routup 5.2.0 → 6.0.0-beta.1

package/dist/src-DaK6SZc0.mjs

@@ -0,0 +1,2694 @@
+import QuickLRU from "quick-lru";
+import { FastURL } from "srvx";
+import { hasInstanceof, markInstanceof } from "@ebec/core";
+import { HTTPError, isHTTPError } from "@ebec/http";
+import { subtle } from "uncrypto";
+import { merge } from "smob";
+import { compile } from "proxy-addr";
+import { get, getType } from "mime-explorer";
+import Negotiator from "negotiator";
+import { pathToRegexp } from "path-to-regexp";
+//#region src/cache/lru.ts
+const DEFAULT_MAX_SIZE = 1024;
+/**
+* Default `ICache` implementation — a bounded LRU backed by
+* [`quick-lru`](https://github.com/sindresorhus/quick-lru). Picked for
+* its small footprint (~1kB), ESM-only build (matches routup), and
+* stable API.
+*
+* For TTL, size-based eviction, or dispose hooks, write your own
+* `ICache` (e.g. wrapping `lru-cache`) and pass it via the router's
+* `BaseRouterOptions.cache` slot.
+*/
+var LruCache = class LruCache {
+	options;
+	inner;
+	constructor(options = {}) {
+		this.options = options;
+		this.inner = new QuickLRU({ maxSize: options.maxSize ?? DEFAULT_MAX_SIZE });
+	}
+	get(key) {
+		return this.inner.get(key);
+	}
+	set(key, value) {
+		this.inner.set(key, value);
+	}
+	delete(key) {
+		this.inner.delete(key);
+	}
+	clear() {
+		this.inner.clear();
+	}
+	clone() {
+		return new LruCache({ ...this.options });
+	}
+};
+//#endregion
+//#region src/constants.ts
+const MethodName = {
+	GET: "GET",
+	POST: "POST",
+	PUT: "PUT",
+	PATCH: "PATCH",
+	DELETE: "DELETE",
+	OPTIONS: "OPTIONS",
+	HEAD: "HEAD"
+};
+const HeaderName = {
+	ACCEPT: "accept",
+	ACCEPT_CHARSET: "accept-charset",
+	ACCEPT_ENCODING: "accept-encoding",
+	ACCEPT_LANGUAGE: "accept-language",
+	ACCEPT_RANGES: "accept-ranges",
+	ALLOW: "allow",
+	CACHE_CONTROL: "cache-control",
+	CONTENT_DISPOSITION: "content-disposition",
+	CONTENT_ENCODING: "content-encoding",
+	CONTENT_LENGTH: "content-length",
+	CONTENT_RANGE: "content-range",
+	CONTENT_TYPE: "content-type",
+	CONNECTION: "connection",
+	COOKIE: "cookie",
+	ETag: "etag",
+	HOST: "host",
+	IF_MODIFIED_SINCE: "if-modified-since",
+	IF_NONE_MATCH: "if-none-match",
+	LAST_MODIFIED: "last-modified",
+	LOCATION: "location",
+	RANGE: "range",
+	RATE_LIMIT_LIMIT: "ratelimit-limit",
+	RATE_LIMIT_REMAINING: "ratelimit-remaining",
+	RATE_LIMIT_RESET: "ratelimit-reset",
+	RETRY_AFTER: "retry-after",
+	SET_COOKIE: "set-cookie",
+	TRANSFER_ENCODING: "transfer-encoding",
+	X_ACCEL_BUFFERING: "x-accel-buffering",
+	X_FORWARDED_HOST: "x-forwarded-host",
+	X_FORWARDED_FOR: "x-forwarded-for",
+	X_FORWARDED_PROTO: "x-forwarded-proto"
+};
+//#endregion
+//#region src/event/module.ts
+var AppEvent = class {
+	request;
+	params;
+	path;
+	method;
+	mountPath;
+	headers;
+	searchParams;
+	response;
+	store;
+	signal;
+	appOptions;
+	_context;
+	_nextCalled = false;
+	_nextResult;
+	_nextCalledDeferred;
+	constructor(context) {
+		this._context = context;
+		this.request = context.request;
+		this.params = context.params;
+		this.path = context.path;
+		this.method = context.method;
+		this.mountPath = context.mountPath;
+		this.headers = context.headers;
+		this.searchParams = context.searchParams;
+		this.response = context.response;
+		this.store = context.store;
+		this.signal = context.signal;
+		this.appOptions = context.appOptions;
+	}
+	get nextCalled() {
+		return this._nextCalled;
+	}
+	get nextResult() {
+		return this._nextResult;
+	}
+	whenNextCalled() {
+		if (!this._nextCalledDeferred) {
+			let resolve;
+			const promise = new Promise((r) => {
+				resolve = r;
+			});
+			this._nextCalledDeferred = {
+				promise,
+				resolve
+			};
+			if (this._nextCalled) resolve();
+		}
+		return this._nextCalledDeferred.promise;
+	}
+	async next(error) {
+		if (this._nextCalled) return this._nextResult;
+		this._nextCalled = true;
+		this._nextResult = this._context.next(this, error);
+		if (this._nextCalledDeferred) this._nextCalledDeferred.resolve();
+		return this._nextResult;
+	}
+};
+//#endregion
+//#region src/response/helpers/cache.ts
+function setResponseCacheHeaders(event, options) {
+	options = options || {};
+	const cacheControls = ["public"].concat(options.cacheControls || []);
+	if (options.maxAge !== void 0) cacheControls.push(`max-age=${+options.maxAge}`, `s-maxage=${+options.maxAge}`);
+	if (options.modifiedTime) {
+		const modifiedTime = typeof options.modifiedTime === "string" ? new Date(options.modifiedTime) : options.modifiedTime;
+		event.response.headers.set("last-modified", modifiedTime.toUTCString());
+	}
+	event.response.headers.set("cache-control", cacheControls.join(", "));
+}
+//#endregion
+//#region src/error/module.ts
+const ErrorSymbol = Symbol.for("AppError");
+var AppError = class extends HTTPError {
+	constructor(input = {}) {
+		super(input);
+		this.name = "AppError";
+		markInstanceof(this, ErrorSymbol);
+	}
+};
+//#endregion
+//#region src/response/helpers/event-stream/utils.ts
+function stripNewlines(value) {
+	return value.replace(/[\r\n]/g, "");
+}
+function serializeEventStreamMessage(message) {
+	let result = "";
+	if (message.id) result += `id: ${stripNewlines(message.id)}\n`;
+	if (message.event) result += `event: ${stripNewlines(message.event)}\n`;
+	if (typeof message.retry === "number" && Number.isInteger(message.retry)) result += `retry: ${message.retry}\n`;
+	const lines = message.data.replace(/\r/g, "").split("\n");
+	for (const line of lines) result += `data: ${line}\n`;
+	result += "\n";
+	return result;
+}
+//#endregion
+//#region src/response/helpers/event-stream/module.ts
+function createEventStream(event, options) {
+	if (options?.maxMessageSize !== void 0) {
+		if (!Number.isInteger(options.maxMessageSize) || options.maxMessageSize < 0) throw new AppError("maxMessageSize must be a non-negative integer.");
+	}
+	let controller;
+	let closed = false;
+	const encoder = new TextEncoder();
+	const stream = new ReadableStream({
+		start(ctrl) {
+			controller = ctrl;
+		},
+		cancel() {
+			closed = true;
+		}
+	});
+	const headers = new Headers(event.response.headers);
+	headers.set(HeaderName.CONTENT_TYPE, "text/event-stream");
+	headers.set(HeaderName.CACHE_CONTROL, "private, no-cache, no-store, no-transform, must-revalidate, max-age=0");
+	headers.set(HeaderName.X_ACCEL_BUFFERING, "no");
+	headers.set(HeaderName.CONNECTION, "keep-alive");
+	const handle = {
+		write(message) {
+			if (closed) return false;
+			if (typeof message === "string") return handle.write({ data: message });
+			const serialized = serializeEventStreamMessage(message);
+			if (options?.maxMessageSize !== void 0) {
+				if (encoder.encode(serialized).byteLength > options.maxMessageSize) return false;
+			}
+			controller.enqueue(encoder.encode(serialized));
+			return true;
+		},
+		end() {
+			if (closed) return;
+			closed = true;
+			controller.close();
+		},
+		response: new Response(stream, {
+			status: event.response.status,
+			headers
+		})
+	};
+	return handle;
+}
+//#endregion
+//#region src/utils/accepts-json.ts
+/**
+* Check if the request accepts JSON responses.
+*
+* Parses the `Accept` header per RFC 7231 (media ranges + quality
+* params) rather than substring-matching, so:
+* - `application/json-seq` does NOT count as accepting `application/json`
+* - `application/json;q=0` is treated as an explicit rejection
+*
+* Returns true if no Accept header is present (API-first default).
+*/
+function acceptsJson(request) {
+	const accept = request.headers.get("accept");
+	if (!accept) return true;
+	return accept.toLowerCase().split(",").some((entry) => {
+		const parts = entry.split(";").map((part) => part.trim());
+		const mediaRange = parts[0];
+		const qParam = parts.slice(1).map((param) => param.split("=").map((s) => s.trim())).find(([key]) => key === "q");
+		const q = qParam ? Number.parseFloat(qParam[1] ?? "") : 1;
+		if (!Number.isFinite(q) || q <= 0) return false;
+		return mediaRange === "*/*" || mediaRange === "application/*" || mediaRange === "application/json" || mediaRange.endsWith("+json");
+	});
+}
+//#endregion
+//#region src/utils/header.ts
+function sanitizeHeaderValue(value) {
+	return value.replace(/[\r\n]/g, "");
+}
+//#endregion
+//#region src/utils/etag/module.ts
+async function sha1(str) {
+	const enc = new TextEncoder();
+	const hash = await subtle.digest("SHA-1", enc.encode(str));
+	return btoa(String.fromCharCode(...new Uint8Array(hash)));
+}
+/**
+* Generate an ETag.
+*/
+async function generateETag(input) {
+	if (input.length === 0) return "\"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk\"";
+	const hash = await sha1(input);
+	return `"${input.length.toString(16)}-${hash.substring(0, 27)}"`;
+}
+/**
+* Create a simple ETag.
+*/
+async function createEtag(input, options = {}) {
+	const tag = await generateETag(input);
+	return options.weak ? `W/${tag}` : tag;
+}
+//#endregion
+//#region src/utils/object.ts
+function isObject(item) {
+	return !!item && typeof item === "object" && !Array.isArray(item);
+}
+//#endregion
+//#region src/utils/etag/utils.ts
+const textEncoder = /* @__PURE__ */ new TextEncoder();
+function buildEtagFn(input) {
+	if (typeof input === "function") return input;
+	input = input ?? true;
+	if (input === false) return () => Promise.resolve(void 0);
+	let options = { weak: true };
+	if (isObject(input)) options = merge(input, options);
+	return async (body, size) => {
+		if (typeof options.threshold !== "undefined") {
+			if ((size ?? textEncoder.encode(body).byteLength) <= options.threshold) return;
+		}
+		return createEtag(body, options);
+	};
+}
+/**
+* Default `EtagFn` used by `toResponse()` when `appOptions.etag` is
+* undefined. Module-scoped so we don't allocate per-request and so
+* all consumers share the same closure.
+*
+* `appOptions.etag === null` (explicitly disabled by the user)
+* remains distinct: consumers must check `=== undefined`, not
+* `== null`, before falling back to this default.
+*/
+const DEFAULT_ETAG_FN = buildEtagFn();
+//#endregion
+//#region src/utils/trust-proxy/module.ts
+function buildTrustProxyFn(input) {
+	if (typeof input === "function") return input;
+	if (input === true) return () => true;
+	if (typeof input === "number") return (_address, hop) => hop < input;
+	if (typeof input === "string") input = input.split(",").map((value) => value.trim());
+	return compile(input || []);
+}
+/**
+* Default `TrustProxyFn` used by request helpers when neither the
+* call's `options.trustProxy` nor `event.appOptions.trustProxy` is
+* set. Trusts no addresses — the conservative default.
