effect 4.0.4 → 4.0.6

package/src/http/HttpServerRequest.ts

@@ -35,6 +35,7 @@ import * as HttpIncomingMessage from "./HttpIncomingMessage.ts"
 import { hasBody, type HttpMethod } from "./HttpMethod.ts"
 import { HttpServerError, type RequestError, RequestParseError } from "./HttpServerError.ts"
 import * as bodyInternal from "./internal/httpBody.ts"
+import * as lazyStream from "./internal/lazyStream.ts"
 import * as Multipart from "./Multipart.ts"
 import * as UrlParams from "./UrlParams.ts"
 
@@ -72,8 +73,11 @@ export const TypeId = "~effect/http/HttpServerRequest"
  * **Details**
  *
  * It extends `HttpIncomingMessage` with request metadata, parsed cookies,
- * multipart accessors, WebSocket upgrade support, and a `modify` method for
- * creating adjusted request views.
+ * multipart accessors, connection upgrades, and a `modify` method for
+ * creating adjusted request views. `upgrade` completes a WebSocket handshake
+ * for `Upgrade: websocket`. Platforms that can hand over the connection, such
+ * as Node, answer other protocols with `101 Switching Protocols` and expose
+ * the raw connection.
  *
  * @stability unstable
  * @category models
@@ -96,11 +100,26 @@ export interface HttpServerRequest extends HttpIncomingMessage.HttpIncomingMessa
 
   readonly upgrade: Effect.Effect<Socket.Socket, HttpServerError>
 
+  /**
+   * Address of the directly connected peer. Trusted proxy middleware replaces
+   * `remoteAddress` with the forwarded client address and keeps the previous
+   * value here; otherwise it equals `remoteAddress`.
+   */
+  readonly peerAddress: Option.Option<string>
+
+  /**
+   * Scheme validated by trusted proxy middleware. `toURL` prefers it over the
+   * scheme of the transport connection.
+   */
+  readonly protocol: "http" | "https" | undefined
+
   readonly modify: (
     options: {
       readonly url?: string
       readonly headers?: Headers.Headers
       readonly remoteAddress?: Option.Option<string>
+      readonly peerAddress?: Option.Option<string>
+      readonly protocol?: "http" | "https"
     }
   ) => HttpServerRequest
 }
@@ -493,12 +512,16 @@ class ServerRequestImpl extends Inspectable.Class implements HttpServerRequest {
   readonly url: string
   public headersOverride?: Headers.Headers | undefined
   private remoteAddressOverride?: Option.Option<string> | undefined
+  private peerAddressOverride?: Option.Option<string> | undefined
+  readonly protocol: "http" | "https" | undefined
 
   constructor(
     source: Request,
     url: string,
     headersOverride?: Headers.Headers,
-    remoteAddressOverride?: Option.Option<string>
+    remoteAddressOverride?: Option.Option<string>,
+    peerAddressOverride?: Option.Option<string>,
+    protocol?: "http" | "https"
   ) {
     super()
     this[TypeId] = TypeId
@@ -507,12 +530,14 @@ class ServerRequestImpl extends Inspectable.Class implements HttpServerRequest {
     this.url = url
     this.headersOverride = headersOverride
     this.remoteAddressOverride = remoteAddressOverride
+    this.peerAddressOverride = peerAddressOverride
+    this.protocol = protocol
   }
   toJSON(): unknown {
     return HttpIncomingMessage.inspect(this, {
       _id: "HttpServerRequest",
       method: this.method,
-      url: this.originalUrl
+      url: UrlParams.redactUrl(this.originalUrl)
     })
   }
   modify(
@@ -520,13 +545,17 @@ class ServerRequestImpl extends Inspectable.Class implements HttpServerRequest {
       readonly url?: string | undefined
       readonly headers?: Headers.Headers | undefined
       readonly remoteAddress?: Option.Option<string> | undefined
+      readonly peerAddress?: Option.Option<string> | undefined
+      readonly protocol?: "http" | "https" | undefined
     }
   ) {
     return new ServerRequestImpl(
       this.source,
       options.url ?? this.url,
       options.headers ?? this.headersOverride,
-      "remoteAddress" in options ? options.remoteAddress : this.remoteAddressOverride
+      "remoteAddress" in options ? options.remoteAddress : this.remoteAddressOverride,
+      options.peerAddress ?? this.peerAddressOverride,
+      options.protocol ?? this.protocol
     )
   }
   get method(): HttpMethod {
@@ -538,6 +567,9 @@ class ServerRequestImpl extends Inspectable.Class implements HttpServerRequest {
   get remoteAddress(): Option.Option<string> {
     return this.remoteAddressOverride ?? Option.none()
   }
+  get peerAddress(): Option.Option<string> {
+    return this.peerAddressOverride ?? this.remoteAddress
+  }
   get headers(): Headers.Headers {
     this.headersOverride ??= Headers.fromInput(this.source.headers as any)
     return this.headersOverride
@@ -688,6 +720,8 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
   public originalUrl: string
   public headersOverride?: Headers.Headers | undefined
   private remoteAddressOverride?: Option.Option<string> | undefined
+  private peerAddressOverride?: Option.Option<string> | undefined
+  readonly protocol: "http" | "https" | undefined
   private urlOverride?: string | undefined
 
