shokupan 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,22 +1,30 @@
-import { trace, SpanKind, SpanStatusCode, context } from "@opentelemetry/api";
+import { readFile } from "node:fs/promises";
 import { Eta } from "eta";
-import { stat, readdir } from "fs/promises";
+import { stat, readdir, readFile as readFile$1 } from "fs/promises";
 import { resolve, join, basename } from "path";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { createNodeEngines } from "@surrealdb/node";
+import { Surreal, RecordId } from "surrealdb";
+import { trace, SpanKind, SpanStatusCode, context } from "@opentelemetry/api";
+import * as os from "node:os";
 import { OAuth2Client, Okta, Auth0, Apple, MicrosoftEntraId, Google, GitHub, generateState, generateCodeVerifier } from "arctic";
 import * as jose from "jose";
-import { OpenAPIAnalyzer } from "./openapi-analyzer-cjdGeQ5a.js";
-import { randomUUID, createHmac } from "crypto";
-import { EventEmitter } from "events";
+import * as zlib from "node:zlib";
+import Ajv from "ajv";
+import addFormats from "ajv-formats";
 import { plainToInstance } from "class-transformer";
 import { validateOrReject } from "class-validator";
+import { OpenAPIAnalyzer } from "./openapi-analyzer-BtIaHIfe.js";
+import { randomUUID, createHmac } from "crypto";
+import { EventEmitter } from "events";
 class ShokupanResponse {
-  _headers = new Headers();
+  _headers = null;
   _status = 200;
   /**
    * Get the current headers
    */
   get headers() {
+    if (!this._headers) this._headers = new Headers();
     return this._headers;
   }
   /**
@@ -37,6 +45,7 @@ class ShokupanResponse {
    * @param value Header value
    */
   set(key, value) {
+    if (!this._headers) this._headers = new Headers();
     this._headers.set(key, value);
     return this;
   }
@@ -46,6 +55,7 @@ class ShokupanResponse {
    * @param value Header value
    */
   append(key, value) {
+    if (!this._headers) this._headers = new Headers();
     this._headers.append(key, value);
     return this;
   }
@@ -54,29 +64,62 @@ class ShokupanResponse {
    * @param key Header name
    */
   get(key) {
-    return this._headers.get(key);
+    return this._headers?.get(key) || null;
   }
   /**
    * Check if a header exists
    * @param key Header name
    */
   has(key) {
-    return this._headers.has(key);
+    return this._headers?.has(key) || false;
+  }
+  /**
+   * Internal: check if headers have been initialized/modified
+   */
+  get hasPopulatedHeaders() {
+    return this._headers !== null;
   }
 }
 class ShokupanContext {
-  constructor(request, server, state, app) {
+  // Raw body for compression optimization
+  constructor(request, server, state, app, signal, enableMiddlewareTracking = false) {
     this.request = request;
     this.server = server;
     this.app = app;
-    this.url = new URL(request.url);
+    this.signal = signal;
     this.state = state || {};
+    if (enableMiddlewareTracking) {
+      const self = this;
+      this.state = new Proxy(this.state, {
+        set(target, p, newValue, receiver) {
+          const result = Reflect.set(target, p, newValue, receiver);
+          const currentHandler = self.handlerStack[self.handlerStack.length - 1];
+          if (currentHandler) {
+            if (!currentHandler.stateChanges) currentHandler.stateChanges = {};
+            currentHandler.stateChanges[p] = newValue;
+          }
+          return result;
+        }
+      });
+    }
     this.response = new ShokupanResponse();
   }
-  url;
+  _url;
   params = {};
+  // Router assigns this, but default to empty object
   state;
+  handlerStack = [];
   response;
+  _debug;
+  _finalResponse;
+  _rawBody;
+  get url() {
+    if (!this._url) {
+      const urlString = this.request.url || "http://localhost/";
+      this._url = new URL(urlString);
+    }
+    return this._url;
+  }
   /**
    * Base request
    */
@@ -93,13 +136,42 @@ class ShokupanContext {
    * Request path
    */
   get path() {
-    return this.url.pathname;
+    if (this._url) return this._url.pathname;
+    const url = this.request.url;
+    let queryIndex = url.indexOf("?");
+    const end = queryIndex === -1 ? url.length : queryIndex;
+    let start = 0;
+    const protocolIndex = url.indexOf("://");
+    if (protocolIndex !== -1) {
+      const hostStart = protocolIndex + 3;
+      const pathStart = url.indexOf("/", hostStart);
+      if (pathStart !== -1 && pathStart < end) {
+        start = pathStart;
+      } else {
+        return "/";
+      }
+    } else {
+      if (url.charCodeAt(0) === 47) {
+        start = 0;
+      }
+    }
+    return url.substring(start, end);
   }
   /**
    * Request query params
    */
   get query() {
-    return Object.fromEntries(this.url.searchParams);
+    const q = {};
+    for (const [key, value] of this.url.searchParams) {
+      if (q[key] === void 0) {
+        q[key] = value;
+      } else if (Array.isArray(q[key])) {
+        q[key].push(value);
+      } else {
+        q[key] = [q[key], value];
+      }
+    }
+    return q;
   }
   /**
    * Client IP address
@@ -174,25 +246,60 @@ class ShokupanContext {
   setCookie(name, value, options = {}) {
     let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
     if (options.maxAge) cookie += `; Max-Age=${Math.floor(options.maxAge)}`;
+    if (options.domain) cookie += `; Domain=${options.domain}`;
+    if (options.path) cookie += `; Path=${options.path || "/"}`;
     if (options.expires) cookie += `; Expires=${options.expires.toUTCString()}`;
     if (options.httpOnly) cookie += `; HttpOnly`;
     if (options.secure) cookie += `; Secure`;
-    if (options.domain) cookie += `; Domain=${options.domain}`;
-    if (options.path) cookie += `; Path=${options.path || "/"}`;
-    if (options.sameSite) {
-      typeof options.sameSite === "string" ? options.sameSite.toLowerCase() : options.sameSite ? "strict" : "lax";
-      cookie += `; SameSite=${typeof options.sameSite === "boolean" ? "Strict" : options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1)}`;
+    let sameSite = options.sameSite;
+    if (sameSite === true) sameSite = "Strict";
+    if (sameSite === void 0 || sameSite === false) ;
+    else {
+      const stringSameSite = typeof sameSite === "string" ? sameSite.toLowerCase() : sameSite;
+      switch (stringSameSite) {
+        case "lax":
+          cookie += "; SameSite=Lax";
+          break;
+        case "strict":
+          cookie += "; SameSite=Strict";
+          break;
+        case "none":
+          cookie += "; SameSite=None";
+          break;
+        default:
+          cookie += "; SameSite=Lax";
+          break;
+      }
     }
     if (options.priority) {
-      cookie += `; Priority=${options.priority.charAt(0).toUpperCase() + options.priority.slice(1)}`;
+      const p = options.priority.toLowerCase();
+      if (p === "low") cookie += "; Priority=Low";
+      else if (p === "medium") cookie += "; Priority=Medium";
+      else if (p === "high") cookie += "; Priority=High";
     }
     this.response.append("Set-Cookie", cookie);
     return this;
   }
   mergeHeaders(headers) {
-    const h = new Headers(this.response.headers);
+    let h;
+    if (this.response.hasPopulatedHeaders) {
+      h = new Headers(this.response.headers);
+    } else {
+      h = new Headers();
+    }
     if (headers) {
-      new Headers(headers).forEach((v, k) => h.set(k, v));
+      if (headers instanceof Headers) {
+        headers.forEach((v, k) => h.set(k, v));
+      } else if (Array.isArray(headers)) {
+        headers.forEach(([k, v]) => h.set(k, v));
+      } else {
+        const keys = Object.keys(headers);
+        for (let i = 0; i < keys.length; i++) {
+          const key = keys[i];
+          const val = headers[key];
+          h.set(key, val);
+        }
+      }
     }
     return h;
   }
@@ -205,17 +312,21 @@ class ShokupanContext {
   send(body, options) {
     const headers = this.mergeHeaders(options?.headers);
     const status = options?.status ?? this.response.status;
-    return new Response(body, { status, headers });
+    if (typeof body === "string" || body instanceof ArrayBuffer || body instanceof Uint8Array) {
+      this._rawBody = body;
+    }
+    this._finalResponse = new Response(body, { status, headers });
+    return this._finalResponse;
   }
   /**
    * Read request body
    */
   async body() {
-    const contentType = this.request.headers.get("content-type");
-    if (contentType?.includes("application/json")) {
+    const contentType = this.request.headers.get("content-type") || "";
+    if (contentType.includes("application/json") || contentType.includes("+json")) {
       return this.request.json();
     }
-    if (contentType?.includes("multipart/form-data") || contentType?.includes("application/x-www-form-urlencoded")) {
+    if (contentType.includes("multipart/form-data") || contentType.includes("application/x-www-form-urlencoded")) {
       return this.request.formData();
     }
     return this.request.text();
@@ -224,28 +335,49 @@ class ShokupanContext {
    * Respond with a JSON object
    */
   json(data, status, headers) {
+    const finalStatus = status ?? this.response.status;
+    const jsonString = JSON.stringify(data);
+    this._rawBody = jsonString;
+    if (!headers && !this.response.hasPopulatedHeaders) {
+      this._finalResponse = new Response(jsonString, {
+        status: finalStatus,
+        headers: { "content-type": "application/json" }
+      });
+      return this._finalResponse;
+    }
     const finalHeaders = this.mergeHeaders(headers);
     finalHeaders.set("content-type", "application/json");
-    const finalStatus = status ?? this.response.status;
-    return new Response(JSON.stringify(data), { status: finalStatus, headers: finalHeaders });
+    this._finalResponse = new Response(jsonString, { status: finalStatus, headers: finalHeaders });
+    return this._finalResponse;
   }
   /**
    * Respond with a text string
    */
   text(data, status, headers) {
-    const finalHeaders = this.mergeHeaders(headers);
-    finalHeaders.set("content-type", "text/plain");
     const finalStatus = status ?? this.response.status;
-    return new Response(data, { status: finalStatus, headers: finalHeaders });
+    this._rawBody = data;
+    if (!headers && !this.response.hasPopulatedHeaders) {
+      this._finalResponse = new Response(data, {
+        status: finalStatus,
+        headers: { "content-type": "text/plain; charset=utf-8" }
+      });
+      return this._finalResponse;
+    }
+    const finalHeaders = this.mergeHeaders(headers);
+    finalHeaders.set("content-type", "text/plain; charset=utf-8");
+    this._finalResponse = new Response(data, { status: finalStatus, headers: finalHeaders });
+    return this._finalResponse;
   }
   /**
    * Respond with HTML content
    */
   html(html, status, headers) {
-    const finalHeaders = this.mergeHeaders(headers);
-    finalHeaders.set("content-type", "text/html");
     const finalStatus = status ?? this.response.status;
-    return new Response(html, { status: finalStatus, headers: finalHeaders });
+    const finalHeaders = this.mergeHeaders(headers);
+    finalHeaders.set("content-type", "text/html; charset=utf-8");
