@specific.dev/spectest 0.93.0 → 0.94.0

package/dist/components/email.js

@@ -1,22 +1,5 @@
-// `email()` — a real SMTP server as a spectest service. The app under test
-// points its SMTP transport at `<key>:1025` and sends mail exactly as it
-// would in production; every message is captured instead of delivered.
-// Tests read the mailbox through typed helpers on `ctx.svc.<key>`
-// (`lastEmail`, `emails`, `clear`), each recorded as an `email` event on
-// the test timeline — single-message ops embed the full captured message
-// (HTML body included) so the dashboard renders the actual email the test
-// asserted against, and returns come back inspect-wrapped so
-// `expect(mail.subject)` links under the step. To wait for a message to
-// *arrive*, use the standard `ctx.poll` with `lastEmail` as the predicate
-// (it returns `undefined` while the mailbox is empty); the winning
-// iteration's `email` event survives poll truncation, so the message still
-// renders nested under the wait step.
-//
-// Captured mail lives in the server's process memory, so it snapshots and
-// forks with the rest of the environment: a `dependsOn` child inherits the
-// parent's mailbox, sibling forks never see each other's messages — the
-// same isolation contract as fake state.
-import { pauseRecording, recordEmail, reserveEvent, resumeRecording, truncateUtf8, } from "../recorder.js";
+import { rawFetch } from "../harness/raw-fetch.js";
+import { recordEmail, reserveEvent, truncateUtf8, } from "../recorder.js";
 import { wrap } from "../inspect.js";
 const DEFAULT_IMAGE = "axllent/mailpit:v1.30";
 const SMTP_PORT = 1025;
@@ -140,29 +123,21 @@ async function instrumented(service, op, query, body) {
         throw err;
     }
 }
-/** Query the mail server's HTTP API. Recording is paused around the fetch
- *  so these internal polls don't land as `http` events on the timeline —
- *  the helper records one consolidated `email` event instead. */
+/** Internal HTTP stays native; the public helper records one email event. */
 async function api(base, path, init) {
-    pauseRecording();
+    const res = await rawFetch(`${base}${path}`, init);
+    if (!res.ok) {
+        throw new Error(`email server API ${path} failed: HTTP ${res.status}`);
+    }
+    const text = await res.text();
+    if (text === "")
+        return undefined;
     try {
-        const res = await fetch(`${base}${path}`, init);
-        if (!res.ok) {
-            throw new Error(`email server API ${path} failed: HTTP ${res.status}`);
-        }
-        const text = await res.text();
-        if (text === "")
-            return undefined;
-        try {
-            return JSON.parse(text);
-        }
-        catch {
-            // Mutating endpoints reply with a plain-text acknowledgement.
-            return text;
-        }
+        return JSON.parse(text);
     }
-    finally {
-        resumeRecording();
+    catch {
+        // Mutating endpoints reply with a plain-text acknowledgement.
+        return text;
     }
 }
 function addresses(v) {

package/dist/components/emulate/entry.mjs

@@ -179,9 +179,8 @@ Bun.serve({
     // own IP and never sends a provider name.
     if (url.pathname === "/healthz") return new Response("ok\n");
 
-    // The daemon reverse-proxies us and rewrites `Host` to the service-net
-    // name, so the provider the client asked for only survives in
-    // `X-Forwarded-Host`. Read that first; `Host` covers a direct call.
+    // Ingress preserves Host and also stamps X-Forwarded-Host with the
+    // requested authority. Host covers direct calls to the emulator.
     const host = (req.headers.get("x-forwarded-host") ?? req.headers.get("host") ?? "")
       .toLowerCase()
       .replace(/:\d+$/, "");

package/dist/components/s3.d.ts

@@ -17,9 +17,9 @@ export interface S3Options {
      * via the daemon's TLS-terminating reverse proxy. Optional — defaults to none;
      * the store is always reachable at `http://<key>:9090` regardless. Set this
      * only when the app under test hardcodes a specific prod S3 endpoint it can't
-     * be told to override (`https://<bucket>.s3.amazonaws.com`, a provider's
-     * storage host): the daemon mints a cert for each host and proxies to the
-     * store's plain HTTP. The store ignores SigV4, so the Host rewrite is harmless.
+     * be told to override (a provider's storage host; requests must still use
+     * path-style addressing): the daemon mints a cert for each host and proxies to the
+     * store's plain HTTP while preserving the requested Host.
      */
     hosts?: string[];
     /** Access key id the helper client signs with. The store ignores SigV4, so

package/dist/components/s3.js

@@ -1,3 +1,4 @@
+import { rawFetch } from "../harness/raw-fetch.js";
 import { S3Client } from "../s3.js";
 // Backing image, pinned internally (not user-configurable). adobe/s3mock 5.1.0
 // is the current release; avoid exactly 5.0.0, which crashed at startup on
@@ -75,7 +76,7 @@ export function s3(opts = {}) {
                         // CreateBucket is a plain `PUT` on the bucket root; the store
                         // returns 200 (or 409 if it already exists — idempotent enough to
                         // ignore).
-                        const res = await fetch(`http://${name}:${S3_PORT}/${bucket}`, {
+                        const res = await rawFetch(`http://${name}:${S3_PORT}/${bucket}`, {
                             method: "PUT",
                         });
                         if (!res.ok && res.status !== 409) {

