@lovrozagar/honey 0.6.8 → 0.7.1

package/src/context.ts

@@ -1,6 +1,11 @@
 import { isNodeOutbound } from "./honey-response.ts"
+import type { HoneyError } from "./error.ts"
+import type { ProducerOptions } from "./producer-stream.ts"
 import type { SSEOptions, SSEStream, TypedResponse } from "./response.ts"
 import { HoneyRes } from "./response.ts"
+import { dict } from "./dict.ts"
+import { peerAddressOf } from "./peer.ts"
+import { resolveClient, TRUST_OFF, type ClientInfo, type TrustSetting } from "./client-info.ts"
 import type { PendingTap } from "./types.ts"
 import { EMPTY_OBJ } from "./types.ts"
 import { parseCookies } from "./validation.ts"
@@ -11,11 +16,22 @@ import { parseCookies } from "./validation.ts"
  */
 class ContextRes extends HoneyRes {
 	private _req: Request
+	private _ctx: HoneyContext<unknown>
 	private _lastEventId: string | undefined | false = false
 
-	constructor(req: Request) {
+	constructor(req: Request, ctx: HoneyContext<unknown>) {
 		super(isNodeOutbound(req))
 		this._req = req
+		this._ctx = ctx
+	}
+
+	/** Streams end with the request: `ctx.signal`. Producer failures go to the app logger. */
+	protected override _producer(): ProducerOptions {
+		const ctx = this._ctx
+		return {
+			report: (err) => reportStreamError(ctx, err),
+			signal: () => ctx.signal,
+		}
 	}
 
 	override sse(
@@ -33,23 +49,41 @@ class ContextRes extends HoneyRes {
 }
 function parseSearch(ctx: HoneyContext): void {
 	const url = ctx._lzUrlFn ? ctx._lzUrlFn() : new URL(ctx.req.url)
-	const first: Record<string, string> = {}
-	const all: Record<string, string[]> = {}
+	/* keys are request data: no prototype, so `?__proto__=` or `?toString=` is just a key */
+	const first = dict<string>()
+	const all = dict<string[]>()
 	for (const [key, value] of url.searchParams) {
-		if (first[key] === undefined) {
+		const values = all[key]
+		if (values === undefined) {
 			first[key] = value
 			all[key] = [value]
 		} else {
-			const values = all[key]
-			if (values) {
-				values.push(value)
-			}
+			values.push(value)
 		}
 	}
 	ctx._lzSearch = first
 	ctx._lzSearchAll = all
 }
 
