@kabmo-labs/kabmo 0.0.0-stage → 0.1.0

package/src/server/lib/wiki/payload.server.ts

@@ -0,0 +1,141 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * One wiki's tree, as the panel renders it.
+ *
+ * Extracted from `routes/wiki/repo.ts` so the HTTP route and the realtime
+ * `wiki:` topic share one implementation: the mirror TTL, the provider probe
+ * and the sidebar merge are the details two copies would drift on.
+ */
+
+import { isMockMode } from '@/server/mock.server';
+import { scopeToRepo } from '@/server/lib/fs/repo-scope';
+import { firstLine, gitRun } from '@/server/lib/wiki/git';
+import { ensureWikiMirror, listWikiPaths, readWikiPage } from '@/server/lib/wiki/mirror.server';
+import { detectWikiProvider } from '@/server/lib/wiki/provider.server';
+import { parseWikiRemote, redactRemoteUrl, wikiWebUrl } from '@/server/lib/wiki/remote';
+import { buildWikiEntries } from '@/shared/lib/wiki/pages';
+import { findWikiSidebarPath, parseWikiSidebar, withRemainingPages } from '@/shared/lib/wiki/sidebar';
+import type { WikiNavSection, WikiRepoPayload } from '@/shared/types/wiki';
+
+/** The checkout's `origin`; null when there is none to read. */
+async function readOriginRemote(dir: string): Promise<{ remote: string | null; error: string }> {
+  const out = await gitRun(['-C', dir, 'remote', 'get-url', 'origin'], { timeoutMs: 5_000 });
+  if (out.exitCode !== 0) return { remote: null, error: firstLine(out.stderr) };
+  return { remote: out.stdout.trim() || null, error: '' };
+}
+
+/** MOCK=true: a deterministic wiki so the panel renders its full range offline. */
+function mockPayload(): WikiRepoPayload {
+  const entries = buildWikiEntries([
+    'Home.md',
+    'Getting-Started.md',
+    'guides/Deployment.md',
+    'guides/Troubleshooting.md',
+    'change_logs/v1.0.0.md',
+    'images/diagram.svg',
+    '_Sidebar.md',
+    '.gitlab/redirects.yml',
+  ]);
+  return {
+    repo: {
+      provider: 'github',
+      host: 'github.com',
+      slug: 'kabmo/demo',
+      remote: 'https://github.com/kabmo/demo',
+      webUrl: 'https://github.com/kabmo/demo/wiki',
+      revision: '0000000000000000000000000000000000000000',
+      updatedAt: new Date().toISOString(),
+    },
+    entries,
+    sidebar: null,
+    generatedAt: new Date().toISOString(),
+    isMock: true,
+  };
+}
+
+export async function buildWikiRepoPayload(
+  rootDir: string,
+  repo: string,
+  options: { refresh?: boolean } = {},
+): Promise<WikiRepoPayload> {
+  const generatedAt = new Date().toISOString();
+
+  if (isMockMode()) return mockPayload();
+
+  const targetDir = await scopeToRepo(rootDir, repo);
+
+  const { remote, error } = await readOriginRemote(targetDir);
+  if (!remote) {
+    const payload: WikiRepoPayload = {
+      repo: null,
+      entries: [],
+      reason: 'no-remote',
+      detail: error || 'This repository has no origin remote',
+      generatedAt,
+      isMock: false,
+    };
+    return payload;
+  }
+
+  const parsed = parseWikiRemote(remote);
+  if (!parsed) {
+    const payload: WikiRepoPayload = {
+      repo: null,
+      entries: [],
+      reason: 'unsupported-remote',
+      detail: `No wiki can be derived from ${redactRemoteUrl(remote)}`,
+      generatedAt,
+      isMock: false,
+    };
+    return payload;
+  }
+
+  const mirror = await ensureWikiMirror(parsed.host, parsed.slug, parsed.wikiRemote, options.refresh === true);
+  if (!mirror.ok) {
+    const payload: WikiRepoPayload = {
+      repo: null,
+      entries: [],
+      reason: mirror.reason,
+      detail: mirror.detail,
+      generatedAt,
+      isMock: false,
+    };
+    return payload;
+  }
+
+  // Probed only now, when the host is known to be reachable and a wiki exists.
+  const provider = await detectWikiProvider(parsed.host);
+  const paths = await listWikiPaths(mirror.mirror.repoDir);
+  const entries = buildWikiEntries(paths);
+
+  // The wiki's own navigation, when the author wrote one: the panel renders its
+  // grouping and labels instead of re-deriving a tree from the file layout. Any
+  // page it does not mention is appended, so nothing becomes unreachable.
+  const sidebarPath = findWikiSidebarPath(paths);
+  let sidebar: WikiNavSection[] | null = null;
+  if (sidebarPath) {
+    const file = await readWikiPage(mirror.mirror.repoDir, sidebarPath);
+    if (file.ok) sidebar = withRemainingPages(parseWikiSidebar(file.text, sidebarPath, entries), entries);
+  }
+
+  const payload: WikiRepoPayload = {
+    repo: {
+      provider,
+      host: parsed.host,
+      slug: parsed.slug,
+      remote: redactRemoteUrl(remote),
+      webUrl: wikiWebUrl(provider, parsed.host, parsed.slug),
+      revision: mirror.mirror.revision,
+      updatedAt: mirror.mirror.updatedAt,
+    },
+    entries,
+    sidebar,
+    generatedAt,
+    isMock: false,
+  };
+  return payload;
+}