+*
+* Module-scoped so all helpers share the same reference and we don't
+* allocate per-request.
+*/
+const DEFAULT_TRUST_PROXY = buildTrustProxyFn();
+//#endregion
+//#region src/utils/mime.ts
+function getMimeType(type) {
+	if (type.includes("/")) return type;
+	return getType(type);
+}
+function getCharsetForMimeType(type) {
+	if (/^text\/|^application\/(javascript|json)/.test(type)) return "utf-8";
+	const meta = get(type);
+	if (meta && meta.charset) return meta.charset.toLowerCase();
+}
+//#endregion
+//#region src/utils/method.ts
+function toMethodName(input, alt) {
+	if (input) return input.toUpperCase();
+	return alt;
+}
+//#endregion
+//#region src/utils/path.ts
+/**
+* Based on https://github.com/unjs/pathe v1.1.1 (055f50a6f1131f4e5c56cf259dd8816168fba329)
+*/
+function normalizeWindowsPath(input = "") {
+	if (!input || !input.includes("\\")) return input;
+	return input.replace(/\\/g, "/");
+}
+const EXTNAME_RE = /.(\.[^./]+)$/;
+function extname(input) {
+	const match = EXTNAME_RE.exec(normalizeWindowsPath(input));
+	return match && match[1] || "";
+}
+function basename(input, extension) {
+	const lastSegment = normalizeWindowsPath(input).split("/").pop();
+	if (!lastSegment) return input;
+	return extension && lastSegment.endsWith(extension) ? lastSegment.slice(0, -extension.length) : lastSegment;
+}
+//#endregion
+//#region src/utils/promise.ts
+function isPromise(p) {
+	return isObject(p) && (p instanceof Promise || typeof p.then === "function");
+}
+//#endregion
+//#region src/utils/url.ts
+function hasLeadingSlash(input = "") {
+	return input.startsWith("/");
+}
+function withLeadingSlash(input = "") {
+	return hasLeadingSlash(input) ? input : `/${input}`;
+}
+function cleanDoubleSlashes(input = "") {
+	if (input.includes("://")) return input.split("://").map((str) => cleanDoubleSlashes(str)).join("://");
+	return input.replace(/\/+/g, "/");
+}
+/**
+* Concatenate path parts into a single mount path.
+*
+* - Drops `undefined` and empty parts.
+* - A lone `'/'` part still contributes (so `joinPaths('/')` returns
+*   `'/'`, distinguishing "match the root exactly" from "no path").
+* - Returns `undefined` when every part is missing — callers
+*   interpret this as "no path" (always-match middleware).
+* - Joins remaining parts with `/`, normalizes the leading slash,
+*   collapses any inner `//`, and trims a trailing slash on results
+*   longer than `/`.
+*
+* Used at registration time to fold a handler / router's intrinsic
+* path into the mount path so the active `IRouter` is the
+* only place that builds path matchers.
+*/
+function joinPaths(...parts) {
+	const kept = [];
+	for (const part of parts) {
+		if (typeof part !== "string" || part === "") continue;
+		kept.push(part);
+	}
+	if (kept.length === 0) return;
+	const normalized = cleanDoubleSlashes(withLeadingSlash(kept.join("/")));
+	if (normalized.length > 1 && normalized.endsWith("/")) return normalized.slice(0, -1);
+	return normalized;
+}
+//#endregion
+//#region src/response/helpers/header.ts
+function appendResponseHeader(event, name, value) {
+	const { headers } = event.response;
+	if (Array.isArray(value)) for (const v of value) headers.append(name, sanitizeHeaderValue(v));
+	else headers.append(name, sanitizeHeaderValue(value));
+}
+function appendResponseHeaderDirective(event, name, value) {
+	const { headers } = event.response;
+	const existing = headers.get(name);
+	if (!existing) {
+		if (Array.isArray(value)) headers.set(name, sanitizeHeaderValue(value.join("; ")));
+		else headers.set(name, sanitizeHeaderValue(value));
+		return;
+	}
+	const directives = existing.split("; ");
+	if (Array.isArray(value)) directives.push(...value);
+	else directives.push(value);
+	const unique = [...new Set(directives)];
+	headers.set(name, sanitizeHeaderValue(unique.join("; ")));
+}
+//#endregion
+//#region src/response/helpers/utils.ts
+function setResponseContentTypeByFileName(event, fileName) {
+	const ext = extname(fileName);
+	if (ext) {
+		let type = getMimeType(ext.substring(1));
+		if (type) {
+			const charset = getCharsetForMimeType(type);
+			if (charset) type += `; charset=${charset}`;
+			event.response.headers.set(HeaderName.CONTENT_TYPE, type);
+		}
+	}
+}
+//#endregion
+//#region src/response/helpers/header-disposition.ts
+const ENCODE_URL_ATTR_CHAR_REGEXP = /[\x00-\x20"'()*,/:;<=>?@[\\\]{}\x7f]/g;
+const NON_ASCII_REGEXP = /[^\x20-\x7e]/g;
+const QUOTE_REGEXP = /[\\"]/g;
+const HEX_ESCAPE_REGEXP = /%[0-9A-Fa-f]{2}/;
+const ASCII_TEXT_REGEXP = /^[\x20-\x7e]+$/;
+const TOKEN_REGEXP = /^[!#$%&'*+.0-9A-Z^_`a-z|~-]+$/;
+function pencode(char) {
+	return `%${char.charCodeAt(0).toString(16).toUpperCase()}`;
+}
+function quoteString(value) {
+	return `"${value.replace(QUOTE_REGEXP, "\\$&")}"`;
+}
+function getAscii(value) {
+	return value.replace(NON_ASCII_REGEXP, "?");
+}
+function encodeExtended(value) {
+	return encodeURIComponent(value).replace(ENCODE_URL_ATTR_CHAR_REGEXP, pencode);
+}
+function formatFilename(value) {
+	if (TOKEN_REGEXP.test(value)) return `filename=${value}`;
+	return `filename=${quoteString(value)}`;
+}
+function setDisposition(event, type, filename) {
+	let disposition = type;
+	if (typeof filename === "string") {
+		setResponseContentTypeByFileName(event, filename);
+		if (ASCII_TEXT_REGEXP.test(filename) && !HEX_ESCAPE_REGEXP.test(filename)) disposition += `; ${formatFilename(filename)}`;
+		else {
+			disposition += `; ${formatFilename(getAscii(filename))}`;
+			disposition += `; filename*=UTF-8''${encodeExtended(filename)}`;
+		}
+	}
+	event.response.headers.set(HeaderName.CONTENT_DISPOSITION, disposition);
+}
+function setResponseHeaderAttachment(event, filename) {
+	setDisposition(event, "attachment", filename);
+}
+function setResponseHeaderInline(event, filename) {
+	setDisposition(event, "inline", filename);
+}
+//#endregion
+//#region src/response/helpers/header-content-type.ts
+function setResponseHeaderContentType(event, input, ifNotExists) {
+	if (ifNotExists) {
+		if (event.response.headers.get(HeaderName.CONTENT_TYPE)) return;
+	}
+	const contentType = getMimeType(input);
+	if (contentType) event.response.headers.set(HeaderName.CONTENT_TYPE, contentType);
+}
+//#endregion
+//#region src/error/is.ts
+function isError(input) {
+	return hasInstanceof(input, ErrorSymbol);
+}
+//#endregion
+//#region src/error/create.ts
+function isNativeError(input) {
+	return isObject(input) && typeof input.message === "string" && typeof input.name === "string";
+}
+/**
+* Create an internal error object by
+* - an existing AppError (returned as-is)
+* - an HTTPError (wrapped into a AppError preserving status)
+* - an Error (wrapped preserving message and cause)
+* - an options object (status, message, etc.)
+* - a message string
+*
+* @param input
+*/
+function createError(input) {
+	if (isError(input)) return input;
+	if (typeof input === "string") return new AppError(input);
+	if (isHTTPError(input)) return new AppError({
+		message: input.message,
+		code: input.code,
+		status: input.status,
+		redirectURL: input.redirectURL,
+		cause: input
+	});
+	if (isNativeError(input)) return new AppError({
+		message: input.message,
+		cause: input
+	});
+	if (!isObject(input)) return new AppError();
+	const options = { ...input };
+	if (options.cause === void 0) options.cause = input;
+	return new AppError(options);
+}
+//#endregion
+//#region src/response/to-response.ts
+function stripWeakPrefix(etag) {
+	return etag.startsWith("W/") ? etag.slice(2) : etag;
+}
+/**
+* Resolve the effective etag fn for this request. `null` means the
+* user explicitly disabled ETag; `undefined` means the option was
+* never set, and we apply the framework default. Anything else is the
+* user's own fn.
+*/
+function effectiveEtagFn(event) {
+	const opt = event.appOptions.etag;
+	if (opt === null) return null;
+	if (typeof opt === "undefined") return DEFAULT_ETAG_FN;
+	return opt;
+}
+/**
+* Compute an ETag and conditionally return a 304, or set the header and
+* return undefined to let the caller emit the full response. Always
+* async because the ETag generator may be async (and typically is, via
+* `uncrypto`).
+*/
+async function applyEtag(body, event, headers) {
+	const etagFn = effectiveEtagFn(event);
+	if (!etagFn) return;
+	const etag = await etagFn(body);
+	if (!etag) return;
+	headers.set("etag", etag);
+	const ifNoneMatch = event.headers.get("if-none-match");
+	if (ifNoneMatch && (ifNoneMatch === "*" || ifNoneMatch.split(",").some((t) => stripWeakPrefix(t.trim()) === stripWeakPrefix(etag)))) return new Response(null, {
+		status: 304,
+		headers
+	});
+}
+/**
+* Convert a handler's return value into a Web `Response`.
+*
+* Returns synchronously for the common cases (string, JSON object,
+* binary, stream, blob) when ETag generation is disabled. Returns a
+* `Promise` when an ETag must be computed (the generator is async).
+*
+* Callers that want the async return uniformly can `await` the result
+* — `await` on a non-Promise still works but pays a microtask hop.
+* The App fast path branches on `instanceof Promise` to keep the
+* sync return truly sync.