+/** What `ctx._rq` carries for client-info resolution; the dispatcher's FetchCtx has these fields. */
+type ClientSource = { env?: unknown; request?: Request; trust?: TrustSetting }
+
+/**
+ * The client address, scheme and host of the request `ctx` serves, decided by the app's
+ * `trustProxy()` setting. `ctx.ip` is its `ip`.
+ */
+export function clientInfo(ctx: HoneyContext<never> | HoneyContext): ClientInfo {
+	const c = ctx as HoneyContext
+	if (c._lzClient === null) {
+		const src = (c._rq ?? {}) as ClientSource
+		/* the peer is registered on the request the adapter handed over; headers are read from
+		 * ctx.req, which survives Deno's upgrade (a header snapshot) */
+		const peer = peerAddressOf(src.request ?? c.req, src.env ?? c.env)
+		c._lzClient = resolveClient(src.trust ?? TRUST_OFF, c.req, peer)
+	}
+	return c._lzClient
+}
+
 function bgSwallow(p: Promise<unknown>) {
 	p.catch(noop)
 }
@@ -63,6 +97,44 @@ function noop() {}
  * `declare` fields have no private brand, so Omit<HoneyContext, "res">
  * works structurally for ApplyOutput type narrowing.
  */
+type Logger = { error?: (obj: unknown, msg?: string) => void }
+
+function reportStreamError(ctx: HoneyContext<unknown>, err: unknown): void {
+	const log = (ctx._rq as { log?: Logger } | null)?.log
+	if (typeof log?.error === "function") {
+		log.error({ err, path: ctx.path }, "stream producer failed")
+		return
+	}
+	console.error("honey: stream producer failed", err)
+}
+
+/**
+ * Abort `ctx.signal` (with `reason`) for the request `ctx` serves: `timeout()` uses it. Streams
+ * still running for the request end, and handlers that pass the signal on stop their work.
+ */
+export function abortRequest(ctx: HoneyContext<never> | HoneyContext, reason?: unknown): void {
+	const c = ctx as HoneyContext
+	if (c._ac === null) linkSignal(c)
+	c._ac?.abort(reason)
+}
+
+/** Create `ctx.signal`, following the request's own signal (client disconnect, shutdown). */
+function linkSignal(ctx: HoneyContext): AbortSignal {
+	const ac = new AbortController()
+	ctx._ac = ac
+	let request: AbortSignal | undefined
+	try {
+		request = ctx.req.signal
+	} catch {
+		/* a request shim without a signal: only timeout() can abort */
+	}
+	if (request !== undefined && request !== null) {
+		if (request.aborted) ac.abort(request.reason)
+		else request.addEventListener("abort", () => ac.abort(request.reason), { once: true })
+	}
+	return ac.signal
+}
+
 export class HoneyContext<TEnv = Record<string, unknown>> {
 	readonly background: (p: Promise<unknown>) => void
 	readonly env: TEnv
@@ -75,14 +147,39 @@ export class HoneyContext<TEnv = Record<string, unknown>> {
 	declare readonly errors: Record<string, (...args: never[]) => unknown>
 	declare readonly executionCtx: { waitUntil?: (p: Promise<unknown>) => void } | undefined
 	declare readonly headers: Record<string, string>
+	/**
+	 * The client's IP address in canonical form (`::ffff:1.2.3.4` is `1.2.3.4`), or `null` when
+	 * the runtime does not report one. Behind reverse proxies, set `app.trustProxy()`; until then
+	 * this is the proxy's address and forwarding headers are ignored.
+	 */
+	declare readonly ip: string | null
 	declare readonly meta: Record<string, unknown>
 	declare readonly path: string
-	declare readonly realtime: { publish(topic: string, data: unknown): void }
+	/** Publish into a realtime namespace (see `RealtimePublisher`); spelled out so generated types inline it. */
+	declare readonly realtime: {
+		publish(topic: string, data: unknown): void
+		namespace(name: string): { publish(topic: string, data: unknown): void }
+	}
 	declare readonly routePattern: string
 	declare readonly search: Record<string, string>
 	declare readonly searchAll: Record<string, string[]>
+	/**
+	 * Aborts when the client disconnects, when `timeout()` fires, or when the server shuts down.
+	 * Pass it to `fetch()`, database drivers and timers so abandoned work stops; streams from
+	 * `ctx.res.sse()`, `stream()` and `generate()` already end with it.
+	 */
+	declare readonly signal: AbortSignal
+	/**
+	 * The error behind the response, once a handler or a deeper middleware threw and the
+	 * `next()` boundary turned it into an error response; `undefined` while nothing failed.
+	 * Read it after `await next()` for metrics, logs or reporting: `errorKey`, `status`, and
+	 * `cause` (the original throw when it was not a `HoneyError`). Later errors replace it.
+	 */
+	declare readonly error: HoneyError | undefined
 
 	/* backing state for lazy getters — stored directly on instance to avoid extra object allocation */
+	/** @internal */ _ac: AbortController | null
+	/** @internal */ _lzClient: ClientInfo | null
 	/** @internal */ _lzCookies: Record<string, string> | null
 	/** @internal */ _lzHeaders: Record<string, string> | null
 	/** @internal */ _lzSearch: Record<string, string> | null
@@ -96,6 +193,9 @@ export class HoneyContext<TEnv = Record<string, unknown>> {
 	/* tap side-effects — queued by c.tap(), drained after handler */
 	/** @internal */ _pendingTaps: PendingTap[] | null
 
+	/* the request this context serves — read by the error boundary and terminal handlers */
+	/** @internal */ _rq: unknown
+
 	constructor(opts: {
 		env: TEnv
 		executionCtx?: { waitUntil?: (p: Promise<unknown>) => void }
@@ -109,7 +209,7 @@ export class HoneyContext<TEnv = Record<string, unknown>> {
 		this.req = opts.req
 		this.env = opts.env
 		this.params = opts.params
-		this.res = new ContextRes(opts.req)
+		this.res = new ContextRes(opts.req, this as HoneyContext<unknown>)
 
