@secure-exec/nodejs 0.2.0-rc.1 → 0.2.0-rc.2

package/dist/bridge/network.js

@@ -3,6 +3,81 @@
 // Cap in-sandbox request/response buffering to prevent host memory exhaustion
 const MAX_HTTP_BODY_BYTES = 50 * 1024 * 1024; // 50 MB
 import { exposeCustomGlobal } from "@secure-exec/core/internal/shared/global-exposure";
+let _fetchHandleCounter = 0;
+function encodeFetchBody(body, bodyEncoding) {
+    if (bodyEncoding === "base64" && typeof Buffer !== "undefined") {
+        return new Uint8Array(Buffer.from(body, "base64"));
+    }
+    if (typeof TextEncoder !== "undefined") {
+        return new TextEncoder().encode(body);
+    }
+    const bytes = new Uint8Array(body.length);
+    for (let index = 0; index < body.length; index += 1) {
+        bytes[index] = body.charCodeAt(index) & 0xff;
+    }
+    return bytes;
+}
+function createFetchBodyStream(body, bodyEncoding) {
+    const ReadableStreamCtor = globalThis.ReadableStream;
+    if (typeof ReadableStreamCtor !== "function") {
+        return null;
+    }
+    const bytes = encodeFetchBody(body, bodyEncoding);
+    const handleId = typeof _registerHandle === "function"
+        ? `fetch-body:${++_fetchHandleCounter}`
+        : null;
+    let released = false;
+    let delivered = false;
+    const release = () => {
+        if (released || !handleId) {
+            return;
+        }
+        released = true;
+        _unregisterHandle?.(handleId);
+    };
+    if (handleId) {
+        _registerHandle?.(handleId, "fetch response body");
+    }
+    return new ReadableStreamCtor({
+        pull(controller) {
+            if (delivered) {
+                release();
+                controller.close();
+                return;
+            }
+            delivered = true;
+            controller.enqueue(bytes);
+            controller.close();
+            release();
+        },
+        cancel() {
+            release();
+        },
+    });
+}
+function serializeFetchHeaders(headers) {
+    if (!headers) {
+        return {};
+    }
+    if (headers instanceof Headers) {
+        return Object.fromEntries(headers.entries());
+    }
+    if (isFlatHeaderList(headers)) {
+        const normalized = {};
+        for (let index = 0; index < headers.length; index += 2) {
+            const key = headers[index];
+            const value = headers[index + 1];
+            if (key !== undefined && value !== undefined) {
+                normalized[key] = value;
+            }
+        }
+        return normalized;
+    }
+    return Object.fromEntries(new Headers(headers).entries());
+}
+function createFetchHeaders(headers) {
+    return new Headers(serializeFetchHeaders(headers));
+}
 // Fetch polyfill
 export async function fetch(input, options = {}) {
     if (typeof _networkFetchRaw === 'undefined') {
@@ -15,7 +90,7 @@ export async function fetch(input, options = {}) {
         resolvedUrl = input.url;
         options = {
             method: input.method,
-            headers: Object.fromEntries(input.headers.entries()),
+            headers: serializeFetchHeaders(input.headers),
             body: input.body,
             ...options,
         };
@@ -25,39 +100,66 @@ export async function fetch(input, options = {}) {
     }
     const optionsJson = JSON.stringify({
         method: options.method || "GET",
-        headers: options.headers || {},
+        headers: serializeFetchHeaders(options.headers),
         body: options.body || null,
     });
-    const responseJson = await _networkFetchRaw.apply(undefined, [resolvedUrl, optionsJson], {
-        result: { promise: true },
-    });
-    const response = JSON.parse(responseJson);
-    // Create Response-like object
-    return {
-        ok: response.ok,
-        status: response.status,
-        statusText: response.statusText,
-        headers: new Map(Object.entries(response.headers || {})),
-        url: response.url || resolvedUrl,
-        redirected: response.redirected || false,
-        type: "basic",
-        async text() {
-            return response.body || "";
-        },
-        async json() {
-            return JSON.parse(response.body || "{}");
-        },
-        async arrayBuffer() {
-            // Not fully supported - return empty buffer
-            return new ArrayBuffer(0);
-        },
-        async blob() {
-            throw new Error("Blob not supported in sandbox");
-        },
-        clone() {
-            return { ...this };
-        },
-    };
+    const handleId = typeof _registerHandle === "function"
+        ? `fetch:${++_fetchHandleCounter}`
