@daloyjs/core 0.35.1 → 0.36.0

package/dist/app.js

@@ -40,6 +40,36 @@ let insecureDefaultsLoggedThisProcess = false;
 export function _resetInsecureDefaultsLogForTests() {
     insecureDefaultsLoggedThisProcess = false;
 }
+/**
+ * The exact set of fields the `"internal-service"` preset flips off when
+ * the caller has not set them explicitly. Surfaced through the boot
+ * audit log entry so operators can see which guards the preset turned
+ * off without re-reading the framework source.
+ */
+const INTERNAL_SERVICE_PRESET_DISABLED = Object.freeze([
+    "secureHeaders auto-install",
+    "corsCrossOriginGuard (state-changing cross-origin write rejection)",
+    "csrf boot guard (session() + state-changing route)",
+    "unconfigured X-Forwarded-* / trustProxy guard",
+]);
+/**
+ * Defaults that the `"internal-service"` preset keeps on. Logged at boot
+ * alongside the disabled list so the audit entry shows the full posture.
+ */
+const INTERNAL_SERVICE_PRESET_KEPT = Object.freeze([
+    "bodyLimitBytes (1 MiB default)",
+    "requestTimeoutMs (30 s default)",
+    "crashOnUnhandledRejection (production)",
+    "weak session secret refuse-to-boot",
+    "cors({ origin: '*' }) refuse-to-boot",
+    "anonymous stateful plugin refuse-to-boot",
+    "stripServerHeaders",
+    "RFC 9457 problem+json prod redaction",
+    "JWT algorithm allowlist + timingSafeEqual credential comparison",
+    "prototype-pollution-safe parsers + isForbiddenObjectKey",
+    "fetchGuard() SSRF defaults",
+    "schema .strict() + response validation when enabled",
+]);
 /**
  * List of secure-by-default surfaces disabled when `secureDefaults: false`
  * is set. Surfaced through the once-per-process `error` log so the operator
@@ -74,6 +104,46 @@ const CANONICAL_HTTP_METHODS = new Set([
     "HEAD",
     "OPTIONS",
 ]);
+/**
+ * Apply a topology-aware security preset on top of caller-supplied
+ * options. Returns a new options object where preset defaults fill in
+ * any field the caller left `undefined`; explicit caller values always
+ * win. Pure / no side effects — the boot audit log is emitted
+ * separately by {@link App.logSecurityPresetIfApplied} so this helper is
+ * safe to call from `new App({ preset: ... })` in test setups.
+ *
+ * The `"internal-service"` preset turns off:
+ *  - `secureHeaders` auto-install (browser-only headers)
+ *  - `corsCrossOriginGuard` (no browser Origin to guard against)
+ *  - `csrf` (set to `"off"` — service-to-service callers aren't browsers)
+ *  - `trustProxy` (set to `false` — explicitly ignore `X-Forwarded-*`
+ *    and silence the unconfigured-proxy 500 guard; the immediate peer
+ *    inside the mesh *is* the caller)
+ *
+ * Everything else (body limits, request timeouts, JWT allowlist,
+ * `crashOnUnhandledRejection`, weak-secret refuse-to-boot, cors-wildcard
+ * refuse-to-boot, anonymous stateful plugin refuse-to-boot,
+ * `stripServerHeaders`, RFC 9457 prod redaction, schema strictness,
+ * `fetchGuard`, parser safety) stays at its standard secure-by-default
+ * value.
+ *
+ * @internal
+ */
+function applySecurityPreset(options) {
+    if (options.preset !== "internal-service")
+        return options;
+    const out = { ...options };
+    if (out.secureHeaders === undefined)
+        out.secureHeaders = false;
+    if (out.corsCrossOriginGuard === undefined)
+        out.corsCrossOriginGuard = false;
+    if (out.csrf === undefined)
+        out.csrf = "off";
+    if (out.trustProxy === undefined && out.behindProxy === undefined) {
+        out.trustProxy = false;
+    }
+    return out;
+}
 const DEFAULTS = {
     bodyLimitBytes: 1024 * 1024,
     requestTimeoutMs: 30_000,
@@ -89,6 +159,25 @@ const TEXT_ENCODER = new TextEncoder();
  * implementation detail — userland code should never depend on it.
