@sequenceholdings/artifact-studio 0.2.6 → 0.3.0

package/dist/gateway/control.d.ts

@@ -0,0 +1,91 @@
+import { z } from 'zod';
+import type { TunnelLease } from '../tunnel/index.js';
+import type { GatewaySession } from './session.js';
+import type { GatewayUsageEvent } from './usage.js';
+export declare const gatewayTargetSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"development">;
+    sessionId: z.ZodString;
+    epoch: z.ZodNumber;
+    projectId: z.ZodString;
+    ownerId: z.ZodString;
+    environment: z.ZodString;
+    publicOrigin: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    expiresAt: z.ZodNumber;
+    maxExpiresAt: z.ZodOptional<z.ZodNumber>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    serviceAccountId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    lattice: z.ZodOptional<z.ZodObject<{
+        runId: z.ZodNullable<z.ZodString>;
+        nodeId: z.ZodNullable<z.ZodString>;
+        stepId: z.ZodNullable<z.ZodString>;
+        processId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    taskRoutes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    manifest: z.ZodOptional<z.ZodObject<{
+        server: z.ZodObject<{
+            resources: z.ZodObject<{
+                concurrency: z.ZodNumber;
+                max_instances: z.ZodNumber;
+                timeout_seconds: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"hosted">;
+    deploymentId: z.ZodString;
+    frameworkBuildId: z.ZodString;
+    upstreamUrl: z.ZodString;
+    upstreamAudience: z.ZodOptional<z.ZodString>;
+    active: z.ZodBoolean;
+    published: z.ZodOptional<z.ZodBoolean>;
+    projectId: z.ZodString;
+    ownerId: z.ZodString;
+    environment: z.ZodString;
+    publicOrigin: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    expiresAt: z.ZodNumber;
+    maxExpiresAt: z.ZodOptional<z.ZodNumber>;
+    capabilities: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    serviceAccountId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    lattice: z.ZodOptional<z.ZodObject<{
+        runId: z.ZodNullable<z.ZodString>;
+        nodeId: z.ZodNullable<z.ZodString>;
+        stepId: z.ZodNullable<z.ZodString>;
+        processId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    taskRoutes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    manifest: z.ZodOptional<z.ZodObject<{
+        server: z.ZodObject<{
+            resources: z.ZodObject<{
+                concurrency: z.ZodNumber;
+                max_instances: z.ZodNumber;
+                timeout_seconds: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+}, z.core.$strip>], "kind">;
+export type GatewayTarget = z.infer<typeof gatewayTargetSchema>;
+export declare class GatewayControlError extends Error {
+    readonly status: number;
+    constructor(status: number);
+}
+export declare class ArtifactGatewayControl {
+    private readonly options;
+    private readonly origin;
+    constructor(options: {
+        url: string;
+        token: string;
+        fetch?: typeof fetch;
+    });
+    private call;
+    usage(event: GatewayUsageEvent): Promise<void>;
+    bootstrap(ticket: string): Promise<{
+        session: GatewaySession;
+        target: GatewayTarget;
+    }>;
+    authorize(session: GatewaySession): Promise<GatewayTarget>;
+    tunnel({ token, sessionId, epoch }: {
+        token: string;
+        sessionId: string;
+        epoch: number;
+    }): Promise<TunnelLease>;
+}

package/dist/gateway/control.js

@@ -0,0 +1,113 @@
+import { z } from 'zod';
+import { normalizePublicOrigin } from '../tunnel/protocol.js';
+import { artifactRequestContextSchema } from '../server/request-context.js';
+import { artifactNextFrameworkBuildIdSchema } from '../runtime-contracts.js';
+const id = z.string().min(1).max(255);
+const base = {
+    projectId: id, ownerId: id, environment: id, publicOrigin: z.string().transform(normalizePublicOrigin),
+    expiresAt: z.number().int().positive(),
