@nifrajs/middleware 2.8.2 → 2.9.0

package/dist/compression.js

@@ -2,6 +2,33 @@ import { definePlugin } from "@nifrajs/core/server";
 // Text-like payloads benefit from gzip; binary media (images/video/archives) is already compressed.
 const COMPRESSIBLE = /^(?:text\/|application\/(?:json|[\w.-]+\+json|javascript|xml|[\w.-]+\+xml|wasm|x-ndjson)|image\/svg\+xml)/i;
 const defaultCompressible = (contentType) => COMPRESSIBLE.test(contentType);
+/** Honor explicit q=0 exclusions; a client that says `gzip;q=0` must not receive gzip. */
+function acceptsGzip(value) {
+    if (value === null)
+        return false;
+    let wildcard;
+    let gzip;
+    for (const item of value.split(",")) {
+        const parts = item.trim().split(";");
+        const coding = parts[0]?.trim().toLowerCase();
+        if (coding !== "gzip" && coding !== "*")
+            continue;
+        let quality = 1;
+        for (let i = 1; i < parts.length; i++) {
+            const [name, raw] = parts[i].trim().split("=", 2);
+            if (name?.toLowerCase() === "q") {
+                const parsed = Number(raw);
+                quality = Number.isFinite(parsed) && parsed >= 0 && parsed <= 1 ? parsed : 0;
+            }
+        }
+        if (coding === "gzip")
+            gzip = quality;
+        else
+            wildcard = quality;
+    }
+    return (gzip ?? wildcard ?? 0) > 0;
+}
+const GZIP_ENCODER = new TextEncoder();
 const concat = (chunks, total) => {
     const out = new Uint8Array(total);
     let offset = 0;
@@ -14,92 +41,186 @@ const concat = (chunks, total) => {
 const gzipHeaders = (source) => {
     const headers = new Headers(source);
     headers.set("content-encoding", "gzip");
-    headers.delete("content-length"); // compressed length is unknown up front → chunked
+    headers.delete("content-length");
+    addGzipVary(headers);
+    return headers;
+};
+function addGzipVary(headers) {
     const vary = headers.get("vary");
-    if (vary === null)
+    if (vary === null) {
         headers.set("vary", "Accept-Encoding");
-    else if (!vary.toLowerCase().split(",").includes("accept-encoding"))
+    }
+    else if (!vary
+        .toLowerCase()
+        .split(",")
+        .some((part) => part.trim() === "accept-encoding")) {
         headers.set("vary", `${vary}, Accept-Encoding`);
-    return headers;
-};
-/**
- * Transparently **gzip** responses when the client sends `Accept-Encoding: gzip` and the body is a
- * compressible type larger than `threshold`. Uses the Web-standard `CompressionStream` (streaming, no
- * full-body buffering), so it runs on every nifra runtime including the edge. gzip is the one encoding
- * `CompressionStream` guarantees everywhere; brotli isn't part of the standard, so it's not offered.
- *
- * The body is **peeked** up to `threshold` bytes to enforce the size floor: a response that ends below
- * the threshold is sent uncompressed (gzip's ~20-byte overhead would enlarge it), and only larger
- * bodies are compressed - the buffered prefix is replayed and the remainder streamed. (Runtimes rarely
- * set `Content-Length` on a constructed `Response`, so the header alone can't gate this.)
- *
- * Skips: clients that don't accept gzip, already-encoded responses, bodyless responses (204/304/HEAD),
- * `Range` responses (206 / `Content-Range`), `Cache-Control: no-transform`, and non-compressible types.
- * Adds `Vary: Accept-Encoding`.
- *
- * ```ts
- * app.use(compression())
- * ```
- */
-export function compression(options = {}) {
-    const threshold = options.threshold ?? 1024;
-    const isCompressible = options.compressible ?? defaultCompressible;
-    return definePlugin("compression", (app) => app.onResponse(async (res, req) => {
-        const body = res.body;
-        if (body === null)
-            return res; // 204/304/HEAD - nothing to compress
-        if (!(req.headers.get("accept-encoding") ?? "").toLowerCase().includes("gzip"))
-            return res;
-        if (res.headers.has("content-encoding"))
-            return res; // already encoded
-        if (res.status === 206 || res.headers.has("content-range"))
-            return res; // ranges pass through
-        if ((res.headers.get("cache-control") ?? "").includes("no-transform"))
-            return res;
-        if (!isCompressible(res.headers.get("content-type") ?? ""))
-            return res;
-        const declared = res.headers.get("content-length");
-        if (declared !== null && Number(declared) < threshold)
-            return res; // fast path when length is known
-        // Peek up to `threshold` bytes to decide whether compressing is worth it.