+*/
+function toResponse(value, event) {
+	if (value === void 0) return;
+	if (value === null) return new Response(null, {
+		status: event.response.status,
+		headers: event.response.headers
+	});
+	const t = typeof value;
+	if (t === "string") {
+		const { status, headers } = event.response;
+		if (!headers.has("content-type")) headers.set("content-type", "text/plain; charset=utf-8");
+		if (event.appOptions.etag !== null) return applyEtag(value, event, headers).then((cached) => cached ?? new Response(value, {
+			status,
+			headers
+		}));
+		return new Response(value, {
+			status,
+			headers
+		});
+	}
+	if (t === "object" && !Array.isArray(value)) {
+		if (value instanceof Response) return value;
+		const { status, headers } = event.response;
+		if (value instanceof ArrayBuffer || value instanceof Uint8Array) {
+			if (!headers.has("content-type")) headers.set("content-type", "application/octet-stream");
+			return new Response(value, {
+				status,
+				headers
+			});
+		}
+		if (value instanceof ReadableStream) return new Response(value, {
+			status,
+			headers
+		});
+		if (value instanceof Blob) {
+			if (!headers.has("content-type")) headers.set("content-type", value.type || "application/octet-stream");
+			return new Response(value, {
+				status,
+				headers
+			});
+		}
+	}
+	const { status, headers } = event.response;
+	if (!headers.has("content-type")) headers.set("content-type", "application/json; charset=utf-8");
+	let json;
+	try {
+		json = JSON.stringify(value);
+	} catch (e) {
+		throw createError({
+			message: "JSON serialization failed",
+			status: 500,
+			cause: e
+		});
+	}
+	if (event.appOptions.etag !== null) return applyEtag(json, event, headers).then((cached) => cached ?? new Response(json, {
+		status,
+		headers
+	}));
+	return new Response(json, {
+		status,
+		headers
+	});
+}
+//#endregion
+//#region src/response/helpers/send-accepted.ts
+async function sendAccepted(event, data) {
+	event.response.status = 202;
+	return await toResponse(data ?? "", event);
+}
+//#endregion
+//#region src/response/helpers/send-created.ts
+async function sendCreated(event, data) {
+	event.response.status = 201;
+	return await toResponse(data ?? "", event);
+}
+//#endregion
+//#region src/response/helpers/send-file.ts
+async function sendFile(event, options) {
+	let stats;
+	if (typeof options.stats === "function") stats = await options.stats();
+	else stats = options.stats;
+	const name = options.name || stats.name;
+	const { headers } = event.response;
+	const disposition = options.disposition ?? (options.attachment ? "attachment" : void 0);
+	if (name) {
+		const fileName = basename(name);
+		if (disposition) {
+			if (!headers.get(HeaderName.CONTENT_DISPOSITION)) if (disposition === "inline") setResponseHeaderInline(event, fileName);
+			else setResponseHeaderAttachment(event, fileName);
+		} else setResponseContentTypeByFileName(event, fileName);
+	}
+	const contentOptions = {};
+	let statusCode = event.response.status;
+	if (stats.size) {
+		const rangeHeader = event.headers.get(HeaderName.RANGE);
+		if (rangeHeader) {
+			const [x, y] = rangeHeader.replace("bytes=", "").split("-");
+			const parsedStart = Number.parseInt(x, 10);
+			const parsedEnd = Number.parseInt(y, 10);
+			contentOptions.start = Number.isFinite(parsedStart) && parsedStart >= 0 ? parsedStart : 0;
+			contentOptions.end = Number.isFinite(parsedEnd) && parsedEnd >= 0 ? Math.min(parsedEnd, stats.size - 1) : stats.size - 1;
+			if (contentOptions.start >= stats.size || contentOptions.start > contentOptions.end) {
+				const rangeHeaders = new Headers(headers);
+				rangeHeaders.set(HeaderName.CONTENT_RANGE, `bytes */${stats.size}`);
+				return new Response(null, {
+					status: 416,
+					headers: rangeHeaders
+				});
+			}
+			headers.set(HeaderName.CONTENT_RANGE, `bytes ${contentOptions.start}-${contentOptions.end}/${stats.size}`);
+			headers.set(HeaderName.CONTENT_LENGTH, `${contentOptions.end - contentOptions.start + 1}`);
+			statusCode = 206;
+		} else headers.set(HeaderName.CONTENT_LENGTH, `${stats.size}`);
+		headers.set(HeaderName.ACCEPT_RANGES, "bytes");
+		if (stats.mtime) {
+			const mtime = new Date(stats.mtime);
+			headers.set(HeaderName.LAST_MODIFIED, mtime.toUTCString());
+			headers.set(HeaderName.ETag, `W/"${stats.size}-${mtime.getTime()}"`);
+		}
+	}
+	const content = await options.content(contentOptions);
+	return new Response(content, {
+		status: statusCode,
+		headers
+	});
+}
+//#endregion
+//#region src/request/helpers/header.ts
+function getRequestHeader(event, name) {
+	return event.headers.get(name);
+}
+//#endregion
+//#region src/request/helpers/negotiator.ts
+const NEGOTIATOR_KEY = Symbol.for("routup:negotiator");
+function headersToPlainObject(headers) {
+	const result = {};
+	headers.forEach((value, key) => {
+		result[key] = value;
+	});
+	return result;
+}
+function useRequestNegotiator(event) {
+	let value = event.store[NEGOTIATOR_KEY];
+	if (value) return value;
+	value = new Negotiator({ headers: headersToPlainObject(event.headers) });
+	event.store[NEGOTIATOR_KEY] = value;
+	return value;
+}
+//#endregion
+//#region src/request/helpers/header-accept.ts
+function getRequestAcceptableContentTypes(event) {
+	return useRequestNegotiator(event).mediaTypes();
+}
+function getRequestAcceptableContentType(event, input) {
+	input = input || [];
+	const items = Array.isArray(input) ? input : [input];
+	if (items.length === 0) return getRequestAcceptableContentTypes(event).shift();
+	if (!getRequestHeader(event, HeaderName.ACCEPT)) return items[0];
+	let polluted = false;
+	const mimeTypes = [];
+	for (const item of items) {
+		const mimeType = getMimeType(item);
+		if (mimeType) mimeTypes.push(mimeType);
+		else polluted = true;
+	}
+	const matches = useRequestNegotiator(event).mediaTypes(mimeTypes);
+	if (matches.length > 0) {
+		if (polluted) return items[0];
+		return items[mimeTypes.indexOf(matches[0])];
+	}
+}
+//#endregion
+//#region src/response/helpers/send-format.ts
+function sendFormat(event, input) {
+	const { default: formatDefault, ...formats } = input;
+	const contentTypes = Object.keys(formats);
+	if (contentTypes.length === 0) return formatDefault();
+	const contentType = getRequestAcceptableContentType(event, contentTypes);
+	if (contentType && formats[contentType]) return formats[contentType]();
+	return formatDefault();
+}
+//#endregion
+//#region src/response/helpers/send-redirect.ts
+function escapeHtml(str) {
+	return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function isAllowedRedirectUrl(location) {
+	if (location.startsWith("//")) return false;
+	if (location.startsWith("/") || location.startsWith(".")) return true;
+	try {
+		const url = new URL(location);
+		return url.protocol === "http:" || url.protocol === "https:";
+	} catch {
+		return true;
+	}
+}
+function sendRedirect(event, location, statusCode = 302) {
+	if (!isAllowedRedirectUrl(location)) throw new AppError({
+		status: 400,
+		message: "Invalid redirect URL scheme."
+	});
+	const sanitizedLocation = sanitizeHeaderValue(location);
+	const html = `<!DOCTYPE html><html><head><meta http-equiv="refresh" content="0; url=${escapeHtml(location)}"></head></html>`;
+	const headers = new Headers(event.response.headers);
+	headers.set("location", sanitizedLocation);
+	headers.set("content-type", "text/html; charset=utf-8");
+	headers.delete("content-length");
+	return new Response(html, {
+		status: statusCode,
+		headers
+	});
+}
+//#endregion
+//#region src/response/helpers/send-stream.ts
+function sendStream(event, stream) {
+	const { status, headers } = event.response;
+	return new Response(stream, {
+		status,
+		headers
+	});
+}
+//#endregion
+//#region src/dispatcher/module.ts
+var DispatcherEvent = class {
+	request;
+	params;
+	path;
+	method;
+	/**
+	* Collected allowed methods (for OPTIONS).
+	*/
+	methodsAllowed;
+	mountPath;
+	error;
+	/**
+	* Options of the App currently dispatching this event. Set on
+	* entry to `App.dispatch` and restored on exit so re-entrant
+	* dispatch calls leave the caller's view intact. Initialized to
+	* `{}` so consumers reading before any dispatch get a valid
+	* (empty) shape.
+	*/
+	appOptions;
+	/**
+	* `true` while an `App.dispatch` call is on the stack for this
+	* event. `App.dispatch` reads this on entry to derive `isRoot`
+	* and writes it on entry/exit so re-entrant calls behave
+	* correctly.
+	*/
+	isDispatching;
+	_dispatched;
+	_response;
+	_store;
+	/**
+	* Cached parsed URL (avoids double-parsing).
+	*/
+	_url;
+	/**
+	* Continuation function for middleware onion model.
+	*/
+	_next;
+	_signal;
+	_signalCleanup;
+	/**
+	* Whether _next has already been called (guard against double-invocation).
+	*/
+	_nextCalled;
+	/**
+	* The cached result of the next handler.
+	*/
+	_nextResult;
+	constructor(request) {
+		this.request = request;
+		this._url = new FastURL(request.url);
+		this.method = request.method;
+		this.path = this._url.pathname;
+		this.mountPath = "/";
+		this.params = {};
+		this.appOptions = {};
+		this.isDispatching = false;
+		this.methodsAllowed = /* @__PURE__ */ new Set();
+		this._dispatched = false;
+		this._nextCalled = false;
+	}
+	get response() {
+		if (!this._response) this._response = {
+			status: 200,
+			headers: new Headers()
+		};
+		return this._response;
+	}
+	get signal() {
+		if (!this._signal) this._signal = this.request.signal;
+		return this._signal;
+	}
+	set signal(value) {
+		if (this._signalCleanup) {
+			this._signalCleanup();
+			this._signalCleanup = void 0;
+		}
+		if (value === this.request.signal) {
+			this._signal = value;
+			return;
+		}
+		const controller = new AbortController();
+		const abort = (e) => {
+			const reason = e?.target instanceof AbortSignal ? e.target.reason : void 0;
+			this.request.signal.removeEventListener("abort", abort);
+			value.removeEventListener("abort", abort);
+			controller.abort(reason);
+		};
+		if (this.request.signal.aborted || value.aborted) {
+			const reason = this.request.signal.aborted ? this.request.signal.reason : value.reason;
+			controller.abort(reason);
+		} else {
+			this.request.signal.addEventListener("abort", abort, { once: true });
+			value.addEventListener("abort", abort, { once: true });
+			this._signalCleanup = () => {
+				this.request.signal.removeEventListener("abort", abort);
+				value.removeEventListener("abort", abort);
+			};
+		}
+		this._signal = controller.signal;
+	}
+	get dispatched() {
+		return this._dispatched;
+	}
+	set dispatched(value) {
+		this._dispatched = value;
+	}
+	async next(event, error) {
+		if (this._nextCalled) return this._nextResult;
+		this._nextCalled = true;
+		if (this._next) this._nextResult = this._next(event, error);
+		return this._nextResult;
+	}
+	setNext(fn) {
+		if (fn) this._next = async (event, error) => {
+			return toResponse(await fn(error), event);
+		};
+		else this._next = void 0;
+		this._nextCalled = false;
+		this._nextResult = void 0;
+	}
+	build(signal) {
+		return new AppEvent({
+			request: this.request,
+			params: this.params,
+			path: this.path,
+			method: this.method,
+			mountPath: this.mountPath,
+			headers: this.request.headers,
+			searchParams: new URLSearchParams(this._url.search),
+			response: this.response,
+			store: this.store,
+			signal: signal ?? this.signal,
+			appOptions: this.appOptions,
+			next: (event, error) => this.next(event, error)
+		});
+	}
+	get store() {
+		if (!this._store) this._store = Object.create(null);
+		return this._store;
+	}
+};
+//#endregion
+//#region src/handler/constants.ts
+const HandlerType = {
+	CORE: "core",
+	ERROR: "error"
+};
+const HandlerSymbol = Symbol.for("Handler");
+//#endregion
+//#region src/handler/module.ts
+var Handler = class {
+	config;
+	method;
+	constructor(handler) {
+		this.config = handler;
+		if (typeof handler.path === "string") this.config.path = withLeadingSlash(handler.path);
+		this.method = this.config.method ? toMethodName(this.config.method) : void 0;
+		markInstanceof(this, HandlerSymbol);
+	}
+	get type() {
+		return this.config.type;
+	}
+	get path() {
+		return this.config.path;
+	}
+	async dispatch(event) {
+		let response;
+		let handlerEvent;
+		let cleanupParentListener;
+		try {
+			const effectiveTimeout = this.resolveTimeout(event.appOptions);
+			let childController;
+			if (effectiveTimeout) {
+				const parentSignal = event.signal;
+				childController = new AbortController();
+				if (parentSignal.aborted) childController.abort(parentSignal.reason);
+				else {
+					const onAbort = () => childController.abort(parentSignal.reason);
+					parentSignal.addEventListener("abort", onAbort, { once: true });
+					cleanupParentListener = () => parentSignal.removeEventListener("abort", onAbort);
+				}
+			}
+			handlerEvent = childController ? event.build(childController.signal) : event.build();
+			const skipFn = this.config.type === HandlerType.ERROR && !event.error;
+			if (!skipFn && this.config.onBefore) await this.config.onBefore(handlerEvent);
+			let invocation;
+			if (skipFn) {} else if (this.config.type === HandlerType.ERROR) {
+				const { fn } = this.config;
+				invocation = fn(event.error, handlerEvent);
+			} else {
+				const { fn } = this.config;
+				invocation = fn(handlerEvent);
+			}
+			let result;
+			if (skipFn) {} else if (effectiveTimeout) result = await this.executeWithTimeout(() => this.resolveHandlerResult(invocation, handlerEvent), effectiveTimeout, childController);
+			else if (isPromise(invocation)) {
+				const awaited = await invocation;
+				result = typeof awaited === "undefined" ? await this.resolveHandlerResult(void 0, handlerEvent) : awaited;
+			} else if (typeof invocation === "undefined") result = await this.resolveHandlerResult(void 0, handlerEvent);
+			else result = invocation;
+			const toResp = toResponse(result, handlerEvent);
+			response = isPromise(toResp) ? await toResp : toResp;
+			if (response) {
+				event.dispatched = true;
+				if (this.config.type === HandlerType.ERROR && event.error) event.error = void 0;
+			}
+			if (!skipFn && this.config.onAfter) await this.config.onAfter(handlerEvent, response);
+		} catch (e) {
+			event.error = isError(e) ? e : createError(e);
+			if (this.config.onError) try {
+				await this.config.onError(event.error, handlerEvent ?? event.build());
+			} catch (innerErr) {
+				event.error = isError(innerErr) ? innerErr : createError(innerErr);
+			}
+			throw event.error;
+		} finally {
+			if (cleanupParentListener) cleanupParentListener();
+		}
+		return response;
+	}
+	/**
+	* Resolve a handler's return value into the final value handed to `toResponse`.
