@statewalker/webrun-http-streams 0.1.1 → 0.2.1

package/src/http1/encode.ts

@@ -0,0 +1,181 @@
+import { discard } from "../bytes.js";
+import type { ByteSource, RequestEnvelope, ResponseEnvelope } from "../message.js";
+import { encodeChunked } from "./chunked.js";
+import { HttpParseError } from "./errors.js";
+import {
+  assertValidHost,
+  assertValidStatusText,
+  assertValidTarget,
+  encodeHeaderLines,
+  encodeLatin1,
+  getAll,
+  isBodylessStatus,
+  isToken,
+  parseContentLength,
+  withoutHeaders,
+} from "./headers.js";
+
+export type ResolvedHttpCodecOptions = {
+  scheme: "http" | "https";
+  host: string;
+  maxHeaderBytes: number;
+};
+
+/** Headers the codec owns: a caller-supplied copy is dropped and re-derived. */
+const REQUEST_OWNED = ["host", "connection", "transfer-encoding"];
+const RESPONSE_OWNED = ["connection", "transfer-encoding"];
+
+/**
+ * Split a URL into an origin-form request target and an authority *without*
+ * going through `new URL()`. `URL` normalises percent-encoding and would
+ * re-serialise the target — which is the exact class of defect note 15 found
+ * in @libp2p/http, where rebuilding the request line silently dropped
+ * `url.search`. Here the target is a verbatim slice of the caller's string.
+ */
+export function splitTarget(
+  url: string,
+  opts: ResolvedHttpCodecOptions,
+): { target: string; authority: string } {
+  if (url.startsWith("/")) {
+    // Neither field is trusted just because it came from a caller's own url:
+    // an unvalidated CRLF here would splice a second request line (or an
+    // extra header) onto the wire — see C1.
+    assertValidTarget(url);
+    return { target: url, authority: opts.host };
+  }
+  const match = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/([^/?#]*)([^#]*)/.exec(url);
+  if (!match) {
+    throw new HttpParseError(`cannot derive a request target from url: ${JSON.stringify(url)}`);
+  }
+  // Both capture groups are mandatory in the regex above (neither is
+  // `?`-quantified), so a successful match always populates them — an empty
+  // string is possible, `undefined` is not.
+  const rawAuthority = match[1]!;
+  if (rawAuthority === "") {
+    throw new HttpParseError(`url has no authority: ${JSON.stringify(url)}`);
+  }
+  // Host is `uri-host [ ":" port ]` — no userinfo (RFC 9110 §7.2). Strip any
+  // `user:pass@` prefix so credentials never end up in a header proxies log.
+  const at = rawAuthority.lastIndexOf("@");
+  const authority = at === -1 ? rawAuthority : rawAuthority.slice(at + 1);
+  assertValidHost(authority);
+
+  const rawTarget = match[2]!;
+  const target = rawTarget === "" ? "/" : rawTarget.startsWith("/") ? rawTarget : `/${rawTarget}`;
+  assertValidTarget(target);
+  return { target, authority };
+}
+
+async function* emitBody(
+  body: ByteSource,
+  declared: number | undefined,
+): AsyncGenerator<Uint8Array> {
+  if (declared === undefined) {
+    yield* encodeChunked(body);
+    return;
+  }
+  let sent = 0;
+  for await (const chunk of body) {
+    if (chunk.byteLength === 0) continue;
+    sent += chunk.byteLength;
+    if (sent > declared) {
+      throw new HttpParseError(
+        `body exceeds declared Content-Length ${declared} (${sent} bytes so far)`,
+      );
+    }
+    yield chunk;
+  }
+  if (sent !== declared) {
+    throw new HttpParseError(`body is ${sent} bytes but Content-Length declares ${declared}`);
+  }
+}
+
+export async function* encodeRequest(
+  env: RequestEnvelope,
+  body: ByteSource | undefined,
