boring-http 2.0.3__tar.gz → 2.2.0__tar.gz

{boring_http-2.0.3 → boring_http-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: boring-http
-Version: 2.0.3
+Version: 2.2.0
 Summary: Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order
 Requires-Dist: boring-ssl2>=1.2.0
 Requires-Dist: ssl2>=2.0.1
@@ -42,7 +42,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
+Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
 
 ## Responses
 
@@ -100,6 +100,8 @@ asyncio.run(main())
 
 A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `connect` covers opening a connection, the proxy, TCP and the TLS or QUIC handshake included, `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
 
+A body is held to what the application reads: over HTTP/2 and HTTP/3 the stream window opens again only as chunks are taken, so a response nobody reads stops at one window (`INITIAL_WINDOW_SIZE` or `initial_max_stream_data_bidi_local`), while the connection window keeps opening on arrival so other streams go on. An HTTP/3 upload keeps at most 1 MiB of the body unsent before it asks the body for the next chunk; HTTP/1.1 and HTTP/2 uploads wait on the socket and the peer's window.
+
 ## HTTP/3
 
 ```python

{boring_http-2.0.3 → boring_http-2.2.0}/README.md

@@ -32,7 +32,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
+Certificates are checked against the system trust store, or against `trust_store=TrustStore.from_file(...)` from `ssl2`; `verify=False` turns the check off for a test server. Revocation is checked against the CRL the certificate names: fetched over HTTP, verified with the issuer from the chain, cached until its next update, and a listed certificate is refused with `RevocationError`. `revocation=Revocation.STRICT` also refuses when no valid CRL can be had, `Revocation.NONE` skips the check, and the default `Revocation.SOFT` lets such a connection through, as browsers do. The check covers the origin's certificate and an HTTPS proxy's own certificate on a plain-HTTP request through it; the proxy's certificate on a TLS tunnel is verified but not checked for revocation. `certificate_chain=SigningChain(...)` from `ssl2` presents a client certificate over TCP and QUIC. `check_peer=` is awaited with the peer's chain in DER, leaf first, and its authority after the same checks; raising from it refuses the connection, which is where a key pin goes. Connections are pooled per origin and proxy under `max_connections` and `max_connections_per_host`; one that has served nothing for `max_idle_time` seconds, 90 by default, is closed instead of reused, and `None` keeps it until the server closes it. Headers go on the wire in the order given, client headers first and then the request's own. `Host` leads an HTTP/1.1 request; HTTP/2 and HTTP/3 lowercase the names and drop the connection-specific ones, nothing else changes. `params`, `json`, `data`, `content`, `files`, `auth` and `cookies` are accepted by `get`, `post`, `put`, `patch`, `delete`, `head`, `options` and `request`.
 
 ## Responses
 
@@ -90,6 +90,8 @@ asyncio.run(main())
 
 A single number sets every phase and the total, so the request gives up after that many seconds whatever it was doing. With a `Timeout` the phases are separate: `connect` covers opening a connection, the proxy, TCP and the TLS or QUIC handshake included, `read` is the longest wait for the next bytes, `total` caps the whole exchange including redirects, and the error names whichever ran out.
 
+A body is held to what the application reads: over HTTP/2 and HTTP/3 the stream window opens again only as chunks are taken, so a response nobody reads stops at one window (`INITIAL_WINDOW_SIZE` or `initial_max_stream_data_bidi_local`), while the connection window keeps opening on arrival so other streams go on. An HTTP/3 upload keeps at most 1 MiB of the body unsent before it asks the body for the next chunk; HTTP/1.1 and HTTP/2 uploads wait on the socket and the peer's window.
+
 ## HTTP/3
 
 ```python

{boring_http-2.0.3 → boring_http-2.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "boring-http"
-version = "2.0.3"
+version = "2.2.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"

{boring_http-2.0.3 → boring_http-2.2.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "boring-http"
-version = "2.0.3"
+version = "2.2.0"
 description = "Asyncio HTTP client on BoringSSL: HTTP/1.1, HTTP/2 and HTTP/3 over QUIC v1 and v2, WebSocket on all three, HTTP and SOCKS proxies, headers in your order"
 readme = "README.md"
 requires-python = ">=3.14"