-        const reader = body.getReader();
-        const buffered = [];
-        let total = 0;
+    }
+}
+function hasNoTransform(value) {
+    return (value
+        ?.split(",")
+        .some((directive) => directive.trim().split(";", 1)[0]?.trim().toLowerCase() === "no-transform") ?? false);
+}
+/** Gzip a resident buffer through the Web-standard `CompressionStream` (available everywhere). */
+async function gzipBytes(bytes) {
+    // No explicit generic: the chunk type infers from `enqueue`, which keeps the stream assignable
+    // to `CompressionStream`'s typing across the Bun/DOM lib variants.
+    const source = new ReadableStream({
+        start(controller) {
+            controller.enqueue(bytes);
+            controller.close();
+        },
+    });
+    const compressed = await new Response(source.pipeThrough(new CompressionStream("gzip"))).arrayBuffer();
+    return new Uint8Array(compressed);
+}
+/** Stream-safe fallback for handler-returned/proxied Responses. Peek only enough to enforce the
+ * threshold, then replay the prefix through CompressionStream without buffering the remainder. */
+function compressRawResponse(response, req, threshold, isCompressible) {
+    const body = response.body;
+    if (body === null)
+        return response;
+    if (response.status === 204 || response.status === 205 || response.status === 304) {
+        return response;
+    }
+    if (!acceptsGzip(req.headers.get("accept-encoding")))
+        return response;
+    if (response.headers.has("content-encoding"))
+        return response;
+    if (response.status === 206 || response.headers.has("content-range"))
+        return response;
+    if (hasNoTransform(response.headers.get("cache-control")))
+        return response;
+    if (!isCompressible(response.headers.get("content-type") ?? ""))
+        return response;
+    const declared = response.headers.get("content-length");
+    if (declared !== null && Number(declared) < threshold)
+        return response;
+    return compressRawBody(response, body, threshold);
+}
+async function compressRawBody(response, body, threshold) {
+    const reader = body.getReader();
+    const buffered = [];
+    let total = 0;
+    try {
         while (total < threshold) {
             const { done, value } = await reader.read();
             if (done) {
-                // Body ended below the threshold - too small to be worth gzipping. Emit as-is.
                 return new Response(concat(buffered, total), {
-                    status: res.status,
-                    statusText: res.statusText,
-                    headers: res.headers,
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: response.headers,
                 });
             }
+            if (value === undefined)
+                return replayRawResponse(response, buffered, reader);
             buffered.push(value);
             total += value.byteLength;
         }
-        // Over the threshold: replay the buffered prefix, then stream the rest - all through gzip.
-        // (No explicit generic: it lets the chunk type infer from the non-shared reader so the stream
-        // matches `CompressionStream`'s `Uint8Array` typing.)
-        const source = new ReadableStream({
-            start(controller) {
-                for (const chunk of buffered)
-                    controller.enqueue(chunk);
-            },
-            async pull(controller) {
+    }
+    catch {
+        return replayRawResponse(response, buffered, reader);
+    }
+    const source = new ReadableStream({
+        start(controller) {
+            for (const chunk of buffered)
+                controller.enqueue(chunk);
+        },
+        async pull(controller) {
+            try {
                 const { done, value } = await reader.read();
-                if (done)
+                if (done || value === undefined)
                     controller.close();
                 else
                     controller.enqueue(value);
-            },
-            cancel: (reason) => reader.cancel(reason),
-        });
-        return new Response(source.pipeThrough(new CompressionStream("gzip")), {
-            status: res.status,
-            statusText: res.statusText,
-            headers: gzipHeaders(res.headers),
-        });
+            }
+            catch (error) {
+                controller.error(error);
+            }
+        },
+        cancel: (reason) => reader.cancel(reason),
+    });
+    return new Response(source.pipeThrough(new CompressionStream("gzip")), {
+        status: response.status,
+        statusText: response.statusText,
+        headers: gzipHeaders(response.headers),
+    });
+}
+function replayRawResponse(response, chunks, reader) {
+    const stream = new ReadableStream({
+        start(controller) {
+            for (const chunk of chunks)
+                controller.enqueue(chunk);
+        },
+        async pull(controller) {
+            try {
+                const { done, value } = await reader.read();
+                if (done || value === undefined)
+                    controller.close();
+                else
+                    controller.enqueue(value);
+            }
+            catch (error) {
+                controller.error(error);
+            }
+        },
+        cancel: (reason) => reader.cancel(reason),
+    });
+    return new Response(stream, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers,
+    });
+}
+/**
+ * Transparently **gzip** responses when the client sends `Accept-Encoding: gzip` and the body is a
+ * compressible type larger than `threshold`. Uses the Web-standard `CompressionStream`, so it runs
+ * on every nifra runtime including the edge; gzip is the one encoding `CompressionStream`
+ * guarantees everywhere, so brotli isn't offered.
