@znight/http 0.0.0-stage → 0.1.0

package/dist/node-io-BY1ZDLRQ.mjs

@@ -0,0 +1,1566 @@
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { AsyncLocalStorage } from "node:async_hooks";
+// src/status.ts
+/** Standard reason phrases (RFC 9110 and common extensions), used in error bodies. */
+const REASONS = {
+	100: "Continue",
+	101: "Switching Protocols",
+	102: "Processing",
+	103: "Early Hints",
+	200: "OK",
+	201: "Created",
+	202: "Accepted",
+	203: "Non-Authoritative Information",
+	204: "No Content",
+	205: "Reset Content",
+	206: "Partial Content",
+	207: "Multi-Status",
+	300: "Multiple Choices",
+	301: "Moved Permanently",
+	302: "Found",
+	303: "See Other",
+	304: "Not Modified",
+	307: "Temporary Redirect",
+	308: "Permanent Redirect",
+	400: "Bad Request",
+	401: "Unauthorized",
+	402: "Payment Required",
+	403: "Forbidden",
+	404: "Not Found",
+	405: "Method Not Allowed",
+	406: "Not Acceptable",
+	407: "Proxy Authentication Required",
+	408: "Request Timeout",
+	409: "Conflict",
+	410: "Gone",
+	411: "Length Required",
+	412: "Precondition Failed",
+	413: "Payload Too Large",
+	414: "URI Too Long",
+	415: "Unsupported Media Type",
+	416: "Range Not Satisfiable",
+	417: "Expectation Failed",
+	418: "I'm a Teapot",
+	421: "Misdirected Request",
+	422: "Unprocessable Entity",
+	423: "Locked",
+	424: "Failed Dependency",
+	425: "Too Early",
+	426: "Upgrade Required",
+	428: "Precondition Required",
+	429: "Too Many Requests",
+	431: "Request Header Fields Too Large",
+	451: "Unavailable For Legal Reasons",
+	500: "Internal Server Error",
+	501: "Not Implemented",
+	502: "Bad Gateway",
+	503: "Service Unavailable",
+	504: "Gateway Timeout",
+	505: "HTTP Version Not Supported",
+	507: "Insufficient Storage",
+	508: "Loop Detected",
+	511: "Network Authentication Required"
+};
+/** Reason phrase of `status` (`404` → `Not Found`), or a generic one for unknown codes. */
+function statusText(status) {
+	const reason = REASONS[status];
+	if (reason !== void 0) return reason;
+	if (status >= 500) return "Server Error";
+	return status >= 400 ? "Client Error" : "Unknown Status";
+}
+/** Whether `status` is an integer in the 100–599 range. */
+function isValidStatus(status) {
+	return typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599;
+}
+/** Statuses whose responses never have a body. */
+function isBodylessStatus(status) {
+	return status === 204 || status === 304 || status >= 100 && status < 200;
+}
+// src/exceptions.ts
+const NO_HEADERS = Object.freeze({});
+/**
+* An error carrying an HTTP status. Thrown from handlers, guards, interceptors or services, it is
+* rendered as `{ statusCode, error, message, details? }` with its status and headers.
+*
+* ```ts
+* throw new HttpException(409, 'Email already used', { field: 'email' })
+* throw new NotFoundException(`User ${id} not found`)
+* throw new UnauthorizedException('Token expired', undefined, { headers: { 'www-authenticate': 'Bearer' } })
+* ```
+*
+* Invalid statuses (not an integer in 100–599) become `500`.
+*/
+var HttpException = class extends Error {
+	/** HTTP status of the response. */
+	status;
+	/** Structured details rendered in the body (omitted when `undefined`). */
+	details;
+	/** Headers added to the response. */
+	headers;
+	constructor(status, message, details, options = {}) {
+		const code = isValidStatus(status) ? status : 500;
+		super(message ?? statusText(code), options.cause === void 0 ? void 0 : { cause: options.cause });
+		this.name = "HttpException";
+		this.status = code;
+		this.details = details;
+		this.headers = options.headers ?? NO_HEADERS;
+	}
+	/** The `statusCode` field of the body (alias of {@link status}). */
+	get statusCode() {
+		return this.status;
+	}
+	/** Body of the error response. Override it in a subclass to change the shape. */
+	toBody() {
+		const body = {
+			statusCode: this.status,
+			error: statusText(this.status),
+			message: this.message
+		};
+		if (this.details !== void 0) body.details = this.details;
+		return body;
+	}
+};
+/** Whether `value` is an {@link HttpException} (also across duplicated package copies). */
+function isHttpException(value) {
+	return value instanceof HttpException || value instanceof Error && typeof value.status === "number" && typeof value.toBody === "function";
+}
+/** 400 Bad Request. */
+var BadRequestException = class extends HttpException {
+	constructor(message, details, options) {
+		super(400, message, details, options);
+		this.name = "BadRequestException";
+	}
+};
+/**
+* 400 Bad Request raised when an input fails its schema (`@Body(schema)`, `@Query(schema)`...).
+* `details` lists the issues as `{ path, message }`; the raw Standard Schema issues are kept in
+* {@link issues} for exception mappers.
+*/
+var ValidationException = class extends BadRequestException {
+	/** What was validated: `body`, `query`, `query "page"`, `param "id"`... */
+	location;
+	issues;
+	constructor(location, issues, options) {
+		super(`Invalid ${location}`, issues.map(toIssueDetail), options);
+		this.name = "ValidationException";
+		this.location = location;
+		this.issues = issues;
+	}
+};
+/**
+* The `details` of a 400 raised by the framework for one invalid input (a multipart field...): the
+* shape of the issues of {@link ValidationException}, documented by `@znight/openapi`.
+*/
+function issue(path, message) {
+	return [{
+		path,
+		message
+	}];
+}
+/** Converts a Standard Schema issue to `{ path, message }` (`path` dotted, `''` for the root). */
+function toIssueDetail(issue) {
+	return {
+		path: formatIssuePath(issue.path),
+		message: issue.message
+	};
+}
+function formatIssuePath(path) {
+	if (path === void 0 || path.length === 0) return "";
+	let result = "";
+	for (const segment of path) {
+		const key = typeof segment === "object" && segment !== null ? segment.key : segment;
+		const text = typeof key === "symbol" ? key.description ?? "symbol" : String(key);
+		result = result === "" ? text : `${result}.${text}`;
+	}
+	return result;
+}
+/** 401 Unauthorized. */
+var UnauthorizedException = class extends HttpException {
+	constructor(message, details, options) {
+		super(401, message, details, options);
+		this.name = "UnauthorizedException";
+	}
+};
+/** 403 Forbidden (also the response of a guard returning `false`). */
+var ForbiddenException = class extends HttpException {
+	constructor(message, details, options) {
+		super(403, message, details, options);
+		this.name = "ForbiddenException";
+	}
+};
+/** 404 Not Found. */
+var NotFoundException = class extends HttpException {
+	constructor(message, details, options) {
+		super(404, message, details, options);
+		this.name = "NotFoundException";
+	}
+};
+/** 405 Method Not Allowed (pass the `allow` header in `options.headers`). */
+var MethodNotAllowedException = class extends HttpException {
+	constructor(message, details, options) {
+		super(405, message, details, options);
+		this.name = "MethodNotAllowedException";
+	}
+};
+/** 409 Conflict. */
+var ConflictException = class extends HttpException {
+	constructor(message, details, options) {
+		super(409, message, details, options);
+		this.name = "ConflictException";
+	}
+};
+/** 410 Gone. */
+var GoneException = class extends HttpException {
+	constructor(message, details, options) {
+		super(410, message, details, options);
+		this.name = "GoneException";
+	}
+};
+/** 413 Payload Too Large (request body above `bodyLimit`). */
+var PayloadTooLargeException = class extends HttpException {
+	constructor(message, details, options) {
+		super(413, message, details, options);
+		this.name = "PayloadTooLargeException";
+	}
+};
+/** 415 Unsupported Media Type. */
+var UnsupportedMediaTypeException = class extends HttpException {
+	constructor(message, details, options) {
+		super(415, message, details, options);
+		this.name = "UnsupportedMediaTypeException";
+	}
+};
+/** 422 Unprocessable Entity. */
+var UnprocessableEntityException = class extends HttpException {
+	constructor(message, details, options) {
+		super(422, message, details, options);
+		this.name = "UnprocessableEntityException";
+	}
+};
+/** 429 Too Many Requests (pass `retry-after` in `options.headers`). */
+var TooManyRequestsException = class extends HttpException {
+	constructor(message, details, options) {
+		super(429, message, details, options);
+		this.name = "TooManyRequestsException";
+	}
+};
+/** 500 Internal Server Error (its message is always sent, unlike unexpected errors). */
+var InternalServerErrorException = class extends HttpException {
+	constructor(message, details, options) {
+		super(500, message, details, options);
+		this.name = "InternalServerErrorException";
+	}
+};
+/** 501 Not Implemented. */
+var NotImplementedException = class extends HttpException {
+	constructor(message, details, options) {
+		super(501, message, details, options);
+		this.name = "NotImplementedException";
+	}
+};
+/** 502 Bad Gateway. */
+var BadGatewayException = class extends HttpException {
+	constructor(message, details, options) {
+		super(502, message, details, options);
+		this.name = "BadGatewayException";
+	}
+};
+/** 503 Service Unavailable. */
+var ServiceUnavailableException = class extends HttpException {
+	constructor(message, details, options) {
+		super(503, message, details, options);
+		this.name = "ServiceUnavailableException";
+	}
+};
+/** 504 Gateway Timeout. */
+var GatewayTimeoutException = class extends HttpException {
+	constructor(message, details, options) {
+		super(504, message, details, options);
+		this.name = "GatewayTimeoutException";
+	}
+};
+// src/stream.ts
+/**
+* Web stream helpers shared by the pipeline and the adapters (internal): conversion of handler
+* stream sources (`ReadableStream`, Node.js `Readable`, async iterables) to byte streams, tracking of
+* response streams (request scope lifetime) and small constructors.