{boring_http-2.0.3 → boring_http-2.2.0}/src/boring_http/client.py

@@ -1,5 +1,12 @@
 import base64
-from collections.abc import AsyncGenerator, AsyncIterable, Mapping, Sequence
+from collections.abc import (
+    AsyncGenerator,
+    AsyncIterable,
+    Awaitable,
+    Callable,
+    Mapping,
+    Sequence,
+)
 from contextlib import asynccontextmanager
 from dataclasses import replace
 from time import monotonic
@@ -16,6 +23,7 @@ from ssl2 import (
     ProxyError,
     ProxyScheme,
     SessionCache,
+    SigningChain,
     SocketTransport,
     TLSClientConfiguration,
     TLSError,
@@ -107,10 +115,13 @@ class Client:
         trust_store: TrustStore | None = None,
         verify: bool = True,
         revocation: Revocation = Revocation.SOFT,
+        certificate_chain: SigningChain | None = None,
+        check_peer: Callable[[tuple[bytes, ...], str], Awaitable[None]] | None = None,
         cookies: CookieJar | None = None,
         base_url: str | None = None,
         max_connections: int = 100,
         max_connections_per_host: int = 10,
+        max_idle_time: float | None = 90.0,
         max_redirects: int = 20,
         max_message_size: int = 16 * 1024 * 1024,
         decode: bool = True,
@@ -138,13 +149,17 @@ class Client:
         self._trust_store = trust_store
         self._verify = verify
         self._revocations = Revocations(revocation, self._fetch_crl)
+        self._certificate_chain = certificate_chain
+        self._check_peer = check_peer
         self._base_url = base_url
         self._max_redirects = max_redirects
         self._max_message_size = max_message_size
         self._decode = decode
         self._contexts: dict[tuple[NextProtocol, ...] | None, ClientContext] = {}
         self._memory: dict[tuple[str, int], OriginMemory] = {}
-        self._pool = Pool(self._connect, max_connections, max_connections_per_host)
+        self._pool = Pool(
+            self._connect, max_connections, max_connections_per_host, max_idle_time
+        )
         self.cookies = CookieJar() if cookies is None else cookies
 
     async def __aenter__(self) -> Self:
@@ -442,12 +457,14 @@ class Client:
                     ALPN[version] for version in self._versions if version in ALPN
                 )
                 configuration = TLSClientConfiguration(
+                    certificate_chain=self._certificate_chain,
                     trust_store=self._trust_store,
                     inner_protocols=offered,
                     verify_certificates=self._verify,
                 )
             else:
                 configuration = TLSClientConfiguration(
+                    certificate_chain=self._certificate_chain,
                     trust_store=self._trust_store,
                     client_hello=hello,
                     verify_certificates=self._verify,
@@ -487,11 +504,16 @@ class Client:
 
     async def _checked(self, stream: TLSStream, authority: str) -> None:
         try:
-            await self._revocations.check(stream.buffer.getpeerchain(), authority)
-        except RevocationError:
+            await self._verified(stream.buffer.getpeerchain(), authority)
+        except BaseException:
             await stream.close()
             raise
 
+    async def _verified(self, chain: tuple[bytes, ...], authority: str) -> None:
+        await self._revocations.check(chain, authority)
+        if self._check_peer is not None:
+            await self._check_peer(chain, authority)
+
     async def _fetch_crl(self, url: str) -> bytes:
         async with Client(
             versions=(HTTPVersion.HTTP_1,), revocation=Revocation.NONE, timeout=10
@@ -519,10 +541,8 @@ class Client:
                     memory=memory,
                 )
                 try:
-                    await self._revocations.check(
-                        client.connection.peer_chain, url.authority
-                    )
-                except RevocationError:
+                    await self._verified(client.connection.peer_chain, url.authority)
+                except BaseException:
                     client.close()
                     raise
                 connection = Http3Connection(client, self._http3, memory)

{boring_http-2.0.3 → boring_http-2.2.0}/src/boring_http/cookies.py

@@ -7,14 +7,6 @@ from typing import Self
 from boring_http.public_suffixes import EXCEPTIONS, RULES
 
