@daloyjs/core 1.0.0-beta.7 → 1.0.0-rc.1

package/dist/app.js

@@ -1,13 +1,12 @@
 import { Router } from "./router.js";
 import { WebSocketRegistry, normalizeWebSocketOptions, } from "./websocket.js";
 import { BadRequestError, ForbiddenError, HttpError, InternalError, MethodNotAllowedError, NotFoundError, PayloadTooLargeError, RequestTimeoutError, TooManyRequestsError, UnsupportedMediaTypeError, ValidationError, } from "./errors.js";
-import { validate } from "./schema.js";
 import { readBodyLimited, safeJsonParse, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertHeaderCountWithinLimit, DEFAULT_MAX_HEADER_COUNT, assertStrongSecret, timingSafeEqual, isForbiddenObjectKey, } from "./security.js";
 import { createLogger, noopLogger } from "./logger.js";
 import { generateOpenAPI, openapiToYAML, } from "./openapi.js";
 import { asyncapiHtml, docsContentSecurityPolicy, redocHtml, scalarHtml, swaggerUiHtml, } from "./docs.js";
 import { generateAsyncAPI, asyncapiToYAML, } from "./asyncapi.js";
-import { secureHeaders as secureHeadersMiddleware, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, CSRF_HOOK_MARKER, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, SECURE_HEADERS_MARKER, } from "./middleware.js";
+import { secureHeaders as secureHeadersMiddleware, AUTH_HOOK_MARKER, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, CSRF_HOOK_MARKER, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, SECURE_HEADERS_MARKER, } from "./middleware.js";
 import { COMPRESSION_HOOK_MARKER } from "./compression.js";
 import { SESSION_HOOK_MARKER, SESSION_SECRETS_MARKER } from "./session.js";
 import { loadShedding as loadSheddingMiddleware, } from "./load-shedding.js";
@@ -119,6 +118,13 @@ const CANONICAL_HTTP_METHODS = new Set([
     "HEAD",
     "OPTIONS",
 ]);
+/**
+ * Global-registry symbol stamped by `mcpRoutes()` on the route definitions it
+ * produces (unless the caller opts out with `public: true`). Read here — rather
+ * than importing from `mcp.ts` — so the MCP module is never pulled into the core
+ * `App` bundle. Must match the string used in `mcpRoutes`.
+ */
+const MCP_ROUTE_MARKER = Symbol.for("daloyjs.mcp.route");
 /**
  * Apply a topology-aware security preset on top of caller-supplied
  * options. Returns a new options object where preset defaults fill in
@@ -194,6 +200,99 @@ export const DALOY_REQUEST_RAW_BODY = Symbol.for("daloyjs.request.rawBody");
  * opt in; userland code should not depend on it.
  */
 export const DALOY_RAW_STREAM = Symbol.for("daloyjs.response.rawStream");
+/**
+ * Internal Symbol an adapter sets (once, on its request shim's prototype) to
+ * declare: "the object that ultimately consumes this request's `Response`
+ * only reads `status` / `headers` / {@link DALOY_RAW_BODY} — it never needs a
+ * branded WHATWG `Response`". When present on the incoming request,
+ * {@link serializeResult} may return a {@link LightResponse} and skip the
+ * ~2µs undici `Response` construction per request. Requests without the
+ * marker (Bun / Deno / Workers adapters, tests, direct `app.fetch()` callers)
+ * always get a real `Response`, so the public contract is unchanged.
+ */
+export const DALOY_LIGHT_RESPONSE_OK = Symbol.for("daloyjs.response.lightOk");
+/**
+ * Minimal `Response` stand-in returned on the Node-adapter hot path (gated by
+ * {@link DALOY_LIGHT_RESPONSE_OK}). Carries `status` + a real `Headers`
+ * instance + the raw body bytes via {@link DALOY_RAW_BODY}; every other
+ * WHATWG surface (body streams, `json()`, `clone()`, …) delegates to a
+ * lazily-materialized real `Response`, so hook code that inspects the
+ * response body still behaves exactly as before — it just pays the
+ * construction cost only when it actually does so. `instanceof Response`
+ * holds via prototype re-rooting; all overridden accessors below shadow
+ * undici's brand-checked ones.