package/dist/components/supabase.js

@@ -1,3 +1,4 @@
+import { rawFetch } from "../harness/raw-fetch.js";
 // A ready-to-use, self-hosted **Supabase** stack, expressed as a set of
 // spectest services (one container each) wired together on spectest-net.
 //
@@ -1807,7 +1808,7 @@ export function supabase(opts = {}) {
                     // snapshot and a test's diff is what its requests mutate.
                     setup: async () => {
                         const t0 = Date.now();
-                        const res = await fetch(`http://${g.key("functions")}:9000/_spectest/warm`);
+                        const res = await rawFetch(`http://${g.key("functions")}:9000/_spectest/warm`);
                         if (!res.ok) {
                             console.warn(`supabase(): edge functions warm-up answered ${res.status}; functions boot on first call instead.`);
                             return;

package/dist/daemon.js

@@ -56,7 +56,7 @@ import { installFetchWrapper, isTransportError } from "./harness/fetch.js";
 import { bindInstrumentationScope, createInstrumentationScope, runInstrumented, runUninstrumented, } from "./harness/instrumentation-scope.js";
 import { encodeRegistry } from "./harness/names-registry.js";
 import { InterceptRegistry, parseTarget, runChain, } from "./harness/intercept.js";
-import { HOP_BY_HOP_HEADERS, augmentCorsResponse, corsPreflightResponse, isCorsPreflight, } from "./harness/http-proxy.js";
+import { HOP_BY_HOP_HEADERS, augmentCorsResponse, corsPreflightResponse, isCorsPreflight, upstreamRequestHeaders, } from "./harness/http-proxy.js";
 import { WS_BRIDGE_HANDLERS, openUpstreamWebSocket, parseSubprotocols, upstreamHandshakeHeaders, } from "./harness/ws-bridge.js";
 import { certCovers as hostmatchCertCovers, hostWithoutPort, matchRoute, selectCertName, wildcardSuffix, } from "./harness/hostmatch.js";
 import { INGRESS_HTTPS_PORT, INGRESS_HTTP_PORT, bindRoute, clearTables, emptyTables, planBind, registryTarget, routesFor, unbindRoute, } from "./harness/ingress-table.js";
@@ -2098,8 +2098,6 @@ server, service, port, listenerLabel, proto) {
         // and the forwardable headers. Same provenance stamps as the HTTP path.
         const protocols = parseSubprotocols(req.headers.get("sec-websocket-protocol"));
         const headers = upstreamHandshakeHeaders(req.headers, {
-            service,
-            port,
             proto,
             clientIp: ingressClientIp(server, req, proto),
         });
@@ -2127,28 +2125,10 @@ server, service, port, listenerLabel, proto) {
         }
         return new Response(`spectest-daemon: ws upgrade refused on ${listenerLabel}\n`, { status: 426, headers: { "content-type": "text/plain" } });
     }
-    const fwdHeaders = new Headers();
-    for (const [k, v] of req.headers) {
-        if (HOP_BY_HOP_HEADERS.has(k.toLowerCase()))
-            continue;
-        fwdHeaders.append(k, v);
-    }
-    // Standard reverse-proxy provenance headers: the upstream sees the
-    // public scheme/host it was reached through and the client's address,
-    // even though we rewrite Host below to the service-net name.
-    const clientIp = ingressClientIp(server, req, proto);
-    const priorXff = req.headers.get("x-forwarded-for");
-    const xff = clientIp ? (priorXff ? `${priorXff}, ${clientIp}` : clientIp) : priorXff;
-    if (xff)
-        fwdHeaders.set("x-forwarded-for", xff);
-    fwdHeaders.set("x-forwarded-proto", proto);
-    const publicHost = req.headers.get("host");
-    if (publicHost)
-        fwdHeaders.set("x-forwarded-host", publicHost);
-    // Override Host so the upstream sees its own service-net name, not
-    // the public hostname. Lets origin servers that vhost by Host header
-    // continue to find the right virtual host.
-    fwdHeaders.set("host", `${service}:${port}`);
+    const fwdHeaders = upstreamRequestHeaders(req.headers, {
+        proto,
+        clientIp: ingressClientIp(server, req, proto),
+    });
     // Fresh connection per upstream request — never reuse a pooled
     // keep-alive conn. Upstreams with short idle timeouts (uvicorn defaults
     // to 5s) close pooled connections under Bun's fetch, and the next

