@daloyjs/core 0.34.3 → 0.35.1

package/dist/app.js

@@ -79,6 +79,16 @@ const DEFAULTS = {
     requestTimeoutMs: 30_000,
     validateResponses: true,
 };
+const TEXT_ENCODER = new TextEncoder();
+/**
+ * Internal Symbol used to stash the raw Uint8Array (or null) body on a
+ * `Response` produced by {@link serializeResult}. Adapters that want to
+ * avoid the cost of `await response.arrayBuffer()` for buffer-backed
+ * responses can read this property and write the bytes directly. The
+ * Symbol is intentionally module-private (not exported) to keep this an
+ * implementation detail — userland code should never depend on it.
+ */
+export const DALOY_RAW_BODY = Symbol.for("daloyjs.response.rawBody");
 /**
  * Contract-first HTTP application.
  *
@@ -181,6 +191,25 @@ export class App {
      * dashboards see the misconfiguration without flooding on every retry.
      */
     trustProxyWarned = false;
+    /**
+    * Cached merge of `options.hooks` only. Used on the cold 404/405 path
+    * and as the baseline for cross-origin guard decisions when no route
+    * matches.
+     */
+    _globalHooksCache;
+    _globalCorsAllowsCache;
+    get globalHooks() {
+        if (this._globalHooksCache === undefined) {
+            this._globalHooksCache = mergeHooks([this.options.hooks ?? {}]);
+        }
+        return this._globalHooksCache;
+    }
+    get globalCorsAllows() {
+        if (this._globalCorsAllowsCache === undefined) {
+            this._globalCorsAllowsCache = corsOriginAllowsFromHooks([this.options.hooks ?? {}]);
+        }
+        return this._globalCorsAllowsCache;
+    }
     constructor(options = {}) {
         this.options = {
             validateResponses: options.validateResponses ?? DEFAULTS.validateResponses,
@@ -377,7 +406,7 @@ export class App {
      * routes whose hook chain includes a `cors()` policy allowing the origin
      * are unaffected.
      */
-    assertCrossOriginAllowed(request, url, method, corsOriginAllows) {
+    assertCrossOriginAllowed(request, requestUrl, method, corsOriginAllows) {
         if (this.options.secureDefaults === false)
             return;
         if (this.options.corsCrossOriginGuard === false)
@@ -399,7 +428,8 @@ export class App {
             // Malformed Origin header — refuse loudly.
             throw new ForbiddenError("Cross-origin state-changing request rejected: malformed Origin header.");
         }
-        if (originUrl.origin === url.origin)
+        const reqOrigin = typeof requestUrl === "string" ? new URL(requestUrl).origin : requestUrl.origin;
+        if (originUrl.origin === reqOrigin)
             return;
         if (corsOriginAllows.some((allows) => allows(origin)))
             return;
@@ -728,11 +758,18 @@ export class App {
         const sources = [...this.groupHooks, def.hooks ?? {}];
         const hooks = mergeHooks(sources);
         const corsOriginAllows = corsOriginAllowsFromHooks(sources);
+        const globalHookLayer = this.options.hooks ?? {};
+        const mergedHooks = mergeHooks([globalHookLayer, ...sources]);
+        const hasFinalizeHook = mergedHooks.onSend !== undefined || mergedHooks.onResponse !== undefined;
+        const fullCorsOriginAllows = [
+            ...corsOriginAllowsFromHooks([globalHookLayer]),
+            ...corsOriginAllows,
+        ];
         const securityMarkers = securityMarkersFromHooks([
-            this.options.hooks ?? {},
+            globalHookLayer,
             ...sources,
         ]);
-        this.router.add(def.method, fullPath, { def: merged, hooks, corsOriginAllows }, def.operationId);
+        this.router.add(def.method, fullPath, { def: merged, hooks, mergedHooks, hasFinalizeHook, corsOriginAllows, fullCorsOriginAllows }, def.operationId);
         this.routes.push(merged);
         this.routeSecurityMarkers.push({
             method: merged.method,
@@ -1426,7 +1463,7 @@ export class App {
         });
         const stripFingerprint = this.options.stripServerHeaders !== false;
         let ctx;
-        const globalHooks = mergeHooks([this.options.hooks ?? {}]);
+        const globalHooks = this.globalHooks;
         let activeErrorHook = globalHooks.onError;
         let activeResponseHook = globalHooks.onResponse;
         let activeSendHook = globalHooks.onSend;
@@ -1435,26 +1472,36 @@ export class App {
             assertNoReservedInternalHeaders(request.headers);
             this.assertTrustProxyConfigured(request);
             this.assertBootGuards();
-            await globalHooks.onRequest?.(request);
-            const url = new URL(request.url);
+            if (globalHooks.onRequest !== undefined) {
+                const onRequestResult = globalHooks.onRequest(request);
+                if (isPromiseLike(onRequestResult))
+                    await onRequestResult;
+            }
             const method = request.method;
+            const requestUrl = request.url;
+            const pathname = getPathnameFast(requestUrl);
+            let url;
+            const getUrl = () => (url ??= new URL(requestUrl));
             const headFallback = method === "HEAD";
-            const match = this.router.find(method, url.pathname) ??