+    this._rawBody = html;
+    this._finalResponse = new Response(html, { status: finalStatus, headers: finalHeaders });
+    return this._finalResponse;
   }
   /**
    * Respond with a redirect
@@ -253,7 +385,8 @@ class ShokupanContext {
   redirect(url, status = 302) {
     const headers = this.mergeHeaders();
     headers.set("Location", url);
-    return new Response(null, { status, headers });
+    this._finalResponse = new Response(null, { status, headers });
+    return this._finalResponse;
   }
   /**
    * Respond with a status code
@@ -261,15 +394,26 @@ class ShokupanContext {
    */
   status(status) {
     const headers = this.mergeHeaders();
-    return new Response(null, { status, headers });
+    this._finalResponse = new Response(null, { status, headers });
+    return this._finalResponse;
   }
   /**
    * Respond with a file
    */
-  file(path, fileOptions, responseOptions) {
+  async file(path, fileOptions, responseOptions) {
     const headers = this.mergeHeaders(responseOptions?.headers);
     const status = responseOptions?.status ?? this.response.status;
-    return new Response(Bun.file(path, fileOptions), { status, headers });
+    if (typeof Bun !== "undefined") {
+      this._finalResponse = new Response(Bun.file(path, fileOptions), { status, headers });
+      return this._finalResponse;
+    } else {
+      const fileBuffer = await readFile(path);
+      if (fileOptions?.type) {
+        headers.set("content-type", fileOptions.type);
+      }
+      this._finalResponse = new Response(fileBuffer, { status, headers });
+      return this._finalResponse;
+    }
   }
   /**
    * JSX Rendering Function
@@ -289,6 +433,74 @@ class ShokupanContext {
     return this.html(html, status, headers);
   }
 }
+function RateLimitMiddleware(options = {}) {
+  const windowMs = options.windowMs || 60 * 1e3;
+  const max = options.limit || options.max || 5;
+  const message = options.message || "Too many requests, please try again later.";
+  const statusCode = options.statusCode || 429;
+  const headers = options.headers !== false;
+  const mode = options.mode || "user";
+  const keyGenerator = options.keyGenerator || ((ctx) => {
+    if (mode === "absolute") {
+      return "global";
+    }
+    return ctx.headers.get("x-forwarded-for") || ctx.request.headers.get("x-forwarded-for") || ctx.server?.requestIP?.(ctx.request)?.address || "unknown";
+  });
+  const skip = options.skip || (() => false);
+  const hits = /* @__PURE__ */ new Map();
+  const interval = setInterval(() => {
+    const now = Date.now();
+    for (const [key, record] of hits.entries()) {
+      if (record.resetTime <= now) {
+        hits.delete(key);
+      }
+    }
+  }, windowMs);
+  if (interval.unref) interval.unref();
+  const rateLimitMiddleware = async function RateLimitMiddleware2(ctx, next) {
+    if (skip(ctx)) return next();
+    const key = keyGenerator(ctx);
+    const now = Date.now();
+    let record = hits.get(key);
+    if (!record || record.resetTime <= now) {
+      record = {
+        hits: 0,
+        resetTime: now + windowMs
+      };
+      hits.set(key, record);
+    }
+    record.hits++;
+    const remaining = Math.max(0, max - record.hits);
+    const resetTime = Math.ceil(record.resetTime / 1e3);
+    const retryAfter = Math.ceil((record.resetTime - now) / 1e3);
+    const setHeaders = (res) => {
+      if (!headers || !res || !res.headers) return;
+      try {
+        res.headers.set("X-RateLimit-Limit", String(max));
+        res.headers.set("X-RateLimit-Remaining", String(remaining));
+        res.headers.set("X-RateLimit-Reset", String(resetTime));
+      } catch (e) {
+      }
+    };
+    if (record.hits > max) {
+      typeof message === "object" ? JSON.stringify(message) : String(message);
+      const res = typeof message === "object" ? ctx.json(message, statusCode) : ctx.text(String(message), statusCode);
+      if (headers) {
+        setHeaders(res);
+        res.headers.set("Retry-After", String(retryAfter));
+      }
+      return res;
+    }
+    const response = await next();
+    if (response instanceof Response && headers) {
+      setHeaders(response);
+    }
+    return response;
+  };
+  rateLimitMiddleware.isBuiltin = true;
+  rateLimitMiddleware.pluginName = "RateLimit";
+  return rateLimitMiddleware;
+}
 const $isApplication = /* @__PURE__ */ Symbol.for("Shokupan.app");
 const $appRoot = /* @__PURE__ */ Symbol.for("Shokupan.app-root");
 const $isMounted = /* @__PURE__ */ Symbol("Shokupan.isMounted");
@@ -385,6 +597,9 @@ const Patch = createMethodDecorator("PATCH");
 const Options = createMethodDecorator("OPTIONS");
 const Head = createMethodDecorator("HEAD");
 const All = createMethodDecorator("ALL");
+function RateLimit(options) {
+  return Use(RateLimitMiddleware(options));
+}
 class Container {
   static services = /* @__PURE__ */ new Map();
   static register(target, instance) {
@@ -418,69 +633,43 @@ function Inject(token) {
     });
   };
 }
-const tracer = trace.getTracer("shokupan.middleware");
-function traceMiddleware(fn, name) {
-  const middlewareName = fn.name || "anonymous middleware";
-  return async (ctx, next) => {
-    return tracer.startActiveSpan(`middleware - ${middlewareName}`, {
-      kind: SpanKind.INTERNAL,
-      attributes: {
-        "code.function": middlewareName,
-        "component": "shokupan.middleware"
-      }
-    }, async (span) => {
-      try {
-        const result = await fn(ctx, next);
-        return result;
-      } catch (err) {
-        span.recordException(err);
-        span.setStatus({ code: SpanStatusCode.ERROR, message: err.message });
-        throw err;
-      } finally {
-        span.end();
-      }
-    });
-  };
-}
-function traceHandler(fn, name) {
-  return async function(...args) {
-    return tracer.startActiveSpan(`route handler - ${name}`, {
-      kind: SpanKind.INTERNAL,
-      attributes: {
-        "http.route": name,
-        "component": "shokupan.route"
-      }
-    }, async (span) => {
+const compose = (middleware) => {
+  if (!middleware.length) {
+    return (context2, next) => {
+      return next ? next() : Promise.resolve();
+    };
+  }
+  return function dispatch(context2, next) {
+    let index = -1;
+    async function runner(i) {
+      if (i <= index) return Promise.reject(new Error("next() called multiple times"));
+      index = i;
+      if (i >= middleware.length) {
+        return next ? next() : Promise.resolve();
+      }
+      const fn = middleware[i];
+      if (!context2._debug) {
+        return fn(context2, () => runner(i + 1));
+      }
+      const debug = context2._debug;
+      const debugId = fn._debugId || fn.name || "anonymous";
+      const previousNode = debug.getCurrentNode();
+      debug.trackEdge(previousNode, debugId);
+      debug.setNode(debugId);
+      const start = performance.now();
       try {
-        const result = await fn.apply(this, args);
-        return result;
+        const res = await Promise.resolve(fn(context2, () => runner(i + 1)));
+        debug.trackStep(debugId, "middleware", performance.now() - start, "success");
+        return res;
       } catch (err) {
-        span.recordException(err);
-        span.setStatus({ code: SpanStatusCode.ERROR, message: err.message });
-        throw err;
+        debug.trackStep(debugId, "middleware", performance.now() - start, "error", err);
+        return Promise.reject(err);
       } finally {
-        span.end();
+        if (previousNode) debug.setNode(previousNode);
       }
-    });
-  };
-}
-const compose = (middleware) => {
-  function fn(context2, next) {
-    let runner = next || (async () => {
-    });
-    for (let i = middleware.length - 1; i >= 0; i--) {
-      const fn2 = traceMiddleware(middleware[i]);
-      const nextStep = runner;
-      let called = false;
-      runner = async () => {
-        if (called) throw new Error("next() called multiple times");
-        called = true;
-        return fn2(context2, nextStep);
-      };
     }
-    return runner();
-  }
-  return fn;
+    return runner(0);
+  };
 };
 class ShokupanRequestBase {
   method;
@@ -538,6 +727,15 @@ function deepMerge(target, ...sources) {
   }
   return deepMerge(target, ...sources);
 }
+const REGEX_QUERY_INT = /parseInt\(ctx\.query\.(\w+)\)/g;
+const REGEX_QUERY_FLOAT = /parseFloat\(ctx\.query\.(\w+)\)/g;
+const REGEX_QUERY_NUMBER = /Number\(ctx\.query\.(\w+)\)/g;
+const REGEX_QUERY_BOOL = /(?:Boolean\(ctx\.query\.(\w+)\)|!+ctx\.query\.(\w+))/g;
+const REGEX_QUERY_GENERIC = /ctx\.query\.(\w+)/g;
+const REGEX_PARAM_INT = /parseInt\(ctx\.params\.(\w+)\)/g;
+const REGEX_PARAM_FLOAT = /parseFloat\(ctx\.params\.(\w+)\)/g;
+const REGEX_HEADER_GET = /ctx\.get\(['"](\w+)['"]\)/g;
+const REGEX_ERROR_STATUS = /ctx\.(?:json|text|html)\([^)]+,\s*(\d{3,})\)/g;
 function analyzeHandler(handler) {
   const handlerSource = handler.toString();
   const inferredSpec = {};
@@ -547,46 +745,28 @@ function analyzeHandler(handler) {
     };
   }
   const queryParams = /* @__PURE__ */ new Map();
-  const queryIntMatch = handlerSource.match(/parseInt\(ctx\.query\.(\w+)\)/g);
-  if (queryIntMatch) {
-    queryIntMatch.forEach((match) => {
-      const paramName = match.match(/ctx\.query\.(\w+)/)?.[1];
-      if (paramName) queryParams.set(paramName, { type: "integer", format: "int32" });
-    });
+  for (const match of handlerSource.matchAll(REGEX_QUERY_INT)) {
+    if (match[1]) queryParams.set(match[1], { type: "integer", format: "int32" });
   }
-  const queryFloatMatch = handlerSource.match(/parseFloat\(ctx\.query\.(\w+)\)/g);
-  if (queryFloatMatch) {
-    queryFloatMatch.forEach((match) => {
-      const paramName = match.match(/ctx\.query\.(\w+)/)?.[1];
-      if (paramName) queryParams.set(paramName, { type: "number", format: "float" });
-    });
+  for (const match of handlerSource.matchAll(REGEX_QUERY_FLOAT)) {
+    if (match[1]) queryParams.set(match[1], { type: "number", format: "float" });
   }
-  const queryNumberMatch = handlerSource.match(/Number\(ctx\.query\.(\w+)\)/g);
-  if (queryNumberMatch) {
-    queryNumberMatch.forEach((match) => {
-      const paramName = match.match(/ctx\.query\.(\w+)/)?.[1];
-      if (paramName && !queryParams.has(paramName)) {
-        queryParams.set(paramName, { type: "number" });
-      }
-    });
+  for (const match of handlerSource.matchAll(REGEX_QUERY_NUMBER)) {
+    if (match[1] && !queryParams.has(match[1])) {
+      queryParams.set(match[1], { type: "number" });
+    }
   }
-  const queryBoolMatch = handlerSource.match(/(?:Boolean\(ctx\.query\.(\w+)\)|!+ctx\.query\.(\w+))/g);
-  if (queryBoolMatch) {
-    queryBoolMatch.forEach((match) => {
-      const paramName = match.match(/ctx\.query\.(\w+)/)?.[1];
-      if (paramName && !queryParams.has(paramName)) {
-        queryParams.set(paramName, { type: "boolean" });
-      }
-    });
+  for (const match of handlerSource.matchAll(REGEX_QUERY_BOOL)) {
+    const name = match[1] || match[2];
+    if (name && !queryParams.has(name)) {
+      queryParams.set(name, { type: "boolean" });
+    }
   }
-  const queryMatch = handlerSource.match(/ctx\.query\.(\w+)/g);
-  if (queryMatch) {
-    queryMatch.forEach((match) => {
-      const paramName = match.split(".")[2];
