@statewalker/webrun-http-streams 0.1.1 → 0.2.2

package/dist/index.js

@@ -1,7 +1,145 @@
-import { fromReadableStream, toReadableStream } from "@statewalker/webrun-streams";
+import { deserializeError, fromReadableStream, serializeError, toReadableStream } from "@statewalker/webrun-streams";
+//#region src/bytes.ts
+const CR = 13;
+const LF = 10;
+const EMPTY = /* @__PURE__ */ new Uint8Array(0);
+var ByteStreamError = class extends Error {
+	name = "ByteStreamError";
+};
+function toAsyncIterator(input) {
+	const asyncIter = input[Symbol.asyncIterator];
+	if (asyncIter) return asyncIter.call(input);
+	const syncIter = input[Symbol.iterator]();
+	return { next() {
+		return Promise.resolve(syncIter.next());
+	} };
+}
+/**
+* Discard an iterable we are contractually forbidden from consuming — a body
+* skipped for HEAD/204, or one abandoned because the peer reported an error.
+*
+* The `.next()` is not optional: `.return()` on a generator still in suspended
+* start is a no-op, so the body never runs and its `try/finally` never unwinds.
+* Without it a wrapped ReadableStream or socket is never cancelled.
+*/
+async function discard(source) {
+	if (source === void 0) return;
+	const it = toAsyncIterator(source);
+	try {
+		await it.next();
+		await it.return?.();
+	} catch {}
+}
+function concatChunks(parts, totalLen) {
+	if (parts.length === 1) {
+		const only = parts[0];
+		if (only !== void 0) return only;
+	}
+	const out = new Uint8Array(totalLen);
+	let off = 0;
+	for (const p of parts) {
+		out.set(p, off);
+		off += p.byteLength;
+	}
+	return out;
+}
+/**
+* Pull-based reader over a byte source. Holds at most one pending buffer, and
+* hands out `subarray` views rather than copies — a body never passes through
+* an allocation here.
+*/
+var ByteReader = class {
+	#iter;
+	#buf = EMPTY;
+	#done = false;
+	constructor(input) {
+		this.#iter = toAsyncIterator(input);
+	}
+	/** Bytes already pulled from the source but not yet consumed. */
+	bufferedLength() {
+		return this.#buf.byteLength;
+	}
+	/** Pull one more non-empty chunk. Returns false at end of stream. */
+	async #pull() {
+		if (this.#done) return false;
+		while (true) {
+			const next = await this.#iter.next();
+			if (next.done) {
+				this.#done = true;
+				return false;
+			}
+			const chunk = next.value;
+			if (chunk.byteLength === 0) continue;
+			this.#buf = this.#buf.byteLength === 0 ? chunk : concatChunks([this.#buf, chunk], this.#buf.byteLength + chunk.byteLength);
+			return true;
+		}
+	}
+	async peekByte() {
+		while (this.#buf.byteLength === 0) if (!await this.#pull()) return void 0;
+		return this.#buf[0];
+	}
+	/** Up to `max` bytes. `undefined` means end of stream. */
+	async readSome(max) {
+		while (this.#buf.byteLength === 0) if (!await this.#pull()) return void 0;
+		const take = Math.min(max, this.#buf.byteLength);
+		const out = this.#buf.subarray(0, take);
+		this.#buf = this.#buf.subarray(take);
+		return out;
+	}
+	/**
+	* One CRLF-terminated line, without the CRLF. A bare LF is rejected: real
+	* peers always send CRLF, and tolerating a bare LF is precisely the lenience
+	* that lets request smuggling through a proxy pair.
+	*
+	* The `maxBytes` bound is best-effort: it only rejects a line if the check
+	* happens to run before the line is fully buffered. A line already sitting in
+	* the buffer bypasses the check. Callers needing a hard per-line limit or
+	* aggregate bounds must keep their own running total.
+	*/
+	async readLine(maxBytes) {
+		let searched = 0;
+		while (true) {
+			const idx = this.#buf.indexOf(LF, searched);
+			if (idx !== -1) {
+				if (idx === 0 || this.#buf[idx - 1] !== CR) throw new ByteStreamError("bare LF line terminator; CRLF required");
+				const line = this.#buf.subarray(0, idx - 1);
+				this.#buf = this.#buf.subarray(idx + 1);
+				return line;
+			}
+			searched = this.#buf.byteLength;
+			if (searched > maxBytes) throw new ByteStreamError(`line exceeds ${maxBytes} bytes without CRLF`);
+			if (!await this.#pull()) throw new ByteStreamError(`stream ended after ${searched} bytes without CRLF`);
+		}
+	}
+	/** Everything not yet consumed, lazily. */
+	async *rest() {
+		while (true) {
+			if (this.#buf.byteLength > 0) {
+				const out = this.#buf;
+				this.#buf = EMPTY;
+				yield out;
+				continue;
+			}
+			if (!await this.#pull()) return;
+		}
+	}
+};
+//#endregion
+//#region src/http1/errors.ts
+/**
+* Raised for any byte sequence this codec refuses to interpret. Every case is
+* a refusal to guess: HTTP/1.1 parsers that guess are how request smuggling
+* works.
+*/
+var HttpParseError = class extends Error {
+	name = "HttpParseError";
+};
+//#endregion
 //#region src/envelope.ts
 const NEWLINE = 10;
-const encoder = new TextEncoder();
+/** Mirrors the HTTP/1.1 codec's default `maxHeaderBytes`. */
+const MAX_ENVELOPE_BYTES = 65536;
+const encoder$1 = new TextEncoder();
 const decoder = new TextDecoder();
 /**
 * Encode an HTTP envelope plus optional body as one continuous byte stream:
@@ -14,7 +152,7 @@ const decoder = new TextDecoder();
 * This is the same wire shape used by the legacy `webrun-http-port` package.
