@wooksjs/event-http 0.7.26 → 0.7.28

package/dist/index.cjs

@@ -36,6 +36,7 @@ let http = require("http");
 http = __toESM(http);
 let stream = require("stream");
 let wooks = require("wooks");
+let crypto = require("crypto");
 let net = require("net");
 
 //#region packages/event-http/src/http-kind.ts
@@ -96,18 +97,22 @@ const useCookies = (0, _wooksjs_event_core.defineWook)((ctx) => ({
 }));
 
 //#endregion
-//#region packages/event-http/src/composables/header-accept.ts
+//#region packages/event-http/src/utils/accept.ts
+/** Short Accept names mapped to their MIME types. */
 const ACCEPT_TYPE_MAP = {
 	json: "application/json",
 	html: "text/html",
 	xml: "application/xml",
 	text: "text/plain"
 };
-const acceptsMime = (0, _wooksjs_event_core.cachedBy)((type, ctx) => {
-	const accept = ctx.get(httpKind.keys.req).headers.accept;
-	const mime = ACCEPT_TYPE_MAP[type] || type;
-	return !!(accept && (accept === "*/*" || accept.includes(mime)));
-});
+/** Whether an `Accept` header value accepts `type` (a short name from {@link ACCEPT_TYPE_MAP} or a MIME type). */
+function acceptHeaderHas(accept, type) {
+	return !!(accept && (accept === "*/*" || accept.includes(ACCEPT_TYPE_MAP[type] || type)));
+}
+
+//#endregion
+//#region packages/event-http/src/composables/header-accept.ts
+const acceptsMime = (0, _wooksjs_event_core.cachedBy)((type, ctx) => acceptHeaderHas(ctx.get(httpKind.keys.req).headers.accept, type));
 /** Provides helpers to check the request's Accept header for supported MIME types. */
 const useAccept = (0, _wooksjs_event_core.defineWook)((ctx) => {
 	return {
@@ -167,6 +172,19 @@ const useAuthorization = (0, _wooksjs_event_core.defineWook)((ctx) => {
 	};
 });
 
+//#endregion
+//#region packages/event-http/src/composables/headers.ts
+/**
+* Returns the incoming request headers.
+* @example
+* ```ts
+* const { host, authorization } = useHeaders()
+* ```
+*/
+function useHeaders(ctx) {
+	return (ctx ?? (0, _wooksjs_event_core.current)()).get(httpKind.keys.req).headers;
+}
+
 //#endregion
 //#region packages/event-http/src/compressor/body-compressor.ts
 const compressors = { identity: {
@@ -416,18 +434,72 @@ const DEFAULT_LIMITS = {
 	maxRatio: 100,
 	readTimeoutMs: 1e4
 };
+const NO_ENCODINGS = Object.freeze([]);
 const contentEncodingsSlot = (0, _wooksjs_event_core.cached)((ctx) => {
-	return (ctx.get(httpKind.keys.req).headers["content-encoding"] || "").split(",").map((p) => p.trim()).filter((p) => !!p);
+	const contentEncoding = ctx.get(httpKind.keys.req).headers["content-encoding"];
+	if (!contentEncoding) return NO_ENCODINGS;
+	return contentEncoding.split(",").map((p) => p.trim()).filter((p) => !!p);
 });
 const isCompressedSlot = (0, _wooksjs_event_core.cached)((ctx) => {
-	const parts = ctx.get(contentEncodingsSlot);
-	for (const p of parts) if ([
-		"deflate",
-		"gzip",
-		"br"
-	].includes(p)) return true;
+	for (const p of ctx.get(contentEncodingsSlot)) if (p === "deflate" || p === "gzip" || p === "br") return true;
 	return false;
 });
+/**
+* Reads the whole request body with plain stream events (one listener set, one timer).
+* Raw bytes are checked against `upfrontLimit` first, then against `maxInflated`
+* (the same order as the streaming path). A stall longer than `timeoutMs` destroys the
+* request; a premature close or stream error becomes 408. The request is destroyed
+* once reading settles, as async iteration did.
