elysia 2.0.0-beta.2 → 2.0.0-beta.3

package/dist/cookie/serialize.mjs

@@ -6,7 +6,7 @@ function serializeCookie(cookies) {
 	if (!cookies || !isNotEmpty(cookies)) return;
 	let set;
 	let isArray = false;
-	for (const key in cookies) {
+	for (const key of Object.keys(cookies)) {
 		if (!key) continue;
 		const property = cookies[key];
 		if (!property) continue;

package/dist/cookie/types.d.ts

@@ -108,6 +108,16 @@ interface CookieOptions {
    * `null` in the array makes Elysia accept an unsigned cookie (intended only for a one-way unsigned→signed migration)
    */
   secrets?: string | null | (string | null)[];
+  /**
+   * Only use secret for signing cookie instead of secret + seperator + name
+   *
+   * Set to `false` once every signed cookie in circulation has been re-issued
+   *
+   * Applies to the app and route level
+   *
+   * @default true
+   */
+  legacySignature?: boolean;
 }
 //#endregion
 export { BaseCookie, CookieOptions };

package/dist/cookie/utils.js

@@ -69,7 +69,7 @@ async function parseCookieRaw(cookieString, config) {
 		if (v === void 0) continue;
 		let value = (0, deuri.default)(v) ?? v;
 		const signCheck = require_cookie_config.resolveSignSecrets(name, config);
-		if (signCheck !== void 0) value = await require_cookie_crypto.unsignWithSecrets(name, value, signCheck);
+		if (signCheck !== void 0) value = await require_cookie_crypto.unsignWithSecrets(name, value, signCheck, config.legacySignature);
 		out[name] = require_cookie_crypto.maybeJsonDecode(value);
 	}
 	return out;
@@ -85,7 +85,7 @@ function parseCookieRawSigned(cookieString, config) {
 		if (v === void 0) continue;
 		let value = (0, deuri.default)(v) ?? v;
 		const signCheck = require_cookie_config.resolveSignSecrets(name, config);
-		if (signCheck !== void 0) value = require_cookie_crypto.unsignWithSecretsSync(name, value, signCheck);
+		if (signCheck !== void 0) value = require_cookie_crypto.unsignWithSecretsSync(name, value, signCheck, config.legacySignature);
 		out[name] = require_cookie_crypto.maybeJsonDecode(value);
 	}
 	return out;
@@ -101,7 +101,10 @@ function buildCookieJar(set, raw, config, lazySign, deferDecode) {
 		if (entry.expires instanceof Date) entry.expires = new Date(entry.expires.getTime());
 		if (lazySign && typeof entry.value === "string") {
 			const secrets = require_cookie_config.resolveSignSecrets(name, config);
-			if (secrets !== void 0) entry["~unsign"] = secrets;
+			if (secrets !== void 0) {
+				entry["~unsign"] = secrets;
+				if (!config.legacySignature) entry["~strict"] = 1;
+			}
 		} else {
 			const value = entry.value;
 			if (value !== null && typeof value === "object") {
@@ -114,16 +117,27 @@ function buildCookieJar(set, raw, config, lazySign, deferDecode) {
