@vouchington/edge 0.0.0-stage → 0.1.0

package/dist/client-info.mjs

@@ -0,0 +1,63 @@
+const FETCH_METADATA_HEADERS = ['sec-fetch-site', 'sec-fetch-mode', 'sec-fetch-dest'];
+const SAFE_NAVIGATION_METHODS = new Set(['GET', 'HEAD']);
+// Browsers send this Origin on same-origin requests made under a no-referrer policy.
+const NO_REFERRER_ORIGIN = 'null';
+export function hasBrowserFetchMetadata(headers) {
+    return FETCH_METADATA_HEADERS.some((name) => headers.has(name));
+}
+/**
+ * Browser evidence that a request came from the web app on this origin, or from a top-level
+ * navigation. Forgeable by non-browser callers, so it only classifies telemetry.
+ */
+export function isWebBrowserRequest(headers, request) {
+    if (isTopLevelNavigation(headers, request.method))
+        return true;
+    if (headers.get('sec-fetch-site')?.toLowerCase() !== 'same-origin')
+        return false;
+    const origin = headers.get('origin');
+    const referer = headers.get('referer');
+    return ((origin === null ||
+        origin === NO_REFERRER_ORIGIN ||
+        parseOrigin(origin) === request.requestOrigin) &&
+        (referer === null || parseOrigin(referer) === request.requestOrigin));
+}
+function isTopLevelNavigation(headers, method) {
+    return (SAFE_NAVIGATION_METHODS.has(method.toUpperCase()) &&
+        headers.get('sec-fetch-mode')?.toLowerCase() === 'navigate' &&
+        headers.get('sec-fetch-dest')?.toLowerCase() === 'document');
+}
+function parseOrigin(value) {
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Normalizes client-identification headers before forwarding. Synthetic traffic gets only the
+ * request-kind header; browser-evidenced traffic gets the injected web headers; anything else
+ * keeps non-web client headers and loses forged web claims.
+ */
+export function applyClientInfoHeaders(headers, policy, options) {
+    const clear = () => {
+        for (const name of policy.clientInfoHeaderNames)
+            headers.delete(name);
+    };
+    headers.delete(policy.requestKindHeader);
+    if (options.requestKind) {
+        clear();
+        headers.set(policy.requestKindHeader, options.requestKind);
+        return;
+    }
+    if (!hasBrowserFetchMetadata(headers)) {
+        if (headers.get(policy.webClientHeader.name) === policy.webClientHeader.value)
+            clear();
+        return;
+    }
+    clear();
+    if (!isWebBrowserRequest(headers, options))
+        return;
+    for (const [name, value] of Object.entries(policy.webClientHeaders))
+        headers.set(name, value);
+}

package/dist/cookies.d.mts

@@ -0,0 +1,9 @@
+import { parseCookies } from '@vouchington/utils/cookies';
+export { parseCookies };
+/**
+ * Sets cookies in a request `cookie` header value. `validate` runs per replacement and should
+ * throw for values that are unsafe to forward.
+ */
+export declare function replaceCookies(cookieHeader: string | null | undefined, replacements: Readonly<Record<string, string | undefined>>, validate?: (name: string, value: string) => void): string;
+/** Removes named cookies; returns null when no cookie remains. */
+export declare function stripCookies(cookieHeader: string | null | undefined, cookieNamesToStrip: Iterable<string>): string | null;

package/dist/cookies.mjs

@@ -0,0 +1,26 @@
+import { parseCookies } from '@vouchington/utils/cookies';
+export { parseCookies };
+function serialize(cookies) {
+    return [...cookies.entries()].map(([name, value]) => `${name}=${value}`).join('; ');
+}
+/**
+ * Sets cookies in a request `cookie` header value. `validate` runs per replacement and should
+ * throw for values that are unsafe to forward.
+ */
+export function replaceCookies(cookieHeader, replacements, validate) {
+    const cookies = parseCookies(cookieHeader);
+    for (const [name, value] of Object.entries(replacements)) {
+        if (value === undefined)
+            continue;
+        validate?.(name, value);
+        cookies.set(name, value);
+    }
+    return serialize(cookies);
+}
+/** Removes named cookies; returns null when no cookie remains. */
+export function stripCookies(cookieHeader, cookieNamesToStrip) {
+    const cookies = parseCookies(cookieHeader);
+    for (const name of cookieNamesToStrip)
+        cookies.delete(name);
+    return cookies.size === 0 ? null : serialize(cookies);
+}

