@zudojs/http 0.1.0 → 1.1.0

package/dist/httpMultipart/http.multipart.js

@@ -4,8 +4,25 @@ import { randomUUID } from "node:crypto";
 /* -------------------------------------------------------------------------- */
 export const DEFAULT_MULTIPART_LIMIT = 10 * 1024 * 1024;
 export const DEFAULT_MULTIPART_FILE_LIMIT = 10 * 1024 * 1024;
+export const DEFAULT_MULTIPART_FIELD_LIMIT = 1024 * 1024;
 export const DEFAULT_MULTIPART_MAX_FILES = 20;
 export const DEFAULT_MULTIPART_MAX_FIELDS = 100;
+/**
+ * Hard cap on the number of parts scanned out of one body, applied before any
+ * part is decoded so a body made entirely of empty delimiters cannot allocate
+ * without bound.
+ */
+export const DEFAULT_MULTIPART_MAX_PARTS = 1000;
+/**
+ * Longest filename retained after sanitisation, in bytes.
+ *
+ * `NAME_MAX` is 255 on every mainstream filesystem; a longer name produces an
+ * `ENAMETOOLONG` that most upload handlers turn into a 500.
+ */
+export const MAX_FILENAME_BYTES = 255;
+const CRLF = Buffer.from("\r\n", "utf8");
+const CRLF_CRLF = Buffer.from("\r\n\r\n", "utf8");
+const LF_LF = Buffer.from("\n\n", "utf8");
 /* -------------------------------------------------------------------------- */
 /* Multipart Parser                                                           */
 /* -------------------------------------------------------------------------- */
@@ -21,45 +38,86 @@ export async function parseMultipart(request, options = {}) {
 /* -------------------------------------------------------------------------- */
 /* Buffer Parser                                                              */
 /* -------------------------------------------------------------------------- */
-export function parseMultipartBuffer(body, boundary, options = {}) {
+/**
+ * Splits a multipart body into its parts.
+ *
+ * The delimiter is matched only where RFC 2046 §5.1.1 allows one — at the
+ * very start of the body, or immediately after a CRLF — so a `--boundary`
+ * sequence occurring inside a part's content cannot forge a new part or
+ * truncate the body. A body whose closing delimiter is missing is rejected
+ * rather than silently treated as complete.
+ */
+export function parseMultipartParts(body, boundary, options = {}) {
     validateBoundary(boundary);
+    const maxParts = options.maxParts ?? DEFAULT_MULTIPART_MAX_PARTS;
+    const encoding = options.encoding ?? "utf8";
+    const delimiter = Buffer.from(`--${boundary}`, "utf8");
+    const crlfDelimiter = Buffer.concat([CRLF, delimiter]);
+    let cursor = findOpeningDelimiter(body, delimiter, crlfDelimiter);
+    const parts = [];
+    let closed = false;
+    while (cursor <= body.length) {
+        if (body[cursor] === 45 && body[cursor + 1] === 45) {
+            closed = true;
+            break;
+        }
+        const contentStart = skipDelimiterEOL(body, cursor);
+        const next = body.indexOf(crlfDelimiter, contentStart);
+        if (next === -1) {
+            throw new MultipartParseError("Multipart closing delimiter was not found.");
+        }
+        if (parts.length >= maxParts) {
+            throw new MultipartLimitError("Maximum number of multipart parts exceeded.");
+        }
+        const parsed = parseMultipartPart(body.subarray(contentStart, next), encoding, options.allowUnnamedParts === true);
+        if (parsed) {
+            parts.push(parsed);
+        }
+        cursor = next + crlfDelimiter.length;
+    }
+    if (!closed) {
+        throw new MultipartParseError("Multipart closing delimiter was not found.");
+    }
+    return parts;
+}
+export function parseMultipartBuffer(body, boundary, options = {}) {
     const maxFileSize = options.maxFileSize ?? DEFAULT_MULTIPART_FILE_LIMIT;
+    const maxFieldSize = options.maxFieldSize ?? DEFAULT_MULTIPART_FIELD_LIMIT;
     const maxFiles = options.maxFiles ?? DEFAULT_MULTIPART_MAX_FILES;
     const maxFields = options.maxFields ?? DEFAULT_MULTIPART_MAX_FIELDS;
-    const fields = {};
+    /*
+     * A null-prototype container: a part named `__proto__` can neither replace
+     * the returned object's prototype nor be read back as an inherited member.
