@oomol-lab/open-flow 0.1.0-beta.74 → 0.1.0-beta.75

package/src/control/common/authoringSchema.ts

@@ -9,6 +9,7 @@ import {
   authoringDefinitionSchemas as definitions,
 } from '../../flow/common/changeSchema.ts'
 import { retryConfigurationSchema, retryNodeTypes } from '../../flow/common/retry.ts'
+import { httpRequestConfigSchema } from '../../http/common/httpRequest.ts'
 import { authoringLlmConfiguration } from './authoringLlm.ts'
 import { authoringOpenApiSchema } from './authoringOpenApi.ts'
 
@@ -31,6 +32,7 @@ export const authoringTypes = [
   'llm',
   'decision',
   'openapi',
+  'http-request',
   'condition',
   'value',
   'wait',
@@ -111,6 +113,7 @@ export const authoringConfigurations = {
   'code': z.strictObject({ inputs: inputFields, outputs: outputFields, capabilities: authoringCapabilities.optional() }),
   'connector': definitions.connector.omit({ outputMode: true }).strict(),
   'openapi': authoringOpenApiSchema,
+  'http-request': httpRequestConfigSchema,
   'agent': definitions.agent
     .omit({ prompt: true, tools: true })
     .extend({
@@ -296,15 +299,17 @@ export function authoringSchema(kind?: AuthoringType) {
                       ? 'Configure static parameters with node.add.inputs or input.set. Definitions come from the selected Trigger key; execution output and variable sources are unavailable.'
                       : kind == 'llm'
                         ? 'Configure model settings, message templates and history as defaults. Input bindings with the same names override these defaults; named business inputs can be bound directly. Template strings interpolate {{name}}.'
-                        : kind == 'openapi'
-                          ? 'Select an operation; the tool resolves its ports and authentication. Read authenticationChoices from node details. authentication is replaced as a complete choice. Bind advertised credentials through inputs.'
-                          : kind == 'workflow'
-                            ? 'Select another workflow with config.flowId. A workflow cannot call itself, including in a disconnected node. Owned unpublished or unavailable targets may be saved as incomplete drafts. Use node.refresh to load the current published interface.'
-                            : kind == 'agent'
-                              ? 'Tools accept Connector Actions or {kind: "workflow", flowId, name, description, approval, inputs}. Workflow parameter sources use model, input or value. The platform derives the interface. Refresh a workflow tool with node.refresh and tool: its name.'
-                              : kind == 'code'
-                                ? 'Select workflows through config.capabilities: [{kind: "workflow", flowId, name}]. Call context.workflows.call(name, input) and await its business output. The platform derives input/output types. Refresh a selected workflow tool with node.refresh and tool: its name. Calls obey node and Run time limits.'
-                                : 'Supply business configuration and input data. Fixed definitions are assembled by the tool. Existing constraints and defaults are preserved on partial updates.',
+                        : kind == 'http-request'
+                          ? 'Configure method, query/headers modes and names, bodyFormat, authentication, responseFormat and statusPolicy. Bind url, query.<name>/header.<name> or whole query/headers objects, body and auth.token (Basic: auth.username/auth.password). Credentials accept variables or upstream outputs only. Outputs: body, statusCode, headers. Authentication is replaced as a complete choice.'
+                          : kind == 'openapi'
+                            ? 'Select an operation; the tool resolves its ports and authentication. Read authenticationChoices from node details. authentication is replaced as a complete choice. Bind advertised credentials through inputs.'
+                            : kind == 'workflow'
+                              ? 'Select another workflow with config.flowId. A workflow cannot call itself, including in a disconnected node. Owned unpublished or unavailable targets may be saved as incomplete drafts. Use node.refresh to load the current published interface.'
+                              : kind == 'agent'
+                                ? 'Tools accept Connector Actions or {kind: "workflow", flowId, name, description, approval, inputs}. Workflow parameter sources use model, input or value. The platform derives the interface. Refresh a workflow tool with node.refresh and tool: its name.'
+                                : kind == 'code'
+                                  ? 'Select workflows through config.capabilities: [{kind: "workflow", flowId, name}]. Call context.workflows.call(name, input) and await its business output. The platform derives input/output types. Refresh a selected workflow tool with node.refresh and tool: its name. Calls obey node and Run time limits.'
+                                  : 'Supply business configuration and input data. Fixed definitions are assembled by the tool. Existing constraints and defaults are preserved on partial updates.',
         example: {
           op: 'node.add',
           as: 'step',
@@ -312,15 +317,16 @@ export function authoringSchema(kind?: AuthoringType) {
           name: 'Step',
           ...((
             {
-              start: { config: { inputDefs: {} } },
-              outputs: { config: { outputDefs: {} } },
-              workflow: { config: { flowId: '<Flow ID>' } },
-              connector: { config: { action: '<Action ID>', connectionId: '<Connection ID>' } },
-              poll: { config: { key: '<Trigger key>', schedule: [{ type: 'every', unit: 'minute', value: 5 }] } },
-              integration: { config: { key: '<Trigger key>' } },
-              openapi: { config: { sourceUrl: 'https://example.com/openapi.json', path: '/items', method: 'get' } },
-              code: { code: 'export default ({value}) => ({result:value})', inputs: { value: { kind: 'value', value: 'Hello' } } },
-              condition: {
+              'start': { config: { inputDefs: {} } },
+              'outputs': { config: { outputDefs: {} } },
+              'workflow': { config: { flowId: '<Flow ID>' } },
+              'connector': { config: { action: '<Action ID>', connectionId: '<Connection ID>' } },
+              'poll': { config: { key: '<Trigger key>', schedule: [{ type: 'every', unit: 'minute', value: 5 }] } },
+              'integration': { config: { key: '<Trigger key>' } },
+              'http-request': { config: {}, inputs: { url: { kind: 'value', value: 'https://example.com' } } },
+              'openapi': { config: { sourceUrl: 'https://example.com/openapi.json', path: '/items', method: 'get' } },
+              'code': { code: 'export default ({value}) => ({result:value})', inputs: { value: { kind: 'value', value: 'Hello' } } },
+              'condition': {
                 config: {
                   match: 'first',
                   branches: [
@@ -335,15 +341,15 @@ export function authoringSchema(kind?: AuthoringType) {
                   ],
                 },
               },
-              value: { config: { values: { threshold: 100, region: 'EU' } } },
-              webhook: { config: { method: 'POST', body: { orderId: { schema: { type: 'string' }, nullable: false } } } },
-              wait: { prompt: 'Continue processing this order?', inputs: { order: { kind: 'value', value: { orderId: 'A-1' } } } },
-              approval: { prompt: 'Approve this order?', inputs: { order: { kind: 'value', value: { orderId: 'A-1' } } } },
-              llm: {
+              'value': { config: { values: { threshold: 100, region: 'EU' } } },
+              'webhook': { config: { method: 'POST', body: { orderId: { schema: { type: 'string' }, nullable: false } } } },
+              'wait': { prompt: 'Continue processing this order?', inputs: { order: { kind: 'value', value: { orderId: 'A-1' } } } },
+              'approval': { prompt: 'Approve this order?', inputs: { order: { kind: 'value', value: { orderId: 'A-1' } } } },
+              'llm': {
                 config: { model: { model: 'deepseek-v4-flash' }, template: [{ role: 'user', content: 'Summarize {{order}}.' }] },
                 inputs: { order: { kind: 'value', value: { orderId: 'A-1', total: 42 } } },
               },
-              agent: {
+              'agent': {
                 config: {
                   model: 'deepseek-v4-flash',
                 },

