@specific.dev/spectest 0.100.0 → 0.102.0

package/dist/components/index.d.ts

@@ -13,6 +13,6 @@ export { github, type GithubOptions } from "./github.js";
 export { apple, type AppleOptions } from "./apple.js";
 export { microsoft, type MicrosoftOptions } from "./microsoft.js";
 export { okta, type OktaOptions } from "./okta.js";
-export { replayFake, type ReplayFakeOptions, type ReplayKey, type ReplayRequest, type MatchKey, type JsonValue, type InjectRule, type InjectMatch, type StringMatch, type SignConfig, type AwsSigV4Sign, type ReplayHelpers, type ReplaySummary, type Cassette, type CassetteInteraction, type CassetteRequest, type CassetteResponse, type CassetteState, } from "./replayFake.js";
+export { replayFake, type ReplayFakeOptions, type ReplayFakeContext, type ReplayHandler, type ReplayKey, type ReplayRequest, type MatchKey, type JsonValue, type InjectRule, type InjectMatch, type StringMatch, type SignConfig, type AwsSigV4Sign, type ReplayHelpers, type ReplaySummary, type Cassette, type CassetteInteraction, type CassetteRequest, type CassetteResponse, type CassetteState, } from "./replayFake.js";
 export { electron, type ElectronOptions } from "./electron.js";
 export { android, type AndroidOptions } from "./android.js";

package/dist/components/replayFake.d.ts

@@ -1,4 +1,4 @@
-import type { FakeDefinition } from "../index.js";
+import type { FakeContext, FakeDefinition } from "../index.js";
 import { type ReplayKey } from "./replay-key.js";
 export type { JsonValue, MatchKey, ReplayRequest, ReplayKey } from "./replay-key.js";
 /** Match one request dimension. A bare string is an exact match; the
@@ -54,7 +54,15 @@ export interface AwsSigV4Sign {
     sessionToken?: string;
 }
 export type SignConfig = AwsSigV4Sign;
-export interface ReplayFakeOptions {
+/** A normal fake context with explicit delegation to recording/replay. */
+export interface ReplayFakeContext extends FakeContext {
+    /** Record against the real upstream in record mode, or consume a matching
+     *  cassette interaction in replay mode. A replay miss returns 599; there
+     *  is no fallback to scripted logic. Inspect a body's clone before calling. */
+    replay(request: Request): Promise<Response>;
+}
+export type ReplayHandler<S> = (request: Request, state: S, ctx: ReplayFakeContext) => Response | Promise<Response>;
+export interface ReplayFakeOptions<S = undefined, H extends Record<string, unknown> = {}> {
     /** Stable name — the `ctx.fakes` key. */
     name: string;
     /** The REAL host to fake, e.g. `"api.stripe.com"`. The fake answers for
@@ -87,6 +95,19 @@ export interface ReplayFakeOptions {
     /** `"auto"` (default) records under eval and replays under test;
      *  `"record"` / `"replay"` force a mode. */
     mode?: "auto" | "record" | "replay";
+    /** Custom state, with the same lifecycle as a normal fake's state. Kept
+     *  separate from cassette internals; helpers and handler see only S. */
+    state?: () => S | Promise<S>;
+    /** Custom helpers exposed alongside replay/dump/recorded/count. Those
+     *  names are reserved. Loading a cassette does not change custom state. */
+    helpers?: (args: {
+        name: string;
+        state: S;
+        ctx: FakeContext;
+    }) => H | Promise<H>;
+    /** Decide whether to answer in code or call ctx.replay(request). Without
+     *  a handler, every request delegates. Only delegated requests record. */
+    handler?: ReplayHandler<S>;
 }
 export interface CassetteRequest {
     method: string;
@@ -144,8 +165,9 @@ export interface ReplaySummary {
     interactions: number;
 }
 export interface ReplayHelpers extends Record<string, unknown> {
-    /** Load a cassette into THIS fork's replay set and replay from it,
+    /** Load a cassette into THIS fork's replay set for delegated requests,
      *  replacing whatever was loaded before and resetting the replay cursor.
+     *  Does not change custom state or bypass a custom handler.
