@naturalcycles/backend-lib 9.77.1 → 9.78.0

package/dist/compressible.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Returns true if the given Content-Type (parameters, e.g `; charset=utf-8`, are ignored) is compressible.
+ *
+ * Vendored (and modernized) from the `compressible` package.
+ * Instead of loading the whole `mime-db` (~2500 types), it's reduced to the equivalent:
+ * a regex + the list of compressible types that the regex doesn't match (as of mime-db@1.54.0).
+ * No type matched by the regex is marked as non-compressible in mime-db.
+ */
+export declare function compressible(type: string): boolean;

package/dist/compressible.js

@@ -0,0 +1,57 @@
+/**
+ * Returns true if the given Content-Type (parameters, e.g `; charset=utf-8`, are ignored) is compressible.
+ *
+ * Vendored (and modernized) from the `compressible` package.
+ * Instead of loading the whole `mime-db` (~2500 types), it's reduced to the equivalent:
+ * a regex + the list of compressible types that the regex doesn't match (as of mime-db@1.54.0).
+ * No type matched by the regex is marked as non-compressible in mime-db.
+ */
+export function compressible(type) {
+    const mime = EXTRACT_TYPE_REGEX.exec(type)[1].toLowerCase();
+    return COMPRESSIBLE_TYPE_REGEX.test(mime) || COMPRESSIBLE_TYPES.has(mime);
+}
+const EXTRACT_TYPE_REGEX = /^\s*([^;\s]*)/;
+const COMPRESSIBLE_TYPE_REGEX = /^text\/|\+(?:json|text|xml)$/;
+const COMPRESSIBLE_TYPES = new Set([
+    'application/dart',
+    'application/ecmascript',
+    'application/javascript',
+    'application/json',
+    'application/octet-stream',
+    'application/postscript',
+    'application/raml+yaml',
+    'application/rtf',
+    'application/tar',
+    'application/toml',
+    'application/vnd.dart',
+    'application/vnd.ms-fontobject',
+    'application/vnd.ms-opentype',
+    'application/wasm',
+    'application/x-httpd-php',
+    'application/x-javascript',
+    'application/x-ns-proxy-autoconfig',
+    'application/x-sh',
+    'application/x-tar',
+    'application/x-virtualbox-hdd',
+    'application/x-virtualbox-ova',
+    'application/x-virtualbox-ovf',
+    'application/x-virtualbox-vbox',
+    'application/x-virtualbox-vdi',
+    'application/x-virtualbox-vhd',
+    'application/x-virtualbox-vmdk',
+    'application/x-www-form-urlencoded',
+    'application/xml',
+    'application/xml-dtd',
+    'font/otf',
+    'font/ttf',
+    'image/bmp',
+    'image/vnd.adobe.photoshop',
+    'image/vnd.microsoft.icon',
+    'image/vnd.ms-dds',
+    'image/x-icon',
+    'image/x-ms-bmp',
+    'message/rfc822',
+    'model/gltf-binary',
+    'x-shader/x-fragment',
+    'x-shader/x-vertex',
+]);

package/dist/onFinished.d.ts

@@ -1,2 +1,14 @@
-import onFinished from 'on-finished';
-export { onFinished };
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/**
+ * Invokes the listener once the request/response has finished (completed, closed or errored).
+ * If it has already finished - the listener is invoked asynchronously (on the next tick).
+ *
+ * Listener runs in the async context (e.g AsyncLocalStorage) of the onFinished caller.
+ *
+ * Vendored (and modernized) from the `on-finished` package, built on top of `stream.finished`.
+ * Stream listeners are attached once per msg (subsequent calls are queued), as `stream.finished`
+ * is too expensive to call per listener (and would exceed the default MaxListeners).
+ */
+export declare function onFinished<T extends IncomingMessage | ServerResponse>(msg: T, listener: Listener<T>): T;
+type Listener<T> = (err: Error | null, msg: T) => void;
+export {};