 		/* direct assignment — no defineProperty */
 		;(this as Record<string, unknown>)["executionCtx"] = opts.executionCtx
@@ -127,6 +227,8 @@ export class HoneyContext<TEnv = Record<string, unknown>> {
 			: bgSwallow
 
 		/* lazy getter backing — flat on instance, no extra object */
+		this._ac = null
+		this._lzClient = null
 		this._lzCookies = null
 		this._lzHeaders = null
 		this._lzSearch = null
@@ -134,11 +236,14 @@ export class HoneyContext<TEnv = Record<string, unknown>> {
 		this._lzUrlFn = opts.urlFn ?? null
 
 		/* error propagation */
+		;(this as Record<string, unknown>)["error"] = undefined
 		this._errorToResponse = null
 		this._isErrorResponse = false
 
 		/* taps */
 		this._pendingTaps = null
+
+		this._rq = null
 	}
 
 	/** @internal */
@@ -173,7 +278,7 @@ export class HoneyContext<TEnv = Record<string, unknown>> {
 			enumerable: true,
 			get(this: HoneyContext): Record<string, string> {
 				if (this._lzHeaders === null) {
-					const h: Record<string, string> = {}
+					const h = dict<string>()
 					this.req.headers.forEach((value, key) => {
 						h[key] = value
 					})
@@ -182,6 +287,20 @@ export class HoneyContext<TEnv = Record<string, unknown>> {
 				return this._lzHeaders
 			},
 		})
+		Object.defineProperty(HoneyContext.prototype, "ip", {
+			configurable: true,
+			enumerable: true,
+			get(this: HoneyContext): string | null {
+				return clientInfo(this).ip
+			},
+		})
+		Object.defineProperty(HoneyContext.prototype, "signal", {
+			configurable: true,
+			enumerable: true,
+			get(this: HoneyContext): AbortSignal {
+				return this._ac === null ? linkSignal(this) : this._ac.signal
+			},
+		})
 		Object.defineProperty(HoneyContext.prototype, "search", {
 			configurable: true,
 			enumerable: true,

package/src/cookie-sign.ts

@@ -1,10 +1,56 @@
 const encoder = new TextEncoder()
 
+/**
+ * Signed value formats:
+ *
+ * - v2 (current): `<value>.~<sig>`, where `sig` is the HMAC-SHA256 of
+ *   `"honey-cookie-v2\0" + name + "\0" + value`. The cookie name is bound into
+ *   the MAC, so a signature cannot be replayed under another cookie that shares
+ *   the secret. `~` is outside the base64url alphabet, so the two formats never
+ *   overlap.
+ * - v1 (legacy): `<value>.<sig>`, the HMAC of the value alone. `verify` accepts
+ *   it while `legacy` is true (the default) so cookies issued before the change
+ *   keep working during a migration window.
+ */
+const V2_MARKER = "~"
+const V2_DOMAIN = "honey-cookie-v2\0"
+/* An HMAC-SHA256 tag is 32 bytes: 43 base64url characters, no padding. */
+const SIG_RE = /^[A-Za-z0-9_-]{43}$/
+
+export type SignOptions = {
+	/** The cookie name to bind the signature to. Pass the same name to `verify`. */
+	name?: string
+}
+
+export type VerifyOptions = {
+	/** The cookie name the signature must be bound to. */
+	name?: string
+	/**
+	 * Also accept legacy (v1) signatures, which are not bound to a name.
+	 * Default `true`; set `false` once every v1 cookie has expired.
+	 */
+	legacy?: boolean
+}
+
+const MAX_CACHED_KEYS = 32
+const keyCache = new Map<string, Promise<CryptoKey>>()
+
 function importKey(secret: string): Promise<CryptoKey> {
-	return crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, [
-		"sign",
-		"verify",
-	])
+	let key = keyCache.get(secret)
+	if (key === undefined) {
+		key = crypto.subtle.importKey("raw", encoder.encode(secret), { hash: "SHA-256", name: "HMAC" }, false, [
+			"sign",
+			"verify",
+		])
+		if (keyCache.size >= MAX_CACHED_KEYS) {
+			const oldest = keyCache.keys().next().value
+			if (oldest !== undefined) keyCache.delete(oldest)
+		}
+		keyCache.set(secret, key)
+		/* A rejected import must not stay cached. */
+		key.catch(() => keyCache.delete(secret))
+	}
+	return key
 }
 
 function toBase64Url(buffer: ArrayBuffer): string {
@@ -16,34 +62,57 @@ function toBase64Url(buffer: ArrayBuffer): string {
 	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")
 }
 
