@nifrajs/middleware 2.8.2 → 2.9.1

package/src/compression.ts

@@ -1,4 +1,4 @@
-import { definePlugin } from "@nifrajs/core/server"
+import { definePlugin, type ResponseHeadersView } from "@nifrajs/core/server"
 
 export interface CompressionOptions {
   /** Don't compress bodies smaller than this many bytes. Default `1024`. Enforced by peeking the body
@@ -15,6 +15,31 @@ const COMPRESSIBLE =
 
 const defaultCompressible = (contentType: string): boolean => COMPRESSIBLE.test(contentType)
 
+/** Honor explicit q=0 exclusions; a client that says `gzip;q=0` must not receive gzip. */
+function acceptsGzip(value: string | null): boolean {
+  if (value === null) return false
+  let wildcard: number | undefined
+  let gzip: number | undefined
+  for (const item of value.split(",")) {
+    const parts = item.trim().split(";")
+    const coding = parts[0]?.trim().toLowerCase()
+    if (coding !== "gzip" && coding !== "*") continue
+    let quality = 1
+    for (let i = 1; i < parts.length; i++) {
+      const [name, raw] = parts[i]!.trim().split("=", 2)
+      if (name?.toLowerCase() === "q") {
+        const parsed = Number(raw)
+        quality = Number.isFinite(parsed) && parsed >= 0 && parsed <= 1 ? parsed : 0
+      }
+    }
+    if (coding === "gzip") gzip = quality
+    else wildcard = quality
+  }
+  return (gzip ?? wildcard ?? 0) > 0
+}
+
+const GZIP_ENCODER = new TextEncoder()
+
 const concat = (chunks: readonly Uint8Array[], total: number): Uint8Array => {
   const out = new Uint8Array(total)
   let offset = 0
@@ -28,28 +53,169 @@ const concat = (chunks: readonly Uint8Array[], total: number): Uint8Array => {
 const gzipHeaders = (source: Headers): Headers => {
   const headers = new Headers(source)
   headers.set("content-encoding", "gzip")
-  headers.delete("content-length") // compressed length is unknown up front → chunked
+  headers.delete("content-length")
+  addGzipVary(headers)
+  return headers
+}
+
+function addGzipVary(headers: ResponseHeadersView): void {
   const vary = headers.get("vary")
-  if (vary === null) headers.set("vary", "Accept-Encoding")
-  else if (!vary.toLowerCase().split(",").includes("accept-encoding"))
+  if (vary === null) {
+    headers.set("vary", "Accept-Encoding")
+  } else if (
+    !vary
+      .toLowerCase()
+      .split(",")
+      .some((part) => part.trim() === "accept-encoding")
+  ) {
     headers.set("vary", `${vary}, Accept-Encoding`)
-  return headers
+  }
+}
+
+function hasNoTransform(value: string | null): boolean {
+  return (
+    value
+      ?.split(",")
+      .some(
+        (directive) => directive.trim().split(";", 1)[0]?.trim().toLowerCase() === "no-transform",
+      ) ?? false
+  )
+}
+
+interface RawReader {
+  read(): Promise<{ readonly done: boolean; readonly value?: Uint8Array }>
+  cancel(reason?: unknown): Promise<void>
+}
+
+/** Gzip a resident buffer through the Web-standard `CompressionStream` (available everywhere). */
+async function gzipBytes(bytes: Uint8Array): Promise<Uint8Array> {
+  // No explicit generic: the chunk type infers from `enqueue`, which keeps the stream assignable
+  // to `CompressionStream`'s typing across the Bun/DOM lib variants.
