@naturalcycles/backend-lib 9.77.2 → 9.79.0

package/dist/compressible.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Returns true if the given Content-Type (parameters, e.g `; charset=utf-8`, are ignored) is compressible.
+ *
+ * Vendored (and modernized) from the `compressible` package.
+ * Instead of loading the whole `mime-db` (~2500 types), it's reduced to the equivalent:
+ * a regex + the list of compressible types that the regex doesn't match (as of mime-db@1.54.0).
+ * No type matched by the regex is marked as non-compressible in mime-db.
+ */
+export declare function compressible(type: string): boolean;

package/dist/compressible.js

@@ -0,0 +1,57 @@
+/**
+ * Returns true if the given Content-Type (parameters, e.g `; charset=utf-8`, are ignored) is compressible.
+ *
+ * Vendored (and modernized) from the `compressible` package.
+ * Instead of loading the whole `mime-db` (~2500 types), it's reduced to the equivalent:
+ * a regex + the list of compressible types that the regex doesn't match (as of mime-db@1.54.0).
+ * No type matched by the regex is marked as non-compressible in mime-db.
+ */
+export function compressible(type) {
+    const mime = EXTRACT_TYPE_REGEX.exec(type)[1].toLowerCase();
+    return COMPRESSIBLE_TYPE_REGEX.test(mime) || COMPRESSIBLE_TYPES.has(mime);
+}
+const EXTRACT_TYPE_REGEX = /^\s*([^;\s]*)/;
+const COMPRESSIBLE_TYPE_REGEX = /^text\/|\+(?:json|text|xml)$/;
+const COMPRESSIBLE_TYPES = new Set([
+    'application/dart',
+    'application/ecmascript',
+    'application/javascript',
+    'application/json',
+    'application/octet-stream',
+    'application/postscript',
+    'application/raml+yaml',
+    'application/rtf',
+    'application/tar',
+    'application/toml',
+    'application/vnd.dart',
+    'application/vnd.ms-fontobject',
+    'application/vnd.ms-opentype',
+    'application/wasm',
+    'application/x-httpd-php',
+    'application/x-javascript',
+    'application/x-ns-proxy-autoconfig',
+    'application/x-sh',
+    'application/x-tar',
+    'application/x-virtualbox-hdd',
+    'application/x-virtualbox-ova',
+    'application/x-virtualbox-ovf',
+    'application/x-virtualbox-vbox',
+    'application/x-virtualbox-vdi',
+    'application/x-virtualbox-vhd',
+    'application/x-virtualbox-vmdk',
+    'application/x-www-form-urlencoded',
+    'application/xml',
+    'application/xml-dtd',
+    'font/otf',
+    'font/ttf',
+    'image/bmp',
+    'image/vnd.adobe.photoshop',
+    'image/vnd.microsoft.icon',
+    'image/vnd.ms-dds',
+    'image/x-icon',
+    'image/x-ms-bmp',
+    'message/rfc822',
+    'model/gltf-binary',
+    'x-shader/x-fragment',
+    'x-shader/x-vertex',
+]);

package/dist/onFinished.d.ts

@@ -1,2 +1,14 @@
-import onFinished from 'on-finished';
-export { onFinished };
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/**
+ * Invokes the listener once the request/response has finished (completed, closed or errored).
+ * If it has already finished - the listener is invoked asynchronously (on the next tick).
+ *
+ * Listener runs in the async context (e.g AsyncLocalStorage) of the onFinished caller.
+ *
+ * Vendored (and modernized) from the `on-finished` package, built on top of `stream.finished`.
+ * Stream listeners are attached once per msg (subsequent calls are queued), as `stream.finished`
+ * is too expensive to call per listener (and would exceed the default MaxListeners).
+ */
+export declare function onFinished<T extends IncomingMessage | ServerResponse>(msg: T, listener: Listener<T>): T;
+type Listener<T> = (err: Error | null, msg: T) => void;
+export {};

package/dist/onFinished.js

@@ -1,2 +1,35 @@
-import onFinished from 'on-finished';
-export { onFinished };
+import { AsyncResource } from 'node:async_hooks';
+import { finished } from 'node:stream';
+/**
+ * Invokes the listener once the request/response has finished (completed, closed or errored).
+ * If it has already finished - the listener is invoked asynchronously (on the next tick).
+ *
+ * Listener runs in the async context (e.g AsyncLocalStorage) of the onFinished caller.
+ *
+ * Vendored (and modernized) from the `on-finished` package, built on top of `stream.finished`.
+ * Stream listeners are attached once per msg (subsequent calls are queued), as `stream.finished`
+ * is too expensive to call per listener (and would exceed the default MaxListeners).
+ */
+export function onFinished(msg, listener) {
+    const m = msg;
+    const queue = m[kQueue];
+    if (queue) {
+        queue.push(bindAsyncContext(listener));
+        return msg;
+    }
+    const q = (m[kQueue] = [bindAsyncContext(listener)]);
+    finished(msg, err => {
+        m[kQueue] = undefined;
+        for (const fn of q)
+            fn(err ?? null, msg);
+    });
+    return msg;
+}
+const kQueue = Symbol('onFinished');
+/**
+ * Faster alternative to `AsyncResource.bind` (which is ~0.8µs per call).
+ */
+function bindAsyncContext(fn) {
+    const resource = new AsyncResource('onFinished');
+    return (err, msg) => resource.runInAsyncScope(fn, null, err, msg);
+}

