permdock 0.0.0 → 0.1.0

package/dist/hono/index.d.ts

@@ -0,0 +1,70 @@
+import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
+import { d as Permission } from "../permissions-B4apnahQ.js";
+import { f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
+import { o as OtelWrap } from "../types-B9dmiiab.js";
+import { r as PdpFactory } from "../types-BvBk1wgn.js";
+import { S as ConnectionOptions, b as Connection, g as discoverViaSignatureAgent, h as WebBotAuthVerifier, n as OpenApiHooks, o as TenantOption, r as ProtectOptions, u as InvalidSignatureError, y as verifyWebBotAuth } from "../create-BKF3dgFk.js";
+import { Context, Hono, MiddlewareHandler } from "hono";
+import { SSEMessage, SSEStreamingApi } from "hono/streaming";
+import { WSEvents } from "hono/ws";
+//#region src/hono/create.d.ts
+type HonoPermDockOptions<TUser = unknown> = {
+  readonly subject: (c: Context) => TUser | Promise<TUser>;
+  readonly tenant?: TenantOption<Context>;
+  readonly memberships?: MembershipSource | readonly MembershipSource[];
+  /** The object graph for relation grants that walk a parent chain; without it they deny. */
+  readonly relations?: RelationSource;
+  readonly entitlements?: EntitlementSource;
+  readonly customRoles?: RoleSource;
+  /** Hosted grants, read once per instance; see `PolicySource`. */
+  readonly policies?: PolicySource;
+  readonly store?: ApprovalStore;
+  readonly sink?: DecisionSink;
+  readonly limits?: LimitStore;
+  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
+  readonly pdp?: PdpFactory;
+  /** Accepted for adapter parity; not read by this adapter. */
+  readonly snapshots?: SnapshotSource;
+  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
+  readonly otel?: OtelWrap;
+  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
+  readonly webBotAuth?: WebBotAuthVerifier;
+  /** Ends or revalidates open sockets and streams. */
+  readonly revocations?: RevocationFeed;
+};
+/** The `Variables` both middlewares set; Hono merges them into the route's Env. */
+type PermDockEnv<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly Variables: {
+    readonly permdock: PermDock<V>;
+    readonly permdockData: TData;
+  };
+};
+type HonoPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: () => MiddlewareHandler<PermDockEnv<unknown, V>>;
+  readonly protect: <TData = unknown>(permission: Permission, loadData?: (c: Context) => TData | Promise<TData>, protectOptions?: ProtectOptions) => MiddlewareHandler<PermDockEnv<NonNullable<TData>, V>>;
+  /** A long-lived connection for the request behind `c`. */
+  readonly connection: (c: Context, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  /** `upgradeWebSocket` events that close with `1008` when the connection aborts. */
+  readonly socket: <T = unknown>(connection: Connection, events: WSEvents<T>) => WSEvents<T>;
+  /**
+   * Writes `source` to a `streamSSE` stream, dropping items the subscriber
+   * cannot read, and resolves when it ends: after an `event: permdock` frame
+   * when the connection aborts, when the client disconnects, or when the
+   * source is done. Await it as the last statement of the callback.
