const html = content.toString();

// Inject before </body> or at end

if (html.includes('</body>')) {

return Buffer.from(html.replace('</body>', LIVE_RELOAD_SCRIPT + '</body>'));

}

return Buffer.from(html + LIVE_RELOAD_SCRIPT);

const urlPath = request.url.split('?')[0];

// Storage path - includes pod name in subdomain mode

const storagePath = getEffectiveUrlPath(request);

// Resource URL - uses the actual request hostname (subdomain in subdomain mode)

const resourceUrl = `${request.protocol}://${request.hostname}${urlPath}`;

return { urlPath, storagePath, resourceUrl };

if (!rangeHeader || !rangeHeader.startsWith('bytes=')) {

return null;

}

const range = rangeHeader.slice(6); // Remove 'bytes='

// Multi-range requests (e.g., "0-100,200-300") are not supported

// Per RFC 7233, ignore Range header and serve full content instead of 416

if (range.includes(',')) {

return null;

}

const parts = range.split('-');

if (parts.length !== 2) {

return null;

}

let start, end;

if (parts[0] === '') {

// Suffix range: bytes=-500 (last 500 bytes)

const suffix = parseInt(parts[1], 10);

if (isNaN(suffix) || suffix <= 0) return null;

start = Math.max(0, fileSize - suffix);

end = fileSize - 1;

} else if (parts[1] === '') {

// Open-ended range: bytes=1024- (from 1024 to end)

start = parseInt(parts[0], 10);

if (isNaN(start) || start < 0) return null;

end = fileSize - 1;

} else {

// Normal range: bytes=0-1023

start = parseInt(parts[0], 10);

end = parseInt(parts[1], 10);

if (isNaN(start) || isNaN(end) || start < 0 || end < start) return null;

}

// Clamp end to file size

if (end >= fileSize) {

end = fileSize - 1;

}

// Check if range is satisfiable

if (start > end || start >= fileSize) {

return null;

}

return { start, end };

const { urlPath, storagePath, resourceUrl } = getRequestPaths(request);

const stats = await storage.stat(storagePath);

if (!stats) {

const origin = request.headers.origin;

const connegEnabled = request.connegEnabled || false;

const headers = getNotFoundHeaders({ resourceUrl, origin, connegEnabled });

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.code(404).send({ error: 'Not Found' });

}

// Check If-None-Match for conditional GET (304 Not Modified)

const ifNoneMatch = request.headers['if-none-match'];

if (ifNoneMatch) {

const check = checkIfNoneMatchForGet(ifNoneMatch, stats.etag);

if (!check.ok && check.notModified) {

return reply.code(304).send();

}

}

const origin = request.headers.origin;

// Handle container

if (stats.isDirectory) {

const connegEnabled = request.connegEnabled || false;

// Check for index.html (serves as both profile and container representation)

const indexPath = storagePath.endsWith('/') ? `${storagePath}index.html` : `${storagePath}/index.html`;

const indexExists = await storage.exists(indexPath);

if (indexExists) {

// Serve index.html (contains JSON-LD structured data)

const content = await storage.read(indexPath);

const indexStats = await storage.stat(indexPath);

// Pick the negotiated RDF type using q-aware Accept parsing. The

// naive `acceptHeader.includes('text/turtle')` we used to do here

// ignored q-weights — `Accept: application/ld+json, text/turtle;q=0.1`

// would still pick Turtle even though JSON-LD was preferred (#325).

const acceptHeader = request.headers.accept || '';

const negotiated = connegEnabled

? selectContentType(acceptHeader, true)

: null;

const wantsTurtle = negotiated === RDF_TYPES.TURTLE

|| negotiated === RDF_TYPES.N3

|| negotiated === 'application/n-triples';

const wantsJsonLd = negotiated === RDF_TYPES.JSON_LD;

if (wantsTurtle || wantsJsonLd) {

// Extract JSON-LD from HTML data island

try {

const htmlStr = content.toString();

const jsonLdMatch = htmlStr.match(/<script type="application\/ld\+json"[^>]*>([\s\S]*?)<\/script>/);

if (jsonLdMatch) {

const jsonLd = safeJsonParse(jsonLdMatch[1]);

if (wantsTurtle) {

// Convert to Turtle

const { content: turtleContent } = await fromJsonLd(

jsonLd,

'text/turtle',

resourceUrl,

true

);

const headers = getAllHeaders({

isContainer: true,

etag: indexStats?.etag || stats.etag,

contentType: 'text/turtle',

origin,

resourceUrl,

connegEnabled

});

headers['Cache-Control'] = RDF_CACHE_CONTROL;