package/dist/onHeaders.d.ts

@@ -0,0 +1,11 @@
+import type { ServerResponse } from 'node:http';
+/**
+ * Invokes the listener once, right before the response writes its headers
+ * (via `res.writeHead`, which is also called implicitly by the first `write`/`end`).
+ *
+ * Headers passed to `writeHead` are applied to `res` before the listener runs,
+ * so the listener sees (and can modify) the final headers and statusCode.
+ *
+ * Vendored (and modernized) from the `on-headers` package.
+ */
+export declare function onHeaders(res: ServerResponse, listener: (this: ServerResponse) => void): void;

package/dist/onHeaders.js

@@ -0,0 +1,56 @@
+/**
+ * Invokes the listener once, right before the response writes its headers
+ * (via `res.writeHead`, which is also called implicitly by the first `write`/`end`).
+ *
+ * Headers passed to `writeHead` are applied to `res` before the listener runs,
+ * so the listener sees (and can modify) the final headers and statusCode.
+ *
+ * Vendored (and modernized) from the `on-headers` package.
+ */
+export function onHeaders(res, listener) {
+    // Loosely typed, to call it with the (statusCode, reason?) signature, bypassing overloads
+    const prevWriteHead = res.writeHead;
+    let fired = false;
+    res.writeHead = function writeHead(statusCode, reasonOrHeaders, headers) {
+        if (fired)
+            return prevWriteHead.apply(this, arguments);
+        fired = true;
+        const reason = typeof reasonOrHeaders === 'string' ? reasonOrHeaders : undefined;
+        headers = reason === undefined ? reasonOrHeaders : headers;
+        this.statusCode = statusCode;
+        if (headers)
+            setHeaders(this, headers);
+        listener.call(this);
+        // Reason phrase is dropped if the listener changed the statusCode
+        return reason !== undefined && this.statusCode === statusCode
+            ? prevWriteHead.call(this, statusCode, reason)
+            : prevWriteHead.call(this, this.statusCode);
+    };
+}
+function setHeaders(res, headers) {
+    if (!Array.isArray(headers)) {
+        for (const k of Object.keys(headers)) {
+            if (k)
+                res.setHeader(k, headers[k]);
+        }
+        return;
+    }
+    if (Array.isArray(headers[0])) {
+        // 2D: [[k, v], [k, v]]
+        for (const [k, v] of headers) {
+            if (k)
+                res.setHeader(k, v);
+        }
+        return;
+    }
+    // 1D (raw): [k, v, k, v], keys may repeat
+    if (headers.length % 2)
+        throw new TypeError('headers array is malformed');
+    for (let i = 0; i < headers.length; i += 2) {
+        res.removeHeader(headers[i]);
+    }
+    for (let i = 0; i < headers.length; i += 2) {
+        if (headers[i])
+            res.appendHeader(headers[i], headers[i + 1]);
+    }
+}

package/dist/server/compressionMiddleware.d.ts

@@ -10,6 +10,18 @@ export interface CompressionOptions {
      * @default 1024
      */
     threshold?: number | string;
+    /**
+     * Bodies sent in one `res.end(chunk)` call (which is what `res.json` and `res.send` do) up to this
+     * size are compressed synchronously on the event loop, instead of through a zlib stream.
+     * For typical JSON responses the per-response stream setup and threadpool round-trip cost more
+     * than the compression itself, and the sync path also keeps an exact `Content-Length`
+     * (streamed responses are chunked).
+     * Bodies above this size, and bodies written in several `res.write` calls, are streamed.
+     * Set to `0` to always stream.
+     *
+     * @default 128kb
+     */
+    syncMaxBytes?: number | string;
     /**
      * Encoding to use when Accept-Encoding header is not present.
      * @default 'identity'
@@ -39,7 +51,8 @@ export interface CompressionOptions {
 /**
  * Compression middleware with support for gzip, deflate, brotli, and zstd.
  *
- * This is a fork of the `compression` npm package with added zstd support.
+ * This is a fork of the `compression` npm package with added zstd support,
+ * and a synchronous fast path for single-chunk bodies (see `syncMaxBytes`).
  *
  * Encoding preference order: zstd > br > gzip > deflate
  */

