Worker Rule Injection Demo

S2 — Streaming ~10 MB HTML rewrite

Origin streams a ~10 MiB HTML report. This host injects one approved script, strips standard HTML comments, and streams progressively without buffering the full body.

Key questions

Question

Does HTMLRewriter operate as a true streaming parser?

Yes. S2 returns rewriter.transform(originResponse).body directly and does not call text(), arrayBuffer(), or tee() on the hot path. This does not claim zero internal parser buffering.

Success criteria / proof

  1. Complete report is transformed.The full response is delivered with one injected script, standard comments removed, and closing HTML intact.
  2. Head fallback works.The normal document injects at the first <head>; a document without a head uses the body fallback.
  3. Document-end fallback works.A fragment without head or body receives exactly one injected script at document end.
  4. Streaming ownership is preserved.The Worker returns the HTMLRewriter body directly and does not buffer the report on the hot path.
  5. Reset behavior is explicit.Origin or transform failure produces an error or truncated stream rather than a false completed response.
Direct Origins2-origin.thecompany-lab.com
Capability Workers2.thecompany-lab.com
Capability fixtures
Slow streamAbsent headFragmentReset path
Direct comparison
Origin slow stream

1. Browser verification

Run a read-only validation. Each row names the action, expected result, observed result, and status; no account or origin state is changed.

Not run yet.

2. Command-line verification (copy and run)

Step 1 — Capture the before stream

Drain the direct origin report and record its size and standard comment markers.

curl -sS https://s2-origin.thecompany-lab.com/ -o /tmp/s2-before.html
wc -c /tmp/s2-before.html
grep -c '<!--' /tmp/s2-before.html || true

Step 2 — Capture the after stream

Drain the capability response. The transformed body should close correctly, contain one injected script, and have no standard comments.

curl -sS https://s2.thecompany-lab.com/ -o /tmp/s2-after.html
wc -c /tmp/s2-after.html
grep -c '<!--' /tmp/s2-after.html   # expect 0
grep -c 'rs-s2-injected' /tmp/s2-after.html   # expect 1
tail -c 40 /tmp/s2-after.html

Step 3 — Verify fallback paths

Each request exercises a different insertion point in the same Worker.

for p in absent-head fragment; do
  curl -sS "https://s2.thecompany-lab.com/$p" -o "/tmp/s2-$p.html"
  echo "--- /$p"
  grep -c 'rs-s2-injected' "/tmp/s2-$p.html"   # expect 1
done

Step 4 — Demonstrate the slow stream

Compare origin and capability start-transfer times for the slow fixture. This records what this run observed; it is not a service promise.

curl -sS -o /dev/null -w 'origin: start=%{time_starttransfer}s total=%{time_total}s\n'   'https://s2-origin.thecompany-lab.com/?slow=1'
curl -sS -o /dev/null -w 'capability: start=%{time_starttransfer}s total=%{time_total}s\n'   'https://s2.thecompany-lab.com/?slow=1'

Step 5 — Verify streaming headers and reset behavior

Length metadata must not describe the rewritten body. The reset fixture should not look like a completed success.

curl -sS -D - -o /dev/null https://s2.thecompany-lab.com/   | grep -iE '^(HTTP|content-length|content-encoding|cache-control|x-redshield-measure)'
curl -sS https://s2.thecompany-lab.com/reset -o /tmp/s2-reset.html || true
wc -c /tmp/s2-reset.html 2>/dev/null || true