package/dist/harness/http-proxy.d.ts

@@ -12,13 +12,18 @@
  * Forwarding `transfer-encoding` or `content-length` from a re-encoded
  * body is the classic way to produce a response the client cannot frame;
  * forwarding `connection` leaks our keep-alive intent to the upstream.
- * `host` is here because the proxy sets its own — the upstream must see
- * the service it actually is, not the public name the client asked for.
+ * `host` identifies the requested origin and must survive the proxy hop.
  */
 export declare const HOP_BY_HOP_HEADERS: ReadonlySet<string>;
 export declare function isHopByHop(name: string): boolean;
 /** Copy headers, dropping the ones that belong to this connection. */
 export declare function forwardableHeaders(headers: Headers): Headers;
+/** Preserve the requested Host (including its port) while dialing the service's
+ * internal address. HTTP and WebSocket forwarding share this policy. */
+export declare function upstreamRequestHeaders(headers: Headers, opts: {
+    proto: string;
+    clientIp?: string;
+}): Headers;
 /**
  * A CORS preflight is an `OPTIONS` carrying both `Origin` and
  * `Access-Control-Request-Method`. An `OPTIONS` without them is a normal

package/dist/harness/http-proxy.js

@@ -12,8 +12,7 @@
  * Forwarding `transfer-encoding` or `content-length` from a re-encoded
  * body is the classic way to produce a response the client cannot frame;
  * forwarding `connection` leaks our keep-alive intent to the upstream.
- * `host` is here because the proxy sets its own — the upstream must see
- * the service it actually is, not the public name the client asked for.
+ * `host` identifies the requested origin and must survive the proxy hop.
  */
 export const HOP_BY_HOP_HEADERS = new Set([
     "connection",
@@ -24,7 +23,6 @@ export const HOP_BY_HOP_HEADERS = new Set([
     "trailers",
     "transfer-encoding",
     "upgrade",
-    "host",
 ]);
 export function isHopByHop(name) {
     return HOP_BY_HOP_HEADERS.has(name.toLowerCase());
@@ -38,6 +36,22 @@ export function forwardableHeaders(headers) {
     });
     return out;
 }
+/** Preserve the requested Host (including its port) while dialing the service's
+ * internal address. HTTP and WebSocket forwarding share this policy. */
+export function upstreamRequestHeaders(headers, opts) {
+    const out = forwardableHeaders(headers);
+    const priorXff = headers.get("x-forwarded-for");
+    const xff = opts.clientIp
+        ? priorXff ? `${priorXff}, ${opts.clientIp}` : opts.clientIp
+        : priorXff;
+    if (xff)
+        out.set("x-forwarded-for", xff);
+    out.set("x-forwarded-proto", opts.proto);
+    const host = headers.get("host");
+    if (host)
+        out.set("x-forwarded-host", host);
+    return out;
+}
 /**
  * A CORS preflight is an `OPTIONS` carrying both `Origin` and
  * `Access-Control-Request-Method`. An `OPTIONS` without them is a normal

package/dist/harness/ws-bridge.d.ts

@@ -33,11 +33,9 @@ export declare function parseSubprotocols(header: string | null | undefined): st
  * The headers the upstream handshake carries: everything forwardable from
  * the client's request (cookies, authorization, origin, user-agent …),
  * minus the client's own handshake fields, plus the proxy provenance
- * headers and a Host that names the service.
+ * headers and the original Host.
  */
 export declare function upstreamHandshakeHeaders(req: Headers, opts: {
-    service: string;
-    port: number;
     proto: string;
     clientIp?: string;
 }): Record<string, string>;

package/dist/harness/ws-bridge.js

@@ -19,7 +19,7 @@
  * the handshake and the frame relay so the two can be tested on loopback
  * without a VM.
  */
-import { forwardableHeaders } from "./http-proxy.js";
+import { upstreamRequestHeaders } from "./http-proxy.js";
 /** Headers that belong to the client's own WebSocket handshake. Bun's
  *  WebSocket client mints its own key and version, and the protocol list
  *  goes through the constructor option, so these never travel as plain
@@ -46,28 +46,15 @@ export function parseSubprotocols(header) {
  * The headers the upstream handshake carries: everything forwardable from
  * the client's request (cookies, authorization, origin, user-agent …),
  * minus the client's own handshake fields, plus the proxy provenance
- * headers and a Host that names the service.
+ * headers and the original Host.
  */
 export function upstreamHandshakeHeaders(req, opts) {
     const out = {};
-    forwardableHeaders(req).forEach((value, key) => {
+    upstreamRequestHeaders(req, opts).forEach((value, key) => {
         if (HANDSHAKE_HEADERS.has(key))
             return;
         out[key] = value;
     });
-    const priorXff = req.get("x-forwarded-for");
-    const xff = opts.clientIp
-        ? priorXff
-            ? `${priorXff}, ${opts.clientIp}`
-            : opts.clientIp
-        : priorXff;
-    if (xff)
-        out["x-forwarded-for"] = xff;
-    out["x-forwarded-proto"] = opts.proto;
-    const publicHost = req.get("host");
-    if (publicHost)
-        out["x-forwarded-host"] = publicHost;
-    out["host"] = `${opts.service}:${opts.port}`;
     return out;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/spectest",
-  "version": "0.93.0",
+  "version": "0.94.0",
   "description": "Spectest SDK for defining test environments in TypeScript.",
   "type": "module",
   "main": "./dist/index.js",