 		return entry;
 	}
 	const cache = require_utils.nullObject();
+	function settle(key) {
+		if (!(key in store)) return;
+		const entry = materializeEntry(key);
+		if ("~unsign" in entry) require_cookie_crypto.resolvePendingCookie(entry, key);
+	}
 	return new Proxy(store, {
 		get(_, key) {
 			return cache[key] ??= new require_cookie_cookie.Cookie(key, set, key in store ? materializeEntry(key) : Object.assign(require_utils.nullObject(), config.defaults, config.fields[key]?.defaults));
 		},
+		has(target, key) {
+			if (typeof key === "string") settle(key);
+			return Reflect.has(target, key);
+		},
+		ownKeys(target) {
+			const keys = Reflect.ownKeys(target);
+			for (let i = 0; i < keys.length; i++) settle(keys[i]);
+			return keys;
+		},
 		getOwnPropertyDescriptor(target, key) {
-			if (typeof key === "string" && key in target) materializeEntry(key);
-			const descriptor = Reflect.getOwnPropertyDescriptor(target, key);
-			const entry = descriptor?.value;
-			if (entry && typeof entry === "object" && "~unsign" in entry) require_cookie_crypto.resolvePendingCookie(entry, String(key));
-			return descriptor;
+			if (typeof key === "string") settle(key);
+			return Reflect.getOwnPropertyDescriptor(target, key);
 		}
 	});
 }
@@ -142,11 +156,11 @@ function collectSignPending(cookies, config) {
 			if (property["~raw"] === value) continue;
 		} else if (typeof value !== "string") value = value + "";
 		const secret = Array.isArray(r.secrets) ? r.secrets[0] ?? null : r.secrets;
-		if (secret === null) throw new TypeError(`Cookie field "${key}" is signed but no \`secrets\` is provided.`);
+		if (!secret?.trim()) throw new TypeError(`Cookie field "${key}" is signed but no \`secrets\` is provided.`);
 		(pending ??= []).push([
 			property,
 			value,
-			secret
+			require_cookie_crypto.deriveSignKey(secret, key)
 		]);
 	}
 	return pending;
@@ -156,8 +170,8 @@ function signCookieValues(cookies, config) {
 	if (!pending) return;
 	if (require_cookie_crypto.hasSyncHmac) {
 		for (let i = 0; i < pending.length; i++) {
-			const [property, value, secret] = pending[i];
-			property.value = require_cookie_crypto.signCookieSyncImpl(value, secret);
+			const [property, value, key] = pending[i];
+			property.value = require_cookie_crypto.signCookieSyncImpl(value, key);
 		}
 		return;
 	}
@@ -165,8 +179,8 @@ function signCookieValues(cookies, config) {
 }
 async function signPending(pending) {
 	for (let i = 0; i < pending.length; i++) {
-		const [property, value, secret] = pending[i];
-		property.value = await require_cookie_crypto.signCookie(value, secret);
+		const [property, value, key] = pending[i];
+		property.value = await require_cookie_crypto.signCookie(value, key);
 	}
 }
 

