tunnelfetch 1.1.0 → 1.1.1

package/README.md

@@ -14,7 +14,7 @@ Zero dependencies. ESM. No build step. No `node:` imports anywhere in `src/`.
 
 > **Maturity.** This is a new implementation, not a battle-tested one. It implements TLS 1.2/1.3 and
 > certificate validation in userland — a category where good tests are necessary and not sufficient.
-> It has 1132 hermetic tests, RFC vectors, byte-by-byte fragmentation, live edge interop, seeded
+> It has over 1100 hermetic tests, RFC vectors, byte-by-byte fragmentation, live edge interop, seeded
 > fuzzing of every peer-facing parser, and 95% line coverage. It has **not** had an external
 > security audit. Treat it as a high-quality implementation worth trying, not as something proven
 > in production. Please report anything you find — see [SECURITY.md](SECURITY.md).
@@ -343,7 +343,8 @@ res.tunnelfetch.httpVersion; // '2' if the server chose h2, '1.1' otherwise
 | `cookies` | `false` | Enable a per-Client cookie jar. |
 | `maxRedirects` | `20` | |
 | `maxBodyBytes` | `Infinity` | Enforced from `Content-Length` before a byte is read. |
-| `decompress` | `true` | gzip/deflate. Never `br` — see limits. |
+| `decompress` | `true` | Decode `Content-Encoding` at all. gzip and deflate are built in. |
+| `decoders` | `{}` | Extra codings, e.g. `{ br: fn }`. Each is added to `Accept-Encoding`. See [`br`, `zstd`](#br-zstd-and-other-codings). |
 | `keepAlive` | `true` | |
 | `http2` | `true` | Offer `h2` in ALPN and speak it if the server selects it. See [HTTP/2](#http2--access-not-speed). |
 | `forceTunnel` | `false` | Never delegate to the platform's `fetch`. |
@@ -675,11 +676,11 @@ WHATWG Streams including BYOB readers, `TextEncoder`/`TextDecoder`, `Decompressi
 
 | Runtime | Offline suite | Notes |
 |---|---|---|
-| Node 22, 24 | **1132 / 1132** | what CI gates on |
+| Node 22, 24 | **all pass** | what CI gates on |
 | Node 20 | not supported | `TextDecoder` treats `iso-8859-1` as true ISO-8859-1 instead of aliasing it to windows-1252 as WHATWG requires, so bodies in that charset decode differently. Left maintenance April 2026 |
 | workerd | live edge suite passes | the target runtime; exercised end to end by the scheduled edge job rather than by the offline suite |
-| Deno 2.9 | 999 / 1001 | both failures are in the TLS 1.2 test server's secp521r1 path, not in the package; WebCrypto ECDSA and ECDH on P-521 both work standalone under Deno. Unresolved, so support is not claimed |
-| Bun 1.3 | 1079 / 1082 | a module-resolution difference in one repo-hygiene test, one timing-sensitive deadline test, and the same TLS 1.2 suite test. Unresolved, so support is not claimed |
+| Deno 2.9 | 2 failures | both failures are in the TLS 1.2 test server's secp521r1 path, not in the package; WebCrypto ECDSA and ECDH on P-521 both work standalone under Deno. Unresolved, so support is not claimed |
+| Bun 1.3 | 3 failures | a module-resolution difference in one repo-hygiene test, one timing-sensitive deadline test, and the same TLS 1.2 suite test. Unresolved, so support is not claimed |
 
 Node 22 and workerd are the supported pair. Deno and Bun very nearly work and are not tested in CI
 — running the suite there is a good first contribution.
@@ -710,8 +711,9 @@ against independently written test servers — the 1.2 server is built on `node:
 on this package's own primitives, so a client bug cannot be cancelled out by the same bug on the
 server side.
 
-Every parser that consumes bytes a peer controls — X.509, OCSP, HTTP/1.1 heads, chunked bodies,
-HTTP/2 frames, HPACK — is fuzzed against one property: **any input either parses or throws a
+Every parser that consumes bytes a peer controls — the TLS record layer and handshake messages,
+X.509, OCSP, HTTP/1.1 heads, chunked bodies, HTTP/2 frames, HPACK — is fuzzed against one
+property: **any input either parses or throws a
 `TunnelFetchError`.** An untyped throw, a `TypeError` from a missing null check or a `RangeError`
 from a bad offset, is a finding: it means a check is missing and every caller relying on the typed
 contract to fail closed will not catch it.