+        : null;
+    if (handleId) {
+        _registerHandle?.(handleId, `fetch ${resolvedUrl}`);
+    }
+    try {
+        const responseJson = await _networkFetchRaw.apply(undefined, [resolvedUrl, optionsJson], {
+            result: { promise: true },
+        });
+        const response = JSON.parse(responseJson);
+        const bodyEncoding = response.headers?.["x-body-encoding"] ?? null;
+        const responseBody = response.body ?? "";
+        let bodyStream;
+        // Create Response-like object
+        return {
+            ok: response.ok,
+            status: response.status,
+            statusText: response.statusText,
+            headers: new Map(Object.entries(response.headers || {})),
+            url: response.url || resolvedUrl,
+            redirected: response.redirected || false,
+            type: "basic",
+            get body() {
+                if (bodyStream === undefined) {
+                    bodyStream = createFetchBodyStream(responseBody, bodyEncoding);
+                }
+                return bodyStream;
+            },
+            async text() {
+                if (bodyEncoding === "base64" && typeof Buffer !== "undefined") {
+                    return Buffer.from(responseBody, "base64").toString("utf8");
+                }
+                return responseBody;
+            },
+            async json() {
+                const textBody = bodyEncoding === "base64" && typeof Buffer !== "undefined"
+                    ? Buffer.from(responseBody, "base64").toString("utf8")
+                    : responseBody;
+                return JSON.parse(textBody || "{}");
+            },
+            async arrayBuffer() {
+                return Uint8Array.from(encodeFetchBody(responseBody, bodyEncoding)).buffer;
+            },
+            async blob() {
+                throw new Error("Blob not supported in sandbox");
+            },
+            clone() {
+                return { ...this };
+            },
+        };
+    }
+    finally {
+        if (handleId) {
+            _unregisterHandle?.(handleId);
+        }
+    }
 }
 // Headers class
 export class Headers {
@@ -131,7 +233,7 @@ export class Request {
     constructor(input, init = {}) {
         this.url = typeof input === "string" ? input : input.url;
         this.method = init.method || (typeof input !== "string" ? input.method : undefined) || "GET";
-        this.headers = new Headers(init.headers || (typeof input !== "string" ? input.headers : undefined));
+        this.headers = createFetchHeaders(init.headers || (typeof input !== "string" ? input.headers : undefined));
         this.body = init.body || null;
         this.mode = init.mode || "cors";
         this.credentials = init.credentials || "same-origin";
@@ -777,80 +879,14 @@ export class ClientRequest {
             }
             const normalizedHeaders = normalizeRequestHeaders(this._options.headers);
             const requestMethod = String(this._options.method || "GET").toUpperCase();
-            const loopbackServerByPort = findLoopbackServerByPort(this._options);
-            const directLoopbackConnectServer = requestMethod === "CONNECT"
-                ? loopbackServerByPort
-                : null;
-            const directLoopbackUpgradeServer = requestMethod !== "CONNECT" &&
-                hasUpgradeRequestHeaders(normalizedHeaders) &&
-                loopbackServerByPort?.listenerCount("upgrade")
-                ? loopbackServerByPort
-                : null;
-            if (directLoopbackConnectServer) {
-                const response = await dispatchLoopbackConnectRequest(directLoopbackConnectServer, this._options);
-                this.finished = true;
-                this.socket = response.socket;
-                response.response.socket = response.socket;
-                response.socket.once("close", () => {
-                    this._emit("close");
-                });
-                this._emit("connect", response.response, response.socket, response.head);
-                process.nextTick(() => {
-                    this._finalizeSocket(socket, false);
-                });
-                return;
-            }
-            if (directLoopbackUpgradeServer) {
-                const response = await dispatchLoopbackUpgradeRequest(directLoopbackUpgradeServer, this._options, this._body);
-                this.finished = true;
-                this.socket = response.socket;
-                response.response.socket = response.socket;
-                response.socket.once("close", () => {
