neon 2.44.0 → 2.45.0

package/dist/dev/runtime.js

@@ -2,6 +2,7 @@ import { createServer } from "node:http";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { getRequestListener } from "@hono/node-server";
+import { createUpgradeListener, installWebSocketBridge, } from "./websocket.js";
 const isFunction = (value) => typeof value === "function";
 const hasFetchMethod = (value) => typeof value === "object" &&
     value !== null &&
@@ -27,6 +28,30 @@ export const resolveFetchHandler = (mod) => {
         "  export default { fetch(req) { /* ... */ } }\n" +
         "  export default function (req) { /* ... */ }");
 };
+const hasUpgradeMethod = (value) => typeof value === "object" &&
+    value !== null &&
+    "upgrade" in value &&
+    typeof value.upgrade === "function";
+/**
+ * Resolve the user's optional WebSocket entrypoint: a named `export function upgrade`,
+ * or an `upgrade` method on the default export. `undefined` when the module has
+ * neither, which is the common case — a function without one either uses
+ * `upgradeWebSocket()` inside `fetch` or serves no WebSockets at all.
+ *
+ * Resolution order matches the deployed runtime exactly (named export first, then the
+ * default-export method), so a module that resolves one way locally cannot resolve the
+ * other way once deployed.
+ */
+export const resolveUpgradeHandler = (mod) => {
+    if (typeof mod.upgrade === "function")
+        return mod.upgrade;
+    const defaultExport = mod.default;
+    if (hasUpgradeMethod(defaultExport)) {
+        const target = defaultExport;
+        return (req, socket, head) => target.upgrade(req, socket, head);
+    }
+    return undefined;
+};
 /**
  * Wrap a fetch handler so user errors become a 500 response (with the message
  * in the body during dev) instead of crashing the child process.
@@ -87,11 +112,30 @@ const listen = (server, port, hostname) => new Promise((resolveListen, rejectLis
 export const startRuntime = async ({ source, port, hostname, }) => {
     const absoluteSource = resolve(process.cwd(), source);
     const mod = (await import(pathToFileURL(absoluteSource).href));
-    const handler = withErrorBoundary(resolveFetchHandler(mod));
+    const fetchHandler = resolveFetchHandler(mod);
+    const handler = withErrorBoundary(fetchHandler);
+    // Publish the bridge `upgradeWebSocket()` reads before the user module can serve a
+    // request, so the helper resolves locally exactly as it does when deployed.
+    installWebSocketBridge();
     const listener = getRequestListener(handler, { hostname });
     const server = createServer((incoming, outgoing) => {
         void listener(incoming, outgoing);
     });
+    // Node emits 'upgrade' rather than 'request' for a WebSocket handshake. Without
+    // this listener Node hands the handshake to the ordinary request handler, which
+    // answers 200 on a connection the client expects to be a 101 — so a function's
+    // WebSocket code silently never ran under `neon dev`.
+    //
+    // The upgrade path takes the RAW handler, not the error-boundary-wrapped one. The
+    // boundary turns a throw into a 500 Response, which on this path is
+    // indistinguishable from a handler that deliberately declined the upgrade — so a
+    // crashing handler would answer 501 ("no WebSocket support") instead of surfacing
+    // the error. The upgrade listener has its own equivalent boundary, and reports a
+    // throw as the 502 the deployed runtime returns.
+    server.on("upgrade", createUpgradeListener({
+        fetch: fetchHandler,
+        upgrade: resolveUpgradeHandler(mod),
+    }));
     const boundPort = await bindPort(server, port, hostname);
     process.stdout.write(`neon-dev:ready ${boundPort}\n`);
     return boundPort;

package/dist/dev/websocket.js

@@ -0,0 +1,1031 @@
+/**
+ * WebSocket support for the `neon dev` server.
+ *
+ * Node's `http.Server` emits `'upgrade'` — not `'request'` — for anything carrying
+ * `Connection: Upgrade`. With no `'upgrade'` listener registered, Node routes the
+ * handshake to the ordinary request handler, which answers `200 OK` on a connection
+ * the client is waiting to see a `101` on. That is why WebSockets did not work under
+ * `neon dev`: a function's `upgrade` export was never called, and the client saw a
+ * nonsense 200 rather than an error.
+ *
+ * This module provides both shapes the deployed runtime supports:
+ *
+ *   1. `export function upgrade(req, socket, head)` — handed the raw Node triple,
+ *      exactly like production. The bundle owns the handshake and framing.
+ *   2. `upgradeWebSocket(request)` from `@neon/functions`, called inside `fetch` —
+ *      reached only when there is no `upgrade` export, matching the runtime's
+ *      precedence rule so local behaviour cannot diverge from deployed behaviour.
+ *
+ * The protocol implementation here mirrors the deployed runtime's. Duplicating it is
+ * deliberate for now: the runtime is a zero-dependency file baked into a microVM image
+ * and cannot import from npm, so sharing a module would mean new vendoring machinery.
+ * The shared contract is the bridge global and the observable behaviour, which the
+ * tests on both sides pin. permessage-deflate is not negotiated on either side.
