@daloyjs/core 0.35.0 → 0.35.2

package/dist/app.js

@@ -79,6 +79,35 @@ const DEFAULTS = {
     requestTimeoutMs: 30_000,
     validateResponses: true,
 };
+const TEXT_ENCODER = new TextEncoder();
+/**
+ * Internal Symbol used to stash the raw Uint8Array (or null) body on a
+ * `Response` produced by {@link serializeResult}. Adapters that want to
+ * avoid the cost of `await response.arrayBuffer()` for buffer-backed
+ * responses can read this property and write the bytes directly. The
+ * Symbol is intentionally module-private (not exported) to keep this an
+ * implementation detail — userland code should never depend on it.
+ */
+export const DALOY_RAW_BODY = Symbol.for("daloyjs.response.rawBody");
+/**
+ * Internal Symbol used by adapters to stash a pre-buffered request body on
+ * the `Request` instance. When set, {@link readBodyLimited} skips the
+ * `ReadableStream` reader loop and returns the cached bytes directly after
+ * re-checking them against the caller-supplied limit. Adapters MUST only
+ * attach bytes they have already validated against the configured
+ * {@link AppOptions.bodyLimitBytes}; the limit re-check in
+ * `readBodyLimited` is defense-in-depth, not the primary cap. Module-public
+ * so first-party adapters can opt in; not part of the userland API surface.
+ */
+export const DALOY_REQUEST_RAW_BODY = Symbol.for("daloyjs.request.rawBody");
+/**
+ * Internal Symbol set by handlers/serializers to attach a raw stream
+ * (Node `Readable` or Web `ReadableStream`) to a `Response`. The Node
+ * adapter pipes the stream straight to the socket, skipping the
+ * Web-stream reader bridge. Module-public so first-party adapters can
+ * opt in; userland code should not depend on it.
+ */
+export const DALOY_RAW_STREAM = Symbol.for("daloyjs.response.rawStream");
 /**
  * Contract-first HTTP application.
  *
@@ -134,6 +163,14 @@ export class App {
     /** Public registry: enables OpenAPI gen, typed-client gen, dead-route detection. */
     routes = [];
     router = new Router();
+    /**
+     * Memoized result of `isProduction()`. The inputs (`options.env`,
+     * `options.production`, `process.env.NODE_ENV`) cannot change between
+     * the moment a route is dispatched and the moment its error is rendered,
+     * so reading `process.env.NODE_ENV` on every error response is wasted
+     * work in the hot path. Computed lazily on first read.
+     */
+    _productionCache;
     /** WebSocket route registry. Adapters look up handlers via `app.webSocketRoutes.find()`. */
     webSocketRoutes = new WebSocketRegistry();
     prefix = "";
@@ -144,6 +181,13 @@ export class App {
     routeSecurityMarkers = [];
     /** Decorator bag merged into ctx.state on every request. */
     decorations = {};
+    /**
+     * Count of own keys on {@link decorations}. Tracked alongside the bag so the
+     * dispatch hot path can take a `count === 0` fast path and skip the
+     * `Object.assign` spread on the common case (no `app.decorate()` calls).
+     * Updated only when {@link decorate} mutates the bag.
+     */
+    decorationsCount = 0;
     installedPlugins = new Set();
     closeHooks = [];
     closeHooksRun = false;
@@ -181,6 +225,25 @@ export class App {
      * dashboards see the misconfiguration without flooding on every retry.
      */
     trustProxyWarned = false;
+    /**
+    * Cached merge of `options.hooks` only. Used on the cold 404/405 path
+    * and as the baseline for cross-origin guard decisions when no route
+    * matches.
+     */
+    _globalHooksCache;
+    _globalCorsAllowsCache;
+    get globalHooks() {
+        if (this._globalHooksCache === undefined) {
+            this._globalHooksCache = mergeHooks([this.options.hooks ?? {}]);
+        }
+        return this._globalHooksCache;
+    }
+    get globalCorsAllows() {
+        if (this._globalCorsAllowsCache === undefined) {
+            this._globalCorsAllowsCache = corsOriginAllowsFromHooks([this.options.hooks ?? {}]);
+        }
+        return this._globalCorsAllowsCache;
+    }
     constructor(options = {}) {
         this.options = {
             validateResponses: options.validateResponses ?? DEFAULTS.validateResponses,
@@ -354,13 +417,20 @@ export class App {
      * auto-mount and error response detail stripping.
      */
     isProduction() {
+        if (this._productionCache !== undefined)
+            return this._productionCache;
+        let v;
         if (this.options.env !== undefined)
-            return this.options.env === "production";
-        if (this.options.production !== undefined)
-            return this.options.production;
-        return (typeof process !== "undefined" &&
-            typeof process.env !== "undefined" &&
-            process.env.NODE_ENV === "production");
+            v = this.options.env === "production";
+        else if (this.options.production !== undefined)
+            v = this.options.production;
+        else
+            v =
+                typeof process !== "undefined" &&
+                    typeof process.env !== "undefined" &&
+                    process.env.NODE_ENV === "production";
+        this._productionCache = v;
+        return v;
     }
     /**
      * Cross-origin guard. Rejects state-changing requests (`POST` /
@@ -377,7 +447,7 @@ export class App {
      * routes whose hook chain includes a `cors()` policy allowing the origin
      * are unaffected.