+  const source = new ReadableStream({
+    start(controller) {
+      controller.enqueue(bytes)
+      controller.close()
+    },
+  })
+  const compressed = await new Response(
+    source.pipeThrough(new CompressionStream("gzip")),
+  ).arrayBuffer()
+  return new Uint8Array(compressed)
+}
+
+/** Stream-safe fallback for handler-returned/proxied Responses. Peek only enough to enforce the
+ * threshold, then replay the prefix through CompressionStream without buffering the remainder. */
+function compressRawResponse(
+  response: Response,
+  req: Request,
+  threshold: number,
+  isCompressible: (contentType: string) => boolean,
+): Response | Promise<Response> {
+  const body = response.body
+  if (body === null) return response
+  if (response.status === 204 || response.status === 205 || response.status === 304) {
+    return response
+  }
+  if (!acceptsGzip(req.headers.get("accept-encoding"))) return response
+  if (response.headers.has("content-encoding")) return response
+  if (response.status === 206 || response.headers.has("content-range")) return response
+  if (hasNoTransform(response.headers.get("cache-control"))) return response
+  if (!isCompressible(response.headers.get("content-type") ?? "")) return response
+  const declared = response.headers.get("content-length")
+  if (declared !== null && Number(declared) < threshold) return response
+
+  return compressRawBody(response, body, threshold)
+}
+
+async function compressRawBody(
+  response: Response,
+  body: ReadableStream<Uint8Array>,
+  threshold: number,
+): Promise<Response> {
+  const reader = body.getReader() as unknown as RawReader
+  const buffered: Uint8Array[] = []
+  let total = 0
+  try {
+    while (total < threshold) {
+      const { done, value } = await reader.read()
+      if (done) {
+        return new Response(concat(buffered, total), {
+          status: response.status,
+          statusText: response.statusText,
+          headers: response.headers,
+        })
+      }
+      if (value === undefined) return replayRawResponse(response, buffered, reader)
+      buffered.push(value)
+      total += value.byteLength
+    }
+  } catch {
+    return replayRawResponse(response, buffered, reader)
+  }
+
+  const source = new ReadableStream({
+    start(controller) {
+      for (const chunk of buffered) controller.enqueue(chunk)
+    },
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read()
+        if (done || value === undefined) controller.close()
+        else controller.enqueue(value)
+      } catch (error) {
+        controller.error(error)
+      }
+    },
+    cancel: (reason) => reader.cancel(reason),
+  })
+  return new Response(source.pipeThrough(new CompressionStream("gzip")), {
+    status: response.status,
+    statusText: response.statusText,
+    headers: gzipHeaders(response.headers),
+  })
+}
+
+function replayRawResponse(
+  response: Response,
+  chunks: readonly Uint8Array[],
+  reader: RawReader,
+): Response {
+  const stream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      for (const chunk of chunks) controller.enqueue(chunk)
+    },
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read()
+        if (done || value === undefined) controller.close()
+        else controller.enqueue(value)
+      } catch (error) {
+        controller.error(error)
+      }
+    },
+    cancel: (reason) => reader.cancel(reason),
+  })
+  return new Response(stream, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  })
 }
 
 /**
  * Transparently **gzip** responses when the client sends `Accept-Encoding: gzip` and the body is a
- * compressible type larger than `threshold`. Uses the Web-standard `CompressionStream` (streaming, no
- * full-body buffering), so it runs on every nifra runtime including the edge. gzip is the one encoding
- * `CompressionStream` guarantees everywhere; brotli isn't part of the standard, so it's not offered.
+ * compressible type larger than `threshold`. Uses the Web-standard `CompressionStream`, so it runs
+ * on every nifra runtime including the edge; gzip is the one encoding `CompressionStream`
+ * guarantees everywhere, so brotli isn't offered.
  *
- * The body is **peeked** up to `threshold` bytes to enforce the size floor: a response that ends below
- * the threshold is sent uncompressed (gzip's ~20-byte overhead would enlarge it), and only larger
- * bodies are compressed - the buffered prefix is replayed and the remainder streamed. (Runtimes rarely
- * set `Content-Length` on a constructed `Response`, so the header alone can't gate this.)