+	*
+	* Contract:
+	* - non-undefined value → return as-is (becomes the response)
+	* - `undefined` + `event.next()` was called → forward downstream result
+	* - `undefined` + `event.next()` not yet called → wait until either `next()` is
+	*   invoked (e.g. from an async callback) or `signal` aborts. A global or
+	*   per-handler timeout aborts `signal` and surfaces as 408. With no timeout
+	*   configured and no eventual `next()` call, the request hangs by design.
+	*/
+	async resolveHandlerResult(invocation, handlerEvent) {
+		const value = await invocation;
+		if (typeof value !== "undefined") return value;
+		if (handlerEvent.nextCalled) return handlerEvent.nextResult;
+		const { signal } = handlerEvent;
+		if (signal.aborted) throw createError({
+			status: 408,
+			message: "Request Timeout"
+		});
+		return new Promise((resolve, reject) => {
+			const onAbort = () => {
+				signal.removeEventListener("abort", onAbort);
+				reject(createError({
+					status: 408,
+					message: "Request Timeout"
+				}));
+			};
+			signal.addEventListener("abort", onAbort, { once: true });
+			handlerEvent.whenNextCalled().then(() => {
+				signal.removeEventListener("abort", onAbort);
+				resolve(handlerEvent.nextResult);
+			});
+		});
+	}
+	async executeWithTimeout(fn, effectiveTimeout, controller) {
+		if (!effectiveTimeout) return fn();
+		let timerId;
+		try {
+			return await Promise.race([fn(), new Promise((_, reject) => {
+				timerId = setTimeout(() => {
+					if (controller) controller.abort();
+					reject(createError({
+						status: 408,
+						message: "Request Timeout"
+					}));
+				}, effectiveTimeout);
+			})]);
+		} finally {
+			clearTimeout(timerId);
+		}
+	}
+	resolveTimeout(appOptions) {
+		const routerDefault = appOptions.handlerTimeout;
+		const handlerOverride = this.config.timeout;
+		if (!routerDefault && !handlerOverride) return;
+		if (!routerDefault) return handlerOverride;
+		if (!handlerOverride) return routerDefault;
+		if (appOptions.handlerTimeoutOverridable) return handlerOverride;
+		return Math.min(routerDefault, handlerOverride);
+	}
+};
+//#endregion
+//#region src/handler/core/define.ts
+function defineCoreHandler(input) {
+	if (typeof input === "function") return new Handler({
+		type: HandlerType.CORE,
+		fn: input
+	});
+	return new Handler({
+		type: HandlerType.CORE,
+		...input
+	});
+}
+//#endregion
+//#region src/handler/error/define.ts
+function defineErrorHandler(input) {
+	if (typeof input === "function") return new Handler({
+		type: HandlerType.ERROR,
+		fn: input
+	});
+	return new Handler({
+		type: HandlerType.ERROR,
+		...input
+	});
+}
+//#endregion
+//#region src/handler/adapters/node/define.ts
+const kHandled = /* @__PURE__ */ Symbol("handled");
+function callHandler(handler, req, res) {
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const onClose = () => settle(kHandled);
+		const onFinish = () => settle(kHandled);
+		const onError = (error) => fail(error);
+		function cleanup() {
+			res.removeListener("close", onClose);
+			res.removeListener("finish", onFinish);
+			res.removeListener("error", onError);
+		}
+		function settle(value) {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve(value);
+		}
+		function fail(error) {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			reject(error);
+		}
+		res.once("close", onClose);
+		res.once("finish", onFinish);
+		res.once("error", onError);
+		try {
+			Promise.resolve(handler(req, res)).then(() => settle(kHandled)).catch(fail);
+		} catch (error) {
+			fail(error);
+		}
+	});
+}
+function callMiddleware(handler, req, res) {
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const onClose = () => settle(kHandled);
+		const onFinish = () => settle(kHandled);
+		const onError = (error) => fail(error);
+		function cleanup() {
+			res.removeListener("close", onClose);
+			res.removeListener("finish", onFinish);
+			res.removeListener("error", onError);
+		}
+		function settle(value) {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve(value);
+		}
+		function fail(error) {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			reject(error);
+		}
+		res.once("close", onClose);
+		res.once("finish", onFinish);
+		res.once("error", onError);
+		try {
+			Promise.resolve(handler(req, res, (error) => {
+				if (error) fail(error);
+				else settle(res.writableEnded || res.destroyed ? kHandled : void 0);
+			})).catch(fail);
+		} catch (error) {
+			fail(error);
+		}
+	});
+}
+function createNodeBridge(handler, isMiddleware) {
+	if (typeof handler !== "function") throw new AppError("fromNodeHandler/fromNodeMiddleware expects a function.");
+	return defineCoreHandler({ fn: (async (event) => {
+		const node = event.request.runtime?.node;
+		if (!node?.req || !node?.res) throw new AppError("fromNodeHandler/fromNodeMiddleware requires a Node.js runtime.");
+		const req = node.req;
+		const res = node.res;
+		if ((isMiddleware ? await callMiddleware(handler, req, res) : await callHandler(handler, req, res)) === kHandled) return null;
+		return event.next();
+	}) });
+}
+/**
+* Wraps a Node.js `(req, res)` handler for use in the routup pipeline.
+*
+* @example
+* ```typescript
+* import { fromNodeHandler } from 'routup/node';
+*
+* router.use(fromNodeHandler((req, res) => {
+*     res.end('Hello');
+* }));
+* ```
+*/
+function fromNodeHandler(handler) {
+	return createNodeBridge(handler, false);
+}
+/**
+* Wraps a Node.js `(req, res, next)` middleware for use in the routup pipeline.
+*
+* @example
+* ```typescript
+* import cors from 'cors';
+* import { fromNodeMiddleware } from 'routup/node';
+*
+* router.use(fromNodeMiddleware(cors()));
+* ```
+*/
+function fromNodeMiddleware(handler) {
+	return createNodeBridge(handler, true);
+}
+//#endregion
+//#region src/handler/adapters/web/is.ts
+function isWebHandlerProvider(input) {
+	return isObject(input) && typeof input.fetch === "function";
+}
+function isWebHandler(input) {
+	return typeof input === "function";
+}
+//#endregion
+//#region src/handler/adapters/web/define.ts
+function fromWebHandler(input) {
+	if (isWebHandlerProvider(input)) return fromWebHandler(input.fetch.bind(input));
+	if (typeof input !== "function") throw new AppError("fromWebHandler expects a function or an object with a fetch method.");
+	return defineCoreHandler({ fn: (event) => input(event.request) });
+}
+//#endregion
+//#region src/handler/is.ts
+function isHandlerOptions(input) {
+	return isObject(input) && typeof input.fn === "function" && typeof input.type === "string";
+}
+function isHandler(input) {
+	return hasInstanceof(input, HandlerSymbol);
+}
+//#endregion
+//#region src/handler/utils.ts
+/**
+* Match a request method against a handler's bound method.
+*
+* - When the handler has no method bound, matches every request method.
+* - Otherwise matches when the request method is the same.
+* - HEAD requests additionally match GET handlers.
+*/
+function matchHandlerMethod(handlerMethod, requestMethod) {
+	return !handlerMethod || requestMethod === handlerMethod || requestMethod === MethodName.HEAD && handlerMethod === MethodName.GET;
+}
+//#endregion
+//#region src/request/helpers/cache.ts
+function isRequestCacheable(event, modifiedTime) {
+	const modifiedSince = event.headers.get(HeaderName.IF_MODIFIED_SINCE);
+	if (!modifiedSince) return false;
+	modifiedTime = typeof modifiedTime === "string" ? new Date(modifiedTime) : modifiedTime;
+	const sinceDate = new Date(modifiedSince);
+	if (Number.isNaN(sinceDate.getTime()) || Number.isNaN(modifiedTime.getTime())) return false;
+	return sinceDate >= modifiedTime;
+}
+//#endregion
+//#region src/request/helpers/header-accept-charset.ts
+function getRequestAcceptableCharsets(event) {
+	return useRequestNegotiator(event).charsets();
+}
+function getRequestAcceptableCharset(event, input) {
+	input = input || [];
+	const items = Array.isArray(input) ? input : [input];
+	if (items.length === 0) return getRequestAcceptableCharsets(event).shift();
+	return useRequestNegotiator(event).charsets(items).shift() || void 0;
+}
+//#endregion
+//#region src/request/helpers/header-accept-encoding.ts
+function getRequestAcceptableEncodings(event) {
+	return useRequestNegotiator(event).encodings();
+}
+function getRequestAcceptableEncoding(event, input) {
+	input = input || [];
+	const items = Array.isArray(input) ? input : [input];
+	if (items.length === 0) return getRequestAcceptableEncodings(event).shift();
+	return useRequestNegotiator(event).encodings(items).shift() || void 0;
+}
+//#endregion
+//#region src/request/helpers/header-accept-language.ts
+function getRequestAcceptableLanguages(event) {
+	return useRequestNegotiator(event).languages();
+}
+function getRequestAcceptableLanguage(event, input) {
+	input = input || [];
+	const items = Array.isArray(input) ? input : [input];
+	if (items.length === 0) return getRequestAcceptableLanguages(event).shift();
+	return useRequestNegotiator(event).languages(items).shift() || void 0;
+}
+//#endregion
+//#region src/request/helpers/header-content-type.ts
+function matchRequestContentType(event, contentType) {
+	const header = getRequestHeader(event, HeaderName.CONTENT_TYPE);
+	if (!header) return true;
+	return header.split(";")[0].trim() === getMimeType(contentType);
+}
+//#endregion
+//#region src/request/helpers/hostname.ts
+function getRequestHostName(event, options = {}) {
+	let trustProxy;
+	if (typeof options.trustProxy !== "undefined") trustProxy = buildTrustProxyFn(options.trustProxy);
+	else trustProxy = event.appOptions.trustProxy ?? DEFAULT_TRUST_PROXY;
+	let hostname = event.headers.get(HeaderName.X_FORWARDED_HOST);
+	if (!hostname || !event.request.ip || !trustProxy(event.request.ip, 0)) hostname = event.headers.get(HeaderName.HOST);
+	else if (hostname && hostname.includes(",")) hostname = hostname.substring(0, hostname.indexOf(",")).trimEnd();
+	if (!hostname) return;
+	const offset = hostname[0] === "[" ? hostname.indexOf("]") + 1 : 0;
+	const index = hostname.indexOf(":", offset);
+	const result = index !== -1 ? hostname.substring(0, index) : hostname;
+	if (/[\x00-\x1F\x7F\s/@\\]/.test(result)) return;
+	return result;
+}
+//#endregion
+//#region src/request/helpers/ip.ts
+/**
+* Get the client IP address from the request.
