@znight/http 0.1.0 → 0.1.2

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import { n as RouteTable, t as nodeAdapter } from "./node-BUnkdSsa.mjs";
-import { $ as UnprocessableEntityException, A as serializeCookie, B as ConflictException, C as decodeCookieValue, D as parseCookieHeader, E as isCookieName, F as isStreamSource, G as InternalServerErrorException, H as GatewayTimeoutException, I as toByteStream, J as NotImplementedException, K as MethodNotAllowedException, L as trackStream, M as captureContext, N as discardStream, O as parseSetCookie, P as isByteStream, Q as UnauthorizedException, R as BadGatewayException, S as checkCookie, T as givenCookieKey, U as GoneException, V as ForbiddenException, W as HttpException, X as ServiceUnavailableException, Y as PayloadTooLargeException, Z as TooManyRequestsException, at as isBodylessStatus, et as UnsupportedMediaTypeException, h as isEventStreamType, it as toIssueDetail, j as serializeResponseCookie, k as serializeClearCookie, nt as isHttpException, ot as isValidStatus, q as NotFoundException, rt as issue, st as statusText, tt as ValidationException, w as encodeCookieValue, x as DEFAULT_COOKIE_OPTIONS, z as BadRequestException } from "./node-io-BY1ZDLRQ.mjs";
+import { n as RouteTable, t as nodeAdapter } from "./node-Clm1Ia7T.mjs";
+import { $ as UnprocessableEntityException, A as serializeCookie, B as ConflictException, C as decodeCookieValue, D as parseCookieHeader, E as isCookieName, F as isStreamSource, G as InternalServerErrorException, H as GatewayTimeoutException, I as toByteStream, J as NotImplementedException, K as MethodNotAllowedException, L as trackStream, M as captureContext, N as discardStream, O as parseSetCookie, P as isByteStream, Q as UnauthorizedException, R as BadGatewayException, S as checkCookie, T as givenCookieKey, U as GoneException, V as ForbiddenException, W as HttpException, X as ServiceUnavailableException, Y as PayloadTooLargeException, Z as TooManyRequestsException, at as isBodylessStatus, et as UnsupportedMediaTypeException, h as isEventStreamType, it as toIssueDetail, j as serializeResponseCookie, k as serializeClearCookie, nt as isHttpException, ot as isValidStatus, q as NotFoundException, rt as issue, st as statusText, tt as ValidationException, w as encodeCookieValue, x as DEFAULT_COOKIE_OPTIONS, z as BadRequestException } from "./node-io-CVnqpVNS.mjs";
 import { a as isMediaTypePattern, i as contentTypeFor, n as parseByteSize, o as matchesMediaType, r as OCTET_STREAM, s as mediaTypeEssence, t as formatByteSize } from "./size-D8rsQcV0.mjs";
-import { i as isThenable, n as errorMessage, t as emptyRecord } from "./utils-DCbu3a4w.mjs";
+import { i as isThenable, n as errorMessage, r as isBun, t as emptyRecord } from "./utils-DCbu3a4w.mjs";
 import { RoutePathError, compareRoutePaths, compareStrings, decodePathValue, joinPaths, matchRoutePath, normalizePath, parseRoutePath } from "./path.mjs";
 import { Readable } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
@@ -823,7 +823,7 @@ var RequestContext = class {
 		this.#source = source;
 		this.#plan = init.body;
 		this.#cookieSettings = init.cookies ?? DEFAULT_COOKIE_SETTINGS;
-		const { path, query } = splitUrl(source.url);
+		const { path, query } = init.url ?? splitUrl(source.url);
 		this.#rawQuery = query;
 		this.requestId = init.requestId;
 		this.method = source.method;
@@ -910,7 +910,7 @@ var RequestContext = class {
 	}
 	/** The `Set-Cookie` lines of {@link setCookie} / {@link clearCookie}, with their keys, in order (internal). */
 	get cookieLines() {
-		return this.#jar === void 0 ? [] : [...this.#jar].map(([key, entry]) => ({
+		return this.#jar === void 0 ? NO_LINES : [...this.#jar].map(([key, entry]) => ({
 			key,
 			line: entry.line
 		}));
@@ -1071,6 +1071,7 @@ function withoutLifetime(options) {
 }
 const EMPTY_HEADERS = Object.freeze({});
 const NO_COOKIES$1 = Object.freeze([]);
+const NO_LINES = Object.freeze([]);
 const NO_FILES$1 = Object.freeze(emptyRecord());
 // src/decorators.ts
 function marker() {}
@@ -3347,6 +3348,11 @@ function isHttpResponse(value) {
 }
 // src/serialize.ts
 const ENCODER = new TextEncoder();
+/**
+* UTF-8 encoding of a text body: a pooled `Buffer` (a `Uint8Array`) is several times cheaper than
+* `TextEncoder` on Node.js, `TextEncoder` is the fastest on Bun.
