@orkestrel/middleware 0.0.5 → 0.0.7

package/dist/src/server/index.cjs

@@ -1,14 +1,14 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
-let node_os = require("node:os");
 let node_path = require("node:path");
-let node_crypto = require("node:crypto");
+let node_util = require("node:util");
+let node_zlib = require("node:zlib");
 let _orkestrel_contract = require("@orkestrel/contract");
+let node_crypto = require("node:crypto");
+let node_os = require("node:os");
 let _orkestrel_server = require("@orkestrel/server");
 let _src_core = require("../core/index.cjs");
-let node_zlib = require("node:zlib");
-let node_util = require("node:util");
 //#region src/server/constants.ts
 /** The HTTP status `createMultipart` renders for each {@link MultipartReason}. */
 var MULTIPART_REASON_STATUS = Object.freeze({
@@ -115,7 +115,7 @@ var MultipartError = class extends Error {
 		super(message);
 		this.status = MULTIPART_REASON_STATUS[reason];
 		this.reason = reason;
-		this.context = context;
+		if (context !== void 0) this.context = context;
 		Object.defineProperty(this, Symbol.for("@orkestrel/middleware.MultipartError"), { value: true });
 	}
 };
@@ -151,6 +151,210 @@ function isMultipartError(value) {
 	return true;
 }
 //#endregion
+//#region src/server/MultipartParser.ts
+var MultipartParser = class MultipartParser {
+	static #defaultDirectory;
+	#reader;
+	#signal;
+	#abort;
+	#boundary;
+	#limits;
+	#allowed;
+	#directory;
+	#staged = [];
+	#files = Object.create(null);
+	#fields = Object.create(null);
+	#buffer = Buffer.alloc(0);
+	#ended = false;
+	#fileCount = 0;
+	#fieldCount = 0;
+	#totalBytes = 0;
+	constructor(stream, signal, boundary, limits, allowed, directory) {
+		this.#reader = stream.getReader();
+		this.#signal = signal;
+		this.#abort = this.#wakeReader.bind(this);
+		this.#boundary = boundary;
+		this.#limits = limits;
+		this.#allowed = allowed;
+		this.#directory = directory;
+	}
+	static directory() {
+		if (MultipartParser.#defaultDirectory === void 0) MultipartParser.#defaultDirectory = MultipartParser.#createDirectory();
+		return MultipartParser.#defaultDirectory;
+	}
+	async parse() {
+		this.#signal.addEventListener("abort", this.#abort, { once: true });
+		try {
+			const openMarker = Buffer.from(`--${this.#boundary}`);
+			let preambleScanned = 0;
+			let index = this.#buffer.indexOf(openMarker);
+			while (index === -1) {
+				const carry = openMarker.length - 1;
+				if (this.#buffer.length > carry) {
+					const drop = this.#buffer.length - carry;
+					preambleScanned += drop;
+					if (preambleScanned > 65536) throw new MultipartError("malformed", "multipart preamble too large");
+					this.#buffer = this.#buffer.subarray(drop);
+				}
+				if (!await this.#pull()) throw new MultipartError("malformed", "missing multipart boundary");
+				index = this.#buffer.indexOf(openMarker);
+			}
+			if (preambleScanned + index > 65536) throw new MultipartError("malformed", "multipart preamble too large");
+			this.#buffer = this.#buffer.subarray(index + openMarker.length);
+			for (;;) {
+				while (this.#buffer.length < 2) if (!await this.#pull()) throw new MultipartError("malformed", "unterminated multipart boundary");
+				if (this.#buffer[0] === 45 && this.#buffer[1] === 45) break;
+				if (this.#buffer[0] !== 13 || this.#buffer[1] !== 10) throw new MultipartError("malformed", "malformed multipart boundary");
+				this.#buffer = this.#buffer.subarray(2);
+				let headerEnd = this.#buffer.indexOf("\r\n\r\n");
+				while (headerEnd === -1) {
+					if (this.#buffer.length > 16384) throw new MultipartError("malformed", "multipart header block too large");
+					if (!await this.#pull()) throw new MultipartError("malformed", "unterminated multipart part headers");
+					headerEnd = this.#buffer.indexOf("\r\n\r\n");
+				}
+				if (headerEnd > 16384) throw new MultipartError("malformed", "multipart header block too large");
+				const headerBlock = this.#buffer.subarray(0, headerEnd).toString("utf8");
+				this.#buffer = this.#buffer.subarray(headerEnd + 4);
+				const { name, filename, contentType } = parsePartHeaders(headerBlock);
