h2lean 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,266 @@
-# Temporary Holding Version
+<div align="center">
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<img src="assets/banner.svg" alt="h2lite banner" width="720">
+
+### The pure-JavaScript HTTP/2 stack for Node.js
+
+**Drop-in replacement for `node:http2` — without the nghttp2 C layer.**
+
+[![npm](https://img.shields.io/badge/npm-v0.1.0-cb3837)](https://www.npmjs.com/package/h2lite)
+[![node](https://img.shields.io/badge/node-%E2%89%A520-339933)](https://nodejs.org)
+[![dependencies](https://img.shields.io/badge/dependencies-0-brightgreen)](package.json)
+[![license](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
+
+Up to **8× less CPU per request** and **6.8× more requests per second** than `node:http2` — measured, paired, and reproducible. Outperforms even uWebSockets (C++) at header-bound HTTP/2 workloads.
+
+</div>
+
+---
+
+## 📑 Table of Contents
+
+- ⚡ [Why h2lite?](#-why-h2lite)
+- 🏎️ [Performance](#️-performance)
+- 🔌 [Compatibility — Drop-in Replacement](#-compatibility--drop-in-replacement)
+- 📦 [Installation](#-installation)
+- 🚀 [Getting Started](#-getting-started)
+  - [Server — the `(req, res)` API](#server--the-req-res-api)
+  - [Server — the raw `Http2Stream` API](#server--the-raw-http2stream-api)
+  - [Secure server (h2s / TLS)](#secure-server-h2s--tls)
+  - [Client — `connect()`](#client--connect)
+  - [Fastify and other frameworks](#fastify-and-other-frameworks)
+  - [Monkey-patching for frameworks without injection](#monkey-patching-for-frameworks-without-injection)
+- 🛠️ [Advanced Tuning](#️-advanced-tuning)
+- 🔒 [Security](#-security)
+- ⚠️ [Not Implemented — Said Loudly](#️-not-implemented--said-loudly)
+- 📚 [Documentation](#-documentation)
+- 🤝 [Contributing](#-contributing)
+- ⚖️ [License](#️-license)
+
+## ⚡ Why h2lite?
+
+Node's native `node:http2` (stable since v10.10.0) has a fundamental architectural constraint: every HTTP/2 frame crosses the JS ↔ C++ boundary between V8 and bundled nghttp2. Frame dispatch, HPACK encoding/decoding, and flow-control bookkeeping all pay for that crossing — on every single frame of every single request.
+
+**h2lite removes the crossing entirely.** The entire protocol — frame parsing, HPACK (RFC 7541), flow control, connection state machines — lives in pure JavaScript, tuned item by item against measured data ([OPTIMIZATION.md](./OPTIMIZATION.md), 35 numbered techniques). Zero native code, zero runtime dependencies.
+
+The result is a library that keeps `node:http2`'s exact public surface while spending dramatically less CPU per request. Perfect for:
+
+- 🧩 **Microservices** — header-heavy service-to-service traffic is where the gap is widest
+- 📡 **gRPC servers** — many small streams, all header-bound
+- 🤖 **AI backends** — long-lived streams, high connection counts, every CPU cycle matters
+- 🔁 **Behind a reverse proxy** — pair h2lite with an HTTP/2-terminating edge and stop paying for HTTP/1.1
+
+## 🏎️ Performance
+
+Every number below is `node`'s own per-request CPU time (μs/req, read inside the process — the metric that travels) or requests per second, measured with [h2load](https://nghttp2.org/documentation/h2load.1.html) against six honest responder arms on the same machine in the same session. Full methodology, caveats and re-run instructions: **[PERFORMANCE.md](./PERFORMANCE.md)**.
+
+**Server, headers-only workload** (the workload HTTP/2 exists for):
+
+| Server | μs/req | req/s | CPU vs `node:http2` |
+|---|--:|--:|--:|
+| node:http (HTTP/1.1) | 9.11 | 111,816 | 1.21× |
+| uWebSockets C++ (HTTP/1.1) | 4.87 | 203,283 | 2.27× |
+| node:http2 (stream API) | 7.30 | 171,835 | 1.52× |
+| **h2lite (stream API)** | **1.38** | **765,149** | **8.01×** |
+| **h2lite (compat API)** | **2.85** | **367,275** | **3.88×** |
+
+**Server, with response body:** 16 kB — **2.50× less CPU** than `node:http2` ([PERFORMANCE.md](./PERFORMANCE.md)). 256 kB — parity, as expected: the work is body-bound, and h2lite does not win by cutting corners.