+ */
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _DevServerWebSocket_instances, _DevServerWebSocket_socket, _DevServerWebSocket_protocol, _DevServerWebSocket_readyState, _DevServerWebSocket_binaryType, _DevServerWebSocket_bufferedAmount, _DevServerWebSocket_chunks, _DevServerWebSocket_queued, _DevServerWebSocket_fragmentOpcode, _DevServerWebSocket_fragments, _DevServerWebSocket_fragmentBytes, _DevServerWebSocket_closeSent, _DevServerWebSocket_closeTimer, _DevServerWebSocket_handlers, _DevServerWebSocket_setHandler, _DevServerWebSocket_onData, _DevServerWebSocket_parse, _DevServerWebSocket_pushFragment, _DevServerWebSocket_deliver, _DevServerWebSocket_handleControl, _DevServerWebSocket_sendClose, _DevServerWebSocket_fail, _DevServerWebSocket_finishClose, _DevServerWebSocket_emitError, _DevServerWebSocket_writeFrame, _DevServerWebSocket_peek, _DevServerWebSocket_take;
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash } from "node:crypto";
+/** The bridge global `@neon/functions` reads. Must match the deployed runtime. */
+const WS_BRIDGE_KEY = Symbol.for("neon.websocket.bridge");
+/** Brand identifying the response the helper produced. Non-enumerable. */
+const UPGRADE_RECORD = Symbol.for("neon.websocket.upgradeRecord");
+/** RFC 6455 §1.3. */
+const WS_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+const OP_CONTINUATION = 0x0;
+const OP_TEXT = 0x1;
+const OP_BINARY = 0x2;
+const OP_CLOSE = 0x8;
+const OP_PING = 0x9;
+const OP_PONG = 0xa;
+const CONNECTING = 0;
+const OPEN = 1;
+const CLOSING = 2;
+const CLOSED = 3;
+/** Reassembly ceiling: a fragmented message buffers until FIN, so it must be bounded. */
+const MAX_MESSAGE_BYTES = 16 * 1024 * 1024;
+/** Control frames carry at most 125 bytes and are never fragmented (§5.5). */
+const MAX_CONTROL_PAYLOAD = 125;
+/** A close reason must fit the 123 bytes left after the 2-byte code. */
+const MAX_CLOSE_REASON_BYTES = 123;
+/** How long to wait for the peer's answering close frame (§7.1.1 leaves this open). */
+const CLOSE_HANDSHAKE_TIMEOUT_MS = 5000;
+const EMPTY = Buffer.alloc(0);
+class ShimErrorEvent extends Event {
+    constructor(type, init = {}) {
+        super(type);
+        this.message = init.message ?? "";
+        this.error = init.error;
+    }
+}
+const ErrorEventCtor = typeof globalThis.ErrorEvent === "function"
+    ? globalThis
+        .ErrorEvent
+    : ShimErrorEvent;
+class ShimCloseEvent extends Event {
+    constructor(type, init = {}) {
+        super(type);
+        this.code = init.code ?? 0;
+        this.reason = init.reason ?? "";
+        this.wasClean = init.wasClean ?? false;
+    }
+}
+export const CloseEventCtor = typeof globalThis.CloseEvent === "function"
+    ? globalThis
+        .CloseEvent
+    : ShimCloseEvent;
+export const acceptKey = (key) => createHash("sha1")
+    .update(key + WS_GUID)
+    .digest("base64");
+const headerValue = (req, name) => {
+    const value = req.headers[name];
+    if (Array.isArray(value))
+        return value[0] ?? "";
+    return typeof value === "string" ? value : "";
+};
+/** Does this request carry a WebSocket handshake (rather than some other upgrade)? */
+export const isWebSocketHandshake = (req) => headerValue(req, "upgrade").toLowerCase() === "websocket" &&
+    headerValue(req, "sec-websocket-key") !== "";
+// -- Request <-> socket association -----------------------------------------
+/** Primary lookup: the exact Request object the dev server built. */
+const pendingByRequest = new WeakMap();
+/**
+ * Fallback for adapters that rebuild the Request before the handler sees it —
+ * Hono's Node adapter does, so the object identity we keyed on is lost.
+ */
+const upgradeStore = new AsyncLocalStorage();
+const registerUpgrade = (request, parts) => {
+    const record = {
+        req: parts.req,
+        socket: parts.socket,
+        head: parts.head.length ? Buffer.from(parts.head) : EMPTY,
+        claimed: false,
+        ws: null,
+        protocol: "",
+        accept: "",
+    };
+    pendingByRequest.set(request, record);
+    return record;
+};
+const readUpgradeRecord = (value) => {
+    if (!value || typeof value !== "object")
+        return null;
+    return (value[UPGRADE_RECORD] ??
+        null);
+};
+// -- The Response subclass ---------------------------------------------------
+/**
+ * `new Response(null, { status: 101 })` throws — the fetch spec restricts constructed
+ * responses to 200-599. A subclass can still report 101 from the getter while being a
+ * genuine `instanceof Response`.
+ *
+ * The lie does not survive `clone()` or `new Response(res.body, res)`; both drop the
+ * brand and the overridden getter. That is detected and failed loudly rather than
+ * silently answering 200 on a socket awaiting a 101.
+ */
+class UpgradeResponse extends Response {
+    constructor(record) {
+        super(null, { status: 200 });
+        Object.defineProperty(this, UPGRADE_RECORD, {
+            value: record,
+            enumerable: false,
+            configurable: false,
+            writable: false,
+        });
+    }
+    get status() {
+        return 101;
+    }
+    get statusText() {
+        return "Switching Protocols";
+    }
+    get ok() {
+        return false;
+    }
+}
+// -- The public helper -------------------------------------------------------
+/** The implementation behind `upgradeWebSocket()` in `@neon/functions`. */
+export const upgradeWebSocket = (request, options = {}) => {
+    const record = pendingByRequest.get(request) ?? upgradeStore.getStore();
+    if (!record) {
+        throw new TypeError("upgradeWebSocket() found no connection to upgrade. It is only usable " +
+            "inside a Neon Functions invocation, on a request carrying a WebSocket " +
+            "handshake.");
+    }
+    if (record.claimed) {
+        throw new TypeError("upgradeWebSocket() was already called for this request; a connection " +
+            "can only be upgraded once.");
+    }
+    const req = record.req;
+    const method = (req.method ?? "GET").toUpperCase();
+    if (method !== "GET") {
+        throw new TypeError(`upgradeWebSocket() requires a GET request, got ${method}.`);
+    }
+    const key = headerValue(req, "sec-websocket-key");
+    if (headerValue(req, "upgrade").toLowerCase() !== "websocket" ||
+        key === "") {
+        throw new TypeError("upgradeWebSocket() requires a WebSocket handshake: the request must " +
+            "carry `Upgrade: websocket` and `Sec-WebSocket-Key`.");
+    }
+    const version = headerValue(req, "sec-websocket-version");
+    if (version !== "" && version !== "13") {
+        throw new TypeError(`unsupported Sec-WebSocket-Version ${version}; only version 13 is supported.`);
+    }
+    // RFC 6455 §4.2.2: echo exactly one protocol, and only one the client offered.
+    // Selecting an un-offered protocol is a server bug that surfaces as an opaque
+    // client-side rejection, so fail here where the cause is obvious.
