shokupan 0.15.0 → 0.15.2

package/dist/{index-46Z4ASUY.cjs → index-B-bQ7kZy.cjs}

@@ -116,26 +116,63 @@ class BodyParser {
   }
   /**
    * Parsing helper for FormData
+   * Security: Enforces maxBodySize by reading the raw body stream before
+   * handing it to formData(), so the limit cannot be bypassed via a spoofed
+   * Content-Length header.
    */
   static async parseFormData(req, maxBodySize) {
-    const clHeader = req.headers.get("content-length");
-    if (!clHeader) {
+    if (!req.headers.has("content-length") && req.headers.get("transfer-encoding") !== "chunked") {
       const err = new Error("Length Required");
       err.status = 411;
       throw err;
     }
-    const cl = parseInt(clHeader, 10);
-    if (isNaN(cl)) {
-      const err = new Error("Bad Request");
-      err.status = 400;
-      throw err;
+    const rawBuffer = await BodyParser.readRawBufferBody(req, maxBodySize);
+    const syntheticReq = new Request("http://localhost", {
+      method: "POST",
+      headers: req.headers,
+      body: rawBuffer.buffer
+    });
+    return syntheticReq.formData();
+  }
+  /**
+   * Reads raw body as Uint8Array with size enforcement (used by parseFormData).
+   */
+  static async readRawBufferBody(req, maxBodySize) {
+    if (typeof req.body === "string") {
+      const enc = new TextEncoder().encode(req.body);
+      if (enc.byteLength > maxBodySize) {
+        const err = new Error("Payload Too Large");
+        err.status = 413;
+        throw err;
+      }
+      return enc;
     }
-    if (cl > maxBodySize) {
-      const err = new Error("Payload Too Large");
-      err.status = 413;
-      throw err;
+    const reader = req.body?.getReader();
+    if (!reader) return new Uint8Array(0);
+    const chunks = [];
+    let totalSize = 0;
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        totalSize += value.length;
+        if (totalSize > maxBodySize) {
+          const err = new Error("Payload Too Large");
+          err.status = 413;
+          throw err;
+        }
+        chunks.push(value);
+      }
+    } finally {
+      reader.releaseLock();
     }
-    return req.formData();
+    const result = new Uint8Array(totalSize);
+    let offset = 0;
+    for (const chunk of chunks) {
+      result.set(chunk, offset);
+      offset += chunk.length;
+    }
+    return result;
   }
   /**
    * Reads raw body as string with size enforcement
@@ -1383,7 +1420,7 @@ class ShokupanContext {
 }
 function RateLimitMiddleware(options = {}) {
   const windowMs = options.windowMs || 60 * 1e3;
-  const max = options.limit || options.max || 5;
+  const max = options.limit || options.max || 100;
   const message = options.message || "Too many requests, please try again later.";
   const statusCode = options.statusCode || 429;
   const headers = options.headers !== false;
@@ -1412,9 +1449,7 @@ function RateLimitMiddleware(options = {}) {
   const hits = /* @__PURE__ */ new Map();
   const interval = setInterval(() => {
     const now = Date.now();
-    const entries = Array.from(hits.entries());
-    for (let i = 0; i < entries.length; i++) {
-      const [key, record] = entries[i];
+    for (const [key, record] of hits) {
       if (record.resetTime <= now) {
         hits.delete(key);
       }
@@ -2797,7 +2832,12 @@ function serveStatic(config, prefix) {
   const normalizedPrefix = prefix.endsWith("/") && prefix !== "/" ? prefix.slice(0, -1) : prefix;
   const isEtag = !!config.etag;
   const extensions = config.extensions || ["html", "htm", "htmx"];
+  const cacheEnabled = config.useCache !== false;
   const FILES = {};
+  let _resolveReady;
+  const _ready = new Promise((resolve2) => {
+    _resolveReady = resolve2;
+  });
   function toHeaders(name, stats, isEtag2) {
     const ctype = mrmime.lookup(name) || "application/octet-stream";
     const headers = {
@@ -2813,7 +2853,7 @@ function serveStatic(config, prefix) {
     }
     return headers;
   }
-  if (!config.useCache) {
+  if (cacheEnabled) {
     async function walk(dir) {
       const entries = await promises$1.readdir(dir, { withFileTypes: true });
       for (const entry of entries) {
@@ -2828,10 +2868,15 @@ function serveStatic(config, prefix) {
         }
       }
     }
-    walk(rootPath).catch(console.error);
+    walk(rootPath).then(_resolveReady).catch((err) => {
