code wiki / _hdl_build / nx_host_router.nx
`nx_host_router.nx` source

↩ module page · 764 lines · 40120 B
1// nx_host_router.nx -- S-class sovereign multi-site host router (pure Nishi, no TLS, no crypto).
2// Config-driven vhost table + PER-REQUEST file serving = HOT CONTENT LOADING: push a file, it is
3// live on the next request, NO recompile. Path-traversal-safe. This is L5 (content) of the sovereign
4// hosting design (knowledge/research/2026-06-05-sovereign-web-hosting.md). Composed into the TLS
5// daemon, which supplies L3/L4. license_tier: ORIGINAL
6import "nx_syscalls.nx"
7const HR_MAGIC_1024: i64 = 1024
8const HR_MAGIC_4096: i64 = 4096
9const HR_MAGIC_5120: i64 = 5120
10const HR_MAGIC_2048: i64 = 2048
11const HR_MAGIC_4095: i64 = 4095
12
13func hr_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
14
15func hr_copy(dst: *u8, src: *u8, n: i64) -> i64 { var i: i64 = 0; while i < n { dst[i] = src[i]; i = i + 1 } return n }
16
17func hr_eq(a: *u8, b: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i < n { if a[i] != b[i] { return 0 } i = i + 1 }
  return 1
21}
22
23func hr_lower(c: u8) -> u8 {
  if c >= (65 as u8) { if c <= (90 as u8) { return (c + (32 as u8)) } }
  return c
26}
27
28func hr_ieq(a: *u8, b: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i < n { if hr_lower(a[i]) != hr_lower(b[i]) { return 0 } i = i + 1 }
  return 1
32}
33
34// Decimal-render v into out; return digit count (no modulo operator dependency).
35func hr_putdec(out: *u8, v: i64) -> i64 {
  if v == 0 { out[0] = (48 as u8); return 1 }
  let tmp: *u8 = sys_mmap(32)
  var n: i64 = 0
  var x: i64 = v
  while x > 0 {
      let q: i64 = x / 10
      let r: i64 = x - q * 10
      tmp[n] = ((48 + r) as u8)
      n = n + 1
      x = q
  }
  var i: i64 = 0
  while i < n { out[i] = tmp[n - 1 - i]; i = i + 1 }
  return n
50}
51
52// Extract the request path ("GET <path> HTTP/1.1") into out (NUL-terminated); drop any ?query.
53func hr_req_path(req: *u8, reqn: i64, out: *u8, cap: i64) -> i64 {
  var i: i64 = 0
  while i < reqn { if req[i] == (32 as u8) { break } i = i + 1 }
  i = i + 1
  var j: i64 = 0
  while i < reqn {
      let c: u8 = req[i]
      if c == (32 as u8) { break }
      if c == (63 as u8) { break }
      if j < cap - 1 { out[j] = c; j = j + 1 }
      i = i + 1
  }
  out[j] = (0 as u8)
  return j
67}
68
69// Extract the ?query of the request line INCLUDING the leading '?' (empty -> 0). seq365: the canonical
70// 301 used to rebuild Location from the PATH alone, silently dropping ?room=&k=... from parameterized
71// links (family invites, probe URLs). Redirects must CARRY the query; this is its one extractor.
72func hr_req_query(req: *u8, reqn: i64, out: *u8, cap: i64) -> i64 {
  var i: i64 = 0
  while i < reqn { if req[i] == (32 as u8) { break } i = i + 1 }
  i = i + 1
  var q: i64 = 0 - 1
  while i < reqn {
      let c: u8 = req[i]
      if c == (32 as u8) { break }
      if c == (63 as u8) { q = i; break }
      i = i + 1
  }
  if q < 0 { out[0] = (0 as u8); return 0 }
  var j: i64 = 0
  while q < reqn {
      let c2: u8 = req[q]
      if c2 == (32 as u8) { break }
      if c2 == (13 as u8) { break }
      if c2 == (10 as u8) { break }
      if j < cap - 1 { out[j] = c2; j = j + 1 }
      q = q + 1
  }
  out[j] = (0 as u8)
  return j
95}
96
97// Extract the Host header (lowercased, port stripped) into out (NUL-terminated).
98func hr_req_host(req: *u8, reqn: i64, out: *u8, cap: i64) -> i64 {
  var i: i64 = 0
  var found: i64 = 0 - 1
  while i + 5 <= reqn {
      if hr_ieq(((req as i64 + i) as *u8), "host:" as *u8, 5) == 1 { found = i + 5; break }
      i = i + 1
  }
  if found < 0 { out[0] = (0 as u8); return 0 }
  var k: i64 = found
  while k < reqn { if req[k] == (32 as u8) { k = k + 1 } else { break } }
  var j: i64 = 0
  while k < reqn {
      let c: u8 = req[k]
      if c == (13 as u8) { break }
      if c == (10 as u8) { break }
      if c == (58 as u8) { break }
      if c == (32 as u8) { break }
      if j < cap - 1 { out[j] = hr_lower(c); j = j + 1 }
      k = k + 1
  }
  out[j] = (0 as u8)
  return j
120}
121
122// Find the doc root for host in the config (lines "<host> <root>"; '#' comment; '*' wildcard default).
123// Exact host wins over wildcard regardless of line order. Returns root length (0 = no match).