package/src/server/lib/wiki/provider.server.ts

@@ -0,0 +1,84 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Which wiki host is in front of us.
+ *
+ * The content read needs no provider at all — GitHub and GitLab publish the
+ * same `.wiki.git` — but two things the reader shows do: the label in the header
+ * and the "open in browser" URL, and the two hosts spell a wiki page
+ * differently (`/wiki/Page` against `/-/wikis/Page`).
+ *
+ * `github.com` and `gitlab.com` are decided by name, with no request. Anything
+ * else is probed once per host: a GitLab instance answers `/api/v4/version` with
+ * JSON (401 unauthenticated, 200 with a token), and the self-hosted GitLab this
+ * feature was built against does exactly that. The probe runs only AFTER a wiki
+ * fetch has succeeded, so it never delays the common failure path, and its
+ * verdict — including "not GitLab" — is cached for the life of the process.
+ */
+
+import type { WikiProvider } from '@/shared/types/wiki';
+
+const HOST_PROBE_TIMEOUT_MS = 3_000;
+
+interface HostVerdict {
+  provider: WikiProvider;
+  at: number;
+}
+
+/** One day: a host does not change product between two panel reads. */
+const VERDICT_TTL_MS = 24 * 60 * 60 * 1000;
+
+interface ProviderCacheHost {
+  hosts: Map<string, HostVerdict>;
+}
+
+declare global {
+  // eslint-disable-next-line no-var
+  var __kabmoWikiProviders: ProviderCacheHost | undefined;
+}
+
+function cache(): Map<string, HostVerdict> {
+  globalThis.__kabmoWikiProviders ??= { hosts: new Map() };
+  return globalThis.__kabmoWikiProviders.hosts;
+}
+
+function byName(host: string): WikiProvider | null {
+  const lower = host.toLowerCase();
+  if (lower === 'github.com' || lower.endsWith('.github.com')) return 'github';
+  if (lower === 'gitlab.com' || lower.endsWith('.gitlab.com')) return 'gitlab';
+  // A self-hosted instance named after the product (`gitlab.example.com`).
+  if (/(^|[.-])gitlab([.-]|$)/.test(lower)) return 'gitlab';
+  return null;
+}
+
+/** True when the host answers GitLab's version endpoint the way GitLab does. */
+async function answersAsGitlab(host: string): Promise<boolean> {
+  try {
+    const response = await fetch(`https://${host}/api/v4/version`, {
+      method: 'GET',
+      signal: AbortSignal.timeout(HOST_PROBE_TIMEOUT_MS),
+      headers: { accept: 'application/json' },
+    });
+    // 401 is the unauthenticated answer and is as good a signal as 200.
+    if (response.status !== 200 && response.status !== 401) return false;
+    return (response.headers.get('content-type') ?? '').includes('json');
+  } catch {
+    return false;
+  }
+}
+
+export async function detectWikiProvider(host: string): Promise<WikiProvider> {
+  const known = byName(host);
+  if (known) return known;
+
+  const verdicts = cache();
+  const cached = verdicts.get(host);
+  if (cached && Date.now() - cached.at < VERDICT_TTL_MS) return cached.provider;
+
+  const provider: WikiProvider = (await answersAsGitlab(host)) ? 'gitlab' : 'other';
+  verdicts.set(host, { provider, at: Date.now() });
+  return provider;
+}

