galbe 0.15.6 → 0.16.0

package/src/parser.ts

@@ -16,11 +16,10 @@ import type {
   STArray,
 } from './schema'
 
-import { readableStreamToArrayBuffer } from 'bun'
 import { Kind, Optional, Stream } from './schema'
-import { validate } from './validator'
-import { InternalServerError, RequestError } from './index'
-import { isIterator, inferBodyType, type ParseMode } from './util'
+import { runCompiled } from './validator.compile'
+import { InternalServerError, PayloadTooLargeError, RequestError } from './index'
+import { isIterator, inferBodyType, responseEntryFor, type ParseMode } from './util'
 
 const textDecoder = new TextDecoder()
 const textEncoder = new TextEncoder()
@@ -43,12 +42,58 @@ async function* rsToAsyncIterator(readableStream: ReadableStream) {
   }
 }
 
+// req.bytes() is untyped and returns ArrayBuffer or Uint8Array depending on
+// body chunking (Bun 1.3) — normalize through arrayBuffer. With a limit,
+// accumulate manually so chunked clients lying about their size (no or forged
+// content-length) are cut off as soon as they cross it.
+const reqBytes = async (req: Request, limit?: number) => {
+  if (limit === undefined) return new Uint8Array(await req.arrayBuffer())
+  const body = req.body
+  if (body === null) return new Uint8Array()
+  const chunks: Uint8Array[] = []
+  let total = 0
+  for await (const chunk of body) {
+    total += chunk.length
+    if (total > limit) throw new PayloadTooLargeError()
+    chunks.push(chunk)
+  }
+  const res = new Uint8Array(total)
+  let offset = 0
+  for (const chunk of chunks) {
+    res.set(chunk, offset)
+    offset += chunk.length
+  }
+  return res
+}
+const reqText = async (req: Request, limit?: number) =>
+  limit === undefined ? req.text() : textDecoder.decode(await reqBytes(req, limit))
+const reqJson = async (req: Request, limit?: number) =>
+  limit === undefined ? req.json() : JSON.parse(await reqText(req, limit))
+
+// Multipart boundary extraction from the content-type header: parameters are
+// `;`-separated and extra legal parameters (charset, …) must not leak into
+// the boundary value.
+const multipartBoundary = (contentType: string | null): string => {
+  for (const param of contentType?.split(';') ?? []) {
+    const eq = param.indexOf('=')
+    if (eq === -1 || param.slice(0, eq).trim().toLowerCase() !== 'boundary') continue
+    let value = param.slice(eq + 1).trim()
+    if (value.length > 1 && value.startsWith('"') && value.endsWith('"')) value = value.slice(1, -1)
+    if (value) return value
+  }
+  throw new RequestError({ status: 400, payload: { body: `Missing multipart boundary` } })
+}
+
+// `contentType` is the normalized media type (no parameters); the raw header is
+// read from the request only where its parameters matter (multipart boundary),
+// so body parsing never needs the materialized header map
 export const requestBodyParser = async (
-  body: ReadableStream | null,
-  headers: Record<string, string>,
+  req: Request,
   schemas?: STBody | STNull,
-  contentType?: string
+  contentType?: string,
+  limit?: number
 ) => {
+  const body = req.body
   const normalizedCT = contentType?.split(';')[0]?.trim()
   let parseMode: ParseMode = inferBodyType(contentType)
   let schema: STBodyValue | STNull | undefined =
@@ -68,27 +113,28 @@ export const requestBodyParser = async (
       // No schema defined, we base parsing on parseMode only
       if (parseMode === 'byteArray') {
         if (body === null) return new Uint8Array()
-        return new Uint8Array(await readableStreamToArrayBuffer(body))
+        return await reqBytes(req, limit)
       } else if (parseMode === 'json') {
         if (body === null) return null
         try {
-          return JSON.parse(await streamToString(body))
+          return await reqJson(req, limit)
         } catch (err: any) {
+          if (err instanceof RequestError) throw err
           throw new RequestError({
             status: 400,
-            payload: { body: err?.message ?? 'Parsing error' },
+            payload: { body: 'Not a valid JSON body' },
           })
         }
       } else if (parseMode === 'text') {
         if (body === null) return ''
-        return streamToString(body)
+        return await reqText(req, limit)
       } else if (parseMode === 'urlForm') {
         if (body === null) return {}
-        return await streamToUrlForm(body)