package/dist/csp.d.mts

@@ -0,0 +1,32 @@
+export type CspDirectives = Record<string, readonly string[]>;
+export type CspOptions = {
+    /** Per-request nonce; adds `'nonce-…'` to `script-src` when set. */
+    nonce?: string;
+    /** `false` enables the development relaxations (`'unsafe-eval'`, `http:` images). */
+    production?: boolean;
+    /** Static-asset origin (see {@link normalizeAssetOrigin}) added to script, style, img, font, connect. */
+    assetOrigin?: string;
+    /** Extra sources appended to a directive, e.g. analytics or captcha origins. */
+    sources?: Readonly<Record<string, readonly string[]>>;
+    /** Whole-directive replacements; `null` removes a directive. Applied before `sources`. */
+    directives?: Readonly<Record<string, readonly string[] | null>>;
+};
+export declare const DEFAULT_CSP_DIRECTIVES: Readonly<CspDirectives>;
+/**
+ * Normalizes an asset origin from configuration. Accepts `https:` origins and
+ * `http://localhost`; strips path, query, and hash so a stray character cannot alter the policy.
+ * Returns an empty string for absent or invalid values.
+ */
+export declare function normalizeAssetOrigin(raw?: string): string;
+/**
+ * Parses a JSON array of exact HTTPS origins (for example upload hosts). Throws on any malformed,
+ * duplicate, non-origin, or disallowed entry so a bad deployment value fails loudly.
+ */
+export declare function parseOriginAllowlist(raw: string | undefined, options?: {
+    isAllowedHostname?: (hostname: string) => boolean;
+    label?: string;
+}): string[];
+/** Serializes directives as a header value, rejecting sources that could inject a directive. */
+export declare function serializeCsp(directives: Readonly<Record<string, readonly string[]>>): string;
+/** Builds a nonce-based CSP from safe defaults plus injected origins. */
+export declare function buildCsp(options?: CspOptions): string;

