@daloyjs/core 0.35.1 → 0.35.2

package/dist/adapters/node.d.ts

@@ -23,6 +23,17 @@ export interface NodeServerOptions {
      * clients can spoof the scheme/host. Default: false.
      */
     trustProxy?: boolean;
+    /**
+     * Maximum declared `Content-Length` (in bytes) for which the Node adapter
+     * pre-buffers the request body into a `Uint8Array` before constructing the
+     * `Request`. Bodies above this threshold fall back to the streaming
+     * `Readable.toWeb(req)` path so the adapter never holds an unbounded buffer
+     * per in-flight request — important under high concurrency where N
+     * simultaneous large uploads would otherwise pin N × threshold bytes of
+     * memory. The threshold is independently capped by `App.bodyLimitBytes`,
+     * which is the actual security limit. Default: 256 KiB.
+     */
+    bufferedBodyMaxBytes?: number;
 }
 /** Handle returned by {@link serve} exposing the underlying Node `Server` plus a `close()` for graceful shutdown. */
 export interface NodeServerHandle {

package/dist/adapters/node.js

@@ -4,11 +4,14 @@
  */
 import { createServer, } from "node:http";
 import { Readable } from "node:stream";
-import { DALOY_RAW_BODY } from "../app.js";
+import { DALOY_RAW_BODY, DALOY_RAW_STREAM, DALOY_REQUEST_RAW_BODY } from "../app.js";
 import { FrameSink, encodeFrame, encodeClosePayload, encodeSendPayload, validateUpgrade, validateSelectedSubprotocol, checkWebSocketOrigin, WS_OPCODE, WS_CLOSE_CODE, WS_READY_STATE, WS_MAX_CONTROL_PAYLOAD, WebSocketProtocolError, WebSocketPayloadTooLargeError, } from "../websocket.js";
 /** Start a Node.js HTTP (and optional WebSocket) server bound to the given {@link App}. */
 export function serve(app, opts = {}) {
     const trustProxy = opts.trustProxy === true;
+    const bufferedBodyMaxBytes = typeof opts.bufferedBodyMaxBytes === "number" && opts.bufferedBodyMaxBytes >= 0
+        ? opts.bufferedBodyMaxBytes
+        : DEFAULT_BUFFERED_BODY_MAX_BYTES;
     const server = createServer({ maxHeaderSize: opts.maxHeaderBytes ?? 16 * 1024 }, (req, res) => {
         // GET/HEAD: no body work, dispatch directly. Keep this first so the GET
         // hot path doesn't pay for any of the buffering bookkeeping below.
@@ -23,7 +26,7 @@ export function serve(app, opts = {}) {
         // WHATWG-stream adapter that dominates POST throughput on Node.
         const cl = req.headers["content-length"];
         const n = cl ? Number(cl) : NaN;
-        if (Number.isFinite(n) && n >= 0 && n <= BUFFERED_BODY_MAX_BYTES) {
+        if (Number.isFinite(n) && n >= 0 && n <= bufferedBodyMaxBytes) {
             bufferRequestBody(req, n).then((bytes) => dispatchToApp(app, req, res, trustProxy, bytes), (e) => writeAdapterError(res, e));
             return;
         }
@@ -70,12 +73,14 @@ export function serve(app, opts = {}) {
     return { server, port, close };
 }
 /**
- * Maximum content-length (in bytes) that the Node adapter will pre-buffer
- * before constructing the `Request`. Bodies above this fall back to the
- * streaming `Readable.toWeb` path so unbounded uploads can't exhaust
- * adapter memory. 1 MiB matches the default `App.bodyLimitBytes`.
+ * Default pre-buffer ceiling for the Node adapter. 256 KiB is a compromise:
+ * large enough that the vast majority of JSON / form requests stay on the
+ * fast (Uint8Array) path, small enough that N concurrent in-flight bodies
+ * don't pin huge amounts of memory. Override via
+ * {@link NodeServerOptions.bufferedBodyMaxBytes}. The actual security cap
+ * on body size remains `App.bodyLimitBytes`.
  */
-const BUFFERED_BODY_MAX_BYTES = 1024 * 1024;
+const DEFAULT_BUFFERED_BODY_MAX_BYTES = 256 * 1024;
 function dispatchToApp(app, req, res, trustProxy, bufferedBody) {
     let request;
     try {
@@ -111,21 +116,31 @@ function dispatchToApp(app, req, res, trustProxy, bufferedBody) {
 }
 function bufferRequestBody(req, expected) {
     return new Promise((resolve, reject) => {
-        const chunks = [];
+        // Pre-allocate to the declared Content-Length. The caller has already
+        // checked `expected <= BUFFERED_BODY_MAX_BYTES` (1 MiB) so this
+        // allocation is bounded and DoS-safe. Skipping the intermediate
+        // `chunks: Buffer[]` array + `Buffer.concat` avoids one full-body
+        // copy per request — significant at 1 MiB bodies under load.
+        // Use `Buffer.alloc` (zero-filled) rather than `Buffer.allocUnsafe`:
+        // the unsafe variant returns uninitialized memory and is forbidden by
+        // `verify:no-unsafe-buffer`. Any unwritten tail is sliced off below.
+        const out = expected > 0 ? Buffer.alloc(expected) : null;
         let received = 0;
         let settled = false;
         const onData = (chunk) => {
             if (settled)
                 return;
-            received += chunk.length;
-            if (received > expected) {
+            const next = received + chunk.length;
+            if (next > expected) {
                 settled = true;
                 cleanup();
                 req.destroy();
                 reject(new Error("Request body exceeded declared Content-Length"));
                 return;
             }
-            chunks.push(chunk);
+            // out is non-null here because next > 0 implies expected > 0.