+    maxExpiresAt: z.number().int().positive().optional(),
+    capabilities: z.array(id).max(256).default([]), serviceAccountId: id.nullable().default(null),
+    lattice: artifactRequestContextSchema.shape.lattice.optional(),
+    taskRoutes: artifactRequestContextSchema.shape.taskRoutes,
+    manifest: z.object({ server: z.object({ resources: z.object({
+                concurrency: z.number().int().min(1).max(80), max_instances: z.number().int().min(1).max(100), timeout_seconds: z.number().int().min(1).max(300),
+            }) }) }).optional(),
+};
+export const gatewayTargetSchema = z.discriminatedUnion('kind', [
+    z.object({ ...base, kind: z.literal('development'), sessionId: id, epoch: z.number().int().positive() }),
+    z.object({ ...base, kind: z.literal('hosted'), deploymentId: id, frameworkBuildId: artifactNextFrameworkBuildIdSchema, upstreamUrl: z.string().url(), upstreamAudience: z.string().url().optional(), active: z.boolean(), published: z.boolean().optional() }),
+]);
+const bootstrapSchema = z.object({ parentOrigin: z.string().transform(normalizePublicOrigin), channelId: id, nonce: z.string().min(16).max(255) });
+export class GatewayControlError extends Error {
+    status;
+    constructor(status) {
+        super('Artifact control plane request failed');
+        this.status = status;
+        this.name = 'GatewayControlError';
+    }
+}
+export class ArtifactGatewayControl {
+    options;
+    origin;
+    constructor(options) {
+        this.options = options;
+        this.origin = normalizePublicOrigin(options.url);
+        if (options.token.length < 32)
+            throw new Error('Artifact control plane token requires at least 32 characters');
+    }
+    async call(path, body, timeoutMs = 10_000) {
+        const response = await (this.options.fetch ?? fetch)(`${this.origin}/api/artifact-studio/next/control/${path}`, {
+            method: 'POST', headers: { authorization: `Bearer ${this.options.token}`, 'content-type': 'application/json' },
+            body: JSON.stringify(body), signal: AbortSignal.timeout(timeoutMs), redirect: 'error',
+        });
+        if (!response.ok)
+            throw new GatewayControlError(response.status);
+        const contentLength = Number(response.headers.get('content-length'));
+        if (contentLength > 128 * 1024) {
+            await response.body?.cancel();
+            throw new GatewayControlError(502);
+        }
+        const reader = response.body?.getReader();
+        if (!reader)
+            throw new GatewayControlError(502);
+        const chunks = [];
+        let length = 0;
+        try {
+            for (;;) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                length += value.length;
+                if (length > 128 * 1024)
+                    throw new GatewayControlError(502);
+                chunks.push(value);
+            }
+            return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        }
+        finally {
+            await reader.cancel().catch(() => undefined);
+        }
+    }
+    async usage(event) {
+        await this.call('usage', event, 2_000);
+    }
+    async bootstrap(ticket) {
+        const value = await this.call('bootstrap', { ticket });
+        const target = gatewayTargetSchema.parse(value), bridge = bootstrapSchema.parse(value);
+        const session = {
+            version: 1, kind: target.kind, projectId: target.projectId, ownerId: target.ownerId,
+            environment: target.environment, publicOrigin: target.publicOrigin,
+            sessionId: target.kind === 'development' ? target.sessionId : null,
+            deploymentId: target.kind === 'hosted' ? target.deploymentId : null,
+            frameworkBuildId: target.kind === 'hosted' ? target.frameworkBuildId : null,
+            expiresAt: Math.min(target.expiresAt, target.maxExpiresAt ?? target.expiresAt, Date.now() + 8 * 60 * 60_000),