package/dist/onFinished.js

@@ -1,2 +1,35 @@
-import onFinished from 'on-finished';
-export { onFinished };
+import { AsyncResource } from 'node:async_hooks';
+import { finished } from 'node:stream';
+/**
+ * Invokes the listener once the request/response has finished (completed, closed or errored).
+ * If it has already finished - the listener is invoked asynchronously (on the next tick).
+ *
+ * Listener runs in the async context (e.g AsyncLocalStorage) of the onFinished caller.
+ *
+ * Vendored (and modernized) from the `on-finished` package, built on top of `stream.finished`.
+ * Stream listeners are attached once per msg (subsequent calls are queued), as `stream.finished`
+ * is too expensive to call per listener (and would exceed the default MaxListeners).
+ */
+export function onFinished(msg, listener) {
+    const m = msg;
+    const queue = m[kQueue];
+    if (queue) {
+        queue.push(bindAsyncContext(listener));
+        return msg;
+    }
+    const q = (m[kQueue] = [bindAsyncContext(listener)]);
+    finished(msg, err => {
+        m[kQueue] = undefined;
+        for (const fn of q)
+            fn(err ?? null, msg);
+    });
+    return msg;
+}
+const kQueue = Symbol('onFinished');
+/**
+ * Faster alternative to `AsyncResource.bind` (which is ~0.8µs per call).
+ */
+function bindAsyncContext(fn) {
+    const resource = new AsyncResource('onFinished');
+    return (err, msg) => resource.runInAsyncScope(fn, null, err, msg);
+}

package/dist/onHeaders.d.ts

@@ -0,0 +1,11 @@
+import type { ServerResponse } from 'node:http';
+/**
+ * Invokes the listener once, right before the response writes its headers
+ * (via `res.writeHead`, which is also called implicitly by the first `write`/`end`).
+ *
+ * Headers passed to `writeHead` are applied to `res` before the listener runs,
+ * so the listener sees (and can modify) the final headers and statusCode.
+ *
+ * Vendored (and modernized) from the `on-headers` package.
+ */
+export declare function onHeaders(res: ServerResponse, listener: (this: ServerResponse) => void): void;

package/dist/onHeaders.js

@@ -0,0 +1,56 @@
+/**
+ * Invokes the listener once, right before the response writes its headers
+ * (via `res.writeHead`, which is also called implicitly by the first `write`/`end`).
+ *
+ * Headers passed to `writeHead` are applied to `res` before the listener runs,
+ * so the listener sees (and can modify) the final headers and statusCode.
+ *
+ * Vendored (and modernized) from the `on-headers` package.
+ */
+export function onHeaders(res, listener) {
+    // Loosely typed, to call it with the (statusCode, reason?) signature, bypassing overloads
+    const prevWriteHead = res.writeHead;
+    let fired = false;
+    res.writeHead = function writeHead(statusCode, reasonOrHeaders, headers) {
+        if (fired)
+            return prevWriteHead.apply(this, arguments);
+        fired = true;
+        const reason = typeof reasonOrHeaders === 'string' ? reasonOrHeaders : undefined;
+        headers = reason === undefined ? reasonOrHeaders : headers;
+        this.statusCode = statusCode;
+        if (headers)
+            setHeaders(this, headers);
+        listener.call(this);
+        // Reason phrase is dropped if the listener changed the statusCode
+        return reason !== undefined && this.statusCode === statusCode
+            ? prevWriteHead.call(this, statusCode, reason)
+            : prevWriteHead.call(this, this.statusCode);
+    };
+}
+function setHeaders(res, headers) {
+    if (!Array.isArray(headers)) {
+        for (const k of Object.keys(headers)) {
+            if (k)
+                res.setHeader(k, headers[k]);
+        }
+        return;
+    }
+    if (Array.isArray(headers[0])) {
+        // 2D: [[k, v], [k, v]]
+        for (const [k, v] of headers) {
+            if (k)
+                res.setHeader(k, v);
+        }
+        return;
+    }
+    // 1D (raw): [k, v, k, v], keys may repeat
+    if (headers.length % 2)
+        throw new TypeError('headers array is malformed');
+    for (let i = 0; i < headers.length; i += 2) {
+        res.removeHeader(headers[i]);
+    }
+    for (let i = 0; i < headers.length; i += 2) {
+        if (headers[i])
+            res.appendHeader(headers[i], headers[i + 1]);
+    }
+}