+            chunk.copy(out, received);
+            received = next;
         };
         const onEnd = () => {
             if (settled)
@@ -136,7 +151,9 @@ function bufferRequestBody(req, expected) {
                 resolve(new Uint8Array(0));
                 return;
             }
-            const buf = chunks.length === 1 ? chunks[0] : Buffer.concat(chunks, received);
+            // Trust Content-Length: if the client under-delivered we still
+            // resolve the prefix actually received (matches prior behavior).
+            const buf = received === expected ? out : out.subarray(0, received);
             resolve(new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength));
         };
         const onErr = (err) => {
@@ -184,23 +201,40 @@ function toWebRequest(req, trustProxy, bufferedBody) {
     const proto = forwardedProto ??
         (req.socket.encrypted ? "https" : "http");
     const url = `${proto}://${host}${req.url ?? "/"}`;
-    const headers = new Headers();
-    for (const k in reqHeaders) {
-        const v = reqHeaders[k];
-        if (v === undefined)
+    // Build headers from `rawHeaders` (a flat [k0,v0,k1,v1,...] array) instead
+    // of the parsed `req.headers` object. This matches @hono/node-server's
+    // `newHeadersFromIncoming`: one `new Headers([[k,v],...])` constructor
+    // call rather than N `headers.set()` calls. It is also stricter for
+    // duplicate-Host smuggling — Node coalesces some singleton headers down
+    // to the first value on `req.headers`, but `rawHeaders` preserves every
+    // occurrence so `assertNoDuplicateSingletonHeaders` actually sees them.
+    // Skip HTTP/2 pseudo-headers (leading ':') defensively, even though
+    // node:http's createServer is HTTP/1.1 only today.
+    const rawHeaders = req.rawHeaders;
+    const headerPairs = [];
+    for (let i = 0; i < rawHeaders.length; i += 2) {
+        const k = rawHeaders[i];
+        if (k.charCodeAt(0) === 58 /* ':' */)
             continue;
-        headers.set(k, Array.isArray(v) ? v.join(", ") : v);
+        headerPairs.push([k, rawHeaders[i + 1]]);
     }
+    const headers = new Headers(headerPairs);
     const method = req.method ?? "GET";
     if (method === "GET" || method === "HEAD") {
         return new Request(url, { method, headers });
     }
     if (bufferedBody !== undefined) {
-        return new Request(url, {
+        const req2 = new Request(url, {
             method,
             headers,
             body: bufferedBody,
         });
+        // Stash the validated bytes so readBodyLimited (and any other internal
+        // body reader) can skip the WHATWG ReadableStream reader loop. The
+        // adapter has already enforced BUFFERED_BODY_MAX_BYTES + Content-Length
+        // here; readBodyLimited re-checks against the caller's limit.
+        req2[DALOY_REQUEST_RAW_BODY] = bufferedBody;
+        return req2;
     }
     return new Request(url, {
         method,
@@ -234,6 +268,30 @@ function sendWebResponse(res, out) {
         }
         return;
     }
+    // Fast-path: handler returned a raw stream. Check before `!res.body` —
+    // a Node Readable is stashed alongside a null Response body, and the
+    // `new Response(null)` constructor also auto-sets `content-length: 0`
+    // which we must strip so Node falls back to chunked transfer-encoding.
+    const rawStream = res[DALOY_RAW_STREAM];
+    if (rawStream !== undefined) {
+        if (typeof rawStream.pipe === "function" && !(rawStream instanceof ReadableStream)) {
+            // Node `Readable` from the handler: skip the Web-stream bridge entirely
+            // and `.pipe(out)` like Fastify/Koa/Express do.
+            out.removeHeader("content-length");
+            return new Promise((resolve, reject) => {
+                const r = rawStream;
+                const onError = (err) => {
+                    r.destroy();
+                    reject(err);
+                };
+                r.once("error", onError);
+                out.once("error", onError);
+                out.once("finish", () => resolve());
+                r.pipe(out);
+            });
+        }
+        return pumpBody(rawStream, out);
+    }
     if (!res.body) {
         out.end();
         return;
@@ -253,16 +311,20 @@ function sendWebResponse(res, out) {
     }
     return pumpBody(res.body, out);
 }
-async function pumpBody(body, out) {
-    const reader = body.getReader();
-    while (true) {
-        const { done, value } = await reader.read();
-        if (done)
-            break;
-        if (value)
-            out.write(value);
-    }
-    out.end();
+function pumpBody(body, out) {
+    // Delegate to Node's native pipe: it honors backpressure and avoids the
+    // per-chunk microtask overhead of an explicit `await reader.read()` loop.
+    return new Promise((resolve, reject) => {
+        const readable = Readable.fromWeb(body);
+        const onError = (err) => {
+            readable.destroy();
+            reject(err);
+        };
+        readable.once("error", onError);
+        out.once("error", onError);
+        out.once("finish", () => resolve());
+        readable.pipe(out);
+    });
 }
 // ---------- WebSocket upgrade ----------
 async function handleUpgrade(app, req, socket, head, trustProxy) {

