cdk-nextjs 0.6.2 → 0.7.1

package/lib/runtime/http/node-sink.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NodeResponseSink = void 0;
+class NodeResponseSink {
+    res;
+    constructor(res) {
+        this.res = res;
+    }
+    begin(head) {
+        try {
+            this.res.writeHead(head.statusCode, head.statusMessage, {
+                ...head.headers,
+                // The one header Node models as an array, which is exactly why
+                // `ResponseHead` carries cookies separately.
+                ...(head.cookies.length > 0 ? { "set-cookie": head.cookies } : {}),
+            });
+        }
+        catch (error) {
+            // `writeHead` rejects a header value Node will not put on the wire — a
+            // non-latin1 `Content-Disposition` filename, a CR/LF. `pipeToSink` tears
+            // down the render when this rethrows, but nothing ever answered the real
+            // response: the connection sat open until the ALB's idle timeout and the
+            // client got a 502/504. `sendError`'s 500 cannot help, since the head it
+            // would send never gets this far either.
+            failHead(this.res);
+            throw error;
+        }
+        return this.res;
+    }
+}
+exports.NodeResponseSink = NodeResponseSink;
+/** Answer a plain 500 in place of a head `writeHead` refused. */
+function failHead(res) {
+    if (res.headersSent) {
+        res.destroy();
+        return;
+    }
+    // The refused call may have set some of its headers before it threw.
+    for (const name of res.getHeaderNames()) {
+        res.removeHeader(name);
+    }
+    res.writeHead(500, {
+        "Content-Type": "text/plain; charset=utf-8",
+        "Cache-Control": "private, no-cache, no-store, max-age=0, must-revalidate",
+    });
+    res.end("Internal Server Error");
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZS1zaW5rLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL3J1bnRpbWUvaHR0cC9ub2RlLXNpbmsudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBWUEsTUFBYSxnQkFBZ0I7SUFDUztJQUFwQyxZQUFvQyxHQUFtQjtRQUFuQixRQUFHLEdBQUgsR0FBRyxDQUFnQjtJQUFHLENBQUM7SUFFcEQsS0FBSyxDQUFDLElBQWtCO1FBQzdCLElBQUksQ0FBQztZQUNILElBQUksQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLGFBQWEsRUFBRTtnQkFDdEQsR0FBRyxJQUFJLENBQUMsT0FBTztnQkFDZiwrREFBK0Q7Z0JBQy9ELDZDQUE2QztnQkFDN0MsR0FBRyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7YUFDbkUsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZix1RUFBdUU7WUFDdkUseUVBQXlFO1lBQ3pFLHlFQUF5RTtZQUN6RSx5RUFBeUU7WUFDekUseUVBQXlFO1lBQ3pFLHlDQUF5QztZQUN6QyxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ25CLE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLEdBQUcsQ0FBQztJQUNsQixDQUFDO0NBQ0Y7QUF2QkQsNENBdUJDO0FBRUQsaUVBQWlFO0FBQ2pFLFNBQVMsUUFBUSxDQUFDLEdBQW1CO0lBQ25DLElBQUksR0FBRyxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ3BCLEdBQUcsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNkLE9BQU87SUFDVCxDQUFDO0lBQ0QscUVBQXFFO0lBQ3JFLEtBQUssTUFBTSxJQUFJLElBQUksR0FBRyxDQUFDLGNBQWMsRUFBRSxFQUFFLENBQUM7UUFDeEMsR0FBRyxDQUFDLFlBQVksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUN6QixDQUFDO0lBQ0QsR0FBRyxDQUFDLFNBQVMsQ0FBQyxHQUFHLEVBQUU7UUFDakIsY0FBYyxFQUFFLDJCQUEyQjtRQUMzQyxlQUFlLEVBQUUseURBQXlEO0tBQzNFLENBQUMsQ0FBQztJQUNILEdBQUcsQ0FBQyxHQUFHLENBQUMsdUJBQXVCLENBQUMsQ0FBQztBQUNuQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBUaGUgY29udGFpbmVyIHNoZWxsJ3Mge0BsaW5rIFJlc3BvbnNlU2lua306IHRoZSBoZWFkIGdvZXMgdG8gYSByZWFsXG4gKiBgbm9kZTpodHRwYCBgU2VydmVyUmVzcG9uc2VgLCB3aGljaCBpcyB0aGVuIHRoZSBzdHJlYW0gdGhlIGJvZHkgaXMgcGlwZWQgaW50by5cbiAqXG4gKiBJdHMgb3duIG1vZHVsZSByYXRoZXIgdGhhbiBpbmxpbmUgaW4gYHNlcnZlci5tdHNgIHNvIGl0IGNhbiBiZSB0ZXN0ZWQgd2l0aG91dFxuICogc3RhcnRpbmcgdGhlIHNlcnZlciB0aGF0IG1vZHVsZSBzdGFydHMgb24gaW1wb3J0LlxuICovXG5pbXBvcnQgdHlwZSB7IFNlcnZlclJlc3BvbnNlIH0gZnJvbSBcIm5vZGU6aHR0cFwiO1xuaW1wb3J0IHR5cGUgeyBXcml0YWJsZSB9IGZyb20gXCJub2RlOnN0cmVhbVwiO1xuaW1wb3J0IHR5cGUgeyBSZXNwb25zZUhlYWQgfSBmcm9tIFwiLi9yZXNwb25zZVwiO1xuaW1wb3J0IHR5cGUgeyBSZXNwb25zZVNpbmsgfSBmcm9tIFwiLi9zaW5rXCI7XG5cbmV4cG9ydCBjbGFzcyBOb2RlUmVzcG9uc2VTaW5rIGltcGxlbWVudHMgUmVzcG9uc2VTaW5rIHtcbiAgcHVibGljIGNvbnN0cnVjdG9yKHByaXZhdGUgcmVhZG9ubHkgcmVzOiBTZXJ2ZXJSZXNwb25zZSkge31cblxuICBwdWJsaWMgYmVnaW4oaGVhZDogUmVzcG9uc2VIZWFkKTogV3JpdGFibGUge1xuICAgIHRyeSB7XG4gICAgICB0aGlzLnJlcy53cml0ZUhlYWQoaGVhZC5zdGF0dXNDb2RlLCBoZWFkLnN0YXR1c01lc3NhZ2UsIHtcbiAgICAgICAgLi4uaGVhZC5oZWFkZXJzLFxuICAgICAgICAvLyBUaGUgb25lIGhlYWRlciBOb2RlIG1vZGVscyBhcyBhbiBhcnJheSwgd2hpY2ggaXMgZXhhY3RseSB3aHlcbiAgICAgICAgLy8gYFJlc3BvbnNlSGVhZGAgY2FycmllcyBjb29raWVzIHNlcGFyYXRlbHkuXG4gICAgICAgIC4uLihoZWFkLmNvb2tpZXMubGVuZ3RoID4gMCA/IHsgXCJzZXQtY29va2llXCI6IGhlYWQuY29va2llcyB9IDoge30pLFxuICAgICAgfSk7XG4gICAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAgIC8vIGB3cml0ZUhlYWRgIHJlamVjdHMgYSBoZWFkZXIgdmFsdWUgTm9kZSB3aWxsIG5vdCBwdXQgb24gdGhlIHdpcmUg4oCUIGFcbiAgICAgIC8vIG5vbi1sYXRpbjEgYENvbnRlbnQtRGlzcG9zaXRpb25gIGZpbGVuYW1lLCBhIENSL0xGLiBgcGlwZVRvU2lua2AgdGVhcnNcbiAgICAgIC8vIGRvd24gdGhlIHJlbmRlciB3aGVuIHRoaXMgcmV0aHJvd3MsIGJ1dCBub3RoaW5nIGV2ZXIgYW5zd2VyZWQgdGhlIHJlYWxcbiAgICAgIC8vIHJlc3BvbnNlOiB0aGUgY29ubmVjdGlvbiBzYXQgb3BlbiB1bnRpbCB0aGUgQUxCJ3MgaWRsZSB0aW1lb3V0IGFuZCB0aGVcbiAgICAgIC8vIGNsaWVudCBnb3QgYSA1MDIvNTA0LiBgc2VuZEVycm9yYCdzIDUwMCBjYW5ub3QgaGVscCwgc2luY2UgdGhlIGhlYWQgaXRcbiAgICAgIC8vIHdvdWxkIHNlbmQgbmV2ZXIgZ2V0cyB0aGlzIGZhciBlaXRoZXIuXG4gICAgICBmYWlsSGVhZCh0aGlzLnJlcyk7XG4gICAgICB0aHJvdyBlcnJvcjtcbiAgICB9XG4gICAgcmV0dXJuIHRoaXMucmVzO1xuICB9XG59XG5cbi8qKiBBbnN3ZXIgYSBwbGFpbiA1MDAgaW4gcGxhY2Ugb2YgYSBoZWFkIGB3cml0ZUhlYWRgIHJlZnVzZWQuICovXG5mdW5jdGlvbiBmYWlsSGVhZChyZXM6IFNlcnZlclJlc3BvbnNlKTogdm9pZCB7XG4gIGlmIChyZXMuaGVhZGVyc1NlbnQpIHtcbiAgICByZXMuZGVzdHJveSgpO1xuICAgIHJldHVybjtcbiAgfVxuICAvLyBUaGUgcmVmdXNlZCBjYWxsIG1heSBoYXZlIHNldCBzb21lIG9mIGl0cyBoZWFkZXJzIGJlZm9yZSBpdCB0aHJldy5cbiAgZm9yIChjb25zdCBuYW1lIG9mIHJlcy5nZXRIZWFkZXJOYW1lcygpKSB7XG4gICAgcmVzLnJlbW92ZUhlYWRlcihuYW1lKTtcbiAgfVxuICByZXMud3JpdGVIZWFkKDUwMCwge1xuICAgIFwiQ29udGVudC1UeXBlXCI6IFwidGV4dC9wbGFpbjsgY2hhcnNldD11dGYtOFwiLFxuICAgIFwiQ2FjaGUtQ29udHJvbFwiOiBcInByaXZhdGUsIG5vLWNhY2hlLCBuby1zdG9yZSwgbWF4LWFnZT0wLCBtdXN0LXJldmFsaWRhdGVcIixcbiAgfSk7XG4gIHJlcy5lbmQoXCJJbnRlcm5hbCBTZXJ2ZXIgRXJyb3JcIik7XG59XG4iXX0=

package/lib/runtime/http/node-sink.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/runtime/http/node-sink.test.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_http_1 = require("node:http");
+const node_sink_1 = require("./node-sink");
+/**
+ * A real `node:http` server, because what is under test is how Node's own
+ * `writeHead` validation interacts with the sink: a stub `ServerResponse` would
+ * not reject the header values that hung the container shell.