+*/
+const ENCODER = new TextEncoder();
+/** The current async context, to run stream reads in it later (the request scope of a response). */
+function captureContext() {
+	const snapshot = AsyncLocalStorage.snapshot;
+	return typeof snapshot === "function" ? snapshot() : (run) => run();
+}
+/** Whether `value` is a stream source (Web stream, Node.js readable or async iterable). */
+function isStreamSource(value) {
+	return value instanceof ReadableStream || value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function";
+}
+/** Byte streams created by {@link toByteStream} (already normalised: not wrapped again). */
+const BYTE_STREAMS = /* @__PURE__ */ new WeakSet();
+/** Whether `stream` was created by {@link toByteStream}. */
+function isByteStream(stream) {
+	return BYTE_STREAMS.has(stream);
+}
+/**
+* Converts a stream source to a pull-based byte stream: the source is read only when the consumer
+* reads (backpressure), strings are encoded as UTF-8, `ArrayBuffer`s and views are converted, empty
+* chunks are skipped and cancelling the stream cancels the source (`iterator.return()`, which
+* destroys a Node.js `Readable`; a `Readable` that was never read is destroyed directly).
+*
+* @throws TypeError (as a stream error) for chunks that are neither bytes nor strings.
+*/
+function toByteStream(source) {
+	let iterator;
+	let reader;
+	const next = () => {
+		if (source instanceof ReadableStream) {
+			const current = reader ?? source.getReader();
+			reader = current;
+			return current.read();
+		}
+		iterator ??= source[Symbol.asyncIterator]();
+		return iterator.next();
+	};
+	const stream = new ReadableStream({
+		async pull(controller) {
+			for (;;) {
+				const result = await next();
+				if (result.done === true) {
+					controller.close();
+					return;
+				}
+				const chunk = toChunk(result.value);
+				if (chunk.byteLength > 0) {
+					controller.enqueue(chunk);
+					return;
+				}
+			}
+		},
+		async cancel(reason) {
+			if (reader !== void 0) await reader.cancel(reason);
+			else if (source instanceof ReadableStream) await source.cancel(reason);
+			else if (iterator === void 0) {
+				const destroyable = source;
+				if (typeof destroyable.destroy === "function") destroyable.destroy();
+			} else await iterator.return?.(reason);
+		}
+	}, { highWaterMark: 0 });
+	BYTE_STREAMS.add(stream);
+	return stream;
+}
+function toChunk(value) {
+	if (value instanceof Uint8Array) return value;
+	if (typeof value === "string") return ENCODER.encode(value);
+	if (value instanceof ArrayBuffer) return new Uint8Array(value);
+	if (ArrayBuffer.isView(value)) return new Uint8Array(value.buffer, value.byteOffset, value.byteLength);
+	throw new TypeError(`Invalid stream chunk: expected a Uint8Array or a string, received ${value === null ? "null" : typeof value}`);
+}
+/**
+* Wraps a response body so that the pipeline knows when it has been fully sent (or abandoned) and
+* reads the source in `run` (the async context of the request scope, so that stream producers can
+* use request-scoped providers). The wrapper is pull-based (no read-ahead): backpressure is the
+* consumer's. A `Blob` is read through `blob.stream()`, opened on the first read only. `onCancel`
+* runs when the consumer cancels the stream (the client left), before the source is cancelled.
+*/
+function trackStream(body, run, onCancel) {
+	let reader = body instanceof Blob ? void 0 : body.getReader();
+	let settle = () => void 0;
+	const done = new Promise((resolve) => {
+		settle = resolve;
+	});
+	let finished = false;
+	const finish = (error) => {
+		if (finished) return;
+		finished = true;
+		settle(error);
+	};
+	return {
+		stream: new ReadableStream({
+			async pull(controller) {
+				let result;
+				try {
+					result = await run(() => {
+						reader ??= body.stream().getReader();
+						return reader.read();
+					});
+				} catch (error) {
+					finish(error);
+					throw error;
+				}
+				if (result.done === true) {
+					controller.close();
+					finish();
+					return;
+				}
+				controller.enqueue(result.value);
+			},
+			async cancel(reason) {
+				onCancel?.();
+				try {
+					const current = reader;
+					if (current !== void 0) await run(() => current.cancel(reason));
+				} catch {} finally {
+					finish();
+				}
+			}
+		}, { highWaterMark: 0 }),
+		done
+	};
+}
+/** A stream failing with `error` on first read. */
+function failedStream(error) {
+	return new ReadableStream({ start(controller) {
+		controller.error(error);
+	} });
+}
+/** Cancels a stream, ignoring failures (unconsumed response bodies). */
+function discardStream(stream) {
+	if (stream instanceof ReadableStream && !stream.locked) stream.cancel().catch(() => void 0);
+}
+// src/cookies.ts
+/** The secure defaults: `Path=/; Secure; HttpOnly; SameSite=Lax`, host-only. */
+const DEFAULT_COOKIE_OPTIONS = Object.freeze({
+	path: "/",
+	secure: true,
+	httpOnly: true,
+	sameSite: "lax"
+});
+/** Largest `name=value` (bytes on the wire, after encoding and signing). */
+const MAX_COOKIE_SIZE = 4096;
+/** Largest `Domain` / `Path` attribute value (bytes). */
+const MAX_COOKIE_ATTRIBUTE_SIZE = 1024;
+const MAX_DOMAIN_LENGTH = 253;
+const EPOCH = "Thu, 01 Jan 1970 00:00:00 GMT";
+/** Years a cookie-date can carry (RFC 6265 §5.1.1; four digits in an IMF-fixdate). */
+const MIN_EXPIRES_YEAR = 1601;
+const MAX_EXPIRES_YEAR = 9999;
+const OPTION_KEYS = /* @__PURE__ */ new Set([
+	"maxAge",
+	"expires",
+	"domain",
+	"path",
+	"secure",
+	"httpOnly",
+	"sameSite",
+	"partitioned",
+	"priority",
+	"signed"
+]);
+const SAME_SITE = {
+	strict: "Strict",
+	lax: "Lax",
+	none: "None"
+};
+const PRIORITY = {
+	low: "Low",
+	medium: "Medium",
+	high: "High"
+};
+/**
+* Parses a `cookie` request header into a prototype-less, frozen record (`__proto__` is just a
+* name). Pairs are split on `;` only (never `,`) and trimmed; a pair without `=` or with an empty
+* name is ignored; names are kept as sent (case-sensitive); a value wrapped in double quotes is
+* unquoted, and percent-decoded when it contains `%` (a malformed sequence keeps the raw value).