+     */
+    const fields = Object.create(null);
     const files = [];
-    const delimiter = Buffer.from(`--${boundary}`, "utf8");
-    const parts = splitMultipartBody(body, delimiter);
-    for (const part of parts) {
-        if (part.length === 0) {
-            continue;
-        }
-        const parsed = parseMultipartPart(part, options.encoding ?? "utf8");
-        if (!parsed) {
-            continue;
-        }
-        if (parsed.filename !== undefined) {
+    let fieldCount = 0;
+    for (const part of parseMultipartParts(body, boundary, options)) {
+        if (part.filename !== undefined) {
             if (files.length >= maxFiles) {
                 throw new MultipartLimitError("Maximum number of uploaded files exceeded.");
             }
-            if (parsed.body.length > maxFileSize) {
+            if (part.data.length > maxFileSize) {
                 throw new MultipartLimitError("Uploaded file exceeds the configured file size limit.");
             }
             files.push({
-                fieldName: parsed.name,
-                filename: sanitizeFilename(parsed.filename),
-                contentType: parsed.contentType ?? "application/octet-stream",
-                encoding: parsed.transferEncoding ?? "binary",
-                size: parsed.body.length,
-                data: parsed.body,
+                fieldName: part.name,
+                filename: sanitizeFilename(part.filename),
+                contentType: part.contentType ?? "application/octet-stream",
+                encoding: part.transferEncoding ?? "binary",
+                size: part.data.length,
+                data: part.data,
             });
             continue;
         }
-        if (countFields(fields) >= maxFields) {
+        fieldCount += 1;
+        if (fieldCount > maxFields) {
             throw new MultipartLimitError("Maximum number of multipart fields exceeded.");
         }
-        const value = parsed.body.toString(options.encoding ?? "utf8");
-        appendField(fields, parsed.name, value);
+        if (part.data.length > maxFieldSize) {
+            throw new MultipartLimitError("Multipart field exceeds the configured size limit.");
+        }
+        appendField(fields, part.name, part.data.toString(options.encoding ?? "utf8"));
     }
     return {
         fields,
@@ -111,6 +169,15 @@ async function readMultipartBody(request, limit) {
             if (settled) {
                 return;
             }
+            /*
+             * A body shorter than its declared Content-Length means the client
+             * stopped sending. Resolving it would hand a silently truncated upload
+             * to the caller as if it were complete.
+             */
+            if (contentLength !== undefined && total !== contentLength) {
+                fail(new MultipartParseError("Multipart request body length does not match Content-Length."));
+                return;
+            }
             settled = true;
             cleanup();
             resolve(Buffer.concat(chunks, total));
@@ -154,32 +221,49 @@ export function extractBoundary(contentType) {
     if (!contentType) {
         return undefined;
     }
-    const match = /(?:^|;)\s*boundary=(?:"([^"]+)"|([^;]+))/i.exec(contentType);
+    const match = /(?:^|;)\s*boundary=(?:"([^"]*)"|([^;]*))/i.exec(contentType);
     if (!match) {
         return undefined;
     }
-    return (match[1] ?? match[2])?.trim();
+    const boundary = (match[1] ?? match[2] ?? "").trim();
+    return boundary.length > 0 ? boundary : undefined;
 }
 function validateBoundary(boundary) {
     if (boundary.length === 0 || boundary.length > 70) {
         throw new MultipartParseError("Invalid multipart boundary.");
     }
 }
-function parseMultipartPart(part, encoding) {
+/* -------------------------------------------------------------------------- */
+/* Part Parsing                                                               */
+/* -------------------------------------------------------------------------- */
+function parseMultipartPart(part, encoding, allowUnnamed) {
     const separator = findHeaderSeparator(part);
-    if (separator === -1) {
-        return undefined;
+    if (separator === undefined) {
+        if (part.length === 0 || allowUnnamed) {
+            return undefined;
+        }
+        throw new MultipartParseError("Multipart part has no header/body separator.");
     }
-    const headerBuffer = part.subarray(0, separator);
-    const bodyStart = separator + getHeaderSeparatorLength(part, separator);
-    const body = part.subarray(bodyStart);
+    const headerBuffer = part.subarray(0, separator.index);
+    /*
+     * The body is taken verbatim. The delimiter's own CRLF was already excluded
+     * by the split, so stripping again here would silently delete two bytes
+     * from any upload whose content genuinely ends in CRLF.
