@daloyjs/core 1.0.0-beta.7 → 1.0.0-rc.0

package/README.md

@@ -509,7 +509,7 @@ The core only ever sees `Request → Response`. Adapters live at the edge.
 
 ## Status
 
-DaloyJS is now in the **`1.0.0` beta** (`1.0.0-beta.7`). The public API is feature-complete and stable for the 1.0 line; from `1.0.0` onward, breaking changes follow SemVer and deprecations get at least one minor cycle. Small adjustments are still possible before the `1.0.0` GA if beta feedback surfaces something. The framework is already in use for production trials.
+DaloyJS is now at its **first `1.0.0` release candidate** (`1.0.0-rc.0`). The public API is frozen for the 1.0 line: only bug fixes and documentation land between RC and GA, and from `1.0.0` onward breaking changes follow SemVer with deprecations getting at least one minor cycle. The framework is already in use for production trials.
 
 **Release quality bar.** Every release ships with **≥90% line + function coverage and ≥90% branch coverage**, strict TypeScript, OpenSSF Scorecard, CodeQL + Opengrep dual SAST, zizmor workflow linting, and npm provenance. Coverage was relaxed from a former 100% gate so complex security work isn't blocked chasing throwaway tests for unreachable defensive branches or tsx source-map phantoms; see [AGENTS.md](AGENTS.md) for the policy.
 

package/dist/adapters/node.js

@@ -4,7 +4,7 @@
  */
 import { createServer, } from "node:http";
 import { Readable } from "node:stream";
-import { DALOY_RAW_BODY, DALOY_RAW_STREAM, DALOY_REQUEST_RAW_BODY } from "../app.js";
+import { DALOY_RAW_BODY, DALOY_RAW_STREAM, DALOY_REQUEST_RAW_BODY, DALOY_LIGHT_RESPONSE_OK, } from "../app.js";
 import { setClientCertificate, normalizePeerCertificate, } from "../mtls.js";
 import { FrameSink, encodeFrame, encodeClosePayload, encodeSendPayload, validateUpgrade, validateSelectedSubprotocol, checkWebSocketOrigin, WS_OPCODE, WS_CLOSE_CODE, WS_READY_STATE, WS_MAX_CONTROL_PAYLOAD, WebSocketProtocolError, WebSocketPayloadTooLargeError, } from "../websocket.js";
 /**
@@ -291,6 +291,209 @@ function writeAdapterError(res, e) {
         res.destroy(e);
     }
 }
+/**
+ * Lazily-materializing stand-in for an incoming WHATWG `Request`.
+ *
+ * Constructing a real (undici) `Request` costs ~4µs for GET and far more for
+ * POST-with-body (the constructor wraps the body bytes in a WHATWG
+ * `ReadableStream` that DaloyJS then bypasses anyway via the
+ * `DALOY_REQUEST_RAW_BODY` fast path). The dispatch hot path only ever reads
+ * `url`, `method`, `headers`, `signal`, and the raw-body symbol — so this
+ * shell carries those directly and defers the real `Request` until one of the
+ * less common surfaces (`json()`, `clone()`, `body`, `formData()`, …) is
+ * actually touched.
+ *
+ * Fidelity notes:
+ * - `instanceof Request` holds (prototype chain is re-rooted onto
+ *   `Request.prototype`), and every WHATWG method/getter is overridden here,
+ *   so nothing hits undici's brand-checked prototype accessors.
+ * - `signal` is an inert per-instance `AbortSignal`. This matches the real
+ *   adapter behaviour today: the Node adapter never wires socket aborts into
+ *   the request signal, so the signal never fires in either implementation.
+ * - Passing this object directly to `fetch()` is not supported (undici
+ *   brand-checks its input) — forward with `request.clone()` instead, which
+ *   returns a real `Request`. This mirrors @hono/node-server's shim.
+ *
+ * Security parity: the `Headers` instance is built eagerly from `rawHeaders`
+ * exactly as before, so the duplicate-singleton / reserved-header /
+ * header-count guards in `App.dispatch` see the identical view they saw with
+ * a real `Request`.