      *  Cassettes are NOT auto-loaded — call this at the top of a test. Pass a
      *  path relative to `spectest/tests/` (e.g. `"recordings/stripe.json"`; it
      *  must stay under `spectest/tests/`) or a cassette object; a missing file
@@ -161,4 +183,6 @@ export interface ReplayHelpers extends Record<string, unknown> {
     /** Count of interactions captured this record session. */
     count(): number;
 }
-export declare function replayFake(opts: ReplayFakeOptions): FakeDefinition<CassetteState, ReplayHelpers>;
+export declare function replayFake<S = undefined, H extends Record<string, unknown> = {}>(opts: ReplayFakeOptions<S, H>): FakeDefinition<CassetteState & {
+    custom: S;
+}, ReplayHelpers & H>;

package/dist/components/replayFake.js

@@ -14,7 +14,7 @@
 //   - REPLAY (hermetic): the request is matched against the cassette the
 //     test EXPLICITLY loaded (`ctx.fakes.<name>.replay(file)`) and the
 //     recorded response is returned. No network. Nothing is auto-loaded:
-//     a test that loads no cassette gets a fail-loud 599 on every request.
+//     a test that loads no cassette gets a fail-loud 599 on every delegated request.
 //     This is what runs under `spectest test`.
 //   - RECORD (MITM): the request is forwarded to the REAL host and the
 //     request/response pair is captured (decoded, redacted), and the real
@@ -35,6 +35,8 @@
 // recorder (a `spectest test` case), false in eval/manual. So `auto`
 // (the default) replays under test and records during manual use — no new
 // control-plane mode flag. `mode: "record" | "replay"` overrides it.
+// An optional custom handler can return scripted responses or explicitly
+// delegate with ctx.replay(request). Only delegated traffic uses this engine.
 //
 // Credential brokering (per-fake): `inject` rules set
 // headers on the egress forward — overwriting whatever the app sent — so
@@ -644,6 +646,9 @@ export function replayFake(opts) {
     }
     // ── handler ─────────────────────────────────────────────────────────
     const handler = async (req, state, _ctx) => {
+        if (req.bodyUsed) {
+            throw new Error(`replayFake(${opts.name}): cannot delegate a consumed request body; inspect request.clone() before calling ctx.replay(request)`);
+        }
         const url = new URL(req.url);
         const bodyBytes = req.method === "GET" || req.method === "HEAD"
             ? new Uint8Array(0)
@@ -668,71 +673,89 @@ export function replayFake(opts) {
             return replay(reqLike, state);
         return record(req, url, reqLike, bodyBytes, state);
     };
+    const replayHelpers = (state) => ({
+        replay(file) {
+            let loaded;
+            let label;
+            if (file && typeof file === "object") {
+                loaded = coerceCassette(file, opts.name, host);
+                label = file.fake || "(inline)";
+            }
+            else if (typeof file === "string" && file.length > 0) {
+                label = file;
+                loaded = readCassetteFile(opts.name, file, host);
+            }
+            else {
+                throw new Error(`replayFake(${opts.name}): replay(...) needs a cassette path under spectest/tests/ ` +
+                    `(e.g. "recordings/${opts.name}.json").`);
+            }
+            // Build/validate before replacing live state: a bad key/cassette
+            // must leave the previous cassette and consumption cursors intact.
+            const index = new Map();
+            for (const [i, interaction] of loaded.interactions.entries()) {
+                const sig = signature(interaction.request, `${JSON.stringify(label)} interaction #${i + 1}`);
+                const queue = index.get(sig);
+                if (queue)
+                    queue.push(i);
+                else
+                    index.set(sig, [i]);
+            }
+            // Mutate the live state object (the handler reads the same
+            // reference); reset the cursor so replay starts from the top.
+            state.cassette = loaded;
+            state.index = index;
+            state.cursor = new Map();
+            return { cassette: label, host: loaded.host, interactions: loaded.interactions.length };
+        },
+        dump() {
+            return structuredClone({
+                version: 1,
+                fake: opts.name,
+                host,
+                interactions: [...state.cassette.interactions, ...state.recorded],
+            });
+        },
+        recorded() {
+            return structuredClone(state.recorded);
+        },
+        count() {
+            return state.recorded.length;
+        },
+    });
+    const initialState = (custom) => ({
+        cassette: emptyCassette(opts.name, host),
+        index: new Map(),
+        cursor: new Map(),
+        recorded: [],
+        dirty: false,
+        custom,
+    });
     const def = {
         name: opts.name,
-        // Fake = real: we answer for the real host on :80 and :443.
         hostnames: [host],
         secretRefs,
-        // Cassettes are NOT auto-loaded — a fork starts with an empty replay
-        // set, so a test that loads nothing fails loud (599). Tests call
-        // `replay(...)` to populate it.