+     */
+    const body = part.subarray(separator.index + separator.length);
     const headers = parsePartHeaders(headerBuffer.toString(encoding));
     const disposition = headers.contentDisposition;
     if (!disposition) {
-        return undefined;
+        if (allowUnnamed) {
+            return undefined;
+        }
+        throw new MultipartParseError("Multipart part is missing Content-Disposition.");
     }
     const name = getDispositionParameter(disposition, "name");
     if (!name) {
+        if (allowUnnamed) {
+            return undefined;
+        }
         throw new MultipartParseError("Multipart part is missing a field name.");
     }
     const filename = getDispositionParameter(disposition, "filename");
@@ -188,14 +272,14 @@ function parseMultipartPart(part, encoding) {
         filename: filename === null ? undefined : filename,
         contentType: headers.contentType,
         transferEncoding: headers.contentTransferEncoding,
-        body: stripTrailingCRLF(body),
+        data: body,
     };
 }
 /* -------------------------------------------------------------------------- */
 /* Header Parsing                                                             */
 /* -------------------------------------------------------------------------- */
 function parsePartHeaders(headerBlock) {
-    const headers = {};
+    const headers = Object.create(null);
     for (const line of headerBlock.split(/\r?\n/)) {
         const separator = line.indexOf(":");
         if (separator <= 0) {
@@ -206,62 +290,151 @@ function parsePartHeaders(headerBlock) {
         headers[name] = value;
     }
     return {
-        contentDisposition: headers["content-disposition"],
-        contentType: headers["content-type"],
-        contentTransferEncoding: headers["content-transfer-encoding"],
+        contentDisposition: ownHeader(headers, "content-disposition"),
+        contentType: ownHeader(headers, "content-type"),
+        contentTransferEncoding: ownHeader(headers, "content-transfer-encoding"),
     };
 }
+function ownHeader(headers, name) {
+    return Object.prototype.hasOwnProperty.call(headers, name)
+        ? headers[name]
+        : undefined;
+}
+/**
+ * Reads one Content-Disposition parameter.
+ *
+ * The RFC 5987 / RFC 2231 extended form (`filename*=UTF-8''%2e%2e%2fetc`) is
+ * preferred over the plain form when present, matching what browsers send for
+ * non-ASCII names — and, more importantly, so a traversal hidden behind
+ * percent-encoding is decoded here and sanitised by the caller rather than
+ * being handed through untouched.