package/dist/csp.mjs

@@ -0,0 +1,113 @@
+export const DEFAULT_CSP_DIRECTIVES = {
+    'default-src': ["'self'"],
+    'script-src': ["'self'"],
+    'style-src': ["'self'", "'unsafe-inline'"],
+    'img-src': ["'self'", 'data:', 'blob:', 'https:'],
+    'font-src': ["'self'"],
+    'frame-src': ["'self'"],
+    'media-src': ["'self'", 'https:', 'blob:'],
+    'connect-src': ["'self'"],
+    'object-src': ["'none'"],
+    'base-uri': ["'self'"],
+    'form-action': ["'self'"],
+    'frame-ancestors': ["'self'"],
+};
+const ASSET_DIRECTIVES = ['script-src', 'style-src', 'img-src', 'font-src', 'connect-src'];
+const UNSAFE_SOURCE = /[\s;,]/u;
+/**
+ * Normalizes an asset origin from configuration. Accepts `https:` origins and
+ * `http://localhost`; strips path, query, and hash so a stray character cannot alter the policy.
+ * Returns an empty string for absent or invalid values.
+ */
+export function normalizeAssetOrigin(raw) {
+    const trimmed = raw?.trim() ?? '';
+    if (!trimmed)
+        return '';
+    try {
+        const url = new URL(trimmed);
+        if (url.protocol === 'https:')
+            return url.origin;
+        if (url.protocol === 'http:' && url.hostname === 'localhost')
+            return url.origin;
+        return '';
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Parses a JSON array of exact HTTPS origins (for example upload hosts). Throws on any malformed,
+ * duplicate, non-origin, or disallowed entry so a bad deployment value fails loudly.
+ */
+export function parseOriginAllowlist(raw, options = {}) {
+    const fail = () => {
+        throw new Error(`${options.label ?? 'Origin allowlist'} must contain exact HTTPS origins`);
+    };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw ?? '');
+    }
+    catch {
+        return fail();
+    }
+    if (!Array.isArray(parsed) || parsed.length === 0)
+        return fail();
+    const origins = parsed.map((value) => {
+        if (typeof value !== 'string')
+            return fail();
+        try {
+            const url = new URL(value);
+            const allowed = options.isAllowedHostname?.(url.hostname) ?? true;
+            if (url.protocol === 'https:' && url.origin === value && allowed)
+                return value;
+        }
+        catch {
+            return fail();
+        }
+        return fail();
+    });
+    if (new Set(origins).size !== origins.length)
+        return fail();
+    return origins;
+}
+/** Serializes directives as a header value, rejecting sources that could inject a directive. */
+export function serializeCsp(directives) {
+    return Object.entries(directives)
+        .map(([name, sources]) => {
+        for (const source of sources) {
+            if (!source || UNSAFE_SOURCE.test(source)) {
+                throw new Error(`Invalid CSP source in ${name}: ${JSON.stringify(source)}`);
+            }
+        }
+        return [name, ...sources].join(' ');
+    })
+        .join('; ');
+}
+/** Builds a nonce-based CSP from safe defaults plus injected origins. */
+export function buildCsp(options = {}) {
+    const directives = {};
+    for (const [name, sources] of Object.entries(DEFAULT_CSP_DIRECTIVES))
+        directives[name] = [...sources];
+    const add = (name, extra) => {
+        directives[name] = [...(directives[name] ?? []), ...extra];
+    };
+    if (options.nonce)
+        add('script-src', [`'nonce-${options.nonce}'`]);
+    if (options.production === false) {
+        add('script-src', ["'unsafe-eval'"]);
+        add('img-src', ['http:']);
+    }
+    const assetOrigin = normalizeAssetOrigin(options.assetOrigin);
+    if (assetOrigin)
+        for (const name of ASSET_DIRECTIVES)
+            add(name, [assetOrigin]);
+    for (const [name, replacement] of Object.entries(options.directives ?? {})) {
+        if (replacement === null)
+            delete directives[name];
+        else
+            directives[name] = [...replacement];
+    }
+    for (const [name, extra] of Object.entries(options.sources ?? {}))
+        add(name, extra);
+    return serializeCsp(directives);
+}

package/dist/env-validation.d.mts

@@ -0,0 +1,42 @@
+export type EnvWarner = (key: string, message: string, level?: 'error' | 'warn') => void;
+/**
+ * Creates a warn-once reporter. Create it at module scope so each isolate logs a given key once
+ * instead of on every request.
+ */
+export declare function createEnvWarner(log?: {
+    error: (message: string) => void;
+    warn: (message: string) => void;
+}): EnvWarner;
+/** Anything truthy other than `false` is production, so ambiguous values fail closed. */
+export declare function isProductionMode(env: {
+    PRODUCTION?: string;
+}): boolean;
+/** True when `PRODUCTION` is set to something other than exactly `true` or `false`. */
+export declare function isProductionValueInvalid(env: {
+    PRODUCTION?: string;
+}): boolean;
+export declare function isSecretValid(value: string | undefined, minLength: number): value is string;
+export declare function warnIfProductionValueInvalid(warn: EnvWarner, env: {
+    PRODUCTION?: string;
+}): void;
+export type SecretRequirement = {
+    /** Binding name used in messages and as the warn-once key. */
+    name: string;
+    value: string | undefined;
+    minLength: number;
+    /** Appended after the dash when the secret is missing or empty. */
+    missingConsequence: string;
+    /** Appended after the dash when the secret is shorter than `minLength`. */
+    shortConsequence?: string;
+    generateHint?: string;
+};
+/** Warns once when a required secret is absent, or present but too short. */
+export declare function warnIfSecretMisconfigured(warn: EnvWarner, secret: SecretRequirement): void;
+/** Warns once when an asset-origin binding is set but would be dropped by `normalizeAssetOrigin`. */
+export declare function warnIfAssetOriginInvalid(warn: EnvWarner, name: string, value?: string): void;
+/** Warns once when a DSN binding is present but unparseable, or absent while `required`. */
+export declare function warnIfDsnInvalid(warn: EnvWarner, binding: {
+    name: string;
+    value: string | undefined;
+    required?: boolean;
+}): void;