  */
 export const DALOY_RAW_BODY = Symbol.for("daloyjs.response.rawBody");
+/**
+ * Internal Symbol used by adapters to stash a pre-buffered request body on
+ * the `Request` instance. When set, {@link readBodyLimited} skips the
+ * `ReadableStream` reader loop and returns the cached bytes directly after
+ * re-checking them against the caller-supplied limit. Adapters MUST only
+ * attach bytes they have already validated against the configured
+ * {@link AppOptions.bodyLimitBytes}; the limit re-check in
+ * `readBodyLimited` is defense-in-depth, not the primary cap. Module-public
+ * so first-party adapters can opt in; not part of the userland API surface.
+ */
+export const DALOY_REQUEST_RAW_BODY = Symbol.for("daloyjs.request.rawBody");
+/**
+ * Internal Symbol set by handlers/serializers to attach a raw stream
+ * (Node `Readable` or Web `ReadableStream`) to a `Response`. The Node
+ * adapter pipes the stream straight to the socket, skipping the
+ * Web-stream reader bridge. Module-public so first-party adapters can
+ * opt in; userland code should not depend on it.
+ */
+export const DALOY_RAW_STREAM = Symbol.for("daloyjs.response.rawStream");
 /**
  * Contract-first HTTP application.
  *
@@ -144,6 +233,14 @@ export class App {
     /** Public registry: enables OpenAPI gen, typed-client gen, dead-route detection. */
     routes = [];
     router = new Router();
+    /**
+     * Memoized result of `isProduction()`. The inputs (`options.env`,
+     * `options.production`, `process.env.NODE_ENV`) cannot change between
+     * the moment a route is dispatched and the moment its error is rendered,
+     * so reading `process.env.NODE_ENV` on every error response is wasted
+     * work in the hot path. Computed lazily on first read.
+     */
+    _productionCache;
     /** WebSocket route registry. Adapters look up handlers via `app.webSocketRoutes.find()`. */
     webSocketRoutes = new WebSocketRegistry();
     prefix = "";
@@ -154,6 +251,13 @@ export class App {
     routeSecurityMarkers = [];
     /** Decorator bag merged into ctx.state on every request. */
     decorations = {};
+    /**
+     * Count of own keys on {@link decorations}. Tracked alongside the bag so the
+     * dispatch hot path can take a `count === 0` fast path and skip the
+     * `Object.assign` spread on the common case (no `app.decorate()` calls).
+     * Updated only when {@link decorate} mutates the bag.
+     */
+    decorationsCount = 0;
     installedPlugins = new Set();
     closeHooks = [];
     closeHooksRun = false;
@@ -211,11 +315,12 @@ export class App {
         return this._globalCorsAllowsCache;
     }
     constructor(options = {}) {
+        const resolved = applySecurityPreset(options);
         this.options = {
-            validateResponses: options.validateResponses ?? DEFAULTS.validateResponses,
-            bodyLimitBytes: options.bodyLimitBytes ?? DEFAULTS.bodyLimitBytes,
-            requestTimeoutMs: options.requestTimeoutMs ?? DEFAULTS.requestTimeoutMs,
-            ...options,
+            validateResponses: resolved.validateResponses ?? DEFAULTS.validateResponses,
+            bodyLimitBytes: resolved.bodyLimitBytes ?? DEFAULTS.bodyLimitBytes,
+            requestTimeoutMs: resolved.requestTimeoutMs ?? DEFAULTS.requestTimeoutMs,
+            ...resolved,
         };
         this.log =
             options.logger === false
@@ -230,6 +335,7 @@ export class App {
         if (this.options.hooks)
             this.assertSecureHookConfig(this.options.hooks);
         this.assertInsecureDefaultsAcknowledged();
+        this.logSecurityPresetIfApplied(options);
         this.installSecureDefaults();
         this.maybeInstallCrashHandlers();
         this.maybeMountDocs();
@@ -284,6 +390,68 @@ export class App {
             }, `app({ secureDefaults: false }) disables: ${DISABLED_BY_INSECURE_DEFAULTS.join(", ")}.`);
         }
     }
+    /**
+     * Emit the one-time boot audit entry for an applied security preset.