+  opts: ResolvedHttpCodecOptions,
+): AsyncGenerator<Uint8Array> {
+  if (!isToken(env.method)) {
+    throw new HttpParseError(`invalid method: ${JSON.stringify(env.method)}`);
+  }
+  const { target, authority } = splitTarget(env.url, opts);
+  if (authority === "") {
+    throw new HttpParseError("no Host available: url has no authority and no host is configured");
+  }
+
+  const carried = withoutHeaders(env.headers, REQUEST_OWNED);
+  const declared = parseContentLength(getAll(carried, "content-length"));
+
+  let head = `${env.method} ${target} HTTP/1.1\r\n`;
+  head += `Host: ${authority}\r\n`;
+  head += encodeHeaderLines(carried);
+  head += "Connection: close\r\n";
+  if (body !== undefined && declared === undefined) head += "Transfer-Encoding: chunked\r\n";
+  head += "\r\n";
+  yield encodeLatin1(head);
+
+  if (body === undefined) {
+    // A head promising `declared` bytes with no body at all is a knowingly
+    // truncated message — the failure must land here, not on the peer that
+    // trusted the header. Content-Length: 0 is the one declared length an
+    // absent body actually satisfies. See I1.
+    if (declared !== undefined && declared !== 0) {
+      throw new HttpParseError(`body is 0 bytes but Content-Length declares ${declared}`);
+    }
+    return;
+  }
+  yield* emitBody(body, declared);
+}
+
+export async function* encodeResponse(
+  env: ResponseEnvelope,
+  body: ByteSource | undefined,
+  // Unused: response encoding needs no scheme/host/maxHeaderBytes. Kept
+  // positionally so this signature mirrors `encodeRequest`'s, which the
+  // `newHttpCodec` wrapper in ./index.ts relies on when partially applying
+  // `opts` to both.
+  _opts: ResolvedHttpCodecOptions,
+  requestMethod?: string,
+): AsyncGenerator<Uint8Array> {
+  if (!Number.isInteger(env.status) || env.status < 100 || env.status > 599) {
+    throw new HttpParseError(`invalid status: ${env.status}`);
+  }
+  const reason = env.statusText ?? "";
+  assertValidStatusText(reason);
+
+  // RFC 9110 §8.6: a 1xx or 204 MUST NOT carry Content-Length — there is no
+  // body to measure, ever, regardless of what the caller supplied. A
+  // response to HEAD is different: no body is sent on *this* response, but
+  // the Content-Length describes the body a GET would have sent, so it stays
+  // (M4).
+  const bodylessStatus = isBodylessStatus(env.status);
+  const bodyless = bodylessStatus || requestMethod?.toUpperCase() === "HEAD";
+
+  const owned = bodylessStatus ? [...RESPONSE_OWNED, "content-length"] : RESPONSE_OWNED;
+  const carried = withoutHeaders(env.headers, owned);
+  const declared = parseContentLength(getAll(carried, "content-length"));
+
+  let head = `HTTP/1.1 ${env.status} ${reason}\r\n`;
+  head += encodeHeaderLines(carried);
+  head += "Connection: close\r\n";
+  if (!bodyless && body !== undefined && declared === undefined) {
+    head += "Transfer-Encoding: chunked\r\n";
+  }
+  head += "\r\n";
+  yield encodeLatin1(head);
+
+  if (bodyless) {
+    await discard(body);
+    return;
+  }
+  if (body === undefined) {
+    // Same truncation guard as encodeRequest — see I1. Not reached when
+    // bodyless: a response to HEAD legitimately keeps a declared
+    // Content-Length with no body (M4), and that is not a truncation.
+    if (declared !== undefined && declared !== 0) {
+      throw new HttpParseError(`body is 0 bytes but Content-Length declares ${declared}`);
+    }
+    return;
+  }
+  yield* emitBody(body, declared);
+}

