edgeaegis 2026.10.1

package/tools/.build/scr/runtime/index.js

@@ -0,0 +1,355 @@
+import { digest, requireInteger, ShieldError, stableJson, } from "../core/types.js";
+import { canonicalPath, checkBoundary, limitsWith, readBody, } from "../http-boundary/index.js";
+import { parseStrictJson } from "../http-boundary/json.js";
+import { compileSecLang, executeSecLang } from "../seclang/index.js";
+import { createAllowlist } from "./allowlist.js";
+import { validateBrowserCache } from "./browser-cache.js";
+import { createErrorPages } from "./error-pages.js";
+import { createProxy } from "./proxy.js";
+export async function createShield(input) {
+    // Capture immutable policy and config; callers cannot mutate enforcement after validation.
+    const options = {
+        ...input,
+        routes: structuredClone(input.routes),
+        publicHosts: [...input.publicHosts],
+        allowlist: structuredClone(input.allowlist ?? []),
+    };
+    if (!/^[A-Za-z0-9_-]{1,64}$/.test(options.tenant) ||
+        !/^[A-Za-z0-9_-]{1,64}$/.test(options.service))
+        throw new Error("Invalid tenant/service");
+    if (typeof input.secLang !== "string" || !input.secLang.trim())
+        throw new Error("Native secLang input is required");
+    const version = await digest(stableJson({
+        source: input.secLang,
+        files: input.secLangOptions?.files ?? {},
+        phraseFiles: input.secLangOptions?.phraseFiles ?? {},
+        fileName: input.secLangOptions?.fileName ?? "main.conf",
+        allowlist: options.allowlist,
+    }));
+    const proxies = new Map();
+    for (const [name, origin] of Object.entries(options.origins)) {
+        if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(name))
+            throw new Error("Invalid business name");
+        proxies.set(name, createProxy(origin));
+    }
+    if (!proxies.size)
+        throw new Error("At least one business origin is required");
+    const errorPages = createErrorPages(options.errorPages ?? {});
+    const limits = limitsWith(options.limits);
+    const maxConcurrent = requireInteger(options.maxConcurrentRequests ?? 64, 1, 10000, "max concurrent requests");
+    const now = options.now ?? Date.now;
+    const stats = {
+        requests: 0,
+        ruleEvaluations: 0,
+        blocked: 0,
+        originRequests: 0,
+        eventFailures: 0,
+    };
+    const routes = new Map();
+    for (const route of options.routes) {
+        validateBrowserCache(route.browserCache);
+        if (route.browserCache && (route.authenticated || route.websocket))
+            throw new Error("Browser caching requires an anonymous HTTP route");
+        if (typeof route.authenticated !== "boolean" ||
+            !proxies.has(route.business) ||
+            (route.websocket !== undefined && typeof route.websocket !== "boolean") ||
+            !Array.isArray(route.methods) ||
+            ![undefined, "none", "json", "text"].includes(route.body))
+            throw new Error("Routes require a configured business, explicit authenticated boolean, methods and a supported body profile");
+        if (canonicalPath(route.path) !== route.path ||
+            routes.has(route.path) ||
+            !route.methods.length ||
+            route.methods.some((m) => !/^[A-Z]{1,20}$/.test(m) || ["CONNECT", "TRACE"].includes(m)))
+            throw new Error("Invalid/duplicate route");
+        routes.set(route.path, route);
+    }
+    let active = 0;
+    const isAllowlisted = createAllowlist(options.allowlist);
+    const nativeProgram = input.secLang
+        ? compileSecLang(input.secLang, {
+            ...input.secLangOptions,
+            requestBodyLimit: limits.maxBodyBytes,
+            now,
+            strict: true,
+        })
+        : undefined;
+    if (nativeProgram && !nativeProgram.supportedRules) {
+        nativeProgram.dispose();
+        throw new Error("SecLang ruleset is empty or unsupported");
+    }
+    let disposed = false;
+    async function handle(request, context, rawTarget, hooks = {}) {
+        const emit = (kind, source, reason, ruleId) => {
+            const event = {
+                id: crypto.randomUUID(),
+                tenant: options.tenant,
+                at: now(),
+                kind,
+                source,
+                reason,
+                policy: version,
+            };
+            if (ruleId)
+                event.ruleId = ruleId;
+            for (const listener of [options.event, hooks.event])
+                try {
+                    listener?.(event);
+                }
+                catch {
+                    stats.eventFailures++;
+                }
+        };
+        const denied = (request, status, source, reason, ruleId) => {
+            stats.blocked++;
+            emit("block", source, reason, ruleId);
+            return (errorPages(request, status) ??
