@specific.dev/spectest 0.88.3 → 0.89.1

package/README.md

@@ -15,6 +15,42 @@ Install the [Spectest CLI](https://github.com/specific-dev/spectest/releases/lat
 and run `spectest docs /installation` for project setup and authentication.
 `spectest docs` contains the complete offline authoring guide.
 
+## HTTP assertions
+
+`ctx.fetch()` returns a wrapped response. Status fields, header lookups, and
+all body readers retain the HTTP call's provenance, so assertions appear under
+that call on the timeline:
+
+```ts
+const response = await ctx.fetch("http://app:3000/image.png");
+expect(response.status).toBe(200);
+expect(response.headers.get("content-type")).toBe("image/png");
+const bytes = await response.bytes();
+expect(bytes).toHaveLength(70);
+expect(bytes[0]).toBe(0x89);
+expect(bytes.slice(0, 8)).toEqual(new Uint8Array([0x89, 0x50, 0x4e, 0x47, 13, 10, 26, 10]));
+```
+
+`arrayBuffer()` wraps buffer metadata and slices. `blob()` wraps metadata and
+its body readers. `formData()` wraps `get()`, `getAll()`, and `has()`, including
+uploaded files and their metadata. Headers also support wrapped `getSetCookie()`
+and Bun's `getAll()`, `toJSON()`, and `count`. Missing fields remain `null`, with
+provenance recovered by an immediately following `expect`.
+
+Use `.unwrap()` to pass a wrapped value to a native API, such as
+`new TextDecoder().decode(bytes.unwrap())`. Use `.transform("text", bytes =>
+new TextDecoder().decode(bytes))` when the derived value should retain provenance.
+Iteration and callback arguments remain raw, as do array/typed-array `length`
+and stream control flags (`done`, `locked`). Use `expect(bytes).toHaveLength(n)`
+for a linked length assertion. `bodyUsed` is wrapped: unwrap it for control flow.
+
+For an open-ended stream, pass `{ captureBody: false }` to return without waiting
+for recorder body capture. SSE (`text/event-stream`) skips capture automatically.
+The HTTP event and assertions are still recorded; the event omits the body.
+`response.body.getReader().read()` returns a raw `done` flag and wrapped `value`.
+BYOB readers, `tee()`, and `pipeThrough()` preserve provenance too. Release reader
+locks and cancel streams when finished, as with native fetch.
+
 ## Electron apps
 
 Use `electron()` to build and run a real Linux Electron app under Xvfb, with
@@ -54,11 +90,15 @@ interactions and replays the app with window chrome derived from its Electron
 configuration. Child tests using `dependsOn` inherit the live app state,
 including unsaved input, in their own isolated environment.
 
-The app must declare Electron in `package.json`. Defaults are `npm ci` with a
+The app must declare Electron in `package.json` (its own or, with `context`
+set to a monorepo root, the root one). Defaults are `npm ci` with a
 package lock (otherwise `npm install`), `npm run build`, and the package's
 `main` entry. Use `appDir`, `installCommand`, `buildCommand`, `entry`, and
 `nodeVersion` to customize the build. `env` supplies runtime variables;
-`dependsOn` waits for backend services in the same environment.
+`dependsOn` waits for backend services in the same environment. Expose the
+backend through the built-in proxy (`tls: [{ hostname, port }]`) and give the
+app its `https://` URL: a renderer Content Security Policy usually refuses a
+plain `http://` service address.
 
 Applications need Linux-compatible dependencies and binaries. Native OS dialogs
 and macOS-specific APIs are outside this basic support. Replays capture the

package/dist/components/electron-chrome.d.ts

@@ -1 +1,2 @@
+export declare const ELECTRON_CA_TRUST: string;
 export declare const ELECTRON_CHROME_HOOK: string;