+ * Built on the portable `onResponseBody` tier for framework-serialized bytes, with a stream-safe raw
+ * fallback for handler-returned/proxied Responses. The common JSON path stays on Node's direct
+ * writer; raw streams are compressed incrementally without being fully buffered.
  *
- * Skips: clients that don't accept gzip, already-encoded responses, bodyless responses (204/304/HEAD),
- * `Range` responses (206 / `Content-Range`), `Cache-Control: no-transform`, and non-compressible types.
- * Adds `Vary: Accept-Encoding`.
+ * Skips: clients that don't accept gzip, already-encoded responses, bodyless responses,
+ * `Range` responses (206 / `Content-Range`), `Cache-Control: no-transform`, non-compressible
+ * types, and bodies below `threshold` (gzip's ~20-byte overhead would enlarge them). Adds
+ * `Vary: Accept-Encoding`.
  *
  * ```ts
  * app.use(compression())
@@ -57,55 +223,29 @@ const gzipHeaders = (source: Headers): Headers => {
  */
 export function compression(options: CompressionOptions = {}) {
   const threshold = options.threshold ?? 1024
+  if (!Number.isSafeInteger(threshold) || threshold < 0) {
+    throw new Error("compression: threshold must be a non-negative safe integer")
+  }
   const isCompressible = options.compressible ?? defaultCompressible
   return definePlugin("compression", (app) =>
-    app.onResponse(async (res, req) => {
-      const body = res.body
-      if (body === null) return res // 204/304/HEAD - nothing to compress
-      if (!(req.headers.get("accept-encoding") ?? "").toLowerCase().includes("gzip")) return res
-      if (res.headers.has("content-encoding")) return res // already encoded
-      if (res.status === 206 || res.headers.has("content-range")) return res // ranges pass through
-      if ((res.headers.get("cache-control") ?? "").includes("no-transform")) return res
-      if (!isCompressible(res.headers.get("content-type") ?? "")) return res
-      const declared = res.headers.get("content-length")
-      if (declared !== null && Number(declared) < threshold) return res // fast path when length is known
-
-      // Peek up to `threshold` bytes to decide whether compressing is worth it.
-      const reader = body.getReader()
-      const buffered: Uint8Array[] = []
-      let total = 0
-      while (total < threshold) {
-        const { done, value } = await reader.read()
-        if (done) {
-          // Body ended below the threshold - too small to be worth gzipping. Emit as-is.
-          return new Response(concat(buffered, total), {
-            status: res.status,
-            statusText: res.statusText,
-            headers: res.headers,
-          })
-        }
-        buffered.push(value)
-        total += value.byteLength
-      }
-      // Over the threshold: replay the buffered prefix, then stream the rest - all through gzip.
-      // (No explicit generic: it lets the chunk type infer from the non-shared reader so the stream
-      // matches `CompressionStream`'s `Uint8Array` typing.)