+     * Called from the constructor with the *original* (pre-preset) options
+     * so the log captures which fields the preset filled in vs. which the
+     * caller set explicitly. Logged at `info` so the line shows up in
+     * standard production log shipping without being noisy.
+     *
+     * Operators can audit the live posture at any time through
+     * {@link App.getSecurityPosture}.
+     *
+     * @since 0.34.0
+     */
+    logSecurityPresetIfApplied(originalOptions) {
+        if (originalOptions.preset !== "internal-service")
+            return;
+        const userOverrode = [];
+        if (originalOptions.secureHeaders !== undefined)
+            userOverrode.push("secureHeaders");
+        if (originalOptions.corsCrossOriginGuard !== undefined) {
+            userOverrode.push("corsCrossOriginGuard");
+        }
+        if (originalOptions.csrf !== undefined)
+            userOverrode.push("csrf");
+        if (originalOptions.trustProxy !== undefined)
+            userOverrode.push("trustProxy");
+        if (originalOptions.behindProxy !== undefined)
+            userOverrode.push("behindProxy");
+        this.log.info({
+            event: "security.preset.applied",
+            preset: "internal-service",
+            disabled: INTERNAL_SERVICE_PRESET_DISABLED,
+            kept: INTERNAL_SERVICE_PRESET_KEPT,
+            userOverrode,
+        }, `Applied security preset "internal-service": disabled ${INTERNAL_SERVICE_PRESET_DISABLED.length} topology-dependent guards; kept ${INTERNAL_SERVICE_PRESET_KEPT.length} input/credential/SSRF guards on. See app.getSecurityPosture() for the live snapshot.`);
+    }
+    /**
+     * Structured snapshot of the live security posture. Returns the same
+     * data the constructor logs under the `security.preset.applied` audit
+     * event plus the resolved values of every secure-by-default knob, so
+     * operators can build a `/__security` introspection route or a CI
+     * audit without parsing the framework source.
+     *
+     * @since 0.34.0
+     */
+    getSecurityPosture() {
+        const o = this.options;
+        return Object.freeze({
+            preset: o.preset,
+            secureDefaults: o.secureDefaults !== false,
+            secureHeaders: o.secureDefaults !== false && o.secureHeaders !== false,
+            corsCrossOriginGuard: o.secureDefaults !== false && o.corsCrossOriginGuard !== false,
+            csrf: o.csrf === "off" ? "off" : "on",
+            crashOnUnhandledRejection: o.crashOnUnhandledRejection === undefined
+                ? "default"
+                : o.crashOnUnhandledRejection,
+            trustProxy: o.trustProxy === undefined ? "unconfigured" : o.trustProxy,
+            bodyLimitBytes: this.options.bodyLimitBytes,
+            requestTimeoutMs: this.options.requestTimeoutMs,
+            stripServerHeaders: o.stripServerHeaders !== false,
+            production: this.isProduction(),
+        });
+    }
     /**
      * Install the secure-by-default global hooks. Currently:
      *  - {@link secureHeaders} as a group-level hook so every response carries
@@ -383,13 +551,20 @@ export class App {
      * auto-mount and error response detail stripping.
      */
     isProduction() {
+        if (this._productionCache !== undefined)
+            return this._productionCache;
+        let v;
         if (this.options.env !== undefined)
-            return this.options.env === "production";
-        if (this.options.production !== undefined)
-            return this.options.production;
-        return (typeof process !== "undefined" &&
-            typeof process.env !== "undefined" &&
-            process.env.NODE_ENV === "production");
+            v = this.options.env === "production";
+        else if (this.options.production !== undefined)
+            v = this.options.production;
+        else
+            v =
+                typeof process !== "undefined" &&
+                    typeof process.env !== "undefined" &&
+                    process.env.NODE_ENV === "production";
+        this._productionCache = v;
+        return v;
     }
     /**
      * Cross-origin guard. Rejects state-changing requests (`POST` /
@@ -1230,7 +1405,10 @@ export class App {
         if (opts.override === true && Object.prototype.hasOwnProperty.call(this.decorations, key)) {
             this.log.warn({ event: "decorate.override", key }, `decorate("${key}") replaced an existing decoration.`);
         }
+        const hadKey = Object.prototype.hasOwnProperty.call(this.decorations, key);
         this.decorations[key] = value;
+        if (!hadKey)
+            this.decorationsCount++;
         return this;
     }
     /**
@@ -1455,12 +1633,18 @@ export class App {
             });
         }
         this.inflight++;
-        const requestId = randomId();
-        const log = this.log.child({
-            requestId,
-            method: request.method,
-            url: request.url,
-        });
+        let requestId = randomId();
+        // Skip the per-request child-logger allocation when the app was
+        // constructed with `{ logger: false }`. noopLogger.child() returns
+        // itself, so the binding is wasted work on every request.