package/dist/components/electron-chrome.js

@@ -1,7 +1,54 @@
+// Trust for the environment CA, applied per session. Chromium on Linux
+// reads its own root store (NSS), never the container's mounted bundle, so
+// the renderer rejects every certificate the environment mints while Node
+// in the main process accepts them through NODE_EXTRA_CA_CERTS. This verify
+// procedure accepts exactly the chains that CA issued for the requested
+// host, and defers to Chromium's own verdict for everything else. An app
+// that installs its own procedure later replaces it, as in production.
+// Kept free of Electron so the unit test can run it under Bun.
+export const ELECTRON_CA_TRUST = String.raw `
+const { X509Certificate } = require('node:crypto');
+function loadEnvironmentCa(path) {
+  try { return path ? new X509Certificate(require('node:fs').readFileSync(path)) : null; }
+  catch { return null; }
+}
+// request: { hostname, errorCode, certificate: { data, issuerCert? } }.
+// Returns true only for a chain that ends at the CA and names the host.
+function issuedByEnvironmentCa(ca, request) {
+  try {
+    const leaf = new X509Certificate(request.certificate.data);
+    const host = request.hostname;
+    const named = leaf.checkHost(host) !== undefined || leaf.checkIP(host) !== undefined;
+    if (!named) return false;
+    const chain = [leaf];
+    for (let c = request.certificate; c.issuerCert && c.issuerCert !== c && chain.length < 8; c = c.issuerCert) {
+      chain.push(new X509Certificate(c.issuerCert.data));
+    }
+    for (let i = 0; i < chain.length; i++) {
+      const cert = chain[i];
+      if (cert.fingerprint256 === ca.fingerprint256) return i > 0;
+      const issuer = chain[i + 1] ?? ca;
+      if (!cert.checkIssued(issuer) || !cert.verify(issuer.publicKey)) return false;
+    }
+    return true;
+  } catch { return false; }
+}
+`;
 // Runs before the application's main entry, like Playwright's Electron loader.
 // Observe constructor options; do not replace the app entry, preload, IPC, or OS.
 export const ELECTRON_CHROME_HOOK = String.raw `
 const electron = require('electron');
+${ELECTRON_CA_TRUST}
+const environmentCa = loadEnvironmentCa(process.env.NODE_EXTRA_CA_CERTS);
+if (environmentCa) {
+  // Every session, including the default one and app-created partitions.
+  electron.app.on('session-created', session => {
+    session.setCertificateVerifyProc((request, callback) => {
+      if (request.errorCode === 0) return callback(0);
+      callback(issuedByEnvironmentCa(environmentCa, request) ? 0 : -3);
+    });
+  });
+}
 const NativeBrowserWindow = electron.BrowserWindow;
 const WrappedBrowserWindow = new Proxy(NativeBrowserWindow, {
   construct(Target, args, NewTarget) {

package/dist/components/electron.d.ts

@@ -1,7 +1,16 @@
 import { type DesktopApp } from "../desktop.js";
 export interface ElectronOptions {
-    /** Project-relative app directory; must contain package.json and Electron. */
+    /** Project-relative app directory; must contain package.json. Electron must
+     * be declared here or in the context's package.json. */
     appDir?: string;
+    /**
+     * Image build context, relative to the project root. Default `appDir`.
+     * Set it to the repository root when the app is one workspace of a
+     * monorepo and resolves packages from above its own directory. The
+     * context is copied to `/app`; `installCommand` runs at the context root,
+     * `buildCommand` and Electron run in the app directory below it.
+     */
+    context?: string;
     /** Debian Node image tag, default 24-bookworm-slim. */
     nodeVersion?: string;
     /** Build the main/preload/renderer output; default npm run build. */
@@ -31,6 +40,7 @@ export declare function electron(options?: ElectronOptions): {
     command: string;
     env: {
         SPECTEST_ELECTRON_ENTRY: string;
+        SPECTEST_ELECTRON_APP_DIR: string;
     };
     dependsOn: string[] | undefined;
     ports: number[];