+* When a name repeats, the first occurrence wins (browsers send the most specific path first).
+* Linear time, never throws.
+*/
+function parseCookieHeader(header) {
+	const result = Object.create(null);
+	if (typeof header === "string") {
+		let start = 0;
+		const length = header.length;
+		let equals = -1;
+		while (start < length) {
+			let end = header.indexOf(";", start);
+			if (end === -1) end = length;
+			if (equals < start) {
+				equals = header.indexOf("=", start);
+				if (equals === -1) equals = length;
+			}
+			if (equals < end) {
+				const name = trim(header, start, equals);
+				if (name !== "" && !Object.hasOwn(result, name)) result[name] = decodeCookieValue(unquote(trim(header, equals + 1, end)));
+			}
+			start = end + 1;
+		}
+	}
+	return Object.freeze(result);
+}
+/** `text.slice(start, end)` without leading and trailing SP / HTAB. */
+function trim(text, start, end) {
+	let from = start;
+	let to = end;
+	while (from < to && isBlank(text.charCodeAt(from))) from++;
+	while (to > from && isBlank(text.charCodeAt(to - 1))) to--;
+	return text.slice(from, to);
+}
+function isBlank(code) {
+	return code === 32 || code === 9;
+}
+function unquote(value) {
+	return value.length >= 2 && value.charCodeAt(0) === 34 && value.charCodeAt(value.length - 1) === 34 ? value.slice(1, -1) : value;
+}
+/**
+* Decodes a cookie value produced by {@link encodeCookieValue} (`decodeURIComponent` when it
+* contains `%`; a malformed sequence keeps the raw value). Never throws.
+*/
+function decodeCookieValue(value) {
+	if (!value.includes("%")) return value;
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+/**
+* Encodes a cookie value canonically: the UTF-8 bytes outside RFC 6265 `cookie-octet` (space, `"`,
+* `,`, `;`, `\`, controls, non-ASCII) and `%` are percent-encoded (upper-case hex), so that
+* {@link decodeCookieValue} restores the value exactly (`a b;c` → `a%20b%3Bc`), and
+* `encode(decode(w)) === w` for every encoded `w`. Quotes are never emitted.
+*
+* @throws TypeError for a non-string or a string with lone surrogates (they cannot round-trip).
+*/
+function encodeCookieValue(value) {
+	if (typeof value !== "string") throw new TypeError(`A cookie value must be a string (received ${describe(value)})`);
+	if (!value.isWellFormed()) throw new TypeError("A cookie value must be a well-formed string (it contains a lone surrogate)");
+	let encoded = "";
+	let plain = 0;
+	for (let index = 0; index < value.length; index++) {
+		const code = value.charCodeAt(index);
+		if (isCookieOctet(code)) continue;
+		encoded += value.slice(plain, index);
+		if (code < 128) {
+			encoded += `%${HEX[code]}`;
+			plain = index + 1;
+		} else {
+			const width = value.codePointAt(index) > 65535 ? 2 : 1;
+			encoded += encodeURIComponent(value.slice(index, index + width));
+			index += width - 1;
+			plain = index + 1;
+		}
+	}
+	return plain === 0 ? value : encoded + value.slice(plain);
+}
+const HEX = Array.from({ length: 128 }, (_, code) => code.toString(16).toUpperCase().padStart(2, "0"));
+/** RFC 6265 `cookie-octet`, `%` excluded (the escape character). */
+function isCookieOctet(code) {
+	return code === 33 || code >= 35 && code <= 43 && code !== 37 || code >= 45 && code <= 58 || code >= 60 && code <= 91 || code >= 93 && code <= 126;
+}
+/** Whether `name` is an RFC 9110 token (a cookie name Znight can set). */
+function isCookieName(name) {
+	if (typeof name !== "string" || name === "") return false;
+	for (let index = 0; index < name.length; index++) if (!isTokenChar(name.charCodeAt(index))) return false;
+	return true;
+}
+function isTokenChar(code) {
+	return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 33 || code >= 35 && code <= 39 || code === 42 || code === 43 || code === 45 || code === 46 || code === 94 || code === 95 || code === 96 || code === 124 || code === 126;
+}
+/**
+* Checks what a cookie says about itself, without plugin defaults: the name, the value type, the
+* options (types, `maxAge`, `expires`, `domain`, `path`) and the size before signing. Run by
+* `HttpResponse.withCookie()` / `withoutCookie()` at call time; the rules depending on the defaults
+* (prefixes, `SameSite=None` and `partitioned` with `secure`), signing and the final size are checked
+* when the response is serialised.
+*
+* @throws TypeError / RangeError naming the cookie.
+*/
+function checkCookie(name, value, options) {
+	checkName(name);
+	const checked = checkOptions(name, options);
+	if (value !== void 0) checkSize(name, encodeValue(name, value));
+	if (typeof checked.domain === "string") normalizeDomain(name, checked.domain);
+	if (checked.path !== void 0) checkPath(name, checked.path);
+}
+/**
+* Serialises a response cookie with `defaults` (merged under the options): every rule of RFC 0006
+* §4.3 is checked. `sign` turns the encoded value into its signed wire form (`signed: true`).
+*
+* @throws TypeError / RangeError naming the cookie.
+*/
+function serializeResponseCookie(cookie, defaults, sign) {
+	const { name, value } = cookie;
+	checkName(name);
+	const options = checkOptions(name, cookie.options);
+	checkOptions(name, defaults, true);
+	const attributes = resolveAttributes(name, {
+		...applicableDefaults(name, defaults),
+		...definedOnly(options)
+	});
+	let wire;
+	let maxAge;
+	let expires;
+	if (value === void 0) {
+		wire = "";
+		maxAge = 0;
+		expires = EPOCH;
+	} else {
+		wire = encodeValue(name, value);
+		if (options.signed === true) {
+			if (sign === void 0) throw new TypeError(`Cannot sign the cookie "${name}": no signing key`);
+			wire = sign(name, wire);
+		}
+		if (options.maxAge !== void 0) maxAge = Math.max(options.maxAge, 0);
+		if (options.expires !== void 0) expires = options.expires.toUTCString();
+	}
+	checkSize(name, wire);
+	let line = `${name}=${wire}`;
+	if (maxAge !== void 0) line += `; Max-Age=${maxAge}`;
+	if (expires !== void 0) line += `; Expires=${expires}`;
+	if (attributes.domain !== void 0) line += `; Domain=${attributes.domain}`;
+	line += `; Path=${attributes.path}`;
+	if (attributes.secure) line += "; Secure";
+	if (attributes.httpOnly) line += "; HttpOnly";
+	if (attributes.sameSite !== void 0) line += `; SameSite=${SAME_SITE[attributes.sameSite]}`;
+	if (attributes.partitioned) line += "; Partitioned";
+	if (attributes.priority !== void 0 && value !== void 0) line += `; Priority=${PRIORITY[attributes.priority]}`;
+	return {
+		key: cookieKey(name, attributes.domain, attributes.path),
+		line
+	};
+}
+/**
+* The `Set-Cookie` line of a cookie with the secure defaults
+* (`Path=/; Secure; HttpOnly; SameSite=Lax`, overridable per cookie), in the order
+* `name=value; Max-Age; Expires; Domain; Path; Secure; HttpOnly; SameSite; Partitioned; Priority`.
+* The value is percent-encoded (see {@link encodeCookieValue}). Signing (`signed: true`) needs the
+* secrets of the plugin: use `ctx.setCookie()` or `HttpPlugin.signCookie()`.
