@nifrajs/core 2.14.1 → 3.2.0

package/src/server/request-context.ts

@@ -5,19 +5,13 @@
  * sits below the server module in the graph.
  */
 import type { RequestBudget } from "../budget.ts"
-import {
-  applyTransportCap,
-  drainCapped,
-  hasTrustedBodyFraming,
-  parseContentLength,
-  RAW_BODY_READERS,
-  readBoundedBytes,
-} from "./body.ts"
+import { applyTransportCap, readBoundedBytes } from "./body.ts"
+import { readBoundedJsonSource } from "./body-lane.ts"
 import type { Platform } from "./context.ts"
 import { type CookieOptions, cookieNamePrefix, parseCookies, serializeCookie } from "./cookies.ts"
 import { headerObjectOf } from "./headers.ts"
-import { jsonError } from "./http.ts"
-import { guardParsedValue, type ProtoPoisoning, parseJsonGuarded } from "./proto-guard.ts"
+import { plainError } from "./http.ts"
+import type { ProtoPoisoning } from "./proto-guard.ts"
 import { searchOf } from "./query.ts"
 import { responseJsonContentType } from "./respond.ts"
 import {
@@ -27,13 +21,13 @@ import {
   getNeverAbortSignal,
   getUnboundedRequestBudget,
   headerOf,
-  PRE_DECODED_BODY,
-  type PreDecodedBody,
+  isResponseResult,
   requestOf,
-  TEXT_DECODER,
 } from "./runtime-core.ts"
 import type { CtxSet, RawContext, RequestSource } from "./server.ts"
 
+export { readBodyFramed, readBoundedJsonSource } from "./body-lane.ts"
+
 /** A fixed past instant for cookie deletion (`Expires`). A literal epoch - deterministic, unlike an
  * argless `new Date()`. */
 const EPOCH = new Date(0)
@@ -390,7 +384,7 @@ export class RequestContext implements RawContext {
   }
 }
 
-/** Backs `c.boundedBody`: bounded byte read that throws a flat 413/400 `Response` (caught by
+/** Backs `c.boundedBody`: bounded byte read that throws a flat 413/400 plain render (caught by
  * `runLifecycle` as control flow, like `throw redirect(...)`), so a handler can't ignore the cap.
  * The byte-cap itself lives in `./body.ts` (shared with the schema path and `verifyWebhook`). */
 async function readBoundedBodyOrThrow(
@@ -401,8 +395,8 @@ async function readBoundedBodyOrThrow(
   const r = await readBoundedBytes(req, maxBytes ?? maxBodyBytes)
   if (r.ok) return r.bytes
   throw r.status === 413
-    ? jsonError(413, "payload_too_large")
-    : jsonError(400, "invalid_content_length")
+    ? plainError(413, "payload_too_large")
+    : plainError(400, "invalid_content_length")
 }
 
 /** Backs `c.boundedJson`: `readBoundedJsonSource`, throwing its flat 400/413 on failure. */
@@ -413,7 +407,9 @@ async function readBoundedJsonBodyOrThrow<T>(
   maxBytes?: number,
 ): Promise<T> {
   const parsed = await readBoundedJsonSource(req, maxBytes ?? maxBodyBytes, protoPoisoning)
-  if (parsed instanceof Response) throw parsed
+  // The lane's own failures are the only branded values it can produce: a parsed JSON body is
+  // `JSON.parse` output, which carries string keys only and so can never answer to a symbol brand.
+  if (isResponseResult(parsed)) throw parsed
   return parsed as T
 }
 