-                (headFallback ? this.router.find("GET", url.pathname) : undefined);
+            const match = this.router.find(method, pathname) ??
+                (headFallback ? this.router.find("GET", pathname) : undefined);
             // Hide internal routes from the public adapter surface. The router
             // still finds them so app.inject() can dispatch normally, but
             // app.fetch() responds 404 to avoid leaking existence.
             const internalHidden = match?.handler.def.internal === true && opts.allowInternal !== true;
-            this.assertCrossOriginAllowed(request, url, method, [
-                ...corsOriginAllowsFromHooks([this.options.hooks ?? {}]),
-                ...(match && !internalHidden ? match.handler.corsOriginAllows : this.corsOriginAllows),
-            ]);
+            if (match && !internalHidden) {
+                this.assertCrossOriginAllowed(request, requestUrl, method, match.handler.fullCorsOriginAllows);
+            }
+            else {
+                this.assertCrossOriginAllowed(request, requestUrl, method, [...this.globalCorsAllows, ...this.corsOriginAllows]);
+            }
             if (!match || internalHidden) {
+                const url404 = getUrl();
                 if (internalHidden) {
                     // Don't leak existence via 405/Allow header. Always 404.
-                    throw new NotFoundError(`No route for ${request.method} ${url.pathname}`);
+                    throw new NotFoundError(`No route for ${request.method} ${url404.pathname}`);
                 }
-                const rawAllowed = this.router.allowedMethods(url.pathname);
+                const rawAllowed = this.router.allowedMethods(url404.pathname);
                 // Filter out methods whose route definitions are marked
                 // `internal: true` unless the caller explicitly opted in via
                 // app.inject(). This prevents 405/Allow from leaking the
@@ -1462,13 +1509,13 @@ export class App {
                 const allowed = opts.allowInternal
                     ? rawAllowed
                     : rawAllowed.filter((m) => {
-                        const candidate = this.router.find(m, url.pathname);
+                        const candidate = this.router.find(m, url404.pathname);
                         return candidate?.handler.def.internal !== true;
                     });
                 ctx = {
                     request,
                     params: {},
-                    query: Object.fromEntries(url.searchParams.entries()),
+                    query: Object.fromEntries(url404.searchParams.entries()),
                     headers: headersToObject(request.headers),
                     body: undefined,
                     state: { ...this.decorations, requestId, log },
@@ -1492,10 +1539,12 @@ export class App {
                             this.options.hooks ?? {},
                             ...this.groupHooks,
                         ]);
-                        const intercepted = await preflightHooks.beforeHandle?.(synthCtx);
+                        const interceptedResult = preflightHooks.beforeHandle?.(synthCtx);
+                        const intercepted = isPromiseLike(interceptedResult) ? await interceptedResult : interceptedResult;
                         if (intercepted instanceof Response) {
                             copyContextHeaders(synthCtx, intercepted);
-                            return await finalizeResponse(intercepted, synthCtx, preflightHooks, stripFingerprint);
+                            const fin = finalizeResponse(intercepted, synthCtx, preflightHooks, stripFingerprint);
+                            return isPromiseLike(fin) ? await fin : fin;
                         }
                         const res = new Response(null, {
                             status: 204,
@@ -1503,35 +1552,61 @@ export class App {
                         });
                         copyContextHeaders(synthCtx, res);
                         res.headers.set("x-request-id", requestId);
-                        return await finalizeResponse(res, synthCtx, preflightHooks, stripFingerprint);
+                        const fin2 = finalizeResponse(res, synthCtx, preflightHooks, stripFingerprint);
+                        return isPromiseLike(fin2) ? await fin2 : fin2;
                     }
                     throw new MethodNotAllowedError(allowed);
                 }
-                throw new NotFoundError(`No route for ${request.method} ${url.pathname}`);