+ */
 function getDispositionParameter(disposition, parameter) {
-    const expression = new RegExp(`(?:^|;)\\s*${escapeRegExp(parameter)}=(?:"([^"]*)"|([^;]*))`, "i");
+    const extended = matchDispositionParameter(disposition, `${parameter}*`);
+    if (extended !== null) {
+        const decoded = decodeExtendedParameter(extended);
+        if (decoded !== undefined) {
+            return decoded;
+        }
+    }
+    return matchDispositionParameter(disposition, parameter);
+}
+function matchDispositionParameter(disposition, parameter) {
+    const expression = new RegExp(`(?:^|;)\\s*${escapeRegExp(parameter)}\\s*=\\s*(?:"([^"]*)"|([^;]*))`, "i");
     const match = expression.exec(disposition);
     if (!match) {
         return null;
     }
-    return match[1] ?? match[2] ?? "";
+    return match[1] ?? match[2]?.trim() ?? "";
 }
-/* -------------------------------------------------------------------------- */
-/* Multipart Splitting                                                        */
-/* -------------------------------------------------------------------------- */
-function splitMultipartBody(body, delimiter) {
-    const parts = [];
-    let cursor = 0;
-    while (cursor < body.length) {
-        const position = body.indexOf(delimiter, cursor);
-        if (position === -1) {
-            break;
-        }
-        const partStart = position + delimiter.length;
-        if (body[partStart] === 45 && body[partStart + 1] === 45) {
-            break;
+function decodeExtendedParameter(value) {
+    const match = /^([^']*)'([^']*)'(.*)$/.exec(value);
+    if (!match) {
+        return undefined;
+    }
+    const [, rawCharset, , encoded] = match;
+    if (rawCharset === undefined || encoded === undefined) {
+        return undefined;
+    }
+    const charset = rawCharset.toLowerCase();
+    if (charset !== "utf-8" && charset !== "iso-8859-1" && charset !== "") {
+        return undefined;
+    }
+    try {
+        if (charset === "iso-8859-1") {
+            return Buffer.from(percentDecodeBytes(encoded)).toString("latin1");
         }
-        let next = body.indexOf(delimiter, partStart);
-        if (next === -1) {
-            next = body.length;
+        return decodeURIComponent(encoded);
+    }
+    catch {
+        return undefined;
+    }
+}
+function percentDecodeBytes(value) {
+    const bytes = [];
+    for (let index = 0; index < value.length; index += 1) {
+        const character = value[index];
+        if (character === undefined) {
+            continue;
         }
-        let part = body.subarray(partStart, next);
-        part = stripLeadingCRLF(part);
-        part = stripTrailingCRLF(part);
-        if (part.length > 0) {
-            parts.push(part);
+        if (character === "%" && index + 2 < value.length) {
+            const hex = value.slice(index + 1, index + 3);
+            if (/^[0-9a-fA-F]{2}$/.test(hex)) {
+                bytes.push(Number.parseInt(hex, 16));
+                index += 2;
+                continue;
+            }
         }
-        cursor = next;
+        bytes.push(character.charCodeAt(0) & 0xff);
     }
-    return parts;
+    return Buffer.from(bytes);
 }
-function findHeaderSeparator(buffer) {
-    return buffer.indexOf(Buffer.from("\r\n\r\n"));
+/* -------------------------------------------------------------------------- */
+/* Multipart Splitting                                                        */
+/* -------------------------------------------------------------------------- */
+function findOpeningDelimiter(body, delimiter, crlfDelimiter) {
+    if (body.subarray(0, delimiter.length).equals(delimiter)) {
+        return delimiter.length;
+    }
+    const position = body.indexOf(crlfDelimiter);
+    if (position === -1) {
+        throw new MultipartParseError("Multipart opening delimiter was not found.");
+    }
+    return position + crlfDelimiter.length;
+}
+/**
+ * Skips the transport padding and line break that follow a delimiter.
+ *
+ * RFC 2046 allows linear whitespace between the delimiter and its CRLF.
+ */
+function skipDelimiterEOL(body, position) {
+    let cursor = position;
+    while (body[cursor] === 32 || body[cursor] === 9) {
+        cursor += 1;
+    }
+    if (body[cursor] === 13 && body[cursor + 1] === 10) {
+        return cursor + 2;
+    }
+    if (body[cursor] === 10) {
+        return cursor + 1;
+    }
+    throw new MultipartParseError("Invalid multipart delimiter line ending.");
 }
-function getHeaderSeparatorLength(buffer, position) {
-    if (buffer.subarray(position, position + 4).equals(Buffer.from("\r\n\r\n"))) {
-        return 4;
+/**
+ * Locates the blank line between a part's headers and its body.