-      const source = new ReadableStream({
-        start(controller) {
-          for (const chunk of buffered) controller.enqueue(chunk)
-        },
-        async pull(controller) {
-          const { done, value } = await reader.read()
-          if (done) controller.close()
-          else controller.enqueue(value)
-        },
-        cancel: (reason) => reader.cancel(reason),
-      })
-      return new Response(source.pipeThrough(new CompressionStream("gzip")), {
-        status: res.status,
-        statusText: res.statusText,
-        headers: gzipHeaders(res.headers),
-      })
+    app.use({
+      onResponseBody(body, headers, req, status) {
+        if (!acceptsGzip(req.header("accept-encoding"))) return undefined
+        if (headers.has("content-encoding")) return undefined
+        if (status === 206 || headers.has("content-range")) return undefined
+        if (hasNoTransform(headers.get("cache-control"))) return undefined
+        if (!isCompressible(headers.get("content-type") ?? "")) return undefined
+        const bytes = typeof body === "string" ? GZIP_ENCODER.encode(body) : body
+        if (bytes.byteLength < threshold) return undefined
+        return gzipBytes(bytes).then((compressed) => {
+          headers.set("content-encoding", "gzip")
+          headers.delete("content-length")
+          addGzipVary(headers)
+          return compressed
+        })
+      },
+      onResponseRaw: (response, req) =>
+        compressRawResponse(response, req, threshold, isCompressible),
     }),
   )
 }

package/src/cors.ts

@@ -1,5 +1,4 @@
 import type { Middleware } from "@nifrajs/core/server"
-import { withHeaders } from "./_utils.ts"
 
 export interface CorsOptions {
   /** Allowed origin(s): `"*"`, an exact origin, a list, or a predicate. Default `"*"`. */
@@ -70,21 +69,31 @@ export function cors(options: CorsOptions = {}): Middleware {
       const requested = allowedHeaders ?? req.headers.get("access-control-request-headers")
       if (requested) headers.set("Access-Control-Allow-Headers", requested)
       if (maxAge !== undefined) headers.set("Access-Control-Max-Age", String(maxAge))
-      // Allow-Origin / Allow-Credentials are added by onResponse (runs on every response).
+      // Allow-Origin / Allow-Credentials are added by onResponseHeaders (runs on every response).
       return new Response(null, { status: 204, headers })
     },
-    onResponse(res, req) {
-      const allowOrigin = resolveAllowOrigin(origin, req.headers.get("origin"))
-      if (allowOrigin === null) return res
-      // Mutate in place on the common (mutable-headers) response; clone only for an immutable one.
-      return withHeaders(res, (headers) => {
-        headers.set("Access-Control-Allow-Origin", allowOrigin)
-        if (allowOrigin !== "*") headers.append("Vary", "Origin")
-        if (credentials) headers.set("Access-Control-Allow-Credentials", "true")
-        if (exposedHeaders !== undefined) {
-          headers.set("Access-Control-Expose-Headers", exposedHeaders)
-        }
-      })
+    onNodeRequest(req) {
+      const isPreflight =
+        req.method === "OPTIONS" && req.header("access-control-request-method") !== null
+      if (!isPreflight) return undefined
+      const headers: Record<string, string> = {
+        "Access-Control-Allow-Methods": methods,
+      }
+      const requested = allowedHeaders ?? req.header("access-control-request-headers")
+      if (requested) headers["Access-Control-Allow-Headers"] = requested
+      if (maxAge !== undefined) headers["Access-Control-Max-Age"] = String(maxAge)
+      return new Response(null, { status: 204, headers })
+    },
+    onResponseHeaders(headers, req) {
+      const allowOrigin = resolveAllowOrigin(origin, req.header("origin"))
+      if (allowOrigin === null) return
+      headers.set("access-control-allow-origin", allowOrigin)
+      if (allowOrigin !== "*") {
+        const vary = headers.get("vary")
+        headers.set("vary", vary === null || vary === "" ? "Origin" : `${vary}, Origin`)
+      }
+      if (credentials) headers.set("access-control-allow-credentials", "true")
+      if (exposedHeaders !== undefined) headers.set("access-control-expose-headers", exposedHeaders)
     },
   }
 }

package/src/etag.ts

@@ -1,4 +1,4 @@
-import { definePlugin } from "@nifrajs/core/server"
+import { definePlugin, type ResponseBodyReplacement } from "@nifrajs/core/server"
 
 /** 32-bit FNV-1a over bytes → hex. A fast, dependency-free content fingerprint for ETags - not crypto. */