package/dist/components/electron.js

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from "node:fs";
+import { posix } from "node:path";
 import { resolveProjectPath } from "../project-files.js";
 import { desktopApp } from "../desktop.js";
 import { ELECTRON_CHROME_HOOK } from "./electron-chrome.js";
@@ -9,13 +10,14 @@ export const ELECTRON_LAUNCHER = String.raw `
 import http from 'node:http';
 import { spawn } from 'node:child_process';
 import { createRequire } from 'node:module';
-const require = createRequire('/app/package.json');
+const appDir = process.env.SPECTEST_ELECTRON_APP_DIR || '/app';
+const require = createRequire(appDir + '/package.json');
 const child = spawn(require('electron'), [
   ...(process.getuid?.() === 0 ? ['--no-sandbox'] : []),
   '--disable-dev-shm-usage', '--remote-debugging-port=9222',
   '-r', '/spectest-electron-chrome.cjs',
   process.env.SPECTEST_ELECTRON_ENTRY || '.',
-], { cwd: '/app', stdio: 'inherit', env: process.env });
+], { cwd: appDir, stdio: 'inherit', env: process.env });
 const upstream = req => ({
   host: '127.0.0.1', port: 9222, path: req.url, method: req.method,
   headers: { ...req.headers, host: '127.0.0.1:9222' },
@@ -50,19 +52,41 @@ child.on('error', error => { console.error(error); process.exit(1); });
 child.on('exit', code => process.exit(code ?? 1));
 for (const signal of ['SIGTERM', 'SIGINT']) process.on(signal, () => child.kill(signal));
 `;
+/** Read a package.json and tell whether it declares electron. */
+function declaresElectron(manifest) {
+    if (!existsSync(manifest))
+        return false;
+    const pkg = JSON.parse(readFileSync(manifest, "utf8"));
+    return Boolean(pkg.dependencies?.electron || pkg.devDependencies?.electron);
+}
+/** The app directory as a path inside the build context: "." or "a/b". */
+function appPathInContext(appDir, context) {
+    const rel = posix.relative(posix.normalize(context), posix.normalize(appDir));
+    if (rel === "")
+        return ".";
+    if (rel.startsWith("..") || posix.isAbsolute(rel)) {
+        throw new Error(`electron(): appDir ${JSON.stringify(appDir)} must be inside context ${JSON.stringify(context)}`);
+    }
+    return rel;
+}
 /** Real Linux Electron under Xvfb, with a generated image and graphical replay.
  * Like expo(), returns an app handle for the matching context method.
  * Requires Linux-compatible application dependencies and binaries. */
 export function electron(options = {}) {
     const appDir = options.appDir ?? ".";
+    const context = options.context ?? appDir;
+    const appPath = appPathInContext(appDir, context);
     const manifest = resolveProjectPath(`${appDir}/package.json`);
     if (!existsSync(manifest))
         throw new Error(`electron(): no package.json in ${appDir}`);
-    const pkg = JSON.parse(readFileSync(manifest, "utf8"));
-    if (!pkg.dependencies?.electron && !pkg.devDependencies?.electron) {
-        throw new Error("electron(): declare electron in the app's dependencies or devDependencies");
+    // A monorepo declares electron in the workspace or at the root; both work
+    // because the app resolves `electron` upward from its own directory.
+    if (!declaresElectron(manifest) && !declaresElectron(resolveProjectPath(`${context}/package.json`))) {
+        throw new Error("electron(): declare electron in the app's dependencies or devDependencies" +
+            (context === appDir ? "" : ` (in ${appDir} or in the context ${context})`));
     }
-    const locked = existsSync(resolveProjectPath(`${appDir}/package-lock.json`));
+    // The install runs at the context root, so that is where the lockfile counts.
+    const locked = existsSync(resolveProjectPath(`${context}/package-lock.json`));
     const node = options.nodeVersion ?? "24-bookworm-slim";
     if (!/^[\w.-]+$/.test(node))
         throw new Error("electron(): invalid Node image tag");
@@ -71,18 +95,22 @@ export function electron(options = {}) {
     if ([install, build].some(command => /[\r\n]/.test(command))) {
         throw new Error("electron(): build/install commands must be single-line shell commands");
     }
+    // Electron can be hoisted to the context root, so find its install script
+    // through Node's resolution from the app directory instead of a fixed path.
+    const inApp = appPath === "." ? "" : `cd ${appPath} && `;
+    const fetchElectron = `${inApp}node "$(node -p "require.resolve('electron/install.js')")"`;
     return {
         image: {
             type: "dockerfile",
-            context: appDir,
+            context,
             exclude: ["node_modules", "**/node_modules", "out", "test-results", ".data"],
             content: `FROM node:${node}
 RUN apt-get update && apt-get install -y --no-install-recommends xvfb xauth libgtk-3-0 libnss3 libgbm1 libasound2 fonts-liberation ca-certificates && rm -rf /var/lib/apt/lists/*
 WORKDIR /app
 COPY . .
 RUN ${install}
-RUN node node_modules/electron/install.js
-RUN ${build}
+RUN ${fetchElectron}
+RUN ${inApp}${build}
 `,
         },
         files: [
@@ -90,7 +118,11 @@ RUN ${build}
             { path: "/spectest-electron-chrome.cjs", content: ELECTRON_CHROME_HOOK },
         ],
         command: "xvfb-run -a node /spectest-electron.mjs",
-        env: { ...options.env, SPECTEST_ELECTRON_ENTRY: options.entry ?? "." },
+        env: {
+            ...options.env,
+            SPECTEST_ELECTRON_ENTRY: options.entry ?? ".",
+            SPECTEST_ELECTRON_APP_DIR: appPath === "." ? "/app" : `/app/${appPath}`,
+        },
         dependsOn: options.dependsOn,
         ports: [9223],
         readyCheck: { type: "http", port: 9223, path: "/json/version", timeoutSecs: 60 },

