edgeaegis 2026.10.1

package/tools/.build/scr/runtime/proxy.js

@@ -0,0 +1,177 @@
+import { requireInteger, ShieldError } from "../core/types.js";
+import { applyBrowserCache } from "./browser-cache.js";
+import { protectStream } from "./stream.js";
+const hop = [
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "host",
+    "content-length",
+];
+export function createProxy(options) {
+    const origin = new URL(options.origin);
+    const loopback = ["127.0.0.1", "[::1]"].includes(origin.hostname);
+    if (origin.username ||
+        origin.password ||
+        origin.pathname !== "/" ||
+        origin.search ||
+        origin.hash ||
+        !options.allowedOrigins.includes(origin.origin))
+        throw new Error("Origin must be an exact allowlisted origin without credentials/path/query");
+    if (origin.protocol !== "https:" &&
+        !(options.allowLoopbackHttp && loopback && origin.protocol === "http:"))
+        throw new Error("Upstream TLS required (only explicit loopback development HTTP allowed)");
+    const originToken = options.originToken;
+    if (!/^[\x21-\x7e]{32,2048}$/.test(originToken))
+        throw new Error("Origin authentication token must contain 32..2048 visible ASCII characters");
+    const timeout = requireInteger(options.timeoutMs ?? 10000, 1, 120000, "proxy timeout");
+    const maxResponse = requireInteger(options.maxResponseBytes ?? 16777216, 1, 1073741824, "response bytes");
+    const transport = options.fetch ?? fetch;
+    let consecutiveFailures = 0;
+    let openUntil = 0;
+    return async (incoming, url, path, body, onComplete = () => { }, websocket = false, browserCache) => {
+        if (Date.now() < openUntil)
+            throw new ShieldError("origin-circuit-open", 503);
+        const target = new URL(origin);
+        target.pathname = path;
+        target.search = url.search;
+        if (target.origin !== origin.origin)
+            throw new ShieldError("origin-allowlist", 502);
+        const headers = new Headers(incoming.headers);
+        for (const name of [...headers.keys()]) {
+            if (hop.includes(name) ||
+                name === "forwarded" ||
+                name === "x-real-ip" ||
+                name.startsWith("x-forwarded-") ||
+                name.startsWith("cf-") ||
+                name.startsWith("x-vercel-") ||
+                name.startsWith("x-nf-") ||
+                name.startsWith("x-shield-") ||
+                name.startsWith("x-edgeshield-"))
+                headers.delete(name);
+        }
+        headers.set("x-shield-origin-auth", originToken);
+        headers.set("accept-encoding", "identity");
+        if (websocket)
+            headers.set("upgrade", "websocket");
+        const abort = new AbortController();
+        let completed = false;
+        const timer = setTimeout(() => {
+            abort.abort();
+            cleanup();
+        }, timeout);
+        const abortFromClient = () => abort.abort();
+        incoming.signal.addEventListener("abort", abortFromClient, { once: true });
+        const cleanup = () => {
+            if (completed)
+                return;
+            completed = true;
+            clearTimeout(timer);
+            incoming.signal.removeEventListener("abort", abortFromClient);
+            onComplete();
+        };
+        try {
+            const init = {
+                method: incoming.method,
+                headers,
+                redirect: "manual",
+                signal: abort.signal,
+            };
+            if (!["GET", "HEAD"].includes(incoming.method) && body.length)
+                init.body = body;
+            if (incoming.signal.aborted)
+                throw new ShieldError("client-aborted", 408);
+            const upstream = await transport(target, init);
+            if (abort.signal.aborted) {
+                void upstream.body?.cancel().catch(() => { });
+                throw new ShieldError("origin-timeout-or-abort", 504);
+            }
+            if (upstream.status >= 500) {
+                consecutiveFailures++;
+                if (consecutiveFailures >= 5)
+                    openUntil = Date.now() + 5000;
+            }
+            else
+                consecutiveFailures = 0;
+            if (upstream.status === 101) {
+                const socket = upstream
+                    .webSocket;
+                cleanup();
+                if (!websocket || !socket) {
+                    try {
+                        socket?.close(1008);