package/dist/server/compressionMiddleware.js

@@ -10,11 +10,11 @@
  * MIT Licensed
  */
 import zlib from 'node:zlib';
-import compressible from 'compressible';
 // @ts-expect-error no types
 import Negotiator from 'negotiator';
-import onHeaders from 'on-headers';
-import vary from 'vary';
+import { compressible } from '../compressible.js';
+import { onHeaders } from '../onHeaders.js';
+import { vary } from '../vary.js';
 const SUPPORTED_ENCODING = ['zstd', 'br', 'gzip', 'deflate', 'identity'];
 const PREFERRED_ENCODING = ['zstd', 'br', 'gzip'];
 const encodingSupported = new Set(['gzip', 'deflate', 'identity', 'br', 'zstd']);
@@ -22,7 +22,8 @@ const cacheControlNoTransformRegExp = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i;
 /**
  * Compression middleware with support for gzip, deflate, brotli, and zstd.
  *
- * This is a fork of the `compression` npm package with added zstd support.
+ * This is a fork of the `compression` npm package with added zstd support,
+ * and a synchronous fast path for single-chunk bodies (see `syncMaxBytes`).
  *
  * Encoding preference order: zstd > br > gzip > deflate
  */
@@ -37,10 +38,14 @@ export function compressionMiddleware(options) {
         },
     };
     // Zstd options
+    // Level 1 instead of zstd's own default of 3: for typical JSON responses the CPU cost and
+    // compression ratio are the same (measured 2026-10 on 22 KB and 115 KB payloads), but a level 3
+    // stream holds ~850 KB of native memory per in-flight response vs ~150 KB at level 1.
+    // That per-response allocation churn is what MALLOC_ARENA_MAX=2 works around on Cloud Run.
     const optsZstd = {
         ...opts.zstd,
         params: {
-            [zlib.constants.ZSTD_c_compressionLevel]: 3,
+            [zlib.constants.ZSTD_c_compressionLevel]: 1,
             ...opts.zstd?.params,
         },
     };
@@ -56,11 +61,17 @@ export function compressionMiddleware(options) {
         zlibOpts.windowBits = opts.windowBits;
     if (opts.chunkSize !== undefined)
         zlibOpts.chunkSize = opts.chunkSize;
+    const codecOpts = { zstd: optsZstd, brotli: optsBrotli, zlib: zlibOpts };
     const filter = opts.filter || shouldCompress;
     const threshold = parseBytes(opts.threshold) ?? 1024;
+    const syncMaxBytes = parseBytes(opts.syncMaxBytes) ?? 128 * 1024;
     const enforceEncoding = opts.enforceEncoding || 'identity';
     return function compression(req, res, next) {
         let ended = false;
+        // Set by the first `res.write`: the body comes in several chunks, so only the stream path applies
+        let wrote = false;
+        // Set once the compress-or-not decision has been made for this response (by either path)
+        let decided = false;
         let length;
         let listeners = [];
         let stream;
@@ -78,6 +89,7 @@ export function compressionMiddleware(options) {
             if (ended) {
                 return false;
             }
+            wrote = true;
             if (!headersSent(res)) {
                 res.writeHead(res.statusCode);
             }
@@ -96,6 +108,26 @@ export function compressionMiddleware(options) {
                 if (!res.getHeader('Content-Length')) {
                     length = chunkLength(chunk, encodingOrCallback);
                 }
+                // Single-chunk body (no prior `res.write`): the whole body is right here, so compress it
+                // synchronously instead of setting up a zlib stream for one chunk.
+                if (chunk && !wrote && !decided) {
+                    const encoding = typeof encodingOrCallback === 'function' ? undefined : encodingOrCallback;
+                    const body = toBuffer(chunk, encoding);
+                    if (body.length <= syncMaxBytes) {
+                        const method = decide(body.length);
+                        if (method) {
+                            const compressed = compressSync(method, body, codecOpts);
+                            res.setHeader('Content-Encoding', method);
+                            res.setHeader('Content-Length', compressed.length);
+                            ended = true;
+                            const cb = typeof encodingOrCallback === 'function' ? encodingOrCallback : callback;
+                            // encoding is irrelevant for a Buffer chunk; it is passed to satisfy the `end` overload
+                            return _end.call(res, compressed, 'utf8', cb);
+                        }
+                        // Not compressing: falls through to the plain `end`.
+                        // The `onHeaders` listener below sees `decided` and does nothing.
+                    }
+                }
                 res.writeHead(res.statusCode);
             }
             if (!stream) {
@@ -127,46 +159,36 @@ export function compressionMiddleware(options) {
             addListeners(res, _on, listeners);