   constructor(
@@ -695,7 +729,9 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
     originalUrl: string,
     urlOverride?: string,
     headersOverride?: Headers.Headers,
-    remoteAddressOverride?: Option.Option<string>
+    remoteAddressOverride?: Option.Option<string>,
+    peerAddressOverride?: Option.Option<string>,
+    protocol?: "http" | "https"
   ) {
     super()
     this[TypeId] = TypeId
@@ -705,13 +741,15 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
     this.urlOverride = urlOverride
     this.headersOverride = headersOverride
     this.remoteAddressOverride = remoteAddressOverride
+    this.peerAddressOverride = peerAddressOverride
+    this.protocol = protocol
   }
 
   toJSON(): unknown {
     return HttpIncomingMessage.inspect(this, {
       _id: "HttpServerRequest",
       method: this.method,
-      url: this.originalUrl
+      url: UrlParams.redactUrl(this.originalUrl)
     })
   }
 
@@ -720,6 +758,8 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
       readonly url?: string | undefined
       readonly headers?: Headers.Headers | undefined
       readonly remoteAddress?: Option.Option<string> | undefined
+      readonly peerAddress?: Option.Option<string> | undefined
+      readonly protocol?: "http" | "https" | undefined
     }
   ) {
     return new ClientRequestImpl(
@@ -727,7 +767,9 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
       this.originalUrl,
       options.url ?? this.url,
       options.headers ?? this.headersOverride,
-      "remoteAddress" in options ? options.remoteAddress : this.remoteAddressOverride
+      "remoteAddress" in options ? options.remoteAddress : this.remoteAddressOverride,
+      options.peerAddress ?? this.peerAddressOverride,
+      options.protocol ?? this.protocol
     )
   }
 
@@ -743,6 +785,10 @@ class ClientRequestImpl extends Inspectable.Class implements HttpServerRequest {
     return this.remoteAddressOverride ?? Option.none()
   }
 