+*/
+function readRawBody(req, upfrontLimit, maxInflated, timeoutMs) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let bytes = 0;
+		if (req.readableEnded) {
+			req.destroy();
+			resolve(buffer.Buffer.alloc(0));
+			return;
+		}
+		if (req.destroyed) {
+			reject(new HttpError(408, "Request body timeout"));
+			return;
+		}
+		let done = false;
+		const timer = timeoutMs === 0 ? null : setTimeout(() => req.destroy(), timeoutMs);
+		const finish = (error) => {
+			if (done) return;
+			done = true;
+			if (timer) clearTimeout(timer);
+			req.off("data", onData);
+			req.off("end", onEnd);
+			req.off("error", onAbort);
+			req.off("close", onAbort);
+			req.destroy();
+			if (error) reject(error);
+			else resolve(chunks.length === 1 ? chunks[0] : buffer.Buffer.concat(chunks, bytes));
+		};
+		const onData = (chunk) => {
+			bytes += chunk.length;
+			if (bytes > upfrontLimit) {
+				finish(new HttpError(413, "Payload Too Large"));
+				return;
+			}
+			if (bytes > maxInflated) {
+				finish(new HttpError(413, "Inflated body too large"));
+				return;
+			}
+			timer?.refresh();
+			chunks.push(chunk);
+		};
+		const onEnd = () => finish();
+		const onAbort = () => finish(new HttpError(408, "Request body timeout"));
+		req.on("data", onData);
+		req.on("end", onEnd);
+		req.on("error", onAbort);
+		req.on("close", onAbort);
+		req.resume();
+	});
+}
 /** @internal Exported for test pre-seeding — use {@link seedRawBody} instead. */
 const rawBodySlot = (0, _wooksjs_event_core.cached)(async (ctx) => {
 	const req = ctx.get(httpKind.keys.req);
@@ -443,6 +515,14 @@ const rawBodySlot = (0, _wooksjs_event_core.cached)(async (ctx) => {
 	const upfrontLimit = isZip ? maxCompressed : maxInflated;
 	if (cl && cl > upfrontLimit) throw new HttpError(413, "Payload Too Large");
 	for (const enc of encs) if (!compressors[enc]) throw new HttpError(415, `Unsupported Content-Encoding "${enc}"`);
+	if (!streamable) {
+		const raw = await readRawBody(req, upfrontLimit, maxInflated, timeoutMs);
+		if (!isZip) return raw;
+		const body = await uncompressBody(encs, raw);
+		if (body.byteLength > maxInflated) throw new HttpError(413, "Inflated body too large");
+		if (raw.byteLength > 0 && body.byteLength / raw.byteLength > maxRatio) throw new HttpError(413, "Compression ratio too high");
+		return body;
+	}
 	let timer = null;
 	function resetTimer() {
 		if (timeoutMs === 0) return;
@@ -475,8 +555,7 @@ const rawBodySlot = (0, _wooksjs_event_core.cached)(async (ctx) => {
 			clearTimer();
 		}
 	}
-	let stream = limitedCompressed();
-	if (streamable) stream = await uncompressBodyStream(encs, stream);
+	const stream = await uncompressBodyStream(encs, limitedCompressed());
 	const chunks = [];
 	let inflatedBytes = 0;
 	try {
@@ -489,14 +568,8 @@ const rawBodySlot = (0, _wooksjs_event_core.cached)(async (ctx) => {
 		if (error instanceof HttpError) throw error;
 		throw new HttpError(408, "Request body timeout");
 	}
-	let body = buffer.Buffer.concat(chunks);
-	if (!streamable && isZip) {
-		body = await uncompressBody(encs, body);
-		inflatedBytes = body.byteLength;
-		if (inflatedBytes > maxInflated) throw new HttpError(413, "Inflated body too large");
-	}
-	if (isZip && rawBytes > 0 && inflatedBytes / rawBytes > maxRatio) throw new HttpError(413, "Compression ratio too high");
-	return body;
+	if (rawBytes > 0 && inflatedBytes / rawBytes > maxRatio) throw new HttpError(413, "Compression ratio too high");
+	return buffer.Buffer.concat(chunks);
 });
 const forwardedIpSlot = (0, _wooksjs_event_core.cached)((ctx) => {
 	const req = ctx.get(httpKind.keys.req);
@@ -592,19 +665,6 @@ function seedRawBody(ctx, raw) {
 	if (ctx.parent) ctx.getOwn(useRequest._slot);
 }
 
-//#endregion
-//#region packages/event-http/src/composables/headers.ts
-/**
-* Returns the incoming request headers.
