@server/next 0.48.2 → 0.49.0

package/index.js

@@ -1,7 +1,10 @@
-// src/ServerError.ts
+// src/errors/index.ts
+var registry = {};
+var definition = (code) => registry[code];
 var ServerError = class _ServerError extends Error {
   code;
   status;
+  hint;
   constructor(code, status2, message, vars = {}) {
     let messageStr;
     if (typeof message === "function") {
@@ -21,42 +24,109 @@ var ServerError = class _ServerError extends Error {
     this.code = code;
     this.message = messageStr;
     this.status = status2;
+    this.hint = registry[code]?.hint;
   }
   static extend(errors) {
     for (const code in errors) {
-      const error = errors[code];
-      if (typeof error === "string") {
-        _ServerError[code] = (vars = {}) => new _ServerError(code, 500, error, vars);
-      } else {
-        _ServerError[code] = (vars = {}) => new _ServerError(code, error.status, error.message, vars);
-      }
+      const raw = errors[code];
+      const def = typeof raw === "string" ? { status: 500, message: raw } : raw;
+      registry[code] = def;
+      _ServerError[code] = (vars = {}) => new _ServerError(code, def.status, def.message, vars);
     }
     return errors;
   }
 };
-var TypedServerError = ServerError;
-var ServerError_default = TypedServerError;
-
-// src/errors/index.ts
-ServerError_default.extend({
+ServerError.extend({
+  NOT_FOUND: {
+    status: 404,
+    message: "Not Found",
+    hint: "No route matched. Register a catch-all last to answer with your own page: `.get(() => <MissingPage />)`, since routes are tried in the order they were added and the first match wins."
+  },
+  METHOD_NOT_ALLOWED: {
+    status: 405,
+    message: 'The HTTP method "{method}" is not supported',
+    hint: "Only GET, POST, PUT, PATCH, DELETE, HEAD and OPTIONS are routed. A client sending anything else is usually a proxy or a scanner."
+  },
   PATH_TRAVERSAL: {
     status: 400,
-    message: "The route param '{param}' tries to climb the path ('{value}'). If this route legitimately receives paths, set security: { traversalProtection: false }"
+    message: "The route param '{param}' tries to climb the path ('{value}')",
+    hint: "A route param pointed outside where it belongs. If this route legitimately receives paths, set `security: { traversalProtection: false }`."
   },
-  AUTH_INVALID_TOKEN: { status: 401, message: "Invalid Authorization token" },
-  AUTH_NO_CODE: {
+  INVALID_REQUEST: {
+    status: 422,
+    message: "Invalid request {source}",
+    hint: "The route's schema rejected the request. The failing fields are on `error.issues`, which a custom `onError` can shape into an API response."
+  },
+  VALIDATION_FAILED: {
+    status: 500,
+    message: "Server Error",
+    hint: "The handler returned something its own `response` schema rejects, so this is a bug in the route rather than in the request."
+  },
+  BODY_TOO_LARGE: {
+    status: 413,
+    message: "Request body exceeds the {limit} limit",
+    hint: "Raise it with `security: { maxBodySize: '10mb' }`, or `maxBodySize: false` to disable the cap. It only bounds what is held in memory; uploaded files stream to `uploads` and have their own limits."
+  },
+  BODY_INVALID_MULTIPART: {
+    status: 400,
+    message: "A multipart/form-data body needs a boundary",
+    hint: "The client set `Content-Type: multipart/form-data` by hand. Let it be set automatically (send a FormData and omit the header) so the boundary is included."
+  },
+  UPLOAD_NOT_CONFIGURED: {
+    status: 500,
+    message: 'A file ("{name}") was uploaded but `uploads` is not configured',
+    hint: "Set `uploads: './uploads'` (or a Bucket) to store files, or `uploads: false` to ignore file fields on purpose."
+  },
+  UPLOAD_TOO_LARGE: {
+    status: 413,
+    message: 'File "{name}" is too large ({size} bytes, limit is {limit})',
+    hint: "Raise it with `uploads: { bucket, maxFileSize: '50mb' }`. `maxTotalSize` bounds one request's files together, and both default to 10mb and 100mb."
+  },
+  UPLOAD_TOO_MANY_FILES: {
+    status: 413,
+    message: "Too many files in one request (the limit is {limit})",
+    hint: "Raise it with `uploads: { bucket, maxFiles: 500 }`. It defaults to 100, which bounds how many objects one request can create."
+  },
+  UPLOAD_TOO_SMALL: {
     status: 400,
-    message: "Missing the OAuth 'code' in the request body"
+    message: 'File "{name}" is too small ({size} bytes, minimum is {limit})',
+    hint: "Set or lower `uploads: { bucket, minSize: '1kb' }`."
+  },
+  UPLOAD_TYPE_NOT_ALLOWED: {
+    status: 415,
+    message: 'File type not allowed for "{name}" (got "{type}", allowed: {allowed})',
+    hint: "`fileType` accepts extensions ('.jpg') and MIME types ('image/jpeg'). It is checked against the file's real format when the bytes identify one, so a mislabelled file is refused even if its name matches."
+  },
+  AUTH_INVALID_TOKEN: {
+    status: 401,
+    message: "Invalid Authorization token",
+    hint: "The bearer token did not verify: check the issuer and audience, and that the token has not expired."
   },
   AUTH_INVALID_HEADER: {
     status: 401,
-    message: "Invalid authorization header {type}, must send 'Bearer {TOKEN}' (with space)"
+    message: "Invalid authorization header {type}, must send 'Bearer {TOKEN}' (with space)",
+    hint: "The Authorization header must read `Bearer <token>`, with a space."
   },
-  AUTH_INVALID_STATE: { status: 403, message: "Invalid OAuth state" }
+  AUTH_INVALID_STATE: {
+    status: 403,
+    message: "Invalid OAuth state",
+    hint: "The OAuth state cookie was missing or did not match. It is signed with `secrets`, lives for 10 minutes, and needs the callback to be on the same origin as the login."
+  },
+  AUTH_ISSUER_UNREACHABLE: {
+    status: 502,
+    message: "Cannot reach the OIDC issuer at {url}",
+    hint: "The issuer's discovery document could not be fetched. Check the `issuer` URL (it must serve /.well-known/openid-configuration) and that this server has network access to it."
+  },
+  AUTH_NO_CODE: {
+    status: 400,
+    message: "Missing the OAuth 'code' in the callback URL",
+    hint: "The provider redirected back without a `code`. Check the callback URL registered with the provider matches /auth/callback/<name>."
+  }
 });
-var errors_default = ServerError_default;
+var TypedServerError = ServerError;
+var errors_default = TypedServerError;
 
-// src/polyfill.ts
+// src/boot/polyfill.ts
 globalThis.env = {};
 if (typeof globalThis.Netlify !== "undefined") {
   Object.assign(
@@ -68,17 +138,9 @@ if (typeof process !== "undefined") {
   Object.assign(globalThis.env, process.env);
 }
 
-// src/helpers/StatusError.ts
-var StatusError = class extends Error {
-  status;
-  constructor(msg, status2 = 500) {
-    super(msg);
-    this.status = status2;
-  }
-};
-
-// src/helpers/bucket.ts
+// src/body/bucket.ts
 import FileSystem from "bucket/fs";
+var isBucketFile = (value) => Boolean(value) && typeof value.stream === "function" && typeof value.bytes === "function" && typeof value.exists === "function" && typeof value.name === "string";
 function bucket(root) {
   if (!root) return null;
   if (typeof root === "string") return FileSystem(root);
@@ -88,135 +150,111 @@ function bucket(root) {
   );
 }
 
-// src/helpers/createId.ts
-var alphabet = "useandom26T198340PX75pxJACKVERYMINDBUSHWOLFGQZbfghjklqvwyzrict";
-var random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
-var cyrb53 = (str, seed = 0) => {
-  if (typeof str !== "string") str = String(str);
-  let h1 = 3735928559 ^ seed;
-  let h2 = 1103547991 ^ seed;
-  for (let i = 0, ch; i < str.length; i++) {
-    ch = str.charCodeAt(i);
-    h1 = Math.imul(h1 ^ ch, 2654435761);
-    h2 = Math.imul(h2 ^ ch, 1597334677);
-  }
-  h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507);
-  h1 ^= Math.imul(h2 ^ h2 >>> 13, 3266489909);
-  h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507);
-  h2 ^= Math.imul(h1 ^ h1 >>> 13, 3266489909);
-  return 4294967296 * (2097151 & h2) + (h1 >>> 0);
-};
-var hash = (str, size) => {
-  let chars = "";
-  let num = cyrb53(str);
-  for (let i = 0; i < size; i++) {
-    if (num < alphabet.length) num = cyrb53(str, i);
-    chars += alphabet[num % alphabet.length];
-    num = Math.floor(num / alphabet.length);
-  }
-  return chars;
-};
-var randomId = (size = 16) => {
-  let id = "";
-  const bytes = random(size);
-  while (size--) {
-    id += alphabet[bytes[size] & 61];
+// src/util/duration.ts
+var times = /(-?(?:\d+\.?\d*|\d*\.?\d+)(?:e[-+]?\d+)?)\s*([\p{L}]*)/iu;
+parse.millisecond = parse.ms = 1e-3;
+parse.second = parse.sec = parse.s = parse[""] = 1;
+parse.minute = parse.min = parse.m = parse.s * 60;
+parse.hour = parse.hr = parse.h = parse.m * 60;
+parse.day = parse.d = parse.h * 24;
+parse.week = parse.wk = parse.w = parse.d * 7;
+parse.year = parse.yr = parse.y = parse.d * 365.25;
+parse.month = parse.b = parse.y / 12;
+function parse(str) {
+  if (str === null || str === void 0) return null;
+  if (typeof str === "number") return str;
+  if (typeof str !== "string") {
+    throw new Error(`Not a string: ${str} (${typeof str})`);
   }
-  return id;
-};
-function createId(source, size = 16) {
-  if (source) return hash(source, size);
-  return randomId(size);
+  str = str.toLowerCase().replace(/[,_]/g, "");
+  const [_, value, units] = times.exec(str) || [];
+  if (!units) return null;
+  const unitValue = parse[units] || parse[units.replace(/s$/, "")];
+  if (!unitValue) return null;
+  const result = unitValue * parseFloat(value);
+  return Math.abs(Math.round(result * 1e3));
 }
 
-// src/helpers/upload.ts
-function resolveUploads(up) {
-  if (!up) return null;
-  if (typeof up === "object" && "bucket" in up) {
-    const { bucket: bucket2, maxSize, minSize, fileType: fileType2 } = up;
-    if (maxSize != null) parseBytes(maxSize);
-    if (minSize != null) parseBytes(minSize);
-    return { bucket: bucket(bucket2), maxSize, minSize, fileType: fileType2 };
+// src/http/etag.ts
+function etag(bytes) {
+  let h = 2166136261;
+  for (let i = 0; i < bytes.length; i++) {
+    h ^= bytes[i];
+    h = Math.imul(h, 16777619);
   }
-  return { bucket: bucket(up) };
-}
-function parseBytes(value) {
-  if (typeof value === "number") return value;
-  const units = {
-    b: 1,
-    kb: 1024,
-    mb: 1024 ** 2,
-    gb: 1024 ** 3
-  };
-  const match = value.toLowerCase().match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)$/);
-  if (!match) throw new Error(`Invalid size: "${value}"`);
-  return parseFloat(match[1]) * (units[match[2]] ?? 1);
+  return `"${bytes.length.toString(16)}-${(h >>> 0).toString(16)}"`;
 }
-function getExt(filename) {
-  const i = filename.lastIndexOf(".");
-  if (i <= 0) return ".bin";
-  return filename.slice(i).toLowerCase();
+
+// src/http/setIfAbsent.ts
+function setIfAbsent(headers2, key, value) {
+  if (value && !headers2.has(key)) headers2.set(key, value);
 }
-async function saveFileToBucket(originalName, data, bucket2, contentType) {
-  const ext = getExt(originalName);
-  const id = `${createId()}${ext}`;
-  const file2 = bucket2.file(id);
-  await file2.write(data, { type: contentType });
-  return {
-    name: originalName,
-    path: file2.path,
-    type: contentType,
-    size: data.length
-  };
+
+// src/http/cache.ts
+function resolveCache(value) {
+  if (value === false || value === 0) return "no-store";
+  if (typeof value === "number") return `public, max-age=${Math.round(value)}`;
+  if (typeof value !== "string") return null;
+  const ms = parse(value);
+  return ms === null ? null : `public, max-age=${Math.round(ms / 1e3)}`;
 }
-function validateFile(originalName, data, contentType, limits) {
-  const { maxSize, minSize, fileType: fileType2 } = limits;
-  if (maxSize !== void 0 && data.length > parseBytes(maxSize)) {
-    throw new Error(
-      `File "${originalName}" is too large (${data.length} bytes, limit is ${maxSize})`
-    );
+async function applyCache(out, ctx) {
+  if (ctx.method !== "get" && ctx.method !== "head" || out.status !== 200) {
+    return out;
   }
-  if (minSize !== void 0 && data.length < parseBytes(minSize)) {
-    throw new Error(
-      `File "${originalName}" is too small (${data.length} bytes, minimum is ${minSize})`
-    );
+  setIfAbsent(out.headers, "cache-control", resolveCache(ctx.options.cache));
+  if (out.headers.has("etag") || !out.headers.has("content-length")) return out;
+  const bytes = new Uint8Array(await out.arrayBuffer());
+  const tag = etag(bytes);
+  const headers2 = new Headers(out.headers);
+  headers2.set("etag", tag);
+  if (ctx.headers["if-none-match"] === tag) {
+    headers2.delete("content-length");
+    return new Response(null, { status: 304, headers: headers2 });
   }
-  if (fileType2 && fileType2.length > 0) {
-    const ext = getExt(originalName);
-    const mime = contentType.toLowerCase();
-    const allowed = fileType2.some(
-      (t) => t.toLowerCase() === mime || t.toLowerCase() === ext
-    );
-    if (!allowed) {
-      throw new Error(
-        `File type not allowed for "${originalName}" (got "${contentType}", allowed: ${fileType2.join(", ")})`
-      );
+  return new Response(bytes, { status: 200, headers: headers2 });
+}
+
+// src/http/createCookies.ts
+var EXPIRED = (/* @__PURE__ */ new Date(0)).toUTCString();
+function normalizeExpires(expires) {
+  if (expires === null || expires === void 0) return void 0;
+  if (expires === 0) return EXPIRED;
+  if (typeof expires === "string") {
+    if (/^[\d._]+\w+$/.test(expires)) {
+      return new Date(Date.now() + parse(expires)).toUTCString();
+    } else {
+      return expires;
     }
   }
+  if (typeof expires === "number") {
+    return new Date(Date.now() + expires).toUTCString();
+  }
+  if (expires instanceof Date) {
+    return expires.toUTCString();
+  }
+  return void 0;
 }
-
-// src/helpers/bodyLimit.ts
-var INF = Number.POSITIVE_INFINITY;
-var DEFAULT_MAX = "1mb";
-var resolveMax = (max) => max === false ? INF : parseBytes(max == null ? DEFAULT_MAX : max);
-var UNITS = ["b", "kb", "mb", "gb", "tb"];
-function human(bytes) {
-  if (!Number.isFinite(bytes) || bytes <= 0) return `${bytes}`;
-  const i = Math.min(
-    Math.floor(Math.log(bytes) / Math.log(1024)),
-    UNITS.length - 1
-  );
-  const value = bytes / 1024 ** i;
-  const rounded = i === 0 ? Math.round(value) : Math.round(value * 10) / 10;
-  return `${rounded}${UNITS[i]}`;
+var clearCookie = (name) => `${name}=; Path=/; Max-Age=0; HttpOnly`;
+var pendingClear = /* @__PURE__ */ new WeakMap();
+var clearOnSend = (ctx, name) => {
+  pendingClear.set(ctx, name);
+};
+var toClear = (ctx) => pendingClear.get(ctx);
+function createCookies(key, val) {
+  if (val.value === null) val.expires = EXPIRED;
+  const { value, path, expires, maxAge, httpOnly, secure, sameSite } = val;
+  let str = `${key}=${encodeURIComponent(value ?? "")};Path=${path || "/"}`;
+  if (typeof expires !== "undefined") str += `;Expires=${normalizeExpires(expires)}`;
+  if (typeof maxAge === "number") str += `;Max-Age=${maxAge}`;
+  if (httpOnly) str += ";HttpOnly";
+  if (secure) str += ";Secure";
+  if (sameSite) str += `;SameSite=${sameSite}`;
+  return str;
 }
-var tooLarge = (max) => new StatusError(
-  `Request body exceeds the ${human(max)} limit. Raise it with security: { maxBody: '10mb' }, or maxBody: false to disable it.`,
-  413
-);
 
-// src/helpers/mimes.ts
-var mimes_default = {
+// src/http/mimes.ts
+var mimes = {
   aac: "audio/aac",
   abw: "application/x-abiword",
   arc: "application/x-freearc",
@@ -236,6 +274,7 @@ var mimes_default = {
   eot: "application/vnd.ms-fontobject",
   epub: "application/epub+zip",
   gz: "application/gzip",
+  heic: "image/heic",
   gif: "image/gif",
   htm: "text/html; charset=utf-8",
   html: "text/html; charset=utf-8",
@@ -296,656 +335,562 @@ var mimes_default = {
   "3g2": "video/3gpp2",
   "7z": "application/x-7z-compressed"
 };
+var mimes_default = mimes;
+var mimeOf = (path) => {
+  const ext = path.split(".").pop()?.toLowerCase();
+  return ext ? mimes[ext] : void 0;
+};
 
-// src/helpers/parseBody.ts
-function getBoundary(header) {
-  if (!header) return null;
-  if (header.includes("multipart/form-data") && !header.includes("boundary=")) {
-    console.error("Do not set the `Content-Type` manually for FormData");
+// src/http/disposition.ts
+var encodeExt = (name) => encodeURIComponent(name).replace(
+  /['()*]/g,
+  (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`
+);
+function disposition(name) {
+  if (!name) return "attachment";
+  const clean2 = name.replace(/[\r\n]/g, "").split(/[\\/]/).pop() || "";
+  if (!clean2) return "attachment";
+  const ascii2 = clean2.replace(/[^\x20-\x7e]/g, "?");
+  const value = `attachment; filename="${ascii2.replace(/["\\]/g, "\\$&")}"`;
+  if (clean2 === ascii2) return value;
+  return `${value}; filename*=UTF-8''${encodeExt(clean2)}`;
+}
+
+// src/http/fileType.ts
+function fileType(file2) {
+  return file2.type || mimeOf(file2.path || file2.name || "");
+}
+
+// src/util/bytes.ts
+var UNITS = ["b", "kb", "mb", "gb", "tb"];
+function parseBytes(value) {
+  if (typeof value === "number") return value;
+  const units = {
+    b: 1,
+    kb: 1024,
+    mb: 1024 ** 2,
+    gb: 1024 ** 3,
+    tb: 1024 ** 4
+  };
+  const match = value.toLowerCase().match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb|tb)$/);
+  if (!match) throw new Error(`Invalid size: "${value}"`);
+  return parseFloat(match[1]) * (units[match[2]] ?? 1);
+}
+function formatBytes(bytes) {
+  if (!Number.isFinite(bytes) || bytes <= 0) return "0b";
+  const i = Math.min(
+    Math.floor(Math.log(bytes) / Math.log(1024)),
+    UNITS.length - 1
+  );
+  const value = bytes / 1024 ** i;
+  const rounded = i === 0 ? Math.round(value) : Math.round(value * 10) / 10;
+  return `${rounded}${UNITS[i]}`;
+}
+
+// src/body/bodyLimit.ts
+var INF = Number.POSITIVE_INFINITY;
+var DEFAULT_MAX = "1mb";
+var resolveMax = (max) => max === false ? INF : parseBytes(max == null ? DEFAULT_MAX : max);
+var tooLarge = (max) => errors_default.BODY_TOO_LARGE({ limit: formatBytes(max) });
+
+// src/http/security.ts
+function resolveSecurity(security) {
+  const off = security === false;
+  const o = security && typeof security === "object" ? security : {};
+  const val = (v, def) => v === false ? null : v === true || v == null ? def : v;
+  const map2 = off ? {} : {
+    "x-frame-options": val(o.frameguard, "SAMEORIGIN"),
+    "x-content-type-options": o.noSniff === false ? null : "nosniff",
+    "referrer-policy": val(
+      o.referrerPolicy,
+      "strict-origin-when-cross-origin"
+    ),
+    "x-xss-protection": o.xssProtection === false ? null : "0",
+    // Opt-in: default off
+    "content-security-policy": val(o.csp, null),
+    "cross-origin-opener-policy": val(o.coop, null),
+    "cross-origin-resource-policy": val(o.corp, null),
+    "permissions-policy": o.permissionsPolicy ?? null
+  };
+  const headers2 = {};
+  for (const key in map2) {
+    const value = map2[key];
+    if (value) headers2[key] = value;
   }
-  const items = header.split(";");
-  for (const item of items) {
-    const trimmedItem = item.trim();
-    if (trimmedItem.startsWith("boundary=")) {
-      return trimmedItem.split("=")[1].trim();
+  return {
+    trustProxy: o.trustProxy ?? true,
+    traversalProtection: off ? false : o.traversalProtection !== false,
+    // Cap on the bytes buffered per request (see bodyLimit). `false` (or
+    // turning security off entirely) resolves to Infinity, meaning no limit.
+    maxBodySize: off ? INF : resolveMax(o.maxBodySize),
+    headers: headers2,
+    hsts: off ? null : val(o.hsts, "max-age=15552000; includeSubDomains")
+  };
+}
+var CLIMBS = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
+var ABSOLUTE = /^(?:[\\/]|[a-zA-Z]:)/;
+function checkTraversal(params, ctx) {
+  if (!ctx.options.security?.traversalProtection) return;
+  for (const param in params) {
+    const value = params[param];
+    if (typeof value !== "string") continue;
+    if (CLIMBS.test(value) || ABSOLUTE.test(value)) {
+      throw errors_default.PATH_TRAVERSAL({ param, value });
     }
   }
-  return null;
-}
-function getMatching(string, regex) {
-  const matches = string.match(regex);
-  return matches?.[1] ?? "";
 }
-function isProbablyText(buffer) {
-  for (let i = 0; i < Math.min(buffer.length, 512); i++) {
-    const byte = buffer[i];
-    if (byte === 0) return false;
-    if (byte < 7 || byte > 13 && byte < 32) return false;
+function applySecurity(res, ctx) {
+  const security = ctx.options.security;
+  if (!security) return;
+  for (const key in security.headers) {
+    setIfAbsent(res.headers, key, security.headers[key]);
+  }
+  if (ctx.platform.production) {
+    setIfAbsent(res.headers, "strict-transport-security", security.hsts);
   }
-  return true;
-}
-var extByMime = {};
-for (const ext in mimes_default) extByMime[mimes_default[ext]] = ext;
-function extFromType(type2) {
-  const base = (type2 || "").split(";")[0].trim().toLowerCase();
-  const ext = extByMime[base];
-  if (ext) return `.${ext}`;
-  const sub = base.split("/")[1];
-  return sub && /^[a-z0-9]+$/.test(sub) ? `.${sub}` : ".bin";
 }
-var asIterable = (s) => s;
-function toStream(input) {
-  if (input instanceof ReadableStream) return input;
+
+// src/util/isReadableStream.ts
+function isReadableStream(obj) {
+  return obj !== null && typeof obj === "object" && typeof obj.pipe === "function" && typeof obj.read === "function" && typeof obj.on === "function";
+}
+
+// src/util/iteratorToReadable.ts
+var enc = new TextEncoder();
+function iteratorToReadable(iterable) {
+  const iterator = iterable[Symbol.asyncIterator]?.() ?? iterable[Symbol.iterator]();
+  let cancelled = false;
   return new ReadableStream({
-    start(controller) {
-      controller.enqueue(input);
-      controller.close();
+    async pull(controller) {
+      try {
+        const { value, done } = await iterator.next();
+        if (cancelled) return;
+        if (done) {
+          controller.close();
+          return;
+        }
+        controller.enqueue(
+          value instanceof Uint8Array ? value : enc.encode(typeof value === "string" ? value : String(value))
+        );
+      } catch (err) {
+        controller.error(err);
+      }
+    },
+    async cancel(reason) {
+      cancelled = true;
+      await iterator.return?.(reason);
     }
   });
 }
-async function toBuffer(input, max = INF) {
-  if (!(input instanceof ReadableStream)) {
-    if (input.length > max) throw tooLarge(max);
-    return input;
-  }
-  const chunks = [];
-  let total = 0;
-  for await (const chunk of asIterable(input)) {
-    total += chunk.byteLength;
-    if (total > max) throw tooLarge(max);
-    chunks.push(Buffer.from(chunk));
+
+// src/util/toWeb.ts
+function toWeb(nodeStream) {
+  if (typeof ReadableStream === "undefined") {
+    throw new Error("Environment not supported, please report this as a bug");
   }
-  return Buffer.concat(chunks);
+  return new ReadableStream({
+    start(controller) {
+      nodeStream.on("data", (chunk) => controller.enqueue(chunk));
+      nodeStream.on("end", () => controller.close());
+      nodeStream.on("error", (err) => controller.error(err));
+    },
+    cancel() {
+      nodeStream.destroy();
+    }
+  });
 }
-function parseUrlEncoded(text) {
-  const out = {};
-  for (const [key, value] of new URLSearchParams(text)) {
-    const existing = out[key];
-    if (existing === void 0) out[key] = value;
-    else if (Array.isArray(existing)) existing.push(value);
-    else out[key] = [existing, value];
-  }
-  return out;
+
+// src/pipeline/serialize.ts
+var TAG = /^\s*<[a-zA-Z!/]/;
+var isHtml = (body) => TAG.test(body);
+function fill(headers2, type2, length) {
+  setIfAbsent(headers2, "content-type", type2);
+  if (length != null) setIfAbsent(headers2, "content-length", String(length));
+}
+function serialize(body, headers2) {
+  if (body instanceof Blob) {
+    fill(headers2, body.type);
+    return body;
+  }
+  if (typeof body === "string") {
+    fill(headers2, isHtml(body) ? mimes_default.html : mimes_default.text, Buffer.byteLength(body));
+    return body;
+  }
+  if (body instanceof Uint8Array) {
+    fill(headers2, null, body.length);
+    return body;
+  }
+  if (typeof body?.getReader === "function") return body;
+  if (isReadableStream(body)) return toWeb(body);
+  if (body?.[Symbol.asyncIterator] || !Array.isArray(body) && body?.[Symbol.iterator]) {
+    return iteratorToReadable(body);
+  }
+  const payload = JSON.stringify(body);
+  fill(headers2, "application/json", Buffer.byteLength(payload));
+  return payload;
 }
-function addField(body, name, value) {
-  if (body[name] === void 0) {
-    body[name] = value;
-    return;
+
+// src/reply.ts
+var EXPIRED2 = (/* @__PURE__ */ new Date(0)).toUTCString();
+var Reply = class _Reply {
+  res;
+  constructor() {
+    this.res = {
+      headers: new Headers()
+    };
   }
-  if (!Array.isArray(body[name])) body[name] = [body[name]];
-  body[name].push(value);
-}
-function startPart(headerStr, bucket2, limits) {
-  const name = getMatching(headerStr, /name="(.+?)"/).trim().replace(/\[\]$/, "");
-  if (!name) return { kind: "skip" };
-  const filename = getMatching(headerStr, /filename="(.+?)"/).trim();
-  if (!filename) return { kind: "text", name, chunks: [] };
-  const type2 = getMatching(headerStr, /Content-Type:\s*([^\r\n]+)/i).trim() || "application/octet-stream";
-  if (!bucket2) return { kind: "drop" };
-  if (limits) {
-    return { kind: "validated", name, filename, type: type2, bucket: bucket2, limits, chunks: [] };
+  status(status2) {
+    this.res.status = status2;
+    return this;
   }
-  const id = `${createId()}${getExt(filename)}`;
-  let controller;
-  const readable = new ReadableStream({
-    start(c) {
-      controller = c;
-    }
-  });
-  const file2 = bucket2.file(id);
-  return {
-    kind: "file",
-    name,
-    filename,
-    type: type2,
-    id,
-    controller,
-    file: file2,
-    write: file2.write(readable, { type: type2 }),
-    size: 0
-  };
-}
-function feedPart(part, data) {
-  if (data.length === 0) return;
-  if (part.kind === "text" || part.kind === "validated") part.chunks.push(data);
-  else if (part.kind === "file") {
-    part.controller.enqueue(data);
-    part.size += data.length;
+  type(type2) {
+    if (!type2) return this;
+    type2 = mimes_default[type2.replace(/^\./, "")] || type2;
+    this.res.headers.set("content-type", type2);
+    return this;
   }
-}
-async function endPart(part, body) {
-  if (part.kind === "text") {
-    const buf = Buffer.concat(part.chunks);
-    const value = isProbablyText(buf) ? buf.toString("utf-8").trim() : buf;
-    addField(body, part.name, value);
-  } else if (part.kind === "validated") {
-    const buf = Buffer.concat(part.chunks);
-    validateFile(part.filename, buf, part.type, part.limits);
-    const ref = await saveFileToBucket(part.filename, buf, part.bucket, part.type);
-    addField(body, part.name, ref);
-  } else if (part.kind === "file") {
-    part.controller.close();
-    await part.write;
-    addField(body, part.name, {
-      name: part.filename,
-      path: part.file.path,
-      type: part.type,
-      size: part.size
-    });
+  download(name) {
+    const ext = name?.split(".").pop();
+    if (ext && !this.res.headers.get("content-type")) this.type(ext);
+    return this.headers("content-disposition", disposition(name));
   }
-}
-var BREAK = Buffer.from("\r\n\r\n");
-async function parseMultipart(stream, boundary, bucket2, limits, max = INF) {
-  const delim = Buffer.from(`\r
---${boundary}`);
-  const body = {};
-  let buf = Buffer.from("\r\n");
-  let state = "boundary";
-  let part = null;
-  let textBytes = 0;
-  const feed = (p, data) => {
-    if (p.kind === "text") {
-      textBytes += data.length;
-      if (textBytes > max) throw tooLarge(max);
+  headers(key, value) {
+    if (typeof key !== "string") {
+      Object.entries(key).map(([key2, value2]) => this.headers(key2, value2));
+      return this;
     }
-    feedPart(p, data);
-  };
-  for await (const chunk of asIterable(stream)) {
-    buf = Buffer.concat([buf, Buffer.from(chunk)]);
-    let advanced = true;
-    while (advanced) {
-      advanced = false;
-      if (state === "boundary") {
-        const i = buf.indexOf(delim);
-        if (i === -1) {
-          if (buf.length >= delim.length) {
-            buf = buf.subarray(buf.length - delim.length + 1);
-          }
-          break;
-        }
-        if (buf.length < i + delim.length + 2) break;
-        const after = i + delim.length;
-        if (buf[after] === 45 && buf[after + 1] === 45) return body;
-        buf = buf.subarray(after + 2);
-        state = "headers";
-        advanced = true;
-      } else if (state === "headers") {
-        const i = buf.indexOf(BREAK);
-        if (i === -1) break;
-        part = startPart(buf.subarray(0, i).toString("utf-8"), bucket2, limits);
-        buf = buf.subarray(i + BREAK.length);
-        state = "body";
-        advanced = true;
-      } else {
-        const i = buf.indexOf(delim);
-        if (i === -1) {
-          const safe = buf.length - (delim.length - 1);
-          if (safe > 0 && part) {
-            feed(part, buf.subarray(0, safe));
-            buf = buf.subarray(safe);
-          }
-          break;
-        }
-        if (part) {
-          feed(part, buf.subarray(0, i));
-          await endPart(part, body);
-          part = null;
-        }
-        buf = buf.subarray(i);
-        state = "boundary";
-        advanced = true;
-      }
+    if (Array.isArray(value)) {
+      this.res.headers.delete(key);
+      for (const val of value) this.res.headers.append(key, val);
+      return this;
     }
-  }
-  if (part) await endPart(part, body);
-  return body;
-}
-async function streamToBucket(stream, type2, bucket2) {
-  const id = `${createId()}${extFromType(type2)}`;
-  const file2 = bucket2.file(id);
-  let size = 0;
-  let controller;
-  const readable = new ReadableStream({
-    start(c) {
-      controller = c;
+    if (key.toLowerCase() === "set-cookie") {
+      this.res.headers.append(key, value);
+    } else {
+      this.res.headers.set(key, value);
     }
-  });
-  const write = file2.write(readable, { type: type2 });
-  for await (const chunk of asIterable(stream)) {
-    controller.enqueue(chunk);
-    size += chunk.byteLength;
+    return this;
   }
-  controller.close();
-  await write;
-  if (!size) return void 0;
-  return { name: id, path: file2.path, type: type2, size };
-}
-async function parseBody(input, contentType, dest, max = INF) {
-  const type2 = Array.isArray(contentType) ? contentType[0] : contentType;
-  let bucket2;
-  let limits;
-  if (dest && "bucket" in dest) {
-    bucket2 = dest.bucket;
-    const { maxSize, minSize, fileType: fileType2 } = dest;
-    if (maxSize != null || minSize != null || fileType2 != null) {
-      limits = { maxSize, minSize, fileType: fileType2 };
+  cache(value) {
+    const resolved = resolveCache(value);
+    if (resolved) this.res.headers.set("cache-control", resolved);
+    return this;
+  }
+  cookies(key, value) {
+    if (typeof key === "object") {
+      Object.entries(key).map(([key2, value2]) => this.cookies(key2, value2));
+      return this;
     }
-  } else {
-    bucket2 = dest;
+    if (Array.isArray(value)) {
+      Object.values(value).map((val) => this.cookies(key, val));
+      return this;
+    }
+    if (value === null) return this.cookies(key, { expires: EXPIRED2 });
+    if (typeof value !== "object") return this.cookies(key, { value });
+    return this.headers("set-cookie", createCookies(key, value));
   }
-  const boundary = type2 && /multipart\/form-data/i.test(type2) ? getBoundary(type2) : null;
-  if (boundary) {
-    return parseMultipart(toStream(input), boundary, bucket2, limits, max);
+  json(body) {
+    if (body === void 0) body = null;
+    setIfAbsent(this.res.headers, "content-type", "application/json");
+    return this.send(JSON.stringify(body));
   }
-  if (!type2 || /^text\//i.test(type2)) {
-    const buf = await toBuffer(input, max);
-    return buf.length ? buf.toString("utf-8") : void 0;
+  redirect(path) {
+    this.headers("location", path);
+    if (this.res.status == null) this.res.status = 302;
+    return this.send();
   }
-  if (/application\/json/i.test(type2)) {
-    const buf = await toBuffer(input, max);
-    return buf.length ? JSON.parse(buf.toString("utf-8")) : void 0;
+  async file(path) {
+    if (typeof path !== "string") {
+      if (!await path.exists()) return new Response(null, { status: 404 });
+      return this.type(fileType(path)).send(path.stream());
+    }
+    if (CLIMBS.test(path)) {
+      return new Response(null, { status: 404 });
+    }
+    try {
+      const fs = await import("fs");
+      const ext = path.split(".").pop();
+      await fs.promises.access(path);
+      const stream = fs.createReadStream(path);
+      return this.type(ext).send(stream);
+    } catch (error) {
+      if (error.code === "ENOENT" || error.code === "EISDIR") {
+        return new Response(null, { status: 404 });
+      }
+      throw error;
+    }
   }
-  if (/application\/x-www-form-urlencoded/i.test(type2)) {
-    const buf = await toBuffer(input, max);
-    return buf.length ? parseUrlEncoded(buf.toString("utf-8")) : void 0;
-  }
-  if (!bucket2) {
-    const buf = await toBuffer(input, max);
-    return buf.length ? buf : void 0;
+  // Accepts everything a route can return, so `send(x)` and `return x` agree.
+  // Async because a bucket file has to be read before its status is known;
+  // routes await whatever they return, so this is invisible in normal use.
+  async send(input = "") {
+    const { status: status2 = 200, headers: headers2 } = this.res;
+    let body = input;
+    if (status2 === 101 || status2 === 204 || status2 === 205 || status2 === 304) {
+      return new Response(null, { status: status2, headers: headers2 });
+    }
+    if (body === null) body = "";
+    if (typeof body?.then === "function") body = await body;
+    if (typeof body === "function") body = body();
+    if (typeof body?.then === "function") {
+      throw new Error(
+        "Cannot render an async component: components must be synchronous. Await the data before rendering and pass it in as props."
+      );
+    }
+    if (body instanceof _Reply) body = await body.send();
+    if (body instanceof Response) {
+      const merged = new Headers(body.headers);
+      for (const [key, value] of headers2) {
+        if (key === "set-cookie") continue;
+        merged.set(key, value);
+      }
+      for (const cookie of headers2.getSetCookie?.() ?? []) {
+        merged.append("set-cookie", cookie);
+      }
+      if (body.url && /^(br|gzip)$/.test(merged.get("content-encoding") || "")) {
+        merged.delete("content-encoding");
+      }
+      return new Response(body.body, {
+        status: this.res.status ?? body.status,
+        headers: merged
+      });
+    }
+    if (isBucketFile(body)) {
+      return this.file(body);
+    }
+    return new Response(serialize(body, headers2), { status: status2, headers: headers2 });
   }
-  if (limits) {
-    const buf = await toBuffer(input);
-    if (!buf.length) return void 0;
-    const name = `upload${extFromType(type2)}`;
-    validateFile(name, buf, type2, limits);
-    return saveFileToBucket(name, buf, bucket2, type2);
+};
+var r = () => new Reply();
+var status = (...args) => r().status(...args);
+var headers = (...args) => r().headers(...args);
+var type = (...args) => r().type(...args);
+var cache = (...args) => r().cache(...args);
+var download = (...args) => r().download(...args);
+var cookies = (...args) => r().cookies(...args);
+var send = (...args) => r().send(...args);
+var json = (...args) => r().json(...args);
+var file = (...args) => r().file(...args);
+var redirect = (...args) => r().redirect(...args);
+
+// src/body/sniff.ts
+var ascii = (text) => [...text].map((char) => char.charCodeAt(0));
+var SIGNATURES = [
+  { type: "image/png", magic: [137, 80, 78, 71, 13, 10, 26, 10] },
+  { type: "image/jpeg", magic: [255, 216, 255] },
+  { type: "image/gif", magic: ascii("GIF87a") },
+  { type: "image/gif", magic: ascii("GIF89a") },
+  // RIFF containers: the format is at byte 8, so the whole thing is one match
+  { type: "image/webp", magic: [...ascii("RIFF"), null, null, null, null, ...ascii("WEBP")] },
+  { type: "audio/wav", magic: [...ascii("RIFF"), null, null, null, null, ...ascii("WAVE")] },
+  { type: "image/bmp", magic: ascii("BM") },
+  { type: "image/tiff", magic: [73, 73, 42, 0] },
+  { type: "image/tiff", magic: [77, 77, 0, 42] },
+  { type: "image/vnd.microsoft.icon", magic: [0, 0, 1, 0] },
+  { type: "image/avif", magic: ascii("ftypavif"), offset: 4 },
+  { type: "image/heic", magic: ascii("ftypheic"), offset: 4 },
+  { type: "application/pdf", magic: ascii("%PDF-") },
+  { type: "application/zip", magic: [80, 75, 3, 4] },
+  { type: "application/gzip", magic: [31, 139] },
+  { type: "video/mp4", magic: ascii("ftyp"), offset: 4 },
+  { type: "video/webm", magic: [26, 69, 223, 163] },
+  { type: "audio/ogg", magic: ascii("OggS") },
+  { type: "audio/mpeg", magic: ascii("ID3") }
+];
+var HEAD_SIZE = 32;
+var matches = (head, { magic, offset = 0 }) => {
+  if (head.length < offset + magic.length) return false;
+  return magic.every((byte, i) => byte === null || head[offset + i] === byte);
+};
+function sniff(head) {
+  for (const signature of SIGNATURES) {
+    if (matches(head, signature)) return signature.type;
   }
-  return streamToBucket(toStream(input), type2, bucket2);
+  return null;
+}
+var KNOWN = new Set(SIGNATURES.map((s) => s.type));
+var isSniffable = (type2) => KNOWN.has((type2 || "").split(";")[0].trim().toLowerCase());
+var CONTAINED = {
+  "application/zip": (type2) => type2.endsWith("+zip") || type2.startsWith("application/vnd.openxmlformats-officedocument.") || type2.startsWith("application/vnd.oasis.opendocument.") || type2 === "application/java-archive" || type2 === "application/vnd.android.package-archive"
+};
+function resolveType(sniffed, declared) {
+  if (!sniffed) return declared;
+  const inside = CONTAINED[sniffed];
+  const claim = (declared || "").split(";")[0].trim().toLowerCase();
+  return inside?.(claim) ? claim : sniffed;
 }
 
-// src/helpers/body.ts
-var sources = /* @__PURE__ */ new WeakMap();
-function setBodySource(ctx, source) {
-  sources.set(ctx, source);
+// src/body/upload.ts
+var DEFAULT_FILE_SIZE = "10mb";
+var DEFAULT_TOTAL_SIZE = "100mb";
+var DEFAULT_FILES = 100;
+function resolveUploads(up) {
+  if (up === false) return false;
+  if (!up) return null;
+  if (typeof up === "object" && "bucket" in up) {
+    const { bucket: bucket2, maxFileSize, maxTotalSize, maxFiles, minSize, fileType: fileType2 } = up;
+    if (maxFileSize != null) parseBytes(maxFileSize);
+    if (maxTotalSize != null) parseBytes(maxTotalSize);
+    if (minSize != null) parseBytes(minSize);
+    return {
+      bucket: bucket(bucket2),
+      maxFileSize: maxFileSize ?? DEFAULT_FILE_SIZE,
+      maxTotalSize: maxTotalSize ?? DEFAULT_TOTAL_SIZE,
+      maxFiles: maxFiles ?? DEFAULT_FILES,
+      minSize,
+      fileType: fileType2
+    };
+  }
+  return {
+    bucket: bucket(up),
+    maxFileSize: DEFAULT_FILE_SIZE,
+    maxTotalSize: DEFAULT_TOTAL_SIZE,
+    maxFiles: DEFAULT_FILES
+  };
 }
-async function resolveBody(ctx, mode = "parse", max = resolveMax(void 0)) {
-  const source = sources.get(ctx);
-  if (!source) return void 0;
-  const contentType = String(ctx.headers["content-type"] || "");
-  const isMultipart = /multipart\/form-data/i.test(contentType);
-  const declared = Number(ctx.headers["content-length"]);
-  const trustDeclared = !isMultipart && !ctx.options.uploads;
-  if (max !== INF && trustDeclared && declared > max) throw tooLarge(max);
-  if (mode === "stream") return source.getStream();
-  if (mode === "raw") {
-    const raw = await source.getBuffer();
-    if (raw.length > max) throw tooLarge(max);
-    if (!raw.length) return void 0;
-    if (!ctx.headers["content-length"]) {
-      ctx.headers["content-length"] = String(raw.length);
-    }
-    return raw;
+function getExt(filename) {
+  const i = filename.lastIndexOf(".");
+  if (i <= 0) return ".bin";
+  return filename.slice(i).toLowerCase();
+}
+function validateFile(originalName, contentType, limits, sniffed) {
+  const { fileType: fileType2 } = limits;
+  if (!fileType2 || fileType2.length === 0) return;
+  if (sniffed === null && isSniffable(contentType)) {
+    throw errors_default.UPLOAD_TYPE_NOT_ALLOWED({
+      name: originalName,
+      type: contentType,
+      allowed: fileType2
+    });
   }
-  const stream = source.getStream();
-  if (!stream) return void 0;
-  let size = 0;
-  const counted = stream.pipeThrough(
-    new TransformStream({
-      transform(chunk, controller) {
-        size += chunk.byteLength;
-        controller.enqueue(chunk);
-      }
-    })
-  );
-  const parsed = await parseBody(
-    counted,
-    ctx.headers["content-type"],
-    ctx.options.uploads,
-    max
+  const ext = getExt(originalName);
+  const mime = contentType.toLowerCase();
+  const allowed = fileType2.some(
+    (t) => t.toLowerCase() === mime || t.toLowerCase() === ext
   );
-  if (size && !ctx.headers["content-length"]) {
-    ctx.headers["content-length"] = String(size);
+  if (!allowed) {
+    throw errors_default.UPLOAD_TYPE_NOT_ALLOWED({
+      name: originalName,
+      type: contentType,
+      allowed: fileType2
+    });
   }
-  return parsed;
 }
 
-// src/helpers/createCookies.ts
-var EXPIRED = (/* @__PURE__ */ new Date(0)).toUTCString();
-var times = /(-?(?:\d+\.?\d*|\d*\.?\d+)(?:e[-+]?\d+)?)\s*([\p{L}]*)/iu;
-parse.millisecond = parse.ms = 1e-3;
-parse.second = parse.sec = parse.s = parse[""] = 1;
-parse.minute = parse.min = parse.m = parse.s * 60;
-parse.hour = parse.hr = parse.h = parse.m * 60;
-parse.day = parse.d = parse.h * 24;
-parse.week = parse.wk = parse.w = parse.d * 7;
-parse.year = parse.yr = parse.y = parse.d * 365.25;
-parse.month = parse.b = parse.y / 12;
-function parse(str) {
-  if (str === null || str === void 0) return null;
-  if (typeof str === "number") return str;
-  if (typeof str !== "string") {
-    throw new Error(`Not a string: ${str} (${typeof str})`);
+// src/router.ts
+function checkParserConflict(options, globalParser) {
+  const parser = options.parser ?? globalParser ?? "parse";
+  if (options.body && parser !== "parse") {
+    throw new Error(
+      `A \`parser: '${parser}'\` route never parses the body, so its \`body\` schema cannot run. Remove one, or set \`parser: 'parse'\` on the route.`
+    );
   }
-  str = str.toLowerCase().replace(/[,_]/g, "");
-  const [_, value, units] = times.exec(str) || [];
-  if (!units) return null;
-  const unitValue = parse[units] || parse[units.replace(/s$/, "")];
-  if (!unitValue) return null;
-  const result = unitValue * parseFloat(value);
-  return Math.abs(Math.round(result * 1e3));
 }
-function normalizeExpires(expires) {
-  if (expires === null || expires === void 0) return void 0;
-  if (expires === 0) return EXPIRED;
-  if (typeof expires === "string") {
-    if (/^[\d._]+\w+$/.test(expires)) {
-      return new Date(Date.now() + parse(expires)).toUTCString();
-    } else {
-      return expires;
+var Router = class _Router {
+  // Assigned by the Server subclass; a bare router has none. Declared here so
+  // route registration can check options against the global config.
+  settings;
+  // Cross-cutting middleware added with .use(); they run on every request
+  middleware = [];
+  // Routes per method, each carrying its own (already-flattened) chain of fns
+  handlers = {
+    socket: [],
+    get: [],
+    head: [],
+    post: [],
+    put: [],
+    patch: [],
+    delete: [],
+    options: []
+  };
+  // For the router we can just return itself since it's not the final export,
+  // but then on the root it'll return some fancy wrappers
+  self() {
+    return this;
+  }
+  // Registers one route: bakes the current middleware + the route's own
+  // functions into a single flat `fns` list. A plain options object may sit
+  // between the path and the handlers, and it's pulled out here.
+  handle(method, pathOrFn, ...rest) {
+    let path = "*";
+    if (typeof pathOrFn === "string") {
+      path = pathOrFn;
+    } else if (pathOrFn != null) {
+      rest.unshift(pathOrFn);
+    }
+    let options = {};
+    if (rest[0] != null && typeof rest[0] !== "function") {
+      options = rest.shift();
     }
+    checkParserConflict(options, this.settings?.parser);
+    if (options.uploads !== void 0) {
+      options.uploads = resolveUploads(options.uploads);
+    }
+    const base = method === "socket" ? [] : this.middleware;
+    const fns = [...base, ...rest].filter((fn) => fn != null);
+    this.handlers[method].push({ path, options, fns });
+    return this.self();
   }
-  if (typeof expires === "number") {
-    return new Date(Date.now() + expires).toUTCString();
+  socket(pathOrMid, optionsOrMid, ...middleware) {
+    return this.handle("socket", pathOrMid, optionsOrMid, ...middleware);
   }
-  if (expires instanceof Date) {
-    return expires.toUTCString();
+  get(pathOrMid, optionsOrMid, ...middleware) {
+    return this.handle("get", pathOrMid, optionsOrMid, ...middleware);
   }
-  return void 0;
-}
-function createCookies(key, val) {
-  if (val.value === null) val.expires = EXPIRED;
-  const { value, path, expires, maxAge, httpOnly, secure, sameSite } = val;
-  let str = `${key}=${encodeURIComponent(value ?? "")};Path=${path || "/"}`;
-  if (typeof expires !== "undefined") str += `;Expires=${normalizeExpires(expires)}`;
-  if (typeof maxAge === "number") str += `;Max-Age=${maxAge}`;
-  if (httpOnly) str += ";HttpOnly";
-  if (secure) str += ";Secure";
-  if (sameSite) str += `;SameSite=${sameSite}`;
-  return str;
-}
-
-// src/helpers/etag.ts
-function etag(bytes) {
-  let h = 2166136261;
-  for (let i = 0; i < bytes.length; i++) {
-    h ^= bytes[i];
-    h = Math.imul(h, 16777619);
+  head(pathOrMid, optionsOrMid, ...middleware) {
+    return this.handle("head", pathOrMid, optionsOrMid, ...middleware);
   }
-  return `"${bytes.length.toString(16)}-${(h >>> 0).toString(16)}"`;
-}
-
-// src/helpers/cache.ts
-function resolveCache(value) {
-  if (value === false || value === 0) return "no-store";
-  if (typeof value === "number") return `public, max-age=${Math.round(value)}`;
-  if (typeof value !== "string") return null;
-  const ms = parse(value);
-  return ms === null ? null : `public, max-age=${Math.round(ms / 1e3)}`;
-}
-async function applyCache(out, ctx) {
-  if (ctx.method !== "get" || out.status !== 200) return out;
-  if (!out.headers.has("cache-control")) {
-    const value = resolveCache(ctx.options.cache);
-    if (value) out.headers.set("cache-control", value);
+  post(pathOrMid, optionsOrMid, ...middleware) {
+    return this.handle("post", pathOrMid, optionsOrMid, ...middleware);
   }
-  if (out.headers.has("etag") || !out.headers.has("content-length")) return out;
-  const bytes = new Uint8Array(await out.arrayBuffer());
-  const tag = etag(bytes);
-  const headers2 = new Headers(out.headers);
-  headers2.set("etag", tag);
-  if (ctx.headers["if-none-match"] === tag) {
-    headers2.delete("content-length");
-    return new Response(null, { status: 304, headers: headers2 });
+  put(pathOrMid, optionsOrMid, ...middleware) {
+    return this.handle("put", pathOrMid, optionsOrMid, ...middleware);
   }
-  return new Response(bytes, { status: 200, headers: headers2 });
-}
-
-// src/helpers/clientIp.ts
-var first = (v) => (Array.isArray(v) ? v[0] : v) || "";
-var normalize = (ip) => ip.replace(/^::ffff:/, "");
-function clientIp(headers2, opts = {}) {
-  const { remoteAddress = "", trustProxy = false } = opts;
-  const cf = first(headers2["cf-connecting-ip"]);
-  if (cf) return normalize(cf);
-  const nf = first(headers2["x-nf-client-connection-ip"]);
-  if (nf) return normalize(nf);
-  if (trustProxy) {
-    const xff = first(headers2["x-forwarded-for"]);
-    if (xff) return normalize(xff.split(",")[0].trim());
-    const real = first(headers2["x-real-ip"]);
-    if (real) return normalize(real);
-  }
-  return normalize(remoteAddress);
-}
-
-// src/helpers/disposition.ts
-var encodeExt = (name) => encodeURIComponent(name).replace(
-  /['()*]/g,
-  (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`
-);
-function disposition(name) {
-  if (!name) return "attachment";
-  const clean2 = name.replace(/[\r\n]/g, "").split(/[\\/]/).pop() || "";
-  if (!clean2) return "attachment";
-  const ascii = clean2.replace(/[^\x20-\x7e]/g, "?");
-  const value = `attachment; filename="${ascii.replace(/["\\]/g, "\\$&")}"`;
-  if (clean2 === ascii) return value;
-  return `${value}; filename*=UTF-8''${encodeExt(clean2)}`;
-}
-
-// src/helpers/fileType.ts
-function fileType(file2) {
-  if (file2.type) return file2.type;
-  const name = file2.path || file2.name || "";
-  const ext = name.split(".").pop()?.toLowerCase();
-  return ext ? mimes_default[ext] : void 0;
-}
-
-// src/helpers/isHtml.ts
-var TAG = /^\s*<[a-zA-Z!/]/;
-function isHtml(body) {
-  return TAG.test(body);
-}
-
-// src/helpers/isReadableStream.ts
-function isReadableStream(obj) {
-  return obj !== null && typeof obj === "object" && typeof obj.pipe === "function" && typeof obj.read === "function" && typeof obj.on === "function";
-}
-
-// src/reply.ts
-var EXPIRED2 = (/* @__PURE__ */ new Date(0)).toUTCString();
-var Reply = class _Reply {
-  res;
-  constructor() {
-    this.res = {
-      headers: new Headers()
-    };
-  }
-  status(status2) {
-    this.res.status = status2;
-    return this;
-  }
-  type(type2) {
-    if (!type2) return this;
-    type2 = mimes_default[type2.replace(/^\./, "")] || type2;
-    this.res.headers.set("content-type", type2);
-    return this;
-  }
-  download(name) {
-    const ext = name?.split(".").pop();
-    if (ext && !this.res.headers.get("content-type")) this.type(ext);
-    return this.headers("content-disposition", disposition(name));
-  }
-  headers(key, value) {
-    if (typeof key !== "string") {
-      Object.entries(key).map(([key2, value2]) => this.headers(key2, value2));
-      return this;
-    }
-    if (Array.isArray(value)) {
-      this.res.headers.delete(key);
-      for (const val of value) this.res.headers.append(key, val);
-      return this;
-    }
-    if (key.toLowerCase() === "set-cookie") {
-      this.res.headers.append(key, value);
-    } else {
-      this.res.headers.set(key, value);
-    }
-    return this;
-  }
-  cache(value) {
-    const resolved = resolveCache(value);
-    if (resolved) this.res.headers.set("cache-control", resolved);
-    return this;
-  }
-  cookies(key, value) {
-    if (typeof key === "object") {
-      Object.entries(key).map(([key2, value2]) => this.cookies(key2, value2));
-      return this;
-    }
-    if (Array.isArray(value)) {
-      Object.values(value).map((val) => this.cookies(key, val));
-      return this;
-    }
-    if (value === null) return this.cookies(key, { expires: EXPIRED2 });
-    if (typeof value !== "object") return this.cookies(key, { value });
-    return this.headers("set-cookie", createCookies(key, value));
-  }
-  json(body) {
-    if (body === void 0) body = null;
-    if (!this.res.headers.get("content-type")) {
-      this.res.headers.set("content-type", "application/json");
-    }
-    return this.send(JSON.stringify(body));
+  patch(pathOrMid, optionsOrMid, ...middleware) {
+    return this.handle("patch", pathOrMid, optionsOrMid, ...middleware);
   }
-  redirect(path) {
-    this.headers("location", path);
-    if (this.res.status == null) this.res.status = 302;
-    return this.send();
+  delete(pathOrMid, optionsOrMid, ...middleware) {
+    return this.handle("delete", pathOrMid, optionsOrMid, ...middleware);
   }
-  async file(path) {
-    if (typeof path !== "string") {
-      if (!await path.exists()) return new Response(null, { status: 404 });
-      return this.type(fileType(path)).send(path.stream());
-    }
-    if (/(?:^|[\\/])\.\.(?:[\\/]|$)/.test(path)) {
-      return new Response(null, { status: 404 });
-    }
-    try {
-      const fs = await import("fs");
-      const ext = path.split(".").pop();
-      await fs.promises.access(path);
-      const stream = fs.createReadStream(path);
-      return this.type(ext).send(stream);
-    } catch (error) {
-      if (error.code === "ENOENT" || error.code === "EISDIR") {
-        return new Response(null, { status: 404 });
-      }
-      throw error;
-    }
+  options(pathOrMid, optionsOrMid, ...middleware) {
+    return this.handle("options", pathOrMid, optionsOrMid, ...middleware);
   }
-  // Accepts everything a route can return, so `send(x)` and `return x` agree.
-  // Async because a bucket file has to be read before its status is known;
-  // routes await whatever they return, so this is invisible in normal use.
-  async send(input = "") {
-    const { status: status2 = 200, headers: headers2 } = this.res;
-    let body = input;
-    if (status2 === 101 || status2 === 204 || status2 === 205 || status2 === 304) {
-      return new Response(null, { status: status2, headers: headers2 });
-    }
-    if (body === null) body = "";
-    if (typeof body?.then === "function") body = await body;
-    if (typeof body === "function") body = body();
-    if (typeof body?.then === "function") {
-      throw new Error(
-        "Cannot render an async component: components must be synchronous. Await the data before rendering and pass it in as props."
-      );
-    }
-    if (body instanceof _Reply) body = await body.send();
-    if (body instanceof Response) {
-      const merged = new Headers(body.headers);
-      for (const [key, value] of headers2) {
-        if (key === "set-cookie") continue;
-        merged.set(key, value);
-      }
-      for (const cookie of headers2.getSetCookie?.() ?? []) {
-        merged.append("set-cookie", cookie);
-      }
-      if (body.url && /^(br|gzip)$/.test(merged.get("content-encoding") || "")) {
-        merged.delete("content-encoding");
-      }
-      return new Response(body.body, {
-        status: this.res.status ?? body.status,
-        headers: merged
-      });
-    }
-    if (body && typeof body.stream === "function" && typeof body.bytes === "function" && typeof body.exists === "function" && typeof body.name === "string") {
-      return this.file(body);
-    }
-    if (body instanceof Blob) {
-      if (!headers2.get("content-type") && body.type) {
-        headers2.set("content-type", body.type);
-      }
-      return new Response(body, { status: status2, headers: headers2 });
-    }
-    if (typeof body === "string") {
-      if (!headers2.get("content-type")) {
-        headers2.set("content-type", isHtml(body) ? mimes_default.html : mimes_default.text);
-      }
-      if (!headers2.has("content-length")) {
-        headers2.set("content-length", String(Buffer.byteLength(body)));
-      }
-      return new Response(body, { status: status2, headers: headers2 });
-    }
-    const name = body?.constructor?.name;
-    if (body instanceof Uint8Array) {
-      if (!headers2.has("content-length")) {
-        headers2.set("content-length", String(body.length));
+  use(...args) {
+    for (const arg of args) {
+      if (arg instanceof _Router) {
+        for (const m of Object.keys(arg.handlers)) {
+          for (const route of arg.handlers[m]) {
+            checkParserConflict(route.options, this.settings?.parser);
+            const base = m === "socket" ? [] : this.middleware;
+            this.handlers[m].push({
+              path: route.path,
+              options: route.options,
+              fns: [...base, ...route.fns]
+            });
+          }
+        }
+      } else {
+        this.middleware.push(arg);
       }
-      return new Response(body, { status: status2, headers: headers2 });
-    }
-    if (typeof body?.getReader === "function") {
-      return new Response(body, { status: status2, headers: headers2 });
-    }
-    if (name === "PassThrough" || name === "Readable") {
-      return new Response(toWeb(body), { status: status2, headers: headers2 });
-    }
-    if (isReadableStream(body)) {
-      return new Response(toWeb(body), { status: status2, headers: headers2 });
-    }
-    if (!Array.isArray(body) && body?.[Symbol.iterator]) {
-      return new Response(iteratorToReadable(body), { status: status2, headers: headers2 });
-    }
-    if (body?.[Symbol.asyncIterator]) {
-      return new Response(iteratorAsyncToReadable(body), { status: status2, headers: headers2 });
     }
-    if (!headers2.get("content-type")) {
-      headers2.set("content-type", "application/json");
-    }
-    const payload = JSON.stringify(body);
-    if (!headers2.has("content-length")) {
-      headers2.set("content-length", String(Buffer.byteLength(payload)));
-    }
-    return new Response(payload, { status: status2, headers: headers2 });
+    return this.self();
   }
 };
-var r = () => new Reply();
-var status = (...args) => r().status(...args);
-var headers = (...args) => r().headers(...args);
-var type = (...args) => r().type(...args);
-var cache = (...args) => r().cache(...args);
-var download = (...args) => r().download(...args);
-var cookies = (...args) => r().cookies(...args);
-var send = (...args) => r().send(...args);
-var json = (...args) => r().json(...args);
-var file = (...args) => r().file(...args);
-var redirect = (...args) => r().redirect(...args);
+function router() {
+  return new Router();
+}
 
-// src/helpers/jwt.ts
-var enc = new TextEncoder();
+// src/util/toArray.ts
+function toArray(value) {
+  if (value == null) return [];
+  return Array.isArray(value) ? [...value] : [value];
+}
+
+// src/auth/jwt.ts
+var enc2 = new TextEncoder();
 var dec = new TextDecoder();
 var b64url = (data) => {
-  const bytes = typeof data === "string" ? enc.encode(data) : data;
+  const bytes = typeof data === "string" ? enc2.encode(data) : data;
   let bin = "";
   for (const b of bytes) bin += String.fromCharCode(b);
   return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -958,9 +903,25 @@ var unb64url = (seg) => {
   for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
   return bytes;
 };
+var decodeJwt = (token) => {
+  const parts = token.split(".");
+  if (parts.length !== 3) return null;
+  const [head, body, sig] = parts;
+  try {
+    return {
+      head,
+      body,
+      sig,
+      header: JSON.parse(dec.decode(unb64url(head))),
+      claims: JSON.parse(dec.decode(unb64url(body)))
+    };
+  } catch {
+    return null;
+  }
+};
 var hmacKey = (secret) => crypto.subtle.importKey(
   "raw",
-  enc.encode(secret),
+  enc2.encode(secret),
   { name: "HMAC", hash: "SHA-256" },
   false,
   ["sign", "verify"]
@@ -976,38 +937,26 @@ async function signJwt(payload, secret, expires) {
   const body = b64url(JSON.stringify(claims2));
   const data = `${head}.${body}`;
   const key = await hmacKey(secret);
-  const sig = await crypto.subtle.sign("HMAC", key, enc.encode(data));
+  const sig = await crypto.subtle.sign("HMAC", key, enc2.encode(data));
   return `${data}.${b64url(new Uint8Array(sig))}`;
 }
 async function verifyJwt(token, secret) {
-  const parts = token.split(".");
-  if (parts.length !== 3) return null;
-  const [head, body, sig] = parts;
-  let header;
-  try {
-    header = JSON.parse(dec.decode(unb64url(head)));
-  } catch {
-    return null;
-  }
-  if (header?.alg !== "HS256") return null;
+  const t = decodeJwt(token);
+  if (!t) return null;
+  if (t.header?.alg !== "HS256") return null;
   let ok = false;
-  for (const candidate of Array.isArray(secret) ? secret : [secret]) {
+  for (const candidate of toArray(secret)) {
     const key = await hmacKey(candidate);
     ok = await crypto.subtle.verify(
       "HMAC",
       key,
-      unb64url(sig),
-      enc.encode(`${head}.${body}`)
+      unb64url(t.sig),
+      enc2.encode(`${t.head}.${t.body}`)
     );
     if (ok) break;
   }
   if (!ok) return null;
-  let payload;
-  try {
-    payload = JSON.parse(dec.decode(unb64url(body)));
-  } catch {
-    return null;
-  }
+  const payload = t.claims;
   if (payload?.exp && Math.floor(Date.now() / 1e3) >= payload.exp) return null;
   return payload;
 }
@@ -1021,22 +970,21 @@ function seconds(expires) {
   if (!ms) throw new Error(`Invalid \`expires\`: "${expires}"`);
   return Math.round(ms / 1e3);
 }
-var looksLikeOurs = (token) => {
-  const parts = token.split(".");
-  if (parts.length !== 3) return false;
-  try {
-    const header = JSON.parse(atob(parts[0].replace(/-/g, "+").replace(/_/g, "/")));
-    return header?.alg === "HS256";
-  } catch {
-    return false;
-  }
-};
+var looksLikeOurs = (token) => decodeJwt(token)?.header?.alg === "HS256";
+var authCookie = (ctx, value, expires) => ({
+  value,
+  path: "/",
+  expires,
+  httpOnly: true,
+  secure: ctx.platform.production,
+  sameSite: "Lax"
+});
 var bearer = (ctx) => {
   const header = ctx.headers.authorization;
   if (!header) return;
   const [type2, token] = header.trim().split(" ");
   if (type2?.toLowerCase() !== "bearer") return;
-  if (!token) throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
+  if (!token) throw errors_default.AUTH_INVALID_HEADER({ type: type2 });
   return token;
 };
 async function read(ctx, strategy) {
@@ -1044,8 +992,8 @@ async function read(ctx, strategy) {
   if (!token) return;
   const payload = await verifyJwt(token, ctx.options.secrets);
   if (!payload) {
-    if (!inCookie(strategy)) throw ServerError_default.AUTH_INVALID_TOKEN();
-    ctx.clearCookie = NAME;
+    if (!inCookie(strategy)) throw errors_default.AUTH_INVALID_TOKEN();
+    clearOnSend(ctx, NAME);
     ctx.options.log?.message(
       "auth",
       looksLikeOurs(token) ? "discarded a session cookie signed with a key that is not in SECRETS. If you rotated it, keep the previous value: secrets: [current, previous]" : "discarded a session cookie that was not issued by this app"
@@ -1061,29 +1009,78 @@ var meta = (payload, strategy) => ({
   provider: payload.provider
 });
 var issue = (ctx, payload, expires) => signJwt(payload, ctx.options.secrets[0], seconds(expires));
-
-// src/auth/providers/index.ts
-import {
-  AmazonCognito,
-  AniList,
-  Apple,
-  Atlassian,
-  Auth0,
-  Authentik,
-  Autodesk,
-  BattleNet,
-  Bitbucket,
-  Box,
-  Bungie,
-  Coinbase,
-  Discord,
-  DonationAlerts,
-  Dribbble,
-  Dropbox,
-  Etsy,
-  EpicGames,
-  Facebook,
-  Figma,
+function validate(strategy, expires, config2) {
+  if (!["session", "cookie", "token", "jwt"].includes(strategy)) {
+    throw new Error(
+      `Unknown strategy "${strategy}"; it takes 'session', 'cookie', 'token' or 'jwt'.`
+    );
+  }
+  seconds(expires);
+  const { onLogin, getUser, toPublicUser } = config2;
+  if (onLogin && !getUser) {
+    throw new Error("`onLogin` needs a `getUser`: something has to resolve the id it returns.");
+  }
+  if (isSigned(strategy)) {
+    if (getUser && !toPublicUser) {
+      throw new Error(
+        `The \`${strategy}\` strategy signs the user into the credential, so it needs a \`toPublicUser\` to say what goes in. Signing the whole row would publish whatever else is on it.`
+      );
+    }
+  } else if (!getUser) {
+    throw new Error(
+      `The \`${strategy}\` strategy puts an id in the credential, so it needs a \`getUser\` to resolve it. With no database, use \`cookie\` or \`jwt\`.`
+    );
+  }
+}
+var publicProfile = ({ id, email, name, avatar }) => ({
+  id,
+  email,
+  name,
+  avatar
+});
+async function credentialPayload(config2, strategy, ctx, profile) {
+  const { onLogin, getUser, toPublicUser } = config2;
+  if (!getUser) return { user: publicProfile(profile) };
+  let id;
+  try {
+    id = await onLogin(profile, ctx);
+  } catch (error) {
+    error.expose = true;
+    throw error;
+  }
+  if (id === void 0 || id === null) {
+    throw new Error("`onLogin` must return the id the credential points at");
+  }
+  if (!isSigned(strategy)) return { sub: String(id) };
+  const user = await getUser(String(id), ctx);
+  if (user === void 0 || user === null) {
+    throw new Error(`getUser returned nothing for the id "${id}" that onLogin just returned`);
+  }
+  return { user: await toPublicUser(user) };
+}
+
+// src/auth/providers/index.ts
+import {
+  AmazonCognito,
+  AniList,
+  Apple,
+  Atlassian,
+  Auth0,
+  Authentik,
+  Autodesk,
+  BattleNet,
+  Bitbucket,
+  Box,
+  Bungie,
+  Coinbase,
+  Discord,
+  DonationAlerts,
+  Dribbble,
+  Dropbox,
+  Etsy,
+  EpicGames,
+  Facebook,
+  Figma,
   Gitea,
   GitHub,
   GitLab,
@@ -1138,10 +1135,9 @@ var passthrough = (options) => {
   const { id, secret, scope, issuer, ...rest } = options;
   return rest;
 };
-var scopeOf = (options, fallback) => {
-  const scope = options.scope ?? fallback;
-  return Array.isArray(scope) ? scope.join(" ") : scope;
-};
+var scopeOf = (options, fallback) => toArray(options.scope ?? fallback).join(" ");
+var callbackPath = (name) => `/auth/callback/${name}`;
+var callbackUrl = (ctx, name) => `${ctx.url.origin}${callbackPath(name)}`;
 var search = (base, params) => {
   const query = new URLSearchParams();
   for (const [key, value] of Object.entries(params)) {
@@ -1161,7 +1157,6 @@ var nowhere = {
 function antarcticProvider(name, Client) {
   const client = (ctx, options) => {
     const { id, secret } = credentials(name, options);
-    if (!id) throw new Error(`${name.toUpperCase()}_ID is not set`);
     return new Client({
       // Whatever that provider needs beyond the standard four: Auth0 takes a
       // `domain`, Keycloak a `realm`, Gitea a `baseURL`, Mastodon an
@@ -1169,8 +1164,9 @@ function antarcticProvider(name, Client) {
       ...passthrough(options),
       clientId: id,
       clientSecret: secret,
-      redirectURI: `${ctx.url.origin}/auth/callback/${name}`,
-      scopes: options.scope ? Array.isArray(options.scope) ? options.scope : options.scope.split(" ") : void 0,
+      redirectURI: callbackUrl(ctx, name),
+      // One list whether given as an array or a space-separated string
+      scopes: options.scope ? toArray(options.scope).flatMap((s) => s.split(" ")) : void 0,
       store: nowhere
     });
   };
@@ -1201,6 +1197,92 @@ function antarcticProvider(name, Client) {
   };
 }
 
+// src/util/createId.ts
+var alphabet = "useandom26T198340PX75pxJACKVERYMINDBUSHWOLFGQZbfghjklqvwyzrict";
+var random = (bytes) => crypto.getRandomValues(new Uint8Array(bytes));
+function createId(size = 16) {
+  let id = "";
+  const bytes = random(size);
+  while (size--) {
+    id += alphabet[bytes[size] & 61];
+  }
+  return id;
+}
+
+// src/auth/discovery.ts
+var bare = (url) => url.replace(/\/+$/, "");
+var discovered = /* @__PURE__ */ new Map();
+function discover(issuer) {
+  const base = bare(issuer);
+  let doc = discovered.get(base);
+  if (!doc) {
+    const url = `${base}/.well-known/openid-configuration`;
+    doc = fetch(url).catch(() => null).then((r2) => {
+      if (!r2?.ok) throw errors_default.AUTH_ISSUER_UNREACHABLE({ url });
+      return r2.json();
+    });
+    doc.catch(() => discovered.delete(base));
+    discovered.set(base, doc);
+  }
+  return doc;
+}
+
+// src/auth/providers/oidc.ts
+var claims = (token) => {
+  const t = token ? decodeJwt(token) : null;
+  if (!t) throw new Error("The issuer returned no usable id_token");
+  return t.claims;
+};
+function oidcProvider(name) {
+  return {
+    async authorize(ctx, options) {
+      const doc = await discover(options.issuer);
+      const state = createId();
+      const url = search(doc.authorization_endpoint, {
+        client_id: credentials(name, options).id,
+        response_type: "code",
+        scope: scopeOf(options, "openid email profile"),
+        redirect_uri: callbackUrl(ctx, name),
+        state,
+        ...passthrough(options)
+      });
+      return { url, state };
+    },
+    async exchange(ctx, options, code) {
+      const doc = await discover(options.issuer);
+      const { id, secret } = credentials(name, options);
+      const body = new URLSearchParams({
+        client_id: id,
+        client_secret: secret,
+        code,
+        grant_type: "authorization_code"
+      });
+      body.set("redirect_uri", callbackUrl(ctx, name));
+      const res = await fetch(doc.token_endpoint, {
+        method: "POST",
+        headers: {
+          accept: "application/json",
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        body
+      });
+      if (!res.ok) throw new Error(`${name}: token exchange failed`);
+      const token = await res.json();
+      const raw = claims(token.id_token);
+      return {
+        provider: name,
+        id: String(raw.sub),
+        email: raw.email,
+        name: raw.name,
+        avatar: raw.picture,
+        accessToken: token.access_token,
+        refreshToken: token.refresh_token,
+        raw
+      };
+    }
+  };
+}
+
 // src/auth/providers/index.ts
 var CLASSES = {
   amazoncognito: AmazonCognito,
@@ -1284,78 +1366,40 @@ for (const [alias, target2] of Object.entries(ALIASES)) {
 var ISSUERS = {
   paypal: "https://www.paypal.com"
 };
-var providers_default = providers;
-
-// src/auth/providers/oidc.ts
-var discovered = /* @__PURE__ */ new Map();
-function discover(issuer) {
-  let doc = discovered.get(issuer);
-  if (!doc) {
-    const url = `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
-    doc = fetch(url).then((r2) => {
-      if (!r2.ok) throw new Error(`Cannot reach the OIDC issuer at ${url}`);
-      return r2.json();
-    });
-    doc.catch(() => discovered.delete(issuer));
-    discovered.set(issuer, doc);
+function normalizeProviders(given) {
+  if (typeof given === "string") return { [given]: {} };
+  if (Array.isArray(given)) {
+    return Object.fromEntries(given.map((name) => [name, {}]));
   }
-  return doc;
+  const map2 = {};
+  for (const [name, raw] of Object.entries(given)) {
+    map2[name] = typeof raw === "string" ? { issuer: raw } : { ...raw };
+  }
+  return map2;
 }
-var claims = (token) => {
-  const body = token.split(".")[1];
-  if (!body) throw new Error("The issuer returned no usable id_token");
-  let b64 = body.replace(/-/g, "+").replace(/_/g, "/");
-  b64 += "=".repeat((4 - b64.length % 4) % 4);
-  return JSON.parse(atob(b64));
-};
-function oidcProvider(name) {
-  return {
-    async authorize(ctx, options) {
-      const doc = await discover(options.issuer);
-      const state = createId();
-      const url = search(doc.authorization_endpoint, {
-        client_id: credentials(name, options).id,
-        response_type: "code",
-        scope: scopeOf(options, "openid email profile"),
-        redirect_uri: `${ctx.url.origin}/auth/callback/${name}`,
-        state,
-        ...passthrough(options)
-      });
-      return { url, state };
-    },
-    async exchange(ctx, options, code) {
-      const doc = await discover(options.issuer);
-      const { id, secret } = credentials(name, options);
-      const body = new URLSearchParams({
-        client_id: id,
-        client_secret: secret,
-        code,
-        grant_type: "authorization_code"
-      });
-      body.set("redirect_uri", `${ctx.url.origin}/auth/callback/${name}`);
-      const res = await fetch(doc.token_endpoint, {
-        method: "POST",
-        headers: {
-          accept: "application/json",
-          "content-type": "application/x-www-form-urlencoded"
-        },
-        body
-      });
-      if (!res.ok) throw new Error(`${name}: token exchange failed`);
-      const token = await res.json();
-      const raw = claims(token.id_token);
-      return {
-        provider: name,
-        id: String(raw.sub),
-        email: raw.email,
-        name: raw.name,
-        avatar: raw.picture,
-        accessToken: token.access_token,
-        refreshToken: token.refresh_token,
-        raw
-      };
+function resolveProvider(name, options) {
+  if (!options.issuer && !providers[name] && ISSUERS[name]) {
+    options.issuer = ISSUERS[name];
+  }
+  if (options.issuer) return oidcProvider(name);
+  if (providers[name]) return providers[name];
+  throw new Error(
+    `Unknown provider "${name}". Give it an \`issuer\` to use any OIDC provider, or pick one of "${Object.keys(providers).join('", "')}".`
+  );
+}
+function parseProviders(given) {
+  const map2 = normalizeProviders(given);
+  const list = Object.entries(map2).map(([name, options]) => {
+    const provider = resolveProvider(name, options);
+    if (!credentials(name, options).id) {
+      throw new Error(
+        `Provider "${name}" has no client id: set the ${name.toUpperCase()}_ID environment variable (usually along ${name.toUpperCase()}_SECRET), or pass \`{ id, secret }\` in its options.`
+      );
     }
-  };
+    return { name, options, provider };
+  });
+  if (!list.length) throw new Error("Auth needs at least one provider");
+  return list;
 }
 
 // src/auth/state.ts
@@ -1363,21 +1407,14 @@ var NAME2 = "oauth_state";
 var EXPIRES = "10m";
 async function startState(ctx, pending) {
   const value = await signJwt(pending, ctx.options.secrets[0], 10 * 60);
-  return {
-    value,
-    path: "/",
-    expires: EXPIRES,
-    httpOnly: true,
-    secure: ctx.platform.production,
-    sameSite: "Lax"
-  };
+  return authCookie(ctx, value, EXPIRES);
 }
 async function readState(ctx, received) {
   const cookie = ctx.cookies[NAME2];
-  if (!cookie || !received) throw ServerError_default.AUTH_INVALID_STATE();
+  if (!cookie || !received) throw errors_default.AUTH_INVALID_STATE();
   const pending = await verifyJwt(cookie, ctx.options.secrets);
   if (!pending || pending.state !== received) {
-    throw ServerError_default.AUTH_INVALID_STATE();
+    throw errors_default.AUTH_INVALID_STATE();
   }
   return pending;
 }
@@ -1385,93 +1422,56 @@ async function readState(ctx, received) {
 // src/auth/flow.ts
 var SPEC = { schema: { tags: "auth" } };
 var wantsJson = (ctx) => String(ctx.headers.accept || "").includes("application/json");
-function parseProviders(given) {
-  const map2 = typeof given === "string" ? { [given]: {} } : Array.isArray(given) ? Object.fromEntries(given.map((name) => [name, {}])) : { ...given };
-  const out = [];
-  for (const [name, raw] of Object.entries(map2)) {
-    const options = typeof raw === "string" ? { issuer: raw } : { ...raw };
-    if (!options.issuer && !providers_default[name] && ISSUERS[name]) {
-      options.issuer = ISSUERS[name];
-    }
-    if (options.issuer) {
-      out.push({ name, options, provider: oidcProvider(name) });
-    } else if (providers_default[name]) {
-      out.push({ name, options, provider: providers_default[name] });
-    } else {
-      throw new Error(
-        `Unknown provider "${name}". Give it an \`issuer\` to use any OIDC provider, or pick one of "${Object.keys(providers_default).join('", "')}".`
-      );
-    }
-  }
-  if (!out.length) throw new Error("Auth needs at least one provider");
-  return out;
-}
 var target = async (where, fallback, user, ctx) => typeof where === "function" ? where(user, ctx) : where ?? fallback;
-function entry(config2) {
+var errorRedirect = async (redirects, ctx, message) => {
+  const to = await target(redirects.error, "/", null, ctx);
+  return redirect(`${to}?error=${encodeURIComponent(message)}`);
+};
+function failureMessage(error, name) {
+  if (error?.expose) return error.message;
+  console.error(`[server:auth] ${name} callback failed:`, error);
+  return "Could not sign you in";
+}
+var spendState = (res) => {
+  res.headers.append("set-cookie", clearCookie(NAME2));
+  return res;
+};
+var loginRoute = ({ provider, options }) => async (ctx) => {
+  const { url, state, payload } = await provider.authorize(ctx, options);
+  const cookie = await startState(ctx, { state, payload });
+  if (wantsJson(ctx)) {
+    return cookies(NAME2, cookie).json({ url });
+  }
+  return cookies(NAME2, cookie).redirect(url);
+};
+var callbackRoute = ({ name, options, provider }, redirects, finish) => async (ctx) => {
+  const query = ctx.url.query;
+  if (query.error) return errorRedirect(redirects, ctx, query.error);
+  const pending = await readState(ctx, query.state);
+  if (!query.code) throw errors_default.AUTH_NO_CODE();
+  try {
+    const profile = await provider.exchange(ctx, options, query.code, pending);
+    return spendState(await finish(ctx, profile));
+  } catch (error) {
+    const message = failureMessage(error, name);
+    return spendState(await errorRedirect(redirects, ctx, message));
+  }
+};
+function flowEntry(config2) {
   const list = parseProviders(config2.providers);
   const strategy = config2.strategy ?? "session";
-  if (!["session", "cookie", "token", "jwt"].includes(strategy)) {
-    throw new Error(
-      `Unknown strategy "${strategy}"; it takes 'session', 'cookie', 'token' or 'jwt'.`
-    );
-  }
   const expires = config2.expires ?? "30d";
-  seconds(expires);
-  const { onLogin, getUser, toPublicUser, onLogout } = config2;
-  if (onLogin && !getUser) {
-    throw new Error("`onLogin` needs a `getUser`: something has to resolve the id it returns.");
-  }
-  if (isSigned(strategy)) {
-    if (getUser && !toPublicUser) {
-      throw new Error(
-        `The \`${strategy}\` strategy signs the user into the credential, so it needs a \`toPublicUser\` to say what goes in. Signing the whole row would publish whatever else is on it.`
-      );
-    }
-  } else if (!getUser) {
-    throw new Error(
-      `The \`${strategy}\` strategy puts an id in the credential, so it needs a \`getUser\` to resolve it. With no database, use \`cookie\` or \`jwt\`.`
-    );
-  }
-  const publicProfile = ({ id, email, name, avatar }) => ({
-    id,
-    email,
-    name,
-    avatar
-  });
-  const redirects = typeof config2.redirect === "object" ? config2.redirect : {};
-  const loginTo = typeof config2.redirect === "object" ? redirects.login : config2.redirect;
+  validate(strategy, expires, config2);
+  const { getUser, onLogout } = config2;
+  const redirects = typeof config2.redirect === "object" ? config2.redirect : { login: config2.redirect };
   const finish = async (ctx, profile) => {
-    const payload = getUser ? await (async () => {
-      let id;
-      try {
-        id = await onLogin(profile, ctx);
-      } catch (error) {
-        error.expose = true;
-        throw error;
-      }
-      if (id === void 0 || id === null) {
-        throw new Error("`onLogin` must return the id the credential points at");
-      }
-      if (!isSigned(strategy)) return { sub: String(id) };
-      const user2 = await getUser(String(id), ctx);
-      if (user2 === void 0 || user2 === null) {
-        throw new Error(`getUser returned nothing for the id "${id}" that onLogin just returned`);
-      }
-      return { user: await toPublicUser(user2) };
-    })() : { user: publicProfile(profile) };
+    const payload = await credentialPayload(config2, strategy, ctx, profile);
     const signed = { ...payload, provider: profile.provider };
     const token = await issue(ctx, signed, expires);
     const user = signed.user ?? await getUser(signed.sub, ctx);
-    const to = await target(loginTo, "/", user, ctx);
+    const to = await target(redirects.login, "/", user, ctx);
     if (inCookie(strategy)) {
-      return cookies("session", {
-        value: token,
-        path: "/",
-        expires,
-        httpOnly: true,
-        secure: ctx.platform.production,
-        sameSite: "Lax"
-      }).redirect(to);
+      return cookies(NAME, authCookie(ctx, token, expires)).redirect(to);
     }
     return redirect(`${to}#token=${token}`);
   };
@@ -1485,70 +1485,49 @@ function entry(config2) {
       if (!payload.sub) return;
       return getUser(payload.sub, ctx);
     },
-    routes(app) {
-      for (const { name, options, provider } of list) {
-        app.get(`/auth/login/${name}`, SPEC, async (ctx) => {
-          const { url, state, payload } = await provider.authorize(ctx, options);
-          const cookie = await startState(ctx, { state, payload });
-          if (wantsJson(ctx)) {
-            return cookies(NAME2, cookie).json({ url });
-          }
-          return cookies(NAME2, cookie).redirect(url);
-        });
-        const callback = async (ctx) => {
-          const query = ctx.url.query;
-          if (query.error) {
-            const to = await target(redirects.error, "/", null, ctx);
-            return redirect(`${to}?error=${encodeURIComponent(query.error)}`);
-          }
-          const pending = await readState(ctx, query.state);
-          if (!query.code) throw ServerError_default.AUTH_NO_CODE();
-          let res;
-          try {
-            const profile = await provider.exchange(
-              ctx,
-              options,
-              query.code,
-              pending
-            );
-            res = await finish(ctx, profile);
-          } catch (error) {
-            const to = await target(redirects.error, "/", null, ctx);
-            let message = "Could not sign you in";
-            if (error?.expose) message = error.message;
-            else console.error(`[server:auth] ${name} callback failed:`, error);
-            res = await redirect(`${to}?error=${encodeURIComponent(message)}`);
-          }
-          res.headers.append(
-            "set-cookie",
-            `${NAME2}=; Path=/; Max-Age=0; HttpOnly`
-          );
-          return res;
-        };
-        app.get(`/auth/callback/${name}`, SPEC, callback);
+    routes() {
+      const r2 = router();
+      for (const one of list) {
+        r2.get(`/auth/login/${one.name}`, SPEC, loginRoute(one));
+        r2.get(callbackPath(one.name), SPEC, callbackRoute(one, redirects, finish));
       }
-      app.post("/auth/logout", SPEC, async (ctx) => {
+      r2.post("/auth/logout", SPEC, async (ctx) => {
         const payload = await read(ctx, strategy).catch(() => void 0);
         if (onLogout && payload?.sub) await onLogout(payload.sub, ctx);
         const to = await target(redirects.logout, "/", null, ctx);
         if (!inCookie(strategy)) return status(204);
-        return cookies("session", { value: null }).redirect(to);
+        return cookies(NAME, { value: null }).redirect(to);
       });
+      return r2;
+    }
+  };
+}
+
+// src/auth/instance.ts
+function instanceEntry(instance) {
+  const path = (instance.path ?? "/api/auth").replace(/\/$/, "");
+  const raw = { parser: "stream" };
+  const forward = (ctx) => instance.handler(
+    new Request(ctx.url.href, {
+      method: ctx.method,
+      headers: ctx.headers,
+      body: ctx.body,
+      // Required by fetch whenever a body is a stream
+      ...ctx.body ? { duplex: "half" } : {}
+    })
+  );
+  return {
+    name: `instance:${path}`,
+    user: async (ctx) => instance.user?.(ctx),
+    routes: () => {
+      const wildcard = `${path}/*`;
+      return router().get(wildcard, raw, forward).post(wildcard, raw, forward).put(wildcard, raw, forward).patch(wildcard, raw, forward).delete(wildcard, raw, forward);
     }
   };
 }
 
 // src/auth/verify.ts
-var enc2 = new TextEncoder();
-var dec2 = new TextDecoder();
-var unb64url2 = (seg) => {
-  let b64 = seg.replace(/-/g, "+").replace(/_/g, "/");
-  b64 += "=".repeat((4 - b64.length % 4) % 4);
-  const bin = atob(b64);
-  const bytes = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
-  return bytes;
-};
+var enc3 = new TextEncoder();
 var ALGS = {
   RS256: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
   RS384: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" },
@@ -1558,11 +1537,10 @@ var ALGS = {
 };
 var cache2 = /* @__PURE__ */ new Map();
 function keysOf(issuer, refresh = false) {
-  let entry3 = cache2.get(issuer);
-  if (!entry3 || refresh && Date.now() - entry3.at > 6e4) {
+  let entry = cache2.get(issuer);
+  if (!entry || refresh && Date.now() - entry.at > 6e4) {
     const keys = (async () => {
-      const url = `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
-      const discovery = await fetch(url).then((r2) => r2.json());
+      const discovery = await discover(issuer);
       const set = await fetch(discovery.jwks_uri).then((r2) => r2.json());
       const out = /* @__PURE__ */ new Map();
       for (const jwk of set.keys ?? []) {
@@ -1576,90 +1554,73 @@ function keysOf(issuer, refresh = false) {
       return out;
     })();
     keys.catch(() => cache2.delete(issuer));
-    entry3 = { at: Date.now(), keys };
-    cache2.set(issuer, entry3);
+    entry = { at: Date.now(), keys };
+    cache2.set(issuer, entry);
   }
-  return entry3.keys;
+  return entry.keys;
 }
-var bearer2 = (ctx) => {
-  const header = ctx.headers.authorization;
-  if (!header) return;
-  const [type2, token] = header.trim().split(" ");
-  if (type2?.toLowerCase() !== "bearer") return;
-  if (!token) throw ServerError_default.AUTH_INVALID_HEADER({ type: type2 });
-  return token;
-};
-function entry2(options) {
-  const { issuer, audience } = options;
-  const claimNames = options.audienceClaim ? Array.isArray(options.audienceClaim) ? options.audienceClaim : [options.audienceClaim] : ["aud"];
+function verifyEntry(options) {
+  const issuer = bare(options.issuer);
+  const { audience } = options;
+  const claimNames = toArray(options.audienceClaim ?? "aud");
   if (!audience) {
     throw new Error(
       "`issuer` needs an `audience`: one issuer serves many applications, and without it a token minted for another one is accepted here."
     );
   }
-  const allowed = Array.isArray(audience) ? audience : [audience];
+  const allowed = toArray(audience);
   return {
     name: `verify:${issuer}`,
     async user(ctx) {
-      const token = options.cookie ? ctx.cookies[options.cookie] : bearer2(ctx);
+      const token = options.cookie ? ctx.cookies[options.cookie] : bearer(ctx);
       if (!token) return;
       let claims2;
       try {
         claims2 = await check(token, issuer, allowed, claimNames);
       } catch (error) {
+        if (error?.code === "AUTH_ISSUER_UNREACHABLE") throw error;
         if (!options.cookie) throw error;
-        ctx.clearCookie = options.cookie;
+        clearOnSend(ctx, options.cookie);
         ctx.options.log?.message(
           "auth",
           `discarded a ${options.cookie} cookie that ${issuer} did not sign, or that has expired`
         );
         return;
       }
-      ctx.auth = {
-        issuedAt: new Date((claims2.iat ?? 0) * 1e3),
-        expiresAt: claims2.exp ? new Date(claims2.exp * 1e3) : void 0,
-        strategy: options.cookie ? "cookie" : "jwt",
-        provider: issuer
-      };
+      ctx.auth = meta(
+        { iat: claims2.iat ?? 0, exp: claims2.exp, provider: issuer },
+        options.cookie ? "cookie" : "jwt"
+      );
       if (!options.getUser) return claims2;
       return options.getUser(claims2.sub, ctx);
     }
   };
 }
 async function check(token, issuer, allowed, claimNames) {
-  const parts = token.split(".");
-  if (parts.length !== 3) throw ServerError_default.AUTH_INVALID_TOKEN();
-  const [head, body, sig] = parts;
-  let header;
-  let claims2;
-  try {
-    header = JSON.parse(dec2.decode(unb64url2(head)));
-    claims2 = JSON.parse(dec2.decode(unb64url2(body)));
-  } catch {
-    throw ServerError_default.AUTH_INVALID_TOKEN();
-  }
+  const t = decodeJwt(token);
+  if (!t) throw errors_default.AUTH_INVALID_TOKEN();
+  const { head, body, sig, header, claims: claims2 } = t;
   const algorithm = ALGS[header?.alg];
-  if (!algorithm) throw ServerError_default.AUTH_INVALID_TOKEN();
+  if (!algorithm) throw errors_default.AUTH_INVALID_TOKEN();
   let key = (await keysOf(issuer)).get(header.kid);
   if (!key) key = (await keysOf(issuer, true)).get(header.kid);
-  if (!key) throw ServerError_default.AUTH_INVALID_TOKEN();
+  if (!key) throw errors_default.AUTH_INVALID_TOKEN();
   const ok = await crypto.subtle.verify(
     algorithm.name === "ECDSA" ? { name: "ECDSA", hash: algorithm.hash } : algorithm,
     key,
-    unb64url2(sig),
-    enc2.encode(`${head}.${body}`)
+    unb64url(sig),
+    enc3.encode(`${head}.${body}`)
   );
-  if (!ok) throw ServerError_default.AUTH_INVALID_TOKEN();
+  if (!ok) throw errors_default.AUTH_INVALID_TOKEN();
   const now = Math.floor(Date.now() / 1e3);
-  if (claims2.exp && now >= claims2.exp) throw ServerError_default.AUTH_INVALID_TOKEN();
-  if (claims2.nbf && now < claims2.nbf) throw ServerError_default.AUTH_INVALID_TOKEN();
-  if (claims2.iss !== issuer) throw ServerError_default.AUTH_INVALID_TOKEN();
+  if (claims2.exp && now >= claims2.exp) throw errors_default.AUTH_INVALID_TOKEN();
+  if (claims2.nbf && now < claims2.nbf) throw errors_default.AUTH_INVALID_TOKEN();
+  if (bare(claims2.iss ?? "") !== issuer) throw errors_default.AUTH_INVALID_TOKEN();
   const name = claimNames.find((one) => claims2[one] !== void 0);
-  if (!name) throw ServerError_default.AUTH_INVALID_TOKEN();
-  const value = claims2[name];
-  const aud = Array.isArray(value) ? value : [value];
+  if (!name) throw errors_default.AUTH_INVALID_TOKEN();
+  const aud = toArray(claims2[name]);
   if (!aud.some((one) => allowed.includes(one))) {
-    throw ServerError_default.AUTH_INVALID_TOKEN();
+    throw errors_default.AUTH_INVALID_TOKEN();
   }
   return claims2;
 }
@@ -1692,20 +1653,8 @@ var VENDORS = {
     docs: "https://supabase.com/docs/guides/auth/jwts"
   }
 };
-var vendors_default = VENDORS;
-
-// src/auth/parse.ts
-function parseAuth(auth2) {
-  if (!auth2) return null;
-  if (Array.isArray(auth2)) {
-    throw new Error(
-      "`auth` takes one method. For several login options, list them under `providers` instead: auth: { providers: ['github', 'google'], ... }."
-    );
-  }
-  return toEntry(auth2);
-}
 function vendorEntry(strategy, name) {
-  const vendor = vendors_default[name];
+  const vendor = VENDORS[name];
   const KEY = name.toUpperCase();
   if (strategy !== "jwt" && strategy !== "cookie") {
     throw new Error(
@@ -1729,63 +1678,50 @@ function vendorEntry(strategy, name) {
       `${KEY}_AUDIENCE is not set. It should be ${vendor.audience}. One issuer serves many applications, all signed with the same keys, so without it a token minted for another one is accepted here.`
     );
   }
-  return entry2({
+  return verifyEntry({
     issuer,
     audience,
     ...vendor.claim ? { audienceClaim: vendor.claim } : {},
     ...strategy === "cookie" ? { cookie: vendor.cookie } : {}
   });
 }
-function toEntry(auth2) {
-  if (typeof auth2 === "string") {
-    const [strategy, name] = auth2.split(":");
-    if (!name) {
-      throw new Error(
-        `Invalid auth "${auth2}": the string form is "<strategy>:<name>", like "cookie:github" to log people in, or "jwt:clerk" to check a token a vendor issued.`
-      );
-    }
-    if (vendors_default[name]) return vendorEntry(strategy, name);
-    return entry({ strategy, providers: name });
+
+// src/auth/parse.ts
+function parseAuth(auth2) {
+  if (!auth2) return null;
+  if (Array.isArray(auth2)) {
+    throw new Error(
+      "`auth` takes one method. For several login options, list them under `providers` instead: auth: { providers: ['github', 'google'], ... }."
+    );
+  }
+  return toEntry(auth2);
+}
+function fromString(auth2) {
+  const [strategy, name] = auth2.split(":");
+  if (!name) {
+    throw new Error(
+      `Invalid auth "${auth2}": the string form is "<strategy>:<name>", like "cookie:github" to log people in, or "jwt:clerk" to check a token a vendor issued.`
+    );
   }
+  if (VENDORS[name]) return vendorEntry(strategy, name);
+  return flowEntry({ strategy, providers: name });
+}
+function toEntry(auth2) {
+  if (typeof auth2 === "string") return fromString(auth2);
   if (typeof auth2 === "function") {
     return { name: "function", user: async (ctx) => auth2(ctx) };
   }
   if (auth2 && typeof auth2 === "object") {
-    if ("issuer" in auth2) return entry2(auth2);
-    if ("providers" in auth2) return entry(auth2);
-    if ("handler" in auth2) {
-      const instance = auth2;
-      const path = (instance.path ?? "/api/auth").replace(/\/$/, "");
-      const raw = { parser: "stream" };
-      const forward = (ctx) => instance.handler(
-        new Request(ctx.url.href, {
-          method: ctx.method,
-          headers: ctx.headers,
-          body: ctx.body,
-          // Required by fetch whenever a body is a stream
-          ...ctx.body ? { duplex: "half" } : {}
-        })
-      );
-      return {
-        name: `instance:${path}`,
-        user: async (ctx) => instance.user?.(ctx),
-        routes: (app) => {
-          const wildcard = `${path}/*`;
-          app.get(wildcard, raw, forward);
-          app.post(wildcard, raw, forward);
-          app.put(wildcard, raw, forward);
-          app.patch(wildcard, raw, forward);
-          app.delete(wildcard, raw, forward);
-        }
-      };
-    }
+    if ("issuer" in auth2) return verifyEntry(auth2);
+    if ("providers" in auth2) return flowEntry(auth2);
+    if ("handler" in auth2) return instanceEntry(auth2);
   }
   throw new Error(
     "Invalid `auth`: it takes a string, a function, `{ providers }`, `{ issuer, audience }`, a library instance, or an array of those."
   );
 }
 
-// src/helpers/color.ts
+// src/boot/color.ts
 var map = {
   reset: 0,
   bright: 1,
@@ -1822,7 +1758,7 @@ function color(str, ...vals) {
   return color(str[0] + vals.map((v, i) => v + str[i + 1]).join(""));
 }
 
-// src/helpers/logger.ts
+// src/boot/logger.ts
 var STATUS_TEXT = {
   200: "OK",
   201: "Created",
@@ -1847,17 +1783,6 @@ var STATUS_TEXT = {
   502: "Bad Gateway",
   503: "Service Unavailable"
 };
-var UNITS2 = ["b", "kb", "mb", "gb", "tb"];
-function formatBytes(bytes) {
-  if (!bytes || bytes < 0) return "0b";
-  const i = Math.min(
-    Math.floor(Math.log(bytes) / Math.log(1024)),
-    UNITS2.length - 1
-  );
-  const value = bytes / 1024 ** i;
-  const rounded = i === 0 ? Math.round(value) : Math.round(value * 10) / 10;
-  return `${rounded}${UNITS2[i]}`;
-}
 var SCOPE_COLORS = {
   start: "green",
   api: "cyan"
@@ -1894,72 +1819,88 @@ function createLogger(level) {
   };
 }
 
-// src/helpers/secrets.ts
+// src/boot/secrets.ts
 function resolveSecrets(option) {
   const given = option ?? globalThis.env.SECRETS?.split(",");
-  const list = (Array.isArray(given) ? given : [given]).map((one) => one?.trim()).filter(Boolean);
+  const list = toArray(given).map((one) => one?.trim()).filter(Boolean);
   return list.length ? list : [`unsafe-${createId()}`];
 }
 
-// src/helpers/security.ts
-function resolveSecurity(security) {
-  const off = security === false;
-  const o = security && typeof security === "object" ? security : {};
-  const val = (v, def) => v === false ? null : v === true || v == null ? def : v;
-  const map2 = off ? {} : {
-    "x-frame-options": val(o.frameguard, "SAMEORIGIN"),
-    "x-content-type-options": o.noSniff === false ? null : "nosniff",
-    "referrer-policy": val(
-      o.referrerPolicy,
-      "strict-origin-when-cross-origin"
-    ),
-    "x-xss-protection": o.xssProtection === false ? null : "0",
-    // Opt-in: default off
-    "content-security-policy": val(o.csp, null),
-    "cross-origin-opener-policy": val(o.coop, null),
-    "cross-origin-resource-policy": val(o.corp, null),
-    "permissions-policy": o.permissionsPolicy ?? null
-  };
-  const headers2 = {};
-  for (const key in map2) {
-    const value = map2[key];
-    if (value) headers2[key] = value;
-  }
-  return {
-    trustProxy: o.trustProxy ?? true,
-    traversalProtection: off ? false : o.traversalProtection !== false,
-    // Cap on the bytes buffered per request (see bodyLimit). `false` (or
-    // turning security off entirely) resolves to Infinity, meaning no limit.
-    maxBody: off ? INF : resolveMax(o.maxBody),
-    headers: headers2,
-    hsts: off ? null : val(o.hsts, "max-age=15552000; includeSubDomains")
-  };
-}
-var CLIMBS = /(?:^|[\\/])\.\.(?:[\\/]|$)/;
-var ABSOLUTE = /^(?:[\\/]|[a-zA-Z]:)/;
-function checkTraversal(params, ctx) {
-  if (!ctx.options.security?.traversalProtection) return;
-  for (const param in params) {
-    const value = params[param];
-    if (typeof value !== "string") continue;
-    if (CLIMBS.test(value) || ABSOLUTE.test(value)) {
-      throw errors_default.PATH_TRAVERSAL({ param, value });
-    }
+// src/errors/render.ts
+var DOCS = "https://server-js.com/documentation/errors";
+var wantsHtml = (ctx) => String(ctx?.headers?.accept || "").includes("text/html");
+var escapeHtml = (str) => String(str).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+var safeCode = (code) => typeof code === "string" && /^[A-Za-z0-9_]{1,64}$/.test(code) ? code : null;
+var inline = (str) => escapeHtml(str).replace(/`([^`]+)`/g, "<code>$1</code>");
+function logLines(error) {
+  const code = error?.code ? `${error.code}: ` : "";
+  const hint = error?.hint ? `
+  ${error.hint}` : "";
+  const valid = safeCode(error?.code);
+  const docs = valid ? `
+  ${DOCS}#${valid.toLowerCase()}` : "";
+  return `${code}${error?.message ?? error}${hint}${docs}`;
+}
+function devPage(error, ctx) {
+  const status2 = Number(error?.status) || 500;
+  const code = safeCode(error?.code);
+  const link = code ? `${DOCS}#${code.toLowerCase()}` : null;
+  const title = code ?? error?.name ?? "Error";
+  const stack = error?.stack ? escapeHtml(String(error.stack)) : "";
+  return `<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8" />
+<title>${status2} ${escapeHtml(title)}</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { margin: 0; padding: 3rem 1.5rem; font: 15px/1.6 ui-sans-serif, system-ui, sans-serif; }
+  main { max-width: 46rem; margin: 0 auto; }
+  .status { font-size: .8rem; letter-spacing: .08em; text-transform: uppercase; opacity: .6; }
+  h1 { font-size: 1.5rem; }
+  code { font-family: ui-monospace, monospace; font-size: .9em; background: color-mix(in srgb, currentColor 10%, transparent); padding: .1em .3em; border-radius: .2em; }
+  pre { overflow-x: auto; font-size: .8rem; opacity: .7; background: light-dark(#eee, #1a1a1a); padding: 1rem; border-radius: .3rem; }
+  footer { font-size: .8rem; opacity: .6; margin-top: 2rem; }
+</style></head>
+<body><main>
+  <p class="status">${status2}${code ? ` &middot; ${escapeHtml(code)}` : ""} &middot; ${escapeHtml(ctx.method.toUpperCase())} ${escapeHtml(ctx.url.pathname)}</p>
+  <h1>${escapeHtml(String(error?.message ?? error))}</h1>
+  ${error?.hint ? `<p>${inline(error.hint)}</p>` : ""}
+  ${link ? `<p><a href="${link}">${link}</a></p>` : ""}
+  ${stack ? `<pre>${stack}</pre>` : ""}
+  <footer>You are seeing this because the app is in development. In production this is a plain ${status2}.</footer>
+</main></body></html>`;
+}
+function defaultOnError(error, ctx) {
+  const status2 = Number(error?.status) || 500;
+  if (status2 >= 500) console.error(`[server:error] ${logLines(error)}`);
+  if (env.NODE_ENV !== "production" && wantsHtml(ctx)) {
+    return new Response(devPage(error, ctx), {
+      status: status2,
+      headers: {
+        "content-type": "text/html; charset=utf-8",
+        // The page renders a message, a stack and a path, none of which
+        // it controls. Nothing may execute or be fetched, so an escaping
+        // miss is inert rather than exploitable.
+        "content-security-policy": "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'"
+      }
+    });
   }
+  const body = status2 < 500 ? error?.message : "Server Error";
+  return new Response(body || "Server Error", { status: status2 });
 }
-function applySecurity(res, ctx) {
-  const security = ctx.options.security;
-  if (!security) return;
-  for (const key in security.headers) {
-    if (!res.headers.has(key)) res.headers.set(key, security.headers[key]);
-  }
-  if (security.hsts && ctx.platform.production && !res.headers.has("strict-transport-security")) {
-    res.headers.set("strict-transport-security", security.hsts);
+
+// src/boot/config.ts
+var announced = false;
+function announceDevelopment() {
+  if (announced || env.NODE_ENV === "production" || env.NODE_ENV === "test") {
+    return;
   }
+  announced = true;
+  console.warn(
+    "[server:app] Running in development mode. Set NODE_ENV=production when you deploy."
+  );
 }
-
-// src/helpers/config.ts
 function config(options = {}) {
+  announceDevelopment();
   const env2 = globalThis.env;
   const opts = options;
   if (typeof opts.body === "string") {
@@ -1974,6 +1915,12 @@ function config(options = {}) {
       );
     }
   }
+  const sec = opts.security;
+  if (sec && typeof sec === "object" && sec.maxBody !== void 0) {
+    throw new Error(
+      "The `security.maxBody` option is now `security.maxBodySize`, to sit alongside the `uploads` limits `maxFileSize` and `maxTotalSize`."
+    );
+  }
   if (opts.secret !== void 0) {
     throw new Error(
       "The `secret` option is now `secrets`, and takes one key or several: `secrets: [current, previous]` signs with the first and verifies with any, so rotating a key no longer signs everyone out."
@@ -2039,7 +1986,6 @@ function config(options = {}) {
   const publicDir = options.public || env2.PUBLIC;
   settings.public = publicDir ? bucket(publicDir) : null;
   settings.uploads = resolveUploads(options.uploads);
-  const production = env2.NODE_ENV === "production";
   if (options.auth || env2.AUTH) {
     settings.auth = parseAuth(
       options.auth || env2.AUTH || null
@@ -2056,11 +2002,7 @@ function config(options = {}) {
     else if (typeof o === "string") settings.openapi = { path: o };
     else settings.openapi = { path: "/openapi.json", ...o };
   }
-  settings.onError = options.onError || ((error) => {
-    return new Response(error.message || "Server Error", {
-      status: error.status || 500
-    });
-  });
+  settings.onError = options.onError || defaultOnError;
   settings.onResponse = options.onResponse;
   const loc = (v) => typeof v === "string" ? v : "enabled";
   if (settings.auth) log.message("auth", `${settings.auth.name} enabled`);
@@ -2075,70 +2017,17 @@ function config(options = {}) {
   return settings;
 }
 
-// src/helpers/cors.ts
-var localhost = /^https?:\/\/localhost(:\d+)?$/;
-function cors(config2, origin = "") {
-  origin = origin?.toLowerCase();
-  if (config2 === true) return origin || null;
-  if (config2 === "*") return "*";
-  if (!origin) return null;
-  if (localhost.test(origin)) return origin;
-  const arr = Array.isArray(config2) ? config2 : typeof config2 === "string" ? config2.split(/\s*,\s*/g) : [];
-  if (arr.includes(origin)) return origin;
-  console.warn(`CORS: Origin "${origin}" not allowed. Allowed "${config2}"`);
-  return null;
-}
-function applyCors(res, ctx) {
-  const settings = ctx.options.cors;
-  if (!settings) return;
-  const requestOrigin = ctx.headers.origin || "";
-  let origin = cors(settings.origin, requestOrigin);
-  if (!origin) return;
-  if (settings.credentials && origin === "*") {
-    if (!requestOrigin) return;
-    origin = requestOrigin.toLowerCase();
-  }
-  res.headers.set("Access-Control-Allow-Origin", origin);
-  res.headers.set("Access-Control-Allow-Methods", settings.methods);
-  res.headers.set("Access-Control-Allow-Headers", settings.headers);
-  if (settings.credentials) {
-    res.headers.set("Access-Control-Allow-Credentials", "true");
-  }
-  if (origin !== "*") res.headers.append("Vary", "Origin");
-  if (ctx.method === "options") {
-    res.headers.set("Access-Control-Max-Age", "86400");
-  }
-}
-
-// src/helpers/forwarded.ts
-var first2 = (value) => {
-  const one = Array.isArray(value) ? value[0] : value;
-  return one?.split(",")[0].trim() || void 0;
-};
-function forwarded(url, headers2, trustProxy) {
-  if (!trustProxy) return;
-  const proto = first2(headers2["x-forwarded-proto"]);
-  if (proto === "http" || proto === "https") url.protocol = `${proto}:`;
-  const host = first2(headers2["x-forwarded-host"]);
-  const port = first2(headers2["x-forwarded-port"]);
-  if (host?.includes(":")) {
-    url.host = host;
-  } else if (host) {
-    url.hostname = host;
-    url.port = port ?? "";
-  } else if (port) {
-    url.port = port;
-  }
-}
-
-// src/helpers/createWebsocket.ts
+// src/ws/createWebsocket.ts
 function createWebsocket(sockets, handlers) {
   const run2 = (event, socket, body) => {
     const routes = handlers.socket?.filter((r2) => r2.path === event) ?? [];
     const user = socket.user ?? socket.data?.user;
+    const ctx = { socket, sockets, body, user };
     for (const route of routes) {
       for (const fn of route.fns) {
-        fn({ socket, sockets, body, user });
+        Promise.resolve(fn(ctx)).catch((error) => {
+          console.error(`[server:socket] ${event} handler failed:`, error);
+        });
       }
     }
   };
@@ -2155,23 +2044,7 @@ function createWebsocket(sockets, handlers) {
   };
 }
 
-// src/helpers/define.ts
-function define(obj, key, cb) {
-  Object.defineProperty(obj, key, {
-    configurable: true,
-    get() {
-      const value = cb(obj);
-      Object.defineProperty(obj, key, {
-        configurable: true,
-        writable: true,
-        value
-      });
-      return obj[key];
-    }
-  });
-}
-
-// src/helpers/getMachine.ts
+// src/boot/getMachine.ts
 function getProvider() {
   if (typeof globalThis.Netlify !== "undefined") return "netlify";
   return null;
@@ -2195,310 +2068,40 @@ function getMachine() {
   };
 }
 
-// src/parseResponse.ts
-async function parseResponse(out, ctx) {
-  if (!out && typeof out !== "string") return null;
-  if (typeof out === "function") {
-    out = await out(ctx);
-    if (!out && typeof out !== "string") return null;
-  }
-  if (typeof out === "number") {
-    out = new Response(null, { status: out });
-  }
-  if (!(out instanceof Response) || out.url) {
-    out = await send(out);
-  }
-  applyCors(out, ctx);
-  applySecurity(out, ctx);
-  out = await applyCache(out, ctx);
-  if (ctx.clearCookie) {
-    out.headers.append(
-      "set-cookie",
-      `${ctx.clearCookie}=; Path=/; Max-Age=0; HttpOnly`
-    );
-  }
-  if (ctx.time?.times?.length > 1) {
-    out.headers.set("Server-Timing", ctx.time.headers());
+// src/auth/index.ts
+function auth(app) {
+  const entry = app.settings.auth;
+  app.use(async function middle(ctx) {
+    ctx.user = await entry.user(ctx);
+  });
+  if (entry.routes) app.use(entry.routes());
+}
+
+// src/http/parseRange.ts
+function parseRange(header, size) {
+  if (!header) return null;
+  const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+  if (!match) return null;
+  const [, rawStart, rawEnd] = match;
+  if (rawStart === "" && rawEnd === "") return null;
+  let start;
+  let end;
+  if (rawStart === "") {
+    const n = Number(rawEnd);
+    if (n <= 0) return "unsatisfiable";
+    start = Math.max(0, size - n);
+    end = size - 1;
+  } else {
+    start = Number(rawStart);
+    end = rawEnd === "" ? size - 1 : Number(rawEnd);
   }
-  return out;
-}
-
-// src/pathPattern.ts
-function pathPattern(pattern, path) {
-  if (pattern === "*" && path === "/") return {};
-  pattern = `/${pattern.replace(/^\//, "")}`;
-  pattern = pattern.replace(/\/$/, "") || "/";
-  path = path.replace(/\/$/, "") || "/";
-  if (pattern === path) return {};
-  const params = {};
-  const pathParts = path.split("/").slice(1).map((u) => decodeURIComponent(u));
-  const pattParts = pattern.split("/").slice(1);
-  let allSame = true;
-  for (let i = 0; i < Math.max(pathParts.length, pattParts.length); i++) {
-    const patt = pattParts[i] || "";
-    const part = pathParts[i] || "";
-    const last = pattParts[pattParts.length - 1];
-    const key = patt.replace(/^:/, "").replace(/\?$/, "").replace(/\(\w*\)/, "");
-    if (patt === part) continue;
-    if (patt.endsWith("?") && !part) continue;
-    if (patt.startsWith(":")) {
-      params[key] = part;
-      if (/\(\w*\)/.test(patt)) {
-        if (patt.includes("(number)")) {
-          const value = Number(part);
-          params[key] = Number.isNaN(value) ? void 0 : value;
-        }
-        if (patt.includes("(date)")) {
-          const value = new Date(part);
-          params[key] = Number.isNaN(value.getTime()) ? void 0 : value;
-        }
-      }
-      continue;
-    }
-    if (!patt && last === "*" && part || patt === "*" && part) {
-      params["*"] = params["*"] || [];
-      params["*"].push(part);
-      continue;
-    }
-    allSame = false;
-  }
-  if (allSame) return params;
-  return null;
-}
-
-// src/errors/ValidationError.ts
-var ValidationError = class extends StatusError {
-  source;
-  issues;
-  constructor(source, issues) {
-    if (source === "response") {
-      super("Server Error", 500);
-    } else {
-      super(`Invalid request ${source}`, 422);
-    }
-    this.source = source;
-    this.issues = issues;
-  }
-};
-
-// src/helpers/validate.ts
-async function run(schema, value, source) {
-  const result = await schema["~standard"].validate(value);
-  if (result.issues) throw new ValidationError(source, result.issues);
-  return result.value;
-}
-async function validateRequest(ctx, options) {
-  if (options.body) {
-    ctx.body = await run(options.body, ctx.body ?? {}, "body");
-  }
-  if (options.query) {
-    const query = await run(options.query, ctx.url.query || {}, "query");
-    replace2(ctx.url.query, query);
-  }
-  if (options.params) {
-    const params = await run(options.params, ctx.url.params || {}, "params");
-    replace2(ctx.url.params, params);
-  }
-}
-async function validateResponse(out, options) {
-  if (!options.response) return out;
-  if (out?.constructor !== Object && !Array.isArray(out)) return out;
-  return await run(options.response, out, "response");
-}
-function replace2(target2, values) {
-  for (const key of Object.keys(target2)) delete target2[key];
-  Object.assign(target2, values);
-}
-
-// src/helpers/handleRequest.ts
-async function handleRequest(app, ctx) {
-  let res = await getResponse(app, ctx);
-  if (res && ctx.options.onResponse) {
-    const replaced = await ctx.options.onResponse(res, ctx);
-    if (replaced) res = replaced;
-  }
-  if (res) ctx.options.log.request(ctx, res);
-  if (res?.body && ctx.method === "head") {
-    res.body.cancel().catch(() => {
-    });
-    res = new Response(null, { status: res.status, headers: res.headers });
-  }
-  return res;
-}
-async function getResponse(app, ctx) {
-  try {
-    let matched = false;
-    const routes = ctx.method === "head" ? [...app.handlers.head, ...app.handlers.get] : app.handlers[ctx.method];
-    for (const route of routes) {
-      const params = pathPattern(route.path, ctx.url.pathname || "/");
-      if (!params) continue;
-      matched = true;
-      define(ctx.url, "params", () => params);
-      if (Object.keys(route.options).length) {
-        ctx.options = { ...app.settings, ...route.options };
-      }
-      checkTraversal(params, ctx);
-      ctx.body = await resolveBody(
-        ctx,
-        ctx.options.parser,
-        ctx.options.security.maxBody
-      );
-      await validateRequest(ctx, route.options);
-      for (const cb of route.fns) {
-        const res = await cb(ctx);
-        const out = await parseResponse(
-          await validateResponse(res, route.options),
-          ctx
-        );
-        if (out) return out;
-      }
-      break;
-    }
-    if (!matched) {
-      ctx.body = await resolveBody(
-        ctx,
-        ctx.options.parser,
-        ctx.options.security.maxBody
-      );
-      for (const mw of app.middleware) {
-        const out = await parseResponse(await mw(ctx), ctx);
-        if (out) return out;
-      }
-    }
-    if (ctx.platform.provider === "netlify") return;
-    throw new ServerError_default("NOT_FOUND", 404, "Not Found");
-  } catch (error) {
-    const res = await ctx.options.onError(error, ctx);
-    applyCors(res, ctx);
-    applySecurity(res, ctx);
-    return res;
-  }
-}
-
-// src/helpers/iteratorAsyncToReadable.ts
-function iteratorAsyncToReadable(asyncGenerator) {
-  let cancelled = false;
-  return new ReadableStream({
-    async pull(controller) {
-      try {
-        const { value, done } = await asyncGenerator.next();
-        if (cancelled) return;
-        if (done) {
-          controller.close();
-          return;
-        }
-        controller.enqueue(new TextEncoder().encode(value));
-      } catch (err) {
-        console.error("Stream error:", err);
-        controller.error(err);
-      }
-    },
-    // Return the generator so its `finally {}` runs and releases resources.
-    async cancel(reason) {
-      cancelled = true;
-      await asyncGenerator.return?.(reason);
-    }
-  });
-}
-
-// src/helpers/iteratorToReadable.ts
-function iteratorToReadable(generator) {
-  return new ReadableStream({
-    async start(controller) {
-      for await (const chunk of generator) {
-        controller.enqueue(chunk);
-      }
-      controller.close();
-    }
-  });
-}
-
-// src/helpers/parseCookies.ts
-function parseCookies(cookies2) {
-  if (!cookies2) return {};
-  const cookieStr = Array.isArray(cookies2) ? cookies2[0] : cookies2;
-  if (!cookieStr) return {};
-  return Object.fromEntries(
-    cookieStr.split(/;\s*/).map((part) => {
-      const [key, ...rest] = part.split("=");
-      const value = rest.join("=");
-      try {
-        return [key, decodeURIComponent(value)];
-      } catch {
-        return [key, value];
-      }
-    })
-  );
-}
-
-// src/helpers/parseHeaders.ts
-var parseHeaders_default = (raw) => {
-  const headers2 = {};
-  raw.forEach((value, originalKey) => {
-    const key = originalKey.toLowerCase();
-    if (headers2[key]) {
-      if (!Array.isArray(headers2[key])) {
-        headers2[key] = [headers2[key]];
-      }
-      headers2[key].push(value);
-    } else {
-      headers2[key] = value;
-    }
-  });
-  return headers2;
-};
-
-// src/helpers/toWeb.ts
-function toWeb(nodeStream) {
-  if (typeof ReadableStream === "undefined") {
-    throw new Error("Environment not supported, please report this as a bug");
-  }
-  return new ReadableStream({
-    start(controller) {
-      nodeStream.on("data", (chunk) => controller.enqueue(chunk));
-      nodeStream.on("end", () => controller.close());
-      nodeStream.on("error", (err) => controller.error(err));
-    },
-    cancel() {
-      nodeStream.destroy();
-    }
-  });
-}
-
-// src/auth/index.ts
-function auth(app) {
-  const entry3 = app.settings.auth;
-  app.use(async function middle(ctx) {
-    ctx.user = await entry3.user(ctx);
-  });
-  entry3.routes?.(app);
-}
-
-// src/helpers/parseRange.ts
-function parseRange(header, size) {
-  if (!header) return null;
-  const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
-  if (!match) return null;
-  const [, rawStart, rawEnd] = match;
-  if (rawStart === "" && rawEnd === "") return null;
-  let start;
-  let end;
-  if (rawStart === "") {
-    const n = Number(rawEnd);
-    if (n <= 0) return "unsatisfiable";
-    start = Math.max(0, size - n);
-    end = size - 1;
-  } else {
-    start = Number(rawStart);
-    end = rawEnd === "" ? size - 1 : Number(rawEnd);
-  }
-  if (!Number.isFinite(start) || !Number.isFinite(end)) return null;
-  if (size === 0 || start > end || start >= size) return "unsatisfiable";
-  return { start, end: Math.min(end, size - 1) };
+  if (!Number.isFinite(start) || !Number.isFinite(end)) return null;
+  if (size === 0 || start > end || start >= size) return "unsatisfiable";
+  return { start, end: Math.min(end, size - 1) };
 }
 
 // src/middle/assets.ts
-var CACHE_CONTROL = "public, max-age=3600";
+var DEFAULT_CACHE = "public, max-age=3600";
 async function assets(ctx) {
   if (!ctx.options.public) return;
   if (ctx.method !== "get" && ctx.method !== "head") return;
@@ -2510,8 +2113,10 @@ async function assets(ctx) {
     const meta2 = info ? await info() : null;
     if (info ? !meta2 : !await file2.exists()) return;
     const ext = ctx.url.pathname.split(".").pop()?.toLowerCase();
-    const ctype = ext && mimes_default[ext] || meta2?.type || ext;
-    const headers2 = { "cache-control": CACHE_CONTROL };
+    const ctype = mimeOf(ctx.url.pathname) || meta2?.type || ext;
+    const headers2 = {
+      "cache-control": resolveCache(ctx.options.cache) ?? DEFAULT_CACHE
+    };
     let tag;
     if (meta2) {
       const stamp = meta2.modified ? meta2.modified.getTime() : 0;
@@ -2577,30 +2182,10 @@ async function toJsonSchema(schema) {
     }
   } catch {
   }
-  return zodToSchema(schema);
-}
-function zodToSchema(schema) {
-  const type2 = schema?.def?.type || "string";
-  if (type2 === "object") {
-    const shape = schema.def.shape;
-    const properties = {};
-    const req = [];
-    for (const key in shape) {
-      const field = shape[key];
-      properties[key] = zodToSchema(field);
-      if (!field.isOptional() && !field.isNullable()) {
-        req.push(key);
-      }
-    }
-    const required = req.length ? req : void 0;
-    return { type: type2, properties, required };
-  }
-  if (type2 === "array") {
-    return { type: type2, items: zodToSchema(schema.def.element) };
-  }
-  return { type: type2 };
+  return void 0;
 }
-var pkgProm = fsp.readFile("package.json", "utf-8").then((data) => JSON.parse(data)).catch(() => ({}));
+var pkgProm;
+var getPkg = () => pkgProm ??= fsp.readFile("package.json", "utf-8").then((data) => JSON.parse(data)).catch(() => ({}));
 var generateOpenApiPaths = async (handlers, specPath) => {
   const paths = {};
   for (const [method, routes] of Object.entries(handlers)) {
@@ -2619,14 +2204,18 @@ var generateOpenApiPaths = async (handlers, specPath) => {
       let requestBody;
       if (meta2?.body) {
         const schema = await toJsonSchema(meta2.body);
-        requestBody = { content: { "application/json": { schema } } };
+        if (schema) {
+          requestBody = { content: { "application/json": { schema } } };
+        }
       }
       let responses;
       if (meta2?.response) {
         const schema = await toJsonSchema(meta2.response);
-        responses = {
-          200: { description: "OK", content: { "application/json": { schema } } }
-        };
+        if (schema) {
+          responses = {
+            200: { description: "OK", content: { "application/json": { schema } } }
+          };
+        }
       }
       const parameters = [];
       const matched = Array.from(path.matchAll(/:[\w()]+/gi));
@@ -2641,7 +2230,7 @@ var generateOpenApiPaths = async (handlers, specPath) => {
       });
       if (meta2?.query) {
         const schema = await toJsonSchema(meta2.query);
-        for (const [name, prop] of Object.entries(schema.properties ?? {})) {
+        for (const [name, prop] of Object.entries(schema?.properties ?? {})) {
           parameters.push({
             name,
             in: "query",
@@ -2663,7 +2252,7 @@ var generateOpenApiPaths = async (handlers, specPath) => {
   return paths;
 };
 var openapi_default = async (ctx) => {
-  const pkg = await pkgProm;
+  const pkg = await getPkg();
   const { title, description, version } = ctx.options.openapi ?? {};
   const domain = pkg.homepage || ctx.url.origin;
   return {
@@ -2681,43 +2270,743 @@ var openapi_default = async (ctx) => {
   };
 };
 
-// src/middle/preflight.ts
-function preflight(ctx) {
-  if (ctx.method !== "options") return;
-  if (!ctx.headers["access-control-request-method"]) return;
-  const handled = ctx.app.handlers.options.some(
-    (route) => pathPattern(route.path, ctx.url.pathname)
+// src/pipeline/pathPattern.ts
+function pathPattern(pattern, path) {
+  if (pattern === "*" && path === "/") return {};
+  pattern = `/${pattern.replace(/^\//, "")}`;
+  pattern = pattern.replace(/\/$/, "") || "/";
+  path = path.replace(/\/$/, "") || "/";
+  if (pattern === path) return {};
+  const params = {};
+  const pathParts = path.split("/").slice(1).map((u) => decodeURIComponent(u));
+  const pattParts = pattern.split("/").slice(1);
+  let allSame = true;
+  for (let i = 0; i < Math.max(pathParts.length, pattParts.length); i++) {
+    const patt = pattParts[i] || "";
+    const part = pathParts[i] || "";
+    const last = pattParts[pattParts.length - 1];
+    const key = patt.replace(/^:/, "").replace(/\?$/, "").replace(/\(\w*\)/, "");
+    if (patt === part) continue;
+    if (patt.endsWith("?") && !part) continue;
+    if (patt.startsWith(":")) {
+      params[key] = part;
+      if (/\(\w*\)/.test(patt)) {
+        if (patt.includes("(number)")) {
+          const value = Number(part);
+          params[key] = Number.isNaN(value) ? void 0 : value;
+        }
+        if (patt.includes("(date)")) {
+          const value = new Date(part);
+          params[key] = Number.isNaN(value.getTime()) ? void 0 : value;
+        }
+      }
+      continue;
+    }
+    if (!patt && last === "*" && part || patt === "*" && part) {
+      params["*"] = params["*"] || [];
+      params["*"].push(part);
+      continue;
+    }
+    allSame = false;
+  }
+  if (allSame) return params;
+  return null;
+}
+
+// src/middle/preflight.ts
+function preflight(ctx) {
+  if (ctx.method !== "options") return;
+  if (!ctx.headers["access-control-request-method"]) return;
+  const handled = ctx.app.handlers.options.some(
+    (route) => pathPattern(route.path, ctx.url.pathname)
+  );
+  if (handled) return;
+  return 204;
+}
+
+// src/middle/timer.ts
+var createTime = () => {
+  const times2 = [["init", performance.now()]];
+  const time = (name) => times2.push([name, performance.now()]);
+  time.times = times2;
+  time.headers = () => {
+    const r2 = (t) => Math.round(t);
+    const times3 = time.times;
+    const timing = times3.slice(1).map(([name, time2], i) => `${name};dur=${r2(time2 - times3[i][1])}`).join(", ");
+    return timing;
+  };
+  return time;
+};
+function timer(ctx) {
+  ctx.time = createTime();
+}
+
+// src/auth/socketUser.ts
+async function socketUser(app, headers2, cookies2) {
+  if (!app.settings.auth) return void 0;
+  const ctx = {
+    options: app.settings,
+    headers: headers2,
+    cookies: cookies2,
+    platform: app.platform,
+    app
+  };
+  return app.settings.auth.user(ctx);
+}
+
+// src/http/cors.ts
+var localhost = /^https?:\/\/localhost(:\d+)?$/;
+function cors(config2, origin = "") {
+  origin = origin?.toLowerCase();
+  if (config2 === true) return origin || null;
+  if (config2 === "*") return "*";
+  if (!origin) return null;
+  if (localhost.test(origin)) return origin;
+  const arr = typeof config2 === "string" ? config2.split(/\s*,\s*/g) : [];
+  if (arr.includes(origin)) return origin;
+  console.warn(`CORS: Origin "${origin}" not allowed. Allowed "${config2}"`);
+  return null;
+}
+function applyCors(res, ctx) {
+  const settings = ctx.options.cors;
+  if (!settings) return;
+  const requestOrigin = ctx.headers.origin || "";
+  let origin = cors(settings.origin, requestOrigin);
+  if (!origin) return;
+  if (settings.credentials && origin === "*") {
+    if (!requestOrigin) return;
+    origin = requestOrigin.toLowerCase();
+  }
+  res.headers.set("Access-Control-Allow-Origin", origin);
+  res.headers.set("Access-Control-Allow-Methods", settings.methods);
+  res.headers.set("Access-Control-Allow-Headers", settings.headers);
+  if (settings.credentials) {
+    res.headers.set("Access-Control-Allow-Credentials", "true");
+  }
+  if (origin !== "*") res.headers.append("Vary", "Origin");
+  if (ctx.method === "options") {
+    res.headers.set("Access-Control-Max-Age", "86400");
+  }
+}
+
+// src/pipeline/parseResponse.ts
+async function parseResponse(out, ctx) {
+  if (!out && typeof out !== "string") return null;
+  if (typeof out === "function") {
+    out = await out(ctx);
+    if (!out && typeof out !== "string") return null;
+  }
+  if (typeof out === "number") {
+    return new Response(null, { status: out });
+  }
+  if (!(out instanceof Response) || out.url) {
+    out = await send(out);
+  }
+  return out;
+}
+async function finalize(out, ctx) {
+  applyCors(out, ctx);
+  applySecurity(out, ctx);
+  out = await applyCache(out, ctx);
+  const stale = toClear(ctx);
+  if (stale) {
+    out.headers.append("set-cookie", clearCookie(stale));
+  }
+  if (ctx.time?.times?.length > 1) {
+    out.headers.set("Server-Timing", ctx.time.headers());
+  }
+  return out;
+}
+
+// src/body/bodyParts.ts
+var asIterable = (s) => s;
+function getMatching(string, regex) {
+  const matches2 = string.match(regex);
+  return matches2?.[1] ?? "";
+}
+function isProbablyText(buffer) {
+  for (let i = 0; i < Math.min(buffer.length, 512); i++) {
+    const byte = buffer[i];
+    if (byte === 0) return false;
+    if (byte < 7 || byte > 13 && byte < 32) return false;
+  }
+  return true;
+}
+var extByMime = {};
+for (const ext in mimes_default) extByMime[mimes_default[ext]] = ext;
+function addField(body, name, value) {
+  if (body[name] === void 0) {
+    body[name] = value;
+    return;
+  }
+  if (!Array.isArray(body[name])) body[name] = [body[name]];
+  body[name].push(value);
+}
+function makeFilePart(name, filename, declared, bucket2, limits, budget) {
+  return {
+    kind: "file",
+    name,
+    filename,
+    declared,
+    bucket: bucket2,
+    limits,
+    budget,
+    head: [],
+    headSize: 0,
+    opened: null,
+    size: 0
+  };
+}
+function startPart(headerStr, bucket2, limits, budget) {
+  const name = getMatching(headerStr, /name="(.+?)"/).trim().replace(/\[\]$/, "");
+  if (!name) return { kind: "skip" };
+  const filename = getMatching(headerStr, /filename="(.+?)"/).trim();
+  if (!filename) return { kind: "text", name, chunks: [] };
+  const type2 = getMatching(headerStr, /Content-Type:\s*([^\r\n]+)/i).trim() || "application/octet-stream";
+  if (bucket2 === false) return { kind: "drop" };
+  if (!bucket2) throw errors_default.UPLOAD_NOT_CONFIGURED({ name: filename });
+  budget.files++;
+  const { maxFiles } = limits;
+  if (maxFiles != null && budget.files > maxFiles) {
+    throw errors_default.UPLOAD_TOO_MANY_FILES({ limit: String(maxFiles) });
+  }
+  return makeFilePart(name, filename, type2, bucket2, limits, budget);
+}
+async function abortFile(part, error) {
+  if (part.opened) {
+    try {
+      part.opened.controller.error(error);
+      await part.opened.write.catch(() => {
+      });
+    } catch {
+    }
+    await part.opened.file.remove().catch(() => {
+    });
+  }
+  throw error;
+}
+async function checkSize(part, added) {
+  part.budget.used += added;
+  const { maxFileSize, maxTotalSize } = part.limits;
+  if (maxFileSize != null && part.size > parseBytes(maxFileSize)) {
+    await abortFile(
+      part,
+      errors_default.UPLOAD_TOO_LARGE({
+        name: part.filename,
+        size: String(part.size),
+        limit: String(maxFileSize)
+      })
+    );
+  }
+  if (maxTotalSize != null && part.budget.used > parseBytes(maxTotalSize)) {
+    await abortFile(
+      part,
+      errors_default.UPLOAD_TOO_LARGE({
+        name: part.filename,
+        size: String(part.budget.used),
+        limit: `${maxTotalSize} for the whole request`
+      })
+    );
+  }
+}
+function openFile(part) {
+  const head = Buffer.concat(part.head);
+  const sniffed = sniff(head);
+  const type2 = resolveType(sniffed, part.declared);
+  validateFile(part.filename, type2, part.limits, sniffed);
+  const ext = sniffed ? extByMime[type2] : void 0;
+  const id = `${createId()}${ext ? `.${ext}` : ""}`;
+  let controller;
+  const readable = new ReadableStream({
+    start(c) {
+      controller = c;
+    }
+  });
+  const file2 = part.bucket.file(id);
+  part.opened = { type: type2, file: file2, controller, write: file2.write(readable, { type: type2 }) };
+}
+async function feedPart(part, data) {
+  if (data.length === 0) return;
+  if (part.kind === "text") {
+    part.chunks.push(data);
+    return;
+  }
+  if (part.kind !== "file") return;
+  if (!part.opened) {
+    part.head.push(data);
+    part.headSize += data.length;
+    if (part.headSize < HEAD_SIZE) return;
+    openFile(part);
+    const head = Buffer.concat(part.head);
+    part.opened.controller.enqueue(head);
+    part.size += head.length;
+    await checkSize(part, head.length);
+    return;
+  }
+  part.opened.controller.enqueue(data);
+  part.size += data.length;
+  await checkSize(part, data.length);
+}
+async function endPart(part, body) {
+  if (part.kind === "text") {
+    const buf = Buffer.concat(part.chunks);
+    const value = isProbablyText(buf) ? buf.toString("utf-8").trim() : buf;
+    addField(body, part.name, value);
+    return;
+  }
+  if (part.kind !== "file") return;
+  if (!part.opened) {
+    openFile(part);
+    const head = Buffer.concat(part.head);
+    if (head.length) {
+      part.opened.controller.enqueue(head);
+      part.size += head.length;
+      await checkSize(part, head.length);
+    }
+  }
+  const opened = part.opened;
+  opened.controller.close();
+  await opened.write;
+  const { minSize } = part.limits;
+  if (minSize != null && part.size < parseBytes(minSize)) {
+    await opened.file.remove().catch(() => {
+    });
+    throw errors_default.UPLOAD_TOO_SMALL({
+      name: part.filename,
+      size: String(part.size),
+      limit: String(minSize)
+    });
+  }
+  addField(body, part.name, {
+    name: part.filename,
+    path: opened.file.path,
+    type: opened.type,
+    size: part.size
+  });
+}
+
+// src/body/multipart.ts
+function getBoundary(header) {
+  if (!header) return null;
+  for (const item of header.split(";")) {
+    const part = item.trim();
+    const eq = part.indexOf("=");
+    if (eq === -1) continue;
+    if (part.slice(0, eq).trim().toLowerCase() !== "boundary") continue;
+    const value = part.slice(eq + 1).trim().replace(/^"(.*)"$/, "$1");
+    return value || null;
+  }
+  return null;
+}
+var BREAK = Buffer.from("\r\n\r\n");
+async function parseMultipart(stream, boundary, bucket2, limits, max = INF) {
+  const budget = { used: 0, max: INF, files: 0 };
+  const delim = Buffer.from(`\r
+--${boundary}`);
+  const body = {};
+  let buf = Buffer.from("\r\n");
+  let state = "boundary";
+  let part = null;
+  let textBytes = 0;
+  const feed = (p, data) => {
+    if (p.kind === "text") {
+      textBytes += data.length;
+      if (textBytes > max) throw tooLarge(max);
+    }
+    return feedPart(p, data);
+  };
+  for await (const chunk of asIterable(stream)) {
+    buf = Buffer.concat([buf, Buffer.from(chunk)]);
+    let advanced = true;
+    while (advanced) {
+      advanced = false;
+      if (state === "boundary") {
+        const i = buf.indexOf(delim);
+        if (i === -1) {
+          if (buf.length >= delim.length) {
+            buf = buf.subarray(buf.length - delim.length + 1);
+          }
+          break;
+        }
+        if (buf.length < i + delim.length + 2) break;
+        const after = i + delim.length;
+        if (buf[after] === 45 && buf[after + 1] === 45) return body;
+        buf = buf.subarray(after + 2);
+        state = "headers";
+        advanced = true;
+      } else if (state === "headers") {
+        const i = buf.indexOf(BREAK);
+        if (i === -1) break;
+        part = startPart(buf.subarray(0, i).toString("utf-8"), bucket2, limits, budget);
+        buf = buf.subarray(i + BREAK.length);
+        state = "body";
+        advanced = true;
+      } else {
+        const i = buf.indexOf(delim);
+        if (i === -1) {
+          const safe = buf.length - (delim.length - 1);
+          if (safe > 0 && part) {
+            await feed(part, buf.subarray(0, safe));
+            buf = buf.subarray(safe);
+          }
+          break;
+        }
+        if (part) {
+          await feed(part, buf.subarray(0, i));
+          await endPart(part, body);
+          part = null;
+        }
+        buf = buf.subarray(i);
+        state = "boundary";
+        advanced = true;
+      }
+    }
+  }
+  if (part) await endPart(part, body);
+  return body;
+}
+
+// src/body/parseBody.ts
+function toStream(input) {
+  if (input instanceof ReadableStream) return input;
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue(input);
+      controller.close();
+    }
+  });
+}
+async function toBuffer(input, max = INF) {
+  if (!(input instanceof ReadableStream)) {
+    if (input.length > max) throw tooLarge(max);
+    return input;
+  }
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of asIterable(input)) {
+    total += chunk.byteLength;
+    if (total > max) throw tooLarge(max);
+    chunks.push(Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks);
+}
+function parseUrlEncoded(text) {
+  const out = {};
+  for (const [key, value] of new URLSearchParams(text)) {
+    const existing = out[key];
+    if (existing === void 0) out[key] = value;
+    else if (Array.isArray(existing)) existing.push(value);
+    else out[key] = [existing, value];
+  }
+  return out;
+}
+async function streamRawToBucket(stream, type2, bucket2, limits) {
+  const part = makeFilePart("body", "upload", type2, bucket2, limits, {
+    used: 0,
+    max: INF,
+    files: 0
+  });
+  for await (const chunk of asIterable(stream)) {
+    await feedPart(part, Buffer.from(chunk));
+  }
+  const body = {};
+  await endPart(part, body);
+  return part.size ? body.body : void 0;
+}
+async function parseBody(input, contentType, dest, max = INF, length) {
+  const type2 = Array.isArray(contentType) ? contentType[0] : contentType;
+  let bucket2;
+  let limits = {};
+  if (dest && typeof dest === "object" && "bucket" in dest) {
+    bucket2 = dest.bucket;
+    const { maxFileSize: maxFileSize2, maxTotalSize, maxFiles, minSize, fileType: fileType2 } = dest;
+    limits = { maxFileSize: maxFileSize2, maxTotalSize, maxFiles, minSize, fileType: fileType2 };
+  } else {
+    bucket2 = dest;
+  }
+  if (type2 && /multipart\/form-data/i.test(type2)) {
+    const boundary = getBoundary(type2);
+    if (!boundary) throw errors_default.BODY_INVALID_MULTIPART();
+    return parseMultipart(toStream(input), boundary, bucket2, limits, max);
+  }
+  if (!type2 || /^text\//i.test(type2)) {
+    const buf = await toBuffer(input, max);
+    return buf.length ? buf.toString("utf-8") : void 0;
+  }
+  if (/^application\/([\w.+-]+\+)?json\b/i.test(type2)) {
+    const buf = await toBuffer(input, max);
+    return buf.length ? JSON.parse(buf.toString("utf-8")) : void 0;
+  }
+  if (/application\/x-www-form-urlencoded/i.test(type2)) {
+    const buf = await toBuffer(input, max);
+    return buf.length ? parseUrlEncoded(buf.toString("utf-8")) : void 0;
+  }
+  if (bucket2 === false) {
+    const buf = await toBuffer(input, max);
+    return buf.length ? buf : void 0;
+  }
+  if (!bucket2) throw errors_default.UPLOAD_NOT_CONFIGURED({ name: "the request body" });
+  const { maxFileSize } = limits;
+  if (length != null && maxFileSize != null && length > parseBytes(maxFileSize)) {
+    throw errors_default.UPLOAD_TOO_LARGE({
+      name: "the request body",
+      size: String(length),
+      limit: String(maxFileSize)
+    });
+  }
+  return streamRawToBucket(toStream(input), type2, bucket2, limits);
+}
+
+// src/body/body.ts
+var sources = /* @__PURE__ */ new WeakMap();
+function setBodySource(ctx, source) {
+  sources.set(ctx, source);
+}
+async function resolveBody(ctx, mode = "parse", max = resolveMax(void 0)) {
+  const source = sources.get(ctx);
+  if (!source) return void 0;
+  const contentType = String(ctx.headers["content-type"] || "");
+  const isMultipart = /multipart\/form-data/i.test(contentType);
+  const declared = Number(ctx.headers["content-length"]);
+  const trustDeclared = !isMultipart && !ctx.options.uploads;
+  if (max !== INF && trustDeclared && declared > max) throw tooLarge(max);
+  if (mode === "stream") return source.getStream();
+  if (mode === "raw") {
+    const raw = await source.getBuffer();
+    if (raw.length > max) throw tooLarge(max);
+    if (!raw.length) return void 0;
+    if (!ctx.headers["content-length"]) {
+      ctx.headers["content-length"] = String(raw.length);
+    }
+    return raw;
+  }
+  const stream = source.getStream();
+  if (!stream) return void 0;
+  let size = 0;
+  const counted = stream.pipeThrough(
+    new TransformStream({
+      transform(chunk, controller) {
+        size += chunk.byteLength;
+        controller.enqueue(chunk);
+      }
+    })
+  );
+  const parsed = await parseBody(
+    counted,
+    ctx.headers["content-type"],
+    ctx.options.uploads,
+    max,
+    Number.isFinite(declared) ? declared : void 0
+  );
+  if (size && !ctx.headers["content-length"]) {
+    ctx.headers["content-length"] = String(size);
+  }
+  return parsed;
+}
+
+// src/util/define.ts
+function define(obj, key, cb) {
+  Object.defineProperty(obj, key, {
+    configurable: true,
+    get() {
+      const value = cb(obj);
+      Object.defineProperty(obj, key, {
+        configurable: true,
+        writable: true,
+        value
+      });
+      return obj[key];
+    }
+  });
+}
+
+// src/errors/ValidationError.ts
+var ValidationError = class extends errors_default {
+  source;
+  issues;
+  constructor(source, issues) {
+    const code = source === "response" ? "VALIDATION_FAILED" : "INVALID_REQUEST";
+    const { status: status2, message } = definition(code);
+    super(code, status2, message, { source });
+    this.source = source;
+    this.issues = issues;
+  }
+};
+
+// src/pipeline/validate.ts
+async function run(schema, value, source) {
+  const result = await schema["~standard"].validate(value);
+  if (result.issues) throw new ValidationError(source, result.issues);
+  return result.value;
+}
+async function validateRequest(ctx, options) {
+  if (options.body) {
+    ctx.body = await run(options.body, ctx.body ?? {}, "body");
+  }
+  if (options.query) {
+    const query = await run(options.query, ctx.url.query || {}, "query");
+    replace2(ctx.url.query, query);
+  }
+  if (options.params) {
+    const params = await run(options.params, ctx.url.params || {}, "params");
+    replace2(ctx.url.params, params);
+  }
+}
+async function validateResponse(out, options) {
+  if (!options.response) return out;
+  if (out?.constructor !== Object && !Array.isArray(out)) return out;
+  return await run(options.response, out, "response");
+}
+function replace2(target2, values) {
+  for (const key of Object.keys(target2)) delete target2[key];
+  Object.assign(target2, values);
+}
+
+// src/context/isValidMethod.ts
+var methods = [
+  "get",
+  "post",
+  "put",
+  "patch",
+  "delete",
+  "head",
+  "options",
+  "socket"
+];
+function isValidMethod(method) {
+  return methods.includes(method);
+}
+
+// src/pipeline/handleRequest.ts
+async function handleRequest(app, ctx) {
+  let res = await getResponse(app, ctx);
+  if (res) res = await finalize(res, ctx);
+  if (res && ctx.options.onResponse) {
+    const replaced = await ctx.options.onResponse(res, ctx);
+    if (replaced) res = replaced;
+  }
+  if (res) ctx.options.log.request(ctx, res);
+  if (res?.body && ctx.method === "head") {
+    res.body.cancel().catch(() => {
+    });
+    res = new Response(null, { status: res.status, headers: res.headers });
+  }
+  return res;
+}
+async function getResponse(app, ctx) {
+  try {
+    if (!isValidMethod(ctx.method)) {
+      throw errors_default.METHOD_NOT_ALLOWED({ method: ctx.method });
+    }
+    let matched = false;
+    const routes = ctx.method === "head" ? [...app.handlers.head, ...app.handlers.get] : app.handlers[ctx.method];
+    for (const route of routes) {
+      const params = pathPattern(route.path, ctx.url.pathname || "/");
+      if (!params) continue;
+      matched = true;
+      define(ctx.url, "params", () => params);
+      const { parser, cache: cache3, uploads } = route.options;
+      if (parser !== void 0 || cache3 !== void 0 || uploads !== void 0) {
+        ctx.options = { ...app.settings };
+        if (parser !== void 0) ctx.options.parser = parser;
+        if (cache3 !== void 0) ctx.options.cache = cache3;
+        if (uploads !== void 0) ctx.options.uploads = uploads;
+      }
+      checkTraversal(params, ctx);
+      ctx.body = await resolveBody(
+        ctx,
+        ctx.options.parser,
+        ctx.options.security.maxBodySize
+      );
+      await validateRequest(ctx, route.options);
+      for (const cb of route.fns) {
+        const res = await cb(ctx);
+        const out = await parseResponse(
+          await validateResponse(res, route.options),
+          ctx
+        );
+        if (out) return out;
+      }
+      break;
+    }
+    if (!matched) {
+      ctx.body = await resolveBody(
+        ctx,
+        ctx.options.parser,
+        ctx.options.security.maxBodySize
+      );
+      for (const mw of app.middleware) {
+        const out = await parseResponse(await mw(ctx), ctx);
+        if (out) return out;
+      }
+    }
+    if (ctx.platform.provider === "netlify") return;
+    throw errors_default.NOT_FOUND();
+  } catch (error) {
+    return ctx.options.onError(error, ctx);
+  }
+}
+
+// src/http/parseCookies.ts
+function parseCookies(cookies2) {
+  if (!cookies2) return {};
+  const cookieStr = Array.isArray(cookies2) ? cookies2[0] : cookies2;
+  if (!cookieStr) return {};
+  return Object.fromEntries(
+    cookieStr.split(/;\s*/).map((part) => {
+      const [key, ...rest] = part.split("=");
+      const value = rest.join("=");
+      try {
+        return [key, decodeURIComponent(value)];
+      } catch {
+        return [key, value];
+      }
+    })
   );
-  if (handled) return;
-  return 204;
 }
 
-// src/middle/timer.ts
-var createTime = () => {
-  const times2 = [["init", performance.now()]];
-  const time = (name) => times2.push([name, performance.now()]);
-  time.times = times2;
-  time.headers = () => {
-    const r2 = (t) => Math.round(t);
-    const times3 = time.times;
-    const timing = times3.slice(1).map(([name, time2], i) => `${name};dur=${r2(time2 - times3[i][1])}`).join(", ");
-    return timing;
-  };
-  return time;
+// src/http/parseHeaders.ts
+var parseHeaders_default = (raw) => {
+  const headers2 = {};
+  raw.forEach((value, originalKey) => {
+    const key = originalKey.toLowerCase();
+    if (headers2[key]) {
+      if (!Array.isArray(headers2[key])) {
+        headers2[key] = [headers2[key]];
+      }
+      headers2[key].push(value);
+    } else {
+      headers2[key] = value;
+    }
+  });
+  return headers2;
 };
-function timer(ctx) {
-  ctx.time = createTime();
-}
 
-// src/auth/socketUser.ts
-async function socketUser(app, headers2, cookies2) {
-  if (!app.settings.auth) return void 0;
-  const ctx = { options: app.settings, headers: headers2, cookies: cookies2 };
-  return app.settings.auth.user(ctx);
+// src/context/writeResponse.ts
+async function writeResponse(out, response) {
+  response.writeHead(out.status || 200, parseHeaders_default(out.headers));
+  try {
+    if (out.body instanceof ReadableStream) {
+      const reader = out.body.getReader();
+      response.on("close", () => reader.cancel().catch(() => {
+      }));
+      while (true) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        response.write(value);
+      }
+    } else {
+      response.write(out.body || "");
+    }
+    response.end();
+  } catch {
+    if (!response.destroyed) response.destroy();
+  }
 }
 
-// src/helpers/wsNode.ts
+// src/ws/wsNode.ts
 var GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
+var MAX_MESSAGE = 16 * 1024 ** 2;
 var CONTINUATION = 0;
 var TEXT = 1;
 var BINARY = 2;
@@ -2747,6 +3036,7 @@ var NodeWebSocket = class {
   handlers;
   buffer;
   fragments;
+  fragmentSize;
   fragmentOpcode;
   closed;
   readyState;
@@ -2758,6 +3048,7 @@ var NodeWebSocket = class {
     this.handlers = handlers;
     this.buffer = Buffer.alloc(0);
     this.fragments = [];
+    this.fragmentSize = 0;
     this.fragmentOpcode = TEXT;
     this.closed = false;
     this.readyState = 1;
@@ -2811,6 +3102,10 @@ var NodeWebSocket = class {
         len = Number(buf.readBigUInt64BE(2));
         offset = 10;
       }
+      if (len > MAX_MESSAGE) {
+        this.close(1009, "Message too big");
+        return;
+      }
       let mask = null;
       if (masked) {
         if (buf.length < offset + 4) return;
@@ -2838,13 +3133,22 @@ var NodeWebSocket = class {
     if (opcode === PONG) return;
     if (opcode === CONTINUATION) {
       this.fragments.push(payload);
+      this.fragmentSize += payload.length;
     } else {
       this.fragments = [payload];
+      this.fragmentSize = payload.length;
       this.fragmentOpcode = opcode;
     }
+    if (this.fragmentSize > MAX_MESSAGE) {
+      this.fragments = [];
+      this.fragmentSize = 0;
+      this.close(1009, "Message too big");
+      return;
+    }
     if (!fin) return;
     const full = this.fragments.length === 1 ? this.fragments[0] : Buffer.concat(this.fragments);
     this.fragments = [];
+    this.fragmentSize = 0;
     const body = this.fragmentOpcode === TEXT ? full.toString("utf8") : full;
     this.handlers.onMessage(body);
   }
@@ -2896,54 +3200,63 @@ Sec-WebSocket-Accept: ${accept}\r
 // src/context/node.ts
 import { TLSSocket } from "tls";
 
-// src/context/isValidMethod.ts
-var methods = [
-  "get",
-  "post",
-  "put",
-  "patch",
-  "delete",
-  "head",
-  "options",
-  "socket"
-];
-function isValidMethod(method) {
-  return methods.includes(method);
+// src/http/clientIp.ts
+var first = (v) => (Array.isArray(v) ? v[0] : v) || "";
+var normalize = (ip) => ip.replace(/^::ffff:/, "");
+function clientIp(headers2, opts = {}) {
+  const { remoteAddress = "", trustProxy = false } = opts;
+  const cf = first(headers2["cf-connecting-ip"]);
+  if (cf) return normalize(cf);
+  const nf = first(headers2["x-nf-client-connection-ip"]);
+  if (nf) return normalize(nf);
+  if (trustProxy) {
+    const xff = first(headers2["x-forwarded-for"]);
+    if (xff) return normalize(xff.split(",")[0].trim());
+    const real = first(headers2["x-real-ip"]);
+    if (real) return normalize(real);
+  }
+  return normalize(remoteAddress);
 }
 
-// src/context/node.ts
-var chunkArray = (arr) => arr.length > 2 ? [[arr[0], arr[1]], ...chunkArray(arr.slice(2))] : [arr];
-async function createNode(req, app, signal = new AbortController().signal) {
-  const init = performance.now();
-  const method = req.method?.toLowerCase() || "get";
-  if (!isValidMethod(method)) {
-    throw new Error(`Invalid HTTP method: ${method}`);
+// src/http/forwarded.ts
+var first2 = (value) => {
+  const one = Array.isArray(value) ? value[0] : value;
+  return one?.split(",")[0].trim() || void 0;
+};
+function forwarded(url, headers2, trustProxy) {
+  if (!trustProxy) return;
+  const proto = first2(headers2["x-forwarded-proto"]);
+  if (proto === "http" || proto === "https") url.protocol = `${proto}:`;
+  const host = first2(headers2["x-forwarded-host"]);
+  const port = first2(headers2["x-forwarded-port"]);
+  if (host?.includes(":")) {
+    url.host = host;
+  } else if (host) {
+    url.hostname = host;
+    url.port = port ?? "";
+  } else if (port) {
+    url.port = port;
   }
-  const chunks = chunkArray(req.rawHeaders);
-  const headers2 = parseHeaders_default(new Headers(chunks));
+}
+
+// src/context/create.ts
+function createContext(app, { method: rawMethod, headers: rawHeaders, url: rawUrl, signal, remoteAddress, source }) {
+  const init = performance.now();
+  const method = rawMethod?.toLowerCase() || "get";
+  const headers2 = parseHeaders_default(rawHeaders);
   const cookies2 = parseCookies(headers2.cookie);
-  const scheme = req.socket instanceof TLSSocket ? "https" : "http";
-  const host = headers2.host || `localhost:${app.settings.port}`;
-  const path = (req.url || "/").replace(/\/$/, "") || "/";
-  const baseUrl = `${scheme}://${host}`;
-  const url = new URL(path, baseUrl);
+  const url = new URL(rawUrl.replace(/\/$/, ""));
   forwarded(url, headers2, app.settings.security.trustProxy);
   define(
     url,
     "query",
     (url2) => Object.fromEntries(url2.searchParams.entries())
   );
-  const source = {
-    getBuffer: () => new Promise((resolve, reject) => {
-      const chunks2 = [];
-      req.on("data", (chunk) => chunks2.push(chunk)).on("end", () => resolve(Buffer.concat(chunks2))).on("error", reject);
-    }),
-    getStream: () => toWeb(req)
-  };
   const ctx = {
     options: app.settings,
     platform: app.platform,
     url,
+    // Possibly not a real Method: handleRequest rejects it inside its boundary
     method,
     body: void 0,
     headers: headers2,
@@ -2952,7 +3265,7 @@ async function createNode(req, app, signal = new AbortController().signal) {
     init,
     app,
     ip: clientIp(headers2, {
-      remoteAddress: req.socket.remoteAddress || "",
+      remoteAddress,
       trustProxy: app.settings.security.trustProxy
     })
   };
@@ -2960,45 +3273,43 @@ async function createNode(req, app, signal = new AbortController().signal) {
   return ctx;
 }
 
+// src/context/node.ts
+var chunkArray = (arr) => arr.length > 2 ? [[arr[0], arr[1]], ...chunkArray(arr.slice(2))] : [arr];
+async function createNode(req, app, signal = new AbortController().signal) {
+  const headers2 = new Headers(chunkArray(req.rawHeaders));
+  const scheme = req.socket instanceof TLSSocket ? "https" : "http";
+  const host = headers2.get("host") || `localhost:${app.settings.port}`;
+  return createContext(app, {
+    method: req.method || "get",
+    headers: headers2,
+    url: `${scheme}://${host}${req.url || "/"}`,
+    signal,
+    remoteAddress: req.socket.remoteAddress || "",
+    source: {
+      getBuffer: () => new Promise((resolve, reject) => {
+        const chunks = [];
+        req.on("data", (chunk) => chunks.push(chunk)).on("end", () => resolve(Buffer.concat(chunks))).on("error", reject);
+      }),
+      // Normalize the node stream to the web ReadableStream every reader expects
+      getStream: () => toWeb(req)
+    }
+  });
+}
+
 // src/context/winter.ts
 async function createWinter(req, app, server2) {
-  const init = performance.now();
-  const method = req.method.toLowerCase();
-  if (!isValidMethod(method)) {
-    throw new Error(`Invalid HTTP method: ${method}`);
-  }
-  const headers2 = parseHeaders_default(req.headers);
-  const cookies2 = parseCookies(headers2.cookie);
-  const baseUrl = req.url.replace(/\/$/, "") || "/";
-  const url = new URL(baseUrl);
-  forwarded(url, headers2, app.settings.security.trustProxy);
-  define(
-    url,
-    "query",
-    (url2) => Object.fromEntries(url2.searchParams.entries())
-  );
-  const source = {
-    getBuffer: async () => Buffer.from(await req.arrayBuffer()),
-    getStream: () => req.body ?? void 0
-  };
-  const ctx = {
-    options: app.settings,
-    platform: app.platform,
-    url,
-    method,
-    body: void 0,
-    headers: headers2,
-    cookies: cookies2,
+  return createContext(app, {
+    method: req.method,
+    headers: req.headers,
+    url: req.url,
     signal: req.signal,
-    init,
-    app,
-    ip: clientIp(headers2, {
-      remoteAddress: server2?.requestIP?.(req)?.address || "",
-      trustProxy: app.settings.security.trustProxy
-    })
-  };
-  setBodySource(ctx, source);
-  return ctx;
+    remoteAddress: server2?.requestIP?.(req)?.address || "",
+    source: {
+      // req.body is already a web ReadableStream, so no conversion is needed
+      getBuffer: async () => Buffer.from(await req.arrayBuffer()),
+      getStream: () => req.body ?? void 0
+    }
+  });
 }
 
 // src/context/handlers.ts
@@ -3017,10 +3328,14 @@ var Winter = async (app, request, env2) => {
       if (env2.upgrade(request, { data: { user } })) return;
     }
   }
-  Object.assign(globalThis.env, env2);
-  const ctx = await createWinter(request, app, env2);
-  const res = await handleRequest(app, ctx);
-  return res;
+  const isRuntimeServer = typeof env2?.upgrade === "function" || typeof env2?.requestIP === "function";
+  if (env2 && !isRuntimeServer) Object.assign(globalThis.env, env2);
+  try {
+    const ctx = await createWinter(request, app, env2);
+    return await handleRequest(app, ctx);
+  } catch {
+    return new Response("Server Error", { status: 500 });
+  }
 };
 var Node = async (app) => {
   const http = await import("http");
@@ -3030,27 +3345,16 @@ var Node = async (app) => {
       response.on("close", () => {
         if (!response.writableFinished) controller.abort();
       });
-      const ctx = await createNode(request, app, controller.signal);
-      if ("error" in ctx) throw ctx.error;
-      const out = await handleRequest(app, ctx);
-      response.writeHead(out.status || 200, parseHeaders_default(out.headers));
+      let out;
       try {
-        if (out.body instanceof ReadableStream) {
-          const reader = out.body.getReader();
-          response.on("close", () => reader.cancel().catch(() => {
-          }));
-          while (true) {
-            const { value, done } = await reader.read();
-            if (done) break;
-            response.write(value);
-          }
-        } else {
-          response.write(out.body || "");
-        }
-        response.end();
+        const ctx = await createNode(request, app, controller.signal);
+        out = await handleRequest(app, ctx);
       } catch {
-        if (!response.destroyed) response.destroy();
+        response.writeHead(500);
+        response.end("Server Error");
+        return;
       }
+      await writeResponse(out, response);
     }
   );
   await attachWebsocket(server2, app);
@@ -3059,115 +3363,14 @@ var Node = async (app) => {
   });
   return server2;
 };
-var Netlify = async (app, request, context) => {
-  request.context = context;
-  if (typeof Netlify === "undefined") {
-    throw new Error("Netlify doesn't exist");
-  }
-  const ctx = await createWinter(request, app);
-  const res = await handleRequest(app, ctx);
-  return res;
-};
-
-// src/router.ts
-function checkParserConflict(options, globalParser) {
-  const parser = options.parser ?? globalParser ?? "parse";
-  if (options.body && parser !== "parse") {
-    throw new Error(
-      `A \`parser: '${parser}'\` route never parses the body, so its \`body\` schema cannot run. Remove one, or set \`parser: 'parse'\` on the route.`
-    );
-  }
-}
-var Router = class _Router {
-  // Cross-cutting middleware added with .use(); they run on every request
-  middleware = [];
-  // Routes per method, each carrying its own (already-flattened) chain of fns
-  handlers = {
-    socket: [],
-    get: [],
-    head: [],
-    post: [],
-    put: [],
-    patch: [],
-    delete: [],
-    options: []
-  };
-  // For the router we can just return itself since it's not the final export,
-  // but then on the root it'll return some fancy wrappers
-  self() {
-    return this;
-  }
-  // Registers one route: bakes the current middleware + the route's own
-  // functions into a single flat `fns` list. A plain options object may sit
-  // between the path and the handlers, and it's pulled out here.
-  handle(method, pathOrFn, ...rest) {
-    let path = "*";
-    if (typeof pathOrFn === "string") {
-      path = pathOrFn;
-    } else if (pathOrFn != null) {
-      rest.unshift(pathOrFn);
-    }
-    let options = {};
-    if (rest[0] != null && typeof rest[0] !== "function") {
-      options = rest.shift();
-    }
-    checkParserConflict(options, this.settings?.parser);
-    if (options.uploads !== void 0) {
-      options.uploads = resolveUploads(options.uploads);
-    }
-    const base = method === "socket" ? [] : this.middleware;
-    const fns = [...base, ...rest].filter((fn) => fn != null);
-    this.handlers[method].push({ path, options, fns });
-    return this.self();
-  }
-  socket(pathOrMid, optionsOrMid, ...middleware) {
-    return this.handle("socket", pathOrMid, optionsOrMid, ...middleware);
-  }
-  get(pathOrMid, optionsOrMid, ...middleware) {
-    return this.handle("get", pathOrMid, optionsOrMid, ...middleware);
-  }
-  head(pathOrMid, optionsOrMid, ...middleware) {
-    return this.handle("head", pathOrMid, optionsOrMid, ...middleware);
-  }
-  post(pathOrMid, optionsOrMid, ...middleware) {
-    return this.handle("post", pathOrMid, optionsOrMid, ...middleware);
-  }
-  put(pathOrMid, optionsOrMid, ...middleware) {
-    return this.handle("put", pathOrMid, optionsOrMid, ...middleware);
-  }
-  patch(pathOrMid, optionsOrMid, ...middleware) {
-    return this.handle("patch", pathOrMid, optionsOrMid, ...middleware);
-  }
-  delete(pathOrMid, optionsOrMid, ...middleware) {
-    return this.handle("delete", pathOrMid, optionsOrMid, ...middleware);
-  }
-  options(pathOrMid, optionsOrMid, ...middleware) {
-    return this.handle("options", pathOrMid, optionsOrMid, ...middleware);
-  }
-  use(...args) {
-    for (const arg of args) {
-      if (arg instanceof _Router) {
-        for (const m of Object.keys(arg.handlers)) {
-          for (const route of arg.handlers[m]) {
-            checkParserConflict(route.options, this.settings?.parser);
-            const base = m === "socket" ? [] : this.middleware;
-            this.handlers[m].push({
-              path: route.path,
-              options: route.options,
-              fns: [...base, ...route.fns]
-            });
-          }
-        }
-      } else {
-        this.middleware.push(arg);
-      }
-    }
-    return this.self();
+var Netlify = async (app, request, _context) => {
+  try {
+    const ctx = await createWinter(request, app);
+    return await handleRequest(app, ctx);
+  } catch {
+    return new Response("Server Error", { status: 500 });
   }
 };
-function router() {
-  return new Router();
-}
 
 // src/ServerTest.ts
 function isSerializable(body) {
@@ -3184,10 +3387,11 @@ function isSerializable(body) {
 function ServerTest(app) {
   const port = app.settings.port;
   const fetch2 = async (method, path, options = {}) => {
-    if (!options.headers) options.headers = {};
-    if (isSerializable(options.body)) {
-      options.headers["content-type"] = "application/json";
-      options.body = JSON.stringify(options.body);
+    const headers2 = new Headers(options.headers);
+    let body = options.body;
+    if (isSerializable(body)) {
+      headers2.set("content-type", "application/json");
+      body = JSON.stringify(body);
     }
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path) && !/^https?:\/\//i.test(path)) {
       throw new Error(
@@ -3197,8 +3401,10 @@ function ServerTest(app) {
     const url = /^https?:\/\//i.test(path) ? path : `http://localhost:${port}${path}`;
     return await app.fetch(
       new Request(url, {
+        ...options,
         method,
-        ...options
+        headers: headers2,
+        body
       })
     );
   };
@@ -3216,7 +3422,6 @@ function ServerTest(app) {
 // src/index.ts
 import { default as default2 } from "bucket";
 var Server = class extends Router {
-  settings;
   platform;
   sockets;
   websocket;
@@ -3231,7 +3436,7 @@ var Server = class extends Router {
     this.sockets = [];
     this.websocket = createWebsocket(this.sockets, this.handlers);
     if (this.platform.runtime === "node") {
-      this.node();
+      this.node().catch((error) => console.error("[server:start]", error));
     } else if (this.platform.runtime === "bun") {
       this.settings.log.start(`http://localhost:${this.settings.port}/`);
     }
@@ -3277,7 +3482,7 @@ function server(options) {
 }
 export {
   Server,
-  ServerError_default as ServerError,
+  errors_default as ServerError,
   ValidationError,
   default2 as bucket,
   cache,