 function fnv1a(bytes: Uint8Array): string {
@@ -17,40 +17,158 @@ export interface ETagOptions {
   readonly maxBytes?: number
 }
 
+const ETAG_ENCODER = new TextEncoder()
+
+async function sha256Tag(bytes: Uint8Array): Promise<string> {
+  const input = new Uint8Array(bytes.byteLength)
+  input.set(bytes)
+  const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", input))
+  let hex = ""
+  for (const byte of digest) hex += byte.toString(16).padStart(2, "0")
+  return hex
+}
+
+const concat = (chunks: readonly Uint8Array[], total: number): Uint8Array => {
+  const out = new Uint8Array(total)
+  let offset = 0
+  for (const chunk of chunks) {
+    out.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return out
+}
+
+type ReadBytes = { readonly bytes: Uint8Array } | { readonly response: Response }
+
+interface ChunkReader {
+  read(): Promise<{ readonly done: boolean; readonly value?: Uint8Array }>
+  cancel(reason?: unknown): Promise<void>
+}
+
+/** Read a raw response without losing a streamed body when the cap is exceeded or the upstream
+ * fails. The already-read prefix is replayed through the same reader instead of cancelling a clone,
+ * which can stall the original body on some runtimes. */
+async function readBytesCapped(res: Response, maxBytes: number): Promise<ReadBytes> {
+  const body = res.body
+  if (body === null) return { bytes: new Uint8Array() }
+  const reader = body.getReader() as unknown as ChunkReader
+  const chunks: Uint8Array[] = []
+  let total = 0
+  try {
+    for (;;) {
+      const { done, value } = await reader.read()
+      if (done) return { bytes: concat(chunks, total) }
+      if (value === undefined) return { response: replayFrom(res, chunks, reader) }
+      chunks.push(value)
+      total += value.byteLength
+      if (total > maxBytes) return { response: replayFrom(res, chunks, reader) }
+    }
+  } catch {
+    return { response: replayFrom(res, chunks, reader) }
+  }
+}
+
+function replayFrom(res: Response, chunks: readonly Uint8Array[], reader: ChunkReader): Response {
+  const stream = new ReadableStream<Uint8Array>({
+    start(controller) {
+      for (const chunk of chunks) controller.enqueue(chunk)
+    },
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read()
+        if (done || value === undefined) controller.close()
+        else controller.enqueue(value)
+      } catch (error) {
+        controller.error(error)
+      }
+    },
+    cancel: (reason) => reader.cancel(reason),
+  })
+  return new Response(stream, {
+    status: res.status,
+    statusText: res.statusText,
+    headers: res.headers,
+  })
+}
+
 /**
  * A {@link definePlugin} plugin that adds a content-hash `ETag` to `GET` `200` responses and returns
  * **`304 Not Modified`** when the client's `If-None-Match` matches - saving bandwidth on unchanged
- * responses. It reads and rebuilds small bodies only; larger responses pass through unchanged.
- * Idempotent.
+ * responses. Built on the portable `onResponseBody` tier: the hook receives the final
+ * framework-serialized bytes on every runtime with nothing drained, so the middleware stays on
+ * Node's direct writer. Handler-returned raw `Response`s (streams, proxied fetches) use a capped,
+ * replaying fallback so oversized bodies remain intact. Idempotent.
  */
 export function etag(options: ETagOptions = {}) {
-  const prefix = (options.weak ?? true) ? "W/" : ""
+  const weak = options.weak ?? true
+  const prefix = weak ? "W/" : ""
   const maxBytes = options.maxBytes ?? 1_000_000
-  if (!Number.isInteger(maxBytes) || maxBytes < 0) {
-    throw new Error("etag: maxBytes must be a non-negative integer")
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) {
+    throw new Error("etag: maxBytes must be a non-negative safe integer")
   }
   return definePlugin("etag", (app) =>
-    app.onResponse(async (res, req) => {
-      if (req.method !== "GET" || res.status !== 200 || res.body === null) return res
-      const declared = parseLength(res.headers.get("content-length"))
-      if (declared !== undefined && declared > maxBytes) return res
-      const body = await readBytesCapped(res, maxBytes)
-      if (body === null) return res
-      const tag = `${prefix}"${fnv1a(body)}"`
-      const headers = new Headers(res.headers)
-      headers.set("ETag", tag)
-      if (matchesIfNoneMatch(req.headers.get("if-none-match"), tag)) {
-        // A 304 carries no body - drop the body-describing headers so strict intermediaries don't see a
-        // null body with a non-zero Content-Length.