+                Response.json({ error: "request_rejected", reason }, { status, headers: { "cache-control": "no-store", "x-content-type-options": "nosniff" } }));
+        };
+        context = structuredClone(context);
+        stats.requests++;
+        if (disposed)
+            return denied(request, 503, "boundary", "engine-closed");
+        if (active >= maxConcurrent)
+            return denied(request, 503, "boundary", "concurrency-capacity");
+        active++;
+        let released = false;
+        const release = () => {
+            if (!released) {
+                active--;
+                if (disposed && active === 0)
+                    nativeProgram?.dispose();
+                released = true;
+            }
+        };
+        let streaming = false;
+        let pendingUpgrade;
+        let source = "boundary";
+        try {
+            if (context.tenant !== options.tenant)
+                throw new ShieldError("tenant-mismatch", 403);
+            if (context.identity !== undefined &&
+                (context.identity.length === 0 || context.identity.length > 256))
+                throw new ShieldError("invalid-trusted-identity", 403);
+            if (context.verifiedClientIp !== undefined &&
+                (context.verifiedClientIp.length > 64 || !/^[0-9a-fA-F:.]+$/.test(context.verifiedClientIp)))
+                throw new ShieldError("invalid-verified-ip", 403);
+            const upgrade = request.headers.has("upgrade");
+            const { url, path } = checkBoundary(request, limits, options.publicHosts, rawTarget, upgrade ? "websocket" : "http");
+            source = "route";
+            const route = routes.get(path);
+            if (!route)
+                throw new ShieldError("unknown-route", 404);
+            if (!route.methods.includes(request.method))
+                throw new ShieldError("method-not-allowed", 405);
+            if (upgrade && !route.websocket)
+                throw new ShieldError("websocket-route-required", 426);
+            source = "identity";
+            if (route.authenticated && !context.identity)
+                throw new ShieldError("authentication-required", 401);
+            source = "boundary";
+            const body = await readBody(request, limits);
+            const contentType = (request.headers.get("content-type") ?? "")
+                .split(";")[0]
+                .trim()
+                .toLowerCase();
+            if (contentType === "application/grpc" || contentType.startsWith("application/grpc+"))
+                throw new ShieldError("native-grpc-requires-http2-ingress", 501);
+            if ((route.body ?? "none") === "none" && body.length)
+                throw new ShieldError("body-not-allowed");
+            let bodyText = "";
+            if (body.length && route.body === "json") {
+                try {
+                    bodyText = new TextDecoder("utf-8", { fatal: true }).decode(body);
+                }
+                catch {
+                    throw new ShieldError("invalid-utf8-body");
+                }
+            }
+            if (body.length && route.body === "json") {
+                if (!/^application\/json(?:\s*;\s*charset=utf-8)?$/i.test(request.headers.get("content-type") ?? ""))
+                    throw new ShieldError("json-content-type-required", 415);
+                parseStrictJson(bodyText);
+            }
+            const nativeInput = {
+                url: url.href,
+                method: request.method,
+                headers: request.headers,
+                bodyText,
+                bodyBytes: body,
+                protocol: context.httpProtocol,
+                remoteAddr: context.verifiedClientIp,
+                rawTarget,
+            };
+            const skipNativeRule = options.allowlist.length
+                ? (id) => isAllowlisted(path, request.method, context, id, now()) ||
+                    isAllowlisted(path, request.method, context, `sec-${id}`, now())
+                : undefined;
+            let nativeTransaction;
+            if (nativeProgram) {
+                // Native SecLang runs AFTER route/auth/body limits and BEFORE origin forwarding.
+                // Rejections are final; unsupported directives have already failed at configuration load.