+*/
+const utf8 = isBun() ? (text) => ENCODER.encode(text) : (text) => Buffer$1.from(text, "utf8");
 /** Content types set by the serialiser. */
 const ContentType = Object.freeze({
 	json: "application/json; charset=utf-8",
@@ -3387,10 +3393,20 @@ function serializeResult(result, options) {
 	const finalStatus = options.status ?? status ?? defaultStatus(options.routeMethod, payload);
 	const headers = emptyRecord();
 	const body = encode(payload, headers);
-	if (options.headers !== void 0) assignHeaders(headers, options.headers);
-	if (options.context !== void 0) assignHeaders(headers, options.context);
-	if (extra !== void 0) assignHeaders(headers, extra);
-	return withCookies(finish(finalStatus, headers, body, options.method), cookies);
+	let own = true;
+	if (options.headers !== void 0) {
+		assignHeaders(headers, options.headers);
+		own = false;
+	}
+	if (options.context !== void 0) {
+		assignHeaders(headers, options.context);
+		own = false;
+	}
+	if (extra !== void 0) {
+		assignHeaders(headers, extra);
+		own = false;
+	}
+	return withCookies(finish(finalStatus, headers, body, options.method, own), cookies);
 }
 /**
 * Serialises an event stream (`@Sse` result, `HttpResponse.sse()`): status 200 unless `@HttpCode`
@@ -3466,7 +3482,11 @@ function addMissingHeaders(target, source) {
 		if (value !== void 0 && target[key] === void 0) target[key] = typeof value === "string" ? value : [...value];
 	}
 }
-function finish(status, headers, body, method) {
+/**
+* The reply of a body: a string (see {@link encode}) is sent as its UTF-8 bytes, with its text.
+* `own`: only {@link encode} set `headers`, which are then valid for a text body.
+*/
+function finish(status, headers, body, method, own = false) {
 	if (isBodylessStatus(status)) {
 		discard(body);
 		delete headers["content-type"];
@@ -3485,18 +3505,34 @@ function finish(status, headers, body, method) {
 			body: null
 		};
 	}
-	return {
+	if (typeof body !== "string") return {
 		status,
 		headers,
 		body
 	};
+	return own ? {
+		status,
+		headers,
+		body: utf8(body),
+		text: body,
+		ownHeaders: true
+	} : {
+		status,
+		headers,
+		body: utf8(body),
+		text: body
+	};
 }
 function discard(body) {
 	if (body instanceof ReadableStream) discardStream(body);
 }
+/**
+* The body of a payload, its `content-type` and, for bytes and text, its `content-length` set in
+* `headers`. Text (a string, JSON) is returned as a string, encoded as UTF-8 by {@link finish}.