+                throw new NotFoundError(`No route for ${request.method} ${url404.pathname}`);
             }
-            const { def, hooks } = match.handler;
-            const allHooks = mergeHooks([globalHooks, hooks]);
+            const { def, hooks, mergedHooks: allHooks, hasFinalizeHook } = match.handler;
             activeErrorHook = allHooks.onError;
             activeResponseHook = allHooks.onResponse;
             activeSendHook = allHooks.onSend;
-            await hooks.onRequest?.(request);
-            ctx = await buildContext(request, url, match.params, def, this.options);
+            if (hooks.onRequest !== undefined) {
+                const routeOnRequestResult = hooks.onRequest(request);
+                if (isPromiseLike(routeOnRequestResult))
+                    await routeOnRequestResult;
+            }
+            ctx = await buildContext(request, getUrl, match.params, def, this.options);
             Object.assign(ctx.state, this.decorations, { requestId, log });
-            ctx.set.headers.set("x-request-id", requestId);
-            const before = await allHooks.beforeHandle?.(ctx);
-            if (before instanceof Response) {
-                copyContextHeaders(ctx, before);
-                return await finalizeResponse(before, ctx, allHooks, stripFingerprint);
+            if (allHooks.beforeHandle !== undefined) {
+                const beforeResult = allHooks.beforeHandle(ctx);
+                const before = isPromiseLike(beforeResult) ? await beforeResult : beforeResult;
+                if (before instanceof Response) {
+                    copyContextHeaders(ctx, before);
+                    if (!before.headers.has("x-request-id"))
+                        before.headers.set("x-request-id", requestId);
+                    if (hasFinalizeHook) {
+                        const fin = finalizeResponse(before, ctx, allHooks, stripFingerprint);
+                        return isPromiseLike(fin) ? await fin : fin;
+                    }
+                    return finalizeFast(before, stripFingerprint);
+                }
             }
-            let result = this.options.mockMode
+            const runResult = this.options.mockMode
                 ? mockResponseFor(def)
-                : await runHandler(def, ctx, this.options.requestTimeoutMs);
-            const afterReturn = await allHooks.afterHandle?.(ctx, result);
-            if (afterReturn !== undefined)
-                result = afterReturn;
-            let response = await serializeResult(result, def, this.options.validateResponses ?? true);
+                : runHandler(def, ctx, this.options.requestTimeoutMs);
+            let result = isPromiseLike(runResult) ? await runResult : runResult;
+            if (allHooks.afterHandle !== undefined) {
+                const afterResult = allHooks.afterHandle(ctx, result);
+                const afterReturn = isPromiseLike(afterResult) ? await afterResult : afterResult;
+                if (afterReturn !== undefined)
+                    result = afterReturn;
+            }
+            const serializeResultRes = serializeResult(result, def, this.options.validateResponses ?? true);
+            let response = isPromiseLike(serializeResultRes) ? await serializeResultRes : serializeResultRes;
             copyContextHeaders(ctx, response);
-            const finalized = await finalizeResponse(response, ctx, allHooks, stripFingerprint);
+            if (!response.headers.has("x-request-id"))
+                response.headers.set("x-request-id", requestId);
+            let finalized;
+            if (hasFinalizeHook) {
+                const fin = finalizeResponse(response, ctx, allHooks, stripFingerprint);
+                finalized = isPromiseLike(fin) ? await fin : fin;
+            }
+            else {
+                finalized = finalizeFast(response, stripFingerprint);
+            }
             if (method === "HEAD") {
                 return new Response(null, {
                     status: finalized.status,
@@ -1903,6 +1978,34 @@ function isStateChangingMethod(method) {
         method === "PATCH" ||
         method === "DELETE");
 }
+/**
+ * Extract the pathname from a fully-qualified request URL without
+ * constructing a `URL` object. ~10x cheaper than `new URL(...).pathname`
+ * and used on the dispatch hot path; full `URL` parsing is deferred until
+ * something actually reads `searchParams`. Mirrors Hono's `getPath`
+ * approach.