-* @example
-* ```ts
-* const { host, authorization } = useHeaders()
-* ```
-*/
-function useHeaders(ctx) {
-	return useRequest(ctx).headers;
-}
-
 //#endregion
 //#region packages/event-http/src/composables/response.ts
 /**
@@ -687,6 +747,120 @@ function useHttpContext(ctx) {
 	return ctx ?? (0, _wooksjs_event_core.current)();
 }
 
+//#endregion
+//#region packages/event-http/src/response/compression.ts
+const COMPRESSIBLE_TYPE = /^(?:text\/(?!event-stream)|image\/svg\+xml|application\/(?:json|javascript|x-javascript|ecmascript|xml|xhtml\+xml|graphql|x-ndjson|ndjson|wasm|x-www-form-urlencoded)\b)|\+(?:json|xml)\b/i;
+/**
+* Default compression filter: `text/*` (except `text/event-stream`), JSON and `+json`, XML and
+* `+xml`, JavaScript, SVG, NDJSON, WASM and form-urlencoded content types.
+*/
+function isCompressibleType(contentType) {
+	return COMPRESSIBLE_TYPE.test(contentType);
+}
+const DEFAULTS = {
+	threshold: 1024,
+	encodings: ["br", "gzip"],
+	brotliQuality: 4,
+	gzipLevel: 6,
+	filter: isCompressibleType
+};
+/**
+* @internal Resolves the `compression` option. `base` supplies the values `value` does not set
+* (the app settings for a per-response override). Returns `undefined` when compression is off.
+*/
+function resolveCompression(value, base = DEFAULTS) {
+	if (!value) return;
+	if (value === true) return base;
+	return {
+		threshold: value.threshold ?? base.threshold,
+		encodings: value.encodings ?? base.encodings,
+		brotliQuality: value.brotliQuality ?? base.brotliQuality,
+		gzipLevel: value.gzipLevel ?? base.gzipLevel,
+		filter: value.filter ?? base.filter
+	};
+}
+/**
+* Picks the content coding for a response from the request's `Accept-Encoding` header.
+*
+* The coding with the highest client q-value wins; `supported` order breaks ties. `q=0`
+* excludes a coding, `*` matches every coding not listed explicitly. Returns `undefined` when
+* the header is missing or none of `supported` is acceptable — send the body uncompressed then.
+*
+* @example
+* ```ts
+* negotiateEncoding('gzip, deflate, br', ['br', 'gzip']) // 'br'
+* negotiateEncoding('br;q=0.5, gzip', ['br', 'gzip'])     // 'gzip'
+* negotiateEncoding('*;q=0, identity', ['br', 'gzip'])    // undefined
+* ```
+*/
+function negotiateEncoding(acceptEncoding, supported) {
+	if (!acceptEncoding) return;
+	const header = Array.isArray(acceptEncoding) ? acceptEncoding.join(",") : acceptEncoding;
+	const listed = /* @__PURE__ */ new Map();
+	let wildcard;
+	for (const part of header.split(",")) {
+		const semi = part.indexOf(";");
+		const name = (semi === -1 ? part : part.slice(0, semi)).trim().toLowerCase();
+		if (!name) continue;
+		const q = semi === -1 ? 1 : parseQ(part.slice(semi + 1));
+		if (name === "*") wildcard = q;
+		else listed.set(name, q);
+	}
+	let best;
+	let bestQ = 0;
+	for (const enc of supported) {
+		const q = listed.get(enc) ?? wildcard ?? 0;
+		if (q > bestQ) {
+			best = enc;
+			bestQ = q;
+		}
+	}
+	return best;
+}
+function parseQ(params) {
+	for (const param of params.split(";")) {
+		const eq = param.indexOf("=");
+		if (eq !== -1 && param.slice(0, eq).trim().toLowerCase() === "q") {
+			const q = Number(param.slice(eq + 1).trim());
+			return Number.isFinite(q) && q > 0 ? Math.min(q, 1) : 0;
+		}
+	}
+	return 1;
+}
+/** @internal Compresses a rendered body of `size` bytes with the given coding (async, libuv threadpool). */
+function compressResponseBody(body, size, encoding, opts) {
+	return new Promise((resolve, reject) => {
+		const done = (error, result) => {
+			if (error) reject(error);
+			else resolve(result);
+		};
+		if (encoding === "br") (0, node_zlib.brotliCompress)(body, { params: {
+			[node_zlib.constants.BROTLI_PARAM_QUALITY]: opts.brotliQuality,
+			[node_zlib.constants.BROTLI_PARAM_MODE]: node_zlib.constants.BROTLI_MODE_TEXT,
+			[node_zlib.constants.BROTLI_PARAM_SIZE_HINT]: size
+		} }, done);
+		else (0, node_zlib.gzip)(body, { level: opts.gzipLevel }, done);
+	});
+}
+/** @internal Cache key for compressed bytes of a prerendered body (coding + level). */
+function compressionCacheKey(encoding, opts) {
+	return encoding === "br" ? `br${opts.brotliQuality}` : `gzip${opts.gzipLevel}`;
+}
+/**
+* @internal Appends `token` to a `Vary` header value unless it (or `*`) is already listed.
