@statewalker/webrun-http-streams 0.1.1 → 0.2.2

package/dist/http1/chunked.d.ts

@@ -0,0 +1,18 @@
+import type { ByteReader } from "../bytes.js";
+import type { ByteSource } from "../message.js";
+/**
+ * Chunk sizes are written in HEXADECIMAL — a 21-byte chunk is `15`. Writing
+ * them in decimal is the defect note 15 found in @libp2p/http, and it is the
+ * one that cannot be caught downstream: decimal digits are also valid hex, so
+ * a conforming parser silently reads the wrong length.
+ *
+ * Zero-length source chunks are skipped; a zero-sized chunk on the wire is the
+ * body terminator.
+ */
+export declare function encodeChunked(body: ByteSource): AsyncGenerator<Uint8Array>;
+/**
+ * Decode a chunked body, yielding data chunks as they arrive. Nothing is
+ * accumulated: a chunk larger than the transport's frame is yielded in pieces.
+ */
+export declare function decodeChunked(reader: ByteReader, maxLineBytes: number): AsyncGenerator<Uint8Array>;
+//# sourceMappingURL=chunked.d.ts.map

package/dist/http1/chunked.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunked.d.ts","sourceRoot":"","sources":["../../src/http1/chunked.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAQhD;;;;;;;;GAQG;AACH,wBAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAAC,UAAU,CAAC,CAQjF;AAED;;;GAGG;AACH,wBAAuB,aAAa,CAClC,MAAM,EAAE,UAAU,EAClB,YAAY,EAAE,MAAM,GACnB,cAAc,CAAC,UAAU,CAAC,CAoD5B"}

package/dist/http1/decode.d.ts

@@ -0,0 +1,5 @@
+import type { ByteSource, DecodedRequest, DecodedResponse } from "../message.js";
+import type { ResolvedHttpCodecOptions } from "./encode.js";
+export declare function decodeRequest(input: ByteSource, opts: ResolvedHttpCodecOptions): Promise<DecodedRequest>;
+export declare function decodeResponse(input: ByteSource, opts: ResolvedHttpCodecOptions, method: string): Promise<DecodedResponse>;
+//# sourceMappingURL=decode.d.ts.map

package/dist/http1/decode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.d.ts","sourceRoot":"","sources":["../../src/http1/decode.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEjF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAoG5D,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,cAAc,CAAC,CA4DzB;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,wBAAwB,EAC9B,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAmC1B"}

package/dist/http1/encode.d.ts

@@ -0,0 +1,20 @@
+import type { ByteSource, RequestEnvelope, ResponseEnvelope } from "../message.js";
+export type ResolvedHttpCodecOptions = {
+    scheme: "http" | "https";
+    host: string;
+    maxHeaderBytes: number;
+};
+/**
+ * Split a URL into an origin-form request target and an authority *without*
+ * going through `new URL()`. `URL` normalises percent-encoding and would
+ * re-serialise the target — which is the exact class of defect note 15 found
+ * in @libp2p/http, where rebuilding the request line silently dropped
+ * `url.search`. Here the target is a verbatim slice of the caller's string.
+ */
+export declare function splitTarget(url: string, opts: ResolvedHttpCodecOptions): {
+    target: string;
+    authority: string;
+};
+export declare function encodeRequest(env: RequestEnvelope, body: ByteSource | undefined, opts: ResolvedHttpCodecOptions): AsyncGenerator<Uint8Array>;
+export declare function encodeResponse(env: ResponseEnvelope, body: ByteSource | undefined, _opts: ResolvedHttpCodecOptions, requestMethod?: string): AsyncGenerator<Uint8Array>;
+//# sourceMappingURL=encode.d.ts.map

