toiljs 0.0.116 → 0.0.118

package/src/devserver/email/validate.ts

@@ -1,37 +0,0 @@
-/**
- * Strict single-recipient check for the guest-supplied `to`, byte-for-byte the
- * edge's (`host/email.rs::valid_recipient`). Rejects header injection
- * (CR/LF/NUL), multiple addresses (comma, semicolon, whitespace, angle
- * brackets, quotes), and the obviously malformed, so a guest can never smuggle a
- * Bcc or a second envelope recipient into the provider call. Exactly one `@`,
- * non-empty local part, dotted domain.
- */
-const FORBIDDEN = new Set(['\r', '\n', '\0', ',', ';', ' ', '\t', '<', '>', '"']);
-
-export function validRecipient(s: string): boolean {
-    if (s.length === 0 || Buffer.byteLength(s, 'utf8') > 320) return false;
-    for (const ch of s) {
-        if (FORBIDDEN.has(ch)) return false;
-    }
-    const parts = s.split('@');
-    if (parts.length !== 2) return false; // not exactly one '@'
-    const [local, domain] = parts;
-    return (
-        local.length > 0 && domain.includes('.') && !domain.startsWith('.') && !domain.endsWith('.')
-    );
-}
-
-/**
- * Lenient validation of the operator-supplied `from` (`host/email.rs::valid_from`):
- * trusted config, so the only hard requirement is no header injection; the
- * provider validates deliverability.
- */
-export function validFrom(s: string): boolean {
-    return (
-        Buffer.byteLength(s, 'utf8') <= 320 &&
-        s.includes('@') &&
-        !s.includes('\r') &&
-        !s.includes('\n') &&
-        !s.includes('\0')
-    );
-}

package/src/devserver/email/wire.ts

@@ -1,55 +0,0 @@
-/**
- * Decode the `email_send` request blob the guest writes into wasm memory — the
- * v2 wire format, byte-for-byte the edge's (`email_send_import.rs::parse_request`
- * and `server/globals/email.ts`):
- *
- *   u16 to_len | u16 subject_len | u16 purpose_len | u32 body_len | u32 html_len
- *   [to][subject][purpose][body][html]      (14-byte LE header, then UTF-8 payloads)
- *
- * `html_len == 0` is a plain-text send. Returns `null` on truncation, a length
- * that overruns the blob, trailing garbage, or non-UTF-8 — all guest encode bugs
- * the caller maps to `BadRecipient`.
- */
-export interface ParsedEmail {
-    readonly to: string;
-    readonly subject: string;
-    readonly purpose: string;
-    readonly body: string;
-    readonly html: string;
-}
-
-const HEADER_LEN = 14;
-
-export function parseEmailBlob(raw: Buffer): ParsedEmail | null {
-    if (raw.length < HEADER_LEN) return null;
-    const toLen = raw.readUInt16LE(0);
-    const subjectLen = raw.readUInt16LE(2);
-    const purposeLen = raw.readUInt16LE(4);
-    const bodyLen = raw.readUInt32LE(6);
-    const htmlLen = raw.readUInt32LE(10);
-
-    const total = toLen + subjectLen + purposeLen + bodyLen + htmlLen;
-    // Exact fit: the five payloads must consume the rest of the blob precisely.
-    if (HEADER_LEN + total !== raw.length) return null;
-
-    let off = HEADER_LEN;
-    const take = (n: number): string | null => {
-        const end = off + n;
-        const slice = raw.subarray(off, end);
-        // Reject invalid UTF-8 (Buffer.toString is lossy, so verify by round-trip).
-        const s = slice.toString('utf8');
-        if (Buffer.byteLength(s, 'utf8') !== n) return null;
-        off = end;
-        return s;
-    };
-
-    const to = take(toLen);
-    const subject = take(subjectLen);
-    const purpose = take(purposeLen);
-    const body = take(bodyLen);
-    const html = take(htmlLen);
-    if (to === null || subject === null || purpose === null || body === null || html === null) {
-        return null;
-    }
-    return { to, subject, purpose, body, html };
-}

