@dunx/http 3.1.3 → 3.2.1

package/dist/index.js

@@ -1,74 +1,58 @@
 // @bun
 import {
   TRACEPARENT_HEADER,
+  TRACERESPONSE_HEADER,
   TRACESTATE_HEADER,
   TraceContext
-} from "./chunk-25g22350.js";
+} from "./chunk-3j2n1n11.js";
 import {
   ApiHidden,
-  CompressionEncoding,
-  CompressionOptions,
-  Controller,
-  DEFAULT_RELAY_CHANNEL,
-  Delete,
-  ErrorFilter,
-  Get,
-  HEALTH_REPORT_SCHEMA,
   HIDDEN,
   HandlerKind,
-  HealthController,
-  HealthOptions,
-  HealthRegistry,
-  HiddenHealthController,
-  HttpError,
   PUBLIC,
-  Patch,
-  Post,
   Public,
-  Put,
-  REQUEST_ID_HEADER,
   ROLES,
-  RawBody,
-  RedisRelay,
-  RequestIds,
   Roles,
-  StaticOptions,
   UNMATCHED,
   UseGuards,
-  ValidationError,
-  WsRelay,
-  assertNoCollisions,
-  assertNoGatewayCollisions,
-  buildFallback,
-  buildRoutes,
-  buildWebSocket,
-  decodeRelay,
-  defaultErrorMapper,
-  defaultRelayError,
+  buildContext,
+  defaultStatusFor,
   discoverGateways,
   discoverRoutes,
-  encode,
-  encodeRelay,
-  errorMapper,
   joinPath,
+  markController,
   markGateway,
   markHandler,
+  markRoute,
   mergeMeta,
   meta,
   metaKey,
-  metaOf,
-  negotiate,
-  observe,
-  toErrorMapper,
-  withUpgradeRoutes
-} from "./chunk-53cs6qek.js";
+  metaOf
+} from "./chunk-3nbj06q8.js";
 import {
   HttpStatusCode,
   __decorateElement,
   __decoratorMetadata,
   __decoratorStart,
+  __privateAdd,
+  __privateGet,
   __runInitializers
 } from "./chunk-sz4pvqxy.js";
+
+// src/route/decorators.ts
+var Controller = (prefix = "") => (target) => {
+  markController(target, prefix);
+  return target;
+};
+var verb = (method) => (path = "/", options) => (value, _context) => {
+  markRoute(value, { method, path, options });
+  return value;
+};
+var Get = verb("GET");
+var Post = verb("POST");
+var Put = verb("PUT");
+var Patch = verb("PATCH");
+var Delete = verb("DELETE");
 // src/server/client-address.ts
 import { AppError } from "@dunx/core";
 var trustedHops = (setting) => {
@@ -101,10 +85,67 @@ class ClientAddress {
 var attachAddressSource = (target, source) => {
   sources.set(target, source);
 };
+// src/server/errors.ts
+import { AppError as AppError2, ConsoleLogger } from "@dunx/core";
+class HttpError extends AppError2 {
+  status;
+  name = "HttpError";
+  headers;
+  constructor(status, message, options) {
+    super(message, options);
+    this.status = status;
+    this.headers = options?.headers;
+  }
+}
+Object.defineProperty(HttpError, Symbol.for("dunx.deps"), { value: () => [{ unresolved: "override readonly status: number" }, { unresolved: "message: string" }, { unresolved: "options?: HttpErrorOptions" }] });
+
+class ValidationError extends HttpError {
+  source;
+  issues;
+  name = "ValidationError";
+  constructor(source, issues) {
+    super(HttpStatusCode.BAD_REQUEST, `Invalid ${source}`);
+    this.source = source;
+    this.issues = issues;
+  }
+}
+Object.defineProperty(ValidationError, Symbol.for("dunx.deps"), { value: () => [{ unresolved: "readonly source: InputSource" }, { unresolved: "readonly issues: readonly ValidationIssue[]" }] });
+
+class ErrorFilter {
+}
+var isErrorFilter = (handler) => typeof handler === "function" && typeof handler.prototype?.catch === "function";
+var toErrorMapper = (handler, resolve) => isErrorFilter(handler) ? (error, req) => resolve(handler).catch(error, req) : handler;
+var errorMapper = (logger) => (error) => {
+  if (error instanceof ValidationError) {
+    return Response.json({ error: error.message, status: error.status, issues: error.issues }, {
+      status: error.status,
+      ...error.headers && { headers: error.headers }
+    });
+  }
+  if (error instanceof HttpError) {
+    return Response.json({ error: error.message, status: error.status }, {
+      status: error.status,
+      ...error.headers && { headers: error.headers }
+    });
+  }
+  if (error instanceof AppError2 && isStatus(error.status)) {
+    if (error.status >= HttpStatusCode.INTERNAL_SERVER_ERROR) {
+      logger.error("Unhandled error", error);
+    }
+    return Response.json({ error: error.message, status: error.status }, { status: error.status });
+  }
+  logger.error("Unhandled error", error);
+  return Response.json({
+    error: "Internal Server Error",
+    status: HttpStatusCode.INTERNAL_SERVER_ERROR
+  }, { status: HttpStatusCode.INTERNAL_SERVER_ERROR });
+};
+var isStatus = (value) => value !== undefined && Number.isInteger(value) && value >= 200 && value <= 599;
+var defaultErrorMapper = errorMapper(new ConsoleLogger);
 // src/server/factory.ts
 import {
   collectModules,
-  AppError as AppError4,
+  AppError as AppError8,
   AppFactory,
   Logger as Logger4,
   provide,
@@ -112,6 +153,395 @@ import {
   RequestContext as RequestContext3
 } from "@dunx/core";
 
+// src/server/metrics.ts
+import { Durations } from "@dunx/core";
+var UNMATCHED_ROUTE = "(unmatched)";
+var seriesFor = (route, method) => ({
+  route,
+  method,
+  count: 0,
+  byStatus: {},
+  duration: new Durations,
+  slowestNs: 0,
+  slowestTraceId: undefined
+});
+
+class RequestMetrics {
+  #series = new Map;
+  #unmatched = new Map;
+  #since = new Date;
+  #server;
+  observe(ctx, status, durationNs, traceId) {
+    let series = this.#series.get(ctx);
+    if (series === undefined) {
+      if (ctx.get(UNMATCHED) === true) {
+        series = this.#unmatched.get(ctx.method);
+        if (series === undefined) {
+          series = seriesFor(UNMATCHED_ROUTE, ctx.method);
+          this.#unmatched.set(ctx.method, series);
+        }
+      } else {
+        series = seriesFor(ctx.path, ctx.method);
+        this.#series.set(ctx, series);
+      }
+    }
+    series.count += 1;
+    const key = String(status);
+    series.byStatus[key] = (series.byStatus[key] ?? 0) + 1;
+    series.duration.record(durationNs);
+    if (durationNs > series.slowestNs) {
+      series.slowestNs = durationNs;
+      series.slowestTraceId = traceId;
+    }
+  }
+  snapshot() {
+    const routes = [];
+    for (const series of [
+      ...this.#series.values(),
+      ...this.#unmatched.values()
+    ]) {
+      routes.push({
+        route: series.route,
+        method: series.method,
+        count: series.count,
+        byStatus: { ...series.byStatus },
+        duration: series.duration.snapshot(),
+        ...series.slowestTraceId === undefined ? {} : { slowestTraceId: series.slowestTraceId }
+      });
+    }
+    return {
+      routes,
+      inFlight: this.#server?.pendingRequests ?? 0,
+      pendingWebSockets: this.#server?.pendingWebSockets ?? 0,
+      since: this.#since.toISOString()
+    };
+  }
+  reset() {
+    this.#series.clear();
+    this.#unmatched.clear();
+    this.#since = new Date;
+  }
+  attach(server) {
+    this.#server = server;
+  }
+}
+var usesMetricsMiddleware = (options) => options.metrics === true && options.requestLogging === false;
+
+class MetricsMiddleware {
+  metrics;
+  constructor(metrics) {
+    this.metrics = metrics;
+  }
+  handle(_req, ctx, next) {
+    const started = Bun.nanoseconds();
+    return next().then((response) => {
+      this.metrics.observe(ctx, response.status, Bun.nanoseconds() - started);
+      return response;
+    }, (error) => {
+      this.metrics.observe(ctx, error instanceof HttpError ? error.status : HttpStatusCode.INTERNAL_SERVER_ERROR, Bun.nanoseconds() - started);
+      throw error;
+    });
+  }
+}
+Object.defineProperty(MetricsMiddleware, Symbol.for("dunx.deps"), { value: () => [RequestMetrics] });
+
+// src/ws/envelope.ts
+var encode = (event, data) => JSON.stringify({ event, data });
+var decode = (message) => {
+  if (typeof message !== "string")
+    return;
+  let parsed;
+  try {
+    parsed = JSON.parse(message);
+  } catch {
+    return;
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    return;
+  const { event, data } = parsed;
+  return typeof event === "string" ? { event, data } : undefined;
+};
+
+// src/ws/middleware.ts
+var composeSocket = (middleware, ctx) => middleware.reduceRight((next, current) => (frame, run) => current.handle(frame, ctx, () => next(frame, run)), (_frame, run) => run());
+var observe = (next, done) => {