+  get peerAddress(): Option.Option<string> {
+    return this.peerAddressOverride ?? this.remoteAddress
+  }
+
   get headers(): Headers.Headers {
     return this.headersOverride ??= this.source.headers
   }
@@ -1039,9 +1085,13 @@ const textDecoder = new TextDecoder()
  *
  * **Details**
  *
- * The host comes from the `host` header, defaulting to `localhost`, and the
- * protocol is `https` only when `x-forwarded-proto` is `https`; invalid URLs
- * return `Option.none`.
+ * Uses `host` (defaulting to `localhost`) and the request `protocol` set by
+ * trusted proxy middleware. Otherwise, infers HTTPS from a case-insensitive
+ * `https:` prefix in `originalUrl`, defaulting to HTTP. Forwarding headers such
+ * as `x-forwarded-proto` are never read directly; use
+ * `HttpMiddleware.xForwardedHeaders` behind a TLS-terminating proxy. An
+ * absolute `url` keeps its own protocol and host. Invalid URLs return
+ * `Option.none`.
  *
  * @stability unstable
  * @category converting
@@ -1049,9 +1099,10 @@ const textDecoder = new TextDecoder()
  */
 export const toURL = (self: HttpServerRequest): Option.Option<URL> => {
   const host = self.headers.host ?? "localhost"
-  const protocol = self.headers["x-forwarded-proto"] === "https" ? "https" : "http"
+  const protocol = self.protocol ?? (/^https:/i.test(self.originalUrl) ? "https" : "http")
   try {
-    return Option.some(new URL(self.url, `${protocol}://${host}`))
+    // Prefix paths with `.` so leading `//` cannot replace the host.
+    return Option.some(new URL(self.url.startsWith("/") ? `.${self.url}` : self.url, `${protocol}://${host}`))
   } catch {
     return Option.none()
   }
@@ -1094,7 +1145,15 @@ export const toWebResult = (self: HttpServerRequest, options?: {
     requestInit.signal = options.signal
   }
   if (hasBody(self.method)) {
-    requestInit.body = Stream.toReadableStreamWith(self.stream, options?.context ?? Context.empty())
+    // Opening on the first pull with a zero high-water mark reads the body only
+    // when the Web body is read, so converting a request leaves it readable.
+    requestInit.body = Stream.toReadableStreamWith(
+      lazyStream.openOnFirstPull(self.stream),
+      options?.context ?? Context.empty(),
+      {
+        strategy: { highWaterMark: 0 }
+      }
+    )
     ;(requestInit as any).duplex = "half"
   }
   return Result.succeed(new Request(url.value, requestInit))

package/src/http/HttpServerResponse.ts

@@ -25,6 +25,7 @@ import { hasProperty } from "../Predicate.ts"
 import { redact } from "../Redactable.ts"
 import type * as Schema from "../Schema.ts"
 import type { ParseOptions } from "../SchemaAST.ts"
+import type * as Socket from "../socket/Socket.ts"
 import * as Stream from "../Stream.ts"
 import type { Mutable } from "../Types.ts"
 import * as Cookies from "./Cookies.ts"
@@ -76,6 +77,9 @@ export interface Options {
   readonly headers?: Headers.Input | undefined
   readonly cookies?: Cookies.Cookies | undefined
   readonly contentType?: string | undefined
+  /**
+   * Sent as `content-length`, so it must equal the body's byte length.
+   */
   readonly contentLength?: number | undefined
 }
 
@@ -1346,6 +1350,9 @@ export const setStatus: {
 export const omitsBody = (response: HttpServerResponse, withoutBody = false): boolean =>
   withoutBody || response.status === 204 || response.status === 205 || response.status === 304
 