124func hr_lookup_root(cfg: *u8, cfgn: i64, host: *u8, hostn: i64, out: *u8, cap: i64) -> i64 {
  var i: i64 = 0
  var wild: i64 = 0 - 1
  var wildlen: i64 = 0
  while i < cfgn {
      while i < cfgn { let c: u8 = cfg[i]; if c == (32 as u8) { i = i + 1 } else { if c == (9 as u8) { i = i + 1 } else { break } } }
      if i < cfgn {
          if cfg[i] == (35 as u8) {
              while i < cfgn { if cfg[i] == (10 as u8) { break } i = i + 1 }
              i = i + 1
              continue
          }
      }
      let htok: i64 = i
      while i < cfgn { let c: u8 = cfg[i]; if c == (32 as u8) { break } if c == (9 as u8) { break } if c == (10 as u8) { break } if c == (13 as u8) { break } i = i + 1 }
      let htoklen: i64 = i - htok
      while i < cfgn { let c: u8 = cfg[i]; if c == (32 as u8) { i = i + 1 } else { if c == (9 as u8) { i = i + 1 } else { break } } }
      let rtok: i64 = i
      while i < cfgn { let c: u8 = cfg[i]; if c == (32 as u8) { break } if c == (9 as u8) { break } if c == (10 as u8) { break } if c == (13 as u8) { break } i = i + 1 }
      let rtoklen: i64 = i - rtok
      while i < cfgn { if cfg[i] == (10 as u8) { break } i = i + 1 }
      i = i + 1
      if htoklen == hostn {
          if hr_eq(((cfg as i64 + htok) as *u8), host, hostn) == 1 {
              if rtoklen > 0 { hr_copy(out, ((cfg as i64 + rtok) as *u8), rtoklen); out[rtoklen] = (0 as u8); return rtoklen }
          }
      }
      if htoklen == 1 { if cfg[htok] == (42 as u8) { if rtoklen > 0 { wild = rtok; wildlen = rtoklen } } }
  }
  if wild >= 0 { if wildlen > 0 { hr_copy(out, ((cfg as i64 + wild) as *u8), wildlen); out[wildlen] = (0 as u8); return wildlen } }
  return 0
155}
156
157// Reject path traversal / NUL / non-absolute. Conservative: any ".." anywhere fails.
158func hr_path_safe(path: *u8, pathn: i64) -> i64 {
  if pathn == 0 { return 0 }
  if path[0] != (47 as u8) { return 0 }
  var i: i64 = 0
  while i < pathn {
      if path[i] == (0 as u8) { return 0 }
      if path[i] == (46 as u8) { if i + 1 < pathn { if path[i + 1] == (46 as u8) { return 0 } } }
      i = i + 1
  }
  return 1
168}
169
170// Join root + path into out; append index.html when the path ends in '/'.
171func hr_resolve(root: *u8, rootn: i64, path: *u8, pathn: i64, out: *u8, cap: i64) -> i64 {
  var j: i64 = 0
  var i: i64 = 0
  while i < rootn { if j < cap - 1 { out[j] = root[i]; j = j + 1 } i = i + 1 }
  if j > 0 { if out[j - 1] == (47 as u8) { j = j - 1 } }
  i = 0
  while i < pathn { if j < cap - 1 { out[j] = path[i]; j = j + 1 } i = i + 1 }
  if pathn > 0 {
      if path[pathn - 1] == (47 as u8) {
          // path ends in '/': append index.html
          let idx: *u8 = "index.html" as *u8
          var k: i64 = 0
          while idx[k] != (0 as u8) { if j < cap - 1 { out[j] = idx[k]; j = j + 1 } k = k + 1 }
      } else {
          // bare path: if the last segment has no '.', it is a directory ->
          // append /index.html so a CLEAN URL (e.g. /econsim) serves the page
          // instead of reading the dir as a 0-byte octet-stream download.
          var seg_has_dot: i64 = 0
          var s: i64 = pathn - 1
          while s >= 0 {
              if path[s] == (47 as u8) { break }
              if path[s] == (46 as u8) { seg_has_dot = 1; break }
              s = s - 1
          }
          if seg_has_dot == 0 {
              let idx2: *u8 = "/index.html" as *u8
              var k2: i64 = 0
              while idx2[k2] != (0 as u8) { if j < cap - 1 { out[j] = idx2[k2]; j = j + 1 } k2 = k2 + 1 }
          }
      }
  }
  out[j] = (0 as u8)
  return j
204}
205
206// MIME by extension.
207func hr_ctype(file: *u8, filen: i64) -> *u8 {
  var dot: i64 = 0 - 1
  var i: i64 = 0
  while i < filen { if file[i] == (46 as u8) { dot = i } i = i + 1 }
  if dot < 0 { return "application/octet-stream" as *u8 }
  let ext: *u8 = (file as i64 + dot) as *u8
  if hr_ieq(ext, ".html" as *u8, 5) == 1 { return "text/html; charset=utf-8" as *u8 }
  if hr_ieq(ext, ".htm" as *u8, 4) == 1 { return "text/html; charset=utf-8" as *u8 }
  if hr_ieq(ext, ".css" as *u8, 4) == 1 { return "text/css; charset=utf-8" as *u8 }
  if hr_ieq(ext, ".json" as *u8, 5) == 1 { return "application/json" as *u8 }
  // .xml (2026-07-30): sitemap.xml was being served as application/octet-stream because the map had no
  // XML row -- the one file on the site whose entire purpose is to be parsed by a machine was the one
  // told it was an opaque blob. RFC 7303 media type; sitemaps.org expects an XML content type.
  if hr_ieq(ext, ".xml" as *u8, 4) == 1 { return "application/xml; charset=utf-8" as *u8 }
  if hr_ieq(ext, ".js" as *u8, 3) == 1 { return "application/javascript" as *u8 }
  if hr_ieq(ext, ".png" as *u8, 4) == 1 { return "image/png" as *u8 }
  if hr_ieq(ext, ".jpg" as *u8, 4) == 1 { return "image/jpeg" as *u8 }
  if hr_ieq(ext, ".jpeg" as *u8, 5) == 1 { return "image/jpeg" as *u8 }
  if hr_ieq(ext, ".svg" as *u8, 4) == 1 { return "image/svg+xml" as *u8 }
  if hr_ieq(ext, ".gif" as *u8, 4) == 1 { return "image/gif" as *u8 }
  if hr_ieq(ext, ".txt" as *u8, 4) == 1 { return "text/plain; charset=utf-8" as *u8 }
  if hr_ieq(ext, ".ico" as *u8, 4) == 1 { return "image/x-icon" as *u8 }
  if hr_ieq(ext, ".pdf" as *u8, 4) == 1 { return "application/pdf" as *u8 }
  if hr_ieq(ext, ".webmanifest" as *u8, 12) == 1 { return "application/manifest+json" as *u8 }
  if hr_ieq(ext, ".wasm" as *u8, 5) == 1 { return "application/wasm" as *u8 }
  if hr_ieq(ext, ".mp4" as *u8, 4) == 1 { return "video/mp4" as *u8 }
  if hr_ieq(ext, ".webm" as *u8, 5) == 1 { return "video/webm" as *u8 }
  if hr_ieq(ext, ".woff2" as *u8, 6) == 1 { return "font/woff2" as *u8 }
  // interop artifacts (the office/coordination second-half): calendar subscribe + office docs
  if hr_ieq(ext, ".ics" as *u8, 4) == 1 { return "text/calendar; charset=utf-8" as *u8 }
  if hr_ieq(ext, ".docx" as *u8, 5) == 1 { return "application/vnd.openxmlformats-officedocument.wordprocessingml.document" as *u8 }
  if hr_ieq(ext, ".xlsx" as *u8, 5) == 1 { return "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" as *u8 }
  if hr_ieq(ext, ".pptx" as *u8, 5) == 1 { return "application/vnd.openxmlformats-officedocument.presentationml.presentation" as *u8 }
  if hr_ieq(ext, ".odt" as *u8, 4) == 1 { return "application/vnd.oasis.opendocument.text" as *u8 }
  if hr_ieq(ext, ".eml" as *u8, 4) == 1 { return "message/rfc822" as *u8 }
  return "application/octet-stream" as *u8
243}
244
245// Emit a full HTTP/1.1 response (status line + Content-Type + Content-Length + body) into out.