+ *
+ * Built on the portable `onResponseBody` tier for framework-serialized bytes, with a stream-safe raw
+ * fallback for handler-returned/proxied Responses. The common JSON path stays on Node's direct
+ * writer; raw streams are compressed incrementally without being fully buffered.
+ *
+ * Skips: clients that don't accept gzip, already-encoded responses, bodyless responses,
+ * `Range` responses (206 / `Content-Range`), `Cache-Control: no-transform`, non-compressible
+ * types, and bodies below `threshold` (gzip's ~20-byte overhead would enlarge them). Adds
+ * `Vary: Accept-Encoding`.
+ *
+ * ```ts
+ * app.use(compression())
+ * ```
+ */
+export function compression(options = {}) {
+    const threshold = options.threshold ?? 1024;
+    if (!Number.isSafeInteger(threshold) || threshold < 0) {
+        throw new Error("compression: threshold must be a non-negative safe integer");
+    }
+    const isCompressible = options.compressible ?? defaultCompressible;
+    return definePlugin("compression", (app) => app.use({
+        onResponseBody(body, headers, req, status) {
+            if (!acceptsGzip(req.header("accept-encoding")))
+                return undefined;
+            if (headers.has("content-encoding"))
+                return undefined;
+            if (status === 206 || headers.has("content-range"))
+                return undefined;
+            if (hasNoTransform(headers.get("cache-control")))
+                return undefined;
+            if (!isCompressible(headers.get("content-type") ?? ""))
+                return undefined;
+            const bytes = typeof body === "string" ? GZIP_ENCODER.encode(body) : body;
+            if (bytes.byteLength < threshold)
+                return undefined;
+            return gzipBytes(bytes).then((compressed) => {
+                headers.set("content-encoding", "gzip");
+                headers.delete("content-length");
+                addGzipVary(headers);
+                return compressed;
+            });
+        },
+        onResponseRaw: (response, req) => compressRawResponse(response, req, threshold, isCompressible),
     }));
 }
 //# sourceMappingURL=compression.js.map

package/dist/compression.js.map

@@ -1 +1 @@
-{"version":3,"file":"compression.js","sourceRoot":"","sources":["../src/compression.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAWnD,oGAAoG;AACpG,MAAM,YAAY,GAChB,4GAA4G,CAAA;AAE9G,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AAE5F,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAE,KAAa,EAAc,EAAE;IAC1E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,MAAe,EAAW,EAAE;IAC/C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACnC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;IACvC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA,CAAC,kDAAkD;IACnF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;SACpD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QACjE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAA;IACjD,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,WAAW,CAAC,UAA8B,EAAE;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAA;IAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAA;IAClE,OAAO,YAAY,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CACzC,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;QACrB,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,GAAG,CAAA,CAAC,qCAAqC;QACnE,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,CAAA;QAC1F,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAAE,OAAO,GAAG,CAAA,CAAC,kBAAkB;QACtE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;YAAE,OAAO,GAAG,CAAA,CAAC,sBAAsB;QAC7F,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,OAAO,GAAG,CAAA;QACjF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,CAAA;QACtE,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QAClD,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;YAAE,OAAO,GAAG,CAAA,CAAC,iCAAiC;QAEnG,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAA;QAC/B,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,OAAO,KAAK,GAAG,SAAS,EAAE,CAAC;YACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,+EAA+E;gBAC/E,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAC3C,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC,CAAA;YACJ,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;QAC3B,CAAC;QACD,2FAA2F;QAC3F,8FAA8F;QAC9F,sDAAsD;QACtD,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;YAChC,KAAK,CAAC,UAAU;gBACd,KAAK,MAAM,KAAK,IAAI,QAAQ;oBAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACzD,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,UAAU;gBACnB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAC3C,IAAI,IAAI;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAA;;oBACvB,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAChC,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;SAC1C,CAAC,CAAA;QACF,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,EAAE;YACrE,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC;SAClC,CAAC,CAAA;IACJ,CAAC,CAAC,CACH,CAAA;AACH,CAAC"}