-                    this._emit("close");
-                });
-                this._emit("upgrade", response.response, response.socket, response.head);
-                process.nextTick(() => {
-                    this._finalizeSocket(socket, false);
-                });
-                return;
-            }
-            const directLoopbackServer = requestMethod !== "CONNECT" &&
-                hasUpgradeRequestHeaders(normalizedHeaders) &&
-                !directLoopbackUpgradeServer
-                ? loopbackServerByPort
-                : findLoopbackServerForRequest(this._options);
-            const directLoopbackHttp2CompatServer = !directLoopbackServer &&
-                requestMethod !== "CONNECT" &&
-                !hasUpgradeRequestHeaders(normalizedHeaders)
-                ? findLoopbackHttp2CompatibilityServer(this._options)
-                : null;
-            const serializedRequest = JSON.stringify({
-                method: requestMethod,
-                url: this._options.path || "/",
-                headers: normalizedHeaders,
-                rawHeaders: flattenRawHeaders(normalizedHeaders),
-                bodyBase64: this._body
-                    ? Buffer.from(this._body).toString("base64")
-                    : undefined,
+            const responseJson = await _networkHttpRequestRaw.apply(undefined, [url, JSON.stringify({
+                    method: this._options.method || "GET",
+                    headers: normalizedHeaders,
+                    body: this._body || null,
+                    ...tls,
+                })], {
+                result: { promise: true },
             });
-            const loopbackResponse = directLoopbackServer
-                ? await dispatchLoopbackServerRequest(directLoopbackServer._bridgeServerId, serializedRequest)
-                : directLoopbackHttp2CompatServer
-                    ? await dispatchLoopbackHttp2CompatibilityRequest(directLoopbackHttp2CompatServer, serializedRequest)
-                    : null;
-            if (loopbackResponse) {
-                this._loopbackAbort = loopbackResponse.abortRequest;
-            }
-            const responseJson = loopbackResponse
-                ? loopbackResponse.responseJson
-                : await _networkHttpRequestRaw.apply(undefined, [url, JSON.stringify({
-                        method: this._options.method || "GET",
-                        headers: normalizedHeaders,
-                        body: this._body || null,
-                        ...tls,
-                    })], {
-                    result: { promise: true },
-                });
             const response = JSON.parse(responseJson);
             this.finished = true;
             this._clearTimeout();
@@ -906,14 +942,6 @@ export class ClientRequest {
                 });
                 return;
             }
-            if (response.connectionReset) {
-                const error = createConnResetError();
-                this._emit("error", error);
-                process.nextTick(() => {
-                    this._finalizeSocket(socket, false);
-                });
-                return;
-            }
             for (const informational of response.informational || []) {
                 this._emit("information", new IncomingMessage({
                     headers: Object.fromEntries(informational.headers || []),
@@ -928,9 +956,6 @@ export class ClientRequest {
             res.once("end", () => {
                 process.nextTick(() => {
                     this._finalizeSocket(socket, this._agent?.keepAlive === true && !this.aborted);
-                    if (response.connectionEnded) {
-                        queueMicrotask(() => socket.end?.());
-                    }
                 });
             });
             if (this._callback) {
@@ -4361,8 +4386,13 @@ class Http2SocketProxy extends Http2EventEmitter {
     remoteFamily = "IPv4";
     servername;
     alpnProtocol = false;
+    readable = true;
+    writable = true;
     destroyed = false;
+    _bridgeReadPollTimer = null;
+    _loopbackServer = null;
     _onDestroy;
+    _destroyCallbackInvoked = false;
     constructor(state, onDestroy) {
         super();
         this._onDestroy = onDestroy;
@@ -4382,8 +4412,28 @@ class Http2SocketProxy extends Http2EventEmitter {
         this.servername = state.servername;
         this.alpnProtocol = state.alpnProtocol ?? this.alpnProtocol;
     }
+    _clearTimeoutTimer() {
+        // Borrowed net.Socket destroy paths call into this hook.