+*/
 function encode(payload, headers) {
 	if (payload === void 0) return null;
-	if (typeof payload === "string") return bytes(ENCODER.encode(payload), headers, ContentType.text);
+	if (typeof payload === "string") return text$1(payload, headers, ContentType.text);
 	if (payload instanceof Uint8Array) return bytes(payload, headers, ContentType.bytes);
 	if (payload instanceof ArrayBuffer) return bytes(new Uint8Array(payload), headers, ContentType.bytes);
 	if (ArrayBuffer.isView(payload)) return bytes(new Uint8Array(payload.buffer, payload.byteOffset, payload.byteLength), headers, ContentType.bytes);
@@ -3517,13 +3553,18 @@ function encode(payload, headers) {
 	if (isSseBody(payload)) throw new TypeError("An event stream (HttpResponse.sse()) cannot be serialised here");
 	const json = JSON.stringify(payload);
 	if (json === void 0) throw new TypeError(`Cannot serialise a ${typeof payload} as a response body`);
-	return bytes(ENCODER.encode(json), headers, ContentType.json);
+	return text$1(json, headers, ContentType.json);
 }
 function bytes(data, headers, type) {
 	headers["content-type"] = type;
 	headers["content-length"] = String(data.byteLength);
 	return data;
 }
+function text$1(data, headers, type) {
+	headers["content-type"] = type;
+	headers["content-length"] = String(Buffer$1.byteLength(data, "utf8"));
+	return data;
+}
 function isNodeReadable(value) {
 	return value instanceof Readable || value !== null && typeof value === "object" && typeof value.pipe === "function" && typeof value.on === "function" && typeof value.read === "function";
 }
@@ -3555,6 +3596,10 @@ const DEFAULT_SSE_SETTINGS = Object.freeze({
 const RAW = Symbol("raw response");
 const REQUEST_ID = /^[\w\-.:@/+=]{1,128}$/;
 const MAX_PATH_IN_MESSAGE = 200;
+/** The default request id generator: a random UUID. */
+function randomRequestId() {
+	return crypto.randomUUID();
+}
 /**
 * The request pipeline (architecture §9.1):
 * `runInScope({ HttpContext, RequestId }) → hooks.run('http:request') → guards → body → interceptors
@@ -3566,6 +3611,10 @@ var Pipeline = class {
 	#logger;
 	#options;
 	#table;
+	/** The `securityHeaders` option as entries (lower-case names, values validated at boot). */
+	#securityHeaders;
+	/** Every request id can be sent: an incoming one matched `REQUEST_ID`, the generated ones are UUIDs. */
+	#validIds;
 	#inflight = 0;
 	#idle = [];
 	/** Open event streams. */
@@ -3578,6 +3627,8 @@ var Pipeline = class {
 		this.#logger = logger;
 		this.#options = options;
 		this.#table = table;
+		this.#validIds = options.generateRequestId === randomRequestId;
+		this.#securityHeaders = Object.entries(options.securityHeaders ?? {}).map(([name, value]) => [name.toLowerCase(), value]);
 	}
 	/** Number of requests being processed. */
 	get inflight() {
@@ -3603,28 +3654,25 @@ var Pipeline = class {
 	* Handles a request routed to `plan` by the adapter. The request stays in flight (and its scope
 	* open) until a streamed or file response body has been fully read or cancelled by the adapter.
 	*/
-	async handle(plan, request) {
+	handle(plan, request) {
 		const startTime = performance.now();
-		this.#enter();
-		let served;
 		try {
-			served = this.#isPreflight(request) ? await this.#preflight(request, startTime) : await this.#route(plan, request, startTime);
-			return served.reply;
-		} finally {
-			this.#leaveWhen(served);
+			return this.#isPreflight(request) ? this.#preflight(request, startTime) : this.#route(plan, request, startTime);
+		} catch (error) {
+			return Promise.reject(error);
 		}
 	}
 	#route(plan, request, startTime, rerouted = false) {
-		const { path, query } = splitUrl(request.url);
-		const raw = matchRoutePath(plan.path, path);
+		const url = splitUrl(request.url);
+		const raw = matchRoutePath(plan.path, url.path);
 		if (raw === void 0) return this.#fallback(request, void 0, startTime, !rerouted);
 		if (plan.redirect === true) {
-			const canonical = sameOriginPath(path.slice(0, -1));
-			const location = query === "" ? canonical : `${canonical}?${query}`;