package/dist/server/compressionMiddleware.js

@@ -10,11 +10,11 @@
  * MIT Licensed
  */
 import zlib from 'node:zlib';
-import compressible from 'compressible';
 // @ts-expect-error no types
 import Negotiator from 'negotiator';
-import onHeaders from 'on-headers';
-import vary from 'vary';
+import { compressible } from '../compressible.js';
+import { onHeaders } from '../onHeaders.js';
+import { vary } from '../vary.js';
 const SUPPORTED_ENCODING = ['zstd', 'br', 'gzip', 'deflate', 'identity'];
 const PREFERRED_ENCODING = ['zstd', 'br', 'gzip'];
 const encodingSupported = new Set(['gzip', 'deflate', 'identity', 'br', 'zstd']);

package/dist/server/genericErrorMiddleware.js

@@ -2,6 +2,17 @@ import { _anyToError, _errorLikeToErrorObject } from '@naturalcycles/js-lib/erro
 import { _objectAssign } from '@naturalcycles/js-lib/types';
 const { APP_ENV } = process.env;
 const includeErrorStack = APP_ENV === 'dev';
+// Headers a handler may have set for the response it never got to send;
+// they would wrongly describe the error response (e.g `res.json` keeps a pre-set Content-Type)
+const staleResponseHeaders = [
+    'Content-Type',
+    'Content-Disposition',
+    'Content-Encoding',
+    'Content-Language',
+    'Content-Range',
+    'ETag',
+    'Last-Modified',
+];
 // Hacky way to store the errorService, so it's available to `respondWithError` function
 let errorService;
 let formatError;
@@ -14,17 +25,6 @@ export function genericErrorMiddleware(cfg = {}) {
     errorService ||= cfg.errorReportingService;
     formatError = cfg.formatError;
     return (err, req, res, _next) => {
-        // if (res.headersSent) {
-        // Here we don't even log this error
-        // It's known that it comes from sentry.requestHandler()
-        // requestHandler waits for all promises/timeouts to finish in the request, and then emits this error here,
-        // while `res` is the same as was returned to the User (so, both headers and the data was already returned by that time)
-        // req.log.warn(`genericErrorHandler, but headersSent=true`, err)
-        // Here we don't propagate the error further, cause there's only "default express error logger" behind it
-        // and nothing else. Previously it was logging the same error once again because of this. Avoid.
-        // return next(err)
-        // return next()
-        // }
         respondWithError(req, res, err);
     };
 }
@@ -48,34 +48,45 @@ export function respondWithError(req, res, err) {
         // todo: add endpoint to the log
         // todo: add userId from the "Context" (or, just req.userId?) to the log
     }
-    if (headersSent)
+    if (headersSent) {
+        // Too late for an error response. A finished response needs nothing beyond the reporting above.
+        // An unfinished one (error mid-stream) is cut off, so the client sees a failed transfer right away
+        // instead of waiting for a body that never completes. Same as Express' default error handler.
+        if (!res.writableEnded)
+            res.destroy();
         return;
+    }
     const httpError = _errorLikeToErrorObject(originalError);
     if (!includeErrorStack)
         delete httpError.stack;
     // http-errors (express itself, its body parsers) carry the status they should be answered with
-    httpError.data.backendResponseStatusCode ||= getHttpErrorStatusCode(originalError) || 500; // default to 500
+    const httpErrorLike = isHttpError(originalError) ? originalError : undefined;
+    httpError.data.backendResponseStatusCode ||= httpErrorLike?.statusCode || 500; // default to 500
     _objectAssign(httpError.data, {
         errorId,
         headersSent: headersSent || undefined,
     });
     formatError?.(httpError, req); // Mutates the error
+    for (const header of staleResponseHeaders)
+        res.removeHeader(header);
+    res.setHeader('Cache-Control', 'no-store');
+    if (httpErrorLike?.headers)
+        res.set(httpErrorLike.headers);
     res.status(httpError.data.backendResponseStatusCode).json({
         error: httpError,
     });
 }
 /**
  * Errors created by the `http-errors` package (express itself, body-parser, raw-body, send)
- * carry the HTTP status they are meant to be answered with: `status` and `statusCode` (always equal),
- * plus `expose` (whether the message is safe to show to the client).
- * All three together are the marker: other libraries also put a `statusCode` on their errors
- * (e.g a gateway's response status), which says nothing about how we should respond.
+ * describe the response they expect: `status` and `statusCode` (always equal),
+ * `expose` (whether the message is safe to show to the client) and optional response `headers`.
+ * The first three together are the marker: other libraries also put `statusCode` or `headers`
+ * on their errors (e.g a gateway's response), which say nothing about how we should respond.
  */
-function getHttpErrorStatusCode(err) {
+function isHttpError(err) {
     const { status, statusCode, expose } = err;
-    if (typeof expose !== 'boolean' || typeof statusCode !== 'number' || status !== statusCode)
-        return;
-    if (!Number.isInteger(statusCode) || statusCode < 400 || statusCode > 599)
-        return;
-    return statusCode;
+    if (typeof expose !== 'boolean' || typeof statusCode !== 'number' || status !== statusCode) {
+        return false;
+    }
+    return Number.isInteger(statusCode) && statusCode >= 400 && statusCode <= 599;
 }