package/dist/app.d.ts

@@ -480,6 +480,25 @@ export interface IntrospectedRoute {
  * implementation detail — userland code should never depend on it.
  */
 export declare const DALOY_RAW_BODY: unique symbol;
+/**
+ * Internal Symbol used by adapters to stash a pre-buffered request body on
+ * the `Request` instance. When set, {@link readBodyLimited} skips the
+ * `ReadableStream` reader loop and returns the cached bytes directly after
+ * re-checking them against the caller-supplied limit. Adapters MUST only
+ * attach bytes they have already validated against the configured
+ * {@link AppOptions.bodyLimitBytes}; the limit re-check in
+ * `readBodyLimited` is defense-in-depth, not the primary cap. Module-public
+ * so first-party adapters can opt in; not part of the userland API surface.
+ */
+export declare const DALOY_REQUEST_RAW_BODY: unique symbol;
+/**
+ * Internal Symbol set by handlers/serializers to attach a raw stream
+ * (Node `Readable` or Web `ReadableStream`) to a `Response`. The Node
+ * adapter pipes the stream straight to the socket, skipping the
+ * Web-stream reader bridge. Module-public so first-party adapters can
+ * opt in; userland code should not depend on it.
+ */
+export declare const DALOY_RAW_STREAM: unique symbol;
 /**
  * Contract-first HTTP application.
  *
@@ -535,6 +554,14 @@ export declare class App {
     /** Public registry: enables OpenAPI gen, typed-client gen, dead-route detection. */
     readonly routes: RouteDefinition<any, any, any, any>[];
     private router;
+    /**
+     * Memoized result of `isProduction()`. The inputs (`options.env`,
+     * `options.production`, `process.env.NODE_ENV`) cannot change between
+     * the moment a route is dispatched and the moment its error is rendered,
+     * so reading `process.env.NODE_ENV` on every error response is wasted
+     * work in the hot path. Computed lazily on first read.
+     */
+    private _productionCache;
     /** WebSocket route registry. Adapters look up handlers via `app.webSocketRoutes.find()`. */
     readonly webSocketRoutes: WebSocketRegistry;
     private prefix;
@@ -545,6 +572,13 @@ export declare class App {
     private routeSecurityMarkers;
     /** Decorator bag merged into ctx.state on every request. */
     private decorations;
+    /**
+     * Count of own keys on {@link decorations}. Tracked alongside the bag so the
+     * dispatch hot path can take a `count === 0` fast path and skip the
+     * `Object.assign` spread on the common case (no `app.decorate()` calls).
+     * Updated only when {@link decorate} mutates the bag.
+     */
+    private decorationsCount;
     private installedPlugins;
     private closeHooks;
     private closeHooksRun;