+        const baseLog = this.log;
+        const log = baseLog === noopLogger
+            ? noopLogger
+            : baseLog.child({
+                requestId,
+                method: request.method,
+                url: request.url,
+            });
         const stripFingerprint = this.options.stripServerHeaders !== false;
         let ctx;
         const globalHooks = this.globalHooks;
@@ -1496,12 +1680,11 @@ export class App {
                 this.assertCrossOriginAllowed(request, requestUrl, method, [...this.globalCorsAllows, ...this.corsOriginAllows]);
             }
             if (!match || internalHidden) {
-                const url404 = getUrl();
                 if (internalHidden) {
                     // Don't leak existence via 405/Allow header. Always 404.
-                    throw new NotFoundError(`No route for ${request.method} ${url404.pathname}`);
+                    throw new NotFoundError(`No route for ${request.method} ${pathname}`);
                 }
-                const rawAllowed = this.router.allowedMethods(url404.pathname);
+                const rawAllowed = this.router.allowedMethods(pathname);
                 // Filter out methods whose route definitions are marked
                 // `internal: true` unless the caller explicitly opted in via
                 // app.inject(). This prevents 405/Allow from leaking the
@@ -1509,19 +1692,52 @@ export class App {
                 const allowed = opts.allowInternal
                     ? rawAllowed
                     : rawAllowed.filter((m) => {
-                        const candidate = this.router.find(m, url404.pathname);
+                        const candidate = this.router.find(m, pathname);
                         return candidate?.handler.def.internal !== true;
                     });
-                ctx = {
-                    request,
-                    params: {},
-                    query: Object.fromEntries(url404.searchParams.entries()),
-                    headers: headersToObject(request.headers),
-                    body: undefined,
-                    state: { ...this.decorations, requestId, log },
-                    set: { headers: new Headers() },
-                };
-                ctx.set.headers.set("x-request-id", requestId);
+                // On the throw paths (405 -> MethodNotAllowedError, 404 -> NotFoundError)
+                // ctx is only read by a registered onError hook. Build it lazily so
+                // the common no-hook 404 doesn't allocate a context object, spread
+                // `decorations`, iterate headers, or materialize a `Headers`
+                // instance just to be thrown away. The 204 OPTIONS preflight branch
+                // below uses its own `synthCtx`, so this skip is safe for it too.
+                const needsCtx = allowed.length > 0 && method === "OPTIONS"
+                    ? false // OPTIONS path builds synthCtx
+                    : activeErrorHook !== undefined;
+                if (needsCtx) {
+                    // `query` and `headers` are materialized lazily — the common
+                    // `onError` hook reads `requestId` / path and never touches them,
+                    // so we skip `new URL(...)` + `Object.fromEntries` + the
+                    // `Headers.forEach` on 404 GETs entirely. Setters preserve write
+                    // semantics for hooks that reassign these fields.