+    let protocol = "";
+    if (options.protocol != null) {
+        if (typeof options.protocol !== "string") {
+            throw new TypeError("options.protocol must be a string.");
+        }
+        const offered = headerValue(req, "sec-websocket-protocol")
+            .split(",")
+            .map((entry) => entry.trim())
+            .filter((entry) => entry !== "");
+        if (!offered.includes(options.protocol)) {
+            throw new TypeError(`the client did not offer the subprotocol "${options.protocol}" ` +
+                `(offered: ${offered.length ? offered.join(", ") : "none"}).`);
+        }
+        protocol = options.protocol;
+    }
+    record.claimed = true;
+    record.protocol = protocol;
+    record.accept = acceptKey(key);
+    record.ws = new DevServerWebSocket({
+        socket: record.socket,
+        url: socketUrl(req),
+        protocol,
+    });
+    return {
+        socket: record.ws,
+        response: new UpgradeResponse(record),
+    };
+};
+const socketUrl = (req) => {
+    const host = headerValue(req, "host") || "localhost";
+    const target = typeof req.url === "string" && req.url.startsWith("/") ? req.url : "/";
+    return `ws://${host}${target}`;
+};
+/** Publish the bridge so `@neon/functions` resolves under `neon dev`. */
+export const installWebSocketBridge = (target = globalThis) => {
+    Object.defineProperty(target, WS_BRIDGE_KEY, {
+        value: { version: 1, upgrade: upgradeWebSocket },
+        enumerable: false,
+        configurable: true,
+        writable: true,
+    });
+};
+// -- Handshake completion ----------------------------------------------------
+/** Headers the handshake owns; a customer value must not override them. */
+const RESERVED_HANDSHAKE_HEADERS = new Set([
+    "connection",
+    "upgrade",
+    "sec-websocket-accept",
+    "sec-websocket-protocol",
+    "sec-websocket-extensions",
+    "content-length",
+    "content-type",
+    "transfer-encoding",
+]);
+const completeUpgrade = (record, response) => {
+    const socket = record.socket;
+    const ws = record.ws;
+    if (!ws)
+        return;
+    // close() was called before the handler returned: never write the 101.
+    if (ws.readyState === CLOSED) {
+        try {
+            socket.end();
+        }
+        catch {
+            /* already gone */
+        }
+        return;
+    }
+    let head = "HTTP/1.1 101 Switching Protocols\r\n" +
+        "upgrade: websocket\r\n" +
+        "connection: Upgrade\r\n" +
+        `sec-websocket-accept: ${record.accept}\r\n`;
+    if (record.protocol) {
+        head += `sec-websocket-protocol: ${record.protocol}\r\n`;
+    }
+    try {
+        response.headers.forEach((value, name) => {
+            const lower = name.toLowerCase();
+            if (RESERVED_HANDSHAKE_HEADERS.has(lower))
+                return;
+            head += `${lower}: ${value}\r\n`;
+        });
+    }
+    catch {
+        // A response without usable headers is not a reason to drop the upgrade.
+    }
+    socket.write(`${head}\r\n`);
+    // A live WebSocket is a long-lived idle-tolerant pipe: no inactivity timeout, and
+    // no Nagle delay on small frames. `Duplex` does not declare either method, so
+    // feature-detect (a test double may implement neither).
+    try {
+        const tunable = socket;
+        tunable.setTimeout?.(0);
+        tunable.setNoDelay?.(true);
+    }
+    catch {
+        /* not a real socket */
+    }
+    ws.openWithHead(record.head);
+};
+// -- Reject / relay helpers --------------------------------------------------
+const STATUS_TEXT = {
+    200: "OK",
+    400: "Bad Request",
+    401: "Unauthorized",
+    403: "Forbidden",
+    404: "Not Found",
+    405: "Method Not Allowed",
+    409: "Conflict",
+    426: "Upgrade Required",
+    429: "Too Many Requests",
+    500: "Internal Server Error",
+    501: "Not Implemented",
+    502: "Bad Gateway",
+    503: "Service Unavailable",
+};
+/**
+ * Answer an upgrade with a plain HTTP response and close. Node gives us a raw socket
+ * for `'upgrade'` (no ServerResponse), so the bytes are written by hand. Always ends
+ * the socket: an unanswered upgrade socket leaks and leaves the client hanging.
+ */
+export const writeUpgradeRejection = (socket, status, reason, extraHeaders = {}) => {
+    const body = `${reason}\n`;
+    let head = `HTTP/1.1 ${status} ${STATUS_TEXT[status] ?? "Error"}\r\n` +
+        "connection: close\r\n" +
+        "content-type: text/plain\r\n" +
+        `content-length: ${Buffer.byteLength(body)}\r\n`;
+    for (const [name, value] of Object.entries(extraHeaders)) {
+        head += `${name.toLowerCase()}: ${value}\r\n`;
+    }
+    try {
+        socket.end(`${head}\r\n${body}`);
+    }
+    catch {
+        try {
+            socket.destroy();
+        }
+        catch {
+            /* already destroyed */
+        }
+    }
+};
+/** Headers the raw writer owns; a handler value must not contradict them. */
+const RESERVED_RESPONSE_HEADERS = new Set([
+    "connection",
+    "content-length",
+    "transfer-encoding",
+    "keep-alive",
+    "upgrade",
+]);
+/**
+ * Write a `Response` the handler returned to decline the upgrade, verbatim: status,
+ * headers and body. Declining a handshake with a 401/403/404 is how a function refuses
+ * a connection, so the response has to reach the client instead of being replaced.
+ */
+const writeResponseToSocket = async (socket, response) => {
+    const body = Buffer.from(await response.arrayBuffer());
+    const statusText = response.statusText || (STATUS_TEXT[response.status] ?? "");
+    let head = `HTTP/1.1 ${response.status} ${statusText}\r\n`;
+    response.headers.forEach((value, name) => {
+        if (RESERVED_RESPONSE_HEADERS.has(name.toLowerCase()))
+            return;
+        head += `${name.toLowerCase()}: ${value}\r\n`;
+    });
+    head += "connection: close\r\n";
+    head += `content-length: ${body.length}\r\n\r\n`;
+    socket.end(Buffer.concat([Buffer.from(head, "latin1"), body]));
+};
+/** RFC 6455 §4.1: a 16-byte nonce, base64-encoded. */
+const isValidWebSocketKey = (key) => /^[A-Za-z0-9+/]{22}==$/.test(key) &&
+    Buffer.from(key, "base64").length === 16;
+/**
+ * Check the parts of the handshake the server owns before any user code runs, so a
+ * malformed client request is answered as the client error it is rather than
+ * surfacing later as a throw from `upgradeWebSocket()` (which the listener cannot
+ * tell apart from a genuine handler bug, and would report as a 502).
+ */
+export const validateHandshake = (req) => {
+    const method = (req.method ?? "GET").toUpperCase();
+    if (method !== "GET") {
+        return {
+            status: 405,
+            reason: `a WebSocket handshake must use GET, got ${method}`,
+        };
+    }
+    const version = headerValue(req, "sec-websocket-version");
+    if (version !== "13") {
+        return {
+            status: 426,
+            reason: `unsupported Sec-WebSocket-Version ${version === "" ? "(absent)" : version}; only version 13 is supported`,
+            // §4.4 requires advertising what the server does support.