-			return this.#serve(request, void 0, emptyRecord(), {
+			const canonical = sameOriginPath(url.path.slice(0, -1));
+			const target = {
 				kind: "redirect",
-				location
-			}, startTime, plan.body);
+				location: url.query === "" ? canonical : `${canonical}?${url.query}`
+			};
+			return this.#serve(request, url, void 0, emptyRecord(), target, startTime, plan.body);
 		}
 		const params = emptyRecord();
 		let malformed;
@@ -3640,18 +3688,15 @@ var Pipeline = class {
 			kind: "error",
 			error: new BadRequestException(`Malformed URL parameter "${malformed}"`)
 		};
-		return this.#serve(request, plan.info, params, target, startTime, plan.body);
+		return this.#serve(request, url, plan.info, params, target, startTime, plan.body);
 	}
 	/** Handles an unmatched request (404, 405, automatic OPTIONS) or a framework error. */
-	async fallback(request, error) {
+	fallback(request, error) {
 		const startTime = performance.now();
-		this.#enter();
-		let served;
 		try {
-			served = await this.#fallback(request, error, startTime);
-			return served.reply;
-		} finally {
-			this.#leaveWhen(served);
+			return this.#fallback(request, error, startTime);
+		} catch (failure) {
+			return Promise.reject(failure);
 		}
 	}
 	#fallback(request, error, startTime, reroute = true) {
@@ -3661,10 +3706,11 @@ var Pipeline = class {
 				kind: "error",
 				error: frameworkError(error)
 			};
-			return this.#serve(request, void 0, emptyRecord(), target, startTime, body);
+			return this.#serve(request, splitUrl(request.url), void 0, emptyRecord(), target, startTime, body);
 		}
 		if (this.#isPreflight(request)) return this.#preflight(request, startTime);
-		const { path } = splitUrl(request.url);
+		const url = splitUrl(request.url);
+		const path = url.path;
 		if (reroute) {
 			const plan = this.#table.find(request.method, path);
 			if (plan !== void 0) return this.#route(plan, request, startTime, true);
@@ -3683,63 +3729,98 @@ var Pipeline = class {
 			kind: "error",
 			error: new MethodNotAllowedException(`Method ${request.method} is not allowed on ${truncate(path)}`, void 0, { headers: { allow: allowHeader(allowed) } })
 		};
-		return this.#serve(request, void 0, emptyRecord(), target, startTime, body);
+		return this.#serve(request, url, void 0, emptyRecord(), target, startTime, body);
 	}
 	/** A CORS preflight (with the `cors` option): answered without running any route. */
 	#isPreflight(request) {
 		return this.#options.cors !== void 0 && isPreflight(request.method, request.headers);
 	}
 	#preflight(request, startTime) {
-		const allowed = this.#table.allowedMethods(splitUrl(request.url).path);
+		const url = splitUrl(request.url);
+		const allowed = this.#table.allowedMethods(url.path);
 		const target = {
 			kind: "preflight",
 			allow: allowed.length === 0 ? void 0 : allowHeader(allowed)
 		};
-		return this.#serve(request, void 0, emptyRecord(), target, startTime, this.#options.body);
-	}
-	async #serve(request, route, params, target, startTime, body) {
-		const requestId = this.#requestId(request);
-		const proxy = this.#options.trustProxy;
-		const ctx = new RequestContext(request, {
-			requestId,
-			adapter: this.#options.adapter,
-			route,
-			params,
-			body,
-			cookies: this.#options.cookies ?? DEFAULT_COOKIE_SETTINGS,
-			...proxy === void 0 ? {} : { client: proxy.resolve(request.remoteAddress ?? request.ip, request.headers, request.encrypted === true) }
-		});
-		if (this.draining && target.kind === "route" && target.plan.definition.sse !== void 0) ctx.abort("shutdown");
-		const event = {
-			method: request.method,
-			path: ctx.path,
-			route: route?.path,
-			requestId,
-			headers: request.headers,
-			context: ctx,
-			startTime,
-			responseHeaders: {}
-		};
+		return this.#serve(request, url, void 0, emptyRecord(), target, startTime, this.#options.body);
+	}
+	#serve(request, url, route, params, target, startTime, body) {
+		this.#enter();
+		let requestId;
+		let ctx;
+		let event;
+		try {
+			requestId = this.#requestId(request);