246func hr_emit(out: *u8, statusline: *u8, ctype: *u8, body: *u8, bodyn: i64) -> i64 {
  var j: i64 = 0
  var k: i64 = 0
  while statusline[k] != (0 as u8) { out[j] = statusline[k]; j = j + 1; k = k + 1 }
  let h1: *u8 = "\r\nContent-Type: " as *u8
  k = 0; while h1[k] != (0 as u8) { out[j] = h1[k]; j = j + 1; k = k + 1 }
  k = 0; while ctype[k] != (0 as u8) { out[j] = ctype[k]; j = j + 1; k = k + 1 }
  let h2: *u8 = "\r\nContent-Length: " as *u8
  k = 0; while h2[k] != (0 as u8) { out[j] = h2[k]; j = j + 1; k = k + 1 }
  j = j + hr_putdec(((out as i64 + j) as *u8), bodyn)
  let h3: *u8 = "\r\nConnection: close\r\nX-Served-By: nishi-host\r\n\r\n" as *u8
  k = 0; while h3[k] != (0 as u8) { out[j] = h3[k]; j = j + 1; k = k + 1 }
  var b: i64 = 0
  while b < bodyn { out[j] = body[b]; j = j + 1; b = b + 1 }
  return j
261}
262
263// Does the request's Host match a configured site? Lets the daemon route ONLY config hosts
264// through the file server and fall back to its legacy routing (e.g. the wiki) for the rest.
265func hr_known_host(cfg: *u8, cfgn: i64, req: *u8, reqn: i64) -> i64 {
  if cfgn <= 0 { return 0 }
  let host: *u8 = sys_mmap(256)
  let root: *u8 = sys_mmap(HR_MAGIC_1024)
  let hn: i64 = hr_req_host(req, reqn, host, 256)
  if hr_lookup_root(cfg, cfgn, host, hn, root, HR_MAGIC_1024) > 0 { return 1 }
  return 0
272}
273
274// Full pipeline: request bytes + config -> HTTP response bytes in out. Reads the file PER REQUEST
275// (hot content). outcap must hold headers + file. Returns response length.
276func hr_serve(cfg: *u8, cfgn: i64, req: *u8, reqn: i64, out: *u8, outcap: i64) -> i64 {
  let host: *u8 = sys_mmap(256)
  let path: *u8 = sys_mmap(HR_MAGIC_4096)
  let root: *u8 = sys_mmap(HR_MAGIC_1024)
  let file: *u8 = sys_mmap(HR_MAGIC_5120)
  let hn: i64 = hr_req_host(req, reqn, host, 256)
  let pn: i64 = hr_req_path(req, reqn, path, HR_MAGIC_4096)
  let rn: i64 = hr_lookup_root(cfg, cfgn, host, hn, root, HR_MAGIC_1024)
  if rn == 0 {
      let b0: *u8 = "<!doctype html><meta charset=utf-8><title>404</title><h1>404 &mdash; unknown host</h1>" as *u8
      return hr_emit(out, "HTTP/1.1 404 Not Found" as *u8, "text/html; charset=utf-8" as *u8, b0, hr_slen(b0))
  }
  if hr_path_safe(path, pn) == 0 {
      let b1: *u8 = "<!doctype html><meta charset=utf-8><title>400</title><h1>400 &mdash; bad path</h1>" as *u8
      return hr_emit(out, "HTTP/1.1 400 Bad Request" as *u8, "text/html; charset=utf-8" as *u8, b1, hr_slen(b1))
  }
  let fnlen: i64 = hr_resolve(root, rn, path, pn, file, HR_MAGIC_5120)
  let lenbox: *i64 = (sys_mmap(8)) as *i64
  lenbox[0] = 0
  let data: *u8 = sys_read_file(file, lenbox)
  if (data as i64) == 0 {
      let b2: *u8 = "<!doctype html><meta charset=utf-8><title>404</title><h1>404 &mdash; not found</h1>" as *u8
      return hr_emit(out, "HTTP/1.1 404 Not Found" as *u8, "text/html; charset=utf-8" as *u8, b2, hr_slen(b2))
  }
  let dn: i64 = lenbox[0]
  let ct: *u8 = hr_ctype(file, fnlen)
  return hr_emit(out, "HTTP/1.1 200 OK" as *u8, ct, data, dn)
303}
304
305// ===== v2: bounds-checked, keep-alive, fallthrough-aware serving =====
306// (ADDITIVE -- hr_serve/hr_emit above are unchanged; the deployed daemon's
307// behaviour is bit-identical until it opts into hr_serve2.)
308
309// Bounds-checked emit. Writes status + Content-Type + Content-Length +
310// keep-alive headers + body into out; returns total length, or -1 if it
311// would not fit in outcap (caller turns that into a 500).  Keep-alive (not
312// close) so one TLS handshake serves the whole page's assets.
