@fluojs/http 1.1.2 → 3.0.0

package/dist/middleware/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAS,MAAM,cAAc,CAAC;AAGvD,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,qBAAqB,EAAE,IAAI,EAAkB,MAAM,aAAa,CAAC;AAM9H;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,KAAK,IAAI,qBAAqB,CAE7F;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAUxE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,WAAW,CAAC,UAAU,CAAC,EACzD,eAAe,EAAE,CAAC,EAClB,GAAG,MAAM,EAAE,MAAM,EAAE,GAClB,qBAAqB,CAEvB;AA2CD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,cAAc,EAAE,EAC7B,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,IAAI,GACb,OAAO,CAAC,IAAI,CAAC,CAqBf"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAS,MAAM,cAAc,CAAC;AAGvD,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EACjB,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,sBAAsB,EACtB,IAAI,EAEL,MAAM,aAAa,CAAC;AAMrB;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,cAAc,GAAG,sBAAsB,GAC7C,KAAK,IAAI,qBAAqB,GAAG,uBAAuB,CAE1D;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAM1D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAUxE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,CAAC,SAAS,WAAW,CAAC,UAAU,CAAC,EACzD,eAAe,EAAE,CAAC,EAClB,GAAG,MAAM,EAAE,MAAM,EAAE,GAClB,qBAAqB,CAEvB;AA8CD;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,SAAS,CAAC,cAAc,GAAG,sBAAsB,CAAC,EAAE,EACjE,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,IAAI,GACb,OAAO,CAAC,IAAI,CAAC,CAqBf"}

package/dist/middleware/rate-limit.d.ts

@@ -1,4 +1,5 @@
 import type { MiddlewareContext, Middleware } from '../types.js';
+import type { TrustProxyPolicy } from '../connection.js';
 /** Snapshot of one key's current rate-limit window state. */
 export interface RateLimitStoreEntry {
     count: number;
@@ -18,10 +19,20 @@ export interface RateLimitOptions {
     keyResolver?: (ctx: MiddlewareContext) => string;
     store?: RateLimitStore;
     /**
-     * Trust `Forwarded`, `X-Forwarded-For`, and `X-Real-IP` before the raw socket address.
-     * Enable this only when the adapter sits behind a trusted proxy that overwrites spoofable headers.
+     * Broad legacy compatibility mode for forwarding headers.
+     *
+     * This trusts the complete `Forwarded`, `X-Forwarded-For`, or `X-Real-IP`
+     * chain and is not limited to the direct peer. Use `trustProxy` instead for
+     * new deployments with a known proxy boundary.
      */
     trustProxyHeaders?: boolean;
+    /**
+     * Explicit proxy boundary used for default client identity resolution.
+     *
+     * @remarks
+     * Prefer this policy over the broad legacy `trustProxyHeaders` mode.
+     */
+    trustProxy?: TrustProxyPolicy;
 }
 /**
  * Create the built-in in-memory store for request rate-limit windows.

package/dist/middleware/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAIjE,6DAA6D;AAC7D,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAC7F,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACjD,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAQD;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,cAAc,CAwC3D;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,UAAU,CAkD/E"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/rate-limit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,GAAG,OAAO,CAAC,mBAAmB,GAAG,SAAS,CAAC,CAAC;IAC7F,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACjD,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;CAC/B;AASD;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,cAAc,CAwC3D;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,UAAU,CAkD/E"}

package/dist/middleware/rate-limit.js

@@ -9,6 +9,7 @@ import { resolveClientIdentity } from '../client-identity.js';
 
 function defaultKeyResolver(ctx, options) {
   return resolveClientIdentity(ctx.request, {
+    trustProxy: options.trustProxy,
     trustProxyHeaders: options.trustProxyHeaders ?? false
   });
 }