+        return parseUrlForm(await reqText(req, limit))
       } else if (parseMode === 'multipart') {
         if (body === null) return {}
-        const boundary = headers?.['content-type']?.match(/boundary\="?([^"]*)"?;?.*$/)?.[1] || ''
-        return await streamToMultipartForm(body, boundary)
+        const boundary = multipartBoundary(req.headers.get('content-type'))
+        return await streamToMultipartForm(oneChunkStream(await reqBytes(req, limit)), boundary)
       } else return body === null ? null : rsToAsyncIterator(body)
     } else {
       // Schemas found
@@ -110,7 +156,7 @@ export const requestBodyParser = async (
             : new Uint8Array()
         }
         if (isStream) return rsToAsyncIterator(body)
-        return new Uint8Array(await readableStreamToArrayBuffer(body))
+        return await reqBytes(req, limit)
       } else if (parseMode === 'text') {
         if (!kind || !['string', 'boolean', 'number', 'integer', 'anyOf', 'oneOf', 'literal'].includes(kind))
           throw new RequestError({ status: 400, payload: { body: `Not a valid body` } })
@@ -122,40 +168,44 @@ export const requestBodyParser = async (
                   controller.close()
                 },
               })
-            : validate('', schema as STSchema, { parse: true })
+            : runCompiled('', schema as STSchema, { parse: true })
         if (isStream) return $streamToString(body)
-        if (kind === 'anyOf' || kind === 'oneOf') {
-          let str = await streamToString(body)
-          return unionize(str, schema as STUnion)
-        }
-        return await streamToString(body, schema as STBodyValue)
+        const str = await reqText(req, limit)
+        if (kind === 'anyOf' || kind === 'oneOf') return unionize(str, schema as STUnion)
+        return runCompiled(str, schema as STSchema, { parse: true })
       } else if (parseMode === 'json') {
         if (
           !kind ||
-          !['object', 'json', 'boolean', 'number', 'integer', 'string', 'array', 'anyOf', 'oneOf', 'intersection'].includes(kind)
+          ![
+            'object',
+            'json',
+            'boolean',
+            'number',
+            'integer',
+            'string',
+            'array',
+            'anyOf',
+            'oneOf',
+            'intersection',
+          ].includes(kind)
         )
           throw new RequestError({ status: 400, payload: { body: `Not a valid body` } })
-        if (kind === 'anyOf' || kind === 'oneOf') {
-          let str = body === null ? 'null' : await streamToString(body)
-          let json = JSON.parse(str)
-          return unionize(json, schema as STUnion)
-        }
-        if (kind === 'intersection') {
-          let str = body === null ? 'null' : await streamToString(body)
-          let json = JSON.parse(str)
-          return intersectionize(json, schema as STIntersection<any>)
-        }
-        const str = body === null ? 'null' : await streamToString(body)
+        // an absent body parses as `null`, matching JSON.parse('null')
+        if (kind === 'anyOf' || kind === 'oneOf')
+          return unionize(body === null ? null : await reqJson(req, limit), schema as STUnion)
+        if (kind === 'intersection')
+          return intersectionize(body === null ? null : await reqJson(req, limit), schema as STIntersection<any>)
         let json
         try {
-          json = JSON.parse(str)
+          json = body === null ? null : await reqJson(req, limit)
         } catch (err: any) {
+          if (err instanceof RequestError) throw err
           throw new RequestError({
             status: 400,
-            payload: { body: err?.message ?? 'Parsing error' },
+            payload: { body: 'Not a valid JSON body' },
           })
         }
-        return validate(json, schema as STSchema, { parse: true })
+        return runCompiled(json, schema as STSchema, { parse: true })
       } else if (parseMode === 'urlForm') {
         if (!kind || !['object', 'anyOf', 'oneOf'].includes(kind))
           throw new RequestError({ status: 400, payload: { body: `Not a valid body` } })
@@ -167,21 +217,11 @@ export const requestBodyParser = async (
                   controller.close()
                 },
               })
-            : await streamToUrlForm(
-                new ReadableStream({
-                  start(controller) {