+   */
+  readonly sse: <T>(connection: Connection, stream: SSEStreamingApi, source: AsyncIterable<T>, options?: SseOptions<T>) => Promise<void>;
+  readonly permdockHandler: () => Hono;
+  readonly openapi: OpenApiHooks;
+};
+type SseOptions<T> = {
+  /** Items the subscriber cannot read under this permission are dropped. */
+  readonly items?: Permission<string, unknown, "instance">;
+  /** The row to check for an item, when the item wraps it. */
+  readonly unwrap?: (item: T) => unknown;
+  /** The frame for an item; defaults to `{ data: JSON.stringify(item) }`. */
+  readonly format?: (item: T) => SSEMessage;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: HonoPermDockOptions<TUser>): HonoPermDock<V>;
+//#endregion
+export { type HonoPermDock, type HonoPermDockOptions, InvalidSignatureError, type PermDockEnv, type SseOptions, discoverViaSignatureAgent, verifyWebBotAuth };

package/dist/hono/index.js

@@ -0,0 +1,131 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { r as PermDockRevokedError } from "../errors-Iy71s7Oj.js";
+import { i as discoverViaSignatureAgent, o as invalidSignatureResponse, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-DsAU9ppl.js";
+import { r as tenantScope, t as createKernel } from "../create-CSkhDU9T.js";
+import { t as problemFromError } from "../map-error-RJ3ZsUyA.js";
+import { i as onRevoked, n as guardIterable, t as POLICY_VIOLATION } from "../stream-Q_xlB6Ko.js";
+import { Hono } from "hono";
+//#region src/hono/create.ts
+function socket(connection, events) {
+	return {
+		...events,
+		onOpen: (evt, ws) => {
+			onRevoked(connection, (problem) => {
+				ws.close(POLICY_VIOLATION, problem.type);
+			});
+			if (!connection.signal.aborted) events.onOpen?.(evt, ws);
+		},
+		onClose: (evt, ws) => {
+			connection.close();
+			events.onClose?.(evt, ws);
+		}
+	};
+}
+async function sse(connection, stream, source, options = {}) {
+	const disconnected = new Promise((resolve) => {
+		stream.onAbort(() => {
+			connection.close();
+			resolve({
+				done: true,
+				value: void 0
+			});
+		});
+	});
+	const iterator = guardIterable(source, connection, compact({
+		items: options.items,
+		unwrap: options.unwrap,
+		onRevoked: (error) => error
+	}))[Symbol.asyncIterator]();
+	try {
+		for (;;) {
+			const next = await Promise.race([iterator.next(), disconnected]);
+			if (next.done === true || stream.aborted) return;
+			const item = next.value;
+			await stream.writeSSE(options.format?.(item) ?? { data: JSON.stringify(item) });
+		}
+	} catch (error) {
+		if (!(error instanceof PermDockRevokedError)) throw error;
+		if (!stream.aborted) await stream.writeSSE({
+			event: "permdock",
+			data: JSON.stringify(error.toProblemDetails())
+		});
+	} finally {
+		Promise.resolve(iterator.return(void 0)).catch(() => void 0);
+	}
+}
+function mapDownstream(c) {
+	const mapped = c.error === void 0 ? void 0 : problemFromError(c.error);
+	if (mapped !== void 0) {
+		c.res = void 0;
+		c.res = mapped;
+	}
+}
+function createPermDock(policy, options) {
+	const contexts = /* @__PURE__ */ new WeakMap();
+	const kernel = createKernel(policy, compact({
+		subject: (request) => {
+			const c = contexts.get(request);
+			return c === void 0 ? null : options.subject(c);
+		},
+		memberships: options.memberships,
+		relations: options.relations,
+		entitlements: options.entitlements,
+		customRoles: options.customRoles,
+		policies: options.policies,
+		store: options.store,
+		sink: options.sink,
+		limits: options.limits,
+		pdp: options.pdp,
+		webBotAuth: options.webBotAuth,
+		revocations: options.revocations,
+		adapter: "hono",
+		wrap: options.otel
+	}));
+	const bind = (c) => {
+		const raw = c.req.raw;
+		if (!contexts.has(raw)) contexts.set(raw, c);
+		return raw;
+	};
+	const scopeOf = (c) => tenantScope(options.tenant, c);
+	const permdock = () => async (c, next) => {
+		try {
+			c.set("permdock", await kernel.permdock(bind(c), await scopeOf(c)));
+		} catch (error) {
+			const response = invalidSignatureResponse(error);
+			if (response !== void 0) return response;
+			throw error;
+		}
+		await next();
+		mapDownstream(c);
+	};