+ */
+class LightResponse {
+    #status;
+    #headers;
+    #rawBody;
+    #real;
+    constructor(status, headers, rawBody) {
+        this.#status = status;
+        this.#headers = headers;
+        this.#rawBody = rawBody;
+        this[DALOY_RAW_BODY] = rawBody;
+    }
+    /** Build (once) and return an equivalent real `Response` for rare surfaces. */
+    #materialize() {
+        return (this.#real ??= new Response(this.#rawBody, {
+            status: this.#status,
+            headers: this.#headers,
+        }));
+    }
+    get status() {
+        return this.#status;
+    }
+    get headers() {
+        return this.#headers;
+    }
+    get ok() {
+        return this.#status >= 200 && this.#status <= 299;
+    }
+    // Spec constants for a synthesized (non-network) Response.
+    get statusText() {
+        return "";
+    }
+    get type() {
+        return "default";
+    }
+    get url() {
+        return "";
+    }
+    get redirected() {
+        return false;
+    }
+    get body() {
+        return this.#materialize().body;
+    }
+    get bodyUsed() {
+        return this.#real !== undefined ? this.#real.bodyUsed : false;
+    }
+    arrayBuffer() {
+        return this.#materialize().arrayBuffer();
+    }
+    blob() {
+        return this.#materialize().blob();
+    }
+    bytes() {
+        return this.#materialize().bytes();
+    }
+    formData() {
+        return this.#materialize().formData();
+    }
+    json() {
+        return this.#materialize().json();
+    }
+    text() {
+        return this.#materialize().text();
+    }
+    clone() {
+        return this.#materialize().clone();
+    }
+}
+// `instanceof Response` must hold for hook code and adapter checks. Every
+// own getter/method above shadows undici's brand-checked accessors.
+Object.setPrototypeOf(LightResponse.prototype, Response.prototype);
 /**
  * The DaloyJS application: a contract-first router plus a web-standard
  * `fetch(Request): Promise<Response>` handler that runs unchanged on Node,
@@ -614,6 +713,26 @@ export class App {
         const origin = request.headers.get("origin");
         if (!origin || origin === "null")
             return;
+        // Fast path: when both the Origin header and the request URL are in the
+        // trivially-normalized shape (lowercase ASCII scheme://host[:port] with
+        // no userinfo / percent-escapes / IPv6 brackets), their origins can be
+        // compared as plain strings without two `new URL()` constructions per
+        // request. Anything unusual returns `undefined` and falls back to the
+        // exact WHATWG comparison below — the guard's accept/reject semantics
+        // are identical on both paths.
+        const fastHeaderOrigin = getOriginFast(origin);
+        if (fastHeaderOrigin !== undefined) {
+            const fastReqOrigin = typeof requestUrl === "string" ? getOriginFast(requestUrl) : requestUrl.origin;
+            if (fastReqOrigin !== undefined) {
+                if (fastHeaderOrigin === fastReqOrigin)
+                    return;
+                if (corsOriginAllows.some((allows) => allows(origin)))
+                    return;
+                throw new ForbiddenError(`Cross-origin ${method} from "${fastHeaderOrigin}" rejected: no registered cors() policy allows that origin. ` +
+                    `Register cors({ origin: [...] }) via app.use(...) to allow it, or pass ` +
+                    `app({ corsCrossOriginGuard: false }) / app({ secureDefaults: false }) to disable this guard.`);
+            }
+        }
         let originUrl;
         try {
             originUrl = new URL(origin);
@@ -794,13 +913,24 @@ export class App {
     /**
      * First-request boot guard. Verifies that the assembled hook
      * chain + route table is internally consistent before any user handler
-     * runs. Currently checks: when `session()` is installed and any route
-     * accepts a state-changing method (`POST` / `PUT` / `PATCH` / `DELETE`),
-     * a `csrf()` hook (or third-party equivalent stamped with
-     * {@link CSRF_HOOK_MARKER}) must also be present in that route's effective
-     * hook chain. Opt out with `app({ csrf: "off" })` or
-     * `app({ secureDefaults: false })`. Runs once per App between registration
-     * changes; the result is cached so the fast path is a single boolean check.