+ */
+/** Shared decoder for LightRequest's direct body reads. */
+const LIGHT_TEXT_DECODER = new TextDecoder();
+class LightRequest {
+    #url;
+    #method;
+    #headers;
+    #bodyBytes;
+    #real;
+    #signal;
+    constructor(url, method, headers, bodyBytes) {
+        this.#url = url;
+        this.#method = method;
+        this.#headers = headers;
+        this.#bodyBytes = bodyBytes;
+    }
+    /** Build (once) and return the real undici `Request` for rare surfaces. */
+    #materialize() {
+        return (this.#real ??=
+            this.#bodyBytes !== undefined
+                ? new Request(this.#url, {
+                    method: this.#method,
+                    headers: this.#headers,
+                    body: this.#bodyBytes,
+                })
+                : new Request(this.#url, { method: this.#method, headers: this.#headers }));
+    }
+    get url() {
+        return this.#url;
+    }
+    get method() {
+        return this.#method;
+    }
+    get headers() {
+        return this.#headers;
+    }
+    get signal() {
+        // Inert, lazily created: the Node adapter has never wired socket
+        // teardown into the request signal, so a never-firing signal is
+        // behaviourally identical to the one a real `Request` would carry.
+        return (this.#signal ??= new AbortController().signal);
+    }
+    get body() {
+        return this.#materialize().body;
+    }
+    get bodyUsed() {
+        if (this.#real !== undefined)
+            return this.#real.bodyUsed;
+        return this.#directlyConsumed;
+    }
+    /**
+     * Set when a body method served the pre-buffered bytes directly (no real
+     * `Request` ever existed). Subsequent body reads reject with a `TypeError`
+     * exactly like a consumed WHATWG body would.
+     */
+    #directlyConsumed = false;
+    /**
+     * Serve a body read straight from the pre-buffered bytes when possible.
+     * Returns `undefined` when the caller must delegate to the materialized
+     * real `Request` (no buffered bytes, or a real `Request` already owns the
+     * body state). Enforces single-read semantics via {@link #directlyConsumed}.
+     */
+    #consumeBytes() {
+        if (this.#real !== undefined || this.#bodyBytes === undefined)
+            return undefined;
+        if (this.#directlyConsumed) {
+            throw new TypeError("Body is unusable: Body has already been read");
+        }
+        this.#directlyConsumed = true;
+        return this.#bodyBytes;
+    }
+    // Spec-constant getters: these are exactly the values undici assigns to a
+    // server-side `new Request(url, { method, headers, body })`, hardcoded so
+    // reading them does not force materialization.
+    get cache() {
+        return "default";
+    }
+    get credentials() {
+        return "same-origin";
+    }
+    get destination() {
+        return "";
+    }
+    get integrity() {
+        return "";
+    }
+    get keepalive() {
+        return false;
+    }
+    get mode() {
+        return "cors";
+    }
+    get redirect() {
+        return "follow";
+    }
+    get referrer() {
+        return "about:client";
+    }
+    get referrerPolicy() {
+        return "";
+    }
+    arrayBuffer() {
+        try {
+            const bytes = this.#consumeBytes();
+            if (bytes === undefined)
+                return this.#materialize().arrayBuffer();
+            // Copy: the underlying buffer is also the framework's raw-body cache.
+            return Promise.resolve(bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength));
+        }
+        catch (e) {
+            return Promise.reject(e);
+        }
+    }
+    blob() {
+        return this.#materialize().blob();
+    }
+    bytes() {
+        try {
+            const bytes = this.#consumeBytes();
+            if (bytes === undefined)
+                return this.#materialize().bytes();
+            return Promise.resolve(new Uint8Array(bytes));
+        }
+        catch (e) {
+            return Promise.reject(e);
+        }
+    }
+    formData() {
+        return this.#materialize().formData();
+    }
+    json() {
+        try {
+            const bytes = this.#consumeBytes();
+            if (bytes === undefined)
+                return this.#materialize().json();
+            // JSON.parse (not the framework's safeJsonParse): request.json() is the
+            // raw WHATWG surface, and its error semantics (SyntaxError rejection)
+            // must match a real Request exactly. Framework-parsed bodies go through
+            // readBody()/safeJsonParse and never hit this method.
