@wooksjs/event-http 0.7.27 → 0.7.29

package/dist/index.cjs

@@ -747,6 +747,120 @@ function useHttpContext(ctx) {
 	return ctx ?? (0, _wooksjs_event_core.current)();
 }
 
+//#endregion
+//#region packages/event-http/src/response/compression.ts
+const COMPRESSIBLE_TYPE = /^(?:text\/(?!event-stream)|image\/svg\+xml|application\/(?:json|javascript|x-javascript|ecmascript|xml|xhtml\+xml|graphql|x-ndjson|ndjson|wasm|x-www-form-urlencoded)\b)|\+(?:json|xml)\b/i;
+/**
+* Default compression filter: `text/*` (except `text/event-stream`), JSON and `+json`, XML and
+* `+xml`, JavaScript, SVG, NDJSON, WASM and form-urlencoded content types.
+*/
+function isCompressibleType(contentType) {
+	return COMPRESSIBLE_TYPE.test(contentType);
+}
+const DEFAULTS = {
+	threshold: 1024,
+	encodings: ["br", "gzip"],
+	brotliQuality: 4,
+	gzipLevel: 6,
+	filter: isCompressibleType
+};
+/**
+* @internal Resolves the `compression` option. `base` supplies the values `value` does not set
+* (the app settings for a per-response override). Returns `undefined` when compression is off.
+*/
+function resolveCompression(value, base = DEFAULTS) {
+	if (!value) return;
+	if (value === true) return base;
+	return {
+		threshold: value.threshold ?? base.threshold,
+		encodings: value.encodings ?? base.encodings,
+		brotliQuality: value.brotliQuality ?? base.brotliQuality,
+		gzipLevel: value.gzipLevel ?? base.gzipLevel,
+		filter: value.filter ?? base.filter
+	};
+}
+/**
+* Picks the content coding for a response from the request's `Accept-Encoding` header.
+*
+* The coding with the highest client q-value wins; `supported` order breaks ties. `q=0`
+* excludes a coding, `*` matches every coding not listed explicitly. Returns `undefined` when
+* the header is missing or none of `supported` is acceptable — send the body uncompressed then.
+*
+* @example
+* ```ts
+* negotiateEncoding('gzip, deflate, br', ['br', 'gzip']) // 'br'
+* negotiateEncoding('br;q=0.5, gzip', ['br', 'gzip'])     // 'gzip'
+* negotiateEncoding('*;q=0, identity', ['br', 'gzip'])    // undefined
+* ```
+*/
+function negotiateEncoding(acceptEncoding, supported) {
+	if (!acceptEncoding) return;
+	const header = Array.isArray(acceptEncoding) ? acceptEncoding.join(",") : acceptEncoding;
+	const listed = /* @__PURE__ */ new Map();
+	let wildcard;
+	for (const part of header.split(",")) {
+		const semi = part.indexOf(";");
+		const name = (semi === -1 ? part : part.slice(0, semi)).trim().toLowerCase();
+		if (!name) continue;
+		const q = semi === -1 ? 1 : parseQ(part.slice(semi + 1));
+		if (name === "*") wildcard = q;
+		else listed.set(name, q);
+	}
+	let best;
+	let bestQ = 0;
+	for (const enc of supported) {
+		const q = listed.get(enc) ?? wildcard ?? 0;
+		if (q > bestQ) {
+			best = enc;
+			bestQ = q;
+		}
+	}
+	return best;
+}
+function parseQ(params) {
+	for (const param of params.split(";")) {
+		const eq = param.indexOf("=");
+		if (eq !== -1 && param.slice(0, eq).trim().toLowerCase() === "q") {
+			const q = Number(param.slice(eq + 1).trim());
+			return Number.isFinite(q) && q > 0 ? Math.min(q, 1) : 0;
+		}
+	}
+	return 1;
+}
+/** @internal Compresses a rendered body of `size` bytes with the given coding (async, libuv threadpool). */
+function compressResponseBody(body, size, encoding, opts) {
+	return new Promise((resolve, reject) => {
+		const done = (error, result) => {
+			if (error) reject(error);
+			else resolve(result);
+		};
+		if (encoding === "br") (0, node_zlib.brotliCompress)(body, { params: {
+			[node_zlib.constants.BROTLI_PARAM_QUALITY]: opts.brotliQuality,
+			[node_zlib.constants.BROTLI_PARAM_MODE]: node_zlib.constants.BROTLI_MODE_TEXT,
+			[node_zlib.constants.BROTLI_PARAM_SIZE_HINT]: size
+		} }, done);
+		else (0, node_zlib.gzip)(body, { level: opts.gzipLevel }, done);
+	});
+}
+/** @internal Cache key for compressed bytes of a prerendered body (coding + level). */
+function compressionCacheKey(encoding, opts) {
+	return encoding === "br" ? `br${opts.brotliQuality}` : `gzip${opts.gzipLevel}`;
+}
+/**
+* @internal Appends `token` to a `Vary` header value unless it (or `*`) is already listed.
+* Returns `undefined` when nothing has to change.
+*/
+function mergeVary(existing, token) {
+	if (!existing || existing.length === 0) return token;
+	const value = Array.isArray(existing) ? existing.join(", ") : existing;
+	const lower = token.toLowerCase();
+	for (const part of value.split(",")) {
+		const name = part.trim().toLowerCase();
+		if (name === lower || name === "*") return;
+	}
+	return value.trim() ? `${value}, ${token}` : token;
+}
+
 //#endregion
 //#region packages/event-http/src/utils/time.ts
 function convertTime(time, unit = "ms") {
@@ -916,8 +1030,10 @@ var HttpResponse = class {
 	* @param _req - The underlying Node.js `IncomingMessage`.
 	* @param _logger - Logger instance for error reporting.
 	* @param defaultHeaders - Optional headers to pre-populate on this response (e.g. from `securityHeaders()`).
+	* @param _captureMode - Finalize state on `send()` without writing to `_res` (programmatic fetch).
+	* @param compression - App-level response compression settings (`undefined` = off).
 	*/
-	constructor(_res, _req, _logger, defaultHeaders, _captureMode = false) {
+	constructor(_res, _req, _logger, defaultHeaders, _captureMode = false, compression) {
 		this._res = _res;
 		this._req = _req;
 		this._logger = _logger;
@@ -927,6 +1043,7 @@ var HttpResponse = class {
 		this._headers = {};
 		this._hasCookies = false;
 		this._responded = false;
+		this._compression = compression;
 		if (defaultHeaders) for (const key in defaultHeaders) this._headers[key] = defaultHeaders[key];
 	}
 	/** The HTTP status code. If not set, it is inferred automatically when `send()` is called. */
@@ -1059,6 +1176,24 @@ var HttpResponse = class {
 		return this;
 	}
 	/**
+	* Overrides response compression for this response (chainable).
+	*
+	* - `false` — never compress this response (e.g. a body that mixes secrets with reflected input).
+	* - `true` — compress with the app settings, or the defaults when the app has compression off.
+	* - an options object — compress with these settings over the app settings (or the defaults).
+	*
+	* Only regular bodies (strings, numbers, booleans, objects, `Uint8Array`) are compressed; streams
+	* and fetch `Response` bodies are sent as is.
+	*/
+	setCompression(value) {
+		this._compression = value === true ? this._compression ?? resolveCompression(true) : resolveCompression(value, this._compression);
+		return this;
+	}
+	/** Effective compression settings for this response, or `false` when compression is off. */
+	get compression() {
+		return this._compression ?? false;
+	}
+	/**
 	* Returns the underlying Node.js `ServerResponse`.