@@ -424,202 +420,3 @@ async function readBoundedJsonBodyOrThrow<T>(
  * with an in-cap `Content-Length` take the runtime's fused `json()` and walk the parsed value;
  * chunked or length-less requests fall back to the streaming byte-cap guard.
  */
-/**
- * Deliberately **not** `async`: the framed lane is the hot path for every JSON POST, and an async
- * wrapper costs a coroutine frame, a wrapper promise, and an extra microtask hop on top of the one
- * the body read already pays (~90ns/request on Node, measured). The lane returns the body read's
- * own promise chain instead, and only the streaming fallback - which is already doing IO in a loop
- * - runs as an async function. Callers that `await` the result are unaffected.
- */
-type JsonResultContinuation<T> = (result: unknown | Response) => T | Promise<T>
-type JsonErrorContinuation<T> = (error: unknown) => T | Promise<T>
-type FramedJsonSource = RequestSource & {
-  readonly bytes?: () => Promise<Uint8Array>
-  readonly jsonWithByteLength?: () => Promise<{
-    readonly value: unknown
-    readonly byteLength: number
-  }>
-}
-
-export function readBoundedJsonSource(
-  req: RequestSource,
-  maxBytes: number,
-  protoPoisoning?: ProtoPoisoning,
-): Promise<unknown | Response>
-export function readBoundedJsonSource<T>(
-  req: RequestSource,
-  maxBytes: number,
-  protoPoisoning: ProtoPoisoning,
-  onResult: JsonResultContinuation<T>,
-  onError: JsonErrorContinuation<T>,
-): Promise<T>
-export function readBoundedJsonSource<T>(
-  req: RequestSource,
-  maxBytes: number,
-  protoPoisoning: ProtoPoisoning = "reject",
-  onResult?: JsonResultContinuation<T>,
-  onError?: JsonErrorContinuation<T>,
-): Promise<unknown | Response | T> {
-  // A pre-parsing hook (the transport-codec lane) may have decoded the body already - its stash
-  // is taken verbatim: the stasher enforced its own byte cap and poisoning policy on text this
-  // lane never sees. One symbol read; a miss on ordinary requests costs a cache-line, not a parse.
-  const preDecoded = (req as { [PRE_DECODED_BODY]?: PreDecodedBody })[PRE_DECODED_BODY]
-  if (preDecoded !== undefined) {
-    return onResult === undefined
-      ? Promise.resolve(preDecoded.value)
-      : Promise.resolve(preDecoded.value).then(onResult)
-  }
-  // Read through the pre-cap readers when the request is transport-capped: this lane enforces its
-  // own `maxBytes` (which may exceed the route's transport cap), so the shadowed user-facing
-  // readers must not narrow it.
-  // Keep the source's header dispatch local: the normal Node source exposes a direct `header`
-  // lookup, while a Web Request only exposes `Headers.get`. Rechecking that optional method through
-  // `headerOf` twice per body is measurable on the framed lane. The raw-reader shadow is still
-  // bypassed for reads, but header authority remains the original source (same semantics as before).
-  const raw = ((req as { [RAW_BODY_READERS]?: RequestSource })[RAW_BODY_READERS] ??
-    req) as FramedJsonSource
-  const sourceHeader = req.header
-  const declared =
-    sourceHeader === undefined
-      ? req.headers.get("content-length")
-      : sourceHeader.call(req, "content-length")
-  if (declared !== null) {
-    // A present Content-Length must be a non-negative integer (HTTP grammar: `1*DIGIT`). A
-    // non-numeric / negative / fractional / exponential value (`Number()` would happily accept
-    // "abc"->NaN, "-5", "1.5", "1e3", "0x10") is malformed -> 400, rather than silently falling
-    // through to the streaming guard - which is an UPPER-bound cap only, so a lying SMALLER length
-    // would otherwise be read in full. Real HTTP servers only hand us a valid framed length; this
-    // hardens hand-built Requests (tests, the in-process client) and crafted input.
-    const length = parseContentLength(declared)
-    if (length === undefined)
-      return onResult === undefined
-        ? Promise.resolve(jsonError(400, "invalid_content_length"))
-        : Promise.resolve(jsonError(400, "invalid_content_length")).then(onResult)
-    if (length > maxBytes)
-      return onResult === undefined
-        ? Promise.resolve(jsonError(413, "payload_too_large"))
-        : Promise.resolve(jsonError(413, "payload_too_large")).then(onResult)
-    // Trusted framing (Bun's native route table, Deno.serve): the runtime's HTTP parser already
-    // delimited the bytes, so the declared length IS the transport frame and chunked routing is
-    // moot - the over-cap 413 above already enforced the byte cap. Take the runtime's fused
-    // decode+parse straight away, before the transfer-encoding probe that only exists to route
-    // *untrusted* Node/adapter sources to the streaming lane. Skipping that probe drops one
-    // `Headers.get()` from every Bun/Deno JSON POST; Node/adapter sources are never marked and fall
-    // through below. The parsed-value poisoning walk still applies.
-    if (hasTrustedBodyFraming(req)) {
-      return raw.json().then(
-        (parsed) => {