+            return Promise.resolve(JSON.parse(LIGHT_TEXT_DECODER.decode(bytes)));
+        }
+        catch (e) {
+            return Promise.reject(e);
+        }
+    }
+    text() {
+        try {
+            const bytes = this.#consumeBytes();
+            if (bytes === undefined)
+                return this.#materialize().text();
+            return Promise.resolve(LIGHT_TEXT_DECODER.decode(bytes));
+        }
+        catch (e) {
+            return Promise.reject(e);
+        }
+    }
+    /**
+     * Returns a real, fully-branded `Request` clone — safe to pass to `fetch()`.
+     * Throws a `TypeError` if the body has already been read, per spec.
+     */
+    clone() {
+        if (this.#directlyConsumed) {
+            throw new TypeError("Request body is already used");
+        }
+        return this.#materialize().clone();
+    }
+}
+// `instanceof Request` must hold for handler code and the framework's own
+// checks. Every own getter/method above shadows the brand-checked undici
+// accessors, so the re-rooted chain is only consulted for identity.
+Object.setPrototypeOf(LightRequest.prototype, Request.prototype);
+// This adapter consumes responses via status/headers/DALOY_RAW_BODY only
+// (see sendWebResponse), so serializeResult may skip the undici Response
+// construction for requests dispatched through this shim. Set once on the
+// prototype: zero per-request cost.
+LightRequest.prototype[DALOY_LIGHT_RESPONSE_OK] = true;
 function toWebRequest(req, trustProxy, bufferedBody) {
     const reqHeaders = req.headers;
     const forwardedHost = trustProxy
@@ -323,18 +526,20 @@ function toWebRequest(req, trustProxy, bufferedBody) {
     const headers = new Headers(headerPairs);
     const method = req.method ?? "GET";
     if (method === "GET" || method === "HEAD") {
-        return new Request(url, { method, headers });
+        // LightRequest: skips the ~4µs undici Request constructor on the GET
+        // hot path. Headers are still built eagerly above, so every header
+        // guard sees the same view as before.
+        return new LightRequest(url, method, headers, undefined);
     }
     if (bufferedBody !== undefined) {
-        const req2 = new Request(url, {
-            method,
-            headers,
-            body: bufferedBody,
-        });
-        // Stash the validated bytes so readBodyLimited (and any other internal
-        // body reader) can skip the WHATWG ReadableStream reader loop. The
-        // adapter has already enforced BUFFERED_BODY_MAX_BYTES + Content-Length
-        // here; readBodyLimited re-checks against the caller's limit.
+        // LightRequest with the pre-buffered bytes: skips the (much more
+        // expensive) body-wrapping undici Request constructor. The bytes are
+        // stashed via DALOY_REQUEST_RAW_BODY so readBodyLimited (and any other
+        // internal body reader) skips the WHATWG ReadableStream reader loop.
+        // The adapter has already enforced BUFFERED_BODY_MAX_BYTES +
+        // Content-Length here; readBodyLimited re-checks against the caller's
+        // limit.
+        const req2 = new LightRequest(url, method, headers, bufferedBody);
         req2[DALOY_REQUEST_RAW_BODY] = bufferedBody;
         return req2;
     }

package/dist/app.d.ts

@@ -756,6 +756,17 @@ export declare const DALOY_REQUEST_RAW_BODY: unique symbol;
  * opt in; userland code should not depend on it.
  */
 export declare const DALOY_RAW_STREAM: unique symbol;
+/**
+ * Internal Symbol an adapter sets (once, on its request shim's prototype) to
+ * declare: "the object that ultimately consumes this request's `Response`
+ * only reads `status` / `headers` / {@link DALOY_RAW_BODY} — it never needs a
+ * branded WHATWG `Response`". When present on the incoming request,
+ * {@link serializeResult} may return a {@link LightResponse} and skip the
+ * ~2µs undici `Response` construction per request. Requests without the
+ * marker (Bun / Deno / Workers adapters, tests, direct `app.fetch()` callers)
+ * always get a real `Response`, so the public contract is unchanged.
+ */
+export declare const DALOY_LIGHT_RESPONSE_OK: unique symbol;
 /**
  * Contract-first HTTP application.