 	* @param passthrough - If `true`, the framework still manages the response lifecycle. If `false` (default), the response is marked as "responded" and the framework will not touch it.
 	*/
@@ -1096,15 +1231,13 @@ var HttpResponse = class {
 			});
 		}
 		const rendered = this.renderBody();
+		const prerendered = this.takePrerendered();
 		this.autoStatus(!!rendered);
-		if (this.applyPrerenderedEtag()) return new globalThis.Response(null, {
+		if (prerendered?.etag && this.applyPrerenderedEtag(prerendered.etag)) return new globalThis.Response(null, {
 			status: this._status,
 			headers: this._buildWebHeaders()
 		});
-		if (rendered) {
-			const contentLength = typeof rendered === "string" ? Buffer.byteLength(rendered) : rendered.byteLength;
-			this._headers["content-length"] = contentLength.toString();
-		}
+		if (rendered) this._headers["content-length"] = renderedSize(rendered, prerendered).toString();
 		const webBody = method === "HEAD" ? null : rendered instanceof Uint8Array ? rendered.buffer : rendered || null;
 		const webResponse = new globalThis.Response(webBody, {
 			status: this._status,
@@ -1151,7 +1284,7 @@ var HttpResponse = class {
 			if (!this._headers["content-type"]) this._headers["content-type"] = "application/json";
 			const prerendered = getPrerenderedJson(body);
 			if (prerendered) {
-				this._prerenderedEtag = prerendered.etag;
+				this._prerendered = prerendered;
 				return prerendered.json;
 			}
 			return JSON.stringify(body);
@@ -1174,6 +1307,7 @@ var HttpResponse = class {
 	*
 	* Flushes all accumulated headers (including cookies) in a single `writeHead()` call,
 	* then writes the body. Supports `Readable` streams, `fetch` `Response` objects, and regular values.
+	* Returns a Promise (which never rejects) for streamed bodies and compressed regular bodies.
 	*
 	* @throws Error if the response was already sent.
 	*/
@@ -1193,7 +1327,7 @@ var HttpResponse = class {
 		const method = this._req.method;
 		if (body instanceof stream.Readable) return this.sendStream(body, method);
 		if (hasFetchResponse && body instanceof Response) return this.sendFetchResponse(body, method);
-		this.sendRegular(method);
+		return this.sendRegular(method);
 	}
 	finalizeCookies() {
 		if (!this._hasCookies) return;
@@ -1211,12 +1345,9 @@ var HttpResponse = class {
 	* matches into a bodiless `304`. Returns `true` when the response became `304`.
 	* Other methods get no ETag (a validator on e.g. a PUT response would describe the stored resource).
 	*/
-	applyPrerenderedEtag() {
-		const etag = this._prerenderedEtag;
-		if (!etag) return false;
-		this._prerenderedEtag = void 0;
+	applyPrerenderedEtag(etag) {
 		const method = this._req.method;
-		if (method !== "GET" && method !== "HEAD" || this._status < 200 || this._status > 299 || this.hasHeaderIgnoreCase("etag")) return false;
+		if (method !== "GET" && method !== "HEAD" || this._status < 200 || this._status > 299 || this.headerKeyIgnoreCase("etag") !== void 0) return false;
 		this._headers.etag = etag;
 		if (this._status !== EHttpStatusCode.OK || !ifNoneMatchHas(this._req.headers["if-none-match"], etag)) return false;
 		this._status = EHttpStatusCode.NotModified;
@@ -1226,9 +1357,16 @@ var HttpResponse = class {
 		}
 		return true;
 	}
-	hasHeaderIgnoreCase(name) {
-		for (const key in this._headers) if (key.toLowerCase() === name) return true;
-		return false;
+	/** Returns the stored key of header `name` (lower-case) in whatever casing it was set with. */
+	headerKeyIgnoreCase(name) {
+		if (name in this._headers) return name;
+		for (const key in this._headers) if (key.toLowerCase() === name) return key;
+	}
+	/** Returns and clears the prerender entry picked by the last `renderBody()`. */
+	takePrerendered() {
+		const prerendered = this._prerendered;
+		this._prerendered = void 0;
+		return prerendered;
 	}
 	autoStatus(hasBody) {
 		if (this._status) return;
@@ -1275,17 +1413,101 @@ var HttpResponse = class {
 		return this.pipeToResponse(stream.Readable.fromWeb(fetchResponse.body), "Error streaming fetch response body");
 	}
 	sendRegular(method) {
-		const renderedBody = this.renderBody();
-		this.autoStatus(!!renderedBody);
-		if (this.applyPrerenderedEtag()) {
+		const body = this.renderBody();
+		const prerendered = this.takePrerendered();
+		const size = renderedSize(body, prerendered);
+		this.autoStatus(!!body);
+		const compression = this._compression && this.isCompressible(size, this._compression) ? this._compression : void 0;
+		if (compression) this.appendVary("Accept-Encoding");
+		if (prerendered?.etag && this.applyPrerenderedEtag(prerendered.etag)) {
 			this._res.writeHead(this._status, this._headers).end();
 			return;
 		}
-		const contentLength = typeof renderedBody === "string" ? Buffer.byteLength(renderedBody) : renderedBody.byteLength;
-		this._headers["content-length"] = contentLength.toString();
-		this._res.writeHead(this._status, this._headers).end(method === "HEAD" ? "" : renderedBody);
+		if (compression && method !== "HEAD") {
+			const encoding = negotiateEncoding(this._req.headers["accept-encoding"], compression.encodings);
+			if (encoding) return this.sendCompressed(body, size, encoding, compression, prerendered);
+		}
+		this._headers["content-length"] = size.toString();
+		this._res.writeHead(this._status, this._headers).end(method === "HEAD" ? "" : body);
+	}
+	/**
+	* Whether a rendered regular body of `size` bytes may be compressed — independent of the
+	* request's `Accept-Encoding` (and of HEAD, which is answered uncompressed).
+	*/
+	isCompressible(size, opts) {
+		const status = this._status;
+		if (!size || size < opts.threshold || status < 200 || status === 204 || status === 206 || status === 304) return false;
+		let contentType;
+		for (const key in this._headers) {
+			const lower = key.toLowerCase();
+			if (lower === "content-type") contentType = this._headers[key];
+			else if (lower === "content-encoding") return false;
+			else if (lower === "cache-control" && /no-transform/i.test(String(this._headers[key]))) return false;
+		}
+		return typeof contentType === "string" && opts.filter(contentType, this);
+	}
+	/** Adds `token` to the `Vary` header (case-insensitive merge, keeps existing entries). */
+	appendVary(token) {
+		const key = this.headerKeyIgnoreCase("vary") ?? "vary";
+		const merged = mergeVary(this._headers[key], token);
+		if (merged !== void 0) this._headers[key] = merged;
+	}
+	/**
+	* Sends the body compressed with `encoding`. Prerendered bodies are compressed once per coding
+	* and level and the bytes reused (sent synchronously once ready). A compressor failure is
+	* logged and the body is sent uncompressed — headers are not written yet, so that is safe.
+	* Never rejects: a sync handler's `send()` is not awaited.