+    }
+    _emitNet(event, error) {
+        if (event === "error" && error) {
+            this.emit("error", error);
+            return;
+        }
+        if (event === "close") {
+            if (!this._destroyCallbackInvoked) {
+                this._destroyCallbackInvoked = true;
+                queueMicrotask(() => {
+                    this._onDestroy?.();
+                });
+            }
+            this.emit("close");
+        }
+    }
     end() {
         this.destroyed = true;
+        this.readable = false;
+        this.writable = false;
         this.emit("close");
         return this;
     }
@@ -4392,8 +4442,9 @@ class Http2SocketProxy extends Http2EventEmitter {
             return this;
         }
         this.destroyed = true;
-        this._onDestroy?.();
-        this.emit("close");
+        this.readable = false;
+        this.writable = false;
+        this._emitNet("close");
         return this;
     }
 }
@@ -4413,6 +4464,163 @@ function createHttp2SettingTypeError(setting, value) {
     error.code = "ERR_HTTP2_INVALID_SETTING_VALUE";
     return error;
 }
+const HTTP2_INTERNAL_BINDING_CONSTANTS = {
+    NGHTTP2_NO_ERROR: 0,
+    NGHTTP2_PROTOCOL_ERROR: 1,
+    NGHTTP2_INTERNAL_ERROR: 2,
+    NGHTTP2_FLOW_CONTROL_ERROR: 3,
+    NGHTTP2_SETTINGS_TIMEOUT: 4,
+    NGHTTP2_STREAM_CLOSED: 5,
+    NGHTTP2_FRAME_SIZE_ERROR: 6,
+    NGHTTP2_REFUSED_STREAM: 7,
+    NGHTTP2_CANCEL: 8,
+    NGHTTP2_COMPRESSION_ERROR: 9,
+    NGHTTP2_CONNECT_ERROR: 10,
+    NGHTTP2_ENHANCE_YOUR_CALM: 11,
+    NGHTTP2_INADEQUATE_SECURITY: 12,
+    NGHTTP2_HTTP_1_1_REQUIRED: 13,
+    NGHTTP2_NV_FLAG_NONE: 0,
+    NGHTTP2_NV_FLAG_NO_INDEX: 1,
+    NGHTTP2_ERR_DEFERRED: -508,
+    NGHTTP2_ERR_STREAM_ID_NOT_AVAILABLE: -509,
+    NGHTTP2_ERR_STREAM_CLOSED: -510,
+    NGHTTP2_ERR_INVALID_ARGUMENT: -501,
+    NGHTTP2_ERR_FRAME_SIZE_ERROR: -522,
+    NGHTTP2_ERR_NOMEM: -901,
+    NGHTTP2_FLAG_NONE: 0,
+    NGHTTP2_FLAG_END_STREAM: 1,
+    NGHTTP2_FLAG_END_HEADERS: 4,
+    NGHTTP2_FLAG_ACK: 1,
+    NGHTTP2_FLAG_PADDED: 8,
+    NGHTTP2_FLAG_PRIORITY: 32,
+    NGHTTP2_DEFAULT_WEIGHT: 16,
+    NGHTTP2_SETTINGS_HEADER_TABLE_SIZE: 1,
+    NGHTTP2_SETTINGS_ENABLE_PUSH: 2,
+    NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS: 3,
+    NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE: 4,
+    NGHTTP2_SETTINGS_MAX_FRAME_SIZE: 5,
+    NGHTTP2_SETTINGS_MAX_HEADER_LIST_SIZE: 6,
+    NGHTTP2_SETTINGS_ENABLE_CONNECT_PROTOCOL: 8,
+};
+const HTTP2_NGHTTP2_ERROR_MESSAGES = {
+    [HTTP2_INTERNAL_BINDING_CONSTANTS.NGHTTP2_ERR_DEFERRED]: "Data deferred",
+    [HTTP2_INTERNAL_BINDING_CONSTANTS.NGHTTP2_ERR_STREAM_ID_NOT_AVAILABLE]: "Stream ID is not available",
+    [HTTP2_INTERNAL_BINDING_CONSTANTS.NGHTTP2_ERR_STREAM_CLOSED]: "Stream was already closed or invalid",
+    [HTTP2_INTERNAL_BINDING_CONSTANTS.NGHTTP2_ERR_INVALID_ARGUMENT]: "Invalid argument",
+    [HTTP2_INTERNAL_BINDING_CONSTANTS.NGHTTP2_ERR_FRAME_SIZE_ERROR]: "Frame size error",
+    [HTTP2_INTERNAL_BINDING_CONSTANTS.NGHTTP2_ERR_NOMEM]: "Out of memory",
+};
+class NghttpError extends Error {
+    code = "ERR_HTTP2_ERROR";
+    constructor(message) {
+        super(message);
+        this.name = "Error";
+    }
+}
+function nghttp2ErrorString(code) {
+    return HTTP2_NGHTTP2_ERROR_MESSAGES[code] ?? `HTTP/2 error (${String(code)})`;
+}
+function createHttp2InvalidArgValueError(property, value) {
+    return createTypeErrorWithCode(`The property 'options.${property}' is invalid. Received ${formatHttp2InvalidValue(value)}`, "ERR_INVALID_ARG_VALUE");
+}
+function formatHttp2InvalidValue(value) {
+    if (typeof value === "function") {
+        return `[Function${value.name ? `: ${value.name}` : ": function"}]`;
+    }
+    if (typeof value === "symbol") {