+            headers: { "sec-websocket-version": "13" },
+        };
+    }
+    if (!isValidWebSocketKey(headerValue(req, "sec-websocket-key"))) {
+        return {
+            status: 400,
+            reason: "Sec-WebSocket-Key must be a base64-encoded 16-byte value",
+        };
+    }
+    return null;
+};
+/**
+ * Build the `'upgrade'` listener for the dev server.
+ *
+ * Precedence matches the deployed runtime exactly: a legacy `upgrade` export wins
+ * unconditionally, and only in its absence is the upgrade routed through `fetch` so
+ * `upgradeWebSocket()` can claim it. A function that does neither gets a clean 501
+ * rather than the misleading 200 Node produces with no listener at all.
+ */
+export const createUpgradeListener = ({ fetch: fetchHandler, upgrade, log = (message) => process.stderr.write(`${message}\n`), }) => {
+    return (req, socket, head) => {
+        void handleUpgrade(req, socket, head, {
+            fetch: fetchHandler,
+            upgrade,
+            log,
+        }).catch((err) => {
+            const message = err instanceof Error ? (err.stack ?? err.message) : String(err);
+            log(`WebSocket upgrade failed:\n${message}`);
+            try {
+                writeUpgradeRejection(socket, 500, "upgrade error");
+            }
+            catch {
+                /* socket already gone */
+            }
+        });
+    };
+};
+const handleUpgrade = async (req, socket, head, { fetch: fetchHandler, upgrade, log, }) => {
+    // A non-WebSocket upgrade (h2c, or something bespoke) is not ours to answer.
+    if (!isWebSocketHandshake(req) && !upgrade) {
+        writeUpgradeRejection(socket, 426, "expected a websocket upgrade");
+        return;
+    }
+    // The launched contract wins, so local precedence matches deployed precedence.
+    // It owns its own handshake, so it is handed the request unvalidated.
+    if (upgrade) {
+        await upgrade(req, socket, head);
+        return;
+    }
+    const rejection = validateHandshake(req);
+    if (rejection) {
+        writeUpgradeRejection(socket, rejection.status, rejection.reason, rejection.headers ?? {});
+        return;
+    }
+    const request = toWebRequest(req);
+    const record = registerUpgrade(request, { req, socket, head });
+    let response;
+    try {
+        response = await upgradeStore.run(record, () => fetchHandler(request));
+    }
+    catch (err) {
+        const message = err instanceof Error ? (err.stack ?? err.message) : String(err);
+        log(`Request handler threw an error while upgrading:\n${message}`);
+        abortClaimedUpgrade(record);
+        writeUpgradeRejection(socket, 502, "handler error");
+        return;
+    }
+    if (readUpgradeRecord(response) === record) {
+        completeUpgrade(record, response);
+        return;
+    }
+    if (record.claimed) {
+        // upgradeWebSocket() ran, but its response never made it back intact.
+        log("websocket_upgrade_response_lost: upgradeWebSocket() was called for this " +
+            "request but the response returned from the handler is not the one it " +
+            "produced. `Response.clone()` and rebuilding a response " +
+            "(`new Response(res.body, res)`, as response-rewriting middleware does) " +
+            "both discard the upgrade. Return the `response` from upgradeWebSocket() " +
+            "unchanged.");
+        abortClaimedUpgrade(record);
+        writeUpgradeRejection(socket, 500, "websocket_upgrade_response_lost");
+        return;
+    }
+    // The handler declined the upgrade and answered with an ordinary response.
+    // Relay it verbatim: returning a 401/403/404 is how a function refuses a
+    // handshake, and replacing it with a status of our own would throw away the
+    // only answer the client was given.
+    await writeResponseToSocket(socket, response);
+};
+/**
+ * The handler claimed the connection but we cannot honour it. Move the socket object
+ * to CLOSED so a customer holding it sees a close event instead of one stuck at
+ * CONNECTING — without touching the underlying socket, which still needs to carry an
+ * HTTP error response.
+ */
+const abortClaimedUpgrade = (record) => {
+    try {
+        record.ws?.abort(1011, "upgrade failed");
+    }
+    catch {
+        /* best effort */
+    }
+};
+/**
+ * Build a Web `Request` from the Node upgrade. A handshake is a GET with no body, so
+ * there is nothing to stream — which is just as well, since the socket has already been
+ * detached from the HTTP parser.
+ */
+const toWebRequest = (req) => {
+    const host = headerValue(req, "host") || "localhost";
+    const target = typeof req.url === "string" && req.url.startsWith("/") ? req.url : "/";
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(req.headers)) {
+        // HTTP/2 pseudo-headers are not valid Header names.
+        if (name.startsWith(":"))
+            continue;
+        if (Array.isArray(value)) {
+            for (const entry of value)
+                headers.append(name, entry);
+        }
+        else if (value != null) {
+            headers.set(name, value);
+        }
+    }
+    return new Request(`http://${host}${target}`, {
+        method: req.method ?? "GET",
+        headers,
+    });
+};
+/**
+ * A WHATWG `WebSocket` over an already-upgraded Node socket.
+ *
+ * Two deliberate divergences from a browser, both matching the deployed runtime:
+ * `binaryType` defaults to `"arraybuffer"` rather than `"blob"`, and `bufferedAmount`
+ * is what we have written and not yet seen flushed, which approximates rather than
+ * matches a browser's accounting.