package/dist/daemon.js

@@ -51,6 +51,7 @@ import { bindInstrumentationScope, createInstrumentationScope, runInstrumented,
 import { encodeRegistry } from "./harness/names-registry.js";
 import { InterceptRegistry, parseTarget, runChain, } from "./harness/intercept.js";
 import { HOP_BY_HOP_HEADERS, augmentCorsResponse, corsPreflightResponse, isCorsPreflight, } from "./harness/http-proxy.js";
+import { WS_BRIDGE_HANDLERS, openUpstreamWebSocket, parseSubprotocols, upstreamHandshakeHeaders, } from "./harness/ws-bridge.js";
 import { certCovers as hostmatchCertCovers, hostWithoutPort, matchRoute, selectCertName, wildcardSuffix, } from "./harness/hostmatch.js";
 import { INGRESS_HTTPS_PORT, INGRESS_HTTP_PORT, bindRoute, clearTables, emptyTables, planBind, registryTarget, routesFor, unbindRoute, } from "./harness/ingress-table.js";
 import { startTlsTerminator } from "./harness/tls-terminator.js";
@@ -1977,8 +1978,8 @@ async function unbindRuntimeTls(hostname) {
  * Spin up one Bun.serve listener bound to (port, optional TLS) that
  * dispatches every request to the matching Route by Host header.
  *
- * Shared by the HTTP and HTTPS branches. Also exports a `websocket`
- * handler so reverse-proxy targets can transparently bridge WS
+ * Shared by the HTTP and HTTPS branches. Also carries the `websocket`
+ * handler set so reverse-proxy targets can transparently bridge WS
  * upgrades through to their upstream service.
  */
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -2016,81 +2017,9 @@ serve = { proto: "http" }) {
         idleTimeout: 0,
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         fetch: (req, server) => dispatchIngress(req, server, byHost, listenerLabel, proto),
-        websocket: {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            async open(ws) {
-                const data = ws.data;
-                try {
-                    const upstream = new WebSocket(data.upstreamUrl);
-                    // ArrayBuffer so binary frames can be ws.send()'d to the
-                    // downstream client verbatim — Blob would need an extra
-                    // .arrayBuffer() round-trip on every message.
-                    upstream.binaryType = "arraybuffer";
-                    data.upstream = upstream;
-                    upstream.addEventListener("open", () => {
-                        for (const m of data.pending)
-                            upstream.send(m);
-                        data.pending = [];
-                    });
-                    upstream.addEventListener("message", (ev) => {
-                        try {
-                            ws.send(ev.data);
-                        }
-                        catch {
-                            /* client gone */
-                        }
-                    });
-                    upstream.addEventListener("close", (ev) => {
-                        try {
-                            ws.close(ev.code, ev.reason);
-                        }
-                        catch {
-                            /* already closed */
-                        }
-                    });
-                    upstream.addEventListener("error", () => {
-                        try {
-                            ws.close(1011, "upstream error");
-                        }
-                        catch {
-                            /* already closed */
-                        }
-                    });
-                }
-                catch (err) {
-                    // eslint-disable-next-line no-console
-                    console.warn(`[ingress] ws upstream open failed for ${data.upstreamUrl}:`, err);
-                    try {
-                        ws.close(1011, "upstream open failed");
-                    }
-                    catch {
-                        /* ignore */
-                    }
-                }
-            },
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            message(ws, message) {
-                const data = ws.data;
-                const payload = typeof message === "string" ? message : new Uint8Array(message);