package/dist/cookie/utils.mjs

@@ -1,7 +1,7 @@
 import { dangerousKeys } from "../constants.mjs";
 import { nullObject } from "../utils.mjs";
 import { parse } from "./lib.mjs";
-import { hasSyncHmac, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieSyncImpl, unsignWithSecrets, unsignWithSecretsSync } from "./crypto.mjs";
+import { deriveSignKey, hasSyncHmac, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieSyncImpl, unsignWithSecrets, unsignWithSecretsSync } from "./crypto.mjs";
 import { Cookie } from "./cookie.mjs";
 import { compileCookieConfig, isCookieSigned, resolveSignSecrets } from "./config.mjs";
 import decodeComponent from "deuri";
@@ -66,7 +66,7 @@ async function parseCookieRaw(cookieString, config) {
 		if (v === void 0) continue;
 		let value = decodeComponent(v) ?? v;
 		const signCheck = resolveSignSecrets(name, config);
-		if (signCheck !== void 0) value = await unsignWithSecrets(name, value, signCheck);
+		if (signCheck !== void 0) value = await unsignWithSecrets(name, value, signCheck, config.legacySignature);
 		out[name] = maybeJsonDecode(value);
 	}
 	return out;
@@ -82,7 +82,7 @@ function parseCookieRawSigned(cookieString, config) {
 		if (v === void 0) continue;
 		let value = decodeComponent(v) ?? v;
 		const signCheck = resolveSignSecrets(name, config);
-		if (signCheck !== void 0) value = unsignWithSecretsSync(name, value, signCheck);
+		if (signCheck !== void 0) value = unsignWithSecretsSync(name, value, signCheck, config.legacySignature);
 		out[name] = maybeJsonDecode(value);
 	}
 	return out;
@@ -98,7 +98,10 @@ function buildCookieJar(set, raw, config, lazySign, deferDecode) {
 		if (entry.expires instanceof Date) entry.expires = new Date(entry.expires.getTime());
 		if (lazySign && typeof entry.value === "string") {
 			const secrets = resolveSignSecrets(name, config);
-			if (secrets !== void 0) entry["~unsign"] = secrets;
+			if (secrets !== void 0) {
+				entry["~unsign"] = secrets;
+				if (!config.legacySignature) entry["~strict"] = 1;
+			}
 		} else {
 			const value = entry.value;
 			if (value !== null && typeof value === "object") {
@@ -111,16 +114,27 @@ function buildCookieJar(set, raw, config, lazySign, deferDecode) {
 		return entry;
 	}
 	const cache = nullObject();
+	function settle(key) {
+		if (!(key in store)) return;
+		const entry = materializeEntry(key);
+		if ("~unsign" in entry) resolvePendingCookie(entry, key);
+	}
 	return new Proxy(store, {
 		get(_, key) {
 			return cache[key] ??= new Cookie(key, set, key in store ? materializeEntry(key) : Object.assign(nullObject(), config.defaults, config.fields[key]?.defaults));
 		},
+		has(target, key) {
+			if (typeof key === "string") settle(key);
+			return Reflect.has(target, key);
+		},
+		ownKeys(target) {
+			const keys = Reflect.ownKeys(target);
+			for (let i = 0; i < keys.length; i++) settle(keys[i]);
+			return keys;
+		},
 		getOwnPropertyDescriptor(target, key) {
-			if (typeof key === "string" && key in target) materializeEntry(key);
-			const descriptor = Reflect.getOwnPropertyDescriptor(target, key);
-			const entry = descriptor?.value;
-			if (entry && typeof entry === "object" && "~unsign" in entry) resolvePendingCookie(entry, String(key));
-			return descriptor;
+			if (typeof key === "string") settle(key);
+			return Reflect.getOwnPropertyDescriptor(target, key);
 		}
 	});
 }
@@ -139,11 +153,11 @@ function collectSignPending(cookies, config) {
 			if (property["~raw"] === value) continue;
 		} else if (typeof value !== "string") value = value + "";
 		const secret = Array.isArray(r.secrets) ? r.secrets[0] ?? null : r.secrets;
-		if (secret === null) throw new TypeError(`Cookie field "${key}" is signed but no \`secrets\` is provided.`);
+		if (!secret?.trim()) throw new TypeError(`Cookie field "${key}" is signed but no \`secrets\` is provided.`);
 		(pending ??= []).push([
 			property,
 			value,
-			secret
+			deriveSignKey(secret, key)
 		]);
 	}
 	return pending;
@@ -153,8 +167,8 @@ function signCookieValues(cookies, config) {
 	if (!pending) return;
 	if (hasSyncHmac) {
 		for (let i = 0; i < pending.length; i++) {
-			const [property, value, secret] = pending[i];
-			property.value = signCookieSyncImpl(value, secret);
+			const [property, value, key] = pending[i];
+			property.value = signCookieSyncImpl(value, key);
 		}
 		return;
 	}
@@ -162,8 +176,8 @@ function signCookieValues(cookies, config) {
 }
 async function signPending(pending) {
 	for (let i = 0; i < pending.length; i++) {
-		const [property, value, secret] = pending[i];
-		property.value = await signCookie(value, secret);
+		const [property, value, key] = pending[i];
+		property.value = await signCookie(value, key);
 	}
 }
 

package/dist/handler/error.d.ts

@@ -2,17 +2,7 @@ import { AppHook } from "../types.js";
 import { Context } from "../context.js";
 