+				if (name === void 0) throw new MultipartError("malformed", "multipart part missing name");
+				const partDelimiter = Buffer.from(`\r\n--${this.#boundary}`);
+				if (filename !== void 0) {
+					if (filename !== "") {
+						this.#fileCount += 1;
+						if (this.#fileCount > this.#limits.files) throw new MultipartError("limit", "too many multipart files");
+					}
+					const path = (0, node_path.join)(this.#directory, (0, node_crypto.randomUUID)());
+					this.#staged.push(path);
+					const handle = await (0, node_fs_promises.open)(path, "w", 384);
+					let size = 0;
+					let head = Buffer.alloc(0);
+					try {
+						for (;;) {
+							const boundaryIndex = this.#buffer.indexOf(partDelimiter);
+							if (boundaryIndex === -1) {
+								const safeLength = Math.max(0, this.#buffer.length - (partDelimiter.length - 1));
+								if (safeLength > 0) {
+									const chunk = this.#buffer.subarray(0, safeLength);
+									size += chunk.length;
+									if (size > this.#limits.file) throw new MultipartError("limit", "multipart file exceeds size limit");
+									if (head.length < 16) head = Buffer.concat([head, chunk.subarray(0, 16 - head.length)]);
+									await handle.write(chunk);
+									this.#buffer = this.#buffer.subarray(safeLength);
+								}
+								if (!await this.#pull()) throw new MultipartError("malformed", "unterminated multipart file part");
+								continue;
+							}
+							const chunk = this.#buffer.subarray(0, boundaryIndex);
+							size += chunk.length;
+							if (size > this.#limits.file) throw new MultipartError("limit", "multipart file exceeds size limit");
+							if (head.length < 16) head = Buffer.concat([head, chunk.subarray(0, 16 - head.length)]);
+							await handle.write(chunk);
+							this.#buffer = this.#buffer.subarray(boundaryIndex + 2);
+							break;
+						}
+					} finally {
+						await handle.close();
+					}
+					if (filename === "" && size === 0) {
+						await (0, node_fs_promises.unlink)(path);
+						this.#staged.splice(this.#staged.indexOf(path), 1);
+					} else {
+						if (filename === "") {
+							this.#fileCount += 1;
+							if (this.#fileCount > this.#limits.files) throw new MultipartError("limit", "too many multipart files");
+						}
+						const detected = detectMIME(head);
+						const declared = contentType ?? "application/octet-stream";
+						const validated = detected !== void 0 && detected === declared;
+						if (this.#allowed !== void 0) {
+							if (!(detected !== void 0 && this.#allowed.includes(detected))) throw new MultipartError("rejected", "multipart file failed type validation");
+						}
+						if ((0, _orkestrel_server.isDangerousKey)(name)) {
+							await (0, node_fs_promises.unlink)(path);
+							this.#staged.splice(this.#staged.indexOf(path), 1);
+						} else {
+							const record = createUploadedFile({
+								field: name,
+								name: filename,
+								size,
+								mime: detected ?? declared,
+								validated,
+								status: "staged",
+								path
+							});
+							const existing = this.#files[name];
+							if (existing === void 0) this.#files[name] = [record];
+							else existing.push(record);
+						}
+					}
+				} else {
+					this.#fieldCount += 1;
+					if (this.#fieldCount > this.#limits.fields) throw new MultipartError("limit", "too many multipart fields");
+					let value = Buffer.alloc(0);
+					for (;;) {
+						const boundaryIndex = this.#buffer.indexOf(partDelimiter);
+						if (boundaryIndex === -1) {
+							const safeLength = Math.max(0, this.#buffer.length - (partDelimiter.length - 1));
+							if (safeLength > 0) {
+								value = Buffer.concat([value, this.#buffer.subarray(0, safeLength)]);
+								if (value.length > this.#limits.field) throw new MultipartError("limit", "multipart field exceeds size limit");
+								this.#buffer = this.#buffer.subarray(safeLength);
+							}
+							if (!await this.#pull()) throw new MultipartError("malformed", "unterminated multipart field part");
+							continue;
+						}
+						value = Buffer.concat([value, this.#buffer.subarray(0, boundaryIndex)]);