+	const protect = (permission, loadData, protectOptions) => async (c, next) => {
+		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(c), protectOptions)(bind(c), await scopeOf(c));
+		if (!guard.ok) return guard.response;
+		c.set("permdock", guard.permdock);
+		c.set("permdockData", guard.data);
+		await next();
+		mapDownstream(c);
+	};
+	const connection = async (c, connectionOptions) => kernel.connection(bind(c), connectionOptions, await scopeOf(c));
+	const permdockHandler = () => {
+		const { POST, GET } = kernel.permdockHandler((request) => {
+			const c = contexts.get(request);
+			return c === void 0 ? { tenant: void 0 } : scopeOf(c);
+		});
+		const app = new Hono();
+		app.post("/", (c) => POST(bind(c)));
+		app.get("/", (c) => GET(bind(c)));
+		return app;
+	};
+	return {
+		permdock,
+		protect,
+		connection,
+		socket,
+		sse,
+		permdockHandler,
+		openapi: kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, verifyWebBotAuth };

package/dist/hosted-BwKQ1BTA.js

@@ -0,0 +1,265 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { E as splitPath, S as isForbiddenKey, c as getResource, h as isSelfParented, i as findPermission } from "./permissions-DC7GROPA.js";
+import { c as indexPolicy, d as role, h as normalizeWhere, i as declaredRoleNames, o as deny, r as completeGrant, t as allow } from "./policy-ANp36PnI.js";
+import { C as listPlans, b as findRole, s as flattenGrantee } from "./grantee-Bv04_Vzf.js";
+import { t as parseDuration } from "./duration-xK2jGFVc.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+//#region src/core/hosted.ts
+function memoryPolicySource(document = null) {
+	const current = document === null ? null : parsePolicyDocument(document);
+	return Object.freeze({
+		current: () => current,
+		refresh: () => Promise.resolve()
+	});
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function rejectUnsafe(value) {
+	if (value === null || typeof value !== "object") return;
+	if (Array.isArray(value)) {
+		for (const item of value) rejectUnsafe(item);
+		return;
+	}
+	for (const key of Object.keys(value)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: unsafe policy document key '${key}'`);
+		rejectUnsafe(value[key]);
+	}
+}
+/** Validates the document envelope; per-grant checks happen at merge time. */
+function parsePolicyDocument(json) {
+	const input = typeof json === "string" ? JSON.parse(json) : json;
+	if (!isRecord(input)) throw new TypeError("PermDock: policy document must be an object");
+	const copy = JSON.parse(JSON.stringify(input));
+	rejectUnsafe(copy);
+	if (copy["v"] !== 1) throw new Error(`PermDock: unsupported policy document version '${String(copy["v"])}'`);
+	if (typeof copy["id"] !== "string" || typeof copy["fingerprint"] !== "string" || typeof copy["catalog"] !== "string" || typeof copy["issuedAt"] !== "number" || !Array.isArray(copy["grants"])) throw new TypeError("PermDock: malformed policy document");
+	return freezeDeep(copy);
+}
+const COMPARISONS = /* @__PURE__ */ new Set([
+	"eq",
+	"ne",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"contains"
+]);
+function safePath(path) {
+	if (typeof path !== "string" || path.length === 0) return false;
+	return splitPath(path).every((segment) => !isForbiddenKey(segment));
+}
+function portableValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return true;
+	if (Array.isArray(value)) return value.every(portableValue);
+	if (!isRecord(value)) return false;
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return false;
+	if (keys[0] === "ref") return safePath(value["ref"]);
+	return keys[0] === "date" && typeof value["date"] === "string";
+}
+/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
+function isPortableCondition(value) {
+	if (!isRecord(value) || typeof value["op"] !== "string") return false;
+	const op = value["op"];
+	if (COMPARISONS.has(op)) return safePath(value["field"]) && portableValue(value["value"]);
+	switch (op) {
+		case "in":
+		case "notIn": return safePath(value["field"]) && (Array.isArray(value["value"]) || isRecord(value["value"])) && portableValue(value["value"]);
+		case "isNull": return safePath(value["field"]) && typeof value["value"] === "boolean";
+		case "and":