+                const native = executeSecLang(nativeProgram, nativeInput, {
+                    shouldSkip: skipNativeRule,
+                });
+                stats.ruleEvaluations += nativeProgram.supportedRules;
+                nativeTransaction = native.transaction;
+                if (native.blocked) {
+                    executeSecLang(nativeProgram, { ...nativeInput, responseStatus: native.status }, {
+                        phases: [5],
+                        transaction: nativeTransaction,
+                        shouldSkip: skipNativeRule,
+                    });
+                    return denied(request, native.status, "rule", "seclang-native-rule-match", native.matched.at(-1) ? `sec-${native.matched.at(-1)}` : undefined);
+                }
+                if (native.transaction.bodyParseError) {
+                    executeSecLang(nativeProgram, { ...nativeInput, responseStatus: 400 }, { phases: [5], transaction: native.transaction, shouldSkip: skipNativeRule });
+                    return denied(request, 400, "boundary", "invalid-request-body");
+                }
+                for (const event of native.events)
+                    if (event.log)
+                        emit("detect", "rule", "seclang-native-observed", `sec-${event.id}`);
+            }
+            source = "proxy";
+            stats.originRequests++;
+            const inspectResponse = nativeProgram?.instructions.some((rule) => "actions" in rule && Number(rule.actions.phase) >= 3);
+            let response = await proxies.get(route.business)(request, url, path, body, inspectResponse ? () => { } : release, upgrade, context.identity ? undefined : route.browserCache);
+            if (response.status === 101)
+                pendingUpgrade = response;
+            if (nativeProgram && inspectResponse && nativeTransaction) {
+                const responseInput = {
+                    ...nativeInput,
+                    responseStatus: response.status,
+                    responseHeaders: response.headers,
+                };
+                const headersResult = executeSecLang(nativeProgram, responseInput, {
+                    phases: [3],
+                    transaction: nativeTransaction,
+                    shouldSkip: skipNativeRule,
+                });
+                if (headersResult.blocked) {
+                    closeUpgrade(response);
+                    await response.body?.cancel();
+                    executeSecLang(nativeProgram, responseInput, {
+                        phases: [5],
+                        transaction: nativeTransaction,
+                        shouldSkip: skipNativeRule,
+                    });
+                    return denied(request, headersResult.status, "rule", "seclang-response-rule-match", `sec-${headersResult.matched.at(-1)}`);
+                }
+                const inspectBody = nativeProgram.instructions.some((rule) => "actions" in rule && rule.actions.phase === 4);
+                if (response.status === 101) {
+                    const result = executeSecLang(nativeProgram, { ...responseInput, responseBodyBytes: new Uint8Array() }, {
+                        phases: [4, 5],
+                        transaction: nativeTransaction,
+                        shouldSkip: skipNativeRule,
+                    });
+                    if (result.blocked) {
+                        closeUpgrade(response);
+                        return denied(request, result.status, "rule", "seclang-response-rule-match", `sec-${result.matched.at(-1)}`);
+                    }
+                    emit("allow", "proxy", "websocket-handshake-forwarded");
+                    pendingUpgrade = undefined;
+                    return response;
+                }
+                const bytes = inspectBody && response.body ? new Uint8Array(await response.arrayBuffer()) : undefined;
+                const bodyResult = executeSecLang(nativeProgram, { ...responseInput, ...(bytes ? { responseBodyBytes: bytes } : {}) }, {
+                    phases: inspectBody ? [4, 5] : [5],
+                    transaction: nativeTransaction,
+                    shouldSkip: skipNativeRule,
+                });
+                if (bodyResult.blocked) {
+                    if (!bytes)
+                        await response.body?.cancel();
+                    return denied(request, bodyResult.status, "rule", "seclang-response-rule-match", `sec-${bodyResult.matched.at(-1)}`);
+                }
+                if (bytes) {
+                    let sent = false;
+                    const stream = new ReadableStream({
+                        pull(controller) {
+                            if (!sent && bytes.length) {
+                                sent = true;
+                                controller.enqueue(bytes);
+                            }
+                            else {
+                                release();
+                                controller.close();
