@znight/http 0.1.1 → 0.1.3

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import { n as RouteTable, t as nodeAdapter } from "./node-BUnkdSsa.mjs";
-import { $ as UnprocessableEntityException, A as serializeCookie, B as ConflictException, C as decodeCookieValue, D as parseCookieHeader, E as isCookieName, F as isStreamSource, G as InternalServerErrorException, H as GatewayTimeoutException, I as toByteStream, J as NotImplementedException, K as MethodNotAllowedException, L as trackStream, M as captureContext, N as discardStream, O as parseSetCookie, P as isByteStream, Q as UnauthorizedException, R as BadGatewayException, S as checkCookie, T as givenCookieKey, U as GoneException, V as ForbiddenException, W as HttpException, X as ServiceUnavailableException, Y as PayloadTooLargeException, Z as TooManyRequestsException, at as isBodylessStatus, et as UnsupportedMediaTypeException, h as isEventStreamType, it as toIssueDetail, j as serializeResponseCookie, k as serializeClearCookie, nt as isHttpException, ot as isValidStatus, q as NotFoundException, rt as issue, st as statusText, tt as ValidationException, w as encodeCookieValue, x as DEFAULT_COOKIE_OPTIONS, z as BadRequestException } from "./node-io-BY1ZDLRQ.mjs";
+import { n as RouteTable, t as nodeAdapter } from "./node-DnYv_AMI.mjs";
+import { $ as TooManyRequestsException, A as parseSetCookie, B as BadGatewayException, C as DEFAULT_COOKIE_OPTIONS, D as givenCookieKey, E as encodeCookieValue, F as discardStream, G as GoneException, H as ConflictException, I as isByteStream, J as MethodNotAllowedException, K as HttpException, L as isStreamSource, M as serializeCookie, N as serializeResponseCookie, O as isCookieName, P as captureContext, Q as ServiceUnavailableException, R as toByteStream, T as decodeCookieValue, U as ForbiddenException, V as BadRequestException, W as GatewayTimeoutException, X as NotImplementedException, Y as NotFoundException, Z as PayloadTooLargeException, at as issue, ct as isValidStatus, et as UnauthorizedException, g as isEventStreamType, it as isHttpException, j as serializeClearCookie, k as parseCookieHeader, lt as statusText, nt as UnsupportedMediaTypeException, ot as toIssueDetail, q as InternalServerErrorException, rt as ValidationException, st as isBodylessStatus, tt as UnprocessableEntityException, w as checkCookie, z as trackStream } from "./node-io-BkdRSQeg.mjs";
 import { a as isMediaTypePattern, i as contentTypeFor, n as parseByteSize, o as matchesMediaType, r as OCTET_STREAM, s as mediaTypeEssence, t as formatByteSize } from "./size-D8rsQcV0.mjs";
-import { i as isThenable, n as errorMessage, t as emptyRecord } from "./utils-DCbu3a4w.mjs";
+import { a as isThenable, i as isBun, n as errorMessage, r as fastRecord, t as emptyRecord } from "./utils-DIWdzVht.mjs";
 import { RoutePathError, compareRoutePaths, compareStrings, decodePathValue, joinPaths, matchRoutePath, normalizePath, parseRoutePath } from "./path.mjs";
 import { Readable } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
@@ -483,9 +483,35 @@ function splitUrl(url) {
 }
 // src/body.ts
 const UTF8 = new TextDecoder("utf-8", { fatal: true });
+/**
+* Parsed `content-type` values: an application receives a handful of them, parsed twice per request
+* with a body (request context, then {@link parseBody}). Bounded, since clients choose the values:
+* cleared when full.
+*/
+const MEDIA_TYPES = /* @__PURE__ */ new Map();
+const MEDIA_TYPES_MAX = 64;
 /** Parses a `content-type` header value (`application/json; charset=utf-8`). */
 function parseMediaType(header) {
 	if (header === void 0) return void 0;
+	if (header === "application/json") return {
+		type: "application/json",
+		charset: void 0
+	};
+	const cached = MEDIA_TYPES.get(header);
+	if (cached !== void 0) return {
+		type: cached.type,
+		charset: cached.charset
+	};
+	const media = parseUncached(header);
+	if (media === void 0) return void 0;
+	if (MEDIA_TYPES.size === MEDIA_TYPES_MAX) MEDIA_TYPES.clear();
+	MEDIA_TYPES.set(header, media);
+	return {
+		type: media.type,
+		charset: media.charset
+	};
+}
+function parseUncached(header) {
 	const separator = header.indexOf(";");
 	const type = (separator === -1 ? header : header.slice(0, separator)).trim().toLowerCase();
 	if (type === "") return void 0;
@@ -537,12 +563,16 @@ function hasBody(headers) {
 */
 function parseBody(bytes, contentType, contentEncoding) {
 	try {
-		return Promise.resolve(parseBytes(bytes, contentType, contentEncoding));
+		return Promise.resolve(parseBodyBytes(bytes, contentType, contentEncoding));
 	} catch (error) {
 		return Promise.reject(error);
 	}
 }
-function parseBytes(bytes, contentType, contentEncoding) {
+/**
+* {@link parseBody} without the promise: returns the parsed body or throws its `HttpException`
+* (internal: the request context parses the buffered body with it, without an extra microtask).
+*/
+function parseBodyBytes(bytes, contentType, contentEncoding) {
 	if (bytes.byteLength === 0) return void 0;
 	checkContentEncoding(contentEncoding);
 	const media = parseMediaType(contentType);
@@ -601,7 +631,29 @@ function single(value, label) {
 	if (Array.isArray(value)) throw new BadRequestException(`Invalid ${label}: expected a single value, received ${value.length}`);
 	throw invalid$1(label, "a string", value);
 }
+/** Longest run of decimal digits whose value is exact without parsing (`999999999999999` < 2^53). */
+const MAX_FAST_DIGITS = 15;
+/**
+* The value of `text` when it is 1 to 15 ASCII decimal digits (the common `/users/42`), `-1`
+* otherwise. The same number as `Number(text)` for such a string, without the regular expression,
+* the trim and the parse of the general path.
+*/
+function digitsValue(text) {
+	const length = text.length;
+	if (length === 0 || length > MAX_FAST_DIGITS) return -1;
+	let result = 0;
+	for (let index = 0; index < length; index++) {
+		const digit = text.charCodeAt(index) - 48;
+		if (digit < 0 || digit > 9) return -1;
+		result = result * 10 + digit;
+	}
+	return result;
+}
 function toNumber(value, label) {
+	if (typeof value === "string") {
+		const digits = digitsValue(value);
+		if (digits !== -1) return digits;
+	}
 	const raw = single(value, label);
 	const text = raw.trim();
 	if (NUMBER.test(text)) {
@@ -611,6 +663,10 @@ function toNumber(value, label) {
 	throw invalid$1(label, "a number", raw);
 }
 function toInteger(value, label) {
+	if (typeof value === "string") {
+		const digits = digitsValue(value);
+		if (digits !== -1) return digits;
+	}
 	const raw = single(value, label);
 	const text = raw.trim();
 	if (INTEGER.test(text)) {
@@ -620,6 +676,8 @@ function toInteger(value, label) {
 	throw invalid$1(label, "an integer", raw);
 }
 function toBoolean(value, label) {
+	if (value === "true" || value === "1") return true;
+	if (value === "false" || value === "0") return false;
 	const raw = single(value, label);
 	switch (raw.trim().toLowerCase()) {
 		case "true":
@@ -781,8 +839,27 @@ const ABORT_MESSAGES = {
 	shutdown: "The server is shutting down",
 	expired: "The event stream reached its maxDuration"
 };
+/**
+* The state of a request context that most requests never need (parsed query, `ctx.state`, body,
+* request cookies, abort signal), created on first use: a context is created for every request.