             listeners = null;
         }
-        // Release the compression stream when the response closes, freeing native
-        // zlib memory even if the client disconnected before the response finished.
-        // Registered before onHeaders so a close that happens before the stream
-        // exists is not missed (the `closed` flag below handles a stream created
-        // afterwards). Fixes CVE-2026-87776 / GHSA-vc2v-76pw-4v95.
-        // We use `stream.destroy()` (not the `destroy` npm package upstream added)
-        // because our Node target frees the zlib handle on destroy().
-        _on.call(res, 'close', function onResponseClose() {
-            closed = true;
-            stream?.destroy();
-        });
-        onHeaders(res, function onResponseHeaders() {
+        /**
+         * The compress-or-not decision, shared by the sync path (`res.end` holding the whole body)
+         * and the stream path (`onHeaders`).
+         * Returns the encoding to use, or undefined when the response is to be sent as-is.
+         */
+        function decide(bodyLength) {
+            decided = true;
             // determine if request is filtered
             if (!filter(req, res)) {
-                nocompress('filtered');
-                return;
+                return nocompress('filtered');
             }
             // determine if the entity should be transformed
             if (!shouldTransform(req, res)) {
-                nocompress('no transform');
-                return;
+                return nocompress('no transform');
             }
             // vary
             vary(res, 'Accept-Encoding');
             // content-length below threshold
             if (Number(res.getHeader('Content-Length')) < threshold ||
-                (length !== undefined && length < threshold)) {
-                nocompress('size below threshold');
-                return;
+                (bodyLength !== undefined && bodyLength < threshold)) {
+                return nocompress('size below threshold');
             }
             const encoding = res.getHeader('Content-Encoding') || 'identity';
             // already encoded
             if (encoding !== 'identity') {
-                nocompress('already encoded');
-                return;
+                return nocompress('already encoded');
             }
             // head
             if (req.method === 'HEAD') {
-                nocompress('HEAD request');
-                return;
+                return nocompress('HEAD request');
             }
             // compression method
             // Get all client-accepted encodings, then pick the first one from our preferred order
@@ -180,9 +202,28 @@ export function compressionMiddleware(options) {
             }
             // negotiation failed
             if (!method || method === 'identity') {
-                nocompress('not acceptable');
-                return;
+                return nocompress('not acceptable');
             }
+            return method;
+        }
+        // Release the compression stream when the response closes, freeing native
+        // zlib memory even if the client disconnected before the response finished.
+        // Registered before onHeaders so a close that happens before the stream
+        // exists is not missed (the `closed` flag below handles a stream created
+        // afterwards). Fixes CVE-2026-87776 / GHSA-vc2v-76pw-4v95.
+        // We use `stream.destroy()` (not the `destroy` npm package upstream added)
+        // because our Node target frees the zlib handle on destroy().
+        _on.call(res, 'close', function onResponseClose() {
+            closed = true;
+            stream?.destroy();
+        });
+        onHeaders(res, function onResponseHeaders() {
+            // The sync path has already handled this response (compressed it, or declined to)
+            if (decided)
+                return;
+            const method = decide(length);
+            if (!method)
+                return;
             // compression stream
             if (method === 'zstd') {
                 stream = zlib.createZstdCompress(optsZstd);
@@ -236,6 +277,19 @@ export function shouldCompress(_req, res) {
     }
     return true;
 }
+/**
+ * Compresses a whole body in one call, on the event loop.
+ * Same codec options as the streams, so the output is identical to the streamed one.
+ */
+function compressSync(method, body, opts) {
+    if (method === 'zstd')
+        return zlib.zstdCompressSync(body, opts.zstd);
+    if (method === 'br')
+        return zlib.brotliCompressSync(body, opts.brotli);
+    if (method === 'gzip')
+        return zlib.gzipSync(body, opts.zlib);
+    return zlib.deflateSync(body, opts.zlib);
+}
 function addListeners(stream, on, listeners) {
     for (const [type, listener] of listeners) {
         on.call(stream, type, listener);