-                    controller.enqueue(new Uint8Array())
-                    controller.close()
-                  },
-                }),
-                schema as STObject
-              )
-        if (kind === 'anyOf' || kind === 'oneOf') {
-          const b = await streamToUrlForm(body)
-          return unionize(b, schema as STUnion)
-        }
+            : parseUrlForm('', schema as STObject)
+        if (kind === 'anyOf' || kind === 'oneOf')
+          return unionize(parseUrlForm(await reqText(req, limit)), schema as STUnion)
         if (isStream) return $streamToUrlForm(body, schema as STStream<STObject>)
-        else return await streamToUrlForm(body, schema as STObject)
+        else return parseUrlForm(await reqText(req, limit), schema as STObject)
       } else if (parseMode === 'multipart') {
         if (kind !== 'multipartForm' && kind !== 'anyOf' && kind !== 'oneOf')
           throw new RequestError({ status: 400, payload: { body: `Not a valid body` } })
@@ -194,13 +234,18 @@ export const requestBodyParser = async (
                 },
               })
             : {}
-        const boundary = headers?.['content-type']?.match(/boundary\="?([^"]*)"?;?.*$/)?.[1] || ''
+        const boundary = multipartBoundary(req.headers.get('content-type'))
         if (kind === 'anyOf' || kind === 'oneOf') {
-          let mp = await streamToMultipartForm(body, boundary)
+          let mp = await streamToMultipartForm(oneChunkStream(await reqBytes(req, limit)), boundary, undefined, limit)
           return unionize(mp, schema as STUnion)
         }
-        if (isStream) return $streamToMultipartForm(body, boundary, schema as STStream<STMultipartForm>)
-        return streamToMultipartForm(body, boundary, schema as STMultipartForm)
+        if (isStream) return $streamToMultipartForm(body, boundary, schema as STStream<STMultipartForm>, limit)
+        return streamToMultipartForm(
+          oneChunkStream(await reqBytes(req, limit)),
+          boundary,
+          schema as STMultipartForm,
+          limit
+        )
       } else if (parseMode === 'default') {
         throw new RequestError({ status: 400, payload: { body: `Not a valid content-type` } })
       }
@@ -218,12 +263,6 @@ async function* $streamToString(body: ReadableStream) {
   const tail = decoder.decode()
   if (tail) yield tail
 }
-const streamToString = async (body: ReadableStream, schema?: STBodyValue): Promise<any> => {
-  let res = ''
-  for await (const chunk of $streamToString(body)) res += chunk
-  if (schema) return validate(res, schema, { parse: true })
-  return res
-}
 async function* $streamToUrlForm(
   body: ReadableStream<Uint8Array>,
   schema?: STStream<STObject>
@@ -300,13 +339,20 @@ async function* $streamToUrlForm(
       payload: { body: `Missing field${reqKeys.length > 1 ? 's' : ''}: ${reqKeys.join(', ')}` },
     })
 }
-const streamToUrlForm = async (body: ReadableStream<Uint8Array>, schema?: STObject) => {
-  let entries = []
+// Buffered counterpart of $streamToUrlForm with the same pair semantics:
+// segments split on `&`, key/value on the first `=`; bare tokens yield an
+// empty key and are filtered out below.
+const parseUrlForm = (text: string, schema?: STObject) => {
+  const entries: [string, any][] = text.split('&').map(seg => {
+    const eq = seg.indexOf('=')
+    return eq === -1
+      ? ['', decodeFormComponent(seg)]
+      : [decodeFormComponent(seg.slice(0, eq)), decodeFormComponent(seg.slice(eq + 1))]
+  })
   const required = Object.fromEntries(
     Object.entries(schema?.props || {}).filter(([_, v]: [string, any]) => !v?.[Optional])
   )
   let errors: Record<string, any> = Object.create(null)
-  for await (const chunk of $streamToUrlForm(body)) entries.push(chunk)
   const object: Record<string, any> = Object.create(null)
   for (let e of entries.filter(([k]) => k)) {
     if (e[0] in object) {
@@ -339,9 +385,32 @@ const streamToUrlForm = async (body: ReadableStream<Uint8Array>, schema?: STObje
     })
   return object
 }
-async function* $streamToMultipartForm(data: ReadableStream<Uint8Array>, boundary: string, schema?: STMultipartForm) {
+// First index >= `from` where `needle` fully occurs in `hay`, -1 if none. The
+// native indexOf skips to candidate positions (the needle's first byte) so only
+// candidates are compared byte by byte, instead of every offset of the scan.