package/src/http1/errors.ts

@@ -0,0 +1,8 @@
+/**
+ * Raised for any byte sequence this codec refuses to interpret. Every case is
+ * a refusal to guess: HTTP/1.1 parsers that guess are how request smuggling
+ * works.
+ */
+export class HttpParseError extends Error {
+  override readonly name = "HttpParseError";
+}

package/src/http1/headers.ts

@@ -0,0 +1,263 @@
+import type { ByteReader } from "../bytes.js";
+import { HttpParseError } from "./errors.js";
+
+export type HeaderList = [string, string][];
+
+const TCHAR = new Set(
+  "!#$%&'*+-.^_`|~0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ",
+);
+
+const SP = 0x20;
+const HTAB = 0x09;
+
+export function isTokenChar(byte: number): boolean {
+  return byte > SP && byte < 0x7f && TCHAR.has(String.fromCharCode(byte));
+}
+
+export function isToken(value: string): boolean {
+  if (value.length === 0) return false;
+  for (const ch of value) {
+    if (!TCHAR.has(ch)) return false;
+  }
+  return true;
+}
+
+/**
+ * Header bytes are latin-1: byte-preserving, matching Node, and lossless
+ * across a decode/encode round-trip. Control characters are rejected
+ * separately by `assertValidHeaderValue`.
+ */
+export function decodeLatin1(bytes: Uint8Array): string {
+  let out = "";
+  for (const byte of bytes) out += String.fromCharCode(byte);
+  return out;
+}
+
+export function encodeLatin1(text: string): Uint8Array {
+  const out = new Uint8Array(text.length);
+  for (let i = 0; i < text.length; i++) {
+    const code = text.charCodeAt(i);
+    if (code > 0xff) {
+      throw new HttpParseError(`not latin-1 encodable: ${JSON.stringify(text)}`);
+    }
+    out[i] = code;
+  }
+  return out;
+}
+
+// RFC 3986 `authority` grammar, restricted to `host [ ":" port ]` (no
+// userinfo — RFC 9110 §7.2 excludes it from Host). Two shapes: an IP-literal
+// in brackets, or a reg-name. Shared by the decoder (validating a Host header
+// taken off the wire) and the encoder (validating the authority `splitTarget`
+// derives from a caller-supplied url) so the grammar is defined exactly once.
+const HOST_IP_LITERAL = /^\[[0-9A-Fa-f:.]+\](:\d{1,5})?$/;
+const HOST_REG_NAME = /^[A-Za-z0-9._~-]+(:\d{1,5})?$/;
+
+/**
+ * Validates a value that is about to become (or was read as) a `Host`
+ * header: untrusted input either way, so an unrecognised shape is a refusal,
+ * not a guess. Rejects a present-but-empty value, one carrying userinfo
+ * (`evil.com@good.com`), and — the reason this also runs on encode — one
+ * smuggling a CRLF-terminated line into the authority of a caller-supplied
+ * url. Never applied to trusted configuration (a codec's `opts.host`).
+ */
+export function assertValidHost(host: string): void {
+  if (!HOST_IP_LITERAL.test(host) && !HOST_REG_NAME.test(host)) {
+    throw new HttpParseError(`invalid Host header: ${JSON.stringify(host)}`);
+  }
+}
+
+/**
+ * A request-target must be entirely visible ASCII (RFC 9110 VCHAR) — nothing
+ * `<= 0x20` (space and every control character, CR/LF included) and nothing
+ * `>= 0x7F` (DEL and beyond). Applied on encode (`splitTarget`, so a
+ * caller-supplied url can never inject a second request line) and on decode
+ * (so a relay that decodes then re-encodes can never put an embedded control
+ * character back on the wire).
+ */
+export function assertValidTarget(target: string): void {
+  for (let i = 0; i < target.length; i++) {
+    const code = target.charCodeAt(i);
+    if (code <= SP || code >= 0x7f) {
+      throw new HttpParseError(`invalid request-target: ${JSON.stringify(target)}`);
+    }
+  }
+}
+
+/**
+ * Shared control-character check behind both `assertValidHeaderValue` and
+ * `assertValidStatusText` — the two were previously checked by different,
+ * looser rules (statusText only rejected CR/LF), which is exactly the
+ * asymmetry class C1 and M5 are both instances of. `label` is prepended
+ * verbatim to each message, so callers keep their own wording.
+ */
+function assertNoControlChars(label: string, value: string): void {
+  for (let i = 0; i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code === 0x0d || code === 0x0a) {
+      throw new HttpParseError(`${label} contains CR or LF`);
+    }
+    if ((code < SP && code !== HTAB) || code === 0x7f) {
+      throw new HttpParseError(`${label} contains a control character`);
+    }
+    if (code > 0xff) {
+      throw new HttpParseError(`${label} is not latin-1 encodable`);
+    }
+  }
+}
+
+export function assertValidHeaderValue(name: string, value: string): void {
+  assertNoControlChars(`header "${name}" value`, value);
+}
+
+/** Same character class as a header value (M5) — CR/LF, every C0 control, and DEL. */
+export function assertValidStatusText(value: string): void {
+  assertNoControlChars("statusText", value);
+}
+
+export function encodeHeaderLines(headers: HeaderList): string {
+  let out = "";
+  for (const [name, value] of headers) {
+    if (!isToken(name)) throw new HttpParseError(`invalid header name: ${JSON.stringify(name)}`);
+    assertValidHeaderValue(name, value);
+    out += `${name}: ${value}\r\n`;
+  }
+  return out;
+}
+
+/**
+ * Read to the blank line. `alreadyUsed` is the byte count of the start line,
+ * so the bound covers the whole head section rather than the headers alone.