package/dist/vary.d.ts

@@ -0,0 +1,8 @@
+import type { ServerResponse } from 'node:http';
+/**
+ * Adds the field (header name) to the response's Vary header, unless it's already there
+ * (case-insensitive). Vary: * stays as is, and adding '*' replaces the whole header with '*'.
+ *
+ * Vendored (and modernized) from the `vary` package.
+ */
+export declare function vary(res: ServerResponse, field: string): void;

package/dist/vary.js

@@ -0,0 +1,25 @@
+/**
+ * Adds the field (header name) to the response's Vary header, unless it's already there
+ * (case-insensitive). Vary: * stays as is, and adding '*' replaces the whole header with '*'.
+ *
+ * Vendored (and modernized) from the `vary` package.
+ */
+export function vary(res, field) {
+    const header = res.getHeader('Vary');
+    const value = Array.isArray(header) ? header.join(', ') : String(header ?? '');
+    if (!value) {
+        res.setHeader('Vary', field);
+        return;
+    }
+    const fields = new Set(value
+        .toLowerCase()
+        .split(',')
+        .map(f => f.trim()));
+    if (field === '*' || fields.has('*')) {
+        if (value !== '*')
+            res.setHeader('Vary', '*');
+    }
+    else if (!fields.has(field.toLowerCase())) {
+        res.setHeader('Vary', `${value}, ${field}`);
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@naturalcycles/backend-lib",
   "type": "module",
-  "version": "9.77.2",
+  "version": "9.79.0",
   "dependencies": {
     "@naturalcycles/db-lib": "^10",
     "@naturalcycles/js-lib": "^15",
@@ -10,21 +10,13 @@
     "@types/cookie-parser": "^1",
     "@types/cors": "^2",
     "@types/express": "^5",
-    "@types/compressible": "^2",
-    "@types/on-finished": "^2",
-    "@types/on-headers": "^1",
-    "@types/vary": "^1",
     "busboy": "^1",
-    "compressible": "^2",
     "cookie-parser": "^1",
     "cors": "^2",
     "express": "^5",
     "helmet": "^8",
     "negotiator": "^1",
-    "on-headers": "^1",
-    "on-finished": "^2",
-    "tslib": "^2",
-    "vary": "^1"
+    "tslib": "^2"
   },
   "peerDependencies": {
     "@sentry/node-core": "^10",

package/src/compressible.ts

@@ -0,0 +1,59 @@
+/**
+ * Returns true if the given Content-Type (parameters, e.g `; charset=utf-8`, are ignored) is compressible.
+ *
+ * Vendored (and modernized) from the `compressible` package.
+ * Instead of loading the whole `mime-db` (~2500 types), it's reduced to the equivalent:
+ * a regex + the list of compressible types that the regex doesn't match (as of mime-db@1.54.0).
+ * No type matched by the regex is marked as non-compressible in mime-db.
+ */
+export function compressible(type: string): boolean {
+  const mime = EXTRACT_TYPE_REGEX.exec(type)![1]!.toLowerCase()
+  return COMPRESSIBLE_TYPE_REGEX.test(mime) || COMPRESSIBLE_TYPES.has(mime)
+}
+
+const EXTRACT_TYPE_REGEX = /^\s*([^;\s]*)/
+const COMPRESSIBLE_TYPE_REGEX = /^text\/|\+(?:json|text|xml)$/
+
+const COMPRESSIBLE_TYPES = new Set([
+  'application/dart',
+  'application/ecmascript',
+  'application/javascript',
+  'application/json',
+  'application/octet-stream',
+  'application/postscript',
+  'application/raml+yaml',
+  'application/rtf',
+  'application/tar',
+  'application/toml',
+  'application/vnd.dart',
+  'application/vnd.ms-fontobject',
+  'application/vnd.ms-opentype',
+  'application/wasm',
+  'application/x-httpd-php',
+  'application/x-javascript',
+  'application/x-ns-proxy-autoconfig',
+  'application/x-sh',
+  'application/x-tar',
+  'application/x-virtualbox-hdd',
+  'application/x-virtualbox-ova',
+  'application/x-virtualbox-ovf',
+  'application/x-virtualbox-vbox',
+  'application/x-virtualbox-vdi',
+  'application/x-virtualbox-vhd',
+  'application/x-virtualbox-vmdk',
+  'application/x-www-form-urlencoded',
+  'application/xml',
+  'application/xml-dtd',
+  'font/otf',
+  'font/ttf',
+  'image/bmp',
+  'image/vnd.adobe.photoshop',
+  'image/vnd.microsoft.icon',
+  'image/vnd.ms-dds',
+  'image/x-icon',
+  'image/x-ms-bmp',
+  'message/rfc822',
+  'model/gltf-binary',
+  'x-shader/x-fragment',
+  'x-shader/x-vertex',
+])

package/src/onFinished.ts

@@ -1,3 +1,44 @@
-import onFinished from 'on-finished'
+import { AsyncResource } from 'node:async_hooks'
+import type { IncomingMessage, ServerResponse } from 'node:http'
+import { finished } from 'node:stream'
 