package/dist/env-validation.mjs

@@ -0,0 +1,58 @@
+import { normalizeAssetOrigin } from './csp.mjs';
+import { parseSentryDsn } from './sentry-dsn.mjs';
+/**
+ * Creates a warn-once reporter. Create it at module scope so each isolate logs a given key once
+ * instead of on every request.
+ */
+export function createEnvWarner(log = console) {
+    const emitted = new Set();
+    return (key, message, level = 'error') => {
+        if (emitted.has(key))
+            return;
+        emitted.add(key);
+        log[level](message);
+    };
+}
+/** Anything truthy other than `false` is production, so ambiguous values fail closed. */
+export function isProductionMode(env) {
+    const production = env.PRODUCTION?.toLowerCase();
+    return Boolean(production) && production !== 'false';
+}
+/** True when `PRODUCTION` is set to something other than exactly `true` or `false`. */
+export function isProductionValueInvalid(env) {
+    const production = env.PRODUCTION?.toLowerCase();
+    return Boolean(production) && production !== 'true' && production !== 'false';
+}
+export function isSecretValid(value, minLength) {
+    return value !== undefined && value.length >= minLength;
+}
+export function warnIfProductionValueInvalid(warn, env) {
+    if (!isProductionValueInvalid(env))
+        return;
+    warn('production-invalid', `PRODUCTION is set to '${env.PRODUCTION}' but must be exactly 'true' or 'false'; treating it as production mode so security controls fail closed`);
+}
+/** Warns once when a required secret is absent, or present but too short. */
+export function warnIfSecretMisconfigured(warn, secret) {
+    const hint = secret.generateHint ?? 'openssl rand -hex 32';
+    if (!secret.value) {
+        warn(`${secret.name}:missing`, `${secret.name} is not set or empty — ${secret.missingConsequence}; generate with: ${hint}`);
+    }
+    else if (secret.value.length < secret.minLength) {
+        const consequence = secret.shortConsequence ?? secret.missingConsequence;
+        warn(`${secret.name}:short`, `${secret.name} is too short (minimum ${secret.minLength} characters) — ${consequence}; generate with: ${hint}`);
+    }
+}
+/** Warns once when an asset-origin binding is set but would be dropped by `normalizeAssetOrigin`. */
+export function warnIfAssetOriginInvalid(warn, name, value) {
+    if (value?.trim() && !normalizeAssetOrigin(value)) {
+        warn(`${name}:invalid`, `${name} failed validation and will be ignored in CSP — static assets may be blocked. Value must be a valid https:// origin or http://localhost:<port> for local development.`);
+    }
+}
+/** Warns once when a DSN binding is present but unparseable, or absent while `required`. */
+export function warnIfDsnInvalid(warn, binding) {
+    if (parseSentryDsn(binding.value))
+        return;
+    if (binding.value === undefined && !binding.required)
+        return;
+    warn(`${binding.name}:dsn`, `${binding.name} is missing or not a valid Sentry DSN`, 'warn');
+}

package/dist/error-response.d.mts

@@ -0,0 +1,9 @@
+export declare const NO_STORE_HEADERS: {
+    readonly 'cache-control': 'no-store, max-age=0, must-revalidate';
+    readonly 'cdn-cache-control': 'no-store';
+    readonly 'cloudflare-cdn-cache-control': 'no-store';
+};
+/** JSON `{ message, code }` error that no cache layer will store. */
+export declare function edgeErrorResponse(status: number, message: string, code: string, headers?: Record<string, string>): Response;
+/** Returns 2xx/3xx unchanged; 4xx/5xx gain no-store headers with `set-cookie` preserved. */
+export declare function withFailureNoStoreHeaders(response: Response): Response;