+ *
+ * Handles the standard `http(s)://host[:port]/path[?query][#hash]` shape
+ * produced by the Node adapter and the Fetch standard. Falls back to a
+ * `URL` parse for inputs that don't match (e.g. opaque schemes), so
+ * correctness is preserved even when the fast path doesn't apply.
+ */
+function getPathnameFast(url) {
+    const schemeEnd = url.indexOf("://");
+    if (schemeEnd === -1)
+        return new URL(url).pathname;
+    const pathStart = url.indexOf("/", schemeEnd + 3);
+    if (pathStart === -1)
+        return "/";
+    let end = url.length;
+    const q = url.indexOf("?", pathStart);
+    if (q !== -1)
+        end = q;
+    const h = url.indexOf("#", pathStart);
+    if (h !== -1 && h < end)
+        end = h;
+    return url.slice(pathStart, end);
+}
 function mergeHooks(layers) {
     const pick = (key) => layers
         .map((h) => h[key])
@@ -1941,6 +2044,11 @@ function stampRequiredScopes(hooks, scopes) {
 function mergeBeforeHandle(beforeHandle, requiredScopes) {
     if (!beforeHandle && requiredScopes.length === 0)
         return undefined;
+    // No scope aggregation needed → return the inner fn as-is so the dispatch
+    // hot path can use the single-fn fast path and avoid an extra closure +
+    // microtask wrapper around a possibly-sync beforeHandle.
+    if (requiredScopes.length === 0)
+        return beforeHandle;
     return async (ctx) => {
         if (requiredScopes.length > 0) {
             const state = ctx.state;
@@ -1958,6 +2066,8 @@ function mergeBeforeHandle(beforeHandle, requiredScopes) {
 function responsePipeline(fns) {
     if (fns.length === 0)
         return undefined;
+    if (fns.length === 1)
+        return fns[0];
     return async (res, ctx) => {
         let current = res;
         for (const fn of fns) {
@@ -1968,19 +2078,59 @@ function responsePipeline(fns) {
         return current;
     };
 }
-async function finalizeResponse(res, ctx, hooks, stripFingerprint = true) {
-    const sent = await hooks.onSend?.(res, ctx);
-    const final = sent instanceof Response ? sent : res;
+function finalizeResponse(res, ctx, hooks, stripFingerprint = true) {
+    let final = res;
+    const finish = (f) => {
+        if (stripFingerprint) {
+            f.headers.delete("server");
+            f.headers.delete("x-powered-by");
+        }
+        if (hooks.onResponse !== undefined) {
+            const onResponseResult = hooks.onResponse(f);
+            if (isPromiseLike(onResponseResult)) {
+                return onResponseResult.then(() => f);
+            }
+        }
+        return f;
+    };
+    if (hooks.onSend !== undefined) {
+        const sentResult = hooks.onSend(res, ctx);
+        if (isPromiseLike(sentResult)) {
+            return sentResult.then((sent) => {
+                if (sent instanceof Response)
+                    final = sent;
+                return finish(final);
+            });
+        }
+        else {
+            if (sentResult instanceof Response)
+                final = sentResult;
+        }
+    }
+    return finish(final);
+}
+function isPromiseLike(value) {
+    return value !== null && typeof value === "object" && typeof value.then === "function";
+}
+/**
+ * Allocation-free finalizer for the common case (no `onSend`/`onResponse`
+ * hooks). Avoids the two `await undefined` microtasks per request that
+ * dominate sub-millisecond dispatch overhead in the no-middleware
+ * benchmark. Behaviour parity with {@link finalizeResponse}: only the
+ * server-fingerprint headers are stripped.