+*
+* ```ts
+* serializeCookie('theme', 'dark', { maxAge: 86_400, httpOnly: false })
+* // theme=dark; Max-Age=86400; Path=/; Secure; SameSite=Lax
+* ```
+*
+* @throws TypeError for an invalid name, value or attribute, a `SameSite=None` or partitioned cookie
+*   without `Secure`, a broken `__Secure-` / `__Host-` / `__Http-` / `__Host-Http-` prefix rule.
+* @throws RangeError when `name=value` exceeds 4096 bytes, or `Domain` / `Path` 1024 bytes.
+*/
+function serializeCookie(name, value, options = {}) {
+	return serializeResponseCookie({
+		name,
+		value,
+		options
+	}, DEFAULT_COOKIE_OPTIONS).line;
+}
+/**
+* The `Set-Cookie` line clearing a cookie: `name=; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT`
+* plus `Domain`, `Path`, `Secure`, `HttpOnly`, `SameSite` and `Partitioned` (secure defaults merged
+* with `options`), so that a prefixed cookie is cleared with valid attributes.
+*/
+function serializeClearCookie(name, options = {}) {
+	return serializeResponseCookie({
+		name,
+		value: void 0,
+		options
+	}, DEFAULT_COOKIE_OPTIONS).line;
+}
+/** The jar key of a cookie (RFC 6265: a cookie is identified by its name, domain and path). */
+function cookieKey(name, domain, path) {
+	return `${name}\u0000${domain ?? ""}\u0000${path}`;
+}
+/**
+* The defaults a cookie takes: all of them, but a `__Host-` cookie (host-only, `Path=/` by
+* definition) never takes a default domain or path. Its own options are still checked.
+*/
+function applicableDefaults(name, defaults) {
+	if (!name.toLowerCase().startsWith("__host-")) return defaults;
+	const { domain: _domain, path: _path, ...rest } = defaults;
+	return rest;
+}
+/** Attributes after the defaults, checked against the cross-attribute and prefix rules. */
+function resolveAttributes(name, options) {
+	const domain = typeof options.domain === "string" ? normalizeDomain(name, options.domain) : void 0;
+	const path = options.path ?? "/";
+	checkPath(name, path);
+	const attributes = {
+		domain,
+		path,
+		secure: options.secure === true,
+		httpOnly: options.httpOnly === true,
+		sameSite: options.sameSite,
+		partitioned: options.partitioned === true,
+		priority: options.priority
+	};
+	if (attributes.sameSite === "none" && !attributes.secure) throw invalid(name, "SameSite=None requires secure: true (browsers reject it otherwise)");
+	if (attributes.partitioned && !attributes.secure) throw invalid(name, "partitioned cookies require secure: true");
+	checkPrefix(name, attributes);
+	return attributes;
+}
+/** `__Secure-`, `__Host-`, `__Http-`, `__Host-Http-` (case-insensitive, like browsers). */
+function checkPrefix(name, attributes) {
+	const lower = name.toLowerCase();
+	const host = lower.startsWith("__host-");
+	const http = lower.startsWith("__http-") || lower.startsWith("__host-http-");
+	if (!host && !http && !lower.startsWith("__secure-")) return;
+	const prefix = prefixName(host, http);
+	if (!attributes.secure) throw invalid(name, `the ${prefix} prefix requires secure: true`);
+	if (http && !attributes.httpOnly) throw invalid(name, `the ${prefix} prefix requires httpOnly: true`);
+	if (host) {
+		if (attributes.domain !== void 0) throw invalid(name, `the ${prefix} prefix forbids a domain`);
+		if (attributes.path !== "/") throw invalid(name, `the ${prefix} prefix requires path: '/'`);
+	}
+}
+function checkName(name) {
+	if (!isCookieName(name)) throw new TypeError(`Invalid cookie name ${describe(name)}: expected a token (letters, digits and ! # $ % & ' * + - . ^ _ \` | ~)`);
+}
+function encodeValue(name, value) {
+	if (typeof value !== "string") throw invalid(name, `the value must be a string (received ${describe(value)})`);
+	if (!value.isWellFormed()) throw invalid(name, "the value contains a lone surrogate");
+	return encodeCookieValue(value);
+}
+function checkSize(name, wire) {
+	const size = byteLength(name) + 1 + wire.length;
+	if (size > 4096) throw new RangeError(`Invalid cookie "${name}": name=value is ${size} bytes on the wire, above the limit of ${MAX_COOKIE_SIZE} (browsers drop it)`);
+}
+/** Checks the type of every option (and rejects unknown keys); returns the options. */
+function checkOptions(name, options, defaults = false) {
+	if (options === void 0) return {};
+	const what = defaults ? "cookies.defaults" : "options";
+	if (options === null || typeof options !== "object" || Array.isArray(options)) throw invalid(name, `${what} must be an object (received ${describe(options)})`);
+	for (const key of Object.keys(options)) if (!OPTION_KEYS.has(key)) throw invalid(name, `unknown option "${key}"`);
+	const { maxAge, expires, domain, path, secure, httpOnly, sameSite, partitioned, priority, signed } = options;
+	if (maxAge !== void 0 && !(typeof maxAge === "number" && Number.isSafeInteger(maxAge))) throw invalid(name, `maxAge must be an integer number of seconds (received ${describe(maxAge)})`);
+	if (expires !== void 0 && !(expires instanceof Date && !Number.isNaN(expires.getTime()))) throw invalid(name, `expires must be a valid Date (received ${describe(expires)})`);
+	if (expires !== void 0) {
+		const year = expires.getUTCFullYear();
+		if (year < MIN_EXPIRES_YEAR || year > MAX_EXPIRES_YEAR) throw invalid(name, `expires must be in the years ${MIN_EXPIRES_YEAR} to ${MAX_EXPIRES_YEAR} (received ${expires.toISOString()}): browsers ignore other dates; use maxAge for a long lifetime (browsers cap it at 400 days)`);
+	}
+	if (domain !== void 0 && domain !== null && typeof domain !== "string") throw invalid(name, `domain must be a string or null (received ${describe(domain)})`);
+	if (path !== void 0 && typeof path !== "string") throw invalid(name, `path must be a string (received ${describe(path)})`);
+	for (const [key, flag] of [
+		["secure", secure],
+		["httpOnly", httpOnly],
+		["partitioned", partitioned],
+		["signed", signed]
+	]) if (flag !== void 0 && typeof flag !== "boolean") throw invalid(name, `${key} must be a boolean (received ${describe(flag)})`);
+	if (sameSite !== void 0 && !Object.hasOwn(SAME_SITE, sameSite)) throw invalid(name, `sameSite must be 'strict', 'lax' or 'none' (received ${describe(sameSite)})`);
+	if (priority !== void 0 && !Object.hasOwn(PRIORITY, priority)) throw invalid(name, `priority must be 'low', 'medium' or 'high' (received ${describe(priority)})`);
+	return options;
+}
+/** Lower-cased, one leading `.` removed; an ASCII host name of at most 253 characters. */
+function normalizeDomain(name, domain) {
+	const normalized = (domain.startsWith(".") ? domain.slice(1) : domain).toLowerCase();
+	if (normalized.length > 1024) throw new RangeError(`Invalid cookie "${name}": the domain exceeds ${MAX_COOKIE_ATTRIBUTE_SIZE} bytes`);
+	if (!isHostName(normalized)) throw invalid(name, `invalid domain ${describe(domain)}: expected an ASCII host name (letters, digits, -, dot-separated labels; IDNs in punycode)`);
+	return normalized;
+}
+function isHostName(domain) {
+	if (domain === "" || domain.length > MAX_DOMAIN_LENGTH) return false;
+	let label = 0;
+	for (let index = 0; index < domain.length; index++) {
+		const code = domain.charCodeAt(index);
+		if (code === 46) {
+			if (label === 0) return false;
+			label = 0;
+			continue;
+		}
+		if (!(code >= 48 && code <= 57 || code >= 97 && code <= 122 || code === 45)) return false;
+		label++;
+	}
+	return label > 0;
+}
+/** Starts with `/`, `%x20-7E` except `;`, at most 1024 bytes. */
+function checkPath(name, path) {
+	if (path.length > 1024) throw new RangeError(`Invalid cookie "${name}": the path exceeds ${MAX_COOKIE_ATTRIBUTE_SIZE} bytes`);
+	let valid = path.startsWith("/");
+	for (let index = 0; valid && index < path.length; index++) {
+		const code = path.charCodeAt(index);
+		valid = code >= 32 && code <= 126 && code !== 59;
+	}
+	if (!valid) throw invalid(name, `invalid path ${describe(path)}: expected "/..." made of visible ASCII characters without ";"`);
+}
+/** The options without `undefined` values (they would erase defaults when spread). */
+function definedOnly(options) {
+	const result = {};
+	for (const key of Object.keys(options)) {
+		const value = options[key];
+		if (value !== void 0) result[key] = value;
+	}
+	return result;
+}
+/**
+* Parses a `Set-Cookie` line (attribute names are case-insensitive; the value is decoded like a
+* request cookie). Used by `inject()` to fill `response.cookies`.