-      if (paramName && !queryParams.has(paramName)) {
-        queryParams.set(paramName, { type: "string" });
-      }
-    });
+  for (const match of handlerSource.matchAll(REGEX_QUERY_GENERIC)) {
+    const name = match[1];
+    if (name && !queryParams.has(name)) {
+      queryParams.set(name, { type: "string" });
+    }
   }
   if (queryParams.size > 0) {
     if (!inferredSpec.parameters) inferredSpec.parameters = [];
@@ -599,19 +779,11 @@ function analyzeHandler(handler) {
     });
   }
   const pathParams = /* @__PURE__ */ new Map();
-  const paramIntMatch = handlerSource.match(/parseInt\(ctx\.params\.(\w+)\)/g);
-  if (paramIntMatch) {
-    paramIntMatch.forEach((match) => {
-      const paramName = match.match(/ctx\.params\.(\w+)/)?.[1];
-      if (paramName) pathParams.set(paramName, { type: "integer", format: "int32" });
-    });
+  for (const match of handlerSource.matchAll(REGEX_PARAM_INT)) {
+    if (match[1]) pathParams.set(match[1], { type: "integer", format: "int32" });
   }
-  const paramFloatMatch = handlerSource.match(/parseFloat\(ctx\.params\.(\w+)\)/g);
-  if (paramFloatMatch) {
-    paramFloatMatch.forEach((match) => {
-      const paramName = match.match(/ctx\.params\.(\w+)/)?.[1];
-      if (paramName) pathParams.set(paramName, { type: "number", format: "float" });
-    });
+  for (const match of handlerSource.matchAll(REGEX_PARAM_FLOAT)) {
+    if (match[1]) pathParams.set(match[1], { type: "number", format: "float" });
   }
   if (pathParams.size > 0) {
     if (!inferredSpec.parameters) inferredSpec.parameters = [];
@@ -624,76 +796,55 @@ function analyzeHandler(handler) {
       });
     });
   }
-  const headerMatch = handlerSource.match(/ctx\.get\(['"](\w+)['"]\)/g);
-  if (headerMatch) {
-    if (!inferredSpec.parameters) inferredSpec.parameters = [];
-    headerMatch.forEach((match) => {
-      const headerName = match.match(/['"](\w+)['"]/)?.[1];
-      if (headerName) {
-        inferredSpec.parameters.push({
-          name: headerName,
-          in: "header",
-          schema: { type: "string" }
-        });
-      }
-    });
+  for (const match of handlerSource.matchAll(REGEX_HEADER_GET)) {
+    if (match[1]) {
+      if (!inferredSpec.parameters) inferredSpec.parameters = [];
+      inferredSpec.parameters.push({
+        name: match[1],
+        in: "header",
+        schema: { type: "string" }
+      });
+    }
   }
   const responses = {};
   if (handlerSource.includes("ctx.json(")) {
     responses["200"] = {
       description: "Successful response",
-      content: {
-        "application/json": { schema: { type: "object" } }
-      }
+      content: { "application/json": { schema: { type: "object" } } }
     };
   }
   if (handlerSource.includes("ctx.html(")) {
     responses["200"] = {
       description: "Successful response",
-      content: {
-        "text/html": { schema: { type: "string" } }
-      }
+      content: { "text/html": { schema: { type: "string" } } }
     };
   }
   if (handlerSource.includes("ctx.text(")) {
     responses["200"] = {
       description: "Successful response",
-      content: {
-        "text/plain": { schema: { type: "string" } }
-      }
+      content: { "text/plain": { schema: { type: "string" } } }
     };
   }
   if (handlerSource.includes("ctx.file(")) {
     responses["200"] = {
       description: "File download",
-      content: {
-        "application/octet-stream": { schema: { type: "string", format: "binary" } }
-      }
+      content: { "application/octet-stream": { schema: { type: "string", format: "binary" } } }
     };
   }
   if (handlerSource.includes("ctx.redirect(")) {
-    responses["302"] = {
-      description: "Redirect"
-    };
+    responses["302"] = { description: "Redirect" };
   }
   if (!responses["200"] && /return\s+\{/.test(handlerSource)) {
     responses["200"] = {
       description: "Successful response",
-      content: {
-        "application/json": { schema: { type: "object" } }
-      }
+      content: { "application/json": { schema: { type: "object" } } }
     };
   }
-  const errorStatusMatch = handlerSource.match(/ctx\.(?:json|text|html)\([^)]+,\s*(\d{3,})\)/g);
-  if (errorStatusMatch) {
-    errorStatusMatch.forEach((match) => {
-      const statusCode = match.match(/,\s*(\d{3,})\)/)?.[1];
-      if (statusCode && statusCode !== "200") {
-        responses[statusCode] = {
-          description: `Error response (${statusCode})`
-        };
-      }
-    });
+  for (const match of handlerSource.matchAll(REGEX_ERROR_STATUS)) {
+    const statusCode = match[1];
+    if (statusCode && statusCode !== "200") {
+      responses[statusCode] = { description: `Error response (${statusCode})` };
+    }
   }
   if (Object.keys(responses).length > 0) {
     inferredSpec.responses = responses;
@@ -707,7 +858,7 @@ async function generateOpenApi(rootRouter, options = {}) {
   const defaultTagName = options.defaultTag || "Application";
   let astRoutes = [];
   try {
-    const { OpenAPIAnalyzer: OpenAPIAnalyzer2 } = await import("./openapi-analyzer-cjdGeQ5a.js");
+    const { OpenAPIAnalyzer: OpenAPIAnalyzer2 } = await import("./openapi-analyzer-BtIaHIfe.js");
     const analyzer = new OpenAPIAnalyzer2(process.cwd());
     const { applications } = await analyzer.analyze();
     const appMap = /* @__PURE__ */ new Map();
@@ -977,10 +1128,10 @@ async function generateOpenApi(rootRouter, options = {}) {
   };
 }
 const eta$1 = new Eta();
-function serveStatic(ctx, config, prefix) {
+function serveStatic(config, prefix) {
   const rootPath = resolve(config.root || ".");
   const normalizedPrefix = prefix.endsWith("/") && prefix !== "/" ? prefix.slice(0, -1) : prefix;
-  return async () => {
+  const serveStaticMiddleware = async (ctx) => {
     let relative = ctx.path.slice(normalizedPrefix.length);
     if (!relative.startsWith("/") && relative.length > 0) relative = "/" + relative;
     if (relative.length === 0) relative = "/";
@@ -1097,16 +1248,209 @@ function serveStatic(ctx, config, prefix) {
         }
       }
     }
-    const file = Bun.file(finalPath);
-    let response = new Response(file);
+    let response;
+    if (typeof Bun !== "undefined") {
+      response = new Response(Bun.file(finalPath));
+    } else {
+      const fileBuffer = await readFile$1(finalPath);
+      response = new Response(fileBuffer);
+    }
     if (config.hooks?.onResponse) {
       const hooked = await config.hooks.onResponse(ctx, response);
       if (hooked) response = hooked;
     }
     return response;
   };
+  serveStaticMiddleware.isBuiltin = true;
+  serveStaticMiddleware.pluginName = "ServeStatic";
+  return serveStaticMiddleware;
+}
+class RouterTrie {
+  root;
+  constructor() {
+    this.root = this.createNode();
+  }
+  createNode() {
+    return {
+      children: {}
+    };
+  }
+  insert(method, path, handler) {
+    let node = this.root;
+    const segments = this.splitPath(path);
+    for (const segment of segments) {
+      if (segment === "**") {
+        if (!node.recursiveChild) {
+          node.recursiveChild = this.createNode();
+        }
+        node = node.recursiveChild;
+      } else if (segment === "*") {
+        if (!node.wildcardChild) {
+          node.wildcardChild = this.createNode();
+        }
+        node = node.wildcardChild;
+      } else if (segment.startsWith(":")) {
+        const paramName = segment.slice(1);
+        if (!node.paramChild) {
+          node.paramChild = this.createNode();
+          node.paramChild.paramName = paramName;
+        }
+        node = node.paramChild;
+        node.paramName = paramName;
+      } else {
+        if (!node.children[segment]) {
+          node.children[segment] = this.createNode();
+        }
+        node = node.children[segment];
+      }
+    }
+    if (!node.handlers) {
+      node.handlers = {};
+    }
+    node.handlers[method] = handler;
+  }
+  search(method, path) {
+    const segments = this.splitPath(path);
+    const params = {};
+    const match = this.findNode(this.root, segments, 0, params);
+    if (match && match.handlers) {
+      const handler = match.handlers[method] || match.handlers["ALL"];
+      if (handler) {
+        return { handler, params };
+      }
+      if (method === "HEAD" && match.handlers["GET"]) {
+        return { handler: match.handlers["GET"], params };
+      }
+    }
+    return null;
+  }
+  findNode(node, segments, index, params) {
+    if (index === segments.length) {
+      if (node.handlers) return node;
+      if (node.recursiveChild && node.recursiveChild.handlers) {
+        return node.recursiveChild;
+      }
+      return null;
+    }
+    const segment = segments[index];
+    const child = node.children[segment];
+    if (child) {
+      const result = this.findNode(child, segments, index + 1, params);
+      if (result) return result;
+    }
+    if (node.paramChild) {
+      params[node.paramChild.paramName] = segment;
+      const result = this.findNode(node.paramChild, segments, index + 1, params);
+      if (result) return result;
+      delete params[node.paramChild.paramName];
+    }
+    if (node.wildcardChild) {
+      const result = this.findNode(node.wildcardChild, segments, index + 1, params);
+      if (result) return result;
+    }
+    if (node.recursiveChild) {
+      const remaining = segments.length - index;
+      for (let k = 0; k <= remaining; k++) {
+        const result = this.findNode(node.recursiveChild, segments, index + k, params);
+        if (result) return result;
+      }
+    }
+    return null;
+  }
+  splitPath(path) {
+    if (path === "/" || path === "") return [];
+    const s = path.startsWith("/") ? path.slice(1) : path;
+    if (s === "") return [];
+    return s.split("/");
+  }
 }
 const asyncContext = new AsyncLocalStorage();
+const engine = process.env["SHOKUPAN_DB_ENGINE"] === "memory" ? "mem://" : "rocksdb://database";
+const db = new Surreal({
+  engines: createNodeEngines()
+});
+const ready = db.connect(engine, { namespace: "vendor", database: "shokupan" }).then(() => {
+  return db.query(`
+        DEFINE TABLE OVERWRITE failed_requests SCHEMALESS COMMENT "Created by Shokupan";
+        DEFINE TABLE OVERWRITE sessions SCHEMALESS COMMENT "Created by Shokupan";
+        DEFINE TABLE OVERWRITE users SCHEMALESS COMMENT "Created by Shokupan";
+        DEFINE TABLE OVERWRITE idempotency_keys SCHEMALESS COMMENT "Created by Shokupan";
+        DEFINE TABLE OVERWRITE middleware_tracking SCHEMALESS COMMENT "Created by Shokupan";
+    `);
+});
+const datastore = {
+  get(store, key) {
+    return db.select(new RecordId(store, key));
+  },
+  set(store, key, value) {
+    return db.create(new RecordId(store, key)).content(value);
+  },
+  async query(query, vars) {
+    try {
+      const r = await db.query(query, vars).collect();
+      return r;
+    } catch (e) {
+      console.error("DS ERROR:", e);
+      throw e;
+    }
+  },
+  ready
+};
+process.on("exit", async () => {
+  await db.close();
+});
+const tracer = trace.getTracer("shokupan.middleware");
+function traceHandler(fn, name) {
+  return async function(...args) {
+    return tracer.startActiveSpan(`route handler - ${name}`, {
+      kind: SpanKind.INTERNAL,
+      attributes: {
+        "http.route": name,