      */
-    assertCrossOriginAllowed(request, url, method, corsOriginAllows) {
+    assertCrossOriginAllowed(request, requestUrl, method, corsOriginAllows) {
         if (this.options.secureDefaults === false)
             return;
         if (this.options.corsCrossOriginGuard === false)
@@ -399,7 +469,8 @@ export class App {
             // Malformed Origin header — refuse loudly.
             throw new ForbiddenError("Cross-origin state-changing request rejected: malformed Origin header.");
         }
-        if (originUrl.origin === url.origin)
+        const reqOrigin = typeof requestUrl === "string" ? new URL(requestUrl).origin : requestUrl.origin;
+        if (originUrl.origin === reqOrigin)
             return;
         if (corsOriginAllows.some((allows) => allows(origin)))
             return;
@@ -728,11 +799,18 @@ export class App {
         const sources = [...this.groupHooks, def.hooks ?? {}];
         const hooks = mergeHooks(sources);
         const corsOriginAllows = corsOriginAllowsFromHooks(sources);
+        const globalHookLayer = this.options.hooks ?? {};
+        const mergedHooks = mergeHooks([globalHookLayer, ...sources]);
+        const hasFinalizeHook = mergedHooks.onSend !== undefined || mergedHooks.onResponse !== undefined;
+        const fullCorsOriginAllows = [
+            ...corsOriginAllowsFromHooks([globalHookLayer]),
+            ...corsOriginAllows,
+        ];
         const securityMarkers = securityMarkersFromHooks([
-            this.options.hooks ?? {},
+            globalHookLayer,
             ...sources,
         ]);
-        this.router.add(def.method, fullPath, { def: merged, hooks, corsOriginAllows }, def.operationId);
+        this.router.add(def.method, fullPath, { def: merged, hooks, mergedHooks, hasFinalizeHook, corsOriginAllows, fullCorsOriginAllows }, def.operationId);
         this.routes.push(merged);
         this.routeSecurityMarkers.push({
             method: merged.method,
@@ -1193,7 +1271,10 @@ export class App {
         if (opts.override === true && Object.prototype.hasOwnProperty.call(this.decorations, key)) {
             this.log.warn({ event: "decorate.override", key }, `decorate("${key}") replaced an existing decoration.`);
         }
+        const hadKey = Object.prototype.hasOwnProperty.call(this.decorations, key);
         this.decorations[key] = value;
+        if (!hadKey)
+            this.decorationsCount++;
         return this;
     }
     /**
@@ -1419,14 +1500,20 @@ export class App {
         }
         this.inflight++;
         const requestId = randomId();
-        const log = this.log.child({
-            requestId,
-            method: request.method,
-            url: request.url,
-        });
+        // Skip the per-request child-logger allocation when the app was
+        // constructed with `{ logger: false }`. noopLogger.child() returns
+        // itself, so the binding is wasted work on every request.
+        const baseLog = this.log;
+        const log = baseLog === noopLogger
+            ? noopLogger
+            : baseLog.child({
+                requestId,
+                method: request.method,
+                url: request.url,
+            });
         const stripFingerprint = this.options.stripServerHeaders !== false;
         let ctx;
-        const globalHooks = mergeHooks([this.options.hooks ?? {}]);
+        const globalHooks = this.globalHooks;
         let activeErrorHook = globalHooks.onError;
         let activeResponseHook = globalHooks.onResponse;
         let activeSendHook = globalHooks.onSend;
@@ -1435,26 +1522,35 @@ export class App {
             assertNoReservedInternalHeaders(request.headers);
             this.assertTrustProxyConfigured(request);
             this.assertBootGuards();
-            await globalHooks.onRequest?.(request);
-            const url = new URL(request.url);
+            if (globalHooks.onRequest !== undefined) {
+                const onRequestResult = globalHooks.onRequest(request);
+                if (isPromiseLike(onRequestResult))
+                    await onRequestResult;
+            }
             const method = request.method;
+            const requestUrl = request.url;
+            const pathname = getPathnameFast(requestUrl);
+            let url;
+            const getUrl = () => (url ??= new URL(requestUrl));
             const headFallback = method === "HEAD";
-            const match = this.router.find(method, url.pathname) ??
-                (headFallback ? this.router.find("GET", url.pathname) : undefined);
+            const match = this.router.find(method, pathname) ??