+     * runs. Currently checks (production + `secureDefaults` only):
+     *
+     * 1. **Shadow auth** — a route that declares an `auth:` requirement (so it is
+     *    advertised as protected in the OpenAPI `security` list) must have an
+     *    authentication hook ({@link AUTH_HOOK_MARKER}) in its effective chain.
+     *    Otherwise it accepts unauthenticated requests while claiming protection.
+     * 2. **Unauthenticated MCP** — a route from {@link mcpRoutes} must have an
+     *    auth hook unless it opted out with `mcpRoutes(path, handler, { public: true })`.
+     *    MCP tools are model-controlled and side-effecting, so a public one is a
+     *    high-impact default.
+     * 3. **Missing CSRF** — when `session()` is installed and any route accepts a
+     *    state-changing method (`POST`/`PUT`/`PATCH`/`DELETE`), a `csrf()` hook
+     *    (or third-party equivalent stamped with {@link CSRF_HOOK_MARKER}) must
+     *    also be present. Skipped when `app({ csrf: "off" })`.
+     *
+     * Opt out of all guards with `app({ secureDefaults: false })`. Runs once per
+     * App between registration changes; the result is cached so the fast path is a
+     * single boolean check.
      */
     assertBootGuards() {
         if (this.bootGuard.checked) {
@@ -811,13 +941,40 @@ export class App {
         this.bootGuard.checked = true;
         if (this.options.secureDefaults === false)
             return;
-        if (this.options.csrf === "off")
-            return;
         // Per the risk register: boot guards only fire in production so CI /
         // staging surfaces that ship sample secrets / no CSRF token while
         // iterating do not pay the refuse-to-boot cost.
         if (!this.isProduction())
             return;
+        // Guard 1: shadow auth — declared `auth:` with nothing enforcing it.
+        const shadowAuth = this.routeSecurityMarkers.find((r) => r.declaresAuth && !r.hasAuth);
+        if (shadowAuth) {
+            const err = new Error(`Route ${shadowAuth.method} ${shadowAuth.path} declares an auth requirement (auth: ...) ` +
+                `but no authentication hook is installed in its effective hook chain, so it is advertised ` +
+                `as protected while accepting unauthenticated requests. ` +
+                `Install an auth middleware (bearerAuth/basicAuth/jwk/httpSignatureAuth/clientCertAuth), ` +
+                `wrap a custom auth hook with markAuthHook(...), remove the route's auth: declaration, ` +
+                `or pass app({ secureDefaults: false }) to disable this guard. ` +
+                `See https://daloyjs.dev/docs/security/boot-guards.`);
+            this.bootGuard.error = err;
+            throw err;
+        }
+        // Guard 2: unauthenticated MCP tool endpoint.
+        const mcpNoAuth = this.routeSecurityMarkers.find((r) => r.isMcp && !r.hasAuth);
+        if (mcpNoAuth) {
+            const err = new Error(`MCP route ${mcpNoAuth.method} ${mcpNoAuth.path} (from mcpRoutes()) has no authentication ` +
+                `hook in its effective hook chain. MCP tools are model-controlled and can trigger side ` +
+                `effects, so an unauthenticated endpoint is a high-impact default. ` +
+                `Install an auth middleware covering the MCP route (e.g. app.use(bearerAuth({ ... }))), ` +
+                `wrap a custom auth hook with markAuthHook(...), pass mcpRoutes(path, handler, { public: true }) ` +
+                `to intentionally expose it, or pass app({ secureDefaults: false }) to disable this guard. ` +
+                `See https://daloyjs.dev/docs/security/boot-guards.`);
+            this.bootGuard.error = err;
+            throw err;
+        }
+        // Guard 3: session() + state-changing route without csrf().
+        if (this.options.csrf === "off")
+            return;
         const stateChanging = this.routeSecurityMarkers.find((r) => isStateChangingMethod(r.method) && r.hasSession && !r.hasCsrf);
         if (!stateChanging)
             return;
@@ -834,7 +991,9 @@ export class App {
     /**
      * Per-request guard for spoofed proxy headers. When the App was
      * constructed without an explicit {@link AppOptions.trustProxy} value
-     * and a request arrives carrying an `X-Forwarded-*` header, refuse to
+     * and a request arrives carrying a spoofable forwarded / client-IP header
+     * (`X-Forwarded-*`, `X-Real-IP`, or a vendor header like `CF-Connecting-IP`,
+     * `Fly-Client-IP`, `True-Client-IP`), refuse to
      * dispatch it: the rate limiter, audit log, and request-id propagation
      * would otherwise honour the attacker-supplied IP. Returns a structured
      * `500 problem+json` so the failure is loud at the network boundary.