package/dist/app.js

@@ -89,6 +89,25 @@ const TEXT_ENCODER = new TextEncoder();
  * implementation detail — userland code should never depend on it.
  */
 export const DALOY_RAW_BODY = Symbol.for("daloyjs.response.rawBody");
+/**
+ * Internal Symbol used by adapters to stash a pre-buffered request body on
+ * the `Request` instance. When set, {@link readBodyLimited} skips the
+ * `ReadableStream` reader loop and returns the cached bytes directly after
+ * re-checking them against the caller-supplied limit. Adapters MUST only
+ * attach bytes they have already validated against the configured
+ * {@link AppOptions.bodyLimitBytes}; the limit re-check in
+ * `readBodyLimited` is defense-in-depth, not the primary cap. Module-public
+ * so first-party adapters can opt in; not part of the userland API surface.
+ */
+export const DALOY_REQUEST_RAW_BODY = Symbol.for("daloyjs.request.rawBody");
+/**
+ * Internal Symbol set by handlers/serializers to attach a raw stream
+ * (Node `Readable` or Web `ReadableStream`) to a `Response`. The Node
+ * adapter pipes the stream straight to the socket, skipping the
+ * Web-stream reader bridge. Module-public so first-party adapters can
+ * opt in; userland code should not depend on it.
+ */
+export const DALOY_RAW_STREAM = Symbol.for("daloyjs.response.rawStream");
 /**
  * Contract-first HTTP application.
  *
@@ -144,6 +163,14 @@ export class App {
     /** Public registry: enables OpenAPI gen, typed-client gen, dead-route detection. */
     routes = [];
     router = new Router();
+    /**
+     * Memoized result of `isProduction()`. The inputs (`options.env`,
+     * `options.production`, `process.env.NODE_ENV`) cannot change between
+     * the moment a route is dispatched and the moment its error is rendered,
+     * so reading `process.env.NODE_ENV` on every error response is wasted
+     * work in the hot path. Computed lazily on first read.
+     */
+    _productionCache;
     /** WebSocket route registry. Adapters look up handlers via `app.webSocketRoutes.find()`. */
     webSocketRoutes = new WebSocketRegistry();
     prefix = "";
@@ -154,6 +181,13 @@ export class App {
     routeSecurityMarkers = [];
     /** Decorator bag merged into ctx.state on every request. */
     decorations = {};
+    /**
+     * Count of own keys on {@link decorations}. Tracked alongside the bag so the
+     * dispatch hot path can take a `count === 0` fast path and skip the
+     * `Object.assign` spread on the common case (no `app.decorate()` calls).
+     * Updated only when {@link decorate} mutates the bag.
+     */
+    decorationsCount = 0;
     installedPlugins = new Set();
     closeHooks = [];
     closeHooksRun = false;
@@ -383,13 +417,20 @@ export class App {
      * auto-mount and error response detail stripping.
      */
     isProduction() {
+        if (this._productionCache !== undefined)
+            return this._productionCache;
+        let v;
         if (this.options.env !== undefined)
-            return this.options.env === "production";
-        if (this.options.production !== undefined)
-            return this.options.production;
-        return (typeof process !== "undefined" &&
-            typeof process.env !== "undefined" &&
-            process.env.NODE_ENV === "production");
+            v = this.options.env === "production";
+        else if (this.options.production !== undefined)
+            v = this.options.production;
+        else
+            v =
+                typeof process !== "undefined" &&
+                    typeof process.env !== "undefined" &&
+                    process.env.NODE_ENV === "production";
+        this._productionCache = v;
+        return v;
     }
     /**
      * Cross-origin guard. Rejects state-changing requests (`POST` /
@@ -1230,7 +1271,10 @@ export class App {
         if (opts.override === true && Object.prototype.hasOwnProperty.call(this.decorations, key)) {
             this.log.warn({ event: "decorate.override", key }, `decorate("${key}") replaced an existing decoration.`);
         }
+        const hadKey = Object.prototype.hasOwnProperty.call(this.decorations, key);
         this.decorations[key] = value;
+        if (!hadKey)
+            this.decorationsCount++;
         return this;
     }
     /**
@@ -1456,11 +1500,17 @@ export class App {
         }
         this.inflight++;
         const requestId = randomId();
-        const log = this.log.child({
-            requestId,
-            method: request.method,
-            url: request.url,
-        });
+        // Skip the per-request child-logger allocation when the app was
+        // constructed with `{ logger: false }`. noopLogger.child() returns
+        // itself, so the binding is wasted work on every request.
+        const baseLog = this.log;
+        const log = baseLog === noopLogger
+            ? noopLogger
+            : baseLog.child({
+                requestId,
+                method: request.method,
+                url: request.url,
+            });
         const stripFingerprint = this.options.stripServerHeaders !== false;
         let ctx;
         const globalHooks = this.globalHooks;
@@ -1496,12 +1546,11 @@ export class App {
                 this.assertCrossOriginAllowed(request, requestUrl, method, [...this.globalCorsAllows, ...this.corsOriginAllows]);
             }
             if (!match || internalHidden) {
-                const url404 = getUrl();
                 if (internalHidden) {
                     // Don't leak existence via 405/Allow header. Always 404.
-                    throw new NotFoundError(`No route for ${request.method} ${url404.pathname}`);
+                    throw new NotFoundError(`No route for ${request.method} ${pathname}`);
                 }
-                const rawAllowed = this.router.allowedMethods(url404.pathname);
+                const rawAllowed = this.router.allowedMethods(pathname);
                 // Filter out methods whose route definitions are marked
                 // `internal: true` unless the caller explicitly opted in via
                 // app.inject(). This prevents 405/Allow from leaking the
@@ -1509,19 +1558,52 @@ export class App {
                 const allowed = opts.allowInternal
                     ? rawAllowed
                     : rawAllowed.filter((m) => {
-                        const candidate = this.router.find(m, url404.pathname);
+                        const candidate = this.router.find(m, pathname);
                         return candidate?.handler.def.internal !== true;