+*
+* @throws TypeError when the line has no `name=value` pair.
+*/
+function parseSetCookie(line) {
+	const parts = String(line).split(";");
+	const pair = parts[0];
+	const equals = pair.indexOf("=");
+	const name = equals === -1 ? "" : trim(pair, 0, equals);
+	if (name === "") throw new TypeError(`Invalid Set-Cookie line ${describe(line)}: missing name=value`);
+	const info = {
+		name,
+		value: decodeCookieValue(unquote(trim(pair, equals + 1, pair.length))),
+		raw: line,
+		secure: false,
+		httpOnly: false,
+		partitioned: false
+	};
+	for (const part of parts.slice(1)) {
+		const separator = part.indexOf("=");
+		const key = trim(part, 0, separator === -1 ? part.length : separator).toLowerCase();
+		const value = separator === -1 ? "" : trim(part, separator + 1, part.length);
+		switch (key) {
+			case "max-age": {
+				const seconds = /^-?\d+$/.test(value) ? Number(value) : NaN;
+				if (Number.isSafeInteger(seconds)) info.maxAge = seconds;
+				break;
+			}
+			case "expires": {
+				const date = new Date(value);
+				if (!Number.isNaN(date.getTime())) info.expires = date;
+				break;
+			}
+			case "domain":
+				if (value !== "") info.domain = (value.startsWith(".") ? value.slice(1) : value).toLowerCase();
+				break;
+			case "path":
+				if (value.startsWith("/")) info.path = value;
+				break;
+			case "secure":
+				info.secure = true;
+				break;
+			case "httponly":
+				info.httpOnly = true;
+				break;
+			case "partitioned":
+				info.partitioned = true;
+				break;
+			case "samesite": {
+				const sameSite = value.toLowerCase();
+				if (sameSite === "strict" || sameSite === "lax" || sameSite === "none") info.sameSite = sameSite;
+				break;
+			}
+			case "priority": {
+				const priority = value.toLowerCase();
+				if (priority === "low" || priority === "medium" || priority === "high") info.priority = priority;
+				break;
+			}
+		}
+	}
+	return Object.freeze(info);
+}
+/** The `set-cookie` lines of a response parsed by name (the last one wins), prototype-less and frozen. */
+function parseSetCookies(lines) {
+	const result = Object.create(null);
+	const list = typeof lines === "string" ? [lines] : lines ?? [];
+	for (const line of list) try {
+		const info = parseSetCookie(line);
+		result[info.name] = info;
+	} catch {}
+	return Object.freeze(result);
+}
+/**
+* The jar key of a cookie as given (`HttpResponse.withCookie()`, before the defaults are known):
+* an absent domain or path is keyed as "default", a `null` domain as host-only.
+*/
+function givenCookieKey(name, options) {
+	const given = options.domain;
+	let domain;
+	if (given === void 0) domain = "
";
+	else if (given === null) domain = "";
+	else domain = (given.startsWith(".") ? given.slice(1) : given).toLowerCase();
+	return `${name}\u0000${domain}\u0000${options.path ?? "
"}`;
+}
+function prefixName(host, http) {
+	if (host) return http ? "__Host-Http-" : "__Host-";
+	return http ? "__Http-" : "__Secure-";
+}
+function invalid(name, reason) {
+	return /* @__PURE__ */ new TypeError(`Invalid cookie "${name}": ${reason}`);
+}
+function byteLength(text) {
+	let size = 0;
+	for (let index = 0; index < text.length; index++) {
+		const code = text.charCodeAt(index);
+		if (code < 128) size += 1;
+		else if (code < 2048 || code >= 55296 && code <= 57343) size += 2;
+		else size += 3;
+	}
+	return size;
+}
+function describe(value) {
+	if (typeof value === "string") return JSON.stringify(value.length > 64 ? `${value.slice(0, 64)}…` : value);
+	if (value instanceof Date) return "an invalid Date";
+	if (value === null) return "null";
+	if (typeof value === "object") return "an object";
+	return typeof value === "bigint" ? `${value}n` : String(value);
+}
+// src/adapters/shared.ts
+/**
+* Applies the defaults of {@link InjectRequest}: query merged in the URL, cookies appended to the
+* `cookie` header (encoded values joined with `; `), body encoding and content type (`FormData` →
+* `multipart/form-data`, `Blob` → its type).
+*/
+async function normalizeInject(request) {
+	if (request === null || typeof request !== "object") throw new TypeError("inject() expects a request object");
+	if (typeof request.url !== "string" || !request.url.startsWith("/")) throw new TypeError(`inject() expects a url starting with "/" (received ${JSON.stringify(request.url)})`);
+	const method = (request.method ?? "GET").toUpperCase();
+	let url = request.url;
+	if (request.query !== void 0) {
+		const search = new URLSearchParams();
+		for (const [key, value] of Object.entries(request.query)) if (typeof value === "string") search.append(key, value);
+		else for (const item of value) search.append(key, item);
+		const query = search.toString();
+		if (query !== "") url += `${url.includes("?") ? "&" : "?"}${query}`;
+	}
+	const headers = {};
+	for (const [name, value] of Object.entries(request.headers ?? {})) headers[name.toLowerCase()] = value;
+	if (request.signedCookies !== void 0) throw new TypeError("inject(): signedCookies are signed by HttpPlugin.inject() (adapters only accept cookies)");
+	const cookie = cookieHeader(request.cookies);
+	if (cookie !== "") headers["cookie"] = headers["cookie"] === void 0 ? cookie : `${headers["cookie"]}; ${cookie}`;
+	const body = request.body;
+	let payload;
+	if (body === void 0) payload = void 0;
+	else if (typeof body === "string") {
+		payload = body;
+		headers["content-type"] ??= "text/plain; charset=utf-8";
+	} else if (body instanceof Uint8Array || body instanceof ArrayBuffer) {
+		payload = body instanceof Uint8Array ? body : new Uint8Array(body);
+		headers["content-type"] ??= "application/octet-stream";
+	} else if (body instanceof FormData) {
+		const encoded = new Response(body);
+		const type = encoded.headers.get("content-type");
+		payload = new Uint8Array(await encoded.arrayBuffer());
+		headers["content-type"] = type ?? encoded.headers.get("content-type") ?? "multipart/form-data";
+	} else if (body instanceof Blob) {
+		payload = new Uint8Array(await body.arrayBuffer());
+		headers["content-type"] ??= body.type === "" ? "application/octet-stream" : body.type;
+	} else {
+		payload = JSON.stringify(body);
+		headers["content-type"] ??= "application/json";
+	}
+	return {
+		method,
+		url,
+		headers,
+		payload
+	};
+}
+/** The `cookie` header of inject cookies: `name=encoded` pairs joined with `; `. */
+function cookieHeader(cookies) {
+	if (cookies === void 0) return "";
+	if (cookies === null || typeof cookies !== "object") throw new TypeError("inject(): cookies must be an object");
+	const pairs = [];
+	for (const name of Object.keys(cookies)) {
+		if (!isRequestCookieName(name)) throw new TypeError(`inject(): invalid cookie name ${JSON.stringify(name)} (empty, or with ";", "=", spaces or controls)`);
+		const value = cookies[name];
+		if (typeof value !== "string") throw new TypeError(`inject(): the value of the cookie "${name}" must be a string`);
+		pairs.push(`${name}=${encodeCookieValue(value)}`);
+	}
+	return pairs.join("; ");
+}
+/** A name a `cookie` header can carry: no `;`, `=`, whitespace or controls, Latin-1. */
+function isRequestCookieName(name) {
+	if (name === "") return false;
+	for (let index = 0; index < name.length; index++) {
+		const code = name.charCodeAt(index);
+		if (code <= 32 || code === 59 || code === 61 || code === 127 || code > 255) return false;
+	}
+	return true;
+}
+const DECODER = new TextDecoder();
+/**
+* Normalises response headers: lower-case names, repeated values joined with `, `, except
+* `set-cookie` (one entry per cookie: an `Expires` attribute contains `, `).