+ *
+ * Both the CRLF form and the bare-LF form some non-browser clients emit are
+ * recognised. A part with neither is an error rather than a silent discard.
+ */
+function findHeaderSeparator(buffer) {
+    const crlf = buffer.indexOf(CRLF_CRLF);
+    const lf = buffer.indexOf(LF_LF);
+    if (crlf !== -1 && (lf === -1 || crlf <= lf)) {
+        return { index: crlf, length: CRLF_CRLF.length };
+    }
+    if (lf !== -1) {
+        return { index: lf, length: LF_LF.length };
     }
-    return 2;
+    return undefined;
 }
 /* -------------------------------------------------------------------------- */
 /* Field Utilities                                                            */
 /* -------------------------------------------------------------------------- */
+/**
+ * Key names that would mutate a prototype chain if used as a field name.
+ */
+const FORBIDDEN_FIELD_NAMES = new Set([
+    "__proto__",
+    "constructor",
+    "prototype",
+]);
 function appendField(fields, name, value) {
-    const existing = fields[name];
+    if (FORBIDDEN_FIELD_NAMES.has(name)) {
+        return;
+    }
+    const existing = Object.prototype.hasOwnProperty.call(fields, name)
+        ? fields[name]
+        : undefined;
     if (existing === undefined) {
         fields[name] = value;
         return;
@@ -272,51 +445,74 @@ function appendField(fields, name, value) {
     }
     fields[name] = [existing, value];
 }
-function countFields(fields) {
-    let count = 0;
-    for (const value of Object.values(fields)) {
-        count += Array.isArray(value) ? value.length : 1;
-    }
-    return count;
-}
 /* -------------------------------------------------------------------------- */
 /* Filename Utilities                                                         */
 /* -------------------------------------------------------------------------- */
+/**
+ * Reduces an uploaded filename to a safe basename.
+ *
+ * Neutralises every form of path escape the name can carry: POSIX and Windows
+ * separators, the `.` and `..` entries (which `path.join` resolves to the
+ * upload directory and its **parent**), a Windows drive-relative prefix such
+ * as `C:evil.txt`, control characters including NUL, and a name long enough
+ * to blow past `NAME_MAX`. A name that reduces to nothing usable is replaced
+ * with a generated one rather than returned empty.
+ */
 export function sanitizeFilename(filename) {
     const normalized = filename.replace(/\\/g, "/");
-    const basename = normalized.slice(normalized.lastIndexOf("/") + 1);
-    const sanitized = basename.replace(/[\u0000-\u001f\u007f]/g, "").trim();
-    return sanitized || `upload-${randomUUID()}`;
-}
-/* -------------------------------------------------------------------------- */
-/* Buffer Utilities                                                           */
-/* -------------------------------------------------------------------------- */
-function stripLeadingCRLF(buffer) {
-    if (buffer.length >= 2 && buffer[0] === 13 && buffer[1] === 10) {
-        return buffer.subarray(2);
+    let basename = normalized.slice(normalized.lastIndexOf("/") + 1);
+    /* A drive-relative name resolves against that drive's own directory. */
+    basename = basename.replace(/^[A-Za-z]:/, "");
+    basename = basename.replace(/[\u0000-\u001f\u007f]/g, "").trim();
+    /* Leading dots would produce a hidden file or a traversal token. */
+    basename = basename.replace(/^\.+/, "");
+    basename = truncateToBytes(basename, MAX_FILENAME_BYTES);
+    basename = basename.trim();
+    if (basename.length === 0 || basename === "." || basename === "..") {
+        return `upload-${randomUUID()}`;
     }
-    return buffer;
+    return basename;
 }
-function stripTrailingCRLF(buffer) {
-    if (buffer.length >= 2 &&
-        buffer[buffer.length - 2] === 13 &&
-        buffer[buffer.length - 1] === 10) {
-        return buffer.subarray(0, buffer.length - 2);
+function truncateToBytes(value, maxBytes) {
+    if (Buffer.byteLength(value, "utf8") <= maxBytes) {
+        return value;
     }
-    return buffer;
+    const buffer = Buffer.from(value, "utf8").subarray(0, maxBytes);
+    /* Drop a trailing partial UTF-8 sequence rather than emitting U+FFFD. */
+    return new TextDecoder("utf-8", { fatal: false })
+        .decode(buffer)
+        .replace(/\ufffd+$/, "");
 }
 /* -------------------------------------------------------------------------- */
 /* Request Utilities                                                          */
 /* -------------------------------------------------------------------------- */
+/**
+ * Reads `Content-Length`, rejecting the framings RFC 9112 requires a server
+ * to refuse: a duplicated header whose values disagree, and a message that
+ * carries both `Content-Length` and `Transfer-Encoding`.