package/src/components/email.ts

@@ -1,3 +1,4 @@
+import { rawFetch } from "../harness/raw-fetch.js";
 // `email()` — a real SMTP server as a spectest service. The app under test
 // points its SMTP transport at `<key>:1025` and sends mail exactly as it
 // would in production; every message is captured instead of delivered.
@@ -19,10 +20,8 @@
 
 import type { ServiceDefinition } from "../index.js";
 import {
-  pauseRecording,
   recordEmail,
   reserveEvent,
-  resumeRecording,
   truncateUtf8,
   type EmailEventMessage,
   type EmailEventSummary,
@@ -262,26 +261,19 @@ async function instrumented<T>(
   }
 }
 
-/** Query the mail server's HTTP API. Recording is paused around the fetch
- *  so these internal polls don't land as `http` events on the timeline —
- *  the helper records one consolidated `email` event instead. */
+/** Internal HTTP stays native; the public helper records one email event. */
 async function api(base: string, path: string, init?: RequestInit): Promise<unknown> {
-  pauseRecording();
+  const res = await rawFetch(`${base}${path}`, init);
+  if (!res.ok) {
+    throw new Error(`email server API ${path} failed: HTTP ${res.status}`);
+  }
+  const text = await res.text();
+  if (text === "") return undefined;
   try {
-    const res = await fetch(`${base}${path}`, init);
-    if (!res.ok) {
-      throw new Error(`email server API ${path} failed: HTTP ${res.status}`);
-    }
-    const text = await res.text();
-    if (text === "") return undefined;
-    try {
-      return JSON.parse(text);
-    } catch {
-      // Mutating endpoints reply with a plain-text acknowledgement.
-      return text;
-    }
-  } finally {
-    resumeRecording();
+    return JSON.parse(text);
+  } catch {
+    // Mutating endpoints reply with a plain-text acknowledgement.
+    return text;
   }
 }
 

package/src/components/emulate/entry.mjs

@@ -179,9 +179,8 @@ Bun.serve({
     // own IP and never sends a provider name.
     if (url.pathname === "/healthz") return new Response("ok\n");
 
-    // The daemon reverse-proxies us and rewrites `Host` to the service-net
-    // name, so the provider the client asked for only survives in
-    // `X-Forwarded-Host`. Read that first; `Host` covers a direct call.
+    // Ingress preserves Host and also stamps X-Forwarded-Host with the
+    // requested authority. Host covers direct calls to the emulator.
     const host = (req.headers.get("x-forwarded-host") ?? req.headers.get("host") ?? "")
       .toLowerCase()
       .replace(/:\d+$/, "");