+                (headFallback ? this.router.find("GET", pathname) : undefined);
             // Hide internal routes from the public adapter surface. The router
             // still finds them so app.inject() can dispatch normally, but
             // app.fetch() responds 404 to avoid leaking existence.
             const internalHidden = match?.handler.def.internal === true && opts.allowInternal !== true;
-            this.assertCrossOriginAllowed(request, url, method, [
-                ...corsOriginAllowsFromHooks([this.options.hooks ?? {}]),
-                ...(match && !internalHidden ? match.handler.corsOriginAllows : this.corsOriginAllows),
-            ]);
+            if (match && !internalHidden) {
+                this.assertCrossOriginAllowed(request, requestUrl, method, match.handler.fullCorsOriginAllows);
+            }
+            else {
+                this.assertCrossOriginAllowed(request, requestUrl, method, [...this.globalCorsAllows, ...this.corsOriginAllows]);
+            }
             if (!match || internalHidden) {
                 if (internalHidden) {
                     // Don't leak existence via 405/Allow header. Always 404.
-                    throw new NotFoundError(`No route for ${request.method} ${url.pathname}`);
+                    throw new NotFoundError(`No route for ${request.method} ${pathname}`);
                 }
-                const rawAllowed = this.router.allowedMethods(url.pathname);
+                const rawAllowed = this.router.allowedMethods(pathname);
                 // Filter out methods whose route definitions are marked
                 // `internal: true` unless the caller explicitly opted in via
                 // app.inject(). This prevents 405/Allow from leaking the
@@ -1462,19 +1558,52 @@ export class App {
                 const allowed = opts.allowInternal
                     ? rawAllowed
                     : rawAllowed.filter((m) => {
-                        const candidate = this.router.find(m, url.pathname);
+                        const candidate = this.router.find(m, pathname);
                         return candidate?.handler.def.internal !== true;
                     });
-                ctx = {
-                    request,
-                    params: {},
-                    query: Object.fromEntries(url.searchParams.entries()),
-                    headers: headersToObject(request.headers),
-                    body: undefined,
-                    state: { ...this.decorations, requestId, log },
-                    set: { headers: new Headers() },
-                };
-                ctx.set.headers.set("x-request-id", requestId);
+                // On the throw paths (405 -> MethodNotAllowedError, 404 -> NotFoundError)
+                // ctx is only read by a registered onError hook. Build it lazily so
+                // the common no-hook 404 doesn't allocate a context object, spread
+                // `decorations`, iterate headers, or materialize a `Headers`
+                // instance just to be thrown away. The 204 OPTIONS preflight branch
+                // below uses its own `synthCtx`, so this skip is safe for it too.
+                const needsCtx = allowed.length > 0 && method === "OPTIONS"
+                    ? false // OPTIONS path builds synthCtx
+                    : activeErrorHook !== undefined;
+                if (needsCtx) {
+                    // `query` and `headers` are materialized lazily — the common
+                    // `onError` hook reads `requestId` / path and never touches them,
+                    // so we skip `new URL(...)` + `Object.fromEntries` + the
+                    // `Headers.forEach` on 404 GETs entirely. Setters preserve write
+                    // semantics for hooks that reassign these fields.
+                    let _query;
+                    let _headers;
+                    const reqRef = request;
+                    const reqUrl = requestUrl;
+                    ctx = {
+                        request,
+                        params: {},
+                        get query() {
+                            if (_query !== undefined)
+                                return _query;
+                            const qi = reqUrl.indexOf("?");
+                            if (qi === -1)
+                                return (_query = {});
+                            const hi = reqUrl.indexOf("#", qi + 1);
+                            const qs = hi === -1 ? reqUrl.slice(qi + 1) : reqUrl.slice(qi + 1, hi);
+                            return (_query = Object.fromEntries(new URLSearchParams(qs)));
+                        },
+                        set query(v) { _query = v; },
+                        get headers() {
+                            return (_headers ??= headersToObject(reqRef.headers));
+                        },
+                        set headers(v) { _headers = v; },
+                        body: undefined,
+                        state: { ...this.decorations, requestId, log },
+                        set: { headers: new Headers() },
+                    };
+                    ctx.set.headers.set("x-request-id", requestId);
+                }
                 if (allowed.length > 0) {
                     if (method === "OPTIONS") {
                         // Synthesize a preflight: let global hooks (e.g. CORS) intercept;
@@ -1492,10 +1621,12 @@ export class App {
                             this.options.hooks ?? {},
                             ...this.groupHooks,
                         ]);
-                        const intercepted = await preflightHooks.beforeHandle?.(synthCtx);
+                        const interceptedResult = preflightHooks.beforeHandle?.(synthCtx);
+                        const intercepted = isPromiseLike(interceptedResult) ? await interceptedResult : interceptedResult;
                         if (intercepted instanceof Response) {
                             copyContextHeaders(synthCtx, intercepted);
