Module transport 

Transport layer for submilli:http — the embedder-facing HttpClient / AuthProxy traits, the default reqwest client with SSRF policy, and the bounded download/decompression plumbing. No Wasm ABI here; the package’s host fns live in super.

Structs

DownloadMeta

Body was streamed to the caller’s writer; only metadata survives.

DownloadProgress

Progress remains observable when a download fails or is cancelled.

HttpRequest

HttpResponse

4xx/5xx are not errors at this layer — only transport failures become HttpError.

NoopAuthProxy

RecordedRequest

How the call log keys and digests a request: its masked URL, and the digest of its masked meta and body. The auth proxy may rewrite the URL and headers (a credential injected into the query or a header, in another position), so a transport that must recognize a request it saw recorded reads this instead of deriving it again.

RedirectDenied

A hop the guard refused. Transports return it unchanged as HttpError::PermissionDenied so the guest sees the original denial.

RedirectHop

The request a redirect is about to send.

ReqwestHttpClient

Default HttpClient — async reqwest, built with the SSRF policy resolver. Redirects are followed by ReqwestHttpClient::follow_redirects rather than reqwest, so every hop is checked against the request’s own policy and guard and the pooled client holds no per-request authorization. The cookies feature is intentionally never enabled, so the client carries no cross-request state; the server builds one per session (see submilli-server) for tenant isolation.

Enums

AuthProxyError

Decompression

EgressAt

Which request an egress refusal belongs to, for a guard that records decisions.

HttpError

Traits

AuthProxy

Pipeline: host fn → auth_proxy.transform(req, caller) → http_client.send(req). Consume-and-return so middlewares compose: m2.transform(m1.transform(req, c)?, c)?. caller is the package that made the call ("main" for the user’s script); blueprint auth-proxy injection applies only to main.

HttpClient

Embedder-supplied HTTP transport. 4xx/5xx are not errors; only transport failures return Err(HttpError). Send + Sync for sharing across stores. Implementations must enforce HttpRequest::transport_policy, including redirect destinations, and must call HttpRequest::redirect_guard before sending each redirect hop, returning its denial as HttpError::PermissionDenied; a transport that follows redirects without the guard bypasses the blueprint’s capability rules. Preserve HttpError::Internal as a fatal host failure.

RedirectGuard

Authorizes one redirect hop before any byte of it is sent.

Functions

default_auth_proxy

default_http_client

describe_error_chain

detect_decompression

Public so embedder HttpClient::download impls can apply the right decoder before counting bytes against max_response_size.

is_policy_refusal

Whether an error chain (as describe_error_chain renders it) is the network policy refusing the destination, which reaches a client builder’s caller as a connect error.

stream_to_writer

Bounded chunked copy (8 KiB stack chunk) with optional gzip/zstd decoding. Public so embedder HttpClient::download impls can reuse it: reader is the response body as it arrives, decoded into writer exactly as the built-in client decodes a download, with the same limits on the wire and decoded bytes.