package/src/components/internal-fetch.test.ts

@@ -0,0 +1,109 @@
+import { expect, test } from "bun:test";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+// Exercise public component hooks with the same dispatcher and async scope as
+// bootstrap. A child process isolates global fetch and recorder state.
+async function check(code: string, workspace?: string): Promise<void> {
+  const moduleUrl = (file: string) => JSON.stringify(new URL(file, import.meta.url).href);
+  const script = `
+    import { strict as assert } from "node:assert";
+    import { s3 } from ${moduleUrl("./s3.ts")};
+    import { supabase } from ${moduleUrl("./supabase.ts")};
+    import { emailHelpers } from ${moduleUrl("./email.ts")};
+    import { installFetchWrapper } from ${moduleUrl("../harness/fetch.ts")};
+    import { createInstrumentationScope, runInstrumented } from ${moduleUrl("../harness/instrumentation-scope.ts")};
+    import { startRecording, stopRecording } from ${moduleUrl("../recorder.ts")};
+    let respond = () => Response.json({});
+    const requests = [];
+    globalThis.fetch = async (input, init) => {
+      requests.push({ url: String(input), method: init?.method ?? "GET" });
+      return respond();
+    };
+    const restore = installFetchWrapper();
+    const scope = createInstrumentationScope(false);
+    try {
+      await runInstrumented(scope, async () => {
+        assert.equal((await fetch("http://probe/")).status.unwrap(), 200);
+        requests.length = 0;
+        ${code}
+      });
+    } finally { scope.active = false; restore(); }
+  `;
+  const child = Bun.spawn([process.execPath, "--eval", script], {
+    env: { ...process.env, ...(workspace ? { SPECTEST_WORKSPACE: workspace } : {}) },
+    stdout: "pipe", stderr: "pipe",
+  });
+  const [exit, stdout, stderr] = await Promise.all([
+    child.exited, new Response(child.stdout).text(), new Response(child.stderr).text(),
+  ]);
+  expect(exit, stdout + stderr).toBe(0);
+}
+
+test.each([200, 201, 409, 403, 500])("S3 setup handles HTTP %i inside a wrapped setup scope", async (status) => {
+  await check(`
+    respond = () => new Response("bucket response", { status: ${status} });
+    const setup = s3({ buckets: ["uploads", "assets"] }).setup;
+    ${status === 403 || status === 500
+      ? `await assert.rejects(() => setup({ name: "storage" }), /failed to create bucket uploads: ${status}/);
+         assert.equal(requests.length, 1);`
+      : `await setup({ name: "storage" });
+         assert.deepEqual(requests, [
+           { url: "http://storage:9090/uploads", method: "PUT" },
+           { url: "http://storage:9090/assets", method: "PUT" },
+         ]);`}
+  `);
+});
+
+test("S3 setup propagates transport failures", async () => {
+  await check(`
+    respond = () => { throw new Error("connection refused"); };
+    await assert.rejects(() => s3({ buckets: ["uploads"] }).setup({ name: "storage" }), /connection refused/);
+  `);
+});
+
+test("Supabase warm-up handles errors and reads native JSON in a wrapped setup scope", async () => {
+  const root = await mkdtemp(join(tmpdir(), "spectest-component-fetch-"));
+  try {
+    await mkdir(join(root, "supabase/functions/hello"), { recursive: true });
+    await writeFile(join(root, "supabase/functions/hello/index.ts"), "export default {};");
+    await check(`
+      const parts = supabase({ dir: "supabase" }).group.services({
+        name: "supabase", key: part => part === "gateway" ? "supabase" : "supabase-" + part,
+      });
+      const warnings = [], logs = [];
+      console.warn = (...args) => warnings.push(args.join(" "));
+      console.log = (...args) => logs.push(args.join(" "));
+      respond = () => new Response("unavailable", { status: 503 });
+      await parts.functions.setup();
+      assert.equal(warnings.length, 1);
+      assert.match(warnings[0], /warm-up answered 503/);
+      respond = () => Response.json({ mode: "shared", warmed: ["hello"], failed: {} });
+      await parts.functions.setup();
+      assert.equal(logs.length, 1);
+      assert.match(logs[0], /warmed 1 edge function in one isolate/);
+    `, root);
+  } finally { await rm(root, { recursive: true, force: true }); }
+});
+
+test("email helpers reject HTTP errors and retain their public event without internal HTTP events", async () => {
+  await check(`
+    const mail = emailHelpers("mail");
+    scope.recording = true;
+    startRecording();
+    respond = () => new Response("unavailable", { status: 503 });
+    await assert.rejects(() => mail.clear(), /email server API .* failed: HTTP 503/);
+    let events = stopRecording();
+    assert.deepEqual(events.map(e => e.kind), ["email"]);
+    assert.match(events[0].error, /HTTP 503/);
+    startRecording();
+    respond = () => Response.json({ messages: [] });
+    assert.deepEqual((await mail.emails()).unwrap(), []);
+    respond = () => new Response(null, { status: 204 });
+    await mail.clear();
+    events = stopRecording();
+    assert.deepEqual(events.map(e => e.kind), ["email", "email"]);
+    assert.equal(events.some(e => e.error), false);
+  `);
+});

package/src/components/s3.ts

@@ -1,3 +1,4 @@
+import { rawFetch } from "../harness/raw-fetch.js";
 import type { ServiceDefinition } from "../index.js";
 import { S3Client, type S3ClientLike } from "../s3.js";
 
@@ -19,9 +20,9 @@ export interface S3Options {
    * via the daemon's TLS-terminating reverse proxy. Optional — defaults to none;
    * the store is always reachable at `http://<key>:9090` regardless. Set this
    * only when the app under test hardcodes a specific prod S3 endpoint it can't
-   * be told to override (`https://<bucket>.s3.amazonaws.com`, a provider's
-   * storage host): the daemon mints a cert for each host and proxies to the
-   * store's plain HTTP. The store ignores SigV4, so the Host rewrite is harmless.
+   * be told to override (a provider's storage host; requests must still use
+   * path-style addressing): the daemon mints a cert for each host and proxies to the
+   * store's plain HTTP while preserving the requested Host.
    */
   hosts?: string[];
   /** Access key id the helper client signs with. The store ignores SigV4, so
@@ -123,7 +124,7 @@ export function s3(opts: S3Options = {}) {
               // CreateBucket is a plain `PUT` on the bucket root; the store
               // returns 200 (or 409 if it already exists — idempotent enough to
               // ignore).
-              const res = await fetch(`http://${name}:${S3_PORT}/${bucket}`, {
+              const res = await rawFetch(`http://${name}:${S3_PORT}/${bucket}`, {
                 method: "PUT",
               });
               if (!res.ok && res.status !== 409) {