package/src/server/lib/wiki/remote.test.ts

@@ -0,0 +1,84 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The remote → wiki URL mapping.
+ *
+ * Both hosts publish a wiki at `<origin>.wiki.git`, which is the whole reason
+ * one implementation covers them; the cases here are the shapes a real
+ * workspace holds — the public HTTPS remote, the self-hosted GitLab remote that
+ * carries its own basic-auth user, and an SSH remote — plus the ones that must
+ * be refused rather than fetched (a local path, an empty value).
+ *
+ * The credential case is the load-bearing one: the URL that authenticates the
+ * fetch is the URL that must never reach the page.
+ */
+
+import { describe, expect, test } from 'bun:test';
+import { parseWikiRemote, redactRemoteUrl, wikiWebUrl } from '@/server/lib/wiki/remote';
+
+describe('parseWikiRemote', () => {
+  test('appends the wiki suffix to an https remote', () => {
+    const parsed = parseWikiRemote('https://github.com/jgraph/drawio.git');
+    expect(parsed).toMatchObject({
+      host: 'github.com',
+      slug: 'jgraph/drawio',
+      projectUrl: 'https://github.com/jgraph/drawio',
+      wikiRemote: 'https://github.com/jgraph/drawio.wiki.git',
+    });
+  });
+
+  test('works on a remote with no .git suffix', () => {
+    expect(parseWikiRemote('https://github.com/rajebdev/outline-cli')?.wikiRemote)
+      .toBe('https://github.com/rajebdev/outline-cli.wiki.git');
+  });
+
+  test('keeps a self-hosted remote’s own credentials on the fetch URL', () => {
+    const parsed = parseWikiRemote('https://user:token@git-rbi.jatismobile.com/jns6_5/drrealhandler.git');
+    expect(parsed?.host).toBe('git-rbi.jatismobile.com');
+    expect(parsed?.slug).toBe('jns6_5/drrealhandler');
+    // The fetch URL authenticates the way the checkout does …
+    expect(parsed?.wikiRemote).toBe('https://user:token@git-rbi.jatismobile.com/jns6_5/drrealhandler.wiki.git');
+    // … and the project URL that leaves the server does not.
+    expect(parsed?.projectUrl).toBe('https://git-rbi.jatismobile.com/jns6_5/drrealhandler');
+  });
+
+  test('keeps a GitLab subgroup in the slug', () => {
+    const parsed = parseWikiRemote('ssh://git@gitlab.com/group/sub/proj.git');
+    expect(parsed?.slug).toBe('group/sub/proj');
+    // The fetch URL keeps the remote's own user, exactly as `git fetch` needs it.
+    expect(parsed?.wikiRemote).toBe('ssh://git@gitlab.com/group/sub/proj.wiki.git');
+  });
+
+  test('accepts an scp-style remote', () => {
+    const parsed = parseWikiRemote('git@github.com:owner/name.git');
+    expect(parsed).toMatchObject({ host: 'github.com', slug: 'owner/name', wikiRemote: 'git@github.com:owner/name.wiki.git' });
+  });
+
+  test('refuses anything a wiki cannot hang off', () => {
+    for (const remote of ['', '   ', '/local/bare/path.git', 'https://github.com/onlyowner', 'not a url']) {
+      expect(parseWikiRemote(remote)).toBe(null);
+    }
+  });
+});
+
+describe('redactRemoteUrl', () => {
+  test('strips the credential and nothing else', () => {
+    expect(redactRemoteUrl('https://user:token@host/o/n.git')).toBe('https://host/o/n.git');
+    expect(redactRemoteUrl('https://host/o/n.git')).toBe('https://host/o/n.git');
+    expect(redactRemoteUrl('git@host:o/n.git')).toBe('git@host:o/n.git');
+  });
+});
+
+describe('wikiWebUrl', () => {
+  test('uses each host’s own wiki path', () => {
+    expect(wikiWebUrl('github', 'github.com', 'jgraph/drawio')).toBe('https://github.com/jgraph/drawio/wiki');
+    expect(wikiWebUrl('gitlab', 'gitlab.com', 'gitlab-org/cli')).toBe('https://gitlab.com/gitlab-org/cli/-/wikis/home');
+  });
+
+  test('says nothing for a host it cannot address', () => {
+    expect(wikiWebUrl('other', 'git.example.test', 'o/n')).toBe(null);
+  });
+});