+            maxExpiresAt: Math.min(target.maxExpiresAt ?? (target.kind === 'development' ? target.expiresAt : Date.now() + 8 * 60 * 60_000), Date.now() + 8 * 60 * 60_000),
+            published: target.kind === 'hosted' && (target.published ?? target.active), bridge,
+            ...(target.lattice ? { lattice: target.lattice } : {}),
+            ...(target.taskRoutes ? { taskRoutes: target.taskRoutes } : {}),
+        };
+        return { session, target };
+    }
+    async authorize(session) {
+        const value = await this.call('session', {
+            ...(session.sessionId ? { sessionId: session.sessionId } : { deploymentId: session.deploymentId }),
+            ownerId: session.ownerId, published: session.published,
+            ...(session.lattice ? { lattice: session.lattice } : {}),
+            ...(session.taskRoutes ? { taskRoutes: session.taskRoutes } : {}),
+        });
+        const target = gatewayTargetSchema.parse(value);
+        if (target.kind !== session.kind || target.projectId !== session.projectId || target.ownerId !== session.ownerId ||
+            target.environment !== session.environment || target.publicOrigin !== session.publicOrigin || target.expiresAt <= Date.now() ||
+            (target.kind === 'development' ? target.sessionId !== session.sessionId : target.deploymentId !== session.deploymentId || target.frameworkBuildId !== session.frameworkBuildId))
+            throw new GatewayControlError(403);
+        return target;
+    }
+    async tunnel({ token, sessionId, epoch }) {
+        const value = await this.call('tunnel', { token, sessionId, epoch });
+        const parsed = z.object({ sessionId: id, epoch: z.number().int().positive(), ownerId: id, projectId: id, environment: id, expiresAt: z.number().int().positive(), publicOrigin: z.string().transform(normalizePublicOrigin) }).parse(value);
+        if (parsed.sessionId !== sessionId || parsed.epoch !== epoch || parsed.expiresAt <= Date.now())
+            throw new GatewayControlError(403);
+        return parsed;
+    }
+}

package/dist/gateway/hosted-proxy.d.ts

@@ -0,0 +1,36 @@
+import { type IncomingMessage, type ServerResponse } from 'node:http';
+export declare const HOSTED_ARTIFACT_PROXY_LIMITS: Readonly<{
+    maxBodyBytes: number;
+    timeoutMs: 60000;
+    maxTimeoutMs: 300000;
+}>;
+export interface HostedArtifactProxyOptions {
+    request: IncomingMessage;
+    response: ServerResponse;
+    target: {
+        upstreamUrl: string;
+        /** Canonical service URL from the same provider record as the revision URL. */
+        upstreamAudience?: string;
+        publicOrigin: string;
+        projectId: string;
+        deploymentId: string;
+    };
+    requestContext: string;
+    /** Admission may inspect a native form prefix and replay it without buffering the body. */
+    body?: AsyncIterable<Uint8Array>;
+    identityTokenProvider?: (input: {
+        audience: string;
+        signal: AbortSignal;
+    }) => Promise<string>;
+    /** Injectable transport for isolated tests; the deployment URL is still validated first. */
+    resolveUpstream?: (input: {
+        url: URL;
+    }) => URL;
+    /** Approved request timeouts may exceed the default up to the platform cap. */
+    limits?: {
+        maxBodyBytes?: number;
+        timeoutMs?: number;
+    };
+}
+/** HTTP-only streaming hop. Authentication, CSRF and release admission happen before calling this. */
+export declare function proxyHostedArtifact(options: HostedArtifactProxyOptions): Promise<void>;

package/dist/gateway/hosted-proxy.js

@@ -0,0 +1,347 @@
+import { request as httpRequest, validateHeaderValue } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { Duplex, Readable, Transform } from 'node:stream';
+import { createBrotliDecompress, createGunzip, createInflate } from 'node:zlib';
+import { GoogleAuth } from 'google-auth-library';
+import { assertSafeRequest, normalizePublicOrigin, sanitizeRequestHeaders, sanitizeResponseHeaders } from '../tunnel/protocol.js';