-function fromBase64Url(str: string): Uint8Array {
-	const padded = str.replace(/-/g, "+").replace(/_/g, "/")
-	const binary = atob(padded)
+/** Strict decode: the input must be the canonical encoding of a 32-byte tag. */
+function fromBase64Url(str: string): Uint8Array<ArrayBuffer> | null {
+	if (!SIG_RE.test(str)) return null
+	let binary: string
+	try {
+		binary = atob(str.replace(/-/g, "+").replace(/_/g, "/"))
+	} catch {
+		return null
+	}
 	const bytes = new Uint8Array(binary.length)
 	for (let i = 0; i < binary.length; i++) {
 		bytes[i] = binary.charCodeAt(i)
 	}
+	/* Reject non-zero trailing bits, which would make signatures malleable. */
+	if (toBase64Url(bytes.buffer) !== str) return null
 	return bytes
 }
 
-export async function sign(value: string, secret: string): Promise<string> {
+function v2Payload(name: string, value: string): Uint8Array<ArrayBuffer> {
+	return encoder.encode(`${V2_DOMAIN}${name}\0${value}`)
+}
+
+export async function sign(value: string, secret: string, opts: SignOptions = {}): Promise<string> {
 	const key = await importKey(secret)
-	const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(value))
-	return `${value}.${toBase64Url(signature)}`
+	const signature = await crypto.subtle.sign("HMAC", key, v2Payload(opts.name ?? "", value))
+	return `${value}.${V2_MARKER}${toBase64Url(signature)}`
 }
 
-export async function verify(signed: string, secrets: string[]): Promise<string | null> {
-	if (signed.length === 0) return null
+/** Returns the original value, or `null` when no secret verifies it or the input is malformed. */
+export async function verify(signed: string, secrets: string[], opts: VerifyOptions = {}): Promise<string | null> {
+	if (typeof signed !== "string" || signed.length === 0) return null
 	const lastDot = signed.lastIndexOf(".")
 	if (lastDot === -1) return null
 
 	const value = signed.slice(0, lastDot)
-	const sig = fromBase64Url(signed.slice(lastDot + 1))
+	let sigText = signed.slice(lastDot + 1)
+	const isV2 = sigText.startsWith(V2_MARKER)
+	if (isV2) sigText = sigText.slice(V2_MARKER.length)
+	else if (opts.legacy === false) return null
+
+	const sig = fromBase64Url(sigText)
+	if (sig === null) return null
+	const payload = isV2 ? v2Payload(opts.name ?? "", value) : encoder.encode(value)
 
 	for (const secret of secrets) {
-		const key = await importKey(secret)
-		const valid = await crypto.subtle.verify("HMAC", key, sig.buffer as ArrayBuffer, encoder.encode(value))
-		if (valid) return value
+		try {
+			const key = await importKey(secret)
+			if (await crypto.subtle.verify("HMAC", key, sig, payload)) return value
+		} catch {
+			/* An unusable secret never verifies. */
+		}
 	}
 