+			const proxy = this.#options.trustProxy;
+			ctx = new RequestContext(request, {
+				requestId,
+				adapter: this.#options.adapter,
+				url,
+				route,
+				params,
+				body,
+				cookies: this.#options.cookies ?? DEFAULT_COOKIE_SETTINGS,
+				client: proxy === void 0 ? void 0 : proxy.resolve(request.remoteAddress ?? request.ip, request.headers, request.encrypted === true)
+			});
+			if (this.draining && target.kind === "route" && target.plan.definition.sse !== void 0) ctx.abort("shutdown");
+			event = {
+				method: request.method,
+				path: ctx.path,
+				route: route?.path,
+				requestId,
+				headers: request.headers,
+				context: ctx,
+				startTime,
+				responseHeaders: {}
+			};
+		} catch (error) {
+			this.#leave();
+			return Promise.reject(error);
+		}
 		let outcome;
-		let reply;
 		let cors;
 		const preflight = target.kind === "preflight";
-		let replied = () => void 0;
-		const ready = new Promise((resolve) => {
-			replied = resolve;
+		let resolve = () => void 0;
+		let reject = () => void 0;
+		const replied = new Promise((onReply, onError) => {
+			resolve = onReply;
+			reject = onError;
 		});
-		const done = this.#container.runInScope(async () => {
+		let answered = false;
+		const answer = (reply) => {
+			answered = true;
+			resolve(reply);
+		};
+		/** The request is over (response body sent or abandoned, scope closed). */
+		const over = () => {
+			ctx.complete();
+			try {
+				if (!answered) {
+					const failure = /* @__PURE__ */ new Error("Request not handled");
+					const reply = serializeError(500, this.#internalBody(failure), ctx.method);
+					const completed = this.#complete(reply, ctx, event, requestId, cors, preflight, true);
+					event.status = 500;
+					answer(completed);
+				}
+			} catch (error) {
+				reject(error);
+			} finally {
+				this.#leave();
+			}
+		};
+		this.#container.runInScope(async () => {
 			let hookError;
 			let failed = false;
 			let run;
 			if (this.#options.cors !== void 0) cors = await this.#corsDecision(request, requestId);
+			let recheck = this.#hooks.hasWrappers("http:request");
 			try {
-				await this.#hooks.run("http:request", event, async () => {
-					outcome = await this.#process(ctx, target, event, cors);
-					if (outcome !== RAW) outcome = this.#checkCookies(this.#checkHeaders(outcome, ctx, event), ctx, event);
-					run = captureContext();
+				if (recheck) await this.#hooks.run("http:request", event, async () => {
+					outcome = this.#checked(await this.#process(ctx, target, event, cors), ctx, event);
+					if (outcome !== RAW && isStreamed(outcome.body)) run = captureContext();
 					return outcome;
 				});
+				else outcome = this.#checked(await this.#process(ctx, target, event, cors), ctx, event);
 			} catch (error) {
 				failed = true;
 				hookError = error;
@@ -3750,33 +3831,41 @@ var Pipeline = class {
 				const fallback = await this.#errorReply(error, ctx);
 				outcome = this.#checkCookies(this.#checkHeaders(fallback, ctx, event), ctx, event);
 				event.status = outcome.status;
+				recheck = true;
 			} else if (failed) this.#logger.error("An \"http:request\" hook wrapper failed after the request was handled", {
 				err: hookError,
 				requestId
 			});
 			if (outcome === RAW) {
 				ctx.commit();
-				replied();
+				const status = request.rawStatus?.() ?? 200;
+				event.status ??= status;
+				answer({
+					status,
+					headers: {},
+					body: null,
+					raw: true
+				});
 				return;
 			}
-			const serialized = this.#complete(outcome, ctx, event, requestId, cors, preflight);
+			const serialized = this.#complete(outcome, ctx, event, requestId, cors, preflight, recheck);
 			const body = serialized.body;
-			if (!(body instanceof ReadableStream || body instanceof Blob)) {
-				reply = adapterReply(serialized, body);
+			if (!isStreamed(body)) {
+				const reply = adapterReply(serialized, body);
 				ctx.commit();
-				replied();
 				ctx.releaseBody();
+				answer(reply);
 				return;
 			}