+ */
 function getContentLength(request) {
     const header = request.headers["content-length"];
-    const value = Array.isArray(header) ? header[0] : header;
-    if (typeof value !== "string") {
+    if (header === undefined) {
         return undefined;
     }
-    const length = Number(value);
-    if (!Number.isSafeInteger(length) || length < 0) {
-        throw new MultipartParseError("Invalid Content-Length header.");
+    const values = (Array.isArray(header) ? header : [header]).flatMap((entry) => typeof entry === "string" ? entry.split(",") : []);
+    if (values.length === 0) {
+        return undefined;
+    }
+    let length;
+    for (const value of values) {
+        const parsed = Number(value.trim());
+        if (!/^\d+$/.test(value.trim()) || !Number.isSafeInteger(parsed)) {
+            throw new MultipartParseError("Invalid Content-Length header.");
+        }
+        if (length !== undefined && parsed !== length) {
+            throw new MultipartParseError("Conflicting Content-Length headers.");
+        }
+        length = parsed;
+    }
+    if (request.headers["transfer-encoding"] !== undefined) {
+        throw new MultipartParseError("Content-Length and Transfer-Encoding must not both be present.");
     }
     return length;
 }

package/dist/httpNegotiation/httpNegotiation.core.d.ts

@@ -0,0 +1,119 @@
+/**
+ * HTTP content negotiation utilities.
+ *
+ * Implements parsing and matching for common HTTP negotiation headers:
+ *
+ *   Accept
+ *   Accept-Encoding
+ *   Accept-Language
+ *   Accept-Charset
+ *
+ * The implementation intentionally keeps the API framework agnostic so it can
+ * be used by both the HTTP server and HTTP client layers.
+ */
+export interface NegotiationPreference {
+    readonly value: string;
+    readonly quality: number;
+    readonly parameters: Readonly<Record<string, string>>;
+    readonly specificity: number;
+    readonly order: number;
+}
+export interface NegotiationMatch<T = string> {
+    readonly value: T;
+    readonly preference: NegotiationPreference;
+    readonly score: number;
+}
+export declare const DEFAULT_NEGOTIATION_QUALITY = 1;
+export declare const MIN_NEGOTIATION_QUALITY = 0;
+export declare const MAX_NEGOTIATION_QUALITY = 1;
+/**
+ * Maximum number of alternatives parsed from one negotiation header.
+ *
+ * An `Accept` header costs the attacker nothing to send and every entry is
+ * parsed character by character and then sorted, so the list length has to be
+ * bounded.
+ */
+export declare const MAX_NEGOTIATION_ENTRIES = 64;
+/**
+ * Parses a negotiation header into its preferences.
+ *
+ * The list split honours `quoted-string`, so a comma inside a quoted
+ * parameter (`profile="a,b"`) no longer tears one preference into three.
+ *
+ * @param header - The raw header value.
+ * @returns The preferences, sorted by quality then specificity.
+ */
+export declare function parseNegotiationHeader(header: string | undefined | null): NegotiationPreference[];
+/**
+ * Reports whether a negotiation header was sent with an empty value.
+ *
+ * RFC 9110 section 12.5.3: an empty `Accept-Encoding` means the client wants
+ * no content coding at all, which is a different statement from omitting the
+ * header.
+ *
+ * @param header - The raw header value.