+                    }
+                    catch {
+                        /* Already closed. */
+                    }
+                    throw new ShieldError("unexpected-origin-upgrade", 502);
+                }
+                const output = new Headers(upstream.headers);
+                for (const name of [...output.keys()])
+                    if (["server", "x-powered-by"].includes(name) ||
+                        name.startsWith("x-shield-") ||
+                        name.startsWith("x-edgeshield-"))
+                        output.delete(name);
+                output.set("cache-control", "no-store");
+                // Preserve the native socket. SecLang inspects this response before ownership is transferred.
+                return new Response(null, {
+                    status: 101,
+                    headers: output,
+                    webSocket: socket,
+                });
+            }
+            // Avoid fetch implementations disagreeing about automatic decompression.
+            if (upstream.headers.has("content-encoding") &&
+                upstream.headers.get("content-encoding") !== "identity") {
+                void upstream.body?.cancel().catch(() => { });
+                throw new ShieldError("unexpected-origin-encoding", 502);
+            }
+            const responseHeaders = new Headers(upstream.headers);
+            for (const token of (responseHeaders.get("connection") ?? "").split(","))
+                if (token.trim())
+                    responseHeaders.delete(token.trim());
+            for (const name of [...responseHeaders.keys()])
+                if (hop.includes(name) ||
+                    ["server", "x-powered-by"].includes(name) ||
+                    name.startsWith("x-shield-"))
+                    responseHeaders.delete(name);
+            applyBrowserCache(incoming, upstream, responseHeaders, browserCache);
+            if (!upstream.body ||
+                incoming.method === "HEAD" ||
+                [204, 205, 304].includes(upstream.status)) {
+                cleanup();
+                void upstream.body?.cancel().catch(() => { });
+                return new Response(null, { status: upstream.status, headers: responseHeaders });
+            }
+            const stream = protectStream(upstream.body, {
+                maxBytes: maxResponse,
+                idleTimeoutMs: timeout,
+                signal: abort.signal,
+                abort: () => abort.abort(),
+                complete: cleanup,
+            });
+            return new Response(stream, {
+                status: upstream.status,
+                statusText: upstream.statusText,
+                headers: responseHeaders,
+            });
+        }
+        catch (error) {
+            const wasAborted = abort.signal.aborted;
+            cleanup();
+            abort.abort();
+            consecutiveFailures++;
+            if (consecutiveFailures >= 5)
+                openUntil = Date.now() + 5000;
+            if (error instanceof ShieldError)
+                throw error;
+            throw new ShieldError(wasAborted ? "origin-timeout-or-abort" : "origin-unavailable", wasAborted ? 504 : 502);
+        }
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/tools/.build/scr/runtime/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../../../scr/runtime/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,cAAc,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAA2B,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAW5C,MAAM,GAAG,GAAG;IACV,YAAY;IACZ,YAAY;IACZ,oBAAoB;IACpB,qBAAqB;IACrB,IAAI;IACJ,SAAS;IACT,mBAAmB;IACnB,SAAS;IACT,MAAM;IACN,gBAAgB;CACjB,CAAC;AAEF,MAAM,UAAU,WAAW,CAAC,OAAqB;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClE,IACE,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ,KAAK,GAAG;QACvB,MAAM,CAAC,MAAM;QACb,MAAM,CAAC,IAAI;QACX,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QAE/C,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;IAC/F,IACE,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAC5B,CAAC,CAAC,OAAO,CAAC,iBAAiB,IAAI,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;QAEvE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACxC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,WAAW,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;IACvF,MAAM,WAAW,GAAG,cAAc,CAChC,OAAO,CAAC,gBAAgB,IAAI,QAAQ,EACpC,CAAC,EACD,UAAU,EACV,gBAAgB,CACjB,CAAC;IACF,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACzC,IAAI,mBAAmB,GAAG,CAAC,CAAC;IAC5B