+* Returns `undefined` when nothing has to change.
+*/
+function mergeVary(existing, token) {
+	if (!existing || existing.length === 0) return token;
+	const value = Array.isArray(existing) ? existing.join(", ") : existing;
+	const lower = token.toLowerCase();
+	for (const part of value.split(",")) {
+		const name = part.trim().toLowerCase();
+		if (name === lower || name === "*") return;
+	}
+	return value.trim() ? `${value}, ${token}` : token;
+}
+
 //#endregion
 //#region packages/event-http/src/utils/time.ts
 function convertTime(time, unit = "ms") {
@@ -763,6 +937,70 @@ const cookieAttrFunc = {
 	sameSite: (v) => v ? `SameSite=${typeof v === "string" ? v : "Strict"}` : ""
 };
 
+//#endregion
+//#region packages/event-http/src/response/prerender.ts
+const registry = /* @__PURE__ */ new WeakMap();
+function weakEtag(json) {
+	return `W/"${(0, crypto.createHash)("sha256").update(json).digest("base64url").slice(0, 22)}"`;
+}
+/**
+* Serializes `obj` to JSON once and remembers the string by object identity. Whenever a handler
+* (or an interceptor) responds with that same object, the response reuses the stored JSON instead
+* of calling `JSON.stringify` again. Use it for large, long-lived response objects that many
+* requests return as is — e.g. a schema or metadata envelope built once and cached.
+*
+* With `{ etag: true }` a weak `ETag` is derived from the serialized bytes; a `GET`/`HEAD`
+* that responds `200` with the object sets the `ETag` header and answers a matching
+* `If-None-Match` with `304 Not Modified` (no body; other headers such as `Cache-Control`
+* and `Vary` are kept). Error responses never become `304`. An `ETag` header set explicitly
+* on the response wins and disables the `304` handling for that response.
+*
+* **Contract: never mutate a registered object (or anything it references).** The stored JSON
+* is not refreshed, so a mutation would keep serving the old bytes. Build a new object instead —
+* freezing registered objects (`Object.freeze`, deeply) in development makes violations throw.
+*
+* Calling it again for the same object is a no-op (it adds the `ETag` if it was not requested
+* the first time). Entries are held weakly and disappear with the object.
+*
+* @param obj - A JSON-serializable object or array
+* @param options - `{ etag: true }` to also compute a weak ETag
+* @returns The same `obj`, so it can wrap a return value
+*
+* @example
+* ```ts
+* const envelope = prerenderJson(Object.freeze(buildMeta()), { etag: true })
+* app.get('/meta', () => {
+*   useResponse().setHeader('cache-control', 'private, no-cache')
+*   return envelope // sent without re-serializing; 304 on a matching If-None-Match
+* })
+* ```
+*/
+function prerenderJson(obj, options) {
+	let entry = registry.get(obj);
+	if (!entry) {
+		const json = JSON.stringify(obj);
+		if (typeof json !== "string") throw new TypeError("prerenderJson: value does not serialize to JSON");
+		entry = { json };
+		registry.set(obj, entry);
+	}
+	if (options?.etag && !entry.etag) entry.etag = weakEtag(entry.json);
+	return obj;
+}
+/** @internal Returns the pre-serialized JSON (and weak ETag) registered for `obj`, if any. */
+function getPrerenderedJson(obj) {
+	return registry.get(obj);
+}
+/** @internal Weak comparison of `etag` against an `If-None-Match` header value. */
+function ifNoneMatchHas(header, etag) {
+	if (!header) return false;
+	const opaque = etag.startsWith("W/") ? etag.slice(2) : etag;
+	for (const part of header.split(",")) {
+		const tag = part.trim();
+		if (tag === "*" || (tag.startsWith("W/") ? tag.slice(2) : tag) === opaque) return true;
+	}
+	return false;
+}
+
 //#endregion
 //#region packages/event-http/src/response/http-response.ts
 const hasFetchResponse = typeof globalThis.Response === "function";
@@ -792,8 +1030,10 @@ var HttpResponse = class {
 	* @param _req - The underlying Node.js `IncomingMessage`.