-export { onFinished }
+/**
+ * Invokes the listener once the request/response has finished (completed, closed or errored).
+ * If it has already finished - the listener is invoked asynchronously (on the next tick).
+ *
+ * Listener runs in the async context (e.g AsyncLocalStorage) of the onFinished caller.
+ *
+ * Vendored (and modernized) from the `on-finished` package, built on top of `stream.finished`.
+ * Stream listeners are attached once per msg (subsequent calls are queued), as `stream.finished`
+ * is too expensive to call per listener (and would exceed the default MaxListeners).
+ */
+export function onFinished<T extends IncomingMessage | ServerResponse>(
+  msg: T,
+  listener: Listener<T>,
+): T {
+  const m = msg as T & { [kQueue]?: Listener<T>[] }
+  const queue = m[kQueue]
+  if (queue) {
+    queue.push(bindAsyncContext(listener))
+    return msg
+  }
+
+  const q = (m[kQueue] = [bindAsyncContext(listener)])
+  finished(msg, err => {
+    m[kQueue] = undefined
+    for (const fn of q) fn(err ?? null, msg)
+  })
+  return msg
+}
+
+type Listener<T> = (err: Error | null, msg: T) => void
+
+const kQueue = Symbol('onFinished')
+
+/**
+ * Faster alternative to `AsyncResource.bind` (which is ~0.8µs per call).
+ */
+function bindAsyncContext<T>(fn: Listener<T>): Listener<T> {
+  const resource = new AsyncResource('onFinished')
+  return (err, msg) => resource.runInAsyncScope(fn, null, err, msg)
+}

package/src/onHeaders.ts

@@ -0,0 +1,66 @@
+import type { OutgoingHttpHeader, OutgoingHttpHeaders, ServerResponse } from 'node:http'
+
+/**
+ * Invokes the listener once, right before the response writes its headers
+ * (via `res.writeHead`, which is also called implicitly by the first `write`/`end`).
+ *
+ * Headers passed to `writeHead` are applied to `res` before the listener runs,
+ * so the listener sees (and can modify) the final headers and statusCode.
+ *
+ * Vendored (and modernized) from the `on-headers` package.
+ */
+export function onHeaders(res: ServerResponse, listener: (this: ServerResponse) => void): void {
+  // Loosely typed, to call it with the (statusCode, reason?) signature, bypassing overloads
+  const prevWriteHead = res.writeHead as (statusCode: number, reason?: string) => ServerResponse
+  let fired = false
+
+  res.writeHead = function writeHead(
+    this: ServerResponse,
+    statusCode: number,
+    reasonOrHeaders?: string | Headers,
+    headers?: Headers,
+  ) {
+    if (fired) return prevWriteHead.apply(this, arguments as any)
+    fired = true
+
+    const reason = typeof reasonOrHeaders === 'string' ? reasonOrHeaders : undefined
+    headers = reason === undefined ? (reasonOrHeaders as Headers | undefined) : headers
+
+    this.statusCode = statusCode
+    if (headers) setHeaders(this, headers)
+    listener.call(this)
+
+    // Reason phrase is dropped if the listener changed the statusCode
+    return reason !== undefined && this.statusCode === statusCode
+      ? prevWriteHead.call(this, statusCode, reason)
+      : prevWriteHead.call(this, this.statusCode)
+  }
+}
+
+type Headers = OutgoingHttpHeaders | OutgoingHttpHeader[]
+
+function setHeaders(res: ServerResponse, headers: Headers): void {
+  if (!Array.isArray(headers)) {
+    for (const k of Object.keys(headers)) {
+      if (k) res.setHeader(k, headers[k]!)
+    }
+    return
+  }
+
+  if (Array.isArray(headers[0])) {
+    // 2D: [[k, v], [k, v]]
+    for (const [k, v] of headers as unknown as [string, OutgoingHttpHeader][]) {
+      if (k) res.setHeader(k, v)
+    }
+    return
+  }
+
+  // 1D (raw): [k, v, k, v], keys may repeat
+  if (headers.length % 2) throw new TypeError('headers array is malformed')
+  for (let i = 0; i < headers.length; i += 2) {
+    res.removeHeader(headers[i] as string)
+  }
+  for (let i = 0; i < headers.length; i += 2) {
+    if (headers[i]) res.appendHeader(headers[i] as string, headers[i + 1] as string | string[])
+  }
+}

package/src/server/compressionMiddleware.ts

@@ -11,11 +11,11 @@
  */
 
 import zlib from 'node:zlib'
-import compressible from 'compressible'
 // @ts-expect-error no types
 import Negotiator from 'negotiator'
-import onHeaders from 'on-headers'
-import vary from 'vary'
+import { compressible } from '../compressible.js'
+import { onHeaders } from '../onHeaders.js'
+import { vary } from '../vary.js'
 import type { BackendRequest, BackendRequestHandler, BackendResponse } from './server.model.js'
 
 export interface CompressionOptions {
@@ -31,6 +31,19 @@ export interface CompressionOptions {
    */
   threshold?: number | string
 