+{"version":3,"file":"compression.js","sourceRoot":"","sources":["../src/compression.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA4B,MAAM,sBAAsB,CAAA;AAW7E,oGAAoG;AACpG,MAAM,YAAY,GAChB,4GAA4G,CAAA;AAE9G,MAAM,mBAAmB,GAAG,CAAC,WAAmB,EAAW,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AAE5F,0FAA0F;AAC1F,SAAS,WAAW,CAAC,KAAoB;IACvC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAChC,IAAI,QAA4B,CAAA;IAChC,IAAI,IAAwB,CAAA;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC7C,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,GAAG;YAAE,SAAQ;QACjD,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;YAClD,IAAI,IAAI,EAAE,WAAW,EAAE,KAAK,GAAG,EAAE,CAAC;gBAChC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;gBAC1B,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;YAC9E,CAAC;QACH,CAAC;QACD,IAAI,MAAM,KAAK,MAAM;YAAE,IAAI,GAAG,OAAO,CAAA;;YAChC,QAAQ,GAAG,OAAO,CAAA;IACzB,CAAC;IACD,OAAO,CAAC,IAAI,IAAI,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;AACpC,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAA;AAEtC,MAAM,MAAM,GAAG,CAAC,MAA6B,EAAE,KAAa,EAAc,EAAE;IAC1E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACjC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACtB,MAAM,IAAI,KAAK,CAAC,UAAU,CAAA;IAC5B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,MAAe,EAAW,EAAE;IAC/C,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACnC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;IACvC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAChC,WAAW,CAAC,OAAO,CAAC,CAAA;IACpB,OAAO,OAAO,CAAA;AAChB,CAAC,CAAA;AAED,SAAS,WAAW,CAAC,OAA4B;IAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAA;IACxC,CAAC;SAAM,IACL,CAAC,IAAI;SACF,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,iBAAiB,CAAC,EACpD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,mBAAmB,CAAC,CAAA;IACjD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB;IAC1C,OAAO,CACL,KAAK;QACH,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,IAAI,CACH,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,cAAc,CAC1F,IAAI,KAAK,CACb,CAAA;AACH,CAAC;AAOD,kGAAkG;AAClG,KAAK,UAAU,SAAS,CAAC,KAAiB;IACxC,+FAA+F;IAC/F,mEAAmE;IACnE,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;QAChC,KAAK,CAAC,UAAU;YACd,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACzB,UAAU,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;KACF,CAAC,CAAA;IACF,MAAM,UAAU,GAAG,MAAM,IAAI,QAAQ,CACnC,MAAM,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAClD,CAAC,WAAW,EAAE,CAAA;IACf,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,CAAA;AACnC,CAAC;AAED;kGACkG;AAClG,SAAS,mBAAmB,CAC1B,QAAkB,EAClB,GAAY,EACZ,SAAiB,EACjB,cAAgD;IAEhD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAA;IAC1B,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAA;IAClC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAClF,OAAO,QAAQ,CAAA;IACjB,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAA;IACrE,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC7D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,QAAQ,CAAA;IACrF,IAAI,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAA;IAC1E,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,QAAQ,CAAA;IAChF,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;IACvD,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,SAAS;QAAE,OAAO,QAAQ,CAAA;IAEtE,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;AACnD,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAAkB,EAClB,IAAgC,EAChC,SAAiB;IAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAA0B,CAAA;IACvD,MAAM,QAAQ,GAAiB,EAAE,CAAA;IACjC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC;QACH,OAAO,KAAK,GAAG,SAAS,EAAE,CAAC;YACzB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;YAC3C,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAC3C,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;oBAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;iBAC1B,CAAC,CAAA;YACJ,CAAC;YACD,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;YAC7E,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAA;QAC3B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC;QAChC,KAAK,CAAC,UAAU;YACd,KAAK,MAAM,KAAK,IAAI,QAAQ;gBAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACzD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAC3C,IAAI,IAAI,IAAI,KAAK,KAAK,SAAS;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAA;;oBAC9C,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC1C,CAAC,CAAA;IACF,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,EAAE;QACrE,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;KACvC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAkB,EAClB,MAA6B,EAC7B,MAAiB;IAEjB,MAAM,MAAM,GAAG,IAAI,cAAc,CAAa;QAC5C,KAAK,CAAC,UAAU;YACd,KAAK,MAAM,KAAK,IAAI,MAAM;gBAAE,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACvD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,UAAU;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;gBAC3C,IAAI,IAAI,IAAI,KAAK,KAAK,SAAS;oBAAE,UAAU,CAAC,KAAK,EAAE,CAAA;;oBAC9C,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;KAC1C,CAAC,CAAA;IACF,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;QAC1B,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO,EAAE,QAAQ,CAAC,OAAO;KAC1B,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,WAAW,CAAC,UAA8B,EAAE;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,YAAY,IAAI,mBAAmB,CAAA;IAClE,OAAO,YAAY,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,EAAE,CACzC,GAAG,CAAC,GAAG,CAAC;QACN,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM;YACvC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YACjE,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;gBAAE,OAAO,SAAS,CAAA;YACrD,IAAI,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;gBAAE,OAAO,SAAS,CAAA;YACpE,IAAI,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YAClE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;gBAAE,OAAO,SAAS,CAAA;YACxE,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACzE,IAAI,KAAK,CAAC,UAAU,GAAG,SAAS;gBAAE,OAAO,SAAS,CAAA;YAClD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;gBAC1C,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAA;gBACvC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;gBAChC,WAAW,CAAC,OAAO,CAAC,CAAA;gBACpB,OAAO,UAAU,CAAA;YACnB,CAAC,CAAC,CAAA;QACJ,CAAC;QACD,aAAa,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,CAC/B,mBAAmB,CAAC,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,cAAc,CAAC;KAChE,CAAC,CACH,CAAA;AACH,CAAC"}

package/dist/cors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAGtD,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAA;IAChF,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC,iGAAiG;IACjG,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,+CAA+C;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAwBD;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,UAAU,CAyC1D"}
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEtD,MAAM,WAAW,WAAW;IAC1B,wFAAwF;IACxF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,CAAA;IAChF,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IACxC,iGAAiG;IACjG,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,+CAA+C;IAC/C,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;IAC/C,2GAA2G;IAC3G,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;IAC9B,4CAA4C;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAwBD;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,UAAU,CAmD1D"}

package/dist/cors.js

@@ -1,4 +1,3 @@
-import { withHeaders } from "./_utils.js";
 const DEFAULT_METHODS = [
     "GET",
     "HEAD",
@@ -51,24 +50,36 @@ export function cors(options = {}) {
                 headers.set("Access-Control-Allow-Headers", requested);
             if (maxAge !== undefined)
                 headers.set("Access-Control-Max-Age", String(maxAge));
-            // Allow-Origin / Allow-Credentials are added by onResponse (runs on every response).
+            // Allow-Origin / Allow-Credentials are added by onResponseHeaders (runs on every response).
             return new Response(null, { status: 204, headers });
         },
-        onResponse(res, req) {
-            const allowOrigin = resolveAllowOrigin(origin, req.headers.get("origin"));
+        onNodeRequest(req) {
+            const isPreflight = req.method === "OPTIONS" && req.header("access-control-request-method") !== null;
+            if (!isPreflight)
+                return undefined;
+            const headers = {
+                "Access-Control-Allow-Methods": methods,
+            };
+            const requested = allowedHeaders ?? req.header("access-control-request-headers");
+            if (requested)
+                headers["Access-Control-Allow-Headers"] = requested;
+            if (maxAge !== undefined)
+                headers["Access-Control-Max-Age"] = String(maxAge);
+            return new Response(null, { status: 204, headers });
+        },
+        onResponseHeaders(headers, req) {
+            const allowOrigin = resolveAllowOrigin(origin, req.header("origin"));
             if (allowOrigin === null)
-                return res;
-            // Mutate in place on the common (mutable-headers) response; clone only for an immutable one.