+        return value.toString();
+    }
+    if (Array.isArray(value)) {
+        return "[]";
+    }
+    if (value === null) {
+        return "null";
+    }
+    if (typeof value === "object") {
+        return "{}";
+    }
+    return String(value);
+}
+function createHttp2PayloadForbiddenError(statusCode) {
+    return createHttp2Error("ERR_HTTP2_PAYLOAD_FORBIDDEN", `Responses with ${String(statusCode)} status must not have a payload`);
+}
+const S_IFMT = 0o170000;
+const S_IFDIR = 0o040000;
+const S_IFREG = 0o100000;
+const S_IFIFO = 0o010000;
+const S_IFSOCK = 0o140000;
+const S_IFLNK = 0o120000;
+function createHttp2BridgeStat(stat) {
+    const atimeMs = stat.atimeMs ?? 0;
+    const mtimeMs = stat.mtimeMs ?? atimeMs;
+    const ctimeMs = stat.ctimeMs ?? mtimeMs;
+    const birthtimeMs = stat.birthtimeMs ?? ctimeMs;
+    const fileType = stat.mode & S_IFMT;
+    return {
+        size: stat.size,
+        mode: stat.mode,
+        atimeMs,
+        mtimeMs,
+        ctimeMs,
+        birthtimeMs,
+        atime: new Date(atimeMs),
+        mtime: new Date(mtimeMs),
+        ctime: new Date(ctimeMs),
+        birthtime: new Date(birthtimeMs),
+        isFile: () => fileType === S_IFREG,
+        isDirectory: () => fileType === S_IFDIR,
+        isFIFO: () => fileType === S_IFIFO,
+        isSocket: () => fileType === S_IFSOCK,
+        isSymbolicLink: () => fileType === S_IFLNK,
+    };
+}
+function normalizeHttp2FileResponseOptions(options) {
+    const normalized = options ?? {};
+    const offset = normalized.offset;
+    if (offset !== undefined && (typeof offset !== "number" || !Number.isFinite(offset))) {
+        throw createHttp2InvalidArgValueError("offset", offset);
+    }
+    const length = normalized.length;
+    if (length !== undefined && (typeof length !== "number" || !Number.isFinite(length))) {
+        throw createHttp2InvalidArgValueError("length", length);
+    }
+    const statCheck = normalized.statCheck;
+    if (statCheck !== undefined && typeof statCheck !== "function") {
+        throw createHttp2InvalidArgValueError("statCheck", statCheck);
+    }
+    const onError = normalized.onError;
+    return {
+        offset: offset === undefined ? 0 : Math.max(0, Math.trunc(offset)),
+        length: typeof length === "number"
+            ? Math.trunc(length)
+            : undefined,
+        statCheck: typeof statCheck === "function" ? statCheck : undefined,
+        onError: typeof onError === "function" ? onError : undefined,
+    };
+}
+function sliceHttp2FileBody(body, offset, length) {
+    const safeOffset = Math.max(0, Math.min(offset, body.length));
+    if (length === undefined || length < 0) {
+        return body.subarray(safeOffset);
+    }
+    return body.subarray(safeOffset, Math.min(body.length, safeOffset + length));
+}
+class Http2Stream {
+    _streamId;
+    constructor(_streamId) {
+        this._streamId = _streamId;
+    }
+    respond(headers) {
+        if (typeof _networkHttp2StreamRespondRaw === "undefined") {
+            throw new Error("http2 server stream respond bridge is not available");
+        }
+        _networkHttp2StreamRespondRaw.applySync(undefined, [
+            this._streamId,
+            serializeHttp2Headers(headers),
+        ]);
+        return 0;
+    }
+}
 const DEFAULT_HTTP2_SETTINGS = {
     headerTableSize: 4096,
     enablePush: true,
@@ -4911,7 +5119,10 @@ function getCompleteUtf8PrefixLength(buffer) {
 }
 class ServerHttp2Stream extends Http2EventEmitter {
     _streamId;
+    _binding;
     _responded = false;
+    _endQueued = false;
+    _pendingSyntheticErrorSuppressions = 0;
     _requestHeaders;
     _isPushStream;
     session;
@@ -4924,6 +5135,7 @@ class ServerHttp2Stream extends Http2EventEmitter {