+*
+* When `trustProxy` is configured, walks the `X-Forwarded-For` chain
+* and returns the rightmost untrusted address (the actual client IP).
+* Falls back to `event.request.ip` (the direct connection IP).
+*/
+function getRequestIP(event, options = {}) {
+	let trustProxy;
+	if (typeof options.trustProxy !== "undefined") trustProxy = buildTrustProxyFn(options.trustProxy);
+	else trustProxy = event.appOptions.trustProxy ?? DEFAULT_TRUST_PROXY;
+	const socketAddr = event.request.ip;
+	if (!socketAddr) return;
+	const forwarded = event.headers.get(HeaderName.X_FORWARDED_FOR);
+	const addrs = [socketAddr];
+	if (forwarded) {
+		const parts = forwarded.split(",");
+		for (let i = parts.length - 1; i >= 0; i--) {
+			const addr = parts[i].trim();
+			if (addr) addrs.push(addr);
+		}
+	}
+	for (let i = 0; i < addrs.length - 1; i++) if (!trustProxy(addrs[i], i)) return addrs[i];
+	return addrs[addrs.length - 1];
+}
+//#endregion
+//#region src/request/helpers/protocol.ts
+function getRequestProtocol(event, options = {}) {
+	let trustProxy;
+	if (typeof options.trustProxy !== "undefined") trustProxy = buildTrustProxyFn(options.trustProxy);
+	else trustProxy = event.appOptions.trustProxy ?? DEFAULT_TRUST_PROXY;
+	let protocol;
+	try {
+		if (new URL(event.request.url).protocol === "https:") protocol = "https";
+		else protocol = "http";
+	} catch {
+		protocol = options.default || "http";
+	}
+	if (!event.request.ip || !trustProxy(event.request.ip, 0)) return protocol;
+	const header = event.headers.get(HeaderName.X_FORWARDED_PROTO);
+	if (!header) return protocol;
+	const index = header.indexOf(",");
+	const forwarded = index !== -1 ? header.substring(0, index).trim().toLowerCase() : header.trim().toLowerCase();
+	if (forwarded === "http" || forwarded === "https") return forwarded;
+	return protocol;
+}
+//#endregion
+//#region src/path/matcher.ts
+function decodeParam(val) {
+	/* istanbul ignore next */
+	if (typeof val !== "string" || val.length === 0) return val;
+	try {
+		return decodeURIComponent(val);
+	} catch {
+		return val;
+	}
+}
+var PathMatcher = class {
+	path;
+	regexp;
+	regexpKeys = [];
+	regexpOptions;
+	constructor(path, options) {
+		this.path = path;
+		this.regexpOptions = options || {};
+		const regexp = pathToRegexp(path, options);
+		this.regexp = regexp.regexp;
+		this.regexpKeys = regexp.keys;
+	}
+	test(path) {
+		return this.regexp.test(path);
+	}
+	exec(path) {
+		if (this.path === "/" && this.regexpOptions.end === false) return {
+			path: "/",
+			params: Object.create(null)
+		};
+		const match = this.regexp.exec(path);
+		if (!match) return;
+		const params = Object.create(null);
+		for (let i = 1; i < match.length; i++) {
+			const key = this.regexpKeys[i - 1];
+			if (!key) continue;
+			const prop = key.name;
+			const val = decodeParam(match[i]);
+			if (typeof val !== "undefined") params[prop] = val;
+		}
+		return {
+			path: match[0],
+			params
+		};
+	}
+};
+//#endregion
+//#region src/path/utils.ts
+function isPath(input) {
+	return typeof input === "string";
+}
+//#endregion
+//#region src/plugin/error/constants.ts
+const PluginErrorCode = {
+	PLUGIN: "PLUGIN",
+	NOT_INSTALLED: "PLUGIN_NOT_INSTALLED",
+	ALREADY_INSTALLED: "PLUGIN_ALREADY_INSTALLED",
+	INSTALL: "PLUGIN_INSTALL"
+};
+//#endregion
+//#region src/plugin/error/is.ts
+const PLUGIN_ERROR_CODES = new Set(Object.values(PluginErrorCode));
+function isPluginError(input) {
+	if (!isError(input)) return false;
+	return PLUGIN_ERROR_CODES.has(input.code);
+}
+//#endregion
+//#region src/plugin/error/module.ts
+var PluginError = class extends AppError {
+	constructor(input = {}) {
+		const options = typeof input === "string" ? { message: input } : { ...input };
+		if (!("code" in options) || !options.code) options.code = PluginErrorCode.PLUGIN;
+		super(options);
+		this.name = "PluginError";
+	}
+};
+//#endregion
+//#region src/plugin/error/sub/already-installed.ts
+var PluginAlreadyInstalledError = class extends PluginError {
+	pluginName;
+	constructor(pluginName) {
+		super({
+			message: `Plugin "${pluginName}" is already installed on this router.`,
+			code: PluginErrorCode.ALREADY_INSTALLED
+		});
+		this.name = "PluginAlreadyInstalledError";
+		this.pluginName = pluginName;
+	}
+};
+//#endregion
+//#region src/plugin/error/sub/install.ts
+var PluginInstallError = class extends PluginError {
+	pluginName;
+	constructor(pluginName, cause) {
+		super({
+			message: `Failed to install plugin "${pluginName}".`,
+			code: PluginErrorCode.INSTALL,
+			cause
+		});
+		this.name = "PluginInstallError";
+		this.pluginName = pluginName;
+	}
+};
+//#endregion
+//#region src/plugin/error/sub/not-installed.ts
+var PluginNotInstalledError = class extends PluginError {
+	pluginName;
+	helperName;
+	constructor(pluginName, helperName) {
+		super({
+			message: `${helperName}() requires the "${pluginName}" plugin. Register it with: router.use(${pluginName}())`,
+			code: PluginErrorCode.NOT_INSTALLED
+		});
+		this.name = "PluginNotInstalledError";
+		this.pluginName = pluginName;
+		this.helperName = helperName;
+	}
+};
+//#endregion
+//#region src/plugin/is.ts
+function isPlugin(input) {
+	if (!isObject(input)) return false;
+	if (typeof input.name !== "undefined" && typeof input.name !== "string") return false;
+	return typeof input.install === "function" && input.install.length === 1;
+}
+//#endregion
+//#region src/router/utils.ts
+/**
+* Build a path-to-regexp-backed `PathMatcher` for the route's mount
+* path, applying the exact-vs-prefix convention every router should
+* agree on:
+*
+* - `route.method !== undefined` → exact match (method-bound route)
+* - `route.method === undefined` → prefix match (middleware / nested
+*   app)
+*
+* Returns `undefined` when the route has no mount path — middleware
+* registered without a path matches every request.
+*
+* Routers are free to ignore this helper and build their own match
+* mechanism (radix tree, single aggregated regex, etc.) — it's
+* provided as a convenience for routers that want path-to-regexp
+* semantics with minimal boilerplate.
+*/
+function buildRoutePathMatcher(route) {
+	if (typeof route.path === "undefined") return;
+	const end = typeof route.method !== "undefined";
+	if (!end && route.path === "/") return;
+	return new PathMatcher(route.path, { end });
+}
+//#endregion
+//#region src/router/linear/module.ts
+/**
+* Default router — walks registered routes linearly per request and
+* runs each route's mount-level matcher (built via `buildRoutePathMatcher`,
+* path-to-regexp-backed). Routes without a mount path (mount-less
+* middleware / nested apps registered via `.use(handler)`) match every
+* request directly — there is no per-route `matchPath()` fallback.
+*
+* Behaviour-preserving wrapper around the previous in-line stack walk
+* in `executePipelineStepLookup`. The matcher allocations live here
+* (not on the registered route), so routers using a different matching
+* strategy (radix tree, aggregated regex, …) can ignore this file
+* entirely.
+*
+* Optional per-router lookup cache: pass an `ICache` via
+* `BaseRouterOptions.cache` to skip the linear walk on repeated
+* requests for the same path. Default is no caching.
+*/
+var LinearRouter = class LinearRouter {
+	_routes;
+	_matchers;
+	cache;
+	constructor(options = {}) {
+		this._routes = [];
+		this._matchers = [];
+		this.cache = options.cache;
+	}
+	add(route) {
+		this._routes.push(route);
+		this._matchers.push(buildRoutePathMatcher(route));
+		this.cache?.clear();
+	}
+	lookup(path, _method) {
+		const cached = this.cache?.get(path);
+		if (typeof cached !== "undefined") return cached;
+		const matches = [];
+		for (let i = 0; i < this._routes.length; i++) {
+			const route = this._routes[i];
+			const matcher = this._matchers[i];
+			if (matcher) {
+				const output = matcher.exec(path);
+				if (typeof output === "undefined") continue;
+				matches.push({
+					route,
+					index: i,
+					params: output.params,
+					path: output.path
+				});
+				continue;
+			}
+			matches.push({
+				route,
+				index: i,
+				params: Object.create(null)
+			});
+		}
+		this.cache?.set(path, matches);
+		return matches;
+	}
+	clone() {
+		return new LinearRouter({ cache: this.cache?.clone() });
+	}
+};
+//#endregion
+//#region src/router/trie/parser.ts
+/**
+* Trie-native path parser.
+*
+* Replaces the call-out to `path-to-regexp` for the syntax surface
+* the trie advertises:
+*
+*   - Static segments: `users`, `v1`
+*   - Named params:    `:id`, `:slug`
+*   - Optional params: `:id?`            (T2 — expanded to two variants)
+*   - Optional groups: `{...}`           (T2 — expanded to two variants)
+*   - Bare splat:      `*`               (matches the rest of the path)
+*   - Named splat:     `*rest`
+*
+* Returns a list of `Segment[]` *variants* — one path string can
+* expand into multiple route variants when it contains optional
+* markers. The trie inserts every variant with the same registration
+* `index` so they dedupe naturally on the candidate list.
+*
+* Returns `null` when the path uses syntax outside this surface
+* (compound segments `/files/:n.ext`, escape sequences `\:`, regex
+* constraints, splat-not-last, …). The caller falls back to the
+* universal bucket so correctness is preserved via path-to-regexp.
+*
+* Variant cap: nested optional groups expand combinatorially. The
+* parser caps the variant count at `MAX_VARIANTS` and falls back to
+* the universal bucket above that — registration-time explosion
+* isn't worth the lookup-time win on degenerate paths.
+*/
+const MAX_VARIANTS = 16;
+const PARAM_NAME = /^[a-zA-Z_]\w*$/;
+/**
+* Tokenize a single path segment (the substring between two `/`).
+* Returns `null` if the segment uses syntax we don't handle.
+*
+* Each segment must yield exactly one token — compound segments
+* (`/files/:n.ext`, `/users-:id`) produce multiple tokens and so
+* trip this check, falling back to the universal bucket.
+*/
+function tokenizeSegment(segment) {
+	if (segment === "") return null;
+	if (segment === "*") return {
+		kind: "splat",
+		name: "*"
+	};
+	if (segment.charAt(0) === "*") {
+		const rest = segment.slice(1);
+		if (PARAM_NAME.test(rest)) return {
+			kind: "splat",
+			name: rest
+		};
+		return null;
+	}
+	if (segment.charAt(0) === ":") {
+		const optional = segment.charAt(segment.length - 1) === "?";
+		const nameRaw = optional ? segment.slice(1, -1) : segment.slice(1);
+		if (PARAM_NAME.test(nameRaw)) return {
+			kind: "param",
+			name: nameRaw,
+			optional
+		};
+		return null;
+	}
+	if (/^[a-zA-Z0-9_\-.~%]+$/.test(segment)) return {
+		kind: "literal",
+		value: segment
+	};
+	return null;
+}
+/**
+* Tokenize the full path into a token stream, recognizing slash-
+* spanning optional groups (`/users{/edit/:id}`).