+						if (value.length > this.#limits.field) throw new MultipartError("limit", "multipart field exceeds size limit");
+						this.#buffer = this.#buffer.subarray(boundaryIndex + 2);
+						break;
+					}
+					if (!(0, _orkestrel_server.isDangerousKey)(name)) this.#fields[name] = value.toString("utf8");
+				}
+				while (this.#buffer.length < openMarker.length) if (!await this.#pull()) throw new MultipartError("malformed", "unterminated multipart boundary");
+				this.#buffer = this.#buffer.subarray(openMarker.length);
+			}
+		} catch (error) {
+			await this.#cleanup();
+			await this.#reader.cancel().catch(() => {});
+			throw error;
+		} finally {
+			this.#signal.removeEventListener("abort", this.#abort);
+			if (!this.#ended) await this.#reader.cancel().catch(() => {});
+		}
+		return {
+			files: Object.freeze(this.#files),
+			fields: Object.freeze(this.#fields)
+		};
+	}
+	static async #createDirectory() {
+		const path = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "orkestrel-multipart-"));
+		await (0, node_fs_promises.chmod)(path, 448);
+		return path;
+	}
+	async #cleanup() {
+		for (const path of this.#staged) try {
+			await (0, node_fs_promises.unlink)(path);
+		} catch {}
+	}
+	async #pull() {
+		if (this.#signal.aborted) throw new MultipartError("malformed", "request aborted mid-upload");
+		if (this.#ended) return false;
+		const { done, value } = await this.#reader.read();
+		if (this.#signal.aborted) throw new MultipartError("malformed", "request aborted mid-upload");
+		if (done) {
+			this.#ended = true;
+			return false;
+		}
+		this.#totalBytes += value.byteLength;
+		if (this.#totalBytes > this.#limits.total) throw new MultipartError("limit", "multipart body exceeds total limit");
+		this.#buffer = Buffer.concat([this.#buffer, Buffer.from(value.buffer, value.byteOffset, value.byteLength)]);
+		return true;
+	}
+	#wakeReader() {
+		this.#reader.cancel().catch(() => {});
+	}
+};
+//#endregion
 //#region src/server/helpers.ts
 /**
 * Whether `pathname` is `prefix` itself or lies under it on a SEGMENT
@@ -174,6 +378,31 @@ function isUnderPath(pathname, prefix) {
 	return pathname.startsWith(boundary);
 }
 /**
+* Resolve the fixed SPA shell path when a static-file miss is eligible for
+* fallback.
+*
+* @param root - The configured static root
+* @param index - The configured shell filename
+* @param exclude - The URL prefix excluded from fallback
+* @param method - The request method
+* @param pathname - The request pathname
+* @param accept - The request's `Accept` header value
+* @returns The fixed shell path, or `undefined` when fallback is ineligible
+*
+* @example
+* ```ts
+* resolveStaticFallbackPath('/srv/public', 'index.html', '/api', 'GET', '/dashboard', 'text/html')
+* // '/srv/public/index.html'
+* ```
+*/
+function resolveStaticFallbackPath(root, index, exclude, method, pathname, accept) {
+	if (method !== "GET") return void 0;
+	if ((0, node_path.extname)(pathname) !== "") return void 0;
+	if (!accept.includes("text/html") && !accept.includes("*/*")) return void 0;
+	if (isUnderPath(pathname, exclude)) return void 0;
+	return (0, node_path.join)(root, index);
+}
+/**
 * Whether `child` is `parent` itself or lies inside it on-disk — the
 * FILESYSTEM containment predicate `createStatic` applies to `fs.realpath`
 * output (never to a URL pathname — that is {@link isUnderPath}'s job).
@@ -236,7 +465,8 @@ function resolveStaticPath(root, prefix, pathname) {
 		return;
 	}
 	if (decoded.includes("\0")) return void 0;
-	const normalized = (0, node_path.normalize)(decoded.replace(/^[/\\]+/, ""));
+	const stripped = decoded.replace(/^[/\\]+/, "");
+	const normalized = (0, node_path.normalize)(stripped);
 	const segments = normalized.split(/[/\\]+/).filter((segment) => segment.length > 0);
 	for (const segment of segments) if (isReservedDeviceName(segment)) return void 0;
 	const resolved = (0, node_path.resolve)(root, normalized);
@@ -313,6 +543,23 @@ function computeFileETag(size, mtimeMs) {
 	return `W/"${size}-${Math.floor(mtimeMs)}"`;
 }
 /**
+* Compress response bytes with Node's guaranteed zlib gzip/deflate codecs.