+
+**Client, same-server paired measurement** (`h2lite.connect()` vs `node:http2.connect()`, driven against nghttpd):
+
+| Workload | node client μs/req | h2lite client μs/req | Advantage |
+|---|--:|--:|---|
+| Headers only | 12.08 | **3.61** | 3.35× |
+| 16 kB | 19.66 | **11.73** | 1.68× |
+| 256 kB | 148.70 | 134.24 | within noise |
+
+> 💡 **Re-measure before quoting.** The project's own rule: an unpaired before/after run cannot separate a change from noise. Both benchmark matrices re-run with one command (`npm run bench:showcase`, `npm run bench:client`) — [bench/](./bench) has the arms, [CONTRIBUTING.md](./CONTRIBUTING.md) §3 has the method.
+
+## 🔌 Compatibility — Drop-in Replacement
+
+Compatibility target is the **public surface** of `node:http2`: names, argument shapes, event orders, wire-visible frame sequences, `rstCode`/`goawayCode` numbers — verified differentially. The test suite runs the **same application scripts** against both `node:http2` and h2lite and compares the transcripts ([test/diff-harness.js](./test/diff-harness.js)); [h2spec](https://github.com/summerwind/h2spec) conformance is 146/146 — the same verdict node's own HTTP/2 receives.
+
+```diff
+- const http2 = require('node:http2');
++ const http2 = require('h2lite');
+
+  const server = http2.createServer((req, res) => {
+    res.end('hello world');
+  });
+  server.listen(8080);
+```
+
+Same class names (`Http2Session`, `Http2Stream`, `Http2ServerRequest`, `Http2ServerResponse`), same event names, same `Http2Session` and settings semantics, all 240 protocol constants re-exported from `node:http2` itself — user code that compares `error.code !== http2.constants.NGHTTP2_ENHANCE_YOUR_CALM` keeps working unchanged. Both transports on both sides: `createServer` (h2c), `createSecureServer` (h2s), `connect()` over cleartext and TLS with node's ALPN rules.
+
+Where behavior deliberately differs from node, it is **documented, measured, and pinned by tests** — never silent. Known divergences: [CONTRIBUTING.md](./CONTRIBUTING.md) §5.
+
+## 📦 Installation
+
+```bash
+npm install h2lite
+```
+
+Requires Node.js **≥ 20** (verified against v26.12.1). Zero runtime dependencies — `lib/` imports nothing but `node:` builtins.
+
+## 🚀 Getting Started
+
+### Server — the `(req, res)` API
+
+The compat API feels like HTTP/1.1 but speaks HTTP/2 — this is what replaces `node:http2` in an existing application:
+
+```javascript
+const http2 = require('h2lite');
+
+const server = http2.createServer((req, res) => {
+  // req is an Http2ServerRequest, res is an Http2ServerResponse
+  res.writeHead(200, { 'content-type': 'text/plain' });
+  res.end('hello from h2lite');
+});
+
+server.listen(8080);
+```
+
+### Server — the raw `Http2Stream` API
+
+Maximum throughput: skip the compat objects entirely and work with streams and header maps:
+
+```javascript
+const http2 = require('h2lite');
+
+const server = http2.createServer();
+
+server.on('stream', (stream, headers) => {
+  stream.respond({ ':status': 200, 'content-type': 'text/plain' });
+  stream.end('hello from the stream API');
+});
+
+server.listen(8081);
+```
+
+### Secure server (h2s / TLS)
+
+```javascript
+const http2 = require('h2lite');
+
+const server = http2.createSecureServer({
+  key: require('fs').readFileSync('key.pem'),
+  cert: require('fs').readFileSync('cert.pem')
+});
+
+server.on('stream', (stream, headers) => {
+  stream.respond({ ':status': 200 });
+  stream.end('secure h2');
+});
+
+server.listen(8443);
+```
+
+TLS decisions stay delegated to `node:tls` — ALPN is pinned to `h2` exactly the way node does it, and certificate handling is node's, not ours.
+
+### Client — `connect()`
+
+```javascript
+const http2 = require('h2lite');
+
+const session = http2.connect('http://localhost:8080');
+
+const req = session.request({ ':path': '/', ':method': 'GET' });
+req.on('response', (headers) => {
+  console.log('status:', headers[':status']);
+});
+req.setEncoding('utf8');
+req.on('data', (chunk) => console.log(chunk));
+req.on('end', () => session.close());
+
+req.end();
+```
+
+Works over `https://…` too — the client speaks both h2c and h2s.