 */
 async function* encodeMessage(envelope, body) {
-	yield encoder.encode(`${JSON.stringify(envelope)}\n`);
+	yield encoder$1.encode(`${JSON.stringify(envelope)}\n`);
 	if (!body) return;
 	for await (const chunk of body) if (chunk.byteLength > 0) yield chunk;
 }
@@ -30,13 +168,14 @@ async function decodeMessage(input) {
 	let tail;
 	while (true) {
 		const next = await iter.next();
-		if (next.done) throw new Error(`decodeMessage: stream ended after ${accumLen} bytes without delimiter (\\n)`);
+		if (next.done) throw new HttpParseError(`decodeMessage: stream ended after ${accumLen} bytes without delimiter (\\n)`);
 		const chunk = next.value;
 		if (chunk.byteLength === 0) continue;
 		const nl = chunk.indexOf(NEWLINE);
 		if (nl === -1) {
 			accum.push(chunk);
 			accumLen += chunk.byteLength;
+			if (accumLen > MAX_ENVELOPE_BYTES) throw new HttpParseError(`decodeMessage: envelope exceeds ${MAX_ENVELOPE_BYTES} bytes without delimiter (\\n)`);
 			continue;
 		}
 		accum.push(chunk.subarray(0, nl));
@@ -49,7 +188,7 @@ async function decodeMessage(input) {
 	try {
 		envelope = JSON.parse(decoder.decode(before));
 	} catch (err) {
-		throw new Error(`decodeMessage: malformed envelope JSON at bytes 0..${before.byteLength}: ${err.message}`);
+		throw new HttpParseError(`decodeMessage: malformed envelope JSON at bytes 0..${before.byteLength}: ${err.message}`);
 	}
 	async function* body() {
 		if (tail.byteLength > 0) yield tail;
@@ -64,26 +203,647 @@ async function decodeMessage(input) {
 		body: body()
 	};
 }
-function toAsyncIterator(input) {
-	const asyncIter = input[Symbol.asyncIterator];
-	if (asyncIter) return asyncIter.call(input);
-	const syncIter = input[Symbol.iterator]();
-	return { next() {
-		return Promise.resolve(syncIter.next());
-	} };
+const OPEN_BRACE = 123;
+/**
+* The original wire format — `<JSON.stringify(envelope)>\n<body bytes…>` —
+* expressed as a `MessageCodec`. Direction-agnostic: requests and responses
+* serialise identically.
+*
+* Retained so a peer pair can be upgraded in either order; see ADR-0006.
+*/
+const jsonEnvelopeCodec = {
+	name: "json-envelope",
+	sniff: (byte) => byte === OPEN_BRACE,
+	encodeRequest: (env, body) => encodeMessage(env, body),
+	encodeResponse: (env, body) => encodeMessage(env, body),
+	decodeRequest: (input) => decodeMessage(input),
+	decodeResponse: (input) => decodeMessage(input)
+};
+//#endregion
+//#region src/http1/headers.ts
+const TCHAR = /* @__PURE__ */ new Set("!#$%&'*+-.^_`|~0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ");
+const SP = 32;
+const HTAB = 9;
+function isTokenChar(byte) {
+	return byte > SP && byte < 127 && TCHAR.has(String.fromCharCode(byte));
 }
-function concatChunks(parts, totalLen) {
-	if (parts.length === 1) return parts[0];
-	const out = new Uint8Array(totalLen);
-	let off = 0;
-	for (const p of parts) {
-		out.set(p, off);
-		off += p.byteLength;
+function isToken(value) {
+	if (value.length === 0) return false;
+	for (const ch of value) if (!TCHAR.has(ch)) return false;
+	return true;
+}
+/**
+* Header bytes are latin-1: byte-preserving, matching Node, and lossless
+* across a decode/encode round-trip. Control characters are rejected
+* separately by `assertValidHeaderValue`.
+*/
+function decodeLatin1(bytes) {
+	let out = "";
+	for (const byte of bytes) out += String.fromCharCode(byte);
+	return out;
+}
+function encodeLatin1(text) {
+	const out = new Uint8Array(text.length);
+	for (let i = 0; i < text.length; i++) {
+		const code = text.charCodeAt(i);
+		if (code > 255) throw new HttpParseError(`not latin-1 encodable: ${JSON.stringify(text)}`);
+		out[i] = code;
+	}
+	return out;
+}
+const HOST_IP_LITERAL = /^\[[0-9A-Fa-f:.]+\](:\d{1,5})?$/;
+const HOST_REG_NAME = /^[A-Za-z0-9._~-]+(:\d{1,5})?$/;
+/**
+* Validates a value that is about to become (or was read as) a `Host`
+* header: untrusted input either way, so an unrecognised shape is a refusal,
+* not a guess. Rejects a present-but-empty value, one carrying userinfo
+* (`evil.com@good.com`), and — the reason this also runs on encode — one
+* smuggling a CRLF-terminated line into the authority of a caller-supplied
+* url. Never applied to trusted configuration (a codec's `opts.host`).
+*/
+function assertValidHost(host) {
+	if (!HOST_IP_LITERAL.test(host) && !HOST_REG_NAME.test(host)) throw new HttpParseError(`invalid Host header: ${JSON.stringify(host)}`);
+}
+/**
+* A request-target must be entirely visible ASCII (RFC 9110 VCHAR) — nothing
+* `<= 0x20` (space and every control character, CR/LF included) and nothing
+* `>= 0x7F` (DEL and beyond). Applied on encode (`splitTarget`, so a
+* caller-supplied url can never inject a second request line) and on decode
+* (so a relay that decodes then re-encodes can never put an embedded control
+* character back on the wire).
+*/
+function assertValidTarget(target) {
+	for (let i = 0; i < target.length; i++) {
+		const code = target.charCodeAt(i);
+		if (code <= SP || code >= 127) throw new HttpParseError(`invalid request-target: ${JSON.stringify(target)}`);
+	}
+}
+/**
+* Shared control-character check behind both `assertValidHeaderValue` and
+* `assertValidStatusText` — the two were previously checked by different,
+* looser rules (statusText only rejected CR/LF), which is exactly the
+* asymmetry class C1 and M5 are both instances of. `label` is prepended
+* verbatim to each message, so callers keep their own wording.
+*/
+function assertNoControlChars(label, value) {
+	for (let i = 0; i < value.length; i++) {
+		const code = value.charCodeAt(i);
+		if (code === 13 || code === 10) throw new HttpParseError(`${label} contains CR or LF`);
+		if (code < SP && code !== HTAB || code === 127) throw new HttpParseError(`${label} contains a control character`);
+		if (code > 255) throw new HttpParseError(`${label} is not latin-1 encodable`);
+	}
+}
+function assertValidHeaderValue(name, value) {
+	assertNoControlChars(`header "${name}" value`, value);
+}
+/** Same character class as a header value (M5) — CR/LF, every C0 control, and DEL. */
+function assertValidStatusText(value) {
+	assertNoControlChars("statusText", value);
+}
+function encodeHeaderLines(headers) {
+	let out = "";
+	for (const [name, value] of headers) {
+		if (!isToken(name)) throw new HttpParseError(`invalid header name: ${JSON.stringify(name)}`);
+		assertValidHeaderValue(name, value);
+		out += `${name}: ${value}\r\n`;
 	}
 	return out;
 }
+/**
+* Read to the blank line. `alreadyUsed` is the byte count of the start line,
+* so the bound covers the whole head section rather than the headers alone.