313// Asset cache window. HTML is NEVER cached (the slot rotates on a 60s window and the served-impression
314// counter rides the HTML, so a cached page would freeze both rotation and billing); an asset is a
315// different fact. Bounded rather than immutable because house creatives sit at STABLE urls -- anything
316// uploaded through nx_adnet_creative is content-addressed and could safely take far longer.
317// DECLARED ABOVE ITS READER ON PURPOSE: nx_parse refuses a forward const read rather than silently
318// letting it evaluate to 0, which would have emitted "max-age=0" and looked like it worked.
319const HR_ASSET_MAXAGE: i64 = 3600
320
321func hr_emit_b(out: *u8, outcap: i64, statusline: *u8, ctype: *u8, body: *u8, bodyn: i64) -> i64 {
  // headers are < 800 bytes for any status/ctype string (CORS + long office ctypes + the SOTA security header set: CSP/HSTS/nosniff/X-Frame-Options/Referrer-Policy)
  // ROOT FIX (2026-07-31, debt 1785513321). This was a BLANKET RESERVE: `bodyn + HR_MAGIC_1024 > outcap`,
  // which for outcap=1024 is true for ANY non-empty body -- so hr_serve2's TOOBIG branch could never emit
  // its own 500 and an oversize file became a SILENT CONNECTION DROP instead of an error. A guard that
  // cannot be satisfied produces a bypass, not safety. nx_host_router2_test asserted the 500 and had been
  // RED on that tooth, uncompiled and unnoticed.
  // Now bounded PRECISELY: refuse an outcap too small to hold the header block at all, then check the
  // ACTUAL accumulated header length against the body before writing a single body byte.
  if outcap < HR_MAGIC_1024 { return 0 - 1 }
  var j: i64 = 0
  var k: i64 = 0
  while statusline[k] != (0 as u8) { out[j] = statusline[k]; j = j + 1; k = k + 1 }
  let h1: *u8 = "\r\nContent-Type: " as *u8
  k = 0; while h1[k] != (0 as u8) { out[j] = h1[k]; j = j + 1; k = k + 1 }
  k = 0; while ctype[k] != (0 as u8) { out[j] = ctype[k]; j = j + 1; k = k + 1 }
  let h2: *u8 = "\r\nContent-Length: " as *u8
  k = 0; while h2[k] != (0 as u8) { out[j] = h2[k]; j = j + 1; k = k + 1 }
  j = j + hr_putdec(((out as i64 + j) as *u8), bodyn)
  // F1120 CROSS-ORIGIN ISOLATION (2026-07-28; /video/capprobe MEASURED crossOriginIsolated=false as
  // the R1 blocker): COOP same-origin + COEP require-corp are what let a page use SharedArrayBuffer =
  // wasm THREADS = tile-parallel sovereign encode (the 60fps+/4K multiplier). BLAST RADIUS NEAR-ZERO
  // BY CONSTRUCTION: the CSP here is already default-src 'self', so every subresource is same-origin
  // and CORP: same-origin covers them. A HEADER CHANGE KILLED THIS PRODUCT FOR 5 DAYS (seq1073) --
  // the video_canary tooth asserts these tokens too: a regression fails the same 300s pass it ships in.
  // CACHEABILITY BY CONTENT TYPE (2026-07-31). This emitter hardcoded no-cache for EVERY response,
  // images included, so a creative shipped on every served page was re-downloaded every single time.
  // HTML MUST STAY no-cache: the slot rotates on a 60s window and the served-impression counter rides
  // the HTML, so caching a page would freeze both rotation and billing. An asset is a different fact.
  let hA: *u8 = "\r\nConnection: keep-alive\r\nKeep-Alive: timeout=65\r\nCache-Control: " as *u8
  k = 0; while hA[k] != (0 as u8) { out[j] = hA[k]; j = j + 1; k = k + 1 }
  var hr_is_html: i64 = 1
  let hr_hm: *u8 = "text/html" as *u8
  var hq: i64 = 0
  while hq < 9 { if ctype[hq] != hr_hm[hq] { hr_is_html = 0; break } hq = hq + 1 }
  if hr_is_html == 1 {
      let hc1: *u8 = "no-cache" as *u8
      k = 0; while hc1[k] != (0 as u8) { out[j] = hc1[k]; j = j + 1; k = k + 1 }
  } else {
      let hc2: *u8 = "public, max-age=" as *u8
      k = 0; while hc2[k] != (0 as u8) { out[j] = hc2[k]; j = j + 1; k = k + 1 }
      j = j + hr_putdec(((out as i64 + j) as *u8), HR_ASSET_MAXAGE)
  }
  let h3: *u8 = "\r\nAccess-Control-Allow-Origin: *\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nCross-Origin-Opener-Policy: same-origin\r\nCross-Origin-Embedder-Policy: require-corp\r\nCross-Origin-Resource-Policy: same-origin\r\nContent-Security-Policy: default-src 'self'; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob:; worker-src 'self' blob:; font-src 'self' data:; connect-src 'self' http://127.0.0.1:7862; media-src 'self' blob:; frame-ancestors 'self'; base-uri 'none'; object-src 'none'\r\nX-Served-By: nishi-substrate-v2\r\n\r\n" as *u8
  k = 0; while h3[k] != (0 as u8) { out[j] = h3[k]; j = j + 1; k = k + 1 }
  // MEASURED bound: j is the ACTUAL header length just emitted, not a guessed reserve. Checked before a
  // single body byte is written, so the refusal is exact and the TOOBIG path can emit its own 500.
  if j + bodyn > outcap { return 0 - 1 }
  var b: i64 = 0
  while b < bodyn { out[j] = body[b]; j = j + 1; b = b + 1 }
  return j
372}
373
374// Serve verdicts for hr_serve2 (sealed enum).
375const HR_S2_MISS:   i64 = 0   // host known but file absent -> caller falls through to legacy routing
376const HR_S2_OK:     i64 = 1   // 200 written
377const HR_S2_BAD:    i64 = 2   // 400 written (traversal/malformed)
378const HR_S2_TOOBIG: i64 = 3   // 500 written (file exceeds outcap)
379
380// v2 pipeline: like hr_serve but (a) bounds-checked emit, (b) keep-alive,
381// (c) MISS verdict instead of a baked 404 when the file is absent -- the
382// daemon decides per host whether to fall through to its legacy routing
383// (nishifamily wiki) or emit a real 404 (andelinwest).  Response length is
384// written to *out_n; the verdict is the return value.
