one 2.6.3 → 2.6.5

package/src/cli.ts

@@ -498,7 +498,7 @@ const subCommands = {
 // workaround for having sub-commands but also positional arg for naming in the create flow
 const subMain = defineCommand({
   meta: {
-    name: 'main',
+    name: 'one',
     version: version,
     description: 'Welcome to One',
   },
@@ -507,7 +507,7 @@ const subMain = defineCommand({
 
 const main = defineCommand({
   meta: {
-    name: 'main',
+    name: 'one',
     version: version,
     description: 'Welcome to One',
   },

package/src/server/assetRange.test.ts

@@ -4,12 +4,13 @@ import { withRange } from './assetRange'
 const bytes = Uint8Array.from({ length: 100 }, (_, i) => i)
 
 // the assets binding streams in chunks; split so ranges cross chunk edges
-function asset(headers: Record<string, string> = {}) {
+function asset(headers: Record<string, string> = {}, pulled = { chunks: 0 }) {
   const chunks = [bytes.slice(0, 30), bytes.slice(30, 70), bytes.slice(70)]
   const body = new ReadableStream<Uint8Array>({
-    start(controller) {
-      for (const chunk of chunks) controller.enqueue(chunk)
-      controller.close()
+    pull(controller) {
+      const chunk = chunks[pulled.chunks++]
+      if (chunk) controller.enqueue(chunk)
+      else controller.close()
     },
   })
   return new Response(body, {
@@ -19,8 +20,8 @@ function asset(headers: Record<string, string> = {}) {
   })
 }
 
-function get(range?: string) {
-  return new Request('https://x.test/a.webm', range ? { headers: { range } } : {})
+function get(range?: string, headers: Record<string, string> = {}) {
+  return new Request('https://x.test/a.webm', { headers: range ? { range, ...headers } : headers })
 }
 
 async function body(response: Response) {
@@ -57,10 +58,49 @@ describe('withRange', () => {
     expect(await body(clamped)).toEqual([98, 99])
   })
 
-  it('answers 416 past the end', async () => {
-    const res = await withRange(get('bytes=100-'), asset())
-    expect(res.status).toBe(416)
-    expect(res.headers.get('content-range')).toBe('bytes */100')
+  it('answers 416 past the end without the full length', async () => {
+    for (const headers of [{}, { 'content-length': '100' }] as Record<string, string>[]) {
+      const res = await withRange(get('bytes=100-'), asset(headers))
+      expect(res.status).toBe(416)
+      expect(res.headers.get('content-range')).toBe('bytes */100')
+      expect(res.headers.get('content-length')).toBeNull()
+      expect(await body(res)).toEqual([])
+    }
+  })
+
+  it('streams only the requested bytes when the length is known', async () => {
+    const pulled = { chunks: 0 }
+    const res = await withRange(get('bytes=0-1'), asset({ 'content-length': '100' }, pulled))
+    expect(res.status).toBe(206)
+    expect(res.headers.get('content-range')).toBe('bytes 0-1/100')
+    expect(res.headers.get('content-length')).toBe('2')
+    expect(await body(res)).toEqual([0, 1])
+    expect(pulled.chunks).toBeLessThan(3)
+
+    const cross = await withRange(get('bytes=25-74'), asset({ 'content-length': '100' }))
+    expect(await body(cross)).toEqual(Array.from(bytes.slice(25, 75)))
+
+    const suffix = await withRange(get('bytes=-5'), asset({ 'content-length': '100' }))
+    expect(suffix.headers.get('content-range')).toBe('bytes 95-99/100')
+    expect(await body(suffix)).toEqual([95, 96, 97, 98, 99])
+  })
+
+  it('honors If-Range only for a matching strong validator', async () => {
+    const tagged = { etag: '"new"', 'last-modified': 'Mon, 12 Oct 2026 00:00:00 GMT' }
+    const fresh = await withRange(get('bytes=0-1', { 'if-range': '"new"' }), asset(tagged))
+    expect(fresh.status).toBe(206)
+    const date = await withRange(
+      get('bytes=0-1', { 'if-range': 'Mon, 12 Oct 2026 00:00:00 GMT' }),
+      asset(tagged)
+    )
+    expect(date.status).toBe(206)
+
+    for (const ifRange of ['"old"', 'W/"new"', 'Sun, 11 Oct 2026 00:00:00 GMT']) {
+      const response = asset(tagged)
+      expect(await withRange(get('bytes=0-1', { 'if-range': ifRange }), response)).toBe(response)
+    }
+    const weak = asset({ etag: 'W/"new"' })
+    expect(await withRange(get('bytes=0-1', { 'if-range': 'W/"new"' }), weak)).toBe(weak)
   })
 
   it('keeps the full response without a usable single range', async () => {

package/src/server/assetRange.ts

@@ -1,15 +1,17 @@
 // cloudflare's assets binding ignores Range and always answers 200 with the
-// whole file and no content-length, which safari refuses for <video>. this
-// reads that full response and answers the 206 (or 416) the browser asked
-// for. multi-range requests keep the full 200, which http allows.
+// whole file, usually with no content-length, which safari refuses for
+// <video>. this answers the 206 (or 416) the browser asked for. multi-range
+// requests and stale If-Range validators keep the full 200, which http allows.
 export async function withRange(request: Request, response: Response): Promise<Response> {
   const range = request.headers.get('range')
   if (
     !range ||
     request.method !== 'GET' ||
     response.status !== 200 ||
+    !response.body ||
     response.headers.has('content-range') ||
-    response.headers.has('content-encoding')
+    response.headers.has('content-encoding') ||
+    !ifRangeMatches(request.headers.get('if-range'), response.headers)
   ) {
     return response
   }
@@ -17,9 +19,43 @@ export async function withRange(request: Request, response: Response): Promise<R
   const match = /^bytes=(\d*)-(\d*)$/.exec(range.trim())
   if (!match || (!match[1] && !match[2])) return response
 