+
+### Fastify and other frameworks
+
+Any framework that lets you hand it a server instance takes h2lite in two lines. Fastify's [`serverFactory`](https://fastify.dev/docs/latest/Reference/Server/#serverfactory):
+
+```javascript
+const Fastify = require('fastify');
+const h2lite = require('h2lite');
+
+const fastify = Fastify({
+  http2: true,
+  serverFactory: (handler) => {
+    return h2lite.createServer((req, res) => handler(req, res));
+  }
+});
+
+fastify.get('/', async () => ({ hello: 'from h2lite under Fastify' }));
+fastify.listen({ port: 8080 });
+```
+
+### Monkey-patching for frameworks without injection
+
+If a framework requires `node:http2` internally and offers no injection point, patch the builtin's exports **before anything else loads** — every later `require('node:http2')` receives the same (mutated) module object:
+
+```javascript
+// patch.js — require this first: node -r ./patch.js app.js
+const nodeHttp2 = require('node:http2');
+const h2lite = require('h2lite');
+
+nodeHttp2.createServer = h2lite.createServer;
+nodeHttp2.createSecureServer = h2lite.createSecureServer;
+nodeHttp2.connect = h2lite.connect;
+```
+
+## 🛠️ Advanced Tuning
+
+- ♻️ **Freeze reusable header objects.** `Object.freeze()` on a header set enables h2lite's per-connection response-block cache — the HPACK bytes are encoded once and copied afterwards. Measured **~25% CPU saved** on a headers-only workload ([PERFORMANCE.md](./PERFORMANCE.md)):
+
+  ```javascript
+  const HEADERS = Object.freeze({ ':status': 200, 'content-type': 'application/json' });
+  server.on('stream', (stream) => stream.respond(HEADERS));
+  ```
+
+- 📏 **Raise `initialWindowSize`** for high-throughput downloads (see the [settings object reference](https://nodejs.org/api/http2.html#settings-object)) — default flow-control windows are conservative and will throttle bulk transfer.
+- 🌊 **Prefer more streams per connection over more connections.** HPACK state, one staging buffer and one dynamic table are per-connection: amortize them by multiplexing, not by fanning out sockets.
+- 🔍 **Read the playbook.** [OPTIMIZATION.md](./OPTIMIZATION.md) documents 35 measured techniques — and the ones that were tried and rejected, so you don't re-invent them.
+
+## 🔒 Security
+
+h2lite terminates **untrusted bytes from the internet** and turns them into objects your application trusts — the threat model is treated as the primary design constraint ([SECURITY.md](./SECURITY.md)):
+
+- 🛡️ **Every denial-of-service limit matches nghttp2** (the engine inside node) or was measured against a live node server — a peer's budget against node is its budget against h2lite: SETTINGS-entry cap (CVE-2020-11080), CONTINUATION cap (CVE-2024-28182), rapid-reset budget (CVE-2023-44487), outbound staging, parked-stream and history bounds.
+- 🚫 **Request-smuggling defense by construction** (RFC 9113 §10.3): field names must be lower-case tokens, values may not carry NUL/CR/LF, connection-specific fields are refused in both directions — all refused at encode time, *before a single octet reaches the wire*. h2lite is stricter than node here, deliberately and measurably.
+- ✅ **Verified, not assumed:**
+  - **300+ differential tests** — application scripts run against both `node:http2` and h2lite, transcripts compared;
+  - **h2spec 146/146** — full RFC 9113/7541 conformance, same verdict as node's own HTTP/2 (`npm run spec`);
+  - **mutation-tested guards** — every defensive limit is rewritten in place and proven to fail the suite ([tools/mutate-guards.js](./tools/mutate-guards.js)).
+
+## ⚠️ Not Implemented — Said Loudly
+
+Two APIs are absent, and both fail **loudly** with `ERR_H2LITE_NOT_IMPLEMENTED` — never a silent wrong answer:
+
+- **Server push** — removed from browsers in 2022 and considered obsolete; the safer replacement is [Early Hints (103)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/103).
+- **`performServerHandshake`** — no known use case outside node's own tests.
+
+## 📚 Documentation
+
+| Document | What it holds |
+|---|---|
+| [PERFORMANCE.md](./PERFORMANCE.md) | 🏎️ Benchmarks: methodology, full tables, caveats, re-run commands |
+| [SECURITY.md](./SECURITY.md) | 🔒 Threat model, every hardening limit, known gaps — stated plainly |
+| [OPTIMIZATION.md](./OPTIMIZATION.md) | 🔬 All 35 measured optimization techniques (and rejected ones) |
+| [CHANGELOG.md](./CHANGELOG.md) | 📋 Release history, Keep-a-Changelog format |
+| [CONTRIBUTING.md](./CONTRIBUTING.md) | 🧪 Testing, benchmarking and commit rules for contributors |
+
+## 🤝 Contributing
+
+Contributions are welcome! The project holds itself to an unusual standard and expects the same from patches:
+
+- **"node behaves this way" needs proof** — read from node's bundled source or measured off a live server, not recalled ([CONTRIBUTING.md](./CONTRIBUTING.md) §3).