+ */
+export async function readHeaderSection(
+  reader: ByteReader,
+  maxHeaderBytes: number,
+  alreadyUsed: number,
+): Promise<HeaderList> {
+  const headers: HeaderList = [];
+  let used = alreadyUsed;
+  while (true) {
+    const remaining = maxHeaderBytes - used;
+    if (remaining <= 0) {
+      throw new HttpParseError(`head section exceeds ${maxHeaderBytes} bytes`);
+    }
+    const lineBytes = await reader.readLine(remaining);
+    used += lineBytes.byteLength + 2;
+    if (used > maxHeaderBytes) {
+      throw new HttpParseError(`head section exceeds ${maxHeaderBytes} bytes`);
+    }
+    if (lineBytes.byteLength === 0) return headers;
+    if (lineBytes[0] === SP || lineBytes[0] === HTAB) {
+      throw new HttpParseError("obs-fold header continuation is not accepted");
+    }
+    const line = decodeLatin1(lineBytes);
+    const colon = line.indexOf(":");
+    if (colon <= 0) throw new HttpParseError(`malformed header line: ${JSON.stringify(line)}`);
+    const name = line.slice(0, colon);
+    if (!isToken(name)) throw new HttpParseError(`invalid header name: ${JSON.stringify(name)}`);
+    const value = line
+      .slice(colon + 1)
+      .replace(/^[ \t]+/, "")
+      .replace(/[ \t]+$/, "");
+    assertValidHeaderValue(name, value);
+    headers.push([name, value]);
+  }
+}
+
+export function getAll(headers: HeaderList, name: string): string[] {
+  const lower = name.toLowerCase();
+  return headers.filter(([k]) => k.toLowerCase() === lower).map(([, v]) => v);
+}
+
+export function withoutHeaders(headers: HeaderList, names: string[]): HeaderList {
+  const drop = new Set(names.map((n) => n.toLowerCase()));
+  return headers.filter(([k]) => !drop.has(k.toLowerCase()));
+}
+
+/**
+ * Parse a `Content-Length` field into a single validated value.
+ *
+ * RFC 9110 §8.6 permits the value to be a comma-separated list of identical
+ * numbers (a relay may have appended one), so the list is folded; differing
+ * values are a refusal, not a choice. Shared by `resolveFraming` on decode and
+ * by the encoder's declared-length check, which previously carried its own
+ * copy that did NOT split on commas — so decode accepted `5, 5` while encode
+ * rejected it, and a relay that decoded then re-encoded threw.
+ *
+ * Returns undefined when the field is absent.
+ */
+export function parseContentLength(values: string[]): number | undefined {
+  if (values.length === 0) return undefined;
+  const unique = new Set(values.flatMap((v) => v.split(",").map((s) => s.trim())));
+  if (unique.size !== 1) {
+    throw new HttpParseError(`conflicting Content-Length values: ${[...unique].join(", ")}`);
+  }
+  // `unique.size === 1` is checked directly above, so this spread has exactly
+  // one element. The `!` is what lets a consumer compiling with
+  // `noUncheckedIndexedAccess` build against this source: without it `raw` is
+  // `string | undefined` and the `.test(raw)` below is a type error in THEIR
+  // build, not in this package's own (which does not enable the flag, so it
+  // cannot catch the regression). It was lost once already, in a rebase that
+  // resolved toward a refactor of this function.
+  const raw = [...unique][0]!;
+  if (!/^\d{1,15}$/.test(raw)) {
+    throw new HttpParseError(`invalid Content-Length: ${JSON.stringify(raw)}`);
+  }
+  return Number(raw);
+}
+
+/**
+ * Statuses that carry no body whatever the headers say (RFC 9110 §8.6): 1xx,
+ * 204 and 304. Defined once because the encoder must not frame a body for
+ * them and the decoder must not try to read one — two lists that agreed today
+ * and were free to drift tomorrow.
+ *
+ * A response to HEAD is also bodyless, but that depends on the request rather
+ * than the status, so callers test it separately.
+ */
+export function isBodylessStatus(status: number): boolean {
+  return status < 200 || status === 204 || status === 304;
+}
+
+export type BodyFraming =
+  | { kind: "chunked" }
+  | { kind: "length"; length: number }
+  | { kind: "none" };
+
+/**
+ * RFC 9112 §6.3, with every ambiguity turned into a refusal. In particular a
+ * message declaring both Content-Length and Transfer-Encoding is rejected
+ * rather than resolved — disagreeing on which one wins is request smuggling.
+ */
+export function resolveFraming(headers: HeaderList, version: string): BodyFraming {
+  const te = getAll(headers, "transfer-encoding");
+  const cl = getAll(headers, "content-length");
+
+  if (te.length > 0 && cl.length > 0) {
+    throw new HttpParseError(
+      "message declares both Content-Length and Transfer-Encoding; refusing (request smuggling)",
+    );
+  }
+
+  if (te.length > 0) {
+    const encodings = te
+      .join(",")
+      .split(",")
+      .map((s) => s.trim().toLowerCase())
+      .filter((s) => s !== "");
+    if (encodings.length !== 1 || encodings[0] !== "chunked") {
+      throw new HttpParseError(`unsupported Transfer-Encoding: ${JSON.stringify(te.join(", "))}`);
+    }
+    if (version === "HTTP/1.0") {
+      throw new HttpParseError("Transfer-Encoding is not valid in HTTP/1.0");
+    }
+    return { kind: "chunked" };
+  }
+
+  const length = parseContentLength(cl);
+  if (length !== undefined) {
+    return { kind: "length", length };
+  }
+
+  return { kind: "none" };
+}