+*/
+async function readHeaderSection(reader, maxHeaderBytes, alreadyUsed) {
+	const headers = [];
+	let used = alreadyUsed;
+	while (true) {
+		const remaining = maxHeaderBytes - used;
+		if (remaining <= 0) throw new HttpParseError(`head section exceeds ${maxHeaderBytes} bytes`);
+		const lineBytes = await reader.readLine(remaining);
+		used += lineBytes.byteLength + 2;
+		if (used > maxHeaderBytes) throw new HttpParseError(`head section exceeds ${maxHeaderBytes} bytes`);
+		if (lineBytes.byteLength === 0) return headers;
+		if (lineBytes[0] === SP || lineBytes[0] === HTAB) throw new HttpParseError("obs-fold header continuation is not accepted");
+		const line = decodeLatin1(lineBytes);
+		const colon = line.indexOf(":");
+		if (colon <= 0) throw new HttpParseError(`malformed header line: ${JSON.stringify(line)}`);
+		const name = line.slice(0, colon);
+		if (!isToken(name)) throw new HttpParseError(`invalid header name: ${JSON.stringify(name)}`);
+		const value = line.slice(colon + 1).replace(/^[ \t]+/, "").replace(/[ \t]+$/, "");
+		assertValidHeaderValue(name, value);
+		headers.push([name, value]);
+	}
+}
+function getAll(headers, name) {
+	const lower = name.toLowerCase();
+	return headers.filter(([k]) => k.toLowerCase() === lower).map(([, v]) => v);
+}
+function withoutHeaders(headers, names) {
+	const drop = new Set(names.map((n) => n.toLowerCase()));
+	return headers.filter(([k]) => !drop.has(k.toLowerCase()));
+}
+/**
+* Parse a `Content-Length` field into a single validated value.
+*
+* RFC 9110 §8.6 permits the value to be a comma-separated list of identical
+* numbers (a relay may have appended one), so the list is folded; differing
+* values are a refusal, not a choice. Shared by `resolveFraming` on decode and
+* by the encoder's declared-length check, which previously carried its own
+* copy that did NOT split on commas — so decode accepted `5, 5` while encode
+* rejected it, and a relay that decoded then re-encoded threw.
+*
+* Returns undefined when the field is absent.
+*/
+function parseContentLength(values) {
+	if (values.length === 0) return void 0;
+	const unique = new Set(values.flatMap((v) => v.split(",").map((s) => s.trim())));
+	if (unique.size !== 1) throw new HttpParseError(`conflicting Content-Length values: ${[...unique].join(", ")}`);
+	const raw = [...unique][0];
+	if (!/^\d{1,15}$/.test(raw)) throw new HttpParseError(`invalid Content-Length: ${JSON.stringify(raw)}`);
+	return Number(raw);
+}
+/**
+* Statuses that carry no body whatever the headers say (RFC 9110 §8.6): 1xx,
+* 204 and 304. Defined once because the encoder must not frame a body for
+* them and the decoder must not try to read one — two lists that agreed today
+* and were free to drift tomorrow.
+*
+* A response to HEAD is also bodyless, but that depends on the request rather
+* than the status, so callers test it separately.
+*/
+function isBodylessStatus(status) {
+	return status < 200 || status === 204 || status === 304;
+}
+/**
+* RFC 9112 §6.3, with every ambiguity turned into a refusal. In particular a
+* message declaring both Content-Length and Transfer-Encoding is rejected
+* rather than resolved — disagreeing on which one wins is request smuggling.
+*/
+function resolveFraming(headers, version) {
+	const te = getAll(headers, "transfer-encoding");
+	const cl = getAll(headers, "content-length");
+	if (te.length > 0 && cl.length > 0) throw new HttpParseError("message declares both Content-Length and Transfer-Encoding; refusing (request smuggling)");
+	if (te.length > 0) {
+		const encodings = te.join(",").split(",").map((s) => s.trim().toLowerCase()).filter((s) => s !== "");
+		if (encodings.length !== 1 || encodings[0] !== "chunked") throw new HttpParseError(`unsupported Transfer-Encoding: ${JSON.stringify(te.join(", "))}`);
+		if (version === "HTTP/1.0") throw new HttpParseError("Transfer-Encoding is not valid in HTTP/1.0");
+		return { kind: "chunked" };
+	}
+	const length = parseContentLength(cl);
+	if (length !== void 0) return {
+		kind: "length",
+		length
+	};
+	return { kind: "none" };
+}
+//#endregion
+//#region src/http1/chunked.ts
+const CRLF = new Uint8Array([13, 10]);
+const LAST_CHUNK = new Uint8Array([
+	48,
+	13,
+	10,
+	13,
+	10
+]);
+const encoder = new TextEncoder();
+/**
+* Chunk sizes are written in HEXADECIMAL — a 21-byte chunk is `15`. Writing
+* them in decimal is the defect note 15 found in @libp2p/http, and it is the
+* one that cannot be caught downstream: decimal digits are also valid hex, so
+* a conforming parser silently reads the wrong length.
+*
+* Zero-length source chunks are skipped; a zero-sized chunk on the wire is the
+* body terminator.
+*/
+async function* encodeChunked(body) {
+	for await (const chunk of body) {
+		if (chunk.byteLength === 0) continue;
+		yield encoder.encode(`${chunk.byteLength.toString(16)}\r\n`);
+		yield chunk;
+		yield CRLF;
+	}
+	yield LAST_CHUNK;
+}
+/**
+* Decode a chunked body, yielding data chunks as they arrive. Nothing is
+* accumulated: a chunk larger than the transport's frame is yielded in pieces.
+*/
+async function* decodeChunked(reader, maxLineBytes) {
+	while (true) {
+		const sizeLine = decodeLatin1(await reader.readLine(maxLineBytes));
+		const semicolon = sizeLine.indexOf(";");
+		const sizeText = semicolon === -1 ? sizeLine : sizeLine.slice(0, semicolon);
+		if (!/^[0-9a-fA-F]{1,32}$/.test(sizeText)) throw new HttpParseError(`invalid chunk size: ${JSON.stringify(sizeLine)}`);
+		const size = Number.parseInt(sizeText, 16);
+		if (!Number.isSafeInteger(size)) throw new HttpParseError(`chunk size is too large: ${JSON.stringify(sizeLine)}`);
+		if (size === 0) {
+			let used = 0;
+			while (true) {
+				const remaining = maxLineBytes - used;
+				if (remaining <= 0) throw new HttpParseError(`trailer section exceeds ${maxLineBytes} bytes`);
+				const lineBytes = await reader.readLine(remaining);
+				used += lineBytes.byteLength + 2;
+				if (used > maxLineBytes) throw new HttpParseError(`trailer section exceeds ${maxLineBytes} bytes`);
+				if (lineBytes.byteLength === 0) break;
+			}
+			return;
+		}
+		let remaining = size;
+		while (remaining > 0) {
+			const part = await reader.readSome(remaining);
+			if (part === void 0) throw new HttpParseError(`chunk truncated: ${remaining} of ${size} bytes missing`);
+			remaining -= part.byteLength;
+			yield part;
+		}
+		try {
+			if ((await reader.readLine(2)).byteLength !== 0) throw new HttpParseError("chunk data not terminated by CRLF");
+		} catch (err) {
+			if (err instanceof ByteStreamError) throw new HttpParseError("chunk data not terminated by CRLF");
+			throw err;
+		}
+	}
+}
+//#endregion
+//#region src/http1/decode.ts
+const VERSIONS = /* @__PURE__ */ new Set(["HTTP/1.1", "HTTP/1.0"]);
+const ABSOLUTE_FORM = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
+/**
+* One message per Duplex call (ADR-0006), so bytes after a complete message
+* are an error. Checked against what is ALREADY BUFFERED rather than by
+* awaiting end-of-stream: a live socket from a keep-alive peer never reaches
+* EOF, so awaiting one would hang instead of failing.