package/src/server/lib/wiki/remote.ts

@@ -0,0 +1,104 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * The git remote → the wiki repository behind it.
+ *
+ * Both GitHub and GitLab publish a project's wiki as a SEPARATE git repository
+ * whose URL is the project's own with `.wiki.git` on the end, so Kabmo
+ * needs no provider API, no token scope and no per-host branch: it appends the
+ * suffix to whatever `origin` already is. That is also why a self-hosted GitLab
+ * (`git-rbi.jatismobile.com/jns6_5/drrealhandler`) works with no code of its own
+ * — verified against the real host, whose `drrealhandler.wiki.git` clones the
+ * same pages its web UI shows.
+ *
+ * The suffix is appended to the remote VERBATIM, credentials and scheme
+ * included, because the fetch has to authenticate the way the checkout does: a
+ * self-hosted GitLab URL in this workspace carries its own basic-auth user, and
+ * an SSH remote has to stay SSH. What travels back to the page is a separate,
+ * credential-free URL — see `redactRemoteUrl`.
+ */
+
+/** A remote, split into what the fetch needs and what the reader may see. */
+export interface ParsedWikiRemote {
+  /** Host of the remote, port included when it has one (`github.com`). */
+  host: string;
+  /** `owner/name`, subgroups included, without `.git`. */
+  slug: string;
+  /** Credential-free `https://host/owner/name` of the PROJECT. */
+  projectUrl: string;
+  /** The wiki repository, in the remote's own scheme and with its own credentials. */
+  wikiRemote: string;
+}
+
+/** `git@github.com:owner/name.git` — a scheme-less scp-style remote. */
+const SCP_LIKE_RE = /^(?:[^@/]+@)?([^:/]+):(.+)$/;
+
+function stripGitSuffix(value: string): string {
+  return value.replace(/\/+$/, '').replace(/\.git$/i, '');
+}
+
+/**
+ * Parse one git remote URL into its wiki parts, or null when it is not a URL a
+ * wiki can hang off (a local path, an empty value, a bare host).
+ *
+ * Accepts the three shapes git itself accepts: `https://host/o/n.git`,
+ * `ssh://git@host/o/n.git`, and `git@host:o/n.git`.
+ */
+export function parseWikiRemote(rawRemote: string | null | undefined): ParsedWikiRemote | null {
+  const raw = (rawRemote ?? '').trim();
+  if (!raw || raw.includes('://') === false && !SCP_LIKE_RE.test(raw)) return null;
+
+  let host: string;
+  let pathPart: string;
+  let scheme = 'https';
+
+  const scp = raw.includes('://') ? null : raw.match(SCP_LIKE_RE);
+  if (scp) {
+    host = scp[1];
+    pathPart = scp[2];
+  } else {
+    let url: URL;
+    try {
+      url = new URL(raw);
+    } catch {
+      return null;
+    }
+    // `new URL` lower-cases the host and drops the default port, so the same
+    // remote spelled two ways keys one cache entry.
+    host = url.host;
+    scheme = url.protocol === 'http:' ? 'http' : 'https';
+    pathPart = url.pathname;
+  }
+
+  const slug = stripGitSuffix(pathPart.replace(/^\/+/, ''));
+  // A wiki needs an owner and a project; a local path or a bare host is not one.
+  if (!host || slug.split('/').filter(Boolean).length < 2) return null;
+
+  return {
+    host,
+    slug,
+    projectUrl: `${scheme}://${host}/${slug}`,
+    wikiRemote: `${stripGitSuffix(raw)}.wiki.git`,
+  };
+}
+
+/**
+ * The credential-free form of a remote, for anything that leaves the server.
+ *
+ * `https://user:token@host/o/n.git` is how a self-hosted GitLab authenticates
+ * from this workspace, and echoing it back would put a secret in the DOM, the
+ * devtools network tab and any screenshot of the panel.
+ */
+export function redactRemoteUrl(rawRemote: string): string {
+  return rawRemote.replace(/^([a-z][a-z0-9+.-]*:\/\/)[^@/]*@/i, '$1');
+}
+
+/** The wiki's web page, per provider. Null when the host is not recognised. */
+export function wikiWebUrl(provider: 'github' | 'gitlab' | 'other', host: string, slug: string): string | null {
+  if (provider === 'github') return `https://${host}/${slug}/wiki`;
+  if (provider === 'gitlab') return `https://${host}/${slug}/-/wikis/home`;
+  return null;
+}