 
-def is_public_suffix(domain: str) -> bool:
-    # publicsuffix.org's algorithm: an exception rule wins, then a listed rule or a wildcard over the parent, and an unlisted top-level label is one
-    if domain in EXCEPTIONS:
-        return False
-    parent = domain.partition(".")[2]
-    return domain in RULES or f"*.{parent}" in RULES or not parent
-
-
 @dataclass(frozen=True, slots=True)
 class Cookie:
     name: str
@@ -57,7 +49,7 @@ class Cookie:
         if domain and not (host == domain or host.endswith("." + domain)):
             return None
         # RFC 6265 section 5.3 step 5: a public suffix as Domain is refused, unless it is the host itself, which keeps the cookie to that host
-        if domain and is_public_suffix(domain):
+        if domain and cls._public_suffix(domain):
             if domain != host:
                 return None
             domain = ""
@@ -92,6 +84,14 @@ class Cookie:
             domain_ok and path_ok and (secure or not self.secure) and not self.expired
         )
 
+    @staticmethod
+    def _public_suffix(domain: str) -> bool:
+        # publicsuffix.org's algorithm: an exception rule wins, then a listed rule or a wildcard over the parent, and an unlisted top-level label is one
+        if domain in EXCEPTIONS:
+            return False
+        parent = domain.partition(".")[2]
+        return domain in RULES or f"*.{parent}" in RULES or not parent
+
     @staticmethod
     def _date(text: str) -> float | None:
         try:

{boring_http-2.0.3 → boring_http-2.2.0}/src/boring_http/http2.py

@@ -105,7 +105,8 @@ class Http2Stream:
         self.waiter: asyncio.Future[None] | None = None
         self.trailers = Headers()
         self.block = bytearray()
-        self.received = 0
+        # what the application took since the last WINDOW_UPDATE for this stream
+        self.consumed = 0
         self.finished = False
 
     def fail(self, error: BaseException) -> None:
@@ -382,7 +383,9 @@ class Http2Connection:
         try:
             while True:
                 if stream.chunks:
-                    yield stream.take()
+                    data = stream.take()
+                    await self.credit(stream, len(data))
+                    yield data
                 elif stream.error is not None:
                     raise stream.error
                 elif stream.finished:
@@ -409,6 +412,24 @@ class Http2Connection:
                 )
             )
 
+    async def credit(self, stream: Http2Stream, size: int) -> None:
+        # the stream window opens again as the application takes data, so a reader that stops holds the server at one window
+        stream.consumed += size
+        if (
+            stream.consumed > self._local_window // 2
+            and not stream.finished
+            and not self.closed
+        ):
+            increment, stream.consumed = stream.consumed, 0
+            await self._write(
+                self._frame(
+                    FrameType.WINDOW_UPDATE,
+                    0,
+                    stream.identifier,
+                    struct.pack("!I", increment),
+                )
+            )
+
     async def _write(self, data: bytes) -> None:
         async with self._write_lock:
             await self._transport.write(data)
@@ -512,15 +533,7 @@ class Http2Connection:
             if flags & END_STREAM:
                 stream.finished = True
             stream.wake()
-            stream.received += len(payload)
-            if stream.received > self._local_window // 2 and not stream.finished:
-                updates = self._frame(
-                    FrameType.WINDOW_UPDATE,
-                    0,
-                    identifier,
-                    struct.pack("!I", stream.received),
-                )
-                stream.received = 0
+        # the connection window opens on arrival, so one stream that is not read leaves the others their share
         self._connection_received += len(payload)
         if self._connection_received > self._connection_window // 2:
             updates += self._frame(
@@ -657,6 +670,7 @@ class Http2StreamTransport:
         while not self._pending:
             if stream.chunks:
                 self._pending = stream.take()
+                await self._connection.credit(stream, len(self._pending))
             elif stream.error is not None:
                 raise stream.error
             elif stream.finished:

{boring_http-2.0.3 → boring_http-2.2.0}/src/boring_http/http3.py

@@ -94,6 +94,8 @@ class Http3Settings:
 
 # RFC 8470 section 5.2: the requests a client may send before the handshake, since a server may see them twice
 SAFE_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
+# how much of a body may wait unsent in its QUIC stream before the next chunk is taken from the caller
+SEND_BUFFER = 1 << 20
 
 
 class StreamFrames:
@@ -266,6 +268,7 @@ class Http3Connection:
             async with deadline.phase("write"):
                 async for chunk in request.body.chunks():
                     self._quic.send(stream_id, self._frame(FrameType.DATA, chunk))
+                    await self._quic.drain(stream_id, SEND_BUFFER)
                 self._quic.send(stream_id, b"", end=True)
         frames = StreamFrames(self._quic, stream_id, deadline)
         status, headers = await self._response_head(frames, stream_id)
@@ -554,6 +557,8 @@ class Http3StreamTransport:
             + Writer.encode_varint(len(data))
             + data,
         )
+        async with self._deadline.phase("write"):
+            await self._quic.drain(self._stream_id, SEND_BUFFER)
 
     async def close(self) -> None:
         if not self._closed:

{boring_http-2.0.3 → boring_http-2.2.0}/src/boring_http/pool.py

@@ -1,5 +1,6 @@
 import asyncio
 from collections.abc import Awaitable, Callable
+from time import monotonic
 from typing import Protocol
 
 from ssl2 import Proxy
@@ -35,15 +36,23 @@ type Connector = Callable[[URL, Proxy | None, bool], Awaitable[Connection]]
 
 class Pool:
     def __init__(
-        self, connector: Connector, max_connections: int, max_connections_per_host: int
+        self,
+        connector: Connector,
+        max_connections: int,
+        max_connections_per_host: int,
+        max_idle_time: float | None,
     ) -> None:
         self._connector = connector
         self._per_host = max_connections_per_host
         self._total = asyncio.Semaphore(max_connections)
+        self._max_idle_time = max_idle_time
         self._limits: dict[Key, asyncio.Semaphore] = {}
         self._locks: dict[Key, asyncio.Lock] = {}
         self._changes: dict[Key, asyncio.Event] = {}
         self._connections: dict[Key, list[Connection]] = {}
+        # the requests each connection is serving, and when it last became idle
+        self._in_use: dict[Connection, int] = {}
+        self._idle_since: dict[Connection, float] = {}
 
     async def acquire(
         self, url: URL, proxy: Proxy | None, deadline: Deadline, *, quic: bool = False
@@ -53,10 +62,13 @@ class Pool:
         changed = self._changes.setdefault(key, asyncio.Event())
         async with self._locks.setdefault(key, asyncio.Lock()):
             while True:
-                for connection in self._connections.get(key, []):
-                    if connection.available:
+                for connection in list(self._connections.get(key, [])):
+                    if self._expired(connection):
+                        await connection.close()
+                    elif connection.available:
                         connection.take()
                         connection.reused = True
+                        self._in_use[connection] += 1
                         return connection
                 if not limit.locked() and not self._total.locked():
                     break
@@ -77,6 +89,7 @@ class Pool:
             connection.take()
             connection.released = lambda: self._changed(key, connection, limit)
             self._connections.setdefault(key, []).append(connection)
+            self._in_use[connection] = 1
             return connection
 
     async def close(self) -> None:
@@ -91,6 +104,21 @@ class Pool:
         connections = self._connections.get(key, [])
         if connection.closed and connection in connections:
             connections.remove(connection)
+            del self._in_use[connection]
+            self._idle_since.pop(connection, None)
             limit.release()
             self._total.release()
+        elif connection in self._in_use:
+            self._in_use[connection] = max(self._in_use[connection] - 1, 0)
+            if not self._in_use[connection]:
+                self._idle_since[connection] = monotonic()
         self._changes[key].set()
+
+    def _expired(self, connection: Connection) -> bool:
+        idle_since = self._idle_since.get(connection)
+        return (
+            self._max_idle_time is not None
+            and idle_since is not None
+            and not self._in_use[connection]
+            and monotonic() - idle_since > self._max_idle_time
+        )

{boring_http-2.0.3 → boring_http-2.2.0}/src/boring_http/quic/connection.py

@@ -499,6 +499,29 @@ class QuicConnection:
         if end:
             stream.end()
 