package/dist/vary.d.ts

@@ -0,0 +1,8 @@
+import type { ServerResponse } from 'node:http';
+/**
+ * Adds the field (header name) to the response's Vary header, unless it's already there
+ * (case-insensitive). Vary: * stays as is, and adding '*' replaces the whole header with '*'.
+ *
+ * Vendored (and modernized) from the `vary` package.
+ */
+export declare function vary(res: ServerResponse, field: string): void;

package/dist/vary.js

@@ -0,0 +1,25 @@
+/**
+ * Adds the field (header name) to the response's Vary header, unless it's already there
+ * (case-insensitive). Vary: * stays as is, and adding '*' replaces the whole header with '*'.
+ *
+ * Vendored (and modernized) from the `vary` package.
+ */
+export function vary(res, field) {
+    const header = res.getHeader('Vary');
+    const value = Array.isArray(header) ? header.join(', ') : String(header ?? '');
+    if (!value) {
+        res.setHeader('Vary', field);
+        return;
+    }
+    const fields = new Set(value
+        .toLowerCase()
+        .split(',')
+        .map(f => f.trim()));
+    if (field === '*' || fields.has('*')) {
+        if (value !== '*')
+            res.setHeader('Vary', '*');
+    }
+    else if (!fields.has(field.toLowerCase())) {
+        res.setHeader('Vary', `${value}, ${field}`);
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/backend-lib",
   "type": "module",
-  "version": "9.77.1",
+  "version": "9.78.0",
   "dependencies": {
     "@naturalcycles/db-lib": "^10",
     "@naturalcycles/js-lib": "^15",
@@ -10,21 +10,13 @@
     "@types/cookie-parser": "^1",
     "@types/cors": "^2",
     "@types/express": "^5",
-    "@types/compressible": "^2",
-    "@types/on-finished": "^2",
-    "@types/on-headers": "^1",
-    "@types/vary": "^1",
     "busboy": "^1",
-    "compressible": "^2",
     "cookie-parser": "^1",
     "cors": "^2",
     "express": "^5",
     "helmet": "^8",
     "negotiator": "^1",
-    "on-headers": "^1",
-    "on-finished": "^2",
-    "tslib": "^2",
-    "vary": "^1"
+    "tslib": "^2"
   },
   "peerDependencies": {
     "@sentry/node-core": "^10",