+ */
+function finalizeFast(res, stripFingerprint) {
     if (stripFingerprint) {
-        final.headers.delete("server");
-        final.headers.delete("x-powered-by");
+        res.headers.delete("server");
+        res.headers.delete("x-powered-by");
     }
-    await hooks.onResponse?.(final);
-    return final;
+    return res;
 }
 function chain(fns) {
     if (fns.length === 0)
         return undefined;
+    if (fns.length === 1)
+        return fns[0];
     return (async (...args) => {
         for (const fn of fns)
             await fn(...args);
@@ -1989,6 +2139,8 @@ function chain(fns) {
 function firstResponse(fns) {
     if (fns.length === 0)
         return undefined;
+    if (fns.length === 1)
+        return fns[0];
     return (async (...args) => {
         for (const fn of fns) {
             const r = await fn(...args);
@@ -2001,6 +2153,8 @@ function firstResponse(fns) {
 function pipeline(fns) {
     if (fns.length === 0)
         return undefined;
+    if (fns.length === 1)
+        return fns[0];
     return (async (ctx, value) => {
         let v = value;
         for (const fn of fns) {
@@ -2011,7 +2165,37 @@ function pipeline(fns) {
         return v;
     });
 }
+/**
+ * Marker stamped on `ctx.set` once the `headers` getter has been
+ * materialised. {@link copyContextHeaders} consults this to skip the
+ * forEach loop entirely on requests where no middleware or handler ever
+ * touched `ctx.set.headers` — the default case for the no-middleware
+ * benchmark.
+ */
+const SET_HEADERS_TOUCHED = Symbol.for("daloyjs.app.setHeadersTouched");
+function makeLazySet() {
+    let h;
+    const set = {};
+    Object.defineProperty(set, "headers", {
+        get() {
+            if (h === undefined) {
+                h = new Headers();
+                set[SET_HEADERS_TOUCHED] = true;
+            }
+            return h;
+        },
+        set(v) {
+            h = v;
+            set[SET_HEADERS_TOUCHED] = true;
+        },
+        enumerable: true,
+        configurable: true,
+    });
+    return set;
+}
 function copyContextHeaders(ctx, res) {
+    if (!ctx.set[SET_HEADERS_TOUCHED])
+        return;
     ctx.set.headers.forEach((v, k) => {
         if (!res.headers.has(k))
             res.headers.set(k, v);
@@ -2020,49 +2204,100 @@ function copyContextHeaders(ctx, res) {
 function hasRequestSchema(request, key) {
     return !!request && !!request[key];
 }
-async function buildContext(request, url, rawParams, def, opts) {
-    const set = { headers: new Headers() };
-    const headersObj = headersToObject(request.headers);
-    const queryObj = queryToObject(url.searchParams);
+function buildContext(request, getUrl, rawParams, def, opts) {
+    const set = makeLazySet();
+    const hasHeadersSchema = !!def.request?.headers;
+    const hasQuerySchema = !!def.request?.query;
+    let headersObj;
+    let queryObj;
+    const buildHeaders = () => (headersObj ??= headersToObject(request.headers));
+    const buildQuery = () => (queryObj ??= queryToObject(getUrl().searchParams));
     let params = rawParams;
-    let query = queryObj;
-    let headers = headersObj;
+    let query;
+    let headers;
     let body = undefined;
-    if (def.request?.params) {
-        const r = await validate(def.request.params, rawParams);
-        if (r.issues)
-            throw new ValidationError("params", toIssues(r.issues));
-        params = r.value;
-    }
-    if (def.request?.query) {
-        const r = await validate(def.request.query, queryObj);
-        if (r.issues)
-            throw new ValidationError("query", toIssues(r.issues));
-        query = r.value;
-    }
-    if (def.request?.headers) {
-        const r = await validate(def.request.headers, headersObj);
-        if (r.issues)
-            throw new ValidationError("headers", toIssues(r.issues));
-        headers = r.value;
-    }
-    if (def.request?.body) {
-        const ct = (request.headers.get("content-type") ?? "").toLowerCase();
-        const allowed = def.accepts ?? opts.allowedContentTypes ?? [
-            "application/json",
-            "application/x-www-form-urlencoded",
-            "multipart/form-data",
-        ];
-        if (!allowed.some((a) => ct.includes(a))) {
-            throw new UnsupportedMediaTypeError(ct || "(none)", allowed);
-        }