+*
+* The group-open marker is emitted in place of the leading `/`
+* inside `{...}`; group-close before the trailing `}`. The walker
+* later expands by either keeping the run between markers or
+* dropping it.
+*/
+function tokenizePath(path) {
+	const trimmed = path.charAt(0) === "/" ? path.slice(1) : path;
+	if (trimmed === "") return [];
+	const tokens = [];
+	let i = 0;
+	const n = trimmed.length;
+	while (i < n) {
+		if (trimmed.charAt(i) === "{") {
+			let close = -1;
+			for (let j = i + 1; j < n; j++) {
+				const c = trimmed.charAt(j);
+				if (c === "{") return null;
+				if (c === "}") {
+					close = j;
+					break;
+				}
+			}
+			if (close === -1) return null;
+			const inner = trimmed.slice(i + 1, close);
+			if (inner.charAt(0) !== "/") return null;
+			const after = close + 1 < n ? trimmed.charAt(close + 1) : "";
+			if (after !== "" && after !== "/" && after !== "{") return null;
+			tokens.push({ kind: "groupOpen" });
+			const innerTokens = tokenizePath(inner);
+			if (innerTokens === null) return null;
+			for (const t of innerTokens) tokens.push(t);
+			tokens.push({ kind: "groupClose" });
+			i = close + 1;
+			continue;
+		}
+		let segEnd = i;
+		while (segEnd < n) {
+			const c = trimmed.charAt(segEnd);
+			if (c === "/" || c === "{") break;
+			segEnd++;
+		}
+		const segment = trimmed.slice(i, segEnd);
+		if (segment !== "") {
+			const token = tokenizeSegment(segment);
+			if (token === null) return null;
+			tokens.push(token);
+		}
+		i = segEnd;
+		if (i < n && trimmed.charAt(i) === "/") i++;
+	}
+	return tokens;
+}
+/**
+* Expand the token stream into one or more concrete `Token[]`
+* variants by:
+*   1. Splitting `groupOpen` … `groupClose` runs into a "with run"
+*      and a "without run" choice (one optional group → ×2 variants).
+*   2. Splitting `param.optional = true` into a "with" and "without"
+*      choice (one `:id?` → ×2 variants).
+*
+* Caps at `MAX_VARIANTS` — beyond that, returns `null` so the path
+* falls back to the universal bucket.
+*
+* Returns `Token[][]` (not `Segment[][]`) so the recursive
+* group-expansion can splice inner variants back into the outer
+* token stream without a lossy round-trip through `Segment`.
+* `parsePath` does the final `Token → Segment` projection.
+*/
+function expand(tokens) {
+	let variants = [[]];
+	for (let i = 0; i < tokens.length; i++) {
+		const token = tokens[i];
+		if (token.kind === "groupOpen") {
+			let depth = 1;
+			let close = -1;
+			for (let j = i + 1; j < tokens.length; j++) {
+				const t = tokens[j];
+				if (t.kind === "groupOpen") depth++;
+				else if (t.kind === "groupClose") {
+					depth--;
+					if (depth === 0) {
+						close = j;
+						break;
+					}
+				}
+			}
+			if (close === -1) return null;
+			const expandedInner = expand(tokens.slice(i + 1, close));
+			if (expandedInner === null) return null;
+			const next = [];
+			for (const v of variants) {
+				if (next.length >= MAX_VARIANTS) return null;
+				next.push(v.slice());
+				for (const innerVariant of expandedInner) {
+					if (next.length >= MAX_VARIANTS) return null;
+					next.push(v.concat(innerVariant));
+				}
+			}
+			variants = next;
+			i = close;
+			continue;
+		}
+		if (token.kind === "param" && token.optional) {
+			const stripped = {
+				kind: "param",
+				name: token.name,
+				optional: false
+			};
+			const next = [];
+			for (const v of variants) {
+				if (next.length >= MAX_VARIANTS) return null;
+				next.push(v.slice());
+				if (next.length >= MAX_VARIANTS) return null;
+				next.push(v.concat([stripped]));
+			}
+			variants = next;
+			continue;
+		}
+		for (const v of variants) v.push(token);
+	}
+	return variants;
+}
+function tokenToSegment(t) {
+	if (t.kind === "literal") return {
+		kind: "static",
+		value: t.value
+	};
+	if (t.kind === "param") return {
+		kind: "param",
+		name: t.name
+	};
+	if (t.kind === "splat") return {
+		kind: "splat",
+		name: t.name
+	};
+	return null;
+}
+/**
+* Stable, structural identity for a variant — used to drop duplicate
+* expansions like `/users{/:id?}` (which produces the bare-`/users`
+* variant twice: once from the "without group" branch and once from
+* the "with group, without optional param" branch).
+*/
+function variantKey(segs) {
+	let out = "";
+	for (const s of segs) if (s.kind === "static") out += `/s:${s.value}`;
+	else if (s.kind === "param") out += `/p:${s.name}`;
+	else out += `/*:${s.name}`;
+	return out;
+}
+function parsePath(path) {
+	const tokens = tokenizePath(path);
+	if (tokens === null) return null;
+	const variants = expand(tokens);
+	if (variants === null) return null;
+	const result = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const v of variants) {
+		const segs = [];
+		for (const t of v) {
+			const s = tokenToSegment(t);
+			if (s === null) return null;
+			segs.push(s);
+		}
+		for (let i = 0; i < segs.length - 1; i++) if (segs[i].kind === "splat") return null;
+		const key = variantKey(segs);
+		if (seen.has(key)) continue;
+		seen.add(key);
+		result.push(segs);
+	}
+	return result;
+}
+//#endregion
+//#region src/router/trie/node.ts
+function createMethodBuckets() {
+	return Object.create(null);
+}
+function createTrieNode() {
+	return {
+		staticChildren: /* @__PURE__ */ new Map(),
+		splatRoutes: createMethodBuckets(),
+		exactRoutes: createMethodBuckets(),
+		prefixRoutes: []
+	};
+}
+//#endregion
+//#region src/router/trie/module.ts
+function decodeOrRaw(s) {
+	try {
+		return decodeURIComponent(s);
+	} catch {
+		return s;
+	}
+}
+/**
+* Build a `params` object from a request's pre-split segments using
+* the variant's pre-computed `ParamCapture[]`. No regex execution —
+* each capture is one indexed read from `segments` (and a join for
+* splats). Replaces the `matcher.exec` confirm pass for trie-walked
+* routes (T3).
+*/
+function extractTrieParams(segments, indexMap) {
+	const out = Object.create(null);
+	for (const cap of indexMap) if (cap.kind === "segment") out[cap.name] = decodeOrRaw(segments[cap.depth]);
+	else {
+		const slice = segments.slice(cap.depth).join("/");
+		out[cap.name] = decodeOrRaw(slice);
+	}
+	return out;
+}
+/**
+* Compute `match.path` (the matched-prefix string) from the request's
+* segments and the variant's recorded depth.
+*
+* - Non-splat variants: prefix = `segments[0..matchDepth].join('/')` —
+*   exactly what the variant consumed (request length = variant
+*   length for exact, request length ≥ variant length for prefix).
+* - Splat variants: the splat absorbed every remaining segment, so
+*   the matched prefix is the entire request path. This mirrors what
+*   `path-to-regexp`'s `output.path` would have returned pre-Phase-2
+*   for `/files/*rest` matching `/files/a/b` (`/files/a/b`, not
+*   `/files`).
+*/
+function trieMatchedPath(segments, matchDepth, splatTerminated) {
+	const upTo = splatTerminated ? segments.length : matchDepth;
+	if (upTo === 0) return "/";
+	return `/${segments.slice(0, upTo).join("/")}`;
+}
+/**
+* Pre-compute the `ParamCapture[]` for a variant's segments. Walk
+* the segments in order; emit one entry per `param` segment and a
+* terminal one for `splat` (always last). Static segments are
+* structurally consumed by the trie walk; they don't appear here.
+*/
+function buildParamsIndexMap(segments) {
+	const out = [];
+	for (const [i, seg] of segments.entries()) if (seg.kind === "param") out.push({
+		kind: "segment",
+		depth: i,
+		name: seg.name
+	});
+	else if (seg.kind === "splat") {
+		out.push({
+			kind: "splat",
+			depth: i,
+			name: seg.name
+		});
+		break;
+	}
+	return out;
+}
+/**
+* Decide which method buckets a given request method should pull
+* from. Always includes `''` (method-agnostic). For HEAD also
+* includes GET (per `matchHandlerMethod`). For OPTIONS or no-method
+* lookups, returns `null` to signal "emit every bucket" — needed so
+* `event.methodsAllowed` is populated for OPTIONS auto-Allow and so
+* `IRouter.lookup(path)` (no method) keeps returning a complete
+* candidate set.
+*/
+function methodBucketKeys(method) {
+	if (typeof method === "undefined" || method === MethodName.OPTIONS) return null;
+	if (method === MethodName.HEAD) return [
+		"",
+		MethodName.HEAD,
+		MethodName.GET
+	];
+	return ["", method];
+}
+function emitBucket(buckets, method, out) {
+	const keys = methodBucketKeys(method);
+	if (keys === null) {
+		for (const k in buckets) {
+			const list = buckets[k];
+			for (const r of list) out.push(r);
+		}
+		return;
+	}
+	for (const k of keys) {
+		const list = buckets[k];
+		if (!list) continue;
+		for (const r of list) out.push(r);
+	}
+}
+function hasAnyBucket(buckets) {
+	for (const _k in buckets) return true;
+	return false;
+}
+function pushIntoBucket(buckets, methodKey, route) {
+	const bucket = buckets[methodKey];
+	if (bucket) bucket.push(route);
+	else buckets[methodKey] = [route];
+}
+/**
+* Radix-trie router — registers routes into a per-segment tree at
+* `add()` time and walks the tree at `lookup()` to collect
+* candidates by structure rather than by linear scan.
+*
+* Inspired by Hono's `TrieRouter` and rou3. The trie handles
+* routup's path vocabulary directly via its own parser
+* (`./parser.ts`):
+*
+*   - Static segments (`/users`)
+*   - Named params (`:id`)
+*   - Optional params (`:id?`) — expanded to two route variants at
+*     registration (T2)
+*   - Optional groups (`/users{/edit}`) — same expansion strategy
+*   - Bare and named splats (`/files/*`, `/files/*rest`)
+*
+* Per-leaf storage is bucketed by HTTP method (T4) so lookup
+* narrows to the request method's bucket(s) instead of emitting
+* every entry at the leaf and letting the dispatcher's filter
+* discard mismatches.
+*
+* Param extraction is `paramsIndexMap`-driven (T3): a pre-built
+* `Array<{ depth, name }>` per variant lets `extractTrieParams`
+* read params straight from the request's pre-split segments — no
+* regex execution per match.
+*
+* Paths the trie parser doesn't handle (compound segments like
+* `/files/:n.ext`, escape sequences `\:`, regex constraints) and
+* empty/root paths fall through to the `universal` bucket. That
+* bucket still uses `path-to-regexp` via `buildRoutePathMatcher`,
+* so correctness is preserved.
+*
+* Pure-static-spine fast path (`shortCircuit`): when the request
+* walks a static spine with no param/splat/prefix siblings on any
+* traversed node, the leaf's `exactRoutes` (filtered to the request
+* method's buckets) is the full answer — no need to walk the param
+* branch or collect prefix candidates at intermediate nodes.
+*/
+var TrieRouter = class TrieRouter {
+	/**
+	* Monotonic counter assigned as the registration `index` on each
+	* route — the dispatch loop uses it to preserve registration
+	* order across the candidate list. App owns the canonical
+	* `Route<T>[]` list (Plan 019); the trie no longer keeps a
+	* parallel copy.
+	*/
+	_routeCount;
+	root;
+	/**
+	* Routes that bypass the trie — registered with no path, with
+	* the root path `/`, or with a path containing syntax the
+	* parser doesn't recognise. Walked linearly on every lookup,
+	* merged into the result in registration order.