+	*/
+	sendCompressed(body, size, encoding, opts, prerendered) {
+		let pending;
+		if (prerendered?.json === body) {
+			const cache = prerendered.compressed ??= {};
+			const cacheKey = compressionCacheKey(encoding, opts);
+			let entry = cache[cacheKey];
+			if (!entry) {
+				const promise = compressResponseBody(body, size, encoding, opts);
+				promise.then((bytes) => cache[cacheKey] = bytes, () => delete cache[cacheKey]);
+				entry = cache[cacheKey] = promise;
+			}
+			pending = entry;
+		} else pending = compressResponseBody(body, size, encoding, opts);
+		if (Buffer.isBuffer(pending)) {
+			this.writeDeferred(pending, pending.byteLength, encoding);
+			return;
+		}
+		return pending.then((bytes) => this.writeDeferred(bytes, bytes.byteLength, encoding), (error) => {
+			this._logger.error("Response compression failed, sending uncompressed body", error);
+			this.writeDeferred(body, size);
+		}).catch((error) => {
+			this._logger.error("Failed to send compressed response", error);
+		});
+	}
+	/**
+	* Writes the body picked by `sendCompressed()` — the `encoding`-compressed bytes, or the identity
+	* body after a compressor failure — unless the client went away meanwhile.
+	*/
+	writeDeferred(body, length, encoding) {
+		if (this._res.destroyed) return;
+		if (encoding) {
+			this._headers["content-encoding"] = encoding;
+			for (const key in this._headers) {
+				const lower = key.toLowerCase();
+				if (lower === "content-length" && key !== lower) delete this._headers[key];
+				else if (lower === "etag") {
+					const etag = this._headers[key];
+					if (typeof etag === "string" && etag && !etag.startsWith("W/")) this._headers[key] = `W/${etag}`;
+				}
+			}
+		}
+		this._headers["content-length"] = length.toString();
+		this._res.writeHead(this._status, this._headers).end(body);
 	}
 };
+/** UTF-8 size of a rendered body — computed once per registration for a prerendered body. */
+function renderedSize(body, prerendered) {
+	if (typeof body !== "string") return body.byteLength;
+	return prerendered?.json === body ? prerendered.size ??= Buffer.byteLength(body) : Buffer.byteLength(body);
+}
 /** Converts a Record of headers to a Web Standard `Headers` object. */
 function recordToWebHeaders(record) {
 	const headers = new Headers();
@@ -1659,7 +1881,7 @@ function escapeHtml(value) {
 //#endregion
 //#region packages/event-http/src/response/wooks-http-response.ts
 let framework = {
-	version: "0.7.27",
+	version: "0.7.29",
 	poweredBy: "wooksjs",
 	link: "https://wooks.moost.org/",
 	image: "https://wooks.moost.org/wooks-full-logo.svg"
@@ -1755,6 +1977,7 @@ var WooksHttp = class extends wooks.WooksAdapterBase {
 		this.logger = opts?.logger || this.getLogger(`[wooks-http]`);
 		this.ResponseClass = opts?.responseClass ?? WooksHttpResponse;
 		this.eventContextOptions = this.getEventContextOptions();
+		this.compression = resolveCompression(opts?.compression);
 	}
 	/** Registers a handler for all HTTP methods on the given path. */
 	all(path, handler) {
@@ -1871,25 +2094,36 @@ var WooksHttp = class extends wooks.WooksAdapterBase {
 	* const server = http.createServer(app.getServerCb())
 	* server.listen(3000)
 	* ```
+	*
+	* Pass `onNoMatch` to mount Wooks as a middleware in front of another handler
+	* (e.g. a Vite dev server). The request is routed first; when no route matches,
+	* `onNoMatch(req, res)` is called directly — before and outside any event context:
+	* no response wrapper is created, no event starts (`current()` throws, no
+	* `ContextInjector` hooks fire) and `onNotFound` is skipped.
 	*/
 	getServerCb(onNoMatch) {
 		const ctxOptions = this.eventContextOptions;
 		const RequestLimits = this.opts?.requestLimits;
 		const notFoundHandler = this.opts?.onNotFound;
 		const defaultHeaders = this.opts?.defaultHeaders;
+		const compression = this.compression;
 		return (req, res) => {
-			const response = new this.ResponseClass(res, req, ctxOptions.logger, defaultHeaders);
 			const method = req.method || "";
 			const url = req.url || "";
+			const match = this.wooks.matchRoute(method, url);
+			if (!match && onNoMatch) {
+				onNoMatch(req, res);
+				return;
+			}
+			const response = new this.ResponseClass(res, req, ctxOptions.logger, defaultHeaders, false, compression);
 			createHttpContext(ctxOptions, {
 				req,
 				response,
 				requestLimits: RequestLimits
 			}, () => {
 				const ctx = (0, _wooksjs_event_core.current)();
-				const handlers = this.wooks.lookupHandlers(method, url, ctx);
+				const handlers = this.wooks.applyRoute(method, match, ctx);
 				if (handlers) return this.processAndCatch(handlers, ctx, response);
-				else if (onNoMatch) onNoMatch(req, res);
 				else if (notFoundHandler) return this.processAndCatch([notFoundHandler], ctx, response);
 				else {
 					this.logger.debug(`404 Not found (${method})${url}`);
@@ -1996,20 +2230,23 @@ var WooksHttp = class extends wooks.WooksAdapterBase {
 	}
 	/**
 	* Programmatic route invocation using the Web Standard fetch API.
-	* Goes through the full dispatch pipeline: context creation, route matching,
-	* handler execution, response finalization.
+	* Goes through the full dispatch pipeline: route matching, context creation,
+	* handler execution, response finalization. An unmatched route returns `null`
+	* before any event context is created (the request body is left unread).
 	*
 	* When called from within an existing HTTP context (e.g. during SSR),
 	* identity headers (authorization, cookie) are automatically forwarded
 	* from the calling request unless already present on the given Request.
 	*
 	* @param request - A Web Standard Request object.
-	* @returns A Web Standard Response, or `null` if no route matched (and no `onNotFound` handler is set).
+	* @returns A Web Standard Response, or `null` if no route matched (`onNotFound` is not used here).
 	*/
 	async fetch(request) {
 		const url = new URL(request.url);
 		const method = request.method;
 		const pathname = url.pathname + url.search;
+		const match = this.wooks.matchRoute(method, pathname);
+		if (!match) return null;
 		const callerCtx = (0, _wooksjs_event_core.tryGetCurrent)();
 		let callerReq;
 		if (callerCtx) try {
@@ -2058,13 +2295,11 @@ var WooksHttp = class extends wooks.WooksAdapterBase {
 			const ctx = (0, _wooksjs_event_core.current)();
 			if (bodyBuffer) seedRawBody(ctx, bodyBuffer);
 			try {
-				const handlers = this.wooks.lookupHandlers(method, pathname, ctx);
-				if (handlers) {
-					const result = this.processHandlers(handlers, ctx, response);
-					if (result !== null && result !== void 0 && typeof result.then === "function") await result.catch((error) => {
-						if (!response.responded) this.respond(error, response, ctx);
-					});
-				} else return null;
+				const handlers = this.wooks.applyRoute(method, match, ctx);
+				const result = this.processHandlers(handlers, ctx, response);
+				if (result !== null && result !== void 0 && typeof result.then === "function") await result.catch((error) => {
+					if (!response.responded) this.respond(error, response, ctx);
+				});
 			} finally {
 				fakeReq.emit("end");
 				fakeReq.emit("close");
@@ -2277,6 +2512,8 @@ exports.createHttpApp = createHttpApp;
 exports.createHttpContext = createHttpContext;
 exports.httpKind = httpKind;
 exports.httpStatusCodes = httpStatusCodes;
+exports.isCompressibleType = isCompressibleType;
+exports.negotiateEncoding = negotiateEncoding;
 exports.prepareTestHttpContext = prepareTestHttpContext;
 exports.prerenderJson = prerenderJson;
 exports.rawBodySlot = rawBodySlot;

package/dist/index.d.ts

@@ -347,6 +347,60 @@ interface TCacheControl {
 /** Renders a `TCacheControl` object into a `Cache-Control` header string. */
 declare function renderCacheControl(data: TCacheControl): string;
 
+/** Content codings supported by response compression, in the order they are listed by default. */
+type THttpCompressionEncoding = 'br' | 'gzip';
+/**
+ * Response compression settings — the `compression` option of `createHttpApp()` and the
+ * argument of `HttpResponse.setCompression()`.