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.send(turtleContent);

} else {

// Return JSON-LD directly

const headers = getAllHeaders({

isContainer: true,

etag: indexStats?.etag || stats.etag,

contentType: 'application/ld+json',

origin,

resourceUrl,

connegEnabled

});

headers['Cache-Control'] = RDF_CACHE_CONTROL;

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.send(JSON.stringify(jsonLd, null, 2));

}

}

} catch (err) {

// Fall through to serve HTML if conversion fails

console.error('Failed to convert profile to RDF:', err.message);

}

}

const headers = getAllHeaders({

isContainer: true,

etag: indexStats?.etag || stats.etag,

contentType: 'text/html',

origin,

resourceUrl,

connegEnabled

});

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

// Inject live reload script for index.html

if (request.liveReloadEnabled) {

reply.header('Cache-Control', 'no-store');

reply.removeHeader('ETag');

return reply.send(injectLiveReload(content));

}

return reply.send(content);

}

// No index.html, return JSON-LD container listing

const entries = await storage.listContainer(storagePath);

const jsonLd = generateContainerJsonLd(resourceUrl, entries || []);

// Check if we should serve Mashlib data browser for containers

if (shouldServeMashlib(request, request.mashlibEnabled, 'application/ld+json')) {

const html = request.mashlibModule

? generateModuleDatabrowserHtml(request.mashlibModule)

: generateDatabrowserHtml(resourceUrl, request.mashlibCdn ? request.mashlibVersion : null);

const headers = getAllHeaders({

isContainer: true,

etag: stats.etag,

contentType: 'text/html',

origin,

resourceUrl,

connegEnabled,

mashlibEnabled: request.mashlibEnabled

});

headers['X-Frame-Options'] = 'DENY';

headers['Content-Security-Policy'] = "frame-ancestors 'none'";

headers['Cache-Control'] = 'no-store';

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.type('text/html').send(html);

}

// Pick the negotiated RDF type using q-aware Accept parsing (#325).

const acceptHeader = request.headers.accept || '';

const negotiated = connegEnabled

? selectContentType(acceptHeader, true)

: null;

const wantsTurtle = negotiated === RDF_TYPES.TURTLE

|| negotiated === RDF_TYPES.N3

|| negotiated === 'application/n-triples';

if (wantsTurtle) {

// Convert container JSON-LD to Turtle

try {

const { content: turtleContent } = await fromJsonLd(

jsonLd,

'text/turtle',

resourceUrl,

true

);

const headers = getAllHeaders({

isContainer: true,

etag: stats.etag,

contentType: 'text/turtle',

origin,

resourceUrl,

connegEnabled,

mashlibEnabled: request.mashlibEnabled

});

headers['Cache-Control'] = RDF_CACHE_CONTROL;

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.send(turtleContent);

} catch (err) {

// Fall through to JSON-LD if conversion fails

console.error('Failed to convert container to Turtle:', err.message);

}

}

const headers = getAllHeaders({

isContainer: true,

etag: stats.etag,

contentType: 'application/ld+json',

origin,

resourceUrl,

connegEnabled,

mashlibEnabled: request.mashlibEnabled

});

headers['Cache-Control'] = RDF_CACHE_CONTROL;

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.send(serializeJsonLd(jsonLd));

}

// Handle resource

const storedContentType = getContentType(storagePath);

const connegEnabled = request.connegEnabled || false;

// Check if we should serve Mashlib data browser

// Only for RDF resources when Accept: text/html is requested

if (shouldServeMashlib(request, request.mashlibEnabled, storedContentType)) {

const html = request.mashlibModule

? generateModuleDatabrowserHtml(request.mashlibModule)

: generateDatabrowserHtml(resourceUrl, request.mashlibCdn ? request.mashlibVersion : null);

const headers = getAllHeaders({

isContainer: false,

etag: stats.etag,

contentType: 'text/html',

origin,

resourceUrl,

connegEnabled,

mashlibEnabled: request.mashlibEnabled

});

headers['X-Frame-Options'] = 'DENY';

headers['Content-Security-Policy'] = "frame-ancestors 'none'";

// Don't cache the HTML wrapper - always negotiate fresh

headers['Cache-Control'] = 'no-store';

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.type('text/html').send(html);

}

// Handle Range requests for media files (video, audio, etc.)