package/dist/http1/encode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encode.d.ts","sourceRoot":"","sources":["../../src/http1/encode.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAgBnF,MAAM,MAAM,wBAAwB,GAAG;IACrC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAMF;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,wBAAwB,GAC7B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA6BvC;AA0BD,wBAAuB,aAAa,CAClC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,UAAU,GAAG,SAAS,EAC5B,IAAI,EAAE,wBAAwB,GAC7B,cAAc,CAAC,UAAU,CAAC,CA+B5B;AAED,wBAAuB,cAAc,CACnC,GAAG,EAAE,gBAAgB,EACrB,IAAI,EAAE,UAAU,GAAG,SAAS,EAK5B,KAAK,EAAE,wBAAwB,EAC/B,aAAa,CAAC,EAAE,MAAM,GACrB,cAAc,CAAC,UAAU,CAAC,CA0C5B"}

package/dist/http1/errors.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Raised for any byte sequence this codec refuses to interpret. Every case is
+ * a refusal to guess: HTTP/1.1 parsers that guess are how request smuggling
+ * works.
+ */
+export declare class HttpParseError extends Error {
+    readonly name = "HttpParseError";
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/http1/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/http1/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,SAAkB,IAAI,oBAAoB;CAC3C"}

package/dist/http1/headers.d.ts

@@ -0,0 +1,78 @@
+import type { ByteReader } from "../bytes.js";
+export type HeaderList = [string, string][];
+export declare function isTokenChar(byte: number): boolean;
+export declare function isToken(value: string): boolean;
+/**
+ * Header bytes are latin-1: byte-preserving, matching Node, and lossless
+ * across a decode/encode round-trip. Control characters are rejected
+ * separately by `assertValidHeaderValue`.
+ */
+export declare function decodeLatin1(bytes: Uint8Array): string;
+export declare function encodeLatin1(text: string): Uint8Array;
+/**
+ * Validates a value that is about to become (or was read as) a `Host`
+ * header: untrusted input either way, so an unrecognised shape is a refusal,
+ * not a guess. Rejects a present-but-empty value, one carrying userinfo
+ * (`evil.com@good.com`), and — the reason this also runs on encode — one
+ * smuggling a CRLF-terminated line into the authority of a caller-supplied
+ * url. Never applied to trusted configuration (a codec's `opts.host`).
+ */
+export declare function assertValidHost(host: string): void;
+/**
+ * A request-target must be entirely visible ASCII (RFC 9110 VCHAR) — nothing
+ * `<= 0x20` (space and every control character, CR/LF included) and nothing
+ * `>= 0x7F` (DEL and beyond). Applied on encode (`splitTarget`, so a
+ * caller-supplied url can never inject a second request line) and on decode
+ * (so a relay that decodes then re-encodes can never put an embedded control
+ * character back on the wire).
+ */
+export declare function assertValidTarget(target: string): void;
+export declare function assertValidHeaderValue(name: string, value: string): void;
+/** Same character class as a header value (M5) — CR/LF, every C0 control, and DEL. */
+export declare function assertValidStatusText(value: string): void;
+export declare function encodeHeaderLines(headers: HeaderList): string;
+/**
+ * Read to the blank line. `alreadyUsed` is the byte count of the start line,
+ * so the bound covers the whole head section rather than the headers alone.
+ */
+export declare function readHeaderSection(reader: ByteReader, maxHeaderBytes: number, alreadyUsed: number): Promise<HeaderList>;
+export declare function getAll(headers: HeaderList, name: string): string[];
+export declare function withoutHeaders(headers: HeaderList, names: string[]): HeaderList;
+/**
+ * Parse a `Content-Length` field into a single validated value.
+ *
+ * RFC 9110 §8.6 permits the value to be a comma-separated list of identical
+ * numbers (a relay may have appended one), so the list is folded; differing
+ * values are a refusal, not a choice. Shared by `resolveFraming` on decode and
+ * by the encoder's declared-length check, which previously carried its own
+ * copy that did NOT split on commas — so decode accepted `5, 5` while encode
+ * rejected it, and a relay that decoded then re-encoded threw.
+ *
+ * Returns undefined when the field is absent.
+ */
+export declare function parseContentLength(values: string[]): number | undefined;
+/**
+ * Statuses that carry no body whatever the headers say (RFC 9110 §8.6): 1xx,
+ * 204 and 304. Defined once because the encoder must not frame a body for
+ * them and the decoder must not try to read one — two lists that agreed today
+ * and were free to drift tomorrow.
+ *
+ * A response to HEAD is also bodyless, but that depends on the request rather
+ * than the status, so callers test it separately.
+ */
+export declare function isBodylessStatus(status: number): boolean;
+export type BodyFraming = {
+    kind: "chunked";
+} | {
+    kind: "length";
+    length: number;
+} | {
+    kind: "none";
+};
+/**
+ * RFC 9112 §6.3, with every ambiguity turned into a refusal. In particular a
+ * message declaring both Content-Length and Transfer-Encoding is rejected
+ * rather than resolved — disagreeing on which one wins is request smuggling.
+ */
+export declare function resolveFraming(headers: HeaderList, version: string): BodyFraming;
+//# sourceMappingURL=headers.d.ts.map