+*/
+function assertNoBufferedBytes(reader) {
+	const extra = reader.bufferedLength();
+	if (extra > 0) throw new HttpParseError(`${extra} trailing bytes after a complete message`);
+}
+/**
+* The public error contract (I2): everything leaving `decodeRequest` /
+* `decodeResponse` is an `HttpParseError`, whether the refusal happened
+* synchronously (a malformed start line or header) or lazily while the body
+* is later drained. `ByteStreamError` — the `ByteReader`'s own class, never
+* exported — is the one thing converted here, message and all preserved via
+* `cause`. Anything else is a genuine failure of the underlying source (a
+* dropped socket, say) and must reach the caller unchanged: blanket-catching
+* would hide that distinction.
+*/
+function toHttpParseError(err) {
+	if (err instanceof ByteStreamError) throw new HttpParseError(err.message, { cause: err });
+	throw err;
+}
+/** Applies `toHttpParseError` across the whole lifetime of a body generator. */
+async function* convertBodyErrors(source) {
+	try {
+		yield* source;
+	} catch (err) {
+		toHttpParseError(err);
+	}
+}
+async function* readBody(reader, framing, opts, noneMeansEof) {
+	if (framing.kind === "chunked") {
+		yield* decodeChunked(reader, opts.maxHeaderBytes);
+		assertNoBufferedBytes(reader);
+		return;
+	}
+	if (framing.kind === "length") {
+		let remaining = framing.length;
+		while (remaining > 0) {
+			const part = await reader.readSome(remaining);
+			if (part === void 0) throw new HttpParseError(`body truncated: ${remaining} of ${framing.length} bytes missing`);
+			remaining -= part.byteLength;
+			yield part;
+		}
+		assertNoBufferedBytes(reader);
+		return;
+	}
+	if (noneMeansEof) {
+		yield* reader.rest();
+		return;
+	}
+	assertNoBufferedBytes(reader);
+}
+/**
+* `readLine`'s bound is best-effort — it is skipped when the line is already
+* buffered — so a very long start line can reach these messages intact. Since
+* a refusal is now echoed back to the sender in a 400 body, quote only enough
+* to diagnose rather than reflecting the whole thing.
+*/
+function quoteLine(line) {
+	const MAX = 120;
+	return line.length <= MAX ? JSON.stringify(line) : `${JSON.stringify(line.slice(0, MAX))} (truncated from ${line.length} chars)`;
+}
+async function decodeRequest(input, opts) {
+	const reader = new ByteReader(input);
+	try {
+		const startBytes = await reader.readLine(opts.maxHeaderBytes);
+		const startLine = decodeLatin1(startBytes);
+		const parts = startLine.split(" ");
+		if (parts.length !== 3) throw new HttpParseError(`malformed request line: ${quoteLine(startLine)}`);
+		const [method, target, version] = parts;
+		if (!isToken(method)) throw new HttpParseError(`invalid method: ${JSON.stringify(method)}`);
+		if (!VERSIONS.has(version)) throw new HttpParseError(`unsupported HTTP version: ${JSON.stringify(version)}`);
+		if (target === "*") throw new HttpParseError("asterisk-form request target is not supported");
+		assertValidTarget(target);
+		const headers = await readHeaderSection(reader, opts.maxHeaderBytes, startBytes.byteLength + 2);
+		const hosts = getAll(headers, "host");
+		if (hosts.length > 1) throw new HttpParseError("multiple Host headers");
+		const host = hosts[0];
+		let url;
+		if (target.startsWith("/")) {
+			if (version === "HTTP/1.1" && host === void 0) throw new HttpParseError("HTTP/1.1 request has no Host header");
+			if (host !== void 0) assertValidHost(host);
+			url = `${opts.scheme}://${host ?? opts.host}${target}`;
+		} else if (ABSOLUTE_FORM.test(target)) url = target;
+		else throw new HttpParseError(`unsupported request target: ${JSON.stringify(target)}`);
+		try {
+			new URL(url);
+		} catch {
+			throw new HttpParseError(`decoded url is not a valid URL: ${JSON.stringify(url)}`);
+		}
+		return {
+			envelope: {
+				url,
+				method,
+				headers
+			},
+			body: convertBodyErrors(readBody(reader, resolveFraming(headers, version), opts, false))
+		};
+	} catch (err) {
+		toHttpParseError(err);
+	}
+}
+async function decodeResponse(input, opts, method) {
+	const reader = new ByteReader(input);
+	try {
+		const startBytes = await reader.readLine(opts.maxHeaderBytes);
+		const startLine = decodeLatin1(startBytes);
+		const firstSp = startLine.indexOf(" ");
+		if (firstSp === -1) throw new HttpParseError(`malformed status line: ${quoteLine(startLine)}`);
+		const version = startLine.slice(0, firstSp);
+		if (!VERSIONS.has(version)) throw new HttpParseError(`unsupported HTTP version: ${JSON.stringify(version)}`);
+		const afterVersion = startLine.slice(firstSp + 1);
+		const secondSp = afterVersion.indexOf(" ");
+		const codeText = secondSp === -1 ? afterVersion : afterVersion.slice(0, secondSp);
+		if (!/^\d{3}$/.test(codeText)) throw new HttpParseError(`invalid status code: ${JSON.stringify(codeText)}`);
+		const status = Number(codeText);
+		const statusText = secondSp === -1 ? "" : afterVersion.slice(secondSp + 1);
+		const headers = await readHeaderSection(reader, opts.maxHeaderBytes, startBytes.byteLength + 2);
+		const bodyless = isBodylessStatus(status) || method.toUpperCase() === "HEAD";
+		const framing = bodyless ? { kind: "none" } : resolveFraming(headers, version);
+		return {
+			envelope: {
+				status,
+				statusText,
+				headers
+			},
+			body: convertBodyErrors(readBody(reader, framing, opts, !bodyless))
+		};
+	} catch (err) {
+		toHttpParseError(err);
+	}
+}
+//#endregion
+//#region src/http1/encode.ts
+/** Headers the codec owns: a caller-supplied copy is dropped and re-derived. */
+const REQUEST_OWNED = [
+	"host",
+	"connection",
+	"transfer-encoding"
+];
+const RESPONSE_OWNED = ["connection", "transfer-encoding"];
+/**
+* Split a URL into an origin-form request target and an authority *without*
+* going through `new URL()`. `URL` normalises percent-encoding and would
+* re-serialise the target — which is the exact class of defect note 15 found
+* in @libp2p/http, where rebuilding the request line silently dropped
+* `url.search`. Here the target is a verbatim slice of the caller's string.