+*
+* @param bytes - The uncompressed response bytes
+* @param encoding - The negotiated actionable coding
+* @returns The compressed bytes
+*
+* @example
+* ```ts
+* const bytes = new TextEncoder().encode('compress me')
+* const compressed = await compressNodeBytes(bytes, 'deflate')
+* ```
+*/
+async function compressNodeBytes(bytes, encoding) {
+	const compressed = encoding === "gzip" ? await (0, node_util.promisify)(node_zlib.gzip)(bytes) : await (0, node_util.promisify)(node_zlib.deflate)(bytes);
+	return Uint8Array.from(compressed);
+}
+/**
 * Sniff a MIME type from a file's leading bytes against a small magic-byte
 * table (jpeg, png, gif87a/89a, webp, pdf, zip) — the SNIFF-AUTHORITATIVE
 * signal `createMultipart`'s type validation rests on, never the declared
@@ -327,17 +574,12 @@ function computeFileETag(size, mtimeMs) {
 * ```
 */
 function detectMIME(head) {
-	function matches(signature, offset = 0) {
-		if (head.length < offset + signature.length) return false;
-		for (let index = 0; index < signature.length; index += 1) if (head[offset + index] !== signature[index]) return false;
-		return true;
-	}
-	if (matches([
+	if (matchesBytes(head, [
 		255,
 		216,
 		255
 	])) return "image/jpeg";
-	if (matches([
+	if (matchesBytes(head, [
 		137,
 		80,
 		78,
@@ -347,7 +589,7 @@ function detectMIME(head) {
 		26,
 		10
 	])) return "image/png";
-	if (matches([
+	if (matchesBytes(head, [
 		71,
 		73,
 		70,
@@ -355,7 +597,7 @@ function detectMIME(head) {
 		55,
 		97
 	])) return "image/gif";
-	if (matches([
+	if (matchesBytes(head, [
 		71,
 		73,
 		70,
@@ -363,35 +605,35 @@ function detectMIME(head) {
 		57,
 		97
 	])) return "image/gif";
-	if (matches([
+	if (matchesBytes(head, [
 		82,
 		73,
 		70,
 		70
-	]) && matches([
+	]) && matchesBytes(head, [
 		87,
 		69,
 		66,
 		80
 	], 8)) return "image/webp";
-	if (matches([
+	if (matchesBytes(head, [
 		37,
 		80,
 		68,
 		70,
 		45
 	])) return "application/pdf";
-	if (matches([
+	if (matchesBytes(head, [
 		80,
 		75,
 		3,
 		4
-	]) || matches([
+	]) || matchesBytes(head, [
 		80,
 		75,
 		5,
 		6
-	]) || matches([
+	]) || matchesBytes(head, [
 		80,
 		75,
 		7,
@@ -399,6 +641,24 @@ function detectMIME(head) {
 	])) return "application/zip";
 }
 /**
+* Whether `bytes` contains `signature` at the requested offset.
+*
+* @param bytes - The bytes to inspect
+* @param signature - The exact byte sequence to match
+* @param offset - The starting byte offset, defaulting to zero
+* @returns `true` when the complete signature matches
+*
+* @example
+* ```ts
+* matchesBytes(Uint8Array.from([0, 0x50, 0x4b]), [0x50, 0x4b], 1) // true
+* ```
+*/
+function matchesBytes(bytes, signature, offset = 0) {
+	if (bytes.length < offset + signature.length) return false;
+	for (let index = 0; index < signature.length; index += 1) if (bytes[offset + index] !== signature[index]) return false;
+	return true;
+}
+/**
 * Extract the `boundary` parameter from a `Content-Type` header, or
 * `undefined` when the request is not `multipart/form-data`.
 *
@@ -442,11 +702,6 @@ function resolveMultipartLimits(limits) {
 	};
 }
 /**
-* Memoized `Promise` for `parseMultipartRequest`'s lazily-created default
-* staging directory — created once per process via {@link resolveDefaultDirectory}.