 			const tracked = trackStream(body, run ?? captureContext(), () => ctx.abort("client"));
 			const session = serialized.sse;
-			reply = adapterReply(serialized, tracked.stream, body instanceof Blob ? body : void 0);
+			const reply = adapterReply(serialized, tracked.stream, body instanceof Blob ? body : void 0);
 			if (session !== void 0) {
 				this.#streams.add(session);
 				if (this.draining) session.close("shutdown");
 			}
 			ctx.commit();
-			replied();
+			answer(reply);
 			const failure = await tracked.done;
 			if (session !== void 0) this.#streams.delete(session);
 			if (failure !== void 0) this.#logger.error("The response stream failed", {
@@ -3785,49 +3874,30 @@ var Pipeline = class {
 				path: ctx.path
 			});
 			ctx.releaseBody();
-		}, [[HttpTokens.Context, ctx], [HttpTokens.RequestId, requestId]]).then(() => {
-			ctx.complete();
-		}, (error) => {
-			ctx.complete();
+		}, [[HttpTokens.Context, ctx], [HttpTokens.RequestId, requestId]]).then(over, (error) => {
+			over();
 			this.#logger.error("Failed to dispose request-scoped providers", {
 				err: error,
 				requestId
 			});
 		});
-		await Promise.race([ready, done]);
-		if (outcome === RAW) {
-			const status = request.rawStatus?.() ?? 200;
-			event.status ??= status;
-			this.#emit(event);
-			return {
-				reply: {
-					status,
-					headers: {},
-					body: null,
-					raw: true
-				},
-				done
-			};
-		}
-		if (reply === void 0) {
-			const failure = /* @__PURE__ */ new Error("Request not handled");
-			reply = this.#complete(serializeError(500, this.#internalBody(failure), ctx.method), ctx, event, requestId, cors, preflight);
-			event.status = 500;
-		}
-		this.#emit(event);
-		return {
-			reply,
-			done
-		};
+		if (!this.#hooks.hasListeners("http:request")) return replied;
+		return replied.then((reply) => {
+			this.#hooks.emit("http:request", event);
+			return reply;
+		});
 	}
 	/**
 	* Adds the headers of the `http:request` wrappers, then the framework headers (see
-	* {@link #frameworkHeaders}), then checks the final headers (see {@link #checkHeaders}).
+	* {@link #frameworkHeaders}). When wrappers ran (`recheck`), checks the final headers again (see
+	* {@link #checkHeaders}): the reply was checked before, and the cookies and framework headers are
+	* valid by construction.
 	*/
-	#complete(reply, ctx, event, requestId, cors, preflight) {
+	#complete(reply, ctx, event, requestId, cors, preflight, recheck) {
 		addMissingHeaders(reply.headers, event.responseHeaders);
 		applyCookies(reply, ctx);
 		this.#frameworkHeaders(reply.headers, requestId, cors, preflight);
+		if (!recheck) return reply;
 		const checked = this.#checkHeaders(reply, ctx, event);
 		if (checked !== reply) {
 			applyCookies(checked, ctx);
@@ -3835,6 +3905,12 @@ var Pipeline = class {
 		}
 		return checked;
 	}
+	/** Checks the headers (unless only the serialiser set them), then the cookies of a reply. */
+	#checked(outcome, ctx, event) {
+		if (outcome === RAW) return outcome;
+		const checked = outcome.ownHeaders === true ? outcome : this.#checkHeaders(outcome, ctx, event);
+		return this.#checkCookies(checked, ctx, event);
+	}
 	/**
 	* Serialises the cookies of an `HttpResponse` (`withCookie`) with the plugin settings (defaults,
 	* signing). A cookie breaking a rule that depends on them (a prefix with the `secure` default,
@@ -3869,7 +3945,7 @@ var Pipeline = class {
 	*/
 	#frameworkHeaders(headers, requestId, cors, preflight) {
 		const header = this.#options.requestIdHeader;
-		if (header !== void 0 && headers[header] === void 0 && isHeaderValue(requestId)) headers[header] = requestId;
+		if (header !== void 0 && headers[header] === void 0 && (this.#validIds || isHeaderValue(requestId))) headers[header] = requestId;
 		const policy = this.#options.cors;
 		if (policy !== void 0) {
 			if (!preflight) {
@@ -3878,8 +3954,7 @@ var Pipeline = class {
 			}
 			if (policy.varyOrigin) mergeVary(headers, "origin");
 		}
-		const security = this.#options.securityHeaders;
-		if (security !== void 0) addMissingHeaders(headers, security);