 	return null

package/src/cookie.ts

@@ -9,8 +9,11 @@ export type CookieOptions = {
 	value: string
 }
 
+const UNSAFE_KEYS = new Set(["__proto__", "constructor", "prototype"])
+
 /**
- * Percent-encode characters outside the RFC 6265 cookie-octet range.
+ * Percent-encode characters outside the RFC 6265 cookie-octet range, plus `%`
+ * itself so the value always decodes back to what was set.
  * Cookie-octets: 0x21, 0x23-0x2B, 0x2D-0x3A, 0x3C-0x5B, 0x5D-0x7E
  */
 function encodeCookieValue(value: string): string {
@@ -18,13 +21,16 @@ function encodeCookieValue(value: string): string {
 	for (const ch of value) {
 		const c = ch.codePointAt(0) ?? 0
 		if (
-			c === 0x21 ||
-			(c >= 0x23 && c <= 0x2b) ||
-			(c >= 0x2d && c <= 0x3a) ||
-			(c >= 0x3c && c <= 0x5b) ||
-			(c >= 0x5d && c <= 0x7e)
+			c !== 0x25 &&
+			(c === 0x21 ||
+				(c >= 0x23 && c <= 0x2b) ||
+				(c >= 0x2d && c <= 0x3a) ||
+				(c >= 0x3c && c <= 0x5b) ||
+				(c >= 0x5d && c <= 0x7e))
 		) {
 			encoded += ch
+		} else if (c >= 0xd800 && c <= 0xdfff) {
+			throw new TypeError("Cookie value contains a lone surrogate and cannot be encoded")
 		} else {
 			encoded += encodeURIComponent(ch)
 		}
@@ -32,7 +38,52 @@ function encodeCookieValue(value: string): string {
 	return encoded
 }
 
+/**
+ * Decode `%XX` sequences that form valid UTF-8 and keep every other byte as
+ * sent. A stray `%` in a foreign cookie no longer disables decoding for the
+ * whole value.
+ */
+export function decodeCookieValue(value: string): string {
+	if (value.indexOf("%") === -1) return value
+	try {
+		return decodeURIComponent(value)
+	} catch {
+		return value.replace(/(?:%[0-9A-Fa-f]{2})+/g, (run) => {
+			try {
+				return decodeURIComponent(run)
+			} catch {
+				return run
+			}
+		})
+	}
+}
+
+/**
+ * Parse a `Cookie` request header. When a name repeats, the first value wins:
+ * browsers send the cookie with the most specific path first (RFC 6265 §5.4).
+ * Names are trimmed on both sides; empty names and prototype keys are skipped.
+ */
+export function parseCookieHeader(header: string): Record<string, string> {
+	const result: Record<string, string> = {}
+	if (header.length === 0) return result
+	for (const pair of header.split(";")) {
+		const eqIdx = pair.indexOf("=")
+		if (eqIdx === -1) continue
+		const name = pair.slice(0, eqIdx).trim()
+		if (name.length === 0 || UNSAFE_KEYS.has(name) || Object.hasOwn(result, name)) continue
+		let value = pair.slice(eqIdx + 1).trim()
+		/* RFC 6265: strip surrounding double quotes before decoding, so an encoded quote survives. */
+		if (value.length >= 2 && value.charCodeAt(0) === 34 && value.charCodeAt(value.length - 1) === 34) {
+			value = value.slice(1, -1)
+		}
+		result[name] = decodeCookieValue(value)
+	}
+	return result
+}
+
 const validCookieNameRe = /^[\w!#$%&'*.^`|~+-]+$/
+/* A host name or IP literal, optionally with a leading dot. */
+const validDomainRe = /^\.?(?:[A-Za-z0-9-]+\.)*[A-Za-z0-9-]+$|^\[[0-9A-Fa-f:.]+\]$/
 
 export function serializeCookie(name: string, opts: CookieOptions): string {
 	if (!validCookieNameRe.test(name)) {
@@ -42,7 +93,9 @@ export function serializeCookie(name: string, opts: CookieOptions): string {
 	let secure = opts.secure
 	let path = opts.path
 
-	if (name.startsWith("__Host-")) {
+	/* Browsers match the prefixes case-insensitively (RFC 6265bis §4.1.3). */
+	const lower = name.toLowerCase()
+	if (lower.startsWith("__host-")) {
 		if (!opts.secure) throw new Error("__Host- cookies require secure: true")
 		if (opts.domain) throw new Error("__Host- cookies must not set domain")
 		if (opts.path !== "/" && opts.path !== undefined) {
@@ -50,7 +103,7 @@ export function serializeCookie(name: string, opts: CookieOptions): string {
 		}
 		secure = true
 		path = path ?? "/"
-	} else if (name.startsWith("__Secure-")) {
+	} else if (lower.startsWith("__secure-")) {
 		if (!opts.secure) throw new Error("__Secure- cookies require secure: true")
 		secure = true
 	}
@@ -59,10 +112,11 @@ export function serializeCookie(name: string, opts: CookieOptions): string {
 		throw new Error("SameSite=None cookies require secure: true")
 	}
 