     constructor(streamId, session, requestHeaders, isPushStream = false) {
         super();
         this._streamId = streamId;
+        this._binding = new Http2Stream(streamId);
         this.session = session;
         this._requestHeaders = requestHeaders;
         this._isPushStream = isPushStream;
@@ -4936,12 +5148,53 @@ class ServerHttp2Stream extends Http2EventEmitter {
             ended: requestHeaders?.[":method"] === "HEAD",
         };
     }
-    respond(headers) {
-        if (typeof _networkHttp2StreamRespondRaw === "undefined") {
-            throw new Error("http2 server stream respond bridge is not available");
+    _closeWithCode(code) {
+        this.rstCode = code;
+        _networkHttp2StreamCloseRaw?.applySync(undefined, [this._streamId, code]);
+    }
+    _markSyntheticClose() {
+        this.destroyed = true;
+        this.readable = false;
+        this.writable = false;
+    }
+    _shouldSuppressHostError() {
+        if (this._pendingSyntheticErrorSuppressions <= 0) {
+            return false;
         }
+        this._pendingSyntheticErrorSuppressions -= 1;
+        return true;
+    }
+    _emitNghttp2Error(errorCode) {
+        const error = new NghttpError(nghttp2ErrorString(errorCode));
+        this._pendingSyntheticErrorSuppressions += 1;
+        this._markSyntheticClose();
+        this.emit("error", error);
+        this._closeWithCode(HTTP2_INTERNAL_BINDING_CONSTANTS.NGHTTP2_INTERNAL_ERROR);
+    }
+    _emitInternalStreamError() {
+        const error = createHttp2Error("ERR_HTTP2_STREAM_ERROR", "Stream closed with error code NGHTTP2_INTERNAL_ERROR");
+        this._pendingSyntheticErrorSuppressions += 1;
+        this._markSyntheticClose();
+        this.emit("error", error);
+        this._closeWithCode(HTTP2_INTERNAL_BINDING_CONSTANTS.NGHTTP2_INTERNAL_ERROR);
+    }
+    _submitResponse(headers) {
         this._responded = true;
-        _networkHttp2StreamRespondRaw.applySync(undefined, [this._streamId, serializeHttp2Headers(headers)]);
+        const ngError = this._binding.respond(headers);
+        if (typeof ngError === "number" && ngError !== 0) {
+            this._emitNghttp2Error(ngError);
+            return false;
+        }
+        return true;
+    }
+    respond(headers) {
+        if (this.destroyed) {
+            throw createHttp2Error("ERR_HTTP2_INVALID_STREAM", "The stream has been destroyed");
+        }
+        if (this._responded) {
+            throw createHttp2Error("ERR_HTTP2_HEADERS_SENT", "Response has already been initiated.");
+        }
+        this._submitResponse(headers);
     }
     pushStream(headers, optionsOrCallback, maybeCallback) {
         if (this._isPushStream) {
@@ -4959,21 +5212,19 @@ class ServerHttp2Stream extends Http2EventEmitter {
         const options = optionsOrCallback && typeof optionsOrCallback === "object" && !Array.isArray(optionsOrCallback)
             ? optionsOrCallback
             : {};
-        const resultJson = _networkHttp2StreamPushStreamRaw.applySyncPromise(undefined, [
+        const resultJson = _networkHttp2StreamPushStreamRaw.applySync(undefined, [
             this._streamId,
             serializeHttp2Headers(normalizeHttp2Headers(headers)),
             JSON.stringify(options ?? {}),
         ]);
         const result = JSON.parse(resultJson);
-        queueMicrotask(() => {
-            if (result.error) {
-                callback(parseHttp2ErrorPayload(result.error));
-                return;
-            }
-            const pushStream = new ServerHttp2Stream(Number(result.streamId), this.session, parseHttp2Headers(result.headers), true);
-            http2Streams.set(Number(result.streamId), pushStream);
-            callback(null, pushStream, parseHttp2Headers(result.headers));