                     });
-                ctx = {
-                    request,
-                    params: {},
-                    query: Object.fromEntries(url404.searchParams.entries()),
-                    headers: headersToObject(request.headers),
-                    body: undefined,
-                    state: { ...this.decorations, requestId, log },
-                    set: { headers: new Headers() },
-                };
-                ctx.set.headers.set("x-request-id", requestId);
+                // On the throw paths (405 -> MethodNotAllowedError, 404 -> NotFoundError)
+                // ctx is only read by a registered onError hook. Build it lazily so
+                // the common no-hook 404 doesn't allocate a context object, spread
+                // `decorations`, iterate headers, or materialize a `Headers`
+                // instance just to be thrown away. The 204 OPTIONS preflight branch
+                // below uses its own `synthCtx`, so this skip is safe for it too.
+                const needsCtx = allowed.length > 0 && method === "OPTIONS"
+                    ? false // OPTIONS path builds synthCtx
+                    : activeErrorHook !== undefined;
+                if (needsCtx) {
+                    // `query` and `headers` are materialized lazily — the common
+                    // `onError` hook reads `requestId` / path and never touches them,
+                    // so we skip `new URL(...)` + `Object.fromEntries` + the
+                    // `Headers.forEach` on 404 GETs entirely. Setters preserve write
+                    // semantics for hooks that reassign these fields.
+                    let _query;
+                    let _headers;
+                    const reqRef = request;
+                    const reqUrl = requestUrl;
+                    ctx = {
+                        request,
+                        params: {},
+                        get query() {
+                            if (_query !== undefined)
+                                return _query;
+                            const qi = reqUrl.indexOf("?");
+                            if (qi === -1)
+                                return (_query = {});
+                            const hi = reqUrl.indexOf("#", qi + 1);
+                            const qs = hi === -1 ? reqUrl.slice(qi + 1) : reqUrl.slice(qi + 1, hi);
+                            return (_query = Object.fromEntries(new URLSearchParams(qs)));
+                        },
+                        set query(v) { _query = v; },
+                        get headers() {
+                            return (_headers ??= headersToObject(reqRef.headers));
+                        },
+                        set headers(v) { _headers = v; },
+                        body: undefined,
+                        state: { ...this.decorations, requestId, log },
+                        set: { headers: new Headers() },
+                    };
+                    ctx.set.headers.set("x-request-id", requestId);
+                }
                 if (allowed.length > 0) {
                     if (method === "OPTIONS") {
                         // Synthesize a preflight: let global hooks (e.g. CORS) intercept;
@@ -1557,7 +1639,7 @@ export class App {
                     }
                     throw new MethodNotAllowedError(allowed);
                 }
-                throw new NotFoundError(`No route for ${request.method} ${url404.pathname}`);
+                throw new NotFoundError(`No route for ${request.method} ${pathname}`);
             }
             const { def, hooks, mergedHooks: allHooks, hasFinalizeHook } = match.handler;
             activeErrorHook = allHooks.onError;
@@ -1569,7 +1651,14 @@ export class App {
                     await routeOnRequestResult;
             }
             ctx = await buildContext(request, getUrl, match.params, def, this.options);
-            Object.assign(ctx.state, this.decorations, { requestId, log });
+            // Stable two-field write keeps `ctx.state`'s hidden class consistent across
+            // requests for the common no-decorator case. The decorations spread only
+            // fires when `app.decorate()` was actually called.
+            const state = ctx.state;
+            state.requestId = requestId;
+            state.log = log;
+            if (this.decorationsCount !== 0)
+                Object.assign(state, this.decorations);
             if (allHooks.beforeHandle !== undefined) {
                 const beforeResult = allHooks.beforeHandle(ctx);
                 const before = isPromiseLike(beforeResult) ? await beforeResult : beforeResult;
@@ -1617,7 +1706,15 @@ export class App {
             return finalized;
         }
         catch (err) {
-            const handled = await activeErrorHook?.(err, ctx);
+            // Skip the unconditional `await activeErrorHook?.(...)`: when no
+            // error hook is registered (the common case), `await undefined`
+            // still schedules a microtask. Branching first lets the hot error
+            // path stay synchronous.
+            let handled;
+            if (activeErrorHook !== undefined) {
+                const r = activeErrorHook(err, ctx);
+                handled = isPromiseLike(r) ? await r : r;
+            }
             if (handled instanceof Response) {
                 if (ctx)
                     copyContextHeaders(ctx, handled);
@@ -1632,10 +1729,12 @@ export class App {
             // the request at `disconnectStatusCode` (default 499) instead of
             // letting an AbortError bubble up as a generic 5xx. Logged at `info`
             // so disconnect storms do not look like service incidents.
-            const disconnectCode = this.options.disconnectStatusCode ?? 499;
+            // `err instanceof HttpError` first: the framework's own thrown
+            // problem errors short-circuit before any signal/option lookup.
+            const isHttp = err instanceof HttpError;
+            const disconnectCode = isHttp ? 0 : (this.options.disconnectStatusCode ?? 499);
             if (disconnectCode > 0 &&
-                request.signal?.aborted === true &&
-                !(err instanceof HttpError)) {
+                request.signal?.aborted === true) {
                 log.info({ event: "request.disconnected", status: disconnectCode }, "Client disconnected before response was sent");
                 const res = new Response(null, {
                     status: disconnectCode,