+		case "or": return Array.isArray(value["conditions"]) && value["conditions"].every(isPortableCondition);
+		case "not": return isPortableCondition(value["condition"]);
+		case "memberOf": return (value["scope"] === "tenant" || value["scope"] === "team" || value["scope"] === "resource") && safePath(value["field"]) && Array.isArray(value["roles"]) && value["roles"].every((item) => typeof item === "string") && (value["resource"] === void 0 || typeof value["resource"] === "string") && (value["parents"] === void 0 || Array.isArray(value["parents"]) && value["parents"].every((parent) => safePath(parent) || isRecord(parent) && safePath(parent["field"]) && typeof parent["resource"] === "string"));
+		default: return false;
+	}
+}
+function approvalRank(approval) {
+	if (approval === void 0) return;
+	if (approval === "human") return {
+		distinct: true,
+		stale: false,
+		quorum: 1,
+		ttl: Number.POSITIVE_INFINITY,
+		escalates: false
+	};
+	return {
+		by: approval.stages === void 0 ? JSON.stringify(approval.by) : JSON.stringify([approval.mode, approval.stages]),
+		distinct: approval.distinct !== false,
+		stale: approval.staleOn === "resource-change",
+		quorum: approval.quorum ?? 1,
+		ttl: parseDuration(approval.ttl) ?? Number.POSITIVE_INFINITY,
+		escalates: approval.escalation !== void 0
+	};
+}
+/** A hosted approval must meet every approval a code allow requires on the permission. */
+function approvalAtLeast(hosted, code) {
+	const mine = approvalRank(hosted);
+	for (const required of code) {
+		const theirs = approvalRank(required);
+		if (theirs === void 0) continue;
+		if (mine === void 0) return false;
+		if (theirs.distinct && !mine.distinct) return false;
+		if (theirs.stale && !mine.stale) return false;
+		if (theirs.by !== void 0 && mine.by !== theirs.by) return false;
+		if (mine.quorum < theirs.quorum || mine.ttl > theirs.ttl) return false;
+		if (mine.escalates && !theirs.escalates) return false;
+	}
+	return true;
+}
+/** A grantee kind this build does not know is never declared, so the hosted grant is dropped. */
+function undeclaredKind(_grantee) {
+	return false;
+}
+function declaredGrantee(policy, grantee, permissionResource) {
+	switch (grantee.kind) {
+		case "role": return declaredRoleNames(policy).has(grantee.role);
+		case "plan": return listPlans(policy.vocabulary.plans).some((leaf) => leaf.key === grantee.plan);
+		case "relation": return grantee.resource === permissionResource && getResource(policy.permissions, grantee.resource)?.relations[grantee.relation] !== void 0 && (grantee.through === void 0 || grantee.through === "parent" && isSelfParented(getResource(policy.permissions, grantee.resource))) && (grantee.depth === void 0 || grantee.through === "parent" && Number.isInteger(grantee.depth) && grantee.depth >= 0 && grantee.depth <= 32);
+		case "anyone":
+		case "authenticated":
+		case "actor":
+		case "assurance": return false;
+		default: return undeclaredKind(grantee);
+	}
+}
+/** Approvers are declared roles, plans or relations, or any authenticated human. */
+function approvalAcceptable(policy, approval, permissionResource) {
+	if (approval === void 0 || approval === "human") return true;
+	if (!isRecord(approval)) return false;
+	if (approval["mode"] !== void 0 || approval["stages"] !== void 0) return false;
+	if (approval["distinct"] !== void 0 && typeof approval["distinct"] !== "boolean") return false;
+	if (approval["staleOn"] !== void 0 && (approval["staleOn"] !== "resource-change" || getResource(policy.permissions, permissionResource)?.version === void 0)) return false;
+	if (approval["quorum"] !== void 0 && (!Number.isInteger(approval["quorum"]) || approval["quorum"] < 1)) return false;
+	if (approval["ttl"] !== void 0 && (typeof approval["ttl"] !== "string" || parseDuration(approval["ttl"]) === void 0)) return false;
+	const escalation = approval["escalation"];
+	if (escalation !== void 0 && (!isRecord(escalation) || typeof escalation["after"] !== "string" || parseDuration(escalation["after"]) === void 0 || !granteesAcceptable(policy, escalation["to"], permissionResource))) return false;
+	if (approval["by"] === void 0) return true;
+	return granteesAcceptable(policy, approval["by"], permissionResource);
+}
+function granteesAcceptable(policy, raw, permissionResource) {
+	if (raw === void 0) return false;
+	const items = flattenGrantee(raw);
+	return items.length > 0 && items.every((item) => isRecord(item) && item.kind !== "relation" && (item.kind === "authenticated" || declaredGrantee(policy, item, permissionResource)));
+}
+function buildGrant(policy, document, raw) {
+	if (!isRecord(raw) || typeof raw["id"] !== "string" || typeof raw["permission"] !== "string" || raw["effect"] !== void 0 && raw["effect"] !== "allow" && raw["effect"] !== "deny" || raw["to"] === void 0) return {
+		ok: false,
+		reason: "invalid"
+	};
+	const permission = findPermission(policy.permissions, raw["permission"]);
+	if (permission === void 0) return {
+		ok: false,
+		reason: "unknown-permission"
+	};
+	if (!policy.hostable.includes(permission.key)) return {
+		ok: false,
+		reason: "not-hostable"
+	};
+	const to = flattenGrantee(raw["to"]);
+	if (to.length === 0 || !to.every((item) => isRecord(item) && declaredGrantee(policy, item, permission.resource))) return {
+		ok: false,
+		reason: "unknown-grantee"
+	};
+	for (const condition of [raw["where"], raw["check"]]) if (condition !== void 0 && !isPortableCondition(condition)) return {
+		ok: false,
+		reason: "non-portable"
+	};
+	if (!approvalAcceptable(policy, raw["approval"], permission.resource)) return {
+		ok: false,
+		reason: "invalid"
+	};
+	if (raw["fields"] !== void 0 && !(Array.isArray(raw["fields"]) && raw["fields"].every((field) => typeof field === "string"))) return {
+		ok: false,
+		reason: "invalid"
+	};
+	const effect = raw["effect"] ?? "allow";
+	const options = compact({
+		where: raw["where"] === void 0 ? void 0 : normalizeWhere(raw["where"]),
+		check: raw["check"] === void 0 ? void 0 : normalizeWhere(raw["check"]),
+		approval: raw["approval"],
+		fields: raw["fields"]
+	});
+	let built;
+	try {
+		const roleItem = to.length === 1 && to[0]?.kind === "role" ? to[0] : null;
+		if (roleItem === null) {
+			const partial = (effect === "allow" ? allow : deny)(permission, {
+				...options,
+				to
+			});
+			built = completeGrant(partial);
+		} else {
+			const binding = policy.rolesByName.get(roleItem.role);
+			const leaf = findRole(policy.vocabulary.roles, roleItem.role);
+			const [first] = role(leaf ?? roleItem.role, [(effect === "allow" ? allow : deny)(permission, options)], binding?.on === void 0 ? {} : { on: binding.on }).grants;
+			if (first === void 0) throw new TypeError("PermDock: role produced no grant");
+			built = first;
+		}
+	} catch {
+		return {
+			ok: false,
+			reason: "invalid"
+		};
+	}
+	if (effect === "allow") {
+		const codeApprovals = policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === permission.key).map((grant) => grant.approval);
+		if (!approvalAtLeast(built.approval, codeApprovals)) return {
+			ok: false,
+			reason: "weaker-approval"
+		};
+	}
+	return {
+		ok: true,
+		grant: freezeDeep({
+			...built,
+			hosted: {
+				document: document.fingerprint,
+				grant: raw["id"]
+			}
+		})
+	};
+}
+/**
+* The code policy plus the hosted grants that pass every rule. Hosted
+* allows OR with code allows and any deny still wins, so a hosted grant can
+* never override a code deny; one that fails a rule is dropped, not thrown.
+*/
+function mergeHostedGrants(policy, document) {
+	if (document === null || document.grants.length === 0) return {
+		policy,
+		dropped: []
+	};
+	const merged = [];
+	const dropped = [];
+	for (const raw of document.grants) {
+		const result = buildGrant(policy, document, raw);
+		if (result.ok) {
+			merged.push(result.grant);
+			continue;
+		}
+		dropped.push(freezeDeep({
+			kind: "hosted-grant-dropped",
+			document: document.fingerprint,
+			grant: isRecord(raw) && typeof raw.id === "string" ? raw.id : "",
+			reason: result.reason
+		}));
+	}
+	if (merged.length === 0) return {
+		policy,
+		dropped
+	};
+	const grants = [...policy.grants, ...merged];
+	return {
+		policy: freezeDeep({
+			...policy,
+			grants,
+			index: indexPolicy(policy.roles, grants, policy.vocabulary),
+			fingerprint: bytesToBase64Url(sha256(`${policy.fingerprint}:${document.fingerprint}`))