+*/
+var ContextState = class {
+	query = void 0;
+	state = void 0;
+	body = void 0;
+	files = void 0;
+	raw = void 0;
+	streamed = false;
+	/** Stops the body stream opened for the request, unless it was read to its end or cancelled. */
+	stopBody = void 0;
+	parsed = void 0;
+	cookies = void 0;
+	signed = void 0;
+	abortReason = void 0;
+	abortController = void 0;
+};
 /** Implementation of {@link HttpContext} used by the pipeline (internal). */
-var RequestContext = class {
+var RequestContext = class RequestContext {
 	requestId;
 	method;
 	url;
@@ -798,60 +875,64 @@ var RequestContext = class {
 	#source;
 	#plan;
 	#rawQuery;
-	#query;
-	#state;
-	#responseHeaders;
-	#body;
-	#files;
-	#raw;
-	#streamed = false;
-	/** Stops the body stream opened for the request, unless it was read to its end or cancelled. */
-	#stopBody;
-	#parsed;
 	#cookieSettings;
-	#cookies;
-	#signed;
+	#responseHeaders = void 0;
 	/** Cookies set on the response, by key (name, domain, path), with their `Set-Cookie` line. */
-	#jar;
+	#jar = void 0;
 	/** The response headers were handed to the adapter (cookies can no longer be set). */
 	#committed = false;
 	/** The request is over: later aborts are ignored. */
 	#completed = false;
-	#abortReason;
-	#abortController;
-	constructor(source, init) {
+	#more = void 0;
+	/** `path` and `query`: `source.url` split; `client`: see {@link RequestContextInit.client}. */
+	constructor(source, requestId, adapter, path, query, route, params, body, cookies, client) {
 		this.#source = source;
-		this.#plan = init.body;
-		this.#cookieSettings = init.cookies ?? DEFAULT_COOKIE_SETTINGS;
-		const { path, query } = splitUrl(source.url);
+		this.#plan = body;
+		this.#cookieSettings = cookies;
 		this.#rawQuery = query;
-		this.requestId = init.requestId;
+		this.requestId = requestId;
 		this.method = source.method;
 		this.url = source.url;
 		this.path = path;
-		this.params = init.params;
+		this.params = params;
 		this.headers = source.headers;
-		this.route = init.route;
+		this.route = route;
 		this.request = source.raw;
 		this.response = source.rawResponse;
-		this.adapter = init.adapter;
-		const connection = source.encrypted === true ? "https" : "http";
-		this.ip = init.client === void 0 ? source.ip : init.client.ip;
-		this.protocol = init.client === void 0 ? connection : init.client.protocol;
+		this.adapter = adapter;
+		if (client === void 0) {
+			this.ip = source.ip;
+			this.protocol = source.encrypted === true ? "https" : "http";
+		} else {
+			this.ip = client.ip;
+			this.protocol = client.protocol;
+		}
+	}
+	/** A context from named settings (defaults: `source.url` split, secure cookie defaults, the adapter's client). */
+	static of(source, init) {
+		const { path, query } = init.url ?? splitUrl(source.url);
+		return new RequestContext(source, init.requestId, init.adapter, path, query, init.route, init.params, init.body, init.cookies ?? DEFAULT_COOKIE_SETTINGS, init.client);
+	}
+	/** The state created on first use. */
+	get #extra() {
+		this.#more ??= new ContextState();
+		return this.#more;
 	}
 	get query() {
-		this.#query ??= parseQuery(this.#rawQuery);
-		return this.#query;
+		const state = this.#extra;
+		state.query ??= parseQuery(this.#rawQuery);
+		return state.query;
 	}
 	get state() {
-		this.#state ??= /* @__PURE__ */ new Map();
-		return this.#state;
+		const state = this.#extra;
+		state.state ??= /* @__PURE__ */ new Map();
+		return state.state;
 	}
 	get body() {
-		return this.#body;
+		return this.#more?.body;
 	}
 	get files() {
-		return this.#files ?? NO_FILES$1;
+		return this.#more?.files ?? NO_FILES$1;
 	}
 	/** Maximum body size of the route, in bytes. */
 	get bodyLimit() {
@@ -879,16 +960,18 @@ var RequestContext = class {
 		else this.#responseHeaders[key] = typeof existing === "string" ? [existing, value] : [...existing, value];
 	}
 	get cookies() {
-		this.#cookies ??= parseCookieHeader(this.headers["cookie"]);
-		return this.#cookies;
+		const state = this.#extra;
+		state.cookies ??= parseCookieHeader(this.headers["cookie"]);
+		return state.cookies;
 	}
 	signedCookie(name) {
 		const signer = this.#cookieSettings.signer;
 		if (signer === void 0) throw missingSecrets(`Cannot read the signed cookie ${JSON.stringify(String(name))}`);
-		this.#signed ??= /* @__PURE__ */ new Map();
-		if (this.#signed.has(name)) return this.#signed.get(name);
+		const state = this.#extra;
+		state.signed ??= /* @__PURE__ */ new Map();
+		if (state.signed.has(name)) return state.signed.get(name);
 		const value = verifySigned(signer, name, this.cookies[name]);
-		this.#signed.set(name, value);
+		state.signed.set(name, value);
 		return value;
 	}
 	setCookie(name, value, options = {}) {
@@ -908,9 +991,13 @@ var RequestContext = class {
 	get responseCookies() {
 		return this.#jar === void 0 ? NO_COOKIES$1 : [...this.#jar.values()].map((entry) => entry.cookie);
 	}
+	/** Whether {@link setCookie} / {@link clearCookie} were called (internal). */
+	get hasCookies() {
+		return this.#jar !== void 0;
+	}
 	/** The `Set-Cookie` lines of {@link setCookie} / {@link clearCookie}, with their keys, in order (internal). */
 	get cookieLines() {
-		return this.#jar === void 0 ? [] : [...this.#jar].map(([key, entry]) => ({
+		return this.#jar === void 0 ? NO_LINES : [...this.#jar].map(([key, entry]) => ({
 			key,
 			line: entry.line
 		}));
@@ -932,27 +1019,29 @@ var RequestContext = class {
 		});
 	}
 	get signal() {
-		if (this.#abortController === void 0) {
+		const state = this.#extra;
+		if (state.abortController === void 0) {
 			const controller = new AbortController();
-			this.#abortController = controller;
-			if (this.#abortReason !== void 0) controller.abort(this.#abortReason);
+			state.abortController = controller;
+			if (state.abortReason !== void 0) controller.abort(state.abortReason);
 			else if (!this.#completed) this.#source.onAbort?.(() => this.abort("client"));
 		}
-		return this.#abortController.signal;
+		return state.abortController.signal;
 	}
 	/** Whether {@link signal} aborted (or will be created aborted). */
 	get aborted() {
-		return this.#abortReason !== void 0;
+		return this.#more?.abortReason !== void 0;
 	}
 	/**
 	* Aborts {@link signal} with a {@link RequestAbortedError} of `kind` (internal): at most once, and
 	* never once the request is over ({@link complete}).
 	*/
 	abort(kind) {
-		if (this.#abortReason !== void 0 || this.#completed) return;
+		if (this.#more?.abortReason !== void 0 || this.#completed) return;
 		const reason = new RequestAbortedError(kind);
-		this.#abortReason = reason;
-		this.#abortController?.abort(reason);
+		const state = this.#extra;
+		state.abortReason = reason;
+		state.abortController?.abort(reason);
 	}
 	/** The response headers are handed to the adapter: cookies can no longer be set (internal). */
 	commit() {
@@ -963,15 +1052,17 @@ var RequestContext = class {
 		this.#completed = true;
 	}
 	rawBody() {
-		if (this.#raw === void 0) {
-			if (this.#streamed) return Promise.reject(alreadyStreamed());
-			this.#raw = this.#source.readBody(this.#plan.limit);
+		const state = this.#extra;
+		if (state.raw === void 0) {
+			if (state.streamed) return Promise.reject(alreadyStreamed());
+			state.raw = this.#source.readBody(this.#plan.limit);
 		}
-		return this.#raw;
+		return state.raw;
 	}
 	bodyStream() {
-		if (this.#raw !== void 0 || this.#streamed) throw alreadyStreamed();
-		this.#streamed = true;
+		const state = this.#extra;
+		if (state.raw !== void 0 || state.streamed) throw alreadyStreamed();
+		state.streamed = true;
 		return this.#openBodyStream();
 	}
 	/**
@@ -980,18 +1071,21 @@ var RequestContext = class {
 	* adapter discard the rest of the body, so that the connection can serve the next request.
 	*/
 	releaseBody() {
-		const stop = this.#stopBody;
-		this.#stopBody = void 0;
+		const state = this.#more;
+		if (state === void 0) return;
+		const stop = state.stopBody;
+		state.stopBody = void 0;
 		stop?.();
 	}
 	/** The body as a stream (see {@link releaseBody}). */
 	#openBodyStream() {
 		const reader = openBodyStream(this.#source, this.#plan.limit).getReader();
+		const state = this.#extra;
 		let controller;
 		const settle = () => {
-			this.#stopBody = void 0;
+			state.stopBody = void 0;
 		};
-		this.#stopBody = () => {
+		state.stopBody = () => {
 			reader.cancel().catch(() => void 0);
 			try {
 				controller?.error(/* @__PURE__ */ new Error("The request is over: its body can no longer be read"));
@@ -1023,32 +1117,34 @@ var RequestContext = class {
 		}, { highWaterMark: 0 });
 	}
 	parseBody() {
-		this.#parsed ??= this.#parse();
-		return this.#parsed;
+		const state = this.#extra;
+		state.parsed ??= this.#parse();
+		return state.parsed;
 	}
 	async #parse() {
 		const headers = this.headers;
 		const contentType = headers["content-type"];
 		const media = parseMediaType(contentType);
+		const state = this.#extra;
 		if (media?.type === "multipart/form-data") {
 			checkContentEncoding(headers["content-encoding"]);
 			const policy = this.#plan.multipart;
 			let result;
-			if (this.#raw === void 0) {
-				if (this.#streamed) throw alreadyStreamed();
-				this.#streamed = true;
+			if (state.raw === void 0) {
+				if (state.streamed) throw alreadyStreamed();
+				state.streamed = true;
 				result = await readMultipart(this.#openBodyStream(), contentType, policy);
-			} else result = parseMultipart(await this.#raw, contentType, policy);
-			this.#files = result.files;
-			this.#body = result.fields;