package/src/devserver/http/envelope.ts

@@ -1,157 +0,0 @@
-/**
- * Node-side wire envelope codec for the WASM dev server, byte-for-byte compatible with
- * `server/runtime/envelope.ts` (the ToilScript guest decoder/encoder) and
- * `toil-backend/src/http/envelope.rs` (the production edge).
- *
- * Layout (little-endian, no padding):
- *
- *   request:
- *     u8   method     (0=GET, 1=POST, 2=PUT, 3=DELETE, 4=PATCH, 5=HEAD, 6=OPTIONS)
- *     u16  path_len
- *     [u8] path
- *     u16  n_headers
- *     for each header: u16 name_len, u16 val_len, [u8] name, [u8] val
- *     u32  body_len
- *     [u8] body
- *
- *   response: same shape but the first u8+u16 (method + path_len + path)
- *     is replaced by `u16 status`.
- *
- * Header names/values and the path must each fit in u16, the body in u32; the
- * encoder throws instead of silently truncating (mirrors `EncodeError` on the
- * edge). The decoder bounds-checks every length field so a malformed guest
- * response can never read past the envelope.
- */
-
-/** Method discriminant matching the on-wire envelope byte (part of the wasm ABI; do not reorder). */
-export const METHOD_CODES: Readonly<Record<string, number>> = {
-    GET: 0,
-    POST: 1,
-    PUT: 2,
-    DELETE: 3,
-    PATCH: 4,
-    HEAD: 5,
-    OPTIONS: 6,
-};
-
-/** A request to serialize for the guest. `path` includes the query string. */
-export interface EnvelopeRequest {
-    readonly method: string;
-    readonly path: string;
-    /** Full request header list, passed through to the guest. */
-    readonly headers: readonly (readonly [string, string])[];
-    readonly body: Uint8Array;
-    /** The connecting client's IP for the `client_ip` import / `ctx.clientIp()`.
-     *  The edge uses the unspoofable socket peer; the dev server best-efforts it. */
-    readonly clientIp?: string;
-}
-
-/** The decoded guest response envelope. */
-export interface EnvelopeResponse {
-    readonly status: number;
-    readonly headers: readonly (readonly [string, string])[];
-    readonly body: Uint8Array;
-}
-
-const U16_MAX = 0xffff;
-const U32_MAX = 0xffffffff;
-
-/**
- * Encode `req` into a fresh buffer. Throws on an unsupported method or a field
- * that does not fit its length prefix; callers turn that into a clean 4xx (or
- * route the request past the guest) instead of handing the guest garbage.
- */
-export function encodeRequestEnvelope(req: EnvelopeRequest): Buffer {
-    const method = METHOD_CODES[req.method.toUpperCase()];
-    if (method === undefined) throw new Error(`unsupported method: ${req.method}`);
-
-    const path = Buffer.from(req.path, 'utf8');
-    if (path.length > U16_MAX) throw new Error(`path too long: ${String(path.length)} bytes`);
-    if (req.headers.length > U16_MAX)
-        throw new Error(`too many headers: ${String(req.headers.length)}`);
-    if (req.body.length > U32_MAX)
-        throw new Error(`body too long: ${String(req.body.length)} bytes`);
-
-    const headers: { name: Buffer; value: Buffer }[] = [];
-    let headersSize = 0;
-    for (const [name, value] of req.headers) {
-        const n = Buffer.from(name, 'utf8');
-        const v = Buffer.from(value, 'utf8');
-        if (n.length > U16_MAX || v.length > U16_MAX) throw new Error(`header too long: ${name}`);
-        headers.push({ name: n, value: v });
-        headersSize += 4 + n.length + v.length;
-    }
-
-    const total = 1 + 2 + path.length + 2 + headersSize + 4 + req.body.length;
-    const out = Buffer.allocUnsafe(total);
-    let cur = 0;
-
-    out.writeUInt8(method, cur);
-    cur += 1;
-    out.writeUInt16LE(path.length, cur);
-    cur += 2;
-    cur += path.copy(out, cur);
-
-    out.writeUInt16LE(headers.length, cur);
-    cur += 2;
-    for (const h of headers) {
-        out.writeUInt16LE(h.name.length, cur);
-        cur += 2;
-        out.writeUInt16LE(h.value.length, cur);
-        cur += 2;
-        cur += h.name.copy(out, cur);
-        cur += h.value.copy(out, cur);
-    }
-
-    out.writeUInt32LE(req.body.length, cur);
-    cur += 4;
-    cur += Buffer.from(req.body.buffer, req.body.byteOffset, req.body.length).copy(out, cur);
-
-    return out;
-}
-
-/**
- * Decode the response envelope the guest wrote at `bytes`. Throws on
- * truncation or a length field that overruns the envelope (a guest bug);
- * the dispatcher converts that into a 500.
- */
-export function decodeResponseEnvelope(bytes: Uint8Array): EnvelopeResponse {
-    const view = Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-    let cur = 0;
-
-    const take = (n: number): number => {
-        if (cur + n > view.length)
-            throw new Error(`response envelope truncated at byte ${String(cur)}`);
-        const at = cur;
-        cur += n;
-        return at;
-    };
-
-    const status = view.readUInt16LE(take(2));
-    if (status === 0) throw new Error('response envelope has status 0');
-
-    const nHeaders = view.readUInt16LE(take(2));
-    const headers: (readonly [string, string])[] = [];
-    for (let i = 0; i < nHeaders; i++) {
-        const nameLen = view.readUInt16LE(take(2));
-        const valLen = view.readUInt16LE(take(2));
-        const name = view.toString('utf8', take(nameLen), cur);
-        const value = view.toString('utf8', take(valLen), cur);
-        headers.push([name, value]);
-    }
-
-    const bodyLen = view.readUInt32LE(take(4));
-    const bodyStart = take(bodyLen);
-    // Copy out of the guest's linear memory so the response outlives the instance.
-    const body = Uint8Array.prototype.slice.call(view, bodyStart, cur);
-
-    return { status, headers, body };
-}
-
-/** Unpack the i64 `handle()` returns: high 32 bits = response offset, low 32 bits = byte length. */
-export function unpackHandleResult(packed: bigint): { ptr: number; len: number } {
-    return {
-        ptr: Number((packed >> 32n) & 0xffffffffn),
-        len: Number(packed & 0xffffffffn),
-    };
-}