-        state: () => ({
-            cassette: emptyCassette(opts.name, host),
-            index: new Map(),
-            cursor: new Map(),
-            recorded: [],
-            dirty: false,
-        }),
-        handler,
-        helpers: ({ state }) => ({
-            replay(file) {
-                let loaded;
-                let label;
-                if (file && typeof file === "object") {
-                    loaded = coerceCassette(file, opts.name, host);
-                    label = file.fake || "(inline)";
-                }
-                else if (typeof file === "string" && file.length > 0) {
-                    label = file;
-                    loaded = readCassetteFile(opts.name, file, host);
-                }
-                else {
-                    throw new Error(`replayFake(${opts.name}): replay(...) needs a cassette path under spectest/tests/ ` +
-                        `(e.g. "recordings/${opts.name}.json").`);
-                }
-                // Build/validate before replacing live state: a bad key/cassette
-                // must leave the previous cassette and consumption cursors intact.
-                const index = new Map();
-                for (const [i, interaction] of loaded.interactions.entries()) {
-                    const sig = signature(interaction.request, `${JSON.stringify(label)} interaction #${i + 1}`);
-                    const queue = index.get(sig);
-                    if (queue)
-                        queue.push(i);
-                    else
-                        index.set(sig, [i]);
+        state: () => opts.state
+            ? Promise.resolve(opts.state()).then(initialState)
+            : initialState(undefined),
+        handler: (request, state, ctx) => opts.handler
+            ? opts.handler(request, state.custom, {
+                ...ctx,
+                replay: (delegated) => handler(delegated, state, ctx),
+            })
+            : handler(request, state, ctx),
+        helpers: ({ name, state, ctx }) => {
+            const builtins = replayHelpers(state);
+            if (!opts.helpers)
+                return builtins;
+            return Promise.resolve(opts.helpers({ name, state: state.custom, ctx })).then((custom) => {
+                for (const key of Object.keys(builtins)) {
+                    if (key in custom) {
+                        throw new Error(`replayFake(${opts.name}): custom helper ${JSON.stringify(key)} is reserved for recording/replay; choose another name`);
+                    }
                 }
-                // Mutate the live state object (the handler reads the same
-                // reference); reset the cursor so replay starts from the top.
-                state.cassette = loaded;
-                state.index = index;
-                state.cursor = new Map();
-                return { cassette: label, host: loaded.host, interactions: loaded.interactions.length };
-            },
-            dump() {
-                return structuredClone({
-                    version: 1,
-                    fake: opts.name,
-                    host,
-                    interactions: [...state.cassette.interactions, ...state.recorded],
-                });
-            },
-            recorded() {
-                return structuredClone(state.recorded);
-            },
-            count() {
-                return state.recorded.length;
-            },
-        }),
+                return { ...custom, ...builtins };
+            });
+        },
     };
     return def;
 }

package/dist/daemon.js

@@ -57,9 +57,10 @@ import { bindInstrumentationScope, createInstrumentationScope, runInstrumented,
 import { encodeRegistry } from "./harness/names-registry.js";
 import { InterceptRegistry, parseTarget, runChain, } from "./harness/intercept.js";
 import { HOP_BY_HOP_HEADERS, withIngressCors, upstreamRequestHeaders, } from "./harness/http-proxy.js";
-import { WS_BRIDGE_HANDLERS, openUpstreamWebSocket, parseSubprotocols, upstreamHandshakeHeaders, } from "./harness/ws-bridge.js";
+import { openUpstreamWebSocket, parseSubprotocols, upstreamHandshakeHeaders, } from "./harness/ws-bridge.js";
 import { certCovers as hostmatchCertCovers, hostWithoutPort, matchRoute, selectCertName, wildcardSuffix, } from "./harness/hostmatch.js";
 import { INGRESS_HTTPS_PORT, INGRESS_HTTP_PORT, bindRoute, clearTables, emptyTables, planBind, registryTarget, routesFor, unbindRoute, } from "./harness/ingress-table.js";
+import { startIngressServer } from "./harness/ingress-server.js";
 import { startHttp2Proxy } from "./harness/http2-proxy.js";
 import { startTlsTerminator } from "./harness/tls-terminator.js";
 import { runContainerArgs } from "./harness/container-run.js";
@@ -1495,11 +1496,10 @@ let LOWERED = {
     aliasesByService: {},
     wildcards: [],
 };
-/** Running HTTP servers per port (Bun.Server). Rebuilt on /load. */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
+/** Running HTTP servers per port. Rebuilt on /load. */
 const INGRESS_HTTP_SERVERS = new Map();
+const INGRESS_HTTP_STARTING = new Map();
 /** Running HTTPS servers per port (currently always {INGRESS_HTTPS_PORT}). */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
 const INGRESS_HTTPS_SERVERS = new Map();
 /**
  * The :443 TLS terminator, once per harness process.
