false
+		}
+		buffer = buffer.byteLength === 0 ? Buffer.from(next.value) : Buffer.concat([buffer, next.value])
+		return true
+	}
+
+	/** At least `size` bytes in the buffer, or the body ended first. */
+	async function want(size: number): Promise<boolean> {
+		while (buffer.byteLength < size) {
+			if (!(await fill())) {
+				return false
+			}
+		}
+		return true
+	}
+
+	/** The bytes after a delimiter: `--` closes the body, CRLF starts the next part's headers. */
+	async function afterDelimiter(): Promise<'part' | 'end'> {
+		if (!(await want(2))) {
+			return fail('the body ends inside a delimiter')
+		}
+		const marker = buffer.subarray(0, 2).toString('latin1')
+		buffer = buffer.subarray(2)
+		if (marker === '--') {
+			return 'end'
+		}
+		if (marker !== '\r\n') {
+			return fail('a delimiter is followed by neither CRLF nor --')
+		}
+		return 'part'
+	}
+
+	async function headers(): Promise<PartHeaders> {
+		for (;;) {
+			const end = buffer.indexOf(HEADERS_END)
+			if (end > options.maxHeaderBytes || (end < 0 && buffer.byteLength > options.maxHeaderBytes)) {
+				return fail(`a part's headers are longer than ${options.maxHeaderBytes} bytes`)
+			}
+			if (end >= 0) {
+				const block = buffer.subarray(0, end)
+				buffer = buffer.subarray(end + HEADERS_END.byteLength)
+				try {
+					return partHeaders(block)
+				} catch (error) {
+					return fail(error instanceof Error ? error.message : 'a part header is malformed')
+				}
+			}
+			if (!(await fill())) {
+				return fail("the body ends inside a part's headers")
+			}
+		}
+	}
+
+	function partBody(): ReadableStream<Uint8Array> {
+		return new ReadableStream<Uint8Array>({
+			async pull(controller) {
+				try {
+					for (;;) {
+						const at = buffer.indexOf(delimiter)
+						if (at >= 0) {
+							if (at > 0) {
+								controller.enqueue(new Uint8Array(buffer.subarray(0, at)))
+							}
+							buffer = buffer.subarray(at + delimiter.byteLength)
+							reading = false
+							controller.close()
+							return
+						}
+						// Keep what could be the start of the delimiter; everything before it is the part's.
+						const safe = buffer.byteLength - (delimiter.byteLength - 1)
+						if (safe > 0) {
+							controller.enqueue(new Uint8Array(buffer.subarray(0, safe)))
+							buffer = buffer.subarray(safe)
+							return
+						}
+						if (!(await fill())) {
+							fail('the body ends inside a part')
+						}
+					}
+				} catch (error) {
+					controller.error(error)
+				}
+			},
+			async cancel() {
+				cancelled = true
+				await source.cancel().catch(() => {})
+			},
+		})
+	}
+
+	let started = false
+	return {
+		async next(): Promise<MultipartPart | null> {
+			if (finished) {
+				return null
+			}
+			if (cancelled) {
+				throw new MultipartError('the body was not read to its end')
+			}
+			if (failed !== null) {
+				throw failed
+			}
+			if (reading) {
+				throw new MultipartError("the previous part's body was not read to its end")
+			}
+			if (!started) {
+				started = true
+				if (!(await want(delimiter.byteLength)) || buffer.indexOf(delimiter) !== 0) {
+					return fail('the body does not start with its boundary')
+				}
+				buffer = buffer.subarray(delimiter.byteLength)
+			}
+			if ((await afterDelimiter()) === 'end') {
+				finished = true
+				// The epilogue is the sender's; nothing reads it.
+				await source.cancel().catch(() => {})
+				return null
+			}
+			const found = await headers()
+			reading = true
+			return Object.freeze({ ...found, body: partBody() })
+		},
+		async cancel(): Promise<void> {
+			cancelled = !finished
+			await source.cancel().catch(() => {})
+		},
+		failure: () => failed,
+	}
+}