+  /**
+   * Bodies sent in one `res.end(chunk)` call (which is what `res.json` and `res.send` do) up to this
+   * size are compressed synchronously on the event loop, instead of through a zlib stream.
+   * For typical JSON responses the per-response stream setup and threadpool round-trip cost more
+   * than the compression itself, and the sync path also keeps an exact `Content-Length`
+   * (streamed responses are chunked).
+   * Bodies above this size, and bodies written in several `res.write` calls, are streamed.
+   * Set to `0` to always stream.
+   *
+   * @default 128kb
+   */
+  syncMaxBytes?: number | string
+
   /**
    * Encoding to use when Accept-Encoding header is not present.
    * @default 'identity'
@@ -71,7 +84,8 @@ const cacheControlNoTransformRegExp = /(?:^|,)\s*?no-transform\s*?(?:,|$)/i
 /**
  * Compression middleware with support for gzip, deflate, brotli, and zstd.
  *
- * This is a fork of the `compression` npm package with added zstd support.
+ * This is a fork of the `compression` npm package with added zstd support,
+ * and a synchronous fast path for single-chunk bodies (see `syncMaxBytes`).
  *
  * Encoding preference order: zstd > br > gzip > deflate
  */
@@ -88,10 +102,14 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
   }
 
   // Zstd options
+  // Level 1 instead of zstd's own default of 3: for typical JSON responses the CPU cost and
+  // compression ratio are the same (measured 2026-10 on 22 KB and 115 KB payloads), but a level 3
+  // stream holds ~850 KB of native memory per in-flight response vs ~150 KB at level 1.
+  // That per-response allocation churn is what MALLOC_ARENA_MAX=2 works around on Cloud Run.
   const optsZstd: zlib.ZstdOptions = {
     ...opts.zstd,
     params: {
-      [zlib.constants.ZSTD_c_compressionLevel]: 3,
+      [zlib.constants.ZSTD_c_compressionLevel]: 1,
       ...opts.zstd?.params,
     },
   }
@@ -104,12 +122,19 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
   if (opts.windowBits !== undefined) zlibOpts.windowBits = opts.windowBits
   if (opts.chunkSize !== undefined) zlibOpts.chunkSize = opts.chunkSize
 
+  const codecOpts: CodecOptions = { zstd: optsZstd, brotli: optsBrotli, zlib: zlibOpts }
+
   const filter = opts.filter || shouldCompress
   const threshold = parseBytes(opts.threshold) ?? 1024
+  const syncMaxBytes = parseBytes(opts.syncMaxBytes) ?? 128 * 1024
   const enforceEncoding = opts.enforceEncoding || 'identity'
 
   return function compression(req, res, next) {
     let ended = false
+    // Set by the first `res.write`: the body comes in several chunks, so only the stream path applies
+    let wrote = false
+    // Set once the compress-or-not decision has been made for this response (by either path)
+    let decided = false
     let length: number | undefined
     let listeners: [string, (...args: any[]) => void][] | null = []
     let stream: zlib.Gzip | zlib.Deflate | zlib.BrotliCompress | zlib.ZstdCompress | undefined
@@ -136,6 +161,8 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
         return false
       }
 
+      wrote = true
+
       if (!headersSent(res)) {
         res.writeHead(res.statusCode)
       }
@@ -161,6 +188,30 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
         if (!res.getHeader('Content-Length')) {
           length = chunkLength(chunk, encodingOrCallback as BufferEncoding)
         }
+
+        // Single-chunk body (no prior `res.write`): the whole body is right here, so compress it
+        // synchronously instead of setting up a zlib stream for one chunk.
+        if (chunk && !wrote && !decided) {
+          const encoding = typeof encodingOrCallback === 'function' ? undefined : encodingOrCallback
+          const body = toBuffer(chunk, encoding)
+
+          if (body.length <= syncMaxBytes) {
+            const method = decide(body.length)
+
+            if (method) {
+              const compressed = compressSync(method, body, codecOpts)
+              res.setHeader('Content-Encoding', method)
+              res.setHeader('Content-Length', compressed.length)
+              ended = true
+              const cb = typeof encodingOrCallback === 'function' ? encodingOrCallback : callback
+              // encoding is irrelevant for a Buffer chunk; it is passed to satisfy the `end` overload
+              return _end.call(res, compressed, 'utf8', cb)
+            }
+            // Not compressing: falls through to the plain `end`.
+            // The `onHeaders` listener below sees `decided` and does nothing.
+          }
+        }
+
         res.writeHead(res.statusCode)
       }
 
@@ -195,34 +246,27 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
       return res
     }
 
-    function nocompress(_msg: string): void {
+    function nocompress(_msg: string): undefined {
       addListeners(res, _on, listeners!)
       listeners = null
     }
 