+// HEAD and 304 retain the representation length; 204 and 205 omit it.
+const omitsContentLength = (status: number): boolean => status === 204 || status === 205
+
 const mergeHeaders = (target: globalThis.Headers, headers: globalThis.Headers): globalThis.Headers => {
   for (const [key, value] of headers as any) {
     if (key === "set-cookie") {
@@ -1366,15 +1373,15 @@ const mergeHeaders = (target: globalThis.Headers, headers: globalThis.Headers):
  * the supplied context, and are interrupted when `signal` aborts.
  *
  * Bodies are omitted for statuses 204, 205, and 304, or when `withoutBody` is true
- * (for example, for HEAD responses). Omitted raw `ReadableStream` bodies are
- * cancelled without awaiting completion, and cancellation errors are ignored.
+ * (for example, for HEAD responses). Statuses 204 and 205 also omit
+ * `content-length`. Omitted raw `ReadableStream` bodies are cancelled without
+ * awaiting completion, and cancellation errors are ignored.
  *
- * A raw `Response` is returned as-is when there are no outer headers or cookies
- * to merge. Otherwise, they are merged into a copy without modifying the raw
- * response: outer headers replace native ones, and cookies are appended. When
- * its body is omitted, the bodyless `Response` keeps those merged
- * headers and uses the outer status for 204, 205 and 304, or the raw `Response`
- * status otherwise.
+ * A raw `Response` is returned as-is unless its body or `content-length` must
+ * be omitted, or outer headers or cookies must be merged. Copies leave the
+ * original unchanged: outer headers replace native ones, and cookies append.
+ * Bodyless copies use the outer status for 204, 205 and 304; otherwise they keep
+ * the raw status.
  *
  * @stability unstable
  * @category converting
@@ -1400,27 +1407,28 @@ export const toWeb = (
   const withoutBody = outerOmitsBody || options?.withoutBody === true
   if (body._tag === "Raw" && body.body instanceof Response) {
     const raw = body.body
-    if (!withoutBody) {
-      if (headers.keys().next().done) {
-        return raw
-      }
-      const copy = new Response(raw.body, raw)
-      mergeHeaders(copy.headers, headers)
-      return copy
-    }
-    // A bodyless outer status is what the caller chose to send; otherwise the
-    // body is only omitted for HEAD and the raw Response describes the resource.
+    // HEAD preserves the raw status; an explicit bodyless status overrides it.
     const source = outerOmitsBody ? response : raw
-    return new Response(undefined, {
-      status: source.status,
-      statusText: source.statusText as string,
-      headers: mergeHeaders(new globalThis.Headers(raw.headers), headers)
-    })
+    const omitContentLength = omitsContentLength(source.status)
+    if (!withoutBody && headers.keys().next().done && !(omitContentLength && raw.headers.has("content-length"))) {
+      return raw
+    }
+    const copy = withoutBody
+      ? new Response(undefined, {
+        status: source.status,
+        statusText: source.statusText as string,
+        headers: raw.headers
+      })
+      : new Response(raw.body, raw)
+    mergeHeaders(copy.headers, headers)
+    if (omitContentLength) copy.headers.delete("content-length")
+    return copy
   }
   if (withoutBody) {
     if (body._tag === "Raw" && isReadableStream(body.body)) {
       body.body.cancel().catch(constVoid)
     }
+    if (omitsContentLength(response.status)) headers.delete("content-length")
     return new Response(undefined, {
       status: response.status,
       statusText: response.statusText as string,
@@ -1696,6 +1704,18 @@ class ServerHttpClientResponse extends Inspectable.Class implements HttpClientRe
     return this.formDataResponse ??= new Response((this.response.body as Body.FormData).formData)
   }
 
+  get upgrade(): Effect.Effect<Socket.Socket, HttpClientError.HttpClientError> {
+    return Effect.fail(
+      new HttpClientError.HttpClientError({
+        reason: new HttpClientError.StatusCodeError({
+          request: this.request,
+          response: this,
+          description: "a server response has no connection to hand over"
+        })
+      })
+    )
+  }
+
   pipe() {
     return pipeArguments(this, arguments)
   }
@@ -1804,6 +1824,12 @@ const makeResponse = (options: {
  * `Set-Cookie` headers are parsed into the response cookie collection and removed
  * from the header map. A present Web body is exposed as a stream body.
  *
+ * **Gotchas**
+ *
+ * Preserves `content-length`, which must match the body. When proxying a
+ * compressed response decoded by `fetch`, remove the stale length from a copy
+ * (`new Response(response.body, response)`) before converting it.
+ *
  * @stability unstable
  * @category converting
  * @since 4.0.0