package/src/http1/index.ts

@@ -0,0 +1,40 @@
+import type { MessageCodec } from "../message.js";
+import { decodeRequest, decodeResponse } from "./decode.js";
+import { encodeRequest, encodeResponse, type ResolvedHttpCodecOptions } from "./encode.js";
+import { isTokenChar } from "./headers.js";
+
+export type HttpCodecOptions = {
+  /**
+   * Scheme used to rebuild an absolute url on decode. HTTP/1.1 origin-form
+   * carries no scheme, so this is configuration, not wire data — a peer
+   * configured `http` rebuilds an `https` url as `http`. Accepted cost of
+   * decision 6; see ADR-0006.
+   */
+  scheme?: "http" | "https";
+  /** Authority used when a url carries none. Also fills the mandatory Host header. */
+  host?: string;
+  /** Bound on the whole head section, start line included. Default 65536. */
+  maxHeaderBytes?: number;
+};
+
+export function newHttpCodec(options: HttpCodecOptions = {}): MessageCodec {
+  const opts: ResolvedHttpCodecOptions = {
+    scheme: options.scheme ?? "http",
+    host: options.host ?? "localhost",
+    maxHeaderBytes: options.maxHeaderBytes ?? 65536,
+  };
+  return {
+    name: "http/1.1",
+    // A request starts with a method token, a response with "HTTP/1.1" — both
+    // begin with a token character. "{" is not a token character, so this is
+    // disjoint from jsonEnvelopeCodec by construction, not by convention.
+    sniff: (byte: number): boolean => isTokenChar(byte),
+    encodeRequest: (env, body) => encodeRequest(env, body, opts),
+    encodeResponse: (env, body, o) => encodeResponse(env, body, opts, o?.method),
+    decodeRequest: (input) => decodeRequest(input, opts),
+    decodeResponse: (input, o) => decodeResponse(input, opts, o.method),
+  };
+}
+
+export const httpCodec: MessageCodec = newHttpCodec();
+export { HttpParseError } from "./errors.js";