+        "component": "shokupan.route"
+      }
+    }, async (span) => {
+      try {
+        const result = await fn.apply(this, args);
+        return result;
+      } catch (err) {
+        span.recordException(err);
+        span.setStatus({ code: SpanStatusCode.ERROR, message: err.message });
+        throw err;
+      } finally {
+        span.end();
+      }
+    });
+  };
+}
+function getCallerInfo(skipFrames = 1) {
+  let file = "unknown";
+  let line = 0;
+  try {
+    const err = new Error();
+    const stack = err.stack?.split("\n") || [];
+    let found = 0;
+    for (let i = 1; i < stack.length; i++) {
+      const l = stack[i];
+      if (!l.includes(":")) continue;
+      if (l.includes("node_modules")) continue;
+      if (l.includes("bun:main")) continue;
+      if (l.includes("src/util/stack.ts")) continue;
+      if (l.includes("src/router.ts")) continue;
+      if (l.includes("src/shokupan.ts")) continue;
+      found++;
+      if (found >= skipFrames) {
+        const match = l.match(/\((.*):(\d+):(\d+)\)/) || l.match(/at (.*):(\d+):(\d+)/);
+        if (match) {
+          file = match[1];
+          line = parseInt(match[2], 10);
+          return { file, line };
+        }
+      }
+    }
+  } catch (e) {
+  }
+  return { file, line };
+}
 const RouterRegistry = /* @__PURE__ */ new Map();
 const ShokupanApplicationTree = {};
 class ShokupanRouter {
@@ -1126,6 +1470,7 @@ class ShokupanRouter {
   [$parent] = null;
   [$childRouters] = [];
   [$childControllers] = [];
+  middleware = [];
   get rootConfig() {
     return this[$appRoot]?.applicationConfig;
   }
@@ -1134,7 +1479,54 @@ class ShokupanRouter {
   }
   [$routes] = [];
   // Public via Symbol for OpenAPI generator
+  trie = new RouterTrie();
+  metadata;
+  // Metadata for the router itself
   currentGuards = [];
+  // Registry Accessor
+  getComponentRegistry() {
+    const routes = this[$routes].map((r) => ({
+      type: "route",
+      path: r.path,
+      method: r.method,
+      metadata: r.metadata,
+      handlerName: r.handler.name,
+      tags: r.handlerSpec?.tags,
+      order: r.order,
+      _fn: r.handler
+      // Expose handler for debugging instrumentation
+    }));
+    const mw = this.middleware;
+    const middleware = mw ? mw.map((m) => ({
+      name: m.name || "middleware",
+      metadata: m.metadata,
+      order: m.order,
+      _fn: m
+      // Expose function for debugging instrumentation
+    })) : [];
+    const routers = this[$childRouters].map((r) => ({
+      type: "router",
+      path: r[$mountPath],
+      metadata: r.metadata,
+      children: r.getComponentRegistry()
+    }));
+    const controllers = this[$childControllers].map((c) => {
+      return {
+        type: "controller",
+        path: c[$mountPath] || "/",
+        name: c.constructor.name,
+        metadata: c.metadata
+        // Check if we can store this
+      };
+    });
+    return {
+      metadata: this.metadata,
+      middleware,
+      routes,
+      routers,
+      controllers
+    };
+  }
   isRouterInstance(target) {
     return typeof target === "object" && target !== null && $isRouter in target;
   }
@@ -1160,6 +1552,14 @@ class ShokupanRouter {
         throw new Error("Router is already mounted");
       }
       controller[$mountPath] = prefix;
+      if (!controller.metadata) {
+        const info = getCallerInfo();
+        controller.metadata = {
+          file: info.file,
+          line: info.line,
+          name: "MountedRouter"
+        };
+      }
       this[$childRouters].push(controller);
       controller[$parent] = this;
       const setRouterContext = (router) => {
@@ -1192,6 +1592,12 @@ class ShokupanRouter {
         }
       }
       instance[$mountPath] = prefix;
+      const info = getCallerInfo();
+      instance.metadata = {
+        file: info.file,
+        line: info.line,
+        name: instance.constructor.name
+      };
       this[$childControllers].push(instance);
       const controllerMiddleware = (typeof controller === "function" ? controller[$middleware] : instance[$middleware]) || [];
       const proto = Object.getPrototypeOf(instance);
@@ -1275,14 +1681,39 @@ class ShokupanRouter {
               for (const arg of sortedArgs) {
                 switch (arg.type) {
                   case RouteParamType.BODY:
-                    args[arg.index] = await ctx.req.json().catch(() => ({}));
+                    try {
+                      if (ctx.req.headers.get("content-type")?.includes("application/json")) {
+                        args[arg.index] = await ctx.req.json();
+                      } else {
+                        const text = await ctx.req.text();
+                        if (!text) {
+                          args[arg.index] = {};
+                        } else {
+                          args[arg.index] = JSON.parse(text);
+                        }
+                      }
+                    } catch (e) {
+                      const err = new Error("Invalid JSON body");
+                      err.status = 400;
+                      throw err;
+                    }
                     break;
                   case RouteParamType.PARAM:
                     args[arg.index] = arg.name ? ctx.params[arg.name] : ctx.params;
                     break;
                   case RouteParamType.QUERY: {
                     const url = new URL(ctx.req.url);
-                    args[arg.index] = arg.name ? url.searchParams.get(arg.name) : Object.fromEntries(url.searchParams);
+                    if (arg.name) {
+                      const vals = url.searchParams.getAll(arg.name);
+                      args[arg.index] = vals.length > 1 ? vals : vals[0];
+                    } else {
+                      const query = {};
+                      for (const key of url.searchParams.keys()) {
+                        const vals = url.searchParams.getAll(key);
+                        query[key] = vals.length > 1 ? vals : vals[0];
+                      }
+                      args[arg.index] = query;
+                    }
                     break;
                   }
                   case RouteParamType.HEADER:
@@ -1297,7 +1728,7 @@ class ShokupanRouter {
                 }
               }
             }
-            const tracedOriginalHandler = traceHandler(originalHandler, normalizedPath);
+            const tracedOriginalHandler = ctx.app?.applicationConfig.enableTracing ? traceHandler(originalHandler, normalizedPath) : originalHandler;
             return tracedOriginalHandler.apply(instance, args);
           };
           let finalHandler = wrappedHandler;
@@ -1430,29 +1861,59 @@ class ShokupanRouter {
       data: result
     };
   }
-  applyHooks(match) {
+  applyRouterHooks(match) {
     if (!this.config?.hooks) return match;
     const hooks = this.config.hooks;
-    const originalHandler = match.handler;
-    match.handler = async (ctx) => {
-      if (hooks.onRequestStart) await hooks.onRequestStart(ctx);
-      try {
-        const result = await originalHandler(ctx);
-        if (hooks.onRequestEnd) await hooks.onRequestEnd(ctx);
-        return result;
+    return {
+      ...match,
+      handler: this.wrapWithHooks(match.handler, hooks)
+    };
+  }
+  wrapWithHooks(handler, hooks) {
+    const hookList = Array.isArray(hooks) ? hooks : [hooks];
+    const hasStart = hookList.some((h) => !!h.onRequestStart);
+    const hasEnd = hookList.some((h) => !!h.onRequestEnd);
+    const hasError = hookList.some((h) => !!h.onError);
+    if (!hasStart && !hasEnd && !hasError) return handler;
+    const originalHandler = handler;
+    const wrapped = async (ctx) => {
+      if (hasStart) {
+        for (let i = 0; i < hookList.length; i++) {
+          const h = hookList[i];
+          if (typeof h.onRequestStart === "function") await h.onRequestStart(ctx);
+        }
+      }
+      const debug = ctx._debug;
+      let debugId;
+      let previousNode;
+      if (debug) {
+        debugId = originalHandler._debugId || originalHandler.name || "handler";
+        previousNode = debug.getCurrentNode();
+        debug.trackEdge(previousNode, debugId);
+        debug.setNode(debugId);
+      }
+      const start = performance.now();
+      try {
+        const res = await originalHandler(ctx);
+        debug?.trackStep(debugId, "handler", performance.now() - start, "success");
+        for (let i = 0; i < hookList.length; i++) {
+          const h = hookList[i];
+          if (typeof h.onRequestEnd === "function") await h.onRequestEnd(ctx);
+        }
+        return res;
       } catch (err) {
-        if (hooks.onError) {
-          try {
-            await hooks.onError(err, ctx);
-          } catch (e) {
-            console.error("Error in router onError hook:", e);
-          }
+        debug?.trackStep(debugId, "handler", performance.now() - start, "error", err);
+        for (let i = 0; i < hookList.length; i++) {
+          const h = hookList[i];
+          if (typeof h.onError === "function") await h.onError(err, ctx);
         }
         throw err;
+      } finally {
+        if (debug && previousNode) debug.setNode(previousNode);
       }
     };
-    match.handler.originalHandler = originalHandler.originalHandler || originalHandler;
-    return match;
+    wrapped.originalHandler = originalHandler.originalHandler ?? originalHandler;
+    return wrapped;
   }
   /**
    * Find a route matching the given method and path.
@@ -1461,29 +1922,24 @@ class ShokupanRouter {
    * @returns Route handler and parameters if found, otherwise null
    */
   find(method, path) {
-    for (const route of this[$routes]) {
-      if (route.method !== "ALL" && route.method !== method) continue;
-      const match = route.regex.exec(path);
-      if (match) {
-        const params = {};
-        route.keys.forEach((key, index) => {
-          params[key] = match[index + 1];
-        });
-        return this.applyHooks({ handler: route.handler, params });
-      }
+    let result = this.trie.search(method, path);
+    if (result) return result;
+    if (method === "HEAD") {
+      result = this.trie.search("GET", path);
+      if (result) return result;
     }
     for (const child of this[$childRouters]) {
       const prefix = child[$mountPath];
       if (path === prefix || path.startsWith(prefix + "/")) {
         const subPath = path.slice(prefix.length) || "/";
         const match = child.find(method, subPath);
-        if (match) return this.applyHooks(match);
+        if (match) return this.applyRouterHooks(match);
       }
       if (prefix.endsWith("/")) {
         if (path.startsWith(prefix)) {
           const subPath = path.slice(prefix.length) || "/";
           const match = child.find(method, subPath);
-          if (match) return this.applyHooks(match);
+          if (match) return this.applyRouterHooks(match);
         }
       }
     }
@@ -1494,7 +1950,7 @@ class ShokupanRouter {
     const pattern = path.replace(/:([a-zA-Z0-9_]+)/g, (_, key) => {
       keys.push(key);
       return "([^/]+)";
-    }).replace(/\*/g, ".*");
+    }).replace(/\*\*/g, ".*").replace(/\*/g, "[^/]+");
     return {
       regex: new RegExp(`^${pattern}$`),
       keys
@@ -1563,18 +2019,84 @@ class ShokupanRouter {