-*/
-var defaultDirectory;
-/**
 * Resolve `parseMultipartRequest`'s default staging directory when the
 * caller did not configure one — a process-owned directory created ONCE
 * (lazily, memoized across calls) via `mkdtemp` under `os.tmpdir()` and
@@ -460,12 +715,7 @@ var defaultDirectory;
 * ```
 */
 function resolveDefaultDirectory() {
-	if (defaultDirectory === void 0) defaultDirectory = (async () => {
-		const path = await (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), "orkestrel-multipart-"));
-		await (0, node_fs_promises.chmod)(path, 448);
-		return path;
-	})();
-	return defaultDirectory;
+	return MultipartParser.directory();
 }
 /**
 * Parse one multipart part's raw header block into its `name` (from
@@ -552,177 +802,7 @@ async function parseMultipartRequest(request, options = {}) {
 	const limits = resolveMultipartLimits(options.limits);
 	const allowed = options.allowed;
 	const directory = options.directory ?? await resolveDefaultDirectory();
-	const staged = [];
-	const files = Object.create(null);
-	const fields = Object.create(null);
-	let fileCount = 0;
-	let fieldCount = 0;
-	let totalBytes = 0;
-	let aborted = false;
-	async function cleanup() {
-		for (const path of staged) try {
-			await (0, node_fs_promises.unlink)(path);
-		} catch {}
-	}
-	const reader = request.body.getReader();
-	let buffer = Buffer.alloc(0);
-	let ended = false;
-	const onAbort = () => {
-		aborted = true;
-	};
-	request.signal.addEventListener("abort", onAbort);
-	async function pull() {
-		if (aborted || request.signal.aborted) throw new MultipartError("malformed", "request aborted mid-upload");
-		if (ended) return false;
-		const { done, value } = await reader.read();
-		if (done) {
-			ended = true;
-			return false;
-		}
-		totalBytes += value.byteLength;
-		if (totalBytes > limits.total) throw new MultipartError("limit", "multipart body exceeds total limit");
-		buffer = Buffer.concat([buffer, Buffer.from(value.buffer, value.byteOffset, value.byteLength)]);
-		return true;
-	}
-	try {
-		const openMarker = Buffer.from(`--${boundary}`);
-		let preambleScanned = 0;
-		let index = buffer.indexOf(openMarker);
-		while (index === -1) {
-			const carry = openMarker.length - 1;
-			if (buffer.length > carry) {
-				const drop = buffer.length - carry;
-				preambleScanned += drop;
-				if (preambleScanned > 65536) throw new MultipartError("malformed", "multipart preamble too large");
-				buffer = buffer.subarray(drop);
-			}
-			if (!await pull()) throw new MultipartError("malformed", "missing multipart boundary");
-			index = buffer.indexOf(openMarker);
-		}
-		buffer = buffer.subarray(index + openMarker.length);
-		for (;;) {
-			while (buffer.length < 2) if (!await pull()) throw new MultipartError("malformed", "unterminated multipart boundary");
-			if (buffer[0] === 45 && buffer[1] === 45) break;
-			if (buffer[0] !== 13 || buffer[1] !== 10) throw new MultipartError("malformed", "malformed multipart boundary");
-			buffer = buffer.subarray(2);
-			let headerEnd = buffer.indexOf("\r\n\r\n");
-			while (headerEnd === -1) {
-				if (buffer.length > 16384) throw new MultipartError("malformed", "multipart header block too large");
-				if (!await pull()) throw new MultipartError("malformed", "unterminated multipart part headers");
-				headerEnd = buffer.indexOf("\r\n\r\n");
-			}
-			const headerBlock = buffer.subarray(0, headerEnd).toString("utf8");
-			buffer = buffer.subarray(headerEnd + 4);
-			const { name, filename, contentType } = parsePartHeaders(headerBlock);
-			if (name === void 0) throw new MultipartError("malformed", "multipart part missing name");
-			const partDelimiter = Buffer.from(`\r\n--${boundary}`);
-			if (filename !== void 0) {
-				if (filename !== "") {
-					fileCount += 1;
-					if (fileCount > limits.files) throw new MultipartError("limit", "too many multipart files");
-				}
-				const path = (0, node_path.join)(directory, (0, node_crypto.randomUUID)());
-				staged.push(path);
-				const handle = await (0, node_fs_promises.open)(path, "w", 384);
-				let size = 0;
-				let head = Buffer.alloc(0);
-				try {
-					for (;;) {