 	* @param _logger - Logger instance for error reporting.
 	* @param defaultHeaders - Optional headers to pre-populate on this response (e.g. from `securityHeaders()`).
+	* @param _captureMode - Finalize state on `send()` without writing to `_res` (programmatic fetch).
+	* @param compression - App-level response compression settings (`undefined` = off).
 	*/
-	constructor(_res, _req, _logger, defaultHeaders, _captureMode = false) {
+	constructor(_res, _req, _logger, defaultHeaders, _captureMode = false, compression) {
 		this._res = _res;
 		this._req = _req;
 		this._logger = _logger;
@@ -801,10 +1041,9 @@ var HttpResponse = class {
 		this._status = 0;
 		this._body = void 0;
 		this._headers = {};
-		this._cookies = {};
-		this._rawCookies = [];
 		this._hasCookies = false;
 		this._responded = false;
+		this._compression = compression;
 		if (defaultHeaders) for (const key in defaultHeaders) this._headers[key] = defaultHeaders[key];
 	}
 	/** The HTTP status code. If not set, it is inferred automatically when `send()` is called. */
@@ -870,7 +1109,7 @@ var HttpResponse = class {
 	}
 	/** Sets an outgoing `Set-Cookie` header with optional attributes (chainable). */
 	setCookie(name, value, attrs) {
-		this._cookies[name] = {
+		(this._cookies ??= {})[name] = {
 			value,
 			attrs: attrs || {}
 		};
@@ -879,23 +1118,23 @@ var HttpResponse = class {
 	}
 	/** Returns a previously set cookie's data, or `undefined` if not set. */
 	getCookie(name) {
-		return this._cookies[name];
+		return this._cookies?.[name];
 	}
 	/** Removes a cookie from the outgoing set list (chainable). */
 	removeCookie(name) {
-		delete this._cookies[name];
+		if (this._cookies) delete this._cookies[name];
 		return this;
 	}
 	/** Removes all outgoing cookies (chainable). */
 	clearCookies() {
-		this._cookies = {};
-		this._rawCookies = [];
+		this._cookies = void 0;
+		this._rawCookies = void 0;
 		this._hasCookies = false;
 		return this;
 	}
 	/** Appends a raw `Set-Cookie` header string (chainable). Use when you need full control over the cookie format. */
 	setCookieRaw(rawValue) {
-		this._rawCookies.push(rawValue);
+		(this._rawCookies ??= []).push(rawValue);
 		this._hasCookies = true;
 		return this;
 	}
@@ -910,8 +1149,10 @@ var HttpResponse = class {
 	*/
 	getSetCookieStrings() {
 		const rendered = [];
-		for (const [name, data] of Object.entries(this._cookies)) if (data) rendered.push(renderCookie(name, data));
-		rendered.push(...this._rawCookies);
+		if (this._cookies) {
+			for (const [name, data] of Object.entries(this._cookies)) if (data) rendered.push(renderCookie(name, data));
+		}
+		if (this._rawCookies) rendered.push(...this._rawCookies);
 		return rendered;
 	}
 	/** Sets the `Cache-Control` header from a directive object (chainable). */
@@ -935,6 +1176,24 @@ var HttpResponse = class {
 		return this;
 	}
 	/**
+	* Overrides response compression for this response (chainable).
+	*
+	* - `false` — never compress this response (e.g. a body that mixes secrets with reflected input).
+	* - `true` — compress with the app settings, or the defaults when the app has compression off.
+	* - an options object — compress with these settings over the app settings (or the defaults).
+	*
+	* Only regular bodies (strings, numbers, booleans, objects, `Uint8Array`) are compressed; streams
+	* and fetch `Response` bodies are sent as is.
+	*/
+	setCompression(value) {
+		this._compression = value === true ? this._compression ?? resolveCompression(true) : resolveCompression(value, this._compression);
+		return this;
+	}
+	/** Effective compression settings for this response, or `false` when compression is off. */
+	get compression() {
+		return this._compression ?? false;
+	}
+	/**
 	* Returns the underlying Node.js `ServerResponse`.
 	* @param passthrough - If `true`, the framework still manages the response lifecycle. If `false` (default), the response is marked as "responded" and the framework will not touch it.