  *

package/dist/app.js

@@ -1,7 +1,6 @@
 import { Router } from "./router.js";
 import { WebSocketRegistry, normalizeWebSocketOptions, } from "./websocket.js";
 import { BadRequestError, ForbiddenError, HttpError, InternalError, MethodNotAllowedError, NotFoundError, PayloadTooLargeError, RequestTimeoutError, TooManyRequestsError, UnsupportedMediaTypeError, ValidationError, } from "./errors.js";
-import { validate } from "./schema.js";
 import { readBodyLimited, safeJsonParse, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertHeaderCountWithinLimit, DEFAULT_MAX_HEADER_COUNT, assertStrongSecret, timingSafeEqual, isForbiddenObjectKey, } from "./security.js";
 import { createLogger, noopLogger } from "./logger.js";
 import { generateOpenAPI, openapiToYAML, } from "./openapi.js";
@@ -194,6 +193,99 @@ export const DALOY_REQUEST_RAW_BODY = Symbol.for("daloyjs.request.rawBody");
  * opt in; userland code should not depend on it.
  */
 export const DALOY_RAW_STREAM = Symbol.for("daloyjs.response.rawStream");
+/**
+ * Internal Symbol an adapter sets (once, on its request shim's prototype) to
+ * declare: "the object that ultimately consumes this request's `Response`
+ * only reads `status` / `headers` / {@link DALOY_RAW_BODY} — it never needs a
+ * branded WHATWG `Response`". When present on the incoming request,
+ * {@link serializeResult} may return a {@link LightResponse} and skip the
+ * ~2µs undici `Response` construction per request. Requests without the
+ * marker (Bun / Deno / Workers adapters, tests, direct `app.fetch()` callers)
+ * always get a real `Response`, so the public contract is unchanged.
+ */
+export const DALOY_LIGHT_RESPONSE_OK = Symbol.for("daloyjs.response.lightOk");
+/**
+ * Minimal `Response` stand-in returned on the Node-adapter hot path (gated by
+ * {@link DALOY_LIGHT_RESPONSE_OK}). Carries `status` + a real `Headers`
+ * instance + the raw body bytes via {@link DALOY_RAW_BODY}; every other
+ * WHATWG surface (body streams, `json()`, `clone()`, …) delegates to a
+ * lazily-materialized real `Response`, so hook code that inspects the
+ * response body still behaves exactly as before — it just pays the
+ * construction cost only when it actually does so. `instanceof Response`
+ * holds via prototype re-rooting; all overridden accessors below shadow
+ * undici's brand-checked ones.
+ */
+class LightResponse {
+    #status;
+    #headers;
+    #rawBody;
+    #real;
+    constructor(status, headers, rawBody) {
+        this.#status = status;
+        this.#headers = headers;
+        this.#rawBody = rawBody;
+        this[DALOY_RAW_BODY] = rawBody;
+    }
+    /** Build (once) and return an equivalent real `Response` for rare surfaces. */
+    #materialize() {
+        return (this.#real ??= new Response(this.#rawBody, {
+            status: this.#status,
+            headers: this.#headers,
+        }));
+    }
+    get status() {
+        return this.#status;
+    }
+    get headers() {
+        return this.#headers;
+    }
+    get ok() {
+        return this.#status >= 200 && this.#status <= 299;
+    }
+    // Spec constants for a synthesized (non-network) Response.
+    get statusText() {
+        return "";
+    }
+    get type() {
+        return "default";
+    }
+    get url() {
+        return "";
+    }
+    get redirected() {
+        return false;
+    }
+    get body() {
+        return this.#materialize().body;
+    }
+    get bodyUsed() {
+        return this.#real !== undefined ? this.#real.bodyUsed : false;
+    }
+    arrayBuffer() {
+        return this.#materialize().arrayBuffer();
+    }
+    blob() {
+        return this.#materialize().blob();
+    }
+    bytes() {
+        return this.#materialize().bytes();
+    }
+    formData() {
+        return this.#materialize().formData();
+    }
+    json() {
+        return this.#materialize().json();
+    }
+    text() {
+        return this.#materialize().text();
+    }
+    clone() {
+        return this.#materialize().clone();
+    }
+}
+// `instanceof Response` must hold for hook code and adapter checks. Every
+// own getter/method above shadows undici's brand-checked accessors.
+Object.setPrototypeOf(LightResponse.prototype, Response.prototype);
 /**
  * The DaloyJS application: a contract-first router plus a web-standard
  * `fetch(Request): Promise<Response>` handler that runs unchanged on Node,
@@ -614,6 +706,26 @@ export class App {
         const origin = request.headers.get("origin");
         if (!origin || origin === "null")
             return;
+        // Fast path: when both the Origin header and the request URL are in the
+        // trivially-normalized shape (lowercase ASCII scheme://host[:port] with
+        // no userinfo / percent-escapes / IPv6 brackets), their origins can be
+        // compared as plain strings without two `new URL()` constructions per
+        // request. Anything unusual returns `undefined` and falls back to the
+        // exact WHATWG comparison below — the guard's accept/reject semantics
+        // are identical on both paths.