@@ -864,6 +1023,13 @@ export class App {
             "x-forwarded-proto",
             "x-forwarded-port",
             "x-real-ip",
+            // Platform-specific client-IP headers are just as spoofable as
+            // X-Forwarded-* when the app is not actually behind that platform's
+            // proxy. Refuse them too so a client cannot forge its source IP via a
+            // vendor header the operator never configured trust for.
+            "cf-connecting-ip",
+            "fly-client-ip",
+            "true-client-ip",
         ]) {
             if (headers.has(name)) {
                 found = name;
@@ -1276,6 +1442,8 @@ export class App {
             method: merged.method,
             path: merged.path,
             ...securityMarkers,
+            declaresAuth: merged.auth !== undefined && merged.auth !== null,
+            isMcp: merged[MCP_ROUTE_MARKER] === true,
         });
         this.resetBootGuardCache();
         return this;
@@ -2287,7 +2455,11 @@ export class App {
                 if (isPromiseLike(routeOnRequestResult))
                     await routeOnRequestResult;
             }
-            ctx = await buildContext(request, getUrl, match.params, def, this.options);
+            // buildContext is sync unless a schema validator or body read actually
+            // suspends — branch on the promise so the fully-sync case never
+            // schedules a microtask.
+            const builtCtx = buildContext(request, getUrl, match.params, def, this.options);
+            ctx = isPromiseLike(builtCtx) ? await builtCtx : builtCtx;
             // Stable two-field write keeps `ctx.state`'s hidden class consistent across
             // requests for the common no-decorator case. The decorations spread only
             // fires when `app.decorate()` was actually called.
@@ -2358,7 +2530,11 @@ export class App {
                 }
                 return finalizedRaw;
             }
-            const serializeResultRes = serializeResult(result, def, this.options.validateResponses ?? true);
+            const serializeResultRes = serializeResult(result, def, this.options.validateResponses ?? true, 
+            // Adapter shims set this marker on their request prototype to declare
+            // that the response consumer only reads status/headers/raw-body — see
+            // DALOY_LIGHT_RESPONSE_OK. Everyone else gets a real Response.
+            request[DALOY_LIGHT_RESPONSE_OK] === true);
             let response = isPromiseLike(serializeResultRes)
                 ? await serializeResultRes
                 : serializeResultRes;
@@ -2767,14 +2943,17 @@ export function topoSortExtensions(exts) {
 function securityMarkersFromHooks(layers) {
     let hasSession = false;
     let hasCsrf = false;
+    let hasAuth = false;
     for (const hooks of layers) {
         const record = hooks;
         if (record[SESSION_HOOK_MARKER] === true)
             hasSession = true;
         if (record[CSRF_HOOK_MARKER] === true)
             hasCsrf = true;
+        if (record[AUTH_HOOK_MARKER] === true)
+            hasAuth = true;
     }
-    return { hasSession, hasCsrf };
+    return { hasSession, hasCsrf, hasAuth };
 }
 function isStateChangingMethod(method) {
     return method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
@@ -2807,6 +2986,85 @@ function getPathnameFast(url) {
         end = h;
     return url.slice(pathStart, end);
 }
+/**
+ * Extract the WHATWG origin (`scheme://host[:port]`) from an absolute
+ * `http`/`https` URL or Origin-header value without constructing a `URL`.
+ * Companion to {@link getPathnameFast}, used by the cross-origin guard on
+ * state-changing requests.