 	*/
@@ -972,11 +1231,13 @@ var HttpResponse = class {
 			});
 		}
 		const rendered = this.renderBody();
+		const prerendered = this.takePrerendered();
 		this.autoStatus(!!rendered);
-		if (rendered) {
-			const contentLength = typeof rendered === "string" ? Buffer.byteLength(rendered) : rendered.byteLength;
-			this._headers["content-length"] = contentLength.toString();
-		}
+		if (prerendered?.etag && this.applyPrerenderedEtag(prerendered.etag)) return new globalThis.Response(null, {
+			status: this._status,
+			headers: this._buildWebHeaders()
+		});
+		if (rendered) this._headers["content-length"] = renderedSize(rendered, prerendered).toString();
 		const webBody = method === "HEAD" ? null : rendered instanceof Uint8Array ? rendered.buffer : rendered || null;
 		const webResponse = new globalThis.Response(webBody, {
 			status: this._status,
@@ -1021,6 +1282,11 @@ var HttpResponse = class {
 		if (body instanceof Uint8Array) return body;
 		if (typeof body === "object") {
 			if (!this._headers["content-type"]) this._headers["content-type"] = "application/json";
+			const prerendered = getPrerenderedJson(body);
+			if (prerendered) {
+				this._prerendered = prerendered;
+				return prerendered.json;
+			}
 			return JSON.stringify(body);
 		}
 		throw new Error(`Unsupported body format "${typeof body}"`);
@@ -1041,6 +1307,7 @@ var HttpResponse = class {
 	*
 	* Flushes all accumulated headers (including cookies) in a single `writeHead()` call,
 	* then writes the body. Supports `Readable` streams, `fetch` `Response` objects, and regular values.
+	* Returns a Promise (which never rejects) for streamed bodies and compressed regular bodies.
 	*
 	* @throws Error if the response was already sent.
 	*/
@@ -1060,7 +1327,7 @@ var HttpResponse = class {
 		const method = this._req.method;
 		if (body instanceof stream.Readable) return this.sendStream(body, method);
 		if (hasFetchResponse && body instanceof Response) return this.sendFetchResponse(body, method);
-		this.sendRegular(method);
+		return this.sendRegular(method);
 	}
 	finalizeCookies() {
 		if (!this._hasCookies) return;
@@ -1072,6 +1339,35 @@ var HttpResponse = class {
 		}
 		this._hasCookies = false;
 	}
+	/**
+	* For a body registered with `prerenderJson(obj, { etag: true })`: sets the `ETag` header on a
+	* GET/HEAD 2xx response (unless one was set explicitly) and turns a `200` whose `If-None-Match`
+	* matches into a bodiless `304`. Returns `true` when the response became `304`.
+	* Other methods get no ETag (a validator on e.g. a PUT response would describe the stored resource).
+	*/
+	applyPrerenderedEtag(etag) {
+		const method = this._req.method;
+		if (method !== "GET" && method !== "HEAD" || this._status < 200 || this._status > 299 || this.headerKeyIgnoreCase("etag") !== void 0) return false;
+		this._headers.etag = etag;
+		if (this._status !== EHttpStatusCode.OK || !ifNoneMatchHas(this._req.headers["if-none-match"], etag)) return false;
+		this._status = EHttpStatusCode.NotModified;
+		for (const key in this._headers) {
+			const lower = key.toLowerCase();
+			if (lower === "content-type" || lower === "content-length") delete this._headers[key];
+		}
+		return true;
+	}
+	/** Returns the stored key of header `name` (lower-case) in whatever casing it was set with. */
+	headerKeyIgnoreCase(name) {
+		if (name in this._headers) return name;
+		for (const key in this._headers) if (key.toLowerCase() === name) return key;
+	}
+	/** Returns and clears the prerender entry picked by the last `renderBody()`. */
+	takePrerendered() {
+		const prerendered = this._prerendered;
+		this._prerendered = void 0;
+		return prerendered;
+	}
 	autoStatus(hasBody) {
 		if (this._status) return;
 		if (!hasBody) {
@@ -1117,13 +1413,101 @@ var HttpResponse = class {
 		return this.pipeToResponse(stream.Readable.fromWeb(fetchResponse.body), "Error streaming fetch response body");
 	}
 	sendRegular(method) {
-		const renderedBody = this.renderBody();
-		this.autoStatus(!!renderedBody);
-		const contentLength = typeof renderedBody === "string" ? Buffer.byteLength(renderedBody) : renderedBody.byteLength;
-		this._headers["content-length"] = contentLength.toString();
-		this._res.writeHead(this._status, this._headers).end(method === "HEAD" ? "" : renderedBody);
+		const body = this.renderBody();
+		const prerendered = this.takePrerendered();
+		const size = renderedSize(body, prerendered);
+		this.autoStatus(!!body);
+		const compression = this._compression && this.isCompressible(size, this._compression) ? this._compression : void 0;
+		if (compression) this.appendVary("Accept-Encoding");
+		if (prerendered?.etag && this.applyPrerenderedEtag(prerendered.etag)) {
+			this._res.writeHead(this._status, this._headers).end();
+			return;
+		}
+		if (compression && method !== "HEAD") {
+			const encoding = negotiateEncoding(this._req.headers["accept-encoding"], compression.encodings);
+			if (encoding) return this.sendCompressed(body, size, encoding, compression, prerendered);
+		}
+		this._headers["content-length"] = size.toString();
+		this._res.writeHead(this._status, this._headers).end(method === "HEAD" ? "" : body);
+	}
+	/**
+	* Whether a rendered regular body of `size` bytes may be compressed — independent of the
+	* request's `Accept-Encoding` (and of HEAD, which is answered uncompressed).
+	*/
+	isCompressible(size, opts) {
+		const status = this._status;
+		if (!size || size < opts.threshold || status < 200 || status === 204 || status === 206 || status === 304) return false;
+		let contentType;
+		for (const key in this._headers) {
+			const lower = key.toLowerCase();
+			if (lower === "content-type") contentType = this._headers[key];
+			else if (lower === "content-encoding") return false;
+			else if (lower === "cache-control" && /no-transform/i.test(String(this._headers[key]))) return false;
+		}
+		return typeof contentType === "string" && opts.filter(contentType, this);
+	}
+	/** Adds `token` to the `Vary` header (case-insensitive merge, keeps existing entries). */
+	appendVary(token) {
+		const key = this.headerKeyIgnoreCase("vary") ?? "vary";
+		const merged = mergeVary(this._headers[key], token);
+		if (merged !== void 0) this._headers[key] = merged;
+	}
+	/**
+	* Sends the body compressed with `encoding`. Prerendered bodies are compressed once per coding
+	* and level and the bytes reused (sent synchronously once ready). A compressor failure is
+	* logged and the body is sent uncompressed — headers are not written yet, so that is safe.
+	* Never rejects: a sync handler's `send()` is not awaited.
+	*/
+	sendCompressed(body, size, encoding, opts, prerendered) {
+		let pending;
+		if (prerendered?.json === body) {
+			const cache = prerendered.compressed ??= {};
+			const cacheKey = compressionCacheKey(encoding, opts);
+			let entry = cache[cacheKey];
+			if (!entry) {
+				const promise = compressResponseBody(body, size, encoding, opts);
+				promise.then((bytes) => cache[cacheKey] = bytes, () => delete cache[cacheKey]);
+				entry = cache[cacheKey] = promise;
+			}
+			pending = entry;
+		} else pending = compressResponseBody(body, size, encoding, opts);
+		if (Buffer.isBuffer(pending)) {
+			this.writeDeferred(pending, pending.byteLength, encoding);
+			return;
+		}
+		return pending.then((bytes) => this.writeDeferred(bytes, bytes.byteLength, encoding), (error) => {
+			this._logger.error("Response compression failed, sending uncompressed body", error);
+			this.writeDeferred(body, size);
+		}).catch((error) => {
+			this._logger.error("Failed to send compressed response", error);
+		});
+	}
+	/**
+	* Writes the body picked by `sendCompressed()` — the `encoding`-compressed bytes, or the identity
+	* body after a compressor failure — unless the client went away meanwhile.