         return innerHandler(ctx);
       };
     }
+    const { file, line } = getCallerInfo();
+    const trackingHandler = wrappedHandler;
+    wrappedHandler = async (ctx) => {
+      if (!ctx.app?.applicationConfig.enableMiddlewareTracking) {
+        return trackingHandler(ctx);
+      }
+      const startTime = performance.now();
+      let error = void 0;
+      try {
+        if (ctx.app?.applicationConfig.enableMiddlewareTracking) {
+          ctx.handlerStack.push({
+            name: handler.name || "anonymous",
+            file,
+            line
+          });
+        }
+        return await trackingHandler(ctx);
+      } catch (e) {
+        error = e;
+        throw e;
+      } finally {
+        if (ctx.app?.applicationConfig.enableMiddlewareTracking) {
+          const duration = performance.now() - startTime;
+          const config = ctx.app.applicationConfig;
+          try {
+            const timestamp = Date.now();
+            const key = `${timestamp}-${handler.name || "anonymous"}-${Math.random().toString(36).substring(7)}`;
+            await datastore.set("middleware_tracking", key, {
+              name: handler.name || "anonymous",
+              path: ctx.path,
+              timestamp,
+              duration,
+              file,
+              line,
+              error: error ? String(error) : void 0,
+              metadata: {
+                isBuiltin: handler.isBuiltin,
+                pluginName: handler.pluginName
+              }
+            });
+            const ttl = config.middlewareTrackingTTL ?? 864e5;
+            const maxCapacity = config.middlewareTrackingMaxCapacity ?? 1e4;
+            const cutoff = Date.now() - ttl;
+            await datastore.query(`DELETE middleware_tracking WHERE timestamp < ${cutoff}`);
+            const results = await datastore.query("SELECT count() FROM middleware_tracking GROUP ALL");
+            if (results && results[0] && results[0].count > maxCapacity) {
+              const toDelete = results[0].count - maxCapacity;
+              await datastore.query(`DELETE middleware_tracking ORDER BY timestamp ASC LIMIT ${toDelete}`);
+            }
+          } catch (datastoreError) {
+            console.error("Failed to store middleware tracking:", datastoreError);
+          }
+        }
+      }
+    };
+    wrappedHandler.originalHandler = trackingHandler.originalHandler || trackingHandler;
+    let bakedHandler = wrappedHandler;
+    if (this.config?.hooks) {
+      bakedHandler = this.wrapWithHooks(wrappedHandler, this.config.hooks);
+    }
     this[$routes].push({
       method,
       path,
-      regex,
-      keys,
-      handler: wrappedHandler,
+      regex: regex ?? new RegExp(""),
+      keys: keys ?? [],
+      handler,
+      bakedHandler,
       handlerSpec: spec,
       group,
-      guards: routeGuards.length > 0 ? routeGuards : void 0,
-      requestTimeout: effectiveTimeout
-      // Save for inspection? Or just relying on closure
+      hooks: this.config?.hooks,
+      requestTimeout,
+      renderer,
+      metadata: {
+        file,
+        line
+      }
     });
+    this.trie.insert(method, path, bakedHandler);
     return this;
   }
   get(path, ...args) {
@@ -1608,7 +2130,35 @@ class ShokupanRouter {
   guard(specOrHandler, handler) {
     const spec = typeof specOrHandler === "function" ? void 0 : specOrHandler;
     const guardHandler = typeof specOrHandler === "function" ? specOrHandler : handler;
-    this.currentGuards.push({ handler: guardHandler, spec });
+    let file = "unknown";
+    let line = 0;
+    try {
+      const err = new Error();
+      const stack = err.stack?.split("\n") || [];
+      const callerLine = stack.find(
+        (l) => l.includes(":") && !l.includes("router.ts") && !l.includes("shokupan.ts") && !l.includes("node_modules") && !l.includes("bun:main")
+      );
+      if (callerLine) {
+        const match = callerLine.match(/\((.*):(\d+):(\d+)\)/) || callerLine.match(/at (.*):(\d+):(\d+)/);
+        if (match) {
+          file = match[1];
+          line = parseInt(match[2], 10);
+        }
+      }
+    } catch (e) {
+    }
+    const trackedGuard = async (ctx, next) => {
+      if (ctx.app?.applicationConfig.enableMiddlewareTracking) {
+        ctx.handlerStack.push({
+          name: guardHandler.name || "guard",
+          file,
+          line
+        });
+      }
+      return guardHandler(ctx, next);
+    };
+    trackedGuard.originalHandler = guardHandler.originalHandler || guardHandler;
+    this.currentGuards.push({ handler: trackedGuard, spec });
     return this;
   }
   /**
@@ -1620,10 +2170,10 @@ class ShokupanRouter {
     const config = typeof options === "string" ? { root: options } : options;
     const prefix = uriPath.startsWith("/") ? uriPath : "/" + uriPath;
     const normalizedPrefix = prefix.endsWith("/") && prefix !== "/" ? prefix.slice(0, -1) : prefix;
-    serveStatic(null, config, prefix);
+    const handlerMiddleware = serveStatic(config, prefix);
     const routeHandler = async (ctx) => {
-      const runner = serveStatic(ctx, config, prefix);
-      return runner();
+      return handlerMiddleware(ctx, async () => {
+      });
     };
     let groupName = "Static";
     const segments = normalizedPrefix.split("/").filter(Boolean);
@@ -1684,6 +2234,49 @@ class ShokupanRouter {
     return generateOpenApi(this, options);
   }
 }
+class SystemCpuMonitor {
+  constructor(intervalMs = 1e3) {
+    this.intervalMs = intervalMs;
+  }
+  interval = null;
+  lastCpus = [];
+  currentUsage = 0;
+  start() {
+    if (this.interval) return;
+    this.lastCpus = os.cpus();
+    this.interval = setInterval(() => this.update(), this.intervalMs);
+  }
+  stop() {
+    if (this.interval) {
+      clearInterval(this.interval);
+      this.interval = null;
+    }
+  }
+  getUsage() {
+    return this.currentUsage;
+  }
+  update() {
+    const cpus = os.cpus();
+    let idle = 0;
+    let total = 0;
+    for (let i = 0; i < cpus.length; i++) {
+      const cpu = cpus[i];
+      const prev = this.lastCpus[i];
+      let type;
+      for (type in cpu.times) {
+        const ticks = cpu.times[type];
+        const prevTicks = prev.times[type];
+        const diff = ticks - prevTicks;
+        total += diff;
+        if (type === "idle") {
+          idle += diff;
+        }
+      }
+    }
+    this.lastCpus = cpus;
+    this.currentUsage = total === 0 ? 0 : (1 - idle / total) * 100;
+  }
+}
 const defaults = {
   port: 3e3,
   hostname: "localhost",
@@ -1695,21 +2288,59 @@ trace.getTracer("shokupan.application");
 class Shokupan extends ShokupanRouter {
   applicationConfig = {};
   openApiSpec;
-  middleware = [];
+  composedMiddleware;
+  cpuMonitor;
+  hookCache = /* @__PURE__ */ new Map();
+  hooksInitialized = false;
   get logger() {
     return this.applicationConfig.logger;
   }
   constructor(applicationConfig = {}) {
-    super();
+    const config = Object.assign({}, defaults, applicationConfig);
+    const { hooks, ...routerConfig } = config;
+    super(routerConfig);
     this[$isApplication] = true;
     this[$appRoot] = this;
-    Object.assign(this.applicationConfig, defaults, applicationConfig);
+    this.applicationConfig = config;
+    const { file, line } = getCallerInfo();
+    this.metadata = {
+      file,
+      line,
+      name: "ShokupanApplication"
+    };
   }
   /**
    * Adds middleware to the application.
    */
   use(middleware) {
-    this.middleware.push(middleware);
+    let trackedMiddleware = middleware;
+    const { file, line } = getCallerInfo();
+    if (!middleware.metadata) {
+      middleware.metadata = {
+        file,
+        line,
+        name: middleware.name || "middleware",
+        isBuiltin: middleware.isBuiltin,
+        pluginName: middleware.pluginName
+      };
+    }
+    trackedMiddleware = async (ctx, next) => {
+      const c = ctx;
+      if (c.handlerStack && c.app?.applicationConfig.enableMiddlewareTracking) {
+        const metadata = middleware.metadata || {};
+        c.handlerStack.push({
+          name: metadata.pluginName ? `${metadata.pluginName} (${metadata.name})` : metadata.name || middleware.name || "middleware",
+          file: metadata.file || file,
+          line: metadata.line || line,
+          isBuiltin: metadata.isBuiltin
+        });
+      }
+      return middleware(ctx, next);
+    };
+    trackedMiddleware.metadata = middleware.metadata;
+    Object.defineProperty(trackedMiddleware, "name", { value: middleware.name || "middleware" });
+    trackedMiddleware.order = this.middleware.length;
+    this.middleware.push(trackedMiddleware);
     return this;
   }
   startupHooks = [];
@@ -1720,6 +2351,15 @@ class Shokupan extends ShokupanRouter {
     this.startupHooks.push(callback);
     return this;
   }
+  specAvailableHooks = [];
+  /**
+   * Registers a callback to be executed when the OpenAPI spec is available.
+   * This happens after generateOpenApi() but before the server starts listening (or at least before it finishes startup if async).
+   */
+  onSpecAvailable(callback) {
+    this.specAvailableHooks.push(callback);
+    return this;
+  }
   /**
    * Starts the application server.
    * 
@@ -1736,17 +2376,43 @@ class Shokupan extends ShokupanRouter {
     }
     if (this.applicationConfig.enableOpenApiGen) {
       this.openApiSpec = await generateOpenApi(this);
+      for (const hook of this.specAvailableHooks) {
+        await hook(this.openApiSpec);
+      }
     }
     if (port === 0 && process.platform === "linux") ;
+    if (this.applicationConfig.autoBackpressureFeedback) {
+      this.cpuMonitor = new SystemCpuMonitor();
+      this.cpuMonitor.start();
+    }
     const serveOptions = {
       port: finalPort,
       hostname: this.applicationConfig.hostname,
       development: this.applicationConfig.development,
       fetch: this.fetch.bind(this),
       reusePort: this.applicationConfig.reusePort,
-      idleTimeout: this.applicationConfig.readTimeout ? this.applicationConfig.readTimeout / 1e3 : void 0
+      idleTimeout: this.applicationConfig.readTimeout ? this.applicationConfig.readTimeout / 1e3 : void 0,
+      websocket: {
+        open(ws) {
+          ws.data?.handler?.open?.(ws);
+        },
+        message(ws, message) {
+          ws.data?.handler?.message?.(ws, message);
+        },
+        drain(ws) {
+          ws.data?.handler?.drain?.(ws);
+        },
+        close(ws, code, reason) {
+          ws.data?.handler?.close?.(ws, code, reason);
+        }
+      }
     };
-    const server = this.applicationConfig.serverFactory ? await this.applicationConfig.serverFactory(serveOptions) : Bun.serve(serveOptions);
+    let factory = this.applicationConfig.serverFactory;
+    if (!factory && typeof Bun === "undefined") {
+      const { createHttpServer } = await import("./server-adapter-BWrEJbKL.js");
+      factory = createHttpServer();
+    }
+    const server = factory ? await factory(serveOptions) : Bun.serve(serveOptions);
     console.log(`Shokupan server listening on http://${server.hostname}:${server.port}`);
     return server;
   }
@@ -1801,110 +2467,165 @@ class Shokupan extends ShokupanRouter {
    * @returns The response to send.