 //#region src/handler/error.d.ts
-/**
- * Adopt the intercepted error's `type` into a problem the hook produced
- * without one.
- *
- * `'about:blank'` is RFC 9457's "unspecified" default, so it's the only value
- * worth replacing — an explicit type the handler set always wins.
- *
- * The result is copied rather than mutated: `.error(Class, value)` wraps a
- * non-function into `() => value`, so the very same `ElysiaStatus` is replayed
- * on every request and an in-place write would leak across requests
- */
+declare const claimsProblemType: (error: any) => boolean;
 declare function adoptErrorType(result: any, error: any): any;
 /**
  * Response served once every error hook has declined the error.
@@ -21,6 +11,27 @@ declare function adoptErrorType(result: any, error: any): any;
  * which must land on *this* function rather than re-implementing it
  */
 declare function fallbackResponse(context: Context, error: any, mapResponse: (response: unknown, set: Context['set'], context?: Context) => unknown, defaultError?: Response): unknown;
+/**
+ * Numeric form of an annotated status, which may be written as a name.
+ * A numeric string keeps coercing so the production mask below can't be
+ * slipped past with `'502'`
+ */
+declare const resolveStatus: (status: unknown) => unknown;
+/**
+ * Body served by an error that carries a status but no usable body:
+ * its declared `response`, otherwise its message
+ */
+declare function statusFallbackBody(error: any, status: unknown): any;
+/**
+ * Read one annotation knob.
+ *
+ * Both knobs are canonically methods, so they're evaluated per serve and may
+ * be `async`. Running a stranger's function is side-effect surface (it may
+ * consume a stream or do IO), so it takes the same problem claim the shaping
+ * does — an unclaimed duck error never invokes one. A *value* annotation stays
+ * inert data and keeps duck-participating as it always has
+ */
+declare const readAnnotation: (self: any, key: "value" | "detail", claimsProblem: boolean) => any;
 declare function createErrorHandler(onErrors: AppHook['error'] | undefined, mapResponse: (response: unknown, set: Context['set'], ...any: unknown[]) => unknown, defaultError?: Response, allowUnsafe?: boolean): (context: Context, error: Error) => unknown;
 //#endregion
-export { adoptErrorType, createErrorHandler, fallbackResponse };
+export { adoptErrorType, claimsProblemType, createErrorHandler, fallbackResponse, readAnnotation, resolveStatus, statusFallbackBody };

package/dist/handler/error.js

@@ -35,20 +35,10 @@ function parseQuery(context) {
 	});
 }
 const isPristineNotFound = (context, error) => error instanceof require_error.NotFound && error.response === "Not Found" && !context.set.cookie && !require_utils.isNotEmpty(context.set.headers);
-/**
-* Adopt the intercepted error's `type` into a problem the hook produced
-* without one.
-*
-* `'about:blank'` is RFC 9457's "unspecified" default, so it's the only value
-* worth replacing — an explicit type the handler set always wins.
-*
-* The result is copied rather than mutated: `.error(Class, value)` wraps a
-* non-function into `() => value`, so the very same `ElysiaStatus` is replayed
-* on every request and an in-place write would leak across requests
-*/
+const claimsProblemType = (error) => typeof error?.type === "string" ? !(error instanceof require_error.ValidationError) && error.constructor?.name !== "ValidationError" : error instanceof require_error.HTTPError;
 function adoptErrorType(result, error) {
 	const body = result?.response;
-	if (typeof error?.type !== "string" || body?.type !== "about:blank" || result.headers?.["content-type"] !== "application/problem+json") return result;
+	if (typeof error?.type !== "string" || !claimsProblemType(error) || body?.type !== "about:blank" || result.headers?.["content-type"] !== "application/problem+json") return result;
 	return new require_error.ElysiaStatus(result.code, {
 		...body,
 		type: error.type
@@ -78,13 +68,13 @@ const resolveStatus = (status) => typeof status === "string" ? require_constants
 * Body served by an error that carries a status but no usable body:
 * its declared `response`, otherwise its message
 */
-const statusFallbackBody = (error, status) => error.response !== void 0 ? error.response : require_universal_is_production.isProduction() && status >= 500 ? "Internal Server Error" : error.message ?? "";
+function statusFallbackBody(error, status) {
+	const masked = require_universal_is_production.isProduction() && status >= 500;
+	const declared = error.response;
+	return declared !== void 0 && !(masked && typeof declared === "object") ? declared : masked ? "Internal Server Error" : error.message ?? "";
+}
 /**
 * RFC 9457 problem document carrying `detail` verbatim, mirroring `problem()`.
-*
-* `detail` is served exactly as annotated — objects included — it is never
-* spread into the envelope. `problemBody` only defaults `type` when the key is
-* *absent*, so an error without one has to supply `'about:blank'` itself
 */
 const problemOf = (self, detail, status) => new require_error.ElysiaStatus(status, require_error.problemBody({
 	type: self.type ?? "about:blank",
@@ -109,7 +99,7 @@ function fallbackErrorResponse(context, error, mapResponse, defaultError) {
 	const self = error;
 	const status = resolveStatus(self.status);
 	const owned = error instanceof require_error.HTTPError;
-	const claimsProblem = owned || typeof self.type === "string";
+	const claimsProblem = claimsProblemType(error);
 	const served = typeof status === "number" ? status : resolveStatus(context.set.status);
 	const failed = (cause) => {
 		context.set.status = 500;
@@ -124,9 +114,13 @@ function fallbackErrorResponse(context, error, mapResponse, defaultError) {
 			if (context.set.status === void 0 || context.set.status === 200) context.set.status = 500;
 			return mapResponse(require_error.internalServerErrorResponse(error), context.set, context);
 		}
-		return defaultError ? defaultError.clone() : require_error.internalServerErrorResponse(error);
+		return mapResponse(defaultError ? defaultError.clone() : require_error.internalServerErrorResponse(error), context.set, context);
+	};
+	const serveMessage = () => {
+		if (!claimsProblem) return legacy();
+		mergeHeaders();
+		return mapResponse(problemOf(self, statusFallbackBody(error, served), served), context.set, context);
 	};
-	const serveMessage = () => claimsProblem ? mapResponse(problemOf(self, statusFallbackBody(error, served), served), context.set, context) : legacy();
 	const serveDetail = () => {
 		let detail;
 		try {
@@ -143,6 +137,11 @@ function fallbackErrorResponse(context, error, mapResponse, defaultError) {
 		mergeHeaders();
 		return mapResponse(problemOf(self, detail, served), context.set, context);
 	};
+	if (error instanceof require_error.ValidationError) return mapResponse(new require_error.ElysiaStatus(422, require_error.problemBody({
+		type: "validation",
+		title: "Validation Error",
+		status: 422
+	}), { "content-type": require_error.PROBLEM_JSON }), context.set, context);
 	if (owned || error instanceof Error && typeof status === "number" && status >= 100 && !(require_universal_is_production.isProduction() && status >= 500)) {
 		let value;
 		try {
@@ -213,5 +212,9 @@ function createErrorHandler(onErrors, mapResponse, defaultError, allowUnsafe = f
 
 //#endregion
 exports.adoptErrorType = adoptErrorType;
+exports.claimsProblemType = claimsProblemType;
 exports.createErrorHandler = createErrorHandler;
-exports.fallbackResponse = fallbackResponse;
+exports.fallbackResponse = fallbackResponse;
+exports.readAnnotation = readAnnotation;
+exports.resolveStatus = resolveStatus;
+exports.statusFallbackBody = statusFallbackBody;

package/dist/handler/error.mjs

@@ -34,20 +34,10 @@ function parseQuery(context) {
 	});
 }
 const isPristineNotFound = (context, error) => error instanceof NotFound && error.response === "Not Found" && !context.set.cookie && !isNotEmpty(context.set.headers);
-/**
-* Adopt the intercepted error's `type` into a problem the hook produced
-* without one.
-*
-* `'about:blank'` is RFC 9457's "unspecified" default, so it's the only value
-* worth replacing — an explicit type the handler set always wins.
-*
-* The result is copied rather than mutated: `.error(Class, value)` wraps a
-* non-function into `() => value`, so the very same `ElysiaStatus` is replayed
-* on every request and an in-place write would leak across requests
-*/
+const claimsProblemType = (error) => typeof error?.type === "string" ? !(error instanceof ValidationError) && error.constructor?.name !== "ValidationError" : error instanceof HTTPError;
 function adoptErrorType(result, error) {
 	const body = result?.response;
-	if (typeof error?.type !== "string" || body?.type !== "about:blank" || result.headers?.["content-type"] !== "application/problem+json") return result;
+	if (typeof error?.type !== "string" || !claimsProblemType(error) || body?.type !== "about:blank" || result.headers?.["content-type"] !== "application/problem+json") return result;
 	return new ElysiaStatus(result.code, {
 		...body,
 		type: error.type
@@ -77,13 +67,13 @@ const resolveStatus = (status) => typeof status === "string" ? StatusMap[status]
 * Body served by an error that carries a status but no usable body:
 * its declared `response`, otherwise its message
 */
-const statusFallbackBody = (error, status) => error.response !== void 0 ? error.response : isProduction() && status >= 500 ? "Internal Server Error" : error.message ?? "";
+function statusFallbackBody(error, status) {
+	const masked = isProduction() && status >= 500;
+	const declared = error.response;
+	return declared !== void 0 && !(masked && typeof declared === "object") ? declared : masked ? "Internal Server Error" : error.message ?? "";
+}
 /**
 * RFC 9457 problem document carrying `detail` verbatim, mirroring `problem()`.
-*
-* `detail` is served exactly as annotated — objects included — it is never
-* spread into the envelope. `problemBody` only defaults `type` when the key is
-* *absent*, so an error without one has to supply `'about:blank'` itself
 */
 const problemOf = (self, detail, status) => new ElysiaStatus(status, problemBody({
 	type: self.type ?? "about:blank",
@@ -108,7 +98,7 @@ function fallbackErrorResponse(context, error, mapResponse, defaultError) {
 	const self = error;
 	const status = resolveStatus(self.status);
 	const owned = error instanceof HTTPError;
-	const claimsProblem = owned || typeof self.type === "string";
+	const claimsProblem = claimsProblemType(error);
 	const served = typeof status === "number" ? status : resolveStatus(context.set.status);
 	const failed = (cause) => {
 		context.set.status = 500;
@@ -123,9 +113,13 @@ function fallbackErrorResponse(context, error, mapResponse, defaultError) {
 			if (context.set.status === void 0 || context.set.status === 200) context.set.status = 500;
 			return mapResponse(internalServerErrorResponse(error), context.set, context);
 		}
-		return defaultError ? defaultError.clone() : internalServerErrorResponse(error);
+		return mapResponse(defaultError ? defaultError.clone() : internalServerErrorResponse(error), context.set, context);
+	};
+	const serveMessage = () => {
+		if (!claimsProblem) return legacy();
+		mergeHeaders();
+		return mapResponse(problemOf(self, statusFallbackBody(error, served), served), context.set, context);
 	};
-	const serveMessage = () => claimsProblem ? mapResponse(problemOf(self, statusFallbackBody(error, served), served), context.set, context) : legacy();
 	const serveDetail = () => {
 		let detail;
 		try {
@@ -142,6 +136,11 @@ function fallbackErrorResponse(context, error, mapResponse, defaultError) {
 		mergeHeaders();
 		return mapResponse(problemOf(self, detail, served), context.set, context);
 	};
+	if (error instanceof ValidationError) return mapResponse(new ElysiaStatus(422, problemBody({
+		type: "validation",
+		title: "Validation Error",
+		status: 422
+	}), { "content-type": PROBLEM_JSON }), context.set, context);
 	if (owned || error instanceof Error && typeof status === "number" && status >= 100 && !(isProduction() && status >= 500)) {
 		let value;
 		try {
@@ -211,4 +210,4 @@ function createErrorHandler(onErrors, mapResponse, defaultError, allowUnsafe = f
 }
 
 //#endregion
-export { adoptErrorType, createErrorHandler, fallbackResponse };
+export { adoptErrorType, claimsProblemType, createErrorHandler, fallbackResponse, readAnnotation, resolveStatus, statusFallbackBody };

package/dist/handler/fetch.js

@@ -13,8 +13,8 @@ let deuri = require("deuri");
 deuri = require_runtime.__toESM(deuri);
 
 //#region src/handler/fetch.ts
-function extractPath(url, context, pathStart) {
-	const s = url.indexOf("/", pathStart);
+function extractPath(url, context) {
+	const s = url.indexOf("/", require_utils.authorityEnd(url));
 	const q = context.qi = url.indexOf("?", s);
 	return context.path = q === -1 ? url.slice(s) : url.substring(s, q);
 }
@@ -111,7 +111,6 @@ function createFetchHandler(app) {
 	const hasWS = !!app["~hasWS"];
 	const hasDynamicWS = hasWS && !!app["~hasDynamicWS"];
 	const strictPath = !!app["~config"]?.strictPath;
-	const pathStart = app["~config"]?.handler?.standardHostname === false ? 7 : 11;
 	const hook = require_utils.flattenChain(app["~hookChain"]);
 	const hasError = !!hook?.error;
 	const abortSignal = app["~config"]?.abortSignal !== false;
@@ -217,7 +216,7 @@ function createFetchHandler(app) {
 			const context = new Context(request);
 			require_adapter_utils.materializeSetHeaders(context.set);
 			if (armEager(request, context)) return require_handler_utils.emptyResponse.clone();
-			extractPath(request.url, context, pathStart);
+			extractPath(request.url, context);
 			context.server = server ?? null;
 			context.rid = require_utils.requestId();
 			const traceLength = tracerFactories.length;
@@ -269,7 +268,7 @@ function createFetchHandler(app) {
 			const context = new Context(request);
 			require_adapter_utils.materializeSetHeaders(context.set);
 			if (armEager(request, context)) return require_handler_utils.emptyResponse.clone();
-			extractPath(request.url, context, pathStart);
+			extractPath(request.url, context);
 			context.server = server ?? null;
 			try {
 				for (let i = 0; i < onRequests.length; i++) {
@@ -291,7 +290,7 @@ function createFetchHandler(app) {
 			const context = new Context(request);
 			require_adapter_utils.materializeSetHeaders(context.set);
 			if (armEager(request, context)) return require_handler_utils.emptyResponse.clone();
-			extractPath(request.url, context, pathStart);
+			extractPath(request.url, context);
 			context.server = server ?? null;
 			try {
 				for (let i = 0; i < onRequests.length; i++) {
@@ -315,7 +314,7 @@ function createFetchHandler(app) {
 	}
 	return (request, server) => {
 		const context = new Context(request);
-		const path = extractPath(request.url, context, pathStart);
+		const path = extractPath(request.url, context);
 		context.server = server ?? null;
 		const method = request.method;
 		if (hasWS && method === "GET") {

package/dist/handler/fetch.mjs

@@ -1,4 +1,4 @@
-import { flattenChain, isNotEmpty, nullObject, requestId } from "../utils.mjs";
+import { authorityEnd, flattenChain, isNotEmpty, nullObject, requestId } from "../utils.mjs";
 import { isProduction } from "../universal/is-production.mjs";
 import { NotFound, PROBLEM_JSON, internalServerErrorResponse } from "../error.mjs";
 import { handleSet, materializeSetHeaders } from "../adapter/utils.mjs";
@@ -10,8 +10,8 @@ import { createContext } from "../context.mjs";
 import decodeComponent from "deuri";
 
 //#region src/handler/fetch.ts
-function extractPath(url, context, pathStart) {
-	const s = url.indexOf("/", pathStart);
+function extractPath(url, context) {
+	const s = url.indexOf("/", authorityEnd(url));
 	const q = context.qi = url.indexOf("?", s);
 	return context.path = q === -1 ? url.slice(s) : url.substring(s, q);
 }
@@ -108,7 +108,6 @@ function createFetchHandler(app) {
 	const hasWS = !!app["~hasWS"];
 	const hasDynamicWS = hasWS && !!app["~hasDynamicWS"];
 	const strictPath = !!app["~config"]?.strictPath;
-	const pathStart = app["~config"]?.handler?.standardHostname === false ? 7 : 11;
 	const hook = flattenChain(app["~hookChain"]);
 	const hasError = !!hook?.error;
 	const abortSignal = app["~config"]?.abortSignal !== false;
@@ -214,7 +213,7 @@ function createFetchHandler(app) {
 			const context = new Context(request);
 			materializeSetHeaders(context.set);
 			if (armEager(request, context)) return emptyResponse.clone();
-			extractPath(request.url, context, pathStart);
+			extractPath(request.url, context);
 			context.server = server ?? null;
 			context.rid = requestId();
 			const traceLength = tracerFactories.length;
@@ -266,7 +265,7 @@ function createFetchHandler(app) {
 			const context = new Context(request);
 			materializeSetHeaders(context.set);
 			if (armEager(request, context)) return emptyResponse.clone();
-			extractPath(request.url, context, pathStart);
+			extractPath(request.url, context);
 			context.server = server ?? null;
 			try {
 				for (let i = 0; i < onRequests.length; i++) {
@@ -288,7 +287,7 @@ function createFetchHandler(app) {
 			const context = new Context(request);
 			materializeSetHeaders(context.set);
 			if (armEager(request, context)) return emptyResponse.clone();
-			extractPath(request.url, context, pathStart);
+			extractPath(request.url, context);
 			context.server = server ?? null;
 			try {
 				for (let i = 0; i < onRequests.length; i++) {
@@ -312,7 +311,7 @@ function createFetchHandler(app) {
 	}
 	return (request, server) => {
 		const context = new Context(request);
-		const path = extractPath(request.url, context, pathStart);
+		const path = extractPath(request.url, context);
 		context.server = server ?? null;
 		const method = request.method;
 		if (hasWS && method === "GET") {

package/dist/handler/utils.js

@@ -1,13 +1,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_universal_constants = require('../universal/constants.js');
+const require_universal_env = require('../universal/env.js');
 const require_error = require('../error.js');
 const require_compile_utils = require('../compile/utils.js');
 
 //#region src/handler/utils.ts
-const emptyResponse = require_universal_constants.isCloudflareWorker ? { clone: () => new Response(null) } : new Response(null);
+const isPreallocateResponseUnsafe = require_universal_constants.isCloudflareWorker || require_universal_constants.isFastly || require_universal_env.env.ELYSIA_PREALLOCATE_RESPONSE === "false";
+const emptyResponse = isPreallocateResponseUnsafe ? { clone: () => new Response(null) } : new Response(null);
 function cachedResponse(body, status, headers) {
 	let cached;
-	return () => require_universal_constants.isCloudflareWorker ? new Response(body, {
+	return () => isPreallocateResponseUnsafe ? new Response(body, {
 		status,
 		headers
 	}) : (cached ??= new Response(body, {

package/dist/handler/utils.mjs

@@ -1,12 +1,14 @@
-import { isCloudflareWorker } from "../universal/constants.mjs";
+import { isCloudflareWorker, isFastly } from "../universal/constants.mjs";
+import { env } from "../universal/env.mjs";
 import { PROBLEM_JSON } from "../error.mjs";
 import { isAsyncFunction, mayReturnPromise } from "../compile/utils.mjs";
 
 //#region src/handler/utils.ts
-const emptyResponse = isCloudflareWorker ? { clone: () => new Response(null) } : new Response(null);
+const isPreallocateResponseUnsafe = isCloudflareWorker || isFastly || env.ELYSIA_PREALLOCATE_RESPONSE === "false";
+const emptyResponse = isPreallocateResponseUnsafe ? { clone: () => new Response(null) } : new Response(null);
 function cachedResponse(body, status, headers) {
 	let cached;
-	return () => isCloudflareWorker ? new Response(body, {
+	return () => isPreallocateResponseUnsafe ? new Response(body, {
 		status,
 		headers
 	}) : (cached ??= new Response(body, {

package/dist/index.js

@@ -1,5 +1,4 @@
 Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: 'Module' } });
-const require_runtime = require('./_virtual/_rolldown/runtime.js');
 const require_constants = require('./constants.js');
 const require_universal_file = require('./universal/file.js');
 const require_utils = require('./utils.js');
@@ -15,7 +14,6 @@ const require_base = require('./base.js');
 const require_type_validator_index = require('./type/validator/index.js');
 const require_type_compat = require('./type/compat.js');
 const require_type_index = require('./type/index.js');
-let typebox_system = require("typebox/system");
 
 //#region src/index.ts
 var src_default = require_base.Elysia;
@@ -37,12 +35,7 @@ exports.StandardValidator = require_validator_index.StandardValidator;
 exports.StatusMap = require_constants.StatusMap;
 exports.StatusMapBack = require_constants.StatusMapBack;
 exports.TypeBoxValidator = require_type_validator_index.TypeBoxValidator;
-Object.defineProperty(exports, 'TypeSystem', {
-  enumerable: true,
-  get: function () {
-    return typebox_system.System;
-  }
-});
+exports.TypeSystem = require_type_index.TypeSystem;
 exports.ValidationError = require_error.ValidationError;
 exports.Validator = require_validator_index.Validator;
 exports.borrow = require_adapter_response_ownership.borrow;

package/dist/package.js

@@ -1,6 +1,6 @@
 
 //#region package.json
-var version = "2.0.0-beta.2";
+var version = "2.0.0-beta.3";
 
 //#endregion
 Object.defineProperty(exports, 'version', {

package/dist/package.mjs

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "2.0.0-beta.2";
+var version = "2.0.0-beta.3";
 
 //#endregion
 export { version };