-            return withHeaders(res, (headers) => {
-                headers.set("Access-Control-Allow-Origin", allowOrigin);
-                if (allowOrigin !== "*")
-                    headers.append("Vary", "Origin");
-                if (credentials)
-                    headers.set("Access-Control-Allow-Credentials", "true");
-                if (exposedHeaders !== undefined) {
-                    headers.set("Access-Control-Expose-Headers", exposedHeaders);
-                }
-            });
+                return;
+            headers.set("access-control-allow-origin", allowOrigin);
+            if (allowOrigin !== "*") {
+                const vary = headers.get("vary");
+                headers.set("vary", vary === null || vary === "" ? "Origin" : `${vary}, Origin`);
+            }
+            if (credentials)
+                headers.set("access-control-allow-credentials", "true");
+            if (exposedHeaders !== undefined)
+                headers.set("access-control-expose-headers", exposedHeaders);
         },
     };
 }

package/dist/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAiBzC,MAAM,eAAe,GAA0B;IAC7C,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,SAAS;CACV,CAAA;AAED,2FAA2F;AAC3F,SAAS,kBAAkB,CACzB,MAA0C,EAC1C,aAA4B;IAE5B,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,GAAG,CAAA;IAC9B,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IACvF,OAAO,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,UAAuB,EAAE;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAA;IACpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAA;IAChD,IAAI,WAAW,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACzD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAE7B,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,CAAC,GAAG;YACX,MAAM,WAAW,GACf,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAA;YAC9E,IAAI,CAAC,WAAW;gBAAE,OAAO,SAAS,CAAA;YAClC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;YAC7B,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAA;YACpD,MAAM,SAAS,GAAG,cAAc,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;YACrF,IAAI,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,SAAS,CAAC,CAAA;YACrE,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YAC/E,qFAAqF;YACrF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QACrD,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,GAAG;YACjB,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAA;YACzE,IAAI,WAAW,KAAK,IAAI;gBAAE,OAAO,GAAG,CAAA;YACpC,6FAA6F;YAC7F,OAAO,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE;gBAClC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAA;gBACvD,IAAI,WAAW,KAAK,GAAG;oBAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;gBACzD,IAAI,WAAW;oBAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;gBACxE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,cAAc,CAAC,CAAA;gBAC9D,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../src/cors.ts"],"names":[],"mappings":"AAiBA,MAAM,eAAe,GAA0B;IAC7C,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,SAAS;CACV,CAAA;AAED,2FAA2F;AAC3F,SAAS,kBAAkB,CACzB,MAA0C,EAC1C,aAA4B;IAE5B,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,GAAG,CAAA;IAC9B,IAAI,aAAa,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACvC,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IACrF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;IACvF,OAAO,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAA;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,UAAuB,EAAE;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAA;IACpC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAA;IAChD,IAAI,WAAW,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAA;IACH,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACzD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;IAE7B,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,SAAS,CAAC,GAAG;YACX,MAAM,WAAW,GACf,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAA;YAC9E,IAAI,CAAC,WAAW;gBAAE,OAAO,SAAS,CAAA;YAClC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAA;YAC7B,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAA;YACpD,MAAM,SAAS,GAAG,cAAc,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAA;YACrF,IAAI,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,SAAS,CAAC,CAAA;YACrE,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;YAC/E,4FAA4F;YAC5F,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QACrD,CAAC;QACD,aAAa,CAAC,GAAG;YACf,MAAM,WAAW,GACf,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,+BAA+B,CAAC,KAAK,IAAI,CAAA;YAClF,IAAI,CAAC,WAAW;gBAAE,OAAO,SAAS,CAAA;YAClC,MAAM,OAAO,GAA2B;gBACtC,8BAA8B,EAAE,OAAO;aACxC,CAAA;YACD,MAAM,SAAS,GAAG,cAAc,IAAI,GAAG,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAAA;YAChF,IAAI,SAAS;gBAAE,OAAO,CAAC,8BAA8B,CAAC,GAAG,SAAS,CAAA;YAClE,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;YAC5E,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;QACrD,CAAC;QACD,iBAAiB,CAAC,OAAO,EAAE,GAAG;YAC5B,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;YACpE,IAAI,WAAW,KAAK,IAAI;gBAAE,OAAM;YAChC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAA;YACvD,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;gBAChC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,CAAA;YAClF,CAAC;YACD,IAAI,WAAW;gBAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAA;YACxE,IAAI,cAAc,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,cAAc,CAAC,CAAA;QAChG,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/etag.d.ts

@@ -7,8 +7,10 @@ export interface ETagOptions {
 /**
  * A {@link definePlugin} plugin that adds a content-hash `ETag` to `GET` `200` responses and returns
  * **`304 Not Modified`** when the client's `If-None-Match` matches - saving bandwidth on unchanged
- * responses. It reads and rebuilds small bodies only; larger responses pass through unchanged.
- * Idempotent.