package/src/devserver/http/proxy.ts

@@ -1,172 +0,0 @@
-/**
- * Transparent proxy from the uWebSockets.js front server to the internal Vite
- * dev server, so every Vite dev feature (module transforms, HMR websocket,
- * `/__toil/*` toolbar endpoints, public assets, SPA fallback) keeps working
- * unchanged behind the WASM dispatcher. HTTP goes through `fetch`, the HMR
- * websocket through Node's built-in `WebSocket` client, both loopback-only.
- */
-
-import { type Request, type Response, type Server, type Websocket } from '@dacely/hyper-express';
-
-/** Where the internal Vite dev server listens (always loopback). */
-export interface ViteTarget {
-    readonly host: string;
-    readonly port: number;
-}
-
-/**
- * Hop-by-hop request headers (RFC 9110 §7.6.1) plus headers `fetch` manages
- * itself; everything else is forwarded verbatim. `accept-encoding` is dropped
- * so Vite answers identity-encoded and bytes can be piped through untouched.
- */
-const SKIP_REQUEST_HEADERS = new Set([
-    'connection',
-    'keep-alive',
-    'proxy-authenticate',
-    'proxy-authorization',
-    'te',
-    'trailer',
-    'transfer-encoding',
-    'upgrade',
-    'content-length',
-    'accept-encoding',
-]);
-
-/** Response headers owned by the front server's own HTTP framing. */
-const SKIP_RESPONSE_HEADERS = new Set([
-    'connection',
-    'keep-alive',
-    'content-length',
-    'content-encoding',
-    'transfer-encoding',
-]);
-
-/** Forwards one HTTP request to Vite and streams the answer back. */
-export async function proxyToVite(
-    request: Request,
-    response: Response,
-    target: ViteTarget,
-): Promise<void> {
-    const url = `http://${target.host}:${String(target.port)}${request.url}`;
-
-    const headers = new Headers();
-    for (const [name, value] of Object.entries(request.headers)) {
-        if (!SKIP_REQUEST_HEADERS.has(name.toLowerCase())) headers.set(name, value);
-    }
-
-    const hasBody = request.method !== 'GET' && request.method !== 'HEAD';
-    const body = hasBody ? await request.buffer() : undefined;
-
-    const upstream = await fetch(url, {
-        method: request.method,
-        headers,
-        body: body && body.length > 0 ? new Uint8Array(body) : undefined,
-        // The browser follows redirects itself; pass them through untouched.
-        redirect: 'manual',
-    });
-
-    response.status(upstream.status);
-    upstream.headers.forEach((value, name) => {
-        if (!SKIP_RESPONSE_HEADERS.has(name)) response.header(name, value);
-    });
-
-    // Buffer the full upstream body and send it with a content-length, instead
-    // of streaming it. uWS/hyper-express chunked-streaming of a `fetch` body
-    // emitted an INVALID chunked encoding in the browser
-    // (net::ERR_INVALID_CHUNKED_ENCODING), so client modules failed to load. Dev
-    // responses are finite (HMR rides the separate websocket), so buffering is
-    // safe and sidesteps the chunked framing entirely.
-    const buf = Buffer.from(await upstream.arrayBuffer());
-    if (buf.length === 0) {
-        response.send();
-        return;
-    }
-    response.send(buf);