@@ -1651,7 +1750,7 @@ export class App {
                     onResponse: activeResponseHook,
                 }, stripFingerprint);
             }
-            const httpErr = err instanceof HttpError
+            const httpErr = isHttp
                 ? err
                 : new InternalError(err instanceof Error ? err.message : "Unexpected error");
             if (httpErr.status >= 500)
@@ -2166,37 +2265,39 @@ function pipeline(fns) {
     });
 }
 /**
- * Marker stamped on `ctx.set` once the `headers` getter has been
- * materialised. {@link copyContextHeaders} consults this to skip the
- * forEach loop entirely on requests where no middleware or handler ever
- * touched `ctx.set.headers` — the default case for the no-middleware
- * benchmark.
+ * Per-request response-side `set` object. Implemented as a class so every
+ * instance shares one V8 hidden class — the previous {@link Object.defineProperty}
+ * based factory installed fresh accessor descriptors on every request, which
+ * forced V8 to treat each `ctx.set` as a unique shape and tanked inline-cache
+ * sharing in `copyContextHeaders` and downstream hooks.
+ *
+ * `_h` is a public-but-underscored slot rather than a `#`-private field so
+ * the compiled output stays target-agnostic; consumer code that reads
+ * `ctx.set.headers` flows through the prototype getter and never sees it.
+ * `touched` replaces the prior `SET_HEADERS_TOUCHED` symbol — same intent,
+ * stable field offset.
  */
-const SET_HEADERS_TOUCHED = Symbol.for("daloyjs.app.setHeadersTouched");
-function makeLazySet() {
-    let h;
-    const set = {};
-    Object.defineProperty(set, "headers", {
-        get() {
-            if (h === undefined) {
-                h = new Headers();
-                set[SET_HEADERS_TOUCHED] = true;
-            }
+class LazyResponseSet {
+    status = undefined;
+    _h = undefined;
+    touched = false;
+    get headers() {
+        const h = this._h;
+        if (h !== undefined)
             return h;
-        },
-        set(v) {
-            h = v;
-            set[SET_HEADERS_TOUCHED] = true;
-        },
-        enumerable: true,
-        configurable: true,
-    });
-    return set;
+        this.touched = true;
+        return (this._h = new Headers());
+    }
+    set headers(v) {
+        this._h = v;
+        this.touched = true;
+    }
 }
 function copyContextHeaders(ctx, res) {
-    if (!ctx.set[SET_HEADERS_TOUCHED])
+    const set = ctx.set;
+    if (set.touched !== true)
         return;
-    ctx.set.headers.forEach((v, k) => {
+    set._h.forEach((v, k) => {
         if (!res.headers.has(k))
             res.headers.set(k, v);
     });
@@ -2204,8 +2305,62 @@ function copyContextHeaders(ctx, res) {
 function hasRequestSchema(request, key) {
     return !!request && !!request[key];
 }
+/**
+ * Stable-shape per-request context. All fields are initialised in fixed
+ * order in the constructor so every dispatched request produces an instance
+ * with the same V8 hidden class — replacing the prior object-literal +
+ * {@link Object.defineProperty} pattern, which gave each request a unique
+ * shape and forced inline-cache misses through every downstream hook.
+ *
+ * `query` / `headers` are prototype getters that either return the value
+ * already stored on `_q` / `_h` (set eagerly by schema validation) or
+ * materialise it lazily from the captured builder closure on first read.
+ * The `_qSet` / `_hSet` flags distinguish "validated, value cached" from
+ * "not yet read" so setters from user hooks remain observable.
+ */
+class RequestContext {
+    request;
+    params;
+    body = undefined;
+    state;
+    set;
+    _q = undefined;
+    _qBuilder = undefined;
+    _qSet = false;
+    _h = undefined;
+    _hBuilder = undefined;
+    _hSet = false;
+    constructor(request, params, state, set) {
+        this.request = request;
+        this.params = params;
+        this.state = state;
+        this.set = set;
+    }
+    get query() {
+        if (this._qSet)
+            return this._q;
+        const b = this._qBuilder;
+        this._qSet = true;
+        return (this._q = b !== undefined ? b() : undefined);
+    }
+    set query(v) {
+        this._q = v;
+        this._qSet = true;
+    }
+    get headers() {
+        if (this._hSet)
+            return this._h;
+        const b = this._hBuilder;
+        this._hSet = true;
+        return (this._h = b !== undefined ? b() : undefined);
+    }
+    set headers(v) {
+        this._h = v;
+        this._hSet = true;
+    }
+}
 function buildContext(request, getUrl, rawParams, def, opts) {
-    const set = makeLazySet();
+    const set = new LazyResponseSet();
     const hasHeadersSchema = !!def.request?.headers;
     const hasQuerySchema = !!def.request?.query;
     let headersObj;
@@ -2218,24 +2373,21 @@ function buildContext(request, getUrl, rawParams, def, opts) {
     let body = undefined;
     const hasSchema = def.request?.params || def.request?.query || def.request?.headers || def.request?.body;
     const finishContext = () => {
-        const ctx = {
-            request,
-            params,
-            body,
-            state: {},
-            set,
-        };
+        const ctx = new RequestContext(request, params, {}, set);
+        ctx.body = body;
         if (hasQuerySchema) {
-            ctx.query = query;
+            ctx._q = query;
+            ctx._qSet = true;
         }
         else {
-            defineLazyContextProperty(ctx, "query", buildQuery);
+            ctx._qBuilder = buildQuery;
         }
         if (hasHeadersSchema) {
-            ctx.headers = headers;
+            ctx._h = headers;
+            ctx._hSet = true;
         }
         else {
-            defineLazyContextProperty(ctx, "headers", buildHeaders);
+            ctx._hBuilder = buildHeaders;
         }
         return ctx;
     };
@@ -2280,25 +2432,6 @@ function buildContext(request, getUrl, rawParams, def, opts) {
         return finishContext();
     })();
 }
-function defineLazyContextProperty(ctx, key, build) {
-    let initialized = false;
-    let value;
-    Object.defineProperty(ctx, key, {
-        get() {
-            if (!initialized) {
-                value = build();
-                initialized = true;
-            }
-            return value;
-        },
-        set(next) {
-            value = next;
-            initialized = true;
-        },
-        enumerable: true,
-        configurable: true,
-    });
-}
 function headersToObject(h) {
     const o = {};
     h.forEach((v, k) => {