+ */
+class DevServerWebSocket extends EventTarget {
+    constructor({ socket, url, protocol, }) {
+        super();
+        _DevServerWebSocket_instances.add(this);
+        _DevServerWebSocket_socket.set(this, void 0);
+        _DevServerWebSocket_protocol.set(this, void 0);
+        _DevServerWebSocket_readyState.set(this, CONNECTING);
+        _DevServerWebSocket_binaryType.set(this, "arraybuffer");
+        _DevServerWebSocket_bufferedAmount.set(this, 0);
+        _DevServerWebSocket_chunks.set(this, []);
+        _DevServerWebSocket_queued.set(this, 0);
+        _DevServerWebSocket_fragmentOpcode.set(this, 0);
+        _DevServerWebSocket_fragments.set(this, []);
+        _DevServerWebSocket_fragmentBytes.set(this, 0);
+        _DevServerWebSocket_closeSent.set(this, false);
+        _DevServerWebSocket_closeTimer.set(this, null);
+        _DevServerWebSocket_handlers.set(this, {
+            open: null,
+            message: null,
+            close: null,
+            error: null,
+        });
+        __classPrivateFieldSet(this, _DevServerWebSocket_socket, socket, "f");
+        this.url = url;
+        __classPrivateFieldSet(this, _DevServerWebSocket_protocol, protocol, "f");
+    }
+    get CONNECTING() {
+        return CONNECTING;
+    }
+    get OPEN() {
+        return OPEN;
+    }
+    get CLOSING() {
+        return CLOSING;
+    }
+    get CLOSED() {
+        return CLOSED;
+    }
+    get protocol() {
+        return __classPrivateFieldGet(this, _DevServerWebSocket_protocol, "f");
+    }
+    get extensions() {
+        return "";
+    }
+    get readyState() {
+        return __classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f");
+    }
+    get bufferedAmount() {
+        return __classPrivateFieldGet(this, _DevServerWebSocket_bufferedAmount, "f");
+    }
+    get binaryType() {
+        return __classPrivateFieldGet(this, _DevServerWebSocket_binaryType, "f");
+    }
+    set binaryType(value) {
+        if (value !== "arraybuffer" && value !== "blob") {
+            throw new DOMException(`binaryType must be "arraybuffer" or "blob", got "${String(value)}"`, "SyntaxError");
+        }
+        __classPrivateFieldSet(this, _DevServerWebSocket_binaryType, value, "f");
+    }
+    get onopen() {
+        return __classPrivateFieldGet(this, _DevServerWebSocket_handlers, "f").open;
+    }
+    set onopen(fn) {
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_setHandler).call(this, "open", fn);
+    }
+    get onmessage() {
+        return __classPrivateFieldGet(this, _DevServerWebSocket_handlers, "f").message;
+    }
+    set onmessage(fn) {
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_setHandler).call(this, "message", fn);
+    }
+    get onclose() {
+        return __classPrivateFieldGet(this, _DevServerWebSocket_handlers, "f").close;
+    }
+    set onclose(fn) {
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_setHandler).call(this, "close", fn);
+    }
+    get onerror() {
+        return __classPrivateFieldGet(this, _DevServerWebSocket_handlers, "f").error;
+    }
+    set onerror(fn) {
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_setHandler).call(this, "error", fn);
+    }
+    send(data) {
+        if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") === CONNECTING) {
+            throw new DOMException("cannot send() while the WebSocket is still CONNECTING; wait for the " +
+                "open event (the socket opens once the handler returns the upgrade response)", "InvalidStateError");
+        }
+        // Per spec, sending on a closing/closed socket is counted and discarded.
+        if (typeof data === "string") {
+            const payload = Buffer.from(data, "utf8");
+            if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") !== OPEN) {
+                __classPrivateFieldSet(this, _DevServerWebSocket_bufferedAmount, __classPrivateFieldGet(this, _DevServerWebSocket_bufferedAmount, "f") + payload.length, "f");
+                return;
+            }
+            __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_writeFrame).call(this, OP_TEXT, payload);
+            return;
+        }
+        if (data instanceof Blob) {
+            // Blobs read asynchronously; chain on the read so ordering holds.
+            const size = data.size;
+            __classPrivateFieldSet(this, _DevServerWebSocket_bufferedAmount, __classPrivateFieldGet(this, _DevServerWebSocket_bufferedAmount, "f") + size, "f");
+            data.arrayBuffer()
+                .then((buf) => {
+                __classPrivateFieldSet(this, _DevServerWebSocket_bufferedAmount, __classPrivateFieldGet(this, _DevServerWebSocket_bufferedAmount, "f") - size, "f");
+                if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") === OPEN) {
+                    __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_writeFrame).call(this, OP_BINARY, Buffer.from(buf));
+                }
+            })
+                .catch(() => {
+                __classPrivateFieldSet(this, _DevServerWebSocket_bufferedAmount, __classPrivateFieldGet(this, _DevServerWebSocket_bufferedAmount, "f") - size, "f");
+            });
+            return;
+        }
+        const payload = toBuffer(data);
+        if (payload === null) {
+            throw new TypeError("send() accepts a string, ArrayBuffer, TypedArray, DataView, or Blob");
+        }
+        if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") !== OPEN) {
+            __classPrivateFieldSet(this, _DevServerWebSocket_bufferedAmount, __classPrivateFieldGet(this, _DevServerWebSocket_bufferedAmount, "f") + payload.length, "f");
+            return;
+        }
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_writeFrame).call(this, OP_BINARY, payload);
+    }
+    close(code, reason) {
+        if (code !== undefined && !isValidCloseCode(code)) {
+            throw new DOMException(`close code ${code} is not allowed; use 1000 or a code in 3000-4999`, "InvalidAccessError");
+        }
+        let reasonBuf = EMPTY;
+        if (reason !== undefined && reason !== null) {
+            reasonBuf = Buffer.from(String(reason), "utf8");
+            if (reasonBuf.length > MAX_CLOSE_REASON_BYTES) {
+                throw new DOMException(`close reason must be at most ${MAX_CLOSE_REASON_BYTES} bytes of UTF-8`, "SyntaxError");
+            }
+        }
+        if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") === CLOSING || __classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") === CLOSED)
+            return;
+        if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") === CONNECTING) {
+            // Nothing to close yet — the handshake has not been written.
+            this.abort(code ?? 1000, reasonBuf.toString("utf8"));
+            return;
+        }
+        __classPrivateFieldSet(this, _DevServerWebSocket_readyState, CLOSING, "f");
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_sendClose).call(this, code ?? 1000, reasonBuf);
+        __classPrivateFieldSet(this, _DevServerWebSocket_closeTimer, setTimeout(() => {
+            // The peer never answered, so no close frame was received: §7.1.5 makes
+            // that 1006, not the code we sent.
+            __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_finishClose).call(this, 1006, "", false);
+        }, CLOSE_HANDSHAKE_TIMEOUT_MS), "f");
+        __classPrivateFieldGet(this, _DevServerWebSocket_closeTimer, "f").unref?.();
+    }
+    // -- dev-server internal ---------------------------------------------
+    /** Called once the 101 is on the wire. */
+    openWithHead(head) {
+        if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") !== CONNECTING)
+            return;
+        const socket = __classPrivateFieldGet(this, _DevServerWebSocket_socket, "f");
+        socket.on("data", (chunk) => __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_onData).call(this, chunk));
+        socket.on("error", (err) => {
+            __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_emitError).call(this, err);
+            __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_finishClose).call(this, 1006, "", false);
+        });
+        socket.on("close", () => __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_finishClose).call(this, 1006, "", false));
+        socket.on("end", () => __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_finishClose).call(this, 1006, "", false));
+        __classPrivateFieldSet(this, _DevServerWebSocket_readyState, OPEN, "f");
+        this.dispatchEvent(new Event("open"));
+        if (head.length)
+            __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_onData).call(this, head);
+    }
+    /**
+     * Give up before the handshake was written. Fires `close` so a caller holding the
+     * socket is not left with something stuck at CONNECTING, but deliberately does not
+     * touch the underlying socket: an HTTP error response still has to go out on it.