-                            return await finalizeResponse(intercepted, synthCtx, preflightHooks, stripFingerprint);
+                            const fin = finalizeResponse(intercepted, synthCtx, preflightHooks, stripFingerprint);
+                            return isPromiseLike(fin) ? await fin : fin;
                         }
                         const res = new Response(null, {
                             status: 204,
@@ -1503,35 +1634,68 @@ export class App {
                         });
                         copyContextHeaders(synthCtx, res);
                         res.headers.set("x-request-id", requestId);
-                        return await finalizeResponse(res, synthCtx, preflightHooks, stripFingerprint);
+                        const fin2 = finalizeResponse(res, synthCtx, preflightHooks, stripFingerprint);
+                        return isPromiseLike(fin2) ? await fin2 : fin2;
                     }
                     throw new MethodNotAllowedError(allowed);
                 }
-                throw new NotFoundError(`No route for ${request.method} ${url.pathname}`);
+                throw new NotFoundError(`No route for ${request.method} ${pathname}`);
             }
-            const { def, hooks } = match.handler;
-            const allHooks = mergeHooks([globalHooks, hooks]);
+            const { def, hooks, mergedHooks: allHooks, hasFinalizeHook } = match.handler;
             activeErrorHook = allHooks.onError;
             activeResponseHook = allHooks.onResponse;
             activeSendHook = allHooks.onSend;
-            await hooks.onRequest?.(request);
-            ctx = await buildContext(request, url, match.params, def, this.options);
-            Object.assign(ctx.state, this.decorations, { requestId, log });
-            ctx.set.headers.set("x-request-id", requestId);
-            const before = await allHooks.beforeHandle?.(ctx);
-            if (before instanceof Response) {
-                copyContextHeaders(ctx, before);
-                return await finalizeResponse(before, ctx, allHooks, stripFingerprint);
+            if (hooks.onRequest !== undefined) {
+                const routeOnRequestResult = hooks.onRequest(request);
+                if (isPromiseLike(routeOnRequestResult))
+                    await routeOnRequestResult;
             }
-            let result = this.options.mockMode
+            ctx = await buildContext(request, getUrl, match.params, def, this.options);
+            // Stable two-field write keeps `ctx.state`'s hidden class consistent across
+            // requests for the common no-decorator case. The decorations spread only
+            // fires when `app.decorate()` was actually called.
+            const state = ctx.state;
+            state.requestId = requestId;
+            state.log = log;
+            if (this.decorationsCount !== 0)
+                Object.assign(state, this.decorations);
+            if (allHooks.beforeHandle !== undefined) {
+                const beforeResult = allHooks.beforeHandle(ctx);
+                const before = isPromiseLike(beforeResult) ? await beforeResult : beforeResult;
+                if (before instanceof Response) {
+                    copyContextHeaders(ctx, before);
+                    if (!before.headers.has("x-request-id"))
+                        before.headers.set("x-request-id", requestId);
+                    if (hasFinalizeHook) {
+                        const fin = finalizeResponse(before, ctx, allHooks, stripFingerprint);
+                        return isPromiseLike(fin) ? await fin : fin;
+                    }
+                    return finalizeFast(before, stripFingerprint);
+                }
+            }
+            const runResult = this.options.mockMode
                 ? mockResponseFor(def)
-                : await runHandler(def, ctx, this.options.requestTimeoutMs);
-            const afterReturn = await allHooks.afterHandle?.(ctx, result);
-            if (afterReturn !== undefined)
-                result = afterReturn;
-            let response = await serializeResult(result, def, this.options.validateResponses ?? true);
+                : runHandler(def, ctx, this.options.requestTimeoutMs);
+            let result = isPromiseLike(runResult) ? await runResult : runResult;
+            if (allHooks.afterHandle !== undefined) {
+                const afterResult = allHooks.afterHandle(ctx, result);
+                const afterReturn = isPromiseLike(afterResult) ? await afterResult : afterResult;
+                if (afterReturn !== undefined)
+                    result = afterReturn;
+            }
+            const serializeResultRes = serializeResult(result, def, this.options.validateResponses ?? true);
+            let response = isPromiseLike(serializeResultRes) ? await serializeResultRes : serializeResultRes;
             copyContextHeaders(ctx, response);
-            const finalized = await finalizeResponse(response, ctx, allHooks, stripFingerprint);
+            if (!response.headers.has("x-request-id"))
+                response.headers.set("x-request-id", requestId);
+            let finalized;
+            if (hasFinalizeHook) {
+                const fin = finalizeResponse(response, ctx, allHooks, stripFingerprint);
+                finalized = isPromiseLike(fin) ? await fin : fin;
+            }
+            else {
+                finalized = finalizeFast(response, stripFingerprint);
+            }
             if (method === "HEAD") {
                 return new Response(null, {
                     status: finalized.status,
@@ -1542,7 +1706,15 @@ export class App {
             return finalized;
         }
         catch (err) {
-            const handled = await activeErrorHook?.(err, ctx);
+            // Skip the unconditional `await activeErrorHook?.(...)`: when no
+            // error hook is registered (the common case), `await undefined`
+            // still schedules a microtask. Branching first lets the hot error
+            // path stay synchronous.