+			} else result = parseMultipart(await state.raw, contentType, policy);
+			state.files = result.files;
+			state.body = result.fields;
 			return result.fields;
 		}
 		if (this.#plan.upload) {
 			if (!(headers["content-length"] !== void 0 || headers["transfer-encoding"] !== void 0 ? hasBody(headers) : this.#source.hasBody?.() === true)) return void 0;
 			throw new UnsupportedMediaTypeException(`Expected a multipart/form-data body${media === void 0 ? "" : ` (received ${JSON.stringify(media.type)})`}`);
 		}
-		const body = await parseBody(await this.rawBody(), contentType, headers["content-encoding"]);
-		this.#body = body;
+		const body = parseBodyBytes(await this.rawBody(), contentType, headers["content-encoding"]);
+		state.body = body;
 		return body;
 	}
 };
@@ -1071,6 +1167,7 @@ function withoutLifetime(options) {
 }
 const EMPTY_HEADERS = Object.freeze({});
 const NO_COOKIES$1 = Object.freeze([]);
+const NO_LINES = Object.freeze([]);
 const NO_FILES$1 = Object.freeze(emptyRecord());
 // src/decorators.ts
 function marker() {}
@@ -1787,7 +1884,7 @@ function encodeExtValue(value) {
 */
 /** Length of a signature: base64url of 32 bytes, without padding. */
 const SIGNATURE_LENGTH = 43;
-const ENCODER$2 = new TextEncoder();
+const ENCODER$3 = new TextEncoder();
 /**
 * Signs and verifies cookie values. The wire form of a signed cookie is
 * `<encoded value>.<signature>` with `signature = base64url(HMAC-SHA256(secret, "<name>=<encoded value>"))`:
@@ -1834,7 +1931,7 @@ function isSignature(text) {
 	return true;
 }
 function toBytes(secret) {
-	return typeof secret === "string" ? ENCODER$2.encode(secret) : secret;
+	return typeof secret === "string" ? ENCODER$3.encode(secret) : secret;
 }
 /**
 * Normalises the option `cookies.secrets` to a list, or explains what is wrong with it (a secret
@@ -2850,8 +2947,8 @@ function describe$1(value) {
 function errorText(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-const ENCODER$1 = new TextEncoder();
-const HEARTBEAT = ENCODER$1.encode(":\n\n");
+const ENCODER$2 = new TextEncoder();
+const HEARTBEAT = ENCODER$2.encode(":\n\n");
 /**
 * One event stream: the byte stream sent to the client and the controls of the pipeline
 * ({@link close} on shutdown or `maxDuration`). The source is read only when the client pulls
@@ -2901,7 +2998,7 @@ var SseSession = class {
 			start: (controller) => {
 				this.#controller = controller;
 				const retry = settings.retry;
-				controller.enqueue(retry === void 0 ? HEARTBEAT : ENCODER$1.encode(`retry: ${retry}\n\n`));
+				controller.enqueue(retry === void 0 ? HEARTBEAT : ENCODER$2.encode(`retry: ${retry}\n\n`));
 				if (settings.maxDuration !== void 0) this.#maxTimer = unref(setTimeout(() => this.close("expired"), timerDelay(settings.maxDuration)));
 			},
 			pull: (controller) => this.#pull(controller),
@@ -2964,7 +3061,7 @@ var SseSession = class {
 				await this.#finish(true);
 				return;
 			}
-			controller.enqueue(ENCODER$1.encode(encoded));
+			controller.enqueue(ENCODER$2.encode(encoded));
 			this.#atBoundary = true;
 			this.#lineHasContent = false;
 			this.#afterCr = false;
@@ -3092,7 +3189,7 @@ var SseSession = class {
 	#finalRetry() {
 		const base = this.#settings.retry ?? 3e3;
 		const random = this.#settings.random ?? Math.random;
-		return ENCODER$1.encode(`retry: ${Math.round(base + random() * base)}\n\n`);
+		return ENCODER$2.encode(`retry: ${Math.round(base + random() * base)}\n\n`);
 	}
 	/**
 	* Stops the source (`return()` / `cancel()`) and waits for it at most `stopTimeoutMs`: an async
@@ -3343,10 +3440,19 @@ function withCookie(cookies, cookie) {
 }
 /** Whether `value` is an {@link HttpResponse} (also across duplicated package copies). */
 function isHttpResponse(value) {
-	return value instanceof HttpResponse || value !== null && typeof value === "object" && value.constructor?.name === "HttpResponse" && "body" in value && "headers" in value;
+	if (value instanceof HttpResponse) return true;
+	if (value === null || typeof value !== "object") return false;
+	const type = value.constructor;
+	if (type === Object || type === Array) return false;
+	return type?.name === "HttpResponse" && "body" in value && "headers" in value;
 }
 // src/serialize.ts
-const ENCODER = new TextEncoder();
+const ENCODER$1 = new TextEncoder();
+/**
+* UTF-8 encoding of a text body: a pooled `Buffer` (a `Uint8Array`) is several times cheaper than
+* `TextEncoder` on Node.js, `TextEncoder` is the fastest on Bun.
+*/
+const utf8$1 = isBun() ? (text) => ENCODER$1.encode(text) : (text) => Buffer$1.from(text, "utf8");
 /** Content types set by the serialiser. */
 const ContentType = Object.freeze({
 	json: "application/json; charset=utf-8",
@@ -3385,12 +3491,28 @@ function serializeResult(result, options) {
 		cookies = cookiesOf(result);
 	}
 	const finalStatus = options.status ?? status ?? defaultStatus(options.routeMethod, payload);
-	const headers = emptyRecord();
-	const body = encode(payload, headers);
-	if (options.headers !== void 0) assignHeaders(headers, options.headers);
-	if (options.context !== void 0) assignHeaders(headers, options.context);
-	if (extra !== void 0) assignHeaders(headers, extra);
-	return withCookies(finish(finalStatus, headers, body, options.method), cookies);
+	const headers = fastRecord();
+	const encoded = encode(payload, headers);
+	let body;
+	let text;
+	if (typeof encoded === "string") {
+		text = encoded;
+		body = encodeText(encoded, headers, sendsBody(finalStatus, options.method));
+	} else body = encoded;
+	let own = true;
+	if (options.headers !== void 0) {
+		assignHeaders(headers, options.headers);
+		own = false;
+	}
+	if (options.context !== void 0) {
+		assignHeaders(headers, options.context);
+		own = false;
+	}
+	if (extra !== void 0) {
+		assignHeaders(headers, extra);
+		own = false;
+	}
+	return withCookies(finish(finalStatus, headers, body, options.method, text, own), cookies);
 }
 /**
 * Serialises an event stream (`@Sse` result, `HttpResponse.sse()`): status 200 unless `@HttpCode`
@@ -3401,7 +3523,7 @@ function serializeResult(result, options) {
 */
 function serializeSseReply(session, response, options) {
 	const status = options.status ?? response?.status ?? 200;
-	const headers = emptyRecord();
+	const headers = fastRecord();
 	headers["cache-control"] = "no-cache, no-transform";
 	headers["x-accel-buffering"] = "no";
 	if (options.headers !== void 0) assignHeaders(headers, options.headers);
@@ -3434,7 +3556,7 @@ function withCookies(reply, cookies) {
 */
 function serializeFileReply(file, response, options) {
 	const status = file.status === 200 ? options.status ?? response.status ?? 200 : file.status;
-	const headers = emptyRecord();
+	const headers = fastRecord();
 	assignHeaders(headers, file.headers);
 	if (options.headers !== void 0) assignHeaders(headers, options.headers);
 	if (options.context !== void 0) assignHeaders(headers, options.context);
@@ -3448,8 +3570,10 @@ function defaultStatus(routeMethod, payload) {
 }
 /** Serialises an error body as JSON. */
 function serializeError(status, body, method) {
-	const headers = emptyRecord();
-	return finish(status, headers, encode(body, headers), method);
+	const headers = fastRecord();
+	const encoded = encode(body, headers);
+	if (typeof encoded !== "string") return finish(status, headers, encoded, method);
+	return finish(status, headers, encodeText(encoded, headers, sendsBody(status, method)), method, encoded);
 }
 /** Copies headers with lower-case names (later values win). */
 function assignHeaders(target, source) {
@@ -3466,7 +3590,11 @@ function addMissingHeaders(target, source) {
 		if (value !== void 0 && target[key] === void 0) target[key] = typeof value === "string" ? value : [...value];
 	}
 }
-function finish(status, headers, body, method) {
+/**
+* The reply of a body: `text` is the string `body` encodes (see {@link encodeText}). `own`: only
+* {@link encode} set `headers`, which are then valid for a text body.
+*/
+function finish(status, headers, body, method, text, own = false) {
 	if (isBodylessStatus(status)) {
 		discard(body);
 		delete headers["content-type"];
@@ -3485,18 +3613,53 @@ function finish(status, headers, body, method) {
 			body: null
 		};
 	}
-	return {
+	if (text === void 0) return {
 		status,
 		headers,
 		body
 	};
+	return own ? {
+		status,
+		headers,
+		body,
+		text,
+		ownHeaders: true
+	} : {
+		status,
+		headers,
+		body,
+		text
+	};
 }
 function discard(body) {
 	if (body instanceof ReadableStream) discardStream(body);
 }
+/** Whether a reply with this status, to this method, carries its body (see {@link finish}). */
+function sendsBody(status, method) {
+	return method !== "HEAD" && !isBodylessStatus(status);
+}
+/**
+* Sets the `content-length` of a text body (right after its `content-type`, before the route
+* headers) and returns its UTF-8 bytes: their length is the header, a lone surrogate counting as
+* U+FFFD. `null` when the reply sends no body (`HEAD`, bodyless status): nothing is encoded then,
+* `Buffer.byteLength` counts the same bytes.
+*/
+function encodeText(text, headers, sent) {
+	if (!sent) {
+		headers["content-length"] = String(Buffer$1.byteLength(text, "utf8"));
+		return null;
+	}
+	const bytes = utf8$1(text);
+	headers["content-length"] = String(bytes.byteLength);
+	return bytes;
+}
+/**
+* The body of a payload, its `content-type` and, for bytes, its `content-length` set in `headers`.
+* Text (a string, JSON) is returned as a string: {@link encodeText} sets its length and encodes it.