@@ -1564,6 +1564,7 @@ function stopIngressServers() {
         }
     }
     INGRESS_HTTP_SERVERS.clear();
+    INGRESS_HTTP_STARTING.clear();
     for (const [port, srv] of INGRESS_HTTPS_SERVERS) {
         try {
             srv.stop?.(true);
@@ -1691,7 +1692,7 @@ async function startIngress() {
         // eslint-disable-next-line no-console
         console.warn(`[ingress] root CA missing at ${CA_PATH}; skipping HTTPS bind (fakes/proxies will be HTTP-only)`);
     }
-    const Bun = requireBun();
+    requireBun();
     // Resolve every ingress hostname to its handler into the live per-port
     // route tables (module scope, so runtime `tls` can extend them later).
     // Fakes run an in-daemon handler on their declared port; proxies
@@ -1732,13 +1733,13 @@ async function startIngress() {
     for (const [port, byHost] of INGRESS.routesByPort) {
         if (port === INGRESS_HTTPS_PORT)
             continue;
-        INGRESS_HTTP_SERVERS.set(port, bindIngressServer(Bun, port, byHost, `port ${port}`));
+        await ensureHttpIngress(port, byHost);
         // eslint-disable-next-line no-console
         console.log(`[ingress] http :${port} for ${[...byHost.keys()].join(", ")}`);
     }
     // ── HTTPS listener on INGRESS_HTTPS_PORT: SNI per certificated hostname.
     if (INGRESS.certByHost.size > 0)
-        await ensureHttpsIngress(Bun);
+        await ensureHttpsIngress();
     // Seed the resolver's names registry: ingress hostnames (fakes, TLS
     // proxies, dnsName(→ingress)) → bridge gateway, plus ingress-targeted
     // wildcards. Service-targeted wildcards wait for the post-container pass
@@ -1750,17 +1751,17 @@ function requireBun() {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const Bun = globalThis.Bun;
     if (!Bun?.serve) {
-        throw new Error("ingress requires Bun.serve; the daemon must run under Bun (it does in-VM)");
+        throw new Error("ingress requires Bun; the daemon must run under Bun (it does in-VM)");
     }
     return Bun;
 }
 /**
  * Bring :443 up, once.
  *
- * Two pieces: a plaintext `Bun.serve` on an ephemeral loopback port that
+ * Two pieces: a plaintext HTTP server on an ephemeral loopback port that
  * carries the HTTPS route table (and therefore all the routing, fake
- * dispatch, interception, reverse-proxying and `server.upgrade()`
- * WebSocket bridging that :80 already gets, unchanged), and the TLS
+ * dispatch, interception, reverse-proxying and WebSocket
+ * bridging that :80 already gets, unchanged), and the TLS
  * terminator in front of it on :443.
  *
  * **This is idempotent, and that is the feature.** Adding a certificate
@@ -1781,27 +1782,25 @@ function requireBun() {
  * container can reach (containers arrive at the bridge gateway), so the
  * only way in is through the terminator.
  */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-async function ensureHttpsIngress(Bun) {
+async function ensureHttpsIngress() {
     if (INGRESS_HTTPS_SERVERS.has(INGRESS_HTTPS_PORT))
         return;
     if (!HTTPS_INGRESS_STARTING) {
         // Cleared on both outcomes: once bound, the check above short-circuits
         // every later caller, and a failed bind must be retryable rather than
         // remembered as a rejection for the life of the project.