+ */
+interface THttpCompressionOptions {
+    /** Minimum body size in bytes to compress. Smaller bodies are sent as is. @default 1024 */
+    threshold?: number;
+    /**
+     * Codings the server may use, in preference order. The client's `Accept-Encoding` q-values
+     * decide first; this order breaks ties. @default ['br', 'gzip']
+     */
+    encodings?: THttpCompressionEncoding[];
+    /** Brotli quality (0–11). Higher is smaller and much slower — keep 4–5 for dynamic bodies. @default 4 */
+    brotliQuality?: number;
+    /** Gzip level (1–9). @default 6 */
+    gzipLevel?: number;
+    /**
+     * Decides whether a response with this content type may be compressed.
+     * Replaces the default check — call `isCompressibleType(contentType)` inside to extend it.
+     * @default isCompressibleType
+     */
+    filter?: (contentType: string, response: HttpResponse) => boolean;
+}
+/** Fully resolved compression settings (what `HttpResponse.compression` returns). */
+interface TResolvedHttpCompression {
+    threshold: number;
+    encodings: THttpCompressionEncoding[];
+    brotliQuality: number;
+    gzipLevel: number;
+    filter: (contentType: string, response: HttpResponse) => boolean;
+}
+/**
+ * Default compression filter: `text/*` (except `text/event-stream`), JSON and `+json`, XML and
+ * `+xml`, JavaScript, SVG, NDJSON, WASM and form-urlencoded content types.
+ */
+declare function isCompressibleType(contentType: string): boolean;
+/**
+ * Picks the content coding for a response from the request's `Accept-Encoding` header.
+ *
+ * The coding with the highest client q-value wins; `supported` order breaks ties. `q=0`
+ * excludes a coding, `*` matches every coding not listed explicitly. Returns `undefined` when
+ * the header is missing or none of `supported` is acceptable — send the body uncompressed then.
+ *
+ * @example
+ * ```ts
+ * negotiateEncoding('gzip, deflate, br', ['br', 'gzip']) // 'br'
+ * negotiateEncoding('br;q=0.5, gzip', ['br', 'gzip'])     // 'gzip'
+ * negotiateEncoding('*;q=0, identity', ['br', 'gzip'])    // undefined
+ * ```
+ */
+declare function negotiateEncoding<T extends string>(acceptEncoding: string | string[] | undefined, supported: readonly T[]): T | undefined;
+
 /**
  * Manages response status, headers, cookies, cache control, and body for an HTTP request.
  *
@@ -370,8 +424,10 @@ declare class HttpResponse {
      * @param _req - The underlying Node.js `IncomingMessage`.
      * @param _logger - Logger instance for error reporting.
      * @param defaultHeaders - Optional headers to pre-populate on this response (e.g. from `securityHeaders()`).
+     * @param _captureMode - Finalize state on `send()` without writing to `_res` (programmatic fetch).
+     * @param compression - App-level response compression settings (`undefined` = off).
      */
-    constructor(_res: ServerResponse, _req: IncomingMessage, _logger: Logger, defaultHeaders?: Record<string, string | string[]>, _captureMode?: boolean);
+    constructor(_res: ServerResponse, _req: IncomingMessage, _logger: Logger, defaultHeaders?: Record<string, string | string[]>, _captureMode?: boolean, compression?: TResolvedHttpCompression);
     protected _status: EHttpStatusCode;
     protected _body: unknown;
     protected _headers: Record<string, string | string[]>;
@@ -381,8 +437,10 @@ declare class HttpResponse {
     protected _rawCookies?: string[];
     protected _hasCookies: boolean;
     protected _responded: boolean;
-    /** Weak ETag of the prerendered body picked by the last `renderBody()` (see `prerenderJson`). */
-    private _prerenderedEtag?;
+    /** Registry entry of the prerendered body picked by the last `renderBody()` (see `prerenderJson`). */
+    private _prerendered?;
+    /** Effective compression settings for this response (`undefined` = off). */
+    protected _compression: TResolvedHttpCompression | undefined;
     /** The HTTP status code. If not set, it is inferred automatically when `send()` is called. */
     get status(): EHttpStatusCode;
     set status(value: EHttpStatusCode);
@@ -437,6 +495,19 @@ declare class HttpResponse {
     setExpires(value: Date | string | number): this;
     /** Sets or clears the `Pragma: no-cache` header (chainable). */
     setPragmaNoCache(value?: boolean): this;
+    /**
+     * Overrides response compression for this response (chainable).
+     *
+     * - `false` — never compress this response (e.g. a body that mixes secrets with reflected input).
+     * - `true` — compress with the app settings, or the defaults when the app has compression off.
+     * - an options object — compress with these settings over the app settings (or the defaults).
+     *
+     * Only regular bodies (strings, numbers, booleans, objects, `Uint8Array`) are compressed; streams
+     * and fetch `Response` bodies are sent as is.
+     */
+    setCompression(value: boolean | THttpCompressionOptions): this;
+    /** Effective compression settings for this response, or `false` when compression is off. */
+    get compression(): Readonly<TResolvedHttpCompression> | false;
     /**
      * Returns the underlying Node.js `ServerResponse`.
      * @param passthrough - If `true`, the framework still manages the response lifecycle. If `false` (default), the response is marked as "responded" and the framework will not touch it.
@@ -467,6 +538,7 @@ declare class HttpResponse {
      *
      * Flushes all accumulated headers (including cookies) in a single `writeHead()` call,
      * then writes the body. Supports `Readable` streams, `fetch` `Response` objects, and regular values.
+     * Returns a Promise (which never rejects) for streamed bodies and compressed regular bodies.
      *
      * @throws Error if the response was already sent.
      */
@@ -479,7 +551,10 @@ declare class HttpResponse {
      * Other methods get no ETag (a validator on e.g. a PUT response would describe the stored resource).
      */
     private applyPrerenderedEtag;
-    private hasHeaderIgnoreCase;
+    /** Returns the stored key of header `name` (lower-case) in whatever casing it was set with. */
+    private headerKeyIgnoreCase;
+    /** Returns and clears the prerender entry picked by the last `renderBody()`. */
+    private takePrerendered;
     private autoStatus;
     private sendStream;
     /**
@@ -493,6 +568,25 @@ declare class HttpResponse {
     private pipeToResponse;
     private sendFetchResponse;
     private sendRegular;
+    /**
+     * Whether a rendered regular body of `size` bytes may be compressed — independent of the
+     * request's `Accept-Encoding` (and of HEAD, which is answered uncompressed).
+     */
+    private isCompressible;
+    /** Adds `token` to the `Vary` header (case-insensitive merge, keeps existing entries). */
+    private appendVary;
+    /**
+     * Sends the body compressed with `encoding`. Prerendered bodies are compressed once per coding
+     * and level and the bytes reused (sent synchronously once ready). A compressor failure is
+     * logged and the body is sent uncompressed — headers are not written yet, so that is safe.
+     * Never rejects: a sync handler's `send()` is not awaited.
+     */
+    private sendCompressed;
+    /**
+     * Writes the body picked by `sendCompressed()` — the `encoding`-compressed bytes, or the identity
+     * body after a compressor failure — unless the client went away meanwhile.