package/dist/static-assets.d.ts

@@ -0,0 +1,77 @@
+import type { MaybePromise } from '@fluojs/core';
+import { type ByteRangeResponseSource } from './byte-range-response.js';
+import type { Middleware, ResponseValidators } from './types.js';
+/** Content encodings that a static asset source may select. */
+export type StaticAssetContentEncoding = 'br' | 'gzip';
+/** Request encoding names considered while selecting a static representation. */
+export type StaticAssetAcceptedEncoding = StaticAssetContentEncoding | 'identity';
+/** Metadata for one selected static representation. */
+export interface StaticAsset {
+    /** Media type for the logical asset path. */
+    readonly contentType: string;
+    /** Optional representation encoding selected by the asset source. */
+    readonly contentEncoding?: StaticAssetContentEncoding;
+    /** Portable bytes or lazy stream factory for the selected representation. */
+    readonly source: ByteRangeResponseSource;
+    /** Exact selected representation length in bytes. */
+    readonly size: number;
+    /** Validators emitted and evaluated for the selected representation. */
+    readonly validators?: ResponseValidators;
+    /** Whether selection can vary by `Accept-Encoding`, including an identity fallback. */
+    readonly variesByEncoding?: boolean;
+    /** Releases source-owned resources after the response settles. */
+    readonly dispose?: () => MaybePromise<void>;
+}
+/** Context supplied to an application-owned static asset source. */
+export interface StaticAssetResolveContext {
+    /** Ordered encodings accepted by the request. */
+    readonly acceptedEncodings: readonly StaticAssetAcceptedEncoding[];
+    /** Request cancellation signal when the adapter exposes one. */
+    readonly signal?: AbortSignal;
+}
+/** Resolution outcome for an existing asset without an acceptable representation. */
+export interface StaticAssetNotAcceptable {
+    /** Signals that the requested asset exists but no representation is acceptable. */
+    readonly notAcceptable: true;
+}
+/** Result returned by an application-owned static asset source. */
+export type StaticAssetResolution = StaticAsset | StaticAssetNotAcceptable | undefined;
+/** Runtime-neutral source for static asset representations. */
+export interface StaticAssetSource {
+    /**
+     * Resolves a normalized relative asset path.
+     *
+     * Paths never begin with `/`; every `/`-separated segment is non-empty, is not
+     * `.` or `..`, and contains no backslash or NUL.
+     *
+     * @param path Normalized relative asset path.
+     * @param context Request capabilities relevant to source selection.
+     * @returns The selected representation, an explicit unacceptable outcome, or `undefined` when no asset exists.
+     */
+    resolve(path: string, context: StaticAssetResolveContext): MaybePromise<StaticAssetResolution>;
+}
+/** Static asset middleware configuration. */
+export interface StaticAssetsMiddlewareOptions {
+    /** Required application-owned source; the portable layer never opens a filesystem itself. */
+    readonly source: StaticAssetSource;
+    /** URL prefix owned by this middleware. Defaults to `/`. */
+    readonly prefix?: string;
+    /** Dotfile policy. `deny` writes 403; `ignore` leaves the request to later middleware/routes. */
+    readonly dotfiles?: 'allow' | 'deny' | 'ignore';
+    /** Directory indexes resolved only for paths ending in `/`. Defaults to `false`. */
+    readonly index?: false | string | readonly string[];
+    /** Cache-Control value emitted for served and conditional responses. Defaults to `public, max-age=0`. */
+    readonly cacheControl?: false | string;
+}
+/** Static middleware that serves a required explicit {@link StaticAssetSource}. */
+export interface StaticAssetsMiddleware extends Middleware {
+}
+/**
+ * Creates portable static asset middleware without assuming filesystem access.
+ *
+ * @param options Source and URL/security policy for one static mount.
+ * @returns Middleware that serves matching `GET` and `HEAD` asset requests.
+ * @throws {TypeError} When configuration is structurally invalid.
+ */
+export declare function createStaticAssetsMiddleware(options: StaticAssetsMiddlewareOptions): StaticAssetsMiddleware;
+//# sourceMappingURL=static-assets.d.ts.map