package/src/compressible.ts

@@ -0,0 +1,59 @@
+/**
+ * Returns true if the given Content-Type (parameters, e.g `; charset=utf-8`, are ignored) is compressible.
+ *
+ * Vendored (and modernized) from the `compressible` package.
+ * Instead of loading the whole `mime-db` (~2500 types), it's reduced to the equivalent:
+ * a regex + the list of compressible types that the regex doesn't match (as of mime-db@1.54.0).
+ * No type matched by the regex is marked as non-compressible in mime-db.
+ */
+export function compressible(type: string): boolean {
+  const mime = EXTRACT_TYPE_REGEX.exec(type)![1]!.toLowerCase()
+  return COMPRESSIBLE_TYPE_REGEX.test(mime) || COMPRESSIBLE_TYPES.has(mime)
+}
+
+const EXTRACT_TYPE_REGEX = /^\s*([^;\s]*)/
+const COMPRESSIBLE_TYPE_REGEX = /^text\/|\+(?:json|text|xml)$/
+
+const COMPRESSIBLE_TYPES = new Set([
+  'application/dart',
+  'application/ecmascript',
+  'application/javascript',
+  'application/json',
+  'application/octet-stream',
+  'application/postscript',
+  'application/raml+yaml',
+  'application/rtf',
+  'application/tar',
+  'application/toml',
+  'application/vnd.dart',
+  'application/vnd.ms-fontobject',
+  'application/vnd.ms-opentype',
+  'application/wasm',
+  'application/x-httpd-php',
+  'application/x-javascript',
+  'application/x-ns-proxy-autoconfig',
+  'application/x-sh',
+  'application/x-tar',
+  'application/x-virtualbox-hdd',
+  'application/x-virtualbox-ova',
+  'application/x-virtualbox-ovf',
+  'application/x-virtualbox-vbox',
+  'application/x-virtualbox-vdi',
+  'application/x-virtualbox-vhd',
+  'application/x-virtualbox-vmdk',
+  'application/x-www-form-urlencoded',
+  'application/xml',
+  'application/xml-dtd',
+  'font/otf',
+  'font/ttf',
+  'image/bmp',
+  'image/vnd.adobe.photoshop',
+  'image/vnd.microsoft.icon',
+  'image/vnd.ms-dds',
+  'image/x-icon',
+  'image/x-ms-bmp',
+  'message/rfc822',
+  'model/gltf-binary',
+  'x-shader/x-fragment',
+  'x-shader/x-vertex',
+])

package/src/onFinished.ts

@@ -1,3 +1,44 @@
-import onFinished from 'on-finished'
+import { AsyncResource } from 'node:async_hooks'
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { finished } from 'node:stream'
 
-export { onFinished }
+/**
+ * Invokes the listener once the request/response has finished (completed, closed or errored).
+ * If it has already finished - the listener is invoked asynchronously (on the next tick).
+ *
+ * Listener runs in the async context (e.g AsyncLocalStorage) of the onFinished caller.
+ *
+ * Vendored (and modernized) from the `on-finished` package, built on top of `stream.finished`.
+ * Stream listeners are attached once per msg (subsequent calls are queued), as `stream.finished`
+ * is too expensive to call per listener (and would exceed the default MaxListeners).
+ */
+export function onFinished<T extends IncomingMessage | ServerResponse>(
+  msg: T,
+  listener: Listener<T>,
+): T {
+  const m = msg as T & { [kQueue]?: Listener<T>[] }
+  const queue = m[kQueue]
+  if (queue) {
+    queue.push(bindAsyncContext(listener))
+    return msg
+  }
+
+  const q = (m[kQueue] = [bindAsyncContext(listener)])
+  finished(msg, err => {
+    m[kQueue] = undefined
+    for (const fn of q) fn(err ?? null, msg)
+  })
+  return msg
+}
+
+type Listener<T> = (err: Error | null, msg: T) => void
+
+const kQueue = Symbol('onFinished')
+
+/**
+ * Faster alternative to `AsyncResource.bind` (which is ~0.8µs per call).
+ */
+function bindAsyncContext<T>(fn: Listener<T>): Listener<T> {
+  const resource = new AsyncResource('onFinished')
+  return (err, msg) => resource.runInAsyncScope(fn, null, err, msg)
+}