+     */
+    private writeDeferred;
 }
 /** Converts a Record of headers to a Web Standard `Headers` object. */
 declare function recordToWebHeaders(record: Record<string, string | string[]>): Headers;
@@ -595,6 +689,18 @@ interface TWooksHttpOptions {
      * @default DEFAULT_FORWARD_HEADERS — ['authorization', 'cookie', 'accept-language', 'x-forwarded-for', 'x-request-id']
      */
     forwardHeaders?: string[] | false;
+    /**
+     * Compresses regular response bodies (JSON, text, HTML, …) with brotli or gzip, negotiated
+     * from the request's `Accept-Encoding`. Off by default. `true` uses the defaults
+     * (`threshold: 1024`, `encodings: ['br', 'gzip']`, `brotliQuality: 4`, `gzipLevel: 6`);
+     * an object overrides them. Streams, fetch `Response` bodies and programmatic `fetch()`
+     * responses are never compressed. Opt a single response out with
+     * `useResponse().setCompression(false)`.
+     *
+     * Do not enable it for responses that mix secrets with attacker-controlled input (BREACH).
+     * @default false
+     */
+    compression?: boolean | THttpCompressionOptions;
 }
 /** HTTP adapter for Wooks that provides route registration, server lifecycle, and request handling. */
 declare class WooksHttp extends WooksAdapterBase {
@@ -602,6 +708,7 @@ declare class WooksHttp extends WooksAdapterBase {
     protected logger: TConsoleBase;
     protected ResponseClass: typeof WooksHttpResponse;
     protected eventContextOptions: EventContextOptions;
+    protected compression: TResolvedHttpCompression | undefined;
     constructor(opts?: TWooksHttpOptions | undefined, wooks?: Wooks | WooksAdapterBase);
     /** Registers a handler for all HTTP methods on the given path. */
     all<ResType = unknown, ParamsType = Record<string, string | string[]>>(path: string, handler: TWooksHandler<ResType>): wooks.TProstoRouterPathHandle<ParamsType>;
@@ -671,6 +778,12 @@ declare class WooksHttp extends WooksAdapterBase {
      * const server = http.createServer(app.getServerCb())
      * server.listen(3000)
      * ```
+     *
+     * Pass `onNoMatch` to mount Wooks as a middleware in front of another handler
+     * (e.g. a Vite dev server). The request is routed first; when no route matches,
+     * `onNoMatch(req, res)` is called directly — before and outside any event context:
+     * no response wrapper is created, no event starts (`current()` throws, no
+     * `ContextInjector` hooks fire) and `onNotFound` is skipped.
      */
     getServerCb(onNoMatch?: (req: IncomingMessage, res: ServerResponse) => void): (req: IncomingMessage, res: ServerResponse) => void;
     /**
@@ -685,15 +798,16 @@ declare class WooksHttp extends WooksAdapterBase {
     private processAsyncResult;
     /**
      * Programmatic route invocation using the Web Standard fetch API.
-     * Goes through the full dispatch pipeline: context creation, route matching,
-     * handler execution, response finalization.
+     * Goes through the full dispatch pipeline: route matching, context creation,
+     * handler execution, response finalization. An unmatched route returns `null`
+     * before any event context is created (the request body is left unread).
      *
      * When called from within an existing HTTP context (e.g. during SSR),
      * identity headers (authorization, cookie) are automatically forwarded
      * from the calling request unless already present on the given Request.
      *
      * @param request - A Web Standard Request object.
-     * @returns A Web Standard Response, or `null` if no route matched (and no `onNotFound` handler is set).
+     * @returns A Web Standard Response, or `null` if no route matched (`onNotFound` is not used here).
      */
     fetch(request: Request): Promise<Response | null>;
     /**
@@ -848,5 +962,5 @@ interface TTestHttpContext {
  */
 declare function prepareTestHttpContext(options: TTestHttpContext): <T>(cb: (...a: any[]) => T) => T;
 
-export { DEFAULT_FORWARD_HEADERS, DEFAULT_LIMITS, EHttpStatusCode, HttpError, HttpResponse, WooksHttp, WooksHttpResponse, WooksURLSearchParams, createHttpApp, createHttpContext, httpKind, httpStatusCodes, prepareTestHttpContext, prerenderJson, rawBodySlot, recordToWebHeaders, renderCacheControl, securityHeaders, seedRawBody, useAccept, useAuthorization, useCookies, useHeaders, useHttpContext, useRequest, useResponse, useUrlParams };
-export type { KnownAcceptType, KnownAuthType, SecurityHeadersOptions, TCacheControl, TCookieAttributes, TCookieAttributesInput, THttpEventData, TPrerenderJsonOptions, TRequestLimits, TSetCookieData, TTestHttpContext, TWooksErrorBody, TWooksErrorBodyExt, TWooksHttpOptions };
+export { DEFAULT_FORWARD_HEADERS, DEFAULT_LIMITS, EHttpStatusCode, HttpError, HttpResponse, WooksHttp, WooksHttpResponse, WooksURLSearchParams, createHttpApp, createHttpContext, httpKind, httpStatusCodes, isCompressibleType, negotiateEncoding, prepareTestHttpContext, prerenderJson, rawBodySlot, recordToWebHeaders, renderCacheControl, securityHeaders, seedRawBody, useAccept, useAuthorization, useCookies, useHeaders, useHttpContext, useRequest, useResponse, useUrlParams };
+export type { KnownAcceptType, KnownAuthType, SecurityHeadersOptions, TCacheControl, TCookieAttributes, TCookieAttributesInput, THttpCompressionEncoding, THttpCompressionOptions, THttpEventData, TPrerenderJsonOptions, TRequestLimits, TResolvedHttpCompression, TSetCookieData, TTestHttpContext, TWooksErrorBody, TWooksErrorBodyExt, TWooksHttpOptions };

package/dist/index.mjs

@@ -2,7 +2,7 @@ import { EventContext, cached, cachedBy, createEventContext, current, defineEven
 import { Buffer as Buffer$1 } from "buffer";
 import { Readable, pipeline } from "node:stream";
 import { promisify } from "node:util";
-import { createBrotliCompress, createBrotliDecompress, createDeflate, createGunzip, createGzip, createInflate } from "node:zlib";
+import { brotliCompress, constants, createBrotliCompress, createBrotliDecompress, createDeflate, createGunzip, createGzip, createInflate, gzip } from "node:zlib";
 import { URLSearchParams } from "url";
 import http, { IncomingMessage, ServerResponse } from "http";
 import { Duplex, Readable as Readable$1, pipeline as pipeline$1 } from "stream";
@@ -718,6 +718,120 @@ function useHttpContext(ctx) {
 	return ctx ?? current();
 }
 
+//#endregion
+//#region packages/event-http/src/response/compression.ts
+const COMPRESSIBLE_TYPE = /^(?:text\/(?!event-stream)|image\/svg\+xml|application\/(?:json|javascript|x-javascript|ecmascript|xml|xhtml\+xml|graphql|x-ndjson|ndjson|wasm|x-www-form-urlencoded)\b)|\+(?:json|xml)\b/i;
+/**
+* Default compression filter: `text/*` (except `text/event-stream`), JSON and `+json`, XML and
+* `+xml`, JavaScript, SVG, NDJSON, WASM and form-urlencoded content types.
+*/
+function isCompressibleType(contentType) {
+	return COMPRESSIBLE_TYPE.test(contentType);
+}
+const DEFAULTS = {
+	threshold: 1024,
+	encodings: ["br", "gzip"],
+	brotliQuality: 4,
+	gzipLevel: 6,
+	filter: isCompressibleType
+};
+/**
+* @internal Resolves the `compression` option. `base` supplies the values `value` does not set
+* (the app settings for a per-response override). Returns `undefined` when compression is off.