-						const boundaryIndex = buffer.indexOf(partDelimiter);
-						if (boundaryIndex === -1) {
-							const safeLength = Math.max(0, buffer.length - (partDelimiter.length - 1));
-							if (safeLength > 0) {
-								const chunk = buffer.subarray(0, safeLength);
-								size += chunk.length;
-								if (size > limits.file) throw new MultipartError("limit", "multipart file exceeds size limit");
-								if (head.length < 16) head = Buffer.concat([head, chunk.subarray(0, 16 - head.length)]);
-								await handle.write(chunk);
-								buffer = buffer.subarray(safeLength);
-							}
-							if (!await pull()) throw new MultipartError("malformed", "unterminated multipart file part");
-							continue;
-						}
-						const chunk = buffer.subarray(0, boundaryIndex);
-						size += chunk.length;
-						if (size > limits.file) throw new MultipartError("limit", "multipart file exceeds size limit");
-						if (head.length < 16) head = Buffer.concat([head, chunk.subarray(0, 16 - head.length)]);
-						await handle.write(chunk);
-						buffer = buffer.subarray(boundaryIndex + 2);
-						break;
-					}
-				} finally {
-					await handle.close();
-				}
-				if (filename === "" && size === 0) {
-					await (0, node_fs_promises.unlink)(path);
-					staged.splice(staged.indexOf(path), 1);
-				} else {
-					if (filename === "") {
-						fileCount += 1;
-						if (fileCount > limits.files) throw new MultipartError("limit", "too many multipart files");
-					}
-					const detected = detectMIME(head);
-					const declared = contentType ?? "application/octet-stream";
-					const validated = detected !== void 0 && detected === declared;
-					if (allowed !== void 0) {
-						if (!(detected !== void 0 && allowed.includes(detected))) throw new MultipartError("rejected", "multipart file failed type validation");
-					}
-					if ((0, _orkestrel_server.isDangerousKey)(name)) {
-						await (0, node_fs_promises.unlink)(path);
-						staged.splice(staged.indexOf(path), 1);
-					} else {
-						const record = createUploadedFile({
-							field: name,
-							name: filename,
-							size,
-							mime: detected ?? declared,
-							validated,
-							status: "staged",
-							path
-						});
-						const existing = files[name];
-						if (existing === void 0) files[name] = [record];
-						else existing.push(record);
-					}
-				}
-			} else {
-				fieldCount += 1;
-				if (fieldCount > limits.fields) throw new MultipartError("limit", "too many multipart fields");
-				let value = Buffer.alloc(0);
-				for (;;) {
-					const boundaryIndex = buffer.indexOf(partDelimiter);
-					if (boundaryIndex === -1) {
-						const safeLength = Math.max(0, buffer.length - (partDelimiter.length - 1));
-						if (safeLength > 0) {
-							value = Buffer.concat([value, buffer.subarray(0, safeLength)]);
-							if (value.length > limits.field) throw new MultipartError("limit", "multipart field exceeds size limit");
-							buffer = buffer.subarray(safeLength);
-						}
-						if (!await pull()) throw new MultipartError("malformed", "unterminated multipart field part");
-						continue;
-					}
-					value = Buffer.concat([value, buffer.subarray(0, boundaryIndex)]);
-					if (value.length > limits.field) throw new MultipartError("limit", "multipart field exceeds size limit");
-					buffer = buffer.subarray(boundaryIndex + 2);
-					break;
-				}
-				if (!(0, _orkestrel_server.isDangerousKey)(name)) fields[name] = value.toString("utf8");
-			}
-			while (buffer.length < openMarker.length) if (!await pull()) throw new MultipartError("malformed", "unterminated multipart boundary");
-			buffer = buffer.subarray(openMarker.length);
-		}
-	} catch (error) {
-		await cleanup();
-		await reader.cancel().catch(() => {});
-		throw error;
-	} finally {
-		request.signal.removeEventListener("abort", onAbort);
-		if (!ended) await reader.cancel().catch(() => {});
-	}
-	return {
-		files: Object.freeze(files),
-		fields: Object.freeze(fields)
-	};
+	return new MultipartParser(request.body, request.signal, boundary, limits, allowed, directory).parse();
 }
 /**
 * Build a frozen {@link UploadedFileInterface} record.