-        HTTPS_INGRESS_STARTING = startHttpsIngress(Bun).finally(() => {
+        HTTPS_INGRESS_STARTING = startHttpsIngress().finally(() => {
             HTTPS_INGRESS_STARTING = undefined;
         });
     }
     return HTTPS_INGRESS_STARTING;
 }
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-async function startHttpsIngress(Bun) {
+async function startHttpsIngress() {
     const routes = routesFor(INGRESS, INGRESS_HTTPS_PORT);
     // `proto` is passed rather than inferred: this listener speaks plain
     // HTTP, but everything reaching it arrived over TLS, so X-Forwarded-Proto
     // must say https.
-    const plain = bindIngressServer(Bun, 0, routes, `https :${INGRESS_HTTPS_PORT}`, {
+    const plain = await bindIngressServer(0, routes, `https :${INGRESS_HTTPS_PORT}`, {
         proto: "https",
         hostname: "127.0.0.1",
     });
@@ -1884,7 +1883,7 @@ async function bindRuntimeTls(hostname, service, port, http2, cors) {
     if (!existsSync(CA_PATH) || !existsSync(CA_KEY_PATH)) {
         throw new Error(`runtime tls for ${JSON.stringify(host)} requires the in-VM root CA at ${CA_PATH}`);
     }
-    const Bun = requireBun();
+    requireBun();
     const route = { kind: "proxy", service, port, http2, cors };
     // Decide the cost before mutating anything: an already-covered hostname
     // (an exact duplicate, or one under a boot wildcard) needs only a route.
@@ -1899,9 +1898,7 @@ async function bindRuntimeTls(hostname, service, port, http2, cors) {
     // the route is only reachable once the hostname resolves, which is the
     // registry write at the end.
     bindRoute(INGRESS, host, route);
-    if (!INGRESS_HTTP_SERVERS.has(INGRESS_HTTP_PORT)) {
-        INGRESS_HTTP_SERVERS.set(INGRESS_HTTP_PORT, bindIngressServer(Bun, INGRESS_HTTP_PORT, routesFor(INGRESS, INGRESS_HTTP_PORT), `port ${INGRESS_HTTP_PORT}`));
-    }
+    await ensureHttpIngress(INGRESS_HTTP_PORT, routesFor(INGRESS, INGRESS_HTTP_PORT));
     if (plan.needsCert) {
         // The terminator reads this table on every handshake, so the leaf is
         // live the moment it lands — no listener is touched, and no connection
@@ -1909,7 +1906,7 @@ async function bindRuntimeTls(hostname, service, port, http2, cors) {
         INGRESS.certByHost.set(host, await generateHostCert(host, [host]));
     }
     if (plan.needsHttpsListener)
-        await ensureHttpsIngress(Bun);
+        await ensureHttpsIngress();
     // Resolve the hostname to the daemon gateway (where :443/:80 listen).
     // A wildcard can only live in the resolver's suffix table.
     const gw = await bridgeGatewayIp();
@@ -1946,57 +1943,27 @@ async function unbindRuntimeTls(hostname) {
         await writeRegistry();
     }
 }
-/**
- * Spin up one Bun.serve listener bound to (port, optional TLS) that
- * dispatches every request to the matching Route by Host header.
- *
- * Shared by the HTTP and HTTPS branches. Also carries the `websocket`
- * handler set so reverse-proxy targets can transparently bridge WS
- * upgrades through to their upstream service.
- */
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function bindIngressServer(
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-Bun, port, byHost, listenerLabel, 
-// Every ingress listener speaks plain HTTP now — the one behind :443
-// sits under the TLS terminator. So the scheme a client actually used
-// can no longer be inferred from the socket and is declared instead; it
-// stamps X-Forwarded-Proto, which upstreams that build absolute URLs or
-// redirect depend on.
-serve = { proto: "http" }) {
-    const proto = serve.proto;
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const opts = {
+/** Concurrent runtime routes must share the asynchronous first bind. */
+async function ensureHttpIngress(port, byHost) {
+    if (INGRESS_HTTP_SERVERS.has(port))
+        return;
+    let starting = INGRESS_HTTP_STARTING.get(port);
+    if (!starting) {
+        starting = bindIngressServer(port, byHost, `port ${port}`).then(server => {
+            INGRESS_HTTP_SERVERS.set(port, server);
+        }).finally(() => INGRESS_HTTP_STARTING.delete(port));
+        INGRESS_HTTP_STARTING.set(port, starting);
+    }
+    await starting;
+}
+/** Bind the shared HTTP/1 ingress handler, including the listener behind TLS. */
+async function bindIngressServer(port, byHost, listenerLabel, serve = { proto: "http" }) {
+    return startIngressServer({
         port,
         hostname: serve.hostname ?? "0.0.0.0",
-        // SO_REUSEPORT on every ingress listener. It was introduced so a
-        // replacement :443 could overlap the original during a certificate
-        // swap; the terminator removed that swap, and this stays for the
-        // remaining case — the `/load` teardown force-closes and rebinds, and
-        // a socket the kernel has not finished releasing would otherwise fail
-        // the next bind with "Is port 443 in use?". Note the flip side, which
-        // {@link stopIngressServers} depends on: a half-alive listener shares
-        // the port silently instead of colliding loudly.