+const indexOfSeq = (hay: Uint8Array, needle: Uint8Array, from: number) => {
+  if (!needle.length) return -1
+  const last = hay.length - needle.length
+  for (let i = hay.indexOf(needle[0]!, from); i !== -1 && i <= last; i = hay.indexOf(needle[0]!, i + 1)) {
+    let b = 1
+    while (b < needle.length && hay[i + b] === needle[b]) b++
+    if (b === needle.length) return i
+  }
+  return -1
+}
+
+async function* $streamToMultipartForm(
+  data: ReadableStream<Uint8Array>,
+  boundary: string,
+  schema?: STMultipartForm,
+  limit?: number
+) {
   const bound = textEncoder.encode(boundary)
   const delimiter = textEncoder.encode('\r\n\r\n')
+  // A match straddling two chunks is undetectable within a single chunk: carry
+  // the tail of the unprocessed bytes into each chunk's scan window so the
+  // lookahead never stops at the chunk seam.
+  const lookahead = Math.max(bound.length, delimiter.length) - 1
   let rest = new Uint8Array()
   let bK: Uint8Array = new Uint8Array()
   let bV: Uint8Array = new Uint8Array()
@@ -350,30 +419,25 @@ async function* $streamToMultipartForm(data: ReadableStream<Uint8Array>, boundar
     Object.entries(schema?.props || {}).filter(([_, v]: [string, any]) => !v?.[Optional])
   )
   for await (const chunk of data) {
+    const carry = rest.subarray(Math.max(0, rest.length - lookahead))
+    const scan = new Uint8Array(carry.length + chunk.length)
+    scan.set(carry)
+    scan.set(chunk, carry.length)
+    rest = rest.slice(0, rest.length - carry.length)
     start = 0
-    for (let i = 0; i < chunk.length; i++) {
-      let matchBound = true
-      let matchDelimiter = true
-      for (let b = 0; b < bound.length; b++) {
-        if (chunk[i + b] === bound[b]) continue
-        else {
-          matchBound = false
-          break
-        }
-      }
-      if (!matchBound) {
-        for (let b = 0; b < delimiter.length; b++) {
-          if (chunk[i + b] === delimiter[b]) continue
-          else {
-            matchDelimiter = false
-            break
-          }
-        }
-      }
-      if (matchBound) {
+    // jump from match to match: whichever of boundary/delimiter comes first
+    // (boundary wins a tie, as in the byte-wise scan this replaces)
+    for (let p = 0; p < scan.length;) {
+      const iB = indexOfSeq(scan, bound, p)
+      const iD = indexOfSeq(scan, delimiter, p)
+      if (iB === -1 && iD === -1) break
+      const isBound = iB !== -1 && (iD === -1 || iB <= iD)
+      const i = isBound ? iB : iD
+      if (isBound) {
         bV = new Uint8Array(rest.length + i - start)
         bV.set(rest)
-        bV.set(chunk.slice(start, i), rest.length)
+        bV.set(scan.slice(start, i), rest.length)
+        if (limit !== undefined && bV.length > limit) throw new PayloadTooLargeError()
         bV = bV.slice(1, bV.length - 4)
         const headers = parseMultipartHeader(textDecoder.decode(bK))
         if (headers) {
@@ -391,22 +455,22 @@ async function* $streamToMultipartForm(data: ReadableStream<Uint8Array>, boundar
         bK = new Uint8Array()
         bV = new Uint8Array()
         start = i + bound.length
-        rest = new Uint8Array()
-        i = start
-      } else if (matchDelimiter) {
+      } else {
         bK = new Uint8Array(rest.length + i - start)
         bK.set(rest)
-        bK.set(chunk.slice(start, i), rest.length)
+        bK.set(scan.slice(start, i), rest.length)
         start = i + 3
-        rest = new Uint8Array()
-        i = start
-      }
-      if (i === chunk.length - 1) {
-        const newRest = new Uint8Array(rest.length + i - start + 1)
-        newRest.set(rest)
-        newRest.set(chunk.slice(start, i + 1), rest.length)
-        rest = newRest
       }
+      rest = new Uint8Array()
+      p = start
+    }
+    if (start < scan.length) {
+      const newRest = new Uint8Array(rest.length + scan.length - start)
+      newRest.set(rest)
+      newRest.set(scan.subarray(start), rest.length)
+      // rest accumulates the current part across chunks — cap its growth
+      if (limit !== undefined && newRest.length > limit) throw new PayloadTooLargeError()
+      rest = newRest
     }
   }
   const headers = parseMultipartHeader(textDecoder.decode(bK))
@@ -469,7 +533,7 @@ const parseMultipartContent = (
       try {
         result = JSON.parse(textDecoder.decode(content).trim())
       } catch (err: any) {
-        throw new RequestError({ status: 400, payload: { body: { [headers.name]: err?.message || 'Parsing error' } } })
+        throw new RequestError({ status: 400, payload: { body: { [headers.name]: 'Not a valid JSON part' } } })
       }
     } else if (schema?.props) {
       const prop = schema.props[headers.name]!