+*/
+function splitTarget(url, opts) {
+	if (url.startsWith("/")) {
+		assertValidTarget(url);
+		return {
+			target: url,
+			authority: opts.host
+		};
+	}
+	const match = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/([^/?#]*)([^#]*)/.exec(url);
+	if (!match) throw new HttpParseError(`cannot derive a request target from url: ${JSON.stringify(url)}`);
+	const rawAuthority = match[1];
+	if (rawAuthority === "") throw new HttpParseError(`url has no authority: ${JSON.stringify(url)}`);
+	const at = rawAuthority.lastIndexOf("@");
+	const authority = at === -1 ? rawAuthority : rawAuthority.slice(at + 1);
+	assertValidHost(authority);
+	const rawTarget = match[2];
+	const target = rawTarget === "" ? "/" : rawTarget.startsWith("/") ? rawTarget : `/${rawTarget}`;
+	assertValidTarget(target);
+	return {
+		target,
+		authority
+	};
+}
+async function* emitBody(body, declared) {
+	if (declared === void 0) {
+		yield* encodeChunked(body);
+		return;
+	}
+	let sent = 0;
+	for await (const chunk of body) {
+		if (chunk.byteLength === 0) continue;
+		sent += chunk.byteLength;
+		if (sent > declared) throw new HttpParseError(`body exceeds declared Content-Length ${declared} (${sent} bytes so far)`);
+		yield chunk;
+	}
+	if (sent !== declared) throw new HttpParseError(`body is ${sent} bytes but Content-Length declares ${declared}`);
+}
+async function* encodeRequest(env, body, opts) {
+	if (!isToken(env.method)) throw new HttpParseError(`invalid method: ${JSON.stringify(env.method)}`);
+	const { target, authority } = splitTarget(env.url, opts);
+	if (authority === "") throw new HttpParseError("no Host available: url has no authority and no host is configured");
+	const carried = withoutHeaders(env.headers, REQUEST_OWNED);
+	const declared = parseContentLength(getAll(carried, "content-length"));
+	let head = `${env.method} ${target} HTTP/1.1\r\n`;
+	head += `Host: ${authority}\r\n`;
+	head += encodeHeaderLines(carried);
+	head += "Connection: close\r\n";
+	if (body !== void 0 && declared === void 0) head += "Transfer-Encoding: chunked\r\n";
+	head += "\r\n";
+	yield encodeLatin1(head);
+	if (body === void 0) {
+		if (declared !== void 0 && declared !== 0) throw new HttpParseError(`body is 0 bytes but Content-Length declares ${declared}`);
+		return;
+	}
+	yield* emitBody(body, declared);
+}
+async function* encodeResponse(env, body, _opts, requestMethod) {
+	if (!Number.isInteger(env.status) || env.status < 100 || env.status > 599) throw new HttpParseError(`invalid status: ${env.status}`);
+	const reason = env.statusText ?? "";
+	assertValidStatusText(reason);
+	const bodylessStatus = isBodylessStatus(env.status);
+	const bodyless = bodylessStatus || requestMethod?.toUpperCase() === "HEAD";
+	const owned = bodylessStatus ? [...RESPONSE_OWNED, "content-length"] : RESPONSE_OWNED;
+	const carried = withoutHeaders(env.headers, owned);
+	const declared = parseContentLength(getAll(carried, "content-length"));
+	let head = `HTTP/1.1 ${env.status} ${reason}\r\n`;
+	head += encodeHeaderLines(carried);
+	head += "Connection: close\r\n";
+	if (!bodyless && body !== void 0 && declared === void 0) head += "Transfer-Encoding: chunked\r\n";
+	head += "\r\n";
+	yield encodeLatin1(head);
+	if (bodyless) {
+		await discard(body);
+		return;
+	}
+	if (body === void 0) {
+		if (declared !== void 0 && declared !== 0) throw new HttpParseError(`body is 0 bytes but Content-Length declares ${declared}`);
+		return;
+	}
+	yield* emitBody(body, declared);
+}
+//#endregion
+//#region src/http1/index.ts
+function newHttpCodec(options = {}) {
+	const opts = {
+		scheme: options.scheme ?? "http",
+		host: options.host ?? "localhost",
+		maxHeaderBytes: options.maxHeaderBytes ?? 65536
+	};
+	return {
+		name: "http/1.1",
+		sniff: (byte) => isTokenChar(byte),
+		encodeRequest: (env, body) => encodeRequest(env, body, opts),
+		encodeResponse: (env, body, o) => encodeResponse(env, body, opts, o?.method),
+		decodeRequest: (input) => decodeRequest(input, opts),
+		decodeResponse: (input, o) => decodeResponse(input, opts, o.method)
+	};
+}
+const httpCodec = newHttpCodec();
+//#endregion
+//#region src/sniff.ts
+/**
+* Dispatches on byte 0. The formats are self-identifying — a JSON envelope
+* always begins `{`, which is not a token character and so can never begin an
+* HTTP start-line — so no negotiation handshake, magic prefix, or version byte
+* is needed.
+*
+* This is what makes a mixed-version peer pair safe: readers accept either
+* format, so the two ends can be upgraded in any order.
+*/
+function newSniffingCodec(options) {
+	const { write, accept } = options;
+	async function pick(input) {
+		const reader = new ByteReader(input);
+		const first = await reader.peekByte();
+		if (first === void 0) throw new HttpParseError("sniff: stream ended before any bytes arrived");
+		const codec = accept.find((c) => c.sniff(first));
+		if (!codec) throw new HttpParseError(`sniff: no accepted codec recognises a message starting with byte 0x${first.toString(16).padStart(2, "0")}`);
+		return {
+			codec,
+			input: reader.rest()
+		};
+	}
+	return {
+		name: `sniff(write=${write.name}; accept=${accept.map((c) => c.name).join(",")})`,
+		sniff: (byte) => accept.some((c) => c.sniff(byte)),
+		encodeRequest: (env, body) => write.encodeRequest(env, body),
+		encodeResponse: (env, body, o) => write.encodeResponse(env, body, o),
+		decodeRequest: async (input) => {
+			const picked = await pick(input);
+			try {
+				return {
+					...await picked.codec.decodeRequest(picked.input),
+					codec: picked.codec
+				};
+			} catch (error) {
+				if (error !== null && typeof error === "object") error.codec = picked.codec;
+				throw error;
+			}
+		},
+		decodeResponse: async (input, o) => {
+			const picked = await pick(input);
+			return picked.codec.decodeResponse(picked.input, o);
+		}
+	};
+}
+//#endregion
+//#region src/codec-default.ts
+/**
+* Writes HTTP/1.1; accepts HTTP/1.1 or the legacy JSON envelope. Used whenever
+* no `codec` option is supplied.