+ *
+ * Returns `undefined` — signalling "fall back to `new URL(...).origin`" —
+ * whenever the input is not in the trivially-normalized shape a `URL` parse
+ * would return unchanged: non-`http(s)` schemes, uppercase characters
+ * (scheme/host case-folding), userinfo (`user@host`, which `URL.origin`
+ * strips), percent-escapes, non-ASCII hosts (IDNA/punycode), IPv6 literals
+ * (zero-compression normalization), empty hosts, backslashes (URL treats
+ * `\` as `/`), and explicit default ports (`:80` / `:443`, which
+ * `URL.origin` elides). The fast path therefore never *disagrees* with the
+ * WHATWG origin — it only answers when the answer is unambiguous.
+ */
+function getOriginFast(url) {
+    let hostStart;
+    if (url.startsWith("http://"))
+        hostStart = 7;
+    else if (url.startsWith("https://"))
+        hostStart = 8;
+    else
+        return undefined;
+    // Find the end of the authority: first "/", "?", or "#" after the scheme.
+    let end = url.length;
+    for (let i = hostStart; i < url.length; i++) {
+        const c = url.charCodeAt(i);
+        if (c === 47 /* / */ || c === 63 /* ? */ || c === 35 /* # */) {
+            end = i;
+            break;
+        }
+    }
+    if (end === hostStart)
+        return undefined; // empty host
+    for (let i = hostStart; i < end; i++) {
+        const c = url.charCodeAt(i);
+        // Reject anything that could normalize differently under a real URL
+        // parse: uppercase A-Z, userinfo "@", percent "%", IPv6 "[", backslash
+        // "\", raw whitespace/controls, and all non-ASCII.
+        if ((c >= 65 && c <= 90) /* A-Z */ ||
+            c === 64 /* @ */ ||
+            c === 37 /* % */ ||
+            c === 91 /* [ */ ||
+            c === 92 /* \ */ ||
+            c <= 32 /* controls + space */ ||
+            c >= 127 /* DEL + non-ASCII */) {
+            return undefined;
+        }
+    }
+    const authority = url.slice(hostStart, end);
+    const colon = authority.indexOf(":");
+    if (colon !== -1) {
+        const port = authority.slice(colon + 1);
+        // Trailing ":" alone, an empty port, or a default port all normalize to
+        // no port under URL — fall back rather than replicate that here. A
+        // second ":" (malformed / IPv6-ish) also falls back.
+        if (port.length === 0 || port.indexOf(":") !== -1)
+            return undefined;
+        if ((hostStart === 7 && port === "80") /* http default */ ||
+            (hostStart === 8 && port === "443") /* https default */) {
+            return undefined;
+        }
+        // Port must be all digits; anything else is not trivially normalized.
+        for (let i = 0; i < port.length; i++) {
+            const c = port.charCodeAt(i);
+            if (c < 48 || c > 57)
+                return undefined;
+        }
+        // Leading zeros normalize away under URL ("0080" -> "80"), and ports
+        // above 65535 make the URL constructor *throw* (the guard's malformed-
+        // origin rejection) — both must take the exact WHATWG path.
+        if (port.length > 1 && port.charCodeAt(0) === 48 /* 0 */)
+            return undefined;
+        if (port.length > 5 || (port.length === 5 && Number(port) > 65535))
+            return undefined;
+    }
+    return url.slice(0, end);
+}
 function mergeHooks(layers) {
     const pick = (key) => layers.map((h) => h[key]).filter((f) => typeof f === "function");
     const requiredScopes = requiredScopesFromHooks(layers);
@@ -3183,44 +3441,77 @@ function buildContext(request, getUrl, rawParams, def, opts) {
     if (!hasSchema) {
         return finishContext();
     }
-    return (async () => {
-        if (def.request?.params) {
-            const r = await validate(def.request.params, rawParams);
-            if (r.issues)
-                throw new ValidationError("params", toIssues(r.issues));
-            params = r.value;
+    const applyChecked = (r, part) => {
+        if (r.issues)
+            throw new ValidationError(part, toIssues(r.issues));
+        return r.value;
+    };
+    const validateBodyAndFinish = (raw) => {
+        const r = def.request.body["~standard"].validate(raw);
+        if (isPromiseLike(r)) {
+            return r.then((resolved) => {
+                body = applyChecked(resolved, "body");
+                return finishContext();
+            });
         }
-        if (hasQuerySchema) {
-            const r = await validate(def.request.query, buildQuery());
-            if (r.issues)
-                throw new ValidationError("query", toIssues(r.issues));
-            query = r.value;
+        body = applyChecked(r, "body");
+        return finishContext();
+    };
+    const stepBody = () => {
+        if (!def.request?.body)
+            return finishContext();
+        const ct = (request.headers.get("content-type") ?? "").toLowerCase();
+        const allowed = def.accepts ??