@@ -479,17 +543,17 @@ const parseMultipartContent = (
         } catch (err: any) {
           throw new RequestError({
             status: 400,
-            payload: { body: { [headers.name]: err?.message || 'Parsing error' } },
+            payload: { body: { [headers.name]: 'Not a valid JSON part' } },
           })
         }
         try {
-          validate(result, prop)
+          runCompiled(result, prop)
         } catch (err) {
           throw new RequestError({ status: 400, payload: { body: { [headers.name]: err } } })
         }
       } else if (prop[Kind] === 'byteArray') {
         try {
-          return validate(content, prop)
+          return runCompiled(content, prop)
         } catch (err) {
           throw new RequestError({ status: 400, payload: { body: { [headers.name]: err } } })
         }
@@ -506,7 +570,7 @@ const parseMultipartContent = (
     const s = getProp(schema?.props, headers.name)
     if (s) {
       try {
-        validate(result, s[Kind] === 'array' ? s.items : s)
+        runCompiled(result, s[Kind] === 'array' ? s.items : s)
       } catch (err) {
         throw new RequestError({ status: 400, payload: { body: { [headers.name]: err } } })
       }
@@ -514,21 +578,34 @@ const parseMultipartContent = (
   }
   return result
 }
-const streamToMultipartForm = async (data: ReadableStream<Uint8Array>, boundary: string, schema?: STMultipartForm) => {
+// Feeding the whole buffer as a single chunk keeps the streaming scanner's
+// semantics while skipping per-network-chunk generator overhead.
+const oneChunkStream = (buf: Uint8Array) =>
+  new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(buf)
+      controller.close()
+    },
+  })
+const streamToMultipartForm = async (
+  data: ReadableStream<Uint8Array>,
+  boundary: string,
+  schema?: STMultipartForm,
+  limit?: number
+) => {
   const res: Record<string, MultipartFormData> = Object.create(null)
   const errors: Record<string, any> = Object.create(null)
   const required = Object.fromEntries(
     Object.entries(schema?.props || {}).filter(([_, v]: [string, any]) => !v?.[Optional])
   )
-  for await (const chunk of $streamToMultipartForm(data, boundary)) {
+  for await (const chunk of $streamToMultipartForm(data, boundary, undefined, limit)) {
     const name = chunk.headers.name
     if (name in res) {
       const existing = res[name]!
       if (!Array.isArray(existing.content)) existing.content = [existing.content]
       existing.content.push(chunk.content)
     } else {
-      if (getProp(schema?.props, name)?.[Kind] === 'array')
-        res[name] = { ...chunk, content: [chunk.content] }
+      if (getProp(schema?.props, name)?.[Kind] === 'array') res[name] = { ...chunk, content: [chunk.content] }
       else res[name] = chunk
     }
     delete required[name]
@@ -537,9 +614,8 @@ const streamToMultipartForm = async (data: ReadableStream<Uint8Array>, boundary:
       try {
         const prop = schema.props[name]!
         const entry = res[name]!