const rangeHeader = request.headers.range;

if (rangeHeader && !isRdfContentType(storedContentType)) {

const range = parseRangeHeader(rangeHeader, stats.size);

if (range) {

const { start, end } = range;

const chunkSize = end - start + 1;

const headers = getAllHeaders({

isContainer: false,

etag: stats.etag,

contentType: storedContentType,

origin,

resourceUrl,

connegEnabled

});

headers['Content-Range'] = `bytes ${start}-${end}/${stats.size}`;

headers['Content-Length'] = chunkSize;

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

const streamResult = storage.createReadStream(storagePath, { start, end });

if (!streamResult) {

return reply.code(500).send({ error: 'Stream error' });

}

// Handle stream errors that occur during response

streamResult.stream.on('error', (err) => {

console.error('Stream error during range response:', err.message);

});

return reply.code(206).send(streamResult.stream);

}

// If range is null (unsupported format or multi-range), fall through to serve full content

}

const content = await storage.read(storagePath);

if (content === null) {

return reply.code(500).send({ error: 'Read error' });

}

// Content negotiation for RDF resources (including HTML with JSON-LD data islands)

if (connegEnabled) {

const contentStr = content.toString();

const acceptHeader = request.headers.accept || '';

// Serve Turtle if: URL ends with .ttl OR Accept's q-weighted top

// RDF type is Turtle/N3 (#325 — naive substring matching ignored

// q-weights and would pick Turtle whenever it appeared in Accept).

const negotiated = selectContentType(acceptHeader, true);

const wantsTurtle = urlPath.endsWith('.ttl')

|| negotiated === RDF_TYPES.TURTLE

|| negotiated === RDF_TYPES.N3

|| negotiated === 'application/n-triples';

// Check if this is HTML with JSON-LD data island

const isHtmlWithDataIsland = contentStr.trimStart().startsWith('<!DOCTYPE') ||

contentStr.trimStart().startsWith('<html');

if (isHtmlWithDataIsland && wantsTurtle) {

// Extract JSON-LD from HTML data island and convert to Turtle

try {

const jsonLdMatch = contentStr.match(/<script\s+type=["']application\/ld\+json["']\s*>([\s\S]*?)<\/script>/i);

if (jsonLdMatch) {

const jsonLd = safeJsonParse(jsonLdMatch[1]);

const { content: turtleContent } = await fromJsonLd(jsonLd, 'text/turtle', resourceUrl, true);

const headers = getAllHeaders({

isContainer: false,

etag: stats.etag,

contentType: 'text/turtle',

origin,

resourceUrl,

connegEnabled,

mashlibEnabled: request.mashlibEnabled

});

headers['Cache-Control'] = RDF_CACHE_CONTROL;

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.send(turtleContent);

}

} catch (err) {

// Fall through to serve HTML if conversion fails

console.error('Failed to convert HTML data island to Turtle:', err.message);

}

} else if (isRdfContentType(storedContentType)) {

// Plain JSON-LD file

try {

const jsonLd = safeJsonParse(contentStr);

// Use Turtle if URL ends with .ttl, otherwise use Accept header preference

const targetType = wantsTurtle ? 'text/turtle' : selectContentType(acceptHeader, connegEnabled);

const { content: outputContent, contentType: outputType } = await fromJsonLd(

jsonLd,

targetType,

resourceUrl,

connegEnabled

);

const headers = getAllHeaders({

isContainer: false,

etag: stats.etag,

contentType: outputType,

origin,

resourceUrl,

connegEnabled,

mashlibEnabled: request.mashlibEnabled

});

headers['Cache-Control'] = RDF_CACHE_CONTROL;

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.send(outputContent);

} catch (e) {

// If not valid JSON-LD, serve as-is

}

}

}

// Serve content as-is (no conneg or non-RDF resource)

// For extensionless files (like profile/card), detect HTML by content

let actualContentType = storedContentType;

if (storedContentType === 'application/octet-stream') {

const contentStr = content.toString().trimStart();

if (contentStr.startsWith('<!DOCTYPE') || contentStr.startsWith('<html')) {

actualContentType = 'text/html';

}

}

const headers = getAllHeaders({

isContainer: false,

etag: stats.etag,

contentType: actualContentType,

origin,

resourceUrl,

connegEnabled,

mashlibEnabled: request.mashlibEnabled

});

if (isRdfContentType(actualContentType)) {

headers['Cache-Control'] = RDF_CACHE_CONTROL;