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,OAAO,KAAK,EACV,QAAiB,EACjB,GAAQ,EACR,IAAY,EACZ,IAAgB,EAChB,UAAU,GAAe,GAAG,EAAE,GAAE,CAAC,EACjC,SAAS,GAAG,KAAK,EACjB,YAAiC,EACd,EAAE;QACrB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACvC,IACE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAClB,IAAI,KAAK,WAAW;gBACpB,IAAI,KAAK,WAAW;gBACpB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;gBAC/B,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBACtB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;gBAC5B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACxB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;gBAC5B,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAEhC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;QACZ,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5C,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,SAAS;gBAAE,OAAO;YACtB,SAAS,GAAG,IAAI,CAAC;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,QAAQ,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;YAC9D,UAAU,EAAE,CAAC;QACf,CAAC,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,GAAgB;gBACxB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO;gBACP,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC;YACF,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,IAAI,GAAG,IAAgB,CAAC;YAC5F,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO;gBAAE,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;YAC1E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACzB,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC7C,MAAM,IAAI,WAAW,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,mBAAmB,EAAE,CAAC;gBACtB,IAAI,mBAAmB,IAAI,CAAC;oBAAE,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC9D,CAAC;;gBAAM,mBAAmB,GAAG,CAAC,CAAC;YAC/B,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAI,QAAqE;qBAClF,SAAS,CAAC;gBACb,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBACH,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;oBACtB,CAAC;oBAAC,MAAM,CAAC;wBACP,qBAAqB;oBACvB,CAAC;oBACD,MAAM,IAAI,WAAW,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;gBAC1D,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;gBAC7C,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;oBACnC,IACE,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;wBACzC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;wBAC5B,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;wBAEhC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACxB,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBACxC,8FAA8F;gBAC9F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACxB,MAAM,EAAE,GAAG;oBACX,OAAO,EAAE,MAAM;oBACf,SAAS,EAAE,MAAM;iBACF,CAAC,CAAC;YACrB,CAAC;YACD,yEAAyE;YACzE,IACE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBACxC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,UAAU,EACvD,CAAC;gBACD,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC7C,MAAM,IAAI,WAAW,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;YAC3D,CAAC;YACD,MAAM,eAAe,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,KAAK,MAAM,KAAK,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;gBACtE,IAAI,KAAK,CAAC,IAAI,EAAE;oBAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACzD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC;gBAC5C,IACE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAClB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACzC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;oBAE5B,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;YACrE,IACE,CAAC,QAAQ,CAAC,IAAI;gBACd,QAAQ,CAAC,MAAM,KAAK,MAAM;gBAC1B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EACzC,CAAC;gBACD,OAAO,EAAE,CAAC;gBACV,KAAK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC7C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,EAAE;gBAC1C,QAAQ,EAAE,WAAW;gBACrB,aAAa,EAAE,OAAO;gBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE;gBAC1B,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;YACH,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;gBAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC;YACxC,OAAO,EAAE,CAAC;YACV,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,mBAAmB,EAAE,CAAC;YACtB,IAAI,mBAAmB,IAAI,CAAC;gBAAE,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAC5D,IAAI,KAAK,YAAY,WAAW;gBAAE,MAAM,KAAK,CAAC;YAC9C,MAAM,IAAI,WAAW,CACnB,UAAU,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,oBAAoB,EAC7D,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CACvB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/tools/.build/scr/runtime/stream.d.ts