+        const fastHeaderOrigin = getOriginFast(origin);
+        if (fastHeaderOrigin !== undefined) {
+            const fastReqOrigin = typeof requestUrl === "string" ? getOriginFast(requestUrl) : requestUrl.origin;
+            if (fastReqOrigin !== undefined) {
+                if (fastHeaderOrigin === fastReqOrigin)
+                    return;
+                if (corsOriginAllows.some((allows) => allows(origin)))
+                    return;
+                throw new ForbiddenError(`Cross-origin ${method} from "${fastHeaderOrigin}" rejected: no registered cors() policy allows that origin. ` +
+                    `Register cors({ origin: [...] }) via app.use(...) to allow it, or pass ` +
+                    `app({ corsCrossOriginGuard: false }) / app({ secureDefaults: false }) to disable this guard.`);
+            }
+        }
         let originUrl;
         try {
             originUrl = new URL(origin);
@@ -2287,7 +2399,11 @@ export class App {
                 if (isPromiseLike(routeOnRequestResult))
                     await routeOnRequestResult;
             }
-            ctx = await buildContext(request, getUrl, match.params, def, this.options);
+            // buildContext is sync unless a schema validator or body read actually
+            // suspends — branch on the promise so the fully-sync case never
+            // schedules a microtask.
+            const builtCtx = buildContext(request, getUrl, match.params, def, this.options);
+            ctx = isPromiseLike(builtCtx) ? await builtCtx : builtCtx;
             // Stable two-field write keeps `ctx.state`'s hidden class consistent across
             // requests for the common no-decorator case. The decorations spread only
             // fires when `app.decorate()` was actually called.
@@ -2358,7 +2474,11 @@ export class App {
                 }
                 return finalizedRaw;
             }
-            const serializeResultRes = serializeResult(result, def, this.options.validateResponses ?? true);
+            const serializeResultRes = serializeResult(result, def, this.options.validateResponses ?? true, 
+            // Adapter shims set this marker on their request prototype to declare
+            // that the response consumer only reads status/headers/raw-body — see
+            // DALOY_LIGHT_RESPONSE_OK. Everyone else gets a real Response.
+            request[DALOY_LIGHT_RESPONSE_OK] === true);
             let response = isPromiseLike(serializeResultRes)
                 ? await serializeResultRes
                 : serializeResultRes;
@@ -2807,6 +2927,85 @@ function getPathnameFast(url) {
         end = h;
     return url.slice(pathStart, end);
 }
+/**
+ * Extract the WHATWG origin (`scheme://host[:port]`) from an absolute
+ * `http`/`https` URL or Origin-header value without constructing a `URL`.
+ * Companion to {@link getPathnameFast}, used by the cross-origin guard on
+ * state-changing requests.
+ *
+ * Returns `undefined` — signalling "fall back to `new URL(...).origin`" —
+ * whenever the input is not in the trivially-normalized shape a `URL` parse
+ * would return unchanged: non-`http(s)` schemes, uppercase characters
+ * (scheme/host case-folding), userinfo (`user@host`, which `URL.origin`
+ * strips), percent-escapes, non-ASCII hosts (IDNA/punycode), IPv6 literals
+ * (zero-compression normalization), empty hosts, backslashes (URL treats
+ * `\` as `/`), and explicit default ports (`:80` / `:443`, which
+ * `URL.origin` elides). The fast path therefore never *disagrees* with the
+ * WHATWG origin — it only answers when the answer is unambiguous.
+ */
+function getOriginFast(url) {
+    let hostStart;
+    if (url.startsWith("http://"))
+        hostStart = 7;
+    else if (url.startsWith("https://"))
+        hostStart = 8;
+    else
+        return undefined;
+    // Find the end of the authority: first "/", "?", or "#" after the scheme.