-        if (Array.isArray(entry.content) && prop[Kind] !== 'array')
-          throw `Multiple values found`
-        entry.content = validate(entry.content, prop, {
+        if (Array.isArray(entry.content) && prop[Kind] !== 'array') throw `Multiple values found`
+        entry.content = runCompiled(entry.content, prop, {
           parse: true,
         })
         if (prop[Kind] === 'array')
@@ -585,7 +661,7 @@ const paramParser = (
   } else if (value === null) return null
   else if (Array.isArray(value)) {
     if (type[Kind] !== 'array') throw `Multiple values found`
-    validate(value, type)
+    runCompiled(value, type)
     let pv = []
     let errors: Record<number, any> = {}
     for (let [idx, v] of value.entries()) {
@@ -607,16 +683,16 @@ const paramParser = (
       if (value === null || value === undefined || value === '') throw `Not a valid integer`
       const parsedValue = Number(value)
       if (!Number.isFinite(parsedValue) || !Number.isInteger(parsedValue)) throw `Not a valid integer`
-      validate(parsedValue, type)
+      runCompiled(parsedValue, type)
       return parsedValue
     } else if (type[Kind] === 'number') {
       if (value === null || value === undefined || value === '') throw `Not a valid number`
       const parsedValue = Number(value)
       if (!Number.isFinite(parsedValue)) throw `Not a valid number`
-      validate(parsedValue, type)
+      runCompiled(parsedValue, type)
       return parsedValue
     } else if (type[Kind] === 'string') {
-      validate(value, type)
+      runCompiled(value, type)
       return value
     } else if (type[Kind] === 'literal') {
       const lit = type as STLiteral
@@ -632,7 +708,7 @@ const paramParser = (
       } catch (e) {
         throw `Not a valid object`
       }
-      return validate(json, type)
+      return runCompiled(json, type)
     } else if (type[Kind] === 'array') {
       return [paramParser(value, (type as STArray).items as STMultipartFormValues) as Static<STPropsValue>]
     } else if (type[Kind] === 'byteArray') {
@@ -688,6 +764,43 @@ export const requestPathParser = (input: string, path: string) => {
   return params
 }
 
+/**
+ * OpenAPI's `deepObject`: `?filter[lat]=1&filter[lon]=2` is one object
+ * parameter. Gathers the bracketed keys belonging to `key` and coerces each
+ * value against the property schema governing it — `additionalProperties`
+ * included, so a `$T.record` query parameter works too. Returns undefined when
+ * the query carries no bracketed key for `key`, leaving the JSON-encoded
+ * spelling (`?filter={"lat":1}`) to `paramParser`.
+ */
+const deepObjectParser = (params: { [key: string]: any }, key: string, type: STObject) => {
+  const prefix = `${key}[`
+  const out: Record<string, any> = {}
+  const errors: Record<string, any> = {}
+  let found = false
+  for (const k of Object.keys(params)) {
+    if (!k.startsWith(prefix) || !k.endsWith(']')) continue
+    // one level only: OpenAPI leaves nested deepObject undefined
+    const prop = k.slice(prefix.length, -1)
+    if (!prop || prop.includes('[') || prop.includes(']')) continue
+    found = true
+    const ps = (type.props?.[prop] ?? type.additionalProperties) as STMultipartFormValues | undefined
+    // an undeclared property is kept raw: `additionalProperties: false` rejects
+    // it downstream, an open object ignores it, and neither needs a guess here
+    if (!ps) {
+      out[prop] = params[k]
+      continue
+    }
+    try {
+      out[prop] = paramParser(params[k], ps)
+    } catch (error) {
+      errors[prop] = error
+    }
+  }
+  if (!found) return undefined
+  if (Object.keys(errors).length) throw errors
+  return out
+}
+
 export const parseEntry = <T extends STProps>(
   params: { [key: string]: any },
   schema: T,
@@ -696,18 +809,38 @@ export const parseEntry = <T extends STProps>(
   const parsedParams: Partial<Static<STObject<T>>> = {}
   const errors: { [key: string]: string | string[] } = {}
 
-  if (options?.i === true) {
-    params = Object.keys(params).reduce((acc, key) => {
-      acc[key.toLowerCase()] = params[key]
-      return acc
-    }, {} as { [key: string]: string | string[] })
+  // case-insensitive lookup (headers) without copying the whole map per request:
+  // the already-lowercased key usually hits, and the lowercased index — null
+  // prototype, the keys are untrusted — is only built when it does not
+  let lowercased: Record<string, any> | undefined
+  const lookup = (key: string) => {
+    const v = params[key]
+    if (v !== undefined || options?.i !== true) return v
+    if (!lowercased) {