package/dist/static-assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-assets.d.ts","sourceRoot":"","sources":["../src/static-assets.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEjD,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,0BAA0B,CAAC;AAOlC,OAAO,KAAK,EACV,UAAU,EAEV,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAKpB,+DAA+D;AAC/D,MAAM,MAAM,0BAA0B,GAAG,IAAI,GAAG,MAAM,CAAC;AAEvD,iFAAiF;AACjF,MAAM,MAAM,2BAA2B,GAAG,0BAA0B,GAAG,UAAU,CAAC;AAElF,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC;IACtD,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,qDAAqD;IACrD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,UAAU,CAAC,EAAE,kBAAkB,CAAC;IACzC,uFAAuF;IACvF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,kEAAkE;IAClE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;CAC7C;AAED,oEAAoE;AACpE,MAAM,WAAW,yBAAyB;IACxC,iDAAiD;IACjD,QAAQ,CAAC,iBAAiB,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACnE,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED,qFAAqF;AACrF,MAAM,WAAW,wBAAwB;IACvC,mFAAmF;IACnF,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC;CAC9B;AAED,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,wBAAwB,GAAG,SAAS,CAAC;AAEvF,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,yBAAyB,GAAG,YAAY,CAAC,qBAAqB,CAAC,CAAC;CAChG;AAED,6CAA6C;AAC7C,MAAM,WAAW,6BAA6B;IAC5C,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACpD,yGAAyG;IACzG,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CACxC;AAED,mFAAmF;AACnF,MAAM,WAAW,sBAAuB,SAAQ,UAAU;CAAG;AAE7D;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,6BAA6B,GACrC,sBAAsB,CAyGxB"}