@@ -0,0 +1,8 @@
+/** No fixed total deadline: continuously progressing transfers can last longer than headerTimeoutMs. */
+export declare function protectStream(input: ReadableStream<Uint8Array>, options: {
+    maxBytes: number;
+    idleTimeoutMs: number;
+    signal: AbortSignal;
+    abort: () => void;
+    complete: () => void;
+}): ReadableStream<Uint8Array>;

package/tools/.build/scr/runtime/stream.js

@@ -0,0 +1,72 @@
+import { requireInteger } from "../core/types.js";
+/** No fixed total deadline: continuously progressing transfers can last longer than headerTimeoutMs. */
+export function protectStream(input, options) {
+    requireInteger(options.maxBytes, 1, 1073741824, "stream bytes");
+    requireInteger(options.idleTimeoutMs, 1, 300000, "stream idle deadline");
+    const reader = input.getReader();
+    let controller;
+    let timer;
+    let ended = false;
+    let total = 0;
+    const cleanup = () => {
+        if (ended)
+            return;
+        ended = true;
+        if (timer)
+            clearTimeout(timer);
+        options.signal.removeEventListener("abort", interrupted);
+        options.complete();
+    };
+    const fail = (error) => {
+        if (ended)
+            return;
+        cleanup();
+        options.abort();
+        void reader.cancel(error).catch(() => { });
+        controller.error(error);
+    };
+    const interrupted = () => fail(new Error("origin-stream-aborted"));
+    const reset = () => {
+        if (timer)
+            clearTimeout(timer);
+        timer = setTimeout(() => fail(new Error("origin-stream-idle-timeout")), options.idleTimeoutMs);
+    };
+    return new ReadableStream({
+        start(c) {
+            controller = c;
+            options.signal.addEventListener("abort", interrupted, { once: true });
+            if (options.signal.aborted)
+                interrupted();
+            else
+                reset();
+        },
+        async pull(c) {
+            if (ended)
+                return;
+            try {
+                const item = await reader.read();
+                if (ended)
+                    return;
+                if (item.done) {
+                    cleanup();
+                    c.close();
+                    return;
+                }
+                total += item.value.byteLength;
+                if (total > options.maxBytes)
+                    throw new Error("origin-response-too-large");
+                reset();
+                c.enqueue(item.value);
+            }
+            catch (error) {
+                fail(error instanceof Error ? error : new Error("stream-failure"));
+            }
+        },
+        cancel(reason) {
+            cleanup();
+            options.abort();
+            return reader.cancel(reason);
+        },
+    });
+}
+//# sourceMappingURL=stream.js.map

package/tools/.build/scr/runtime/stream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.js","sourceRoot":"","sources":["../../../../scr/runtime/stream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,wGAAwG;AACxG,MAAM,UAAU,aAAa,CAC3B,KAAiC,EACjC,OAMC;IAED,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IAChE,cAAc,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,UAAuD,CAAC;IAC5D,IAAI,KAAgD,CAAC;IACrD,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,IAAI,KAAK;YAAE,OAAO;QAClB,KAAK,GAAG,IAAI,CAAC;QACb,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,OAAO,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,KAAY,EAAE,EAAE;QAC5B,IAAI,KAAK;YAAE,OAAO;QAClB,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1C,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC,CAAC;IACF,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IACjG,CAAC,CAAC;IACF,OAAO,IAAI,cAAc,CAAa;QACpC,KAAK,CAAC,CAAC;YACL,UAAU,GAAG,CAAC,CAAC;YACf,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO;gBAAE,WAAW,EAAE,CAAC;;gBACrC,KAAK,EAAE,CAAC;QACf,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,CAAC;YACV,IAAI,KAAK;gBAAE,OAAO;YAClB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,KAAK;oBAAE,OAAO;gBAClB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;oBACd,OAAO,EAAE,CAAC;oBACV,CAAC,CAAC,KAAK,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;gBAC/B,IAAI,KAAK,GAAG,OAAO,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBAC3E,KAAK,EAAE,CAAC;gBACR,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QACD,MAAM,CAAC,MAAM;YACX,OAAO,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/tools/.build/scr/seclang/body.d.ts