package/src/onHeaders.ts

@@ -0,0 +1,66 @@
+import type { OutgoingHttpHeader, OutgoingHttpHeaders, ServerResponse } from 'node:http'
+
+/**
+ * Invokes the listener once, right before the response writes its headers
+ * (via `res.writeHead`, which is also called implicitly by the first `write`/`end`).
+ *
+ * Headers passed to `writeHead` are applied to `res` before the listener runs,
+ * so the listener sees (and can modify) the final headers and statusCode.
+ *
+ * Vendored (and modernized) from the `on-headers` package.
+ */
+export function onHeaders(res: ServerResponse, listener: (this: ServerResponse) => void): void {
+  // Loosely typed, to call it with the (statusCode, reason?) signature, bypassing overloads
+  const prevWriteHead = res.writeHead as (statusCode: number, reason?: string) => ServerResponse
+  let fired = false
+
+  res.writeHead = function writeHead(
+    this: ServerResponse,
+    statusCode: number,
+    reasonOrHeaders?: string | Headers,
+    headers?: Headers,
+  ) {
+    if (fired) return prevWriteHead.apply(this, arguments as any)
+    fired = true
+
+    const reason = typeof reasonOrHeaders === 'string' ? reasonOrHeaders : undefined
+    headers = reason === undefined ? (reasonOrHeaders as Headers | undefined) : headers
+
+    this.statusCode = statusCode
+    if (headers) setHeaders(this, headers)
+    listener.call(this)
+
+    // Reason phrase is dropped if the listener changed the statusCode
+    return reason !== undefined && this.statusCode === statusCode
+      ? prevWriteHead.call(this, statusCode, reason)
+      : prevWriteHead.call(this, this.statusCode)
+  }
+}
+
+type Headers = OutgoingHttpHeaders | OutgoingHttpHeader[]
+
+function setHeaders(res: ServerResponse, headers: Headers): void {
+  if (!Array.isArray(headers)) {
+    for (const k of Object.keys(headers)) {
+      if (k) res.setHeader(k, headers[k]!)
+    }
+    return
+  }
+
+  if (Array.isArray(headers[0])) {
+    // 2D: [[k, v], [k, v]]
+    for (const [k, v] of headers as unknown as [string, OutgoingHttpHeader][]) {
+      if (k) res.setHeader(k, v)
+    }
+    return
+  }
+
+  // 1D (raw): [k, v, k, v], keys may repeat
+  if (headers.length % 2) throw new TypeError('headers array is malformed')
+  for (let i = 0; i < headers.length; i += 2) {
+    res.removeHeader(headers[i] as string)
+  }
+  for (let i = 0; i < headers.length; i += 2) {
+    if (headers[i]) res.appendHeader(headers[i] as string, headers[i + 1] as string | string[])
+  }
+}

package/src/server/compressionMiddleware.ts

@@ -11,11 +11,11 @@
  */
 
 import zlib from 'node:zlib'
-import compressible from 'compressible'
 // @ts-expect-error no types
 import Negotiator from 'negotiator'
-import onHeaders from 'on-headers'
-import vary from 'vary'
+import { compressible } from '../compressible.js'
+import { onHeaders } from '../onHeaders.js'
+import { vary } from '../vary.js'
 import type { BackendRequest, BackendRequestHandler, BackendResponse } from './server.model.js'
 
 export interface CompressionOptions {

package/src/server/genericErrorMiddleware.ts

@@ -1,6 +1,6 @@
 import type { BackendErrorResponseObject, ErrorObject } from '@naturalcycles/js-lib/error'
 import { _anyToError, _errorLikeToErrorObject } from '@naturalcycles/js-lib/error'
-import type { HttpStatusCode } from '@naturalcycles/js-lib/http'
+import type { StringMap } from '@naturalcycles/js-lib/types'
 import { _objectAssign } from '@naturalcycles/js-lib/types'
 import type { BackendErrorRequestHandler, BackendRequest, BackendResponse } from './server.model.js'
 
@@ -30,6 +30,18 @@ export interface ErrorReportingService {
 const { APP_ENV } = process.env
 const includeErrorStack = APP_ENV === 'dev'
 
+// Headers a handler may have set for the response it never got to send;
+// they would wrongly describe the error response (e.g `res.json` keeps a pre-set Content-Type)
+const staleResponseHeaders = [
+  'Content-Type',
+  'Content-Disposition',
+  'Content-Encoding',
+  'Content-Language',
+  'Content-Range',
+  'ETag',
+  'Last-Modified',
+]
+
 // Hacky way to store the errorService, so it's available to `respondWithError` function
 let errorService: ErrorReportingService | undefined
 let formatError: GenericErrorMiddlewareCfg['formatError']
@@ -46,18 +58,6 @@ export function genericErrorMiddleware(
   formatError = cfg.formatError
 
   return (err, req, res, _next) => {
-    // if (res.headersSent) {
-    // Here we don't even log this error
-    // It's known that it comes from sentry.requestHandler()
-    // requestHandler waits for all promises/timeouts to finish in the request, and then emits this error here,
-    // while `res` is the same as was returned to the User (so, both headers and the data was already returned by that time)
-    // req.log.warn(`genericErrorHandler, but headersSent=true`, err)
-    // Here we don't propagate the error further, cause there's only "default express error logger" behind it
-    // and nothing else. Previously it was logging the same error once again because of this. Avoid.
-    // return next(err)
-    // return next()
-    // }
-
     respondWithError(req, res, err)
   }
 }
@@ -85,13 +85,20 @@ export function respondWithError(req: BackendRequest, res: BackendResponse, err:
     // todo: add userId from the "Context" (or, just req.userId?) to the log
   }
 