+                    let _query;
+                    let _headers;
+                    const reqRef = request;
+                    const reqUrl = requestUrl;
+                    ctx = {
+                        request,
+                        params: {},
+                        get query() {
+                            if (_query !== undefined)
+                                return _query;
+                            const qi = reqUrl.indexOf("?");
+                            if (qi === -1)
+                                return (_query = {});
+                            const hi = reqUrl.indexOf("#", qi + 1);
+                            const qs = hi === -1 ? reqUrl.slice(qi + 1) : reqUrl.slice(qi + 1, hi);
+                            return (_query = Object.fromEntries(new URLSearchParams(qs)));
+                        },
+                        set query(v) { _query = v; },
+                        get headers() {
+                            return (_headers ??= headersToObject(reqRef.headers));
+                        },
+                        set headers(v) { _headers = v; },
+                        body: undefined,
+                        state: { ...this.decorations, requestId, log },
+                        set: { headers: new Headers() },
+                    };
+                    ctx.set.headers.set("x-request-id", requestId);
+                }
                 if (allowed.length > 0) {
                     if (method === "OPTIONS") {
                         // Synthesize a preflight: let global hooks (e.g. CORS) intercept;
@@ -1557,7 +1773,7 @@ export class App {
                     }
                     throw new MethodNotAllowedError(allowed);
                 }
-                throw new NotFoundError(`No route for ${request.method} ${url404.pathname}`);
+                throw new NotFoundError(`No route for ${request.method} ${pathname}`);
             }
             const { def, hooks, mergedHooks: allHooks, hasFinalizeHook } = match.handler;
             activeErrorHook = allHooks.onError;
@@ -1569,10 +1785,24 @@ export class App {
                     await routeOnRequestResult;
             }
             ctx = await buildContext(request, getUrl, match.params, def, this.options);
-            Object.assign(ctx.state, this.decorations, { requestId, log });
+            // Stable two-field write keeps `ctx.state`'s hidden class consistent across
+            // requests for the common no-decorator case. The decorations spread only
+            // fires when `app.decorate()` was actually called.
+            const state = ctx.state;
+            state.requestId = requestId;
+            state.log = log;
+            if (this.decorationsCount !== 0)
+                Object.assign(state, this.decorations);
             if (allHooks.beforeHandle !== undefined) {
                 const beforeResult = allHooks.beforeHandle(ctx);
                 const before = isPromiseLike(beforeResult) ? await beforeResult : beforeResult;
+                // Honor any request id override applied by middleware (e.g. the
+                // `requestId()` Hooks bundle replaces the framework-generated value
+                // with a trusted incoming header or a user-supplied generator).
+                const overriddenId = state.requestId;
+                if (typeof overriddenId === "string" && overriddenId.length > 0) {
+                    requestId = overriddenId;
+                }
                 if (before instanceof Response) {
                     copyContextHeaders(ctx, before);
                     if (!before.headers.has("x-request-id"))
@@ -1597,8 +1827,10 @@ export class App {
             const serializeResultRes = serializeResult(result, def, this.options.validateResponses ?? true);
             let response = isPromiseLike(serializeResultRes) ? await serializeResultRes : serializeResultRes;
             copyContextHeaders(ctx, response);
-            if (!response.headers.has("x-request-id"))
-                response.headers.set("x-request-id", requestId);
+            // `serializeResult` always builds a fresh Response with no request id —
+            // skip the `has()` probe and set directly. Saves one undici contains()
+            // call per request on the hot path.
+            response.headers.set("x-request-id", requestId);
             let finalized;
             if (hasFinalizeHook) {
                 const fin = finalizeResponse(response, ctx, allHooks, stripFingerprint);
@@ -1617,7 +1849,15 @@ export class App {
             return finalized;
         }
         catch (err) {
-            const handled = await activeErrorHook?.(err, ctx);
+            // Skip the unconditional `await activeErrorHook?.(...)`: when no
+            // error hook is registered (the common case), `await undefined`
+            // still schedules a microtask. Branching first lets the hot error
+            // path stay synchronous.
+            let handled;
+            if (activeErrorHook !== undefined) {
+                const r = activeErrorHook(err, ctx);
+                handled = isPromiseLike(r) ? await r : r;
+            }
             if (handled instanceof Response) {
                 if (ctx)
                     copyContextHeaders(ctx, handled);
@@ -1632,10 +1872,12 @@ export class App {
             // the request at `disconnectStatusCode` (default 499) instead of
             // letting an AbortError bubble up as a generic 5xx. Logged at `info`
             // so disconnect storms do not look like service incidents.
-            const disconnectCode = this.options.disconnectStatusCode ?? 499;
+            // `err instanceof HttpError` first: the framework's own thrown
+            // problem errors short-circuit before any signal/option lookup.