package/src/server/lib/workspace/register-folder.server.ts

@@ -0,0 +1,78 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Insert one workspace folder row, with the side effects every creation path
+ * owes.
+ *
+ * Two routes create a workspace — `POST /api/folders` (the user named a
+ * directory) and `POST /api/folders/clone` (a repository was cloned into one)
+ * — and the parts that matter are the ones a second copy gets wrong:
+ *
+ * - **The name is unique case-insensitively.** The sidebar lists folders by
+ *   name, so a second folder called `kabmo` beside the first is indistinguishable.
+ * - **A tombstone for the same project path is cleared.** `deleted_workspaces`
+ *   remembers a removed folder so the omp discovery sync does not resurrect
+ *   it; re-adding that path by hand is the user overriding the tombstone, and
+ *   leaving it would make the folder vanish on the next boot. Cleared by
+ *   CANONICAL key, because a tombstone may hold the unresolved spelling of the
+ *   same directory (`/var/...` vs `/private/var/...` on macOS).
+ * - **The skill-discovery watcher set grows with the folder.** A new workspace
+ *   brings its own `.omp/skills` into scope; without the sync a skill created
+ *   there stays invisible to a live session until the server restarts.
+ * - **The sidebar is told.** A folder is structure, so the signal is what
+ *   republishes the list to every open tab.
+ */
+
+import type { DbClient } from '@/server/lib/db/client';
+import { projectPathKey } from '@/server/lib/omp/core/paths';
+import { syncDiscoveryRootsWatch } from '@/server/lib/omp/config/roots-watch.server';
+import { emitRealtimeSignal } from '@/server/lib/realtime/signals.server';
+
+export type RegisterFolderResult =
+  | { ok: true; id: number; name: string }
+  | { ok: false; code: 'duplicate_name'; error: string };
+
+/**
+ * The name a folder is listed under when the caller did not supply one: the
+ * directory's basename, lowercased, so a path-only request still yields a name
+ * the user recognizes.
+ */
+export function defaultFolderName(projectPath: string): string {
+  const withoutTrailing = projectPath.replace(/[\\/]+$/, '');
+  return (withoutTrailing.split(/[\\/]/).pop() ?? '').toLowerCase();
+}
+
+export async function registerWorkspaceFolder(
+  db: DbClient,
+  input: { name: string; projectPath: string | null },
+): Promise<RegisterFolderResult> {
+  const existing = await db.get('SELECT id FROM workspace_folders WHERE lower(name) = lower(?)', [input.name]);
+  if (existing) {
+    return { ok: false, code: 'duplicate_name', error: 'A workspace with this name already exists' };
+  }
+
+  if (input.projectPath) {
+    const target = projectPathKey(input.projectPath);
+    const tombstones = await db.all<{ project_path: string | null }>(
+      'SELECT project_path FROM deleted_workspaces',
+    );
+    for (const row of tombstones) {
+      if (typeof row.project_path !== 'string') continue;
+      if (projectPathKey(row.project_path) !== target) continue;
+      await db.run('DELETE FROM deleted_workspaces WHERE project_path = ?', [row.project_path]);
+    }
+  }
+
+  const result = await db.run(
+    'INSERT INTO workspace_folders (name, is_expanded, project_path) VALUES (?, 1, ?)',
+    [input.name, input.projectPath],
+  );
+
+  void syncDiscoveryRootsWatch();
+  emitRealtimeSignal('sidebar-structure');
+
+  return { ok: true, id: result.lastID, name: input.name };
+}

package/src/server/mock.server.ts

@@ -0,0 +1,27 @@
+/**
+ * @license
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Utility to determine whether the application is running in MOCK mode.
+ *
+ * - When MOCK=true (or MOCK=1): all data uses mock / simulated presets (demo chat traces, mock token analytics, mock settings presets).
+ * - When MOCK=false (or MOCK=0): all data uses real data (real SQLite persistence, real token calculations, real workspace state).
+ * - Unset (or any unrecognized value) defaults to REAL data — Kabmo is a
+ *   diagnostic console for a live omp install, so demo presets must be opted
+ *   into explicitly rather than inherited by omission.
+ */
+export function isMockMode(): boolean {
+  const envVal = (Bun.env.MOCK || '').trim().toLowerCase();
+
+  return envVal === 'true' || envVal === '1' || envVal === 'on' || envVal === 'yes';
+}
+
+export function getMockModeInfo(): { isMock: boolean; rawEnv: string } {
+  const isMock = isMockMode();
+  return {
+    isMock,
+    rawEnv: Bun.env.MOCK || (isMock ? 'true' : 'false (default)'),
+  };
+}