+      console.error("[serveStatic] Cache population error:", err);
+      _resolveReady();
+    });
+  } else {
+    _resolveReady();
   }
   const serveStaticMiddleware = async (ctx) => {
-    let reqPath = ctx.path.slice(normalizedPrefix.length);
+    let reqPath = ctx.params?.["*"] ?? ctx.path.slice(normalizedPrefix.length);
     if (!reqPath.startsWith("/")) reqPath = "/" + reqPath;
     try {
       reqPath = decodeURIComponent(reqPath);
@@ -2842,7 +2887,7 @@ function serveStatic(config, prefix) {
       return ctx.json({ error: "Forbidden" }, 403);
     }
     let file;
-    if (!config.useCache) {
+    if (cacheEnabled) {
       file = FILES[reqPath];
       if (!file) {
         for (const ext of extensions) {
@@ -2919,7 +2964,7 @@ function serveStatic(config, prefix) {
                                          <li><a href="../">../</a></li>
                                      <% } %>
                                      <% it.files.forEach(function(f) { %>
-                                         <li><a href="<%= f %>"><%= f %></a></li>
+                                         <li><a href="<%= encodeURIComponent(f) %>"><%= f %></a></li>
                                      <% }) %>
                                  </ul>
                                  </body>
@@ -2977,6 +3022,7 @@ function serveStatic(config, prefix) {
   };
   serveStaticMiddleware.isBuiltin = true;
   serveStaticMiddleware.pluginName = "ServeStatic";
+  serveStaticMiddleware.ready = _ready;
   return serveStaticMiddleware;
 }
 class OpenTelemetryPlugin {
@@ -3691,14 +3737,21 @@ class RouterTrie {
       delete params[node.paramChild.paramName];
     }
     if (node.wildcardChild) {
+      params["*"] = segment;
       const result = this.findNode(node.wildcardChild, segments, index + 1, params);
       if (result) return result;
+      delete params["*"];
     }
     if (node.recursiveChild) {
       const remaining = segments.length - index;
       for (let k = 0; k <= remaining; k++) {
+        const matchedSegments = segments.slice(index, index + k).join("/");
+        params["*"] = matchedSegments;
+        params["**"] = matchedSegments;
         const result = this.findNode(node.recursiveChild, segments, index + k, params);
         if (result) return result;
+        delete params["*"];
+        delete params["**"];
       }
     }
     return null;
@@ -4173,13 +4226,13 @@ class ShokupanRouter {
       }
       return ctx.upgrade({
         open: async (ctx2, ws) => {
+          ctx2[$ws] = ws;
           if (handlers.onOpen) {
             const sessionData = await handlers.onOpen(ctx2, ws);
             if (sessionData !== void 0) {
               ws.data = sessionData;
               ctx2.state = sessionData;
             }
-            ctx2[$ws] = ws;
           }
           if (!ctx2[$wsMessages]) ctx2[$wsMessages] = [];
           const originalSend = ws.send.bind(ws);
@@ -4287,6 +4340,7 @@ class ShokupanRouter {
       }
       return ctx.upgrade({
         open: async (ctx2, ws) => {
+          ctx2[$ws] = ws;
           if (openMethodName) {
             const openMethod = instance[openMethodName];
             if (openMethod) {
@@ -4615,13 +4669,17 @@ class ShokupanRouter {
   find(method, path2) {
     let result = this.trie.search(method, path2);
     if (result) {
-      result.handler = this.wrapHandlerWithMiddleware(result.handler);
+      if (!this[$isApplication]) {
+        result.handler = this.wrapHandlerWithMiddleware(result.handler);
+      }
       return result;
     }
     if (method === "HEAD") {
       result = this.trie.search("GET", path2);
       if (result) {
-        result.handler = this.wrapHandlerWithMiddleware(result.handler);
+        if (!this[$isApplication]) {
+          result.handler = this.wrapHandlerWithMiddleware(result.handler);
+        }
         return result;
       }
     }
@@ -5920,29 +5978,29 @@ class Shokupan extends ShokupanRouter {
     try {
       switch (adapterName) {
         case "sqlite": {
-          const { SqliteAdapter } = await Promise.resolve().then(() => require("./sqlite-sfDxgiji.cjs"));
+          const { SqliteAdapter } = await Promise.resolve().then(() => require("./sqlite-Bf3Y44PF.cjs"));
           this.datastore = new SqliteAdapter(options);
           break;
         }
         case "level": {