385func hr_serve2(cfg: *u8, cfgn: i64, req: *u8, reqn: i64, out: *u8, outcap: i64, out_n: *i64) -> i64 {
  out_n[0] = 0
  let host: *u8 = sys_mmap(256)
  let path: *u8 = sys_mmap(HR_MAGIC_4096)
  let root: *u8 = sys_mmap(HR_MAGIC_1024)
  let file: *u8 = sys_mmap(HR_MAGIC_5120)
  let hn: i64 = hr_req_host(req, reqn, host, 256)
  let pn: i64 = hr_req_path(req, reqn, path, HR_MAGIC_4096)
  let rn: i64 = hr_lookup_root(cfg, cfgn, host, hn, root, HR_MAGIC_1024)
  if rn == 0 { return HR_S2_MISS }
  if hr_path_safe(path, pn) == 0 {
      let b1: *u8 = "<!doctype html><meta charset=utf-8><title>400</title><h1>400 &mdash; bad path</h1>" as *u8
      out_n[0] = hr_emit_b(out, outcap, "HTTP/1.1 400 Bad Request" as *u8, "text/html; charset=utf-8" as *u8, b1, hr_slen(b1))
      return HR_S2_BAD
  }
  let fnlen: i64 = hr_resolve(root, rn, path, pn, file, HR_MAGIC_5120)
  let lenbox: *i64 = (sys_mmap(8)) as *i64
  lenbox[0] = 0
  let data: *u8 = sys_read_file(file, lenbox)
  if (data as i64) == 0 { return HR_S2_MISS }
  let dn: i64 = lenbox[0]
  let ct: *u8 = hr_ctype(file, fnlen)
  let w: i64 = hr_emit_b(out, outcap, "HTTP/1.1 200 OK" as *u8, ct, data, dn)
  if w < 0 {
      let b3: *u8 = "<!doctype html><meta charset=utf-8><title>500</title><h1>500 &mdash; file exceeds serve buffer</h1>" as *u8
      out_n[0] = hr_emit_b(out, outcap, "HTTP/1.1 500 Internal Server Error" as *u8, "text/html; charset=utf-8" as *u8, b3, hr_slen(b3))
      return HR_S2_TOOBIG
  }
  out_n[0] = w
  return HR_S2_OK
415}
416
417// Real 404 for hosts that do NOT fall through (e.g. andelinwest.com).
418func hr_emit_404(out: *u8, outcap: i64) -> i64 {
  let b2: *u8 = "<!doctype html><meta charset=utf-8><title>404</title><h1>404 &mdash; not found</h1>" as *u8
  return hr_emit_b(out, outcap, "HTTP/1.1 404 Not Found" as *u8, "text/html; charset=utf-8" as *u8, b2, hr_slen(b2))
421}
422
423// ===== v3: S-CLASS ROUTING -- clean URLs + canonical 301s, ONE resolver for every path =====
424// (ADDITIVE: hr_serve/hr_serve2 above are byte-identical and untouched.) This mirrors the gated pure
425// engine nx_route.nx (nx_route_gate 5/5) against the LIVE filesystem so routing is a property of the
426// HOST, not per-page redirect stubs:
427//   * CLEAN extensionless URLs serve, for BOTH layouts: /foo -> foo/index.html (dir) OR foo.html (flat).
428//   * ONE CANONICAL url via REAL 301s: /foo.html, /foo/, /foo/index.html, /index.html all collapse to
429//     the clean canonical -- BUT only when that clean target actually resolves to a file, so a legacy
430//     .html route (served by fallthrough, not a docroot file) is never 301'd into a 404.
431//   * dir-index keeps PRECEDENCE over .html (so an existing /games hub is never shadowed by a stale flat).
432//   * traversal -> 400 ; nothing resolves -> MISS (caller falls through to legacy, unchanged).
433const HR_S2_REDIR: i64 = 4   // 301 written to out (out_n set); caller must NOT fall through
434const HR_S2_STREAM: i64 = 5  // headers written to out; BODY handed via hr_stream_body/bodyn -- the
                           // caller sends both through its own chunked TLS primitive. ZERO-CEILING
                           // static serving (debt 1785879638): no file-size constant exists on this
                           // path; anything the host can mmap streams. Body ptr/len ride module
                           // statics (scalars, not arrays -- the BSS-array crash class): the daemon
                           // forks per connection, so the pair is per-process and consumed before
                           // the next request in that process.
441static hr_stream_p: i64 = 0
442static hr_stream_n: i64 = 0
443func hr_stream_body() -> i64 { return hr_stream_p }
444func hr_stream_bodyn() -> i64 { return hr_stream_n }
445
446// header half of hr_emit_b, byte-identical headers (incl cacheability-by-ctype + the security set);
447// Content-Length = bodyn, but NO body byte is written -- the stream caller sends the body itself.