}

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

// Inject live reload script into HTML (disable caching since content is modified)

if (actualContentType === 'text/html' && request.liveReloadEnabled) {

reply.header('Cache-Control', 'no-store');

reply.removeHeader('ETag');

return reply.send(injectLiveReload(content));

}

return reply.send(content);

const { storagePath, resourceUrl } = getRequestPaths(request);

const stats = await storage.stat(storagePath);

if (!stats) {

const origin = request.headers.origin;

const connegEnabled = request.connegEnabled || false;

const headers = getNotFoundHeaders({ resourceUrl, origin, connegEnabled });

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.code(404).send();

}

const origin = request.headers.origin;

const connegEnabled = request.connegEnabled || false;

let contentType;

if (stats.isDirectory) {

const indexPath = storagePath.endsWith('/') ? `${storagePath}index.html` : `${storagePath}/index.html`;

const indexExists = await storage.exists(indexPath);

const acceptHeader = request.headers.accept || '';

if (connegEnabled) {

// HEAD must mirror what GET would emit; otherwise client caches and

// RDF-aware tooling key off a content-type that doesn't match the

// body they'll see on the next GET (#325). Use q-aware Accept

// parsing for both the index.html and listing branches.

const negotiated = selectContentType(acceptHeader, true);

const wantsTurtle = negotiated === RDF_TYPES.TURTLE

|| negotiated === RDF_TYPES.N3

|| negotiated === 'application/n-triples';

const wantsJsonLd = negotiated === RDF_TYPES.JSON_LD;

if (wantsTurtle) {

contentType = 'text/turtle';

} else if (wantsJsonLd) {

// For an index.html container, only override to JSON-LD if the

// Accept header explicitly asked for JSON; otherwise fall back

// to text/html so HEAD matches the index.html that GET serves.

const explicitJson = /\b(application\/ld\+json|application\/json)\b/i.test(acceptHeader);

contentType = (indexExists && !explicitJson) ? 'text/html' : 'application/ld+json';

} else {

contentType = indexExists ? 'text/html' : 'application/ld+json';

}

} else if (indexExists) {

contentType = 'text/html';

} else {

contentType = 'application/ld+json';

}

} else {

contentType = getContentType(storagePath);

}

const headers = getAllHeaders({

isContainer: stats.isDirectory,

etag: stats.etag,

contentType,

origin,

resourceUrl,

connegEnabled

});

if (!stats.isDirectory) {

headers['Content-Length'] = stats.size;

}

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.code(200).send();

// Read-only mode - block all writes

if (request.config?.readOnly) {

return reply.code(405).send({ error: 'Method Not Allowed', message: 'Server is in read-only mode' });

}

const { urlPath, storagePath, resourceUrl } = getRequestPaths(request);

const connegEnabled = request.connegEnabled || false;

// Handle container creation via PUT

if (isContainer(urlPath)) {

const stats = await storage.stat(storagePath);

if (stats?.isDirectory) {

// If container has index.html and PUT sends HTML, rewrite URL to target the

// index document and delegate to the standard PUT pipeline. This mirrors GET

// behavior (line 138) which serves index.html for container URLs, and reuses

// If-Match/If-None-Match, quota checks, and notification handling.

const indexPath = storagePath.endsWith('/') ? `${storagePath}index.html` : `${storagePath}/index.html`;

const contentType = request.headers['content-type'] || '';

if (contentType.includes('text/html') && await storage.exists(indexPath)) {

const indexUrl = urlPath.endsWith('/') ? `${urlPath}index.html` : `${urlPath}/index.html`;

// Fastify request.url is a getter, so proxy it with the rewritten path

const proxied = Object.create(request, { url: { value: indexUrl } });

return handlePut(proxied, reply);

}

// Container exists but no index routing applies - reject

return reply.code(409).send({ error: 'Cannot PUT to existing container' });

}

// Create the container (and any intermediate containers)

const success = await storage.createContainer(storagePath);

if (!success) {

return reply.code(500).send({ error: 'Failed to create container' });

}

const origin = request.headers.origin;

const headers = getAllHeaders({

isContainer: true,

origin,

connegEnabled

});

headers['Location'] = resourceUrl;

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

emitChange(request.protocol + '://' + request.hostname, urlPath, 'created');

return reply.code(201).send();

}

const contentType = request.headers['content-type'] || '';

// Check if we can accept this input type

if (!canAcceptInput(contentType, connegEnabled)) {

return reply.code(415).send({

error: 'Unsupported Media Type',

message: connegEnabled

? 'Supported types: application/ld+json, text/turtle, text/n3'