package/src/execution/common/engineContract.ts

@@ -6,6 +6,7 @@ export interface EngineContract {
   readonly waitAutoContinue?: boolean
   readonly webhookResponses?: boolean
   readonly workflowTools?: boolean
+  readonly httpRequests?: boolean
 }
 
 export const currentEngineContract = 'open-flow-engine/v8'
@@ -13,6 +14,7 @@ export const nodejsEngineContract = 'open-flow-engine/v8/nodejs-compat-v1'
 
 const currentContract: EngineContract = {
   workflowTools: true,
+  httpRequests: true,
   waitAutoContinue: true,
   webhookResponses: true,
   platformExports: new Set(['engineContract', 'identity']),
@@ -64,12 +66,14 @@ export function findEngineContract(contract: string): EngineContract | undefined
     return {
       ...(contract.endsWith('/nodejs-compat-v1') ? nodejsContract : currentContract),
       workflowTools: false,
+      httpRequests: false,
       platformSource: `export const engineContract = ${JSON.stringify(contract)}\nexport function identity(value) { return value }\n`,
     }
   if (contract == 'open-flow-engine/v6' || contract == 'open-flow-engine/v6/nodejs-compat-v1')
     return {
       ...(contract == 'open-flow-engine/v6' ? currentContract : nodejsContract),
       workflowTools: false,
+      httpRequests: false,
       waitAutoContinue: false,
       webhookResponses: false,
       platformSource: `export const engineContract = ${JSON.stringify(contract)}