+*/
+const defaultCodec = newSniffingCodec({
+	write: httpCodec,
+	accept: [httpCodec, jsonEnvelopeCodec]
+});
 //#endregion
 //#region src/http-data.ts
+/** Carries the serialized JS error between two webrun peers. */
+const PEER_ERROR_HEADER = "x-webrun-error";
+/** Hard cap on the peer-error header (M3): see `encodeErrorResponse`. */
+const MAX_DETAIL_CHARS = 4096;
+/**
+* JSON with every non-printable-ASCII character escaped, so the result is a
+* legal latin-1 header value whatever the error message contained.
+*/
+function asciiJson(value) {
+	return JSON.stringify(value).replace(/[^\x20-\x7E]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+/**
+* Decision 13: a real HTTP peer cannot receive a JavaScript exception, only a
+* response. So an uncaught handler error becomes a conforming 500 whose body
+* carries the message, with the serialized error in a namespaced header that
+* another webrun peer re-throws from.
+*/
+function encodeErrorResponse(codec, error, method, status = 500, statusText = "Internal Server Error") {
+	const serialized = serializeError(error);
+	let detail = asciiJson(serialized);
+	if (detail.length > MAX_DETAIL_CHARS) detail = asciiJson({ message: serialized.message });
+	if (detail.length > MAX_DETAIL_CHARS) detail = detail.slice(0, MAX_DETAIL_CHARS);
+	const message = serialized.message ?? statusText;
+	return codec.encodeResponse({
+		status,
+		statusText,
+		headers: [["Content-Type", "text/plain; charset=utf-8"], [PEER_ERROR_HEADER, detail]]
+	}, [new TextEncoder().encode(message)], { method });
+}
+/**
+* `output` is the `Duplex` call's own generator — one logical call, per the
+* `Duplex` contract in `@statewalker/webrun-streams`: "Consumer `.return()`
+* on the output → producer's `finally` runs." On a mux transport
+* (`emulateMux`), that `finally` is what frees the stream-table slot; skip it
+* and every peer-error response leaks one slot, unboundedly, until the mux
+* itself is exhausted (`maxStreams` reached, every further call rejected).
+*
+* Cancelling `output` here — not inside the codec's own decode logic — is
+* deliberate. `codec.decodeResponse` already pulled from `output` to read the
+* head before this function runs, so unlike the body case above there's no
+* suspended-start no-op to worry about. And it's safe specifically *because*
+* this is the client's own response-only generator: the request was already
+* fully sent before we got here, so there is nothing left to write on it.
+* The equivalent is NOT safe inside `src/http1/decode.ts`'s `ByteReader` —
+* that code also runs when a caller wires `codec.decodeRequest`/
+* `decodeResponse` directly onto a raw bidirectional socket (see
+* `tests/http1-node-interop.test.ts`), where the *same* object is read from
+* and then written back to (a server reads the request, then replies on the
+* same socket); cancelling the read side there tears down the whole
+* connection out from under the pending write. That was tried and reverted —
+* see the Task 11 report for the "socket hang up" failure it caused.
+*/
+async function throwIfPeerError(result, output) {
+	const found = result.envelope.headers.find(([k]) => k.toLowerCase() === PEER_ERROR_HEADER);
+	if (!found) return;
+	await discard(result.body);
+	try {
+		await output.return?.(void 0);
+	} catch {}
+	let payload;
+	try {
+		payload = JSON.parse(found[1]);
+	} catch {
+		payload = { message: found[1] };
+	}
+	throw deserializeError(payload);
+}
 /**
 * Initiate an HTTP call over a `Duplex`. The caller's `call: Duplex` is
 * obtained from any `webrun-streams-*` adapter's `connect`. Returns the
@@ -92,24 +852,227 @@ function concatChunks(parts, totalLen) {
 * The call is one logical Duplex invocation; multiplexing of concurrent
 * calls is the adapter's concern (native or `emulateMux`).
 */
-async function httpFetch(call, env, body) {
-	return decodeMessage(call(encodeMessage(env, body)));
+async function httpFetch(call, env, body, options = {}) {
+	const codec = options.codec ?? defaultCodec;
+	const output = call(codec.encodeRequest(env, body));
+	const result = await codec.decodeResponse(output, { method: env.method });
+	await throwIfPeerError(result, output);
+	return result;
 }
 /**
 * Wrap an HTTP handler as a `Duplex` so it can be registered with any
-* `webrun-streams-*` adapter's `serve`. The duplex `split`s the input to
-* recover envelope + body, dispatches to the handler, and emits the response
-* via `encodeMessage`.
+* `webrun-streams-*` adapter's `serve`.
 */
-function httpServe(handler) {
+function httpServe(handler, options = {}) {
+	const codec = options.codec ?? defaultCodec;
 	return async function* httpHandlerDuplex(input) {
-		const { envelope: reqEnv, body: reqBody } = await decodeMessage(input);
-		const result = await handler(reqEnv, reqBody);
-		yield* encodeMessage(result.envelope, result.body);
+		let decoded;
+		try {
+			decoded = await codec.decodeRequest(input);
+		} catch (error) {
+			if (!(error instanceof HttpParseError)) throw error;
+			yield* encodeErrorResponse(error.codec ?? codec, error, "GET", 400, "Bad Request");
+			return;
+		}
+		const replyCodec = decoded.codec ?? codec;
+		let result;
+		try {
+			result = await handler(decoded.envelope, decoded.body);
+		} catch (error) {
+			yield* encodeErrorResponse(replyCodec, error, decoded.envelope.method);
+			return;
+		}
+		yield* replyCodec.encodeResponse(result.envelope, result.body, { method: decoded.envelope.method });
+	};
+}
+//#endregion
+//#region src/request-streams.ts
+/**
+* The one place that knows a runtime may not implement request body streams,
+* and the buffering both fallbacks need. `fetch.ts` and `http-stubs.ts` each
+* carry a client and a server direction that must agree on the answer, so the
+* predicate lives here rather than being written out four times.
+*/
+/**
+* Whether `Request.prototype` exposes a `body` accessor. Two call sites read
+* that property, and two more depend on the constructor accepting a
+* `ReadableStream` as `init.body`; this predicate answers for all four.
+*
+* What was verified, and all that is claimed here: Firefox (146 at the time of
+* writing) has *neither*, and Chromium and Node have *both*. On Firefox it is
+* not that `body` is `undefined` on the instance —
+* `Object.getOwnPropertyDescriptor(Request.prototype, "body")` is `null`, the
+* accessor is genuinely absent — and because a `ReadableStream` is then not a
+* recognised `BodyInit`, the constructor falls through to the string branch and
+* stores the literal text `[object ReadableStream]`.
+*
+* The two halves are NOT guaranteed to ship together, so do not read this as a
+* test for "request streams" in general. Safari is the counterexample: it has
+* had `Request.body` since 11.1 but only accepts a stream as `init.body` from
+* Technology Preview 250, so a shipping Safari has the reader half without the
+* upload half and this returns `true` there. That looks benign — WebKit appears
+* to store the stream on the `Request` rather than stringify it, and its error
+* comes from `fetch()`, which this package never calls on the objects it builds
+* — but it is untested, and it is the case to look at first if a Safari report
+* arrives. The sharper probe, if one is ever needed, is whether
+* `new Request(url, {method:"POST", body:new ReadableStream(), duplex:"half"})`
+* has a `content-type` of `text/plain;charset=UTF-8` (stringified) or `null`
+* (stored); it is not used here because it costs a `Request` and a
+* `ReadableStream` per call and agrees with the descriptor check on every
+* runtime measured.