-        });
+        if (result.error) {
+            callback(parseHttp2ErrorPayload(result.error));
+            return;
+        }
+        const pushStream = new ServerHttp2Stream(Number(result.streamId), this.session, parseHttp2Headers(result.headers), true);
+        http2Streams.set(Number(result.streamId), pushStream);
+        callback(null, pushStream, parseHttp2Headers(result.headers));
     }
     write(data) {
         if (this._writableState.ended) {
@@ -4994,7 +5245,12 @@ class ServerHttp2Stream extends Http2EventEmitter {
     }
     end(data) {
         if (!this._responded) {
-            this.respond({ ":status": 200 });
+            if (!this._submitResponse({ ":status": 200 })) {
+                return;
+            }
+        }
+        if (this._endQueued) {
+            return;
         }
         if (typeof _networkHttp2StreamEndRaw === "undefined") {
             throw new Error("http2 server stream end bridge is not available");
@@ -5009,8 +5265,14 @@ class ServerHttp2Stream extends Http2EventEmitter {
                     : Buffer.from(data);
             encoded = buffer.toString("base64");
         }
-        _networkHttp2StreamEndRaw.applySync(undefined, [this._streamId, encoded]);
-        this._writableState.ended = true;
+        this._endQueued = true;
+        queueMicrotask(() => {
+            if (!this._endQueued || this.destroyed) {
+                return;
+            }
+            this._endQueued = false;
+            _networkHttp2StreamEndRaw.applySync(undefined, [this._streamId, encoded]);
+        });
     }
     pause() {
         this._readableState.flowing = false;
@@ -5023,18 +5285,39 @@ class ServerHttp2Stream extends Http2EventEmitter {
         return this;
     }
     respondWithFile(path, headers, options) {
+        if (this.destroyed) {
+            throw createHttp2Error("ERR_HTTP2_INVALID_STREAM", "The stream has been destroyed");
+        }
+        if (this._responded) {
+            throw createHttp2Error("ERR_HTTP2_HEADERS_SENT", "Response has already been initiated.");
+        }
+        const normalizedOptions = normalizeHttp2FileResponseOptions(options);
+        const responseHeaders = { ...(headers ?? {}) };
+        const statusCode = responseHeaders[":status"];
+        if (statusCode === 204 || statusCode === 205 || statusCode === 304) {
+            throw createHttp2PayloadForbiddenError(Number(statusCode));
+        }
         try {
+            const statJson = _fs.stat.applySyncPromise(undefined, [path]);
             const bodyBase64 = _fs.readFileBinary.applySyncPromise(undefined, [path]);
+            const stat = createHttp2BridgeStat(JSON.parse(statJson));
+            const callbackOptions = {
+                offset: normalizedOptions.offset,
+                length: normalizedOptions.length ?? Math.max(0, stat.size - normalizedOptions.offset),
+            };
+            normalizedOptions.statCheck?.(stat, responseHeaders, callbackOptions);
             const body = Buffer.from(bodyBase64, "base64");
-            this._responded = true;
-            this.respond({
+            const slicedBody = sliceHttp2FileBody(body, normalizedOptions.offset, normalizedOptions.length);
+            if (responseHeaders["content-length"] === undefined) {
+                responseHeaders["content-length"] = slicedBody.byteLength;
+            }
+            if (!this._submitResponse({
                 ":status": 200,
-                ...(headers ?? {}),
-            });
-            this.end(body);
-            queueMicrotask(() => {
-                this.session.close();
-            });
+                ...responseHeaders,
+            })) {
+                return;
+            }
+            this.end(slicedBody);
             return;