-                if (data.upstream && data.upstream.readyState === WebSocket.OPEN) {
-                    data.upstream.send(payload);
-                }
-                else {
-                    // Buffer until the upstream finishes its handshake.
-                    data.pending.push(payload);
-                }
-            },
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            close(ws, code, reason) {
-                const data = ws.data;
-                try {
-                    data.upstream?.close(code, reason);
-                }
-                catch {
-                    /* ignore */
-                }
-            },
-        },
+        // The frame relay for bridged WebSocket upgrades; `proxyToService`
+        // opens the upstream before it upgrades the client (harness/ws-bridge.ts).
+        websocket: WS_BRIDGE_HANDLERS,
     };
     return Bun.serve(opts);
 }
@@ -2181,8 +2110,12 @@ function ingressClientIp(server, req, proto) {
  * Reverse-proxy a request to `http://<service>:<port>` on
  * `spectest-net`. Handles plain HTTP/1.1 + 2 and WebSocket upgrades:
  *
- *   - WS upgrade requests get routed through `server.upgrade()`, with
- *     the upstream URL stashed on `ws.data`. The shared `websocket`
+ *   - WS upgrade requests open the upstream WebSocket first, with the
+ *     client's full `Sec-WebSocket-Protocol` list and its forwardable
+ *     headers (cookies, authorization, origin, x-forwarded-*). Only after
+ *     that handshake succeeds is the client upgraded, with the protocol
+ *     the upstream selected; a refused upstream handshake is a 502, not a
+ *     101 followed by a close. The open upstream rides on `ws.data`; the shared `websocket`
  *     handler opens the upstream and bridges frames both ways.
  *   - Plain requests pass through via `fetch()` with hop-by-hop
  *     headers stripped; the response body is a ReadableStream returned
@@ -2205,16 +2138,38 @@ server, service, port, listenerLabel, proto) {
     const upgrade = req.headers.get("upgrade")?.toLowerCase() ?? "";
     if (upgrade === "websocket") {
         const upstreamUrl = `ws://${await proxyUpstreamHost(service)}:${port}${upstreamPath}`;
-        const wsData = {
-            upstreamUrl,
-            upstream: null,
-            pending: [],
-        };
-        const ok = server.upgrade(req, { data: wsData });
+        // The upstream handshake carries what the client's did: the whole
+        // subprotocol list (a console ticket often rides as the second entry)
+        // and the forwardable headers. Same provenance stamps as the HTTP path.
+        const protocols = parseSubprotocols(req.headers.get("sec-websocket-protocol"));
+        const headers = upstreamHandshakeHeaders(req.headers, {
+            service,
+            port,
+            proto,
+            clientIp: ingressClientIp(server, req, proto),
+        });
+        const opened = await openUpstreamWebSocket(upstreamUrl, { protocols, headers });
+        if (!opened.ok) {
+            return new Response(`spectest-daemon: ${opened.reason} (${upstreamUrl}) on ${listenerLabel}\n`, { status: 502, headers: { "content-type": "text/plain" } });
+        }
+        const wsData = { upstreamUrl, upstream: opened.socket };
+        // Echo the protocol the upstream selected; Bun would otherwise pick
+        // the client's first entry by itself, which can differ.
+        const selected = opened.socket.protocol;
+        const ok = server.upgrade(req, {
+            data: wsData,
+            headers: selected ? { "sec-websocket-protocol": selected } : undefined,
+        });
         if (ok) {
             // Bun has already taken over the response — return a stub.
             return new Response(null, { status: 101 });
         }
+        try {
+            opened.socket.close(1011, "client upgrade refused");
+        }
+        catch {
+            /* ignore */
+        }
         return new Response(`spectest-daemon: ws upgrade refused on ${listenerLabel}\n`, { status: 426, headers: { "content-type": "text/plain" } });
     }
     const fwdHeaders = new Headers();