         reusePort: true,
-        // OCI layer uploads can exceed Bun's default 128 MiB request limit.
-        // Large proxy bodies stream through; this limit does not allocate a buffer.
-        maxRequestBodySize: 1024 ** 4,
-        // Bun.serve defaults to a 10s idleTimeout, which kills any proxied
-        // request whose upstream takes >10s to produce bytes — under parallel
-        // test load that surfaced as "fetch failed"/"other side closed" on
-        // deploy-archive uploads and ERR_EMPTY_RESPONSE in browser tests
-        // ([Bun.serve]: request timed out after 10 seconds). Ingress fronts
-        // arbitrarily slow app endpoints (deploys can legitimately take
-        // minutes), so disable the idle timeout entirely; forked test VMs are
-        // short-lived, leaked-connection risk is bounded by the fork.
-        idleTimeout: 0,
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        fetch: (req, server) => dispatchIngress(req, server, byHost, listenerLabel, proto),
-        // The frame relay for bridged WebSocket upgrades; `proxyToService`
-        // opens the upstream before it upgrades the client (harness/ws-bridge.ts).
-        websocket: WS_BRIDGE_HANDLERS,
-    };
-    return Bun.serve(opts);
+        fetch: (req, server) => dispatchIngress(req, server, byHost, listenerLabel, serve.proto),
+    });
 }
 /**
  * Resolve a Host header to a route: an exact entry first, then the longest
@@ -2128,7 +2095,7 @@ server, service, port, listenerLabel, proto) {
             headers: selected ? { "sec-websocket-protocol": selected } : undefined,
         });
         if (ok) {
-            // Bun has already taken over the response — return a stub.
+            // The WebSocket has already taken over the response — return a stub.
             return new Response(null, { status: 101 });
         }
         try {
@@ -2189,6 +2156,7 @@ server, service, port, listenerLabel, proto) {
                 headers: fwdHeaders,
                 body: hasBody ? (bufferedBody ?? req.body) : undefined,
                 redirect: "manual",
+                signal: req.signal,
             });
             // decompress:false → forward the encoded body untouched (see fn doc).
             // keepalive:false → fresh connection per request (see fwdHeaders above).
@@ -2198,7 +2166,7 @@ server, service, port, listenerLabel, proto) {
                 keepalive: false,
                 // eslint-disable-next-line @typescript-eslint/no-explicit-any
             });
-            // Strip hop-by-hop response headers; let Bun set content-length / TE.
+            // Strip connection framing while preserving the unchanged body's length.
             const respHeaders = new Headers();
             for (const [k, v] of upstreamRes.headers) {
                 if (HOP_BY_HOP_HEADERS.has(k.toLowerCase()))

package/dist/harness/ingress-server.d.ts

@@ -0,0 +1,26 @@
+import { type WsBridgeData } from "./ws-bridge.js";
+export interface IngressServer {
+    port: number;
+    stop(force?: boolean): void;
+    requestIP(req: Request): {
+        address: string;
+        port: number;
+    } | undefined;
+    upgrade(req: Request, options: {
+        data: WsBridgeData;
+        headers?: Record<string, string>;
+    }): boolean;
+}
+/**
+ * Serve the ingress's Fetch handlers through node:http. Bun.serve discards
+ * Content-Length on a still-streaming Response, even when its bytes are
+ * unchanged. ServerResponse preserves the declared length while pipeline
+ * propagates backpressure and cancellation without buffering the whole body.
+ * This is also the HTTP/1 listener behind the TLS terminator.
+ */
+export declare function startIngressServer(options: {
+    port: number;
+    hostname?: string;
+    reusePort?: boolean;
+    fetch(req: Request, server: IngressServer): Response | undefined | Promise<Response | undefined>;
+}): Promise<IngressServer>;