+ * responses. Built on the portable `onResponseBody` tier: the hook receives the final
+ * framework-serialized bytes on every runtime with nothing drained, so the middleware stays on
+ * Node's direct writer. Handler-returned raw `Response`s (streams, proxied fetches) use a capped,
+ * replaying fallback so oversized bodies remain intact. Idempotent.
  */
 export declare function etag(options?: ETagOptions): import("@nifrajs/core/server").NifraPlugin<import("@nifrajs/core/server").AnyServer, import("@nifrajs/core/server").AnyServer>;
 //# sourceMappingURL=etag.d.ts.map

package/dist/etag.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"etag.d.ts","sourceRoot":"","sources":["../src/etag.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,WAAW;IAC1B,0GAA0G;IAC1G,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;;;;GAKG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,kIA0B7C"}
+{"version":3,"file":"etag.d.ts","sourceRoot":"","sources":["../src/etag.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,WAAW;IAC1B,0GAA0G;IAC1G,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,oGAAoG;IACpG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AA4ED;;;;;;;GAOG;AACH,wBAAgB,IAAI,CAAC,OAAO,GAAE,WAAgB,kIAwC7C"}

package/dist/etag.js

@@ -8,40 +8,150 @@ function fnv1a(bytes) {
     }
     return (h >>> 0).toString(16);
 }
+const ETAG_ENCODER = new TextEncoder();
+async function sha256Tag(bytes) {
+    const input = new Uint8Array(bytes.byteLength);
+    input.set(bytes);
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", input));
+    let hex = "";
+    for (const byte of digest)
+        hex += byte.toString(16).padStart(2, "0");
+    return hex;
+}
+const concat = (chunks, total) => {
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        out.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return out;
+};
+/** Read a raw response without losing a streamed body when the cap is exceeded or the upstream
+ * fails. The already-read prefix is replayed through the same reader instead of cancelling a clone,
+ * which can stall the original body on some runtimes. */
+async function readBytesCapped(res, maxBytes) {
+    const body = res.body;
+    if (body === null)
+        return { bytes: new Uint8Array() };
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                return { bytes: concat(chunks, total) };
+            if (value === undefined)
+                return { response: replayFrom(res, chunks, reader) };
+            chunks.push(value);
+            total += value.byteLength;
+            if (total > maxBytes)
+                return { response: replayFrom(res, chunks, reader) };
+        }
+    }
+    catch {
+        return { response: replayFrom(res, chunks, reader) };
+    }
+}
+function replayFrom(res, chunks, reader) {
+    const stream = new ReadableStream({
+        start(controller) {
+            for (const chunk of chunks)
+                controller.enqueue(chunk);
+        },
+        async pull(controller) {
+            try {
+                const { done, value } = await reader.read();
+                if (done || value === undefined)
+                    controller.close();
+                else
+                    controller.enqueue(value);
+            }
+            catch (error) {
+                controller.error(error);
+            }
+        },
+        cancel: (reason) => reader.cancel(reason),
+    });
+    return new Response(stream, {
+        status: res.status,
+        statusText: res.statusText,
+        headers: res.headers,
+    });
+}
 /**
  * A {@link definePlugin} plugin that adds a content-hash `ETag` to `GET` `200` responses and returns
  * **`304 Not Modified`** when the client's `If-None-Match` matches - saving bandwidth on unchanged
- * responses. It reads and rebuilds small bodies only; larger responses pass through unchanged.
- * Idempotent.
+ * responses. Built on the portable `onResponseBody` tier: the hook receives the final
+ * framework-serialized bytes on every runtime with nothing drained, so the middleware stays on
+ * Node's direct writer. Handler-returned raw `Response`s (streams, proxied fetches) use a capped,
+ * replaying fallback so oversized bodies remain intact. Idempotent.
  */
 export function etag(options = {}) {
-    const prefix = (options.weak ?? true) ? "W/" : "";
+    const weak = options.weak ?? true;
+    const prefix = weak ? "W/" : "";
     const maxBytes = options.maxBytes ?? 1_000_000;
-    if (!Number.isInteger(maxBytes) || maxBytes < 0) {
-        throw new Error("etag: maxBytes must be a non-negative integer");
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
+        throw new Error("etag: maxBytes must be a non-negative safe integer");
     }
-    return definePlugin("etag", (app) => app.onResponse(async (res, req) => {
-        if (req.method !== "GET" || res.status !== 200 || res.body === null)
-            return res;
-        const declared = parseLength(res.headers.get("content-length"));
-        if (declared !== undefined && declared > maxBytes)
-            return res;
-        const body = await readBytesCapped(res, maxBytes);
-        if (body === null)
-            return res;
-        const tag = `${prefix}"${fnv1a(body)}"`;
-        const headers = new Headers(res.headers);
-        headers.set("ETag", tag);
-        if (matchesIfNoneMatch(req.headers.get("if-none-match"), tag)) {
-            // A 304 carries no body - drop the body-describing headers so strict intermediaries don't see a
-            // null body with a non-zero Content-Length.