package/dist/errors.js

@@ -202,8 +202,12 @@ export class HttpError extends Error {
         if (opts.requestId)
             out.instance = `urn:request:${opts.requestId}`;
         const headers = new Headers({ "content-type": "application/problem+json" });
-        for (const [name, value] of Object.entries(this.headers ?? {})) {
-            headers.set(name, value);
+        // Skip the Object.entries({}) churn on the common case where the
+        // error was constructed without extra response headers.
+        if (this.headers !== undefined) {
+            for (const [name, value] of Object.entries(this.headers)) {
+                headers.set(name, value);
+            }
         }
         // Merge Context.set.headers (CSRF rotation, session renewal,
         // request-id, secureHeaders output) without overriding headers the

package/dist/safe-redirect.d.ts

@@ -38,7 +38,7 @@
  * });
  * ```
  *
- * @since 0.35.1
+ * @since 0.35.2
  */
 /** Reason an open-redirect candidate was refused. */
 export type SafeRedirectBlockReason = "empty-target" | "invalid-control-characters" | "protocol-relative" | "backslash-path" | "path-not-allowed" | "origin-not-allowed" | "scheme-not-allowed" | "parse-failed";
@@ -86,6 +86,6 @@ export interface SafeRedirectOptions {
  * @param target - User-supplied URL candidate (path or absolute URL).
  * @param options - Allowlist + response configuration.
  *
- * @since 0.35.1
+ * @since 0.35.2
  */
 export declare function safeRedirect(target: string, options?: SafeRedirectOptions): Response;

package/dist/safe-redirect.js

@@ -38,7 +38,7 @@
  * });
  * ```
  *
- * @since 0.35.1
+ * @since 0.35.2
  */
 /** Thrown when {@link safeRedirect} refuses a candidate URL and no `fallback` is configured. */
 export class OpenRedirectBlockedError extends Error {
@@ -126,7 +126,7 @@ function classify(target, allowedPaths, allowedOrigins) {
  * @param target - User-supplied URL candidate (path or absolute URL).
  * @param options - Allowlist + response configuration.
  *
- * @since 0.35.1
+ * @since 0.35.2
  */
 export function safeRedirect(target, options = {}) {
     const allowedPaths = options.allowedPaths ?? [];

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3d46c2b6-0b38-564b-9dd2-79098e99155b",
+  "serialNumber": "urn:uuid:1d9fa950-874b-5a89-9b39-98f1bbdfdb30",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-26T23:20:20.188Z",
+    "timestamp": "2026-05-28T07:51:16.251Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.35.1"
+        "version": "0.35.2"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@0.35.1",
+      "bom-ref": "pkg:npm/@daloyjs/core@0.35.2",
       "name": "@daloyjs/core",
-      "version": "0.35.1",
+      "version": "0.35.2",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@0.35.1",
+      "purl": "pkg:npm/@daloyjs/core@0.35.2",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-0.35.1",
+        "tagId": "swidtag--daloyjs-core-0.35.2",
         "name": "@daloyjs/core",
-        "version": "0.35.1",
+        "version": "0.35.2",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@0.35.1",
+      "ref": "pkg:npm/@daloyjs/core@0.35.2",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-0.35.1",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.35.1-3d46c2b6-0b38-564b-9dd2-79098e99155b",
+  "name": "@daloyjs/core-0.35.2",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.35.2-1d9fa950-874b-5a89-9b39-98f1bbdfdb30",
   "creationInfo": {
-    "created": "2026-05-26T23:20:20.188Z",
+    "created": "2026-05-28T07:51:16.251Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "0.35.1",
+      "versionInfo": "0.35.2",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@0.35.1"
+          "referenceLocator": "pkg:npm/@daloyjs/core@0.35.2"
         }
       ]
     }

package/dist/security.d.ts

@@ -85,21 +85,6 @@ export declare function sanitizeHeaderValue(value: string): string;
  * @since 0.1.0
  */
 export declare function timingSafeEqual(a: string, b: string): boolean;
-/**
- * Generate a cryptographically strong, URL-safe identifier (~22 chars).
- *
- * Uses Web Crypto's `crypto.randomUUID()` when available, falling back to
- * 16 random bytes via `crypto.getRandomValues()`. The last-resort fallback
- * (timestamp + `Math.random()`) only triggers in environments without
- * WebCrypto, which is none of Node 20+/Bun/Deno/Cloudflare Workers/Vercel
- * Edge.
- *
- * Suitable for request ids, session ids, and short-lived correlation tokens.
- * Do not use for long-lived secrets unless you also sign or wrap them.
- *
- * @returns A random URL-safe id string.
- * @since 0.1.0
- */
 export declare function randomId(): string;
 /**
  * Header names that MUST appear at most once on a request per RFC 7230.
@@ -338,7 +323,7 @@ export declare function signWebhookPayload(opts: {
  * @returns A sanitized basename safe to combine with a trusted directory.
  * @throws {BadRequestError} When the input reduces to an empty string or
  *   matches a Windows-reserved device name.
- * @since 0.35.1
+ * @since 0.35.0
  */
 export declare function sanitizeFilename(name: string): string;
 /**
@@ -365,7 +350,7 @@ export declare function sanitizeFilename(name: string): string;
  * @param input - The candidate relative path.
  * @returns The input unchanged when safe.
  * @throws {BadRequestError} When the path could escape its base directory.
- * @since 0.35.1
+ * @since 0.35.0
  */
 export declare function assertSafeRelativePath(input: string): string;
 /**
@@ -376,7 +361,7 @@ export declare function assertSafeRelativePath(input: string): string;
  * Returns `true` on the first hit. Use before passing untrusted data
  * into a query object that may be interpreted as an operator expression.
  *
- * @since 0.35.1
+ * @since 0.35.0
  */
 export declare function hasMongoOperatorKeys(value: unknown): boolean;
 /**
@@ -385,6 +370,6 @@ export declare function hasMongoOperatorKeys(value: unknown): boolean;
  * threading it into a NoSQL driver — closes the
  * `{"password": {"$ne": null}}` authentication-bypass class of bug.
  *
- * @since 0.35.1
+ * @since 0.35.0
  */
 export declare function assertNoMongoOperators(value: unknown): void;