+	*/
+	writeDeferred(body, length, encoding) {
+		if (this._res.destroyed) return;
+		if (encoding) {
+			this._headers["content-encoding"] = encoding;
+			for (const key in this._headers) {
+				const lower = key.toLowerCase();
+				if (lower === "content-length" && key !== lower) delete this._headers[key];
+				else if (lower === "etag") {
+					const etag = this._headers[key];
+					if (typeof etag === "string" && etag && !etag.startsWith("W/")) this._headers[key] = `W/${etag}`;
+				}
+			}
+		}
+		this._headers["content-length"] = length.toString();
+		this._res.writeHead(this._status, this._headers).end(body);
 	}
 };
+/** UTF-8 size of a rendered body — computed once per registration for a prerendered body. */
+function renderedSize(body, prerendered) {
+	if (typeof body !== "string") return body.byteLength;
+	return prerendered?.json === body ? prerendered.size ??= Buffer.byteLength(body) : Buffer.byteLength(body);
+}
 /** Converts a Record of headers to a Web Standard `Headers` object. */
 function recordToWebHeaders(record) {
 	const headers = new Headers();
@@ -1497,7 +1881,7 @@ function escapeHtml(value) {
 //#endregion
 //#region packages/event-http/src/response/wooks-http-response.ts
 let framework = {
-	version: "0.7.26",
+	version: "0.7.28",
 	poweredBy: "wooksjs",
 	link: "https://wooks.moost.org/",
 	image: "https://wooks.moost.org/wooks-full-logo.svg"
@@ -1521,7 +1905,8 @@ var WooksHttpResponse = class extends HttpResponse {
 	}
 	renderError(data, ctx) {
 		this._status = data.statusCode || 500;
-		const { has } = useAccept(ctx);
+		const accept = ctx.get(httpKind.keys.req).headers.accept;
+		const has = (type) => acceptHeaderHas(accept, type);
 		if (has("json")) {
 			this._headers["content-type"] = "application/json";
 			this._body = JSON.stringify(data);
@@ -1592,6 +1977,7 @@ var WooksHttp = class extends wooks.WooksAdapterBase {
 		this.logger = opts?.logger || this.getLogger(`[wooks-http]`);
 		this.ResponseClass = opts?.responseClass ?? WooksHttpResponse;
 		this.eventContextOptions = this.getEventContextOptions();
+		this.compression = resolveCompression(opts?.compression);
 	}
 	/** Registers a handler for all HTTP methods on the given path. */
 	all(path, handler) {
@@ -1714,8 +2100,9 @@ var WooksHttp = class extends wooks.WooksAdapterBase {
 		const RequestLimits = this.opts?.requestLimits;
 		const notFoundHandler = this.opts?.onNotFound;
 		const defaultHeaders = this.opts?.defaultHeaders;
+		const compression = this.compression;
 		return (req, res) => {
-			const response = new this.ResponseClass(res, req, ctxOptions.logger, defaultHeaders);
+			const response = new this.ResponseClass(res, req, ctxOptions.logger, defaultHeaders, false, compression);
 			const method = req.method || "";
 			const url = req.url || "";
 			createHttpContext(ctxOptions, {
@@ -1817,33 +2204,19 @@ var WooksHttp = class extends wooks.WooksAdapterBase {
 		}
 	}
 	async processAsyncResult(promise, handlers, startIndex, ctx, response) {
-		try {
-			const result = await promise;
-			await this.respond(result, response, ctx);
+		for (let i = startIndex; i < handlers.length; i++) try {
+			const result = await (i === startIndex ? promise : handlers[i]());
+			const sent = this.respond(result, response, ctx);
+			if (sent) await sent;
 			return result;
 		} catch (error) {
-			const isLastHandler = startIndex === handlers.length - 1;
 			if (!(error instanceof HttpError)) this.logger.error(`Uncaught route handler exception: ${ctx.get(httpKind.keys.req)?.url || ""}`, error);
-			if (isLastHandler) {
-				await this.respond(error, response, ctx);
+			if (i === handlers.length - 1) {
+				const sent = this.respond(error, response, ctx);
+				if (sent) await sent;
 				return error;
 			}
 		}
-		for (let i = startIndex + 1; i < handlers.length; i++) {
-			const handler = handlers[i];
-			const isLastHandler = i === handlers.length - 1;
-			try {
-				const result = await handler();
-				await this.respond(result, response, ctx);
-				return result;
-			} catch (error) {
-				if (!(error instanceof HttpError)) this.logger.error(`Uncaught route handler exception: ${ctx.get(httpKind.keys.req)?.url || ""}`, error);
-				if (isLastHandler) {
-					await this.respond(error, response, ctx);
-					return error;
-				}
-			}
-		}
 	}
 	/**
 	* Programmatic route invocation using the Web Standard fetch API.
@@ -2128,7 +2501,10 @@ exports.createHttpApp = createHttpApp;
 exports.createHttpContext = createHttpContext;
 exports.httpKind = httpKind;
 exports.httpStatusCodes = httpStatusCodes;
+exports.isCompressibleType = isCompressibleType;
+exports.negotiateEncoding = negotiateEncoding;
 exports.prepareTestHttpContext = prepareTestHttpContext;
+exports.prerenderJson = prerenderJson;
 exports.rawBodySlot = rawBodySlot;
 exports.recordToWebHeaders = recordToWebHeaders;
 exports.renderCacheControl = renderCacheControl;