-        headers.delete("content-length")
-        headers.delete("content-type")
-        return new Response(null, { status: 304, headers })
-      }
-      return new Response(body, { status: res.status, statusText: res.statusText, headers })
+    app.use({
+      onResponseBody(body, headers, req, status) {
+        if (req.method !== "GET" || status !== 200) return undefined
+        const bytes = typeof body === "string" ? ETAG_ENCODER.encode(body) : body
+        if (bytes.byteLength > maxBytes) return undefined
+        const finish = (fingerprint: string): ResponseBodyReplacement | undefined => {
+          const tag = prefix + String.fromCharCode(34) + fingerprint + String.fromCharCode(34)
+          headers.set("etag", tag)
+          if (matchesIfNoneMatch(req.header("if-none-match"), tag)) {
+            // A 304 carries no body - drop the body-describing headers so strict intermediaries
+            // do not see a null body with a non-zero Content-Length.
+            headers.delete("content-length")
+            headers.delete("content-type")
+            return { body: null, status: 304 }
+          }
+          return undefined
+        }
+        if (weak) return finish(fnv1a(bytes))
+        return sha256Tag(bytes).then(finish)
+      },
+      onResponseRaw(response, req) {
+        if (req.method !== "GET" || response.status !== 200 || response.body === null) {
+          return response
+        }
+        const declared = response.headers.get("content-length")
+        if (declared !== null && /^(?:0|[1-9]\d*)$/.test(declared) && Number(declared) > maxBytes) {
+          return response
+        }
+        return etagRawResponse(response, req, weak, prefix, maxBytes)
+      },
     }),
   )
 }
 
+async function etagRawResponse(
+  response: Response,
+  req: Request,
+  weak: boolean,
+  prefix: string,
+  maxBytes: number,
+): Promise<Response> {
+  const read = await readBytesCapped(response, maxBytes)
+  if ("response" in read) return read.response
+  const fingerprint = weak ? fnv1a(read.bytes) : await sha256Tag(read.bytes)
+  const tag = prefix + String.fromCharCode(34) + fingerprint + String.fromCharCode(34)
+  const headers = new Headers(response.headers)
+  headers.set("etag", tag)
+  if (matchesIfNoneMatch(req.headers.get("if-none-match"), tag)) {
+    headers.delete("content-length")
+    headers.delete("content-type")
+    return new Response(null, { status: 304, headers })
+  }
+  // The body was consumed and rebuilt from bytes. Re-derive framing at the serving adapter
+  // instead of trusting a stale upstream declaration.
+  headers.delete("content-length")
+  return new Response(read.bytes, {
+    status: response.status,
+    statusText: response.statusText,
+    headers,
+  })
+}
+
 function matchesIfNoneMatch(value: string | null, tag: string): boolean {
   if (value === null) return false
   const normalizedTag = weakComparableTag(tag)
@@ -65,39 +183,3 @@ function matchesIfNoneMatch(value: string | null, tag: string): boolean {
 function weakComparableTag(tag: string): string {
   return tag.startsWith("W/") ? tag.slice(2) : tag
 }
-
-function parseLength(value: string | null): number | undefined {
-  if (value === null) return undefined
-  if (!/^(?:0|[1-9]\d*)$/.test(value)) return undefined
-  return Number(value)
-}
-
-async function readBytesCapped(res: Response, maxBytes: number): Promise<Uint8Array | null> {
-  const body = res.clone().body
-  if (body === null) return new Uint8Array()
-  const reader = body.getReader()
-  const chunks: Uint8Array[] = []
-  let total = 0
-  try {
-    for (;;) {
-      const { done, value } = await reader.read()
-      if (done) {
-        const out = new Uint8Array(total)
-        let offset = 0
-        for (const chunk of chunks) {
-          out.set(chunk, offset)
-          offset += chunk.byteLength
-        }
-        return out
-      }
-      total += value.byteLength
-      if (total > maxBytes) {
-        await reader.cancel()
-        return null
-      }
-      chunks.push(value)
-    }
-  } catch {
-    return null
-  }
-}

package/src/language.ts

@@ -86,24 +86,23 @@ export function language<const L extends readonly string[]>(options: LanguageOpt
     throw new Error("language: defaultLanguage must be in supported")
   }
   const emitHeader = options.header !== false
-  const matches = new WeakMap<Request, LanguageMatch>()
-
+  // The match is a pure function of the Accept-Language header, so the response hooks recompute it
+  // instead of pairing state through a WeakMap - that is what lets the Node twin exist at all (it
+  // has no `Request` identity to key on), keeps both hooks trivially identical, and lets the derive
+  // read the header without materializing a Web `Request` on the Node adapter.
