webspresso 0.0.102 → 0.0.104

package/.agents/ORM.md

@@ -51,7 +51,9 @@ import { defineModel, zdb } from 'webspresso';
 export default defineModel({
   name: 'Product',
   table: 'products',
-  schema: zdb.schema({
+  timestamps: true, // auto-injects createdAt & updatedAt into schema & scopes
+  softDelete: true, // auto-injects deletedAt & manages soft-delete scope
+  schema: {
     id: zdb.id(),
     name: zdb.string().min(2),
     slug: zdb.string().unique(),
@@ -61,9 +63,7 @@ export default defineModel({
     metadata: zdb.json({ optional: true }),
     category_id: zdb.integer(),
     active: zdb.boolean({ default: true }),
-    created_at: zdb.timestamp({ auto: 'create' }),
-    updated_at: zdb.timestamp({ auto: 'update' }),
-  }),
+  },
   relations: {
     category: { type: 'belongsTo', model: 'Category', foreignKey: 'category_id' },
     reviews: { type: 'hasMany', model: 'Review', foreignKey: 'product_id' },
@@ -81,6 +81,13 @@ export default defineModel({
 });
 ```
 
+### Automatic Timestamps & Soft Deletes (`timestamps`, `softDelete`)
+Instead of manually defining boilerplate timestamp and soft delete columns in `schema`, configure them declaratively:
+- **Top-level / Options:** `timestamps: true` (or `options: { timestamps: true }`) automatically injects `createdAt` and `updatedAt` into the Zod schema, validation rules, column map, and Knex migrations.
+- **Soft Deletes:** `softDelete: true` (or `softDeletes: true`) automatically injects `deletedAt` (nullable/optional) into the schema and activates the repository `whereNull('deletedAt')` soft-delete scope.
+- **Custom column names & snake_case:** `timestamps: { snakeCase: true }` or `timestamps: { createdAt: 'created_at', updatedAt: 'updated_at' }`, `softDelete: { deletedAt: 'deleted_at' }`.
+- **Explicit Schema Spread:** `...zdb.timestamps()` and `...zdb.softDeletes()` are also supported for explicit schema definitions.
+
 ### Supported `zdb` Data Types
 - `zdb.id()` — Primary key (BigInt / Auto-increment)
 - `zdb.string({ max, unique, optional, sortable })` — String / VarChar
@@ -90,6 +97,8 @@ export default defineModel({
 - `zdb.file()` — File asset URL / upload path (non-sortable by default)
 - `zdb.json()` — Serialized JSON column (non-sortable by default)
 - `zdb.timestamp({ auto, sortable })` — Timestamp (`auto: 'create'` / `auto: 'update'`)
+- `zdb.timestamps({ snakeCase })` — Timestamp pair (`createdAt`, `updatedAt`)
+- `zdb.softDelete()`, `zdb.softDeletes({ snakeCase })` — Soft delete timestamp (`deletedAt`)
 
 *Note: All `zdb` types support chainable `.config({ sortable: boolean })` or options object `{ sortable: boolean }`.*
 

package/.agents/skills/webspresso-orm-and-database/SKILL.md

@@ -21,8 +21,10 @@ module.exports = defineModel({
   name: 'Product',
   table: 'products',
   primaryKey: 'id',
+  timestamps: true, // auto-injects createdAt & updatedAt into schema & scopes
+  softDelete: true, // auto-injects deletedAt & enables soft-delete scope
   
-  schema: zdb.object({
+  schema: {
     id: zdb.id(),
     name: zdb.string().min(1).max(255),
     slug: zdb.string().unique(),
@@ -30,10 +32,7 @@ module.exports = defineModel({
     in_stock: zdb.boolean().default(true),
     metadata: zdb.json().optional(),
     user_id: zdb.foreignKey('users.id'),
-    created_at: zdb.timestamp().autoCreate(),
-    updated_at: zdb.timestamp().autoUpdate(),
-    deleted_at: zdb.timestamp().nullable(),
-  }),