448func hr_emit_head(out: *u8, outcap: i64, statusline: *u8, ctype: *u8, bodyn: i64) -> i64 {
  if outcap < HR_MAGIC_1024 { return 0 - 1 }
  var j: i64 = 0
  var k: i64 = 0
  while statusline[k] != (0 as u8) { out[j] = statusline[k]; j = j + 1; k = k + 1 }
  let h1: *u8 = "\r\nContent-Type: " as *u8
  k = 0; while h1[k] != (0 as u8) { out[j] = h1[k]; j = j + 1; k = k + 1 }
  k = 0; while ctype[k] != (0 as u8) { out[j] = ctype[k]; j = j + 1; k = k + 1 }
  let h2: *u8 = "\r\nContent-Length: " as *u8
  k = 0; while h2[k] != (0 as u8) { out[j] = h2[k]; j = j + 1; k = k + 1 }
  j = j + hr_putdec(((out as i64 + j) as *u8), bodyn)
  let hA: *u8 = "\r\nConnection: keep-alive\r\nKeep-Alive: timeout=65\r\nCache-Control: " as *u8
  k = 0; while hA[k] != (0 as u8) { out[j] = hA[k]; j = j + 1; k = k + 1 }
  var hh: i64 = 1
  let hm: *u8 = "text/html" as *u8
  var hq: i64 = 0
  while hq < 9 { if ctype[hq] != hm[hq] { hh = 0; break } hq = hq + 1 }
  if hh == 1 {
      let hc1: *u8 = "no-cache" as *u8
      k = 0; while hc1[k] != (0 as u8) { out[j] = hc1[k]; j = j + 1; k = k + 1 }
  } else {
      let hc2: *u8 = "public, max-age=" as *u8
      k = 0; while hc2[k] != (0 as u8) { out[j] = hc2[k]; j = j + 1; k = k + 1 }
      j = j + hr_putdec(((out as i64 + j) as *u8), HR_ASSET_MAXAGE)
  }
  let h3: *u8 = "\r\nAccess-Control-Allow-Origin: *\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nReferrer-Policy: strict-origin-when-cross-origin\r\nStrict-Transport-Security: max-age=63072000; includeSubDomains\r\nCross-Origin-Opener-Policy: same-origin\r\nCross-Origin-Embedder-Policy: require-corp\r\nCross-Origin-Resource-Policy: same-origin\r\nContent-Security-Policy: default-src 'self'; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob:; worker-src 'self' blob:; font-src 'self' data:; connect-src 'self' http://127.0.0.1:7862; media-src 'self' blob:; frame-ancestors 'self'; base-uri 'none'; object-src 'none'\r\nX-Served-By: nishi-substrate-v2\r\n\r\n" as *u8
  k = 0; while h3[k] != (0 as u8) { out[j] = h3[k]; j = j + 1; k = k + 1 }
  if j > outcap { return 0 - 1 }
  return j
477}
478
479func hr_ends2(s: *u8, n: i64, suf: *u8, sufn: i64) -> i64 {
  if sufn > n { return 0 }
  var i: i64 = 0
  while i < sufn { if s[n - sufn + i] != suf[i] { return 0 } i = i + 1 }
  return 1
484}
485
486// Canonical clean form of path -> loc (NUL-terminated). Returns locn (>0 => a redirect is warranted),
487// or 0 when the path is already canonical. Order: /index.html before .html (the former is a suffix of it).
488func hr_canon(path: *u8, pn: i64, loc: *u8) -> i64 {
  if pn <= 1 { return 0 }
  if hr_ends2(path, pn, "/index.html" as *u8, 11) == 1 {
      let m1: i64 = pn - 11
      if m1 <= 0 { loc[0] = 47 as u8; loc[1] = 0 as u8; return 1 }
      var i1: i64 = 0; while i1 < m1 { loc[i1] = path[i1]; i1 = i1 + 1 } loc[m1] = 0 as u8; return m1
  }
  if hr_ends2(path, pn, ".html" as *u8, 5) == 1 {
      let m2: i64 = pn - 5
      if m2 <= 0 { return 0 }
      var i2: i64 = 0; while i2 < m2 { loc[i2] = path[i2]; i2 = i2 + 1 } loc[m2] = 0 as u8; return m2
  }
  if path[pn - 1] == (47 as u8) {
      let m3: i64 = pn - 1
      var i3: i64 = 0; while i3 < m3 { loc[i3] = path[i3]; i3 = i3 + 1 } loc[m3] = 0 as u8; return m3
  }
  return 0
505}
506
507// Join root (trailing '/' trimmed) + path + suffix into file; return length.
508func hr_join(root: *u8, rn: i64, path: *u8, pn: i64, suffix: *u8, file: *u8, cap: i64) -> i64 {
  var j: i64 = 0; var i: i64 = 0
  while i < rn { if j < cap - 1 { file[j] = root[i]; j = j + 1 } i = i + 1 }
  if j > 0 { if file[j - 1] == (47 as u8) { j = j - 1 } }
  i = 0
  while i < pn { if j < cap - 1 { file[j] = path[i]; j = j + 1 } i = i + 1 }
  if (suffix as i64) != 0 {
      i = 0
      while suffix[i] != (0 as u8) { if j < cap - 1 { file[j] = suffix[i]; j = j + 1 } i = i + 1 }
  }
  file[j] = 0 as u8
  return j
520}
521
522// Resolve path -> the first existing candidate file (read PER REQUEST = hot content). Candidate order:
523// "/" -> index.html ; dotted last segment (asset) -> exact ; clean URL -> dir-index THEN .html.
524// Returns data ptr (0 = nothing resolved); sets *fnlen (file-path length, for MIME) + *dn (byte count).
525func hr_resolve_read(root: *u8, rn: i64, path: *u8, pn: i64, file: *u8, cap: i64, fnlen: *i64, dn: *i64) -> *u8 {
  let lenbox: *i64 = (sys_mmap(8)) as *i64; lenbox[0] = 0
  var data: *u8 = 0 as *u8
  if pn == 1 {
      fnlen[0] = hr_join(root, rn, path, pn, "index.html" as *u8, file, cap)
      data = sys_read_file(file, lenbox)
  } else {
      var seg_dot: i64 = 0; var s: i64 = pn - 1
      while s >= 0 { if path[s] == (47 as u8) { break } if path[s] == (46 as u8) { seg_dot = 1; break } s = s - 1 }
      if seg_dot == 1 {
          fnlen[0] = hr_join(root, rn, path, pn, 0 as *u8, file, cap)
          data = sys_read_file(file, lenbox)
      } else {
          fnlen[0] = hr_join(root, rn, path, pn, "/index.html" as *u8, file, cap)
          data = sys_read_file(file, lenbox)
          if (data as i64) == 0 {
              fnlen[0] = hr_join(root, rn, path, pn, ".html" as *u8, file, cap)
              data = sys_read_file(file, lenbox)
          }
      }
  }
  dn[0] = lenbox[0]
  return data
548}
549
550// Emit a 301 with Location (empty body, keep-alive). -1 if it would not fit.