+*/
 function encode(payload, headers) {
 	if (payload === void 0) return null;
-	if (typeof payload === "string") return bytes(ENCODER.encode(payload), headers, ContentType.text);
+	if (typeof payload === "string") return text$1(payload, headers, ContentType.text);
 	if (payload instanceof Uint8Array) return bytes(payload, headers, ContentType.bytes);
 	if (payload instanceof ArrayBuffer) return bytes(new Uint8Array(payload), headers, ContentType.bytes);
 	if (ArrayBuffer.isView(payload)) return bytes(new Uint8Array(payload.buffer, payload.byteOffset, payload.byteLength), headers, ContentType.bytes);
@@ -3517,18 +3680,22 @@ function encode(payload, headers) {
 	if (isSseBody(payload)) throw new TypeError("An event stream (HttpResponse.sse()) cannot be serialised here");
 	const json = JSON.stringify(payload);
 	if (json === void 0) throw new TypeError(`Cannot serialise a ${typeof payload} as a response body`);
-	return bytes(ENCODER.encode(json), headers, ContentType.json);
+	return text$1(json, headers, ContentType.json);
 }
 function bytes(data, headers, type) {
 	headers["content-type"] = type;
 	headers["content-length"] = String(data.byteLength);
 	return data;
 }
+function text$1(data, headers, type) {
+	headers["content-type"] = type;
+	return data;
+}
 function isNodeReadable(value) {
 	return value instanceof Readable || value !== null && typeof value === "object" && typeof value.pipe === "function" && typeof value.on === "function" && typeof value.read === "function";
 }
 function fromWebResponse(response, method) {
-	const headers = emptyRecord();
+	const headers = fastRecord();
 	for (const [name, value] of response.headers) if (name !== "set-cookie") headers[name] = value;
 	const cookies = response.headers.getSetCookie();
 	if (cookies.length > 0) headers["set-cookie"] = cookies;
@@ -3555,6 +3722,63 @@ const DEFAULT_SSE_SETTINGS = Object.freeze({
 const RAW = Symbol("raw response");
 const REQUEST_ID = /^[\w\-.:@/+=]{1,128}$/;
 const MAX_PATH_IN_MESSAGE = 200;
+/** The default request id generator: a random UUID (version 4, like `crypto.randomUUID()`). */
+function randomRequestId() {
+	return uuid();
+}
+const uuidPool = /* @__PURE__ */ new Uint8Array(2048);
+let uuidOffset = uuidPool.length;
+/** The text of the last UUID, its dashes in place. */
+const uuidText = Buffer$1.alloc(36, 45);
+/** The two lower-case hexadecimal digits of each byte, as character codes. */
+const HEX_CODES = /* @__PURE__ */ new Uint8Array(512);
+for (let byte = 0; byte < 256; byte++) {
+	const digits = byte.toString(16).padStart(2, "0");
+	HEX_CODES[byte * 2] = digits.charCodeAt(0);
+	HEX_CODES[byte * 2 + 1] = digits.charCodeAt(1);
+}
+function putHex(position, byte) {
+	uuidText[position] = HEX_CODES[byte * 2];
+	uuidText[position + 1] = HEX_CODES[byte * 2 + 1];
+}
+/**
+* A random version 4 UUID written from a pool of random bytes (`crypto.getRandomValues`), as Node.js
+* does, but read as one flat string: `crypto.randomUUID()` returns a concatenation of 20 pieces that
+* is flattened again when the header is written, which makes it about twice as slow.
+*/
+function pooledUuid() {
+	if (uuidOffset === uuidPool.length) {
+		crypto.getRandomValues(uuidPool);
+		uuidOffset = 0;
+	}
+	const pool = uuidPool;
+	const at = uuidOffset;
+	uuidOffset = at + 16;
+	putHex(0, pool[at]);
+	putHex(2, pool[at + 1]);
+	putHex(4, pool[at + 2]);
+	putHex(6, pool[at + 3]);
+	putHex(9, pool[at + 4]);
+	putHex(11, pool[at + 5]);
+	putHex(14, pool[at + 6] & 15 | 64);
+	putHex(16, pool[at + 7]);
+	putHex(19, pool[at + 8] & 63 | 128);
+	putHex(21, pool[at + 9]);
+	putHex(24, pool[at + 10]);
+	putHex(26, pool[at + 11]);
+	putHex(28, pool[at + 12]);
+	putHex(30, pool[at + 13]);
+	putHex(32, pool[at + 14]);
+	putHex(34, pool[at + 15]);
+	return readUuidText();
+}
+/**
+* The text of {@link uuidText}: Node.js `Buffer#latin1Slice` (what `toString('latin1')` calls after
+* checking its arguments) when present.
+*/
+const readUuidText = typeof uuidText.latin1Slice === "function" ? () => uuidText.latin1Slice(0, 36) : () => uuidText.toString("latin1", 0, 36);
+/** UUID generator: Bun's native `crypto.randomUUID()` is the fastest there. */
+const uuid = isBun() ? () => crypto.randomUUID() : pooledUuid;
 /**
 * The request pipeline (architecture §9.1):
 * `runInScope({ HttpContext, RequestId }) → hooks.run('http:request') → guards → body → interceptors
@@ -3566,6 +3790,26 @@ var Pipeline = class {
 	#logger;
 	#options;
 	#table;
+	/** The `securityHeaders` option as entries (lower-case names, values validated at boot). */
+	#securityHeaders;
+	/** Every request id can be sent: an incoming one matched `REQUEST_ID`, the generated ones are UUIDs. */
+	#validIds;
+	/**
+	* The headers of a JSON reply of the fast lane, in their final order (content type and length,
+	* then the framework headers, see {@link #frameworkHeaders}): copied, then completed with the
+	* length and the request id.
+	*/
+	#jsonHeaders;
+	/** The request id header of {@link #jsonHeaders}, `undefined` when the reply has none. */
+	#jsonIdHeader;
+	/** The headers of a reply without body of the fast lane (the framework headers, see {@link #jsonHeaders}). */
+	#emptyHeaders;
+	/** The request id header of {@link #emptyHeaders}, `undefined` when the reply has none. */
+	#emptyIdHeader;
+	/** Whether {@link #jsonHeaders} and {@link #emptyHeaders} hold every framework header (see {@link #fastRoute}). */
+	#fastHeaders;
+	/** The `cookies` option (secure defaults, no signing, when not set). */
+	#cookies;
 	#inflight = 0;
 	#idle = [];
 	/** Open event streams. */
@@ -3578,6 +3822,23 @@ var Pipeline = class {
 		this.#logger = logger;
 		this.#options = options;
 		this.#table = table;
+		this.#validIds = options.generateRequestId === randomRequestId;
+		this.#cookies = options.cookies ?? DEFAULT_COOKIE_SETTINGS;
+		this.#securityHeaders = Object.entries(options.securityHeaders ?? {}).map(([name, value]) => [name.toLowerCase(), value]);
+		const placeholder = "-";
+		const idHeader = options.requestIdHeader;
+		const json = {
+			"content-type": ContentType.json,
+			"content-length": "0"
+		};
+		this.#frameworkHeaders(json, placeholder, void 0, false);
+		this.#jsonHeaders = json;
+		this.#jsonIdHeader = idHeader !== void 0 && json[idHeader] === placeholder ? idHeader : void 0;
+		const empty = {};
+		this.#frameworkHeaders(empty, placeholder, void 0, false);
+		this.#emptyHeaders = empty;
+		this.#emptyIdHeader = idHeader !== void 0 && empty[idHeader] === placeholder ? idHeader : void 0;
+		this.#fastHeaders = (idHeader === void 0 || !(idHeader in Object.prototype)) && this.#securityHeaders.every(([name]) => !(name in Object.prototype));
 	}
 	/** Number of requests being processed. */
 	get inflight() {
@@ -3600,31 +3861,229 @@ var Pipeline = class {
 		return new Promise((resolve) => this.#idle.push(resolve));
 	}
 	/**
+	* The adapter handler of a route: {@link handle}, or a fast lane for the routes that need no
+	* guard, interceptor, event stream, raw response nor `@Header` when CORS is off (see
+	* {@link #fast}).
+	*/
+	handler(plan) {
+		const route = this.#fastRoute(plan);
+		if (route === void 0) return (request) => this.handle(plan, request);
+		return (request) => this.#fast(route, request);
+	}
+	/** The fast lane of a route, `undefined` when the route needs the general pipeline. */
+	#fastRoute(plan) {
+		const definition = plan.definition;
+		if (!this.#fastHeaders || this.#options.cors !== void 0 || plan.redirect === true || plan.guards.length > 0 || plan.interceptors.length > 0 || definition.sse !== void 0 || definition.rawResponse === true || definition.headers !== void 0 || definition.method === "ALL") return;
+		const post = definition.method === "POST";
+		const json = definition.status ?? (post ? 201 : 200);
+		return {
+			plan,
+			target: {
+				kind: "route",
+				plan
+			},
+			method: definition.method,
+			jsonStatus: definition.method === "HEAD" || isBodylessStatus(json) ? void 0 : json,
+			emptyStatus: definition.status ?? (post ? 201 : 204)
+		};
+	}
+	/**
+	* The fast lane: what {@link handle} does for a route of {@link #fastRoute}, decided once instead
+	* of per request, without promises while the route stays synchronous. A request takes it when no
+	* `http:request` wrapper nor listener is registered, the server is not draining and its method
+	* is the route's (not a `HEAD` served by a `GET` route); a plain object or array returned by the
+	* handler is serialised as JSON, and `undefined` answered without body, with the headers in their
+	* final order (a template precomputed at boot).
+	* A thenable result is awaited in the lane (see {@link #fastAsync}). Anything else — a malformed
+	* path (before the request starts), a thrown error or a rejection, an `HttpResponse`, a `Response`
+	* or any other result, headers or cookies set through the context — continues in the general
+	* pipeline, in the same request scope, with the same outcome.
+	*/
+	#fast(route, request) {
+		const plan = route.plan;
+		const hooks = this.#hooks;
+		if (this.draining || request.method !== route.method || hooks.hasWrappers("http:request") || hooks.hasListeners("http:request")) return this.handle(plan, request);
+		const url = request.url;
+		const mark = url.indexOf("?");
+		const path = mark === -1 ? url : url.slice(0, mark);
+		const params = routeParams(plan.path, path);
+		if (params === void 0) return this.handle(plan, request);
+		this.#enter();
+		let ctx;
+		try {
+			const query = mark === -1 ? "" : url.slice(mark + 1);
+			ctx = this.#context(request, this.#requestId(request), path, query, plan.info, params, plan.body);
+		} catch (error) {
+			this.#leave();
+			return Promise.reject(error);
+		}
+		const scope = this.#container.openScope([[HttpTokens.Context, ctx], [HttpTokens.RequestId, ctx.requestId]]);
+		const done = scope.run(this.#fastRun, route, request, ctx);
+		if (done instanceof Exchange) {
+			done.done.then(() => this.#end(done, scope, void 0), (error) => this.#end(done, scope, error));
+			if (!hooks.hasListeners("http:request")) return done.replied;
+			done.tracked = true;
+			return this.#emitted(done);
+		}
+		const closing = scope.close();
+		if (closing === void 0) {
+			ctx.complete();
+			this.#leave();
+		} else {
+			const x = new Exchange(request, ctx, ctx.requestId, route.target);
+			x.answer(done);
+			closing.then(() => this.#over(x), (error) => this.#disposalFailed(x, error));
+		}
+		if (!hooks.hasListeners("http:request")) return Promise.resolve(done);
+		const event = requestEvent(request, ctx, performance.now());
+		event.status = done.status;
+		return Promise.resolve(done).then((reply) => {
+			hooks.emit("http:request", event);
+			return reply;
+		});
+	}
+	/**
+	* The fast lane in the request scope: the reply when the handler answered synchronously with a
+	* plain JSON value or `undefined`, otherwise the exchange finishing the request (see {@link #fast}).