package/src/components/supabase.ts

@@ -1,3 +1,4 @@
+import { rawFetch } from "../harness/raw-fetch.js";
 // A ready-to-use, self-hosted **Supabase** stack, expressed as a set of
 // spectest services (one container each) wired together on spectest-net.
 //
@@ -2300,7 +2301,7 @@ export function supabase(opts: SupabaseOptions = {}): SupabaseStack {
           // snapshot and a test's diff is what its requests mutate.
           setup: async () => {
             const t0 = Date.now();
-            const res = await fetch(`http://${g.key("functions")}:9000/_spectest/warm`);
+            const res = await rawFetch(`http://${g.key("functions")}:9000/_spectest/warm`);
             if (!res.ok) {
               console.warn(`supabase(): edge functions warm-up answered ${res.status}; functions boot on first call instead.`);
               return;

package/src/daemon.ts

@@ -130,6 +130,7 @@ import {
   augmentCorsResponse,
   corsPreflightResponse,
   isCorsPreflight,
+  upstreamRequestHeaders,
 } from "./harness/http-proxy.js";
 import {
   WS_BRIDGE_HANDLERS,
@@ -2579,8 +2580,6 @@ async function proxyToService(
     // and the forwardable headers. Same provenance stamps as the HTTP path.
     const protocols = parseSubprotocols(req.headers.get("sec-websocket-protocol"));
     const headers = upstreamHandshakeHeaders(req.headers, {
-      service,
-      port,
       proto,
       clientIp: ingressClientIp(server, req, proto),
     });
@@ -2614,25 +2613,10 @@ async function proxyToService(
     );
   }
 
-  const fwdHeaders = new Headers();
-  for (const [k, v] of req.headers) {
-    if (HOP_BY_HOP_HEADERS.has(k.toLowerCase())) continue;
-    fwdHeaders.append(k, v);
-  }
-  // Standard reverse-proxy provenance headers: the upstream sees the
-  // public scheme/host it was reached through and the client's address,
-  // even though we rewrite Host below to the service-net name.
-  const clientIp = ingressClientIp(server, req, proto);
-  const priorXff = req.headers.get("x-forwarded-for");
-  const xff = clientIp ? (priorXff ? `${priorXff}, ${clientIp}` : clientIp) : priorXff;
-  if (xff) fwdHeaders.set("x-forwarded-for", xff);
-  fwdHeaders.set("x-forwarded-proto", proto);
-  const publicHost = req.headers.get("host");
-  if (publicHost) fwdHeaders.set("x-forwarded-host", publicHost);
-  // Override Host so the upstream sees its own service-net name, not
-  // the public hostname. Lets origin servers that vhost by Host header
-  // continue to find the right virtual host.
-  fwdHeaders.set("host", `${service}:${port}`);
+  const fwdHeaders = upstreamRequestHeaders(req.headers, {
+    proto,
+    clientIp: ingressClientIp(server, req, proto),
+  });
   // Fresh connection per upstream request — never reuse a pooled
   // keep-alive conn. Upstreams with short idle timeouts (uvicorn defaults
   // to 5s) close pooled connections under Bun's fetch, and the next

package/src/harness/http-proxy.test.ts

@@ -6,6 +6,7 @@ import {
   forwardableHeaders,
   isCorsPreflight,
   isHopByHop,
+  upstreamRequestHeaders,
 } from "./http-proxy";
 
 describe("hop-by-hop headers", () => {
@@ -13,7 +14,7 @@ describe("hop-by-hop headers", () => {
     expect(isHopByHop("Connection")).toBe(true);
     expect(isHopByHop("TRANSFER-ENCODING")).toBe(true);
     expect(isHopByHop("upgrade")).toBe(true);
-    expect(isHopByHop("host")).toBe(true);
+    expect(isHopByHop("host")).toBe(false);
   });
 
   test("ordinary headers are forwardable", () => {
@@ -23,8 +24,7 @@ describe("hop-by-hop headers", () => {
   });
 
   /** Forwarding transfer-encoding from a re-encoded body produces a
-   *  response the client cannot frame; forwarding host would hide which
-   *  service the upstream actually is. */
+   *  response the client cannot frame. Host identifies the requested origin. */
   test("forwardableHeaders drops them and keeps the rest", () => {
     const h = new Headers({
       host: "app.test",
@@ -34,7 +34,7 @@ describe("hop-by-hop headers", () => {
       "content-type": "application/json",
     });
     const out = forwardableHeaders(h);
-    expect(out.get("host")).toBeNull();
+    expect(out.get("host")).toBe("app.test");
     expect(out.get("connection")).toBeNull();
     expect(out.get("transfer-encoding")).toBeNull();
     expect(out.get("authorization")).toBe("Bearer x");
@@ -49,6 +49,68 @@ describe("hop-by-hop headers", () => {
   });
 });
 