+	*/
+	universal;
+	cache;
+	constructor(options = {}) {
+		this._routeCount = 0;
+		this.root = createTrieNode();
+		this.universal = [];
+		this.cache = options.cache;
+	}
+	add(route) {
+		const index = this._routeCount++;
+		if (typeof route.path !== "string" || route.path === "" || route.path === "/") {
+			this.universal.push({
+				route,
+				index,
+				matcher: buildRoutePathMatcher(route)
+			});
+			this.cache?.clear();
+			return;
+		}
+		const variants = parsePath(route.path);
+		if (variants === null) {
+			this.universal.push({
+				route,
+				index,
+				matcher: buildRoutePathMatcher(route)
+			});
+			this.cache?.clear();
+			return;
+		}
+		for (const segments of variants) this.insertIntoTrie(segments, route, index);
+		this.cache?.clear();
+	}
+	lookup(path, method) {
+		const cacheKey = `${method ?? ""}\t${path}`;
+		const cached = this.cache?.get(cacheKey);
+		if (typeof cached !== "undefined") return cached;
+		const candidates = [];
+		for (const u of this.universal) candidates.push(u);
+		const segments = this.parseRequestPath(path);
+		const shortCircuit = this.shortCircuit(segments, method);
+		if (shortCircuit !== null) for (const c of shortCircuit) candidates.push(c);
+		else this.walk(this.root, segments, 0, candidates, method);
+		candidates.sort((a, b) => {
+			if (a.index !== b.index) return a.index - b.index;
+			const ad = a.matchDepth ?? -1;
+			return (b.matchDepth ?? -1) - ad;
+		});
+		const matches = [];
+		let lastIndex = -1;
+		for (const candidate of candidates) {
+			const { route, index, matcher, paramsIndexMap, matchDepth } = candidate;
+			if (index === lastIndex) continue;
+			if (matcher) {
+				const output = matcher.exec(path);
+				if (typeof output === "undefined") continue;
+				matches.push({
+					route,
+					index,
+					params: this.assignParams(output.params),
+					path: output.path
+				});
+				lastIndex = index;
+				continue;
+			}
+			if (paramsIndexMap && typeof matchDepth === "number") {
+				matches.push({
+					route,
+					index,
+					params: extractTrieParams(segments, paramsIndexMap),
+					path: trieMatchedPath(segments, matchDepth, candidate.splatTerminated === true)
+				});
+				lastIndex = index;
+				continue;
+			}
+			matches.push({
+				route,
+				index,
+				params: Object.create(null)
+			});
+			lastIndex = index;
+		}
+		this.cache?.set(cacheKey, matches);
+		return matches;
+	}
+	clone() {
+		return new TrieRouter({ cache: this.cache?.clone() });
+	}
+	/**
+	* T1: returns the pre-computed candidate list when the request's
+	* static spine has no param sibling, no prefix routes, and no
+	* splats along the way. The leaf node's `exactRoutes` (filtered
+	* to the request method's buckets) is then the complete answer —
+	* no need to walk the param branch or collect prefix/splat
+	* candidates from intermediate nodes. When any branch is
+	* encountered, returns `null` and the caller falls through to
+	* the regular `walk`.
+	*/
+	shortCircuit(segments, method) {
+		let node = this.root;
+		for (const segment of segments) {
+			if (node.paramChild || hasAnyBucket(node.splatRoutes) || node.prefixRoutes.length > 0) return null;
+			const child = node.staticChildren.get(segment);
+			if (!child) return null;
+			node = child;
+		}
+		if (node.paramChild || hasAnyBucket(node.splatRoutes) || node.prefixRoutes.length > 0) return null;
+		const out = [];
+		emitBucket(node.exactRoutes, method, out);
+		return out;
+	}
+	parseRequestPath(path) {
+		const trimmed = path.charAt(0) === "/" ? path.slice(1) : path;
+		if (trimmed === "") return [];
+		const parts = trimmed.split("/");
+		const result = [];
+		for (const part of parts) if (part !== "") result.push(part);
+		return result;
+	}
+	insertIntoTrie(segments, route, index) {
+		let node = this.root;
+		const exact = this.isExactMatchRoute(route);
+		const methodKey = route.method ?? "";
+		const paramsIndexMap = buildParamsIndexMap(segments);
+		for (const [i, segment] of segments.entries()) {
+			const seg = segment;
+			if (seg.kind === "splat") {
+				pushIntoBucket(node.splatRoutes, methodKey, {
+					route,
+					index,
+					paramsIndexMap,
+					matchDepth: i,
+					splatTerminated: true
+				});
+				return;
+			}
+			if (seg.kind === "param") {
+				if (!node.paramChild) node.paramChild = createTrieNode();
+				node = node.paramChild;
+				continue;
+			}
+			let child = node.staticChildren.get(seg.value);
+			if (!child) {
+				child = createTrieNode();
+				node.staticChildren.set(seg.value, child);
+			}
+			node = child;
+		}
+		const indexed = {
+			route,
+			index,
+			paramsIndexMap,
+			matchDepth: segments.length
+		};
+		if (exact) pushIntoBucket(node.exactRoutes, methodKey, indexed);
+		else node.prefixRoutes.push(indexed);
+	}
+	walk(node, segments, depth, collected, method) {
+		emitBucket(node.splatRoutes, method, collected);
+		if (depth === segments.length) {
+			emitBucket(node.exactRoutes, method, collected);
+			for (const p of node.prefixRoutes) collected.push(p);
+			return;
+		}
+		for (const p of node.prefixRoutes) collected.push(p);
+		const seg = segments[depth];
+		const staticChild = node.staticChildren.get(seg);
+		if (staticChild) this.walk(staticChild, segments, depth + 1, collected, method);
+		if (node.paramChild) this.walk(node.paramChild, segments, depth + 1, collected, method);
+	}
+	isExactMatchRoute(route) {
+		return typeof route.method !== "undefined";
+	}
+	/**
+	* T5: copy params onto a prototype-less object so downstream
+	* lookups skip prototype-chain traversal and avoid `__proto__` /
+	* `hasOwnProperty` shadowing from user-controlled segment values.
+	*/
+	assignParams(source) {
+		const out = Object.create(null);
+		for (const k in source) if (Object.prototype.hasOwnProperty.call(source, k)) out[k] = source[k];
+		return out;
+	}
+};
+//#endregion
+//#region src/router/smart/module.ts
+/**
+* Default crossover. Empirically `LinearRouter` wins for small route
+* counts (no per-request trie walk overhead, no static-spine setup);
+* `TrieRouter` wins past ~30 entries on typical workloads. Override
+* via `SmartRouterOptions.threshold` when a benchmark says otherwise
+* for your route shape.
+*/
+const DEFAULT_THRESHOLD = 30;
+/**
+* Auto-selecting router. Accumulates registered routes in a pending
+* buffer; on the first `lookup()` call, picks `LinearRouter` or
+* `TrieRouter` based on the registered route count and replays the
+* pending list onto the chosen inner router. Every subsequent call
+* — `add`, `lookup`, `clone` — forwards to the inner.
+*
+* Use this when you don't want to commit to a router family up-front
+* (e.g. a library that registers a variable number of routes
+* depending on configuration). For known workloads, prefer the
+* concrete router — `SmartRouter` adds one indirection per call.
+*
+* Inspired by Hono's `SmartRouter` (which auto-selects across more
+* candidates including `RegExpRouter`); ours covers the only choice
+* that matters in routup today: linear-vs-trie at the registration-
+* size crossover.
+*/
+var SmartRouter = class SmartRouter {
+	inner;
+	pending = [];
+	threshold;
+	/**
+	* Cache handed off to whichever inner router gets chosen. Stays
+	* `undefined` if the user didn't configure one.
+	*/
+	cache;
+	constructor(options = {}) {
+		this.threshold = options.threshold ?? DEFAULT_THRESHOLD;
+		this.cache = options.cache;
+	}
+	add(route) {
+		if (this.inner) {
+			this.inner.add(route);
+			return;
+		}
+		this.pending.push(route);
+	}
+	lookup(path, method) {
+		if (!this.inner) {
+			this.inner = this.choose();
+			for (const r of this.pending) this.inner.add(r);
+			this.pending = [];
+		}
+		return this.inner.lookup(path, method);
+	}
+	clone() {
+		return new SmartRouter({
+			threshold: this.threshold,
+			cache: this.cache?.clone()
+		});
+	}
+	/**
+	* Pick the inner router based on the registered route count.
+	* `LinearRouter` for tiny tables, `TrieRouter` past the
+	* configured threshold.
+	*
+	* @protected
+	*/
+	choose() {
+		if (this.pending.length < this.threshold) return new LinearRouter({ cache: this.cache });
+		return new TrieRouter({ cache: this.cache });
+	}
+};
+//#endregion
+//#region src/app/options.ts
+function normalizeAppOptions(input) {
+	let etag;
+	if (typeof input.etag !== "undefined") if (input.etag === null || input.etag === false) etag = null;
+	else etag = buildEtagFn(input.etag);
+	let trustProxy;
+	if (typeof input.trustProxy !== "undefined") trustProxy = buildTrustProxyFn(input.trustProxy);
+	if (typeof input.timeout !== "undefined") {
+		if (!Number.isFinite(input.timeout) || input.timeout <= 0) delete input.timeout;
+	}
+	if (typeof input.handlerTimeout !== "undefined") {
+		if (!Number.isFinite(input.handlerTimeout) || input.handlerTimeout <= 0) delete input.handlerTimeout;
+	}
+	return {
+		...input,
+		etag,
+		trustProxy
+	};
+}
+//#endregion
+//#region src/app/constants.ts
+const AppSymbol = Symbol.for("App");
+//#endregion
+//#region src/app/check.ts
+function isAppInstance(input) {
+	return hasInstanceof(input, AppSymbol);
+}
+//#endregion
+//#region src/app/module.ts
+/**
+* Merge resolver-supplied path params into `event.params` *only* when
+* `match.params` actually has keys. Skipping the object spread on the
+* empty-params path (every static route, every middleware match) saves
+* an allocation per match — the hottest path in static-route apps.
+*/
+function mergeMatchParams(event, matchParams) {
+	let hasKeys = false;
+	for (const _k in matchParams) {
+		hasKeys = true;
+		break;
+	}
+	if (!hasKeys) return;
+	event.params = {
+		...event.params,
+		...matchParams
+	};
+}
+var App = class App {
+	/**
+	* A label for the App instance.
+	*/
+	name;
+	/**
+	* Registration-time path prefix for entries registered on this
+	* App. Local to this instance — never inherited from a parent.
+	*
+	* @protected
+	*/
+	_path;
+	/**
+	* Pluggable router (route table) — owns the "which entries match
+	* this path?" lookup. Defaults to `LinearRouter` (walks entries
+	* linearly per request); swap in via `AppContext.router`
+	* for a radix/trie implementation on apps with many routes.
+	*
+	* @protected
+	*/
+	router;
+	/**
+	* Normalized options for this App instance.
+	*
+	* Frozen on construction — once published to `event.appOptions`
+	* it is shared across all requests, and a handler must not be
+	* able to mutate router-global state.
+	*/
+	_options;
+	/**
+	* Registry of installed plugins (name → version) on this App.
+	*
+	* Read by `use(otherApp)` (via the public `plugins` getter) so
+	* plugin registries merge into the parent at flatten time —
+	* `parent.hasPlugin('foo')` then reflects plugins installed on
+	* apps mounted into it.
+	*
+	* @protected
+	*/
+	_plugins;
+	/**
+	* Every route registered on this App, in registration order.
+	*
+	* Read by `use(otherApp)` to snapshot routes at flatten time
+	* and by `clone()` to seed the copy. Late mutations to `_routes`
+	* after a flatten do not propagate.
+	*/
+	_routes = [];
+	constructor(input = {}) {
+		this.name = input.name;
+		this._path = input.path;
+		this._plugins = new Map(input.plugins);
+		this.router = input.router ?? new LinearRouter();
+		this._options = Object.freeze(normalizeAppOptions(input.options ?? {}));
+		markInstanceof(this, AppSymbol);
+	}
+	/**
+	* Public read of the canonical route list. Used by `use(child)`
+	* to snapshot the child's routes at flatten time. Returned
+	* as `readonly` — callers must not mutate.