+            opts.allowedContentTypes ?? [
+            "application/json",
+            "application/x-www-form-urlencoded",
+            "multipart/form-data",
+        ];
+        if (!allowed.some((a) => ct.includes(a))) {
+            throw new UnsupportedMediaTypeError(ct || "(none)", allowed);
         }
-        if (hasHeadersSchema) {
-            const r = await validate(def.request.headers, buildHeaders());
-            if (r.issues)
-                throw new ValidationError("headers", toIssues(r.issues));
-            headers = r.value;
-        }
-        if (def.request?.body) {
-            const ct = (request.headers.get("content-type") ?? "").toLowerCase();
-            const allowed = def.accepts ??
-                opts.allowedContentTypes ?? [
-                "application/json",
-                "application/x-www-form-urlencoded",
-                "multipart/form-data",
-            ];
-            if (!allowed.some((a) => ct.includes(a))) {
-                throw new UnsupportedMediaTypeError(ct || "(none)", allowed);
-            }
-            const raw = await readBody(request, ct, opts.bodyLimitBytes, opts.multipart);
-            const r = await validate(def.request.body, raw);
-            if (r.issues)
-                throw new ValidationError("body", toIssues(r.issues));
-            body = r.value;
+        const raw = readBody(request, ct, opts.bodyLimitBytes, opts.multipart);
+        if (isPromiseLike(raw))
+            return raw.then(validateBodyAndFinish);
+        return validateBodyAndFinish(raw);
+    };
+    const stepHeaders = () => {
+        if (!hasHeadersSchema)
+            return stepBody();
+        const r = def.request.headers["~standard"].validate(buildHeaders());
+        if (isPromiseLike(r)) {
+            return r.then((resolved) => {
+                headers = applyChecked(resolved, "headers");
+                return stepBody();
+            });
         }
-        return finishContext();
-    })();
+        headers = applyChecked(r, "headers");
+        return stepBody();
+    };
+    const stepQuery = () => {
+        if (!hasQuerySchema)
+            return stepHeaders();
+        const r = def.request.query["~standard"].validate(buildQuery());
+        if (isPromiseLike(r)) {
+            return r.then((resolved) => {
+                query = applyChecked(resolved, "query");
+                return stepHeaders();
+            });
+        }
+        query = applyChecked(r, "query");
+        return stepHeaders();
+    };
+    if (def.request?.params) {
+        const r = def.request.params["~standard"].validate(rawParams);
+        if (isPromiseLike(r)) {
+            return r.then((resolved) => {
+                params = applyChecked(resolved, "params");
+                return stepQuery();
+            });
+        }
+        params = applyChecked(r, "params");
+    }
+    return stepQuery();
 }
 function headersToObject(h) {
     const o = {};
@@ -3251,26 +3542,79 @@ function toIssues(issues) {
             .join("."),
     }));
 }
-async function readBody(req, ct, limit, multipart) {
+/** Shared decoder for request-body text. Allocating one per request is wasted work. */
+const TEXT_DECODER = new TextDecoder();
+/**
+ * Synchronous fast path for {@link readBodyLimited}: returns the adapter's
+ * pre-buffered body bytes when they are available on the request via
+ * {@link DALOY_REQUEST_RAW_BODY}, or `undefined` when the caller must fall
+ * back to the async streaming read. Runs the exact same Content-Length
+ * validation and size-limit checks (in the same order, throwing the same
+ * errors) as `readBodyLimited`, so the security posture is identical — the
+ * only difference is that a symbol-cache hit never touches the microtask
+ * queue.
+ *
+ * @throws {BadRequestError} When `Content-Length` is present but invalid.
+ * @throws {PayloadTooLargeError} When the declared or actual size exceeds `limit`.