+- **"it's faster" needs a paired benchmark** — same session, same shape, ABBA-interleaved.
+- `npm test` (300+ differential tests) and `npm run lint` must be green before a commit lands.
+
+Good first contributions: fuzzing harness (start from [tools/probe-wire.js](./tools/probe-wire.js)), more differential scenarios in [test/](./test), documentation.
+
+## ⚖️ License
+
+[Apache-2.0](./LICENSE)

package/index.js

@@ -0,0 +1,72 @@
+// h2lite -- a pure-JS HTTP/2 library with a node:http2-shaped API.
+//
+// Servers: h2c and h2s (prior-knowledge, ALPN 'h2'), the `stream` and compat
+// (`request`) APIs. Client: `connect()` + `session.request()` over h2c and h2s
+// (see lib/client.js); server push on the client stays notImplemented.
+// Deliberately reused from node:http2, because re-typing them would only create
+// drift: the 240 protocol constants and the `sensitiveHeaders` symbol. A peer
+// must see the same rstCode/goawayCode numbers as with node, and user code
+// compares against those names.
+'use strict';
+
+const nodeHttp2 = require('node:http2');
+const { createServer, createSecureServer, Http2Server, Http2SecureServer,
+  Http2ServerRequest, Http2ServerResponse, notImplemented } = require('./lib/server');
+const { Http2Session, OUR_DEFAULTS, PEER_DEFAULTS, SETTINGS_BY_ID, ID_BY_SETTING } = require('./lib/session');
+const { DATA, HEADERS, PRIORITY, RST_STREAM, SETTINGS, PUSH_PROMISE, PING, GOAWAY,
+  WINDOW_UPDATE, CONTINUATION } = require('./lib/frames');
+const { Decoder, Encoder, HPackError } = require('./lib/hpack');
+const { connect } = require('./lib/client');
+
+// The packed SETTINGS blob node's getPackedSettings produces: id/value pairs.
+function getPackedSettings(settings) {
+  const names = Object.keys(settings).filter((k) => ID_BY_SETTING[k] !== undefined);
+  const body = Buffer.alloc(names.length * 6);
+  let n = 0;
+  for (const name of names) {
+    const value = typeof settings[name] === 'boolean' ? (settings[name] ? 1 : 0) : settings[name];
+    body.writeUInt16BE(ID_BY_SETTING[name], n);
+    body.writeUInt32BE(value >>> 0, n + 2);
+    n += 6;
+  }
+  return body;
+}
+
+function getUnpackedSettings(buf) {
+  const out = {};
+  if (!Buffer.isBuffer(buf)) throw new TypeError('a Buffer is required');
+  if (buf.length % 6 !== 0) {
+    const err = new Error('buffer length must be a multiple of 6');
+    err.code = 'ERR_HTTP2_INVALID_PACKED_SETTINGS_LENGTH';
+    throw err;
+  }
+  for (let i = 0; i + 6 <= buf.length; i += 6) {
+    const name = SETTINGS_BY_ID[buf.readUInt16BE(i)];
+    if (name === undefined) continue;
+    out[name] = buf.readUInt32BE(i + 2);
+  }
+  return out;
+}
+
+module.exports = {
+  constants: nodeHttp2.constants,
+  sensitiveHeaders: nodeHttp2.sensitiveHeaders,
+  createServer,
+  createSecureServer,
+  connect,
+  performServerHandshake: () => { throw notImplemented('performServerHandshake'); },
+  getDefaultSettings: () => ({ ...OUR_DEFAULTS }),
+  getPackedSettings,
+  getUnpackedSettings,
+  Http2Server,
+  Http2SecureServer,
+  Http2Session,
+  // node exports exactly these two compat classes at the top level
+  Http2ServerRequest,
+  Http2ServerResponse,
+  // internal pieces, exported because tests and benchmarks reach for them
+  HPack: { Decoder, Encoder, HPackError },
+  FrameType: { DATA, HEADERS, PRIORITY, RST_STREAM, SETTINGS, PUSH_PROMISE, PING,
+    GOAWAY, WINDOW_UPDATE, CONTINUATION },
+  PeerDefaults: PEER_DEFAULTS,
+};