551func hr_emit_redirect(out: *u8, outcap: i64, loc: *u8, locn: i64) -> i64 {
  if locn + 256 > outcap { return 0 - 1 }
  var j: i64 = 0; var k: i64 = 0
  let s1: *u8 = "HTTP/1.1 301 Moved Permanently\r\nLocation: " as *u8
  k = 0; while s1[k] != (0 as u8) { out[j] = s1[k]; j = j + 1; k = k + 1 }
  k = 0; while k < locn { out[j] = loc[k]; j = j + 1; k = k + 1 }
  let s2: *u8 = "\r\nContent-Length: 0\r\nConnection: keep-alive\r\nCache-Control: no-cache\r\nX-Served-By: nishi-host\r\n\r\n" as *u8
  k = 0; while s2[k] != (0 as u8) { out[j] = s2[k]; j = j + 1; k = k + 1 }
  return j
560}
561
562// ===== v3+slot helpers: universal ad-slot injection (ADDITIVE -- hr_serve3 below is untouched) =====
563// hr_serve3_slot behaves byte-identically to hr_serve3 when slot_n==0 (gated). With slot bytes: a
564// text/html body containing </body> and NOT carrying the nx-ad-optout marker gets the slot inserted
565// before the LAST </body>; Content-Length stays correct by construction (merge happens before emit).
566// injected[0]=1 ONLY when the slot actually landed (the caller logs a served impression off it).
567
568func hr_ct_is_html(ct: *u8) -> i64 {
  return hr_eq(ct, "text/html" as *u8, 9)
570}
571
572// index of the LAST "</body>" (case-insensitive) in body, or -1.
573func hr_find_close_body(body: *u8, bn: i64) -> i64 {
  if bn < 7 { return 0 - 1 }
  var i: i64 = bn - 7
  while i >= 0 {
      if body[i] == (60 as u8) {
          if hr_ieq(((body as i64 + i) as *u8), "</body>" as *u8, 7) == 1 { return i }
      }
      i = i - 1
  }
  return 0 - 1
583}
584
585// page-level opt-out marker scan (any page may carry nx-ad-optout to refuse the slot).
586func hr_has_optout(body: *u8, bn: i64) -> i64 {
  var i: i64 = 0
  while i + 12 <= bn {
      if body[i] == (110 as u8) {
          if hr_eq(((body as i64 + i) as *u8), "nx-ad-optout" as *u8, 12) == 1 { return 1 }
      }
      i = i + 1
  }
  return 0
595}
596
597
598// ---- SLOT ANCHOR (2026-07-31): let a PAGE choose where its ad goes -------------------------------
599// WHY: the slot was always injected before the closing body tag -- the absolute bottom of the document.
600// On a long reference page essentially nobody scrolls there, and the MRC rule needs 50% of the creative
601// in view for one CONTINUOUS second. So viewable impressions were structurally near-zero: we measured
602// honestly and still sold a position nobody sees. The honest number does not fix placement, it EXPOSES
603// it -- and this is the mechanism that lets it be fixed.
604//
605// A page opts in by placing the marker where it wants the ad. NO MARKER = the old behaviour, byte for
606// byte, so this cannot change a single existing page. Placement stays a PRODUCT decision made per page,
607// not an engineering default imposed on every site at once.
608const HR_SLOT_MARK: *u8 = "<!--nx-ad-slot-->" as *u8
609
610func hr_find_slot_anchor(d: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i + 17 <= n {
      var k: i64 = 0
      var m: i64 = 1
      while k < 17 { if d[i + k] != HR_SLOT_MARK[k] { m = 0; break } k = k + 1 }
      if m == 1 { return i }
      i = i + 1
  }
  return hr_find_close_body(d, n)
620}
621
622func hr_serve3_slot(cfg: *u8, cfgn: i64, req: *u8, reqn: i64, out: *u8, outcap: i64, out_n: *i64, slot: *u8, slot_n: i64, injected: *i64) -> i64 {
  injected[0] = 0
  out_n[0] = 0
  let host: *u8 = sys_mmap(256)
  let path: *u8 = sys_mmap(HR_MAGIC_4096)
  let root: *u8 = sys_mmap(HR_MAGIC_1024)
  let file: *u8 = sys_mmap(HR_MAGIC_5120)
  let hn: i64 = hr_req_host(req, reqn, host, 256)
  let pn: i64 = hr_req_path(req, reqn, path, HR_MAGIC_4096)
  let rn: i64 = hr_lookup_root(cfg, cfgn, host, hn, root, HR_MAGIC_1024)
  if rn == 0 { return HR_S2_MISS }
  if hr_path_safe(path, pn) == 0 {
      let b1: *u8 = "<!doctype html><meta charset=utf-8><title>400</title><h1>400 &mdash; bad path</h1>" as *u8
      out_n[0] = hr_emit_b(out, outcap, "HTTP/1.1 400 Bad Request" as *u8, "text/html; charset=utf-8" as *u8, b1, hr_slen(b1))
      return HR_S2_BAD
  }
  let fnlen: *i64 = (sys_mmap(8)) as *i64
  let dn: *i64 = (sys_mmap(8)) as *i64
  let loc: *u8 = sys_mmap(HR_MAGIC_4096)
  let locn: i64 = hr_canon(path, pn, loc)
  if locn > 0 {
      let cfile: *u8 = sys_mmap(HR_MAGIC_5120)
      let cdata: *u8 = hr_resolve_read(root, rn, loc, locn, cfile, HR_MAGIC_5120, fnlen, dn)
      if (cdata as i64) != 0 {
          // seq365: CARRY the ?query on the canonical 301 (resolve above used the PATH-only loc;
          // append after resolve so filesystem lookup never sees query bytes). No-query requests
          // emit byte-identical redirects to before.