+  },
 
   relations: {
     user: {

package/README.md

@@ -115,13 +115,13 @@ const { defineModel, zdb } = require('webspresso');
 module.exports = defineModel({
   name: 'Note',
   table: 'notes',
+  timestamps: true, // auto-injects createdAt & updatedAt into schema & scopes
+  softDelete: true, // auto-injects deletedAt & enables soft-delete scope
   schema: {
     id: zdb.id(),
     title: zdb.string(200),
     content: zdb.text(),
     userId: zdb.integer(),
-    ...zdb.timestamps(),
-    ...zdb.softDeletes(),
   },
   relations: {
     user: { type: 'belongsTo', model: 'User', foreignKey: 'userId' },

package/bin/commands/dev.js

@@ -13,8 +13,9 @@ const { spawn } = require('child_process');
 function buildWatchArgs() {
   const args = ['--watch'];
   
-  // Add watch paths for common directories
-  const watchPaths = ['pages', 'models', 'views'];
+  // Add watch paths for server-side code directories (services, models, config, pages)
+  // Note: views contains Nunjucks templates which are live-reloaded in-memory by devReloadHub
+  const watchPaths = ['pages', 'models', 'services', 'config'];
   
   for (const dir of watchPaths) {
     if (fs.existsSync(dir)) {

package/bin/utils/orm-map-html.js

@@ -4,6 +4,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { escapeHtml } = require('../../core/utils/html');
 
 /**
  * @param {object} snapshot - { generatedAt, models }
@@ -661,14 +662,7 @@ function buildOrmMapHtml(snapshot, mermaidSource, meta = {}) {
 `;
 }
 
-function escapeHtml(s) {
-  if (s == null) return '';
-  return String(s)
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;');
-}
+
 
 /**
  * Optional: read package name from cwd/package.json

package/core/auth/jwt.js

@@ -5,6 +5,9 @@
  */
 
 const crypto = require('crypto');
+const { safeCompare } = require('../utils/crypto');
+
+const HS256_HEADER_BASE64URL = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9';
 
 /**
  * Base64URL encode string or Buffer
@@ -12,12 +15,9 @@ const crypto = require('crypto');
  * @returns {string}
  */
 function base64UrlEncode(input) {
-  const buf = Buffer.isBuffer(input) ? input : Buffer.from(input, 'utf8');
-  return buf
-    .toString('base64')
-    .replace(/=/g, '')
-    .replace(/\+/g, '-')
-    .replace(/\//g, '_');
+  return Buffer.isBuffer(input)
+    ? input.toString('base64url')
+    : Buffer.from(String(input), 'utf8').toString('base64url');
 }
 
 /**
@@ -26,11 +26,7 @@ function base64UrlEncode(input) {
  * @returns {string}
  */
 function base64UrlDecode(input) {
-  let base64 = input.replace(/-/g, '+').replace(/_/g, '/');
-  while (base64.length % 4 !== 0) {
-    base64 += '=';
-  }
-  return Buffer.from(base64, 'base64').toString('utf8');
+  return Buffer.from(String(input), 'base64url').toString('utf8');
 }
 
 /**
@@ -110,16 +106,14 @@ function signJwt(payload, secret, options = {}) {
     ...payload,
   };
 
-  const encodedHeader = base64UrlEncode(JSON.stringify(header));
+  const encodedHeader = algorithm === 'HS256' ? HS256_HEADER_BASE64URL : base64UrlEncode(JSON.stringify(header));
   const encodedPayload = base64UrlEncode(JSON.stringify(fullPayload));
 
   const signingInput = `${encodedHeader}.${encodedPayload}`;
-  const signature = crypto
+  const encodedSignature = crypto
     .createHmac('sha256', secret)
     .update(signingInput)
-    .digest();
-
-  const encodedSignature = base64UrlEncode(signature);
+    .digest('base64url');
 