package/src/index.ts

@@ -1,7 +1,9 @@
+export { defaultCodec } from "./codec-default.js";
 export { DuplexSiteBuilder, type SiteHandler } from "./duplex-site-builder.js";
 export {
   decodeMessage,
   encodeMessage,
+  jsonEnvelopeCodec,
   type RequestEnvelope,
   type ResponseEnvelope,
 } from "./envelope.js";
@@ -9,9 +11,11 @@ export { fetchOverDuplex, serveFetchOverDuplex } from "./fetch.js";
 export {
   type HttpDataHandler,
   type HttpDataHandlerResult,
+  type HttpDataOptions,
   type HttpFetchResult,
   httpFetch,
   httpServe,
+  PEER_ERROR_HEADER,
 } from "./http-data.js";
 export { HttpError, type HttpErrorOptions } from "./http-error.js";
 export {
@@ -22,3 +26,17 @@ export {
   type SerializedHttpRequest,
   type SerializedHttpResponse,
 } from "./http-stubs.js";
+export {
+  type HttpCodecOptions,
+  HttpParseError,
+  httpCodec,
+  newHttpCodec,
+} from "./http1/index.js";
+export type {
+  ByteSource,
+  DecodedRequest,
+  DecodedResponse,
+  MessageCodec,
+  ResponseCodecOptions,
+} from "./message.js";
+export { newSniffingCodec, type SniffingCodecOptions } from "./sniff.js";

package/src/message.ts

@@ -0,0 +1,62 @@
+/** Anything the codecs will read bytes from. */
+export type ByteSource = AsyncIterable<Uint8Array> | Iterable<Uint8Array>;
+
+export type RequestEnvelope = {
+  url: string;
+  method: string;
+  headers: [string, string][];
+};
+
+export type ResponseEnvelope = {
+  status: number;
+  statusText: string;
+  headers: [string, string][];
+};
+
+export type DecodedRequest = {
+  envelope: RequestEnvelope;
+  body: AsyncIterable<Uint8Array>;
+  /** The codec that actually read this message; set by the sniffing codec. */
+  codec?: MessageCodec;
+};
+
+export type DecodedResponse = {
+  envelope: ResponseEnvelope;
+  body: AsyncIterable<Uint8Array>;
+};
+
+/** Extra context a codec may need that the envelope does not carry. */
+export type ResponseCodecOptions = {
+  /**
+   * Method of the request this response answers. Required by HTTP/1.1: a
+   * response to HEAD carries framing headers but no body, and no parser can
+   * know that from the response bytes alone.
+   */
+  method: string;
+};
+
+/**
+ * One wire format. Requests and responses are separate operations because
+ * HTTP/1.1 serialises them differently — a codec cannot be generic over the
+ * envelope the way the JSON format was.
+ */
+export interface MessageCodec {
+  readonly name: string;
+
+  /**
+   * True if a message in this format may begin with `byte`. Used by the
+   * sniffing codec to dispatch without a negotiation handshake. Implementations
+   * must be mutually exclusive with every other codec they are paired with.
+   */
+  sniff(byte: number): boolean;
+
+  encodeRequest(env: RequestEnvelope, body?: ByteSource): AsyncGenerator<Uint8Array>;
+  encodeResponse(
+    env: ResponseEnvelope,
+    body?: ByteSource,
+    options?: ResponseCodecOptions,
+  ): AsyncGenerator<Uint8Array>;
+
+  decodeRequest(input: ByteSource): Promise<DecodedRequest>;
+  decodeResponse(input: ByteSource, options: ResponseCodecOptions): Promise<DecodedResponse>;
+}