@@ -0,0 +1,13 @@
+export type BodyProcessor = "" | "URLENCODED" | "JSON" | "XML" | "MULTIPART";
+export declare function bodyProcessor(headers: Headers): BodyProcessor;
+export declare function parseBody(body: string, headers: Headers, processor: BodyProcessor, bytes?: Uint8Array, maxBodyBytes?: number): {
+    args: [string, string][];
+    files: {
+        name: string;
+        filename: string;
+        size: number;
+    }[];
+    partHeaders: [string, string][];
+    xml: import("@xmldom/xmldom").Document | undefined;
+};
+export declare function xmlValues(document: NonNullable<ReturnType<typeof parseBody>["xml"]>, expression: string): [string, string][];

package/tools/.build/scr/seclang/body.js

@@ -0,0 +1,109 @@
+import { DOMParser } from "@xmldom/xmldom";
+import xpath from "xpath";
+import { formEntries, fromOctets, utf8Bytes } from "./bytes.js";
+import { jsonArguments } from "./json.js";
+export function bodyProcessor(headers) {
+    const type = headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
+    if (type === "application/x-www-form-urlencoded")
+        return "URLENCODED";
+    if (type === "application/json")
+        return "JSON";
+    if (type === "text/xml" || type === "application/xml")
+        return "XML";
+    if (type === "multipart/form-data")
+        return "MULTIPART";
+    return "";
+}
+export function parseBody(body, headers, processor, bytes, maxBodyBytes = 2 * 1024 * 1024) {
+    const args = [];
+    const files = [];
+    const partHeaders = [];
+    let xml;
+    if ((bytes?.length ?? new TextEncoder().encode(body).length) > maxBodyBytes)
+        throw new Error("SecLang body limit exceeded");
+    const binary = bytes ? fromOctets(bytes) : utf8Bytes(body);
+    if (processor === "URLENCODED")
+        args.push(...formEntries(binary, true));
+    if (bytes && (processor === "JSON" || processor === "XML"))
+        body = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    if (processor === "JSON" && body) {
+        args.push(...jsonArguments(body).map(([path, value]) => [utf8Bytes(path), utf8Bytes(value)]));
+    }
+    if (processor === "XML" && body) {
+        if (/<!DOCTYPE|<!ENTITY/i.test(body))
+            throw new Error("XML DTD/entities are disabled");
+        xml = new DOMParser({
+            onError: (_level, message) => {
+                throw new Error(`Invalid XML: ${message}`);
+            },
+        }).parseFromString(body, "application/xml");
+    }
+    if (processor === "MULTIPART" && binary) {
+        body = binary;
+        const type = headers.get("content-type") ?? "";
+        const boundary = /(?:^|;)\s*boundary=(?:"([^"\r\n]+)"|([^;\s]+))/i.exec(type);
+        const token = boundary?.[1] ?? boundary?.[2];
+        if (!token || token.length > 70 || !/^[\x20-\x7e]+$/.test(token))
+            throw new Error("Invalid multipart boundary");
+        const escaped = token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        const delimiters = [];
+        for (const match of body.matchAll(new RegExp(`(?:^|\\r?\\n)--${escaped}(--)?[ \\t]*(?:\\r?\\n|$)`, "g"))) {
+            delimiters.push(match);
+            if (delimiters.length > 129)
+                throw new Error("Multipart part limit exceeded");
+            if (match[1])
+                break;
+        }
+        if (!delimiters.length || !delimiters.at(-1)?.[1])
+            throw new Error("Malformed multipart body");
+        for (let i = 0; i < delimiters.length - 1; i++) {
+            const opening = delimiters[i], next = delimiters[i + 1];
+            const part = body.slice(opening.index + opening[0].length, next.index);
+            const separator = /\r?\n\r?\n/.exec(part), end = separator?.index ?? -1;
+            if (end < 0 || end > 16384)
+                throw new Error("Invalid multipart part headers");
+            const lines = part.slice(0, end).split(/\r?\n/);
+            const disposition = lines.find((line) => /^content-disposition:/i.test(line));
+            if (lines.filter((line) => /^content-disposition:/i.test(line)).length !== 1)
+                throw new Error("Ambiguous multipart disposition");
+            const parameter = (name) => {
+                const pattern = name === "name"
+                    ? /(?:^|;)\s*name=(?:"((?:\\.|[^"\\\r\n])*)"|([^;\s]*))/i
+                    : /(?:^|;)\s*filename=(?:"((?:\\.|[^"\\\r\n])*)"|([^;\s]*))/i;
+                const match = pattern.exec(disposition ?? "");
+                return match ? (match[1] ?? match[2] ?? "").replace(/\\(["\\])/g, "$1") : undefined;
+            };
+            const name = parameter("name");
+            if (name === undefined)
+                throw new Error("Multipart field name missing");
+            const filename = parameter("filename");
+            for (const line of lines) {
+                if (!/^[!#$%&'*+.^_`|~0-9A-Za-z-]+:[^\0\r\n]*$/.test(line))
+                    throw new Error("Invalid multipart header");
+                partHeaders.push([name, line]);
+            }
+            const content = part.slice(end + separator[0].length);
+            if (filename !== undefined)
+                files.push({
+                    name,
+                    filename,
+                    size: content.length,
+                });
+            else
+                args.push([name, content]);
+        }
+    }
+    return { args, files, partHeaders, xml };
+}
+export function xmlValues(document, expression) {
+    const result = xpath.select(expression, document);
+    if (!Array.isArray(result))
+        return [[expression, String(result)]];
+    return result.map((value, index) => [
+        String(index),
+        typeof value === "object" && value !== null
+            ? (value.textContent ?? "")
+            : String(value),
+    ]);
+}
+//# sourceMappingURL=body.js.map