   return `${signingInput}.${encodedSignature}`;
 }
@@ -177,12 +171,9 @@ function verifyJwt(token, secret, options = {}) {
     .update(signingInput)
     .digest();
 
-  const actualSignatureBuf = Buffer.from(encodedSignature.replace(/-/g, '+').replace(/_/g, '/'), 'base64');
+  const actualSignatureBuf = Buffer.from(encodedSignature, 'base64url');
 
-  if (
-    expectedSignatureBuf.length !== actualSignatureBuf.length ||
-    !crypto.timingSafeEqual(expectedSignatureBuf, actualSignatureBuf)
-  ) {
+  if (!safeCompare(expectedSignatureBuf, actualSignatureBuf)) {
     throw new Error('Invalid JWT signature');
   }
 

package/core/auth/oauth.js

@@ -6,6 +6,8 @@
  */
 
 const crypto = require('crypto');
+const { fetchWithTimeout } = require('../utils/fetch');
+const { safeCompare } = require('../utils/crypto');
 
 /**
  * Custom error class for OAuth operations
@@ -57,14 +59,17 @@ const DEFAULT_PROVIDERS = {
     userEmailsUrl: 'https://api.github.com/user/emails',
     defaultScopes: ['read:user', 'user:email'],
     defaultParams: {},
-    async fetchExtra(tokens) {
+    async fetchExtra(tokens, options = {}) {
       try {
-        const res = await fetch('https://api.github.com/user/emails', {
+        const timeout = typeof options?.timeout === 'number' ? options.timeout : 10000;
+        const res = await fetchWithTimeout('https://api.github.com/user/emails', {
           headers: {
             Authorization: `Bearer ${tokens.access_token}`,
             Accept: 'application/vnd.github.v3+json',
             'User-Agent': 'Webspresso-OAuth',
           },
+          timeout,
+          signal: options?.signal,
         });
         if (res.ok) {
           const emails = await res.json();
@@ -78,7 +83,7 @@ const DEFAULT_PROVIDERS = {
           }
         }
       } catch {
-        // Fallback gracefully if email endpoint is unreachable
+        // Fallback gracefully if email endpoint is unreachable or times out
       }
       return null;
     },
@@ -167,10 +172,7 @@ function verifySignedState(stateString, secret, maxAgeMs = 10 * 60 * 1000) {
     .update(body)
     .digest('base64url');
 
-  const bufA = Buffer.from(signature);
-  const bufB = Buffer.from(expectedSignature);
-
-  if (bufA.length !== bufB.length || !crypto.timingSafeEqual(bufA, bufB)) {
+  if (!safeCompare(signature, expectedSignature)) {
     throw new OAuthError('OAuth state signature verification failed', 'INVALID_STATE');
   }
 
@@ -202,6 +204,9 @@ class OAuthClient {
   constructor(config = {}) {
     this.secret = config.secret || process.env.OAUTH_SECRET || process.env.SESSION_SECRET || 'webspresso-oauth-secret';
     this.stateTtlMs = config.stateTtlMs || 10 * 60 * 1000;
+    this.timeout = typeof (config.timeout || config.requestTimeout) === 'number'
+      ? (config.timeout || config.requestTimeout)
+      : 10000;
     this.providers = {};
 
     if (config.providers) {
@@ -227,6 +232,7 @@ class OAuthClient {
       redirectUri: options.redirectUri || options.redirect_uri || builtin.redirectUri,
       scopes: options.scopes || options.scope || builtin.defaultScopes || [],
       params: { ...(builtin.defaultParams || {}), ...(options.params || {}) },
+      timeout: typeof options.timeout === 'number' ? options.timeout : (builtin.timeout || this.timeout || 10000),
     };
     return this;
   }
@@ -330,7 +336,7 @@ class OAuthClient {
    * @param {string} [params.codeVerifier]