-        const raw = await readBody(request, ct, opts.bodyLimitBytes, opts.multipart);
-        const r = await validate(def.request.body, raw);
-        if (r.issues)
-            throw new ValidationError("body", toIssues(r.issues));
-        body = r.value;
-    }
-    return { request, params, query, headers, body, state: {}, set };
+    const hasSchema = def.request?.params || def.request?.query || def.request?.headers || def.request?.body;
+    const finishContext = () => {
+        const ctx = {
+            request,
+            params,
+            body,
+            state: {},
+            set,
+        };
+        if (hasQuerySchema) {
+            ctx.query = query;
+        }
+        else {
+            defineLazyContextProperty(ctx, "query", buildQuery);
+        }
+        if (hasHeadersSchema) {
+            ctx.headers = headers;
+        }
+        else {
+            defineLazyContextProperty(ctx, "headers", buildHeaders);
+        }
+        return ctx;
+    };
+    if (!hasSchema) {
+        return finishContext();
+    }
+    return (async () => {
+        if (def.request?.params) {
+            const r = await validate(def.request.params, rawParams);
+            if (r.issues)
+                throw new ValidationError("params", toIssues(r.issues));
+            params = r.value;
+        }
+        if (hasQuerySchema) {
+            const r = await validate(def.request.query, buildQuery());
+            if (r.issues)
+                throw new ValidationError("query", toIssues(r.issues));
+            query = r.value;
+        }
+        if (hasHeadersSchema) {
+            const r = await validate(def.request.headers, buildHeaders());
+            if (r.issues)
+                throw new ValidationError("headers", toIssues(r.issues));
+            headers = r.value;
+        }
+        if (def.request?.body) {
+            const ct = (request.headers.get("content-type") ?? "").toLowerCase();
+            const allowed = def.accepts ?? opts.allowedContentTypes ?? [
+                "application/json",
+                "application/x-www-form-urlencoded",
+                "multipart/form-data",
+            ];
+            if (!allowed.some((a) => ct.includes(a))) {
+                throw new UnsupportedMediaTypeError(ct || "(none)", allowed);
+            }
+            const raw = await readBody(request, ct, opts.bodyLimitBytes, opts.multipart);
+            const r = await validate(def.request.body, raw);
+            if (r.issues)
+                throw new ValidationError("body", toIssues(r.issues));
+            body = r.value;
+        }
+        return finishContext();
+    })();
+}
+function defineLazyContextProperty(ctx, key, build) {
+    let initialized = false;
+    let value;
+    Object.defineProperty(ctx, key, {
+        get() {
+            if (!initialized) {
+                value = build();
+                initialized = true;
+            }
+            return value;
+        },
+        set(next) {
+            value = next;
+            initialized = true;
+        },
+        enumerable: true,
+        configurable: true,
+    });
 }
 function headersToObject(h) {
     const o = {};
@@ -2155,41 +2390,84 @@ async function readBody(req, ct, limit, multipart) {
     const bytes = await readBodyLimited(req, limit);
     return new TextDecoder().decode(bytes);
 }
-async function serializeResult(result, def, validateResponses) {
+function serializeResult(result, def, validateResponses) {
     const spec = def.responses[result.status];
     if (!spec) {
         throw new InternalError(`Handler returned status ${result.status} which is not declared in responses for ${def.method} ${def.path}`);
     }
+    const finish = () => {
+        const headers = new Headers(result.headers);
+        const explicitCt = headers.get("content-type");
+        const treatAsJson = !explicitCt || explicitCt.includes("application/json");
+        if (!explicitCt)
+            headers.set("content-type", "application/json");
+        let body;
+        let rawBody = null;
+        let isStream = false;
+        if (result.body === undefined || result.body === null) {
+            body = null;
+        }
+        else if (!treatAsJson && typeof result.body === "string") {
+            const bytes = TEXT_ENCODER.encode(result.body);
+            setContentLength(headers, bytes.byteLength);