package/tools/.build/scr/seclang/body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body.js","sourceRoot":"","sources":["../../../../scr/seclang/body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9E,IAAI,IAAI,KAAK,mCAAmC;QAAE,OAAO,YAAY,CAAC;IACtE,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,MAAM,CAAC;IAC/C,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,WAAW,CAAC;IACvD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,OAAgB,EAChB,SAAwB,EACxB,KAAkB,EAClB,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;IAE9B,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAuD,EAAE,CAAC;IACrE,MAAM,WAAW,GAAuB,EAAE,CAAC;IAC3C,IAAI,GAAyD,CAAC;IAC9D,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,YAAY;QACzE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,SAAS,KAAK,YAAY;QAAE,IAAI,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACxE,IAAI,KAAK,IAAI,CAAC,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,KAAK,CAAC;QACxD,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,SAAS,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CACP,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,GAAG,CACxB,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAqB,CAC3E,CACF,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,KAAK,KAAK,IAAI,IAAI,EAAE,CAAC;QAChC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACvF,GAAG,GAAG,IAAI,SAAS,CAAC;YAClB,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;gBAC3B,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAC;YAC7C,CAAC;SACF,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,SAAS,KAAK,WAAW,IAAI,MAAM,EAAE,CAAC;QACxC,IAAI,GAAG,MAAM,CAAC;QACd,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,iDAAiD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAuB,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAC/B,IAAI,MAAM,CAAC,kBAAkB,OAAO,2BAA2B,EAAE,GAAG,CAAC,CACtE,EAAE,CAAC;YACF,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC9E,IAAI,KAAK,CAAC,CAAC,CAAC;gBAAE,MAAM;QACtB,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC/F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAE,EAC5B,IAAI,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,KAAM,CAAC,CAAC;YACzE,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EACvC,GAAG,GAAG,SAAS,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;YAC/B,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAChD,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9E,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,CAAC,IAAyB,EAAE,EAAE;gBAC9C,MAAM,OAAO,GACX,IAAI,KAAK,MAAM;oBACb,CAAC,CAAC,uDAAuD;oBACzD,CAAC,CAAC,2DAA2D,CAAC;gBAClE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;gBAC9C,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtF,CAAC,CAAC;YACF,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;YAC/B,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACxE,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;YACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,0CAA0C,CAAC,IAAI,CAAC,IAAI,CAAC;oBACxD,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBAC9C,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,SAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACvD,IAAI,QAAQ,KAAK,SAAS;gBACxB,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI;oBACJ,QAAQ;oBACR,IAAI,EAAE,OAAO,CAAC,MAAM;iBACrB,CAAC,CAAC;;gBACA,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,QAA0D,EAC1D,UAAkB;IAElB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,QAA2B,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC;QACb,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;YACzC,CAAC,CAAC,CAAE,KAAc,CAAC,WAAW,IAAI,EAAE,CAAC;YACrC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAClB,CAAC,CAAC;AACL,CAAC"}

package/tools/.build/scr/seclang/bytes.d.ts

@@ -0,0 +1,5 @@
+export declare function utf8Bytes(value: string): string;
+export declare function fromOctets(bytes: Uint8Array): string;
+export declare function octets(value: string): Uint8Array;
+export declare const asciiLower: (value: string) => string;
+export declare function formEntries(value: string, binary?: boolean): [string, string][];

package/tools/.build/scr/seclang/bytes.js

@@ -0,0 +1,38 @@
+/** Internal SecLang strings represent octets, including NUL and invalid UTF-8. */
+const encoder = new TextEncoder();
+export function utf8Bytes(value) {
+    // ASCII already has exactly the required octets, including embedded NUL.
+    if (!/[^\x00-\x7f]/.test(value))
+        return value;
+    return fromOctets(encoder.encode(value));
+}
+export function fromOctets(bytes) {
+    let result = "";
+    for (let i = 0; i < bytes.length; i += 8192)
+        result += String.fromCharCode(...bytes.subarray(i, i + 8192));
+    return result;
+}
+export function octets(value) {
+    const result = new Uint8Array(value.length);
+    for (let i = 0; i < value.length; i++) {
+        const code = value.charCodeAt(i);
+        if (code > 255)
+            throw new Error("SecLang byte string contains a non-byte character");
+        result[i] = code;
+    }
+    return result;
+}
+export const asciiLower = (value) => value.replace(/[A-Z]+/g, (part) => part.toLowerCase());
+export function formEntries(value, binary = false) {
+    if (!value)
+        return [];
+    return (binary ? value : utf8Bytes(value))
+        .split("&")
+        .filter(Boolean)
+        .map((part) => {
+        const at = part.indexOf("=");
+        const decode = (v) => v.replace(/%([\da-f]{2})|\+/gi, (all, hex) => hex ? String.fromCharCode(Number.parseInt(hex, 16)) : all === "+" ? " " : all);
+        return [decode(at < 0 ? part : part.slice(0, at)), decode(at < 0 ? "" : part.slice(at + 1))];
+    });
+}
+//# sourceMappingURL=bytes.js.map

package/tools/.build/scr/seclang/bytes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bytes.js","sourceRoot":"","sources":["../../../../scr/seclang/bytes.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,yEAAyE;IACzE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI;QACzC,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,GAAG,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACrF,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,KAAa,EAAU,EAAE,CAClD,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAEzD,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,MAAM,GAAG,KAAK;IACvD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;SACvC,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAC3B,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAC3C,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAC9E,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;AACP,CAAC"}