+import { createReleaseFormTransform } from '../server/release-forms.js';
+export const HOSTED_ARTIFACT_PROXY_LIMITS = Object.freeze({ maxBodyBytes: 32 * 1024 * 1024, timeoutMs: 60_000, maxTimeoutMs: 300_000 });
+const googleAuth = new GoogleAuth();
+const identityClients = new Map();
+async function defaultIdentityTokenProvider({ audience }) {
+    let pending = identityClients.get(audience);
+    if (!pending) {
+        if (identityClients.size >= 256) {
+            const oldest = identityClients.keys().next().value;
+            if (oldest)
+                identityClients.delete(oldest);
+        }
+        pending = googleAuth.getIdTokenClient(audience);
+        identityClients.set(audience, pending);
+    }
+    try {
+        const client = await pending;
+        const headers = await client.getRequestHeaders();
+        const authorization = headers.get('authorization');
+        if (!authorization?.startsWith('Bearer '))
+            throw new Error('Missing platform identity token');
+        return authorization.slice('Bearer '.length);
+    }
+    catch (error) {
+        identityClients.delete(audience);
+        throw error;
+    }
+}
+function cloudRunOrigin(value) {
+    const url = new URL(value);
+    if (!/^https:\/\/[a-z0-9.-]+\.run\.app\/?$/.test(value) || url.protocol !== 'https:' ||
+        url.username || url.password || url.port || url.pathname !== '/' || url.search || url.hash ||
+        !url.hostname.split('.').every((part) => /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(part)))
+        throw new Error('Invalid hosted deployment origin');
+    return url;
+}
+function stripCloudHeaders(headers) {
+    for (const name of Object.keys(headers)) {
+        if (name === 'x-serverless-authorization' || name.startsWith('x-goog-'))
+            delete headers[name];
+    }
+}
+function rewriteLocation({ location, upstream, publicOrigin }) {
+    if (!/^(?:https?:)?\/\//i.test(location))
+        return location;
+    const url = new URL(location, upstream);
+    return url.origin === upstream.origin ? `${publicOrigin}${url.pathname}${url.search}${url.hash}` : location;
+}
+function mergeFramePolicy({ application, trusted }) {
+    const policies = Array.isArray(application) ? application : [application];
+    const frames = Array.isArray(trusted) ? trusted : [trusted];
+    return [...policies.map((policy) => policy.split(';')
+            .filter((directive) => directive.trim().split(/\s/, 1)[0].toLowerCase() !== 'frame-ancestors')
+            .map((directive) => directive.trim()).filter(Boolean).join('; ')).filter(Boolean), ...frames];
+}
+function enforceBrowserCachePolicy({ request, response }) {
+    const path = (request.url ?? '/').split('?', 1)[0];
+    let staticAsset = false;
+    try {
+        const segments = path.slice(1).split('/').map((segment) => decodeURIComponent(segment));
+        staticAsset = path.startsWith('/_next/static/') && /\.(?:js|css)$/.test(path) &&
+            segments.every((segment) => segment !== '' && segment !== '.' && segment !== '..' && !/[\\/]/.test(segment));
+    }
+    catch { /* Malformed or ambiguous asset paths retain the default no-store policy. */ }
+    const contentType = response.getHeader('content-type');
+    const mediaType = typeof contentType === 'string' ? contentType.split(';', 1)[0].trim().toLowerCase() : undefined;
+    const assetType = path.endsWith('.css') ? mediaType === 'text/css' : mediaType === 'text/javascript' || mediaType === 'application/javascript';
+    const revalidateAsset = staticAsset && ['GET', 'HEAD'].includes(request.method ?? 'GET') &&
+        (response.statusCode === 200 || response.statusCode === 304) &&
+        (assetType || (response.statusCode === 304 && contentType === undefined));
+    // Every protected reuse must reach authorization. Retain only private static
+    // JS/CSS bytes and validators; app output may never opt into browser/CDN TTLs.