package/README.zh-CN.md

@@ -11,7 +11,7 @@
 
 零依赖。ESM。无构建步骤。`src/` 中没有任何 `node:` 导入。
 
-> **成熟度。** 这是一个新实现，不是久经沙场的实现。它在用户态实现了 TLS 1.2/1.3 与证书校验——在这个领域，好的测试是必要条件，但不是充分条件。它有 1132 个离线测试、RFC 向量、逐字节分片、真实边缘互操作测试、对每一个面向对端的解析器做种子化 fuzzing，行覆盖率 95%；但它**没有**经过外部安全审计。请把它当作一个值得一试的高质量实现，而不是一个已被生产验证的东西。发现任何问题都欢迎报告——见 [SECURITY.md](SECURITY.md)。
+> **成熟度。** 这是一个新实现，不是久经沙场的实现。它在用户态实现了 TLS 1.2/1.3 与证书校验——在这个领域，好的测试是必要条件，但不是充分条件。它有一千一百多个离线测试、RFC 向量、逐字节分片、真实边缘互操作测试、对每一个面向对端的解析器做种子化 fuzzing，行覆盖率 95%；但它**没有**经过外部安全审计。请把它当作一个值得一试的高质量实现，而不是一个已被生产验证的东西。发现任何问题都欢迎报告——见 [SECURITY.md](SECURITY.md)。
 
 ```js
 import { Client } from 'tunnelfetch';
@@ -278,7 +278,8 @@ res.tunnelfetch.httpVersion; // 服务器选了 h2 就是 '2'，否则是 '1.1'
 | `cookies` | `false` | 启用该 Client 专属的 cookie jar。 |
 | `maxRedirects` | `20` | |
 | `maxBodyBytes` | `Infinity` | 在读入任何字节之前就按 `Content-Length` 强制执行。 |
-| `decompress` | `true` | gzip/deflate。永远不含 `br`——见限制一节。 |
+| `decompress` | `true` | 是否解码 `Content-Encoding`。gzip 与 deflate 内置。 |
+| `decoders` | `{}` | 额外的编码，如 `{ br: fn }`；每一个都会被加进 `Accept-Encoding`。见 [`br`、`zstd`](#brzstd-与其它编码)。 |
 | `keepAlive` | `true` | |
 | `http2` | `true` | 在 ALPN 中报出 `h2`，服务器选中即使用。见 [HTTP/2](#http2--要的是访问不是速度)。 |
 | `forceTunnel` | `false` | 永不委托给平台的 `fetch`。 |
@@ -501,11 +502,11 @@ WebCrypto (X25519、ECDH P-256/384/521、ECDSA、RSA-PSS、RSASSA-PKCS1、HKDF
 
 | 运行时 | 离线测试 | 说明 |
 |---|---|---|
-| Node 22、24 | **1132 / 1132** | CI 把关的组合 |
+| Node 22、24 | **全部通过** | CI 把关的组合 |
 | Node 20 | 不支持 | `TextDecoder` 把 `iso-8859-1` 当作真正的 ISO-8859-1，而没有按 WHATWG 要求别名到 windows-1252，该字符集的响应体解码结果不同。已于 2026 年 4 月结束维护 |
 | workerd | live 边缘测试全过 | 目标运行时；由定时边缘任务端到端验证，不在离线套件里 |
-| Deno 2.9 | 999 / 1001 | 两个失败都落在 TLS 1.2 测试服务器的 secp521r1 路径上，不在包内；Deno 的 WebCrypto ECDSA 与 ECDH 在 P-521 上单独测试都正常。原因未定位，因此不宣称支持 |
-| Bun 1.3 | 1079 / 1082 | 一个 repo-hygiene 测试的模块解析差异、一个对时序敏感的 deadline 测试，以及同一个 TLS 1.2 套件测试。原因未定位，因此不宣称支持 |
+| Deno 2.9 | 2 个失败 | 两个失败都落在 TLS 1.2 测试服务器的 secp521r1 路径上，不在包内；Deno 的 WebCrypto ECDSA 与 ECDH 在 P-521 上单独测试都正常。原因未定位，因此不宣称支持 |
+| Bun 1.3 | 3 个失败 | 一个 repo-hygiene 测试的模块解析差异、一个对时序敏感的 deadline 测试，以及同一个 TLS 1.2 套件测试。原因未定位，因此不宣称支持 |
 
 受支持的组合是 Node 22 与 workerd。Deno 和 Bun 已经非常接近可用，但没有进 CI——把这套测试在那两个运行时上跑通，是一个很好的首次贡献。
 