+ */
+async function respondWith(head) {
+    let thrown;
+    const server = (0, node_http_1.createServer)((_req, res) => {
+        try {
+            new node_sink_1.NodeResponseSink(res).begin(head).end("the body");
+        }
+        catch (error) {
+            thrown = error;
+        }
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const { port } = server.address();
+    try {
+        return await new Promise((resolve, reject) => {
+            const req = (0, node_http_1.request)({ port, host: "127.0.0.1", path: "/" }, (res) => {
+                let body = "";
+                res.setEncoding("utf-8");
+                res.on("data", (chunk) => (body += chunk));
+                res.on("end", () => resolve({ status: res.statusCode, body, thrown }));
+            });
+            // What the ALB did: wait for an answer that never came.
+            req.setTimeout(2_000, () => reject(new Error("the response hung")));
+            req.on("error", reject);
+            req.end();
+        });
+    }
+    finally {
+        server.close();
+    }
+}
+describe("NodeResponseSink", () => {
+    it("writes the head, cookies included, and hands back the response", async () => {
+        const result = await respondWith({
+            statusCode: 201,
+            headers: { "content-type": "text/plain" },
+            cookies: ["a=1", "b=2"],
+        });
+        expect(result).toMatchObject({ status: 201, body: "the body" });
+        expect(result.thrown).toBeUndefined();
+    });
+    it.each([
+        ["a non-latin1 value", 'attachment; filename="résumé—final.pdf"'],
+        ["a CR/LF", "one\r\nx-injected: yes"],
+    ])("answers 500 rather than hanging when writeHead rejects %s", async (_name, value) => {
+        const result = await respondWith({
+            statusCode: 200,
+            headers: { "content-disposition": value },
+            cookies: [],
+        });
+        expect(result.status).toBe(500);
+        expect(result.body).toBe("Internal Server Error");
+        // Rethrown, so `pipeToSink` tears the render down. (Node's own error
+        // class, from outside Jest's realm, hence not `toBeInstanceOf`.)
+        expect(result.thrown).toMatchObject({ code: "ERR_INVALID_CHAR" });
+    });
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibm9kZS1zaW5rLnRlc3QuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvcnVudGltZS9odHRwL25vZGUtc2luay50ZXN0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEseUNBQWlFO0FBRWpFLDJDQUErQztBQUcvQzs7OztHQUlHO0FBQ0gsS0FBSyxVQUFVLFdBQVcsQ0FDeEIsSUFBa0I7SUFFbEIsSUFBSSxNQUFlLENBQUM7SUFDcEIsTUFBTSxNQUFNLEdBQUcsSUFBQSx3QkFBWSxFQUFDLENBQUMsSUFBSSxFQUFFLEdBQUcsRUFBRSxFQUFFO1FBQ3hDLElBQUksQ0FBQztZQUNILElBQUksNEJBQWdCLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN4RCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sR0FBRyxLQUFLLENBQUM7UUFDakIsQ0FBQztJQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0gsTUFBTSxJQUFJLE9BQU8sQ0FBTyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsV0FBVyxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFDN0UsTUFBTSxFQUFFLElBQUksRUFBRSxHQUFHLE1BQU0sQ0FBQyxPQUFPLEVBQWlCLENBQUM7SUFDakQsSUFBSSxDQUFDO1FBQ0gsT0FBTyxNQUFNLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQzNDLE1BQU0sR0FBRyxHQUFHLElBQUEsbUJBQVcsRUFBQyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxHQUFHLEVBQUUsRUFBRSxDQUFDLEdBQUcsRUFBRSxFQUFFO2dCQUN0RSxJQUFJLElBQUksR0FBRyxFQUFFLENBQUM7Z0JBQ2QsR0FBRyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsQ0FBQztnQkFDekIsR0FBRyxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxJQUFJLEtBQUssQ0FBQyxDQUFDLENBQUM7Z0JBQzNDLEdBQUcsQ0FBQyxFQUFFLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxDQUFDLE9BQU8sQ0FBQyxFQUFFLE1BQU0sRUFBRSxHQUFHLENBQUMsVUFBVSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDekUsQ0FBQyxDQUFDLENBQUM7WUFDSCx3REFBd0Q7WUFDeEQsR0FBRyxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLG1CQUFtQixDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3BFLEdBQUcsQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ3hCLEdBQUcsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUNaLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztZQUFTLENBQUM7UUFDVCxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDakIsQ0FBQztBQUNILENBQUM7QUFFRCxRQUFRLENBQUMsa0JBQWtCLEVBQUUsR0FBRyxFQUFFO0lBQ2hDLEVBQUUsQ0FBQyxnRUFBZ0UsRUFBRSxLQUFLLElBQUksRUFBRTtRQUM5RSxNQUFNLE1BQU0sR0FBRyxNQUFNLFdBQVcsQ0FBQztZQUMvQixVQUFVLEVBQUUsR0FBRztZQUNmLE9BQU8sRUFBRSxFQUFFLGNBQWMsRUFBRSxZQUFZLEVBQUU7WUFDekMsT0FBTyxFQUFFLENBQUMsS0FBSyxFQUFFLEtBQUssQ0FBQztTQUN4QixDQUFDLENBQUM7UUFDSCxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsYUFBYSxDQUFDLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLENBQUMsQ0FBQztRQUNoRSxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLGFBQWEsRUFBRSxDQUFDO0lBQ3hDLENBQUMsQ0FBQyxDQUFDO0lBRUgsRUFBRSxDQUFDLElBQUksQ0FBQztRQUNOLENBQUMsb0JBQW9CLEVBQUUseUNBQXlDLENBQUM7UUFDakUsQ0FBQyxTQUFTLEVBQUUsd0JBQXdCLENBQUM7S0FDdEMsQ0FBQyxDQUNBLDJEQUEyRCxFQUMzRCxLQUFLLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFO1FBQ3JCLE1BQU0sTUFBTSxHQUFHLE1BQU0sV0FBVyxDQUFDO1lBQy9CLFVBQVUsRUFBRSxHQUFHO1lBQ2YsT0FBTyxFQUFFLEVBQUUscUJBQXFCLEVBQUUsS0FBSyxFQUFFO1lBQ3pDLE9BQU8sRUFBRSxFQUFFO1NBQ1osQ0FBQyxDQUFDO1FBQ0gsTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDaEMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsdUJBQXVCLENBQUMsQ0FBQztRQUNsRCxxRUFBcUU7UUFDckUsaUVBQWlFO1FBQ2pFLE1BQU0sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsYUFBYSxDQUFDLEVBQUUsSUFBSSxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FBQztJQUNwRSxDQUFDLENBQ0YsQ0FBQztBQUNKLENBQUMsQ0FBQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgY3JlYXRlU2VydmVyLCByZXF1ZXN0IGFzIGh0dHBSZXF1ZXN0IH0gZnJvbSBcIm5vZGU6aHR0cFwiO1xuaW1wb3J0IHR5cGUgeyBBZGRyZXNzSW5mbyB9IGZyb20gXCJub2RlOm5ldFwiO1xuaW1wb3J0IHsgTm9kZVJlc3BvbnNlU2luayB9IGZyb20gXCIuL25vZGUtc2lua1wiO1xuaW1wb3J0IHsgUmVzcG9uc2VIZWFkIH0gZnJvbSBcIi4vcmVzcG9uc2VcIjtcblxuLyoqXG4gKiBBIHJlYWwgYG5vZGU6aHR0cGAgc2VydmVyLCBiZWNhdXNlIHdoYXQgaXMgdW5kZXIgdGVzdCBpcyBob3cgTm9kZSdzIG93blxuICogYHdyaXRlSGVhZGAgdmFsaWRhdGlvbiBpbnRlcmFjdHMgd2l0aCB0aGUgc2luazogYSBzdHViIGBTZXJ2ZXJSZXNwb25zZWAgd291bGRcbiAqIG5vdCByZWplY3QgdGhlIGhlYWRlciB2YWx1ZXMgdGhhdCBodW5nIHRoZSBjb250YWluZXIgc2hlbGwuXG4gKi9cbmFzeW5jIGZ1bmN0aW9uIHJlc3BvbmRXaXRoKFxuICBoZWFkOiBSZXNwb25zZUhlYWQsXG4pOiBQcm9taXNlPHsgc3RhdHVzPzogbnVtYmVyOyBib2R5OiBzdHJpbmc7IHRocm93bjogdW5rbm93biB9PiB7XG4gIGxldCB0aHJvd246IHVua25vd247XG4gIGNvbnN0IHNlcnZlciA9IGNyZWF0ZVNlcnZlcigoX3JlcSwgcmVzKSA9PiB7XG4gICAgdHJ5IHtcbiAgICAgIG5ldyBOb2RlUmVzcG9uc2VTaW5rKHJlcykuYmVnaW4oaGVhZCkuZW5kKFwidGhlIGJvZHlcIik7XG4gICAgfSBjYXRjaCAoZXJyb3IpIHtcbiAgICAgIHRocm93biA9IGVycm9yO1xuICAgIH1cbiAgfSk7XG4gIGF3YWl0IG5ldyBQcm9taXNlPHZvaWQ+KChyZXNvbHZlKSA9PiBzZXJ2ZXIubGlzdGVuKDAsIFwiMTI3LjAuMC4xXCIsIHJlc29sdmUpKTtcbiAgY29uc3QgeyBwb3J0IH0gPSBzZXJ2ZXIuYWRkcmVzcygpIGFzIEFkZHJlc3NJbmZvO1xuICB0cnkge1xuICAgIHJldHVybiBhd2FpdCBuZXcgUHJvbWlzZSgocmVzb2x2ZSwgcmVqZWN0KSA9PiB7XG4gICAgICBjb25zdCByZXEgPSBodHRwUmVxdWVzdCh7IHBvcnQsIGhvc3Q6IFwiMTI3LjAuMC4xXCIsIHBhdGg6IFwiL1wiIH0sIChyZXMpID0+IHtcbiAgICAgICAgbGV0IGJvZHkgPSBcIlwiO1xuICAgICAgICByZXMuc2V0RW5jb2RpbmcoXCJ1dGYtOFwiKTtcbiAgICAgICAgcmVzLm9uKFwiZGF0YVwiLCAoY2h1bmspID0+IChib2R5ICs9IGNodW5rKSk7XG4gICAgICAgIHJlcy5vbihcImVuZFwiLCAoKSA9PiByZXNvbHZlKHsgc3RhdHVzOiByZXMuc3RhdHVzQ29kZSwgYm9keSwgdGhyb3duIH0pKTtcbiAgICAgIH0pO1xuICAgICAgLy8gV2hhdCB0aGUgQUxCIGRpZDogd2FpdCBmb3IgYW4gYW5zd2VyIHRoYXQgbmV2ZXIgY2FtZS5cbiAgICAgIHJlcS5zZXRUaW1lb3V0KDJfMDAwLCAoKSA9PiByZWplY3QobmV3IEVycm9yKFwidGhlIHJlc3BvbnNlIGh1bmdcIikpKTtcbiAgICAgIHJlcS5vbihcImVycm9yXCIsIHJlamVjdCk7XG4gICAgICByZXEuZW5kKCk7XG4gICAgfSk7XG4gIH0gZmluYWxseSB7XG4gICAgc2VydmVyLmNsb3NlKCk7XG4gIH1cbn1cblxuZGVzY3JpYmUoXCJOb2RlUmVzcG9uc2VTaW5rXCIsICgpID0+IHtcbiAgaXQoXCJ3cml0ZXMgdGhlIGhlYWQsIGNvb2tpZXMgaW5jbHVkZWQsIGFuZCBoYW5kcyBiYWNrIHRoZSByZXNwb25zZVwiLCBhc3luYyAoKSA9PiB7XG4gICAgY29uc3QgcmVzdWx0ID0gYXdhaXQgcmVzcG9uZFdpdGgoe1xuICAgICAgc3RhdHVzQ29kZTogMjAxLFxuICAgICAgaGVhZGVyczogeyBcImNvbnRlbnQtdHlwZVwiOiBcInRleHQvcGxhaW5cIiB9LFxuICAgICAgY29va2llczogW1wiYT0xXCIsIFwiYj0yXCJdLFxuICAgIH0pO1xuICAgIGV4cGVjdChyZXN1bHQpLnRvTWF0Y2hPYmplY3QoeyBzdGF0dXM6IDIwMSwgYm9keTogXCJ0aGUgYm9keVwiIH0pO1xuICAgIGV4cGVjdChyZXN1bHQudGhyb3duKS50b0JlVW5kZWZpbmVkKCk7XG4gIH0pO1xuXG4gIGl0LmVhY2goW1xuICAgIFtcImEgbm9uLWxhdGluMSB2YWx1ZVwiLCAnYXR0YWNobWVudDsgZmlsZW5hbWU9XCJyw6lzdW3DqeKAlGZpbmFsLnBkZlwiJ10sXG4gICAgW1wiYSBDUi9MRlwiLCBcIm9uZVxcclxcbngtaW5qZWN0ZWQ6IHllc1wiXSxcbiAgXSkoXG4gICAgXCJhbnN3ZXJzIDUwMCByYXRoZXIgdGhhbiBoYW5naW5nIHdoZW4gd3JpdGVIZWFkIHJlamVjdHMgJXNcIixcbiAgICBhc3luYyAoX25hbWUsIHZhbHVlKSA9PiB7XG4gICAgICBjb25zdCByZXN1bHQgPSBhd2FpdCByZXNwb25kV2l0aCh7XG4gICAgICAgIHN0YXR1c0NvZGU6IDIwMCxcbiAgICAgICAgaGVhZGVyczogeyBcImNvbnRlbnQtZGlzcG9zaXRpb25cIjogdmFsdWUgfSxcbiAgICAgICAgY29va2llczogW10sXG4gICAgICB9KTtcbiAgICAgIGV4cGVjdChyZXN1bHQuc3RhdHVzKS50b0JlKDUwMCk7XG4gICAgICBleHBlY3QocmVzdWx0LmJvZHkpLnRvQmUoXCJJbnRlcm5hbCBTZXJ2ZXIgRXJyb3JcIik7XG4gICAgICAvLyBSZXRocm93biwgc28gYHBpcGVUb1NpbmtgIHRlYXJzIHRoZSByZW5kZXIgZG93bi4gKE5vZGUncyBvd24gZXJyb3JcbiAgICAgIC8vIGNsYXNzLCBmcm9tIG91dHNpZGUgSmVzdCdzIHJlYWxtLCBoZW5jZSBub3QgYHRvQmVJbnN0YW5jZU9mYC4pXG4gICAgICBleHBlY3QocmVzdWx0LnRocm93bikudG9NYXRjaE9iamVjdCh7IGNvZGU6IFwiRVJSX0lOVkFMSURfQ0hBUlwiIH0pO1xuICAgIH0sXG4gICk7XG59KTtcbiJdfQ==

package/lib/runtime/http/request.d.ts

@@ -0,0 +1,62 @@
+/**
+ * A synthesized `http.IncomingMessage`.
+ *
+ * Both shells use this — the Lambda shell because it has an event rather than a
+ * socket, and the container shell so that the code paths Next.js exercises are
+ * the ones the Lambda e2e suite covers. Handing Containers a real
+ * `IncomingMessage` would mean the container suite proves nothing about Lambda.
+ *
+ * Derived from `serverless-http`'s `lib/request.js` (MIT, © Doug Moscrop) — the
+ * fake-socket shape and the `_read` push are its work:
+ * https://github.com/dougmoscrop/serverless-http/blob/master/lib/request.js
+ *
+ * What Next.js actually reads off `req` (`next/dist/server/base-http/node.js`,
+ * `NodeNextRequest`): `method`, `url` (which it *reassigns* during
+ * normalization), `headers`, `cookies` (which it *assigns*), the
+ * `NEXT_REQUEST_META` symbol, `fetchMetrics`, and `on("data"|"end"|"error")`.
+ * Nothing else, so nothing else needs to be faithful.
+ */
+import { IncomingMessage } from "node:http";
+import type { IncomingHttpHeaders } from "node:http";
+import { Readable } from "node:stream";
+export interface IncomingMessageInit {
+    readonly method: string;
+    /**
+     * Origin-form target: path + query, never absolute. This is what Next.js
+     * parses and rewrites, so it must be exactly what the route resolved to.
+     */
+    readonly url: string;
+    readonly headers: IncomingHttpHeaders;
+    /**
+     * `undefined` for bodyless requests. A `Readable` is piped through with
+     * backpressure; a `Buffer` is pushed in one go.
+     */
+    readonly body?: Readable | Buffer;
+    /** Fills `req.socket.remoteAddress`, which `x-forwarded-for` handling reads. */
+    readonly remoteAddress?: string;
+    /** `false` for the container shell behind an ALB terminating TLS. */
+    readonly encrypted?: boolean;
+    /** `RuntimeRequest.trustForwardedHost`, kept for the requests made on its behalf. */
+    readonly trustForwardedHost?: boolean;
+}
+export declare class ShimIncomingMessage extends IncomingMessage {
+    /** Set by Next.js's `NodeNextRequest.originalRequest` getter. */
+    cookies?: unknown;
+    fetchMetrics?: unknown;
+    /** See {@link IncomingMessageInit.trustForwardedHost}. */
+    readonly trustForwardedHost: boolean;
+    private source?;
+    private pumping;
+    constructor(init: IncomingMessageInit);
+    _read(size?: number): void;
+    /**
+     * `IncomingMessage.prototype._destroy` reaches for the socket — it calls
+     * `stream.finished()` on it to wait for the connection to close — and throws
+     * `ERR_INVALID_ARG_TYPE` on the synthesized one. There is no connection to tear
+     * down here, so the destroy is just completed, after the `"aborted"` that
+     * signals a truncated request.
+     */
+    _destroy(error: Error | null, callback: (error?: Error | null) => void): void;
+}
+/** Lowercases and flattens a `Headers` into `IncomingHttpHeaders`. */
+export declare function toIncomingHttpHeaders(headers: Headers): IncomingHttpHeaders;

package/lib/runtime/http/request.js

@@ -0,0 +1,134 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ShimIncomingMessage = void 0;
+exports.toIncomingHttpHeaders = toIncomingHttpHeaders;
+/**
+ * A synthesized `http.IncomingMessage`.
+ *
+ * Both shells use this — the Lambda shell because it has an event rather than a
+ * socket, and the container shell so that the code paths Next.js exercises are
+ * the ones the Lambda e2e suite covers. Handing Containers a real
+ * `IncomingMessage` would mean the container suite proves nothing about Lambda.
+ *
+ * Derived from `serverless-http`'s `lib/request.js` (MIT, © Doug Moscrop) — the
+ * fake-socket shape and the `_read` push are its work:
+ * https://github.com/dougmoscrop/serverless-http/blob/master/lib/request.js
+ *
+ * What Next.js actually reads off `req` (`next/dist/server/base-http/node.js`,
+ * `NodeNextRequest`): `method`, `url` (which it *reassigns* during
+ * normalization), `headers`, `cookies` (which it *assigns*), the
+ * `NEXT_REQUEST_META` symbol, `fetchMetrics`, and `on("data"|"end"|"error")`.
+ * Nothing else, so nothing else needs to be faithful.
+ */
+const node_http_1 = require("node:http");
+/**
+ * The subset of `net.Socket` that `IncomingMessage`'s constructor and Next.js
+ * touch. A real socket cannot be synthesized, and nothing needs one.