package/src/request-streams.ts

@@ -0,0 +1,75 @@
+/**
+ * The one place that knows a runtime may not implement request body streams,
+ * and the buffering both fallbacks need. `fetch.ts` and `http-stubs.ts` each
+ * carry a client and a server direction that must agree on the answer, so the
+ * predicate lives here rather than being written out four times.
+ */
+
+/**
+ * Whether `Request.prototype` exposes a `body` accessor. Two call sites read
+ * that property, and two more depend on the constructor accepting a
+ * `ReadableStream` as `init.body`; this predicate answers for all four.
+ *
+ * What was verified, and all that is claimed here: Firefox (146 at the time of
+ * writing) has *neither*, and Chromium and Node have *both*. On Firefox it is
+ * not that `body` is `undefined` on the instance —
+ * `Object.getOwnPropertyDescriptor(Request.prototype, "body")` is `null`, the
+ * accessor is genuinely absent — and because a `ReadableStream` is then not a
+ * recognised `BodyInit`, the constructor falls through to the string branch and
+ * stores the literal text `[object ReadableStream]`.
+ *
+ * The two halves are NOT guaranteed to ship together, so do not read this as a
+ * test for "request streams" in general. Safari is the counterexample: it has
+ * had `Request.body` since 11.1 but only accepts a stream as `init.body` from
+ * Technology Preview 250, so a shipping Safari has the reader half without the
+ * upload half and this returns `true` there. That looks benign — WebKit appears
+ * to store the stream on the `Request` rather than stringify it, and its error
+ * comes from `fetch()`, which this package never calls on the objects it builds
+ * — but it is untested, and it is the case to look at first if a Safari report
+ * arrives. The sharper probe, if one is ever needed, is whether
+ * `new Request(url, {method:"POST", body:new ReadableStream(), duplex:"half"})`
+ * has a `content-type` of `text/plain;charset=UTF-8` (stringified) or `null`
+ * (stored); it is not used here because it costs a `Request` and a
+ * `ReadableStream` per call and agrees with the descriptor check on every
+ * runtime measured.
+ *
+ * A capability check, never a user-agent test: the question is what this
+ * runtime does, and the answer flips on its own the day Firefox ships request
+ * streams. Evaluated per call rather than cached at module load so that a test
+ * can install a `Request` without the capability and exercise the real branch
+ * under Node.
+ */
+export function supportsRequestStreams(): boolean {
+  return (
+    typeof Request === "function" &&
+    Object.getOwnPropertyDescriptor(Request.prototype, "body") != null
+  );
+}
+
+/**
+ * Drain a body iterable into one contiguous buffer. Only the fallbacks need it.
+ * Allocates its own buffer rather than reusing `bytes.ts`'s `concatChunks`,
+ * which passes a single chunk straight through: that chunk is a view onto the
+ * decoder's own read buffer, and the result here is handed to `new Request` and
+ * outlives the decode. The allocation is also what makes it a
+ * `Uint8Array<ArrayBuffer>`, which `BodyInit` accepts and the looser
+ * `Uint8Array<ArrayBufferLike>` does not.
+ */
+export async function collectBytes(
+  source: AsyncIterable<Uint8Array>,
+): Promise<Uint8Array<ArrayBuffer>> {
+  const parts: Uint8Array[] = [];
+  let total = 0;
+  for await (const chunk of source) {
+    if (chunk.byteLength === 0) continue;
+    parts.push(chunk);
+    total += chunk.byteLength;
+  }
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.byteLength;
+  }
+  return out;
+}