package/src/execution/common/events.ts

@@ -22,6 +22,7 @@ const nodeKinds = new Set([
   'decision',
   'javascript',
   'openapi',
+  'http-request',
   'llm',
   'value',
   'wait',
@@ -54,6 +55,7 @@ function nodeKind(
   | 'decision'
   | 'javascript'
   | 'openapi'
+  | 'http-request'
   | 'llm'
   | 'value'
   | 'wait'
@@ -73,6 +75,7 @@ function nodeKind(
     | 'decision'
     | 'javascript'
     | 'openapi'
+    | 'http-request'
     | 'llm'
     | 'value'
     | 'wait'

package/src/execution/common/node-execution.ts

@@ -108,6 +108,7 @@ function nodeKind(
   | 'decision'
   | 'javascript'
   | 'openapi'
+  | 'http-request'
   | 'llm'
   | 'value'
   | 'wait'
@@ -319,7 +320,8 @@ export function executeNode(
     const title = nodeTitle(node)
     const projectedInputs = Object.fromEntries(
       Object.entries(nodeInputs).filter(([handle]) => {
-        if (node.kind == 'task' && 'executor' in node.task && node.task?.executor.kind == 'openapi' && handle.startsWith('auth.')) return false
+        if (node.kind == 'task' && 'executor' in node.task && ['openapi', 'http-request'].includes(node.task.executor.kind) && handle.startsWith('auth.'))
+          return false
         const mapping = nodeInputMappings(node)[handle]
         return mapping?.kind != 'sources' || mapping.sources.every((source) => source.kind != 'binding')
       }),
@@ -365,7 +367,7 @@ export function executeNode(
             Object.entries(nodeInputs).filter(([handle]) => {
               if (additional.has(handle)) return false
               const task = 'executor' in node.task ? node.task : undefined
-              if (task?.executor.kind != 'openapi') return true
+              if (task == null || !['openapi', 'http-request'].includes(task.executor.kind)) return true
               const mapping = node.inputs[handle]
               return (
                 mapping?.kind != 'unset' &&

package/src/execution/common/scheduler.ts

@@ -69,6 +69,7 @@ export type SchedulerEvent =
         | 'decision'
         | 'javascript'
         | 'openapi'
+        | 'http-request'
         | 'llm'
         | 'value'
         | 'wait'

package/src/flow/common/change.ts

@@ -1,6 +1,6 @@
 import type { JsonValue, Port, PortDefinition } from '../../types/index.ts'
 
-import { assertOpenApiAuthBindings } from '../../openapi/common/authBindings.ts'
+import { assertHttpAuthBindings } from '../../http/common/authBindings.ts'
 export { fixedInputValue, inputValue, inputValues } from './inputValue.ts'
 import type { RetryConfiguration } from './retry.ts'
 import type { WebhookMethod } from './webhookMethod.ts'
@@ -167,6 +167,7 @@ export interface ConditionNode extends GraphNodeBase {
 }
 
 export type ManagedTaskExecutor =
+  | import('../../http/common/httpRequest.ts').HttpRequestExecutor
   | import('../../workflow/common/workflow.ts').WorkflowExecutor
   | import('../../decision/common/decision.ts').DecisionExecutor
   | import('../../openapi/common/openapi.ts').OpenApiExecutor
@@ -1031,6 +1032,6 @@ export function applyFlowChanges(content: RevisionContent, operations: readonly
       }
     }
   }
-  assertOpenApiAuthBindings(document)
+  assertHttpAuthBindings(document)
   return upgradeDecodedRevisionContent({ document, modelVersion: currentFlowModelVersion, modules })
 }