-          const { LevelAdapter } = await Promise.resolve().then(() => require("./level-B0zBSwWA.cjs"));
+          const { LevelAdapter } = await Promise.resolve().then(() => require("./level-C8w1C6JX.cjs"));
           this.datastore = new LevelAdapter(options);
           break;
         }
         case "surrealdb": {
-          const { SurrealAdapter } = await Promise.resolve().then(() => require("./surreal-DiEl_VJL.cjs"));
+          const { SurrealAdapter } = await Promise.resolve().then(() => require("./surreal-Ctjsrb6S.cjs"));
           const legacyConfig = this.applicationConfig.surreal || {};
           const effectiveOptions = { ...legacyConfig, ...options };
           this.datastore = new SurrealAdapter(effectiveOptions);
           break;
         }
         case "knex": {
-          const { KnexAdapter } = await Promise.resolve().then(() => require("./knex-CIS1IT0Y.cjs"));
+          const { KnexAdapter } = await Promise.resolve().then(() => require("./knex-DYPtgZG5.cjs"));
           this.datastore = new KnexAdapter(options || {});
           break;
         }
         default: {
-          const { SurrealAdapter } = await Promise.resolve().then(() => require("./surreal-DiEl_VJL.cjs"));
+          const { SurrealAdapter } = await Promise.resolve().then(() => require("./surreal-Ctjsrb6S.cjs"));
           const legacy = this.applicationConfig.surreal;
           this.datastore = new SurrealAdapter(options || legacy || {});
         }
@@ -6897,7 +6955,7 @@ class ApiExplorerPlugin extends ShokupanRouter {
     }
   }
   static getBasePath() {
-    const dir = path$1.dirname(node_url.fileURLToPath(typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("index-46Z4ASUY.cjs", document.baseURI).href));
+    const dir = path$1.dirname(node_url.fileURLToPath(typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("index-B-bQ7kZy.cjs", document.baseURI).href));
     if (dir.endsWith("dist")) {
       return dir + "/plugins/application/api-explorer";
     }
@@ -6926,22 +6984,26 @@ class ApiExplorerPlugin extends ShokupanRouter {
     this.get("/style.css", (ctx) => serveFile(ctx, "style.css", "text/css"));
     this.get("/theme.css", (ctx) => serveFile(ctx, "theme.css", "text/css"));
     this.get("/explorer-client.mjs", (ctx) => serveFile(ctx, "explorer-client.mjs", "application/javascript"));
-    this.get("/_source", async (ctx) => {
-      const file = ctx.query["file"];
-      if (!file) return ctx.text("Missing file parameter", 400);
-      const { resolve, normalize, isAbsolute } = await import("node:path");
-      const cwd = process.cwd();
-      const resolvedPath = resolve(cwd, file);
-      if (!resolvedPath.startsWith(cwd)) {
-        return ctx.text("Forbidden: File must be within project root", 403);
-      }
-      try {
-        const content = await promises$1.readFile(resolvedPath, "utf-8");
-        return ctx.text(content);
-      } catch (err) {
-        return ctx.text("File not found", 404);
-      }
-    });
+    const isProduction = process.env.NODE_ENV === "production";
+    const sourceViewEnabled = this.pluginOptions.enableSourceView ?? !isProduction;
+    if (sourceViewEnabled) {
+      this.get("/_source", async (ctx) => {
+        const file = ctx.query["file"];
+        if (!file) return ctx.text("Missing file parameter", 400);
+        const { resolve } = await import("node:path");
+        const cwd = process.cwd();
+        const resolvedPath = resolve(cwd, file);
+        if (!resolvedPath.startsWith(cwd + "/") && resolvedPath !== cwd) {
+          return ctx.text("Forbidden: File must be within project root", 403);
+        }
+        try {
+          const content = await promises$1.readFile(resolvedPath, "utf-8");
+          return ctx.text(content);
+        } catch (err) {
+          return ctx.text("File not found", 404);
+        }
+      });
+    }
     this.get("/openapi.json", async (ctx) => {
       const spec = this.root.openApiSpec ? structuredClone(this.root.openApiSpec) : await (this.root || this).generateApiSpec();
       return ctx.json(stripSourceCode(spec));
@@ -7566,7 +7628,7 @@ class AsyncApiPlugin extends ShokupanRouter {
     this.init();
   }
   static getBasePath() {
-    const dir = path$1.dirname(node_url.fileURLToPath(typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("index-46Z4ASUY.cjs", document.baseURI).href));