@@ -524,7 +525,7 @@ npm run test:live # explicit; needs TUNNELFETCH_PROXY in the environment
 
 TLS 密钥调度与记录层逐字节钉死在 **RFC 8448** "Example Handshake Traces for TLS 1.3" 上：AEAD 复现出 RFC 里一模一样的密文记录，记录层把 RFC 的完整线上字节在两个方向上原样重放。两个 TLS 驱动都对着独立编写的测试服务器测试——1.2 的服务器建在 `node:crypto` 上，而不是本包自己的原语上，这样客户端的 bug 就不可能被服务器端的同一个 bug 抵消掉。
 
-每一个消费对端字节的解析器——X.509、OCSP、HTTP/1.1 响应头、分块体、HTTP/2 帧、HPACK——都会被 fuzz，断言的属性只有一条：**任意输入，要么解析成功，要么抛出 `TunnelFetchError`。** 抛出未类型化的错误（少了空值检查的 `TypeError`、越界的 `RangeError`）就是一个发现：它意味着某处检查缺失，而所有依赖类型化契约来 fail closed 的调用方都接不住它。
+每一个消费对端字节的解析器——TLS 记录层与握手消息、X.509、OCSP、HTTP/1.1 响应头、分块体、HTTP/2 帧、HPACK——都会被 fuzz，断言的属性只有一条：**任意输入，要么解析成功，要么抛出 `TunnelFetchError`。** 抛出未类型化的错误（少了空值检查的 `TypeError`、越界的 `RangeError`）就是一个发现：它意味着某处检查缺失，而所有依赖类型化契约来 fail closed 的调用方都接不住它。
 
 fuzzer 自带种子、零依赖，失败时会打印种子、迭代序号和 base64 的输入——可以精确复现，而无法复现失败的 fuzzer 算不上 fuzzer。目标从 `test/fuzz/targets/` 自动发现，新增一个就是放一个文件进去。这套测试还会 fuzz **它自己**：两个合成目标分别证明引擎能报出未类型化的抛出、且不会误报类型化的抛出——否则一次全绿的 fuzz 只能证明 fuzzer 从来没睁眼。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tunnelfetch",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "A fetch-shaped HTTP client that can route through HTTP CONNECT / HTTPS / SOCKS5 proxies on runtimes with only raw TCP, such as Cloudflare Workers. Implements TLS in userland because the runtime cannot verify a tunnelled peer.",
   "keywords": [
     "fetch",

package/src/client.js

@@ -483,17 +483,65 @@ function registerHttp2(client, key, conn) {
  */
 function snapshotOptions(options) {
   const o = { ...options };
-  if (o.trust && typeof o.trust === 'object') {
-    const t = { ...o.trust };
-    if (Array.isArray(t.pins)) t.pins = Object.freeze([...t.pins]);
-    if (Array.isArray(t.anchors)) t.anchors = Object.freeze([...t.anchors]);
-    o.trust = Object.freeze(t);
-  }
-  if (o.tls && typeof o.tls === 'object') o.tls = Object.freeze({ ...o.tls });
+  if (o.trust && typeof o.trust === 'object') o.trust = deepCopyConfig(o.trust);
+  if (o.tls && typeof o.tls === 'object') o.tls = deepCopyConfig(o.tls);
   if (o.timeouts && typeof o.timeouts === 'object') o.timeouts = Object.freeze({ ...o.timeouts });
   return Object.freeze(o);
 }
 
+/**
+ * Recursively copy and freeze a configuration value so nothing the caller still holds can change
+ * what this Client trusts.