+     */
+    abort(code = 1006, reason = "") {
+        if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") === CLOSED)
+            return;
+        __classPrivateFieldSet(this, _DevServerWebSocket_readyState, CLOSED, "f");
+        if (__classPrivateFieldGet(this, _DevServerWebSocket_closeTimer, "f")) {
+            clearTimeout(__classPrivateFieldGet(this, _DevServerWebSocket_closeTimer, "f"));
+            __classPrivateFieldSet(this, _DevServerWebSocket_closeTimer, null, "f");
+        }
+        this.dispatchEvent(new CloseEventCtor("close", { code, reason, wasClean: false }));
+    }
+}
+_DevServerWebSocket_socket = new WeakMap(), _DevServerWebSocket_protocol = new WeakMap(), _DevServerWebSocket_readyState = new WeakMap(), _DevServerWebSocket_binaryType = new WeakMap(), _DevServerWebSocket_bufferedAmount = new WeakMap(), _DevServerWebSocket_chunks = new WeakMap(), _DevServerWebSocket_queued = new WeakMap(), _DevServerWebSocket_fragmentOpcode = new WeakMap(), _DevServerWebSocket_fragments = new WeakMap(), _DevServerWebSocket_fragmentBytes = new WeakMap(), _DevServerWebSocket_closeSent = new WeakMap(), _DevServerWebSocket_closeTimer = new WeakMap(), _DevServerWebSocket_handlers = new WeakMap(), _DevServerWebSocket_instances = new WeakSet(), _DevServerWebSocket_setHandler = function _DevServerWebSocket_setHandler(type, fn) {
+    const previous = __classPrivateFieldGet(this, _DevServerWebSocket_handlers, "f")[type];
+    if (previous)
+        this.removeEventListener(type, previous);
+    __classPrivateFieldGet(this, _DevServerWebSocket_handlers, "f")[type] = typeof fn === "function" ? fn : null;
+    const next = __classPrivateFieldGet(this, _DevServerWebSocket_handlers, "f")[type];
+    if (next)
+        this.addEventListener(type, next);
+}, _DevServerWebSocket_onData = function _DevServerWebSocket_onData(chunk) {
+    if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") === CLOSED)
+        return;
+    __classPrivateFieldGet(this, _DevServerWebSocket_chunks, "f").push(chunk);
+    __classPrivateFieldSet(this, _DevServerWebSocket_queued, __classPrivateFieldGet(this, _DevServerWebSocket_queued, "f") + chunk.length, "f");
+    try {
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_parse).call(this);
+    }
+    catch (err) {
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_emitError).call(this, err);
+        const code = err.wsCode ?? 1002;
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_fail).call(this, code, err instanceof Error ? err.message : String(err));
+    }
+}, _DevServerWebSocket_parse = function _DevServerWebSocket_parse() {
+    for (;;) {
+        if (__classPrivateFieldGet(this, _DevServerWebSocket_queued, "f") < 2)
+            return;
+        const b0 = __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_peek).call(this, 0);
+        const b1 = __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_peek).call(this, 1);
+        const fin = (b0 & 0x80) !== 0;
+        const rsv = b0 & 0x70;
+        const opcode = b0 & 0x0f;
+        const masked = (b1 & 0x80) !== 0;
+        let length = b1 & 0x7f;
+        let headerLen = 2;
+        if (length === 126) {
+            if (__classPrivateFieldGet(this, _DevServerWebSocket_queued, "f") < 4)
+                return;
+            length = (__classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_peek).call(this, 2) << 8) | __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_peek).call(this, 3);
+            headerLen = 4;
+        }
+        else if (length === 127) {
+            if (__classPrivateFieldGet(this, _DevServerWebSocket_queued, "f") < 10)
+                return;
+            let big = 0n;
+            for (let i = 0; i < 8; i++)
+                big = (big << 8n) | BigInt(__classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_peek).call(this, 2 + i));
+            if (big > BigInt(MAX_MESSAGE_BYTES)) {
+                throw protocolError(1009, "frame too large");
+            }
+            length = Number(big);
+            headerLen = 10;
+        }
+        if (masked)
+            headerLen += 4;
+        if (__classPrivateFieldGet(this, _DevServerWebSocket_queued, "f") < headerLen + length)
+            return;
+        // Validate before consuming, so a rejected frame cannot desync the parser.