package/dist/error-response.mjs

@@ -0,0 +1,19 @@
+import { withHeaders } from './headers.mjs';
+export const NO_STORE_HEADERS = {
+    'cache-control': 'no-store, max-age=0, must-revalidate',
+    'cdn-cache-control': 'no-store',
+    'cloudflare-cdn-cache-control': 'no-store',
+};
+/** JSON `{ message, code }` error that no cache layer will store. */
+export function edgeErrorResponse(status, message, code, headers) {
+    return new Response(JSON.stringify({ message, code }), {
+        status,
+        headers: { 'content-type': 'application/json', ...headers, ...NO_STORE_HEADERS },
+    });
+}
+/** Returns 2xx/3xx unchanged; 4xx/5xx gain no-store headers with `set-cookie` preserved. */
+export function withFailureNoStoreHeaders(response) {
+    if (response.status < 400)
+        return response;
+    return withHeaders(response, NO_STORE_HEADERS);
+}

package/dist/headers.d.mts

@@ -0,0 +1,8 @@
+/** Copies headers entry by entry so repeated `set-cookie` values survive. */
+export declare function copyHeaders(headers: Headers): Headers;
+/** Returns a response with `entries` set, replacing same-named headers and keeping `set-cookie`. */
+export declare function withHeaders(response: Response, entries: Record<string, string>): Response;
+/** Returns a response with `entries` appended after the existing headers. */
+export declare function appendHeaders(response: Response, entries: ReadonlyArray<readonly [string, string]>): Response;
+/** Deletes every named header in place. */
+export declare function deleteHeaders(headers: Headers, names: Iterable<string>): void;

package/dist/headers.mjs

@@ -0,0 +1,34 @@
+/** Copies headers entry by entry so repeated `set-cookie` values survive. */
+export function copyHeaders(headers) {
+    const copied = new Headers();
+    headers.forEach((value, key) => {
+        copied.append(key, value);
+    });
+    return copied;
+}
+function rebuild(response, headers) {
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+/** Returns a response with `entries` set, replacing same-named headers and keeping `set-cookie`. */
+export function withHeaders(response, entries) {
+    const headers = copyHeaders(response.headers);
+    for (const [key, value] of Object.entries(entries))
+        headers.set(key, value);
+    return rebuild(response, headers);
+}
+/** Returns a response with `entries` appended after the existing headers. */
+export function appendHeaders(response, entries) {
+    const headers = copyHeaders(response.headers);
+    for (const [key, value] of entries)
+        headers.append(key, value);
+    return rebuild(response, headers);
+}
+/** Deletes every named header in place. */
+export function deleteHeaders(headers, names) {
+    for (const name of names)
+        headers.delete(name);
+}

package/dist/index.d.mts

@@ -0,0 +1,19 @@
+export * from './basic-auth-credentials.mts';
+export * from './basic-auth.mts';
+export * from './cache-policy.mts';
+export * from './cache-url.mts';
+export * from './cache-vary.mts';
+export * from './cached-origin.mts';
+export * from './client-info.mts';
+export * from './cookies.mts';
+export * from './csp.mts';
+export * from './env-validation.mts';
+export * from './error-response.mts';
+export * from './headers.mts';
+export * from './nonce-rewrite.mts';
+export * from './origin-fetch.mts';
+export * from './proxy.mts';
+export * from './security-headers.mts';
+export * from './sentry-dsn.mts';
+export * from './sentry-tunnel.mts';
+export type { SentryTunnelDiagnosticDetails, SentryTunnelLog, SentryTunnelRejectReason, } from './sentry-tunnel-diagnostics.mts';

package/dist/index.mjs

@@ -0,0 +1,18 @@
+export * from './basic-auth-credentials.mjs';
+export * from './basic-auth.mjs';
+export * from './cache-policy.mjs';
+export * from './cache-url.mjs';
+export * from './cache-vary.mjs';
+export * from './cached-origin.mjs';
+export * from './client-info.mjs';
+export * from './cookies.mjs';
+export * from './csp.mjs';
+export * from './env-validation.mjs';
+export * from './error-response.mjs';
+export * from './headers.mjs';
+export * from './nonce-rewrite.mjs';
+export * from './origin-fetch.mjs';
+export * from './proxy.mjs';
+export * from './security-headers.mjs';
+export * from './sentry-dsn.mjs';
+export * from './sentry-tunnel.mjs';