+ *
+ * A shallow freeze is not enough, and the gap was found in review: `Object.freeze([...anchors])`
+ * gives a frozen ARRAY whose elements are still the caller's `Uint8Array`s, and freezing a typed
+ * array does not freeze its bytes. Writing into the DER of a trust anchor after the first request
+ * therefore changed the certificate material this Client validated against — while the pool key
+ * stayed put, because `anchorDigest` memoises per array object. The same shape applies to `tls`,
+ * where `groups`, `ciphers` and `clientRandom` are all caller-owned mutable buffers.
+ *
+ * Only plain objects, arrays and byte arrays are copied. Everything else is passed through by
+ * REFERENCE, deliberately: `trust.verify` is a function whose identity is what distinguishes one
+ * custom policy from another in the pool key (see `customCounter`), and an AbortSignal or a
+ * CookieJar is a live object, not data. Copying either would break them.
+ *
+ * @template T
+ * @param {T} value
+ * @param {number} [depth]
+ * @returns {T}
+ */
+function deepCopyConfig(value, depth = 0) {
+  // Certificate material is not deeply nested; a bound turns a pathological input into an error
+  // rather than a stack overflow, and nothing legitimate comes close to it.
+  if (depth > 8) {
+    throw new ConfigError(
+      codes.CONFIG_INVALID,
+      'trust or tls configuration nests more than 8 levels deep; refusing to copy it',
+    );
+  }
+  if (ArrayBuffer.isView(value)) {
+    // Not frozen: V8 refuses to freeze a typed array that has elements. Immutability here comes
+    // from the copy being PRIVATE — the caller has no reference to it — rather than from
+    // Object.freeze. Copying the underlying buffer slice rather than the view also detaches it
+    // from any sibling view over the same memory.
+    const Ctor = /** @type {any} */ (value.constructor);
+    return new Ctor(value.buffer.slice(value.byteOffset, value.byteOffset + value.byteLength));
+  }
+  if (Array.isArray(value)) {
+    return Object.freeze(value.map((v) => deepCopyConfig(v, depth + 1)));
+  }
+  if (value && typeof value === 'object') {
+    const proto = Object.getPrototypeOf(value);
+    // Only plain objects. A class instance is a live thing with behaviour, and rebuilding it from
+    // its own enumerable properties would produce something that merely looks like it.
+    if (proto !== Object.prototype && proto !== null) return value;
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = deepCopyConfig(v, depth + 1);
+    return Object.freeze(out);
+  }
+  return value;
+}
+
 /**
  * Remember a body until it settles. Never rejects: a failed body is still a finished one, and this
  * set exists to answer "is anything still arriving", not "did it go well".

package/src/http2/connection.js

@@ -117,10 +117,25 @@ export class Http2Retryable extends Http2Error {}
  * @property {number} [maxConcurrentStreams] our advertised SETTINGS_MAX_CONCURRENT_STREAMS.
  * @property {number} [maxHeaderTableSize] our advertised SETTINGS_HEADER_TABLE_SIZE.
  * @property {number} [maxHeaderListSize] self-protection cap on a decoded response header list.
+ * @property {number} [maxHeaderBlockBytes] cap on the RAW bytes of one HEADERS+CONTINUATION run,
+ *   before HPACK decoding. Default 262144, matching the decoded cap. This is the bound that stops
+ *   a CONTINUATION flood; `maxHeaderListSize` cannot, because it is only reachable once the whole
+ *   block has been assembled in memory.
  * @property {(err: Error | null) => void} [onClose] called once when the connection dies, so a
  *   registry can drop it.
  */
 
+/**
+ * The declared content-length, or null when absent. A list with conflicting values is refused by
+ * the header layer before this is reached; a malformed single value is treated as absent rather
+ * than as zero, because guessing a length is the failure mode being closed here.
+ */
+function contentLengthOf(headers) {
+  const raw = headers.get?.('content-length') ?? null;
+  if (raw === null) return null;
+  return /^\d+$/.test(raw.trim()) ? Number(raw.trim()) : null;
+}
+
 export class Http2Connection {
   /**
    * @param {import('../tls/connect.js').ByteDuplex | { readable: ReadableStream<Uint8Array>,
@@ -169,7 +184,18 @@ export class Http2Connection {
     // Header-block continuation state: while assembling a HEADERS+CONTINUATION run, no other frame
     // may interleave (RFC 9113 s6.10). Non-null means "the next frame must be CONTINUATION on this
     // stream id".