+    def unsent(self, stream_id: int) -> int:
+        stream = self._send_streams.get(stream_id)
+        return 0 if stream is None else stream.unsent
+
+    def stream_read(self, stream_id: int, size: int) -> bool:
+        # the stream window opens again as the application takes data, so a reader that stops holds the server at one window
+        receive = self._receive_streams.get(stream_id)
+        if receive is None or receive.final_size is not None:
+            return False
+        receive.read += size
+        window = (
+            self._parameters.initial_max_stream_data_bidi_local
+            if stream_id % 4 < 2
+            else self._parameters.initial_max_stream_data_uni
+        )
+        if receive.max_data - receive.read >= window // 2:
+            return False
+        receive.max_data = receive.read + window
+        self._pending[EncryptionLevel.APPLICATION].append(
+            MaxStreamData(stream_id, receive.max_data)
+        )
+        return True
+
     def reset_stream(self, stream_id: int, error: int) -> None:
         stream = self._send_streams.get(stream_id)
         if stream is not None and not stream.reset_sent:
@@ -935,16 +958,6 @@ class QuicConnection:
             if data:
                 receive.chunks.append(data)
             self._readable[stream_id] = receive
-            window = (
-                self._parameters.initial_max_stream_data_bidi_local
-                if bidirectional
-                else self._parameters.initial_max_stream_data_uni
-            )
-            if receive.max_data - receive.consumed < window // 2 and not end:
-                receive.max_data = receive.consumed + window
-                self._pending[EncryptionLevel.APPLICATION].append(
-                    MaxStreamData(stream_id, receive.max_data)
-                )
             if end:
                 del self._receive_streams[stream_id]
         if (

{boring_http-2.0.3 → boring_http-2.2.0}/src/boring_http/quic/protocol.py

@@ -135,6 +135,8 @@ class QuicClient:
         )
         self._inboxes: dict[int, Inbox] = {}
         self._unsent: deque[bytes] = deque()
+        # set after every flush, so a writer waiting for its stream to drain looks again
+        self._progress = asyncio.Event()
         self._closed = False
         self.incoming: asyncio.Queue[int] = asyncio.Queue()
         self.datagrams: asyncio.Queue[bytes] = asyncio.Queue()
@@ -261,7 +263,10 @@ class QuicClient:
         while True:
             if inbox.chunks:
                 chunks, inbox.chunks = inbox.chunks, []
-                return chunks[0] if len(chunks) == 1 else b"".join(chunks)
+                data = chunks[0] if len(chunks) == 1 else b"".join(chunks)
+                if self._connection.stream_read(stream_id, len(data)):
+                    self._flush_soon()
+                return data
             if inbox.error is not None:
                 raise inbox.error
             if inbox.ended:
@@ -270,6 +275,17 @@ class QuicClient:
             await inbox.waiter
             inbox.waiter = None
 
+    async def drain(self, stream_id: int, limit: int) -> None:
+        # a writer waits while more than limit bytes of its stream are unsent, so a large body is never queued whole
+        while self._connection.unsent(stream_id) > limit:
+            inbox = self._inboxes.get(stream_id)
+            if inbox is not None and inbox.error is not None:
+                raise inbox.error
+            if self._terminated.done():
+                raise RemoteDisconnected("QUIC connection closed with data unsent")
+            self._progress.clear()
+            await self._progress.wait()
+
     def close(self, error: int = 0, reason: str = "") -> None:
         if not self._terminated.done():
             self._connection.close(error, reason)
@@ -385,6 +401,7 @@ class QuicClient:
                 # these count as lost, and the connection goes back to the size every path carries
                 self._connection.datagram_too_long()
             index = end
+        self._progress.set()
         self._dispatch()
         self._arm_timer()
         if len(datagrams) >= MAX_BURST and not self._unsent and self._pacer is None:
@@ -492,3 +509,4 @@ class QuicClient:
             inbox.wake()
         if not self._terminated.done():
             self._terminated.set_result(ConnectionTerminated(0, str(error), False))
+        self._progress.set()

{boring_http-2.0.3 → boring_http-2.2.0}/src/boring_http/quic/streams.py

@@ -24,6 +24,10 @@ class SendStream:
     def active(self) -> bool:
         return bool(self.pending) or (self.ended and not self.fin_sent)
 
+    @property
+    def unsent(self) -> int:
+        return sum(len(data) for _, data in self.pending) - self.position
+
     def write(self, data: bytes) -> None:
         if self.ended:
             raise ProtocolError(f"stream {self.stream_id} already ended")
@@ -90,6 +94,8 @@ class ReceiveStream:
         self.stream_id = stream_id
         self.max_data = max_data
         self.consumed = 0
+        # what the application has taken, which is what moves max_data
+        self.read = 0
         # in-order data the application has not been handed yet
         self.chunks: list[bytes] = []
         self.fragments: dict[int, bytes] = {}