+            let handled;
+            if (activeErrorHook !== undefined) {
+                const r = activeErrorHook(err, ctx);
+                handled = isPromiseLike(r) ? await r : r;
+            }
             if (handled instanceof Response) {
                 if (ctx)
                     copyContextHeaders(ctx, handled);
@@ -1557,10 +1729,12 @@ export class App {
             // the request at `disconnectStatusCode` (default 499) instead of
             // letting an AbortError bubble up as a generic 5xx. Logged at `info`
             // so disconnect storms do not look like service incidents.
-            const disconnectCode = this.options.disconnectStatusCode ?? 499;
+            // `err instanceof HttpError` first: the framework's own thrown
+            // problem errors short-circuit before any signal/option lookup.
+            const isHttp = err instanceof HttpError;
+            const disconnectCode = isHttp ? 0 : (this.options.disconnectStatusCode ?? 499);
             if (disconnectCode > 0 &&
-                request.signal?.aborted === true &&
-                !(err instanceof HttpError)) {
+                request.signal?.aborted === true) {
                 log.info({ event: "request.disconnected", status: disconnectCode }, "Client disconnected before response was sent");
                 const res = new Response(null, {
                     status: disconnectCode,
@@ -1576,7 +1750,7 @@ export class App {
                     onResponse: activeResponseHook,
                 }, stripFingerprint);
             }
-            const httpErr = err instanceof HttpError
+            const httpErr = isHttp
                 ? err
                 : new InternalError(err instanceof Error ? err.message : "Unexpected error");
             if (httpErr.status >= 500)
@@ -1903,6 +2077,34 @@ function isStateChangingMethod(method) {
         method === "PATCH" ||
         method === "DELETE");
 }
+/**
+ * Extract the pathname from a fully-qualified request URL without
+ * constructing a `URL` object. ~10x cheaper than `new URL(...).pathname`
+ * and used on the dispatch hot path; full `URL` parsing is deferred until
+ * something actually reads `searchParams`. Mirrors Hono's `getPath`
+ * approach.
+ *
+ * Handles the standard `http(s)://host[:port]/path[?query][#hash]` shape
+ * produced by the Node adapter and the Fetch standard. Falls back to a
+ * `URL` parse for inputs that don't match (e.g. opaque schemes), so
+ * correctness is preserved even when the fast path doesn't apply.
+ */
+function getPathnameFast(url) {
+    const schemeEnd = url.indexOf("://");
+    if (schemeEnd === -1)
+        return new URL(url).pathname;
+    const pathStart = url.indexOf("/", schemeEnd + 3);
+    if (pathStart === -1)
+        return "/";
+    let end = url.length;
+    const q = url.indexOf("?", pathStart);
+    if (q !== -1)
+        end = q;
+    const h = url.indexOf("#", pathStart);
+    if (h !== -1 && h < end)
+        end = h;
+    return url.slice(pathStart, end);
+}
 function mergeHooks(layers) {
     const pick = (key) => layers
         .map((h) => h[key])
@@ -1941,6 +2143,11 @@ function stampRequiredScopes(hooks, scopes) {
 function mergeBeforeHandle(beforeHandle, requiredScopes) {
     if (!beforeHandle && requiredScopes.length === 0)
         return undefined;
+    // No scope aggregation needed → return the inner fn as-is so the dispatch
+    // hot path can use the single-fn fast path and avoid an extra closure +
+    // microtask wrapper around a possibly-sync beforeHandle.
+    if (requiredScopes.length === 0)
+        return beforeHandle;
     return async (ctx) => {
         if (requiredScopes.length > 0) {
             const state = ctx.state;
@@ -1958,6 +2165,8 @@ function mergeBeforeHandle(beforeHandle, requiredScopes) {
 function responsePipeline(fns) {
     if (fns.length === 0)
         return undefined;
+    if (fns.length === 1)
+        return fns[0];
     return async (res, ctx) => {
         let current = res;
         for (const fn of fns) {
@@ -1968,19 +2177,59 @@ function responsePipeline(fns) {
         return current;
     };
 }
-async function finalizeResponse(res, ctx, hooks, stripFingerprint = true) {
-    const sent = await hooks.onSend?.(res, ctx);
-    const final = sent instanceof Response ? sent : res;
+function finalizeResponse(res, ctx, hooks, stripFingerprint = true) {
+    let final = res;
+    const finish = (f) => {
+        if (stripFingerprint) {
+            f.headers.delete("server");
+            f.headers.delete("x-powered-by");
+        }
+        if (hooks.onResponse !== undefined) {
+            const onResponseResult = hooks.onResponse(f);
+            if (isPromiseLike(onResponseResult)) {
+                return onResponseResult.then(() => f);
+            }
+        }
+        return f;
+    };
+    if (hooks.onSend !== undefined) {
+        const sentResult = hooks.onSend(res, ctx);
+        if (isPromiseLike(sentResult)) {
+            return sentResult.then((sent) => {
+                if (sent instanceof Response)
+                    final = sent;
+                return finish(final);
+            });
+        }
+        else {
+            if (sentResult instanceof Response)
+                final = sentResult;
+        }
+    }
+    return finish(final);
+}
+function isPromiseLike(value) {
+    return value !== null && typeof value === "object" && typeof value.then === "function";
+}
+/**
+ * Allocation-free finalizer for the common case (no `onSend`/`onResponse`
+ * hooks). Avoids the two `await undefined` microtasks per request that
+ * dominate sub-millisecond dispatch overhead in the no-middleware
+ * benchmark. Behaviour parity with {@link finalizeResponse}: only the
+ * server-fingerprint headers are stripped.