+		for (const [name, value] of this.#securityHeaders) if (headers[name] === void 0) headers[name] = value;
 		if (this.draining) headers["connection"] = "close";
 	}
 	/**
@@ -3921,7 +3996,12 @@ var Pipeline = class {
 		this.#log(error, ctx);
 		return serializeError(500, this.#internalBody(error), ctx.method);
 	}
-	async #process(ctx, target, event, cors) {
+	/** The outcome of a request: its route run, or a reply of the framework. Never rejects (errors are mapped). */
+	#process(ctx, target, event, cors) {
+		return target.kind === "route" ? this.#invoke(ctx, target.plan, event) : this.#answer(ctx, target, event, cors);
+	}
+	/** Answers a request without running a route. Never rejects. */
+	async #answer(ctx, target, event, cors) {
 		try {
 			switch (target.kind) {
 				case "error": throw target.error;
@@ -3944,45 +4024,55 @@ var Pipeline = class {
 					status: 308,
 					headers: { location: target.location }
 				}));
-				default: return await this.#invoke(ctx, target.plan, event);
 			}
 		} catch (error) {
-			event.error = error;
-			const reply = await this.#errorReply(error, ctx);
-			event.status = reply.status;
-			return reply;
+			return await this.#failed(error, ctx, event);
 		}
 	}
+	/** The reply of an error (see {@link #errorReply}), recorded on the event. */
+	async #failed(error, ctx, event) {
+		event.error = error;
+		const reply = await this.#errorReply(error, ctx);
+		event.status = reply.status;
+		return reply;
+	}
+	/** Runs a route: guards, body, interceptors, handler, serialisation. Never rejects (errors are mapped). */
 	async #invoke(ctx, plan, event) {
-		const controller = this.#resolve(plan.controller);
-		for (const guard of plan.guards) if (await this.#resolve(guard).canActivate(ctx) !== true) throw new ForbiddenException("Forbidden resource");
-		if (plan.parseBody) await ctx.parseBody();
-		const definition = plan.definition;
-		const interceptors = plan.interceptors;
-		let result;
-		if (interceptors.length === 0) result = await definition.invoke(controller, ctx);
-		else {
-			const chain = async (index) => {
-				if (index === interceptors.length) return await definition.invoke(controller, ctx);
-				return await this.#resolve(interceptors[index]).intercept(ctx, () => chain(index + 1));
+		try {
+			const controller = this.#resolve(plan.controller);
+			for (const guard of plan.guards) if (await this.#resolve(guard).canActivate(ctx) !== true) throw new ForbiddenException("Forbidden resource");
+			if (plan.parseBody) await ctx.parseBody();
+			const definition = plan.definition;
+			const interceptors = plan.interceptors;
+			let result;
+			if (interceptors.length === 0) {
+				result = definition.invoke(controller, ctx);
+				if (isThenable(result)) result = await result;
+			} else {
+				const chain = async (index) => {
+					if (index === interceptors.length) return await definition.invoke(controller, ctx);
+					return await this.#resolve(interceptors[index]).intercept(ctx, () => chain(index + 1));
+				};
+				result = await chain(0);
+			}
+			if (definition.rawResponse === true && !(result instanceof Response)) return RAW;
+			const options = {
+				method: ctx.method,
+				routeMethod: definition.method,
+				status: definition.status,
+				headers: definition.headers,
+				context: ctx.hasResponseHeaders ? ctx.responseHeaders : void 0
 			};
-			result = await chain(0);
+			const sse = definition.sse;
+			let reply;
+			if (sse !== void 0 && !(result instanceof Response) && !isHttpResponse(result)) {
+				if (!isSseSource(result)) throw new TypeError(`@Sse handler ${displayName(plan.info.controller)}.${definition.handler} must return an AsyncIterable, an Iterable or a ReadableStream of SseEvent (received ${describeResult(result)})`);
+				reply = serializeSseReply(this.#openStream(result, sseOptions(sse), ctx), void 0, options);
+			} else reply = isHttpResponse(result) ? await this.#serialize(result, ctx, options, sse) : serializeResult(result, options);
+			return this.#finish(event, reply);