: 'Supported type: application/ld+json (enable conneg for Turtle support)'

});

}

// Check if resource already exists and get current ETag

const stats = await storage.stat(storagePath);

const existed = stats !== null;

const currentEtag = stats?.etag || null;

// Check If-Match header (for safe updates)

const ifMatch = request.headers['if-match'];

if (ifMatch) {

const check = checkIfMatch(ifMatch, currentEtag);

if (!check.ok) {

return reply.code(check.status).send({ error: check.error });

}

}

// Check If-None-Match header (for create-only semantics)

const ifNoneMatch = request.headers['if-none-match'];

if (ifNoneMatch) {

const check = checkIfNoneMatchForWrite(ifNoneMatch, currentEtag);

if (!check.ok) {

return reply.code(check.status).send({ error: check.error });

}

}

// Get content from request body

let content = request.body;

// Handle raw body for non-JSON content types

if (Buffer.isBuffer(content)) {

// Already a buffer, use as-is

} else if (typeof content === 'string') {

content = Buffer.from(content);

} else if (content && typeof content === 'object') {

content = Buffer.from(JSON.stringify(content));

} else {

content = Buffer.from('');

}

// Convert Turtle/N3 to JSON-LD if conneg enabled

const inputType = contentType.split(';')[0].trim().toLowerCase();

if (connegEnabled && (inputType === RDF_TYPES.TURTLE || inputType === RDF_TYPES.N3)) {

try {

const jsonLd = await toJsonLd(content, contentType, resourceUrl, connegEnabled);

content = Buffer.from(JSON.stringify(jsonLd, null, 2));

} catch (e) {

return reply.code(400).send({

error: 'Bad Request',

message: 'Invalid Turtle/N3 format: ' + e.message

});

}

}

// Check storage quota before writing (skip in public mode - no pod structure)

const podName = request.config?.public ? null : getPodName(request);

const oldSize = stats?.size || 0;

const sizeDelta = content.length - oldSize;

if (podName && sizeDelta > 0) {

const { allowed, error } = await checkQuota(podName, sizeDelta, request.defaultQuota || 0);

if (!allowed) {

return reply.code(507).send({ error: 'Insufficient Storage', message: error });

}

}

const success = await storage.write(storagePath, content);

if (!success) {

return reply.code(500).send({ error: 'Write failed' });

}

// Update quota usage after successful write

if (podName && sizeDelta !== 0) {

await updateQuotaUsage(podName, sizeDelta);

}

const origin = request.headers.origin;

const headers = getAllHeaders({ isContainer: false, origin, resourceUrl, connegEnabled, mashlibEnabled: request.mashlibEnabled });

headers['Location'] = resourceUrl;

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

// Emit change notification for WebSocket subscribers

if (request.notificationsEnabled) {

emitChange(resourceUrl);

}

return reply.code(existed ? 204 : 201).send();

// Read-only mode - block all writes

if (request.config?.readOnly) {

return reply.code(405).send({ error: 'Method Not Allowed', message: 'Server is in read-only mode' });

}

const { storagePath, resourceUrl } = getRequestPaths(request);

// Check if resource exists and get current ETag

const stats = await storage.stat(storagePath);

if (!stats) {

const origin = request.headers.origin;

const connegEnabled = request.connegEnabled || false;

const headers = getNotFoundHeaders({ resourceUrl, origin, connegEnabled });

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

return reply.code(404).send({ error: 'Not Found' });

}

// Check If-Match header (for safe deletes)

const ifMatch = request.headers['if-match'];

if (ifMatch) {

const check = checkIfMatch(ifMatch, stats.etag);

if (!check.ok) {

return reply.code(check.status).send({ error: check.error });

}

}

// Get file size before deletion for quota update

const fileSize = stats.size || 0;

const success = await storage.remove(storagePath);

if (!success) {

return reply.code(500).send({ error: 'Delete failed' });

}

// Update quota usage (subtract deleted file size)

const podName = getPodName(request);

if (podName && fileSize > 0) {

await updateQuotaUsage(podName, -fileSize);

}

const origin = request.headers.origin;

const headers = getAllHeaders({ isContainer: false, origin, resourceUrl });

Object.entries(headers).forEach(([k, v]) => reply.header(k, v));

// Emit change notification for WebSocket subscribers

if (request.notificationsEnabled) {

emitChange(resourceUrl);

}

return reply.code(204).send();

const { urlPath, storagePath, resourceUrl } = getRequestPaths(request);

const stats = await storage.stat(storagePath);