+describe("upstream request headers", () => {
+  test("preserves authority and stamps forwarding headers from the incoming request", () => {
+    const headers = upstreamRequestHeaders(new Headers({
+      host: "bucket.storage.test:8443",
+      "x-forwarded-host": "unrelated.test",
+      "x-forwarded-proto": "http",
+      "x-forwarded-for": "10.0.0.1",
+      authorization: "signed-request",
+    }), { proto: "https", clientIp: "10.0.0.2" });
+    expect(headers.get("host")).toBe("bucket.storage.test:8443");
+    expect(headers.get("x-forwarded-host")).toBe("bucket.storage.test:8443");
+    expect(headers.get("x-forwarded-proto")).toBe("https");
+    expect(headers.get("x-forwarded-for")).toBe("10.0.0.1, 10.0.0.2");
+    expect(headers.get("authorization")).toBe("signed-request");
+  });
+
+  test.each(["http", "https"])("%s ingress forwards Host to a separately addressed upstream", async (proto) => {
+    const upstream = Bun.serve({
+      port: 0, hostname: "127.0.0.1",
+      async fetch(req) {
+        const url = new URL(req.url);
+        return Response.json({
+          host: req.headers.get("host"),
+          forwardedHost: req.headers.get("x-forwarded-host"),
+          forwardedProto: req.headers.get("x-forwarded-proto"),
+          authorization: req.headers.get("authorization"),
+          method: req.method, path: url.pathname + url.search, body: await req.text(),
+        });
+      },
+    });
+    // Both listeners in the daemon speak HTTP; HTTPS reaches one through the
+    // TLS terminator, with proto supplied explicitly to the forwarding path.
+    const proxy = Bun.serve({
+      port: 0, hostname: "127.0.0.1",
+      fetch(req) {
+        const url = new URL(req.url);
+        const headers = upstreamRequestHeaders(req.headers, { proto });
+        return fetch(new Request(new URL(url.pathname + url.search, upstream.url), {
+          method: req.method, headers, body: req.body, redirect: "manual",
+        }));
+      },
+    });
+    try {
+      for (const host of ["storage.test", "bucket.storage.test:8443"]) {
+        const res = await fetch(new URL("/uploads/file?generation=7", proxy.url), {
+          method: "PUT", body: "contents",
+          headers: { host, authorization: "signed-request" },
+        });
+        expect(res.status).toBe(200);
+        expect(await res.json()).toEqual({
+          host, forwardedHost: host, forwardedProto: proto,
+          authorization: "signed-request", method: "PUT",
+          path: "/uploads/file?generation=7", body: "contents",
+        });
+      }
+    } finally {
+      proxy.stop(true);
+      upstream.stop(true);
+    }
+  });
+});
+
 describe("preflight detection", () => {
   const req = (method: string, headers: Record<string, string>) =>
     new Request("http://app.test/", { method, headers });

package/src/harness/http-proxy.ts

@@ -13,8 +13,7 @@
  * Forwarding `transfer-encoding` or `content-length` from a re-encoded
  * body is the classic way to produce a response the client cannot frame;
  * forwarding `connection` leaks our keep-alive intent to the upstream.
- * `host` is here because the proxy sets its own — the upstream must see
- * the service it actually is, not the public name the client asked for.
+ * `host` identifies the requested origin and must survive the proxy hop.
  */
 export const HOP_BY_HOP_HEADERS: ReadonlySet<string> = new Set([
   "connection",
@@ -25,7 +24,6 @@ export const HOP_BY_HOP_HEADERS: ReadonlySet<string> = new Set([
   "trailers",
   "transfer-encoding",
   "upgrade",
-  "host",
 ]);
 
 export function isHopByHop(name: string): boolean {
@@ -41,6 +39,24 @@ export function forwardableHeaders(headers: Headers): Headers {
   return out;
 }
 
+/** Preserve the requested Host (including its port) while dialing the service's
+ * internal address. HTTP and WebSocket forwarding share this policy. */
+export function upstreamRequestHeaders(
+  headers: Headers,
+  opts: { proto: string; clientIp?: string },
+): Headers {
+  const out = forwardableHeaders(headers);
+  const priorXff = headers.get("x-forwarded-for");
+  const xff = opts.clientIp
+    ? priorXff ? `${priorXff}, ${opts.clientIp}` : opts.clientIp
+    : priorXff;
+  if (xff) out.set("x-forwarded-for", xff);
+  out.set("x-forwarded-proto", opts.proto);
+  const host = headers.get("host");
+  if (host) out.set("x-forwarded-host", host);
+  return out;
+}
+
 /**
  * A CORS preflight is an `OPTIONS` carrying both `Origin` and
  * `Access-Control-Request-Method`. An `OPTIONS` without them is a normal