package/src/http/HttpStaticServer.ts

@@ -10,11 +10,15 @@
  * @stability unstable
  * @since 4.0.0
  */
+import * as DateTime from "../DateTime.ts"
 import * as Effect from "../Effect.ts"
 import * as FileSystem from "../FileSystem.ts"
 import * as Layer from "../Layer.ts"
+import * as Option from "../Option.ts"
 import * as Path from "../Path.ts"
 import type { PlatformError } from "../PlatformError.ts"
+import * as Result from "../Result.ts"
+import * as Headers from "./Headers.ts"
 import * as HttpPlatform from "./HttpPlatform.ts"
 import * as HttpRouter from "./HttpRouter.ts"
 import * as HttpServerError from "./HttpServerError.ts"
@@ -206,12 +210,26 @@ export const make: (options: {
           return serveFile(request, resolvedPath, info.size)
         }
         if (info.type === "Directory" && index !== undefined) {
+          let originalUrl = request.originalUrl
+          if (!originalUrl.startsWith("/")) {
+            const url = new URL(originalUrl)
+            originalUrl = url.pathname + url.search
+          }
+          const pathname = stripQueryString(originalUrl)
+          if (!pathname.endsWith("/")) {
+            // Keep the redirect local even when the path starts with multiple separators.
+            const location = pathname.replace(/^\/+/, "/").replace(/\\/g, "%5C")
+            return Effect.succeed(HttpServerResponse.redirect(
+              `${location}/${originalUrl.slice(pathname.length)}`,
+              { status: 301 }
+            ))
+          }
           return serveFile(request, path.join(resolvedPath, index))
         }
         return Effect.fail(toRouteNotFoundError(request))
       }
-    })
-  })
+    });
+  });
 })
 
 /**
@@ -398,16 +416,9 @@ const resolveFilePath = (path: Path.Path, root: string, url: string): string | u
   if (decodedPath.includes("\u0000")) {
     return undefined
   }
-  const normalizedPath = path.normalize(decodedPath.startsWith("/") ? decodedPath.slice(1) : decodedPath)
-  if (normalizedPath === ".." || normalizedPath.startsWith(`..${path.sep}`)) {
-    return undefined
-  }
-  const resolvedPath = path.join(root, normalizedPath)
-  const rootPrefix = root.endsWith(path.sep) ? root : `${root}${path.sep}`
-  if (resolvedPath !== root && !resolvedPath.startsWith(rootPrefix)) {
-    return undefined
-  }
-  return resolvedPath
+  // every leading separator is part of the URL, not a filesystem root
+  const relativePath = decodedPath.replace(path.sep === "\\" ? /^[/\\]+/ : /^\/+/, "")
+  return Option.getOrUndefined(path.resolveWithin(root, relativePath))
 }
 
 const toRouteNotFoundError = (request: HttpServerRequest.HttpServerRequest) =>
@@ -452,19 +463,18 @@ const matchesIfNoneMatch = (ifNoneMatch: string, etag: string | undefined): bool
   return false
 }
 
+// An invalid date on either side disables the precondition (RFC 9110 §13.1.3).
 const isNotModifiedSince = (ifModifiedSince: string, lastModified: string | undefined): boolean => {
   if (lastModified === undefined) {
     return false
   }
-  const ifModifiedSinceMs = Date.parse(ifModifiedSince)
-  if (Number.isNaN(ifModifiedSinceMs)) {
-    return false
-  }
-  const lastModifiedMs = Date.parse(lastModified)
-  if (Number.isNaN(lastModifiedMs)) {
+  const ifModifiedSinceDate = Headers.parseHttpDate(ifModifiedSince)
+  if (Result.isFailure(ifModifiedSinceDate)) {
     return false
   }
-  return lastModifiedMs <= ifModifiedSinceMs
+  const lastModifiedDate = Headers.parseHttpDate(lastModified)
+  return Result.isSuccess(lastModifiedDate) &&
+    DateTime.toEpochMillis(lastModifiedDate.success) <= DateTime.toEpochMillis(ifModifiedSinceDate.success)
 }
 
 // Only a strong entity-tag can match (RFC 9110 §13.1.5). Weak tags start

package/src/http/HttpTraceContext.ts

@@ -49,7 +49,7 @@ export const toHeaders = (span: Tracer.Span): Headers.Headers =>
         onSome: (parent) => `-${parent.spanId}`
       })
     }`,
-    traceparent: `00-${span.traceId}-${span.spanId}-${span.sampled ? "01" : "00"}`
+    traceparent: `00-${span.traceId.padStart(32, "0")}-${span.spanId}-${span.sampled ? "01" : "00"}`
   })
 