+      const index: Record<string, any> = Object.create(null)
+      for (const k of Object.keys(params)) index[k.toLowerCase()] = params[k]
+      lowercased = index
+    }
+    return lowercased[key]
   }
 
   Object.entries(schema).forEach(([key, s]) => {
     const k = options?.i === true ? key.toLowerCase() : key
-    let v = params[k]
-    if (s[Kind] === 'array' && options?.name === 'query' && typeof v === 'string') v = v.split(',')
+    let v = lookup(k)
+    if (s[Kind] === 'array' && options?.name === 'query' && typeof v === 'string') {
+      // a single value may carry several items; repeated keys always may too
+      const delimiter = (s as unknown as STArray).split
+      if (delimiter !== false) v = v.split(delimiter || ',')
+    }
     try {
+      if (options?.name === 'query' && s[Kind] === 'object' && v === undefined) {
+        const deep = deepObjectParser(params, k, s as unknown as STObject)
+        if (deep !== undefined) {
+          //@ts-ignore
+          parsedParams[k] = runCompiled(deep, s as unknown as STSchema)
+          return
+        }
+      }
       let p = paramParser(v, s as STMultipartFormValues)
       //@ts-ignore
       if (p !== undefined) parsedParams[k] = p
@@ -753,10 +886,9 @@ export const responseParser = (response: any, ctx: Context, cookies: string[], s
     }
     for (const cookie of cookies) existing.append('set-cookie', cookie)
     return response
-  }
-  else if (typeof response === 'string') {
+  } else if (typeof response === 'string') {
     if (!details?.headers?.has('content-type')) {
-      const statusEntry: any = schema?.[details.status]
+      const statusEntry: any = responseEntryFor(schema as Partial<Record<string | number, any>>, details.status)
       const isJson = statusEntry?.[Kind]
         ? statusEntry[Kind] === 'json'
         : statusEntry?.['application/json'] && !statusEntry?.['text/plain']
@@ -779,16 +911,27 @@ export const responseParser = (response: any, ctx: Context, cookies: string[], s
     const rs = new ReadableStream({
       type: 'direct',
       async pull(controller) {
-        let id = ctx.request.headers.get('last-event-id') ?? crypto.randomUUID()
+        // ids only need to be unique within the stream: one random prefix per
+        // connection plus a counter, instead of a CSPRNG call per event
+        const prefix = crypto.randomUUID()
+        let n = 0
+        let id = ctx.request.headers.get('last-event-id') ?? `${prefix}:${n}`
         for await (const r of response) {
-          let data = `id:${id}\ndata:${r}\n\n`
+          // multi-line values must be split into one data: field per line (SSE spec)
+          let data =
+            `id:${id}\n` +
+            String(r)
+              .split(/\r\n|\r|\n/)
+              .map(l => `data:${l}`)
+              .join('\n') +
+            '\n\n'
           try {
             await controller.write(data)
             await controller.flush()
           } catch (err) {
             console.error(err)
           }
-          id = crypto.randomUUID()
+          id = `${prefix}:${++n}`
         }
         controller.close()
       },
@@ -810,13 +953,16 @@ export const responseParser = (response: any, ctx: Context, cookies: string[], s
 const unionize = (b: any, schema: STUnion) => {
   let res
   let error
-  const discriminants = schema.members.reduce((acc, obj) => {
-    const props = (obj as STObject).props
-    return acc.filter(k => props && k in props && props[k]?.[Kind] === 'literal' && !props[k]?.[Optional])
-  }, Object.keys((schema.members[0] as STObject)?.props || {}))
+  const discriminants = schema.members.reduce(
+    (acc, obj) => {
+      const props = (obj as STObject).props
+      return acc.filter(k => props && k in props && props[k]?.[Kind] === 'literal' && !props[k]?.[Optional])
+    },
+    Object.keys((schema.members[0] as STObject)?.props || {})
+  )
   for (let s of schema.members) {
     try {
-      res = validate(b, s, { parse: true })
+      res = runCompiled(b, s, { parse: true })
       if (res !== undefined) break
     } catch (err: any) {
       if (discriminants.every(d => !err?.[d]?.startsWith('Not a valid value'))) error = err
@@ -830,7 +976,7 @@ const unionize = (b: any, schema: STUnion) => {
 const intersectionize = (b: any, schema: STIntersection<any>) => {
   let res
   try {
-    for (let s of schema.allOf) res = validate(b, s, { parse: true })
+    for (let s of schema.allOf) res = runCompiled(b, s, { parse: true })
     return res
   } catch (e) {
     throw new RequestError({ status: 400, payload: { body: `No matching body schema found` } })