+        if (rsv !== 0) {
+            throw protocolError(1002, "reserved bits must be clear (no extensions were negotiated)");
+        }
+        if (!masked)
+            throw protocolError(1002, "client frames must be masked");
+        const isControl = (opcode & 0x08) !== 0;
+        if (isControl) {
+            if (!fin) {
+                throw protocolError(1002, "control frames must not be fragmented");
+            }
+            if (length > MAX_CONTROL_PAYLOAD) {
+                throw protocolError(1002, "control frame payload exceeds 125 bytes");
+            }
+        }
+        if (opcode !== OP_CONTINUATION &&
+            opcode !== OP_TEXT &&
+            opcode !== OP_BINARY &&
+            opcode !== OP_CLOSE &&
+            opcode !== OP_PING &&
+            opcode !== OP_PONG) {
+            throw protocolError(1002, `reserved opcode 0x${opcode.toString(16)}`);
+        }
+        const header = __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_take).call(this, headerLen);
+        const payload = __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_take).call(this, length);
+        if (masked) {
+            const mask = header.subarray(headerLen - 4, headerLen);
+            for (let i = 0; i < payload.length; i++) {
+                payload[i] =
+                    payload[i] ^ mask[i & 3];
+            }
+        }
+        if (isControl) {
+            __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_handleControl).call(this, opcode, payload);
+            if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") === CLOSED)
+                return;
+            continue;
+        }
+        if (opcode === OP_CONTINUATION) {
+            if (__classPrivateFieldGet(this, _DevServerWebSocket_fragmentOpcode, "f") === 0) {
+                throw protocolError(1002, "continuation frame without a start frame");
+            }
+            __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_pushFragment).call(this, payload);
+        }
+        else {
+            if (__classPrivateFieldGet(this, _DevServerWebSocket_fragmentOpcode, "f") !== 0) {
+                throw protocolError(1002, "new data frame while a fragmented message was open");
+            }
+            if (!fin) {
+                __classPrivateFieldSet(this, _DevServerWebSocket_fragmentOpcode, opcode, "f");
+                __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_pushFragment).call(this, payload);
+                continue;
+            }
+            __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_deliver).call(this, opcode, payload);
+            continue;
+        }
+        if (fin) {
+            const messageOpcode = __classPrivateFieldGet(this, _DevServerWebSocket_fragmentOpcode, "f");
+            const full = __classPrivateFieldGet(this, _DevServerWebSocket_fragments, "f").length === 1
+                ? __classPrivateFieldGet(this, _DevServerWebSocket_fragments, "f")[0]
+                : Buffer.concat(__classPrivateFieldGet(this, _DevServerWebSocket_fragments, "f"));
+            __classPrivateFieldSet(this, _DevServerWebSocket_fragmentOpcode, 0, "f");
+            __classPrivateFieldSet(this, _DevServerWebSocket_fragments, [], "f");
+            __classPrivateFieldSet(this, _DevServerWebSocket_fragmentBytes, 0, "f");
+            __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_deliver).call(this, messageOpcode, full);
+        }
+    }
+}, _DevServerWebSocket_pushFragment = function _DevServerWebSocket_pushFragment(payload) {
+    __classPrivateFieldSet(this, _DevServerWebSocket_fragmentBytes, __classPrivateFieldGet(this, _DevServerWebSocket_fragmentBytes, "f") + payload.length, "f");
+    if (__classPrivateFieldGet(this, _DevServerWebSocket_fragmentBytes, "f") > MAX_MESSAGE_BYTES) {
+        throw protocolError(1009, `message exceeds the ${MAX_MESSAGE_BYTES} byte limit`);
+    }
+    // An empty continuation frame is legal and contributes nothing to the
+    // message. Dropping it here keeps a flood of them from growing the fragment
+    // list without ever moving `#fragmentBytes` toward the limit above.
+    if (payload.length === 0)
+        return;
+    __classPrivateFieldGet(this, _DevServerWebSocket_fragments, "f").push(payload);
+}, _DevServerWebSocket_deliver = function _DevServerWebSocket_deliver(opcode, payload) {
+    if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") !== OPEN)
+        return;
+    let data;
+    if (opcode === OP_TEXT) {
+        try {
+            data = new TextDecoder("utf-8", { fatal: true }).decode(payload);
+        }
+        catch {
+            throw protocolError(1007, "text frame is not valid UTF-8");
+        }
+    }
+    else if (__classPrivateFieldGet(this, _DevServerWebSocket_binaryType, "f") === "blob") {
+        // Copy into a plain Uint8Array: a Node Buffer is not a valid BlobPart.
+        data = new Blob([new Uint8Array(payload)]);
+    }
+    else {
+        // A fresh ArrayBuffer, not a view onto our read buffer.
+        data = payload.buffer.slice(payload.byteOffset, payload.byteOffset + payload.byteLength);
+    }
+    this.dispatchEvent(new MessageEvent("message", { data, origin: this.url }));
+}, _DevServerWebSocket_handleControl = function _DevServerWebSocket_handleControl(opcode, payload) {
+    if (opcode === OP_PING) {
+        if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") === OPEN)
+            __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_writeFrame).call(this, OP_PONG, payload);
+        return;
+    }
+    if (opcode === OP_PONG)
+        return;
+    let code = 1005;
+    let reason = "";
+    if (payload.length === 1) {
+        throw protocolError(1002, "close frame payload must be empty or at least 2 bytes");
+    }
+    if (payload.length >= 2) {
+        code = (payload[0] << 8) | payload[1];
+        if (!isEchoableCloseCode(code)) {
+            throw protocolError(1002, `invalid close code ${code}`);
+        }
+        try {
+            reason = new TextDecoder("utf-8", { fatal: true }).decode(payload.subarray(2));
+        }
+        catch {
+            throw protocolError(1007, "close reason is not valid UTF-8");
+        }
+    }
+    if (!__classPrivateFieldGet(this, _DevServerWebSocket_closeSent, "f")) {
+        // Mirror the peer's code (§5.5.1). 1005 must never go on the wire.
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_sendClose).call(this, code === 1005 ? 1000 : code, EMPTY);
+    }
+    __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_finishClose).call(this, code, reason, true);
+}, _DevServerWebSocket_sendClose = function _DevServerWebSocket_sendClose(code, reasonBuf) {
+    if (__classPrivateFieldGet(this, _DevServerWebSocket_closeSent, "f"))
+        return;
+    __classPrivateFieldSet(this, _DevServerWebSocket_closeSent, true, "f");
+    const payload = Buffer.allocUnsafe(2 + reasonBuf.length);
+    payload.writeUInt16BE(code, 0);
+    if (reasonBuf.length)
+        reasonBuf.copy(payload, 2);
+    __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_writeFrame).call(this, OP_CLOSE, payload);