+ */
+function finalizeFast(res, stripFingerprint) {
     if (stripFingerprint) {
-        final.headers.delete("server");
-        final.headers.delete("x-powered-by");
+        res.headers.delete("server");
+        res.headers.delete("x-powered-by");
     }
-    await hooks.onResponse?.(final);
-    return final;
+    return res;
 }
 function chain(fns) {
     if (fns.length === 0)
         return undefined;
+    if (fns.length === 1)
+        return fns[0];
     return (async (...args) => {
         for (const fn of fns)
             await fn(...args);
@@ -1989,6 +2238,8 @@ function chain(fns) {
 function firstResponse(fns) {
     if (fns.length === 0)
         return undefined;
+    if (fns.length === 1)
+        return fns[0];
     return (async (...args) => {
         for (const fn of fns) {
             const r = await fn(...args);
@@ -2001,6 +2252,8 @@ function firstResponse(fns) {
 function pipeline(fns) {
     if (fns.length === 0)
         return undefined;
+    if (fns.length === 1)
+        return fns[0];
     return (async (ctx, value) => {
         let v = value;
         for (const fn of fns) {
@@ -2011,8 +2264,40 @@ function pipeline(fns) {
         return v;
     });
 }
+/**
+ * Per-request response-side `set` object. Implemented as a class so every
+ * instance shares one V8 hidden class — the previous {@link Object.defineProperty}
+ * based factory installed fresh accessor descriptors on every request, which
+ * forced V8 to treat each `ctx.set` as a unique shape and tanked inline-cache
+ * sharing in `copyContextHeaders` and downstream hooks.
+ *
+ * `_h` is a public-but-underscored slot rather than a `#`-private field so
+ * the compiled output stays target-agnostic; consumer code that reads
+ * `ctx.set.headers` flows through the prototype getter and never sees it.
+ * `touched` replaces the prior `SET_HEADERS_TOUCHED` symbol — same intent,
+ * stable field offset.
+ */
+class LazyResponseSet {
+    status = undefined;
+    _h = undefined;
+    touched = false;
+    get headers() {
+        const h = this._h;
+        if (h !== undefined)
+            return h;
+        this.touched = true;
+        return (this._h = new Headers());
+    }
+    set headers(v) {
+        this._h = v;
+        this.touched = true;
+    }
+}
 function copyContextHeaders(ctx, res) {
-    ctx.set.headers.forEach((v, k) => {
+    const set = ctx.set;
+    if (set.touched !== true)
+        return;
+    set._h.forEach((v, k) => {
         if (!res.headers.has(k))
             res.headers.set(k, v);
     });
@@ -2020,49 +2305,132 @@ function copyContextHeaders(ctx, res) {
 function hasRequestSchema(request, key) {
     return !!request && !!request[key];
 }
-async function buildContext(request, url, rawParams, def, opts) {
-    const set = { headers: new Headers() };
-    const headersObj = headersToObject(request.headers);
-    const queryObj = queryToObject(url.searchParams);
+/**
+ * Stable-shape per-request context. All fields are initialised in fixed
+ * order in the constructor so every dispatched request produces an instance
+ * with the same V8 hidden class — replacing the prior object-literal +
+ * {@link Object.defineProperty} pattern, which gave each request a unique
+ * shape and forced inline-cache misses through every downstream hook.
+ *
+ * `query` / `headers` are prototype getters that either return the value
+ * already stored on `_q` / `_h` (set eagerly by schema validation) or
+ * materialise it lazily from the captured builder closure on first read.
+ * The `_qSet` / `_hSet` flags distinguish "validated, value cached" from
+ * "not yet read" so setters from user hooks remain observable.