package/dist/http1/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../src/http1/headers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,MAAM,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;AAS5C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM9C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAItD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAUrD;AAUD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAIlD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAOtD;AAwBD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAExE;AAED,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,CAQ7D;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,UAAU,CAAC,CA6BrB;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlE;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,CAG/E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAkBvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAExD;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,GAAG,WAAW,CA+BhF"}

package/dist/http1/index.d.ts

@@ -0,0 +1,18 @@
+import type { MessageCodec } from "../message.js";
+export type HttpCodecOptions = {
+    /**
+     * Scheme used to rebuild an absolute url on decode. HTTP/1.1 origin-form
+     * carries no scheme, so this is configuration, not wire data — a peer
+     * configured `http` rebuilds an `https` url as `http`. Accepted cost of
+     * decision 6; see ADR-0006.
+     */
+    scheme?: "http" | "https";
+    /** Authority used when a url carries none. Also fills the mandatory Host header. */
+    host?: string;
+    /** Bound on the whole head section, start line included. Default 65536. */
+    maxHeaderBytes?: number;
+};
+export declare function newHttpCodec(options?: HttpCodecOptions): MessageCodec;
+export declare const httpCodec: MessageCodec;
+export { HttpParseError } from "./errors.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/http1/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http1/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAKlD,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,YAAY,CAAC,OAAO,GAAE,gBAAqB,GAAG,YAAY,CAiBzE;AAED,eAAO,MAAM,SAAS,EAAE,YAA6B,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,11 @@
+export { defaultCodec } from "./codec-default.js";
 export { DuplexSiteBuilder, type SiteHandler } from "./duplex-site-builder.js";
-export { decodeMessage, encodeMessage, type RequestEnvelope, type ResponseEnvelope, } from "./envelope.js";
+export { decodeMessage, encodeMessage, jsonEnvelopeCodec, type RequestEnvelope, type ResponseEnvelope, } from "./envelope.js";
 export { fetchOverDuplex, serveFetchOverDuplex } from "./fetch.js";
-export { type HttpDataHandler, type HttpDataHandlerResult, type HttpFetchResult, httpFetch, httpServe, } from "./http-data.js";
+export { type HttpDataHandler, type HttpDataHandlerResult, type HttpDataOptions, type HttpFetchResult, httpFetch, httpServe, PEER_ERROR_HEADER, } from "./http-data.js";
 export { HttpError, type HttpErrorOptions } from "./http-error.js";
 export { type HttpHandler, newHttpClientStub, newHttpServerStub, type SerializedHttpEnvelope, type SerializedHttpRequest, type SerializedHttpResponse, } from "./http-stubs.js";
+export { type HttpCodecOptions, HttpParseError, httpCodec, newHttpCodec, } from "./http1/index.js";
+export type { ByteSource, DecodedRequest, DecodedResponse, MessageCodec, ResponseCodecOptions, } from "./message.js";
+export { newSniffingCodec, type SniffingCodecOptions } from "./sniff.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EACL,aAAa,EACb,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,SAAS,EACT,SAAS,GACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,KAAK,WAAW,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EACL,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,SAAS,EACT,SAAS,EACT,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EACL,KAAK,WAAW,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,KAAK,gBAAgB,EACrB,cAAc,EACd,SAAS,EACT,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,UAAU,EACV,cAAc,EACd,eAAe,EACf,YAAY,EACZ,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC"}