-            headers.delete("content-length");
-            headers.delete("content-type");
-            return new Response(null, { status: 304, headers });
-        }
-        return new Response(body, { status: res.status, statusText: res.statusText, headers });
+    return definePlugin("etag", (app) => app.use({
+        onResponseBody(body, headers, req, status) {
+            if (req.method !== "GET" || status !== 200)
+                return undefined;
+            const bytes = typeof body === "string" ? ETAG_ENCODER.encode(body) : body;
+            if (bytes.byteLength > maxBytes)
+                return undefined;
+            const finish = (fingerprint) => {
+                const tag = prefix + String.fromCharCode(34) + fingerprint + String.fromCharCode(34);
+                headers.set("etag", tag);
+                if (matchesIfNoneMatch(req.header("if-none-match"), tag)) {
+                    // A 304 carries no body - drop the body-describing headers so strict intermediaries
+                    // do not see a null body with a non-zero Content-Length.
+                    headers.delete("content-length");
+                    headers.delete("content-type");
+                    return { body: null, status: 304 };
+                }
+                return undefined;
+            };
+            if (weak)
+                return finish(fnv1a(bytes));
+            return sha256Tag(bytes).then(finish);
+        },
+        onResponseRaw(response, req) {
+            if (req.method !== "GET" || response.status !== 200 || response.body === null) {
+                return response;
+            }
+            const declared = response.headers.get("content-length");
+            if (declared !== null && /^(?:0|[1-9]\d*)$/.test(declared) && Number(declared) > maxBytes) {
+                return response;
+            }
+            return etagRawResponse(response, req, weak, prefix, maxBytes);
+        },
     }));
 }
+async function etagRawResponse(response, req, weak, prefix, maxBytes) {
+    const read = await readBytesCapped(response, maxBytes);
+    if ("response" in read)
+        return read.response;
+    const fingerprint = weak ? fnv1a(read.bytes) : await sha256Tag(read.bytes);
+    const tag = prefix + String.fromCharCode(34) + fingerprint + String.fromCharCode(34);
+    const headers = new Headers(response.headers);
+    headers.set("etag", tag);
+    if (matchesIfNoneMatch(req.headers.get("if-none-match"), tag)) {
+        headers.delete("content-length");
+        headers.delete("content-type");
+        return new Response(null, { status: 304, headers });
+    }
+    // The body was consumed and rebuilt from bytes. Re-derive framing at the serving adapter
+    // instead of trusting a stale upstream declaration.
+    headers.delete("content-length");
+    return new Response(read.bytes, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
 function matchesIfNoneMatch(value, tag) {
     if (value === null)
         return false;
@@ -58,42 +168,4 @@ function matchesIfNoneMatch(value, tag) {
 function weakComparableTag(tag) {
     return tag.startsWith("W/") ? tag.slice(2) : tag;
 }
-function parseLength(value) {
-    if (value === null)
-        return undefined;
-    if (!/^(?:0|[1-9]\d*)$/.test(value))
-        return undefined;
-    return Number(value);
-}
-async function readBytesCapped(res, maxBytes) {
-    const body = res.clone().body;
-    if (body === null)
-        return new Uint8Array();
-    const reader = body.getReader();
-    const chunks = [];
-    let total = 0;
-    try {
-        for (;;) {
-            const { done, value } = await reader.read();
-            if (done) {
-                const out = new Uint8Array(total);
-                let offset = 0;
-                for (const chunk of chunks) {
-                    out.set(chunk, offset);
-                    offset += chunk.byteLength;
-                }
-                return out;
-            }
-            total += value.byteLength;
-            if (total > maxBytes) {
-                await reader.cancel();
-                return null;
-            }
-            chunks.push(value);
-        }
-    }
-    catch {
-        return null;
-    }
-}
 //# sourceMappingURL=etag.js.map