-	if (opts.domain && /[;\r\n]/.test(opts.domain)) {
+	if (opts.domain && !validDomainRe.test(opts.domain)) {
 		throw new Error("Cookie domain contains invalid characters")
 	}
-	if (path && /[;\r\n]/.test(path)) {
+	/* av-value: any CHAR except CTLs or ";" (RFC 6265 §4.1.1). */
+	if (path && /[^\x20-\x3a\x3c-\x7e]/.test(path)) {
 		throw new Error("Cookie path contains invalid characters")
 	}
 
@@ -73,7 +127,8 @@ export function serializeCookie(name: string, opts: CookieOptions): string {
 		if (!Number.isFinite(opts.maxAge) || opts.maxAge < 0) {
 			throw new Error(`Invalid cookie Max-Age: ${opts.maxAge}`)
 		}
-		cookie += `; Max-Age=${Math.floor(opts.maxAge)}`
+		/* Clamp so the value prints as digits; browsers cap Max-Age at 400 days anyway. */
+		cookie += `; Max-Age=${Math.min(Math.floor(opts.maxAge), Number.MAX_SAFE_INTEGER)}`
 	}
 	if (opts.expires) {
 		if (Number.isNaN(opts.expires.getTime())) {

package/src/cors.ts

@@ -1,8 +1,9 @@
 import { namedMiddleware } from "./middleware.ts"
-import { replaceResponse } from "./honey-response.ts"
 import type { MiddlewareFn } from "./middleware.ts"
+import { withHeaders } from "./with-headers.ts"
 
 export type CORSOptions = {
+	/** Requires an explicit `origin` list, string or predicate; `"*"` or no origin throws. */
 	credentials?: boolean
 	exposeHeaders?: string[]
 	headers?: string[]
@@ -14,79 +15,79 @@ export type CORSOptions = {
 const DEFAULT_METHODS = ["GET", "HEAD", "PUT", "PATCH", "POST", "DELETE"]
 const DEFAULT_MAX_AGE = 86400
 
+/**
+ * Returns the value for `Access-Control-Allow-Origin`, or null when the origin
+ * is not allowed. The opaque origin `null` (sandboxed iframes, `file:`, some
+ * redirects) is never reflected: any page can produce it.
+ */
 function matchOrigin(origin: string, config: CORSOptions["origin"]): string | null {
 	if (config === undefined || config === "*") return "*"
+	if (origin === "null") return null
 	if (typeof config === "string") return config === origin ? origin : null
 	if (Array.isArray(config)) return config.includes(origin) ? origin : null
-	if (typeof config === "function") return config(origin) ? origin : null
-	return null
+	return config(origin) ? origin : null
+}
+
+/** Append `value` to `Vary` unless it is already listed (or `*`). */
+function addVary(headers: Headers, value: string): void {
+	const current = headers.get("vary")
+	if (current === null || current.trim() === "") {
+		headers.set("vary", value)
+		return
+	}
+	const tokens = current.split(",").map((t) => t.trim().toLowerCase())
+	if (tokens.includes("*") || tokens.includes(value.toLowerCase())) return
+	headers.set("vary", `${current}, ${value}`)
 }
 
 export function cors(options?: CORSOptions): MiddlewareFn<{ req: Request }, {}> {
 	const opts = options ?? {}
 