package/dist/nonce-rewrite.d.mts

@@ -0,0 +1,14 @@
+export type NonceRewriteOptions = {
+    /**
+     * `<meta name="…">` tags removed from the rewritten HTML, for example trace-context tags that
+     * belong to the cache-fill request rather than the client that receives the cached bytes.
+     */
+    stripMetaNames?: readonly string[];
+};
+/**
+ * Streams an HTML response, replacing a cache placeholder nonce with a per-request nonce. Bounded
+ * tails keep replacements correct across chunk boundaries without buffering the document.
+ * The `content-security-policy` header is the caller's to rebuild with the real nonce.
+ */
+export declare function rewritePlaceholderNonce(response: Response, placeholderNonce: string, realNonce: string, options?: NonceRewriteOptions): Response;
+export declare function createNonceRewriteStream(placeholderNonce: string, realNonce: string, options?: NonceRewriteOptions): TransformStream<Uint8Array, Uint8Array>;

package/dist/nonce-rewrite.mjs

@@ -0,0 +1,104 @@
+const MAX_META_TAG_CHARS = 16 * 1024;
+const OUTPUT_BATCH_CHARS = 16 * 1024;
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&');
+}
+/**
+ * Streams an HTML response, replacing a cache placeholder nonce with a per-request nonce. Bounded
+ * tails keep replacements correct across chunk boundaries without buffering the document.
+ * The `content-security-policy` header is the caller's to rebuild with the real nonce.
+ */
+export function rewritePlaceholderNonce(response, placeholderNonce, realNonce, options = {}) {
+    if (!response.body || !placeholderNonce || placeholderNonce === realNonce)
+        return response;
+    const headers = new Headers(response.headers);
+    // A byte transform cannot keep the wire length or encoding, so neither header stays valid.
+    headers.delete('content-encoding');
+    headers.delete('content-length');
+    return new Response(response.body.pipeThrough(createNonceRewriteStream(placeholderNonce, realNonce, options)), { status: response.status, statusText: response.statusText, headers });
+}
+export function createNonceRewriteStream(placeholderNonce, realNonce, options = {}) {
+    const decoder = new TextDecoder();
+    const encoder = new TextEncoder();
+    const names = options.stripMetaNames ?? [];
+    const metaTag = names.length === 0
+        ? undefined
+        : new RegExp(`^<meta\\s+name="(?:${names.map(escapeRegExp).join('|')})"[^>]*>$`, 'iu');
+    let controller;
+    let nonceCandidate = '';
+    let metaCandidate = '';
+    let outputBuffer = '';
+    const flushOutput = () => {
+        if (!outputBuffer)
+            return;
+        controller.enqueue(encoder.encode(outputBuffer));
+        outputBuffer = '';
+    };
+    const appendOutput = (output) => {
+        outputBuffer += output;
+        if (outputBuffer.length >= OUTPUT_BATCH_CHARS)
+            flushOutput();
+    };
+    const appendMetaFiltered = (text) => {
+        for (const char of text) {
+            if (!metaTag) {
+                appendOutput(char);
+            }
+            else if (!metaCandidate) {
+                if (char === '<')
+                    metaCandidate = char;
+                else
+                    appendOutput(char);
+            }
+            else {
+                metaCandidate += char;
+                const lower = metaCandidate.toLowerCase();
+                if ('<meta'.startsWith(lower))
+                    continue;
+                if (!lower.startsWith('<meta') || metaCandidate.length > MAX_META_TAG_CHARS) {
+                    appendOutput(metaCandidate);
+                    metaCandidate = '';
+                }
+                else if (char === '>') {
+                    if (!metaTag.test(metaCandidate))
+                        appendOutput(metaCandidate);
+                    metaCandidate = '';
+                }
+            }
+        }
+    };
+    const longestPlaceholderPrefix = (value) => {
+        const max = Math.min(value.length, placeholderNonce.length - 1);
+        for (let length = max; length > 0; length -= 1) {
+            if (value.endsWith(placeholderNonce.slice(0, length)))
+                return length;
+        }
+        return 0;
+    };
+    const appendNonceRewritten = (text) => {
+        for (const char of text) {
+            const candidate = nonceCandidate + char;
+            if (candidate === placeholderNonce) {
+                appendMetaFiltered(realNonce);
+                nonceCandidate = '';
+                continue;
+            }
+            const prefixLength = longestPlaceholderPrefix(candidate);
+            appendMetaFiltered(candidate.slice(0, candidate.length - prefixLength));
+            nonceCandidate = candidate.slice(candidate.length - prefixLength);
+        }
+    };
+    return new TransformStream({
+        transform(chunk, ctl) {
+            controller = ctl;
+            appendNonceRewritten(decoder.decode(chunk, { stream: true }));
+        },
+        flush(ctl) {
+            controller = ctl;
+            appendNonceRewritten(decoder.decode());
+            appendMetaFiltered(nonceCandidate);
+            appendOutput(metaCandidate);
+            flushOutput();
+        },
+    });
+}