package/dist/static-assets.js

@@ -0,0 +1,270 @@
+import { writeByteRangeResponse } from './byte-range-response.js';
+import { appendVaryHeader, readFirstNonEmptyRequestHeaderValue } from './header-helpers.js';
+import { applyResponseValidators, resolveConditionalRequestRepresentation, writeConditionalResponse } from './dispatch/conditional-request-policy.js';
+const defaultCacheControl = 'public, max-age=0';
+const defaultDotfiles = 'ignore';
+
+/** Content encodings that a static asset source may select. */
+
+/** Request encoding names considered while selecting a static representation. */
+
+/** Metadata for one selected static representation. */
+
+/** Context supplied to an application-owned static asset source. */
+
+/** Resolution outcome for an existing asset without an acceptable representation. */
+
+/** Result returned by an application-owned static asset source. */
+
+/** Runtime-neutral source for static asset representations. */
+
+/** Static asset middleware configuration. */
+
+/** Static middleware that serves a required explicit {@link StaticAssetSource}. */
+
+/**
+ * Creates portable static asset middleware without assuming filesystem access.
+ *
+ * @param options Source and URL/security policy for one static mount.
+ * @returns Middleware that serves matching `GET` and `HEAD` asset requests.
+ * @throws {TypeError} When configuration is structurally invalid.
+ */
+export function createStaticAssetsMiddleware(options) {
+  const configuration = resolveStaticAssetsConfiguration(options);
+  return {
+    async handle(context, next) {
+      const assetPath = resolveStaticAssetPath(context.request.path, configuration.prefix, configuration.dotfiles);
+      if (!isStaticAssetMethod(context.request.method)) {
+        await next();
+        return;
+      }
+      if (assetPath === 'denied') {
+        context.response.setStatus(403);
+        await context.response.send(undefined);
+        return;
+      }
+      if (!assetPath) {
+        await next();
+        return;
+      }
+      const sourceContext = createStaticAssetResolveContext(context);
+      const resolution = await resolveStaticAsset(configuration, assetPath, sourceContext);
+      if (resolution === 'denied') {
+        context.response.setStatus(403);
+        await context.response.send(undefined);
+        return;
+      }
+      if (!resolution) {
+        await next();
+        return;
+      }
+      if (isStaticAssetNotAcceptable(resolution)) {
+        appendVaryHeader(context.response, 'Accept-Encoding');
+        context.response.setHeader('Content-Length', '0');
+        context.response.setStatus(406);
+        await context.response.send(undefined, {
+          compression: false
+        });
+        return;
+      }
+      try {
+        if (!isStaticAssetEncodingAccepted(resolution, sourceContext.acceptedEncodings)) {
+          appendVaryHeader(context.response, 'Accept-Encoding');
+          context.response.setHeader('Content-Length', '0');
+          context.response.setStatus(406);
+          await context.response.send(undefined, {
+            compression: false
+          });
+          return;
+        }
+        if (configuration.cacheControl !== false) {
+          context.response.setHeader('Cache-Control', configuration.cacheControl);
+        }
+        if (resolution.contentEncoding) {
+          context.response.setHeader('Content-Encoding', resolution.contentEncoding);
+        }
+        if (resolution.contentEncoding || resolution.variesByEncoding) {
+          appendVaryHeader(context.response, 'Accept-Encoding');
+        }
+        const conditional = resolveConditionalRequestRepresentation(context.request, {
+          exists: true,
+          validators: resolution.validators
+        });
+        if (conditional.outcome !== 'proceed') {
+          await writeConditionalResponse(context.response, conditional.outcome, conditional.validators, {
+            compression: false
+          });
+          return;
+        }
+        context.response.setStatus(200);
+        await writeByteRangeResponse({
+          applySuccessResponseMetadata: () => {
+            applyResponseValidators(context.response, conditional.validators);
+          },
+          compression: false,
+          entry: {
+            contentType: resolution.contentType,
+            size: resolution.size,
+            source: resolution.source
+          },
+          request: context.request,
+          response: context.response,
+          validators: conditional.validators
+        });
+      } finally {
+        await resolution.dispose?.();
+      }
+    }
+  };
+}
+function resolveStaticAssetsConfiguration(options) {
+  if (!options || typeof options !== 'object' || !options.source || typeof options.source.resolve !== 'function') {
+    throw new TypeError('Static asset middleware requires an explicit asset source.');
+  }
+  const dotfiles = options.dotfiles ?? defaultDotfiles;
+  if (dotfiles !== 'allow' && dotfiles !== 'deny' && dotfiles !== 'ignore') {
+    throw new TypeError('Static asset dotfiles policy must be "allow", "deny", or "ignore".');
+  }
+  const cacheControl = options.cacheControl ?? defaultCacheControl;
+  if (cacheControl !== false && (typeof cacheControl !== 'string' || cacheControl.trim() === '')) {