    */
   async fetch(req, server) {
-    const tracer2 = trace.getTracer("shokupan.application");
-    const store = asyncContext.getStore();
-    const attrs = {
-      attributes: {
-        "http.url": req.url,
-        "http.method": req.method
-      }
-    };
-    const parent = store?.get("span");
-    const ctx = parent ? trace.setSpan(context.active(), parent) : void 0;
-    return tracer2.startActiveSpan(`${req.method} ${new URL(req.url).pathname}`, attrs, ctx, (span) => {
+    if (this.applicationConfig.enableTracing) {
+      const tracer2 = trace.getTracer("shokupan.application");
+      const store = asyncContext.getStore();
+      const attrs = {
+        attributes: {
+          "http.url": req.url,
+          "http.method": req.method
+        }
+      };
+      const parent = store?.get("span");
+      const ctx = parent ? trace.setSpan(context.active(), parent) : void 0;
+      return tracer2.startActiveSpan(`${req.method} ${new URL(req.url).pathname}`, attrs, ctx, (span) => {
+        const ctxMap = /* @__PURE__ */ new Map();
+        ctxMap.set("span", span);
+        ctxMap.set("request", req);
+        return asyncContext.run(ctxMap, () => this.handleRequest(req, server).finally(() => span.end()));
+      });
+    }
+    if (this.applicationConfig.enableAsyncLocalStorage) {
       const ctxMap = /* @__PURE__ */ new Map();
-      ctxMap.set("span", span);
       ctxMap.set("request", req);
-      const runCallback = () => {
-        const request = req;
-        const ctx2 = new ShokupanContext(request, server, void 0, this);
-        const handle = async () => {
-          try {
-            if (this.applicationConfig.hooks?.onRequestStart) {
-              await this.applicationConfig.hooks.onRequestStart(ctx2);
-            }
-            const fn = compose(this.middleware);
-            const result = await fn(ctx2, async () => {
-              const match = this.find(req.method, ctx2.path);
-              if (match) {
-                ctx2.params = match.params;
-                return match.handler(ctx2);
-              }
-              return null;
-            });
-            let response;
-            if (result instanceof Response) {
-              response = result;
-            } else if (result === null || result === void 0) {
-              span.setAttribute("http.status_code", 404);
-              response = ctx2.text("Not Found", 404);
-            } else if (typeof result === "object") {
-              response = ctx2.json(result);
-            } else {
-              response = ctx2.text(String(result));
-            }
-            if (this.applicationConfig.hooks?.onRequestEnd) {
-              await this.applicationConfig.hooks.onRequestEnd(ctx2);
-            }
-            if (this.applicationConfig.hooks?.onResponseStart) {
-              await this.applicationConfig.hooks.onResponseStart(ctx2, response);
-            }
-            return response;
-          } catch (err) {
-            console.error(err);
-            span.recordException(err);
-            span.setStatus({ code: 2 });
-            const status = err.status || err.statusCode || 500;
-            const body = { error: err.message || "Internal Server Error" };
-            if (err.errors) body.errors = err.errors;
-            if (this.applicationConfig.hooks?.onError) {
-              try {
-                await this.applicationConfig.hooks.onError(err, ctx2);
-              } catch (hookErr) {
-                console.error("Error in onError hook:", hookErr);
-              }
-            }
-            return ctx2.json(body, status);
-          }
-        };
-        let executionPromise = handle();
-        const timeoutMs = this.applicationConfig.requestTimeout;
-        if (timeoutMs && timeoutMs > 0 && this.applicationConfig.hooks?.onRequestTimeout) {
-          let timeoutId;
-          const timeoutPromise = new Promise((_, reject) => {
-            timeoutId = setTimeout(async () => {
-              try {
-                if (this.applicationConfig.hooks?.onRequestTimeout) {
-                  await this.applicationConfig.hooks.onRequestTimeout(ctx2);
-                }
-              } catch (e) {
-                console.error("Error in onRequestTimeout hook:", e);
-              }
-              reject(new Error("Request Timeout"));
-            }, timeoutMs);
-          });
-          executionPromise = Promise.race([executionPromise, timeoutPromise]).finally(() => clearTimeout(timeoutId));
+      return asyncContext.run(ctxMap, () => this.handleRequest(req, server));
+    }
+    return this.handleRequest(req, server);
+  }
+  async handleRequest(req, server) {
+    const request = req;
+    const controller = new AbortController();
+    const ctx = new ShokupanContext(request, server, void 0, this, controller.signal, this.applicationConfig.enableMiddlewareTracking);
+    const handle = async () => {
+      if (this.cpuMonitor && this.cpuMonitor.getUsage() > (this.applicationConfig.autoBackpressureLevel ?? 60)) {
+        const msg = "Too Many Requests (CPU Backpressure)";
+        const res = ctx.text(msg, 429);
+        await this.executeHook("onResponseEnd", ctx, res);
+        return res;
+      }
+      try {
+        if (this.hasHook("onRequestStart")) {
+          await this.executeHook("onRequestStart", ctx);
         }
-        return executionPromise.catch((err) => {
-          if (err.message === "Request Timeout") {
-            return ctx2.text("Request Timeout", 408);
+        const fn = this.composedMiddleware ??= compose(this.middleware);
+        const result = await fn(ctx, async () => {
+          const match = this.find(req.method, ctx.path);
+          if (match) {
+            ctx.params = match.params;
+            return match.handler(ctx);
           }
-          console.error("Unexpected error in request execution:", err);
-          return ctx2.text("Internal Server Error", 500);
-        }).then(async (res) => {
-          if (this.applicationConfig.hooks?.onResponseEnd) {
-            await this.applicationConfig.hooks.onResponseEnd(ctx2, res);
+          return null;
+        });
+        let response;
+        if (result instanceof Response) {
+          response = result;
+        } else if ((result === null || result === void 0) && ctx._finalResponse instanceof Response) {
+          response = ctx._finalResponse;
+        } else if (result === null || result === void 0) {
+          if (ctx._finalResponse instanceof Response) {
+            response = ctx._finalResponse;
+          } else if (ctx.response.status !== 200 || ctx.response.hasPopulatedHeaders) {
+            response = ctx.send(null, { status: ctx.response.status, headers: ctx.response.headers });
+          } else {
+            response = ctx.text("Not Found", 404);
           }
-          return res;
-        }).finally(() => span.end());
-      };
-      if (this.applicationConfig.enableAsyncLocalStorage) {
-        return asyncContext.run(ctxMap, runCallback);
-      } else {
-        return runCallback();
+        } else if (typeof result === "object") {
+          response = ctx.json(result);
+        } else {
+          response = ctx.text(String(result));
+        }
+        if (this.hasHook("onRequestEnd")) {
+          await this.executeHook("onRequestEnd", ctx);
+        }
+        if (this.hasHook("onResponseStart")) {
+          await this.executeHook("onResponseStart", ctx, response);
+        }
+        return response;
+      } catch (err) {
+        console.error(err);
+        const span = asyncContext.getStore()?.get("span");
+        if (span) span.setStatus({ code: 2 });
+        const status = err.status || err.statusCode || 500;
+        const body = { error: err.message || "Internal Server Error" };
+        if (err.errors) body.errors = err.errors;
+        if (this.hasHook("onError")) {
+          await this.executeHook("onError", err, ctx);
+        }
+        return ctx.json(body, status);
       }
+    };
+    let executionPromise = handle();
+    const timeoutMs = this.applicationConfig.requestTimeout;
+    if (timeoutMs && timeoutMs > 0) {
+      let timeoutId;
+      const timeoutPromise = new Promise((_, reject) => {
+        timeoutId = setTimeout(async () => {
+          controller.abort();
+          if (this.hasHook("onRequestTimeout")) {
+            await this.executeHook("onRequestTimeout", ctx);
+          }
+          reject(new Error("Request Timeout"));
+        }, timeoutMs);
+      });
+      executionPromise = Promise.race([executionPromise, timeoutPromise]).finally(() => clearTimeout(timeoutId));
+    }
+    return executionPromise.catch((err) => {
+      if (err.message === "Request Timeout") {
+        return ctx.text("Request Timeout", 408);
+      }
+      console.error("Unexpected error in request execution:", err);
+      return ctx.text("Internal Server Error", 500);
+    }).then(async (res) => {
+      if (this.hasHook("onResponseEnd")) {
+        await this.executeHook("onResponseEnd", ctx, res);
+      }
+      return res;
     });
   }
+  ensureHooksInitialized() {
+    const hooks = this.applicationConfig.hooks;
+    if (hooks) {
+      const hookList = Array.isArray(hooks) ? hooks : [hooks];
+      const hookTypes = [
+        "onRequestStart",
+        "onRequestEnd",
+        "onResponseStart",
+        "onResponseEnd",
+        "onError",
+        "beforeValidate",
+        "afterValidate",
+        "onRequestTimeout",
+        "onReadTimeout",
+        "onWriteTimeout"
+      ];
+      for (const type of hookTypes) {
+        const fns = [];
+        for (const h of hookList) {
+          if (h[type]) fns.push(h[type]);
+        }
+        if (fns.length > 0) {
+          this.hookCache.set(type, fns);
+        }
+      }
+    }
+    this.hooksInitialized = true;
+  }
+  async executeHook(name, ...args) {
+    if (!this.hooksInitialized) {
+      this.ensureHooksInitialized();
+    }
+    const fns = this.hookCache.get(name);
+    if (!fns) return;
+    for (const fn of fns) {
+      await fn(...args);
+    }
+  }
+  hasHook(name) {
+    if (!this.hooksInitialized) {
+      this.ensureHooksInitialized();
+    }
+    return this.hookCache.has(name);
+  }
 }
 class AuthPlugin extends ShokupanRouter {
   constructor(authConfig) {
@@ -2109,7 +2830,7 @@ class AuthPlugin extends ShokupanRouter {
   /**
    * Middleware to verify JWT
    */
-  middleware() {
+  getMiddleware() {
     return async (ctx, next) => {
       const authHeader = ctx.req.headers.get("Authorization");
       let token = authHeader?.startsWith("Bearer ") ? authHeader.substring(7) : null;
@@ -2129,19 +2850,44 @@ class AuthPlugin extends ShokupanRouter {
   }
 }
 function Compression(options = {}) {
-  const threshold = options.threshold ?? 1024;
-  return async (ctx, next) => {
+  const threshold = options.threshold ?? 512;
+  const compressionMiddleware = async function CompressionMiddleware(ctx, next) {
     const acceptEncoding = ctx.headers.get("accept-encoding") || "";
     let method = null;
     if (acceptEncoding.includes("br")) method = "br";
-    else if (acceptEncoding.includes("gzip")) method = "gzip";
+    else if (acceptEncoding.includes("zstd")) {
+      if (typeof Bun === "undefined") {
+        throw new Error("zstd compression is only available in Bun runtime. Client requested zstd but server is running on Node.js.");
+      }
+      method = "zstd";
+    } else if (acceptEncoding.includes("gzip")) method = "gzip";
     else if (acceptEncoding.includes("deflate")) method = "deflate";
     if (!method) return next();
-    const response = await next();
+    let response = await next();
+    if (!(response instanceof Response) && ctx._finalResponse instanceof Response) {
+      response = ctx._finalResponse;
+    }
     if (response instanceof Response) {
       if (response.headers.has("Content-Encoding")) return response;
-      const body = await response.arrayBuffer();
-      if (body.byteLength < threshold) {
+      let body;
+      let bodySize;
+      if (ctx._rawBody !== void 0) {
+        if (typeof ctx._rawBody === "string") {
+          const encoded = new TextEncoder().encode(ctx._rawBody);
+          body = encoded.buffer;
+          bodySize = encoded.byteLength;
+        } else if (ctx._rawBody instanceof Uint8Array) {
+          body = ctx._rawBody.buffer;
+          bodySize = ctx._rawBody.byteLength;
+        } else {
+          body = ctx._rawBody;
+          bodySize = ctx._rawBody.byteLength;
+        }
+      } else {
+        body = await response.arrayBuffer();
+        bodySize = body.byteLength;
+      }
+      if (bodySize < threshold) {
         return new Response(body, {
           status: response.status,
           statusText: response.statusText,
@@ -2149,17 +2895,36 @@ function Compression(options = {}) {
         });
       }
       let compressed;
-      if (method === "br") {
-        compressed = require("node:zlib").brotliCompressSync(body);
-      } else if (method === "gzip") {
-        compressed = Bun.gzipSync(body);
-      } else {
-        compressed = Bun.deflateSync(body);
+      switch (method) {
+        case "br":
+          compressed = await new Promise((res, rej) => zlib.brotliCompress(body, {
+            params: {
+              [zlib.constants.BROTLI_PARAM_QUALITY]: 4
+            }
+          }, (err, data) => {
+            if (err) return rej(err);