-	/* credentials + wildcard is a CORS spec violation — auto-narrow to echo origin */
-	const credentialWildcard = opts.credentials === true && (opts.origin === undefined || opts.origin === "*")
+	if (opts.credentials === true && (opts.origin === undefined || opts.origin === "*")) {
+		throw new TypeError(
+			"cors: `credentials: true` needs an explicit `origin` (string, list or predicate). A wildcard would let every site make credentialed requests and read the response.",
+		)
+	}
+
+	/* `Vary: Origin` whenever the answer depends on the request's Origin — that is,
+	 * on every response unless the policy is a plain wildcard. Without it a shared
+	 * cache can serve one origin's ACAO (or its absence) to another. */
+	const varies = !(opts.origin === undefined || opts.origin === "*")
+	const methods = (opts.methods ?? DEFAULT_METHODS).join(", ")
+	const allowHeaders = opts.headers && opts.headers.length > 0 ? opts.headers.join(", ") : null
+	const exposeHeaders = opts.exposeHeaders && opts.exposeHeaders.length > 0 ? opts.exposeHeaders.join(", ") : null
+	const maxAge = String(opts.maxAge ?? DEFAULT_MAX_AGE)
 
 	const mw: MiddlewareFn<{ req: Request }, {}> = async (ctx, next) => {
 		const req = ctx.req
 		const requestOrigin = req.headers.get("origin")
+		const allowedOrigin = requestOrigin === null ? null : matchOrigin(requestOrigin, opts.origin)
 
-		/* no origin → not a CORS request */
-		if (requestOrigin === null) {
-			return next()
-		}
-
-		const allowedOrigin = credentialWildcard ? requestOrigin : matchOrigin(requestOrigin, opts.origin)
-
-		/* origin not allowed */
-		if (allowedOrigin === null) {
-			return next()
-		}
-
-		const isPreflight = req.method === "OPTIONS" && req.headers.has("access-control-request-method")
-
-		/* Vary: Origin whenever response depends on the request origin (non-wildcard) */
-		const needsVary = allowedOrigin !== "*"
-
-		if (isPreflight) {
-			const corsHeaders = new Headers()
-			corsHeaders.set("access-control-allow-origin", allowedOrigin)
-			corsHeaders.set("access-control-allow-methods", (opts.methods ?? DEFAULT_METHODS).join(", "))
-			if (opts.headers && opts.headers.length > 0) {
-				corsHeaders.set("access-control-allow-headers", opts.headers.join(", "))
+		if (allowedOrigin !== null && req.method === "OPTIONS" && req.headers.has("access-control-request-method")) {
+			const headers = new Headers()
+			headers.set("access-control-allow-origin", allowedOrigin)
+			headers.set("access-control-allow-methods", methods)
+			if (allowHeaders !== null) {
+				headers.set("access-control-allow-headers", allowHeaders)
 			} else {
 				const requested = req.headers.get("access-control-request-headers")
-				if (requested) {
-					corsHeaders.set("access-control-allow-headers", requested)
-				}
-			}
-			corsHeaders.set("access-control-max-age", String(opts.maxAge ?? DEFAULT_MAX_AGE))
-			if (opts.credentials) {
-				corsHeaders.set("access-control-allow-credentials", "true")
+				if (requested) headers.set("access-control-allow-headers", requested)
+				addVary(headers, "Access-Control-Request-Headers")
 			}
-			if (needsVary) {
-				corsHeaders.set("vary", "Origin")
-			}
-			return new Response(null, { headers: corsHeaders, status: 204 })
+			headers.set("access-control-max-age", maxAge)
+			if (opts.credentials) headers.set("access-control-allow-credentials", "true")
+			if (varies) addVary(headers, "Origin")
+			return new Response(null, { headers, status: 204 })
 		}
 
-		/* simple/actual request */
 		const response = await next()
-		const headers = new Headers(response.headers)
-		headers.set("access-control-allow-origin", allowedOrigin)
-		if (opts.credentials) {
-			headers.set("access-control-allow-credentials", "true")
-		}
-		if (opts.exposeHeaders && opts.exposeHeaders.length > 0) {
-			headers.set("access-control-expose-headers", opts.exposeHeaders.join(", "))
-		}
-		if (needsVary) {
-			headers.append("vary", "Origin")
-		}
-		return replaceResponse(response, {
-			headers,
-			status: response.status,
+		if (allowedOrigin === null && !varies) return response
+		return withHeaders(response, (headers) => {
+			if (varies) addVary(headers, "Origin")
+			if (allowedOrigin === null) return
+			headers.set("access-control-allow-origin", allowedOrigin)
+			if (opts.credentials) headers.set("access-control-allow-credentials", "true")
+			if (exposeHeaders !== null) headers.set("access-control-expose-headers", exposeHeaders)
 		})
 	}