+*/
+function injectHeaders(headers) {
+	const normalized = {};
+	for (const [name, value] of Object.entries(headers)) {
+		if (value === void 0) continue;
+		const key = name.toLowerCase();
+		if (key === "set-cookie") normalized[key] = typeof value === "object" ? [...value] : [String(value)];
+		else normalized[key] = typeof value === "object" ? value.join(", ") : String(value);
+	}
+	return normalized;
+}
+/** Whether a `content-type` is `text/event-stream`. */
+function isEventStreamType(contentType) {
+	if (typeof contentType !== "string") return false;
+	const semicolon = contentType.indexOf(";");
+	return (semicolon === -1 ? contentType : contentType.slice(0, semicolon)).trim().toLowerCase() === "text/event-stream";
+}
+/**
+* `inject()` on top of `injectStream()`: reads the body to its end, except for an event stream
+* (which would never end): its body is cancelled (the server sees a disconnect) and the call
+* rejects with a hint.
+*/
+async function bufferInjectStream(injectStream, request) {
+	const response = await injectStream(request);
+	const method = (request.method ?? "GET").toUpperCase();
+	if (method !== "HEAD" && isEventStreamType(response.headers["content-type"])) {
+		await response.body.cancel().catch(() => void 0);
+		throw new TypeError(`inject(): ${method} ${request.url} answered an event stream (text/event-stream): use injectSse() or injectStream()`);
+	}
+	const reader = response.body.getReader();
+	const chunks = [];
+	let size = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		size += value.byteLength;
+		chunks.push(value);
+	}
+	const bytes = concat(chunks, size);
+	const body = DECODER.decode(bytes);
+	return {
+		status: response.status,
+		headers: response.headers,
+		body,
+		bytes,
+		cookies: response.cookies,
+		json: () => JSON.parse(body)
+	};
+}
+/** Builds an {@link InjectStreamResponse}. */
+function injectStreamResponse(status, headers, body) {
+	const normalized = injectHeaders(headers);
+	return {
+		status,
+		headers: normalized,
+		cookies: parseSetCookies(normalized["set-cookie"]),
+		body
+	};
+}
+/** Builds an {@link HttpServerAddress} from a bound address. */
+function serverAddress(address, port, family) {
+	const ipv6 = family === "IPv6" || family === 6 || address.includes(":");
+	let client = address;
+	if (address === "0.0.0.0") client = "127.0.0.1";
+	else if (address === "::") client = "::1";
+	const url = `http://${client.includes(":") ? `[${client}]` : client}:${port}`;
+	return Object.freeze({
+		host: address,
+		port,
+		family: ipv6 ? "IPv6" : "IPv4",
+		url,
+		toString: () => url
+	});
+}
+/** The 413 error of a body above `limit` bytes. */
+function payloadTooLarge(limit) {
+	return new PayloadTooLargeException(`Request body exceeds the limit of ${limit} bytes`, void 0, { headers: { connection: "close" } });
+}
+/** Rejects early when `content-length` announces more than `limit` bytes. */
+function exceedsDeclaredLength(contentLength, limit) {
+	if (contentLength === void 0) return false;
+	const length = Number(contentLength);
+	return Number.isFinite(length) && length > limit;
+}
+/** Bytes read (and discarded) from an abandoned Web request body before it is cancelled. */
+const MAX_DISCARD_BYTES = 67108864;
+/**
+* The body of a Web request as a pull-based stream enforcing `limit` (see
+* `AdapterRequest.streamBody`). `body` is only read when needed (a Node.js-backed request body
+* starts buffering once accessed). On overflow or cancellation the rest of the body is read and
+* discarded in the background (up to 64 MiB, then cancelled), so the server can write the response
+* and keep the connection usable instead of resetting it.
+*/
+function webBodyStream(body, limit, contentLength) {
+	if (exceedsDeclaredLength(contentLength, limit)) return failedStream(payloadTooLarge(limit));
+	const source = body();
+	if (source === null) return new ReadableStream({ start: (controller) => controller.close() });
+	const reader = source.getReader();
+	let size = 0;
+	let abandoned = false;
+	const abandon = () => {
+		if (abandoned) return;
+		abandoned = true;
+		discardReader(reader);
+	};
+	return new ReadableStream({
+		async pull(controller) {
+			let result;
+			try {
+				result = await reader.read();
+			} catch (error) {
+				abandoned = true;
+				throw new BadRequestException("Failed to read the request body", void 0, { cause: error });
+			}
+			if (result.done) {
+				abandoned = true;
+				controller.close();
+				return;
+			}
+			size += result.value.byteLength;
+			if (size > limit) {
+				abandon();
+				throw payloadTooLarge(limit);
+			}
+			controller.enqueue(result.value);
+		},
+		cancel: abandon
+	}, { highWaterMark: 0 });
+}
+/** Reads and drops the rest of a request body in the background, cancelling it past 64 MiB. */
+function discardReader(reader) {
+	let discarded = 0;
+	const next = () => {
+		reader.read().then((result) => {
+			if (result.done) return;
+			discarded += result.value?.byteLength ?? 0;
+			if (discarded > MAX_DISCARD_BYTES) reader.cancel().catch(() => void 0);
+			else next();
+		}, () => void 0);
+	};
+	next();
+}
+/** Reads a Web request body fully, enforcing `limit` (see {@link webBodyStream}). */
+async function readWebStream(body, limit, contentLength) {
+	const reader = webBodyStream(body, limit, contentLength).getReader();
+	const chunks = [];
+	let size = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		size += value.byteLength;
+		chunks.push(value);
+	}
+	return concat(chunks, size);
+}
+/** Concatenates chunks (no copy for a single chunk). */
+function concat(chunks, size) {
+	if (chunks.length === 0) return /* @__PURE__ */ new Uint8Array(0);
+	if (chunks.length === 1) return chunks[0];
+	const result = new Uint8Array(size);
+	let offset = 0;
+	for (const chunk of chunks) {
+		result.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return result;
+}
+let lightMyRequest;
+/** Loads `light-my-request`, with an actionable error when it is not installed. */
+function loadLightMyRequest(adapter) {
+	lightMyRequest ??= import("light-my-request").then((module) => {
+		const loaded = module;
+		return loaded.default ?? loaded;
+	}, (error) => {
+		lightMyRequest = void 0;
+		throw new Error(`inject() with the ${adapter} adapter requires the optional peer dependency "light-my-request" (bun add -d light-my-request / npm i -D light-my-request)`, { cause: error });
+	});
+	return lightMyRequest;
+}
+/**
+* The light-my-request options of a normalised inject request (streaming mode). The signal is
+* handled by {@link lightStreamResponse} (light-my-request would destroy its fake request with an
+* unhandled error); an already aborted signal rejects at once, like `fetch()`.
+*/
+async function lightInjectOptions(request) {
+	request.signal?.throwIfAborted();
+	const normalized = await normalizeInject(request);
+	return {
+		method: normalized.method,
+		url: normalized.url,
+		headers: normalized.headers,
+		remoteAddress: "127.0.0.1",
+		payloadAsStream: true,
+		...normalized.payload === void 0 ? {} : { payload: toBuffer(normalized.payload) }
+	};
+}
+/** Runs a request through a Node.js request listener with `light-my-request`, streaming the body. */
+async function injectNodeStream(adapter, dispatch, request) {
+	const options = await lightInjectOptions(request);
+	const { inject } = await loadLightMyRequest(adapter);
+	return lightStreamResponse(await inject(dispatch, options), request.signal);
+}
+/**
+* An {@link InjectStreamResponse} of a light-my-request streaming response. Cancelling the body
+* (or aborting `signal`) destroys the server response: the server sees a client disconnect.