+            res(data);
+          }));
+          break;
+        case "gzip":
+          compressed = await new Promise((res, rej) => zlib.gzip(body, (err, data) => {
+            if (err) return rej(err);
+            res(data);
+          }));
+          break;
+        case "zstd":
+          compressed = await Bun.zstdCompress(body);
+          break;
+        default:
+          compressed = await new Promise((res, rej) => zlib.deflate(body, (err, data) => {
+            if (err) return rej(err);
+            res(data);
+          }));
+          break;
       }
       const headers = new Headers(response.headers);
       headers.set("Content-Encoding", method);
       headers.set("Content-Length", String(compressed.length));
-      headers.delete("Content-Length");
       return new Response(compressed, {
         status: response.status,
         statusText: response.statusText,
@@ -2168,6 +2933,9 @@ function Compression(options = {}) {
     }
     return response;
   };
+  compressionMiddleware.isBuiltin = true;
+  compressionMiddleware.pluginName = "Compression";
+  return compressionMiddleware;
 }
 function Cors(options = {}) {
   const defaults2 = {
@@ -2177,7 +2945,7 @@ function Cors(options = {}) {
     optionsSuccessStatus: 204
   };
   const opts = { ...defaults2, ...options };
-  return async (ctx, next) => {
+  const corsMiddleware = async function CorsMiddleware(ctx, next) {
     const headers = new Headers();
     const origin = ctx.headers.get("origin");
     const set = (k, v) => headers.set(k, v);
@@ -2239,6 +3007,9 @@ function Cors(options = {}) {
     }
     return response;
   };
+  corsMiddleware.isBuiltin = true;
+  corsMiddleware.pluginName = "Cors";
+  return corsMiddleware;
 }
 function useExpress(expressMiddleware) {
   return async (ctx, next) => {
@@ -2300,122 +3071,409 @@ function useExpress(expressMiddleware) {
     });
   };
 }
-function RateLimit(options = {}) {
-  const windowMs = options.windowMs || 60 * 1e3;
-  const max = options.max || 5;
-  const message = options.message || "Too many requests, please try again later.";
-  const statusCode = options.statusCode || 429;
-  const headers = options.headers !== false;
-  const keyGenerator = options.keyGenerator || ((ctx) => {
-    return ctx.headers.get("x-forwarded-for") || ctx.url.hostname || "unknown";
-  });
-  const skip = options.skip || (() => false);
-  const hits = /* @__PURE__ */ new Map();
-  const interval = setInterval(() => {
-    const now = Date.now();
-    for (const [key, record] of hits.entries()) {
-      if (record.resetTime <= now) {
-        hits.delete(key);
-      }
-    }
-  }, windowMs);
-  if (interval.unref) interval.unref();
-  return async (ctx, next) => {
-    if (skip(ctx)) return next();
-    const key = keyGenerator(ctx);
-    const now = Date.now();
-    let record = hits.get(key);
-    if (!record || record.resetTime <= now) {
-      record = {
-        hits: 0,
-        resetTime: now + windowMs
-      };
-      hits.set(key, record);
-    }
-    record.hits++;
-    const remaining = Math.max(0, max - record.hits);
-    const resetTime = Math.ceil(record.resetTime / 1e3);
-    if (record.hits > max) {
-      if (headers) {
-        const res = typeof message === "object" ? ctx.json(message, statusCode) : ctx.text(String(message), statusCode);
-        res.headers.set("X-RateLimit-Limit", String(max));
-        res.headers.set("X-RateLimit-Remaining", "0");
-        res.headers.set("X-RateLimit-Reset", String(resetTime));
-        return res;
-      }
-      return typeof message === "object" ? ctx.json(message, statusCode) : ctx.text(String(message), statusCode);
-    }
-    const response = await next();
-    if (response instanceof Response && headers) {
-      response.headers.set("X-RateLimit-Limit", String(max));
-      response.headers.set("X-RateLimit-Remaining", String(remaining));
-      response.headers.set("X-RateLimit-Reset", String(resetTime));
-    }
-    return response;
-  };
+class ValidationError extends Error {
+  constructor(errors) {
+    super("Validation Error");
+    this.errors = errors;
+  }
+  status = 400;
 }
-const eta = new Eta();
-class ScalarPlugin extends ShokupanRouter {
-  constructor(pluginOptions) {
-    super();
-    this.pluginOptions = pluginOptions;
-    this.init();
+function isZod(schema) {
+  return typeof schema?.safeParse === "function";
+}
+async function validateZod(schema, data) {
+  const result = await schema.safeParseAsync(data);
+  if (!result.success) {
+    throw new ValidationError(result.error.errors);
   }
-  init() {
-    this.get("/", (ctx) => {
-      let path = ctx.url.toString();
-      if (!path.endsWith("/")) path += "/";
-      return ctx.html(eta.renderString(`<!doctype html>
-                <html>
-                <head>
-                    <title>API Reference</title>
-                    <meta charset = "utf-8" />
-                    <meta name="viewport" content = "width=device-width, initial-scale=1" />
-                </head>
-
-                <body>
-                    <div id="app"></div>
-
-                    <script src="<%= it.path %>scalar.js"><\/script>
-                    <script>
-                        Scalar.createApiReference('#app', [{ ...<%~ JSON.stringify(it.config.baseDocument) %>,
-                            url: "<%= it.path %>openapi.json",
-                        }
-                    ])
-                    <\/script>
-                </body>
-
-                </html>`, { path, config: this.pluginOptions }));
-    });
-    this.get("/scalar.js", (ctx) => {
-      return ctx.file(__dirname + "/../../node_modules/@scalar/api-reference/dist/browser/standalone.js");
-    });
-    this.get("/openapi.json", async (ctx) => {
-      let spec;
-      if (this.root.openApiSpec) {
-        try {
-          spec = structuredClone(this.root.openApiSpec);
-        } catch (e) {
-          spec = Object.assign({}, this.root.openApiSpec);
-        }
-      } else {
-        spec = await (this.root || this).generateApiSpec();
-      }
-      if (this.pluginOptions.baseDocument) {
-        deepMerge(spec, this.pluginOptions.baseDocument);
-      }
-      return ctx.json(spec);
-    });
+  return result.data;
+}
+function isTypeBox(schema) {
+  return typeof schema?.Check === "function" && typeof schema?.Errors === "function";
+}
+function validateTypeBox(schema, data) {
+  if (!schema.Check(data)) {
+    throw new ValidationError([...schema.Errors(data)]);
   }
-  // New lifecycle method to be called by router.mount
-  onMount(parent) {
-    if (parent.onStart) {
-      parent.onStart(async () => {
-        if (this.pluginOptions.enableStaticAnalysis) {
-          try {
-            const entrypoint = process.argv[1];
-            console.log(`[ScalarPlugin] Running eager static analysis on entrypoint: ${entrypoint}`);
-            const analyzer = new OpenAPIAnalyzer(process.cwd(), entrypoint);
+  return data;
+}
+function isAjv(schema) {
+  return typeof schema === "function" && "errors" in schema;
+}
+function validateAjv(schema, data) {
+  const valid = schema(data);
+  if (!valid) {
+    throw new ValidationError(schema.errors);
+  }
+  return data;
+}
+const valibot = (schema, parser) => {
+  return {
+    _valibot: true,
+    schema,
+    parser
+  };
+};
+function isValibotWrapper(schema) {
+  return schema?._valibot === true;
+}
+async function validateValibotWrapper(wrapper, data) {
+  const result = await wrapper.parser(wrapper.schema, data);
+  if (!result.success) {
+    throw new ValidationError(result.issues);
+  }
+  return result.output;
+}
+function isClass(schema) {
+  try {
+    if (typeof schema === "function" && /^\s*class\s+/.test(schema.toString())) {
+      return true;
+    }
+    return typeof schema === "function" && schema.prototype && schema.name;
+  } catch {
+    return false;
+  }
+}
+async function validateClassValidator(schema, data) {
+  const object = plainToInstance(schema, data);
+  try {
+    await validateOrReject(object);
+    return object;
+  } catch (errors) {
+    const formattedErrors = Array.isArray(errors) ? errors.map((err) => ({
+      property: err.property,
+      constraints: err.constraints,
+      children: err.children
+    })) : errors;
+    throw new ValidationError(formattedErrors);
+  }
+}
+const safelyGetBody = async (ctx) => {
+  const req = ctx.req;
+  if (req._bodyParsed) {
+    return req._bodyValue;
+  }
+  try {
+    let data;
+    if (typeof req.json === "function") {
+      data = await req.json();
+    } else {
+      data = req.body;
+      if (typeof data === "string") {
+        try {
+          data = JSON.parse(data);
+        } catch {
+        }
+      }
+    }
+    req._bodyParsed = true;
+    req._bodyValue = data;
+    Object.defineProperty(req, "json", {
+      value: async () => req._bodyValue,
+      configurable: true
+    });
+    return data;
+  } catch (e) {
+    return {};
+  }
+};
+function getValidator(schema) {
+  if (isZod(schema)) {
+    return (data) => validateZod(schema, data);
+  }
+  if (isTypeBox(schema)) {
+    return (data) => validateTypeBox(schema, data);
+  }
+  if (isAjv(schema)) {
+    return (data) => validateAjv(schema, data);
+  }
+  if (isValibotWrapper(schema)) {
+    return (data) => validateValibotWrapper(schema, data);
+  }
+  if (isClass(schema)) {
+    return (data) => validateClassValidator(schema, data);
+  }
+  if (typeof schema === "function") {
+    return schema;
+  }
+  throw new Error("Unknown validator type provided. Please use a supported library (Zod, Ajv, TypeBox) or a custom function.");
+}
+function validate(config) {
+  const validators = {};
+  if (config.params) validators.params = getValidator(config.params);
+  if (config.query) validators.query = getValidator(config.query);
+  if (config.headers) validators.headers = getValidator(config.headers);
+  if (config.body) validators.body = getValidator(config.body);
+  return async (ctx, next) => {
+    const dataToValidate = {};
+    if (config.params) dataToValidate.params = ctx.params;
+    let queryObj;
+    if (config.query) {
+      const url = new URL(ctx.req.url);
+      queryObj = Object.fromEntries(url.searchParams.entries());
+      dataToValidate.query = queryObj;
+    }
+    if (config.headers) dataToValidate.headers = Object.fromEntries(ctx.req.headers.entries());
+    let body;
+    if (config.body) {
+      body = await safelyGetBody(ctx);
+      dataToValidate.body = body;
+    }
+    if (ctx.app?.applicationConfig.hooks?.beforeValidate) {
+      await ctx.app.applicationConfig.hooks.beforeValidate(ctx, dataToValidate);
+    }
+    if (validators.params) {
+      ctx.params = await validators.params(ctx.params);
+    }
+    let validQuery;
+    if (validators.query && queryObj) {
+      validQuery = await validators.query(queryObj);
+    }
+    if (validators.headers) {
+      const headersObj = Object.fromEntries(ctx.req.headers.entries());
+      await validators.headers(headersObj);
+    }
+    let validBody;
+    if (validators.body) {
+      const b = body ?? await safelyGetBody(ctx);
+      validBody = await validators.body(b);
+      const req = ctx.req;
+      req._bodyValue = validBody;
+      Object.defineProperty(req, "json", {
+        value: async () => validBody,
+        configurable: true
+      });
+      ctx.body = validBody;
+    }
+    if (ctx.app?.applicationConfig.hooks?.afterValidate) {
+      const validatedData = { ...dataToValidate };
+      if (config.params) validatedData.params = ctx.params;
+      if (config.query) validatedData.query = validQuery;
+      if (config.body) validatedData.body = validBody;
+      await ctx.app.applicationConfig.hooks.afterValidate(ctx, validatedData);
+    }
+    return next();
+  };
+}
+const ajv = new Ajv({ coerceTypes: true, allErrors: true });
+addFormats(ajv);
+const compiledValidators = /* @__PURE__ */ new WeakMap();
+function openApiValidator() {
+  return async (ctx, next) => {
+    const app = ctx.app;
+    if (!app || !app.openApiSpec) {
+      return next();
+    }
+    let cache = compiledValidators.get(app);
+    if (!cache) {
+      cache = compileValidators(app.openApiSpec);
+      compiledValidators.set(app, cache);
+    }
+    let matchPath;
+    let matchParams = {};
+    if (cache.validators.has(ctx.path)) {
+      matchPath = ctx.path;
+    } else {
+      for (const [path, { regex, paramNames }] of cache.paths) {
+        const match = regex.exec(ctx.path);
+        if (match) {
+          matchPath = path;
+          paramNames.forEach((name, i) => {
+            matchParams[name] = match[i + 1];
+          });
+          break;
+        }
+      }
+    }
+    if (!matchPath) {
+      return next();
+    }
+    const method = ctx.req.method.toLowerCase();
+    const validators = cache.validators.get(matchPath)?.[method];
+    if (!validators) {
+      return next();
+    }
+    const errors = [];
+    if (validators.body) {
+      let body;
+      try {
+        body = await ctx.req.json().catch(() => ({}));
+      } catch {
+        body = {};
+      }
+      const valid = validators.body(body);
+      if (!valid && validators.body.errors) {
+        errors.push(...validators.body.errors.map((e) => ({ ...e, location: "body" })));
+      }
+    }
+    if (validators.query) {
+      const query = Object.fromEntries(new URL(ctx.req.url).searchParams.entries());