-    this._continuation = null; // { streamId, fragments: Uint8Array[], endStream, kind }
+    this._continuation = null; // { streamId, fragments: Uint8Array[], bytes, endStream, kind }
+    // A header block arrives as a HEADERS frame plus any number of CONTINUATION frames, and it is
+    // only decodable once the last one lands — so the fragments must be held. `maxHeaderListSize`
+    // bounds the DECODED list and is checked in _completeHeaderBlock, which is to say after the
+    // whole block is already in memory: a peer that simply never sets END_HEADERS never reaches
+    // it. That is the CONTINUATION flood (the class behind CVE-2024-27316 and its siblings), and
+    // it is bounded here instead, on the raw bytes, as they arrive.
+    //
+    // 262144 by default, the same figure as the decoded cap. HPACK does not expand — an indexed
+    // reference makes a small input decode LARGER, never the reverse — so a block whose raw size
+    // exceeds the decoded cap could not have produced an acceptable header list anyway.
+    this._maxHeaderBlockBytes = opts.maxHeaderBlockBytes ?? 262144;
     this._expectFirstSettings = true;
 
     this._fatal = null; // set once; rejects every stream and every future request
@@ -306,6 +332,9 @@ export class Http2Connection {
       /** @type {Uint8Array[]} */
       recvQueue: [],
       recvEnded: false,
+      /** @type {number | null} declared content-length, null when absent */
+      declaredLength: null,
+      receivedLength: 0,
       /** @type {Error | null} */
       bodyError: null,
       /** @type {(() => void) | null} */
@@ -368,7 +397,13 @@ export class Http2Connection {
       this._connSendWindow -= n;
       const end = offset >= body.byteLength;
       await this._write(dataFrame(streamId, slice, end));
-      if (end) stream.localEnded = true;
+      if (end) {
+        stream.localEnded = true;
+        // The remote half may have ended long ago — a server is free to answer before the upload
+        // finishes — in which case nothing else will ever re-check, and the stream stays in the
+        // map for the life of the connection. Every other place that ends a half calls this.
+        this._maybeCloseStream(stream);
+      }
     }
   }
 
@@ -673,12 +708,43 @@ export class Http2Connection {
     if (flags & FLAG.END_HEADERS) {
       this._completeHeaderBlock(streamId, fragment, endStream);
     } else {
-      this._continuation = { streamId, fragments: [fragment.slice()], endStream };
+      this._continuation = {
+        streamId,
+        fragments: [fragment.slice()],
+        bytes: fragment.length,
+        endStream,
+      };
+      // The opening frame alone can exceed the cap when SETTINGS_MAX_FRAME_SIZE is large.
+      if (!this._headerBlockWithinCap()) return;
     }
   }
 
+  /**
+   * Enforce the raw header-block cap, killing the connection when it is passed.
+   * Connection-level rather than stream-level on purpose: the fragments are HPACK input, and
+   * abandoning a partial block would leave the shared decoder desynchronised for every other
+   * stream — which RFC 9113 s4.3 makes a connection error in its own right.
+   * @returns {boolean} true when assembly may continue
+   */
+  _headerBlockWithinCap() {
+    const { bytes, streamId } = this._continuation;
+    if (bytes <= this._maxHeaderBlockBytes) return true;
+    this._continuation = null;
+    this._die(
+      new Http2Error(
+        codes.HTTP2_PROTOCOL,
+        `header block on stream ${streamId} reached ${bytes} bytes across HEADERS and ` +
+          `CONTINUATION frames, over the ${this._maxHeaderBlockBytes} byte cap`,
+        { streamId, bytes, cap: this._maxHeaderBlockBytes },
+      ),
+    );
+    return false;
+  }
+
   _onContinuation(flags, payload) {
     this._continuation.fragments.push(payload.slice());
+    this._continuation.bytes += payload.length;
+    if (!this._headerBlockWithinCap()) return;
     if (flags & FLAG.END_HEADERS) {
       const { streamId, fragments, endStream } = this._continuation;
       this._continuation = null;
@@ -734,6 +800,13 @@ export class Http2Connection {
       return;
     }
     stream.responseReceived = true;
+    // RFC 9113 s8.1.1: a message with a content-length that disagrees with the DATA delivered is
+    // malformed. h1 enforces this through its framing; h2 declares the length in a header and
+    // delimits with END_STREAM, so the two can disagree — and a body that silently differs from
+    // its declared length is exactly the ambiguity this package refuses everywhere else. Held on
+    // the stream and checked as DATA arrives and again at END_STREAM.