+                            }
+                        },
+                        cancel() {
+                            release();
+                        },
+                    }, { highWaterMark: 0 });
+                    response = new Response(stream, {
+                        status: response.status,
+                        statusText: response.statusText,
+                        headers: response.headers,
+                    });
+                }
+                else if (response.body) {
+                    const reader = response.body.getReader();
+                    response = new Response(new ReadableStream({
+                        async pull(controller) {
+                            try {
+                                const item = await reader.read();
+                                if (item.done) {
+                                    release();
+                                    controller.close();
+                                }
+                                else
+                                    controller.enqueue(item.value);
+                            }
+                            catch (error) {
+                                release();
+                                controller.error(error);
+                            }
+                        },
+                        async cancel(reason) {
+                            try {
+                                await reader.cancel(reason);
+                            }
+                            finally {
+                                release();
+                            }
+                        },
+                    }, { highWaterMark: 0 }), { status: response.status, statusText: response.statusText, headers: response.headers });
+                }
+            }
+            streaming = response.body !== null;
+            emit("allow", "proxy", "forwarded");
+            pendingUpgrade = undefined;
+            return response;
+        }
+        catch (error) {
+            if (error instanceof ShieldError)
+                return denied(request, error.status, source, error.code);
+            emit("error", source, "internal-error");
+            return denied(request, 500, source, "internal-error");
+        }
+        finally {
+            if (pendingUpgrade)
+                closeUpgrade(pendingUpgrade);
+            if (!streaming)
+                release();
+        }
+    }
+    return {
+        handle: (request, context, rawTarget, hooks) => handle(request, context, rawTarget, hooks),
+        version,
+        dispose() {
+            disposed = true;
+            if (active === 0)
+                nativeProgram?.dispose();
+        },
+        stats,
+    };
+}
+function closeUpgrade(response) {
+    const socket = response.webSocket;
+    try {
+        socket?.close(1008, "Handshake rejected");
+    }
+    catch {
+        /* Already closed. */
+    }
+}
+//# sourceMappingURL=index.js.map

package/tools/.build/scr/runtime/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../scr/runtime/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,cAAc,EAEd,WAAW,EACX,UAAU,GAEX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAEL,aAAa,EACb,aAAa,EACb,UAAU,EACV,QAAQ,GACT,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAA8B,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACjG,OAAO,EAAuB,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAA2B,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAmB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAqB,MAAM,YAAY,CAAC;AAqC5D,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAoB;IACrD,2FAA2F;IAC3F,MAAM,OAAO,GAAG;QACd,GAAG,KAAK;QACR,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;QACrC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;QACnC,SAAS,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;KAClD,CAAC;IACF,IACE,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QAC7C,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAE9C,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE;QAC5D,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,MAAM,CAC1B,UAAU,CAAC;QACT,MAAM,EAAE,KAAK,CAAC,OAAO;QACrB,KAAK,EAAE,KAAK,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;QACxC,WAAW,EAAE,KAAK,CAAC,cAAc,EAAE,WAAW,IAAI,EAAE;QACpD,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,QAAQ,IAAI,WAAW;QACvD,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CACH,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAA0C,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC7F,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,cAAc,CAClC,OAAO,CAAC,qBAAqB,IAAI,EAAE,EACnC,CAAC,EACD,KAAK,EACL,yBAAyB,CAC1B,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG;QACZ,QAAQ,EAAE,CAAC;QACX,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,CAAC;QACV,cAAc,EAAE,CAAC;QACjB,aAAa,EAAE,CAAC;KACjB,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAiB,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnC,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,IACE,OAAO,KAAK,CAAC,aAAa,KAAK,SAAS;YACxC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC5B,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;YACvE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YAC7B,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAEzD,MAAM,IAAI,KAAK,CACb,4GAA4G,CAC7G,CAAC;QACJ,IACE,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI;YACxC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACtB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM;YACrB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAEvF,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,aAAa,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,KAAK,CAAC,OAAO;QACjC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5B,GAAG,KAAK,CAAC,cAAc;YACvB,gBAAgB,EAAE,MAAM,CAAC,YAAY;YACrC,GAAG;YACH,MAAM,EAAE,IAAI;SACb,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,aAAa,IAAI,CAAC,aAAa,CAAC,cAAc,EAAE,CAAC;QACnD,aAAa,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAC;IAErB,KAAK,UAAU,MAAM,CACnB,OAAgB,EAChB,OAAuB,EACvB,SAAkB,EAClB,KAAK,GAA+C,EAAE;QAEtD,MAAM,IAAI,GAAG,CACX,IAA2B,EAC3B,MAA+B,EAC/B,MAAc,EACd,MAAe,EACf,EAAE;YACF,MAAM,KAAK,GAAkB;gBAC3B,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,EAAE,EAAE,GAAG,EAAE;gBACT,IAAI;gBACJ,MAAM;gBACN,MAAM;gBACN,MAAM,EAAE,OAAO;aAChB,CAAC;YACF,IAAI,MAAM;gBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;YAClC,KAAK,MAAM,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;gBACjD,IAAI,CAAC;oBACH,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,CAAC,aAAa,EAAE,CAAC;gBACxB,CAAC;QACL,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,CACb,OAAgB,EAChB,MAAc,EACd,MAA+B,EAC/B,MAAc,EACd,MAAe,EACf,EAAE;YACF,KAAK,CAAC,OAAO,EAAE,CAAC;YAChB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACtC,OAAO,CACL,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,EACrC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,EAAE,SAAS,EAAE,EAAE,CAC1F,CACF,CAAC;QACJ,CAAC,CAAC;QACF,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QACnC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjB,IAAI,QAAQ;YAAE,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QACvE,IAAI,MAAM,IAAI,aAAa;YAAE,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;QAC7F,MAAM,EAAE,CAAC;QACT,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,EAAE,CAAC;gBACT,IAAI,QAAQ,IAAI,MAAM,KAAK,CAAC;oBAAE,aAAa,EAAE,OAAO,EAAE,CAAC;gBACvD,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;QACH,CAAC,CAAC;QACF,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,cAAoC,CAAC;QACzC,IAAI,MAAM,GAA4B,UAAU,CAAC;QACjD,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;gBAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;YACrF,IACE,OAAO,CAAC,QAAQ,KAAK,SAAS;gBAC9B,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC;gBAEhE,MAAM,IAAI,WAAW,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YACzD,IACE,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACtC,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;gBAE5F,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;YACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/C,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CACjC,OAAO,EACP,MAAM,EACN,OAAO,CAAC,WAAW,EACnB,SAAS,EACT,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAC/B,CAAC;YACF,MAAM,GAAG,OAAO,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/B,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;YAC9F,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,0BAA0B,EAAE,GAAG,CAAC,CAAC;YACxF,MAAM,GAAG,UAAU,CAAC;YACpB,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAC1C,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YACxD,MAAM,GAAG,UAAU,CAAC;YACpB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,WAAW,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;iBAC5D,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE;iBACd,IAAI,EAAE;iBACN,WAAW,EAAE,CAAC;YACjB,IAAI,WAAW,KAAK,kBAAkB,IAAI,WAAW,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBACnF,MAAM,IAAI,WAAW,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;YACnE,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM;gBAClD,MAAM,IAAI,WAAW,CAAC,kBAAkB,CAAC,CAAC;YAC5C,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzC,IAAI,CAAC;oBACH,QAAQ,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACpE,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,WAAW,CAAC,mBAAmB,CAAC,CAAC;gBAC7C,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACzC,IACE,CAAC,+CAA+C,CAAC,IAAI,CACnD,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAC1C;oBAED,MAAM,IAAI,WAAW,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;gBAC3D,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YACD,MAAM,WAAW,GAAG;gBAClB,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ;gBACR,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,OAAO,CAAC,YAAY;gBAC9B,UAAU,EAAE,OAAO,CAAC,gBAAgB;gBACpC,SAAS;aACV,CAAC;YACF,