+      const valid = validators.query(query);
+      if (!valid && validators.query.errors) {
+        errors.push(...validators.query.errors.map((e) => ({ ...e, location: "query" })));
+      }
+    }
+    if (validators.params) {
+      const params = { ...matchParams, ...ctx.params };
+      const valid = validators.params(params);
+      if (!valid && validators.params.errors) {
+        errors.push(...validators.params.errors.map((e) => ({ ...e, location: "path" })));
+      }
+    }
+    if (validators.headers) {
+      const headers = Object.fromEntries(ctx.req.headers.entries());
+      const valid = validators.headers(headers);
+      if (!valid && validators.headers.errors) {
+        errors.push(...validators.headers.errors.map((e) => ({ ...e, location: "header" })));
+      }
+    }
+    if (errors.length > 0) {
+      throw new ValidationError(errors);
+    }
+    return next();
+  };
+}
+function compileValidators(spec) {
+  const validators = /* @__PURE__ */ new Map();
+  const paths = /* @__PURE__ */ new Map();
+  for (const [path, pathItem] of Object.entries(spec.paths || {})) {
+    if (path.includes("{")) {
+      const paramNames = [];
+      const regexStr = "^" + path.replace(/{([^}]+)}/g, (_, name) => {
+        paramNames.push(name);
+        return "([^/]+)";
+      }) + "$";
+      paths.set(path, {
+        regex: new RegExp(regexStr),
+        paramNames
+      });
+    }
+    const pathValidators = {};
+    for (const [method, operation] of Object.entries(pathItem)) {
+      if (method === "parameters" || method === "summary" || method === "description") continue;
+      const oper = operation;
+      const opValidators = {};
+      if (oper.requestBody?.content?.["application/json"]?.schema) {
+        opValidators.body = ajv.compile(oper.requestBody.content["application/json"].schema);
+      }
+      const parameters = [...oper.parameters || [], ...pathItem.parameters || []];
+      const queryProps = {};
+      const pathProps = {};
+      const headerProps = {};
+      const queryRequired = [];
+      const pathRequired = [];
+      const headerRequired = [];
+      for (const param of parameters) {
+        if (param.in === "query") {
+          queryProps[param.name] = param.schema || {};
+          if (param.required) queryRequired.push(param.name);
+        } else if (param.in === "path") {
+          pathProps[param.name] = param.schema || {};
+          pathRequired.push(param.name);
+        } else if (param.in === "header") {
+          headerProps[param.name] = param.schema || {};
+          if (param.required) headerRequired.push(param.name);
+        }
+      }
+      if (Object.keys(queryProps).length > 0) {
+        opValidators.query = ajv.compile({
+          type: "object",
+          properties: queryProps,
+          required: queryRequired.length > 0 ? queryRequired : void 0
+        });
+      }
+      if (Object.keys(pathProps).length > 0) {
+        opValidators.params = ajv.compile({
+          type: "object",
+          properties: pathProps,
+          required: pathRequired.length > 0 ? pathRequired : void 0
+        });
+      }
+      if (Object.keys(headerProps).length > 0) {
+        opValidators.headers = ajv.compile({
+          type: "object",
+          properties: headerProps,
+          required: headerRequired.length > 0 ? headerRequired : void 0
+        });
+      }
+      pathValidators[method] = opValidators;
+    }
+    validators.set(path, pathValidators);
+  }
+  return { paths, validators };
+}
+function precompileValidators(app, spec) {
+  const cache = compileValidators(spec);
+  compiledValidators.set(app, cache);
+}
+function enableOpenApiValidation(app) {
+  app.use(openApiValidator());
+  app.onSpecAvailable((spec) => {
+    precompileValidators(app, spec);
+  });
+}
+const eta = new Eta();
+class ScalarPlugin extends ShokupanRouter {
+  constructor(pluginOptions) {
+    super();
+    this.pluginOptions = pluginOptions;
+    this.init();
+  }
+  init() {
+    this.get("/", (ctx) => {
+      let path = ctx.url.toString();
+      if (!path.endsWith("/")) path += "/";
+      return ctx.html(eta.renderString(`<!doctype html>
+                <html>
+                <head>
+                    <title>API Reference</title>
+                    <meta charset = "utf-8" />
+                    <meta name="viewport" content = "width=device-width, initial-scale=1" />
+                </head>
+
+                <body>
+                    <div id="app"></div>
+
+                    <script src="<%= it.path %>scalar.js"><\/script>
+                    <script>
+                        Scalar.createApiReference('#app', [{ ...<%~ JSON.stringify(it.config.baseDocument) %>,
+                            url: "<%= it.path %>openapi.json",
+                        }
+                    ])
+                    <\/script>
+                </body>
+
+                </html>`, { path, config: this.pluginOptions }));
+    });
+    this.get("/scalar.js", (ctx) => {
+      return ctx.file(__dirname + "/../../node_modules/@scalar/api-reference/dist/browser/standalone.js");
+    });
+    this.get("/openapi.json", async (ctx) => {
+      let spec;
+      if (this.root.openApiSpec) {
+        try {
+          spec = structuredClone(this.root.openApiSpec);
+        } catch (e) {
+          spec = Object.assign({}, this.root.openApiSpec);
+        }
+      } else {
+        spec = await (this.root || this).generateApiSpec();
+      }
+      if (this.pluginOptions.baseDocument) {
+        deepMerge(spec, this.pluginOptions.baseDocument);
+      }
+      return ctx.json(spec);
+    });
+  }
+  // New lifecycle method to be called by router.mount
+  onMount(parent) {
+    if (parent.onStart) {
+      parent.onStart(async () => {
+        if (this.pluginOptions.enableStaticAnalysis) {
+          try {
+            const entrypoint = process.argv[1];
+            console.log(`[ScalarPlugin] Running eager static analysis on entrypoint: ${entrypoint}`);
+            const analyzer = new OpenAPIAnalyzer(process.cwd(), entrypoint);
             let staticSpec = await analyzer.analyze();
             if (!this.pluginOptions.baseDocument) this.pluginOptions.baseDocument = {};
             deepMerge(this.pluginOptions.baseDocument, staticSpec);
@@ -2429,7 +3487,7 @@ class ScalarPlugin extends ShokupanRouter {
   }
 }
 function SecurityHeaders(options = {}) {
-  return async (ctx, next) => {
+  const securityHeadersMiddleware = async function SecurityHeadersMiddleware(ctx, next) {
     const headers = {};
     const set = (k, v) => headers[k] = v;
     if (options.dnsPrefetchControl !== false) {
@@ -2483,6 +3541,9 @@ function SecurityHeaders(options = {}) {
     }
     return response;
   };
+  securityHeadersMiddleware.isBuiltin = true;
+  securityHeadersMiddleware.pluginName = "SecurityHeaders";
+  return securityHeadersMiddleware;
 }
 class Cookie {
   maxAge;
@@ -2596,7 +3657,7 @@ function Session(options) {
   const resave = options.resave === void 0 ? true : options.resave;
   const saveUninitialized = options.saveUninitialized === void 0 ? true : options.saveUninitialized;
   const rolling = options.rolling || false;
-  return async (ctx, next) => {
+  const sessionMiddleware = async function SessionMiddleware(ctx, next) {
     let reqSessionId = null;
     const cookieHeader = ctx.req.headers.get("cookie");
     const cookies = {};
@@ -2732,194 +3793,9 @@ function Session(options) {
     }
     return result;
   };
-}
-class ValidationError extends Error {
-  constructor(errors) {
-    super("Validation Error");
-    this.errors = errors;
-  }
-  status = 400;
-}
-function isZod(schema) {
-  return typeof schema?.safeParse === "function";
-}
-async function validateZod(schema, data) {
-  const result = await schema.safeParseAsync(data);
-  if (!result.success) {
-    throw new ValidationError(result.error.errors);
-  }
-  return result.data;
-}
-function isTypeBox(schema) {
-  return typeof schema?.Check === "function" && typeof schema?.Errors === "function";
-}
-function validateTypeBox(schema, data) {
-  if (!schema.Check(data)) {
-    throw new ValidationError([...schema.Errors(data)]);
-  }
-  return data;
-}
-function isAjv(schema) {
-  return typeof schema === "function" && "errors" in schema;
-}
-function validateAjv(schema, data) {
-  const valid = schema(data);
-  if (!valid) {
-    throw new ValidationError(schema.errors);
-  }
-  return data;
-}
-const valibot = (schema, parser) => {
-  return {
-    _valibot: true,
-    schema,
-    parser
-  };
-};
-function isValibotWrapper(schema) {
-  return schema?._valibot === true;
-}
-async function validateValibotWrapper(wrapper, data) {
-  const result = await wrapper.parser(wrapper.schema, data);
-  if (!result.success) {
-    throw new ValidationError(result.issues);
-  }
-  return result.output;
-}
-function isClass(schema) {
-  try {
-    if (typeof schema === "function" && /^\s*class\s+/.test(schema.toString())) {
-      return true;
-    }
-    return typeof schema === "function" && schema.prototype && schema.name;
-  } catch {
-    return false;
-  }
-}
-async function validateClassValidator(schema, data) {
-  const object = plainToInstance(schema, data);
-  try {
-    await validateOrReject(object);
-    return object;
-  } catch (errors) {
-    const formattedErrors = Array.isArray(errors) ? errors.map((err) => ({
-      property: err.property,
-      constraints: err.constraints,
-      children: err.children
-    })) : errors;
-    throw new ValidationError(formattedErrors);
-  }
-}
-const safelyGetBody = async (ctx) => {
-  const req = ctx.req;
-  if (req._bodyParsed) {
-    return req._bodyValue;
-  }
-  try {
-    let data;
-    if (typeof req.json === "function") {
-      data = await req.json();
-    } else {
-      data = req.body;
-      if (typeof data === "string") {
-        try {
-          data = JSON.parse(data);
-        } catch {
-        }
-      }
-    }
-    req._bodyParsed = true;
-    req._bodyValue = data;
-    Object.defineProperty(req, "json", {
-      value: async () => req._bodyValue,
-      configurable: true
-    });
-    return data;
-  } catch (e) {
-    return {};
-  }
-};
-function validate(config) {
-  return async (ctx, next) => {
-    const dataToValidate = {};
-    if (config.params) dataToValidate.params = ctx.params;
-    let queryObj;
-    if (config.query) {
-      const url = new URL(ctx.req.url);
-      queryObj = Object.fromEntries(url.searchParams.entries());
-      dataToValidate.query = queryObj;
-    }
-    if (config.headers) dataToValidate.headers = Object.fromEntries(ctx.req.headers.entries());
-    let body;
-    if (config.body) {
-      body = await safelyGetBody(ctx);
-      dataToValidate.body = body;
-    }
-    if (ctx.app?.applicationConfig.hooks?.beforeValidate) {
-      await ctx.app.applicationConfig.hooks.beforeValidate(ctx, dataToValidate);
-    }
-    if (config.params) {
-      ctx.params = await runValidation(config.params, ctx.params);
-    }
-    let validQuery;
-    if (config.query && queryObj) {
-      validQuery = await runValidation(config.query, queryObj);
-    }
-    if (config.headers) {
-      const headersObj = Object.fromEntries(ctx.req.headers.entries());
-      await runValidation(config.headers, headersObj);
-    }
-    let validBody;
-    if (config.body) {
-      const b = body ?? await safelyGetBody(ctx);
-      validBody = await runValidation(config.body, b);
-      const req = ctx.req;
-      req._bodyValue = validBody;
-      Object.defineProperty(req, "json", {
-        value: async () => validBody,
-        configurable: true
-      });
-      ctx.body = validBody;
-    }
-    if (ctx.app?.applicationConfig.hooks?.afterValidate) {
-      const validatedData = { ...dataToValidate };
-      if (config.params) validatedData.params = ctx.params;
-      if (config.query) validatedData.query = validQuery;
-      if (config.body) validatedData.body = validBody;
-      await ctx.app.applicationConfig.hooks.afterValidate(ctx, validatedData);
-    }
-    return next();
-  };
-}
-async function runValidation(schema, data) {
-  if (isZod(schema)) {
-    return validateZod(schema, data);
-  }
-  if (isTypeBox(schema)) {
-    return validateTypeBox(schema, data);
-  }
-  if (isAjv(schema)) {
-    return validateAjv(schema, data);
-  }
-  if (isValibotWrapper(schema)) {
-    return validateValibotWrapper(schema, data);
-  }
-  if (isClass(schema)) {
-    return validateClassValidator(schema, data);
-  }
-  if (isTypeBox(schema)) {
-    return validateTypeBox(schema, data);
-  }
-  if (isAjv(schema)) {
-    return validateAjv(schema, data);
-  }
-  if (isValibotWrapper(schema)) {
-    return validateValibotWrapper(schema, data);
-  }
-  if (typeof schema === "function") {
-    return schema(data);
-  }
-  throw new Error("Unknown validator type provided. Please use a supported library (Zod, Ajv, TypeBox) or a custom function.");
+  sessionMiddleware.isBuiltin = true;
+  sessionMiddleware.pluginName = "Session";
+  return sessionMiddleware;
 }
 export {
   $appRoot,
@@ -2960,6 +3836,7 @@ export {
   Put,
   Query,
   RateLimit,
+  RateLimitMiddleware,
   Req,
   RouteParamType,
   RouterRegistry,
@@ -2975,7 +3852,11 @@ export {
   Spec,
   Use,
   ValidationError,
+  compileValidators,
   compose,
+  enableOpenApiValidation,
+  openApiValidator,
+  precompileValidators,
   useExpress,
   valibot,
   validate