+ */
+function readBodyBytesFast(req, limit) {
+    const cl = req.headers.get("content-length");
+    if (cl) {
+        const n = Number(cl);
+        if (!Number.isFinite(n) || n < 0)
+            throw new BadRequestError("Invalid Content-Length");
+        if (n > limit)
+            throw new PayloadTooLargeError(limit);
+    }
+    const cached = req[DALOY_REQUEST_RAW_BODY];
+    if (cached instanceof Uint8Array) {
+        if (cached.byteLength > limit)
+            throw new PayloadTooLargeError(limit);
+        return cached;
+    }
+    return undefined;
+}
+function parseJsonBodyBytes(bytes) {
+    if (bytes.byteLength === 0)
+        return undefined;
+    return safeJsonParse(TEXT_DECODER.decode(bytes));
+}
+function parseUrlencodedBodyBytes(bytes) {
+    const params = new URLSearchParams(TEXT_DECODER.decode(bytes));
+    // Same Spring4Shell-class defense as queryToObject: Object.fromEntries
+    // would set __proto__ / constructor / prototype as own properties.
+    const out = {};
+    for (const [k, v] of params) {
+        if (isForbiddenObjectKey(k))
+            continue;
+        out[k] = v;
+    }
+    return out;
+}
+/**
+ * Read and parse a request body according to its content type. Plain
+ * (non-`async`) on purpose: when the adapter pre-buffered the body bytes
+ * (the common JSON POST case on Node), the parse completes synchronously and
+ * the caller stays on the sync dispatch fast path. Falls back to the
+ * streaming `readBodyLimited` promise otherwise. All parsing keeps the
+ * prototype-pollution-safe semantics of the previous implementation.
+ */
+function readBody(req, ct, limit, multipart) {
     if (ct.includes("application/json")) {
-        const bytes = await readBodyLimited(req, limit);
-        if (bytes.byteLength === 0)
-            return undefined;
-        return safeJsonParse(new TextDecoder().decode(bytes));
+        const fast = readBodyBytesFast(req, limit);
+        if (fast !== undefined)
+            return parseJsonBodyBytes(fast);
+        return readBodyLimited(req, limit).then(parseJsonBodyBytes);
     }
     if (ct.includes("application/x-www-form-urlencoded")) {
-        const bytes = await readBodyLimited(req, limit);
-        const params = new URLSearchParams(new TextDecoder().decode(bytes));
-        // Same Spring4Shell-class defense as queryToObject: Object.fromEntries
-        // would set __proto__ / constructor / prototype as own properties.
-        const out = {};
-        for (const [k, v] of params) {
-            if (isForbiddenObjectKey(k))
-                continue;
-            out[k] = v;
-        }
-        return out;
+        const fast = readBodyBytesFast(req, limit);
+        if (fast !== undefined)
+            return parseUrlencodedBodyBytes(fast);
+        return readBodyLimited(req, limit).then(parseUrlencodedBodyBytes);
     }
+    return readBodySlow(req, ct, limit, multipart);
+}
+async function readBodySlow(req, ct, limit, multipart) {
     if (ct.includes("multipart/form-data")) {
         // Fast-fail on an honestly-declared oversize body.
         const cl = req.headers.get("content-length");
@@ -3362,7 +3706,7 @@ function normalizeSunset(value, method, path) {
     }
     return date.toUTCString();
 }
-function serializeResult(result, def, validateResponses) {
+function serializeResult(result, def, validateResponses, lightOk = false) {
     const spec = def.responses[result.status];
     if (!spec) {
         throw new InternalError(`Handler returned status ${result.status} which is not declared in responses for ${def.method} ${def.path}`);
@@ -3424,6 +3768,13 @@ function serializeResult(result, def, validateResponses) {
             body = bytes;
             rawBody = bytes;
         }
+        // Node-adapter hot path (opt-in via DALOY_LIGHT_RESPONSE_OK on the
+        // incoming request): skip the ~2µs undici Response construction. Only
+        // buffer-backed bodies qualify — streams keep the real Response so the
+        // adapter's stream plumbing is untouched.
+        if (lightOk && !isStream) {
+            return new LightResponse(result.status, headers, rawBody);
+        }
         const response = new Response(body, { status: result.status, headers });
         if (!isStream) {
             response[DALOY_RAW_BODY] = rawBody;