-  if (headersSent) return
+  if (headersSent) {
+    // Too late for an error response. A finished response needs nothing beyond the reporting above.
+    // An unfinished one (error mid-stream) is cut off, so the client sees a failed transfer right away
+    // instead of waiting for a body that never completes. Same as Express' default error handler.
+    if (!res.writableEnded) res.destroy()
+    return
+  }
 
   const httpError = _errorLikeToErrorObject(originalError)
   if (!includeErrorStack) delete httpError.stack
 
   // http-errors (express itself, its body parsers) carry the status they should be answered with
-  httpError.data.backendResponseStatusCode ||= getHttpErrorStatusCode(originalError) || 500 // default to 500
+  const httpErrorLike = isHttpError(originalError) ? originalError : undefined
+  httpError.data.backendResponseStatusCode ||= httpErrorLike?.statusCode || 500 // default to 500
   _objectAssign(httpError.data, {
     errorId,
     headersSent: headersSent || undefined,
@@ -99,27 +106,33 @@ export function respondWithError(req: BackendRequest, res: BackendResponse, err:
 
   formatError?.(httpError, req) // Mutates the error
 
+  for (const header of staleResponseHeaders) res.removeHeader(header)
+  res.setHeader('Cache-Control', 'no-store')
+  if (httpErrorLike?.headers) res.set(httpErrorLike.headers)
+
   res.status(httpError.data.backendResponseStatusCode).json({
     error: httpError,
   } satisfies BackendErrorResponseObject)
 }
 
-interface HttpErrorLike {
+interface HttpErrorLike extends Error {
   status: number
   statusCode: number
   expose: boolean
+  headers?: StringMap<string>
 }
 
 /**
  * Errors created by the `http-errors` package (express itself, body-parser, raw-body, send)
- * carry the HTTP status they are meant to be answered with: `status` and `statusCode` (always equal),
- * plus `expose` (whether the message is safe to show to the client).
- * All three together are the marker: other libraries also put a `statusCode` on their errors
- * (e.g a gateway's response status), which says nothing about how we should respond.
+ * describe the response they expect: `status` and `statusCode` (always equal),
+ * `expose` (whether the message is safe to show to the client) and optional response `headers`.
+ * The first three together are the marker: other libraries also put `statusCode` or `headers`
+ * on their errors (e.g a gateway's response), which say nothing about how we should respond.
  */
-function getHttpErrorStatusCode(err: Error): HttpStatusCode | undefined {
+function isHttpError(err: Error): err is HttpErrorLike {
   const { status, statusCode, expose } = err as Partial<HttpErrorLike>
-  if (typeof expose !== 'boolean' || typeof statusCode !== 'number' || status !== statusCode) return
-  if (!Number.isInteger(statusCode) || statusCode < 400 || statusCode > 599) return
-  return statusCode
+  if (typeof expose !== 'boolean' || typeof statusCode !== 'number' || status !== statusCode) {
+    return false
+  }
+  return Number.isInteger(statusCode) && statusCode >= 400 && statusCode <= 599
 }

package/src/vary.ts

@@ -0,0 +1,29 @@
+import type { ServerResponse } from 'node:http'
+
+/**
+ * Adds the field (header name) to the response's Vary header, unless it's already there
+ * (case-insensitive). Vary: * stays as is, and adding '*' replaces the whole header with '*'.
+ *
+ * Vendored (and modernized) from the `vary` package.
+ */
+export function vary(res: ServerResponse, field: string): void {
+  const header = res.getHeader('Vary')
+  const value = Array.isArray(header) ? header.join(', ') : String(header ?? '')
+  if (!value) {
+    res.setHeader('Vary', field)
+    return
+  }
+
+  const fields = new Set(
+    value
+      .toLowerCase()
+      .split(',')
+      .map(f => f.trim()),
+  )
+
+  if (field === '*' || fields.has('*')) {
+    if (value !== '*') res.setHeader('Vary', '*')
+  } else if (!fields.has(field.toLowerCase())) {
+    res.setHeader('Vary', `${value}, ${field}`)
+  }
+}