+	*/
+	#fastRun = (route, request, ctx) => {
+		const plan = route.plan;
+		if (plan.parseBody) return this.#fastLater(route, request, ctx, NO_RESULT);
+		let result;
+		let reply;
+		try {
+			result = plan.definition.invoke(this.#resolve(plan.controller), ctx);
+			if (isThenable(result)) return this.#fastLater(route, request, ctx, result);
+			reply = this.#fastReply(route, ctx, result);
+		} catch (error) {
+			const x = new Exchange(request, ctx, ctx.requestId, route.target);
+			x.done = this.#respond(x, () => this.#failed(error, ctx, x.event));
+			return x;
+		}
+		if (reply !== void 0) {
+			ctx.commit();
+			ctx.releaseBody();
+			return reply;
+		}
+		const x = new Exchange(request, ctx, ctx.requestId, route.target);
+		x.done = this.#respond(x, () => this.#settle(ctx, plan, x.event, result));
+		return x;
+	};
+	/** The fast lane of a route with a body to read or a handler that returned a thenable. */
+	#fastLater(route, request, ctx, result) {
+		const x = new Exchange(request, ctx, ctx.requestId, route.target);
+		x.done = this.#fastAsync(x, route, result);
+		return x;
+	}
+	/**
+	* The asynchronous part of the fast lane, in the request scope: the body read (`result` is
+	* {@link NO_RESULT}) and the handler run, or the thenable it returned awaited. Never rejects.
+	*/
+	async #fastAsync(x, route, pending) {
+		const ctx = x.ctx;
+		const plan = route.plan;
+		let result = pending;
+		let reply;
+		try {
+			if (result === NO_RESULT) {
+				const controller = this.#resolve(plan.controller);
+				await ctx.parseBody();
+				result = plan.definition.invoke(controller, ctx);
+			}
+			if (isThenable(result)) result = await result;
+			reply = this.#fastReply(route, ctx, result);
+		} catch (error) {
+			await this.#respond(x, () => this.#failed(error, ctx, x.event));
+			return;
+		}
+		if (reply === void 0) {
+			const value = result;
+			await this.#respond(x, () => this.#settle(ctx, plan, x.event, value));
+			return;
+		}
+		ctx.commit();
+		ctx.releaseBody();
+		if (x.tracked) x.event.status = reply.status;
+		x.answer(reply);
+	}
+	/**
+	* The reply of a plain JSON value (see {@link isPlainJson}) or of `undefined`: what
+	* `serializeResult` and {@link #complete} produce for it, the headers in their final order.
+	* `undefined` when the result or the context needs the general pipeline. Throws like
+	* `JSON.stringify`.
+	*/
+	#fastReply(route, ctx, result) {
+		const status = result === void 0 ? route.emptyStatus : route.jsonStatus;
+		if (status === void 0 || ctx.hasResponseHeaders || ctx.hasCookies || this.draining) return void 0;
+		const requestId = ctx.requestId;
+		if (!this.#validIds && !isHeaderValue(requestId)) return void 0;
+		if (result === void 0) {
+			const headers = { ...this.#emptyHeaders };
+			const idHeader = this.#emptyIdHeader;
+			if (idHeader !== void 0) headers[idHeader] = requestId;
+			return {
+				status,
+				headers,
+				body: null
+			};
+		}
+		if (!isPlainJson(result)) return void 0;
+		const json = JSON.stringify(result);
+		if (json === void 0) throw new TypeError(`Cannot serialise a ${typeof result} as a response body`);
+		const headers = { ...this.#jsonHeaders };
+		const body = utf8(json);
+		headers["content-length"] = String(body.byteLength);
+		const idHeader = this.#jsonIdHeader;
+		if (idHeader !== void 0) headers[idHeader] = requestId;
+		return {
+			status,
+			headers,
+			body,
+			text: json
+		};
+	}
+	/** Ends a fast-lane request once its asynchronous part settled: its scope is closed, then it is over. */
+	#end(x, scope, error) {
+		const closing = scope.close();
+		if (error !== void 0) {
+			const report = () => this.#disposalFailed(x, error);
+			if (closing === void 0) report();
+			else closing.then(report, report);
+			return;
+		}
+		if (closing === void 0) this.#over(x);
+		else closing.then(() => this.#over(x), (failure) => this.#disposalFailed(x, failure));
+	}
+	#disposalFailed(x, error) {
+		this.#over(x);
+		this.#logger.error("Failed to dispose request-scoped providers", {
+			err: error,
+			requestId: x.requestId
+		});
+	}
+	/**
 	* Handles a request routed to `plan` by the adapter. The request stays in flight (and its scope
 	* open) until a streamed or file response body has been fully read or cancelled by the adapter.
 	*/
-	async handle(plan, request) {
+	handle(plan, request) {
 		const startTime = performance.now();
-		this.#enter();
-		let served;
 		try {
-			served = this.#isPreflight(request) ? await this.#preflight(request, startTime) : await this.#route(plan, request, startTime);
-			return served.reply;
-		} finally {
-			this.#leaveWhen(served);
+			return this.#isPreflight(request) ? this.#preflight(request, startTime) : this.#route(plan, request, startTime);
+		} catch (error) {
+			return Promise.reject(error);
 		}
 	}
 	#route(plan, request, startTime, rerouted = false) {
-		const { path, query } = splitUrl(request.url);
-		const raw = matchRoutePath(plan.path, path);
+		const url = splitUrl(request.url);
+		const raw = matchRoutePath(plan.path, url.path);
 		if (raw === void 0) return this.#fallback(request, void 0, startTime, !rerouted);
 		if (plan.redirect === true) {
-			const canonical = sameOriginPath(path.slice(0, -1));
-			const location = query === "" ? canonical : `${canonical}?${query}`;
-			return this.#serve(request, void 0, emptyRecord(), {
+			const canonical = sameOriginPath(url.path.slice(0, -1));
+			const target = {
 				kind: "redirect",
-				location
-			}, startTime, plan.body);
+				location: url.query === "" ? canonical : `${canonical}?${url.query}`
+			};
+			return this.#serve(request, url, void 0, emptyRecord(), target, startTime, plan.body);
 		}
 		const params = emptyRecord();
 		let malformed;
@@ -3640,18 +4099,15 @@ var Pipeline = class {
 			kind: "error",
 			error: new BadRequestException(`Malformed URL parameter "${malformed}"`)
 		};
-		return this.#serve(request, plan.info, params, target, startTime, plan.body);
+		return this.#serve(request, url, plan.info, params, target, startTime, plan.body);
 	}
 	/** Handles an unmatched request (404, 405, automatic OPTIONS) or a framework error. */
-	async fallback(request, error) {
+	fallback(request, error) {
 		const startTime = performance.now();
-		this.#enter();
-		let served;
 		try {
-			served = await this.#fallback(request, error, startTime);
-			return served.reply;
-		} finally {
-			this.#leaveWhen(served);
+			return this.#fallback(request, error, startTime);
+		} catch (failure) {
+			return Promise.reject(failure);
 		}
 	}
 	#fallback(request, error, startTime, reroute = true) {
@@ -3661,10 +4117,11 @@ var Pipeline = class {
 				kind: "error",
 				error: frameworkError(error)
 			};
-			return this.#serve(request, void 0, emptyRecord(), target, startTime, body);
+			return this.#serve(request, splitUrl(request.url), void 0, emptyRecord(), target, startTime, body);
 		}
 		if (this.#isPreflight(request)) return this.#preflight(request, startTime);
-		const { path } = splitUrl(request.url);
+		const url = splitUrl(request.url);
+		const path = url.path;
 		if (reroute) {
 			const plan = this.#table.find(request.method, path);
 			if (plan !== void 0) return this.#route(plan, request, startTime, true);
@@ -3683,151 +4140,169 @@ var Pipeline = class {
 			kind: "error",
 			error: new MethodNotAllowedException(`Method ${request.method} is not allowed on ${truncate(path)}`, void 0, { headers: { allow: allowHeader(allowed) } })
 		};
-		return this.#serve(request, void 0, emptyRecord(), target, startTime, body);
+		return this.#serve(request, url, void 0, emptyRecord(), target, startTime, body);
 	}
 	/** A CORS preflight (with the `cors` option): answered without running any route. */
 	#isPreflight(request) {
 		return this.#options.cors !== void 0 && isPreflight(request.method, request.headers);
 	}
 	#preflight(request, startTime) {
-		const allowed = this.#table.allowedMethods(splitUrl(request.url).path);
+		const url = splitUrl(request.url);
+		const allowed = this.#table.allowedMethods(url.path);
 		const target = {
 			kind: "preflight",
 			allow: allowed.length === 0 ? void 0 : allowHeader(allowed)
 		};
-		return this.#serve(request, void 0, emptyRecord(), target, startTime, this.#options.body);
+		return this.#serve(request, url, void 0, emptyRecord(), target, startTime, this.#options.body);
 	}
-	async #serve(request, route, params, target, startTime, body) {
-		const requestId = this.#requestId(request);
-		const proxy = this.#options.trustProxy;
-		const ctx = new RequestContext(request, {
-			requestId,
-			adapter: this.#options.adapter,
-			route,
-			params,
-			body,
-			cookies: this.#options.cookies ?? DEFAULT_COOKIE_SETTINGS,
-			...proxy === void 0 ? {} : { client: proxy.resolve(request.remoteAddress ?? request.ip, request.headers, request.encrypted === true) }
+	#serve(request, url, route, params, target, startTime, body) {
+		this.#enter();
+		let x;
+		try {
+			const requestId = this.#requestId(request);
+			const ctx = this.#context(request, requestId, url.path, url.query, route, params, body);
+			if (this.draining && target.kind === "route" && target.plan.definition.sse !== void 0) ctx.abort("shutdown");
+			x = new Exchange(request, ctx, requestId, target, startTime);
+		} catch (error) {
+			this.#leave();
+			return Promise.reject(error);
+		}
+		this.#container.runInScope(() => this.#respond(x, void 0), [[HttpTokens.Context, x.ctx], [HttpTokens.RequestId, x.requestId]]).then(() => this.#over(x), (error) => {
+			this.#over(x);
+			this.#logger.error("Failed to dispose request-scoped providers", {
+				err: error,
+				requestId: x.requestId
+			});
 		});
-		if (this.draining && target.kind === "route" && target.plan.definition.sse !== void 0) ctx.abort("shutdown");
-		const event = {
-			method: request.method,
-			path: ctx.path,
-			route: route?.path,
-			requestId,
-			headers: request.headers,
-			context: ctx,
-			startTime,
-			responseHeaders: {}
-		};
-		let outcome;
-		let reply;
-		let cors;
-		const preflight = target.kind === "preflight";
-		let replied = () => void 0;
-		const ready = new Promise((resolve) => {
-			replied = resolve;
+		return this.#hooks.hasListeners("http:request") ? this.#emitted(x) : x.replied;
+	}
+	/** The reply of a request once the `http:request` listeners saw its event. */
+	#emitted(x) {
+		return x.replied.then((reply) => {
+			this.#hooks.emit("http:request", x.event);
+			return reply;
 		});
-		const done = this.#container.runInScope(async () => {
-			let hookError;
-			let failed = false;
-			let run;
-			if (this.#options.cors !== void 0) cors = await this.#corsDecision(request, requestId);
-			try {
+	}
+	/** The request context of a request (internal). */
+	#context(request, requestId, path, query, route, params, body) {
+		const proxy = this.#options.trustProxy;
+		return new RequestContext(request, requestId, this.#options.adapter, path, query, route, params, body, this.#cookies, proxy === void 0 ? void 0 : proxy.resolve(request.remoteAddress ?? request.ip, request.headers, request.encrypted === true));
+	}
+	/**
+	* Answers a request in its scope: its outcome (`process`, or the target of the exchange after the
+	* CORS decision and through the `http:request` wrappers), checked, completed and handed to the
+	* adapter; a streamed body is then tracked until it was sent or abandoned. Never rejects.