+    stream.declaredLength = contentLengthOf(head.headers);
+    stream.receivedLength = 0;
     if (endStream) {
       // No body and no trailers: the completion contract is satisfiable now, exactly like the h1
       // "complete at creation" case, so a caller that never reads the (empty) body still lets the
@@ -777,6 +850,13 @@ export class Http2Connection {
   }
 
   _onData(flags, streamId, payload) {
+    if (streamId === 0) {
+      // RFC 9113 s6.1: DATA is always associated with a stream, and a zero id MUST be a connection
+      // error. Absorbing it silently was letting a peer push bytes with no stream to charge them
+      // to, which is the shape of a smuggling primitive as much as a resource one.
+      this._die(new Http2Error(codes.HTTP2_PROTOCOL, 'DATA frame on stream 0'));
+      return;
+    }
     const stream = this._streams.get(streamId);
     // Flow control is accounted at the connection level for EVERY DATA frame, even one for a
     // stream we have already closed — the peer spent connection window to send it, and not
@@ -824,11 +904,40 @@ export class Http2Connection {
     if (overhead > 0) this._replenishConn(overhead);
     // The stream window was debited by flowLen; credit the overhead back on the stream too.
     if (overhead > 0) this._replenish(stream, overhead);
+    stream.receivedLength += data.byteLength;
+    // Caught on the way past rather than only at END_STREAM, so an over-long body is refused
+    // before the excess is queued for the caller.
+    if (stream.declaredLength !== null && stream.receivedLength > stream.declaredLength) {
+      this._resetStream(
+        stream,
+        H2_ERROR.PROTOCOL_ERROR,
+        new Http2Error(
+          codes.HTTP2_PROTOCOL,
+          `response body is longer than its content-length: ${stream.receivedLength} bytes so ` +
+            `far against a declared ${stream.declaredLength}`,
+          { declared: stream.declaredLength, received: stream.receivedLength },
+        ),
+      );
+      return;
+    }
     if (data.byteLength > 0) {
       stream.recvQueue.push(data.slice());
       this._wakePull(stream);
     }
     if (flags & FLAG.END_STREAM) {
+      if (stream.declaredLength !== null && stream.receivedLength !== stream.declaredLength) {
+        this._resetStream(
+          stream,
+          H2_ERROR.PROTOCOL_ERROR,
+          new Http2Error(
+            codes.HTTP2_PROTOCOL,
+            `response body ended at ${stream.receivedLength} bytes against a declared ` +
+              `content-length of ${stream.declaredLength}`,
+            { declared: stream.declaredLength, received: stream.receivedLength },
+          ),
+        );
+        return;
+      }
       stream.recvEnded = true;
       this._wakePull(stream);
       this._maybeCloseStream(stream);

package/types/http2/connection.d.ts

@@ -34,19 +34,6 @@ export function buildRequestFields({ method, scheme, authority, path, headers }:
  */
 export class Http2Retryable extends Http2Error {
 }
-/**
- * @typedef {object} Http2ConnectionOptions
- * @property {import('../transport.js').ConnectionInfo} [info] provenance attached to responses
- * @property {number} [initialWindowSize] our SETTINGS_INITIAL_WINDOW_SIZE (receive window per
- *   stream). Defaults to curl's 10 MiB; tests lower it to exercise flow control.
- * @property {number} [connectionWindow] the connection receive window we open with a WINDOW_UPDATE
- *   right after SETTINGS. Defaults to curl's 1000 MiB.
- * @property {number} [maxConcurrentStreams] our advertised SETTINGS_MAX_CONCURRENT_STREAMS.