+	*/
+	get routes() {
+		return this._routes;
+	}
+	/**
+	* Public read of the installed-plugin registry. Used by
+	* `use(child)` to merge child plugins into the parent at
+	* flatten time. Returned as `ReadonlyMap` — callers must not
+	* mutate; go through `use(plugin)` to install.
+	*/
+	get plugins() {
+		return this._plugins;
+	}
+	/**
+	* Register a route with the active router and record it on the
+	* App so `clone` / `setRouter` / `use(child)` can read the
+	* canonical list back.
+	*
+	* @protected
+	*/
+	register(route) {
+		this.router.add(route);
+		this._routes.push(route);
+	}
+	/**
+	* Swap the active router. Replays every previously-registered
+	* route onto the new router so lookups stay correct.
+	*
+	* Useful for picking a router after route shape is known (e.g.
+	* a SmartRouter-style decision), or for testing alternatives
+	* mid-flight without rebuilding the App. Any cache the previous
+	* router carried is dropped along with it.
+	*/
+	setRouter(router) {
+		for (const route of this._routes) router.add(route);
+		this.router = router;
+	}
+	/**
+	* Public entry point — creates a DispatcherEvent from the request,
+	* runs the pipeline, and returns a Response (with 404/500 fallbacks).
+	*/
+	async fetch(request) {
+		const event = new DispatcherEvent(request);
+		let response;
+		try {
+			const timeoutMs = this._options.timeout;
+			if (timeoutMs) {
+				const controller = new AbortController();
+				event.signal = controller.signal;
+				let timerId;
+				try {
+					response = await Promise.race([this.dispatch(event), new Promise((_, reject) => {
+						timerId = setTimeout(() => {
+							controller.abort();
+							reject(createError({
+								status: 408,
+								message: "Request Timeout"
+							}));
+						}, timeoutMs);
+					})]);
+				} finally {
+					clearTimeout(timerId);
+				}
+			} else response = await this.dispatch(event);
+		} catch (e) {
+			event.error = createError(e);
+		}
+		if (response) return response;
+		if (event.error) return this.buildFallbackResponse(request, event, event.error.status || 500, event.error.message);
+		return this.buildFallbackResponse(request, event, 404, "Not Found");
+	}
+	buildFallbackResponse(request, event, status, message) {
+		const headers = new Headers(event.response.headers);
+		if (acceptsJson(request)) {
+			headers.set("content-type", "application/json; charset=utf-8");
+			return new Response(JSON.stringify({
+				status,
+				message
+			}), {
+				status,
+				headers
+			});
+		}
+		headers.set("content-type", "text/plain; charset=utf-8");
+		return new Response(message, {
+			status,
+			headers
+		});
+	}
+	async dispatch(event) {
+		const savedPath = event.path;
+		const savedMountPath = event.mountPath;
+		const savedParams = event.params;
+		const savedAppOptions = event.appOptions;
+		const wasDispatching = event.isDispatching;
+		const isRoot = !wasDispatching;
+		event.appOptions = this._options;
+		event.isDispatching = true;
+		let response;
+		try {
+			const matches = this.router.lookup(event.path, event.method);
+			response = await this.runMatches(event, matches, event.path, 0);
+			if (!event.error && !event.dispatched && isRoot && event.method === MethodName.OPTIONS) {
+				if (event.methodsAllowed.has(MethodName.GET)) event.methodsAllowed.add(MethodName.HEAD);
+				const options = [...event.methodsAllowed].map((key) => key.toUpperCase()).join(",");
+				const optionsHeaders = new Headers(event.response.headers);
+				optionsHeaders.set(HeaderName.ALLOW, options);
+				response = new Response(options, {
+					status: event.response.status || 200,
+					headers: optionsHeaders
+				});
+				event.dispatched = true;
+			}
+		} finally {
+			event.appOptions = savedAppOptions;
+			event.isDispatching = wasDispatching;
+			if (!event.dispatched) {
+				event.path = savedPath;
+				event.mountPath = savedMountPath;
+				event.params = savedParams;
+			}
+		}
+		return response;
+	}
+	/**
+	* Walk the matched routes for the current event, dispatching each
+	* handler in order. Re-entered (recursively) from the `setNext`
+	* continuation so `event.next()` resumes from the next match.
+	*/
+	async runMatches(event, matches, matchesPath, startIndex) {
+		let i = startIndex;
+		let response;
+		while (!event.dispatched && i < matches.length) {
+			const match = matches[i];
+			const handler = match.route.data;
+			if (event.error && handler.type === HandlerType.CORE || !event.error && handler.type === HandlerType.ERROR) {
+				i++;
+				continue;
+			}
+			const { method } = match.route;
+			if (method) event.methodsAllowed.add(method);
+			if (!matchHandlerMethod(method, event.method)) {
+				i++;
+				continue;
+			}
+			mergeMatchParams(event, match.params);
+			const savedMountPath = event.mountPath;
+			if (typeof match.path === "string") event.mountPath = match.path;
+			const capturedMatches = matches;
+			const capturedMatchesPath = matchesPath;
+			const nextIndex = i + 1;
+			event.setNext(async (error) => {
+				if (error) event.error = createError(error);
+				const pathChanged = event.path !== capturedMatchesPath;
+				const nextMatches = pathChanged ? this.router.lookup(event.path, event.method) : capturedMatches;
+				const nextMatchesPath = pathChanged ? event.path : capturedMatchesPath;
+				const nextStart = pathChanged ? 0 : nextIndex;
+				return this.runMatches(event, nextMatches, nextMatchesPath, nextStart);
+			});
+			try {
+				const dispatchResponse = await handler.dispatch(event);
+				if (dispatchResponse) {
+					response = dispatchResponse;
+					event.dispatched = true;
+				}
+			} catch (e) {
+				event.error = createError(e);
+			} finally {
+				event.mountPath = savedMountPath;
+			}
+			i++;
+		}
+		return response;
+	}
+	delete(...input) {
+		this.useForMethod(MethodName.DELETE, ...input);
+		return this;
+	}
+	get(...input) {
+		this.useForMethod(MethodName.GET, ...input);
+		return this;
+	}
+	post(...input) {
+		this.useForMethod(MethodName.POST, ...input);
+		return this;
+	}
+	put(...input) {
+		this.useForMethod(MethodName.PUT, ...input);
+		return this;
+	}
+	patch(...input) {
+		this.useForMethod(MethodName.PATCH, ...input);
+		return this;
+	}
+	head(...input) {
+		this.useForMethod(MethodName.HEAD, ...input);
+		return this;
+	}
+	options(...input) {
+		this.useForMethod(MethodName.OPTIONS, ...input);
+		return this;
+	}
+	useForMethod(method, ...input) {
+		let path;
+		for (const element of input) {
+			if (isPath(element)) {
+				path = element;
+				continue;
+			}
+			let handler;
+			if (isHandler(element)) handler = element;
+			else if (isHandlerOptions(element)) handler = new Handler({
+				...element,
+				method
+			});
+			else continue;
+			this.register({
+				path: joinPaths(this._path, path, handler.path),
+				method,
+				data: handler
+			});
+		}
+	}
+	use(...input) {
+		let path;
+		for (const item of input) {
+			if (isPath(item)) {
+				path = withLeadingSlash(item);
+				continue;
+			}
+			if (isAppInstance(item)) {
+				this.flatten(item, path);
+				continue;
+			}
+			if (isHandler(item)) {
+				this.register({
+					path: joinPaths(this._path, path, item.path),
+					method: item.method,
+					data: item
+				});
+				continue;
+			}
+			if (isHandlerOptions(item)) {
+				const handler = new Handler({ ...item });
+				this.register({
+					path: joinPaths(this._path, path, handler.path),
+					method: handler.method,
+					data: handler
+				});
+				continue;
+			}
+			if (isPlugin(item)) if (path) this.install(item, { path });
+			else this.install(item);
+		}
+		return this;
+	}
+	/**
+	* Snapshot a child App's routes and plugin registry into this
+	* one. Each route's path is prefixed with `this._path`, the
+	* supplied mount `path`, and the route's own path (in that
+	* order); the resulting entry is registered on this App's
+	* router. The child app is not retained — late mutations on it
+	* after this call do not propagate.
+	*
+	* @protected
+	*/
+	flatten(child, path) {
+		for (const name of child.plugins.keys()) if (this._plugins.has(name)) throw new PluginAlreadyInstalledError(name);
+		for (const [name, version] of child.plugins) this._plugins.set(name, version);
+		for (const route of child.routes) this.register({
+			path: joinPaths(this._path, path, route.path),
+			method: route.method,
+			data: route.data
+		});
+	}
+	/**
+	* Check if a plugin with the given name is installed on this App.
+	*/
+	hasPlugin(name) {
+		return this._plugins.has(name);
+	}
+	/**
+	* Get the version of an installed plugin by name, or `undefined`
+	* if the plugin is not installed.
+	*/
+	getPluginVersion(name) {
+		return this._plugins.get(name);
+	}
+	install(plugin, context = {}) {
+		if (this._plugins.has(plugin.name)) throw new PluginAlreadyInstalledError(plugin.name);
+		const scratch = new App({ name: plugin.name });
+		plugin.install(scratch);
+		if (context.path) this.use(context.path, scratch);
+		else this.use(scratch);
+		this._plugins.set(plugin.name, plugin.version);
+		return this;
+	}
+	/**
+	* Return a new `App` that mirrors this one but owns independent
+	* mountable state — fresh router of the same family seeded with
+	* the current routes, shallow copy of options, and a fresh
+	* plugins map carrying the same entries.
+	*/
+	clone() {
+		const next = new App({
+			name: this.name,
+			path: this._path,
+			options: { ...this._options },
+			plugins: this._plugins,
+			router: this.router.clone()
+		});
+		for (const route of this._routes) next.register({
+			path: route.path,
+			method: route.method,
+			data: route.data
+		});
+		return next;
+	}
+};
+//#endregion
+export { isError as $, fromWebHandler as A, DispatcherEvent as B, getRequestAcceptableEncodings as C, matchHandlerMethod as D, isRequestCacheable as E, defineErrorHandler as F, getRequestAcceptableContentTypes as G, sendRedirect as H, defineCoreHandler as I, sendFile as J, useRequestNegotiator as K, Handler as L, isWebHandlerProvider as M, fromNodeHandler as N, isHandler as O, fromNodeMiddleware as P, createError as Q, HandlerSymbol as R, getRequestAcceptableEncoding as S, getRequestAcceptableCharsets as T, sendFormat as U, sendStream as V, getRequestAcceptableContentType as W, sendAccepted as X, sendCreated as Y, toResponse as Z, getRequestIP as _, LinearRouter as a, appendResponseHeaderDirective as at, getRequestAcceptableLanguage as b, PluginNotInstalledError as c, AppError as ct, PluginError as d, AppEvent as dt, setResponseHeaderContentType as et, isPluginError as f, HeaderName as ft, getRequestProtocol as g, PathMatcher as h, TrieRouter as i, appendResponseHeader as it, isWebHandler as j, isHandlerOptions as k, PluginInstallError as l, ErrorSymbol as lt, isPath as m, LruCache as mt, normalizeAppOptions as n, setResponseHeaderInline as nt, buildRoutePathMatcher as o, createEventStream as ot, PluginErrorCode as p, MethodName as pt, getRequestHeader as q, SmartRouter as r, setResponseContentTypeByFileName as rt, isPlugin as s, serializeEventStreamMessage as st, App as t, setResponseHeaderAttachment as tt, PluginAlreadyInstalledError as u, setResponseCacheHeaders as ut, getRequestHostName as v, getRequestAcceptableCharset as w, getRequestAcceptableLanguages as x, matchRequestContentType as y, HandlerType as z };
+
+//# sourceMappingURL=src-DaK6SZc0.mjs.map