+	* `process` is given by the fast lane, which decided at the start of the request that no wrapper
+	* applies and that CORS is off.
+	*/
+	async #respond(x, process) {
+		const ctx = x.ctx;
+		const requestId = x.requestId;
+		const event = x.event;
+		let outcome;
+		let hookError;
+		let failed = false;
+		let run;
+		let recheck = false;
+		let work = process;
+		if (work === void 0) {
+			if (this.#options.cors !== void 0) x.cors = await this.#corsDecision(x.request, requestId);
+			recheck = this.#hooks.hasWrappers("http:request");
+			const target = x.target;
+			work = () => this.#process(ctx, target, event, x.cors);
+		}
+		try {
+			if (recheck) {
+				const inner = work;
 				await this.#hooks.run("http:request", event, async () => {
-					outcome = await this.#process(ctx, target, event, cors);
-					if (outcome !== RAW) outcome = this.#checkCookies(this.#checkHeaders(outcome, ctx, event), ctx, event);
-					run = captureContext();
+					outcome = this.#checked(await inner(), ctx, event);
+					if (outcome !== RAW && isStreamed(outcome.body)) run = captureContext();
 					return outcome;
 				});
-			} catch (error) {
-				failed = true;
-				hookError = error;
-			}
-			if (outcome === void 0) {
-				const error = failed ? hookError : /* @__PURE__ */ new Error("An \"http:request\" hook wrapper did not call next()");
-				event.error ??= error;
-				const fallback = await this.#errorReply(error, ctx);
-				outcome = this.#checkCookies(this.#checkHeaders(fallback, ctx, event), ctx, event);
-				event.status = outcome.status;
-			} else if (failed) this.#logger.error("An \"http:request\" hook wrapper failed after the request was handled", {
-				err: hookError,
-				requestId
-			});
-			if (outcome === RAW) {
-				ctx.commit();
-				replied();
-				return;
-			}
-			const serialized = this.#complete(outcome, ctx, event, requestId, cors, preflight);
-			const body = serialized.body;
-			if (!(body instanceof ReadableStream || body instanceof Blob)) {
-				reply = adapterReply(serialized, body);
-				ctx.commit();
-				replied();
-				ctx.releaseBody();
-				return;
-			}
-			const tracked = trackStream(body, run ?? captureContext(), () => ctx.abort("client"));
-			const session = serialized.sse;
-			reply = adapterReply(serialized, tracked.stream, body instanceof Blob ? body : void 0);
-			if (session !== void 0) {
-				this.#streams.add(session);
-				if (this.draining) session.close("shutdown");
-			}
-			ctx.commit();
-			replied();
-			const failure = await tracked.done;
-			if (session !== void 0) this.#streams.delete(session);
-			if (failure !== void 0) this.#logger.error("The response stream failed", {
-				err: failure,
-				requestId,
-				path: ctx.path
-			});
-			ctx.releaseBody();
-		}, [[HttpTokens.Context, ctx], [HttpTokens.RequestId, requestId]]).then(() => {
-			ctx.complete();
-		}, (error) => {
-			ctx.complete();
-			this.#logger.error("Failed to dispose request-scoped providers", {
-				err: error,
-				requestId
-			});
+			} else outcome = this.#checked(await work(), ctx, event);
+		} catch (error) {
+			failed = true;
+			hookError = error;
+		}
+		if (outcome === void 0) {
+			const error = failed ? hookError : /* @__PURE__ */ new Error("An \"http:request\" hook wrapper did not call next()");
+			event.error ??= error;
+			const fallback = await this.#errorReply(error, ctx);
+			outcome = this.#checkCookies(this.#checkHeaders(fallback, ctx, event), ctx, event);
+			event.status = outcome.status;
+			recheck = true;
+		} else if (failed) this.#logger.error("An \"http:request\" hook wrapper failed after the request was handled", {
+			err: hookError,
+			requestId
 		});
-		await Promise.race([ready, done]);
 		if (outcome === RAW) {
-			const status = request.rawStatus?.() ?? 200;
+			ctx.commit();
+			const status = x.request.rawStatus?.() ?? 200;
 			event.status ??= status;
-			this.#emit(event);
-			return {
-				reply: {
-					status,
-					headers: {},
-					body: null,
-					raw: true
-				},
-				done
-			};
+			x.answer({
+				status,
+				headers: {},
+				body: null,
+				raw: true
+			});
+			return;
 		}
-		if (reply === void 0) {
-			const failure = /* @__PURE__ */ new Error("Request not handled");
-			reply = this.#complete(serializeError(500, this.#internalBody(failure), ctx.method), ctx, event, requestId, cors, preflight);
-			event.status = 500;
+		const serialized = this.#complete(outcome, ctx, event, requestId, x.cors, x.preflight, recheck);
+		const body = serialized.body;
+		if (!isStreamed(body)) {
+			const reply = adapterReply(serialized, body);
+			ctx.commit();
+			ctx.releaseBody();
+			x.answer(reply);
+			return;
+		}
+		const tracked = trackStream(body, run ?? captureContext(), () => ctx.abort("client"));
+		const session = serialized.sse;
+		const reply = adapterReply(serialized, tracked.stream, body instanceof Blob ? body : void 0);
+		if (session !== void 0) {
+			this.#streams.add(session);
+			if (this.draining) session.close("shutdown");
+		}
+		ctx.commit();
+		x.answer(reply);
+		const failure = await tracked.done;
+		if (session !== void 0) this.#streams.delete(session);
+		if (failure !== void 0) this.#logger.error("The response stream failed", {
+			err: failure,
+			requestId,
+			path: ctx.path
+		});
+		ctx.releaseBody();
+	}
+	/** The request is over (response body sent or abandoned, scope closed). */
+	#over(x) {
+		const ctx = x.ctx;
+		ctx.complete();
+		try {
+			if (!x.answered) {
+				const failure = /* @__PURE__ */ new Error("Request not handled");
+				const reply = serializeError(500, this.#internalBody(failure), ctx.method);
+				const completed = this.#complete(reply, ctx, x.event, x.requestId, x.cors, x.preflight, true);
+				x.event.status = 500;
+				x.answer(completed);
+			}
+		} catch (error) {
+			x.fail(error);
+		} finally {
+			this.#leave();
 		}
-		this.#emit(event);
-		return {
-			reply,
-			done
-		};
 	}
 	/**
 	* Adds the headers of the `http:request` wrappers, then the framework headers (see
-	* {@link #frameworkHeaders}), then checks the final headers (see {@link #checkHeaders}).
+	* {@link #frameworkHeaders}). When wrappers ran (`recheck`), checks the final headers again (see
+	* {@link #checkHeaders}): the reply was checked before, and the cookies and framework headers are
+	* valid by construction.