+*/
+function resolveCompression(value, base = DEFAULTS) {
+	if (!value) return;
+	if (value === true) return base;
+	return {
+		threshold: value.threshold ?? base.threshold,
+		encodings: value.encodings ?? base.encodings,
+		brotliQuality: value.brotliQuality ?? base.brotliQuality,
+		gzipLevel: value.gzipLevel ?? base.gzipLevel,
+		filter: value.filter ?? base.filter
+	};
+}
+/**
+* Picks the content coding for a response from the request's `Accept-Encoding` header.
+*
+* The coding with the highest client q-value wins; `supported` order breaks ties. `q=0`
+* excludes a coding, `*` matches every coding not listed explicitly. Returns `undefined` when
+* the header is missing or none of `supported` is acceptable — send the body uncompressed then.
+*
+* @example
+* ```ts
+* negotiateEncoding('gzip, deflate, br', ['br', 'gzip']) // 'br'
+* negotiateEncoding('br;q=0.5, gzip', ['br', 'gzip'])     // 'gzip'
+* negotiateEncoding('*;q=0, identity', ['br', 'gzip'])    // undefined
+* ```
+*/
+function negotiateEncoding(acceptEncoding, supported) {
+	if (!acceptEncoding) return;
+	const header = Array.isArray(acceptEncoding) ? acceptEncoding.join(",") : acceptEncoding;
+	const listed = /* @__PURE__ */ new Map();
+	let wildcard;
+	for (const part of header.split(",")) {
+		const semi = part.indexOf(";");
+		const name = (semi === -1 ? part : part.slice(0, semi)).trim().toLowerCase();
+		if (!name) continue;
+		const q = semi === -1 ? 1 : parseQ(part.slice(semi + 1));
+		if (name === "*") wildcard = q;
+		else listed.set(name, q);
+	}
+	let best;
+	let bestQ = 0;
+	for (const enc of supported) {
+		const q = listed.get(enc) ?? wildcard ?? 0;
+		if (q > bestQ) {
+			best = enc;
+			bestQ = q;
+		}
+	}
+	return best;
+}
+function parseQ(params) {
+	for (const param of params.split(";")) {
+		const eq = param.indexOf("=");
+		if (eq !== -1 && param.slice(0, eq).trim().toLowerCase() === "q") {
+			const q = Number(param.slice(eq + 1).trim());
+			return Number.isFinite(q) && q > 0 ? Math.min(q, 1) : 0;
+		}
+	}
+	return 1;
+}
+/** @internal Compresses a rendered body of `size` bytes with the given coding (async, libuv threadpool). */
+function compressResponseBody(body, size, encoding, opts) {
+	return new Promise((resolve, reject) => {
+		const done = (error, result) => {
+			if (error) reject(error);
+			else resolve(result);
+		};
+		if (encoding === "br") brotliCompress(body, { params: {
+			[constants.BROTLI_PARAM_QUALITY]: opts.brotliQuality,
+			[constants.BROTLI_PARAM_MODE]: constants.BROTLI_MODE_TEXT,
+			[constants.BROTLI_PARAM_SIZE_HINT]: size
+		} }, done);
+		else gzip(body, { level: opts.gzipLevel }, done);
+	});
+}
+/** @internal Cache key for compressed bytes of a prerendered body (coding + level). */
+function compressionCacheKey(encoding, opts) {
+	return encoding === "br" ? `br${opts.brotliQuality}` : `gzip${opts.gzipLevel}`;
+}
+/**
+* @internal Appends `token` to a `Vary` header value unless it (or `*`) is already listed.
+* Returns `undefined` when nothing has to change.
+*/
+function mergeVary(existing, token) {
+	if (!existing || existing.length === 0) return token;
+	const value = Array.isArray(existing) ? existing.join(", ") : existing;
+	const lower = token.toLowerCase();
+	for (const part of value.split(",")) {
+		const name = part.trim().toLowerCase();
+		if (name === lower || name === "*") return;
+	}
+	return value.trim() ? `${value}, ${token}` : token;
+}
+
 //#endregion
 //#region packages/event-http/src/utils/time.ts
 function convertTime(time, unit = "ms") {
@@ -887,8 +1001,10 @@ var HttpResponse = class {
 	* @param _req - The underlying Node.js `IncomingMessage`.
 	* @param _logger - Logger instance for error reporting.
 	* @param defaultHeaders - Optional headers to pre-populate on this response (e.g. from `securityHeaders()`).
+	* @param _captureMode - Finalize state on `send()` without writing to `_res` (programmatic fetch).
+	* @param compression - App-level response compression settings (`undefined` = off).
 	*/
-	constructor(_res, _req, _logger, defaultHeaders, _captureMode = false) {
+	constructor(_res, _req, _logger, defaultHeaders, _captureMode = false, compression) {
 		this._res = _res;
 		this._req = _req;
 		this._logger = _logger;
@@ -898,6 +1014,7 @@ var HttpResponse = class {
 		this._headers = {};
 		this._hasCookies = false;
 		this._responded = false;
+		this._compression = compression;
 		if (defaultHeaders) for (const key in defaultHeaders) this._headers[key] = defaultHeaders[key];
 	}
 	/** The HTTP status code. If not set, it is inferred automatically when `send()` is called. */
@@ -1030,6 +1147,24 @@ var HttpResponse = class {
 		return this;
 	}
 	/**
+	* Overrides response compression for this response (chainable).
+	*
+	* - `false` — never compress this response (e.g. a body that mixes secrets with reflected input).
+	* - `true` — compress with the app settings, or the defaults when the app has compression off.
+	* - an options object — compress with these settings over the app settings (or the defaults).
+	*
+	* Only regular bodies (strings, numbers, booleans, objects, `Uint8Array`) are compressed; streams
+	* and fetch `Response` bodies are sent as is.
+	*/
+	setCompression(value) {
+		this._compression = value === true ? this._compression ?? resolveCompression(true) : resolveCompression(value, this._compression);
+		return this;
+	}
+	/** Effective compression settings for this response, or `false` when compression is off. */
+	get compression() {
+		return this._compression ?? false;
+	}
+	/**
 	* Returns the underlying Node.js `ServerResponse`.
 	* @param passthrough - If `true`, the framework still manages the response lifecycle. If `false` (default), the response is marked as "responded" and the framework will not touch it.
 	*/
@@ -1067,15 +1202,13 @@ var HttpResponse = class {
 			});
 		}
 		const rendered = this.renderBody();
+		const prerendered = this.takePrerendered();
 		this.autoStatus(!!rendered);
-		if (this.applyPrerenderedEtag()) return new globalThis.Response(null, {
+		if (prerendered?.etag && this.applyPrerenderedEtag(prerendered.etag)) return new globalThis.Response(null, {
 			status: this._status,
 			headers: this._buildWebHeaders()
 		});
-		if (rendered) {
-			const contentLength = typeof rendered === "string" ? Buffer.byteLength(rendered) : rendered.byteLength;
-			this._headers["content-length"] = contentLength.toString();
-		}
+		if (rendered) this._headers["content-length"] = renderedSize(rendered, prerendered).toString();
 		const webBody = method === "HEAD" ? null : rendered instanceof Uint8Array ? rendered.buffer : rendered || null;
 		const webResponse = new globalThis.Response(webBody, {
 			status: this._status,
@@ -1122,7 +1255,7 @@ var HttpResponse = class {
 			if (!this._headers["content-type"]) this._headers["content-type"] = "application/json";
 			const prerendered = getPrerenderedJson(body);
 			if (prerendered) {
-				this._prerenderedEtag = prerendered.etag;
+				this._prerendered = prerendered;
 				return prerendered.json;
 			}
 			return JSON.stringify(body);
@@ -1145,6 +1278,7 @@ var HttpResponse = class {
 	*
 	* Flushes all accumulated headers (including cookies) in a single `writeHead()` call,
 	* then writes the body. Supports `Readable` streams, `fetch` `Response` objects, and regular values.