package/src/flow/common/changeSchema.ts

@@ -3,7 +3,8 @@ import type { ChangeOperation, FlowDocument, JsonValue, RevisionContent } from '
 import { dequal } from 'dequal/lite'
 import { z } from 'zod'
 import { limitDecisionTask } from '../../decision/common/decision.ts'
-import { assertOpenApiAuthBindings } from '../../openapi/common/authBindings.ts'
+import { assertHttpAuthBindings } from '../../http/common/authBindings.ts'
+import { httpRequestExecutorSchema } from '../../http/common/httpRequest.ts'
 import { checkJsonDepth } from './json.ts'
 import { retryConfigurationSchema } from './retry.ts'
 import { triggerScheduleSchema } from './triggerScheduleSchema.ts'
@@ -118,6 +119,7 @@ const managedFields = z.object({
         .optional(),
     }),
     z.strictObject({ kind: z.literal('workflow'), flowId: text, revisionId: text }),
+    httpRequestExecutorSchema,
   ]),
 })
 
@@ -591,7 +593,7 @@ export function decodeRevisionContent(value: unknown): RevisionContent {
   checkJsonDepth(value)
   const content = revision.parse(value) as RevisionContent
   checkModelVersion(content)
-  assertOpenApiAuthBindings(content.document)
+  assertHttpAuthBindings(content.document)
   return content
 }
 
@@ -601,7 +603,7 @@ export function decodeRevisionEnvelope(value: unknown): RevisionContent {
   const candidate = revisionSource.modelVersion == 2 ? { ...revisionSource, document: upgradeLegacyDocument(revisionSource.document) } : value
   const content = envelope.parse(candidate) as RevisionContent
   checkModelVersion(content)
-  assertOpenApiAuthBindings(content.document)
+  assertHttpAuthBindings(content.document)
   return { modelVersion: content.modelVersion, document: content.document, modules: content.modules }
 }
 
@@ -711,6 +713,13 @@ export function changeOperationsSchema(kind?: string): JsonValue {
 }
 
 function checkModelVersion(content: RevisionContent): void {
+  if (
+    content.modelVersion < 11 &&
+    Object.values(content.document.graph.nodes).some(
+      (candidateNode) => candidateNode.kind == 'task' && 'executor' in candidateNode.task && candidateNode.task.executor.kind == 'http-request',
+    )
+  )
+    throw new TypeError('HTTP Request requires Flow model version 11.')
   if (
     content.modelVersion < 11 &&
     Object.values(content.document.graph.nodes).some(

package/src/flow/common/graph.ts

@@ -1,3 +1,4 @@
+import type { InputPort } from './change.ts'
 import type {
   BindingSource,
   FlowDocument,
@@ -14,6 +15,7 @@ import type {
 } from './change.ts'
 import type { Diagnostic } from './semantics.ts'
 
+import { httpHeaderNameIssue } from '../../http/common/headers.ts'
 import { missingTriggerConfig, resolveTriggerConfig } from '../../trigger/common/config.ts'
 import { triggerOutputDefinitions, triggerOutputPorts, webhookSupportsBody } from '../../trigger/common/contract.ts'
 import { isTriggerNode, portsByHandle, validVariableName } from './change.ts'
@@ -27,7 +29,6 @@ import {
   webhookResponseInputs,
   validWebhookStatus,
   webhookHeaderValues,
-  webhookHeaderNameIssue,
   webhookHeaderValuePort,
   webhookHeadersPort,
   webhookResponseAllowsBody,
@@ -92,7 +93,7 @@ export function webhookResponseDiagnostics(graph: Graph, triggerId: string, path
     ] as const) {
       const names: string[] = []
       for (const name of Object.keys(headers ?? {})) {
-        if (webhookHeaderNameIssue(name, names) != null)
+        if (httpHeaderNameIssue(name, names) != null)
           diagnostics.push(graphDiagnostic('trigger.webhook-response-header-name', 'Use valid, unique HTTP header names.', location))
         names.push(name)
       }
@@ -615,9 +616,14 @@ export function checkInputSources(
 }
 
 /** Enumerate structurally available outputs while retaining their compatibility with one input. */
-export function inputSourceCandidates(graph: Graph, target: string, handle: string): Readonly<Record<string, readonly InputSourceCandidate[]>> {
+export function inputSourceCandidates(
+  graph: Graph,
+  target: string,
+  handle: string,
+  inputPort?: InputPort,
+): Readonly<Record<string, readonly InputSourceCandidate[]>> {
   const targetNode = graph.nodes[target]
-  const input = targetNode == null ? undefined : nodeInputPorts(targetNode)[handle]
+  const input = inputPort ?? (targetNode == null ? undefined : nodeInputPorts(targetNode)[handle])
   if (input == null) return {}
   const analysis = graphPaths(graph)
   return Object.fromEntries(

package/src/flow/common/retry.ts

@@ -7,7 +7,7 @@ export interface RetryConfiguration {
   readonly intervalMs: number
 }
 