package/dist/origin-fetch.d.mts

@@ -0,0 +1,21 @@
+export declare const DROPPED_SOCKET_PATTERN: RegExp;
+export type OriginFetchOptions = {
+    /** Defaults to global `fetch`; inject a service binding's fetch or a test double. */
+    fetch?: (request: Request) => Promise<Response>;
+    /** Receives the final error before the 502 is produced. */
+    onError?: (error: unknown) => void;
+    /** Overrides which errors are safe to retry once on a fresh connection. */
+    isRetryable?: (error: unknown) => boolean;
+};
+export type OriginFetchResult = {
+    duration: number;
+    response: Response;
+} | {
+    error: Response;
+};
+/**
+ * Fetches an origin request. GET and HEAD are retried once after a dropped socket; mutating
+ * methods are single-attempt because a lost response may already have been applied. Failures
+ * become a no-store 502 under `error`.
+ */
+export declare function fetchOriginResponse(originRequest: Request, options?: OriginFetchOptions): Promise<OriginFetchResult>;

package/dist/origin-fetch.mjs

@@ -0,0 +1,36 @@
+import { edgeErrorResponse } from './error-response.mjs';
+const IDEMPOTENT_METHODS = new Set(['GET', 'HEAD']);
+export const DROPPED_SOCKET_PATTERN = /network connection lost|connection reset by peer|ECONNRESET|ECONNREFUSED|EPIPE|UND_ERR_SOCKET/i;
+function isDroppedSocket(error) {
+    return error instanceof Error && DROPPED_SOCKET_PATTERN.test(error.message);
+}
+/**
+ * Fetches an origin request. GET and HEAD are retried once after a dropped socket; mutating
+ * methods are single-attempt because a lost response may already have been applied. Failures
+ * become a no-store 502 under `error`.
+ */
+export async function fetchOriginResponse(originRequest, options = {}) {
+    const send = options.fetch ?? fetch;
+    const isRetryable = options.isRetryable ?? isDroppedSocket;
+    const start = Date.now();
+    const canRetry = IDEMPOTENT_METHODS.has(originRequest.method.toUpperCase());
+    const failure = (error) => {
+        options.onError?.(error);
+        return { error: edgeErrorResponse(502, 'Bad Gateway', 'BAD_GATEWAY') };
+    };
+    // Clone first so a retry still has an unread request.
+    const firstRequest = canRetry ? originRequest.clone() : originRequest;
+    try {
+        return { duration: Date.now() - start, response: await send(firstRequest) };
+    }
+    catch (error) {
+        if (!canRetry || !isRetryable(error))
+            return failure(error);
+    }
+    try {
+        return { duration: Date.now() - start, response: await send(originRequest) };
+    }
+    catch (error) {
+        return failure(error);
+    }
+}