+*/
+function lightStreamResponse(response, signal) {
+	const readable = response.stream();
+	const disconnect = () => {
+		response.raw.res.destroy();
+		readable.destroy();
+	};
+	let finished = false;
+	const body = new ReadableStream({
+		start(controller) {
+			readable.on("data", (chunk) => {
+				if (finished) return;
+				controller.enqueue(new Uint8Array(chunk.buffer, chunk.byteOffset, chunk.byteLength));
+				if ((controller.desiredSize ?? 0) <= 0) readable.pause();
+			});
+			readable.once("end", () => {
+				if (finished) return;
+				finished = true;
+				controller.close();
+			});
+			readable.once("error", (error) => {
+				if (finished) return;
+				finished = true;
+				controller.error(error);
+			});
+		},
+		pull() {
+			if (readable.isPaused()) readable.resume();
+		},
+		cancel() {
+			finished = true;
+			disconnect();
+		}
+	}, { highWaterMark: 0 });
+	if (signal !== void 0) {
+		if (signal.aborted) disconnect();
+		else signal.addEventListener("abort", disconnect, { once: true });
+	}
+	return injectStreamResponse(response.statusCode, response.headers, body);
+}
+/** A `Buffer` view of bytes (tools such as light-my-request JSON-encode other objects). */
+function toBuffer(payload) {
+	return typeof payload === "string" ? payload : Buffer.from(payload.buffer, payload.byteOffset, payload.byteLength);
+}
+/**
+* Runs a request through a Fetch handler (`(request: Request) => Promise<Response>`), streaming
+* the body. Cancelling the body (or aborting `signal`) aborts the request signal and cancels the
+* response body.
+*/
+async function injectFetchStream(fetch, request) {
+	const signal = request.signal;
+	signal?.throwIfAborted();
+	const normalized = await normalizeInject(request);
+	const abort = new AbortController();
+	signal?.addEventListener("abort", () => abort.abort(signal.reason), { once: true });
+	const init = {
+		method: normalized.method,
+		headers: normalized.headers,
+		signal: abort.signal
+	};
+	if (normalized.payload !== void 0 && normalized.method !== "GET" && normalized.method !== "HEAD") init.body = normalized.payload;
+	const response = await fetch(new Request(`http://localhost${normalized.url}`, init));
+	const headers = {};
+	for (const [name, value] of response.headers) if (name !== "set-cookie") headers[name] = value;
+	const cookies = response.headers.getSetCookie();
+	if (cookies.length > 0) headers["set-cookie"] = cookies;
+	const reader = response.body?.getReader();
+	const body = new ReadableStream({
+		async pull(controller) {
+			if (reader === void 0) {
+				controller.close();
+				return;
+			}
+			const result = await reader.read();
+			if (result.done) controller.close();
+			else controller.enqueue(result.value);
+		},
+		async cancel(reason) {
+			abort.abort(reason);
+			await reader?.cancel(reason).catch(() => void 0);
+		}
+	}, { highWaterMark: 0 });
+	abort.signal.addEventListener("abort", () => reader?.cancel(abort.signal.reason).catch(() => void 0), { once: true });
+	return injectStreamResponse(response.status, headers, body);
+}
+// src/adapters/node-io.ts
+/** Bytes buffered by a request body stream before the request is paused. */
+const BODY_HIGH_WATER_MARK = 65536;
+/** Request headers with array values (only `set-cookie` in Node.js) joined with `, `. */
+function normalizeNodeHeaders(headers) {
+	for (const name in headers) if (typeof headers[name] !== "string") return copyHeaders(headers);
+	return headers;
+}
+function copyHeaders(headers) {
+	const result = {};
+	for (const name in headers) {
+		const value = headers[name];
+		result[name] = Array.isArray(value) ? value.join(", ") : value;
+	}
+	return result;
+}
+/**
+* Whether the body was already read by someone else: an Express body parser (`express.json()`...)
+* marks the request with `_body`; otherwise a declared body that already ended.
+*/
+function consumedElsewhere(request) {
+	if (request._body === true) return true;
+	if (!request.readableEnded) return false;
+	const length = request.headers["content-length"];
+	return request.headers["transfer-encoding"] !== void 0 || length !== void 0 && length.trim() !== "0";
+}
+/** The error of a body consumed before Znight read it (an empty body would be silently wrong). */
+function consumedError() {
+	return /* @__PURE__ */ new Error("The request body was already read by a middleware (an Express body parser such as express.json()?): Znight reads the bodies of its routes itself, do not register body parsers for them");
+}
+/** Reads a Node.js request body, enforcing `limit` (on `content-length`, then while streaming). */
+function readNodeBody(request, limit) {
+	if (exceedsDeclaredLength(request.headers["content-length"], limit)) {
+		request.resume();
+		return Promise.reject(payloadTooLarge(limit));
+	}
+	if (consumedElsewhere(request)) return Promise.reject(consumedError());
+	if (request.readableEnded) return Promise.resolve(/* @__PURE__ */ new Uint8Array(0));
+	if (request.destroyed) return Promise.reject(new BadRequestException("The request was aborted"));
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let size = 0;
+		const cleanup = () => {
+			request.off("data", onData);
+			request.off("end", onEnd);
+			request.off("error", onError);
+			request.off("close", onClose);
+		};
+		const onData = (chunk) => {
+			const bytes = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+			size += bytes.byteLength;
+			if (size > limit) {
+				cleanup();
+				request.resume();
+				reject(payloadTooLarge(limit));
+				return;
+			}
+			chunks.push(bytes);
+		};
+		const onEnd = () => {
+			cleanup();
+			resolve(concat(chunks, size));
+		};
+		const onError = (error) => {
+			cleanup();
+			reject(new BadRequestException("Failed to read the request body", void 0, { cause: error }));
+		};
+		const onClose = () => {
+			if (request.complete) return;
+			cleanup();
+			reject(new BadRequestException("The request was aborted"));
+		};
+		request.on("data", onData);
+		request.on("end", onEnd);
+		request.on("error", onError);
+		request.on("close", onClose);
+	});
+}
+/**
+* A Node.js request body as a Web stream (see `AdapterRequest.streamBody`): the request is paused
+* while the consumer does not read (backpressure); past `limit` bytes the stream errors with 413 and
+* the rest of the body is discarded (`request.resume()`), like when the consumer cancels the stream,
+* so the response can still be written (it carries `connection: close`).
+*/
+function nodeBodyStream(request, limit) {
+	if (exceedsDeclaredLength(request.headers["content-length"], limit)) {
+		request.resume();
+		return failedStream(payloadTooLarge(limit));
+	}
+	if (consumedElsewhere(request)) return failedStream(consumedError());
+	if (request.readableEnded) return new ReadableStream({ start: (controller) => controller.close() });
+	if (request.destroyed) return failedStream(new BadRequestException("The request was aborted"));
+	let size = 0;
+	let cleanup = () => void 0;
+	return new ReadableStream({
+		start(controller) {
+			const onData = (chunk) => {
+				const bytes = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+				size += bytes.byteLength;
+				if (size > limit) {
+					cleanup();
+					request.resume();
+					controller.error(payloadTooLarge(limit));
+					return;
+				}
+				controller.enqueue(bytes);
+				if ((controller.desiredSize ?? 0) <= 0) request.pause();
+			};
+			const onEnd = () => {
+				cleanup();
+				controller.close();
+			};
+			const onError = (error) => {
+				cleanup();
+				controller.error(new BadRequestException("Failed to read the request body", void 0, { cause: error }));
+			};
+			const onClose = () => {
+				if (request.complete) return;
+				cleanup();
+				controller.error(new BadRequestException("The request was aborted"));
+			};
+			cleanup = () => {
+				request.off("data", onData);
+				request.off("end", onEnd);
+				request.off("error", onError);
+				request.off("close", onClose);
+			};
+			request.on("data", onData);
+			request.on("end", onEnd);
+			request.on("error", onError);
+			request.on("close", onClose);
+		},
+		pull() {
+			if (request.isPaused()) request.resume();
+		},
+		cancel() {
+			cleanup();
+			request.resume();
+		}
+	}, {
+		highWaterMark: BODY_HIGH_WATER_MARK,
+		size: (chunk) => chunk?.byteLength ?? 0
+	});
+}
+/** Wraps a Node.js request/response pair as an {@link AdapterRequest}. */
+function nodeAdapterRequest(request, response, options = {}) {
+	let body;
+	return {
+		method: request.method ?? "GET",
+		url: options.url ?? request.url ?? "/",
+		headers: normalizeNodeHeaders(request.headers),
+		ip: options.ip ?? request.socket?.remoteAddress,
+		remoteAddress: request.socket?.remoteAddress,
+		encrypted: isEncrypted(request),
+		raw: options.raw ?? request,
+		rawResponse: options.rawResponse ?? response,
+		readBody: (limit) => {
+			body ??= readNodeBody(request, limit);
+			return body;
+		},
+		streamBody: (limit) => nodeBodyStream(request, limit),
+		rawStatus: () => response.statusCode,
+		onAbort: (listener) => onResponseAbort(response, listener)
+	};
+}
+/**
+* Calls `listener` once when `response` closes before it was fully written (the client left): on
+* the next microtask when it is already destroyed, never after a complete response.