+}, _DevServerWebSocket_fail = function _DevServerWebSocket_fail(code, reason) {
+    if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") === OPEN) {
+        const reasonBuf = Buffer.from(reason.slice(0, MAX_CLOSE_REASON_BYTES), "utf8");
+        try {
+            __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_sendClose).call(this, code, reasonBuf);
+        }
+        catch {
+            /* socket already gone */
+        }
+    }
+    __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_finishClose).call(this, code, reason, false);
+}, _DevServerWebSocket_finishClose = function _DevServerWebSocket_finishClose(code, reason, wasClean) {
+    if (__classPrivateFieldGet(this, _DevServerWebSocket_readyState, "f") === CLOSED)
+        return;
+    __classPrivateFieldSet(this, _DevServerWebSocket_readyState, CLOSED, "f");
+    if (__classPrivateFieldGet(this, _DevServerWebSocket_closeTimer, "f")) {
+        clearTimeout(__classPrivateFieldGet(this, _DevServerWebSocket_closeTimer, "f"));
+        __classPrivateFieldSet(this, _DevServerWebSocket_closeTimer, null, "f");
+    }
+    __classPrivateFieldSet(this, _DevServerWebSocket_chunks, [], "f");
+    __classPrivateFieldSet(this, _DevServerWebSocket_queued, 0, "f");
+    __classPrivateFieldSet(this, _DevServerWebSocket_fragments, [], "f");
+    __classPrivateFieldSet(this, _DevServerWebSocket_fragmentBytes, 0, "f");
+    try {
+        __classPrivateFieldGet(this, _DevServerWebSocket_socket, "f").end();
+    }
+    catch {
+        try {
+            __classPrivateFieldGet(this, _DevServerWebSocket_socket, "f").destroy();
+        }
+        catch {
+            /* already gone */
+        }
+    }
+    this.dispatchEvent(new CloseEventCtor("close", { code, reason, wasClean }));
+}, _DevServerWebSocket_emitError = function _DevServerWebSocket_emitError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    this.dispatchEvent(new ErrorEventCtor("error", { message, error: err }));
+}, _DevServerWebSocket_writeFrame = function _DevServerWebSocket_writeFrame(opcode, payload) {
+    const frame = encodeFrame(opcode, payload);
+    __classPrivateFieldSet(this, _DevServerWebSocket_bufferedAmount, __classPrivateFieldGet(this, _DevServerWebSocket_bufferedAmount, "f") + frame.length, "f");
+    try {
+        __classPrivateFieldGet(this, _DevServerWebSocket_socket, "f").write(frame, () => {
+            __classPrivateFieldSet(this, _DevServerWebSocket_bufferedAmount, __classPrivateFieldGet(this, _DevServerWebSocket_bufferedAmount, "f") - frame.length, "f");
+            if (__classPrivateFieldGet(this, _DevServerWebSocket_bufferedAmount, "f") < 0)
+                __classPrivateFieldSet(this, _DevServerWebSocket_bufferedAmount, 0, "f");
+        });
+    }
+    catch (err) {
+        __classPrivateFieldSet(this, _DevServerWebSocket_bufferedAmount, __classPrivateFieldGet(this, _DevServerWebSocket_bufferedAmount, "f") - frame.length, "f");
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_emitError).call(this, err);
+        __classPrivateFieldGet(this, _DevServerWebSocket_instances, "m", _DevServerWebSocket_finishClose).call(this, 1006, "", false);
+    }
+}, _DevServerWebSocket_peek = function _DevServerWebSocket_peek(index) {
+    let remaining = index;
+    for (const chunk of __classPrivateFieldGet(this, _DevServerWebSocket_chunks, "f")) {
+        if (remaining < chunk.length)
+            return chunk[remaining];
+        remaining -= chunk.length;
+    }
+    return 0;
+}, _DevServerWebSocket_take = function _DevServerWebSocket_take(n) {
+    if (n === 0)
+        return EMPTY;
+    __classPrivateFieldSet(this, _DevServerWebSocket_queued, __classPrivateFieldGet(this, _DevServerWebSocket_queued, "f") - n, "f");
+    const first = __classPrivateFieldGet(this, _DevServerWebSocket_chunks, "f")[0];
+    if (first.length === n)
+        return __classPrivateFieldGet(this, _DevServerWebSocket_chunks, "f").shift();
+    if (first.length > n) {
+        __classPrivateFieldGet(this, _DevServerWebSocket_chunks, "f")[0] = first.subarray(n);
+        // Copy: the caller unmasks in place and the remainder is still queued.
+        return Buffer.from(first.subarray(0, n));
+    }
+    const out = Buffer.allocUnsafe(n);
+    let offset = 0;
+    while (offset < n) {
+        const chunk = __classPrivateFieldGet(this, _DevServerWebSocket_chunks, "f")[0];
+        const take = Math.min(chunk.length, n - offset);
+        chunk.copy(out, offset, 0, take);
+        offset += take;
+        if (take === chunk.length)
+            __classPrivateFieldGet(this, _DevServerWebSocket_chunks, "f").shift();
+        else
+            __classPrivateFieldGet(this, _DevServerWebSocket_chunks, "f")[0] = chunk.subarray(take);
+    }
+    return out;
+};
+DevServerWebSocket.CONNECTING = CONNECTING;
+DevServerWebSocket.OPEN = OPEN;
+DevServerWebSocket.CLOSING = CLOSING;
+DevServerWebSocket.CLOSED = CLOSED;
+const encodeFrame = (opcode, payload) => {
+    const len = payload.length;
+    let header;
+    if (len < 126) {
+        header = Buffer.allocUnsafe(2);
+        header[1] = len;
+    }
+    else if (len < 65536) {
+        header = Buffer.allocUnsafe(4);
+        header[1] = 126;
+        header.writeUInt16BE(len, 2);
+    }
+    else {
+        header = Buffer.allocUnsafe(10);
+        header[1] = 127;
+        header.writeBigUInt64BE(BigInt(len), 2);
+    }
+    header[0] = 0x80 | opcode;
+    return Buffer.concat([header, payload]);
+};
+const toBuffer = (data) => {
+    if (data instanceof ArrayBuffer)
+        return Buffer.from(new Uint8Array(data));
+    if (ArrayBuffer.isView(data)) {
+        return Buffer.from(new Uint8Array(data.buffer, data.byteOffset, data.byteLength));
+    }
+    return null;
+};
+/** Codes a server may send (§7.4): 1000, or the private 3000-4999 range. */
+const isValidCloseCode = (code) => code === 1000 || (Number.isInteger(code) && code >= 3000 && code <= 4999);
+/** Codes that may legally appear in a close frame we receive — wider than the above. */
+const isEchoableCloseCode = (code) => {
+    if (!Number.isInteger(code))
+        return false;
+    if (code >= 3000 && code <= 4999)
+        return true;
+    return (code >= 1000 &&
+        code <= 1014 &&
+        code !== 1004 &&
+        code !== 1005 &&
+        code !== 1006);
+};
+const protocolError = (code, message) => {
+    const err = new Error(message);
+    err.wsCode = code;
+    return err;
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neon",
-  "version": "2.44.0",
+  "version": "2.45.0",
   "description": "CLI tool for Neon, the cloud backend primitives built around Lakebase Postgres",
   "keywords": [
     "neon",
@@ -55,11 +55,11 @@
     "which": "3.0.1",
     "yaml": "^2.9.0",
     "yargs": "17.7.2",
-    "@neon/config-runtime": "0.12.4",
-    "@neon/env": "0.14.0",
     "@neon/sdk": "1.5.0",
+    "@neon/config": "0.14.0",
+    "@neon/config-runtime": "0.12.4",
     "neon-init": "0.20.7",
-    "@neon/config": "0.14.0"
+    "@neon/env": "0.14.0"
   },
   "optionalDependencies": {
     "esbuild": "0.28.1"