+  let result;
+  try {
+    result = next();
+  } catch (error) {
+    done(error, undefined);
+    throw error;
+  }
+  if (result instanceof Promise) {
+    return result.then((value) => {
+      done(undefined, value);
+      return value;
+    }, (error) => {
+      done(error, undefined);
+      throw error;
+    });
+  }
+  done(undefined, result);
+  return result;
+};
+
+// src/ws/runtime.ts
+import { AppError as AppError3 } from "@dunx/core";
+var slotOf = (handler) => handler.kind === HandlerKind.MESSAGE && handler.event !== undefined ? `message ${JSON.stringify(handler.event)}` : handler.kind;
+var buildRuntime = (gateway) => {
+  if (gateway.handlers.length === 0) {
+    throw new AppError3(`${gateway.name} is registered as a gateway but declares no handlers. ` + "Add an @OnMessage/@OnOpen/... method, or drop the @Gateway decorator.");
+  }
+  const owners = new Map;
+  const events = new Map;
+  for (const handler of gateway.handlers) {
+    const slot = slotOf(handler);
+    const existing = owners.get(slot);
+    if (existing) {
+      throw new AppError3(`Handler collision in ${gateway.name}: ${slot} is claimed by ` + `${existing.method}() and by ${handler.method}(). One handler per event.`);
+    }
+    owners.set(slot, handler);
+    if (handler.kind === HandlerKind.MESSAGE && handler.event !== undefined) {
+      events.set(handler.event, handler.invoke);
+    }
+  }
+  const at = (slot) => owners.get(slot)?.invoke;
+  return {
+    name: gateway.name,
+    path: gateway.path,
+    upgrade: at(HandlerKind.UPGRADE),
+    open: at(HandlerKind.OPEN),
+    close: at(HandlerKind.CLOSE),
+    drain: at(HandlerKind.DRAIN),
+    ping: at(HandlerKind.PING),
+    pong: at(HandlerKind.PONG),
+    raw: at(HandlerKind.MESSAGE),
+    events
+  };
+};
+var buildGateways = (discovered) => {
+  const byPath = new Map;
+  for (const gateway of discovered) {
+    const existing = byPath.get(gateway.path);
+    if (existing) {
+      throw new AppError3(`Gateway path collision: ${gateway.path} is served by ${existing.name} ` + `and by ${gateway.name}. One gateway per path.`);
+    }
+    byPath.set(gateway.path, buildRuntime(gateway));
+  }
+  return byPath;
+};
+var someHandler = (gateways, pick) => {
+  for (const gateway of gateways)
+    if (pick(gateway) !== undefined)
+      return true;
+  return false;
+};
+
+// src/ws/adapter.ts
+var RUNTIME = Symbol.for("dunx.ws.runtime");
+var UNCLAIMED = Symbol.for("dunx.ws.unclaimed");
+var defaultOnError = (error, socket) => {
+  console.error(`[dunx/http] ${socket.data.path} handler failed:`, error);
+};
+var reportedByMiddleware = () => {
+  return;
+};
+var unreported = (middleware) => "Socket middleware is installed and none of it sets reportsErrors, so a " + "throwing gateway handler is reported nowhere: the console fallback is off " + "whenever middleware wraps the handler. Set reportsErrors on the one that " + "records a failure, or pass websocket.onError. Installed: " + `${middleware.map((entry) => entry.constructor.name).join(", ")}.`;
+var runtimeOf = (socket) => socket.data[RUNTIME];
+var isBinary = (value) => value instanceof ArrayBuffer || ArrayBuffer.isView(value);
+var replyRaw = (socket, value) => {
+  if (value === undefined)
+    return;
+  socket.send(typeof value === "string" || isBinary(value) ? value : JSON.stringify(value));
+};
+var settle = (result, socket, onError, then) => {
+  if (result instanceof Promise) {
+    result.then((value) => {
+      if (!then)
+        return;
+      try {
+        then(value);
+      } catch (error) {
+        onError(error, socket);
+      }
+    }, (error) => onError(error, socket));
+    return;
+  }
+  if (then)
+    then(result);
+};
+var framing = (kind) => {
+  if (kind === HandlerKind.CLOSE) {
+    return (args) => ({
+      socket: args[0],
+      data: { code: args[1], reason: args[2] }
+    });
+  }
+  if (kind === HandlerKind.OPEN || kind === HandlerKind.DRAIN) {
+    return (args) => ({ socket: args[0], data: undefined });
+  }
+  return (args) => ({ socket: args[1], data: args[0] });
+};
+var NOTHING = () => {
+  return;
+};
+var through = (gateway, middleware, kind, event, invoke) => {
+  const ctx = {
+    gateway: gateway.name,
+    path: gateway.path,
+    kind,
+    event
+  };
+  const dispatch = composeSocket(middleware, ctx);
+  const frameOf = framing(kind);
+  const run = invoke ?? NOTHING;
+  return (...args) => dispatch(frameOf(args), () => run(...args));
+};
+var withMiddleware = (gateway, middleware) => {
+  const wrap = (kind, event, invoke) => through(gateway, middleware, kind, event, invoke);
+  const optional = (kind, invoke) => invoke === undefined ? undefined : wrap(kind, undefined, invoke);
+  return {
+    ...gateway,
+    open: wrap(HandlerKind.OPEN, undefined, gateway.open),
+    close: wrap(HandlerKind.CLOSE, undefined, gateway.close),
+    drain: optional(HandlerKind.DRAIN, gateway.drain),
+    ping: optional(HandlerKind.PING, gateway.ping),
+    pong: optional(HandlerKind.PONG, gateway.pong),
+    raw: optional(HandlerKind.MESSAGE, gateway.raw),
+    events: new Map([...gateway.events].map(([event, invoke]) => [
+      event,
+      wrap(HandlerKind.MESSAGE, event, invoke)
+    ]))
+  };
+};
+var unclaimedDispatch = (gateway, middleware) => (frame, event) => composeSocket(middleware, {
+  gateway: gateway.name,
+  path: gateway.path,
+  kind: HandlerKind.MESSAGE,
+  event
+})(frame, () => {
+  return;
+});
+var buildWebSocket = (discovered, options = {}, middleware = []) => {
+  const byPath = buildGateways(discovered);
+  const wrapped = middleware.length === 0 ? byPath : new Map([...byPath].map(([path, gateway]) => [
+    path,
+    withMiddleware(gateway, middleware)
+  ]));
+  const gateways = [...wrapped.values()];
+  const onError = options.onError ?? (middleware.length === 0 ? defaultOnError : reportedByMiddleware);
+  const reports = options.onError !== undefined || middleware.some((entry) => entry.reportsErrors === true);
+  const { onError: _onError, ...socketOptions } = options;
+  const run = (invoke, args, ws, then) => {
+    try {
+      settle(invoke(...args), ws, onError, then);
+    } catch (error) {
+      onError(error, ws);
+    }
+  };
+  const websocket = {
+    ...socketOptions,
+    message(ws, message) {
+      const gateway = runtimeOf(ws);
+      let event;
+      if (gateway.events.size > 0) {
+        const envelope = decode(message);
+        const handler = envelope && gateway.events.get(envelope.event);
+        if (envelope && handler) {
+          run(handler, [envelope.data, ws], ws, (value) => {
+            if (value !== undefined)
+              ws.send(encode(envelope.event, value));
+          });
+          return;
+        }
+        event = envelope?.event;
+      }
+      if (gateway.raw) {
+        run(gateway.raw, [message, ws], ws, (value) => replyRaw(ws, value));
+        return;
+      }
+      const unclaimed2 = ws.data[UNCLAIMED];
+      if (!unclaimed2)
+        return;
+      try {
+        settle(unclaimed2({ socket: ws, data: message }, event), ws, onError, undefined);
+      } catch (error) {
+        onError(error, ws);
+      }
+    },
+    ...someHandler(gateways, (g) => g.open) && {
+      open(ws) {
+        const { open } = runtimeOf(ws);
+        if (open)
+          run(open, [ws], ws, undefined);
+      }
+    },
+    ...someHandler(gateways, (g) => g.close) && {
+      close(ws, code, reason) {
+        const { close } = runtimeOf(ws);
+        if (close)
+          run(close, [ws, code, reason], ws, undefined);
+      }
+    },
+    ...someHandler(gateways, (g) => g.drain) && {
+      drain(ws) {
+        const { drain } = runtimeOf(ws);
+        if (drain)
+          run(drain, [ws], ws, undefined);
+      }
+    },
+    ...someHandler(gateways, (g) => g.ping) && {
+      ping(ws, data) {
+        const { ping } = runtimeOf(ws);
+        if (ping)
+          run(ping, [data, ws], ws, undefined);
+      }
+    },
+    ...someHandler(gateways, (g) => g.pong) && {
+      pong(ws, data) {
+        const { pong } = runtimeOf(ws);
+        if (pong)
+          run(pong, [data, ws], ws, undefined);