+    throw new TypeError('Static asset cacheControl must be a non-empty string or false.');
+  }
+  return {
+    cacheControl,
+    dotfiles,
+    index: normalizeIndex(options.index),
+    prefix: normalizePrefix(options.prefix),
+    source: options.source
+  };
+}
+function normalizePrefix(prefix) {
+  const value = prefix ?? '/';
+  if (typeof value !== 'string' || !value.startsWith('/')) {
+    throw new TypeError('Static asset prefix must begin with "/".');
+  }
+  const normalized = value.replace(/\/+$/, '');
+  return normalized === '' ? '/' : normalized;
+}
+function normalizeIndex(index) {
+  if (index === undefined || index === false) {
+    return [];
+  }
+  const values = typeof index === 'string' ? [index] : index;
+  if (!Array.isArray(values) || values.length === 0) {
+    throw new TypeError('Static asset index must be false, a non-empty filename, or a non-empty filename array.');
+  }
+  return values.map(value => {
+    if (typeof value !== 'string' || value === '' || value.includes('/') || value.includes('\\') || value === '.' || value === '..') {
+      throw new TypeError('Static asset index names must be plain filenames.');
+    }
+    return value;
+  });
+}
+function resolveStaticAssetPath(requestPath, prefix, dotfiles) {
+  if (!matchesStaticPrefix(requestPath, prefix)) {
+    return undefined;
+  }
+  const encodedPath = prefix === '/' ? requestPath : requestPath.slice(prefix.length);
+  const directory = encodedPath.endsWith('/');
+  const encodedSegments = encodedPath.split('/').filter(segment => segment.length > 0);
+  const segments = [];
+  for (const encodedSegment of encodedSegments) {
+    let segment;
+    try {
+      segment = decodeURIComponent(encodedSegment);
+    } catch {
+      return undefined;
+    }
+    if (segment === '' || segment === '.' || segment === '..' || segment.includes('/') || segment.includes('\\') || segment.includes('\0')) {
+      return undefined;
+    }
+    if (segment.startsWith('.') && dotfiles !== 'allow') {
+      return dotfiles === 'deny' ? 'denied' : undefined;
+    }
+    segments.push(segment);
+  }
+  return {
+    directory,
+    path: segments.join('/')
+  };
+}
+function matchesStaticPrefix(requestPath, prefix) {
+  return prefix === '/' ? requestPath.startsWith('/') : requestPath === prefix || requestPath.startsWith(`${prefix}/`);
+}
+function isStaticAssetMethod(method) {
+  const normalized = method.toUpperCase();
+  return normalized === 'GET' || normalized === 'HEAD';
+}
+function createStaticAssetResolveContext(context) {
+  return {
+    acceptedEncodings: parseAcceptedEncodings(context),
+    signal: context.request.signal
+  };
+}
+function parseAcceptedEncodings(context) {
+  const value = readFirstNonEmptyRequestHeaderValue(context.request, 'accept-encoding');
+  if (!value) {
+    return ['identity'];
+  }
+  const qualities = new Map();
+  for (const candidate of value.split(',')) {
+    const [name, ...parameters] = candidate.trim().toLowerCase().split(';');
+    const quality = parameters.find(parameter => parameter.trim().startsWith('q='));
+    const parsedQuality = parseAcceptEncodingQuality(quality?.trim().slice(2));
+    if (!name || parsedQuality === undefined) {
+      continue;
+    }
+    qualities.set(name, parsedQuality);
+  }
+  return ['br', 'gzip', 'identity'].map(encoding => ({
+    encoding,
+    quality: resolveAcceptEncodingQuality(encoding, qualities)
+  })).filter(candidate => candidate.quality > 0).sort((left, right) => right.quality - left.quality || encodingPriority(left.encoding) - encodingPriority(right.encoding)).map(candidate => candidate.encoding);
+}
+function parseAcceptEncodingQuality(value) {
+  if (value === undefined) {
+    return 1;
+  }
+  if (!/^(?:0(?:\.\d{0,3})?|1(?:\.0{0,3})?)$/.test(value)) {
+    return undefined;
+  }
+  return Number(value);
+}
+function resolveAcceptEncodingQuality(encoding, qualities) {
+  const explicit = qualities.get(encoding);
+  if (explicit !== undefined) {
+    return explicit;
+  }
+  const wildcard = qualities.get('*');
+  return encoding === 'identity' ? wildcard === 0 ? 0 : 1 : wildcard ?? 0;
+}
+function encodingPriority(encoding) {
+  return encoding === 'br' ? 0 : encoding === 'gzip' ? 1 : 2;
+}
+async function resolveStaticAsset(configuration, assetPath, context) {
+  if (assetPath.directory) {
+    for (const indexName of configuration.index) {
+      if (indexName.startsWith('.') && configuration.dotfiles !== 'allow') {
+        if (configuration.dotfiles === 'deny') {
+          return 'denied';
+        }
+        continue;
+      }
+      const asset = await configuration.source.resolve(assetPath.path === '' ? indexName : `${assetPath.path}/${indexName}`, context);
+      if (asset) {
+        return asset;
+      }
+    }
+    return undefined;
+  }
+  if (assetPath.path === '') {
+    return undefined;
+  }
+  return await configuration.source.resolve(assetPath.path, context);
+}
+function isStaticAssetNotAcceptable(resolution) {
+  return resolution !== undefined && 'notAcceptable' in resolution && resolution.notAcceptable;
+}
+function isStaticAssetEncodingAccepted(asset, acceptedEncodings) {
+  return acceptedEncodings.includes(asset.contentEncoding ?? 'identity');
+}