+    let end = url.length;
+    for (let i = hostStart; i < url.length; i++) {
+        const c = url.charCodeAt(i);
+        if (c === 47 /* / */ || c === 63 /* ? */ || c === 35 /* # */) {
+            end = i;
+            break;
+        }
+    }
+    if (end === hostStart)
+        return undefined; // empty host
+    for (let i = hostStart; i < end; i++) {
+        const c = url.charCodeAt(i);
+        // Reject anything that could normalize differently under a real URL
+        // parse: uppercase A-Z, userinfo "@", percent "%", IPv6 "[", backslash
+        // "\", raw whitespace/controls, and all non-ASCII.
+        if ((c >= 65 && c <= 90) /* A-Z */ ||
+            c === 64 /* @ */ ||
+            c === 37 /* % */ ||
+            c === 91 /* [ */ ||
+            c === 92 /* \ */ ||
+            c <= 32 /* controls + space */ ||
+            c >= 127 /* DEL + non-ASCII */) {
+            return undefined;
+        }
+    }
+    const authority = url.slice(hostStart, end);
+    const colon = authority.indexOf(":");
+    if (colon !== -1) {
+        const port = authority.slice(colon + 1);
+        // Trailing ":" alone, an empty port, or a default port all normalize to
+        // no port under URL — fall back rather than replicate that here. A
+        // second ":" (malformed / IPv6-ish) also falls back.
+        if (port.length === 0 || port.indexOf(":") !== -1)
+            return undefined;
+        if ((hostStart === 7 && port === "80") /* http default */ ||
+            (hostStart === 8 && port === "443") /* https default */) {
+            return undefined;
+        }
+        // Port must be all digits; anything else is not trivially normalized.
+        for (let i = 0; i < port.length; i++) {
+            const c = port.charCodeAt(i);
+            if (c < 48 || c > 57)
+                return undefined;
+        }
+        // Leading zeros normalize away under URL ("0080" -> "80"), and ports
+        // above 65535 make the URL constructor *throw* (the guard's malformed-
+        // origin rejection) — both must take the exact WHATWG path.
+        if (port.length > 1 && port.charCodeAt(0) === 48 /* 0 */)
+            return undefined;
+        if (port.length > 5 || (port.length === 5 && Number(port) > 65535))
+            return undefined;
+    }
+    return url.slice(0, end);
+}
 function mergeHooks(layers) {
     const pick = (key) => layers.map((h) => h[key]).filter((f) => typeof f === "function");
     const requiredScopes = requiredScopesFromHooks(layers);
@@ -3183,44 +3382,77 @@ function buildContext(request, getUrl, rawParams, def, opts) {
     if (!hasSchema) {
         return finishContext();
     }
-    return (async () => {
-        if (def.request?.params) {
-            const r = await validate(def.request.params, rawParams);
-            if (r.issues)
-                throw new ValidationError("params", toIssues(r.issues));
-            params = r.value;
+    const applyChecked = (r, part) => {
+        if (r.issues)
+            throw new ValidationError(part, toIssues(r.issues));
+        return r.value;
+    };
+    const validateBodyAndFinish = (raw) => {
+        const r = def.request.body["~standard"].validate(raw);
+        if (isPromiseLike(r)) {
+            return r.then((resolved) => {
+                body = applyChecked(resolved, "body");
+                return finishContext();
+            });
         }
-        if (hasQuerySchema) {
-            const r = await validate(def.request.query, buildQuery());
-            if (r.issues)
-                throw new ValidationError("query", toIssues(r.issues));
-            query = r.value;
+        body = applyChecked(r, "body");
+        return finishContext();
+    };
+    const stepBody = () => {
+        if (!def.request?.body)
+            return finishContext();
+        const ct = (request.headers.get("content-type") ?? "").toLowerCase();
+        const allowed = def.accepts ??
+            opts.allowedContentTypes ?? [
+            "application/json",
+            "application/x-www-form-urlencoded",
+            "multipart/form-data",
+        ];
+        if (!allowed.some((a) => ct.includes(a))) {
+            throw new UnsupportedMediaTypeError(ct || "(none)", allowed);
         }
-        if (hasHeadersSchema) {
-            const r = await validate(def.request.headers, buildHeaders());
-            if (r.issues)
-                throw new ValidationError("headers", toIssues(r.issues));
-            headers = r.value;
-        }
-        if (def.request?.body) {
-            const ct = (request.headers.get("content-type") ?? "").toLowerCase();
-            const allowed = def.accepts ??