package/tools/.build/scr/seclang/index.d.ts

@@ -0,0 +1,166 @@
+/**
+ * EdgeAegis's first-party SecLang state machine (no ModSecurity process).
+ * Compiles native rules, source includes and data into executable transaction instructions.
+ * Data is a Request-like object or real Web Request; no I/O occurs while executing.
+ */
+import type { InjectionDetectors } from "./libinjection.js";
+import type { SecLangRegex, SecLangRegexBackend } from "./pcre2.js";
+import { type SecLangSourceOptions } from "./sources.js";
+import { CollectionStore } from "./state.js";
+export { createInjectionDetectors } from "./libinjection.js";
+export type { SecLangRegexBackend } from "./pcre2.js";
+export { createPCRE2Backend, PCRE2Error } from "./pcre2.js";
+export declare function splitActions(source: any): string[];
+/** Compile an entire file; strict mode prevents using a partial CRS policy as a full WAF. */
+export interface CompileSecLangOptions extends SecLangSourceOptions {
+    now?: () => number;
+    requestBodyLimit?: number;
+    phraseFiles?: Record<string, string[]>;
+    strict?: boolean;
+    regexBackend?: SecLangRegexBackend;
+    detectors?: InjectionDetectors;
+}
+export declare function compileSecLang(source: any, { phraseFiles, strict, regexBackend, detectors, fileName, files, requestBodyLimit, now, }?: CompileSecLangOptions): {
+    instructions: ({
+        type: string;
+        name: string | undefined;
+        line: number;
+    } | {
+        type: string;
+        selectors: {
+            negative: any;
+            count: any;
+            name: any;
+            key: any;
+            keyRegex: SecLangRegex | undefined;
+            foldedKey: string | undefined;
+        }[];
+        operator: {
+            op: string;
+            operand: string;
+            negated: any;
+            regex: SecLangRegex | undefined;
+            phrases: string[] | undefined;
+            dynamic: any;
+            detectors: any;
+            ranges: any;
+            networks: any;
+            dynamicRegexBackend: any;
+        } | undefined;
+        actions: {
+            phase: undefined;
+            transformations: never[];
+            changes: never[];
+            controls: never[];
+            initializers: never[];
+            effects: never[];
+            tags: never[];
+            log: boolean;
+            audit: boolean;
+        };
+        unconditional: boolean;
+        line: number;
+        file: string | undefined;
+    })[];
+    phaseInstructions: Map<number, ({
+        type: string;
+        name: string | undefined;
+        line: number;
+    } | {
+        type: string;
+        selectors: {
+            negative: any;
+            count: any;
+            name: any;
+            key: any;
+            keyRegex: SecLangRegex | undefined;
+            foldedKey: string | undefined;
+        }[];
+        operator: {
+            op: string;
+            operand: string;
+            negated: any;
+            regex: SecLangRegex | undefined;
+            phrases: string[] | undefined;
+            dynamic: any;
+            detectors: any;
+            ranges: any;
+            networks: any;
+            dynamicRegexBackend: any;
+        } | undefined;
+        actions: {
+            phase: undefined;
+            transformations: never[];
+            changes: never[];
+            controls: never[];
+            initializers: never[];
+            effects: never[];
+            tags: never[];
+            log: boolean;
+            audit: boolean;
+        };
+        unconditional: boolean;
+        line: number;
+        file: string | undefined;
+    })[]>;
+    unsupported: ({
+        line: any;
+        file: any;
+        reason: any;
+        rule: any;
+    } | {
+        line: number;
+        reason: string;
+        rule: any;
+    })[];
+    supportedRules: number;
+    sourceRules: number;
+    components: (string | undefined)[];
+    requestBodyLimit: number;
+    unicodeMap: Map<number, number>;
+    settings: {
+        engine: string;
+        requestBodyAccess: boolean;
+        responseBodyAccess: boolean;
+        removedIds: never[];
+    };
+    now: () => number;
+    collections: CollectionStore;
+    dispose: () => void;
+    readonly disposed: boolean;
+};
+/** Evaluate request phases with per-transaction TX state and deterministic order. */
+export interface SecLangTransaction {
+    tx: Map<string, string | number>;
+    matchedVars: [string, string][];
+    uniqueId: string;
+    [key: string]: unknown;
+}
+export interface ExecuteSecLangOptions {
+    tx?: Record<string, string | number>;
+    phases?: number[];
+    anomalyThreshold?: number;
+    shouldSkip?: ((id: string) => boolean) | undefined;
+    transaction?: SecLangTransaction;
+}
+export declare function executeSecLang(program: any, request: any, { tx: inputTx, phases, anomalyThreshold, shouldSkip, transaction, }?: ExecuteSecLangOptions): {
+    blocked: boolean;
+    status: number;
+    matched: any[];
+    events: {
+        id: any;
+        phase: number;
+        log: any;
+        audit: any;
+        message: any;
+        logdata: any;
+        truncated: boolean;
+        severity: any;
+        tags: any;
+    }[];
+    score: number;
+    tx: {
+        [k: string]: string | number;
+    };
+    transaction: SecLangTransaction;
+};