+ */
+function fakeSocket(init) {
+    return {
+        encrypted: init.encrypted ?? true,
+        readable: false,
+        remoteAddress: init.remoteAddress,
+        address: () => ({ port: init.encrypted === false ? 80 : 443 }),
+        end: () => { },
+        destroy: () => { },
+        // `send` (used by `serveStatic`) checks this before streaming a file.
+        writable: true,
+    };
+}
+class ShimIncomingMessage extends node_http_1.IncomingMessage {
+    /** Set by Next.js's `NodeNextRequest.originalRequest` getter. */
+    cookies;
+    fetchMetrics;
+    /** See {@link IncomingMessageInit.trustForwardedHost}. */
+    trustForwardedHost;
+    source;
+    pumping = false;
+    constructor(init) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        super(fakeSocket(init));
+        const headers = { ...init.headers };
+        const body = init.body;
+        if (Buffer.isBuffer(body) &&
+            headers["content-length"] === undefined &&
+            headers["transfer-encoding"] === undefined) {
+            // RFC 9110: a body without a length is unframed. Next.js's body parsing
+            // for Pages API routes reads `content-length`, and API Gateway / Function
+            // URL events do not always carry one.
+            headers["content-length"] = String(Buffer.byteLength(body));
+        }
+        this.trustForwardedHost = init.trustForwardedHost ?? false;
+        this.method = init.method.toUpperCase();
+        this.url = init.url;
+        this.headers = headers;
+        this.httpVersion = "1.1";
+        this.httpVersionMajor = 1;
+        this.httpVersionMinor = 1;
+        if (body === undefined) {
+            this.complete = true;
+            this.push(null);
+        }
+        else if (Buffer.isBuffer(body)) {
+            this.complete = true;
+            this.push(body);
+            this.push(null);
+        }
+        else {
+            this.source = body;
+        }
+    }
+    _read(size) {
+        const source = this.source;
+        if (!source) {
+            return;
+        }
+        if (this.pumping) {
+            source.resume();
+            return;
+        }
+        this.pumping = true;
+        source.on("data", (chunk) => {
+            if (!this.push(chunk)) {
+                source.pause();
+            }
+        });
+        source.on("end", () => {
+            this.complete = true;
+            this.push(null);
+        });
+        source.on("error", (error) => {
+            this.destroy(error);
+        });
+        void size;
+    }
+    /**
+     * `IncomingMessage.prototype._destroy` reaches for the socket — it calls
+     * `stream.finished()` on it to wait for the connection to close — and throws
+     * `ERR_INVALID_ARG_TYPE` on the synthesized one. There is no connection to tear
+     * down here, so the destroy is just completed, after the `"aborted"` that
+     * signals a truncated request.
+     */
+    _destroy(error, callback) {
+        if (!this.readableEnded || !this.complete) {
+            this.aborted = true;
+            this.emit("aborted");
+        }
+        callback(error);
+    }
+}
+exports.ShimIncomingMessage = ShimIncomingMessage;
+/** Lowercases and flattens a `Headers` into `IncomingHttpHeaders`. */
+function toIncomingHttpHeaders(headers) {
+    const result = {};
+    headers.forEach((value, name) => {
+        if (name === "set-cookie") {
+            // The only request header Node models as an array.
+            result["set-cookie"] = headers.getSetCookie();
+            return;
+        }
+        result[name] = value;
+    });
+    return result;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVxdWVzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9ydW50aW1lL2h0dHAvcmVxdWVzdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUF3SkEsc0RBV0M7QUFuS0Q7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBaUJHO0FBQ0gseUNBQTRDO0FBeUI1Qzs7O0dBR0c7QUFDSCxTQUFTLFVBQVUsQ0FBQyxJQUF5QjtJQUMzQyxPQUFPO1FBQ0wsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLElBQUksSUFBSTtRQUNqQyxRQUFRLEVBQUUsS0FBSztRQUNmLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYTtRQUNqQyxPQUFPLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQyxFQUFFLElBQUksRUFBRSxJQUFJLENBQUMsU0FBUyxLQUFLLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUM5RCxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUUsQ0FBQztRQUNiLE9BQU8sRUFBRSxHQUFHLEVBQUUsR0FBRSxDQUFDO1FBQ2pCLHNFQUFzRTtRQUN0RSxRQUFRLEVBQUUsSUFBSTtLQUNmLENBQUM7QUFDSixDQUFDO0FBRUQsTUFBYSxtQkFBb0IsU0FBUSwyQkFBZTtJQUN0RCxpRUFBaUU7SUFDMUQsT0FBTyxDQUFXO0lBQ2xCLFlBQVksQ0FBVztJQUM5QiwwREFBMEQ7SUFDMUMsa0JBQWtCLENBQVU7SUFFcEMsTUFBTSxDQUFZO0lBQ2xCLE9BQU8sR0FBRyxLQUFLLENBQUM7SUFFeEIsWUFBbUIsSUFBeUI7UUFDMUMsOERBQThEO1FBQzlELEtBQUssQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFRLENBQUMsQ0FBQztRQUUvQixNQUFNLE9BQU8sR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3BDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUM7UUFDdkIsSUFDRSxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztZQUNyQixPQUFPLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxTQUFTO1lBQ3ZDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxLQUFLLFNBQVMsRUFDMUMsQ0FBQztZQUNELHdFQUF3RTtZQUN4RSwwRUFBMEU7WUFDMUUsc0NBQXNDO1lBQ3RDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUVELElBQUksQ0FBQyxrQkFBa0IsR0FBRyxJQUFJLENBQUMsa0JBQWtCLElBQUksS0FBSyxDQUFDO1FBQzNELElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUN4QyxJQUFJLENBQUMsR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUM7UUFDcEIsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUM7UUFDdkIsSUFBSSxDQUFDLFdBQVcsR0FBRyxLQUFLLENBQUM7UUFDekIsSUFBSSxDQUFDLGdCQUFnQixHQUFHLENBQUMsQ0FBQztRQUMxQixJQUFJLENBQUMsZ0JBQWdCLEdBQUcsQ0FBQyxDQUFDO1FBRTFCLElBQUksSUFBSSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3ZCLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO1lBQ3JCLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDbEIsQ0FBQzthQUFNLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ2pDLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO1lBQ3JCLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDaEIsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNsQixDQUFDO2FBQU0sQ0FBQztZQUNOLElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSxDQUFDO1FBQ3JCLENBQUM7SUFDSCxDQUFDO0lBRWUsS0FBSyxDQUFDLElBQWE7UUFDakMsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQztRQUMzQixJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDWixPQUFPO1FBQ1QsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2pCLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNoQixPQUFPO1FBQ1QsQ0FBQztRQUNELElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1FBQ3BCLE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBYSxFQUFFLEVBQUU7WUFDbEMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDdEIsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ2pCLENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztRQUNILE1BQU0sQ0FBQyxFQUFFLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRTtZQUNwQixJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksQ0FBQztZQUNyQixJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2xCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxLQUFLLEVBQUUsRUFBRTtZQUMzQixJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3RCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsS0FBSyxJQUFJLENBQUM7SUFDWixDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ2EsUUFBUSxDQUN0QixLQUFtQixFQUNuQixRQUF3QztRQUV4QyxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUMxQyxJQUFJLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQztZQUNwQixJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3ZCLENBQUM7UUFDRCxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDbEIsQ0FBQztDQUNGO0FBekZELGtEQXlGQztBQUVELHNFQUFzRTtBQUN0RSxTQUFnQixxQkFBcUIsQ0FBQyxPQUFnQjtJQUNwRCxNQUFNLE1BQU0sR0FBd0IsRUFBRSxDQUFDO0lBQ3ZDLE9BQU8sQ0FBQyxPQUFPLENBQUMsQ0FBQyxLQUFLLEVBQUUsSUFBSSxFQUFFLEVBQUU7UUFDOUIsSUFBSSxJQUFJLEtBQUssWUFBWSxFQUFFLENBQUM7WUFDMUIsbURBQW1EO1lBQ25ELE1BQU0sQ0FBQyxZQUFZLENBQUMsR0FBRyxPQUFPLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDOUMsT0FBTztRQUNULENBQUM7UUFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsS0FBSyxDQUFDO0lBQ3ZCLENBQUMsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQSBzeW50aGVzaXplZCBgaHR0cC5JbmNvbWluZ01lc3NhZ2VgLlxuICpcbiAqIEJvdGggc2hlbGxzIHVzZSB0aGlzIOKAlCB0aGUgTGFtYmRhIHNoZWxsIGJlY2F1c2UgaXQgaGFzIGFuIGV2ZW50IHJhdGhlciB0aGFuIGFcbiAqIHNvY2tldCwgYW5kIHRoZSBjb250YWluZXIgc2hlbGwgc28gdGhhdCB0aGUgY29kZSBwYXRocyBOZXh0LmpzIGV4ZXJjaXNlcyBhcmVcbiAqIHRoZSBvbmVzIHRoZSBMYW1iZGEgZTJlIHN1aXRlIGNvdmVycy4gSGFuZGluZyBDb250YWluZXJzIGEgcmVhbFxuICogYEluY29taW5nTWVzc2FnZWAgd291bGQgbWVhbiB0aGUgY29udGFpbmVyIHN1aXRlIHByb3ZlcyBub3RoaW5nIGFib3V0IExhbWJkYS5cbiAqXG4gKiBEZXJpdmVkIGZyb20gYHNlcnZlcmxlc3MtaHR0cGAncyBgbGliL3JlcXVlc3QuanNgIChNSVQsIMKpIERvdWcgTW9zY3JvcCkg4oCUIHRoZVxuICogZmFrZS1zb2NrZXQgc2hhcGUgYW5kIHRoZSBgX3JlYWRgIHB1c2ggYXJlIGl0cyB3b3JrOlxuICogaHR0cHM6Ly9naXRodWIuY29tL2RvdWdtb3Njcm9wL3NlcnZlcmxlc3MtaHR0cC9ibG9iL21hc3Rlci9saWIvcmVxdWVzdC5qc1xuICpcbiAqIFdoYXQgTmV4dC5qcyBhY3R1YWxseSByZWFkcyBvZmYgYHJlcWAgKGBuZXh0L2Rpc3Qvc2VydmVyL2Jhc2UtaHR0cC9ub2RlLmpzYCxcbiAqIGBOb2RlTmV4dFJlcXVlc3RgKTogYG1ldGhvZGAsIGB1cmxgICh3aGljaCBpdCAqcmVhc3NpZ25zKiBkdXJpbmdcbiAqIG5vcm1hbGl6YXRpb24pLCBgaGVhZGVyc2AsIGBjb29raWVzYCAod2hpY2ggaXQgKmFzc2lnbnMqKSwgdGhlXG4gKiBgTkVYVF9SRVFVRVNUX01FVEFgIHN5bWJvbCwgYGZldGNoTWV0cmljc2AsIGFuZCBgb24oXCJkYXRhXCJ8XCJlbmRcInxcImVycm9yXCIpYC5cbiAqIE5vdGhpbmcgZWxzZSwgc28gbm90aGluZyBlbHNlIG5lZWRzIHRvIGJlIGZhaXRoZnVsLlxuICovXG5pbXBvcnQgeyBJbmNvbWluZ01lc3NhZ2UgfSBmcm9tIFwibm9kZTpodHRwXCI7XG5pbXBvcnQgdHlwZSB7IEluY29taW5nSHR0cEhlYWRlcnMgfSBmcm9tIFwibm9kZTpodHRwXCI7XG5pbXBvcnQgeyBSZWFkYWJsZSB9IGZyb20gXCJub2RlOnN0cmVhbVwiO1xuXG5leHBvcnQgaW50ZXJmYWNlIEluY29taW5nTWVzc2FnZUluaXQge1xuICByZWFkb25seSBtZXRob2Q6IHN0cmluZztcbiAgLyoqXG4gICAqIE9yaWdpbi1mb3JtIHRhcmdldDogcGF0aCArIHF1ZXJ5LCBuZXZlciBhYnNvbHV0ZS4gVGhpcyBpcyB3aGF0IE5leHQuanNcbiAgICogcGFyc2VzIGFuZCByZXdyaXRlcywgc28gaXQgbXVzdCBiZSBleGFjdGx5IHdoYXQgdGhlIHJvdXRlIHJlc29sdmVkIHRvLlxuICAgKi9cbiAgcmVhZG9ubHkgdXJsOiBzdHJpbmc7XG4gIHJlYWRvbmx5IGhlYWRlcnM6IEluY29taW5nSHR0cEhlYWRlcnM7XG4gIC8qKlxuICAgKiBgdW5kZWZpbmVkYCBmb3IgYm9keWxlc3MgcmVxdWVzdHMuIEEgYFJlYWRhYmxlYCBpcyBwaXBlZCB0aHJvdWdoIHdpdGhcbiAgICogYmFja3ByZXNzdXJlOyBhIGBCdWZmZXJgIGlzIHB1c2hlZCBpbiBvbmUgZ28uXG4gICAqL1xuICByZWFkb25seSBib2R5PzogUmVhZGFibGUgfCBCdWZmZXI7XG4gIC8qKiBGaWxscyBgcmVxLnNvY2tldC5yZW1vdGVBZGRyZXNzYCwgd2hpY2ggYHgtZm9yd2FyZGVkLWZvcmAgaGFuZGxpbmcgcmVhZHMuICovXG4gIHJlYWRvbmx5IHJlbW90ZUFkZHJlc3M/OiBzdHJpbmc7XG4gIC8qKiBgZmFsc2VgIGZvciB0aGUgY29udGFpbmVyIHNoZWxsIGJlaGluZCBhbiBBTEIgdGVybWluYXRpbmcgVExTLiAqL1xuICByZWFkb25seSBlbmNyeXB0ZWQ/OiBib29sZWFuO1xuICAvKiogYFJ1bnRpbWVSZXF1ZXN0LnRydXN0Rm9yd2FyZGVkSG9zdGAsIGtlcHQgZm9yIHRoZSByZXF1ZXN0cyBtYWRlIG9uIGl0cyBiZWhhbGYuICovXG4gIHJlYWRvbmx5IHRydXN0Rm9yd2FyZGVkSG9zdD86IGJvb2xlYW47XG59XG5cbi8qKlxuICogVGhlIHN1YnNldCBvZiBgbmV0LlNvY2tldGAgdGhhdCBgSW5jb21pbmdNZXNzYWdlYCdzIGNvbnN0cnVjdG9yIGFuZCBOZXh0LmpzXG4gKiB0b3VjaC4gQSByZWFsIHNvY2tldCBjYW5ub3QgYmUgc3ludGhlc2l6ZWQsIGFuZCBub3RoaW5nIG5lZWRzIG9uZS5cbiAqL1xuZnVuY3Rpb24gZmFrZVNvY2tldChpbml0OiBJbmNvbWluZ01lc3NhZ2VJbml0KSB7XG4gIHJldHVybiB7XG4gICAgZW5jcnlwdGVkOiBpbml0LmVuY3J5cHRlZCA/PyB0cnVlLFxuICAgIHJlYWRhYmxlOiBmYWxzZSxcbiAgICByZW1vdGVBZGRyZXNzOiBpbml0LnJlbW90ZUFkZHJlc3MsXG4gICAgYWRkcmVzczogKCkgPT4gKHsgcG9ydDogaW5pdC5lbmNyeXB0ZWQgPT09IGZhbHNlID8gODAgOiA0NDMgfSksXG4gICAgZW5kOiAoKSA9PiB7fSxcbiAgICBkZXN0cm95OiAoKSA9PiB7fSxcbiAgICAvLyBgc2VuZGAgKHVzZWQgYnkgYHNlcnZlU3RhdGljYCkgY2hlY2tzIHRoaXMgYmVmb3JlIHN0cmVhbWluZyBhIGZpbGUuXG4gICAgd3JpdGFibGU6IHRydWUsXG4gIH07XG59XG5cbmV4cG9ydCBjbGFzcyBTaGltSW5jb21pbmdNZXNzYWdlIGV4dGVuZHMgSW5jb21pbmdNZXNzYWdlIHtcbiAgLyoqIFNldCBieSBOZXh0LmpzJ3MgYE5vZGVOZXh0UmVxdWVzdC5vcmlnaW5hbFJlcXVlc3RgIGdldHRlci4gKi9cbiAgcHVibGljIGNvb2tpZXM/OiB1bmtub3duO1xuICBwdWJsaWMgZmV0Y2hNZXRyaWNzPzogdW5rbm93bjtcbiAgLyoqIFNlZSB7QGxpbmsgSW5jb21pbmdNZXNzYWdlSW5pdC50cnVzdEZvcndhcmRlZEhvc3R9LiAqL1xuICBwdWJsaWMgcmVhZG9ubHkgdHJ1c3RGb3J3YXJkZWRIb3N0OiBib29sZWFuO1xuXG4gIHByaXZhdGUgc291cmNlPzogUmVhZGFibGU7XG4gIHByaXZhdGUgcHVtcGluZyA9IGZhbHNlO1xuXG4gIHB1YmxpYyBjb25zdHJ1Y3Rvcihpbml0OiBJbmNvbWluZ01lc3NhZ2VJbml0KSB7XG4gICAgLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIEB0eXBlc2NyaXB0LWVzbGludC9uby1leHBsaWNpdC1hbnlcbiAgICBzdXBlcihmYWtlU29ja2V0KGluaXQpIGFzIGFueSk7XG5cbiAgICBjb25zdCBoZWFkZXJzID0geyAuLi5pbml0LmhlYWRlcnMgfTtcbiAgICBjb25zdCBib2R5ID0gaW5pdC5ib2R5O1xuICAgIGlmIChcbiAgICAgIEJ1ZmZlci5pc0J1ZmZlcihib2R5KSAmJlxuICAgICAgaGVhZGVyc1tcImNvbnRlbnQtbGVuZ3RoXCJdID09PSB1bmRlZmluZWQgJiZcbiAgICAgIGhlYWRlcnNbXCJ0cmFuc2Zlci1lbmNvZGluZ1wiXSA9PT0gdW5kZWZpbmVkXG4gICAgKSB7XG4gICAgICAvLyBSRkMgOTExMDogYSBib2R5IHdpdGhvdXQgYSBsZW5ndGggaXMgdW5mcmFtZWQuIE5leHQuanMncyBib2R5IHBhcnNpbmdcbiAgICAgIC8vIGZvciBQYWdlcyBBUEkgcm91dGVzIHJlYWRzIGBjb250ZW50LWxlbmd0aGAsIGFuZCBBUEkgR2F0ZXdheSAvIEZ1bmN0aW9uXG4gICAgICAvLyBVUkwgZXZlbnRzIGRvIG5vdCBhbHdheXMgY2Fycnkgb25lLlxuICAgICAgaGVhZGVyc1tcImNvbnRlbnQtbGVuZ3RoXCJdID0gU3RyaW5nKEJ1ZmZlci5ieXRlTGVuZ3RoKGJvZHkpKTtcbiAgICB9XG5cbiAgICB0aGlzLnRydXN0Rm9yd2FyZGVkSG9zdCA9IGluaXQudHJ1c3RGb3J3YXJkZWRIb3N0ID8/IGZhbHNlO1xuICAgIHRoaXMubWV0aG9kID0gaW5pdC5tZXRob2QudG9VcHBlckNhc2UoKTtcbiAgICB0aGlzLnVybCA9IGluaXQudXJsO1xuICAgIHRoaXMuaGVhZGVycyA9IGhlYWRlcnM7XG4gICAgdGhpcy5odHRwVmVyc2lvbiA9IFwiMS4xXCI7XG4gICAgdGhpcy5odHRwVmVyc2lvbk1ham9yID0gMTtcbiAgICB0aGlzLmh0dHBWZXJzaW9uTWlub3IgPSAxO1xuXG4gICAgaWYgKGJvZHkgPT09IHVuZGVmaW5lZCkge1xuICAgICAgdGhpcy5jb21wbGV0ZSA9IHRydWU7XG4gICAgICB0aGlzLnB1c2gobnVsbCk7XG4gICAgfSBlbHNlIGlmIChCdWZmZXIuaXNCdWZmZXIoYm9keSkpIHtcbiAgICAgIHRoaXMuY29tcGxldGUgPSB0cnVlO1xuICAgICAgdGhpcy5wdXNoKGJvZHkpO1xuICAgICAgdGhpcy5wdXNoKG51bGwpO1xuICAgIH0gZWxzZSB7XG4gICAgICB0aGlzLnNvdXJjZSA9IGJvZHk7XG4gICAgfVxuICB9XG5cbiAgcHVibGljIG92ZXJyaWRlIF9yZWFkKHNpemU/OiBudW1iZXIpOiB2b2lkIHtcbiAgICBjb25zdCBzb3VyY2UgPSB0aGlzLnNvdXJjZTtcbiAgICBpZiAoIXNvdXJjZSkge1xuICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICBpZiAodGhpcy5wdW1waW5nKSB7XG4gICAgICBzb3VyY2UucmVzdW1lKCk7XG4gICAgICByZXR1cm47XG4gICAgfVxuICAgIHRoaXMucHVtcGluZyA9IHRydWU7XG4gICAgc291cmNlLm9uKFwiZGF0YVwiLCAoY2h1bms6IEJ1ZmZlcikgPT4ge1xuICAgICAgaWYgKCF0aGlzLnB1c2goY2h1bmspKSB7XG4gICAgICAgIHNvdXJjZS5wYXVzZSgpO1xuICAgICAgfVxuICAgIH0pO1xuICAgIHNvdXJjZS5vbihcImVuZFwiLCAoKSA9PiB7XG4gICAgICB0aGlzLmNvbXBsZXRlID0gdHJ1ZTtcbiAgICAgIHRoaXMucHVzaChudWxsKTtcbiAgICB9KTtcbiAgICBzb3VyY2Uub24oXCJlcnJvclwiLCAoZXJyb3IpID0+IHtcbiAgICAgIHRoaXMuZGVzdHJveShlcnJvcik7XG4gICAgfSk7XG4gICAgdm9pZCBzaXplO1xuICB9XG5cbiAgLyoqXG4gICAqIGBJbmNvbWluZ01lc3NhZ2UucHJvdG90eXBlLl9kZXN0cm95YCByZWFjaGVzIGZvciB0aGUgc29ja2V0IOKAlCBpdCBjYWxsc1xuICAgKiBgc3RyZWFtLmZpbmlzaGVkKClgIG9uIGl0IHRvIHdhaXQgZm9yIHRoZSBjb25uZWN0aW9uIHRvIGNsb3NlIOKAlCBhbmQgdGhyb3dzXG4gICAqIGBFUlJfSU5WQUxJRF9BUkdfVFlQRWAgb24gdGhlIHN5bnRoZXNpemVkIG9uZS4gVGhlcmUgaXMgbm8gY29ubmVjdGlvbiB0byB0ZWFyXG4gICAqIGRvd24gaGVyZSwgc28gdGhlIGRlc3Ryb3kgaXMganVzdCBjb21wbGV0ZWQsIGFmdGVyIHRoZSBgXCJhYm9ydGVkXCJgIHRoYXRcbiAgICogc2lnbmFscyBhIHRydW5jYXRlZCByZXF1ZXN0LlxuICAgKi9cbiAgcHVibGljIG92ZXJyaWRlIF9kZXN0cm95KFxuICAgIGVycm9yOiBFcnJvciB8IG51bGwsXG4gICAgY2FsbGJhY2s6IChlcnJvcj86IEVycm9yIHwgbnVsbCkgPT4gdm9pZCxcbiAgKTogdm9pZCB7XG4gICAgaWYgKCF0aGlzLnJlYWRhYmxlRW5kZWQgfHwgIXRoaXMuY29tcGxldGUpIHtcbiAgICAgIHRoaXMuYWJvcnRlZCA9IHRydWU7XG4gICAgICB0aGlzLmVtaXQoXCJhYm9ydGVkXCIpO1xuICAgIH1cbiAgICBjYWxsYmFjayhlcnJvcik7XG4gIH1cbn1cblxuLyoqIExvd2VyY2FzZXMgYW5kIGZsYXR0ZW5zIGEgYEhlYWRlcnNgIGludG8gYEluY29taW5nSHR0cEhlYWRlcnNgLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHRvSW5jb21pbmdIdHRwSGVhZGVycyhoZWFkZXJzOiBIZWFkZXJzKTogSW5jb21pbmdIdHRwSGVhZGVycyB7XG4gIGNvbnN0IHJlc3VsdDogSW5jb21pbmdIdHRwSGVhZGVycyA9IHt9O1xuICBoZWFkZXJzLmZvckVhY2goKHZhbHVlLCBuYW1lKSA9PiB7XG4gICAgaWYgKG5hbWUgPT09IFwic2V0LWNvb2tpZVwiKSB7XG4gICAgICAvLyBUaGUgb25seSByZXF1ZXN0IGhlYWRlciBOb2RlIG1vZGVscyBhcyBhbiBhcnJheS5cbiAgICAgIHJlc3VsdFtcInNldC1jb29raWVcIl0gPSBoZWFkZXJzLmdldFNldENvb2tpZSgpO1xuICAgICAgcmV0dXJuO1xuICAgIH1cbiAgICByZXN1bHRbbmFtZV0gPSB2YWx1ZTtcbiAgfSk7XG4gIHJldHVybiByZXN1bHQ7XG59XG4iXX0=

package/lib/runtime/http/request.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/runtime/http/request.test.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_stream_1 = require("node:stream");
+const request_1 = require("./request");
+async function readAll(stream) {
+    const chunks = [];
+    for await (const chunk of stream) {
+        chunks.push(chunk);
+    }
+    return Buffer.concat(chunks).toString("utf-8");
+}
+describe("ShimIncomingMessage", () => {
+    it("exposes the request line and headers Next.js reads", () => {
+        const req = new request_1.ShimIncomingMessage({
+            method: "get",
+            url: "/a?b=c",
+            headers: { host: "example.test" },
+        });
+        // Uppercased: Next.js compares `req.method === "POST"` in several places.
+        expect(req.method).toBe("GET");
+        expect(req.url).toBe("/a?b=c");
+        expect(req.headers.host).toBe("example.test");
+        expect(req.httpVersion).toBe("1.1");
+    });
+    it("ends the stream immediately when there is no body", async () => {
+        const req = new request_1.ShimIncomingMessage({
+            method: "GET",
+            url: "/",
+            headers: {},
+        });
+        expect(req.complete).toBe(true);
+        await expect(readAll(req)).resolves.toBe("");
+    });
+    it("frames a Buffer body with a content-length", async () => {
+        const req = new request_1.ShimIncomingMessage({
+            method: "POST",
+            url: "/api",
+            headers: { "content-type": "application/json" },
+            body: Buffer.from('{"a":1}'),
+        });
+        // Pages API body parsing reads `content-length`, and neither Function URL
+        // nor API Gateway events reliably carry one.
+        expect(req.headers["content-length"]).toBe("7");
+        await expect(readAll(req)).resolves.toBe('{"a":1}');
+    });
+    it("leaves an existing content-length alone", () => {
+        const req = new request_1.ShimIncomingMessage({
+            method: "POST",
+            url: "/api",
+            headers: { "content-length": "99" },
+            body: Buffer.from("ab"),
+        });
+        expect(req.headers["content-length"]).toBe("99");
+    });
+    it("pipes a streamed body through", async () => {
+        const req = new request_1.ShimIncomingMessage({
+            method: "PUT",
+            url: "/upload",
+            headers: { "transfer-encoding": "chunked" },
+            body: node_stream_1.Readable.from([Buffer.from("one "), Buffer.from("two")]),
+        });
+        await expect(readAll(req)).resolves.toBe("one two");
+        expect(req.complete).toBe(true);
+    });
+    it("destroys itself when the source stream errors", async () => {
+        const source = new node_stream_1.Readable({
+            read() {
+                this.destroy(new Error("upstream gone"));
+            },
+        });
+        const req = new request_1.ShimIncomingMessage({
+            method: "POST",
+            url: "/",
+            headers: {},
+            body: source,
+        });
+        await expect(readAll(req)).rejects.toThrow("upstream gone");
+    });
+    it("fills the socket fields that `send` and x-forwarded-for handling read", () => {
+        const req = new request_1.ShimIncomingMessage({
+            method: "GET",
+            url: "/",
+            headers: {},
+            remoteAddress: "203.0.113.7",
+            encrypted: false,
+        });
+        expect(req.socket.remoteAddress).toBe("203.0.113.7");
+        // `serveStatic` checks `res.socket.writable` before streaming a file.