+*
+* A capability check, never a user-agent test: the question is what this
+* runtime does, and the answer flips on its own the day Firefox ships request
+* streams. Evaluated per call rather than cached at module load so that a test
+* can install a `Request` without the capability and exercise the real branch
+* under Node.
+*/
+function supportsRequestStreams() {
+	return typeof Request === "function" && Object.getOwnPropertyDescriptor(Request.prototype, "body") != null;
+}
+/**
+* Drain a body iterable into one contiguous buffer. Only the fallbacks need it.
+* Allocates its own buffer rather than reusing `bytes.ts`'s `concatChunks`,
+* which passes a single chunk straight through: that chunk is a view onto the
+* decoder's own read buffer, and the result here is handed to `new Request` and
+* outlives the decode. The allocation is also what makes it a
+* `Uint8Array<ArrayBuffer>`, which `BodyInit` accepts and the looser
+* `Uint8Array<ArrayBufferLike>` does not.
+*/
+async function collectBytes(source) {
+	const parts = [];
+	let total = 0;
+	for await (const chunk of source) {
+		if (chunk.byteLength === 0) continue;
+		parts.push(chunk);
+		total += chunk.byteLength;
+	}
+	const out = new Uint8Array(total);
+	let offset = 0;
+	for (const part of parts) {
+		out.set(part, offset);
+		offset += part.byteLength;
+	}
+	return out;
+}
+//#endregion
+//#region src/http-stubs.ts
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([
+	101,
+	103,
+	204,
+	205,
+	304
+]);
+const REQUEST_FIELDS = [
+	"url",
+	"method",
+	"mode",
+	"credentials",
+	"cache",
+	"redirect",
+	"referrer",
+	"referrerPolicy",
+	"integrity",
+	"keepalive"
+];
+/** `SerializedHttpEnvelope.content` is never absent, only empty. */
+async function* noBytes() {}
+async function* oneChunk(chunk) {
+	yield chunk;
+}
+/**
+* Returns an HTTP handler that serializes a Request, hands the envelope to
+* `send` for transport, and deserializes the reply into a Response. Used on
+* the caller side.
+*/
+function newHttpClientStub(send) {
+	return async (requestOrPromise) => {
+		const request = await requestOrPromise;
+		const headers = [...request.headers].map(([k, v]) => [k, v]);
+		const options = {
+			url: request.url,
+			headers
+		};
+		for (const field of REQUEST_FIELDS) {
+			const val = request[field];
+			if (val !== void 0 && field !== "url") options[field] = val;
+		}
+		let content;
+		if (request.body != null) content = fromReadableStream(request.body);
+		else if (!supportsRequestStreams()) content = oneChunk(new Uint8Array(await request.arrayBuffer()));
+		else content = noBytes();
+		const result = await send({
+			options,
+			content
+		});
+		if (!result) return new Response(null, {
+			status: 404,
+			statusText: "Error 404: Not Found"
+		});
+		const responseOptions = result.options;
+		const method = options.method;
+		if (method === "HEAD" || method === "OPTIONS" || NULL_BODY_STATUSES.has(responseOptions.status)) {
+			await discard(result.content);
+			return new Response(null, responseOptions);
+		}
+		return new Response(toReadableStream(result.content[Symbol.asyncIterator]()), responseOptions);
+	};
+}
+/**
+* Returns a server-side transport handler. It deserializes the incoming
+* request envelope, delegates to `handler`, and serializes the response.
+*/
+function newHttpServerStub(handler) {
+	return async (envelopeOrPromise) => {
+		const { options, content } = await envelopeOrPromise;
+		const { url, method, headers = [], ...rest } = options;
+		const { mode: _mode, ...forwardable } = rest;
+		const requestHeaders = new Headers();
+		for (const [key, value] of headers) requestHeaders.append(key, value);
+		const hasBody = method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
+		const requestInit = {
+			...forwardable,
+			method,
+			headers: requestHeaders
+		};
+		if (!hasBody) await discard(content);
+		else if (supportsRequestStreams()) {
+			requestInit.body = toReadableStream(content[Symbol.asyncIterator]());
+			requestInit.duplex = "half";
+		} else requestInit.body = await collectBytes(content);
+		const response = await handler(new Request(url, requestInit));
+		return {
+			options: {
+				status: response.status,
+				statusText: response.statusText,
+				headers: Object.fromEntries([...response.headers])
+			},
+			content: response.body ? fromReadableStream(response.body) : (async function* () {})()
+		};
 	};
 }
 //#endregion
 //#region src/fetch.ts
+/**
+* Connection-scoped headers. The codec surfaces them verbatim (decision 12),
+* but they are meaningless to a `Request`/`Response`, and re-emitting them
+* from a relay would corrupt its framing.
+*/
+const HOP_BY_HOP = /* @__PURE__ */ new Set([
+	"connection",
+	"host",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+function forwardableHeaders(headers) {
+	return headers.filter(([name]) => !HOP_BY_HOP.has(name.toLowerCase()));
+}
 function headersToArray(headers) {
 	const out = [];
 	headers.forEach((value, key) => {
@@ -164,43 +1127,65 @@ function asyncIterableToReadable(iter) {
 * the other side. The request's `signal` is plumbed into the body iteration —
 * abort terminates the underlying call.
 */
-async function fetchOverDuplex(call, request) {
+async function fetchOverDuplex(call, request, options = {}) {
 	if (request.signal?.aborted) throw abortReason(request.signal);
-	const { envelope, body: respBody } = await httpFetch(call, {
+	const env = {
 		url: request.url,
 		method: request.method,
 		headers: headersToArray(request.headers)
-	}, request.body ? readableToAsyncIterable(request.body) : void 0);
-	return new Response(asyncIterableToReadable(withAbort(respBody, request.signal)), {
+	};
+	let body;
+	if (request.body != null) body = readableToAsyncIterable(request.body);
+	else if (!supportsRequestStreams()) {
+		const buffered = new Uint8Array(await request.arrayBuffer());
+		if (buffered.byteLength > 0) body = [buffered];
+	}
+	const { envelope, body: respBody } = await httpFetch(call, env, body, options);
+	const responseInit = {
 		status: envelope.status,
 		statusText: envelope.statusText,
-		headers: envelope.headers
-	});
+		headers: forwardableHeaders(envelope.headers)
+	};
+	if (request.method === "HEAD" || request.method === "OPTIONS" || NULL_BODY_STATUSES.has(envelope.status)) {
+		await respBody.return?.();
+		return new Response(null, responseInit);
+	}
+	return new Response(asyncIterableToReadable(withAbort(respBody, request.signal)), responseInit);
 }
 /**
 * Wrap a `(Request) => Promise<Response>` handler as a `Duplex` so it can be
 * registered with any `webrun-streams-*` adapter's `serve`.