+    for (const name of response.getHeaderNames()) {
+        if (/(?:^|-)cdn-cache-control$/.test(name) || ['surrogate-control', 'x-accel-expires', 'expires', 'age'].includes(name)) {
+            response.removeHeader(name);
+        }
+    }
+    response.setHeader('cache-control', revalidateAsset ? 'private, no-cache' : 'private, no-store');
+    response.setHeader('cdn-cache-control', 'no-store');
+    response.setHeader('surrogate-control', 'no-store');
+    response.setHeader('pragma', 'no-cache');
+    response.setHeader('expires', '0');
+}
+/** HTTP-only streaming hop. Authentication, CSRF and release admission happen before calling this. */
+export function proxyHostedArtifact(options) {
+    return new HostedExchange(options).run();
+}
+class HostedExchange {
+    options;
+    controller = new AbortController();
+    maximum;
+    timeoutMs;
+    timer;
+    upload;
+    outgoing;
+    incoming;
+    responseSource;
+    transforms = [];
+    stopped = false;
+    sentBytes = 0;
+    receivedBytes = 0;
+    resolve;
+    constructor(options) {
+        this.options = options;
+        this.maximum = this.boundLimit(options.limits?.maxBodyBytes, HOSTED_ARTIFACT_PROXY_LIMITS.maxBodyBytes);
+        this.timeoutMs = this.boundLimit(options.limits?.timeoutMs, HOSTED_ARTIFACT_PROXY_LIMITS.maxTimeoutMs, HOSTED_ARTIFACT_PROXY_LIMITS.timeoutMs);
+    }
+    boundLimit(value, maximum, fallback = maximum) {
+        return Number.isSafeInteger(value) && value !== undefined && value > 0 ? Math.min(value, maximum) : fallback;
+    }
+    run() {
+        return new Promise((resolve) => {
+            this.resolve = resolve;
+            const { request, response } = this.options;
+            if (request.aborted || response.destroyed || response.writableEnded) {
+                this.finish();
+                return;
+            }
+            response.once('finish', this.finish);
+            response.once('close', this.finish);
+            response.once('error', this.finish);
+            request.once('aborted', this.finish);
+            request.once('error', this.finish);
+            this.timer = setTimeout(() => this.fail(504), this.timeoutMs);
+            this.timer.unref();
+            void this.prepare().catch(() => this.fail(502));
+        });
+    }
+    async prepare() {
+        const { request, response, target, requestContext } = this.options;
+        const upstream = cloudRunOrigin(target.upstreamUrl);
+        // Cloud Run revision tags select immutable transport destinations, but IAM
+        // requires the canonical service audience. Both are control-plane owned;
+        // never derive this from a browser host, header or query parameter.
+        const audience = target.upstreamAudience === undefined ? upstream : cloudRunOrigin(target.upstreamAudience);
+        const publicOrigin = normalizePublicOrigin(target.publicOrigin);
+        try {
+            assertSafeRequest(request.method ?? 'GET', request.url ?? '/');
+            validateHeaderValue('x-sequence-artifact-context', requestContext);
+            if (!requestContext || requestContext.length > 16384)
+                throw new Error('Invalid request context');
+        }
+        catch {
+            this.fail(400);
+            return;
+        }
+        const length = request.headers['content-length'];
+        if (length !== undefined && (!/^(0|[1-9][0-9]*)$/.test(length) || Number(length) > this.maximum)) {
+            this.fail(413);
+            return;
+        }
+        const headers = sanitizeRequestHeaders(request.headers, publicOrigin);
+        stripCloudHeaders(headers);
+        const provider = this.options.identityTokenProvider ?? defaultIdentityTokenProvider;
+        const token = await provider({ audience: audience.origin, signal: this.controller.signal });
+        if (this.stopped)
+            return;
+        if (!/^[A-Za-z0-9._~-]+$/.test(token) || token.length > 16384)
+            throw new Error('Invalid platform token');
+        headers.host = upstream.host;
+        // HTML forms receive release markers. Avoid compression when possible;
+        // runtimes that still compress HTML are decoded as a bounded stream below.
+        headers['accept-encoding'] = 'identity';
+        // Cloud Run removes this token's signature before passing it to user code.