package/dist/harness/fetch.js

@@ -61,8 +61,7 @@ export function isTransportError(err) {
 export function installFetchWrapper() {
     const original = globalThis.fetch;
     // SDK internals (the MCP client, its OAuth flow) must not see the
-    // wrapper: a wrapped `res.ok` is an object, and the wrapper reads every
-    // body to the end, which never finishes for an SSE stream.
+    // wrapper: its response properties and body readers return wrapped values.
     setRawFetch(original);
     const wrappedFn = async (input, init) => {
         const scope = currentInstrumentationScope();
@@ -85,7 +84,12 @@ export function installFetchWrapper() {
             const contentType = res.headers.get("content-type");
             const contentLength = () => parseContentLength(res.headers.get("content-length"));
             const textual = isTextualContentType(contentType);
-            if (textual === false) {
+            const streaming = contentType?.split(";")[0]?.trim().toLowerCase() === "text/event-stream";
+            if (init?.captureBody === false || streaming) {
+                // Return on headers: an open-ended stream must not be drained (or
+                // cloned into an unbounded background buffer) by the recorder.
+            }
+            else if (textual === false) {
                 responseBody = omittedBody("binary", contentType, contentLength());
             }
             else {

package/dist/harness/ws-bridge.d.ts

@@ -0,0 +1,78 @@
+/**
+ * The ingress WebSocket bridge: one client WebSocket on an ingress
+ * listener, one upstream WebSocket to the service, frames copied in both
+ * directions.
+ *
+ * The handshake is the part that matters. A client that sends
+ * `Sec-WebSocket-Protocol: console, <ticket>` expects the upstream to see
+ * the full list, and expects to get back the one the upstream selected.
+ * The first version of this bridge opened the upstream with no protocols
+ * and no headers, so a ticket or a cookie that rode on the handshake never
+ * reached the service, and the service refused the connection after the
+ * client already saw a 101. So the bridge now opens the upstream FIRST,
+ * with the client's protocol list and forwardable headers, waits for the
+ * upstream handshake, and only then upgrades the client with the protocol
+ * the upstream selected. An upstream that refuses the handshake becomes a
+ * 502 to the client, the same as the HTTP proxy path.
+ *
+ * `daemon.ts` owns the listener and the route lookup; this module owns
+ * the handshake and the frame relay so the two can be tested on loopback
+ * without a VM.
+ */
+/** Per-bridge context stored on `ws.data` of the client socket. */
+export interface WsBridgeData {
+    upstreamUrl: string;
+    /** Open by the time the client socket exists: the handshake awaited it. */
+    upstream: WebSocket;
+}
+/** `Sec-WebSocket-Protocol` is a comma-separated list; each token is
+ *  trimmed, empty tokens are dropped, order is kept (RFC 6455 §4.1 lets
+ *  the server pick from the list, so order is the client's preference). */
+export declare function parseSubprotocols(header: string | null | undefined): string[];
+/**
+ * The headers the upstream handshake carries: everything forwardable from
+ * the client's request (cookies, authorization, origin, user-agent …),
+ * minus the client's own handshake fields, plus the proxy provenance
+ * headers and a Host that names the service.
+ */
+export declare function upstreamHandshakeHeaders(req: Headers, opts: {
+    service: string;
+    port: number;
+    proto: string;
+    clientIp?: string;
+}): Record<string, string>;
+export type UpstreamOpen = {
+    ok: true;
+    socket: WebSocket;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Open the upstream WebSocket and wait for its handshake. Resolves once
+ * the socket is open, or once it failed; the handshake listeners are
+ * removed either way so a later close does not fire them again.
+ */
+export declare function openUpstreamWebSocket(url: string, opts: {
+    protocols: string[];
+    headers: Record<string, string>;
+    timeoutMs?: number;
+}): Promise<UpstreamOpen>;
+/** The minimum of Bun's ServerWebSocket that the relay uses. */
+interface ClientSocket {
+    data: WsBridgeData;
+    send(data: string | ArrayBuffer | Uint8Array): unknown;
+    close(code?: number, reason?: string): unknown;
+}
+/**
+ * The `websocket` handler set for `Bun.serve`. The upstream is already
+ * open when `open()` runs, so frames go straight through in both
+ * directions, and a close on either side closes the other with the same
+ * code and reason.
+ */
+export declare const WS_BRIDGE_HANDLERS: {
+    open(ws: ClientSocket): void;
+    message(ws: ClientSocket, message: string | Buffer): void;
+    close(ws: ClientSocket, code: number, reason: string): void;
+};
+export {};