-  const bytes = new Uint8Array(await response.arrayBuffer())
-  const size = bytes.byteLength
+  const length = response.headers.get('content-length')
+  const known = length && /^\d+$/.test(length) ? Number(length) : undefined
 
+  const headers = new Headers(response.headers)
+  headers.set('accept-ranges', 'bytes')
+  headers.delete('content-length')
+
+  // only the requested bytes are kept in memory. with a known size reading
+  // stops after them; without one the size only comes from reading to the end
+  const { size, kept, keptStart } = await readRange(response.body, match, known)
+  const span = resolve(match, size)
+  if (!span) {
+    headers.set('content-range', `bytes */${size}`)
+    return new Response(null, { status: 416, headers })
+  }
+  headers.set('content-range', `bytes ${span.start}-${span.end}/${size}`)
+  headers.set('content-length', String(span.end - span.start + 1))
+  return new Response(kept.subarray(span.start - keptStart, span.end - keptStart + 1), {
+    status: 206,
+    headers,
+  })
+}
+
+// rfc 9110 13.1.5: honor the range only when the validator still matches,
+// using a strong etag comparison or an exact last-modified date
+function ifRangeMatches(ifRange: string | null, headers: Headers) {
+  if (!ifRange) return true
+  const value = ifRange.trim()
+  if (value.startsWith('"')) {
+    const etag = headers.get('etag')
+    return !!etag && !etag.startsWith('W/') && etag === value
+  }
+  if (value.startsWith('W/')) return false
+  return headers.get('last-modified') === value
+}
+
+function resolve(match: RegExpExecArray, size: number) {
   let start: number
   let end: number
   if (!match[1]) {
@@ -30,16 +66,56 @@ export async function withRange(request: Request, response: Response): Promise<R
     start = Number(match[1])
     end = match[2] ? Math.min(Number(match[2]), size - 1) : size - 1
   }
+  if (start >= size || start > end) return
+  return { start, end }
+}
 
-  const headers = new Headers(response.headers)
-  headers.set('accept-ranges', 'bytes')
+async function readRange(
+  body: ReadableStream<Uint8Array>,
+  match: RegExpExecArray,
+  known: number | undefined
+) {
+  const span = known === undefined ? undefined : (resolve(match, known) ?? { start: known, end: -1 })
+  // an unknown-size suffix range keeps a rolling tail of the requested length
+  const suffix = !span && !match[1] ? Number(match[2]) : 0
+  const from = span ? span.start : match[1] ? Number(match[1]) : 0
+  const to = span ? span.end : match[2] && match[1] ? Number(match[2]) : Number.POSITIVE_INFINITY
 
-  if (start >= size || start > end) {
-    headers.set('content-range', `bytes */${size}`)
-    return new Response(null, { status: 416, headers })
+  const chunks: Uint8Array[] = []
+  let keptBytes = 0
+  let size = 0
+  const reader = body.getReader()
+  while (known === undefined || size <= to) {
+    const { done, value } = await reader.read()
+    if (done) break
+    const chunkStart = size
+    size += value.byteLength
+    if (suffix) {
+      chunks.push(value)
+      keptBytes += value.byteLength
+      // drop whole chunks that fall before the rolling tail
+      while (chunks.length > 1 && keptBytes - chunks[0].byteLength >= suffix) {
+        keptBytes -= chunks.shift()!.byteLength
+      }
+      continue
+    }
+    const lo = Math.max(from, chunkStart)
+    const hi = Math.min(to + 1, size)
+    if (hi > lo) {
+      chunks.push(value.subarray(lo - chunkStart, hi - chunkStart))
+      keptBytes += hi - lo
+    }
+  }
+  if (known !== undefined) {
+    await reader.cancel()
+    size = known
   }
 
-  headers.set('content-range', `bytes ${start}-${end}/${size}`)
-  headers.set('content-length', String(end - start + 1))
-  return new Response(bytes.subarray(start, end + 1), { status: 206, headers })
+  const kept = new Uint8Array(keptBytes)
+  let at = 0
+  for (const chunk of chunks) {
+    kept.set(chunk, at)
+    at += chunk.byteLength
+  }
+  return { size, kept, keptStart: suffix ? size - keptBytes : from }
 }

package/types/server/assetRange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assetRange.d.ts","sourceRoot":"","sources":["../../src/server/assetRange.ts"],"names":[],"mappings":"AAIA,wBAAsB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAwCvF"}
+{"version":3,"file":"assetRange.d.ts","sourceRoot":"","sources":["../../src/server/assetRange.ts"],"names":[],"mappings":"AAIA,wBAAsB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsCvF"}