    * @returns {Promise<Object>} Token response
    */
-  async exchangeCode(providerName, { code, redirectUri, codeVerifier }) {
+  async exchangeCode(providerName, { code, redirectUri, codeVerifier, timeout, signal } = {}) {
     const provider = this.getProvider(providerName);
 
     if (!code) {
@@ -354,9 +360,13 @@ class OAuthClient {
       bodyParams.set('code_verifier', codeVerifier);
     }
 
+    const requestTimeout = typeof timeout === 'number'
+      ? timeout
+      : (provider.timeout || this.timeout || 10000);
+
     let res;
     try {
-      res = await fetch(provider.tokenUrl, {
+      res = await fetchWithTimeout(provider.tokenUrl, {
         method: 'POST',
         headers: {
           'Content-Type': 'application/x-www-form-urlencoded',
@@ -364,6 +374,8 @@ class OAuthClient {
           'User-Agent': 'Webspresso-OAuth',
         },
         body: bodyParams.toString(),
+        timeout: requestTimeout,
+        signal,
       });
     } catch (err) {
       throw new OAuthError(`Token exchange network request failed: ${err.message}`, 'NETWORK_ERROR', err);
@@ -398,7 +410,7 @@ class OAuthClient {
    * @param {Object} tokens - Tokens object returned from exchangeCode
    * @returns {Promise<Object>} Normalized user profile
    */
-  async fetchUserProfile(providerName, tokens) {
+  async fetchUserProfile(providerName, tokens, options = {}) {
     const provider = this.getProvider(providerName);
     const accessToken = tokens.access_token || tokens.accessToken;
 
@@ -406,19 +418,26 @@ class OAuthClient {
       throw new OAuthError('Missing access_token for user profile retrieval', 'MISSING_TOKEN');
     }
 
+    const requestTimeout = typeof options?.timeout === 'number'
+      ? options.timeout
+      : (provider.timeout || this.timeout || 10000);
+    const signal = options?.signal;
+
     let extraData = null;
     if (typeof provider.fetchExtra === 'function') {
-      extraData = await provider.fetchExtra(tokens);
+      extraData = await provider.fetchExtra(tokens, { timeout: requestTimeout, signal });
     }
 
     let res;
     try {
-      res = await fetch(provider.userInfoUrl, {
+      res = await fetchWithTimeout(provider.userInfoUrl, {
         headers: {
           Authorization: `Bearer ${accessToken}`,
           Accept: 'application/json',
           'User-Agent': 'Webspresso-OAuth',
         },
+        timeout: requestTimeout,
+        signal,
       });
     } catch (err) {
       throw new OAuthError(`User profile fetch failed: ${err.message}`, 'NETWORK_ERROR', err);
@@ -457,7 +476,7 @@ class OAuthClient {
    * @param {string} [params.redirectUri] - Redirect URI
    * @returns {Promise<{ provider: string, user: Object, tokens: Object, stateData: Object }>}
    */
-  async handleCallback(providerName, { code, state, redirectUri }) {
+  async handleCallback(providerName, { code, state, redirectUri, timeout, signal } = {}) {
     if (!state) {
       throw new OAuthError('Missing OAuth state in callback', 'INVALID_STATE');
     }
@@ -483,10 +502,15 @@ class OAuthClient {
       code,
       redirectUri: effectiveRedirectUri,
       codeVerifier,
+      timeout,
+      signal,
     });
 
     // Fetch normalized profile
-    const user = await this.fetchUserProfile(providerName, tokens);
+    const user = await this.fetchUserProfile(providerName, tokens, {
+      timeout,
+      signal,
+    });
 
     return {
       provider: providerName,

package/core/auth/totp.js