 */
-function serveFetchOverDuplex(handler) {
+function serveFetchOverDuplex(handler, options = {}) {
 	return httpServe(async (env, body) => {
 		const reqInit = {
 			method: env.method,
-			headers: env.headers
+			headers: forwardableHeaders(env.headers)
 		};
 		if (env.method !== "GET" && env.method !== "HEAD") {
-			reqInit.body = asyncIterableToReadable(body);
-			reqInit.duplex = "half";
+			if (supportsRequestStreams()) {
+				reqInit.body = asyncIterableToReadable(body);
+				reqInit.duplex = "half";
+			} else reqInit.body = await collectBytes(body);
 		}
 		const response = await handler(new Request(env.url, reqInit));
+		const respEnv = {
+			status: response.status,
+			statusText: response.statusText,
+			headers: headersToArray(response.headers)
+		};
+		if (env.method === "HEAD" || env.method === "OPTIONS" || NULL_BODY_STATUSES.has(response.status)) {
+			await response.body?.cancel();
+			return {
+				envelope: respEnv,
+				body: void 0
+			};
+		}
 		return {
-			envelope: {
-				status: response.status,
-				statusText: response.statusText,
-				headers: headersToArray(response.headers)
-			},
+			envelope: respEnv,
 			body: response.body ? readableToAsyncIterable(response.body) : void 0
 		};
-	});
+	}, options);
 }
 async function* withAbort(iter, signal) {
 	if (!signal) {
@@ -228,7 +1213,7 @@ function abortReason(signal) {
 * ```ts
 * import { SiteBuilder } from "@statewalker/webrun-site-builder";
 * import { DuplexSiteBuilder } from "@statewalker/webrun-http-streams";
-* import { serve } from "@statewalker/webrun-streams-port";
+* import { serve } from "@statewalker/webrun-rpc";
 *
 * const handler = new SiteBuilder()
 *   .setEndpoint("/api/time", () => new Response(new Date().toISOString()))
@@ -243,14 +1228,20 @@ function abortReason(signal) {
 */
 var DuplexSiteBuilder = class {
 	#handler;
+	#codec;
 	setHandler(handler) {
 		this.#handler = handler;
 		return this;
 	}
+	/** Pin the wire format. Defaults to HTTP/1.1 with legacy acceptance. */
+	setCodec(codec) {
+		this.#codec = codec;
+		return this;
+	}
 	async start(serve, params) {
 		if (!this.#handler) throw new Error("DuplexSiteBuilder.start: setHandler(handler) must be called before start()");
 		const handler = this.#handler;
-		return serve(params, serveFetchOverDuplex(async (req) => handler(req)));
+		return serve(params, serveFetchOverDuplex(async (req) => handler(req), { codec: this.#codec }));
 	}
 };
 //#endregion
@@ -278,10 +1269,11 @@ var HttpError = class HttpError extends Error {
 	}
 	static fromError(error) {
 		if (error instanceof HttpError) return error;
+		const message = error instanceof Error ? error.message : String(error);
 		return new HttpError({
 			status: 500,
 			statusText: "Bad Request",
-			message: error instanceof Error ? error.message : String(error)
+			message
 		});
 	}
 	static errorResourceNotFound(options = {}) {
@@ -314,94 +1306,4 @@ var HttpError = class HttpError extends Error {
 	}
 };
 //#endregion
-//#region src/http-stubs.ts
-const NULL_BODY_STATUSES = new Set([
-	101,
-	103,
-	204,
-	205,
-	304
-]);
-const REQUEST_FIELDS = [
-	"url",
-	"method",
-	"mode",
-	"credentials",
-	"cache",
-	"redirect",
-	"referrer",
-	"referrerPolicy",
-	"integrity",
-	"keepalive"
-];
-/**
-* Returns an HTTP handler that serializes a Request, hands the envelope to
-* `send` for transport, and deserializes the reply into a Response. Used on
-* the caller side.
-*/
-function newHttpClientStub(send) {
-	return async (requestOrPromise) => {
-		const request = await requestOrPromise;
-		const headers = [...request.headers].map(([k, v]) => [k, v]);
-		const options = {
-			url: request.url,
-			headers
-		};
-		for (const field of REQUEST_FIELDS) {
-			const val = request[field];
-			if (val !== void 0 && field !== "url") options[field] = val;
-		}
-		const result = await send({
-			options,
-			content: request.body ? fromReadableStream(request.body) : (async function* () {})()
-		});
-		if (!result) return new Response(null, {
-			status: 404,
-			statusText: "Error 404: Not Found"
-		});
-		const responseOptions = result.options;
-		const method = options.method;
-		if (method === "HEAD" || method === "OPTIONS" || NULL_BODY_STATUSES.has(responseOptions.status)) {
-			await result.content.return?.();
-			return new Response(null, responseOptions);
-		}
-		return new Response(toReadableStream(result.content[Symbol.asyncIterator]()), responseOptions);
-	};
-}
-/**
-* Returns a server-side transport handler. It deserializes the incoming
-* request envelope, delegates to `handler`, and serializes the response.
-*/
-function newHttpServerStub(handler) {
-	return async (envelopeOrPromise) => {
-		const { options, content } = await envelopeOrPromise;
-		const { url, method, headers = [], ...rest } = options;
-		const { mode: _mode, ...forwardable } = rest;
-		const requestHeaders = new Headers();
-		for (const [key, value] of headers) requestHeaders.append(key, value);
-		const hasBody = method !== "GET" && method !== "HEAD" && method !== "OPTIONS";
-		let body;
-		if (hasBody) body = toReadableStream(content[Symbol.asyncIterator]());
-		else await content.return?.();
-		const requestInit = {
-			...forwardable,
-			method,
-			headers: requestHeaders
-		};
-		if (hasBody) {
-			requestInit.body = body;
-			requestInit.duplex = "half";
-		}
-		const response = await handler(new Request(url, requestInit));
-		return {
-			options: {
-				status: response.status,
-				statusText: response.statusText,
-				headers: Object.fromEntries([...response.headers])
-			},
-			content: response.body ? fromReadableStream(response.body) : (async function* () {})()
-		};
-	};
-}
-//#endregion
-export { DuplexSiteBuilder, HttpError, decodeMessage, encodeMessage, fetchOverDuplex, httpFetch, httpServe, newHttpClientStub, newHttpServerStub, serveFetchOverDuplex };
+export { DuplexSiteBuilder, HttpError, HttpParseError, PEER_ERROR_HEADER, decodeMessage, defaultCodec, encodeMessage, fetchOverDuplex, httpCodec, httpFetch, httpServe, jsonEnvelopeCodec, newHttpClientStub, newHttpCodec, newHttpServerStub, newSniffingCodec, serveFetchOverDuplex };