-    // Release the compression stream when the response closes, freeing native
-    // zlib memory even if the client disconnected before the response finished.
-    // Registered before onHeaders so a close that happens before the stream
-    // exists is not missed (the `closed` flag below handles a stream created
-    // afterwards). Fixes CVE-2026-87776 / GHSA-vc2v-76pw-4v95.
-    // We use `stream.destroy()` (not the `destroy` npm package upstream added)
-    // because our Node target frees the zlib handle on destroy().
-    _on.call(res, 'close', function onResponseClose() {
-      closed = true
-      stream?.destroy()
-    })
+    /**
+     * The compress-or-not decision, shared by the sync path (`res.end` holding the whole body)
+     * and the stream path (`onHeaders`).
+     * Returns the encoding to use, or undefined when the response is to be sent as-is.
+     */
+    function decide(bodyLength: number | undefined): string | undefined {
+      decided = true
 
-    onHeaders(res, function onResponseHeaders() {
       // determine if request is filtered
       if (!filter(req, res)) {
-        nocompress('filtered')
-        return
+        return nocompress('filtered')
       }
 
       // determine if the entity should be transformed
       if (!shouldTransform(req, res)) {
-        nocompress('no transform')
-        return
+        return nocompress('no transform')
       }
 
       // vary
@@ -231,24 +275,21 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
       // content-length below threshold
       if (
         Number(res.getHeader('Content-Length')) < threshold ||
-        (length !== undefined && length < threshold)
+        (bodyLength !== undefined && bodyLength < threshold)
       ) {
-        nocompress('size below threshold')
-        return
+        return nocompress('size below threshold')
       }
 
       const encoding = (res.getHeader('Content-Encoding') as string) || 'identity'
 
       // already encoded
       if (encoding !== 'identity') {
-        nocompress('already encoded')
-        return
+        return nocompress('already encoded')
       }
 
       // head
       if (req.method === 'HEAD') {
-        nocompress('HEAD request')
-        return
+        return nocompress('HEAD request')
       }
 
       // compression method
@@ -266,10 +307,31 @@ export function compressionMiddleware(options?: CompressionOptions): BackendRequ
 
       // negotiation failed
       if (!method || method === 'identity') {
-        nocompress('not acceptable')
-        return
+        return nocompress('not acceptable')
       }
 
+      return method
+    }
+
+    // Release the compression stream when the response closes, freeing native
+    // zlib memory even if the client disconnected before the response finished.
+    // Registered before onHeaders so a close that happens before the stream
+    // exists is not missed (the `closed` flag below handles a stream created
+    // afterwards). Fixes CVE-2026-87776 / GHSA-vc2v-76pw-4v95.
+    // We use `stream.destroy()` (not the `destroy` npm package upstream added)
+    // because our Node target frees the zlib handle on destroy().
+    _on.call(res, 'close', function onResponseClose() {
+      closed = true
+      stream?.destroy()
+    })
+
+    onHeaders(res, function onResponseHeaders() {
+      // The sync path has already handled this response (compressed it, or declined to)
+      if (decided) return
+
+      const method = decide(length)
+      if (!method) return
+
       // compression stream
       if (method === 'zstd') {
         stream = zlib.createZstdCompress(optsZstd)
@@ -331,6 +393,23 @@ export function shouldCompress(_req: any, res: any): boolean {
   return true
 }
 
+interface CodecOptions {
+  zstd: zlib.ZstdOptions
+  brotli: zlib.BrotliOptions
+  zlib: zlib.ZlibOptions
+}
+
+/**
+ * Compresses a whole body in one call, on the event loop.
+ * Same codec options as the streams, so the output is identical to the streamed one.
+ */
+function compressSync(method: string, body: Buffer, opts: CodecOptions): Buffer {
+  if (method === 'zstd') return zlib.zstdCompressSync(body, opts.zstd)
+  if (method === 'br') return zlib.brotliCompressSync(body, opts.brotli)
+  if (method === 'gzip') return zlib.gzipSync(body, opts.zlib)
+  return zlib.deflateSync(body, opts.zlib)
+}
+
 function addListeners(
   stream: any,
   on: (type: string, listener: (...args: any[]) => void) => void,

package/src/vary.ts

@@ -0,0 +1,29 @@
+import type { ServerResponse } from 'node:http'
+
+/**
+ * Adds the field (header name) to the response's Vary header, unless it's already there
+ * (case-insensitive). Vary: * stays as is, and adding '*' replaces the whole header with '*'.
+ *
+ * Vendored (and modernized) from the `vary` package.
+ */
+export function vary(res: ServerResponse, field: string): void {
+  const header = res.getHeader('Vary')
+  const value = Array.isArray(header) ? header.join(', ') : String(header ?? '')
+  if (!value) {
+    res.setHeader('Vary', field)
+    return
+  }
+
+  const fields = new Set(
+    value
+      .toLowerCase()
+      .split(',')
+      .map(f => f.trim()),
+  )
+
+  if (field === '*' || fields.has('*')) {
+    if (value !== '*') res.setHeader('Vary', '*')
+  } else if (!fields.has(field.toLowerCase())) {
+    res.setHeader('Vary', `${value}, ${field}`)
+  }
+}