+        // https://cloud.google.com/run/docs/authenticating/service-to-service
+        headers['x-serverless-authorization'] = `Bearer ${token}`;
+        headers['x-sequence-artifact-context'] = requestContext;
+        const destination = this.resolveDestination(upstream);
+        const transport = destination.protocol === 'https:' ? httpsRequest : httpRequest;
+        this.outgoing = transport(destination, { method: request.method, path: request.url, headers, maxHeaderSize: 32 * 1024 }, (incoming) => this.receive({ incoming, upstream, publicOrigin }));
+        this.outgoing.on('error', () => this.fail(502));
+        this.outgoing.once('upgrade', (_incoming, socket) => { socket.destroy(); this.fail(502); });
+        this.outgoing.on('drain', () => { if (!this.stopped)
+            this.upload?.resume(); });
+        this.upload = this.options.body ? Readable.from(this.options.body, { highWaterMark: 64 * 1024, objectMode: false }) : request;
+        this.upload.on('data', this.sendChunk);
+        this.upload.once('end', () => this.outgoing?.end());
+        this.upload.once('error', () => this.fail(502));
+        response.on('drain', () => { if (!this.stopped)
+            this.responseSource?.resume(); });
+    }
+    resolveDestination(upstream) {
+        const destination = this.options.resolveUpstream?.({ url: upstream }) ?? upstream;
+        const injectedLoopback = destination.protocol === 'http:' && ['127.0.0.1', '[::1]'].includes(destination.hostname);
+        if ((destination.origin !== upstream.origin && !injectedLoopback) || destination.username || destination.password ||
+            destination.pathname !== '/' || destination.search || destination.hash)
+            throw new Error('Invalid hosted transport destination');
+        return destination;
+    }
+    sendChunk = (chunk) => {
+        if (this.stopped)
+            return;
+        this.sentBytes += chunk.byteLength;
+        if (this.sentBytes > this.maximum) {
+            this.fail(413);
+            return;
+        }
+        if (!this.outgoing?.write(chunk))
+            this.upload?.pause();
+    };
+    receive({ incoming, upstream, publicOrigin }) {
+        this.incoming = incoming;
+        if (this.stopped) {
+            incoming.destroy();
+            return;
+        }
+        try {
+            const headers = sanitizeResponseHeaders(incoming.headers);
+            stripCloudHeaders(headers);
+            delete headers['x-frame-options'];
+            if (typeof headers.location === 'string')
+                headers.location = rewriteLocation({ location: headers.location, upstream, publicOrigin });
+            const response = this.options.response;
+            this.responseSource = this.prepareResponseSource({ incoming, headers, publicOrigin });
+            const framePolicy = response.getHeader('content-security-policy');
+            if (headers['content-security-policy'] && (typeof framePolicy === 'string' || Array.isArray(framePolicy))) {
+                headers['content-security-policy'] = mergeFramePolicy({ application: headers['content-security-policy'], trusted: framePolicy });
+            }
+            response.statusCode = incoming.statusCode ?? 502;
+            for (const [name, value] of Object.entries(headers)) {
+                const existing = name === 'set-cookie' ? response.getHeader(name) : undefined;
+                if (typeof existing === 'string' || Array.isArray(existing)) {
+                    // Rolling gateway leases and application cookies share the response,
+                    // but application cookies were stripped of reserved names above.
+                    response.setHeader(name, [...(Array.isArray(existing) ? existing : [existing]), ...(Array.isArray(value) ? value : [value])]);
+                }
+                else
+                    response.setHeader(name, value);
+            }
+            enforceBrowserCachePolicy({ request: this.options.request, response });
+            this.responseSource.on('data', this.receiveChunk);
+            this.responseSource.once('end', () => response.end());
+            this.responseSource.once('error', () => this.fail(502));
+            incoming.once('error', () => this.fail(502));
+            incoming.once('aborted', () => this.fail(502));
+        }
+        catch {
+            this.fail(502);
+        }
+    }
+    prepareResponseSource({ incoming, headers, publicOrigin }) {
+        const contentType = headers['content-type'];
+        if (typeof contentType !== 'string' || contentType.split(';', 1)[0].trim().toLowerCase() !== 'text/html')
+            return incoming;
+        const disposition = headers['content-disposition'];
+        if (typeof disposition === 'string' && /^attachment(?:;|$)/i.test(disposition.trim()))
+            return incoming;
+        if (/;\s*charset\s*=/i.test(contentType) && !/;\s*charset\s*=\s*"?utf-?8"?\s*(?:;|$)/i.test(contentType))
+            throw new Error('Unsupported HTML encoding');
+        const encoding = headers['content-encoding'];
+        for (const header of ['content-encoding', 'content-length', 'etag', 'content-md5', 'digest', 'content-digest', 'repr-digest', 'accept-ranges'])