package/src/server/plugins/compress.ts

@@ -0,0 +1,79 @@
+// node:zlib stays for brotli only — Bun has no brotli API (Bun.brotliCompressSync is undefined).
+import { brotliCompressSync, constants } from 'node:zlib';
+
+/**
+ * Compresses a response body, except `text/event-stream`.
+ *
+ * SSE must never be compressed: zlib holds small frames until its buffer
+ * fills, so a compressed event stream delivers nothing until it ends. This
+ * mirrors the Express `compression({ filter })` it replaces.
+ *
+ * The incoming body is buffered and a fresh `Response` is returned, because a
+ * `Response` body can only be read once — reading it here would otherwise
+ * leave Elysia nothing to send.
+ *
+ * Encodings are offered best-first: zstd, brotli, gzip. On a 905 KiB JSON body
+ * the three measured 0.48 ms / 8 KiB, 1.05 ms / 7 KiB and 2.22 ms / 19 KiB —
+ * zstd is both the fastest and, within 14% of brotli's ratio, effectively as
+ * small, and it stays ahead at every payload size measured (0.004 ms against
+ * 0.007 ms for gzip at 2 KiB). Brotli remains for a client that accepts `br`
+ * but not `zstd`, and gzip is the floor every client has.
+ */
+const MIN_BYTES = 1024;
+
+const COMPRESSIBLE = /^(text\/|application\/(json|javascript|xml|wasm|svg))/;
+
+/** Compression encodings this server can produce, best first. */
+const ENCODINGS = ['zstd', 'br', 'gzip'] as const;
+
+type Encoding = (typeof ENCODINGS)[number];
+
+/**
+ * The best encoding the client accepts, or null.
+ *
+ * Plain substring matching, matching the previous `includes('br')` behavior: a
+ * browser's `Accept-Encoding` is an explicit set of alternatives, not a
+ * preference ordering this server has to weigh.
+ */
+function negotiateEncoding(acceptEncoding: string): Encoding | null {
+  for (const encoding of ENCODINGS) {
+    if (acceptEncoding.includes(encoding)) return encoding;
+  }
+  return null;
+}
+
+function compress(body: Uint8Array<ArrayBuffer>, encoding: Encoding): Uint8Array {
+  if (encoding === 'zstd') return Bun.zstdCompressSync(body, { level: 3 });
+  if (encoding === 'br') {
+    return brotliCompressSync(body, { params: { [constants.BROTLI_PARAM_QUALITY]: 4 } });
+  }
+  return Bun.gzipSync(body, { level: 6 });
+}
+
+export async function maybeCompress(response: Response, acceptEncoding: string | null): Promise<Response> {
+  if (!acceptEncoding) return response;
+  const contentType = response.headers.get('content-type') ?? '';
+  if (contentType.includes('text/event-stream')) return response;
+  if (!COMPRESSIBLE.test(contentType)) return response;
+  if (response.status === 204 || response.status === 304) return response;
+
+  const encoding = negotiateEncoding(acceptEncoding);
+  if (!encoding) return response;
+
+  const buffer = new Uint8Array(await response.arrayBuffer()) as Uint8Array<ArrayBuffer>;
+  if (buffer.byteLength < MIN_BYTES) {
+    // Body already consumed — hand back a rebuilt Response over the same bytes.
+    return rebuild(response, buffer);
+  }
+
+  const compressed = compress(buffer, encoding);
+  const headers = new Headers(response.headers);
+  headers.set('content-encoding', encoding);
+  headers.set('content-length', String(compressed.byteLength));
+  headers.append('vary', 'accept-encoding');
+  return new Response(compressed, { status: response.status, headers });
+}
+
+function rebuild(response: Response, buffer: Uint8Array): Response {
+  return new Response(buffer, { status: response.status, headers: response.headers });
+}