         }
         catch {
@@ -5059,10 +5342,22 @@ class ServerHttp2Stream extends Http2EventEmitter {
                 : NaN;
         const path = Number.isFinite(fd) ? _fdGetPath.applySync(undefined, [fd]) : null;
         if (!path) {
-            throw new Error("Invalid file descriptor for respondWithFD");
+            this._emitInternalStreamError();
+            return;
         }
         this.respondWithFile(path, headers, options);
     }
+    destroy(error) {
+        if (this.destroyed) {
+            return this;
+        }
+        this.destroyed = true;
+        if (error) {
+            this.emit("error", error);
+        }
+        this._closeWithCode(HTTP2_INTERNAL_BINDING_CONSTANTS.NGHTTP2_CANCEL);
+        return this;
+    }
     _emitData(dataBase64) {
         if (!dataBase64) {
             return;
@@ -5266,7 +5561,11 @@ class Http2Session extends Http2EventEmitter {
     constructor(sessionId, socketState) {
         super();
         this._sessionId = sessionId;
-        this.socket = new Http2SocketProxy(socketState, () => this.destroy());
+        this.socket = new Http2SocketProxy(socketState, () => {
+            setTimeout(() => {
+                this.destroy();
+            }, 0);
+        });
         this[HTTP2_K_SOCKET] = this.socket;
     }
     _retain() {
@@ -5832,6 +6131,10 @@ function http2Dispatch(kind, id, data, extra, extraNumber, extraHeaders, flags)
         const stream = http2Streams.get(id);
         if (!stream)
             return;
+        if (typeof stream._shouldSuppressHostError === "function" &&
+            stream._shouldSuppressHostError()) {
+            return;
+        }
         stream.emit("error", parseHttp2ErrorPayload(data));
         return;
     }
@@ -5936,6 +6239,9 @@ function onHttp2Dispatch(_eventType, payload) {
 export const http2 = {
     Http2ServerRequest,
     Http2ServerResponse,
+    Http2Stream,
+    NghttpError,
+    nghttp2ErrorString,
     constants: {
         HTTP2_HEADER_METHOD: ":method",
         HTTP2_HEADER_PATH: ":path",
@@ -5944,19 +6250,14 @@ export const http2 = {
         HTTP2_HEADER_STATUS: ":status",
         HTTP2_HEADER_CONTENT_TYPE: "content-type",
         HTTP2_HEADER_CONTENT_LENGTH: "content-length",
+        HTTP2_HEADER_LAST_MODIFIED: "last-modified",
         HTTP2_HEADER_ACCEPT: "accept",
         HTTP2_HEADER_ACCEPT_ENCODING: "accept-encoding",
         HTTP2_METHOD_GET: "GET",
         HTTP2_METHOD_POST: "POST",
         HTTP2_METHOD_PUT: "PUT",
         HTTP2_METHOD_DELETE: "DELETE",
-        NGHTTP2_NO_ERROR: 0,
-        NGHTTP2_PROTOCOL_ERROR: 1,
-        NGHTTP2_INTERNAL_ERROR: 2,
-        NGHTTP2_FRAME_SIZE_ERROR: 6,
-        NGHTTP2_FLOW_CONTROL_ERROR: 3,
-        NGHTTP2_REFUSED_STREAM: 7,
-        NGHTTP2_CANCEL: 8,
+        ...HTTP2_INTERNAL_BINDING_CONSTANTS,
         DEFAULT_SETTINGS_MAX_HEADER_LIST_SIZE: 65535,
     },
     getDefaultSettings() {
@@ -6023,6 +6324,23 @@ if (typeof globalThis.Blob === "undefined") {
     exposeCustomGlobal("Blob", class BlobStub {
     });
 }
+if (typeof globalThis.File === "undefined") {
+    class FileStub extends Blob {
+        name;
+        lastModified;
+        webkitRelativePath;
+        constructor(parts = [], name = "", options = {}) {
+            super(parts, options);
+            this.name = String(name);
+            this.lastModified =
+                typeof options.lastModified === "number"
+                    ? options.lastModified
+                    : Date.now();
+            this.webkitRelativePath = "";
+        }
+    }
+    exposeCustomGlobal("File", FileStub);
+}
 if (typeof globalThis.FormData === "undefined") {
     // Minimal FormData stub — server frameworks check `instanceof FormData`.
     class FormDataStub {