+            body = bytes;
+            rawBody = bytes;
+        }
+        else if (!treatAsJson && result.body instanceof Uint8Array) {
+            setContentLength(headers, result.body.byteLength);
+            body = result.body;
+            rawBody = result.body;
+        }
+        else if (!treatAsJson && result.body instanceof ArrayBuffer) {
+            setContentLength(headers, result.body.byteLength);
+            body = result.body;
+            rawBody = new Uint8Array(result.body);
+        }
+        else if (!treatAsJson && result.body instanceof ReadableStream) {
+            body = result.body;
+            isStream = true;
+        }
+        else {
+            const bytes = TEXT_ENCODER.encode(JSON.stringify(result.body));
+            setContentLength(headers, bytes.byteLength);
+            body = bytes;
+            rawBody = bytes;
+        }
+        const response = new Response(body, { status: result.status, headers });
+        if (!isStream) {
+            response[DALOY_RAW_BODY] = rawBody;
+        }
+        return response;
+    };
     if (validateResponses && spec.body) {
-        const r = await validate(spec.body, result.body);
-        if (r.issues) {
-            throw new InternalError(`Response body for ${def.method} ${def.path} failed schema validation: ${r.issues
-                .map((i) => i.message)
-                .join("; ")}`);
+        // Call the Standard Schema validator directly so a sync validator
+        // stays on the sync fast path. The public `validate()` helper always
+        // returns a Promise (stable API surface), but here we own the schema
+        // and can branch on whether validation actually needed to suspend.
+        const r = spec.body["~standard"].validate(result.body);
+        if (isPromiseLike(r)) {
+            return r.then((resolved) => {
+                if (resolved.issues) {
+                    throw new InternalError(`Response body for ${def.method} ${def.path} failed schema validation: ${resolved.issues
+                        .map((i) => i.message)
+                        .join("; ")}`);
+                }
+                return finish();
+            });
+        }
+        else {
+            if (r.issues) {
+                throw new InternalError(`Response body for ${def.method} ${def.path} failed schema validation: ${r.issues
+                    .map((i) => i.message)
+                    .join("; ")}`);
+            }
         }
     }
-    const headers = new Headers(result.headers);
-    const explicitCt = headers.get("content-type");
-    const treatAsJson = !explicitCt || explicitCt.includes("application/json");
-    if (!explicitCt)
-        headers.set("content-type", "application/json");
-    let body;
-    if (result.body === undefined || result.body === null) {
-        body = null;
-    }
-    else if (!treatAsJson &&
-        (typeof result.body === "string" ||
-            result.body instanceof Uint8Array ||
-            result.body instanceof ArrayBuffer)) {
-        body = result.body;
-    }
-    else if (!treatAsJson && result.body instanceof ReadableStream) {
-        body = result.body;
-    }
-    else {
-        body = JSON.stringify(result.body);
-    }
-    return new Response(body, { status: result.status, headers });
+    return finish();
+}
+function setContentLength(headers, byteLength) {
+    if (!headers.has("content-length"))
+        headers.set("content-length", String(byteLength));
 }
 function mockResponseFor(def) {
     const statuses = Object.keys(def.responses).map(Number).sort();
@@ -2203,10 +2481,11 @@ function mockResponseFor(def) {
     return { status, body: example };
 }
 function runHandler(def, ctx, requestTimeoutMs) {
-    const handlerPromise = Promise.resolve(def.handler(ctx));
-    return requestTimeoutMs > 0
-        ? withTimeout(handlerPromise, requestTimeoutMs)
-        : handlerPromise;
+    const result = def.handler(ctx);
+    if (requestTimeoutMs === 0 || !isPromiseLike(result)) {
+        return result;
+    }
+    return withTimeout(result, requestTimeoutMs);
 }
 function withTimeout(p, ms) {
     return new Promise((resolve, reject) => {
@@ -2347,4 +2626,3 @@ function readHostPackageJsonInfo() {
 export function _resetPackageJsonCacheForTests() {
     PACKAGE_JSON_CACHE.value = undefined;
 }
-//# sourceMappingURL=app.js.map