package/dist/security.js

@@ -9,6 +9,12 @@
  * - randomId: cryptographically strong request id.
  */
 import { PayloadTooLargeError, BadRequestError, } from "./errors.js";
+// Resolved once at module load. Mirror of `DALOY_REQUEST_RAW_BODY` in
+// app.ts; defined here via the global Symbol registry to avoid an import
+// cycle (app.ts -> security.ts). Adapters attach a pre-validated
+// Uint8Array under this key so readBodyLimited can skip the WHATWG stream
+// reader loop.
+const REQUEST_RAW_BODY = Symbol.for("daloyjs.request.rawBody");
 /**
  * Read a `Request` body to a `Uint8Array` while enforcing a hard byte cap.
  *
@@ -36,6 +42,15 @@ export async function readBodyLimited(req, limit) {
         if (n > limit)
             throw new PayloadTooLargeError(limit);
     }
+    // Fast path: adapter pre-buffered the body and stashed it via the
+    // REQUEST_RAW_BODY symbol. Re-check the limit (defense-in-depth) and
+    // return zero-copy. Skips the WHATWG ReadableStream reader loop entirely.
+    const cached = req[REQUEST_RAW_BODY];
+    if (cached instanceof Uint8Array) {
+        if (cached.byteLength > limit)
+            throw new PayloadTooLargeError(limit);
+        return cached;
+    }
     if (!req.body)
         return new Uint8Array(0);
     const reader = req.body.getReader();
@@ -177,8 +192,20 @@ export function timingSafeEqual(a, b) {
  * @returns A random URL-safe id string.
  * @since 0.1.0
  */
+// Cache the Web Crypto entry points at module load so randomId() doesn't pay
+// for a `globalThis.crypto` + optional-chain property lookup per request.
+// Falls back to the runtime lookup path if Web Crypto is patched/replaced
+// after module load (test harnesses, custom runtimes) — the cache is only
+// trusted when `globalThis.crypto` is still the same reference, otherwise
+// the stubbed object would be silently bypassed.
+const _webCrypto = globalThis.crypto;
+const _randomUUID = _webCrypto && typeof _webCrypto.randomUUID === "function"
+    ? _webCrypto.randomUUID.bind(_webCrypto)
+    : undefined;
 export function randomId() {
     const c = globalThis.crypto;
+    if (c === _webCrypto && _randomUUID !== undefined)
+        return _randomUUID();
     if (c?.randomUUID)
         return c.randomUUID();
     if (c?.getRandomValues) {
@@ -263,11 +290,13 @@ export const RESERVED_INBOUND_HEADER_PREFIXES = Object.freeze([
  * @since 0.36.0
  */
 export function assertNoReservedInternalHeaders(headers) {
+    // WHATWG Headers.forEach() yields lowercased names, so the per-header
+    // .toLowerCase() call this function used to do was dead work on every
+    // request. Skip it.
     headers.forEach((_value, name) => {
-        const lower = name.toLowerCase();
         for (const prefix of RESERVED_INBOUND_HEADER_PREFIXES) {
-            if (lower.startsWith(prefix)) {
-                throw new BadRequestError(`Reserved internal header rejected: ${lower}`);
+            if (name.startsWith(prefix)) {
+                throw new BadRequestError(`Reserved internal header rejected: ${name}`);
             }
         }
     });
@@ -631,7 +660,7 @@ const WINDOWS_RESERVED_NAMES = new Set([
  * @returns A sanitized basename safe to combine with a trusted directory.
  * @throws {BadRequestError} When the input reduces to an empty string or
  *   matches a Windows-reserved device name.
- * @since 0.35.1
+ * @since 0.35.0
  */
 export function sanitizeFilename(name) {
     if (typeof name !== "string") {
@@ -683,7 +712,7 @@ export function sanitizeFilename(name) {
  * @param input - The candidate relative path.
  * @returns The input unchanged when safe.
  * @throws {BadRequestError} When the path could escape its base directory.
- * @since 0.35.1
+ * @since 0.35.0
  */
 export function assertSafeRelativePath(input) {
     if (typeof input !== "string" || input.length === 0) {
@@ -744,7 +773,7 @@ function walkForMongoOperators(value) {
  * Returns `true` on the first hit. Use before passing untrusted data
  * into a query object that may be interpreted as an operator expression.
  *
- * @since 0.35.1
+ * @since 0.35.0
  */
 export function hasMongoOperatorKeys(value) {
     return walkForMongoOperators(value);
@@ -755,7 +784,7 @@ export function hasMongoOperatorKeys(value) {
  * threading it into a NoSQL driver — closes the
  * `{"password": {"$ne": null}}` authentication-bypass class of bug.
  *
- * @since 0.35.1
+ * @since 0.35.0
  */
 export function assertNoMongoOperators(value) {
     if (walkForMongoOperators(value)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "0.35.1",
+  "version": "0.35.2",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {