@znight/http 0.1.2 → 0.1.3

package/dist/index.mjs

@@ -1,7 +1,7 @@
-import { n as RouteTable, t as nodeAdapter } from "./node-Clm1Ia7T.mjs";
-import { $ as UnprocessableEntityException, A as serializeCookie, B as ConflictException, C as decodeCookieValue, D as parseCookieHeader, E as isCookieName, F as isStreamSource, G as InternalServerErrorException, H as GatewayTimeoutException, I as toByteStream, J as NotImplementedException, K as MethodNotAllowedException, L as trackStream, M as captureContext, N as discardStream, O as parseSetCookie, P as isByteStream, Q as UnauthorizedException, R as BadGatewayException, S as checkCookie, T as givenCookieKey, U as GoneException, V as ForbiddenException, W as HttpException, X as ServiceUnavailableException, Y as PayloadTooLargeException, Z as TooManyRequestsException, at as isBodylessStatus, et as UnsupportedMediaTypeException, h as isEventStreamType, it as toIssueDetail, j as serializeResponseCookie, k as serializeClearCookie, nt as isHttpException, ot as isValidStatus, q as NotFoundException, rt as issue, st as statusText, tt as ValidationException, w as encodeCookieValue, x as DEFAULT_COOKIE_OPTIONS, z as BadRequestException } from "./node-io-CVnqpVNS.mjs";
+import { n as RouteTable, t as nodeAdapter } from "./node-DnYv_AMI.mjs";
+import { $ as TooManyRequestsException, A as parseSetCookie, B as BadGatewayException, C as DEFAULT_COOKIE_OPTIONS, D as givenCookieKey, E as encodeCookieValue, F as discardStream, G as GoneException, H as ConflictException, I as isByteStream, J as MethodNotAllowedException, K as HttpException, L as isStreamSource, M as serializeCookie, N as serializeResponseCookie, O as isCookieName, P as captureContext, Q as ServiceUnavailableException, R as toByteStream, T as decodeCookieValue, U as ForbiddenException, V as BadRequestException, W as GatewayTimeoutException, X as NotImplementedException, Y as NotFoundException, Z as PayloadTooLargeException, at as issue, ct as isValidStatus, et as UnauthorizedException, g as isEventStreamType, it as isHttpException, j as serializeClearCookie, k as parseCookieHeader, lt as statusText, nt as UnsupportedMediaTypeException, ot as toIssueDetail, q as InternalServerErrorException, rt as ValidationException, st as isBodylessStatus, tt as UnprocessableEntityException, w as checkCookie, z as trackStream } from "./node-io-BkdRSQeg.mjs";
 import { a as isMediaTypePattern, i as contentTypeFor, n as parseByteSize, o as matchesMediaType, r as OCTET_STREAM, s as mediaTypeEssence, t as formatByteSize } from "./size-D8rsQcV0.mjs";
-import { i as isThenable, n as errorMessage, r as isBun, t as emptyRecord } from "./utils-DCbu3a4w.mjs";
+import { a as isThenable, i as isBun, n as errorMessage, r as fastRecord, t as emptyRecord } from "./utils-DIWdzVht.mjs";
 import { RoutePathError, compareRoutePaths, compareStrings, decodePathValue, joinPaths, matchRoutePath, normalizePath, parseRoutePath } from "./path.mjs";
 import { Readable } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
@@ -483,9 +483,35 @@ function splitUrl(url) {
 }
 // src/body.ts
 const UTF8 = new TextDecoder("utf-8", { fatal: true });
+/**
+* Parsed `content-type` values: an application receives a handful of them, parsed twice per request
+* with a body (request context, then {@link parseBody}). Bounded, since clients choose the values:
+* cleared when full.
+*/
+const MEDIA_TYPES = /* @__PURE__ */ new Map();
+const MEDIA_TYPES_MAX = 64;
 /** Parses a `content-type` header value (`application/json; charset=utf-8`). */
 function parseMediaType(header) {
 	if (header === void 0) return void 0;
+	if (header === "application/json") return {
+		type: "application/json",
+		charset: void 0
+	};
+	const cached = MEDIA_TYPES.get(header);
+	if (cached !== void 0) return {
+		type: cached.type,
+		charset: cached.charset
+	};
+	const media = parseUncached(header);
+	if (media === void 0) return void 0;
+	if (MEDIA_TYPES.size === MEDIA_TYPES_MAX) MEDIA_TYPES.clear();
+	MEDIA_TYPES.set(header, media);
+	return {
+		type: media.type,
+		charset: media.charset
+	};
+}
+function parseUncached(header) {
 	const separator = header.indexOf(";");
 	const type = (separator === -1 ? header : header.slice(0, separator)).trim().toLowerCase();
 	if (type === "") return void 0;
@@ -537,12 +563,16 @@ function hasBody(headers) {
 */
 function parseBody(bytes, contentType, contentEncoding) {
 	try {
-		return Promise.resolve(parseBytes(bytes, contentType, contentEncoding));
+		return Promise.resolve(parseBodyBytes(bytes, contentType, contentEncoding));
 	} catch (error) {
 		return Promise.reject(error);
 	}
 }
-function parseBytes(bytes, contentType, contentEncoding) {
+/**
+* {@link parseBody} without the promise: returns the parsed body or throws its `HttpException`
+* (internal: the request context parses the buffered body with it, without an extra microtask).
+*/
+function parseBodyBytes(bytes, contentType, contentEncoding) {
 	if (bytes.byteLength === 0) return void 0;
 	checkContentEncoding(contentEncoding);
 	const media = parseMediaType(contentType);
@@ -601,7 +631,29 @@ function single(value, label) {
 	if (Array.isArray(value)) throw new BadRequestException(`Invalid ${label}: expected a single value, received ${value.length}`);
 	throw invalid$1(label, "a string", value);
 }
+/** Longest run of decimal digits whose value is exact without parsing (`999999999999999` < 2^53). */
+const MAX_FAST_DIGITS = 15;
+/**
+* The value of `text` when it is 1 to 15 ASCII decimal digits (the common `/users/42`), `-1`
+* otherwise. The same number as `Number(text)` for such a string, without the regular expression,
+* the trim and the parse of the general path.
+*/
+function digitsValue(text) {
+	const length = text.length;
+	if (length === 0 || length > MAX_FAST_DIGITS) return -1;
+	let result = 0;
+	for (let index = 0; index < length; index++) {
+		const digit = text.charCodeAt(index) - 48;
+		if (digit < 0 || digit > 9) return -1;
+		result = result * 10 + digit;
+	}
+	return result;
+}
 function toNumber(value, label) {
+	if (typeof value === "string") {
+		const digits = digitsValue(value);
+		if (digits !== -1) return digits;
+	}
 	const raw = single(value, label);
 	const text = raw.trim();
 	if (NUMBER.test(text)) {
@@ -611,6 +663,10 @@ function toNumber(value, label) {
 	throw invalid$1(label, "a number", raw);
 }
 function toInteger(value, label) {
+	if (typeof value === "string") {
+		const digits = digitsValue(value);
+		if (digits !== -1) return digits;
+	}
 	const raw = single(value, label);
 	const text = raw.trim();
 	if (INTEGER.test(text)) {
@@ -620,6 +676,8 @@ function toInteger(value, label) {
 	throw invalid$1(label, "an integer", raw);
 }
 function toBoolean(value, label) {
+	if (value === "true" || value === "1") return true;
+	if (value === "false" || value === "0") return false;
 	const raw = single(value, label);
 	switch (raw.trim().toLowerCase()) {
 		case "true":
@@ -781,8 +839,27 @@ const ABORT_MESSAGES = {
 	shutdown: "The server is shutting down",
 	expired: "The event stream reached its maxDuration"
 };
+/**
+* The state of a request context that most requests never need (parsed query, `ctx.state`, body,
+* request cookies, abort signal), created on first use: a context is created for every request.
+*/
+var ContextState = class {
+	query = void 0;
+	state = void 0;
+	body = void 0;
+	files = void 0;
+	raw = void 0;
+	streamed = false;
+	/** Stops the body stream opened for the request, unless it was read to its end or cancelled. */
+	stopBody = void 0;
+	parsed = void 0;
+	cookies = void 0;
+	signed = void 0;
+	abortReason = void 0;
+	abortController = void 0;
+};
 /** Implementation of {@link HttpContext} used by the pipeline (internal). */
-var RequestContext = class {
+var RequestContext = class RequestContext {
 	requestId;
 	method;
 	url;
@@ -798,60 +875,64 @@ var RequestContext = class {
 	#source;
 	#plan;
 	#rawQuery;
-	#query;
-	#state;
-	#responseHeaders;
-	#body;
-	#files;
-	#raw;
-	#streamed = false;
-	/** Stops the body stream opened for the request, unless it was read to its end or cancelled. */
-	#stopBody;
-	#parsed;
 	#cookieSettings;
-	#cookies;
-	#signed;
+	#responseHeaders = void 0;
 	/** Cookies set on the response, by key (name, domain, path), with their `Set-Cookie` line. */
-	#jar;
+	#jar = void 0;
 	/** The response headers were handed to the adapter (cookies can no longer be set). */
 	#committed = false;
 	/** The request is over: later aborts are ignored. */
 	#completed = false;
-	#abortReason;
-	#abortController;
-	constructor(source, init) {
+	#more = void 0;
+	/** `path` and `query`: `source.url` split; `client`: see {@link RequestContextInit.client}. */
+	constructor(source, requestId, adapter, path, query, route, params, body, cookies, client) {
 		this.#source = source;
-		this.#plan = init.body;
-		this.#cookieSettings = init.cookies ?? DEFAULT_COOKIE_SETTINGS;
-		const { path, query } = init.url ?? splitUrl(source.url);
+		this.#plan = body;
+		this.#cookieSettings = cookies;
 		this.#rawQuery = query;
-		this.requestId = init.requestId;
+		this.requestId = requestId;
 		this.method = source.method;
 		this.url = source.url;
 		this.path = path;
-		this.params = init.params;
+		this.params = params;
 		this.headers = source.headers;
-		this.route = init.route;
+		this.route = route;
 		this.request = source.raw;
 		this.response = source.rawResponse;
-		this.adapter = init.adapter;
-		const connection = source.encrypted === true ? "https" : "http";
-		this.ip = init.client === void 0 ? source.ip : init.client.ip;
-		this.protocol = init.client === void 0 ? connection : init.client.protocol;
+		this.adapter = adapter;
+		if (client === void 0) {
+			this.ip = source.ip;
+			this.protocol = source.encrypted === true ? "https" : "http";
+		} else {
+			this.ip = client.ip;
+			this.protocol = client.protocol;
+		}
+	}
+	/** A context from named settings (defaults: `source.url` split, secure cookie defaults, the adapter's client). */
+	static of(source, init) {
+		const { path, query } = init.url ?? splitUrl(source.url);
+		return new RequestContext(source, init.requestId, init.adapter, path, query, init.route, init.params, init.body, init.cookies ?? DEFAULT_COOKIE_SETTINGS, init.client);
+	}
+	/** The state created on first use. */
+	get #extra() {
+		this.#more ??= new ContextState();
+		return this.#more;
 	}
 	get query() {
-		this.#query ??= parseQuery(this.#rawQuery);
-		return this.#query;
+		const state = this.#extra;
+		state.query ??= parseQuery(this.#rawQuery);
+		return state.query;
 	}
 	get state() {
-		this.#state ??= /* @__PURE__ */ new Map();
-		return this.#state;
+		const state = this.#extra;
+		state.state ??= /* @__PURE__ */ new Map();
+		return state.state;
 	}
 	get body() {
-		return this.#body;
+		return this.#more?.body;
 	}
 	get files() {
-		return this.#files ?? NO_FILES$1;
+		return this.#more?.files ?? NO_FILES$1;
 	}
 	/** Maximum body size of the route, in bytes. */
 	get bodyLimit() {
@@ -879,16 +960,18 @@ var RequestContext = class {
 		else this.#responseHeaders[key] = typeof existing === "string" ? [existing, value] : [...existing, value];
 	}
 	get cookies() {
-		this.#cookies ??= parseCookieHeader(this.headers["cookie"]);
-		return this.#cookies;
+		const state = this.#extra;
+		state.cookies ??= parseCookieHeader(this.headers["cookie"]);
+		return state.cookies;
 	}
 	signedCookie(name) {
 		const signer = this.#cookieSettings.signer;
 		if (signer === void 0) throw missingSecrets(`Cannot read the signed cookie ${JSON.stringify(String(name))}`);
-		this.#signed ??= /* @__PURE__ */ new Map();
-		if (this.#signed.has(name)) return this.#signed.get(name);
+		const state = this.#extra;
+		state.signed ??= /* @__PURE__ */ new Map();
+		if (state.signed.has(name)) return state.signed.get(name);
 		const value = verifySigned(signer, name, this.cookies[name]);
-		this.#signed.set(name, value);
+		state.signed.set(name, value);
 		return value;
 	}
 	setCookie(name, value, options = {}) {
@@ -908,6 +991,10 @@ var RequestContext = class {
 	get responseCookies() {
 		return this.#jar === void 0 ? NO_COOKIES$1 : [...this.#jar.values()].map((entry) => entry.cookie);
 	}
+	/** Whether {@link setCookie} / {@link clearCookie} were called (internal). */
+	get hasCookies() {
+		return this.#jar !== void 0;
+	}
 	/** The `Set-Cookie` lines of {@link setCookie} / {@link clearCookie}, with their keys, in order (internal). */
 	get cookieLines() {
 		return this.#jar === void 0 ? NO_LINES : [...this.#jar].map(([key, entry]) => ({
@@ -932,27 +1019,29 @@ var RequestContext = class {
 		});
 	}
 	get signal() {
-		if (this.#abortController === void 0) {
+		const state = this.#extra;
+		if (state.abortController === void 0) {
 			const controller = new AbortController();
-			this.#abortController = controller;
-			if (this.#abortReason !== void 0) controller.abort(this.#abortReason);
+			state.abortController = controller;
+			if (state.abortReason !== void 0) controller.abort(state.abortReason);
 			else if (!this.#completed) this.#source.onAbort?.(() => this.abort("client"));
 		}
-		return this.#abortController.signal;
+		return state.abortController.signal;
 	}
 	/** Whether {@link signal} aborted (or will be created aborted). */
 	get aborted() {
-		return this.#abortReason !== void 0;
+		return this.#more?.abortReason !== void 0;
 	}
 	/**
 	* Aborts {@link signal} with a {@link RequestAbortedError} of `kind` (internal): at most once, and
 	* never once the request is over ({@link complete}).
 	*/
 	abort(kind) {
-		if (this.#abortReason !== void 0 || this.#completed) return;
+		if (this.#more?.abortReason !== void 0 || this.#completed) return;
 		const reason = new RequestAbortedError(kind);
-		this.#abortReason = reason;
-		this.#abortController?.abort(reason);
+		const state = this.#extra;
+		state.abortReason = reason;
+		state.abortController?.abort(reason);
 	}
 	/** The response headers are handed to the adapter: cookies can no longer be set (internal). */
 	commit() {
@@ -963,15 +1052,17 @@ var RequestContext = class {
 		this.#completed = true;
 	}
 	rawBody() {
-		if (this.#raw === void 0) {
-			if (this.#streamed) return Promise.reject(alreadyStreamed());
-			this.#raw = this.#source.readBody(this.#plan.limit);
+		const state = this.#extra;
+		if (state.raw === void 0) {
+			if (state.streamed) return Promise.reject(alreadyStreamed());
+			state.raw = this.#source.readBody(this.#plan.limit);
 		}
-		return this.#raw;
+		return state.raw;
 	}
 	bodyStream() {
-		if (this.#raw !== void 0 || this.#streamed) throw alreadyStreamed();
-		this.#streamed = true;
+		const state = this.#extra;
+		if (state.raw !== void 0 || state.streamed) throw alreadyStreamed();
+		state.streamed = true;
 		return this.#openBodyStream();
 	}
 	/**
@@ -980,18 +1071,21 @@ var RequestContext = class {
 	* adapter discard the rest of the body, so that the connection can serve the next request.
 	*/
 	releaseBody() {
-		const stop = this.#stopBody;
-		this.#stopBody = void 0;
+		const state = this.#more;
+		if (state === void 0) return;
+		const stop = state.stopBody;
+		state.stopBody = void 0;
 		stop?.();
 	}
 	/** The body as a stream (see {@link releaseBody}). */
 	#openBodyStream() {
 		const reader = openBodyStream(this.#source, this.#plan.limit).getReader();
+		const state = this.#extra;
 		let controller;
 		const settle = () => {
-			this.#stopBody = void 0;
+			state.stopBody = void 0;
 		};
-		this.#stopBody = () => {
+		state.stopBody = () => {
 			reader.cancel().catch(() => void 0);
 			try {
 				controller?.error(/* @__PURE__ */ new Error("The request is over: its body can no longer be read"));
@@ -1023,32 +1117,34 @@ var RequestContext = class {
 		}, { highWaterMark: 0 });
 	}
 	parseBody() {
-		this.#parsed ??= this.#parse();
-		return this.#parsed;
+		const state = this.#extra;
+		state.parsed ??= this.#parse();
+		return state.parsed;
 	}
 	async #parse() {
 		const headers = this.headers;
 		const contentType = headers["content-type"];
 		const media = parseMediaType(contentType);
+		const state = this.#extra;
 		if (media?.type === "multipart/form-data") {
 			checkContentEncoding(headers["content-encoding"]);
 			const policy = this.#plan.multipart;
 			let result;
-			if (this.#raw === void 0) {
-				if (this.#streamed) throw alreadyStreamed();
-				this.#streamed = true;
+			if (state.raw === void 0) {
+				if (state.streamed) throw alreadyStreamed();
+				state.streamed = true;
 				result = await readMultipart(this.#openBodyStream(), contentType, policy);
-			} else result = parseMultipart(await this.#raw, contentType, policy);
-			this.#files = result.files;
-			this.#body = result.fields;
+			} else result = parseMultipart(await state.raw, contentType, policy);
+			state.files = result.files;
+			state.body = result.fields;
 			return result.fields;
 		}
 		if (this.#plan.upload) {
 			if (!(headers["content-length"] !== void 0 || headers["transfer-encoding"] !== void 0 ? hasBody(headers) : this.#source.hasBody?.() === true)) return void 0;
 			throw new UnsupportedMediaTypeException(`Expected a multipart/form-data body${media === void 0 ? "" : ` (received ${JSON.stringify(media.type)})`}`);
 		}
-		const body = await parseBody(await this.rawBody(), contentType, headers["content-encoding"]);
-		this.#body = body;
+		const body = parseBodyBytes(await this.rawBody(), contentType, headers["content-encoding"]);
+		state.body = body;
 		return body;
 	}
 };
@@ -1788,7 +1884,7 @@ function encodeExtValue(value) {
 */
 /** Length of a signature: base64url of 32 bytes, without padding. */
 const SIGNATURE_LENGTH = 43;
-const ENCODER$2 = new TextEncoder();
+const ENCODER$3 = new TextEncoder();
 /**
 * Signs and verifies cookie values. The wire form of a signed cookie is
 * `<encoded value>.<signature>` with `signature = base64url(HMAC-SHA256(secret, "<name>=<encoded value>"))`:
@@ -1835,7 +1931,7 @@ function isSignature(text) {
 	return true;
 }
 function toBytes(secret) {
-	return typeof secret === "string" ? ENCODER$2.encode(secret) : secret;
+	return typeof secret === "string" ? ENCODER$3.encode(secret) : secret;
 }
 /**
 * Normalises the option `cookies.secrets` to a list, or explains what is wrong with it (a secret
@@ -2851,8 +2947,8 @@ function describe$1(value) {
 function errorText(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-const ENCODER$1 = new TextEncoder();
-const HEARTBEAT = ENCODER$1.encode(":\n\n");
+const ENCODER$2 = new TextEncoder();
+const HEARTBEAT = ENCODER$2.encode(":\n\n");
 /**
 * One event stream: the byte stream sent to the client and the controls of the pipeline
 * ({@link close} on shutdown or `maxDuration`). The source is read only when the client pulls
@@ -2902,7 +2998,7 @@ var SseSession = class {
 			start: (controller) => {
 				this.#controller = controller;
 				const retry = settings.retry;
-				controller.enqueue(retry === void 0 ? HEARTBEAT : ENCODER$1.encode(`retry: ${retry}\n\n`));
+				controller.enqueue(retry === void 0 ? HEARTBEAT : ENCODER$2.encode(`retry: ${retry}\n\n`));
 				if (settings.maxDuration !== void 0) this.#maxTimer = unref(setTimeout(() => this.close("expired"), timerDelay(settings.maxDuration)));
 			},
 			pull: (controller) => this.#pull(controller),
@@ -2965,7 +3061,7 @@ var SseSession = class {
 				await this.#finish(true);
 				return;
 			}
-			controller.enqueue(ENCODER$1.encode(encoded));
+			controller.enqueue(ENCODER$2.encode(encoded));
 			this.#atBoundary = true;
 			this.#lineHasContent = false;
 			this.#afterCr = false;
@@ -3093,7 +3189,7 @@ var SseSession = class {
 	#finalRetry() {
 		const base = this.#settings.retry ?? 3e3;
 		const random = this.#settings.random ?? Math.random;
-		return ENCODER$1.encode(`retry: ${Math.round(base + random() * base)}\n\n`);
+		return ENCODER$2.encode(`retry: ${Math.round(base + random() * base)}\n\n`);
 	}
 	/**
 	* Stops the source (`return()` / `cancel()`) and waits for it at most `stopTimeoutMs`: an async
@@ -3344,15 +3440,19 @@ function withCookie(cookies, cookie) {
 }
 /** Whether `value` is an {@link HttpResponse} (also across duplicated package copies). */
 function isHttpResponse(value) {
-	return value instanceof HttpResponse || value !== null && typeof value === "object" && value.constructor?.name === "HttpResponse" && "body" in value && "headers" in value;
+	if (value instanceof HttpResponse) return true;
+	if (value === null || typeof value !== "object") return false;
+	const type = value.constructor;
+	if (type === Object || type === Array) return false;
+	return type?.name === "HttpResponse" && "body" in value && "headers" in value;
 }
 // src/serialize.ts
-const ENCODER = new TextEncoder();
+const ENCODER$1 = new TextEncoder();
 /**
 * UTF-8 encoding of a text body: a pooled `Buffer` (a `Uint8Array`) is several times cheaper than
 * `TextEncoder` on Node.js, `TextEncoder` is the fastest on Bun.
 */
-const utf8 = isBun() ? (text) => ENCODER.encode(text) : (text) => Buffer$1.from(text, "utf8");
+const utf8$1 = isBun() ? (text) => ENCODER$1.encode(text) : (text) => Buffer$1.from(text, "utf8");
 /** Content types set by the serialiser. */
 const ContentType = Object.freeze({
 	json: "application/json; charset=utf-8",
@@ -3391,8 +3491,14 @@ function serializeResult(result, options) {
 		cookies = cookiesOf(result);
 	}
 	const finalStatus = options.status ?? status ?? defaultStatus(options.routeMethod, payload);
-	const headers = emptyRecord();
-	const body = encode(payload, headers);
+	const headers = fastRecord();
+	const encoded = encode(payload, headers);
+	let body;
+	let text;
+	if (typeof encoded === "string") {
+		text = encoded;
+		body = encodeText(encoded, headers, sendsBody(finalStatus, options.method));
+	} else body = encoded;
 	let own = true;
 	if (options.headers !== void 0) {
 		assignHeaders(headers, options.headers);
@@ -3406,7 +3512,7 @@ function serializeResult(result, options) {
 		assignHeaders(headers, extra);
 		own = false;
 	}
-	return withCookies(finish(finalStatus, headers, body, options.method, own), cookies);
+	return withCookies(finish(finalStatus, headers, body, options.method, text, own), cookies);
 }
 /**
 * Serialises an event stream (`@Sse` result, `HttpResponse.sse()`): status 200 unless `@HttpCode`
@@ -3417,7 +3523,7 @@ function serializeResult(result, options) {
 */
 function serializeSseReply(session, response, options) {
 	const status = options.status ?? response?.status ?? 200;
-	const headers = emptyRecord();
+	const headers = fastRecord();
 	headers["cache-control"] = "no-cache, no-transform";
 	headers["x-accel-buffering"] = "no";
 	if (options.headers !== void 0) assignHeaders(headers, options.headers);
@@ -3450,7 +3556,7 @@ function withCookies(reply, cookies) {
 */
 function serializeFileReply(file, response, options) {
 	const status = file.status === 200 ? options.status ?? response.status ?? 200 : file.status;
-	const headers = emptyRecord();
+	const headers = fastRecord();
 	assignHeaders(headers, file.headers);
 	if (options.headers !== void 0) assignHeaders(headers, options.headers);
 	if (options.context !== void 0) assignHeaders(headers, options.context);
@@ -3464,8 +3570,10 @@ function defaultStatus(routeMethod, payload) {
 }
 /** Serialises an error body as JSON. */
 function serializeError(status, body, method) {
-	const headers = emptyRecord();
-	return finish(status, headers, encode(body, headers), method);
+	const headers = fastRecord();
+	const encoded = encode(body, headers);
+	if (typeof encoded !== "string") return finish(status, headers, encoded, method);
+	return finish(status, headers, encodeText(encoded, headers, sendsBody(status, method)), method, encoded);
 }
 /** Copies headers with lower-case names (later values win). */
 function assignHeaders(target, source) {
@@ -3483,10 +3591,10 @@ function addMissingHeaders(target, source) {
 	}
 }
 /**
-* The reply of a body: a string (see {@link encode}) is sent as its UTF-8 bytes, with its text.
-* `own`: only {@link encode} set `headers`, which are then valid for a text body.
+* The reply of a body: `text` is the string `body` encodes (see {@link encodeText}). `own`: only
+* {@link encode} set `headers`, which are then valid for a text body.
 */
-function finish(status, headers, body, method, own = false) {
+function finish(status, headers, body, method, text, own = false) {
 	if (isBodylessStatus(status)) {
 		discard(body);
 		delete headers["content-type"];
@@ -3505,7 +3613,7 @@ function finish(status, headers, body, method, own = false) {
 			body: null
 		};
 	}
-	if (typeof body !== "string") return {
+	if (text === void 0) return {
 		status,
 		headers,
 		body
@@ -3513,22 +3621,41 @@ function finish(status, headers, body, method, own = false) {
 	return own ? {
 		status,
 		headers,
-		body: utf8(body),
-		text: body,
+		body,
+		text,
 		ownHeaders: true
 	} : {
 		status,
 		headers,
-		body: utf8(body),
-		text: body
+		body,
+		text
 	};
 }
 function discard(body) {
 	if (body instanceof ReadableStream) discardStream(body);
 }
+/** Whether a reply with this status, to this method, carries its body (see {@link finish}). */
+function sendsBody(status, method) {
+	return method !== "HEAD" && !isBodylessStatus(status);
+}
+/**
+* Sets the `content-length` of a text body (right after its `content-type`, before the route
+* headers) and returns its UTF-8 bytes: their length is the header, a lone surrogate counting as
+* U+FFFD. `null` when the reply sends no body (`HEAD`, bodyless status): nothing is encoded then,
+* `Buffer.byteLength` counts the same bytes.
+*/
+function encodeText(text, headers, sent) {
+	if (!sent) {
+		headers["content-length"] = String(Buffer$1.byteLength(text, "utf8"));
+		return null;
+	}
+	const bytes = utf8$1(text);
+	headers["content-length"] = String(bytes.byteLength);
+	return bytes;
+}
 /**
-* The body of a payload, its `content-type` and, for bytes and text, its `content-length` set in
-* `headers`. Text (a string, JSON) is returned as a string, encoded as UTF-8 by {@link finish}.
+* The body of a payload, its `content-type` and, for bytes, its `content-length` set in `headers`.
+* Text (a string, JSON) is returned as a string: {@link encodeText} sets its length and encodes it.
 */
 function encode(payload, headers) {
 	if (payload === void 0) return null;
@@ -3562,14 +3689,13 @@ function bytes(data, headers, type) {
 }
 function text$1(data, headers, type) {
 	headers["content-type"] = type;
-	headers["content-length"] = String(Buffer$1.byteLength(data, "utf8"));
 	return data;
 }
 function isNodeReadable(value) {
 	return value instanceof Readable || value !== null && typeof value === "object" && typeof value.pipe === "function" && typeof value.on === "function" && typeof value.read === "function";
 }
 function fromWebResponse(response, method) {
-	const headers = emptyRecord();
+	const headers = fastRecord();
 	for (const [name, value] of response.headers) if (name !== "set-cookie") headers[name] = value;
 	const cookies = response.headers.getSetCookie();
 	if (cookies.length > 0) headers["set-cookie"] = cookies;
@@ -3596,11 +3722,64 @@ const DEFAULT_SSE_SETTINGS = Object.freeze({
 const RAW = Symbol("raw response");
 const REQUEST_ID = /^[\w\-.:@/+=]{1,128}$/;
 const MAX_PATH_IN_MESSAGE = 200;
-/** The default request id generator: a random UUID. */
+/** The default request id generator: a random UUID (version 4, like `crypto.randomUUID()`). */
 function randomRequestId() {
-	return crypto.randomUUID();
+	return uuid();
+}
+const uuidPool = /* @__PURE__ */ new Uint8Array(2048);
+let uuidOffset = uuidPool.length;
+/** The text of the last UUID, its dashes in place. */
+const uuidText = Buffer$1.alloc(36, 45);
+/** The two lower-case hexadecimal digits of each byte, as character codes. */
+const HEX_CODES = /* @__PURE__ */ new Uint8Array(512);
+for (let byte = 0; byte < 256; byte++) {
+	const digits = byte.toString(16).padStart(2, "0");
+	HEX_CODES[byte * 2] = digits.charCodeAt(0);
+	HEX_CODES[byte * 2 + 1] = digits.charCodeAt(1);
+}
+function putHex(position, byte) {
+	uuidText[position] = HEX_CODES[byte * 2];
+	uuidText[position + 1] = HEX_CODES[byte * 2 + 1];
+}
+/**
+* A random version 4 UUID written from a pool of random bytes (`crypto.getRandomValues`), as Node.js
+* does, but read as one flat string: `crypto.randomUUID()` returns a concatenation of 20 pieces that
+* is flattened again when the header is written, which makes it about twice as slow.
+*/
+function pooledUuid() {
+	if (uuidOffset === uuidPool.length) {
+		crypto.getRandomValues(uuidPool);
+		uuidOffset = 0;
+	}
+	const pool = uuidPool;
+	const at = uuidOffset;
+	uuidOffset = at + 16;
+	putHex(0, pool[at]);
+	putHex(2, pool[at + 1]);
+	putHex(4, pool[at + 2]);
+	putHex(6, pool[at + 3]);
+	putHex(9, pool[at + 4]);
+	putHex(11, pool[at + 5]);
+	putHex(14, pool[at + 6] & 15 | 64);
+	putHex(16, pool[at + 7]);
+	putHex(19, pool[at + 8] & 63 | 128);
+	putHex(21, pool[at + 9]);
+	putHex(24, pool[at + 10]);
+	putHex(26, pool[at + 11]);
+	putHex(28, pool[at + 12]);
+	putHex(30, pool[at + 13]);
+	putHex(32, pool[at + 14]);
+	putHex(34, pool[at + 15]);
+	return readUuidText();
 }
 /**
+* The text of {@link uuidText}: Node.js `Buffer#latin1Slice` (what `toString('latin1')` calls after
+* checking its arguments) when present.
+*/
+const readUuidText = typeof uuidText.latin1Slice === "function" ? () => uuidText.latin1Slice(0, 36) : () => uuidText.toString("latin1", 0, 36);
+/** UUID generator: Bun's native `crypto.randomUUID()` is the fastest there. */
+const uuid = isBun() ? () => crypto.randomUUID() : pooledUuid;
+/**
 * The request pipeline (architecture §9.1):
 * `runInScope({ HttpContext, RequestId }) → hooks.run('http:request') → guards → body → interceptors
 * → invoke → serialise`, errors being mapped to responses inside `hooks.run`.
@@ -3615,6 +3794,22 @@ var Pipeline = class {
 	#securityHeaders;
 	/** Every request id can be sent: an incoming one matched `REQUEST_ID`, the generated ones are UUIDs. */
 	#validIds;
+	/**
+	* The headers of a JSON reply of the fast lane, in their final order (content type and length,
+	* then the framework headers, see {@link #frameworkHeaders}): copied, then completed with the
+	* length and the request id.
+	*/
+	#jsonHeaders;
+	/** The request id header of {@link #jsonHeaders}, `undefined` when the reply has none. */
+	#jsonIdHeader;
+	/** The headers of a reply without body of the fast lane (the framework headers, see {@link #jsonHeaders}). */
+	#emptyHeaders;
+	/** The request id header of {@link #emptyHeaders}, `undefined` when the reply has none. */
+	#emptyIdHeader;
+	/** Whether {@link #jsonHeaders} and {@link #emptyHeaders} hold every framework header (see {@link #fastRoute}). */
+	#fastHeaders;
+	/** The `cookies` option (secure defaults, no signing, when not set). */
+	#cookies;
 	#inflight = 0;
 	#idle = [];
 	/** Open event streams. */
@@ -3628,7 +3823,22 @@ var Pipeline = class {
 		this.#options = options;
 		this.#table = table;
 		this.#validIds = options.generateRequestId === randomRequestId;
+		this.#cookies = options.cookies ?? DEFAULT_COOKIE_SETTINGS;
 		this.#securityHeaders = Object.entries(options.securityHeaders ?? {}).map(([name, value]) => [name.toLowerCase(), value]);
+		const placeholder = "-";
+		const idHeader = options.requestIdHeader;
+		const json = {
+			"content-type": ContentType.json,
+			"content-length": "0"
+		};
+		this.#frameworkHeaders(json, placeholder, void 0, false);
+		this.#jsonHeaders = json;
+		this.#jsonIdHeader = idHeader !== void 0 && json[idHeader] === placeholder ? idHeader : void 0;
+		const empty = {};
+		this.#frameworkHeaders(empty, placeholder, void 0, false);
+		this.#emptyHeaders = empty;
+		this.#emptyIdHeader = idHeader !== void 0 && empty[idHeader] === placeholder ? idHeader : void 0;
+		this.#fastHeaders = (idHeader === void 0 || !(idHeader in Object.prototype)) && this.#securityHeaders.every(([name]) => !(name in Object.prototype));
 	}
 	/** Number of requests being processed. */
 	get inflight() {
@@ -3651,6 +3861,207 @@ var Pipeline = class {
 		return new Promise((resolve) => this.#idle.push(resolve));
 	}
 	/**
+	* The adapter handler of a route: {@link handle}, or a fast lane for the routes that need no
+	* guard, interceptor, event stream, raw response nor `@Header` when CORS is off (see
+	* {@link #fast}).
+	*/
+	handler(plan) {
+		const route = this.#fastRoute(plan);
+		if (route === void 0) return (request) => this.handle(plan, request);
+		return (request) => this.#fast(route, request);
+	}
+	/** The fast lane of a route, `undefined` when the route needs the general pipeline. */
+	#fastRoute(plan) {
+		const definition = plan.definition;
+		if (!this.#fastHeaders || this.#options.cors !== void 0 || plan.redirect === true || plan.guards.length > 0 || plan.interceptors.length > 0 || definition.sse !== void 0 || definition.rawResponse === true || definition.headers !== void 0 || definition.method === "ALL") return;
+		const post = definition.method === "POST";
+		const json = definition.status ?? (post ? 201 : 200);
+		return {
+			plan,
+			target: {
+				kind: "route",
+				plan
+			},
+			method: definition.method,
+			jsonStatus: definition.method === "HEAD" || isBodylessStatus(json) ? void 0 : json,
+			emptyStatus: definition.status ?? (post ? 201 : 204)
+		};
+	}
+	/**
+	* The fast lane: what {@link handle} does for a route of {@link #fastRoute}, decided once instead
+	* of per request, without promises while the route stays synchronous. A request takes it when no
+	* `http:request` wrapper nor listener is registered, the server is not draining and its method
+	* is the route's (not a `HEAD` served by a `GET` route); a plain object or array returned by the
+	* handler is serialised as JSON, and `undefined` answered without body, with the headers in their
+	* final order (a template precomputed at boot).
+	* A thenable result is awaited in the lane (see {@link #fastAsync}). Anything else — a malformed
+	* path (before the request starts), a thrown error or a rejection, an `HttpResponse`, a `Response`
+	* or any other result, headers or cookies set through the context — continues in the general
+	* pipeline, in the same request scope, with the same outcome.
+	*/
+	#fast(route, request) {
+		const plan = route.plan;
+		const hooks = this.#hooks;
+		if (this.draining || request.method !== route.method || hooks.hasWrappers("http:request") || hooks.hasListeners("http:request")) return this.handle(plan, request);
+		const url = request.url;
+		const mark = url.indexOf("?");
+		const path = mark === -1 ? url : url.slice(0, mark);
+		const params = routeParams(plan.path, path);
+		if (params === void 0) return this.handle(plan, request);
+		this.#enter();
+		let ctx;
+		try {
+			const query = mark === -1 ? "" : url.slice(mark + 1);
+			ctx = this.#context(request, this.#requestId(request), path, query, plan.info, params, plan.body);
+		} catch (error) {
+			this.#leave();
+			return Promise.reject(error);
+		}
+		const scope = this.#container.openScope([[HttpTokens.Context, ctx], [HttpTokens.RequestId, ctx.requestId]]);
+		const done = scope.run(this.#fastRun, route, request, ctx);
+		if (done instanceof Exchange) {
+			done.done.then(() => this.#end(done, scope, void 0), (error) => this.#end(done, scope, error));
+			if (!hooks.hasListeners("http:request")) return done.replied;
+			done.tracked = true;
+			return this.#emitted(done);
+		}
+		const closing = scope.close();
+		if (closing === void 0) {
+			ctx.complete();
+			this.#leave();
+		} else {
+			const x = new Exchange(request, ctx, ctx.requestId, route.target);
+			x.answer(done);
+			closing.then(() => this.#over(x), (error) => this.#disposalFailed(x, error));
+		}
+		if (!hooks.hasListeners("http:request")) return Promise.resolve(done);
+		const event = requestEvent(request, ctx, performance.now());
+		event.status = done.status;
+		return Promise.resolve(done).then((reply) => {
+			hooks.emit("http:request", event);
+			return reply;
+		});
+	}
+	/**
+	* The fast lane in the request scope: the reply when the handler answered synchronously with a
+	* plain JSON value or `undefined`, otherwise the exchange finishing the request (see {@link #fast}).
+	*/
+	#fastRun = (route, request, ctx) => {
+		const plan = route.plan;
+		if (plan.parseBody) return this.#fastLater(route, request, ctx, NO_RESULT);
+		let result;
+		let reply;
+		try {
+			result = plan.definition.invoke(this.#resolve(plan.controller), ctx);
+			if (isThenable(result)) return this.#fastLater(route, request, ctx, result);
+			reply = this.#fastReply(route, ctx, result);
+		} catch (error) {
+			const x = new Exchange(request, ctx, ctx.requestId, route.target);
+			x.done = this.#respond(x, () => this.#failed(error, ctx, x.event));
+			return x;
+		}
+		if (reply !== void 0) {
+			ctx.commit();
+			ctx.releaseBody();
+			return reply;
+		}
+		const x = new Exchange(request, ctx, ctx.requestId, route.target);
+		x.done = this.#respond(x, () => this.#settle(ctx, plan, x.event, result));
+		return x;
+	};
+	/** The fast lane of a route with a body to read or a handler that returned a thenable. */
+	#fastLater(route, request, ctx, result) {
+		const x = new Exchange(request, ctx, ctx.requestId, route.target);
+		x.done = this.#fastAsync(x, route, result);
+		return x;
+	}
+	/**
+	* The asynchronous part of the fast lane, in the request scope: the body read (`result` is
+	* {@link NO_RESULT}) and the handler run, or the thenable it returned awaited. Never rejects.
+	*/
+	async #fastAsync(x, route, pending) {
+		const ctx = x.ctx;
+		const plan = route.plan;
+		let result = pending;
+		let reply;
+		try {
+			if (result === NO_RESULT) {
+				const controller = this.#resolve(plan.controller);
+				await ctx.parseBody();
+				result = plan.definition.invoke(controller, ctx);
+			}
+			if (isThenable(result)) result = await result;
+			reply = this.#fastReply(route, ctx, result);
+		} catch (error) {
+			await this.#respond(x, () => this.#failed(error, ctx, x.event));
+			return;
+		}
+		if (reply === void 0) {
+			const value = result;
+			await this.#respond(x, () => this.#settle(ctx, plan, x.event, value));
+			return;
+		}
+		ctx.commit();
+		ctx.releaseBody();
+		if (x.tracked) x.event.status = reply.status;
+		x.answer(reply);
+	}
+	/**
+	* The reply of a plain JSON value (see {@link isPlainJson}) or of `undefined`: what
+	* `serializeResult` and {@link #complete} produce for it, the headers in their final order.
+	* `undefined` when the result or the context needs the general pipeline. Throws like
+	* `JSON.stringify`.
+	*/
+	#fastReply(route, ctx, result) {
+		const status = result === void 0 ? route.emptyStatus : route.jsonStatus;
+		if (status === void 0 || ctx.hasResponseHeaders || ctx.hasCookies || this.draining) return void 0;
+		const requestId = ctx.requestId;
+		if (!this.#validIds && !isHeaderValue(requestId)) return void 0;
+		if (result === void 0) {
+			const headers = { ...this.#emptyHeaders };
+			const idHeader = this.#emptyIdHeader;
+			if (idHeader !== void 0) headers[idHeader] = requestId;
+			return {
+				status,
+				headers,
+				body: null
+			};
+		}
+		if (!isPlainJson(result)) return void 0;
+		const json = JSON.stringify(result);
+		if (json === void 0) throw new TypeError(`Cannot serialise a ${typeof result} as a response body`);
+		const headers = { ...this.#jsonHeaders };
+		const body = utf8(json);
+		headers["content-length"] = String(body.byteLength);
+		const idHeader = this.#jsonIdHeader;
+		if (idHeader !== void 0) headers[idHeader] = requestId;
+		return {
+			status,
+			headers,
+			body,
+			text: json
+		};
+	}
+	/** Ends a fast-lane request once its asynchronous part settled: its scope is closed, then it is over. */
+	#end(x, scope, error) {
+		const closing = scope.close();
+		if (error !== void 0) {
+			const report = () => this.#disposalFailed(x, error);
+			if (closing === void 0) report();
+			else closing.then(report, report);
+			return;
+		}
+		if (closing === void 0) this.#over(x);
+		else closing.then(() => this.#over(x), (failure) => this.#disposalFailed(x, failure));
+	}
+	#disposalFailed(x, error) {
+		this.#over(x);
+		this.#logger.error("Failed to dispose request-scoped providers", {
+			err: error,
+			requestId: x.requestId
+		});
+	}
+	/**
 	* Handles a request routed to `plan` by the adapter. The request stays in flight (and its scope
 	* open) until a streamed or file response body has been fully read or cancelled by the adapter.
 	*/
@@ -3746,146 +4157,140 @@ var Pipeline = class {
 	}
 	#serve(request, url, route, params, target, startTime, body) {
 		this.#enter();
-		let requestId;
-		let ctx;
-		let event;
+		let x;
 		try {
-			requestId = this.#requestId(request);
-			const proxy = this.#options.trustProxy;
-			ctx = new RequestContext(request, {
-				requestId,
-				adapter: this.#options.adapter,
-				url,
-				route,
-				params,
-				body,
-				cookies: this.#options.cookies ?? DEFAULT_COOKIE_SETTINGS,
-				client: proxy === void 0 ? void 0 : proxy.resolve(request.remoteAddress ?? request.ip, request.headers, request.encrypted === true)
-			});
+			const requestId = this.#requestId(request);
+			const ctx = this.#context(request, requestId, url.path, url.query, route, params, body);
 			if (this.draining && target.kind === "route" && target.plan.definition.sse !== void 0) ctx.abort("shutdown");
-			event = {
-				method: request.method,
-				path: ctx.path,
-				route: route?.path,
-				requestId,
-				headers: request.headers,
-				context: ctx,
-				startTime,
-				responseHeaders: {}
-			};
+			x = new Exchange(request, ctx, requestId, target, startTime);
 		} catch (error) {
 			this.#leave();
 			return Promise.reject(error);
 		}
-		let outcome;
-		let cors;
-		const preflight = target.kind === "preflight";
-		let resolve = () => void 0;
-		let reject = () => void 0;
-		const replied = new Promise((onReply, onError) => {
-			resolve = onReply;
-			reject = onError;
+		this.#container.runInScope(() => this.#respond(x, void 0), [[HttpTokens.Context, x.ctx], [HttpTokens.RequestId, x.requestId]]).then(() => this.#over(x), (error) => {
+			this.#over(x);
+			this.#logger.error("Failed to dispose request-scoped providers", {
+				err: error,
+				requestId: x.requestId
+			});
 		});
-		let answered = false;
-		const answer = (reply) => {
-			answered = true;
-			resolve(reply);
-		};
-		/** The request is over (response body sent or abandoned, scope closed). */
-		const over = () => {
-			ctx.complete();
-			try {
-				if (!answered) {
-					const failure = /* @__PURE__ */ new Error("Request not handled");
-					const reply = serializeError(500, this.#internalBody(failure), ctx.method);
-					const completed = this.#complete(reply, ctx, event, requestId, cors, preflight, true);
-					event.status = 500;
-					answer(completed);
-				}
-			} catch (error) {
-				reject(error);
-			} finally {
-				this.#leave();
-			}
-		};
-		this.#container.runInScope(async () => {
-			let hookError;
-			let failed = false;
-			let run;
-			if (this.#options.cors !== void 0) cors = await this.#corsDecision(request, requestId);
-			let recheck = this.#hooks.hasWrappers("http:request");
-			try {
-				if (recheck) await this.#hooks.run("http:request", event, async () => {
-					outcome = this.#checked(await this.#process(ctx, target, event, cors), ctx, event);
+		return this.#hooks.hasListeners("http:request") ? this.#emitted(x) : x.replied;
+	}
+	/** The reply of a request once the `http:request` listeners saw its event. */
+	#emitted(x) {
+		return x.replied.then((reply) => {
+			this.#hooks.emit("http:request", x.event);
+			return reply;
+		});
+	}
+	/** The request context of a request (internal). */
+	#context(request, requestId, path, query, route, params, body) {
+		const proxy = this.#options.trustProxy;
+		return new RequestContext(request, requestId, this.#options.adapter, path, query, route, params, body, this.#cookies, proxy === void 0 ? void 0 : proxy.resolve(request.remoteAddress ?? request.ip, request.headers, request.encrypted === true));
+	}
+	/**
+	* Answers a request in its scope: its outcome (`process`, or the target of the exchange after the
+	* CORS decision and through the `http:request` wrappers), checked, completed and handed to the
+	* adapter; a streamed body is then tracked until it was sent or abandoned. Never rejects.
+	* `process` is given by the fast lane, which decided at the start of the request that no wrapper
+	* applies and that CORS is off.
+	*/
+	async #respond(x, process) {
+		const ctx = x.ctx;
+		const requestId = x.requestId;
+		const event = x.event;
+		let outcome;
+		let hookError;
+		let failed = false;
+		let run;
+		let recheck = false;
+		let work = process;
+		if (work === void 0) {
+			if (this.#options.cors !== void 0) x.cors = await this.#corsDecision(x.request, requestId);
+			recheck = this.#hooks.hasWrappers("http:request");
+			const target = x.target;
+			work = () => this.#process(ctx, target, event, x.cors);
+		}
+		try {
+			if (recheck) {
+				const inner = work;
+				await this.#hooks.run("http:request", event, async () => {
+					outcome = this.#checked(await inner(), ctx, event);
 					if (outcome !== RAW && isStreamed(outcome.body)) run = captureContext();
 					return outcome;
 				});
-				else outcome = this.#checked(await this.#process(ctx, target, event, cors), ctx, event);
-			} catch (error) {
-				failed = true;
-				hookError = error;
-			}
-			if (outcome === void 0) {
-				const error = failed ? hookError : /* @__PURE__ */ new Error("An \"http:request\" hook wrapper did not call next()");
-				event.error ??= error;
-				const fallback = await this.#errorReply(error, ctx);
-				outcome = this.#checkCookies(this.#checkHeaders(fallback, ctx, event), ctx, event);
-				event.status = outcome.status;
-				recheck = true;
-			} else if (failed) this.#logger.error("An \"http:request\" hook wrapper failed after the request was handled", {
-				err: hookError,
-				requestId
-			});
-			if (outcome === RAW) {
-				ctx.commit();
-				const status = request.rawStatus?.() ?? 200;
-				event.status ??= status;
-				answer({
-					status,
-					headers: {},
-					body: null,
-					raw: true
-				});
-				return;
-			}
-			const serialized = this.#complete(outcome, ctx, event, requestId, cors, preflight, recheck);
-			const body = serialized.body;
-			if (!isStreamed(body)) {
-				const reply = adapterReply(serialized, body);
-				ctx.commit();
-				ctx.releaseBody();
-				answer(reply);
-				return;
-			}
-			const tracked = trackStream(body, run ?? captureContext(), () => ctx.abort("client"));
-			const session = serialized.sse;
-			const reply = adapterReply(serialized, tracked.stream, body instanceof Blob ? body : void 0);
-			if (session !== void 0) {
-				this.#streams.add(session);
-				if (this.draining) session.close("shutdown");
-			}
+			} else outcome = this.#checked(await work(), ctx, event);
+		} catch (error) {
+			failed = true;
+			hookError = error;
+		}
+		if (outcome === void 0) {
+			const error = failed ? hookError : /* @__PURE__ */ new Error("An \"http:request\" hook wrapper did not call next()");
+			event.error ??= error;
+			const fallback = await this.#errorReply(error, ctx);
+			outcome = this.#checkCookies(this.#checkHeaders(fallback, ctx, event), ctx, event);
+			event.status = outcome.status;
+			recheck = true;
+		} else if (failed) this.#logger.error("An \"http:request\" hook wrapper failed after the request was handled", {
+			err: hookError,
+			requestId
+		});
+		if (outcome === RAW) {
 			ctx.commit();
-			answer(reply);
-			const failure = await tracked.done;
-			if (session !== void 0) this.#streams.delete(session);
-			if (failure !== void 0) this.#logger.error("The response stream failed", {
-				err: failure,
-				requestId,
-				path: ctx.path
+			const status = x.request.rawStatus?.() ?? 200;
+			event.status ??= status;
+			x.answer({
+				status,
+				headers: {},
+				body: null,
+				raw: true
 			});
+			return;
+		}
+		const serialized = this.#complete(outcome, ctx, event, requestId, x.cors, x.preflight, recheck);
+		const body = serialized.body;
+		if (!isStreamed(body)) {
+			const reply = adapterReply(serialized, body);
+			ctx.commit();
 			ctx.releaseBody();
-		}, [[HttpTokens.Context, ctx], [HttpTokens.RequestId, requestId]]).then(over, (error) => {
-			over();
-			this.#logger.error("Failed to dispose request-scoped providers", {
-				err: error,
-				requestId
-			});
-		});
-		if (!this.#hooks.hasListeners("http:request")) return replied;
-		return replied.then((reply) => {
-			this.#hooks.emit("http:request", event);
-			return reply;
+			x.answer(reply);
+			return;
+		}
+		const tracked = trackStream(body, run ?? captureContext(), () => ctx.abort("client"));
+		const session = serialized.sse;
+		const reply = adapterReply(serialized, tracked.stream, body instanceof Blob ? body : void 0);
+		if (session !== void 0) {
+			this.#streams.add(session);
+			if (this.draining) session.close("shutdown");
+		}
+		ctx.commit();
+		x.answer(reply);
+		const failure = await tracked.done;
+		if (session !== void 0) this.#streams.delete(session);
+		if (failure !== void 0) this.#logger.error("The response stream failed", {
+			err: failure,
+			requestId,
+			path: ctx.path
 		});
+		ctx.releaseBody();
+	}
+	/** The request is over (response body sent or abandoned, scope closed). */
+	#over(x) {
+		const ctx = x.ctx;
+		ctx.complete();
+		try {
+			if (!x.answered) {
+				const failure = /* @__PURE__ */ new Error("Request not handled");
+				const reply = serializeError(500, this.#internalBody(failure), ctx.method);
+				const completed = this.#complete(reply, ctx, x.event, x.requestId, x.cors, x.preflight, true);
+				x.event.status = 500;
+				x.answer(completed);
+			}
+		} catch (error) {
+			x.fail(error);
+		} finally {
+			this.#leave();
+		}
 	}
 	/**
 	* Adds the headers of the `http:request` wrappers, then the framework headers (see
@@ -3920,7 +4325,7 @@ var Pipeline = class {
 	#checkCookies(reply, ctx, event) {
 		const cookies = reply.cookies;
 		if (cookies === void 0 || cookies.length === 0) return reply;
-		const settings = this.#options.cookies ?? DEFAULT_COOKIE_SETTINGS;
+		const settings = this.#cookies;
 		const lines = [];
 		try {
 			for (const cookie of cookies) lines.push(serializeWith(cookie, settings));
@@ -4038,41 +4443,72 @@ var Pipeline = class {
 	}
 	/** Runs a route: guards, body, interceptors, handler, serialisation. Never rejects (errors are mapped). */
 	async #invoke(ctx, plan, event) {
+		let result;
 		try {
 			const controller = this.#resolve(plan.controller);
 			for (const guard of plan.guards) if (await this.#resolve(guard).canActivate(ctx) !== true) throw new ForbiddenException("Forbidden resource");
 			if (plan.parseBody) await ctx.parseBody();
 			const definition = plan.definition;
 			const interceptors = plan.interceptors;
-			let result;
-			if (interceptors.length === 0) {
-				result = definition.invoke(controller, ctx);
-				if (isThenable(result)) result = await result;
-			} else {
+			if (interceptors.length === 0) result = definition.invoke(controller, ctx);
+			else {
 				const chain = async (index) => {
 					if (index === interceptors.length) return await definition.invoke(controller, ctx);
 					return await this.#resolve(interceptors[index]).intercept(ctx, () => chain(index + 1));
 				};
-				result = await chain(0);
+				result = chain(0);
 			}
-			if (definition.rawResponse === true && !(result instanceof Response)) return RAW;
-			const options = {
-				method: ctx.method,
-				routeMethod: definition.method,
-				status: definition.status,
-				headers: definition.headers,
-				context: ctx.hasResponseHeaders ? ctx.responseHeaders : void 0
-			};
-			const sse = definition.sse;
-			let reply;
-			if (sse !== void 0 && !(result instanceof Response) && !isHttpResponse(result)) {
-				if (!isSseSource(result)) throw new TypeError(`@Sse handler ${displayName(plan.info.controller)}.${definition.handler} must return an AsyncIterable, an Iterable or a ReadableStream of SseEvent (received ${describeResult(result)})`);
-				reply = serializeSseReply(this.#openStream(result, sseOptions(sse), ctx), void 0, options);
-			} else reply = isHttpResponse(result) ? await this.#serialize(result, ctx, options, sse) : serializeResult(result, options);
-			return this.#finish(event, reply);
 		} catch (error) {
 			return await this.#failed(error, ctx, event);
 		}
+		const settled = this.#settle(ctx, plan, event, result);
+		return settled instanceof Promise ? await settled : settled;
+	}
+	/**
+	* The rest of {@link #invoke} once the handler (and its interceptors) returned `result`: awaited
+	* when it is a thenable, then serialised. Never throws nor rejects (errors are mapped).
+	*/
+	#settle(ctx, plan, event, result) {
+		if (isThenable(result)) return this.#settleLater(ctx, plan, event, result);
+		try {
+			const outcome = this.#outcome(ctx, plan, event, result);
+			return outcome instanceof Promise ? outcome.catch((error) => this.#failed(error, ctx, event)) : outcome;
+		} catch (error) {
+			return this.#failed(error, ctx, event);
+		}
+	}
+	async #settleLater(ctx, plan, event, pending) {
+		let result;
+		try {
+			result = await pending;
+		} catch (error) {
+			return await this.#failed(error, ctx, event);
+		}
+		const settled = this.#settle(ctx, plan, event, result);
+		return settled instanceof Promise ? await settled : settled;
+	}
+	/**
+	* The outcome of a handler result: `RAW` for a `@Res()` route, otherwise its reply (files resolved,
+	* event streams opened: only an `HttpResponse` may need an asynchronous step). Throws (or rejects)
+	* when the result cannot be served.
+	*/
+	#outcome(ctx, plan, event, result) {
+		const definition = plan.definition;
+		if (definition.rawResponse === true && !(result instanceof Response)) return RAW;
+		const options = {
+			method: ctx.method,
+			routeMethod: definition.method,
+			status: definition.status,
+			headers: definition.headers,
+			context: ctx.hasResponseHeaders ? ctx.responseHeaders : void 0
+		};
+		const sse = definition.sse;
+		if (sse !== void 0 && !(result instanceof Response) && !isHttpResponse(result)) {
+			if (!isSseSource(result)) throw new TypeError(`@Sse handler ${displayName(plan.info.controller)}.${definition.handler} must return an AsyncIterable, an Iterable or a ReadableStream of SseEvent (received ${describeResult(result)})`);
+			return this.#finish(event, serializeSseReply(this.#openStream(result, sseOptions(sse), ctx), void 0, options));
+		}
+		if (!isHttpResponse(result)) return this.#finish(event, serializeResult(result, options));
+		return this.#serialize(result, ctx, options, sse).then((reply) => this.#finish(event, reply));
 	}
 	/** Serialises a handler (or exception mapper) result; file bodies are resolved, event streams opened. */
 	async #serialize(result, ctx, options, route) {
@@ -4234,6 +4670,126 @@ var Pipeline = class {
 		}
 	}
 };
+/** `#fastAsync` reads the body and runs the handler. */
+const NO_RESULT = Symbol("no result");
+/** A request being answered (internal): its context, its target and the promise of its reply. */
+var Exchange = class {
+	request;
+	ctx;
+	requestId;
+	target;
+	preflight;
+	replied;
+	cors = void 0;
+	answered = false;
+	/** The `http:request` listeners will see the event (fast lane: keep its status). */
+	tracked = false;
+	/** The asynchronous part of a fast-lane request (never rejects). */
+	done = void 0;
+	#resolve;
+	#reject;
+	#event;
+	/** `startTime`: the event is created now (general pipeline); otherwise when first needed (fast lane). */
+	constructor(request, ctx, requestId, target, startTime) {
+		this.request = request;
+		this.ctx = ctx;
+		this.requestId = requestId;
+		this.target = target;
+		this.preflight = target.kind === "preflight";
+		let resolve;
+		let reject;
+		this.replied = new Promise((onReply, onError) => {
+			resolve = onReply;
+			reject = onError;
+		});
+		this.#resolve = resolve;
+		this.#reject = reject;
+		if (startTime !== void 0) this.#event = requestEvent(request, ctx, startTime);
+	}
+	/**
+	* The `http:request` event. The fast lane creates it when the general pipeline takes over: no
+	* hook saw the request start, so its `startTime` is not observed.
+	*/
+	get event() {
+		this.#event ??= requestEvent(this.request, this.ctx, performance.now());
+		return this.#event;
+	}
+	answer(reply) {
+		this.answered = true;
+		this.#resolve(reply);
+	}
+	fail(error) {
+		this.#reject(error);
+	}
+};
+/** The `http:request` event of a request. */
+function requestEvent(request, ctx, startTime) {
+	return {
+		method: request.method,
+		path: ctx.path,
+		route: ctx.route?.path,
+		requestId: ctx.requestId,
+		headers: request.headers,
+		context: ctx,
+		startTime,
+		responseHeaders: {}
+	};
+}
+/**
+* The decoded parameters of a raw request path matched against a route, in one pass: what
+* `matchRoutePath` then `decodePathValue` (see `Pipeline.#route`) give for a path they accept.
+* `undefined` when the path does not match or a value is not valid percent-encoding: the general
+* pipeline then answers it (a reroute, a 400).
+*/
+function routeParams(route, path) {
+	if (path.charCodeAt(0) !== 47) return void 0;
+	const params = emptyRecord();
+	const segments = route.segments;
+	const last = segments.length - 1;
+	if (last === -1) return path === "/" ? params : void 0;
+	let position = 1;
+	for (let index = 0; index <= last; index++) {
+		const segment = segments[index];
+		if (segment.kind === "wildcard") {
+			const rest = decodePathValue(path.slice(position));
+			if (rest === void 0) return void 0;
+			params["*"] = rest;
+			return params;
+		}
+		const slash = path.indexOf("/", position);
+		const end = slash === -1 ? path.length : slash;
+		if (segment.kind === "static") {
+			const value = segment.value;
+			if (end - position !== value.length || !path.startsWith(value, position)) return void 0;
+		} else {
+			if (end === position) return void 0;
+			const decoded = decodePathValue(path.slice(position, end));
+			if (decoded === void 0) return void 0;
+			params[segment.name] = decoded;
+		}
+		if (index === last) return end === path.length ? params : void 0;
+		if (slash === -1) return void 0;
+		position = slash + 1;
+	}
+	return params;
+}
+/**
+* A value the fast lane serialises as JSON: a plain object or array (its own prototype and
+* constructor), not duck-typed as a Node.js stream. Anything `serializeResult` could treat otherwise
+* (`HttpResponse`, `Response`, bytes, streams, `Blob`, strings, `undefined`...) is not.
+*/
+function isPlainJson(value) {
+	if (value === null || typeof value !== "object") return false;
+	const prototype = Object.getPrototypeOf(value);
+	const ctor = value.constructor;
+	if (prototype === Object.prototype) {
+		if (ctor !== Object) return false;
+	} else if (prototype !== Array.prototype || ctor !== Array) return false;
+	return typeof value.pipe !== "function";
+}
+const ENCODER = new TextEncoder();
+/** UTF-8 encoding of a text body, like the serialiser (a pooled `Buffer` on Node.js, `TextEncoder` on Bun). */
+const utf8 = isBun() ? (text) => ENCODER.encode(text) : (text) => Buffer$1.from(text, "utf8");
 /**
 * The reply handed to the adapter (internal fields of the serialised reply left out). A streamed
 * `text/event-stream` body is an event stream whatever produced it (`@Sse`, `HttpResponse.sse()`, a
@@ -5019,7 +5575,7 @@ var HttpPlugin = class HttpPlugin {
 			adapter.registerRoute({
 				method: registration.method,
 				path: registration.path,
-				handler: (request) => pipeline.handle(plan, request)
+				handler: pipeline.handler(plan)
 			});
 			routes.push(Object.freeze({
 				method: registration.method,
@@ -5671,7 +6227,8 @@ function isStandardSchema(value) {
 * the schema strips them).
 *
 * Returns synchronously when the schema validates synchronously, a promise otherwise (async
-* refinements): generated code always `await`s it.
+* refinements): generated code calls the handler directly with the value, and `await`s the value
+* when it is a thenable (`isThenable`).
 *
 * @param location what is validated, used in the error message: `body`, `query`, `query "page"`,
 *   `param "id"`, `headers`, `cookie "sid"`, `cookies`...
@@ -5681,8 +6238,9 @@ function isStandardSchema(value) {
 * @throws TypeError when `schema` is not a Standard Schema v1 (a programming error → 500).
 */
 function validate(schema, value, location) {
-	if (!isStandardSchema(schema)) throw new TypeError(`The schema of ${location} is not a Standard Schema v1 (missing "~standard.validate")`);
-	const result = schema["~standard"].validate(value);
+	const props = schema !== null && (typeof schema === "object" || typeof schema === "function") ? schema["~standard"] : void 0;
+	if (props === null || typeof props !== "object" || props.version !== 1 || typeof props.validate !== "function") throw new TypeError(`The schema of ${location} is not a Standard Schema v1 (missing "~standard.validate")`);
+	const result = props.validate(value);
 	if (isThenable(result)) return Promise.resolve(result).then((settled) => unwrap(settled, location));
 	return unwrap(result, location);
 }
@@ -5707,6 +6265,6 @@ function redact(issue) {
 		path
 	};
 }
-export { All, BadGatewayException, BadRequestException, Body, BodyLimit, ConflictException, Controller, Cookie, Ctx, Delete, EventChannel, ForbiddenException, GatewayTimeoutException, Get, GoneException, Head, Header, Headers, HttpCode, HttpException, HttpPlugin, HttpResponse, HttpTokens, InternalServerErrorException, MethodNotAllowedException, NotFoundException, NotImplementedException, Options, Param, Patch, PayloadTooLargeException, Post, Put, Query, Req, RequestAbortedError, Res, ServiceUnavailableException, SignedCookie, Sse, TooManyRequestsException, UnauthorizedException, UnprocessableEntityException, UnsupportedMediaTypeException, UploadedFile, UploadedFiles, UseGuard, UseInterceptor, Validate, ValidationException, coerce, contentDisposition, contentTypeFor, createRouteDecorator, encodeSseEvent, formatByteSize, isHttpException, isHttpResponse, isJsonType, isStandardSchema, isValidStatus, matchesMediaType, nodeAdapter, parseBody, parseByteSize, parseCookieHeader, parseMediaType, parseQuery, parseRange, parseSetCookie, parseSseStream, serializeClearCookie, serializeCookie, statusText, toIssueDetail, uploads, validate };
+export { All, BadGatewayException, BadRequestException, Body, BodyLimit, ConflictException, Controller, Cookie, Ctx, Delete, EventChannel, ForbiddenException, GatewayTimeoutException, Get, GoneException, Head, Header, Headers, HttpCode, HttpException, HttpPlugin, HttpResponse, HttpTokens, InternalServerErrorException, MethodNotAllowedException, NotFoundException, NotImplementedException, Options, Param, Patch, PayloadTooLargeException, Post, Put, Query, Req, RequestAbortedError, Res, ServiceUnavailableException, SignedCookie, Sse, TooManyRequestsException, UnauthorizedException, UnprocessableEntityException, UnsupportedMediaTypeException, UploadedFile, UploadedFiles, UseGuard, UseInterceptor, Validate, ValidationException, coerce, contentDisposition, contentTypeFor, createRouteDecorator, encodeSseEvent, formatByteSize, isHttpException, isHttpResponse, isJsonType, isStandardSchema, isThenable, isValidStatus, matchesMediaType, nodeAdapter, parseBody, parseByteSize, parseCookieHeader, parseMediaType, parseQuery, parseRange, parseSetCookie, parseSseStream, serializeClearCookie, serializeCookie, statusText, toIssueDetail, uploads, validate };
 
 //# sourceMappingURL=index.mjs.map