Chunked Transfer Framing Verdict

Verifies HTTP/1.1 chunked-transfer-encoding framing against RFC 9112 section 7.1 before you trust the decoded body. Pure function over bytes you already have: a captured response, a replayed pcap payload, a test fixture. No I/O, no dependencies, no sockets.

THE SILENT FAILURE. Chunked framing is length-prefixed, so a decoder that is lenient about the prefix does not fail -- it returns a DIFFERENT body. A chunk-size line with a stray byte, a missing final CRLF, a trailer section that was never really a trailer: each one produces plausible bytes rather than an exception, and request smuggling lives in exactly this gap between what two implementations think the same bytes mean.

IT REFUSES RATHER THAN GUESSES. Every verdict is OK, REJECT with the reason and the BYTE OFFSET of the offending byte, or NOT_DETERMINABLE naming the fact it would need. It never answers OK for input it could not fully check -- that is the whole promise.

WHAT THE EVIDENCE IS WORTH, MEASURED. An independent reviewer reimplemented this package from the README and the RFCs alone, with no sight of the source. Their rival implementation passed all 112 tests then shipping, and the same suite caught a deliberately naive implementation -- so the suite was sound for everything it covered. They then probed the built artifact directly and found a class it had never exercised: a trailer field-name made of a control byte, a leading space, or DEL all returned OK, with the DEL byte silently DROPPED so the caller received an empty field-name beside a confident OK. RFC 9110 5.1 gives field-name = token; the guard had checked only for missing or empty. Fixed, and disabling the new guard now fails 11 tests.

That is the reason to buy the suite and not just the function: 112 passing tests AND an independent implementation agreeing with every one of them still left a whole byte-class unchecked. The tests are written from the SPEC, not from the implementation, so they keep their value if you rewrite the code underneath them.

VERIFIED: 130 tests, measured by running the suite, every mutation observed FAILING before restore.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function verifyChunkedFraming(input: Uint8Array | string): ChunkedFramingVerdict;