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM;gBAC7C,CAAC,CAAC,CAAC,EAAU,EAAE,EAAE,CACb,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;oBACvD,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;gBACpE,CAAC,CAAC,SAAS,CAAC;YACd,IAAI,iBAA+E,CAAC;YACpF,IAAI,aAAa,EAAE,CAAC;gBAClB,iFAAiF;gBACjF,0FAA0F;gBAC1F,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,WAAW,EAAE;oBACxD,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAC;gBACH,KAAK,CAAC,eAAe,IAAI,aAAa,CAAC,cAAc,CAAC;gBACtD,iBAAiB,GAAG,MAAM,CAAC,WAAW,CAAC;gBACvC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,cAAc,CACZ,aAAa,EACb,EAAE,GAAG,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,EACjD;wBACE,MAAM,EAAE,CAAC,CAAC,CAAC;wBACX,WAAW,EAAE,iBAAiB;wBAC9B,UAAU,EAAE,cAAc;qBAC3B,CACF,CAAC;oBACF,OAAO,MAAM,CACX,OAAO,EACP,MAAM,CAAC,MAAM,EACb,MAAM,EACN,2BAA2B,EAC3B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAC;gBACJ,CAAC;gBACD,IAAI,MAAM,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;oBACtC,cAAc,CACZ,aAAa,EACb,EAAE,GAAG,WAAW,EAAE,cAAc,EAAE,GAAG,EAAE,EACvC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,CAC7E,CAAC;oBACF,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,sBAAsB,CAAC,CAAC;gBAClE,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM;oBAC/B,IAAI,KAAK,CAAC,GAAG;wBAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,GAAG,OAAO,CAAC;YACjB,KAAK,CAAC,cAAc,EAAE,CAAC;YACvB,MAAM,eAAe,GAAG,aAAa,EAAE,YAAY,CAAC,IAAI,CACtD,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,IAAI,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAC/D,CAAC;YACF,IAAI,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAE,CAC/C,OAAO,EACP,GAAG,EACH,IAAI,EACJ,IAAI,EACJ,eAAe,CAAC,CAAC,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EACpC,OAAO,EACP,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAClD,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,cAAc,GAAG,QAAQ,CAAC;YACvD,IAAI,aAAa,IAAI,eAAe,IAAI,iBAAiB,EAAE,CAAC;gBAC1D,MAAM,aAAa,GAAG;oBACpB,GAAG,WAAW;oBACd,cAAc,EAAE,QAAQ,CAAC,MAAM;oBAC/B,eAAe,EAAE,QAAQ,CAAC,OAAO;iBAClC,CAAC;gBACF,MAAM,aAAa,GAAG,cAAc,CAAC,aAAa,EAAE,aAAa,EAAE;oBACjE,MAAM,EAAE,CAAC,CAAC,CAAC;oBACX,WAAW,EAAE,iBAAiB;oBAC9B,UAAU,EAAE,cAAc;iBAC3B,CAAC,CAAC;gBACH,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;oBAC1B,YAAY,CAAC,QAAQ,CAAC,CAAC;oBACvB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAC9B,cAAc,CAAC,aAAa,EAAE,aAAa,EAAE;wBAC3C,MAAM,EAAE,CAAC,CAAC,CAAC;wBACX,WAAW,EAAE,iBAAiB;wBAC9B,UAAU,EAAE,cAAc;qBAC3B,CAAC,CAAC;oBACH,OAAO,MAAM,CACX,OAAO,EACP,aAAa,CAAC,MAAM,EACpB,MAAM,EACN,6BAA6B,EAC7B,OAAO,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CACtC,CAAC;gBACJ,CAAC;gBACD,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,CACjD,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CACxD,CAAC;gBACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,MAAM,GAAG,cAAc,CAC3B,aAAa,EACb,EAAE,GAAG,aAAa,EAAE,iBAAiB,EAAE,IAAI,UAAU,EAAE,EAAE,EACzD;wBACE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;wBACd,WAAW,EAAE,iBAAiB;wBAC9B,UAAU,EAAE,cAAc;qBAC3B,CACF,CAAC;oBACF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;wBACnB,YAAY,CAAC,QAAQ,CAAC,CAAC;wBACvB,OAAO,MAAM,CACX,OAAO,EACP,MAAM,CAAC,MAAM,EACb,MAAM,EACN,6BAA6B,EAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/B,CAAC;oBACJ,CAAC;oBACD,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,+BAA+B,CAAC,CAAC;oBACxD,cAAc,GAAG,SAAS,CAAC;oBAC3B,OAAO,QAAQ,CAAC;gBAClB,CAAC;gBACD,MAAM,KAAK,GACT,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC1F,MAAM,UAAU,GAAG,cAAc,CAC/B,aAAa,EACb,EAAE,GAAG,aAAa,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACpE;oBACE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClC,WAAW,EAAE,iBAAiB;oBAC9B,UAAU,EAAE,cAAc;iBAC3B,CACF,CAAC;gBACF,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;oBACvB,IAAI,CAAC,KAAK;wBAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;oBAC1C,OAAO,MAAM,CACX,OAAO,EACP,UAAU,CAAC,MAAM,EACjB,MAAM,EACN,6BAA6B,EAC7B,OAAO,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CACnC,CAAC;gBACJ,CAAC;gBACD,IAAI,KAAK,EAAE,CAAC;oBACV,IAAI,IAAI,GAAG,KAAK,CAAC;oBACjB,MAAM,MAAM,GAAG,IAAI,cAAc,CAC/B;wBACE,IAAI,CAAC,UAAU;4BACb,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gCAC1B,IAAI,GAAG,IAAI,CAAC;gCACZ,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;4BAC5B,CAAC;iCAAM,CAAC;gCACN,OAAO,EAAE,CAAC;gCACV,UAAU,CAAC,KAAK,EAAE,CAAC;4BACrB,CAAC;wBACH,CAAC;wBACD,MAAM;4BACJ,OAAO,EAAE,CAAC;wBACZ,CAAC;qBACF,EACD,EAAE,aAAa,EAAE,CAAC,EAAE,CACrB,CAAC;oBACF,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE;wBAC9B,MAAM,EAAE,QAAQ,CAAC,MAAM;wBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;qBAC1B,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACzB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACzC,QAAQ,GAAG,IAAI,QAAQ,CACrB,IAAI,cAAc,CAChB;wBACE,KAAK,CAAC,IAAI,CAAC,UAAU;4BACnB,IAAI,CAAC;gCACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gCACjC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oCACd,OAAO,EAAE,CAAC;oCACV,UAAU,CAAC,