 /**

package/src/http/MultipartParser/internal/contentType.ts

@@ -18,6 +18,13 @@
 const paramRE =
   /; *([!#$%&'*+.^\w`|~-]+)=("(?:[\v\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u{10ffff}]|\\[\v\u0020-\u{10ffff}])*"|[!#$%&'*+.^\w`|~-]+) */gu
 
+/**
+ * RegExp to match *( ";" disposition-parm ) in RFC 6266 sec 4.1, which allows
+ * optional whitespace around separators
+ */
+const dispositionParamRE =
+  /;[ \t]*([!#$%&'*+.^\w`|~-]+)[ \t]*=[ \t]*("(?:[\v\u0020\u0021\u0023-\u005b\u005d-\u007e\u0080-\u{10ffff}]|\\[\v\u0020-\u{10ffff}])*"|[!#$%&'*+.^\w`|~-]+)[ \t]*/gu
+
 /**
  * RegExp to match quoted-pair in RFC 7230 sec 3.2.6
  *
@@ -34,14 +41,13 @@ const quotedPairRE = /\\([\v\u0020-\u{10ffff}])/gu
  * subtype    = token
  */
 const mediaTypeRE = /^[!#$%&'*+.^\w|~-]+\/[!#$%&'*+.^\w|~-]+$/u
-const mediaTypeRENoSlash = /^[!#$%&'*+.^\w|~-]+$/u
+const dispositionTypeRE = /^[!#$%&'*+.^\w|~-]+$/u
 
 // default ContentType to prevent repeated object creation
 const defaultContentType = { value: "", parameters: Object.create(null) }
 
 export function parse(
-  header: string | undefined,
-  withoutSlash = false
+  header: string | undefined
 ): {
   readonly value: string
   readonly parameters: Record<string, string>
@@ -52,9 +58,8 @@ export function parse(
 
   let index = header.indexOf(";")
   const type = index !== -1 ? header.slice(0, index).trim() : header.trim()
-  const mediaRE = withoutSlash ? mediaTypeRENoSlash : mediaTypeRE
 
-  if (mediaRE.test(type) === false) {
+  if (mediaTypeRE.test(type) === false) {
     return defaultContentType
   }
 
@@ -87,7 +92,7 @@ export function parse(
       // remove quotes and escapes
       value = value.slice(1, value.length - 1)
 
-      if (!withoutSlash && quotedPairRE.test(value)) {
+      if (quotedPairRE.test(value)) {
         value = value.replace(quotedPairRE, "$1")
       }
     }
@@ -101,3 +106,99 @@ export function parse(
 