@@ -163,20 +163,8 @@ function generateHotp(secret, counter, options = {}) {
   return token;
 }
 
-/**
- * Timing-safe token equality check
- * @param {string} a
- * @param {string} b
- * @returns {boolean}
- */
-function timingSafeTokenCompare(a, b) {
-  if (typeof a !== 'string' || typeof b !== 'string') return false;
-  if (a.length !== b.length) return false;
-
-  const bufA = Buffer.from(a);
-  const bufB = Buffer.from(b);
-  return crypto.timingSafeEqual(bufA, bufB);
-}
+const { safeCompare } = require('../utils/crypto');
+const timingSafeTokenCompare = safeCompare;
 
 /**
  * Verify HOTP token against counter
@@ -412,7 +400,7 @@ function verifyRecoveryCode(code, hashedCodes = []) {
       continue;
     }
     const candidateBuf = Buffer.from(candidateHash, 'hex');
-    if (crypto.timingSafeEqual(targetBuf, candidateBuf)) {
+    if (safeCompare(targetBuf, candidateBuf)) {
       matchedIndex = i;
       break;
     }

package/core/auth/user-agent.js

@@ -17,27 +17,29 @@
  * @property {boolean} isBot
  */
 
+const { getClientIp } = require('../utils/ip');
+
 /**
- * Extract client IP address handling proxies
- * @param {Object} req - Express / Node.js HTTP request
- * @returns {string}
+ * Parse raw User-Agent header string into structured device info
+ * Zero external dependencies — pure regex extraction
+ * 
+ * @param {string} [userAgent='']
+ * @returns {DeviceInfo}
  */
-function getClientIp(req) {
-  if (!req) return '127.0.0.1';
-
-  const forwarded = req.headers?.['x-forwarded-for'];
-  if (forwarded) {
-    const ips = typeof forwarded === 'string' ? forwarded.split(',') : forwarded;
-    const first = Array.isArray(ips) ? ips[0] : ips;
-    if (first) return first.trim();
-  }
+const MAX_UA_CACHE = 512;
+const uaCache = new Map();
 
-  return req.headers?.['x-real-ip'] ||
-    req.ip ||
-    req.connection?.remoteAddress ||
-    req.socket?.remoteAddress ||
-    '127.0.0.1';
-}
+const EMPTY_DEVICE_INFO = Object.freeze({
+  browser: 'Unknown',
+  os: 'Unknown',
+  device: 'unknown',
+  isMobile: false,
+  isTablet: false,
+  isDesktop: false,
+  isBot: false,
+});
+
+const BOT_PATTERN = /googlebot|bingbot|yandex|baiduspider|duckduckbot|slurp|twitterbot|facebookexternalhit|rogerbot|linkedinbot|embedly|quora link preview|showyoubot|outbrain|pinterest\/|slackbot|vkshare|w3c_validator|whatsapp|curl|wget|postman/i;
 
 /**
  * Parse raw User-Agent header string into structured device info
@@ -50,34 +52,30 @@ function parseUserAgent(userAgent = '') {
   const ua = String(userAgent || '').trim();
 
   if (!ua) {
-    return {
-      browser: 'Unknown',
-      os: 'Unknown',
-      device: 'unknown',
-      isMobile: false,
-      isTablet: false,
-      isDesktop: false,
-      isBot: false,
-    };
+    return { ...EMPTY_DEVICE_INFO };
+  }
+
+  const cached = uaCache.get(ua);
+  if (cached) {
+    return { ...cached };
   }
 
   // 1. Detect Bots / Crawlers
-  const botPattern = /googlebot|bingbot|yandex|baiduspider|duckduckbot|slurp|twitterbot|facebookexternalhit|rogerbot|linkedinbot|embedly|quora link preview|showyoubot|outbrain|pinterest\/|slackbot|vkshare|w3c_validator|whatsapp|curl|wget|postman/i;
-  const isBot = botPattern.test(ua);
+  const isBot = BOT_PATTERN.test(ua);
 
   // 2. Detect Operating System
   let os = 'Unknown';
+  let match;
   if (/iPad/i.test(ua)) {
-    const match = ua.match(/OS ([\d_\.]+)/i);
+    match = ua.match(/OS ([\d_\.]+)/i);