+      }
+    }
+  };
+  const unclaimed = new Map(middleware.length === 0 ? [] : gateways.map((gateway) => [
+    gateway,
+    unclaimedDispatch(gateway, middleware)
+  ]));
+  const accept = (req, server, gateway, context) => {
+    const fallback = unclaimed.get(gateway);
+    const data = {
+      path: gateway.path,
+      context,
+      id: crypto.randomUUID(),
+      [RUNTIME]: gateway,
+      ...fallback === undefined ? {} : { [UNCLAIMED]: fallback }
+    };
+    return server.upgrade(req, { data }) ? undefined : new Response("Expected a WebSocket upgrade", { status: 426 });
+  };
+  const upgradeHandler = (gateway) => (req, server) => {
+    if (!gateway.upgrade)
+      return accept(req, server, gateway, undefined);
+    const result = gateway.upgrade(req);
+    if (result instanceof Promise) {
+      return result.then((value) => value instanceof Response ? value : accept(req, server, gateway, value));
+    }
+    return result instanceof Response ? result : accept(req, server, gateway, result);
+  };
+  return {
+    websocket,
+    routes: new Map(gateways.map((gateway) => [gateway.path, upgradeHandler(gateway)])),
+    paths: [...byPath.keys()],
+    warnings: middleware.length > 0 && !reports ? [unreported(middleware)] : [],
+    gateways: gateways.map((gateway) => ({
+      name: gateway.name,
+      path: gateway.path,
+      events: [...gateway.events.keys()]
+    }))
+  };
+};
+
 // src/ws/logging.ts
 import { Logger, LogLevel, RequestContext } from "@dunx/core";
 var LIFECYCLE_LABEL = {
@@ -210,7 +640,64 @@ class SocketLoggingMiddleware {
 Object.defineProperty(SocketLoggingMiddleware, Symbol.for("dunx.deps"), { value: () => [Logger, RequestContext, { unresolved: "options: SocketLoggingOptions = {}", optional: true }] });
 
 // src/ws/pubsub.ts
-import { AppError as AppError2 } from "@dunx/core";
+import { AppError as AppError5 } from "@dunx/core";
+
+// src/ws/relay.ts
+import { AppError as AppError4 } from "@dunx/core";
+var assertRelayUrl = (url, protocols, example) => {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    throw new AppError4(`${JSON.stringify(url)} is not a valid URL for the websocket relay. ` + `Expected something like ${example}.`);
+  }
+  if (!protocols.includes(parsed.protocol)) {
+    throw new AppError4(`Unsupported protocol ${JSON.stringify(parsed.protocol)} in ` + `${JSON.stringify(url)}. Expected one of ${protocols.join(", ")}.`);
+  }
+  return url;
+};
+var redactUrl = (url) => {
+  const parsed = new URL(url);
+  if (parsed.password)
+    parsed.password = "***";
+  return parsed.toString();
+};
+var DEFAULT_RELAY_CHANNEL = "dunx:ws";
+var defaultRelayError = (error, phase) => {
+  console.warn(`[dunx/http] the websocket relay could not ${phase}. Fan-out is local to ` + "this process until it recovers:", error);
+};
+var toBytes = (data) => ArrayBuffer.isView(data) ? new Uint8Array(data.buffer, data.byteOffset, data.byteLength) : new Uint8Array(data);
+var encodeRelay = (origin, topic, data) => typeof data === "string" ? JSON.stringify({ o: origin, t: topic, d: data }) : JSON.stringify({
+  o: origin,
+  t: topic,
+  d: Buffer.from(toBytes(data)).toString("base64"),
+  b: 1
+});
+var decodeRelay = (message) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(message);
+  } catch {
+    return;
+  }
+  if (typeof parsed !== "object" || parsed === null)
+    return;
+  const { o, t, d, b } = parsed;
+  if (typeof o !== "string" || typeof t !== "string" || typeof d !== "string") {
+    return;
+  }
+  return { origin: o, topic: t, data: b ? Buffer.from(d, "base64") : d };
+};
+
+class WsRelay {
+  constructor() {
+    if (new.target === WsRelay) {
+      throw new AppError4("WsRelay is a contract, not an implementation. Bind one with " + "WsRelayModule.forRoot() for Redis or WsRelayModule.forPostgres() " + "for Postgres, or extend it with a relay of your own.");
+    }
+  }
+}
+
+// src/ws/pubsub.ts
 class PubSub {
   #origin = Bun.randomUUIDv7();
   #server;
@@ -235,7 +722,7 @@ class PubSub {
   }
   async relayThrough(relay, options = {}) {
     if (this.#relay) {
-      throw new AppError2("PubSub already relays. Two subscriptions on one channel would deliver " + "every relayed message twice - pass HttpOptions.relay or call " + "relayThrough(), not both.");
+      throw new AppError5("PubSub already relays. Two subscriptions on one channel would deliver " + "every relayed message twice - pass HttpOptions.relay or call " + "relayThrough(), not both.");
     }
     this.#relay = relay;
     this.#channel = options.channel ?? DEFAULT_RELAY_CHANNEL;
@@ -331,7 +818,7 @@ class PubSub {
   }
   #live() {
     if (!this.#server) {
-      throw new AppError2("PubSub has no server yet. Publish once the server is listening: " + "HttpApp.listen() is what attaches it.");
+      throw new AppError5("PubSub has no server yet. Publish once the server is listening: " + "HttpApp.listen() is what attaches it.");
     }
     return this.#server;
   }
@@ -339,10 +826,10 @@ class PubSub {
 
 // src/server/application.ts
 import {
-  AppError as AppError3,
+  AppError as AppError7,
   Logger as Logger3,
   runtimeInfo,
-  ShutdownHooks,
+  ShutdownAware,
   teardownError,
   teardownFailures as toFailures
 } from "@dunx/core";
@@ -352,6 +839,27 @@ import {
   Logger as Logger2,
   RequestContext as RequestContext2
 } from "@dunx/core";
+
+// src/server/raw-body.ts
+var WANTED = Symbol.for("dunx.http.rawBody.wanted");
+var TEXT = Symbol.for("dunx.http.rawBody.text");
+
+class RawBody {
+  static want(req) {
+    req[WANTED] = true;
+  }
+  static wanted(req) {
+    return req[WANTED] === true;
+  }
+  static record(req, text) {
+    req[TEXT] = text;
+  }
+  static read(req) {
+    return req[TEXT];
+  }
+}
+
+// src/server/request-logging.ts
 var parse = (text, limit) => {
   if (limit === 0)
     return;
@@ -378,7 +886,9 @@ class RequestLoggingMiddleware {
   #correlateIgnored;
   #correlate;
   #trace;
-  constructor(logger, context, options = {}) {
+  #traceResponse;
+  #metrics;
+  constructor(logger, context, options = {}, metrics) {
     this.logger = logger;
     this.context = context;
     this.#limit = options.maxBodyLength ?? 2048;
@@ -388,7 +898,9 @@ class RequestLoggingMiddleware {
     this.#ignorePrefix = options.ignorePrefix ?? [];
     this.#correlateIgnored = options.correlateIgnored ?? false;
     this.#correlate = options.correlate ?? true;
-    this.#trace = options.trace ?? false;
+    this.#trace = options.trace ?? true;
+    this.#traceResponse = options.traceResponse ?? true;
+    this.#metrics = metrics;
   }
   #ignored(path) {
     if (this.#ignore.size > 0 && this.#ignore.has(path))
@@ -403,28 +915,32 @@ class RequestLoggingMiddleware {
     const mark = from === -1 ? -1 : url.indexOf("?", from);
     const path = from === -1 ? "/" : mark === -1 ? url.slice(from) : url.slice(from, mark);
     if (this.#ignored(path)) {
+      if (this.#metrics !== undefined) {
+        return this.#ignoredWithMetrics(req, ctx, path, next);
+      }
       return this.#correlateIgnored ? this.#correlated(req, ctx, path, next) : next();
     }
     const started = Bun.nanoseconds();
-    const requestId = RequestIds.assign(req);
     const scope = {
-      requestId,
       method: ctx.method,
       event: path,
       flow: "http",
       context: `${ctx.controller}.${ctx.handler}`
     };
     if (this.#trace) {
-      const trace = TraceContext.adopt(req, requestId);
+      const trace = TraceContext.adopt(req, this.#traceResponse);
       scope.traceId = trace.traceId;
       scope.spanId = trace.spanId;
+      scope.traceFlags = trace.flags;
       if (trace.parentSpanId !== undefined) {
         scope.parentSpanId = trace.parentSpanId;
       }
+      if (trace.state !== undefined)
+        scope.traceState = trace.state;
     }
-    return this.#correlate ? this.context.runWithContext(scope, () => this.#begin(req, ctx, url, mark, path, requestId, started, next, undefined)) : this.#begin(req, ctx, url, mark, path, requestId, started, next, scope);
+    return this.#correlate ? this.context.runWithContext(scope, () => this.#begin(req, ctx, url, mark, path, started, next, undefined)) : this.#begin(req, ctx, url, mark, path, started, next, scope);
   }
-  #begin(req, ctx, url, mark, path, requestId, started, next, scope) {
+  #begin(req, ctx, url, mark, path, started, next, scope) {
     const request = {};
     if (mark !== -1) {
       request["query"] = Object.fromEntries(new URLSearchParams(url.slice(mark + 1)));
@@ -432,13 +948,13 @@ class RequestLoggingMiddleware {
     const body = this.#body(req, ctx);
     if (body === undefined) {
       request["userAgent"] = req.headers.get("user-agent");
-      return this.#dispatch(req, path, requestId, started, request, next, scope);
+      return this.#dispatch(req, ctx, path, started, request, next, scope);
     }
     return body.then((value) => {
       if (value !== undefined)
         request["body"] = value;
       request["userAgent"] = req.headers.get("user-agent");
-      return this.#dispatch(req, path, requestId, started, request, next, scope);
+      return this.#dispatch(req, ctx, path, started, request, next, scope);
     });
   }
   #shared(req, request) {
@@ -453,36 +969,56 @@ class RequestLoggingMiddleware {
     if (value !== undefined)
       request["body"] = value;
   }
-  #correlated(req, ctx, path, next) {
-    const requestId = RequestIds.assign(req);
-    const stamp = (response) => {
-      response.headers.set(REQUEST_ID_HEADER, requestId);
-      return response;
+  #ignoredWithMetrics(req, ctx, path, next) {
+    const started = Bun.nanoseconds();
+    const failed = (error) => {
+      this.#observe(req, ctx, error instanceof HttpError ? error.status : HttpStatusCode.INTERNAL_SERVER_ERROR, started);
+      throw error;
     };
+    let settled;
+    try {
+      settled = this.#correlateIgnored ? this.#correlated(req, ctx, path, next) : next();
+    } catch (error) {
+      return failed(error);
+    }
+    return settled.then((response) => {
+      this.#observe(req, ctx, response.status, started);
+      return response;
+    }, failed);
+  }
+  #correlated(req, ctx, path, next) {
+    const trace = this.#trace ? TraceContext.adopt(req, this.#traceResponse) : undefined;
+    const stamp = (response) => trace === undefined ? response : TraceContext.stamp(response, req);
     if (!this.#correlate)
       return next().then(stamp);
     return this.context.runWithContext({
-      requestId,
+      ...trace === undefined ? {} : {
+        traceId: trace.traceId,
+        spanId: trace.spanId,
+        traceFlags: trace.flags,
+        ...trace.parentSpanId === undefined ? {} : { parentSpanId: trace.parentSpanId },
+        ...trace.state === undefined ? {} : { traceState: trace.state }
+      },
       method: ctx.method,
       event: path,
       flow: "http",
       context: `${ctx.controller}.${ctx.handler}`
     }, () => next().then(stamp));
   }
-  #dispatch(req, path, requestId, started, request, next, scope) {
+  #dispatch(req, ctx, path, started, request, next, scope) {
     let settled;
     try {
       settled = next();
     } catch (error) {
-      this.#failed(req, path, started, request, error, scope);
+      this.#failed(req, ctx, path, started, request, error, scope);
       throw error;
     }
-    return settled.then((response) => this.#succeeded(req, path, requestId, started, request, response, scope), (error) => {
-      this.#failed(req, path, started, request, error, scope);
+    return settled.then((response) => this.#succeeded(req, ctx, path, started, request, response, scope), (error) => {
+      this.#failed(req, ctx, path, started, request, error, scope);
       throw error;
     });
   }
-  #failed(req, path, started, request, error, scope) {
+  #failed(req, ctx, path, started, request, error, scope) {
     this.#shared(req, request);
     const status = error instanceof HttpError ? error.status : HttpStatusCode.INTERNAL_SERVER_ERROR;
     const entry = {
@@ -492,6 +1028,7 @@ class RequestLoggingMiddleware {
       statusCode: status,
       elapsedMs: elapsedMs2(started)
     };
+    this.#observe(req, ctx, status, started);
     const line = `${req.method} ${path} ${status}`;
     if (status < HttpStatusCode.INTERNAL_SERVER_ERROR) {
       this.logger.warn(line, entry);
@@ -499,8 +1036,9 @@ class RequestLoggingMiddleware {
       this.logger.error(line, entry);
     }
   }
-  #succeeded(req, path, requestId, started, request, response, scope) {
+  #succeeded(req, ctx, path, started, request, response, scope) {
     this.#shared(req, request);
+    this.#observe(req, ctx, response.status, started);
     const body = this.#responseFields(response);
     if (body === undefined) {
       this.logger.info(`${req.method} ${path} ${response.status}`, {
@@ -509,8 +1047,7 @@ class RequestLoggingMiddleware {
         statusCode: response.status,
         elapsedMs: elapsedMs2(started)
       });
-      response.headers.set(REQUEST_ID_HEADER, requestId);
-      return response;
+      return TraceContext.stamp(response, req);
     }
     return body.then((value) => {
       this.logger.info(`${req.method} ${path} ${response.status}`, {
@@ -520,10 +1057,14 @@ class RequestLoggingMiddleware {
         ...value === undefined ? {} : { responseBody: value },
         elapsedMs: elapsedMs2(started)
       });
-      response.headers.set(REQUEST_ID_HEADER, requestId);
-      return response;
+      return TraceContext.stamp(response, req);
     });
   }
+  #observe(req, ctx, status, started) {
+    if (this.#metrics === undefined)
+      return;
+    this.#metrics.observe(ctx, status, Bun.nanoseconds() - started, TraceContext.of(req)?.traceId);
+  }
   #body(req, ctx) {
     if (!this.#requestBody)
       return;
@@ -547,13 +1088,304 @@ class RequestLoggingMiddleware {
     return response.clone().text().then((text) => parse(text, this.#limit));
   }
 }
-Object.defineProperty(RequestLoggingMiddleware, Symbol.for("dunx.deps"), { value: () => [Logger2, RequestContext2, { unresolved: "options: RequestLoggingOptions = {}", optional: true }] });
+Object.defineProperty(RequestLoggingMiddleware, Symbol.for("dunx.deps"), { value: () => [Logger2, RequestContext2, { unresolved: "options: RequestLoggingOptions = {}", optional: true }, { unresolved: "metrics?: RequestMetrics", typeOnly: "RequestMetrics" }] });
+
+// src/server/routes.ts
+import { AppError as AppError6 } from "@dunx/core";
+
+// src/server/cors.ts
+var ORIGIN = "access-control-allow-origin";
+var allowedOrigin = (options, requested) => {
+  const origin = options.origin ?? "*";
+  if (typeof origin === "string") {
+    if (origin !== "*")
+      return origin === requested ? origin : undefined;
+    if (!options.credentials)
+      return "*";
+    return requested ?? undefined;
+  }
+  if (requested === null)
+    return;
+  const allowed = typeof origin === "function" ? origin(requested) : origin.includes(requested);
+  return allowed ? requested : undefined;
+};
+var applyCors = (options, req, response) => {
+  const origin = allowedOrigin(options, req.headers.get("origin"));
+  if (origin === undefined)
+    return response;
+  response.headers.set(ORIGIN, origin);
+  if (origin !== "*")
+    response.headers.append("vary", "Origin");
+  if (options.credentials) {
+    response.headers.set("access-control-allow-credentials", "true");
+  }
+  if (options.exposedHeaders?.length) {
+    response.headers.set("access-control-expose-headers", options.exposedHeaders.join(", "));
+  }
+  return response;
+};
+var withCors = (options, handler) => {
+  return async (req) => applyCors(options, req, await handler(req));
+};
+var preflight = (options, methods) => {
+  const allowMethods = (options.methods ?? methods).join(", ");
+  return async (req) => {
+    const response = applyCors(options, req, new Response(null, { status: HttpStatusCode.NO_CONTENT }));
+    if (!response.headers.has(ORIGIN))
+      return response;
+    response.headers.set("access-control-allow-methods", allowMethods);
+    const allowHeaders = options.allowedHeaders ?? (req.headers.get("access-control-request-headers") ?? "").split(",").map((header) => header.trim()).filter((header) => header.length > 0);
+    if (allowHeaders.length > 0) {
+      response.headers.set("access-control-allow-headers", allowHeaders.join(", "));
+    }
+    if (options.maxAge !== undefined) {
+      response.headers.set("access-control-max-age", String(options.maxAge));
+    }
+    return response;
+  };
+};
+
+// src/server/input.ts
+var grouped = (entries) => {
+  const collected = {};
+  entries.forEach((value, key) => {
+    const existing = collected[key];
+    if (existing === undefined)
+      collected[key] = value;
+    else if (Array.isArray(existing))
+      existing.push(value);
+    else
+      collected[key] = [existing, value];
+  });
+  return collected;
+};
+var asJson = (req) => req.json();
+var asUrlEncoded = async (req) => grouped(new URLSearchParams(await req.text()));
+var asMultipart = async (req) => grouped(await req.formData());
+var asText = (req) => req.text();
+var parserFor = (media) => {
+  if (media === "application/json" || media.endsWith("+json"))
+    return asJson;
+  if (media === "application/x-www-form-urlencoded")
+    return asUrlEncoded;
+  if (media === "multipart/form-data")
+    return asMultipart;
+  if (media.startsWith("text/"))
+    return asText;
+  return;
+};
+var JSON_MEDIA = "application/json";
+var mediaTypeOf = (req) => {
+  const header = req.headers.get("content-type");
+  if (header === JSON_MEDIA || header === null)
+    return JSON_MEDIA;
+  const end = header.indexOf(";");
+  const media = (end === -1 ? header : header.slice(0, end)).trim();
+  return media === "" ? JSON_MEDIA : media.toLowerCase();
+};
+var flatten = (issue) => {
+  const path = issue.path?.map((segment) => String(typeof segment === "object" ? segment.key : segment)).join(".");
+  return path === undefined || path === "" ? { message: issue.message } : { message: issue.message, path };
+};
+var accept = (source, result) => {
+  if (result.issues !== undefined) {
+    throw new ValidationError(source, result.issues.map(flatten));
+  }
+  return result.value;
+};
+var fillWith = (draft, source, schema, value) => {
+  const result = schema["~standard"].validate(value);
+  if (result instanceof Promise) {
+    return result.then((settled) => {
+      draft[source] = accept(source, settled);
+      return draft;
+    });
+  }
+  draft[source] = accept(source, result);
+  return draft;
+};
+var bodyFill = (schema) => (draft) => {
+  const media = mediaTypeOf(draft.req);
+  const parse2 = parserFor(media);
+  if (parse2 === undefined) {
+    throw new HttpError(HttpStatusCode.UNSUPPORTED_MEDIA_TYPE, `Unsupported content type "${media}". Declared bodies accept ` + "application/json, application/x-www-form-urlencoded, multipart/form-data or text/*.");
+  }
+  const read = parse2 === asJson && RawBody.wanted(draft.req) ? draft.req.text().then((text) => {
+    RawBody.record(draft.req, text);
+    return JSON.parse(text);
+  }) : parse2(draft.req);
+  return read.then((value) => fillWith(draft, "body", schema, value), (error) => {
+    throw new HttpError(HttpStatusCode.BAD_REQUEST, `Malformed ${media} body`, { cause: error });
+  });
+};
+var searchOf = (url) => {
+  const start = url.indexOf("?");
+  if (start === -1)
+    return "";
+  const end = url.indexOf("#", start + 1);
+  return end === -1 ? url.slice(start + 1) : url.slice(start + 1, end);
+};
+var queryFill = (schema) => (draft) => {
+  const params = new URLSearchParams(searchOf(draft.req.url));
+  return fillWith(draft, "query", schema, grouped(params));
+};
+var paramsFill = (schema) => (draft) => fillWith(draft, "params", schema, draft.req.params);
+var then = (first, second) => (draft) => {
+  const started = first(draft);
+  return started instanceof Promise ? started.then(second) : second(started);
+};
+var buildInputReader = (options) => {
+  const fills = [];
+  if (options?.body !== undefined)
+    fills.push(bodyFill(options.body));
+  if (options?.query !== undefined)
+    fills.push(queryFill(options.query));
+  if (options?.params !== undefined)
+    fills.push(paramsFill(options.params));
+  if (fills.length === 0)
+    return (req) => ({ req });
+  const fill = fills.reduce(then);
+  return (req) => fill({ req });
+};
+
+// src/server/middleware.ts
+var compose = (middleware, ctx, handler) => middleware.reduceRight((next, current) => (req) => current.handle(req, ctx, () => next(req)), handler);
+
+// src/server/routes.ts
+var construct = (guard) => new guard;
+var toResponse = (value, status) => {
+  if (value instanceof Response)
+    return value;
+  if (value === undefined || value === null) {
+    return new Response(null, { status: HttpStatusCode.NO_CONTENT });
+  }
+  return Response.json(value, { status });
+};
+var statusFor = (route) => route.options?.status ?? defaultStatusFor(route.method);
+var assertNoCollisions = (discovered) => {
+  const owners = new Map;
+  for (const route of discovered) {
+    const key = `${route.method} ${route.path}`;
+    const owner = `${route.controller}.${route.handlerName}`;
+    const existing = owners.get(key);
+    if (existing !== undefined) {
+      throw new AppError6(`Route collision: ${key} is declared by ${existing} and by ${owner}. ` + "Bun would keep only one of them.");
+    }
+    owners.set(key, owner);
+  }
+};
+var assertNoGatewayCollisions = (discovered, gatewayPaths) => {
+  const gateways = new Set(gatewayPaths);
+  for (const route of discovered) {
+    if (gateways.has(route.path)) {
+      throw new AppError6(`Gateway path collision: ${route.path} is served by a gateway and by ` + `${route.controller}.${route.handlerName}(). The upgrade is a route too, ` + "so one of them would be dropped.");
+    }
+  }
+};
+var withUpgradeRoutes = (routes, gateways) => {
+  const merged = { ...routes };
+  for (const [path, upgrade] of gateways)
+    merged[path] = { GET: upgrade };
+  return merged;
+};
+var unmatchedContext = (req, isPublic) => Object.freeze({
+  controller: "(unmatched)",
+  handler: "(none)",
+  method: req.method,
+  path: new URL(req.url).pathname,
+  parsesBody: false,
+  get: (key) => {
+    if (key.id === UNMATCHED.id)
+      return true;
+    if (key.id === PUBLIC.id && isPublic)
+      return true;
+    return;
+  }
+});
+var buildFallback = (middleware = [], onError = defaultErrorMapper, cors, notFound = "guarded") => {
+  const miss = () => {
+    throw new HttpError(HttpStatusCode.NOT_FOUND, "NOT_FOUND");
+  };
+  const run = async (req) => {
+    try {
+      return await compose(middleware, unmatchedContext(req, notFound === "public"), miss)(req);
+    } catch (error) {
+      return TraceContext.stamp(onError(error, req), req);
+    }
+  };
+  return cors ? withCors(cors, run) : run;
+};
+var directOr = (guarded, route, read, status, onError, noMiddleware) => {
+  if (!noMiddleware)
+    return guarded;
+  const settle2 = (value, req) => {
+    try {
+      return toResponse(value, status);
+    } catch (error) {
+      return onError(error, req);
+    }
+  };
+  const invoke = (input, req) => {
+    try {
+      const value = route.handler(input);
+      return value instanceof Promise ? value.then((resolved) => settle2(resolved, req), (error) => onError(error, req)) : settle2(value, req);
+    } catch (error) {
+      return onError(error, req);
+    }
+  };
+  return (req) => {
+    try {
+      const input = read(req);
+      return input instanceof Promise ? input.then((resolved) => invoke(resolved, req), (error) => onError(error, req)) : invoke(input, req);
+    } catch (error) {
+      return onError(error, req);
+    }
+  };
+};
+var buildRoutes = (discovered, middleware = [], onError = defaultErrorMapper, cors, resolve = construct) => {
+  assertNoCollisions(discovered);
+  const routes = {};
+  const instances = new Map;
+  const guardOf = (guard, from) => {
+    const existing = instances.get(guard);
+    if (existing)
+      return existing;
+    const created = resolve(guard, from);
+    instances.set(guard, created);
+    return created;
+  };
+  for (const route of discovered) {
+    const read = buildInputReader(route.options);
+    const status = statusFor(route);
+    const chain = [
+      ...middleware,
+      ...(route.moduleMiddleware ?? []).map((entry) => guardOf(entry, route.module)),
+      ...(route.guards ?? []).map((guard) => guardOf(guard, route.module))
+    ];
+    const chained = compose(chain, buildContext(route), async (req) => toResponse(await route.handler(await read(req)), status));
+    const guarded = async (req) => {
+      try {
+        return await chained(req);
+      } catch (error) {
+        return TraceContext.stamp(onError(error, req), req);
+      }
+    };
+    const byMethod = routes[route.path] ??= {};
+    byMethod[route.method] = cors ? withCors(cors, guarded) : directOr(guarded, route, read, status, onError, chain.length === 0);
+  }
+  if (cors) {
+    for (const byMethod of Object.values(routes)) {
+      byMethod.OPTIONS = preflight(cors, Object.keys(byMethod));
+    }
+  }
+  return routes;
+};
 
 // src/server/settings.ts
 var defaultSettings = () => ({ "trust proxy": false });
 
 // src/server/application.ts
-class HttpApplication {
+class HttpApplication extends ShutdownAware {
   warnings;
   #root;
   closed;
@@ -576,14 +1408,15 @@ class HttpApplication {
   #server;
   #resolveClosed;
   #shuttingDown;
-  #hooks = new ShutdownHooks;
   constructor(app, discovered, options, root, websocket) {
+    super();
     this.#app = app;
     this.#root = root;
     this.warnings = app.warnings;
     this.#discovered = discovered;
     this.#middleware = [
       ...options.requestLogging === false ? [] : [RequestLoggingMiddleware],
+      ...usesMetricsMiddleware(options) ? [MetricsMiddleware] : [],
       ...options.middleware ?? []
     ];
     this.#onError = options.onError === undefined ? errorMapper(app.get(Logger3)) : toErrorMapper(options.onError, (token) => app.get(token, root));
@@ -666,6 +1499,7 @@ class HttpApplication {
       server: this.#server,
       trustProxy: this.#settings["trust proxy"]
     });
+    this.#app.get(RequestMetrics).attach(this.#server);
     const pubsub = this.#app.get(PubSub);
     pubsub.attach(this.#server);
     if (this.#relay) {
@@ -732,10 +1566,6 @@ class HttpApplication {
     })();
     return this.#shuttingDown;
   }
-  enableShutdownHooks(signals = ["SIGTERM", "SIGINT"], options = {}) {
-    this.#hooks.install(() => this.shutdown(), signals, options);
-    return this;
-  }
   #prefixed() {
     if (this.#globalPrefix === "")
       return this.#discovered;
@@ -747,7 +1577,7 @@ class HttpApplication {
   #assertNotStarted(hook) {
     if (!this.#started)
       return;
-    throw new AppError3(`${hook} must be called before listen(). The route table and the middleware ` + "chain are folded into one closure per route when the server binds, so " + "this call could not take effect.");
+    throw new AppError7(`${hook} must be called before listen(). The route table and the middleware ` + "chain are folded into one closure per route when the server binds, so " + "this call could not take effect.");
   }
 }
 Object.defineProperty(HttpApplication, Symbol.for("dunx.deps"), { value: () => [{ unresolved: "app: App", typeOnly: "App" }, { unresolved: "discovered: readonly DiscoveredRoute[]" }, { unresolved: "options: HttpOptions" }, { unresolved: "root: ModuleRef", typeOnly: "ModuleRef" }, { unresolved: "websocket?: WebSocketRuntime", typeOnly: "WebSocketRuntime" }] });
@@ -776,6 +1606,9 @@ class HttpOptionsProvider {
   get socketLogging() {
     return true;
   }
+  get metrics() {
+    return false;
+  }
   get onError() {
     return;
   }
@@ -806,6 +1639,7 @@ function resolveHttpOptions(settings, given) {
     cors: settings.cors,
     requestLogging: settings.requestLogging,
     socketLogging: settings.socketLogging,
+    metrics: settings.metrics,
     onError: settings.onError,
     websocket: settings.websocket,
     relay: settings.relay,
@@ -828,15 +1662,24 @@ var pick = (given, fallback) => {
 class HttpFactory {
   static async create(root, options = {}) {
     const logging = provide(RequestLoggingMiddleware, {
-      useFactory: (logger, context, settings) => new RequestLoggingMiddleware(logger, context, pick(options.requestLogging, settings.requestLogging)),
-      inject: [Logger4, RequestContext3, HttpOptionsProvider]
+      useFactory: (logger, context, settings, metrics) => new RequestLoggingMiddleware(logger, context, pick(options.requestLogging, settings.requestLogging), options.metrics ?? settings.metrics ? metrics : undefined),
+      inject: [
+        Logger4,
+        RequestContext3,
+        HttpOptionsProvider,
+        RequestMetrics
+      ]
+    });
+    const metricsMiddleware = provide(MetricsMiddleware, {
+      useFactory: (metrics) => new MetricsMiddleware(metrics),
+      inject: [RequestMetrics]
     });
     const socketLogging = provide(SocketLoggingMiddleware, {
       useFactory: (logger, context, settings) => new SocketLoggingMiddleware(logger, context, pick(options.socketLogging, settings.socketLogging)),
       inject: [Logger4, RequestContext3, HttpOptionsProvider]
     });
-    const services = [PubSub, ClientAddress];
-    const providers = [...services, logging, socketLogging];
+    const services = [PubSub, ClientAddress, RequestMetrics];
+    const providers = [...services, logging, metricsMiddleware, socketLogging];
     const scope = {
       module: HttpModule,
       global: true,
@@ -856,7 +1699,7 @@ class HttpFactory {
       for (const controller of readControllers(module)) {
         const routes = discoverRoutes(app.get(controller, module.ref));
         if (routes.length === 0) {
-          throw new AppError4(`${controller.name} is registered as a controller but declares no routes. ` + "Add a @Get/@Post/... method, or move it to providers.");
+          throw new AppError8(`${controller.name} is registered as a controller but declares no routes. ` + "Add a @Get/@Post/... method, or move it to providers.");
         }
         discovered.push(...routes.map((route) => ({
           ...route,
@@ -883,6 +1726,27 @@ class HttpFactory {
 }
 // src/static/files.ts
 import { join, normalize, resolve } from "path";
+
+// src/static/options.ts
+class StaticOptions {
+  root;
+  path;
+  maxAge;
+  immutable;
+  constructor(init) {
+    this.root = init.root;
+    this.path = normalizePrefix(init.path ?? "/");
+    this.maxAge = init.maxAge ?? 60;
+    this.immutable = init.immutable ?? (() => false);
+  }
+}
+Object.defineProperty(StaticOptions, Symbol.for("dunx.deps"), { value: () => [{ unresolved: "init: StaticOptionsInit" }] });
+var normalizePrefix = (path) => {
+  const trimmed = path.split("/").filter(Boolean).join("/");
+  return trimmed === "" ? "/" : `/${trimmed}`;
+};
+
+// src/static/files.ts
 class StaticFiles {
   #options;
   #root;
@@ -979,6 +1843,99 @@ StaticModule = __decorateElement(_init, 0, "StaticModule", _dec, StaticModule);
 __runInitializers(_init, 1, StaticModule);
 __decoratorMetadata(_init, StaticModule);
 let _StaticModule = StaticModule;
+// src/compression/negotiate.ts
+var quality = (params) => {
+  for (const param of params) {
+    const [key, value] = param.split("=");
+    if (key?.trim().toLowerCase() !== "q")
+      continue;
+    const q = Number.parseFloat(value ?? "");
+    return Number.isFinite(q) && q >= 0 && q <= 1 ? q : 1;
+  }
+  return 1;
+};
+var negotiate = (header, offered) => {
+  if (header === null)
+    return;
+  const accepted = new Map;
+  for (const element of header.split(",")) {
+    const [name, ...params] = element.split(";");
+    const token = name?.trim().toLowerCase();
+    if (token === undefined || token === "")
+      continue;
+    accepted.set(token, quality(params));
+  }
+  const wildcard = accepted.get("*");
+  let best;
+  let bestQuality = 0;
+  for (const encoding of offered) {
+    const q = accepted.get(encoding) ?? wildcard ?? 0;
+    if (q > bestQuality) {
+      best = encoding;
+      bestQuality = q;
+    }
+  }
+  return best;
+};
+
+// src/compression/options.ts
+var CompressionEncoding = Object.freeze({
+  ZSTD: "zstd",
+  GZIP: "gzip"
+});
+var COMPRESSIBLE = new Set([
+  "application/graphql",
+  "application/graphql-response+json",
+  "application/javascript",
+  "application/json",
+  "application/manifest+json",
+  "application/wasm",
+  "application/x-javascript",
+  "application/x-ndjson",
+  "application/xml",
+  "image/svg+xml"
+]);
+var isCompressibleType = (contentType) => {
+  if (contentType === null)
+    return false;
+  const type = contentType.split(";")[0]?.trim().toLowerCase() ?? "";
+  if (type.startsWith("text/"))
+    return true;
+  if (type.endsWith("+json") || type.endsWith("+xml"))
+    return true;
+  return COMPRESSIBLE.has(type);
+};
+var encodable = (encoding) => {
+  const sync = encoding === CompressionEncoding.ZSTD ? Bun.zstdCompressSync : Bun.gzipSync;
+  if (typeof sync !== "function")
+    return false;
+  try {
+    new CompressionStream(encoding);
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+class CompressionOptions {
+  encodings;
+  threshold;
+  filter;
+  constructor(init = {}) {
+    this.encodings = init.encodings ?? [
+      CompressionEncoding.ZSTD,
+      CompressionEncoding.GZIP
+    ];
+    const missing = this.encodings.filter((encoding) => !encodable(encoding));
+    if (missing.length > 0) {
+      throw new Error(`Bun ${Bun.version} cannot encode ${missing.join(", ")}. ` + "Pass `encodings` without it, or upgrade Bun.");
+    }
+    this.threshold = init.threshold ?? 1024;
+    this.filter = init.filter ?? isCompressibleType;
+  }
+}
+Object.defineProperty(CompressionOptions, Symbol.for("dunx.deps"), { value: () => [{ unresolved: "init: CompressionOptionsInit = {}", optional: true }] });
+
 // src/compression/compression.ts
 var BODYLESS = new Set([204, 205, 304]);
 var BUFFER_LIMIT = 1024 * 1024;
@@ -1159,7 +2116,7 @@ var SkipThrottle = () => meta(SKIP_THROTTLE, true);
 import { Logger as Logger5 } from "@dunx/core";
 
 // src/throttle/options.ts
-import { AppError as AppError5 } from "@dunx/core";
+import { AppError as AppError9 } from "@dunx/core";
 
 class ThrottleOptions {
   limit;
@@ -1170,13 +2127,13 @@ class ThrottleOptions {
   store;
   constructor(init) {
     if (init.prefix.trim() === "") {
-      throw new AppError5("ThrottleModule needs a prefix naming this application, and it has no " + "default: two apps sharing one Redis with one throttle namespace each " + "spend the other's budget. Pass something like { prefix: 'orders-api' }.");
+      throw new AppError9("ThrottleModule needs a prefix naming this application, and it has no " + "default: two apps sharing one Redis with one throttle namespace each " + "spend the other's budget. Pass something like { prefix: 'orders-api' }.");
     }
     if (!Number.isInteger(init.limit) || init.limit < 1) {
-      throw new AppError5(`ThrottleModule needs a limit of at least 1; got ${init.limit}.`);
+      throw new AppError9(`ThrottleModule needs a limit of at least 1; got ${init.limit}.`);
     }
     if (!Number.isInteger(init.windowSeconds) || init.windowSeconds < 1) {
-      throw new AppError5("ThrottleModule needs a windowSeconds of at least 1; got " + `${init.windowSeconds}.`);
+      throw new AppError9("ThrottleModule needs a windowSeconds of at least 1; got " + `${init.windowSeconds}.`);
     }
     this.limit = init.limit;
     this.windowSeconds = init.windowSeconds;
@@ -1189,12 +2146,12 @@ class ThrottleOptions {
 Object.defineProperty(ThrottleOptions, Symbol.for("dunx.deps"), { value: () => [{ unresolved: "init: ThrottleOptionsInit" }] });
 
 // src/throttle/store.ts
-import { AppError as AppError6 } from "@dunx/core";
+import { AppError as AppError10 } from "@dunx/core";
 
 class ThrottleStore {
   constructor() {
     if (new.target === ThrottleStore) {
-      throw new AppError6("ThrottleStore is a contract, not an implementation. Bind one with " + "ThrottleModule.forRoot({ store: new RedisThrottleStore(redis) }), or " + "leave it out for the in-process MemoryThrottleStore.");
+      throw new AppError10("ThrottleStore is a contract, not an implementation. Bind one with " + "ThrottleModule.forRoot({ store: new RedisThrottleStore(redis) }), or " + "leave it out for the in-process MemoryThrottleStore.");
     }
   }
 }
@@ -1398,21 +2355,8 @@ var OnMessage = (event) => (value) => {
   return value;
 };
 // src/ws/postgres-relay.ts
-import { AppError as AppError7 } from "@dunx/core";
 var PROTOCOLS = ["postgres:", "postgresql:"];
 var defaultPostgresRelayUrl = () => process.env["POSTGRES_URL"] ?? process.env["DATABASE_URL"] ?? "postgres://localhost:5432";
-var assertUrl = (url) => {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    throw new AppError7(`${JSON.stringify(url)} is not a valid URL for the websocket relay. ` + "Expected something like postgres://localhost:5432/app.");
-  }
-  if (!PROTOCOLS.includes(parsed.protocol)) {
-    throw new AppError7(`Unsupported protocol ${JSON.stringify(parsed.protocol)} in ` + `${JSON.stringify(url)}. Expected one of ${PROTOCOLS.join(", ")}.`);
-  }
-  return url;
-};
 
 class PostgresRelay extends WsRelay {
   #url;
@@ -1421,14 +2365,11 @@ class PostgresRelay extends WsRelay {
   #subscription;
   constructor(options = {}) {
     super();
-    this.#url = assertUrl(options.url ?? defaultPostgresRelayUrl());
+    this.#url = assertRelayUrl(options.url ?? defaultPostgresRelayUrl(), PROTOCOLS, "postgres://localhost:5432/app");
     this.#max = options.max ?? 1;
   }
   get url() {
-    const parsed = new URL(this.#url);
-    if (parsed.password)
-      parsed.password = "***";
-    return parsed.toString();
+    return redactUrl(this.#url);
   }
   #client() {
     return this.#sql ??= new Bun.SQL({ url: this.#url, max: this.#max });
@@ -1462,6 +2403,82 @@ class PostgresRelay extends WsRelay {
   }
 }
 Object.defineProperty(PostgresRelay, Symbol.for("dunx.deps"), { value: () => [{ unresolved: "options: PostgresRelayOptions = {}", optional: true }] });
+// src/ws/redis-relay.ts
+var PROTOCOLS2 = [
+  "redis:",
+  "rediss:",
+  "valkey:",
+  "valkeys:",
+  "redis+tls:",
+  "redis+unix:",
+  "redis+tls+unix:"
+];
+var defaultRelayUrl = () => process.env["VALKEY_URL"] ?? process.env["REDIS_URL"] ?? "redis://localhost:6379";
+
+class RedisRelay extends WsRelay {
+  #url;
+  #options;
+  #pub;
+  #sub;
+  #channel;
+  constructor(options = {}) {
+    super();
+    this.#url = assertRelayUrl(options.url ?? defaultRelayUrl(), PROTOCOLS2, "redis://localhost:6379");
+    this.#options = {
+      maxRetries: options.maxRetries ?? 0,
+      ...options.connectionTimeout !== undefined && {
+        connectionTimeout: options.connectionTimeout
+      },
+      ...options.tls !== undefined && { tls: options.tls }
+    };
+  }
+  get url() {
+    return redactUrl(this.#url);
+  }
+  async publish(channel, message) {
+    const client = this.#pub ??= new Bun.RedisClient(this.#url, this.#options);
+    try {
+      return await client.publish(channel, message);
+    } catch (error) {
+      if (this.#pub === client) {
+        this.#pub = undefined;
+        client.close();
+      }
+      throw error;
+    }
+  }
+  async subscribe(channel, listener) {
+    const client = this.#sub ??= new Bun.RedisClient(this.#url, this.#options);
+    try {
+      await client.connect();
+      await client.subscribe(channel, listener);
+      this.#channel = channel;
+    } catch (error) {
+      if (this.#sub === client) {
+        this.#sub = undefined;
+        client.close();
+      }
+      throw error;
+    }
+  }
+  async close() {
+    const sub = this.#sub;
+    const channel = this.#channel;
+    this.#pub?.close();
+    this.#pub = undefined;
+    this.#sub = undefined;
+    this.#channel = undefined;
+    if (!sub)
+      return;
+    if (channel !== undefined) {
+      try {
+        await sub.unsubscribe(channel);
+      } catch {}
+    }
+    sub.close();
+  }
+}
+Object.defineProperty(RedisRelay, Symbol.for("dunx.deps"), { value: () => [{ unresolved: "options: RedisRelayOptions = {}", optional: true }] });
 // src/ws/relay-module.ts
 import {
   provide as provide5
@@ -1603,6 +2620,201 @@ class PingProbe {
 
 class QueryProbe {
 }
+// src/health/controller.ts
+import { inject } from "@dunx/core";
+
+// src/health/report-schema.ts
+var state = {
+  type: "string",
+  enum: ["up", "down", "unknown"],
+  description: "`unknown` is not `down`: a probe that timed out has told you nothing."
+};
+var HEALTH_REPORT_SCHEMA = Object.freeze({
+  $id: "HealthReport",
+  type: "object",
+  description: "What the probe found. `up` answers 200 and anything else answers 503.",
+  properties: {
+    status: state,
+    draining: {
+      type: "boolean",
+      description: "The process is shutting down, or something holds it out."
+    },
+    uptimeMs: {
+      type: "integer",
+      description: "Measured on a monotonic clock, so it never goes backwards."
+    },
+    checks: {
+      type: "array",
+      items: {
+        type: "object",
+        properties: {
+          name: { type: "string" },
+          state,
+          critical: {
+            type: "boolean",
+            description: "A failure here sheds traffic. Memory and disk do not."
+          },
+          ms: { type: "integer", description: "How long the check took." },
+          detail: {
+            type: "string",
+            description: "A latency, a version, or a failure message."
+          }
+        },
+        required: ["name", "state", "critical", "ms"]
+      }
+    }
+  },
+  required: ["status", "draining", "uptimeMs", "checks"]
+});
+
+// src/health/registry.ts
+var bounded = async (indicator, timeoutMs) => {
+  let timer;
+  const timeout = new Promise((resolve2) => {
+    timer = setTimeout(() => resolve2({ state: "unknown", detail: `no answer in ${timeoutMs} ms` }), timeoutMs);
+    timer.unref?.();
+  });
+  try {
+    return await Promise.race([
+      Promise.resolve().then(() => indicator.check()).catch((error) => ({
+        state: "down",
+        detail: error instanceof Error ? error.message : String(error)
+      })),
+      timeout
+    ]);
+  } finally {
+    if (timer)
+      clearTimeout(timer);
+  }
+};
+var worst = (checks) => {
+  const critical = checks.filter((check) => check.critical);
+  if (critical.some((check) => check.state === "down"))
+    return "down";
+  if (critical.some((check) => check.state === "unknown"))
+    return "unknown";
+  return "up";
+};
+
+class HealthOptions {
+  liveness;
+  readiness;
+  timeoutMs;
+  routes;
+  documented;
+  drainDelayMs;
+  constructor(init = {}) {
+    this.liveness = init.liveness ?? [];
+    this.readiness = init.readiness ?? [];
+    this.timeoutMs = init.timeoutMs ?? 2000;
+    this.routes = init.routes ?? true;
+    this.documented = init.documented ?? true;
+    this.drainDelayMs = Math.max(0, init.drainDelayMs ?? 0);
+  }
+}
+Object.defineProperty(HealthOptions, Symbol.for("dunx.deps"), { value: () => [{ unresolved: "init: HealthOptionsInit = {}", optional: true }] });
+
+class HealthRegistry {
+  options;
+  readiness_;
+  #startedAt = performance.now();
+  constructor(options, readiness_) {
+    this.options = options;
+    this.readiness_ = readiness_;
+  }
+  async report(indicators) {
+    const checks = await Promise.all(indicators.map(async (indicator) => {
+      const started = performance.now();
+      const result = await bounded(indicator, this.options.timeoutMs);
+      return {
+        name: indicator.name,
+        state: result.state,
+        critical: indicator.critical,
+        ms: Math.round(performance.now() - started),
+        ...result.detail === undefined ? {} : { detail: result.detail }
+      };
+    }));
+    return {
+      status: worst(checks),
+      draining: this.readiness_.draining,
+      uptimeMs: Math.round(performance.now() - this.#startedAt),
+      checks
+    };
+  }
+  liveness() {
+    return this.report(this.options.liveness);
+  }
+  async readiness() {
+    const report = await this.report(this.options.readiness);
+    if (!this.readiness_.draining)
+      return report;
+    return {
+      ...report,
+      status: "down",
+      checks: [
+        {
+          name: "readiness",
+          state: "down",
+          critical: true,
+          ms: 0,
+          detail: this.readiness_.reason ?? "not accepting traffic"
+        },
+        ...report.checks
+      ]
+    };
+  }
+}
+Object.defineProperty(HealthRegistry, Symbol.for("dunx.deps"), { value: () => [HealthOptions, { unresolved: "private readonly readiness_: Readiness", typeOnly: "Readiness" }] });
+
+// src/health/controller.ts
+var probeResponses = {
+  response: { 200: HEALTH_REPORT_SCHEMA, 503: HEALTH_REPORT_SCHEMA }
+};
+var answer = (report) => Response.json(report, { status: report.status === "up" ? 200 : 503 });
+var _dec = [
+  Controller("health")
+];
+var _dec2 = [
+  Public(),
+  Get("/live", probeResponses)
+];
+var _dec3 = [
+  Public(),
+  Get("/ready", probeResponses)
+];
+var _health = new WeakMap;
+var _init = __decoratorStart(undefined);
+
+class HealthController {
+  constructor() {
+    __privateAdd(this, _health, inject(HealthRegistry));
+    __runInitializers(_init, 5, this);
+  }
+  async live() {
+    return answer(await __privateGet(this, _health).liveness());
+  }
+  async ready() {
+    return answer(await __privateGet(this, _health).readiness());
+  }
+}
+__decorateElement(_init, 1, "live", _dec2, HealthController);
+__decorateElement(_init, 1, "ready", _dec3, HealthController);
+HealthController = __decorateElement(_init, 0, "HealthController", _dec, HealthController);
+__runInitializers(_init, 1, HealthController);
+__decoratorMetadata(_init, HealthController);
+let _HealthController = HealthController;
+var _dec = [
+  ApiHidden()
+];
+var _base = HealthController;
+var _init = __decoratorStart(_base);
+
+class HiddenHealthController extends _base {
+}
+HiddenHealthController = __decorateElement(_init, 0, "HiddenHealthController", _dec, HiddenHealthController);
+__runInitializers(_init, 1, HiddenHealthController);
+__decoratorMetadata(_init, HiddenHealthController);
+let _HiddenHealthController = HiddenHealthController;
 // src/health/indicators.ts
 import { statfs } from "fs/promises";
 var ms = (started) => Math.round(performance.now() - started);
@@ -1819,6 +3031,7 @@ export {
   MemoryIndicator,
   MemoryOptions,
   MemoryThrottleStore,
+  MetricsMiddleware,
   OnClose,
   OnDrain,
   OnMessage,
@@ -1836,7 +3049,6 @@ export {
   Public,
   Put,
   QueryProbe,
-  REQUEST_ID_HEADER,
   ROLES,
   Readiness,
   ReadinessOptions,
@@ -1845,6 +3057,7 @@ export {
   RedisThrottleStore,
   RelayConnectionOptions,
   RequestLoggingMiddleware,
+  RequestMetrics,
   Roles,
   SKIP_THROTTLE,
   SkipThrottle,
@@ -1854,6 +3067,7 @@ export {
   StaticOptions,
   THROTTLE,
   TRACEPARENT_HEADER,
+  TRACERESPONSE_HEADER,
   TRACESTATE_HEADER,
   Throttle,
   ThrottleGuard,
@@ -1862,6 +3076,7 @@ export {
   ThrottleStore,
   TraceContext,
   UNMATCHED,
+  UNMATCHED_ROUTE,
   UseGuards,
   ValidationError,
   WsRelay,