 	*/
-	#complete(reply, ctx, event, requestId, cors, preflight) {
+	#complete(reply, ctx, event, requestId, cors, preflight, recheck) {
 		addMissingHeaders(reply.headers, event.responseHeaders);
 		applyCookies(reply, ctx);
 		this.#frameworkHeaders(reply.headers, requestId, cors, preflight);
+		if (!recheck) return reply;
 		const checked = this.#checkHeaders(reply, ctx, event);
 		if (checked !== reply) {
 			applyCookies(checked, ctx);
@@ -3835,6 +4310,12 @@ var Pipeline = class {
 		}
 		return checked;
 	}
+	/** Checks the headers (unless only the serialiser set them), then the cookies of a reply. */
+	#checked(outcome, ctx, event) {
+		if (outcome === RAW) return outcome;
+		const checked = outcome.ownHeaders === true ? outcome : this.#checkHeaders(outcome, ctx, event);
+		return this.#checkCookies(checked, ctx, event);
+	}
 	/**
 	* Serialises the cookies of an `HttpResponse` (`withCookie`) with the plugin settings (defaults,
 	* signing). A cookie breaking a rule that depends on them (a prefix with the `secure` default,
@@ -3844,7 +4325,7 @@ var Pipeline = class {
 	#checkCookies(reply, ctx, event) {
 		const cookies = reply.cookies;
 		if (cookies === void 0 || cookies.length === 0) return reply;
-		const settings = this.#options.cookies ?? DEFAULT_COOKIE_SETTINGS;
+		const settings = this.#cookies;
 		const lines = [];
 		try {
 			for (const cookie of cookies) lines.push(serializeWith(cookie, settings));
@@ -3869,7 +4350,7 @@ var Pipeline = class {
 	*/
 	#frameworkHeaders(headers, requestId, cors, preflight) {
 		const header = this.#options.requestIdHeader;
-		if (header !== void 0 && headers[header] === void 0 && isHeaderValue(requestId)) headers[header] = requestId;
+		if (header !== void 0 && headers[header] === void 0 && (this.#validIds || isHeaderValue(requestId))) headers[header] = requestId;
 		const policy = this.#options.cors;
 		if (policy !== void 0) {
 			if (!preflight) {
@@ -3878,8 +4359,7 @@ var Pipeline = class {
 			}
 			if (policy.varyOrigin) mergeVary(headers, "origin");
 		}
-		const security = this.#options.securityHeaders;
-		if (security !== void 0) addMissingHeaders(headers, security);
+		for (const [name, value] of this.#securityHeaders) if (headers[name] === void 0) headers[name] = value;
 		if (this.draining) headers["connection"] = "close";
 	}
 	/**
@@ -3921,7 +4401,12 @@ var Pipeline = class {
 		this.#log(error, ctx);
 		return serializeError(500, this.#internalBody(error), ctx.method);
 	}
-	async #process(ctx, target, event, cors) {
+	/** The outcome of a request: its route run, or a reply of the framework. Never rejects (errors are mapped). */
+	#process(ctx, target, event, cors) {
+		return target.kind === "route" ? this.#invoke(ctx, target.plan, event) : this.#answer(ctx, target, event, cors);
+	}
+	/** Answers a request without running a route. Never rejects. */
+	async #answer(ctx, target, event, cors) {
 		try {
 			switch (target.kind) {
 				case "error": throw target.error;
@@ -3944,30 +4429,71 @@ var Pipeline = class {
 					status: 308,
 					headers: { location: target.location }
 				}));
-				default: return await this.#invoke(ctx, target.plan, event);
 			}
 		} catch (error) {
-			event.error = error;
-			const reply = await this.#errorReply(error, ctx);
-			event.status = reply.status;
-			return reply;
+			return await this.#failed(error, ctx, event);
 		}
 	}
+	/** The reply of an error (see {@link #errorReply}), recorded on the event. */
+	async #failed(error, ctx, event) {
+		event.error = error;
+		const reply = await this.#errorReply(error, ctx);
+		event.status = reply.status;
+		return reply;
+	}
+	/** Runs a route: guards, body, interceptors, handler, serialisation. Never rejects (errors are mapped). */
 	async #invoke(ctx, plan, event) {
-		const controller = this.#resolve(plan.controller);
-		for (const guard of plan.guards) if (await this.#resolve(guard).canActivate(ctx) !== true) throw new ForbiddenException("Forbidden resource");
-		if (plan.parseBody) await ctx.parseBody();
-		const definition = plan.definition;
-		const interceptors = plan.interceptors;
 		let result;
-		if (interceptors.length === 0) result = await definition.invoke(controller, ctx);
-		else {
-			const chain = async (index) => {
-				if (index === interceptors.length) return await definition.invoke(controller, ctx);
-				return await this.#resolve(interceptors[index]).intercept(ctx, () => chain(index + 1));
-			};
-			result = await chain(0);
+		try {
+			const controller = this.#resolve(plan.controller);
+			for (const guard of plan.guards) if (await this.#resolve(guard).canActivate(ctx) !== true) throw new ForbiddenException("Forbidden resource");
+			if (plan.parseBody) await ctx.parseBody();
+			const definition = plan.definition;
+			const interceptors = plan.interceptors;
+			if (interceptors.length === 0) result = definition.invoke(controller, ctx);
+			else {
+				const chain = async (index) => {
+					if (index === interceptors.length) return await definition.invoke(controller, ctx);
+					return await this.#resolve(interceptors[index]).intercept(ctx, () => chain(index + 1));
+				};
+				result = chain(0);
+			}
+		} catch (error) {
+			return await this.#failed(error, ctx, event);
 		}
+		const settled = this.#settle(ctx, plan, event, result);
+		return settled instanceof Promise ? await settled : settled;
+	}
+	/**
+	* The rest of {@link #invoke} once the handler (and its interceptors) returned `result`: awaited
+	* when it is a thenable, then serialised. Never throws nor rejects (errors are mapped).
+	*/
+	#settle(ctx, plan, event, result) {
+		if (isThenable(result)) return this.#settleLater(ctx, plan, event, result);
+		try {
+			const outcome = this.#outcome(ctx, plan, event, result);
+			return outcome instanceof Promise ? outcome.catch((error) => this.#failed(error, ctx, event)) : outcome;
+		} catch (error) {
+			return this.#failed(error, ctx, event);
+		}
+	}
+	async #settleLater(ctx, plan, event, pending) {
+		let result;
+		try {
+			result = await pending;
+		} catch (error) {
+			return await this.#failed(error, ctx, event);
+		}
+		const settled = this.#settle(ctx, plan, event, result);
+		return settled instanceof Promise ? await settled : settled;
+	}
+	/**
+	* The outcome of a handler result: `RAW` for a `@Res()` route, otherwise its reply (files resolved,
+	* event streams opened: only an `HttpResponse` may need an asynchronous step). Throws (or rejects)
+	* when the result cannot be served.
+	*/
+	#outcome(ctx, plan, event, result) {
+		const definition = plan.definition;
 		if (definition.rawResponse === true && !(result instanceof Response)) return RAW;
 		const options = {
 			method: ctx.method,
@@ -3977,12 +4503,12 @@ var Pipeline = class {
 			context: ctx.hasResponseHeaders ? ctx.responseHeaders : void 0
 		};
 		const sse = definition.sse;
-		let reply;
 		if (sse !== void 0 && !(result instanceof Response) && !isHttpResponse(result)) {
 			if (!isSseSource(result)) throw new TypeError(`@Sse handler ${displayName(plan.info.controller)}.${definition.handler} must return an AsyncIterable, an Iterable or a ReadableStream of SseEvent (received ${describeResult(result)})`);
-			reply = serializeSseReply(this.#openStream(result, sseOptions(sse), ctx), void 0, options);
-		} else reply = await this.#serialize(result, ctx, options, sse);
-		return this.#finish(event, reply);
+			return this.#finish(event, serializeSseReply(this.#openStream(result, sseOptions(sse), ctx), void 0, options));
+		}
+		if (!isHttpResponse(result)) return this.#finish(event, serializeResult(result, options));
+		return this.#serialize(result, ctx, options, sse).then((reply) => this.#finish(event, reply));
 	}
 	/** Serialises a handler (or exception mapper) result; file bodies are resolved, event streams opened. */
 	async #serialize(result, ctx, options, route) {
@@ -4132,17 +4658,9 @@ var Pipeline = class {
 		}
 		return this.#options.generateRequestId();
 	}
-	#emit(event) {
-		if (this.#hooks.hasListeners("http:request")) this.#hooks.emit("http:request", event);
-	}
 	#enter() {
 		this.#inflight++;
 	}
-	/** Leaves once the request is over (immediately when it failed before being served). */
-	#leaveWhen(served) {
-		if (served === void 0) this.#leave();
-		else served.done.then(() => this.#leave());
-	}
 	#leave() {
 		this.#inflight--;
 		if (this.#inflight === 0 && this.#idle.length > 0) {
@@ -4152,6 +4670,126 @@ var Pipeline = class {
 		}
 	}
 };
+/** `#fastAsync` reads the body and runs the handler. */
+const NO_RESULT = Symbol("no result");
+/** A request being answered (internal): its context, its target and the promise of its reply. */
+var Exchange = class {
+	request;
+	ctx;
+	requestId;
+	target;
+	preflight;
+	replied;
+	cors = void 0;
+	answered = false;
+	/** The `http:request` listeners will see the event (fast lane: keep its status). */
+	tracked = false;
+	/** The asynchronous part of a fast-lane request (never rejects). */
+	done = void 0;
+	#resolve;
+	#reject;
+	#event;
+	/** `startTime`: the event is created now (general pipeline); otherwise when first needed (fast lane). */
+	constructor(request, ctx, requestId, target, startTime) {
+		this.request = request;
+		this.ctx = ctx;
+		this.requestId = requestId;
+		this.target = target;
+		this.preflight = target.kind === "preflight";
+		let resolve;
+		let reject;
+		this.replied = new Promise((onReply, onError) => {
+			resolve = onReply;
+			reject = onError;
+		});
+		this.#resolve = resolve;
+		this.#reject = reject;
+		if (startTime !== void 0) this.#event = requestEvent(request, ctx, startTime);
+	}
+	/**
+	* The `http:request` event. The fast lane creates it when the general pipeline takes over: no
+	* hook saw the request start, so its `startTime` is not observed.