+		}),
+		dropped
+	};
+}
+//#endregion
+export { parsePolicyDocument as i, memoryPolicySource as n, mergeHostedGrants as r, isPortableCondition as t };

package/dist/http-DPuDaChb.d.ts

@@ -0,0 +1,13 @@
+import { IncomingMessage, ServerResponse } from "node:http";
+//#region src/node/http.d.ts
+type NodeRequest = IncomingMessage & {
+  readonly originalUrl?: string;
+  readonly protocol?: string;
+  readonly body?: unknown;
+};
+declare function toRequest(req: NodeRequest, stream?: IncomingMessage | null): Request;
+declare function sendResponse(res: ServerResponse, response: Response): Promise<void>;
+declare const fromResponse: typeof sendResponse;
+declare function isServerResponse(value: unknown): value is ServerResponse;
+//#endregion
+export { toRequest as a, sendResponse as i, fromResponse as n, isServerResponse as r, NodeRequest as t };

package/dist/http-GgVApX1k.js

@@ -0,0 +1,111 @@
+//#region src/node/http.ts
+function toRequest(req, stream = req) {
+	const host = headerValue(req.headers.host) ?? "localhost";
+	const url = `${req.protocol ?? "http"}://${host}${req.originalUrl ?? req.url ?? "/"}`;
+	const headers = new Headers();
+	for (const [key, value] of Object.entries(req.headers)) {
+		if (typeof value === "string") {
+			headers.set(key, value);
+			continue;
+		}
+		if (Array.isArray(value)) for (const item of value) headers.append(key, item);
+	}
+	const method = req.method ?? "GET";
+	if (method === "GET" || method === "HEAD") return new Request(url, {
+		method,
+		headers
+	});
+	const parsed = bodyOf(req, headers);
+	if (parsed !== void 0) return new Request(url, {
+		method,
+		headers,
+		body: parsed
+	});
+	if (stream === null) return new Request(url, {
+		method,
+		headers
+	});
+	const init = {
+		method,
+		headers,
+		body: incomingBody(stream),
+		duplex: "half"
+	};
+	return new Request(url, init);
+}
+function chunkOf(chunk) {
+	return typeof chunk === "string" ? Buffer.from(chunk) : new Uint8Array(chunk);
+}
+/**
+* Pull-based with `highWaterMark: 0`: nothing is read from `req` until the
+* Web body is consumed, so a later body parser (multer, `express.json()`)
+* still sees the whole stream.
+*/
+function incomingBody(req) {
+	return new ReadableStream({ pull(controller) {
+		return new Promise((resolve) => {
+			const drain = () => {
+				const chunk = req.read();
+				if (chunk !== null) {
+					controller.enqueue(chunkOf(chunk));
+					return true;
+				}
+				if (req.readableEnded) {
+					controller.close();
+					return true;
+				}
+				return false;
+			};
+			if (drain()) {
+				resolve();
+				return;
+			}
+			const cleanup = () => {
+				req.off("readable", onReadable);
+				req.off("end", onEnd);
+				req.off("error", onError);
+			};
+			const onReadable = () => {
+				if (drain()) {
+					cleanup();
+					resolve();
+				}
+			};
+			const onEnd = () => {
+				cleanup();
+				controller.close();
+				resolve();
+			};
+			const onError = (err) => {
+				cleanup();
+				controller.error(err);
+				resolve();
+			};
+			req.on("readable", onReadable);
+			req.once("end", onEnd);
+			req.once("error", onError);
+		});
+	} }, { highWaterMark: 0 });
+}
+function headerValue(value) {
+	if (typeof value === "string" && value.length > 0) return value;
+	if (Array.isArray(value) && typeof value[0] === "string") return value[0];
+}
+function bodyOf(req, headers) {
+	if (req.body === void 0) return;
+	if (typeof req.body === "string") return req.body;
+	if (!headers.has("content-type")) headers.set("content-type", "application/json");
+	return JSON.stringify(req.body);
+}
+async function sendResponse(res, response) {
+	res.statusCode = response.status;
+	for (const [key, value] of response.headers.entries()) res.setHeader(key, value);
+	const body = Buffer.from(await response.arrayBuffer());
+	res.end(body);
+}
+const fromResponse = sendResponse;
+function isServerResponse(value) {
+	return typeof value === "object" && value !== null && "setHeader" in value && typeof value.setHeader === "function" && "end" in value;
+}
+//#endregion
+export { toRequest as i, isServerResponse as n, sendResponse as r, fromResponse as t };