-}
-
-/**
- * A uWS message as something `WebSocket.send` accepts: text stays a string,
- * binary is copied into a plain `ArrayBuffer`-backed view (a `Buffer` may sit
- * on a shared pool slab, which the WebSocket types reject).
- */
-function toUpstreamMessage(data: Buffer, binary: boolean): string | Uint8Array<ArrayBuffer> {
-    if (!binary) return data.toString('utf8');
-    const copy = new Uint8Array(data.length);
-    copy.set(data);
-    return copy;
-}
-
-/**
- * Wires a catch-all websocket route that pipes every upgrade (Vite's HMR
- * socket connects to the page origin at `/`, subprotocol `vite-hmr`) to the
- * internal Vite server. Messages are queued until the upstream socket opens,
- * closes propagate in both directions.
- */
-export function wireWebsocketProxy(app: Server, target: ViteTarget): void {
-    app.upgrade('/*', (request: Request, response: Response) => {
-        response.upgrade({
-            url: request.url,
-            protocol: request.headers['sec-websocket-protocol'] ?? '',
-        });
-    });
-
-    app.ws(
-        '/*',
-        { message_type: 'Buffer', idle_timeout: 120, max_payload_length: 16 * 1024 * 1024 },
-        (ws: Websocket) => {
-            pipeToVite(ws, target, ws.context as { url: string; protocol: string });
-        },
-    );
-}
-
-/**
- * Pipe ONE upgraded websocket to the internal Vite HMR server. The verbatim body extracted from
- * {@link wireWebsocketProxy} so the dev STREAM router (doc 08 4.1 `wireStreams`) can reuse it for every
- * NON-stream upgrade while it handles `@stream`-route upgrades itself - HMR stays byte-for-byte
- * unchanged. `ctx` is the upgrade context (`{ url, protocol }`) the upgrade handler stamped.
- */
-export function pipeToVite(
-    ws: Websocket,
-    target: ViteTarget,
-    ctx: { url: string; protocol: string },
-): void {
-    const { url, protocol } = ctx;
-    const upstream = new WebSocket(
-        `ws://${target.host}:${String(target.port)}${url}`,
-        protocol ? protocol.split(',').map((p) => p.trim()) : [],
-    );
-    upstream.binaryType = 'arraybuffer';
-
-    const pending: (string | Uint8Array<ArrayBuffer>)[] = [];
-    let open = false;
-
-    upstream.onopen = (): void => {
-        open = true;
-        for (const m of pending) upstream.send(m);
-        pending.length = 0;
-    };
-    upstream.onmessage = (event: MessageEvent): void => {
-        if (typeof event.data === 'string') ws.send(event.data);
-        else ws.send(Buffer.from(event.data as ArrayBuffer), true);
-    };
-    upstream.onclose = (event: CloseEvent): void => {
-        ws.close(event.code, event.reason);
-    };
-    upstream.onerror = (): void => {
-        ws.close();
-    };
-
-    ws.on('message', (message: Buffer, isBinary: boolean) => {
-        const m = toUpstreamMessage(message, isBinary);
-        if (open) upstream.send(m);
-        else pending.push(m);
-    });
-    ws.on('close', () => {
-        if (
-            upstream.readyState === WebSocket.OPEN ||
-            upstream.readyState === WebSocket.CONNECTING
-        ) {
-            upstream.close();
-        }
-    });
-}