+	* Returns a Promise (which never rejects) for streamed bodies and compressed regular bodies.
 	*
 	* @throws Error if the response was already sent.
 	*/
@@ -1164,7 +1298,7 @@ var HttpResponse = class {
 		const method = this._req.method;
 		if (body instanceof Readable$1) return this.sendStream(body, method);
 		if (hasFetchResponse && body instanceof Response) return this.sendFetchResponse(body, method);
-		this.sendRegular(method);
+		return this.sendRegular(method);
 	}
 	finalizeCookies() {
 		if (!this._hasCookies) return;
@@ -1182,12 +1316,9 @@ var HttpResponse = class {
 	* matches into a bodiless `304`. Returns `true` when the response became `304`.
 	* Other methods get no ETag (a validator on e.g. a PUT response would describe the stored resource).
 	*/
-	applyPrerenderedEtag() {
-		const etag = this._prerenderedEtag;
-		if (!etag) return false;
-		this._prerenderedEtag = void 0;
+	applyPrerenderedEtag(etag) {
 		const method = this._req.method;
-		if (method !== "GET" && method !== "HEAD" || this._status < 200 || this._status > 299 || this.hasHeaderIgnoreCase("etag")) return false;
+		if (method !== "GET" && method !== "HEAD" || this._status < 200 || this._status > 299 || this.headerKeyIgnoreCase("etag") !== void 0) return false;
 		this._headers.etag = etag;
 		if (this._status !== EHttpStatusCode.OK || !ifNoneMatchHas(this._req.headers["if-none-match"], etag)) return false;
 		this._status = EHttpStatusCode.NotModified;
@@ -1197,9 +1328,16 @@ var HttpResponse = class {
 		}
 		return true;
 	}
-	hasHeaderIgnoreCase(name) {
-		for (const key in this._headers) if (key.toLowerCase() === name) return true;
-		return false;
+	/** Returns the stored key of header `name` (lower-case) in whatever casing it was set with. */
+	headerKeyIgnoreCase(name) {
+		if (name in this._headers) return name;
+		for (const key in this._headers) if (key.toLowerCase() === name) return key;
+	}
+	/** Returns and clears the prerender entry picked by the last `renderBody()`. */
+	takePrerendered() {
+		const prerendered = this._prerendered;
+		this._prerendered = void 0;
+		return prerendered;
 	}
 	autoStatus(hasBody) {
 		if (this._status) return;
@@ -1246,17 +1384,101 @@ var HttpResponse = class {
 		return this.pipeToResponse(Readable$1.fromWeb(fetchResponse.body), "Error streaming fetch response body");
 	}
 	sendRegular(method) {
-		const renderedBody = this.renderBody();
-		this.autoStatus(!!renderedBody);
-		if (this.applyPrerenderedEtag()) {
+		const body = this.renderBody();
+		const prerendered = this.takePrerendered();
+		const size = renderedSize(body, prerendered);
+		this.autoStatus(!!body);
+		const compression = this._compression && this.isCompressible(size, this._compression) ? this._compression : void 0;
+		if (compression) this.appendVary("Accept-Encoding");
+		if (prerendered?.etag && this.applyPrerenderedEtag(prerendered.etag)) {
 			this._res.writeHead(this._status, this._headers).end();
 			return;
 		}
-		const contentLength = typeof renderedBody === "string" ? Buffer.byteLength(renderedBody) : renderedBody.byteLength;
-		this._headers["content-length"] = contentLength.toString();
-		this._res.writeHead(this._status, this._headers).end(method === "HEAD" ? "" : renderedBody);
+		if (compression && method !== "HEAD") {
+			const encoding = negotiateEncoding(this._req.headers["accept-encoding"], compression.encodings);
+			if (encoding) return this.sendCompressed(body, size, encoding, compression, prerendered);
+		}
+		this._headers["content-length"] = size.toString();
+		this._res.writeHead(this._status, this._headers).end(method === "HEAD" ? "" : body);
+	}
+	/**
+	* Whether a rendered regular body of `size` bytes may be compressed — independent of the
+	* request's `Accept-Encoding` (and of HEAD, which is answered uncompressed).
+	*/
+	isCompressible(size, opts) {
+		const status = this._status;
+		if (!size || size < opts.threshold || status < 200 || status === 204 || status === 206 || status === 304) return false;
+		let contentType;
+		for (const key in this._headers) {
+			const lower = key.toLowerCase();
+			if (lower === "content-type") contentType = this._headers[key];
+			else if (lower === "content-encoding") return false;
+			else if (lower === "cache-control" && /no-transform/i.test(String(this._headers[key]))) return false;
+		}
+		return typeof contentType === "string" && opts.filter(contentType, this);
+	}
+	/** Adds `token` to the `Vary` header (case-insensitive merge, keeps existing entries). */
+	appendVary(token) {
+		const key = this.headerKeyIgnoreCase("vary") ?? "vary";
+		const merged = mergeVary(this._headers[key], token);
+		if (merged !== void 0) this._headers[key] = merged;
+	}
+	/**
+	* Sends the body compressed with `encoding`. Prerendered bodies are compressed once per coding
+	* and level and the bytes reused (sent synchronously once ready). A compressor failure is
+	* logged and the body is sent uncompressed — headers are not written yet, so that is safe.
+	* Never rejects: a sync handler's `send()` is not awaited.
+	*/
+	sendCompressed(body, size, encoding, opts, prerendered) {
+		let pending;
+		if (prerendered?.json === body) {
+			const cache = prerendered.compressed ??= {};
+			const cacheKey = compressionCacheKey(encoding, opts);
+			let entry = cache[cacheKey];
+			if (!entry) {
+				const promise = compressResponseBody(body, size, encoding, opts);
+				promise.then((bytes) => cache[cacheKey] = bytes, () => delete cache[cacheKey]);
+				entry = cache[cacheKey] = promise;
+			}
+			pending = entry;
+		} else pending = compressResponseBody(body, size, encoding, opts);
+		if (Buffer.isBuffer(pending)) {
+			this.writeDeferred(pending, pending.byteLength, encoding);
+			return;
+		}
+		return pending.then((bytes) => this.writeDeferred(bytes, bytes.byteLength, encoding), (error) => {
+			this._logger.error("Response compression failed, sending uncompressed body", error);
+			this.writeDeferred(body, size);
+		}).catch((error) => {
+			this._logger.error("Failed to send compressed response", error);
+		});
+	}
+	/**
+	* Writes the body picked by `sendCompressed()` — the `encoding`-compressed bytes, or the identity
+	* body after a compressor failure — unless the client went away meanwhile.