KAAK,EAAE,CAAC;gCACrB,CAAC;;oCAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;4BACxC,CAAC;4BAAC,OAAO,KAAK,EAAE,CAAC;gCACf,OAAO,EAAE,CAAC;gCACV,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;4BAC1B,CAAC;wBACH,CAAC;wBACD,KAAK,CAAC,MAAM,CAAC,MAAM;4BACjB,IAAI,CAAC;gCACH,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;4BAC9B,CAAC;oCAAS,CAAC;gCACT,OAAO,EAAE,CAAC;4BACZ,CAAC;wBACH,CAAC;qBACF,EACD,EAAE,aAAa,EAAE,CAAC,EAAE,CACrB,EACD,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CACxF,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,SAAS,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;YACnC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YACpC,cAAc,GAAG,SAAS,CAAC;YAC3B,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,WAAW;gBAAE,OAAO,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3F,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;YACxC,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACxD,CAAC;gBAAS,CAAC;YACT,IAAI,cAAc;gBAAE,YAAY,CAAC,cAAc,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS;gBAAE,OAAO,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,CACN,OAAgB,EAChB,OAAuB,EACvB,SAAkB,EAClB,KAAkD,EAClD,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC;QAC/C,OAAO;QACP,OAAO;YACL,QAAQ,GAAG,IAAI,CAAC;YAChB,IAAI,MAAM,KAAK,CAAC;gBAAE,aAAa,EAAE,OAAO,EAAE,CAAC;QAC7C,CAAC;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAkB;IACtC,MAAM,MAAM,GACV,QACD,CAAC,SAAS,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC"}

package/tools/.build/scr/runtime/node.d.ts

@@ -0,0 +1,3 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+/** Node-only transport; the engine itself imports no Node API. Never trusts X-Forwarded-For. */
+export declare function createNodeServer(handler: (request: Request, incoming: IncomingMessage) => Promise<Response>, publicHost: string | (() => string)): import("node:http").Server<typeof IncomingMessage, typeof ServerResponse>;

package/tools/.build/scr/runtime/node.js

@@ -0,0 +1,97 @@
+import { createServer } from "node:http";
+import { Readable } from "node:stream";
+import { canonicalPath, checkRawHeaders } from "../http-boundary/index.js";
+/** Node-only transport; the engine itself imports no Node API. Never trusts X-Forwarded-For. */
+export function createNodeServer(handler, publicHost) {
+    const server = createServer({
+        maxHeaderSize: 16384,
+        insecureHTTPParser: false,
+        requestTimeout: 15000,
+        headersTimeout: 10000,
+        keepAliveTimeout: 5000,
+    }, async (incoming, outgoing) => {
+        const abort = new AbortController();
+        incoming.on("aborted", () => abort.abort());
+        outgoing.on("close", () => {
+            if (!outgoing.writableFinished)
+                abort.abort();
+        });
+        try {
+            const expectedHost = typeof publicHost === "string" ? publicHost : publicHost();
+            checkRawHeaders(incoming.rawHeaders);
+            canonicalPath(incoming.url ?? "");
+            if (incoming.headers.host !== expectedHost ||
+                !incoming.url?.startsWith("/") ||
+                incoming.url.startsWith("//"))
+                throw new Error("Invalid authority/target");
+            const headers = new Headers();
+            for (let i = 0; i < incoming.rawHeaders.length; i += 2)
+                headers.append(incoming.rawHeaders[i] ?? "", incoming.rawHeaders[i + 1] ?? "");
+            const init = {
+                method: incoming.method ?? "GET",
+                headers,
+                signal: abort.signal,
+            };
+            if (!["GET", "HEAD"].includes(init.method ?? "GET")) {
+                init.body = Readable.toWeb(incoming);
+                init.duplex = "half";
+            }
+            const request = new Request(`http://${expectedHost}${incoming.url}`, init);
+            const response = await handler(request, incoming);
+            if (!incoming.complete) {
+                outgoing.setHeader("connection", "close");
+                outgoing.once("finish", () => incoming.destroy());
+            }
+            outgoing.statusCode = response.status;
+            for (const [name, value] of response.headers)
+                if (name !== "set-cookie")
+                    outgoing.setHeader(name, value);
+            const cookies = response.headers.getSetCookie();
+            if (cookies.length)
+                outgoing.setHeader("set-cookie", cookies);
+            if (!response.body) {
+                outgoing.end();
+                return;
+            }
+            const reader = response.body.getReader();
+            try {
+                while (true) {
+                    const item = await reader.read();
+                    if (item.done)
+                        break;
+                    if (!outgoing.write(item.value))
+                        await new Promise((resolve, reject) => {
+                            const done = () => {