   return definePlugin("language", (app) =>
     app
       .derive((c) => {
-        const match = pickLanguage(c.req.headers.get("accept-language"), supported, defaultLanguage)
-        matches.set(c.req, match)
+        const match = pickLanguage(c.header("accept-language"), supported, defaultLanguage)
         return { language: match.language, languageMatch: match }
       })
-      .onResponse((res, req) => {
-        if (!emitHeader) return res
-        const match = matches.get(req)
-        if (match === undefined) return res
-        matches.delete(req)
-        if (res.headers.has("content-language")) return res
-        const headers = new Headers(res.headers)
-        headers.set("content-language", match.language)
-        return new Response(res.body, { status: res.status, statusText: res.statusText, headers })
+      .use({
+        onResponseHeaders(headers, req) {
+          if (!emitHeader) return
+          if (headers.has("content-language")) return
+          const match = pickLanguage(req.header("accept-language"), supported, defaultLanguage)
+          headers.set("content-language", match.language)
+        },
       }),
   )
 }

package/src/logger.ts

@@ -1,4 +1,4 @@
-import { definePlugin } from "@nifrajs/core/server"
+import { definePlugin, pathnameOf } from "@nifrajs/core/server"
 
 /** Structured fields logged per request. */
 export interface RequestLogFields {
@@ -23,13 +23,20 @@ export function logger(options: LoggerOptions = {}) {
   // A request logger's whole job is to log; the default writes JSON to stdout, routable via `log`.
   const sink = options.log ?? ((fields: RequestLogFields) => console.log(JSON.stringify(fields)))
   const starts = new WeakMap<Request, number>()
+  // Twin-side starts, keyed by the NodeRequestContext identity (the same object reaches the request
+  // and response twins), so Node logging never has to materialize a Web `Request`.
+  const nativeStarts = new WeakMap<object, number>()
   return definePlugin("logger", (app) =>
-    app
-      .onRequest((req) => {
+    app.use({
+      onRequest(req) {
         starts.set(req, performance.now())
         return undefined
-      })
-      .onResponse((res, req) => {
+      },
+      onNodeRequest(req) {
+        nativeStarts.set(req, performance.now())
+        return undefined
+      },
+      onResponse(res, req) {
         const start = starts.get(req)
         starts.delete(req)
         sink({
@@ -39,6 +46,17 @@ export function logger(options: LoggerOptions = {}) {
           ms: start === undefined ? 0 : Math.round(performance.now() - start),
         })
         return res
-      }),
+      },
+      onNodeResponse(res, req) {
+        const start = nativeStarts.get(req)
+        nativeStarts.delete(req)
+        sink({
+          method: req.method,
+          path: pathnameOf(req.url),
+          status: res.status,
+          ms: start === undefined ? 0 : Math.round(performance.now() - start),
+        })
+      },
+    }),
   )
 }