+	*/
+	get event() {
+		this.#event ??= requestEvent(this.request, this.ctx, performance.now());
+		return this.#event;
+	}
+	answer(reply) {
+		this.answered = true;
+		this.#resolve(reply);
+	}
+	fail(error) {
+		this.#reject(error);
+	}
+};
+/** The `http:request` event of a request. */
+function requestEvent(request, ctx, startTime) {
+	return {
+		method: request.method,
+		path: ctx.path,
+		route: ctx.route?.path,
+		requestId: ctx.requestId,
+		headers: request.headers,
+		context: ctx,
+		startTime,
+		responseHeaders: {}
+	};
+}
+/**
+* The decoded parameters of a raw request path matched against a route, in one pass: what
+* `matchRoutePath` then `decodePathValue` (see `Pipeline.#route`) give for a path they accept.
+* `undefined` when the path does not match or a value is not valid percent-encoding: the general
+* pipeline then answers it (a reroute, a 400).
+*/
+function routeParams(route, path) {
+	if (path.charCodeAt(0) !== 47) return void 0;
+	const params = emptyRecord();
+	const segments = route.segments;
+	const last = segments.length - 1;
+	if (last === -1) return path === "/" ? params : void 0;
+	let position = 1;
+	for (let index = 0; index <= last; index++) {
+		const segment = segments[index];
+		if (segment.kind === "wildcard") {
+			const rest = decodePathValue(path.slice(position));
+			if (rest === void 0) return void 0;
+			params["*"] = rest;
+			return params;
+		}
+		const slash = path.indexOf("/", position);
+		const end = slash === -1 ? path.length : slash;
+		if (segment.kind === "static") {
+			const value = segment.value;
+			if (end - position !== value.length || !path.startsWith(value, position)) return void 0;
+		} else {
+			if (end === position) return void 0;
+			const decoded = decodePathValue(path.slice(position, end));
+			if (decoded === void 0) return void 0;
+			params[segment.name] = decoded;
+		}
+		if (index === last) return end === path.length ? params : void 0;
+		if (slash === -1) return void 0;
+		position = slash + 1;
+	}
+	return params;
+}
+/**
+* A value the fast lane serialises as JSON: a plain object or array (its own prototype and
+* constructor), not duck-typed as a Node.js stream. Anything `serializeResult` could treat otherwise
+* (`HttpResponse`, `Response`, bytes, streams, `Blob`, strings, `undefined`...) is not.
+*/
+function isPlainJson(value) {
+	if (value === null || typeof value !== "object") return false;
+	const prototype = Object.getPrototypeOf(value);
+	const ctor = value.constructor;
+	if (prototype === Object.prototype) {
+		if (ctor !== Object) return false;
+	} else if (prototype !== Array.prototype || ctor !== Array) return false;
+	return typeof value.pipe !== "function";
+}
+const ENCODER = new TextEncoder();
+/** UTF-8 encoding of a text body, like the serialiser (a pooled `Buffer` on Node.js, `TextEncoder` on Bun). */
+const utf8 = isBun() ? (text) => ENCODER.encode(text) : (text) => Buffer$1.from(text, "utf8");
 /**
 * The reply handed to the adapter (internal fields of the serialised reply left out). A streamed
 * `text/event-stream` body is an event stream whatever produced it (`@Sse`, `HttpResponse.sse()`, a
@@ -4159,6 +4797,13 @@ var Pipeline = class {
 * before a quiet stream's first byte, and lifts idle timeouts.
 */
 function adapterReply(serialized, body, blob) {
+	const text = serialized.text;
+	if (text !== void 0) return {
+		status: serialized.status,
+		headers: serialized.headers,
+		body,
+		text
+	};
 	const reply = {
 		status: serialized.status,
 		headers: serialized.headers,
@@ -4180,7 +4825,7 @@ function adapterReply(serialized, body, blob) {
 * one in place. One line per cookie.
 */
 function applyCookies(reply, ctx) {
-	const own = reply.cookieLines ?? [];
+	const own = reply.cookieLines ?? NO_COOKIE_LINES;
 	const context = ctx.cookieLines;
 	if (own.length === 0 && context.length === 0) return;
 	const merged = /* @__PURE__ */ new Map();
@@ -4192,6 +4837,11 @@ function applyCookies(reply, ctx) {
 	else if (existing !== void 0) raw = [...existing];
 	reply.headers["set-cookie"] = [...raw, ...merged.values()];
 }
+const NO_COOKIE_LINES = Object.freeze([]);
+/** Whether a reply body is streamed (a file is read through a stream too). */
+function isStreamed(body) {
+	return body instanceof ReadableStream || body instanceof Blob;
+}
 /** `SseOptions` of the `sse` metadata of a route (`heartbeat: 0` disables the heartbeat). */
 function sseOptions(definition) {
 	return {
@@ -4925,7 +5575,7 @@ var HttpPlugin = class HttpPlugin {
 			adapter.registerRoute({
 				method: registration.method,
 				path: registration.path,
-				handler: (request) => pipeline.handle(plan, request)
+				handler: pipeline.handler(plan)
 			});
 			routes.push(Object.freeze({
 				method: registration.method,
@@ -5029,7 +5679,7 @@ function resolve$1(options) {
 	if (typeof drainTimeoutMs !== "number" || !(drainTimeoutMs >= 0)) throw invalidOption("drainTimeoutMs", "a positive number (or Infinity)", drainTimeoutMs);
 	const requestIdHeader = options.requestIdHeader ?? DEFAULT_REQUEST_ID_HEADER;
 	if (requestIdHeader !== false && (typeof requestIdHeader !== "string" || !isHeaderName(requestIdHeader))) throw invalidOption("requestIdHeader", "a header name or false", requestIdHeader);
-	const generateRequestId = options.generateRequestId ?? (() => crypto.randomUUID());
+	const generateRequestId = options.generateRequestId ?? randomRequestId;
 	if (typeof generateRequestId !== "function") throw invalidOption("generateRequestId", "a function", generateRequestId);
 	const adapter = options.adapter ?? nodeAdapter();
 	if (adapter === null || typeof adapter !== "object" || typeof adapter.registerRoute !== "function" || typeof adapter.listen !== "function" || typeof adapter.inject !== "function") throw invalidOption("adapter", "an HttpAdapter (nodeAdapter(), fastifyAdapter()...)", adapter);
@@ -5577,7 +6227,8 @@ function isStandardSchema(value) {
 * the schema strips them).
 *
 * Returns synchronously when the schema validates synchronously, a promise otherwise (async
-* refinements): generated code always `await`s it.
+* refinements): generated code calls the handler directly with the value, and `await`s the value
+* when it is a thenable (`isThenable`).
 *
 * @param location what is validated, used in the error message: `body`, `query`, `query "page"`,
 *   `param "id"`, `headers`, `cookie "sid"`, `cookies`...
@@ -5587,8 +6238,9 @@ function isStandardSchema(value) {
 * @throws TypeError when `schema` is not a Standard Schema v1 (a programming error → 500).
 */
 function validate(schema, value, location) {
-	if (!isStandardSchema(schema)) throw new TypeError(`The schema of ${location} is not a Standard Schema v1 (missing "~standard.validate")`);
-	const result = schema["~standard"].validate(value);
+	const props = schema !== null && (typeof schema === "object" || typeof schema === "function") ? schema["~standard"] : void 0;
+	if (props === null || typeof props !== "object" || props.version !== 1 || typeof props.validate !== "function") throw new TypeError(`The schema of ${location} is not a Standard Schema v1 (missing "~standard.validate")`);
+	const result = props.validate(value);
 	if (isThenable(result)) return Promise.resolve(result).then((settled) => unwrap(settled, location));
 	return unwrap(result, location);
 }
@@ -5613,6 +6265,6 @@ function redact(issue) {
 		path
 	};
 }
-export { All, BadGatewayException, BadRequestException, Body, BodyLimit, ConflictException, Controller, Cookie, Ctx, Delete, EventChannel, ForbiddenException, GatewayTimeoutException, Get, GoneException, Head, Header, Headers, HttpCode, HttpException, HttpPlugin, HttpResponse, HttpTokens, InternalServerErrorException, MethodNotAllowedException, NotFoundException, NotImplementedException, Options, Param, Patch, PayloadTooLargeException, Post, Put, Query, Req, RequestAbortedError, Res, ServiceUnavailableException, SignedCookie, Sse, TooManyRequestsException, UnauthorizedException, UnprocessableEntityException, UnsupportedMediaTypeException, UploadedFile, UploadedFiles, UseGuard, UseInterceptor, Validate, ValidationException, coerce, contentDisposition, contentTypeFor, createRouteDecorator, encodeSseEvent, formatByteSize, isHttpException, isHttpResponse, isJsonType, isStandardSchema, isValidStatus, matchesMediaType, nodeAdapter, parseBody, parseByteSize, parseCookieHeader, parseMediaType, parseQuery, parseRange, parseSetCookie, parseSseStream, serializeClearCookie, serializeCookie, statusText, toIssueDetail, uploads, validate };
+export { All, BadGatewayException, BadRequestException, Body, BodyLimit, ConflictException, Controller, Cookie, Ctx, Delete, EventChannel, ForbiddenException, GatewayTimeoutException, Get, GoneException, Head, Header, Headers, HttpCode, HttpException, HttpPlugin, HttpResponse, HttpTokens, InternalServerErrorException, MethodNotAllowedException, NotFoundException, NotImplementedException, Options, Param, Patch, PayloadTooLargeException, Post, Put, Query, Req, RequestAbortedError, Res, ServiceUnavailableException, SignedCookie, Sse, TooManyRequestsException, UnauthorizedException, UnprocessableEntityException, UnsupportedMediaTypeException, UploadedFile, UploadedFiles, UseGuard, UseInterceptor, Validate, ValidationException, coerce, contentDisposition, contentTypeFor, createRouteDecorator, encodeSseEvent, formatByteSize, isHttpException, isHttpResponse, isJsonType, isStandardSchema, isThenable, isValidStatus, matchesMediaType, nodeAdapter, parseBody, parseByteSize, parseCookieHeader, parseMediaType, parseQuery, parseRange, parseSetCookie, parseSseStream, serializeClearCookie, serializeCookie, statusText, toIssueDetail, uploads, validate };
 
 //# sourceMappingURL=index.mjs.map