+	*/
+	writeDeferred(body, length, encoding) {
+		if (this._res.destroyed) return;
+		if (encoding) {
+			this._headers["content-encoding"] = encoding;
+			for (const key in this._headers) {
+				const lower = key.toLowerCase();
+				if (lower === "content-length" && key !== lower) delete this._headers[key];
+				else if (lower === "etag") {
+					const etag = this._headers[key];
+					if (typeof etag === "string" && etag && !etag.startsWith("W/")) this._headers[key] = `W/${etag}`;
+				}
+			}
+		}
+		this._headers["content-length"] = length.toString();
+		this._res.writeHead(this._status, this._headers).end(body);
 	}
 };
+/** UTF-8 size of a rendered body — computed once per registration for a prerendered body. */
+function renderedSize(body, prerendered) {
+	if (typeof body !== "string") return body.byteLength;
+	return prerendered?.json === body ? prerendered.size ??= Buffer.byteLength(body) : Buffer.byteLength(body);
+}
 /** Converts a Record of headers to a Web Standard `Headers` object. */
 function recordToWebHeaders(record) {
 	const headers = new Headers();
@@ -1630,7 +1852,7 @@ function escapeHtml(value) {
 //#endregion
 //#region packages/event-http/src/response/wooks-http-response.ts
 let framework = {
-	version: "0.7.27",
+	version: "0.7.29",
 	poweredBy: "wooksjs",
 	link: "https://wooks.moost.org/",
 	image: "https://wooks.moost.org/wooks-full-logo.svg"
@@ -1726,6 +1948,7 @@ var WooksHttp = class extends WooksAdapterBase {
 		this.logger = opts?.logger || this.getLogger(`[wooks-http]`);
 		this.ResponseClass = opts?.responseClass ?? WooksHttpResponse;
 		this.eventContextOptions = this.getEventContextOptions();
+		this.compression = resolveCompression(opts?.compression);
 	}
 	/** Registers a handler for all HTTP methods on the given path. */
 	all(path, handler) {
@@ -1842,25 +2065,36 @@ var WooksHttp = class extends WooksAdapterBase {
 	* const server = http.createServer(app.getServerCb())
 	* server.listen(3000)
 	* ```
+	*
+	* Pass `onNoMatch` to mount Wooks as a middleware in front of another handler
+	* (e.g. a Vite dev server). The request is routed first; when no route matches,
+	* `onNoMatch(req, res)` is called directly — before and outside any event context:
+	* no response wrapper is created, no event starts (`current()` throws, no
+	* `ContextInjector` hooks fire) and `onNotFound` is skipped.
 	*/
 	getServerCb(onNoMatch) {
 		const ctxOptions = this.eventContextOptions;
 		const RequestLimits = this.opts?.requestLimits;
 		const notFoundHandler = this.opts?.onNotFound;
 		const defaultHeaders = this.opts?.defaultHeaders;
+		const compression = this.compression;
 		return (req, res) => {
-			const response = new this.ResponseClass(res, req, ctxOptions.logger, defaultHeaders);
 			const method = req.method || "";
 			const url = req.url || "";
+			const match = this.wooks.matchRoute(method, url);
+			if (!match && onNoMatch) {
+				onNoMatch(req, res);
+				return;
+			}
+			const response = new this.ResponseClass(res, req, ctxOptions.logger, defaultHeaders, false, compression);
 			createHttpContext(ctxOptions, {
 				req,
 				response,
 				requestLimits: RequestLimits
 			}, () => {
 				const ctx = current();
-				const handlers = this.wooks.lookupHandlers(method, url, ctx);
+				const handlers = this.wooks.applyRoute(method, match, ctx);
 				if (handlers) return this.processAndCatch(handlers, ctx, response);
-				else if (onNoMatch) onNoMatch(req, res);
 				else if (notFoundHandler) return this.processAndCatch([notFoundHandler], ctx, response);
 				else {
 					this.logger.debug(`404 Not found (${method})${url}`);
@@ -1967,20 +2201,23 @@ var WooksHttp = class extends WooksAdapterBase {
 	}
 	/**
 	* Programmatic route invocation using the Web Standard fetch API.
-	* Goes through the full dispatch pipeline: context creation, route matching,
-	* handler execution, response finalization.
+	* Goes through the full dispatch pipeline: route matching, context creation,
+	* handler execution, response finalization. An unmatched route returns `null`
+	* before any event context is created (the request body is left unread).
 	*
 	* When called from within an existing HTTP context (e.g. during SSR),
 	* identity headers (authorization, cookie) are automatically forwarded
 	* from the calling request unless already present on the given Request.
 	*
 	* @param request - A Web Standard Request object.
-	* @returns A Web Standard Response, or `null` if no route matched (and no `onNotFound` handler is set).
+	* @returns A Web Standard Response, or `null` if no route matched (`onNotFound` is not used here).
 	*/
 	async fetch(request) {
 		const url = new URL(request.url);
 		const method = request.method;
 		const pathname = url.pathname + url.search;
+		const match = this.wooks.matchRoute(method, pathname);
+		if (!match) return null;
 		const callerCtx = tryGetCurrent();
 		let callerReq;
 		if (callerCtx) try {
@@ -2029,13 +2266,11 @@ var WooksHttp = class extends WooksAdapterBase {
 			const ctx = current();
 			if (bodyBuffer) seedRawBody(ctx, bodyBuffer);
 			try {
-				const handlers = this.wooks.lookupHandlers(method, pathname, ctx);
-				if (handlers) {
-					const result = this.processHandlers(handlers, ctx, response);
-					if (result !== null && result !== void 0 && typeof result.then === "function") await result.catch((error) => {
-						if (!response.responded) this.respond(error, response, ctx);
-					});
-				} else return null;
+				const handlers = this.wooks.applyRoute(method, match, ctx);
+				const result = this.processHandlers(handlers, ctx, response);
+				if (result !== null && result !== void 0 && typeof result.then === "function") await result.catch((error) => {
+					if (!response.responded) this.respond(error, response, ctx);
+				});
 			} finally {
 				fakeReq.emit("end");
 				fakeReq.emit("close");
@@ -2236,4 +2471,4 @@ function prepareTestHttpContext(options) {
 }
 
 //#endregion
-export { DEFAULT_FORWARD_HEADERS, DEFAULT_LIMITS, EHttpStatusCode, HttpError, HttpResponse, WooksHttp, WooksHttpResponse, WooksURLSearchParams, createHttpApp, createHttpContext, httpKind, httpStatusCodes, prepareTestHttpContext, prerenderJson, rawBodySlot, recordToWebHeaders, renderCacheControl, securityHeaders, seedRawBody, useAccept, useAuthorization, useCookies, useHeaders, useHttpContext, useLogger, useRequest, useResponse, useRouteParams, useUrlParams };
+export { DEFAULT_FORWARD_HEADERS, DEFAULT_LIMITS, EHttpStatusCode, HttpError, HttpResponse, WooksHttp, WooksHttpResponse, WooksURLSearchParams, createHttpApp, createHttpContext, httpKind, httpStatusCodes, isCompressibleType, negotiateEncoding, prepareTestHttpContext, prerenderJson, rawBodySlot, recordToWebHeaders, renderCacheControl, securityHeaders, seedRawBody, useAccept, useAuthorization, useCookies, useHeaders, useHttpContext, useLogger, useRequest, useResponse, useRouteParams, useUrlParams };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wooksjs/event-http",
-  "version": "0.7.27",
+  "version": "0.7.29",
   "description": "@wooksjs/event-http",
   "keywords": [
     "api",
@@ -42,14 +42,14 @@
   "devDependencies": {
     "typescript": "^5.9.3",
     "vitest": "^3.2.7",
-    "@wooksjs/event-core": "^0.7.27",
-    "wooks": "^0.7.27"
+    "@wooksjs/event-core": "^0.7.29",
+    "wooks": "^0.7.29"
   },
   "peerDependencies": {
     "@prostojs/logger": "^0.4.3",
     "@prostojs/router": "^0.3.5",
-    "wooks": "^0.7.27",
-    "@wooksjs/event-core": "^0.7.27"
+    "@wooksjs/event-core": "^0.7.29",
+    "wooks": "^0.7.29"
   },
   "scripts": {
     "build": "rolldown -c ../../rolldown.config.mjs"