+            delete headers[header];
+        if (this.options.request.method === 'HEAD' || incoming.statusCode === 204 || incoming.statusCode === 304)
+            return incoming;
+        if (incoming.statusCode === 206)
+            throw new Error('Partial HTML cannot receive release markers');
+        let source = incoming;
+        if (encoding && encoding !== 'identity') {
+            const decoder = encoding === 'gzip' ? createGunzip() : encoding === 'br' ? createBrotliDecompress() : encoding === 'deflate' ? createInflate() : undefined;
+            if (!decoder)
+                throw new Error('Unsupported HTML compression');
+            this.transforms.push(decoder);
+            source = source.pipe(decoder);
+        }
+        let decodedBytes = 0;
+        const maximum = this.maximum;
+        const limit = new Transform({ transform(chunk, _encoding, callback) {
+                decodedBytes += chunk.byteLength;
+                if (decodedBytes > maximum)
+                    callback(new Error('HTML response exceeds the platform limit'));
+                else
+                    callback(null, chunk);
+            } });
+        const marker = Duplex.fromWeb(createReleaseFormTransform({ deploymentId: this.options.target.deploymentId, documentUrl: new URL(this.options.request.url ?? '/', publicOrigin).href }));
+        this.transforms.push(limit, marker);
+        for (const stream of this.transforms)
+            stream.once('error', () => this.fail(502));
+        return source.pipe(limit).pipe(marker);
+    }
+    receiveChunk = (chunk) => {
+        if (this.stopped)
+            return;
+        this.receivedBytes += chunk.byteLength;
+        if (this.receivedBytes > this.maximum) {
+            this.fail(502);
+            return;
+        }
+        if (!this.options.response.write(chunk))
+            this.responseSource?.pause();
+    };
+    fail(status) {
+        if (this.stopped)
+            return;
+        this.upload?.pause();
+        this.incoming?.pause();
+        this.responseSource?.pause();
+        const response = this.options.response;
+        if (response.headersSent)
+            response.destroy();
+        else {
+            // Do not send application cookies, encodings or redirects with a gateway error.
+            for (const name of response.getHeaderNames()) {
+                if (name !== 'content-security-policy')
+                    response.removeHeader(name);
+            }
+            response.statusCode = status;
+            enforceBrowserCachePolicy({ request: this.options.request, response });
+            response.writeHead(status, { 'content-type': 'application/json', connection: 'close' });
+            response.end(JSON.stringify({ error: status === 413 ? 'Request body exceeds the platform limit' : status === 504 ? 'Application request timed out' : status === 400 ? 'Invalid application request' : 'Application temporarily unavailable' }));
+        }
+        this.finish();
+    }
+    finish = () => {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        clearTimeout(this.timer);
+        this.controller.abort();
+        this.upload?.off('data', this.sendChunk);
+        this.incoming?.off('data', this.receiveChunk);
+        this.responseSource?.off('data', this.receiveChunk);
+        for (const transform of this.transforms)
+            transform.destroy();
+        if (!this.incoming?.complete || !this.outgoing?.writableFinished) {
+            this.outgoing?.destroy();
+            this.incoming?.destroy();
+        }
+        const { request, response } = this.options;
+        const closeUpload = () => {
+            if (!request.complete)
+                request.destroy();
+            if (this.upload !== request)
+                this.upload?.destroy();
+        };
+        if (response.writableFinished || response.destroyed)
+            closeUpload();
+        else
+            response.once('finish', closeUpload);
+        this.resolve?.();
+    };
+}

package/dist/gateway/release-admission.d.ts

@@ -0,0 +1,23 @@
+import type { IncomingMessage } from 'node:http';
+type RejectionReason = 'inactive-release' | 'missing-release' | 'conflicting-release' | 'stale-release' | 'invalid-form' | 'prefix-limit';
+export declare class ReleaseAdmissionError extends Error {
+    readonly reason: RejectionReason;
+    readonly status = 409;
+    readonly code = "update-required";
+    constructor(reason?: RejectionReason);
+}
+/**
+ * Admit a mutation against the release that rendered its document. No request is
+ * forwarded until admission succeeds. An admitted form exposes one continuation
+ * over the original iterator, including every byte inspected here.
+ */
+export declare function admitHostedMutation({ request, expectedDeploymentId, expectedFrameworkBuildId, active, published }: {
+    request: IncomingMessage;
+    expectedDeploymentId: string;
+    expectedFrameworkBuildId: string;
+    active: boolean;
+    published: boolean;
+}): Promise<{
+    body?: AsyncIterable<Uint8Array>;
+}>;
+export {};