-          let guarded: unknown
-          try {
-            guarded = guardParsedValue(parsed, protoPoisoning)
-          } catch {
-            return onResult === undefined
-              ? jsonError(400, "invalid_json")
-              : onResult(jsonError(400, "invalid_json"))
-          }
-          return onResult === undefined ? guarded : onResult(guarded)
-        },
-        () => (onResult === undefined ? INVALID_JSON() : onResult(INVALID_JSON())),
-      )
-    }
-    const chunked =
-      (sourceHeader === undefined
-        ? req.headers.get("transfer-encoding")
-        : sourceHeader.call(req, "transfer-encoding")) !== null
-    if (!chunked) {
-      const jsonWithByteLength = raw.jsonWithByteLength
-      if (jsonWithByteLength !== undefined) {
-        return jsonWithByteLength.call(raw).then(
-          ({ value, byteLength }) => {
-            if (byteLength > length || byteLength > maxBytes) {
-              return onResult === undefined
-                ? jsonError(413, "payload_too_large")
-                : onResult(jsonError(413, "payload_too_large"))
-            }
-            let guarded: unknown
-            try {
-              guarded = guardParsedValue(value, protoPoisoning)
-            } catch {
-              return onResult === undefined
-                ? jsonError(400, "invalid_json")
-                : onResult(jsonError(400, "invalid_json"))
-            }
-            return onResult === undefined ? guarded : onResult(guarded)
-          },
-          () => (onResult === undefined ? INVALID_JSON() : onResult(INVALID_JSON())),
-        )
-      }
-      const bytesReader = raw.bytes
-      if (bytesReader !== undefined) {
-        return bytesReader.call(raw).then(
-          (bytes) => {
-            if (bytes.byteLength > length || bytes.byteLength > maxBytes) {
-              return onResult === undefined
-                ? jsonError(413, "payload_too_large")
-                : onResult(jsonError(413, "payload_too_large"))
-            }
-            try {
-              const parsed = parseJsonGuarded(TEXT_DECODER.decode(bytes), protoPoisoning)
-              return onResult === undefined ? parsed : onResult(parsed)
-            } catch {
-              return onResult === undefined
-                ? jsonError(400, "invalid_json")
-                : onResult(jsonError(400, "invalid_json"))
-            }
-          },
-          () => (onResult === undefined ? INVALID_JSON() : onResult(INVALID_JSON())),
-        )
-      }
-      // Read the actual framed bytes before parsing. A declared length is only a hint on Web
-      // Requests and adapter-shaped sources: a caller can construct a Request (or an adapter can
-      // decode/expand a body) whose header claims fewer bytes than the delivered payload. Calling
-      // native `json()` here would accept that understatement and bypass the cap. The byte lane
-      // already owns this post-read check; keeping the JSON lane on the same raw-byte read makes the
-      // trust boundary consistent. `Uint8Array(buffer)` is a view, not a copy.
-      return raw.arrayBuffer().then(
-        (buffer) => {
-          const bytes = new Uint8Array(buffer)
-          if (bytes.byteLength > length || bytes.byteLength > maxBytes) {
-            return onResult === undefined
-              ? jsonError(413, "payload_too_large")
-              : onResult(jsonError(413, "payload_too_large"))
-          }
-          let parsed: unknown
-          try {
-            parsed = parseJsonGuarded(TEXT_DECODER.decode(bytes), protoPoisoning)
-          } catch {
-            return onResult === undefined
-              ? jsonError(400, "invalid_json")
-              : onResult(jsonError(400, "invalid_json"))
-          }
-          return onResult === undefined ? parsed : onResult(parsed)
-        },
-        () => (onResult === undefined ? INVALID_JSON() : onResult(INVALID_JSON())),
-      )
-    }
-  }
-  const streamed = readStreamedJsonSource(raw, maxBytes, protoPoisoning)
-  return onResult === undefined ? streamed : streamed.then(onResult, onError)
-}
-
-/** The shared rejection handler for a body read that never completed (client abort, socket error,
- * malformed framing): the same flat 400 a syntactically invalid body gets. Hoisted so the framed
- * lane allocates no per-request closure for it. */
-const INVALID_JSON = (): Response => jsonError(400, "invalid_json")
-
-/** The chunked / length-less fallback: drain under the streaming byte cap, then parse guarded. */
-async function readStreamedJsonSource(
-  raw: RequestSource,
-  maxBytes: number,
-  protoPoisoning: ProtoPoisoning,
-): Promise<unknown | Response> {
-  const body = raw.body
-  if (body === null) return jsonError(400, "invalid_json")
-  const drained = await drainCapped(body, maxBytes)
-  if (!drained.ok) return jsonError(413, "payload_too_large")
-  try {
-    return parseJsonGuarded(TEXT_DECODER.decode(drained.bytes), protoPoisoning)
-  } catch {
-    return jsonError(400, "invalid_json")
-  }
-}