-export const retryNodeTypes = ['code', 'connector', 'openapi', 'llm', 'decision'] as const
+export const retryNodeTypes = ['code', 'connector', 'openapi', 'http-request', 'llm', 'decision'] as const
 export const nodeRetryLimits = { maxRetries: 5, minIntervalMs: 1000, maxIntervalMs: 60000, intervalStepMs: 1000 } as const
 export const defaultNodeRetry: RetryConfiguration = { maxRetries: 2, intervalMs: 2000 }
 export const retryConfigurationSchema = z.strictObject({

package/src/flow/common/semantics.ts

@@ -1,4 +1,6 @@
+import { dequal } from 'dequal/lite'
 import { decisionTaskIssues } from '../../decision/common/decision.ts'
+import { httpRequestIssues, httpAuthHandles, httpRequestTask, httpRequestUrl } from '../../http/common/httpRequest.ts'
 import { openApiIssues, authHandles } from '../../openapi/common/openapi.ts'
 import { nodeWorkflowReferences } from '../../workflow/common/workflow.ts'
 import { isTriggerNode } from './change.ts'
@@ -271,13 +273,57 @@ export async function validateFlow(revision: RevisionContent, engine: EngineCont
       })
     for (const message of openApiIssues(task))
       checked.diagnostics.push({ code: 'openapi.config-invalid', column: 0, line: 1, message, path: `/document/graph/nodes/${nodeId}/task/executor` })
-    if (task.executor.kind == 'openapi') {
-      const handles = authHandles(task.executor.auth)
+    if (task.executor.kind == 'http-request') {
+      for (const issue of httpRequestIssues(task.executor))
+        checked.diagnostics.push({
+          code: 'http-request.config-invalid',
+          column: 0,
+          line: 1,
+          message: issue.message,
+          path: `/document/graph/nodes/${nodeId}/task/executor/${issue.field}`,
+        })
+      if (node.inputs.url?.kind == 'value') {
+        try {
+          httpRequestUrl(node.inputs.url.value)
+        } catch {
+          checked.diagnostics.push({
+            code: 'http-request.url-invalid',
+            column: 0,
+            line: 1,
+            message: 'Enter an HTTP(S) URL without embedded credentials.',
+            path: `/document/graph/nodes/${nodeId}/inputs/url`,
+          })
+        }
+      }
+      if (task.executor.bodyFormat != 'none' && (node.inputs.body == null || node.inputs.body.kind == 'unset'))
+        checked.diagnostics.push({
+          code: 'http-request.body-required',
+          column: 0,
+          line: 1,
+          message: 'Set or bind the request body; JSON null is an explicit value.',
+          path: `/document/graph/nodes/${nodeId}/inputs/body`,
+        })
+      const expected = httpRequestTask(task.executor)
+
+      if (
+        !dequal(httpPortContracts(task.inputs), httpPortContracts(expected.inputs)) ||
+        !dequal(httpPortContracts(task.outputs), httpPortContracts(expected.outputs))
+      )
+        checked.diagnostics.push({
+          code: 'http-request.ports-invalid',
+          column: 0,
+          line: 1,
+          message: 'HTTP Request ports must match its configuration.',
+          path: `/document/graph/nodes/${nodeId}/task`,
+        })
+    }
+    if (task.executor.kind == 'openapi' || task.executor.kind == 'http-request') {
+      const handles = task.executor.kind == 'openapi' ? authHandles(task.executor.auth) : httpAuthHandles(task.executor)
       for (const handle of handles) {
         const mapping = node.inputs[handle]
         if (mapping?.kind != 'sources' || mapping.sources.length == 0)
           checked.diagnostics.push({
-            code: 'openapi.auth-source',
+            code: `${task.executor.kind}.auth-source`,
             column: 0,
             line: 1,
             message: 'Authentication requires a deployment variable or upstream output.',
@@ -385,9 +431,20 @@ function runRevision(revision: RevisionContent, triggerId: string): RevisionCont
   }
 }
 