+ */
+class RequestContext {
+    request;
+    params;
+    body = undefined;
+    state;
+    set;
+    _q = undefined;
+    _qBuilder = undefined;
+    _qSet = false;
+    _h = undefined;
+    _hBuilder = undefined;
+    _hSet = false;
+    constructor(request, params, state, set) {
+        this.request = request;
+        this.params = params;
+        this.state = state;
+        this.set = set;
+    }
+    get query() {
+        if (this._qSet)
+            return this._q;
+        const b = this._qBuilder;
+        this._qSet = true;
+        return (this._q = b !== undefined ? b() : undefined);
+    }
+    set query(v) {
+        this._q = v;
+        this._qSet = true;
+    }
+    get headers() {
+        if (this._hSet)
+            return this._h;
+        const b = this._hBuilder;
+        this._hSet = true;
+        return (this._h = b !== undefined ? b() : undefined);
+    }
+    set headers(v) {
+        this._h = v;
+        this._hSet = true;
+    }
+}
+function buildContext(request, getUrl, rawParams, def, opts) {
+    const set = new LazyResponseSet();
+    const hasHeadersSchema = !!def.request?.headers;
+    const hasQuerySchema = !!def.request?.query;
+    let headersObj;
+    let queryObj;
+    const buildHeaders = () => (headersObj ??= headersToObject(request.headers));
+    const buildQuery = () => (queryObj ??= queryToObject(getUrl().searchParams));
     let params = rawParams;
-    let query = queryObj;
-    let headers = headersObj;
+    let query;
+    let headers;
     let body = undefined;
-    if (def.request?.params) {
-        const r = await validate(def.request.params, rawParams);
-        if (r.issues)
-            throw new ValidationError("params", toIssues(r.issues));
-        params = r.value;
-    }
-    if (def.request?.query) {
-        const r = await validate(def.request.query, queryObj);
-        if (r.issues)
-            throw new ValidationError("query", toIssues(r.issues));
-        query = r.value;
-    }
-    if (def.request?.headers) {
-        const r = await validate(def.request.headers, headersObj);
-        if (r.issues)
-            throw new ValidationError("headers", toIssues(r.issues));
-        headers = r.value;
-    }
-    if (def.request?.body) {
-        const ct = (request.headers.get("content-type") ?? "").toLowerCase();
-        const allowed = def.accepts ?? opts.allowedContentTypes ?? [
-            "application/json",
-            "application/x-www-form-urlencoded",
-            "multipart/form-data",
-        ];
-        if (!allowed.some((a) => ct.includes(a))) {
-            throw new UnsupportedMediaTypeError(ct || "(none)", allowed);
+    const hasSchema = def.request?.params || def.request?.query || def.request?.headers || def.request?.body;
+    const finishContext = () => {
+        const ctx = new RequestContext(request, params, {}, set);
+        ctx.body = body;
+        if (hasQuerySchema) {
+            ctx._q = query;
+            ctx._qSet = true;
         }
-        const raw = await readBody(request, ct, opts.bodyLimitBytes, opts.multipart);
-        const r = await validate(def.request.body, raw);
-        if (r.issues)
-            throw new ValidationError("body", toIssues(r.issues));
-        body = r.value;
-    }
-    return { request, params, query, headers, body, state: {}, set };
+        else {
+            ctx._qBuilder = buildQuery;
+        }
+        if (hasHeadersSchema) {
+            ctx._h = headers;
+            ctx._hSet = true;
+        }
+        else {
+            ctx._hBuilder = buildHeaders;
+        }
+        return ctx;
+    };
+    if (!hasSchema) {
+        return finishContext();
+    }
+    return (async () => {
+        if (def.request?.params) {
+            const r = await validate(def.request.params, rawParams);
+            if (r.issues)
+                throw new ValidationError("params", toIssues(r.issues));
+            params = r.value;
+        }
+        if (hasQuerySchema) {
+            const r = await validate(def.request.query, buildQuery());
+            if (r.issues)
+                throw new ValidationError("query", toIssues(r.issues));
+            query = r.value;
+        }
+        if (hasHeadersSchema) {
+            const r = await validate(def.request.headers, buildHeaders());
+            if (r.issues)
+                throw new ValidationError("headers", toIssues(r.issues));
+            headers = r.value;
+        }
+        if (def.request?.body) {
+            const ct = (request.headers.get("content-type") ?? "").toLowerCase();
+            const allowed = def.accepts ?? opts.allowedContentTypes ?? [
+                "application/json",
+                "application/x-www-form-urlencoded",
+                "multipart/form-data",
+            ];
+            if (!allowed.some((a) => ct.includes(a))) {
+                throw new UnsupportedMediaTypeError(ct || "(none)", allowed);
+            }
+            const raw = await readBody(request, ct, opts.bodyLimitBytes, opts.multipart);
+            const r = await validate(def.request.body, raw);
+            if (r.issues)
+                throw new ValidationError("body", toIssues(r.issues));
+            body = r.value;
+        }
+        return finishContext();
+    })();
 }
 function headersToObject(h) {
     const o = {};
@@ -2155,41 +2523,84 @@ async function readBody(req, ct, limit, multipart) {
     const bytes = await readBodyLimited(req, limit);
     return new TextDecoder().decode(bytes);
 }
-async function serializeResult(result, def, validateResponses) {
+function serializeResult(result, def, validateResponses) {
     const spec = def.responses[result.status];
     if (!spec) {
         throw new InternalError(`Handler returned status ${result.status} which is not declared in responses for ${def.method} ${def.path}`);
     }
+    const finish = () => {
+        const headers = new Headers(result.headers);
+        const explicitCt = headers.get("content-type");
+        const treatAsJson = !explicitCt || explicitCt.includes("application/json");
+        if (!explicitCt)
+            headers.set("content-type", "application/json");
+        let body;
+        let rawBody = null;
+        let isStream = false;
+        if (result.body === undefined || result.body === null) {
+            body = null;
+        }
+        else if (!treatAsJson && typeof result.body === "string") {
+            const bytes = TEXT_ENCODER.encode(result.body);
+            setContentLength(headers, bytes.byteLength);
+            body = bytes;
+            rawBody = bytes;
+        }
+        else if (!treatAsJson && result.body instanceof Uint8Array) {
+            setContentLength(headers, result.body.byteLength);
+            body = result.body;
+            rawBody = result.body;
+        }
+        else if (!treatAsJson && result.body instanceof ArrayBuffer) {
+            setContentLength(headers, result.body.byteLength);
+            body = result.body;
+            rawBody = new Uint8Array(result.body);
+        }
+        else if (!treatAsJson && result.body instanceof ReadableStream) {
+            body = result.body;
+            isStream = true;
+        }
+        else {
+            const bytes = TEXT_ENCODER.encode(JSON.stringify(result.body));
+            setContentLength(headers, bytes.byteLength);
+            body = bytes;
+            rawBody = bytes;
+        }
+        const response = new Response(body, { status: result.status, headers });
+        if (!isStream) {
+            response[DALOY_RAW_BODY] = rawBody;
+        }
+        return response;
+    };
     if (validateResponses && spec.body) {
-        const r = await validate(spec.body, result.body);
-        if (r.issues) {
-            throw new InternalError(`Response body for ${def.method} ${def.path} failed schema validation: ${r.issues
-                .map((i) => i.message)
-                .join("; ")}`);
-        }
-    }
-    const headers = new Headers(result.headers);
-    const explicitCt = headers.get("content-type");
-    const treatAsJson = !explicitCt || explicitCt.includes("application/json");
-    if (!explicitCt)
-        headers.set("content-type", "application/json");
-    let body;
-    if (result.body === undefined || result.body === null) {
-        body = null;
-    }
-    else if (!treatAsJson &&
-        (typeof result.body === "string" ||
-            result.body instanceof Uint8Array ||
-            result.body instanceof ArrayBuffer)) {
-        body = result.body;
-    }
-    else if (!treatAsJson && result.body instanceof ReadableStream) {
-        body = result.body;
-    }
-    else {
-        body = JSON.stringify(result.body);
-    }
-    return new Response(body, { status: result.status, headers });
+        // Call the Standard Schema validator directly so a sync validator
+        // stays on the sync fast path. The public `validate()` helper always
+        // returns a Promise (stable API surface), but here we own the schema
+        // and can branch on whether validation actually needed to suspend.
+        const r = spec.body["~standard"].validate(result.body);
+        if (isPromiseLike(r)) {
+            return r.then((resolved) => {
+                if (resolved.issues) {
+                    throw new InternalError(`Response body for ${def.method} ${def.path} failed schema validation: ${resolved.issues
+                        .map((i) => i.message)
+                        .join("; ")}`);
+                }
+                return finish();
+            });
+        }
+        else {
+            if (r.issues) {
+                throw new InternalError(`Response body for ${def.method} ${def.path} failed schema validation: ${r.issues
+                    .map((i) => i.message)
+                    .join("; ")}`);
+            }
+        }
+    }
+    return finish();
+}
+function setContentLength(headers, byteLength) {
+    if (!headers.has("content-length"))
+        headers.set("content-length", String(byteLength));
 }
 function mockResponseFor(def) {
     const statuses = Object.keys(def.responses).map(Number).sort();
@@ -2203,10 +2614,11 @@ function mockResponseFor(def) {
     return { status, body: example };
 }
 function runHandler(def, ctx, requestTimeoutMs) {
-    const handlerPromise = Promise.resolve(def.handler(ctx));
-    return requestTimeoutMs > 0
-        ? withTimeout(handlerPromise, requestTimeoutMs)
-        : handlerPromise;
+    const result = def.handler(ctx);
+    if (requestTimeoutMs === 0 || !isPromiseLike(result)) {
+        return result;
+    }
+    return withTimeout(result, requestTimeoutMs);
 }
 function withTimeout(p, ms) {
     return new Promise((resolve, reject) => {
@@ -2347,4 +2759,3 @@ function readHostPackageJsonInfo() {
 export function _resetPackageJsonCacheForTests() {
     PACKAGE_JSON_CACHE.value = undefined;
 }
-//# sourceMappingURL=app.js.map