- * @property {number} [maxHeaderTableSize] our advertised SETTINGS_HEADER_TABLE_SIZE.
- * @property {number} [maxHeaderListSize] self-protection cap on a decoded response header list.
- * @property {(err: Error | null) => void} [onClose] called once when the connection dies, so a
- *   registry can drop it.
- */
 export class Http2Connection {
     /**
      * @param {import('../tls/connect.js').ByteDuplex | { readable: ReadableStream<Uint8Array>,
@@ -83,8 +70,10 @@ export class Http2Connection {
     _continuation: {
         streamId: any;
         fragments: Uint8Array<ArrayBuffer>[];
+        bytes: number;
         endStream: boolean;
     } | null;
+    _maxHeaderBlockBytes: number;
     _expectFirstSettings: boolean;
     _fatal: any;
     _goaway: {
@@ -137,6 +126,9 @@ export class Http2Connection {
         /** @type {Uint8Array[]} */
         recvQueue: Uint8Array[];
         recvEnded: boolean;
+        /** @type {number | null} declared content-length, null when absent */
+        declaredLength: number | null;
+        receivedLength: number;
         /** @type {Error | null} */
         bodyError: Error | null;
         /** @type {(() => void) | null} */
@@ -187,6 +179,14 @@ export class Http2Connection {
     _dispatchFrame(frame: any): void;
     _onSettings(flags: any, streamId: any, payload: any): void;
     _onHeaders(flags: any, streamId: any, payload: any): void;
+    /**
+     * Enforce the raw header-block cap, killing the connection when it is passed.
+     * Connection-level rather than stream-level on purpose: the fragments are HPACK input, and
+     * abandoning a partial block would leave the shared decoder desynchronised for every other
+     * stream — which RFC 9113 s4.3 makes a connection error in its own right.
+     * @returns {boolean} true when assembly may continue
+     */
+    _headerBlockWithinCap(): boolean;
     _onContinuation(flags: any, payload: any): void;
     /** A full header block has been assembled: HPACK-decode it (connection-fatal on failure, since
      *  HPACK state is shared) and route it to the stream as a response head or as trailers. */
@@ -225,24 +225,6 @@ export class Http2Connection {
     _settleResolve(d: any, value: any): void;
     _settleReject(d: any, err: any): void;
 }
-export type BodyStream = ReadableStream<Uint8Array> & {
-    completed: Promise<boolean>;
-    trailers: Promise<Headers | null>;
-};
-export type Http2ResponseHead = {
-    status: number;
-    /**
-     * always '' — HTTP/2 has no reason phrase
-     */
-    statusText: string;
-    headers: Headers;
-    /**
-     * one entry per set-cookie field, kept separate like the h1 path
-     */
-    setCookie: string[];
-    httpVersion: "2";
-    body: BodyStream;
-};
 export type Http2ConnectionOptions = {
     /**
      * provenance attached to responses
@@ -270,12 +252,37 @@ export type Http2ConnectionOptions = {
      * self-protection cap on a decoded response header list.
      */
     maxHeaderListSize?: number | undefined;
+    /**
+     * cap on the RAW bytes of one HEADERS+CONTINUATION run,
+     * before HPACK decoding. Default 262144, matching the decoded cap. This is the bound that stops
+     * a CONTINUATION flood; `maxHeaderListSize` cannot, because it is only reachable once the whole
+     * block has been assembled in memory.
+     */
+    maxHeaderBlockBytes?: number | undefined;
     /**
      * called once when the connection dies, so a
      * registry can drop it.
      */
     onClose?: ((err: Error | null) => void) | undefined;
 };
+export type BodyStream = ReadableStream<Uint8Array> & {
+    completed: Promise<boolean>;
+    trailers: Promise<Headers | null>;
+};
+export type Http2ResponseHead = {
+    status: number;
+    /**
+     * always '' — HTTP/2 has no reason phrase
+     */
+    statusText: string;
+    headers: Headers;
+    /**
+     * one entry per set-cookie field, kept separate like the h1 path
+     */
+    setCookie: string[];
+    httpVersion: "2";
+    body: BodyStream;
+};
 import { Http2Error } from '../errors.js';
 import { ByteReader } from '../util/bytes.js';
 import { ByteWriter } from '../util/bytes.js';