+ * @returns `true` if the header is present but empty.
+ */
+export declare function isEmptyNegotiationHeader(header: string | undefined | null): boolean;
+export declare function parsePreference(value: string, order?: number): NegotiationPreference;
+/**
+ * Parses a `q` parameter value.
+ *
+ * A weight that does not match the `qvalue` grammar is treated as
+ * unacceptable (`0`) rather than as the default `1`; otherwise a garbage
+ * weight makes an alternative *maximally* preferred, which lets a client
+ * steer negotiation deterministically.
+ *
+ * @param value - The raw weight.
+ * @returns The quality in `[0, 1]`.
+ */
+export declare function parseQuality(value: string): number;
+export declare function formatQuality(quality: number): string;
+export declare function isAcceptableQuality(quality: number): boolean;
+export declare function comparePreferences(left: NegotiationPreference, right: NegotiationPreference): number;
+export declare function sortPreferences(preferences: readonly NegotiationPreference[]): NegotiationPreference[];
+export declare function parseAccept(header: string | undefined | null): NegotiationPreference[];
+export declare function matchesAccept(accepted: string, available: string): boolean;
+export declare function negotiateAccept(header: string | undefined | null, available: readonly string[]): string | undefined;
+export declare function parseAcceptEncoding(header: string | undefined | null): NegotiationPreference[];
+export declare function matchesEncoding(accepted: string, available: string): boolean;
+export declare function negotiateEncoding(header: string | undefined | null, available: readonly string[]): string | undefined;
+export declare function getEncodingQuality(header: string | undefined | null, encoding: string): number;
+export declare function parseAcceptLanguage(header: string | undefined | null): NegotiationPreference[];
+export declare function matchesLanguage(accepted: string, available: string): boolean;
+export declare function negotiateLanguage(header: string | undefined | null, available: readonly string[]): string | undefined;
+export declare function getLanguageQuality(header: string | undefined | null, language: string): number;
+export declare function parseAcceptCharset(header: string | undefined | null): NegotiationPreference[];
+export declare function matchesCharset(accepted: string, available: string): boolean;
+export declare function negotiateCharset(header: string | undefined | null, available: readonly string[]): string | undefined;
+/**
+ * Selects the best available alternative for a preference list.
+ *
+ * A `q=0` preference is an **exclusion**, not merely a skipped entry:
+ * RFC 9110 section 12.4.2 requires a more specific `q=0` to override a
+ * broader wildcard, so `*\/*, text/html;q=0` must not yield `text/html`.
+ *
+ * @param preferences - The parsed preferences.
+ * @param available - The alternatives the server can produce.
+ * @param matcher - Matches a preference value against an alternative.
+ * @returns The selected alternative, or `undefined` if none is acceptable.
+ */
+export declare function negotiate<T>(preferences: readonly NegotiationPreference[], available: readonly T[], matcher: (accepted: string, available: T) => boolean): T | undefined;
+export declare function getPreferenceQuality<T>(preferences: readonly NegotiationPreference[], value: T, matcher: (accepted: string, available: T) => boolean): number;
+export declare function normalizeMediaType(value: string): string;
+export declare function splitMediaType(value: string): [string, string] | undefined;
+export declare function mediaTypeSpecificity(value: string): number;
+export declare function normalizeLanguageTag(value: string): string;
+export declare function languageSpecificity(value: string): number;
+export declare function normalizeEncoding(value: string): string;
+export declare function isIdentityEncoding(value: string): boolean;
+export declare function isWildcardEncoding(value: string): boolean;
+export declare function createPreference(value: string, options?: {
+    readonly quality?: number;
+    readonly parameters?: Readonly<Record<string, string>>;
+    readonly order?: number;
+    readonly specificity?: number;
+}): NegotiationPreference;
+export declare function formatNegotiationPreferences(preferences: readonly NegotiationPreference[]): string;
+export declare function formatPreference(preference: NegotiationPreference): string;
+//# sourceMappingURL=httpNegotiation.core.d.ts.map