@@ -935,10 +1015,6 @@ function createStatic(options) {
 	const useETag = options.etag ?? true;
 	const fallback = options.fallback === true ? { exclude: DEFAULT_STATIC_FALLBACK_EXCLUDE } : options.fallback === false || options.fallback === void 0 ? void 0 : { exclude: options.fallback.exclude ?? "/api" };
 	let canonicalRootPromise;
-	function canonicalRoot() {
-		if (canonicalRootPromise === void 0) canonicalRootPromise = (0, node_fs_promises.realpath)(root);
-		return canonicalRootPromise;
-	}
 	return async (request, context, next) => {
 		if (context.method !== "GET" && context.method !== "HEAD") return next();
 		const target = resolveStaticPath(root, options.prefix, context.url.pathname);
@@ -948,47 +1024,83 @@ function createStatic(options) {
 			if (dotfiles === "deny") throw new _orkestrel_server.HTTPError(403, "forbidden");
 			if (dotfiles === "ignore") return next();
 		}
-		let resolvedPath;
+		let resolvedPath = target;
+		let fallbackNeeded = false;
 		try {
-			const [rootReal, targetReal] = await Promise.all([canonicalRoot(), (0, node_fs_promises.realpath)(target)]);
+			if (canonicalRootPromise === void 0) canonicalRootPromise = (0, node_fs_promises.realpath)(root);
+			const [rootReal, targetReal] = await Promise.all([canonicalRootPromise, (0, node_fs_promises.realpath)(target)]);
 			if (!isContainedPath(targetReal, rootReal)) return next();
 			resolvedPath = targetReal;
 		} catch {
-			return trySpaFallback();
+			fallbackNeeded = true;
 		}
 		let directoryInfo;
-		try {
+		if (!fallbackNeeded) try {
 			directoryInfo = await (0, node_fs_promises.stat)(resolvedPath);
 		} catch {
-			return trySpaFallback();
+			fallbackNeeded = true;
 		}
-		if (directoryInfo.isDirectory()) {
+		if (directoryInfo?.isDirectory()) {
 			resolvedPath = (0, node_path.join)(resolvedPath, index);
 			try {
-				const [rootReal, indexReal] = await Promise.all([canonicalRoot(), (0, node_fs_promises.realpath)(resolvedPath)]);
-				if (!isContainedPath(indexReal, rootReal)) return trySpaFallback();
-				resolvedPath = indexReal;
+				if (canonicalRootPromise === void 0) canonicalRootPromise = (0, node_fs_promises.realpath)(root);
+				const [rootReal, indexReal] = await Promise.all([canonicalRootPromise, (0, node_fs_promises.realpath)(resolvedPath)]);
+				if (isContainedPath(indexReal, rootReal)) resolvedPath = indexReal;
+				else fallbackNeeded = true;
 			} catch {
-				return trySpaFallback();
+				fallbackNeeded = true;
 			}
 		}
 		let handle;
-		try {
+		let info;
+		if (!fallbackNeeded) try {
 			handle = await (0, node_fs_promises.open)(resolvedPath, "r");
 		} catch {
-			return trySpaFallback();
+			fallbackNeeded = true;
 		}
-		let info;
-		try {
+		if (handle !== void 0) try {
 			info = await handle.stat();
 		} catch {
 			await handle.close();
-			return trySpaFallback();
+			handle = void 0;
+			fallbackNeeded = true;
 		}
-		if (!info.isFile()) {
+		if (handle !== void 0 && info !== void 0 && !info.isFile()) {
 			await handle.close();
-			return trySpaFallback();
+			handle = void 0;
+			info = void 0;
+			fallbackNeeded = true;
+		}
+		if (fallbackNeeded) {
+			const shellPath = resolveStaticFallbackPath(root, index, fallback?.exclude ?? "/api", context.method, context.url.pathname, request.headers.get("accept") ?? "");
+			if (fallback === void 0 || shellPath === void 0) return next();
+			let shellReal;
+			try {
+				if (canonicalRootPromise === void 0) canonicalRootPromise = (0, node_fs_promises.realpath)(root);
+				const [rootReal, candidate] = await Promise.all([canonicalRootPromise, (0, node_fs_promises.realpath)(shellPath)]);
+				if (!isContainedPath(candidate, rootReal)) return next();
+				shellReal = candidate;
+			} catch {
+				return next();
+			}
+			let shellHandle;
+			try {
+				shellHandle = await (0, node_fs_promises.open)(shellReal, "r");
+			} catch {
+				return next();
+			}
+			try {
+				const body = streamFile(shellHandle);
+				return new Response(body, {