     os = match ? `iPadOS ${match[1].replace(/_/g, '.')}` : 'iPadOS';
   } else if (/iPhone|iPod/i.test(ua)) {
-    const match = ua.match(/OS ([\d_\.]+)/i);
+    match = ua.match(/OS ([\d_\.]+)/i);
     os = match ? `iOS ${match[1].replace(/_/g, '.')}` : 'iOS';
-  } else if (/Android/i.test(ua)) {
-    const match = ua.match(/Android (\d+(\.\d+)?)/i);
-    os = match ? `Android ${match[1]}` : 'Android';
+  } else if ((match = ua.match(/Android (\d+(\.\d+)?)/i))) {
+    os = `Android ${match[1]}`;
   } else if (/Macintosh|Mac OS X/i.test(ua)) {
-    const match = ua.match(/Mac OS X ([\d_\.]+)/i);
+    match = ua.match(/Mac OS X ([\d_\.]+)/i);
     if (match) {
       const ver = match[1].replace(/_/g, '.');
       os = `macOS ${ver}`;
@@ -100,30 +98,22 @@ function parseUserAgent(userAgent = '') {
 
   // 3. Detect Browser
   let browser = 'Unknown';
-  if (/Edg(e|A|iOS)?\/(\d+)/i.test(ua)) {
-    const match = ua.match(/Edg(e|A|iOS)?\/(\d+)/i);
-    browser = `Edge ${match ? match[2] : ''}`.trim();
-  } else if (/OPR\/(\d+)/i.test(ua)) {
-    const match = ua.match(/OPR\/(\d+)/i);
-    browser = `Opera ${match ? match[1] : ''}`.trim();
-  } else if (/SamsungBrowser\/(\d+)/i.test(ua)) {
-    const match = ua.match(/SamsungBrowser\/(\d+)/i);
-    browser = `Samsung Internet ${match ? match[1] : ''}`.trim();
-  } else if (/Brave\/(\d+)/i.test(ua)) {
-    const match = ua.match(/Brave\/(\d+)/i);
-    browser = `Brave ${match ? match[1] : ''}`.trim();
-  } else if (/Vivaldi\/(\d+)/i.test(ua)) {
-    const match = ua.match(/Vivaldi\/(\d+)/i);
-    browser = `Vivaldi ${match ? match[1] : ''}`.trim();
-  } else if (/Chrome\/(\d+)/i.test(ua) && !/Chromium/i.test(ua)) {
-    const match = ua.match(/Chrome\/(\d+)/i);
-    browser = `Chrome ${match ? match[1] : ''}`.trim();
-  } else if (/Firefox\/(\d+)/i.test(ua) || /FxiOS\/(\d+)/i.test(ua)) {
-    const match = ua.match(/(?:Firefox|FxiOS)\/(\d+)/i);
-    browser = `Firefox ${match ? match[1] : ''}`.trim();
-  } else if (/Safari/i.test(ua) && /Version\/(\d+)/i.test(ua)) {
-    const match = ua.match(/Version\/(\d+)/i);
-    browser = `Safari ${match ? match[1] : ''}`.trim();
+  if ((match = ua.match(/Edg(e|A|iOS)?\/(\d+)/i))) {
+    browser = `Edge ${match[2] || ''}`.trim();
+  } else if ((match = ua.match(/OPR\/(\d+)/i))) {
+    browser = `Opera ${match[1] || ''}`.trim();
+  } else if ((match = ua.match(/SamsungBrowser\/(\d+)/i))) {
+    browser = `Samsung Internet ${match[1] || ''}`.trim();
+  } else if ((match = ua.match(/Brave\/(\d+)/i))) {
+    browser = `Brave ${match[1] || ''}`.trim();
+  } else if ((match = ua.match(/Vivaldi\/(\d+)/i))) {
+    browser = `Vivaldi ${match[1] || ''}`.trim();
+  } else if (!/Chromium/i.test(ua) && (match = ua.match(/Chrome\/(\d+)/i))) {
+    browser = `Chrome ${match[1] || ''}`.trim();
+  } else if ((match = ua.match(/(?:Firefox|FxiOS)\/(\d+)/i))) {
+    browser = `Firefox ${match[1] || ''}`.trim();
+  } else if ((match = ua.match(/Version\/(\d+)/i)) && /Safari/i.test(ua)) {
+    browser = `Safari ${match[1] || ''}`.trim();
   } else if (/Safari/i.test(ua) && !/Chrome/i.test(ua)) {
     browser = 'Safari';
   } else if (/MSIE (\d+)/i.test(ua) || (/Trident/i.test(ua) && /rv:(\d+)/i.test(ua))) {
@@ -144,7 +134,7 @@ function parseUserAgent(userAgent = '') {
   else if (isMobile) device = 'mobile';
   else if (isDesktop) device = 'desktop';
 
-  return {
+  const result = {
     browser,
     os,