+        expect(req.socket.writable).toBe(true);
+    });
+});
+describe("toIncomingHttpHeaders", () => {
+    it("flattens a Headers, keeping set-cookie as an array", () => {
+        const headers = new Headers({ "x-a": "1" });
+        headers.append("set-cookie", "a=1");
+        headers.append("set-cookie", "b=2");
+        expect((0, request_1.toIncomingHttpHeaders)(headers)).toEqual({
+            "x-a": "1",
+            "set-cookie": ["a=1", "b=2"],
+        });
+    });
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicmVxdWVzdC50ZXN0LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL3J1bnRpbWUvaHR0cC9yZXF1ZXN0LnRlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7QUFBQSw2Q0FBdUM7QUFDdkMsdUNBQXVFO0FBRXZFLEtBQUssVUFBVSxPQUFPLENBQUMsTUFBZ0I7SUFDckMsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksS0FBSyxFQUFFLE1BQU0sS0FBSyxJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQ2pDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBZSxDQUFDLENBQUM7SUFDL0IsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7QUFDakQsQ0FBQztBQUVELFFBQVEsQ0FBQyxxQkFBcUIsRUFBRSxHQUFHLEVBQUU7SUFDbkMsRUFBRSxDQUFDLG9EQUFvRCxFQUFFLEdBQUcsRUFBRTtRQUM1RCxNQUFNLEdBQUcsR0FBRyxJQUFJLDZCQUFtQixDQUFDO1lBQ2xDLE1BQU0sRUFBRSxLQUFLO1lBQ2IsR0FBRyxFQUFFLFFBQVE7WUFDYixPQUFPLEVBQUUsRUFBRSxJQUFJLEVBQUUsY0FBYyxFQUFFO1NBQ2xDLENBQUMsQ0FBQztRQUNILDBFQUEwRTtRQUMxRSxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvQixNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUMvQixNQUFNLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDOUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7SUFDdEMsQ0FBQyxDQUFDLENBQUM7SUFFSCxFQUFFLENBQUMsbURBQW1ELEVBQUUsS0FBSyxJQUFJLEVBQUU7UUFDakUsTUFBTSxHQUFHLEdBQUcsSUFBSSw2QkFBbUIsQ0FBQztZQUNsQyxNQUFNLEVBQUUsS0FBSztZQUNiLEdBQUcsRUFBRSxHQUFHO1lBQ1IsT0FBTyxFQUFFLEVBQUU7U0FDWixDQUFDLENBQUM7UUFDSCxNQUFNLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUNoQyxNQUFNLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO0lBQy9DLENBQUMsQ0FBQyxDQUFDO0lBRUgsRUFBRSxDQUFDLDRDQUE0QyxFQUFFLEtBQUssSUFBSSxFQUFFO1FBQzFELE1BQU0sR0FBRyxHQUFHLElBQUksNkJBQW1CLENBQUM7WUFDbEMsTUFBTSxFQUFFLE1BQU07WUFDZCxHQUFHLEVBQUUsTUFBTTtZQUNYLE9BQU8sRUFBRSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRTtZQUMvQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7U0FDN0IsQ0FBQyxDQUFDO1FBQ0gsMEVBQTBFO1FBQzFFLDZDQUE2QztRQUM3QyxNQUFNLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2hELE1BQU0sTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDdEQsQ0FBQyxDQUFDLENBQUM7SUFFSCxFQUFFLENBQUMseUNBQXlDLEVBQUUsR0FBRyxFQUFFO1FBQ2pELE1BQU0sR0FBRyxHQUFHLElBQUksNkJBQW1CLENBQUM7WUFDbEMsTUFBTSxFQUFFLE1BQU07WUFDZCxHQUFHLEVBQUUsTUFBTTtZQUNYLE9BQU8sRUFBRSxFQUFFLGdCQUFnQixFQUFFLElBQUksRUFBRTtZQUNuQyxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUM7U0FDeEIsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNuRCxDQUFDLENBQUMsQ0FBQztJQUVILEVBQUUsQ0FBQywrQkFBK0IsRUFBRSxLQUFLLElBQUksRUFBRTtRQUM3QyxNQUFNLEdBQUcsR0FBRyxJQUFJLDZCQUFtQixDQUFDO1lBQ2xDLE1BQU0sRUFBRSxLQUFLO1lBQ2IsR0FBRyxFQUFFLFNBQVM7WUFDZCxPQUFPLEVBQUUsRUFBRSxtQkFBbUIsRUFBRSxTQUFTLEVBQUU7WUFDM0MsSUFBSSxFQUFFLHNCQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7U0FDL0QsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxNQUFNLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNwRCxNQUFNLENBQUMsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNsQyxDQUFDLENBQUMsQ0FBQztJQUVILEVBQUUsQ0FBQywrQ0FBK0MsRUFBRSxLQUFLLElBQUksRUFBRTtRQUM3RCxNQUFNLE1BQU0sR0FBRyxJQUFJLHNCQUFRLENBQUM7WUFDMUIsSUFBSTtnQkFDRixJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksS0FBSyxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUM7WUFDM0MsQ0FBQztTQUNGLENBQUMsQ0FBQztRQUNILE1BQU0sR0FBRyxHQUFHLElBQUksNkJBQW1CLENBQUM7WUFDbEMsTUFBTSxFQUFFLE1BQU07WUFDZCxHQUFHLEVBQUUsR0FBRztZQUNSLE9BQU8sRUFBRSxFQUFFO1lBQ1gsSUFBSSxFQUFFLE1BQU07U0FDYixDQUFDLENBQUM7UUFDSCxNQUFNLE1BQU0sQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxDQUFDO0lBQzlELENBQUMsQ0FBQyxDQUFDO0lBRUgsRUFBRSxDQUFDLHVFQUF1RSxFQUFFLEdBQUcsRUFBRTtRQUMvRSxNQUFNLEdBQUcsR0FBRyxJQUFJLDZCQUFtQixDQUFDO1lBQ2xDLE1BQU0sRUFBRSxLQUFLO1lBQ2IsR0FBRyxFQUFFLEdBQUc7WUFDUixPQUFPLEVBQUUsRUFBRTtZQUNYLGFBQWEsRUFBRSxhQUFhO1lBQzVCLFNBQVMsRUFBRSxLQUFLO1NBQ2pCLENBQUMsQ0FBQztRQUNILE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUNyRCxzRUFBc0U7UUFDdEUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3pDLENBQUMsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDLENBQUM7QUFFSCxRQUFRLENBQUMsdUJBQXVCLEVBQUUsR0FBRyxFQUFFO0lBQ3JDLEVBQUUsQ0FBQyxvREFBb0QsRUFBRSxHQUFHLEVBQUU7UUFDNUQsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsRUFBRSxLQUFLLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUM1QyxPQUFPLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNwQyxPQUFPLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNwQyxNQUFNLENBQUMsSUFBQSwrQkFBcUIsRUFBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztZQUM3QyxLQUFLLEVBQUUsR0FBRztZQUNWLFlBQVksRUFBRSxDQUFDLEtBQUssRUFBRSxLQUFLLENBQUM7U0FDN0IsQ0FBQyxDQUFDO0lBQ0wsQ0FBQyxDQUFDLENBQUM7QUFDTCxDQUFDLENBQUMsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IFJlYWRhYmxlIH0gZnJvbSBcIm5vZGU6c3RyZWFtXCI7XG5pbXBvcnQgeyBTaGltSW5jb21pbmdNZXNzYWdlLCB0b0luY29taW5nSHR0cEhlYWRlcnMgfSBmcm9tIFwiLi9yZXF1ZXN0XCI7XG5cbmFzeW5jIGZ1bmN0aW9uIHJlYWRBbGwoc3RyZWFtOiBSZWFkYWJsZSk6IFByb21pc2U8c3RyaW5nPiB7XG4gIGNvbnN0IGNodW5rczogQnVmZmVyW10gPSBbXTtcbiAgZm9yIGF3YWl0IChjb25zdCBjaHVuayBvZiBzdHJlYW0pIHtcbiAgICBjaHVua3MucHVzaChjaHVuayBhcyBCdWZmZXIpO1xuICB9XG4gIHJldHVybiBCdWZmZXIuY29uY2F0KGNodW5rcykudG9TdHJpbmcoXCJ1dGYtOFwiKTtcbn1cblxuZGVzY3JpYmUoXCJTaGltSW5jb21pbmdNZXNzYWdlXCIsICgpID0+IHtcbiAgaXQoXCJleHBvc2VzIHRoZSByZXF1ZXN0IGxpbmUgYW5kIGhlYWRlcnMgTmV4dC5qcyByZWFkc1wiLCAoKSA9PiB7XG4gICAgY29uc3QgcmVxID0gbmV3IFNoaW1JbmNvbWluZ01lc3NhZ2Uoe1xuICAgICAgbWV0aG9kOiBcImdldFwiLFxuICAgICAgdXJsOiBcIi9hP2I9Y1wiLFxuICAgICAgaGVhZGVyczogeyBob3N0OiBcImV4YW1wbGUudGVzdFwiIH0sXG4gICAgfSk7XG4gICAgLy8gVXBwZXJjYXNlZDogTmV4dC5qcyBjb21wYXJlcyBgcmVxLm1ldGhvZCA9PT0gXCJQT1NUXCJgIGluIHNldmVyYWwgcGxhY2VzLlxuICAgIGV4cGVjdChyZXEubWV0aG9kKS50b0JlKFwiR0VUXCIpO1xuICAgIGV4cGVjdChyZXEudXJsKS50b0JlKFwiL2E/Yj1jXCIpO1xuICAgIGV4cGVjdChyZXEuaGVhZGVycy5ob3N0KS50b0JlKFwiZXhhbXBsZS50ZXN0XCIpO1xuICAgIGV4cGVjdChyZXEuaHR0cFZlcnNpb24pLnRvQmUoXCIxLjFcIik7XG4gIH0pO1xuXG4gIGl0KFwiZW5kcyB0aGUgc3RyZWFtIGltbWVkaWF0ZWx5IHdoZW4gdGhlcmUgaXMgbm8gYm9keVwiLCBhc3luYyAoKSA9PiB7XG4gICAgY29uc3QgcmVxID0gbmV3IFNoaW1JbmNvbWluZ01lc3NhZ2Uoe1xuICAgICAgbWV0aG9kOiBcIkdFVFwiLFxuICAgICAgdXJsOiBcIi9cIixcbiAgICAgIGhlYWRlcnM6IHt9LFxuICAgIH0pO1xuICAgIGV4cGVjdChyZXEuY29tcGxldGUpLnRvQmUodHJ1ZSk7XG4gICAgYXdhaXQgZXhwZWN0KHJlYWRBbGwocmVxKSkucmVzb2x2ZXMudG9CZShcIlwiKTtcbiAgfSk7XG5cbiAgaXQoXCJmcmFtZXMgYSBCdWZmZXIgYm9keSB3aXRoIGEgY29udGVudC1sZW5ndGhcIiwgYXN5bmMgKCkgPT4ge1xuICAgIGNvbnN0IHJlcSA9IG5ldyBTaGltSW5jb21pbmdNZXNzYWdlKHtcbiAgICAgIG1ldGhvZDogXCJQT1NUXCIsXG4gICAgICB1cmw6IFwiL2FwaVwiLFxuICAgICAgaGVhZGVyczogeyBcImNvbnRlbnQtdHlwZVwiOiBcImFwcGxpY2F0aW9uL2pzb25cIiB9LFxuICAgICAgYm9keTogQnVmZmVyLmZyb20oJ3tcImFcIjoxfScpLFxuICAgIH0pO1xuICAgIC8vIFBhZ2VzIEFQSSBib2R5IHBhcnNpbmcgcmVhZHMgYGNvbnRlbnQtbGVuZ3RoYCwgYW5kIG5laXRoZXIgRnVuY3Rpb24gVVJMXG4gICAgLy8gbm9yIEFQSSBHYXRld2F5IGV2ZW50cyByZWxpYWJseSBjYXJyeSBvbmUuXG4gICAgZXhwZWN0KHJlcS5oZWFkZXJzW1wiY29udGVudC1sZW5ndGhcIl0pLnRvQmUoXCI3XCIpO1xuICAgIGF3YWl0IGV4cGVjdChyZWFkQWxsKHJlcSkpLnJlc29sdmVzLnRvQmUoJ3tcImFcIjoxfScpO1xuICB9KTtcblxuICBpdChcImxlYXZlcyBhbiBleGlzdGluZyBjb250ZW50LWxlbmd0aCBhbG9uZVwiLCAoKSA9PiB7XG4gICAgY29uc3QgcmVxID0gbmV3IFNoaW1JbmNvbWluZ01lc3NhZ2Uoe1xuICAgICAgbWV0aG9kOiBcIlBPU1RcIixcbiAgICAgIHVybDogXCIvYXBpXCIsXG4gICAgICBoZWFkZXJzOiB7IFwiY29udGVudC1sZW5ndGhcIjogXCI5OVwiIH0sXG4gICAgICBib2R5OiBCdWZmZXIuZnJvbShcImFiXCIpLFxuICAgIH0pO1xuICAgIGV4cGVjdChyZXEuaGVhZGVyc1tcImNvbnRlbnQtbGVuZ3RoXCJdKS50b0JlKFwiOTlcIik7XG4gIH0pO1xuXG4gIGl0KFwicGlwZXMgYSBzdHJlYW1lZCBib2R5IHRocm91Z2hcIiwgYXN5bmMgKCkgPT4ge1xuICAgIGNvbnN0IHJlcSA9IG5ldyBTaGltSW5jb21pbmdNZXNzYWdlKHtcbiAgICAgIG1ldGhvZDogXCJQVVRcIixcbiAgICAgIHVybDogXCIvdXBsb2FkXCIsXG4gICAgICBoZWFkZXJzOiB7IFwidHJhbnNmZXItZW5jb2RpbmdcIjogXCJjaHVua2VkXCIgfSxcbiAgICAgIGJvZHk6IFJlYWRhYmxlLmZyb20oW0J1ZmZlci5mcm9tKFwib25lIFwiKSwgQnVmZmVyLmZyb20oXCJ0d29cIildKSxcbiAgICB9KTtcbiAgICBhd2FpdCBleHBlY3QocmVhZEFsbChyZXEpKS5yZXNvbHZlcy50b0JlKFwib25lIHR3b1wiKTtcbiAgICBleHBlY3QocmVxLmNvbXBsZXRlKS50b0JlKHRydWUpO1xuICB9KTtcblxuICBpdChcImRlc3Ryb3lzIGl0c2VsZiB3aGVuIHRoZSBzb3VyY2Ugc3RyZWFtIGVycm9yc1wiLCBhc3luYyAoKSA9PiB7XG4gICAgY29uc3Qgc291cmNlID0gbmV3IFJlYWRhYmxlKHtcbiAgICAgIHJlYWQoKSB7XG4gICAgICAgIHRoaXMuZGVzdHJveShuZXcgRXJyb3IoXCJ1cHN0cmVhbSBnb25lXCIpKTtcbiAgICAgIH0sXG4gICAgfSk7XG4gICAgY29uc3QgcmVxID0gbmV3IFNoaW1JbmNvbWluZ01lc3NhZ2Uoe1xuICAgICAgbWV0aG9kOiBcIlBPU1RcIixcbiAgICAgIHVybDogXCIvXCIsXG4gICAgICBoZWFkZXJzOiB7fSxcbiAgICAgIGJvZHk6IHNvdXJjZSxcbiAgICB9KTtcbiAgICBhd2FpdCBleHBlY3QocmVhZEFsbChyZXEpKS5yZWplY3RzLnRvVGhyb3coXCJ1cHN0cmVhbSBnb25lXCIpO1xuICB9KTtcblxuICBpdChcImZpbGxzIHRoZSBzb2NrZXQgZmllbGRzIHRoYXQgYHNlbmRgIGFuZCB4LWZvcndhcmRlZC1mb3IgaGFuZGxpbmcgcmVhZFwiLCAoKSA9PiB7XG4gICAgY29uc3QgcmVxID0gbmV3IFNoaW1JbmNvbWluZ01lc3NhZ2Uoe1xuICAgICAgbWV0aG9kOiBcIkdFVFwiLFxuICAgICAgdXJsOiBcIi9cIixcbiAgICAgIGhlYWRlcnM6IHt9LFxuICAgICAgcmVtb3RlQWRkcmVzczogXCIyMDMuMC4xMTMuN1wiLFxuICAgICAgZW5jcnlwdGVkOiBmYWxzZSxcbiAgICB9KTtcbiAgICBleHBlY3QocmVxLnNvY2tldC5yZW1vdGVBZGRyZXNzKS50b0JlKFwiMjAzLjAuMTEzLjdcIik7XG4gICAgLy8gYHNlcnZlU3RhdGljYCBjaGVja3MgYHJlcy5zb2NrZXQud3JpdGFibGVgIGJlZm9yZSBzdHJlYW1pbmcgYSBmaWxlLlxuICAgIGV4cGVjdChyZXEuc29ja2V0LndyaXRhYmxlKS50b0JlKHRydWUpO1xuICB9KTtcbn0pO1xuXG5kZXNjcmliZShcInRvSW5jb21pbmdIdHRwSGVhZGVyc1wiLCAoKSA9PiB7XG4gIGl0KFwiZmxhdHRlbnMgYSBIZWFkZXJzLCBrZWVwaW5nIHNldC1jb29raWUgYXMgYW4gYXJyYXlcIiwgKCkgPT4ge1xuICAgIGNvbnN0IGhlYWRlcnMgPSBuZXcgSGVhZGVycyh7IFwieC1hXCI6IFwiMVwiIH0pO1xuICAgIGhlYWRlcnMuYXBwZW5kKFwic2V0LWNvb2tpZVwiLCBcImE9MVwiKTtcbiAgICBoZWFkZXJzLmFwcGVuZChcInNldC1jb29raWVcIiwgXCJiPTJcIik7XG4gICAgZXhwZWN0KHRvSW5jb21pbmdIdHRwSGVhZGVycyhoZWFkZXJzKSkudG9FcXVhbCh7XG4gICAgICBcIngtYVwiOiBcIjFcIixcbiAgICAgIFwic2V0LWNvb2tpZVwiOiBbXCJhPTFcIiwgXCJiPTJcIl0sXG4gICAgfSk7XG4gIH0pO1xufSk7XG4iXX0=

package/lib/runtime/http/response.d.ts

@@ -0,0 +1,77 @@
+import type { OutgoingHttpHeaders, ServerResponse } from "node:http";
+import { Transform } from "node:stream";
+import type { TransformCallback } from "node:stream";
+export interface ResponseHead {
+    readonly statusCode: number;
+    readonly statusMessage?: string;
+    /**
+     * Flat header map with `set-cookie` removed — a `Record<string, string>`
+     * cannot represent it, and both sinks take cookies separately.
+     */
+    readonly headers: Record<string, string>;
+    readonly cookies: string[];
+}
+/**
+ * One entry per `Set-Cookie` line, the way Node's `ServerResponse` emits them:
+ * each array element is a whole cookie and a string is exactly one. Nothing here
+ * splits on commas — `Expires=` dates contain one in every format (`Wed, 21 Oct`,
+ * `Wednesday, 21-Oct-26`), and a heuristic split turns one cookie into a session
+ * cookie on the wrong path plus a junk one.
+ */
+export declare function setCookieList(value: string | string[] | number): string[];
+type HeaderValue = string | number | string[];
+export declare class ShimServerResponse extends Transform {
+    statusCode: number;
+    statusMessage?: string;
+    headersSent: boolean;
+    /** Accepted and ignored: there is no socket to schedule a `Date` header on. */
+    sendDate: boolean;
+    strictContentLength: boolean;
+    chunkedEncoding: boolean;
+    shouldKeepAlive: boolean;
+    useChunkedEncodingByDefault: boolean;
+    /** Set by Next.js in a few places; never read by us. */
+    req?: unknown;
+    /**
+     * Installed by the runtime core when it inserts gzip, so that Next.js's
+     * per-chunk `if ("flush" in res) res.flush()` actually reaches the
+     * compressor. Without it, streamed HTML sits in zlib's buffer.
+     */
+    flush?: () => void;
+    /** Lowercased name → original casing + value, mirroring Node's own store. */
+    private readonly headerStore;
+    constructor();
+    setHeader(name: string, value: HeaderValue): this;
+    appendHeader(name: string, value: string | string[]): this;
+    getHeader(name: string): HeaderValue | undefined;
+    getHeaders(): OutgoingHttpHeaders;
+    getHeaderNames(): string[];
+    hasHeader(name: string): boolean;
+    removeHeader(name: string): void;
+    writeHead(statusCode: number, statusMessageOrHeaders?: string | OutgoingHttpHeaders | HeaderValue[], maybeHeaders?: OutgoingHttpHeaders | HeaderValue[]): this;
+    /**
+     * Freezes status + headers and emits them as the `"head"` event. Called
+     * explicitly by Next.js before it streams, and lazily by this class on the
+     * first byte or on `end()` when it isn't.
+     */
+    flushHeaders(): void;
+    /** Deprecated on `ServerResponse`, but `NodeNextResponse.sent` reads it. */
+    get finished(): boolean;
+    private buildHead;
+    _transform(chunk: unknown, _encoding: BufferEncoding, callback: TransformCallback): void;
+    _flush(callback: TransformCallback): void;
+    addTrailers(): never;
+    assignSocket(): never;
+    detachSocket(): never;
+    writeContinue(): never;
+    writeEarlyHints(): never;
+    writeProcessing(): never;
+}
+/**
+ * `ShimServerResponse` is structurally a `ServerResponse` for everything Next.js
+ * touches, but not nominally one (no socket, no trailers). The entrypoint
+ * signature wants the real type, so the cast is centralized here with the
+ * reasoning attached rather than repeated at each call site.
+ */
+export declare function asServerResponse(res: ShimServerResponse): ServerResponse;
+export {};