+					status: 200,
+					headers: new Headers({ "content-type": lookupContentType(shellReal) })
+				});
+			} catch (error) {
+				await shellHandle.close().catch(() => {});
+				throw error;
+			}
 		}
+		if (handle === void 0 || info === void 0) return next();
 		let streaming = false;
 		try {
 			const headers = new Headers({
@@ -1050,32 +1162,6 @@ function createStatic(options) {
 			if (!streaming) await handle.close().catch(() => {});
 			throw error;
 		}
-		function trySpaFallback() {
-			if (fallback === void 0) return next();
-			if (context.method !== "GET") return next();
-			if ((0, node_path.extname)(context.url.pathname) !== "") return next();
-			const accept = request.headers.get("accept") ?? "";
-			if (!accept.includes("text/html") && !accept.includes("*/*")) return next();
-			if (isUnderPath(context.url.pathname, fallback.exclude)) return next();
-			const shellPath = (0, node_path.join)(root, index);
-			return Promise.all([canonicalRoot(), (0, node_fs_promises.realpath)(shellPath)]).then(([rootReal, shellReal]) => {
-				if (!isContainedPath(shellReal, rootReal)) return next();
-				return (0, node_fs_promises.open)(shellReal, "r").then((shellHandle) => {
-					let shellStreaming = false;
-					try {
-						const body = streamFile(shellHandle);
-						shellStreaming = true;
-						return new Response(body, {
-							status: 200,
-							headers: new Headers({ "content-type": lookupContentType(shellReal) })
-						});
-					} catch (error) {
-						if (!shellStreaming) shellHandle.close().catch(() => {});
-						throw error;
-					}
-				});
-			}).catch(() => next());
-		}
 	};
 }
 /**
@@ -1119,7 +1205,7 @@ function createMultipart(options = {}) {
 			throw error;
 		}
 		if (body === void 0) return next();
-		context.state.multipart = body;
+		Object.assign(context.state, { multipart: body });
 		try {
 			return await next();
 		} catch (error) {
@@ -1164,14 +1250,13 @@ function createCompression(options) {
 	const threshold = options?.threshold ?? _src_core.DEFAULT_COMPRESSION_THRESHOLD;
 	const filter = options?.filter;
 	const encodings = ["gzip", "deflate"];
-	const gzipAsync = (0, node_util.promisify)(node_zlib.gzip);
-	const deflateAsync = (0, node_util.promisify)(node_zlib.deflate);
 	return async (request, context, next) => {
-		return (0, _src_core.compressResponse)(request, context, await next(), {
+		const response = await next();
+		return (0, _src_core.compressResponse)(request, context, response, {
 			threshold,
-			filter,
+			...filter !== void 0 ? { filter } : {},
 			encodings,
-			compress: async (bytes, encoding) => encoding === "gzip" ? gzipAsync(bytes) : deflateAsync(bytes)
+			compress: compressNodeBytes
 		});
 	};
 }
@@ -1190,6 +1275,7 @@ exports.MULTIPART_MAX_PREAMBLE = MULTIPART_MAX_PREAMBLE;
 exports.MULTIPART_REASON_STATUS = MULTIPART_REASON_STATUS;
 exports.MultipartError = MultipartError;
 exports.RESERVED_DEVICE_NAMES = RESERVED_DEVICE_NAMES;
+exports.compressNodeBytes = compressNodeBytes;
 exports.computeFileETag = computeFileETag;
 exports.createCompression = createCompression;
 exports.createMultipart = createMultipart;
@@ -1202,6 +1288,7 @@ exports.isMultipartError = isMultipartError;
 exports.isReservedDeviceName = isReservedDeviceName;
 exports.isUnderPath = isUnderPath;
 exports.lookupContentType = lookupContentType;
+exports.matchesBytes = matchesBytes;
 exports.moveUploadedFile = moveUploadedFile;
 exports.multipartBoundary = multipartBoundary;
 exports.parseMultipartRequest = parseMultipartRequest;
@@ -1209,6 +1296,7 @@ exports.parsePartHeaders = parsePartHeaders;
 exports.readUploadedFile = readUploadedFile;
 exports.resolveDefaultDirectory = resolveDefaultDirectory;
 exports.resolveMultipartLimits = resolveMultipartLimits;
+exports.resolveStaticFallbackPath = resolveStaticFallbackPath;
 exports.resolveStaticPath = resolveStaticPath;
 exports.streamFile = streamFile;
 exports.streamUploadedFile = streamUploadedFile;