     device,
@@ -153,9 +143,18 @@ function parseUserAgent(userAgent = '') {
     isDesktop,
     isBot,
   };
+
+  if (uaCache.size >= MAX_UA_CACHE) {
+    const oldestKey = uaCache.keys().next().value;
+    uaCache.delete(oldestKey);
+  }
+  uaCache.set(ua, result);
+
+  return { ...result };
 }
 
 module.exports = {
   getClientIp,
   parseUserAgent,
 };
+

package/core/compression/compression-stream.js

@@ -5,7 +5,7 @@
  */
 
 const zlib = require('zlib');
-const { supportsBrotli } = require('./negotiate');
+const negotiate = require('./negotiate');
 
 /**
  * Create a zlib compression transform stream based on encoding
@@ -23,7 +23,7 @@ function createCompressionStream(encoding, options = {}) {
 
   switch (enc) {
     case 'br': {
-      if (!supportsBrotli()) {
+      if (options.supportsBrotli === false || !negotiate.supportsBrotli()) {
         return null;
       }
       const brotliOpts = { ...(options.brotli || {}) };

package/core/compression/middleware.js

@@ -55,6 +55,7 @@ function createCompressionMiddleware(options = {}) {
   const customFilter = typeof options.filter === 'function' ? options.filter : null;
 
   const comp = compression({
+    ...options,
     threshold,
     brotli: options.brotli,
     level: options.level,
@@ -73,7 +74,6 @@ function createCompressionMiddleware(options = {}) {
       }
       return compression.filter(req, res);
     },
-    ...options,
   });
 
   return function compressionMiddleware(req, res, next) {

package/core/compression/negotiate.js

@@ -69,6 +69,9 @@ function parseAcceptEncoding(header) {
   return results;
 }
 
+const DEFAULT_SUPPORTED_ENCODINGS = Object.freeze(getDefaultSupportedEncodings());
+const DEFAULT_SUPPORTED_STRING = DEFAULT_SUPPORTED_ENCODINGS.join(',');
+
 const selectEncodingCache = new Map();
 const MAX_ENCODING_CACHE_SIZE = 128;
 
@@ -83,16 +86,20 @@ function selectEncoding(acceptEncoding, supportedEncodings) {
     return 'identity';
   }
 
-  const supported = Array.isArray(supportedEncodings) && supportedEncodings.length > 0
-    ? supportedEncodings.map(e => e.toLowerCase()).filter(e => e !== 'br' || supportsBrotli())
-    : getDefaultSupportedEncodings();
+  const isDefault = !supportedEncodings || !Array.isArray(supportedEncodings) || supportedEncodings.length === 0;
+  const cacheKey = isDefault
+    ? `${acceptEncoding}|${DEFAULT_SUPPORTED_STRING}`
+    : `${acceptEncoding}|${supportedEncodings.join(',')}`;
 
-  const cacheKey = `${acceptEncoding}|${supported.join(',')}`;
   const cached = selectEncodingCache.get(cacheKey);
   if (cached !== undefined) {
     return cached;
   }
 
+  const supported = isDefault
+    ? DEFAULT_SUPPORTED_ENCODINGS
+    : supportedEncodings.map(e => e.toLowerCase()).filter(e => e !== 'br' || supportsBrotli());
+
   const clientPreferences = parseAcceptEncoding(acceptEncoding);
   if (clientPreferences.length === 0) {
     if (selectEncodingCache.size < MAX_ENCODING_CACHE_SIZE) {

package/core/content/renderer.js

@@ -3,19 +3,7 @@
  * @module core/content/renderer
  */
 
-/**
- * Escape HTML for text nodes (not for rich-text which uses | safe separately).
- * @param {unknown} value
- * @returns {string}
- */
-function escapeHtml(value) {
-  if (value === null || value === undefined) return '';
-  return String(value)
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;');
-}
+const { escapeHtml } = require('../utils/html');
 
 /**
  * @param {unknown} value