+            const isHttp = err instanceof HttpError;
+            const disconnectCode = isHttp ? 0 : (this.options.disconnectStatusCode ?? 499);
             if (disconnectCode > 0 &&
-                request.signal?.aborted === true &&
-                !(err instanceof HttpError)) {
+                request.signal?.aborted === true) {
                 log.info({ event: "request.disconnected", status: disconnectCode }, "Client disconnected before response was sent");
                 const res = new Response(null, {
                     status: disconnectCode,
@@ -1651,7 +1893,7 @@ export class App {
                     onResponse: activeResponseHook,
                 }, stripFingerprint);
             }
-            const httpErr = err instanceof HttpError
+            const httpErr = isHttp
                 ? err
                 : new InternalError(err instanceof Error ? err.message : "Unexpected error");
             if (httpErr.status >= 500)
@@ -2166,37 +2408,39 @@ function pipeline(fns) {
     });
 }
 /**
- * Marker stamped on `ctx.set` once the `headers` getter has been
- * materialised. {@link copyContextHeaders} consults this to skip the
- * forEach loop entirely on requests where no middleware or handler ever
- * touched `ctx.set.headers` — the default case for the no-middleware
- * benchmark.
+ * Per-request response-side `set` object. Implemented as a class so every
+ * instance shares one V8 hidden class — the previous {@link Object.defineProperty}
+ * based factory installed fresh accessor descriptors on every request, which
+ * forced V8 to treat each `ctx.set` as a unique shape and tanked inline-cache
+ * sharing in `copyContextHeaders` and downstream hooks.
+ *
+ * `_h` is a public-but-underscored slot rather than a `#`-private field so
+ * the compiled output stays target-agnostic; consumer code that reads
+ * `ctx.set.headers` flows through the prototype getter and never sees it.
+ * `touched` replaces the prior `SET_HEADERS_TOUCHED` symbol — same intent,
+ * stable field offset.
  */
-const SET_HEADERS_TOUCHED = Symbol.for("daloyjs.app.setHeadersTouched");
-function makeLazySet() {
-    let h;
-    const set = {};
-    Object.defineProperty(set, "headers", {
-        get() {
-            if (h === undefined) {
-                h = new Headers();
-                set[SET_HEADERS_TOUCHED] = true;
-            }
+class LazyResponseSet {
+    status = undefined;
+    _h = undefined;
+    touched = false;
+    get headers() {
+        const h = this._h;
+        if (h !== undefined)
             return h;
-        },
-        set(v) {
-            h = v;
-            set[SET_HEADERS_TOUCHED] = true;
-        },
-        enumerable: true,
-        configurable: true,
-    });
-    return set;
+        this.touched = true;
+        return (this._h = new Headers());
+    }
+    set headers(v) {
+        this._h = v;
+        this.touched = true;
+    }
 }
 function copyContextHeaders(ctx, res) {
-    if (!ctx.set[SET_HEADERS_TOUCHED])
+    const set = ctx.set;
+    if (set.touched !== true)
         return;
-    ctx.set.headers.forEach((v, k) => {
+    set._h.forEach((v, k) => {
         if (!res.headers.has(k))
             res.headers.set(k, v);
     });
@@ -2204,8 +2448,62 @@ function copyContextHeaders(ctx, res) {
 function hasRequestSchema(request, key) {
     return !!request && !!request[key];
 }
+/**
+ * Stable-shape per-request context. All fields are initialised in fixed
+ * order in the constructor so every dispatched request produces an instance
+ * with the same V8 hidden class — replacing the prior object-literal +
+ * {@link Object.defineProperty} pattern, which gave each request a unique
+ * shape and forced inline-cache misses through every downstream hook.
+ *
+ * `query` / `headers` are prototype getters that either return the value
+ * already stored on `_q` / `_h` (set eagerly by schema validation) or
+ * materialise it lazily from the captured builder closure on first read.
+ * The `_qSet` / `_hSet` flags distinguish "validated, value cached" from
+ * "not yet read" so setters from user hooks remain observable.