+*/
+function onResponseAbort(response, listener) {
+	if (response.writableFinished) return;
+	if (response.destroyed) {
+		queueMicrotask(listener);
+		return;
+	}
+	response.once("close", () => {
+		if (!response.writableFinished) listener();
+	});
+}
+/** Whether the request came over TLS (`node:https`, `node:http2` secure servers). */
+function isEncrypted(request) {
+	return request.socket?.encrypted === true;
+}
+/**
+* Writes a reply to a `ServerResponse`. Resolves when the response is complete (streams included);
+* never rejects (a failing stream destroys the response).
+*/
+async function writeNodeReply(response, reply) {
+	if (reply.raw === true) {
+		discardStream(reply.body instanceof ReadableStream ? reply.body : null);
+		return;
+	}
+	if (response.headersSent || response.destroyed) {
+		discardStream(reply.body instanceof ReadableStream ? reply.body : null);
+		if (!response.writableEnded && !response.destroyed) response.end();
+		return;
+	}
+	try {
+		const headers = withNativeCookies(response.getHeader("set-cookie"), reply.headers);
+		response.writeHead(reply.status, headers);
+	} catch {
+		discardStream(reply.body instanceof ReadableStream ? reply.body : null);
+		if (!response.headersSent) {
+			for (const name of response.getHeaderNames()) response.removeHeader(name);
+			response.statusCode = 500;
+			response.setHeader("content-type", "application/json; charset=utf-8");
+			response.end("{\"statusCode\":500,\"error\":\"Internal Server Error\"}");
+		}
+		return;
+	}
+	const body = reply.body;
+	if (body === null) {
+		response.end();
+		return;
+	}
+	if (reply.eventStream === true && response.isLightMyRequest !== true) response.setTimeout(0);
+	if (body instanceof Uint8Array) {
+		response.end(body);
+		return;
+	}
+	const stream = body instanceof Blob ? body.stream() : body;
+	try {
+		await pipeline(Readable.fromWeb(stream), response);
+	} catch {
+		if (!response.destroyed) response.destroy();
+	}
+}
+/**
+* `headers` with the `set-cookie` lines already set on the native response (Express middleware
+* `res.cookie()`, Fastify hooks `reply.header('set-cookie', ...)`) before its own: `headers`
+* unchanged when either side has none.
+*/
+function withNativeCookies(native, headers) {
+	const own = headers["set-cookie"];
+	if (own === void 0 || native === void 0 || typeof native === "number") return headers;
+	const before = typeof native === "string" ? [native] : native;
+	if (before.length === 0) return headers;
+	return {
+		...headers,
+		"set-cookie": [...before, ...typeof own === "string" ? [own] : own]
+	};
+}
+/** Last-resort 500 when a handler promise rejected (should not happen: the pipeline maps errors). */
+function writeNodeFailure(response) {
+	if (response.headersSent) {
+		if (!response.writableEnded) response.destroy();
+		return;
+	}
+	response.statusCode = 500;
+	response.setHeader("content-type", "application/json; charset=utf-8");
+	response.end("{\"statusCode\":500,\"error\":\"Internal Server Error\"}");
+}
+/**
+* Tracks the connections of a `node:http` server to close them on shutdown: idle keep-alive
+* connections first (graceful), every connection when forced. `server.closeIdleConnections()` /
+* `closeAllConnections()` are not reliable on every runtime (Bun), so sockets are tracked here.
+*/
+var ConnectionTracker = class {
+	/** Socket → number of requests in progress. */
+	#sockets = /* @__PURE__ */ new Map();
+	#closing = false;
+	constructor(server) {
+		server.on("connection", (socket) => {
+			this.#sockets.set(socket, 0);
+			socket.once("close", () => this.#sockets.delete(socket));
+		});
+		server.on("request", (request, response) => {
+			const socket = request.socket;
+			if (!this.#sockets.has(socket)) return;
+			this.#sockets.set(socket, (this.#sockets.get(socket) ?? 0) + 1);
+			response.once("close", () => {
+				const active = this.#sockets.get(socket);
+				if (active === void 0) return;
+				this.#sockets.set(socket, active - 1);
+				if (active - 1 === 0 && this.#closing) socket.end();
+			});
+		});
+	}
+	/** Ends idle connections now and the others once their requests completed. */
+	closeIdle() {
+		this.#closing = true;
+		for (const [socket, active] of this.#sockets) if (active === 0) socket.end();
+	}
+	/** Destroys every connection. */
+	destroyAll() {
+		this.#closing = true;
+		for (const socket of this.#sockets.keys()) socket.destroy();
+	}
+};
+/** Closes a `node:http` server: graceful (idle connections ended), then forced when asked. */
+function closeServer(server, tracker, closing, force) {
+	const promise = closing ?? new Promise((resolve) => {
+		if (!server.listening) {
+			resolve();
+			return;
+		}
+		server.close(() => resolve());
+		server.closeIdleConnections?.();
+		tracker.closeIdle();
+	});
+	if (force) {
+		server.closeAllConnections?.();
+		tracker.destroyAll();
+	}
+	return promise;
+}
+export { UnprocessableEntityException as $, serializeCookie as A, ConflictException as B, decodeCookieValue as C, parseCookieHeader as D, isCookieName as E, isStreamSource as F, InternalServerErrorException as G, GatewayTimeoutException as H, toByteStream as I, NotImplementedException as J, MethodNotAllowedException as K, trackStream as L, captureContext as M, discardStream as N, parseSetCookie as O, isByteStream as P, UnauthorizedException as Q, BadGatewayException as R, checkCookie as S, givenCookieKey as T, GoneException as U, ForbiddenException as V, HttpException as W, ServiceUnavailableException as X, PayloadTooLargeException as Y, TooManyRequestsException as Z, lightStreamResponse as _, nodeBodyStream as a, isBodylessStatus as at, webBodyStream as b, readNodeBody as c, writeNodeReply as d, UnsupportedMediaTypeException as et, bufferInjectStream as f, lightInjectOptions as g, isEventStreamType as h, nodeAdapterRequest as i, toIssueDetail as it, serializeResponseCookie as j, serializeClearCookie as k, withNativeCookies as l, injectNodeStream as m, closeServer as n, isHttpException as nt, normalizeNodeHeaders as o, isValidStatus as ot, injectFetchStream as p, NotFoundException as q, isEncrypted as r, issue as rt, onResponseAbort as s, statusText as st, ConnectionTracker as t, ValidationException as tt, writeNodeFailure as u, readWebStream as v, encodeCookieValue as w, DEFAULT_COOKIE_OPTIONS as x, serverAddress as y, BadRequestException as z };
+
+//# sourceMappingURL=node-io-BY1ZDLRQ.mjs.map