+		} catch (error) {
+			return await this.#failed(error, ctx, event);
 		}
-		if (definition.rawResponse === true && !(result instanceof Response)) return RAW;
-		const options = {
-			method: ctx.method,
-			routeMethod: definition.method,
-			status: definition.status,
-			headers: definition.headers,
-			context: ctx.hasResponseHeaders ? ctx.responseHeaders : void 0
-		};
-		const sse = definition.sse;
-		let reply;
-		if (sse !== void 0 && !(result instanceof Response) && !isHttpResponse(result)) {
-			if (!isSseSource(result)) throw new TypeError(`@Sse handler ${displayName(plan.info.controller)}.${definition.handler} must return an AsyncIterable, an Iterable or a ReadableStream of SseEvent (received ${describeResult(result)})`);
-			reply = serializeSseReply(this.#openStream(result, sseOptions(sse), ctx), void 0, options);
-		} else reply = await this.#serialize(result, ctx, options, sse);
-		return this.#finish(event, reply);
 	}
 	/** Serialises a handler (or exception mapper) result; file bodies are resolved, event streams opened. */
 	async #serialize(result, ctx, options, route) {
@@ -4132,17 +4222,9 @@ var Pipeline = class {
 		}
 		return this.#options.generateRequestId();
 	}
-	#emit(event) {
-		if (this.#hooks.hasListeners("http:request")) this.#hooks.emit("http:request", event);
-	}
 	#enter() {
 		this.#inflight++;
 	}
-	/** Leaves once the request is over (immediately when it failed before being served). */
-	#leaveWhen(served) {
-		if (served === void 0) this.#leave();
-		else served.done.then(() => this.#leave());
-	}
 	#leave() {
 		this.#inflight--;
 		if (this.#inflight === 0 && this.#idle.length > 0) {
@@ -4159,6 +4241,13 @@ var Pipeline = class {
 * before a quiet stream's first byte, and lifts idle timeouts.
 */
 function adapterReply(serialized, body, blob) {
+	const text = serialized.text;
+	if (text !== void 0) return {
+		status: serialized.status,
+		headers: serialized.headers,
+		body,
+		text
+	};
 	const reply = {
 		status: serialized.status,
 		headers: serialized.headers,
@@ -4180,7 +4269,7 @@ function adapterReply(serialized, body, blob) {
 * one in place. One line per cookie.
 */
 function applyCookies(reply, ctx) {
-	const own = reply.cookieLines ?? [];
+	const own = reply.cookieLines ?? NO_COOKIE_LINES;
 	const context = ctx.cookieLines;
 	if (own.length === 0 && context.length === 0) return;
 	const merged = /* @__PURE__ */ new Map();
@@ -4192,6 +4281,11 @@ function applyCookies(reply, ctx) {
 	else if (existing !== void 0) raw = [...existing];
 	reply.headers["set-cookie"] = [...raw, ...merged.values()];
 }
+const NO_COOKIE_LINES = Object.freeze([]);
+/** Whether a reply body is streamed (a file is read through a stream too). */
+function isStreamed(body) {
+	return body instanceof ReadableStream || body instanceof Blob;
+}
 /** `SseOptions` of the `sse` metadata of a route (`heartbeat: 0` disables the heartbeat). */
 function sseOptions(definition) {
 	return {
@@ -5029,7 +5123,7 @@ function resolve$1(options) {
 	if (typeof drainTimeoutMs !== "number" || !(drainTimeoutMs >= 0)) throw invalidOption("drainTimeoutMs", "a positive number (or Infinity)", drainTimeoutMs);
 	const requestIdHeader = options.requestIdHeader ?? DEFAULT_REQUEST_ID_HEADER;
 	if (requestIdHeader !== false && (typeof requestIdHeader !== "string" || !isHeaderName(requestIdHeader))) throw invalidOption("requestIdHeader", "a header name or false", requestIdHeader);
-	const generateRequestId = options.generateRequestId ?? (() => crypto.randomUUID());
+	const generateRequestId = options.generateRequestId ?? randomRequestId;
 	if (typeof generateRequestId !== "function") throw invalidOption("generateRequestId", "a function", generateRequestId);
 	const adapter = options.adapter ?? nodeAdapter();
 	if (adapter === null || typeof adapter !== "object" || typeof adapter.registerRoute !== "function" || typeof adapter.listen !== "function" || typeof adapter.inject !== "function") throw invalidOption("adapter", "an HttpAdapter (nodeAdapter(), fastifyAdapter()...)", adapter);