+const httpPortContracts = (ports: import('./change.ts').ManagedTaskDefinition['inputs']) =>
+  ports
+    .filter((port) => 'handle' in port)
+    .map(({ handle, jsonSchema, nullable }) => ({ handle, jsonSchema, nullable }))
+    .toSorted((a, b) => a.handle.localeCompare(b.handle))
+
 export async function prepareFlow(revision: RevisionContent, engineContract: string, triggerId?: string): Promise<PrepareFlowResult> {
   const engine = findEngineContract(engineContract)
   if (engine == null) return { kind: 'engine-unsupported' }
+  if (
+    !engine.httpRequests &&
+    Object.values(revision.document.graph.nodes).some((node) => node.kind == 'task' && 'executor' in node.task && node.task.executor.kind == 'http-request')
+  )
+    return { kind: 'engine-unsupported' }
   if (!engine.workflowTools && Object.values(revision.document.graph.nodes).some((node) => nodeWorkflowReferences(node).some((ref) => ref.tool != null)))
     return { kind: 'engine-unsupported' }
   if (triggerId != null) {

package/src/flow/common/webhookResponse.ts

@@ -1,5 +1,7 @@
 import type { InputPort, JsonValue, Port, PortDefinition } from './change.ts'
 
+import { httpHeaderNameIssue } from '../../http/common/headers.ts'
+
 export const webhookResponseTimeout = {
   defaultMs: 30_000,
   minMs: 1000,
@@ -30,12 +32,6 @@ export function workflowOutputsPort(outputs: readonly Port[]): PortDefinition {
   } as const
 }
 
-/** Header names are case-insensitive; never silently combine duplicate business fields. */
-export function webhookHeaderNameIssue(name: string, names: readonly string[]): 'invalid' | 'duplicate' | undefined {
-  if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) return 'invalid'
-  if (names.some((candidate) => candidate.toLowerCase() === name.toLowerCase())) return 'duplicate'
-}
-
 /** Fixed inputs belong to the node, not author-supplied definitions. */
 export const webhookResponseInputs: readonly InputPort[] = [
   { handle: 'body', jsonSchema: {}, nullable: true, value: '' },
@@ -60,7 +56,7 @@ export function webhookHeaderValues(source: unknown): Readonly<Record<string, st
   const headers: Record<string, string> = {}
   const names: string[] = []
   for (const [name, value] of Object.entries(source)) {
-    if (webhookHeaderNameIssue(name, names) != null) return
+    if (httpHeaderNameIssue(name, names) != null) return
     if (typeof value !== 'string' && typeof value !== 'boolean' && !(typeof value === 'number' && Number.isFinite(value))) return
     const text = String(value)
     if ([...text].some((character) => character.charCodeAt(0) > 255 || /[\0\r\n]/.test(character))) return

package/src/{openapi → http}/common/authBindings.ts

@@ -1,12 +1,12 @@
 import type { FlowDocument } from '../../flow/common/change.ts'
 
 /** Never allow credentials to enter a Revision as literal node inputs. */
-export function assertOpenApiAuthBindings(document: FlowDocument): void {
+export function assertHttpAuthBindings(document: FlowDocument): void {
   for (const node of Object.values(document.graph.nodes)) {
-    if (node.kind != 'task' || !('executor' in node.task) || node.task.executor.kind != 'openapi') continue
+    if (node.kind != 'task' || !('executor' in node.task) || !['openapi', 'http-request'].includes(node.task.executor.kind)) continue
     for (const [handle, mapping] of Object.entries(node.inputs)) {
       if (handle.startsWith('auth.') && mapping.kind == 'value')
-        throw new TypeError('OpenAPI authentication accepts deployment variables and upstream outputs only.')
+        throw new TypeError('HTTP authentication accepts deployment variables and upstream outputs only.')
     }
   }
 }

package/src/http/common/headers.ts

@@ -0,0 +1,5 @@
+/** Header names are case-insensitive; never silently combine duplicate business fields. */
+export function httpHeaderNameIssue(name: string, names: readonly string[]): 'invalid' | 'duplicate' | undefined {
+  if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/.test(name)) return 'invalid'
+  if (names.some((candidate) => candidate.toLowerCase() === name.toLowerCase())) return 'duplicate'
+}