package/src/harness/ws-bridge.test.ts

@@ -20,7 +20,7 @@ describe("parseSubprotocols", () => {
 describe("upstreamHandshakeHeaders", () => {
   test("forwards cookies and origin, drops the client's handshake fields, stamps provenance", () => {
     const req = new Headers({
-      host: "api.prod.specific.dev",
+      host: "api.prod.specific.dev:8443",
       connection: "Upgrade",
       upgrade: "websocket",
       "sec-websocket-key": "abc==",
@@ -32,16 +32,14 @@ describe("upstreamHandshakeHeaders", () => {
       authorization: "Bearer t",
     });
     const out = upstreamHandshakeHeaders(req, {
-      service: "api",
-      port: 4000,
       proto: "https",
       clientIp: "10.0.0.7",
     });
     expect(out["cookie"]).toBe("sid=1");
     expect(out["origin"]).toBe("https://app.test");
     expect(out["authorization"]).toBe("Bearer t");
-    expect(out["host"]).toBe("api:4000");
-    expect(out["x-forwarded-host"]).toBe("api.prod.specific.dev");
+    expect(out["host"]).toBe("api.prod.specific.dev:8443");
+    expect(out["x-forwarded-host"]).toBe("api.prod.specific.dev:8443");
     expect(out["x-forwarded-proto"]).toBe("https");
     expect(out["x-forwarded-for"]).toBe("10.0.0.7");
     for (const k of Object.keys(out)) {
@@ -52,8 +50,6 @@ describe("upstreamHandshakeHeaders", () => {
 
   test("appends the client to an existing x-forwarded-for", () => {
     const out = upstreamHandshakeHeaders(new Headers({ "x-forwarded-for": "1.2.3.4" }), {
-      service: "api",
-      port: 1,
       proto: "http",
       clientIp: "10.0.0.7",
     });
@@ -71,7 +67,7 @@ describe("the bridge on loopback", () => {
   let upstream: ReturnType<typeof Bun.serve>;
   let bridge: ReturnType<typeof Bun.serve>;
   /** What the upstream saw on its last handshake. */
-  let seen: { protocols: string[]; cookie: string | null; xfh: string | null } | null = null;
+  let seen: { protocols: string[]; cookie: string | null; host: string | null; xfh: string | null } | null = null;
 
   beforeAll(() => {
     upstream = Bun.serve({
@@ -81,6 +77,7 @@ describe("the bridge on loopback", () => {
         seen = {
           protocols,
           cookie: req.headers.get("cookie"),
+          host: req.headers.get("host"),
           xfh: req.headers.get("x-forwarded-host"),
         };
         if (protocols[1] !== "ticket-ok") return new Response("Unauthorized", { status: 401 });
@@ -110,8 +107,6 @@ describe("the bridge on loopback", () => {
       async fetch(req, server) {
         const protocols = parseSubprotocols(req.headers.get("sec-websocket-protocol"));
         const headers = upstreamHandshakeHeaders(req.headers, {
-          service: "api",
-          port: upstream.port!,
           proto: "https",
         });
         const url = new URL(req.url);
@@ -153,7 +148,7 @@ describe("the bridge on loopback", () => {
     ) => WebSocket;
     const ws = new Ctor(`ws://127.0.0.1:${bridge.port}/console?x=1`, {
       protocols,
-      headers: { cookie: "sid=abc", host: "api.prod.specific.dev" },
+      headers: { cookie: "sid=abc", host: "api.prod.specific.dev:8443" },
     });
     ws.binaryType = "arraybuffer";
     const events: Array<{ kind: "open" | "message" | "close" | "error"; value?: unknown }> = [];
@@ -180,7 +175,8 @@ describe("the bridge on loopback", () => {
     expect(seen).toEqual({
       protocols: ["console", "ticket-ok"],
       cookie: "sid=abc",
-      xfh: "api.prod.specific.dev",
+      host: "api.prod.specific.dev:8443",
+      xfh: "api.prod.specific.dev:8443",
     });
     await Bun.sleep(20);
     ws.send("hi");

package/src/harness/ws-bridge.ts

@@ -20,7 +20,7 @@
  * without a VM.
  */
 
-import { forwardableHeaders } from "./http-proxy.js";
+import { upstreamRequestHeaders } from "./http-proxy.js";
 
 /** Headers that belong to the client's own WebSocket handshake. Bun's
  *  WebSocket client mints its own key and version, and the protocol list
@@ -56,33 +56,20 @@ export function parseSubprotocols(header: string | null | undefined): string[] {
  * The headers the upstream handshake carries: everything forwardable from
  * the client's request (cookies, authorization, origin, user-agent …),
  * minus the client's own handshake fields, plus the proxy provenance
- * headers and a Host that names the service.
+ * headers and the original Host.
  */
 export function upstreamHandshakeHeaders(
   req: Headers,
   opts: {
-    service: string;
-    port: number;
     proto: string;
     clientIp?: string;
   },
 ): Record<string, string> {
   const out: Record<string, string> = {};
-  forwardableHeaders(req).forEach((value, key) => {
+  upstreamRequestHeaders(req, opts).forEach((value, key) => {
     if (HANDSHAKE_HEADERS.has(key)) return;
     out[key] = value;
   });
-  const priorXff = req.get("x-forwarded-for");
-  const xff = opts.clientIp
-    ? priorXff
-      ? `${priorXff}, ${opts.clientIp}`
-      : opts.clientIp
-    : priorXff;
-  if (xff) out["x-forwarded-for"] = xff;
-  out["x-forwarded-proto"] = opts.proto;
-  const publicHost = req.get("host");
-  if (publicHost) out["x-forwarded-host"] = publicHost;
-  out["host"] = `${opts.service}:${opts.port}`;
   return out;
 }