+                                outgoing.off("error", failed);
+                                outgoing.off("close", failed);
+                                resolve();
+                            };
+                            const failed = () => {
+                                outgoing.off("drain", done);
+                                reject(new Error("client-closed"));
+                            };
+                            outgoing.once("drain", done);
+                            outgoing.once("error", failed);
+                            outgoing.once("close", failed);
+                        });
+                }
+                outgoing.end();
+            }
+            catch {
+                void reader.cancel().catch(() => { });
+                outgoing.destroy();
+            }
+        }
+        catch {
+            if (!outgoing.headersSent) {
+                outgoing.writeHead(400, { "content-type": "application/json", connection: "close" });
+                outgoing.end('{"error":"invalid_http_request"}');
+            }
+            else
+                outgoing.destroy();
+        }
+    });
+    server.maxConnections = 256;
+    return server;
+}
+//# sourceMappingURL=node.js.map

package/tools/.build/scr/runtime/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../../../scr/runtime/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE3E,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAC9B,OAA2E,EAC3E,UAAmC;IAEnC,MAAM,MAAM,GAAG,YAAY,CACzB;QACE,aAAa,EAAE,KAAK;QACpB,kBAAkB,EAAE,KAAK;QACzB,cAAc,EAAE,KAAK;QACrB,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,IAAI;KACvB,EACD,KAAK,EAAE,QAAyB,EAAE,QAAwB,EAAE,EAAE;QAC5D,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5C,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,QAAQ,CAAC,gBAAgB;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAChD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAChF,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACrC,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAClC,IACE,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY;gBACtC,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;gBAC9B,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAE7B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;gBACpD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACjF,MAAM,IAAI,GAAsC;gBAC9C,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,KAAK;gBAChC,OAAO;gBACP,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;YACF,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC;gBACpD,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAA+B,CAAC;gBACnE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACvB,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,UAAU,YAAY,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;YAC3E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBAC1C,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;YACD,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;YACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO;gBAC1C,IAAI,IAAI,KAAK,YAAY;oBAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAChD,IAAI,OAAO,CAAC,MAAM;gBAAE,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnB,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBACjC,IAAI,IAAI,CAAC,IAAI;wBAAE,MAAM;oBACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;wBAC7B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;4BAC1C,MAAM,IAAI,GAAG,GAAG,EAAE;gCAChB,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gCAC9B,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gCAC9B,OAAO,EAAE,CAAC;4BACZ,CAAC,CAAC;4BACF,MAAM,MAAM,GAAG,GAAG,EAAE;gCAClB,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gCAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;4BACrC,CAAC,CAAC;4BACF,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;4BAC7B,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;4BAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;wBACjC,CAAC,CAAC,CAAC;gBACP,CAAC;gBACD,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACrC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBACrF,QAAQ,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;YACnD,CAAC;;gBAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC,CACF,CAAC;IACF,MAAM,CAAC,cAAc,GAAG,GAAG,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/tools/.build/scr/runtime/proxy.d.ts

@@ -0,0 +1,12 @@
+import { type Fetch } from "../core/types.js";
+import { type BrowserCachePolicy } from "./browser-cache.js";
+export interface ProxyOptions {
+    origin: string;
+    allowedOrigins: readonly string[];
+    originToken: string;
+    timeoutMs?: number;
+    maxResponseBytes?: number;
+    allowLoopbackHttp?: boolean;
+    fetch?: Fetch;
+}
+export declare function createProxy(options: ProxyOptions): (incoming: Request, url: URL, path: string, body: Uint8Array, onComplete?: () => void, websocket?: boolean, browserCache?: BrowserCachePolicy) => Promise<Response>;