   return result
 }
+
+// RFC 8187 ext-value: charset "'" [ language ] "'" value-chars
+const extValueRE = /^(utf-8|iso-8859-1)'[a-z0-9-]*'((?:%[0-9a-f]{2}|[!#$&+.^_`|~\w-])*)$/i
+const pctEncodedRE = /%([0-9a-f]{2})/gi
+
+/**
+ * Decodes an RFC 8187 ext-value, returning `undefined` when it is malformed.
+ * ISO-8859-1 is decoded byte by byte because `TextDecoder` treats it as
+ * windows-1252.
+ */
+function decodeExtValue(value: string): string | undefined {
+  const match = extValueRE.exec(value)
+  if (match === null) {
+    return undefined
+  }
+  if (match[1].toLowerCase() === "iso-8859-1") {
+    return match[2].replace(pctEncodedRE, (_, hex: string) => String.fromCharCode(parseInt(hex, 16)))
+  }
+  try {
+    return decodeURIComponent(match[2])
+  } catch {
+    return undefined
+  }
+}
+
+export interface ContentDisposition {
+  readonly value: string
+  readonly parameters: Record<string, string>
+  /** `filename*` decoded per RFC 8187, falling back to `filename` */
+  readonly filename: string | undefined
+}
+
+// default ContentDisposition to prevent repeated object creation
+const defaultContentDisposition: ContentDisposition = { ...defaultContentType, filename: undefined }
+
+/**
+ * Parses a Content-Disposition header according to RFC 6266, returning
+ * `undefined` when it is malformed, repeats a parameter or carries an
+ * undecodable `filename*`.
+ *
+ * Quoted-pairs are left as-is, so unescaped backslashes in file paths survive.
+ */
+export function parseDisposition(
+  header: string | ReadonlyArray<string> | undefined
+): ContentDisposition | undefined {
+  if (header === undefined) {
+    return defaultContentDisposition
+  } else if (typeof header !== "string") {
+    return undefined
+  }
+
+  let index = header.indexOf(";")
+  const type = index !== -1 ? header.slice(0, index).trim() : header.trim()
+
+  if (dispositionTypeRE.test(type) === false) {
+    return undefined
+  }
+
+  const parameters: Record<string, string> = Object.create(null)
+
+  if (index !== -1) {
+    let match: RegExpExecArray | null
+
+    dispositionParamRE.lastIndex = index
+
+    while ((match = dispositionParamRE.exec(header))) {
+      if (match.index !== index) {
+        return undefined
+      }
+
+      index += match[0].length
+      const key = match[1].toLowerCase()
+      const value = match[2]
+
+      if (key in parameters) {
+        return undefined
+      }
+
+      parameters[key] = value[0] === "\"" ? value.slice(1, value.length - 1) : value
+    }
+
+    if (index !== header.length) {
+      return undefined
+    }
+  }
+
+  let filename: string | undefined = parameters.filename
+  if ("filename*" in parameters) {
+    filename = decodeExtValue(parameters["filename*"])
+    if (filename === undefined) {
+      return undefined
+    }
+  }
+
+  return { value: type.toLowerCase(), parameters, filename }
+}

package/src/http/MultipartParser/internal/headers.ts

@@ -1,3 +1,4 @@
+import * as Bytes from "../../../Bytes.ts"
 import type { Continue, FailureReason, ReturnValue } from "../HeadersParser.ts"
 
 const constMaxPairs = 100
@@ -55,13 +56,6 @@ export function make() {
     return value
   }
 
-  function concatUint8Array(a: Uint8Array, b: Uint8Array): Uint8Array {
-    const newUint8Array = new Uint8Array(a.length + b.length)
-    newUint8Array.set(a)
-    newUint8Array.set(b, a.length)
-    return newUint8Array
-  }
-
   function error(reason: FailureReason) {
     return reset({ _tag: "Failure", reason, headers: state.headers })
   }
@@ -73,11 +67,8 @@ export function make() {
       endOffset = state.previousChunk.length
       previousCursor = endOffset
 
-      const newChunk = new Uint8Array(chunk.length + endOffset)
-      newChunk.set(state.previousChunk)
-      newChunk.set(chunk, endOffset)
+      chunk = Bytes.concat([state.previousChunk, chunk])
       state.previousChunk = undefined
-      chunk = newChunk
     }
     const end = chunk.length
 
@@ -182,10 +173,7 @@ export function make() {
             } else if (state.crlf >= 2) {
               state.value = state.value === undefined
                 ? chunk.subarray(start, i - state.crlf)
-                : concatUint8Array(
-                  state.value,
-                  chunk.subarray(start, i - state.crlf)
-                )
+                : Bytes.concat([state.value, chunk.subarray(start, i - state.crlf)])
               const value = decoder.decode(state.value)
               if (state.headers[state.key] === undefined) {
                 state.headers[state.key] = value
@@ -229,7 +217,7 @@ export function make() {
         if (i === end) {
           state.value = state.value === undefined
             ? chunk.subarray(start, end)
-            : concatUint8Array(state.value, chunk.subarray(start, end))
+            : Bytes.concat([state.value, chunk.subarray(start, end)])
           return constContinue
         }
       }