-                opts.allowedContentTypes ?? [
-                "application/json",
-                "application/x-www-form-urlencoded",
-                "multipart/form-data",
-            ];
-            if (!allowed.some((a) => ct.includes(a))) {
-                throw new UnsupportedMediaTypeError(ct || "(none)", allowed);
-            }
-            const raw = await readBody(request, ct, opts.bodyLimitBytes, opts.multipart);
-            const r = await validate(def.request.body, raw);
-            if (r.issues)
-                throw new ValidationError("body", toIssues(r.issues));
-            body = r.value;
+        const raw = readBody(request, ct, opts.bodyLimitBytes, opts.multipart);
+        if (isPromiseLike(raw))
+            return raw.then(validateBodyAndFinish);
+        return validateBodyAndFinish(raw);
+    };
+    const stepHeaders = () => {
+        if (!hasHeadersSchema)
+            return stepBody();
+        const r = def.request.headers["~standard"].validate(buildHeaders());
+        if (isPromiseLike(r)) {
+            return r.then((resolved) => {
+                headers = applyChecked(resolved, "headers");
+                return stepBody();
+            });
         }
-        return finishContext();
-    })();
+        headers = applyChecked(r, "headers");
+        return stepBody();
+    };
+    const stepQuery = () => {
+        if (!hasQuerySchema)
+            return stepHeaders();
+        const r = def.request.query["~standard"].validate(buildQuery());
+        if (isPromiseLike(r)) {
+            return r.then((resolved) => {
+                query = applyChecked(resolved, "query");
+                return stepHeaders();
+            });
+        }
+        query = applyChecked(r, "query");
+        return stepHeaders();
+    };
+    if (def.request?.params) {
+        const r = def.request.params["~standard"].validate(rawParams);
+        if (isPromiseLike(r)) {
+            return r.then((resolved) => {
+                params = applyChecked(resolved, "params");
+                return stepQuery();
+            });
+        }
+        params = applyChecked(r, "params");
+    }
+    return stepQuery();
 }
 function headersToObject(h) {
     const o = {};
@@ -3251,26 +3483,79 @@ function toIssues(issues) {
             .join("."),
     }));
 }
-async function readBody(req, ct, limit, multipart) {
+/** Shared decoder for request-body text. Allocating one per request is wasted work. */
+const TEXT_DECODER = new TextDecoder();
+/**
+ * Synchronous fast path for {@link readBodyLimited}: returns the adapter's
+ * pre-buffered body bytes when they are available on the request via
+ * {@link DALOY_REQUEST_RAW_BODY}, or `undefined` when the caller must fall
+ * back to the async streaming read. Runs the exact same Content-Length
+ * validation and size-limit checks (in the same order, throwing the same
+ * errors) as `readBodyLimited`, so the security posture is identical — the
+ * only difference is that a symbol-cache hit never touches the microtask
+ * queue.
+ *
+ * @throws {BadRequestError} When `Content-Length` is present but invalid.
+ * @throws {PayloadTooLargeError} When the declared or actual size exceeds `limit`.
+ */
+function readBodyBytesFast(req, limit) {
+    const cl = req.headers.get("content-length");
+    if (cl) {
+        const n = Number(cl);
+        if (!Number.isFinite(n) || n < 0)
+            throw new BadRequestError("Invalid Content-Length");
+        if (n > limit)
+            throw new PayloadTooLargeError(limit);
+    }
+    const cached = req[DALOY_REQUEST_RAW_BODY];
+    if (cached instanceof Uint8Array) {
+        if (cached.byteLength > limit)
+            throw new PayloadTooLargeError(limit);
+        return cached;
+    }
+    return undefined;
+}
+function parseJsonBodyBytes(bytes) {
+    if (bytes.byteLength === 0)
+        return undefined;
+    return safeJsonParse(TEXT_DECODER.decode(bytes));
+}
+function parseUrlencodedBodyBytes(bytes) {
+    const params = new URLSearchParams(TEXT_DECODER.decode(bytes));
+    // Same Spring4Shell-class defense as queryToObject: Object.fromEntries
+    // would set __proto__ / constructor / prototype as own properties.
+    const out = {};
+    for (const [k, v] of params) {
+        if (isForbiddenObjectKey(k))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+/**
+ * Read and parse a request body according to its content type. Plain
+ * (non-`async`) on purpose: when the adapter pre-buffered the body bytes
+ * (the common JSON POST case on Node), the parse completes synchronously and
+ * the caller stays on the sync dispatch fast path. Falls back to the
+ * streaming `readBodyLimited` promise otherwise. All parsing keeps the
+ * prototype-pollution-safe semantics of the previous implementation.
+ */
+function readBody(req, ct, limit, multipart) {
     if (ct.includes("application/json")) {
-        const bytes = await readBodyLimited(req, limit);
-        if (bytes.byteLength === 0)
-            return undefined;
-        return safeJsonParse(new TextDecoder().decode(bytes));
+        const fast = readBodyBytesFast(req, limit);
+        if (fast !== undefined)
+            return parseJsonBodyBytes(fast);
+        return readBodyLimited(req, limit).then(parseJsonBodyBytes);
     }
     if (ct.includes("application/x-www-form-urlencoded")) {
-        const bytes = await readBodyLimited(req, limit);
-        const params = new URLSearchParams(new TextDecoder().decode(bytes));
-        // Same Spring4Shell-class defense as queryToObject: Object.fromEntries
-        // would set __proto__ / constructor / prototype as own properties.
-        const out = {};
-        for (const [k, v] of params) {
-            if (isForbiddenObjectKey(k))
-                continue;
-            out[k] = v;
-        }
-        return out;
+        const fast = readBodyBytesFast(req, limit);
+        if (fast !== undefined)
+            return parseUrlencodedBodyBytes(fast);
+        return readBodyLimited(req, limit).then(parseUrlencodedBodyBytes);
     }
+    return readBodySlow(req, ct, limit, multipart);
+}
+async function readBodySlow(req, ct, limit, multipart) {
     if (ct.includes("multipart/form-data")) {
         // Fast-fail on an honestly-declared oversize body.
         const cl = req.headers.get("content-length");
@@ -3362,7 +3647,7 @@ function normalizeSunset(value, method, path) {
     }
     return date.toUTCString();
 }
-function serializeResult(result, def, validateResponses) {
+function serializeResult(result, def, validateResponses, lightOk = false) {
     const spec = def.responses[result.status];
     if (!spec) {
         throw new InternalError(`Handler returned status ${result.status} which is not declared in responses for ${def.method} ${def.path}`);
@@ -3424,6 +3709,13 @@ function serializeResult(result, def, validateResponses) {
             body = bytes;
             rawBody = bytes;
         }
+        // Node-adapter hot path (opt-in via DALOY_LIGHT_RESPONSE_OK on the
+        // incoming request): skip the ~2µs undici Response construction. Only
+        // buffer-backed bodies qualify — streams keep the real Response so the
+        // adapter's stream plumbing is untouched.
+        if (lightOk && !isStream) {
+            return new LightResponse(result.status, headers, rawBody);
+        }
         const response = new Response(body, { status: result.status, headers });
         if (!isStream) {
             response[DALOY_RAW_BODY] = rawBody;

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b5480fcc-c870-525f-bf19-08a30ac9e3d6",
+  "serialNumber": "urn:uuid:e297e402-67fc-54e1-a292-02441ebb5d71",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-02T15:07:00.378Z",
+    "timestamp": "2026-07-03T11:51:00.910Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-beta.7"
+        "version": "1.0.0-rc.0"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-beta.7",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
       "name": "@daloyjs/core",
-      "version": "1.0.0-beta.7",
+      "version": "1.0.0-rc.0",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-beta.7",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-beta.7",
+        "tagId": "swidtag--daloyjs-core-1.0.0-rc.0",
         "name": "@daloyjs/core",
-        "version": "1.0.0-beta.7",
+        "version": "1.0.0-rc.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-beta.7",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.0",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-beta.7",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-beta.7-b5480fcc-c870-525f-bf19-08a30ac9e3d6",
+  "name": "@daloyjs/core-1.0.0-rc.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.0-e297e402-67fc-54e1-a292-02441ebb5d71",
   "creationInfo": {
-    "created": "2026-07-02T15:07:00.378Z",
+    "created": "2026-07-03T11:51:00.910Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-beta.7",
+      "versionInfo": "1.0.0-rc.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-beta.7"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.0"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-beta.7",
+  "version": "1.0.0-rc.0",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {