@usetoki/toki 0.1.1

package/dist/middleware.js

@@ -0,0 +1,133 @@
+import { brotliCompress, constants, gzip } from "node:zlib";
+import { promisify } from "node:util";
+import { rawResponse, reply } from "./response.js";
+const gzipAsync = promisify(gzip);
+const brotliAsync = promisify(brotliCompress);
+// text + text-like only; compressing already-compressed bytes wastes cpu
+function isCompressible(contentType) {
+    return /^text\/|^application\/(json|javascript|xml|wasm|.*\+json|.*\+xml)|^image\/svg/.test(contentType);
+}
+// coding allowed when its token (or `*`) is present with q != 0 — mirrors the
+// native static negotiator so dynamic responses honor `Accept-Encoding: br;q=0`.
+function acceptsEncoding(accept, coding) {
+    for (const part of accept.split(",")) {
+        const segment = part.trim();
+        const semi = segment.indexOf(";");
+        const name = (semi === -1 ? segment : segment.slice(0, semi)).trim().toLowerCase();
+        if (name !== coding && name !== "*") {
+            continue;
+        }
+        if (semi !== -1) {
+            const q = /q=([\d.]+)/.exec(segment.slice(semi + 1));
+            if (q !== null && Number(q[1]) === 0) {
+                continue;
+            }
+        }
+        return true;
+    }
+    return false;
+}
+const DEFAULT_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS"];
+// returns the ACAO value, or null to omit the header entirely
+function resolveOrigin(requestOrigin, options) {
+    const allowed = options.origin ?? "*";
+    if (allowed === "*") {
+        return "*";
+    }
+    if (requestOrigin === null) {
+        return null;
+    }
+    if (typeof allowed === "string") {
+        return allowed;
+    }
+    if (Array.isArray(allowed)) {
+        return allowed.includes(requestOrigin) ? requestOrigin : null;
+    }
+    return allowed(requestOrigin) ? requestOrigin : null;
+}
+/** CORS headers for actual (non-preflight) requests. */
+export function corsHeaders(options = {}) {
+    return (req) => {
+        const origin = resolveOrigin(req.headers.get("origin"), options);
+        if (origin !== null) {
+            req.setResponseHeader("Access-Control-Allow-Origin", origin);
+            if (origin !== "*") {
+                // reflected origin varies per request; caches must key on it
+                req.appendResponseHeader("Vary", "Origin");
+            }
+        }
+        if (options.credentials) {
+            req.setResponseHeader("Access-Control-Allow-Credentials", "true");
+        }
+        if (options.exposedHeaders?.length) {
+            req.setResponseHeader("Access-Control-Expose-Headers", options.exposedHeaders.join(", "));
+        }
+    };
+}
+/** Answers a CORS preflight `OPTIONS` with `204`. */
+export function corsPreflight(options = {}) {
+    return (req) => {
+        const origin = resolveOrigin(req.headers.get("origin"), options);
+        if (origin !== null) {
+            req.setResponseHeader("Access-Control-Allow-Origin", origin);
+        }
+        if (options.credentials) {
+            req.setResponseHeader("Access-Control-Allow-Credentials", "true");
+        }
+        req.setResponseHeader("Access-Control-Allow-Methods", (options.methods ?? DEFAULT_METHODS).join(", "));
+        const requested = req.headers.get("access-control-request-headers");
+        req.setResponseHeader("Access-Control-Allow-Headers", options.allowedHeaders?.join(", ") ?? requested ?? "*");
+        if (options.maxAge !== undefined) {
+            req.setResponseHeader("Access-Control-Max-Age", String(options.maxAge));
+        }
+        return reply.empty(204);
+    };
+}
+/** onResponse hook: brotli/gzip per `Accept-Encoding`, off the event loop (libuv pool). */
+export function compression(options = {}) {
+    const threshold = options.threshold ?? 1024;
+    const gzipLevel = options.gzipLevel ?? 6;
+    const brotliQuality = options.brotliQuality ?? 5;
+    return async (req, res) => {
+        if (typeof res.body !== "string" || Buffer.byteLength(res.body) < threshold) {
+            return;
+        }
+        if (!isCompressible(res.contentType)) {
+            return;
+        }
+        const accept = req.headers.get("accept-encoding") ?? "";
+        const encoding = acceptsEncoding(accept, "br")
+            ? "br"
+            : acceptsEncoding(accept, "gzip")
+                ? "gzip"
+                : null;
+        if (encoding === null) {
+            return;
+        }
+        const input = Buffer.from(res.body);
+        const compressed = encoding === "br"
+            ? await brotliAsync(input, { params: { [constants.BROTLI_PARAM_QUALITY]: brotliQuality } })
+            : await gzipAsync(input, { level: gzipLevel });
+        return rawResponse(res.status, res.contentType, new Uint8Array(compressed), [
+            ...res.headers,
+            ["Content-Encoding", encoding],
+            ["Vary", "Accept-Encoding"],
+        ]);
+    };
+}
+/** Baseline hardening headers on every response. */
+export function securityHeaders(options = {}) {
+    return (req) => {
+        req.setResponseHeader("X-Content-Type-Options", "nosniff");
+        req.setResponseHeader("X-Frame-Options", options.frameOptions ?? "DENY");
+        req.setResponseHeader("Referrer-Policy", options.referrerPolicy ?? "no-referrer");
+        if (options.hsts) {
+            const maxAge = options.hsts === true ? 15552000 : options.hsts;
+            req.setResponseHeader("Strict-Transport-Security", `max-age=${maxAge}; includeSubDomains`);
+        }
+        if (options.csp) {
+            req.setResponseHeader("Content-Security-Policy", options.csp);
+        }
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../ts/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGnD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAClC,MAAM,WAAW,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;AAE9C,yEAAyE;AACzE,SAAS,cAAc,CAAC,WAAmB;IACzC,OAAO,+EAA+E,CAAC,IAAI,CACzF,WAAW,CACZ,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,iFAAiF;AACjF,SAAS,eAAe,CAAC,MAAc,EAAE,MAAc;IACrD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnF,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACpC,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;YAChB,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAa7E,8DAA8D;AAC9D,SAAS,aAAa,CAAC,aAA4B,EAAE,OAAoB;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;IACtC,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACpB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IACD,OAAO,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,WAAW,CAAC,UAAuB,EAAE;IACnD,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,iBAAiB,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,6DAA6D;gBAC7D,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,GAAG,CAAC,iBAAiB,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,iBAAiB,CAAC,+BAA+B,EAAE,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAAC,UAAuB,EAAE;IACrD,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,iBAAiB,CAAC,6BAA6B,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,GAAG,CAAC,iBAAiB,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,GAAG,CAAC,iBAAiB,CACnB,8BAA8B,EAC9B,CAAC,OAAO,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAChD,CAAC;QACF,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QACpE,GAAG,CAAC,iBAAiB,CACnB,8BAA8B,EAC9B,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,IAAI,GAAG,CACvD,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,GAAG,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;AACJ,CAAC;AAuBD,2FAA2F;AAC3F,MAAM,UAAU,WAAW,CAAC,UAA8B,EAAE;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;IACjD,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC;YAC5E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC;YAC5C,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC;gBAC/B,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,UAAU,GACd,QAAQ,KAAK,IAAI;YACf,CAAC,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,oBAAoB,CAAC,EAAE,aAAa,EAAE,EAAE,CAAC;YAC3F,CAAC,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnD,OAAO,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE;YAC1E,GAAG,GAAG,CAAC,OAAO;YACd,CAAC,kBAAkB,EAAE,QAAQ,CAAC;YAC9B,CAAC,MAAM,EAAE,iBAAiB,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,eAAe,CAAC,UAA2B,EAAE;IAC3D,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,GAAG,CAAC,iBAAiB,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC3D,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,CAAC;QACzE,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,OAAO,CAAC,cAAc,IAAI,aAAa,CAAC,CAAC;QAClF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YAC/D,GAAG,CAAC,iBAAiB,CAAC,2BAA2B,EAAE,WAAW,MAAM,qBAAqB,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,GAAG,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/native.d.ts

@@ -0,0 +1,81 @@
+/** request handed to the dispatcher; strings decoded lazily by JS */
+export interface NativeRequest {
+    readonly method: string;
+    readonly path: string;
+    /** raw query after `?`, empty when absent */
+    readonly query: string;
+    /** `Name: Value\r\n` lines */
+    readonly rawHeaders: string;
+    /** index into handler array; `0xFFFFFFFF` is the not-found handler */
+    readonly routeIndex: number;
+    /** token for {@link Native.submitResponse} */
+    readonly dispatchId: number;
+    readonly ip: string;
+    /** captured `:param`/`*` values, `null` for routes with none */
+    readonly params: Record<string, string> | null;
+    /** external view over the engine's buffer; valid only during dispatch */
+    readonly body: Uint8Array | null;
+}
+/** dispatcher return; `headers` is a pre-joined block, engine owns status line + Content-Length + Connection */
+export interface NativeResponse {
+    status?: number;
+    headers?: string;
+    body?: string | Uint8Array;
+}
+/** static file for the engine; native derives MIME/ETag/headers, TS supplies bytes + mtime + cache policy */
+export interface StaticEntry {
+    readonly path: string;
+    readonly body: Uint8Array;
+    /** also feeds the ETag */
+    readonly mtimeMs: number;
+    readonly cacheControl: string;
+    /** served when `Accept-Encoding` permits */
+    readonly gzip?: Uint8Array;
+    readonly brotli?: Uint8Array;
+}
+/** server tuning for {@link Toki.listen} */
+export interface ServerOptions {
+    /** default `"0.0.0.0"` */
+    host?: string;
+    /** default 1 MiB */
+    maxBodyBytes?: number;
+    /** close a stalled (no-data) connection after this; 0 disables */
+    headerTimeoutMs?: number;
+    /** default 128 */
+    maxHeaders?: number;
+    /** pending-connection queue, default 512 */
+    backlog?: number;
+    /** `SO_REUSEPORT` so workers can share the port (kernel-balanced; Linux/BSD) */
+    reusePort?: boolean;
+    /** dispatch unmatched routes to JS; set automatically when a not-found handler exists */
+    notFound?: boolean;
+    /** native per-IP limit: `max` per `windowMs`, over-limit gets a native 429 before JS */
+    rateLimit?: {
+        max: number;
+        windowMs: number;
+    };
+    /** @internal flattened {@link ServerOptions.rateLimit} */
+    rateLimitMax?: number;
+    /** @internal */
+    rateLimitWindowMs?: number;
+}
+interface Native {
+    /**
+     * Serve routes (parallel `methods`/`paths`) plus `staticEntries`. `dispatch` returns a
+     * {@link NativeResponse} for sync, or `undefined` to defer to {@link Native.submitResponse};
+     * a GET/HEAD route miss falls back to the static table.
+     */
+    listen(port: number, methods: string[], paths: string[], dispatch: (req: NativeRequest) => NativeResponse | undefined, staticEntries: StaticEntry[], options: ServerOptions): number;
+    /** complete a deferred handler */
+    submitResponse(dispatchId: number, response: NativeResponse): void;
+    /** begin a chunked response; writes the head */
+    startStream(dispatchId: number, status: number, headers: string): void;
+    /** write one chunk; returns queued-byte backlog, or -1 if the connection is gone */
+    writeStreamChunk(dispatchId: number, chunk: Uint8Array): number;
+    /** terminating chunk, then resume/close the connection */
+    endStream(dispatchId: number): void;
+    /** stop accepting and close every live connection */
+    close(): void;
+}
+export declare const native: Native;
+export {};

package/dist/native.js

@@ -0,0 +1,38 @@
+// sole entry point to the Zig addon
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const require = createRequire(import.meta.url);
+const root = join(dirname(fileURLToPath(import.meta.url)), "..");
+// process.platform/arch → the package + filename suffix the release builds publish.
+function nativeTriple() {
+    const { platform, arch } = process;
+    if (platform === "win32")
+        return `win32-${arch}-msvc`;
+    if (platform === "linux")
+        return `linux-${arch}-gnu`;
+    return `${platform}-${arch}`;
+}
+// Local source build (zig-out) first, then a binary bundled beside the loader, then
+// the per-platform npm package installed as an optional dependency.
+function loadNative() {
+    const triple = nativeTriple();
+    const attempts = [
+        ["zig-out/toki.node", () => require(join(root, "zig-out", "toki.node"))],
+        [`toki.${triple}.node`, () => require(join(root, `toki.${triple}.node`))],
+        [`@usetoki/toki-${triple}`, () => require(`@usetoki/toki-${triple}`)],
+    ];
+    const errors = [];
+    for (const [name, load] of attempts) {
+        try {
+            return load();
+        }
+        catch (error) {
+            errors.push(`  ${name}: ${error.message}`);
+        }
+    }
+    throw new Error(`toki: no native binary for ${process.platform}-${process.arch}. Tried:\n${errors.join("\n")}\n` +
+        "Use a supported platform, or build from source with `npm run build`.");
+}
+export const native = loadNative();
+//# sourceMappingURL=native.js.map

package/dist/native.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../ts/native.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AA0FjE,oFAAoF;AACpF,SAAS,YAAY;IACnB,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACnC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,IAAI,OAAO,CAAC;IACtD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,IAAI,MAAM,CAAC;IACrD,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,oFAAoF;AACpF,oEAAoE;AACpE,SAAS,UAAU;IACjB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAA4C;QACxD,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QACxE,CAAC,QAAQ,MAAM,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC,iBAAiB,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;KACtE,CAAC;IACF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,EAAY,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,8BAA8B,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,aAAa,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;QAC9F,sEAAsE,CACzE,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAW,UAAU,EAAE,CAAC"}

package/dist/pipeline.d.ts

@@ -0,0 +1,16 @@
+import type { TokiRequest } from "./request.js";
+import { type JSONSchema, type RouteSchema } from "./schema.js";
+import type { HandlerResult, Middleware, ResponseHook, SerializationHook, TokiResponse } from "./types.js";
+export declare function isThenable<T>(value: unknown): value is Promise<T>;
+/** What `materialize` needs off a compiled route — a CompiledRoute satisfies it. */
+interface ResultShape {
+    readonly responseSchemas?: Record<number, JSONSchema>;
+    readonly defaultStatus?: number;
+}
+export declare function materialize(result: HandlerResult, route: ResultShape): TokiResponse;
+export declare function validationStep(schema: RouteSchema): Middleware;
+export declare function contentTypeMatcher(type: string | RegExp): (contentType: string) => boolean;
+export declare function runBefore(steps: readonly Middleware[], req: TokiRequest, start: number): HandlerResult | undefined | Promise<HandlerResult | undefined>;
+export declare function runSerialization(hooks: readonly SerializationHook[], req: TokiRequest, payload: unknown, start: number): unknown | Promise<unknown>;
+export declare function runAfter(hooks: readonly ResponseHook[], req: TokiRequest, res: TokiResponse, start: number): TokiResponse | Promise<TokiResponse>;
+export {};

package/dist/pipeline.js

@@ -0,0 +1,125 @@
+import { isTokiResponse, jsonResponse, normalize, reply } from "./response.js";
+import { serialize, validate } from "./schema.js";
+export function isThenable(value) {
+    return (value != null &&
+        (typeof value === "object" || typeof value === "function") &&
+        typeof value.then === "function");
+}
+// turn a handler result into a response; plain values serialize as JSON, via the
+// route's response schema when one is present
+export function materialize(result, route) {
+    if (isTokiResponse(result)) {
+        return result;
+    }
+    const status = route.defaultStatus ?? 200;
+    if (typeof result === "string") {
+        return reply.text(result, status);
+    }
+    const schema = route.responseSchemas?.[status];
+    return jsonResponse(schema ? serialize(schema, result) : JSON.stringify(result), status);
+}
+// before-step: validate the request against `schema`, short-circuiting 400
+export function validationStep(schema) {
+    return (req) => {
+        const errors = validateRequest(req, schema);
+        if (errors.length > 0) {
+            return reply.json({ statusCode: 400, error: "Bad Request", message: errors.join("; "), errors }, 400);
+        }
+    };
+}
+function validateRequest(req, schema) {
+    const errors = [];
+    if (schema.params) {
+        errors.push(...validate(schema.params, coerce(schema.params, { ...req.params }), "params"));
+    }
+    if (schema.query) {
+        errors.push(...validate(schema.query, coerce(schema.query, fromEntries(req.query)), "query"));
+    }
+    if (schema.headers) {
+        errors.push(...validate(schema.headers, fromEntries(req.headers), "headers"));
+    }
+    if (schema.body) {
+        let body;
+        try {
+            body = req.json();
+        }
+        catch {
+            return [...errors, "body must be valid JSON"];
+        }
+        errors.push(...validate(schema.body, body, "body"));
+    }
+    return errors;
+}
+function fromEntries(source) {
+    return Object.fromEntries(source.entries());
+}
+// coerce string-valued fields (query/params) to the type their schema declares
+function coerce(schema, obj) {
+    if (!schema.properties) {
+        return obj;
+    }
+    const out = { ...obj };
+    for (const [key, sub] of Object.entries(schema.properties)) {
+        const value = out[key];
+        if (typeof value !== "string") {
+            continue;
+        }
+        if (sub.type === "number" || sub.type === "integer") {
+            const n = Number(value);
+            if (!Number.isNaN(n))
+                out[key] = n;
+        }
+        else if (sub.type === "boolean" && (value === "true" || value === "false")) {
+            out[key] = value === "true";
+        }
+    }
+    return out;
+}
+// content-type predicate: a RegExp, "*" for any, or a case-insensitive prefix
+export function contentTypeMatcher(type) {
+    if (type instanceof RegExp) {
+        return (contentType) => type.test(contentType);
+    }
+    if (type === "*") {
+        return () => true;
+    }
+    const lower = type.toLowerCase();
+    return (contentType) => contentType.startsWith(lower);
+}
+// pipeline runners — each stays sync until a step returns a Promise, then chains
+export function runBefore(steps, req, start) {
+    for (let i = start; i < steps.length; i++) {
+        const out = steps[i](req);
+        if (isThenable(out)) {
+            return out.then((value) => (value != null ? value : runBefore(steps, req, i + 1)));
+        }
+        if (out != null) {
+            return out;
+        }
+    }
+    return undefined;
+}
+// thread a payload through the preSerialization hooks; each returns the next payload
+export function runSerialization(hooks, req, payload, start) {
+    for (let i = start; i < hooks.length; i++) {
+        const out = hooks[i](req, payload);
+        if (isThenable(out)) {
+            return out.then((value) => runSerialization(hooks, req, value, i + 1));
+        }
+        payload = out;
+    }
+    return payload;
+}
+export function runAfter(hooks, req, res, start) {
+    for (let i = start; i < hooks.length; i++) {
+        const out = hooks[i](req, res);
+        if (isThenable(out)) {
+            return out.then((value) => runAfter(hooks, req, value != null ? normalize(value) : res, i + 1));
+        }
+        if (out != null) {
+            res = normalize(out);
+        }
+    }
+    return res;
+}
+//# sourceMappingURL=pipeline.js.map

package/dist/pipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline.js","sourceRoot":"","sources":["../ts/pipeline.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC/E,OAAO,EAAqC,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AASrF,MAAM,UAAU,UAAU,CAAI,KAAc;IAC1C,OAAO,CACL,KAAK,IAAI,IAAI;QACb,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC;QAC1D,OAAQ,KAA4B,CAAC,IAAI,KAAK,UAAU,CACzD,CAAC;AACJ,CAAC;AAQD,iFAAiF;AACjF,8CAA8C;AAC9C,MAAM,UAAU,WAAW,CAAC,MAAqB,EAAE,KAAkB;IACnE,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,IAAI,GAAG,CAAC;IAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/C,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AAC3F,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,OAAO,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CACf,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAC7E,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAgB,EAAE,MAAmB;IAC5D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,GAAG,MAAM,EAAE,yBAAyB,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,MAEpB;IACC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,+EAA+E;AAC/E,SAAS,MAAM,CAAC,MAAkB,EAAE,GAA4B;IAC9D,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,GAAG,GAAG,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,KAAK,MAAM,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,IAAI,IAAI,YAAY,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;IACpB,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,SAAS,CACvB,KAA4B,EAC5B,GAAgB,EAChB,KAAa;IAEb,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,gBAAgB,CAC9B,KAAmC,EACnC,GAAgB,EAChB,OAAgB,EAChB,KAAa;IAEb,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,GAAG,GAAG,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,KAA8B,EAC9B,GAAgB,EAChB,GAAiB,EACjB,KAAa;IAEb,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;YAChB,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/request.d.ts

@@ -0,0 +1,65 @@
+import { type CookieOptions } from "./cookies.js";
+import { type ParsedForm } from "./forms.js";
+import type { NativeRequest } from "./native.js";
+import type { ContentTypeParserEntry, Logger, RouteMethod } from "./types.js";
+/** Per-request context the dispatcher supplies; kept off the hot fields. */
+interface RequestContext {
+    readonly log: Logger;
+    /** Content-type parsers in effect for this route (nearest scope first). */
+    readonly parsers?: readonly ContentTypeParserEntry[];
+}
+/**
+ * An incoming request handed to a handler. Query/headers parsed lazily.
+ * Backed by an engine-owned buffer — valid only during the handler call;
+ * read the body before any `await`.
+ */
+export declare class TokiRequest {
+    #private;
+    /** The HTTP method, e.g. `"GET"`. */
+    readonly method: RouteMethod;
+    /** The path, without the query string, e.g. `"/users/42"`. */
+    readonly path: string;
+    /** The raw request body, or `null` when there is none. */
+    readonly body: Uint8Array | null;
+    /** The peer IP address. */
+    readonly ip: string;
+    /** A {@link Logger} for this request; silent unless a logger was configured. */
+    readonly log: Logger;
+    constructor(raw: NativeRequest, context?: RequestContext);
+    /** The request host (from the `Host` header), without the port. */
+    get hostname(): string;
+    /** `"https"` when forwarded as such by a proxy, else `"http"`. */
+    get protocol(): string;
+    /** A short id unique within this process run; generated on first read. */
+    get id(): string;
+    /** Params captured from the route pattern (`:id`, `*`); an absent key reads as `undefined`. */
+    get params(): Readonly<Record<string, string | undefined>>;
+    /** The parsed query string. */
+    get query(): URLSearchParams;
+    /** The request headers. */
+    get headers(): Headers;
+    /** Stage a response header, replacing any previously staged value for `name`. */
+    setResponseHeader(name: string, value: string): this;
+    /** Stage a response header, appending rather than replacing (e.g. `Set-Cookie`). */
+    appendResponseHeader(name: string, value: string): this;
+    /** Cookies parsed from the `Cookie` header; an absent key reads as `undefined`. */
+    get cookies(): Readonly<Record<string, string | undefined>>;
+    /** Set a cookie on the response (staged as a `Set-Cookie` header). */
+    setCookie(name: string, value: string, options?: CookieOptions): this;
+    /** Clear a cookie by setting it expired. */
+    clearCookie(name: string, options?: CookieOptions): this;
+    /** @internal Read by the dispatcher; not intended for handler use. */
+    get stagedResponseHeaders(): ReadonlyArray<readonly [string, string]>;
+    /** Decode the body as UTF-8 text, or `""` when there is none. */
+    text(): string;
+    /** Parse the body as JSON. `T` is an unchecked assertion; throws on malformed input. */
+    json<T = unknown>(): T;
+    /** Body parsed as a form (urlencoded/multipart); null for any other content type. */
+    get form(): ParsedForm | null;
+    /**
+     * Body parsed by the matching content-type parser, falling back to built-ins
+     * (JSON/text/forms) else raw bytes. Cached; `undefined` when no body. `T` unchecked.
+     */
+    parseBody<T = unknown>(): Promise<T>;
+}
+export {};

package/dist/request.js

@@ -0,0 +1,170 @@
+import { parseCookies, serializeCookie } from "./cookies.js";
+import { parseForm } from "./forms.js";
+import { silentLogger } from "./logger.js";
+let sequence = 0;
+const NO_PARSERS = [];
+/**
+ * An incoming request handed to a handler. Query/headers parsed lazily.
+ * Backed by an engine-owned buffer — valid only during the handler call;
+ * read the body before any `await`.
+ */
+export class TokiRequest {
+    /** The HTTP method, e.g. `"GET"`. */
+    method;
+    /** The path, without the query string, e.g. `"/users/42"`. */
+    path;
+    /** The raw request body, or `null` when there is none. */
+    body;
+    /** The peer IP address. */
+    ip;
+    /** A {@link Logger} for this request; silent unless a logger was configured. */
+    log;
+    // backs the lazy accessors; reshaped only on first read
+    #raw;
+    #parsers;
+    constructor(raw, context) {
+        this.#raw = raw;
+        this.method = raw.method;
+        this.path = raw.path;
+        this.body = raw.body;
+        this.ip = raw.ip;
+        this.log = context?.log ?? silentLogger;
+        this.#parsers = context?.parsers ?? NO_PARSERS;
+    }
+    /** The request host (from the `Host` header), without the port. */
+    get hostname() {
+        const host = this.headers.get("host") ?? "";
+        const colon = host.lastIndexOf(":");
+        return colon === -1 ? host : host.slice(0, colon);
+    }
+    /** `"https"` when forwarded as such by a proxy, else `"http"`. */
+    get protocol() {
+        return this.headers.get("x-forwarded-proto") ?? "http";
+    }
+    #id;
+    #params;
+    #query;
+    #headers;
+    #cookies;
+    /** A short id unique within this process run; generated on first read. */
+    get id() {
+        return (this.#id ??= (sequence++).toString(36));
+    }
+    /** Params captured from the route pattern (`:id`, `*`); an absent key reads as `undefined`. */
+    get params() {
+        return (this.#params ??= Object.freeze(this.#raw.params ?? {}));
+    }
+    /** The parsed query string. */
+    get query() {
+        return (this.#query ??= new URLSearchParams(this.#raw.query));
+    }
+    /** The request headers. */
+    get headers() {
+        if (this.#headers === undefined) {
+            const headers = new Headers();
+            for (const line of this.#raw.rawHeaders.split("\r\n")) {
+                const colon = line.indexOf(":");
+                if (colon === -1) {
+                    continue;
+                }
+                headers.append(line.slice(0, colon), line.slice(colon + 1).trimStart());
+            }
+            this.#headers = headers;
+        }
+        return this.#headers;
+    }
+    // pre-handler can stage headers before the response exists; dispatcher merges them,
+    // response's own headers win on conflict
+    #staged;
+    /** Stage a response header, replacing any previously staged value for `name`. */
+    setResponseHeader(name, value) {
+        const staged = (this.#staged ??= []);
+        const lower = name.toLowerCase();
+        for (let i = 0; i < staged.length; i++) {
+            if (staged[i][0].toLowerCase() === lower) {
+                staged[i] = [name, value];
+                return this;
+            }
+        }
+        staged.push([name, value]);
+        return this;
+    }
+    /** Stage a response header, appending rather than replacing (e.g. `Set-Cookie`). */
+    appendResponseHeader(name, value) {
+        (this.#staged ??= []).push([name, value]);
+        return this;
+    }
+    /** Cookies parsed from the `Cookie` header; an absent key reads as `undefined`. */
+    get cookies() {
+        if (this.#cookies === undefined) {
+            const header = this.headers.get("cookie");
+            this.#cookies = header ? parseCookies(header) : Object.freeze({});
+        }
+        return this.#cookies;
+    }
+    /** Set a cookie on the response (staged as a `Set-Cookie` header). */
+    setCookie(name, value, options) {
+        return this.appendResponseHeader("Set-Cookie", serializeCookie(name, value, options));
+    }
+    /** Clear a cookie by setting it expired. */
+    clearCookie(name, options) {
+        return this.setCookie(name, "", { ...options, maxAge: 0, expires: new Date(0) });
+    }
+    /** @internal Read by the dispatcher; not intended for handler use. */
+    get stagedResponseHeaders() {
+        return this.#staged ?? [];
+    }
+    /** Decode the body as UTF-8 text, or `""` when there is none. */
+    text() {
+        return this.body ? new TextDecoder().decode(this.body) : "";
+    }
+    /** Parse the body as JSON. `T` is an unchecked assertion; throws on malformed input. */
+    json() {
+        return JSON.parse(this.text());
+    }
+    #form;
+    /** Body parsed as a form (urlencoded/multipart); null for any other content type. */
+    get form() {
+        if (this.#form === undefined) {
+            this.#form = this.body ? parseForm(this.headers.get("content-type") ?? "", this.body) : null;
+        }
+        return this.#form;
+    }
+    #parsedDone = false;
+    #parsedValue;
+    /**
+     * Body parsed by the matching content-type parser, falling back to built-ins
+     * (JSON/text/forms) else raw bytes. Cached; `undefined` when no body. `T` unchecked.
+     */
+    async parseBody() {
+        if (!this.#parsedDone) {
+            this.#parsedValue = await this.#runParse();
+            this.#parsedDone = true;
+        }
+        return this.#parsedValue;
+    }
+    #runParse() {
+        const body = this.body;
+        if (!body) {
+            return undefined;
+        }
+        const contentType = (this.headers.get("content-type") ?? "").toLowerCase();
+        for (const entry of this.#parsers) {
+            if (entry.test(contentType)) {
+                return entry.parser(this, body);
+            }
+        }
+        if (contentType.startsWith("application/json") || contentType.includes("+json")) {
+            return this.json();
+        }
+        if (contentType.startsWith("text/")) {
+            return this.text();
+        }
+        if (contentType.startsWith("application/x-www-form-urlencoded") ||
+            contentType.startsWith("multipart/form-data")) {
+            return this.form;
+        }
+        return body;
+    }
+}
+//# sourceMappingURL=request.js.map