+ */
+class RequestContext {
+    request;
+    params;
+    body = undefined;
+    state;
+    set;
+    _q = undefined;
+    _qBuilder = undefined;
+    _qSet = false;
+    _h = undefined;
+    _hBuilder = undefined;
+    _hSet = false;
+    constructor(request, params, state, set) {
+        this.request = request;
+        this.params = params;
+        this.state = state;
+        this.set = set;
+    }
+    get query() {
+        if (this._qSet)
+            return this._q;
+        const b = this._qBuilder;
+        this._qSet = true;
+        return (this._q = b !== undefined ? b() : undefined);
+    }
+    set query(v) {
+        this._q = v;
+        this._qSet = true;
+    }
+    get headers() {
+        if (this._hSet)
+            return this._h;
+        const b = this._hBuilder;
+        this._hSet = true;
+        return (this._h = b !== undefined ? b() : undefined);
+    }
+    set headers(v) {
+        this._h = v;
+        this._hSet = true;
+    }
+}
 function buildContext(request, getUrl, rawParams, def, opts) {
-    const set = makeLazySet();
+    const set = new LazyResponseSet();
     const hasHeadersSchema = !!def.request?.headers;
     const hasQuerySchema = !!def.request?.query;
     let headersObj;
@@ -2218,24 +2516,21 @@ function buildContext(request, getUrl, rawParams, def, opts) {
     let body = undefined;
     const hasSchema = def.request?.params || def.request?.query || def.request?.headers || def.request?.body;
     const finishContext = () => {
-        const ctx = {
-            request,
-            params,
-            body,
-            state: {},
-            set,
-        };
+        const ctx = new RequestContext(request, params, {}, set);
+        ctx.body = body;
         if (hasQuerySchema) {
-            ctx.query = query;
+            ctx._q = query;
+            ctx._qSet = true;
         }
         else {
-            defineLazyContextProperty(ctx, "query", buildQuery);
+            ctx._qBuilder = buildQuery;
         }
         if (hasHeadersSchema) {
-            ctx.headers = headers;
+            ctx._h = headers;
+            ctx._hSet = true;
         }
         else {
-            defineLazyContextProperty(ctx, "headers", buildHeaders);
+            ctx._hBuilder = buildHeaders;
         }
         return ctx;
     };
@@ -2280,25 +2575,6 @@ function buildContext(request, getUrl, rawParams, def, opts) {
         return finishContext();
     })();
 }
-function defineLazyContextProperty(ctx, key, build) {
-    let initialized = false;
-    let value;
-    Object.defineProperty(ctx, key, {
-        get() {
-            if (!initialized) {
-                value = build();
-                initialized = true;
-            }
-            return value;
-        },
-        set(next) {
-            value = next;
-            initialized = true;
-        },
-        enumerable: true,
-        configurable: true,
-    });
-}
 function headersToObject(h) {
     const o = {};
     h.forEach((v, k) => {

package/dist/errors.js

@@ -202,8 +202,12 @@ export class HttpError extends Error {
         if (opts.requestId)
             out.instance = `urn:request:${opts.requestId}`;
         const headers = new Headers({ "content-type": "application/problem+json" });
-        for (const [name, value] of Object.entries(this.headers ?? {})) {
-            headers.set(name, value);
+        // Skip the Object.entries({}) churn on the common case where the
+        // error was constructed without extra response headers.
+        if (this.headers !== undefined) {
+            for (const [name, value] of Object.entries(this.headers)) {
+                headers.set(name, value);
+            }
         }
         // Merge Context.set.headers (CSRF rotation, session renewal,
         // request-id, secureHeaders output) without overriding headers the

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export { createApp } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
 export { _resetCrashHandlersForTests } from "./app.js";
 export { _resetInsecureDefaultsLogForTests } from "./app.js";
-export type { AppOptions, AppOpenAPIOptions, DocsRouteOptions, HealthRouteOptions, CspReportRouteOptions, IntrospectedRoute, PluginInstalledEvent, PluginExtension, ShutdownEvent, } from "./app.js";
+export type { AppOptions, AppOpenAPIOptions, DocsRouteOptions, HealthRouteOptions, CspReportRouteOptions, IntrospectedRoute, PluginInstalledEvent, PluginExtension, ShutdownEvent, SecurityPreset, } from "./app.js";
 export { getConnInfo, setConnInfo, assertBehindProxy, resolveClientIp, readRemoteAddress, readRemotePort, pickForwardedForByHops, } from "./conn-info.js";
 export type { BehindProxyConfig, ConnInfo } from "./conn-info.js";
 export { subdomains, PSL_SNAPSHOT_DATE, PSL_PUBLIC_SUFFIXES, MAX_SNAPSHOT_AGE_DAYS, } from "./subdomains.js";