package/src/server/respond.ts

@@ -4,11 +4,14 @@
  * spine types, so the wire-response format lives in one module distinct from the request engine.
  */
 
+import { NODE_BRIDGE_MARKER_KEYS } from "./bridge-markers.ts"
 import {
   CONTEXT_SET,
   EMPTY_RESPONSE_CONTROLS,
   type HandlerResult,
   isResponseResult,
+  type PlainRender,
+  plainRenderHeaders,
 } from "./runtime-core.ts"
 import type { CtxSet, RawContext } from "./server.ts"
 import { mergeStaticHeaderRecord, type StaticResponseHeaders } from "./static-headers.ts"
@@ -24,6 +27,16 @@ function headersInit(set: CtxSet): Record<string, string> | Headers | undefined
   return headers
 }
 
+/** The `c.set` a plain render stands for: its status and headers, carrying over the request's queued
+ * cookies so `set.cookie(...)` then an early exit still ships them. */
+function plainRenderSet(plain: PlainRender, set: CtxSet): CtxSet {
+  return {
+    status: plain.status,
+    _headers: plainRenderHeaders(plain, set),
+    _cookies: set._cookies,
+  } as CtxSet
+}
+
 // Keep the fast JSON respond path byte-identical to `Response.json` without probing it at module
 // scope: workerd forbids `Response.json()` during startup. A shared `Headers` is safe to reuse
 // across responses: the Response constructor copies `init.headers` into its own list.
@@ -109,6 +122,8 @@ function staticJsonResponse(
       contentType,
     )
   }
+  // lgtm [js/stack-trace-exposure] `body` is already serialized; ordinary thrown errors are replaced
+  // with the fixed internal-error envelope before reaching this response boundary.
   return new Response(body, init)
 }
 
@@ -147,6 +162,7 @@ function withStaticHeaderInit(
 // portable constructor path there and select the Deno-specific shape only for Web responses that
 // carry a plain record. The first request lazily probes Deno's native JSON content-type so this
 // preserves the runtime's Response.json contract instead of baking in Bun's charset suffix.
+const IS_BUN = typeof (globalThis as { Bun?: unknown }).Bun !== "undefined"
 const IS_DENO = typeof (globalThis as { Deno?: unknown }).Deno !== "undefined"
 let denoJsonContentType: string | undefined
 
@@ -163,6 +179,8 @@ function denoResponseWithJsonBody(
   headers: Record<string, string>,
   defaultContentType = responseJsonContentType(),
 ): Response {
+  // lgtm [js/stack-trace-exposure] this body is serialized data; ordinary thrown errors are replaced
+  // with the fixed internal-error envelope before reaching this response boundary.
   const response = new Response(body, { status })
   let hasContentType = false
   for (const [name, value] of Object.entries(headers)) {
@@ -175,10 +193,28 @@ function denoResponseWithJsonBody(
   return response
 }
 
+/**
+ * Render a JSON value with caller-owned headers on the runtimes where mutating the response is
+ * cheaper than asking the Response constructor to ingest a record. Node deliberately stays on the
+ * record path: its undici implementation is a little faster there, and its production HTTP adapter
+ * normally uses the direct node outcome anyway. The two operations are equivalent at the Web
+ * boundary: Response.json supplies the same default content type, then the caller's headers override
+ * it exactly as `withJsonContentType` did.
+ */
+function jsonResponseWithOwnHeaders(
+  result: object,
+  status: number,
+  headers: Record<string, string>,
+): Response {
+  const response = status === 200 ? Response.json(result) : Response.json(result, { status })
+  for (const name of Object.keys(headers)) response.headers.set(name, headers[name]!)
+  return stamped(response)
+}
+
 // The framework-buffered-body marker shared with the Node adapter: a Response carrying it exposes
 // its already-serialized bytes without draining. On the Web serving paths it exists ONLY when a
 // registered body/raw hook needs it, so hook-less apps pay nothing.
-const RESPONSE_BODY = Symbol.for("nifra.response.body")
+const RESPONSE_BODY = Symbol.for(NODE_BRIDGE_MARKER_KEYS.responseBody)
 
 /**
  * Headers objects the framework itself constructed - guaranteed mutable, no guard. Response
@@ -396,6 +432,18 @@ export function toResponse(
   statics?: StaticResponseHeaders,
 ): Response {
   if (isResponseResult(result)) {
+    const plain = result.plain
+    if (plain !== undefined) {
+      // Rendered as the value it is, on the branches below, rather than through `toResponse()`: the
+      // status and headers fold into a `set` and the body takes the ordinary JSON lane. One level
+      // only - a plain render's body is a user value, never another response carrier.
+      return toResponse(
+        plain.body as HandlerResult,
+        plainRenderSet(plain, set),
+        tagResponseBody,
+        statics,
+      )
+    }
     return withStatics(
       appendCookiesToResponse(normalizeBodylessResponse(result.toResponse()), set),
       statics,
@@ -413,6 +461,24 @@ export function toResponse(
   if (status === 204 || status === 205 || status === 304) {
     return stamped(new Response(null, headers === undefined ? { status } : { status, headers }))
   }
+  // Bun and Deno both make a JSON response first and then accept a few header mutations more cheaply
+  // than ingesting the same plain record in the constructor. This is the common dynamic-header
+  // shape (`c.set.headers`) after all cookies/static-header/tagging cases have been excluded. Keep the
+  // Node record path unchanged: its Web constructor wins by a small margin, and the native Node
+  // adapter's normal route finalizer does not build this Response in the first place.
+  if (
+    own !== undefined &&
+    !(own instanceof Headers) &&
+    statics === undefined &&
+    (set._cookies === undefined || set._cookies.length === 0) &&
+    (IS_BUN || IS_DENO) &&
+    !tagResponseBody &&
+    result !== undefined &&
+    typeof result === "object" &&
+    result !== null
+  ) {
+    return jsonResponseWithOwnHeaders(result, status, own)
+  }
   if (own === undefined && result !== undefined) {
     // Fast respond (profiled ~50 ns/req faster on every plain-JSON return): `JSON.stringify` + a
     // prebuilt init beats `Response.json`'s internal init handling. Output is byte-identical -
@@ -426,7 +492,8 @@ export function toResponse(
           : { status, headers: jsonCtHeaders }
       return tagged(
         statics === undefined
-          ? new Response(body, init)
+          ? // lgtm [js/stack-trace-exposure] the serialized body is not a caught error stack.
+            new Response(body, init)
           : staticJsonResponse(body, status, statics, JSON_CONTENT_TYPE, init),
         body,
         tagResponseBody,
@@ -446,7 +513,8 @@ export function toResponse(
               headers as Record<string, string>,
               JSON_CT_HEADERS.get("content-type") ?? "application/json;charset=utf-8",
             )
-          : new Response(body, { status, headers: withJsonContentType(headers) })
+          : // lgtm [js/stack-trace-exposure] the serialized body is not a caught error stack.
+            new Response(body, { status, headers: withJsonContentType(headers) })
       return tagged(
         response,
         body,

package/src/server/response-contract-lane.ts

@@ -48,6 +48,7 @@ import {
 } from "../schema/standard.ts"
 import { INSTALL_RESPONSE_CONTRACT } from "./install.ts"
 import type { IdentityPlugin } from "./plugin.ts"
+import { isResponseResult } from "./runtime-core.ts"
 import type { AnyServer } from "./server.ts"
 
 /**
@@ -91,8 +92,11 @@ export function checkResponseContract(
   mode: "warn" | "enforce",
 ): ResponseContractOutcome | Promise<ResponseContractOutcome> {
   // A handler may return a raw Response as deliberate control flow (a redirect, a stream). There is no
-  // JSON payload to hold to the contract, and re-serializing one would corrupt it.
-  if (result instanceof Response || result === undefined) return { kind: "ok", value: result }
+  // JSON payload to hold to the contract, and re-serializing one would corrupt it. A `status(...)` is
+  // the same control flow in plain-data form: the contract describes the route's SUCCESS payload, so
+  // holding an early exit (a 401 body, say) to it would fail every guarded route that declares one.
+  if (result instanceof Response || result === undefined || isResponseResult(result))
+    return { kind: "ok", value: result }
   const settled = schema["~standard"].validate(result)
   return settled instanceof Promise
     ? settled.then((r) => interpret(r, result, mode))

package/src/server/response-observer-runtime.ts

@@ -0,0 +1,135 @@
+import type {
+  NodeRequestContext,
+  NodeResponseHook,
+  ResponseBodyHook,
+  ResponseHeadersHook,
+  ResponseHeadersView,
+} from "./node-outcome-hook.ts"
+import { recordHeadersView } from "./node-outcome-hook.ts"
+import { knownMutableHeaders, rememberMutableHeaders, taggedResponseBody } from "./respond.ts"
+import { applyBodyReplacement, withReplacedBody } from "./response-hooks.ts"
+
+type MaybePromise<T> = T | Promise<T>
+type WebResponseHook = (response: Response, req: Request) => MaybePromise<Response>
+
+export type { ResponseBodyHook, ResponseHeadersHook } from "./node-outcome-hook.ts"
+
+export interface ResponseObserverHost {
+  assertConfigurable(operation: string): void
+  addResponseHook(web: WebResponseHook, node: NodeResponseHook | undefined): void
+  enableResponseBodyTagging(): object
+  responseBodyOwners(): ReadonlySet<object>
+}
+
+export interface ResponseObserverMethods {
+  onResponseHeaders(fn: ResponseHeadersHook): this
+  onResponseBody(fn: ResponseBodyHook): this
+  onResponseRaw(fn: (response: Response, req: Request) => MaybePromise<Response>): this
+}
+
+export interface ResponseObserverRuntime {
+  install(host: ResponseObserverHost): ResponseObserverMethods
+}
+
+const HEADER_MUTABILITY_PROBE = "x-nifra-header-probe"
+const GUARDED_RESPONSE_HEADERS = new WeakSet<Headers>()
+
+function hasMutableResponseHeaders(headers: Headers): boolean {
+  if (knownMutableHeaders(headers)) return true
+  if (GUARDED_RESPONSE_HEADERS.has(headers)) return false
+  let previous: string | null = null
+  try {
+    previous = headers.get(HEADER_MUTABILITY_PROBE)
+    headers.set(HEADER_MUTABILITY_PROBE, "1")
+    if (previous === null) headers.delete(HEADER_MUTABILITY_PROBE)
+    else headers.set(HEADER_MUTABILITY_PROBE, previous)
+    rememberMutableHeaders(headers)
+    return true
+  } catch {
+    try {
+      if (previous === null) headers.delete(HEADER_MUTABILITY_PROBE)
+      else headers.set(HEADER_MUTABILITY_PROBE, previous)
+    } catch {
+      // A guarded response rejected the probe and the clone path is authoritative.
+    }
+    GUARDED_RESPONSE_HEADERS.add(headers)
+    return false
+  }
+}
+
+function webRequestView(req: Request): NodeRequestContext {
+  return { method: req.method, url: req.url, header: (name) => req.headers.get(name) }
+}
+
+function webHeadersView(
+  response: Response,
+  req: Request,
+): {
+  readonly response: Response
+  readonly headers: ResponseHeadersView
+  readonly request: NodeRequestContext
+} {
+  const request = webRequestView(req)
+  if (!hasMutableResponseHeaders(response.headers)) {
+    const clone = new Response(response.body, response)
+    return { response: clone, headers: clone.headers, request }
+  }
+  return { response, headers: response.headers, request }
+}
+
+export function createResponseObserverRuntime(): ResponseObserverRuntime {
+  return {
+    install(host) {
+      return {
+        onResponseHeaders(this: ResponseObserverMethods, fn): ResponseObserverMethods {
+          host.assertConfigurable("onResponseHeaders()")
+          host.addResponseHook(
+            (response, req) => {
+              const view = webHeadersView(response, req)
+              const out = fn(view.headers, view.request, response.status)
+              return out instanceof Promise ? out.then(() => view.response) : view.response
+            },
+            (response, req) => fn(recordHeadersView(response), req, response.status),
+          )
+          return this
+        },
+        onResponseBody(this: ResponseObserverMethods, fn): ResponseObserverMethods {
+          host.assertConfigurable("onResponseBody()")
+          host.enableResponseBodyTagging()
+          host.addResponseHook(
+            (response, req) => {
+              const body = taggedResponseBody(response, host.responseBodyOwners())
+              if (body === undefined) return response
+              const view = webHeadersView(response, req)
+              const out = fn(body, view.headers, view.request, response.status)
+              return out instanceof Promise
+                ? out.then((replaced) => withReplacedBody(response, replaced))
+                : withReplacedBody(response, out)
+            },
+            (response, req) => {
+              if (response.body === null) return undefined
+              const out = fn(response.body, recordHeadersView(response), req, response.status)
+              if (out instanceof Promise)
+                return out.then((replaced) => applyBodyReplacement(response, replaced))
+              applyBodyReplacement(response, out)
+              return undefined
+            },
+          )
+          return this
+        },
+        onResponseRaw(this: ResponseObserverMethods, fn): ResponseObserverMethods {
+          host.assertConfigurable("onResponseRaw()")
+          host.enableResponseBodyTagging()
+          host.addResponseHook(
+            (response, req) =>
+              taggedResponseBody(response, host.responseBodyOwners()) === undefined
+                ? fn(response, req)
+                : response,
+            () => undefined,
+          )
+          return this
+        },
+      }
+    },
+  }
+}