          let qbuf: *u8 = sys_mmap(HR_MAGIC_2048)
          let qn: i64 = hr_req_query(req, reqn, qbuf, HR_MAGIC_2048)
          var locq: i64 = locn
          if qn > 0 { if locn + qn < HR_MAGIC_4095 {
              var qi: i64 = 0
              while qi < qn { loc[locn + qi] = qbuf[qi]; qi = qi + 1 }
              locq = locn + qn
              loc[locq] = 0 as u8
          } }
          out_n[0] = hr_emit_redirect(out, outcap, loc, locq)
          if out_n[0] < 0 { out_n[0] = 0; return HR_S2_MISS }
          return HR_S2_REDIR
      }
  }
  let data: *u8 = hr_resolve_read(root, rn, path, pn, file, HR_MAGIC_5120, fnlen, dn)
  if (data as i64) == 0 { return HR_S2_MISS }
  let ct: *u8 = hr_ctype(file, fnlen[0])
  var body: *u8 = data
  var bodyn: i64 = dn[0]
  if slot_n > 0 {
      if hr_ct_is_html(ct) == 1 {
          let cb: i64 = hr_find_slot_anchor(data, bodyn)
          if cb >= 0 {
              let oo: i64 = hr_has_optout(data, bodyn)
              if oo == 0 {
                  let mcap: i64 = bodyn + slot_n + 16
                  let merged: *u8 = sys_mmap(mcap)
                  var w2: i64 = 0
                  var a: i64 = 0
                  while a < cb { merged[w2] = data[a]; w2 = w2 + 1; a = a + 1 }
                  var b2: i64 = 0
                  while b2 < slot_n { merged[w2] = slot[b2]; w2 = w2 + 1; b2 = b2 + 1 }
                  while a < bodyn { merged[w2] = data[a]; w2 = w2 + 1; a = a + 1 }
                  body = merged
                  bodyn = w2
                  injected[0] = 1
              }
          }
      }
  }
  let w: i64 = hr_emit_b(out, outcap, "HTTP/1.1 200 OK" as *u8, ct, body, bodyn)
  if w < 0 {
      // ZERO-CEILING STREAM (debt 1785879638; operator: no self-imposed limits, no magic numbers):
      // the body is ALREADY in memory -- emit headers only (they always fit any sane outcap) and
      // hand the body pointer to the daemon, which sends both through the same chunked TLS send.
      // No file-size constant exists on this path. 500 remains ONLY for an outcap below the header floor.
      let hw: i64 = hr_emit_head(out, outcap, "HTTP/1.1 200 OK" as *u8, ct, bodyn)
      if hw > 0 {
          hr_stream_p = body as i64
          hr_stream_n = bodyn
          out_n[0] = hw
          return HR_S2_STREAM
      }
      let b3: *u8 = "<!doctype html><meta charset=utf-8><title>500</title><h1>500 &mdash; file exceeds serve buffer</h1>" as *u8
      out_n[0] = hr_emit_b(out, outcap, "HTTP/1.1 500 Internal Server Error" as *u8, "text/html; charset=utf-8" as *u8, b3, hr_slen(b3))
      return HR_S2_TOOBIG
  }
  out_n[0] = w
  return HR_S2_OK
708}
709
710// v3 pipeline: canonical 301 (safe) + clean multi-candidate resolve. Verdicts: OK/MISS/BAD/TOOBIG/REDIR.
711func hr_serve3(cfg: *u8, cfgn: i64, req: *u8, reqn: i64, out: *u8, outcap: i64, out_n: *i64) -> i64 {
  out_n[0] = 0
  let host: *u8 = sys_mmap(256)
  let path: *u8 = sys_mmap(HR_MAGIC_4096)
  let root: *u8 = sys_mmap(HR_MAGIC_1024)
  let file: *u8 = sys_mmap(HR_MAGIC_5120)
  let hn: i64 = hr_req_host(req, reqn, host, 256)
  let pn: i64 = hr_req_path(req, reqn, path, HR_MAGIC_4096)
  let rn: i64 = hr_lookup_root(cfg, cfgn, host, hn, root, HR_MAGIC_1024)
  if rn == 0 { return HR_S2_MISS }
  if hr_path_safe(path, pn) == 0 {
      let b1: *u8 = "<!doctype html><meta charset=utf-8><title>400</title><h1>400 &mdash; bad path</h1>" as *u8
      out_n[0] = hr_emit_b(out, outcap, "HTTP/1.1 400 Bad Request" as *u8, "text/html; charset=utf-8" as *u8, b1, hr_slen(b1))
      return HR_S2_BAD
  }
  let fnlen: *i64 = (sys_mmap(8)) as *i64
  let dn: *i64 = (sys_mmap(8)) as *i64
  // canonical 301 -- only when the clean target actually resolves (never 301 to a 404)
  let loc: *u8 = sys_mmap(HR_MAGIC_4096)
  let locn: i64 = hr_canon(path, pn, loc)
  if locn > 0 {
      let cfile: *u8 = sys_mmap(HR_MAGIC_5120)
      let cdata: *u8 = hr_resolve_read(root, rn, loc, locn, cfile, HR_MAGIC_5120, fnlen, dn)
      if (cdata as i64) != 0 {
          // seq365: CARRY the ?query on the canonical 301 (resolve above used the PATH-only loc;
          // append after resolve so filesystem lookup never sees query bytes). No-query requests
          // emit byte-identical redirects to before.
          let qbuf: *u8 = sys_mmap(HR_MAGIC_2048)
          let qn: i64 = hr_req_query(req, reqn, qbuf, HR_MAGIC_2048)
          var locq: i64 = locn
          if qn > 0 { if locn + qn < HR_MAGIC_4095 {
              var qi: i64 = 0
              while qi < qn { loc[locn + qi] = qbuf[qi]; qi = qi + 1 }
              locq = locn + qn
              loc[locq] = 0 as u8
          } }
          out_n[0] = hr_emit_redirect(out, outcap, loc, locq)
          if out_n[0] < 0 { out_n[0] = 0; return HR_S2_MISS }
          return HR_S2_REDIR
      }
  }
  // resolve + serve the (canonical) path
  let data: *u8 = hr_resolve_read(root, rn, path, pn, file, HR_MAGIC_5120, fnlen, dn)
  if (data as i64) == 0 { return HR_S2_MISS }
  let ct: *u8 = hr_ctype(file, fnlen[0])
  let w: i64 = hr_emit_b(out, outcap, "HTTP/1.1 200 OK" as *u8, ct, data, dn[0])
  if w < 0 {
      let b3: *u8 = "<!doctype html><meta charset=utf-8><title>500</title><h1>500 &mdash; file exceeds serve buffer</h1>" as *u8
      out_n[0] = hr_emit_b(out, outcap, "HTTP/1.1 500 Internal Server Error" as *u8, "text/html; charset=utf-8" as *u8, b3, hr_slen(b3))
      return HR_S2_TOOBIG
  }
  out_n[0] = w
  return HR_S2_OK
764}
nx_host_router.nx source

`nx_host_router.nx` source