+    const dir = path$1.dirname(node_url.fileURLToPath(typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("index-B-bQ7kZy.cjs", document.baseURI).href));
     if (dir.endsWith("dist")) {
       return dir + "/plugins/application/asyncapi";
     }
@@ -7822,7 +7884,16 @@ class AuthPlugin extends ShokupanRouter {
       };
     } else if (provider === "apple") {
       if (idToken) {
-        const payload = this.jose.decodeJwt(idToken);
+        const { createRemoteJWKSet, jwtVerify } = this.jose;
+        if (!this._appleJwks) {
+          this._appleJwks = createRemoteJWKSet(
+            new URL("https://appleid.apple.com/auth/keys")
+          );
+        }
+        const { payload } = await jwtVerify(idToken, this._appleJwks, {
+          issuer: "https://appleid.apple.com",
+          audience: this.authConfig.providers.apple?.clientId
+        });
         user = {
           id: payload.sub,
           email: payload["email"],
@@ -8199,7 +8270,7 @@ function Card({ title, contentId }) {
     /* @__PURE__ */ jsxRuntime.jsx("div", { id: contentId })
   ] });
 }
-const require$1 = node_module.createRequire(typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("index-46Z4ASUY.cjs", document.baseURI).href);
+const require$1 = node_module.createRequire(typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("index-B-bQ7kZy.cjs", document.baseURI).href);
 const http = require$1("node:http");
 const https = require$1("node:https");
 class FetchInterceptor {
@@ -8803,7 +8874,7 @@ class Dashboard {
   }
   // Get base path for dashboard files - works in both dev (src/) and production (dist/)
   static getBasePath() {
-    const dir = path$1.dirname(node_url.fileURLToPath(typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("index-46Z4ASUY.cjs", document.baseURI).href));
+    const dir = path$1.dirname(node_url.fileURLToPath(typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("index-B-bQ7kZy.cjs", document.baseURI).href));
     if (dir.endsWith("dist")) {
       return dir + "/plugins/application/dashboard";
     }
@@ -11212,14 +11283,29 @@ function Compression(options = {}) {
     }
     const acceptEncoding = ctx.headers.get("accept-encoding") || "";
     let method = null;
-    if (acceptEncoding.includes("br")) method = "br";
-    else if (acceptEncoding.includes("zstd")) {
-      if (typeof Bun === "undefined") {
-        throw new Error("zstd compression is only available in Bun runtime. Client requested zstd but server is running on Node.js.");
-      }
-      method = "zstd";
-    } else if (acceptEncoding.includes("gzip")) method = "gzip";
-    else if (acceptEncoding.includes("deflate")) method = "deflate";
+    const encodings = acceptEncoding.split(",");
+    for (let i = 0; i < encodings.length; i++) {
+      const enc = encodings[i].split(";")[0].trim().toLowerCase();
+      if (enc === "br" && allowedAlgorithms.has("br")) {
+        method = "br";
+        break;
+      }
+      if (enc === "zstd" && allowedAlgorithms.has("zstd")) {
+        if (typeof Bun !== "undefined") {
+          method = "zstd";
+          break;
+        }
+        continue;
+      }
+      if (enc === "gzip" && allowedAlgorithms.has("gzip")) {
+        method = "gzip";
+        break;
+      }
+      if (enc === "deflate" && allowedAlgorithms.has("deflate")) {
+        method = "deflate";
+        break;
+      }
+    }
     if (!method) return next();
     if (!allowedAlgorithms.has(method)) {
       return next();
@@ -11306,6 +11392,11 @@ function Cors(options = {}) {
     optionsSuccessStatus: 204
   };
   const opts = { ...defaults2, ...options };
+  if (opts.credentials && opts.origin === "*") {
+    throw new Error(
+      'CORS misconfiguration: `credentials: true` is incompatible with `origin: "*"`. Specify an explicit origin or array of origins instead.'
+    );
+  }
   const corsMiddleware = async function CorsMiddleware(ctx, next) {
     const headers = {};
     const origin = ctx.headers.get("origin");
@@ -11591,10 +11682,21 @@ function validate(config) {
     let validQuery;
     if (validators.query && queryObj) {
       validQuery = await validators.query(queryObj);
+      Object.defineProperty(ctx, "query", {
+        value: validQuery,
+        writable: true,
+        configurable: true
+      });
     }
+    let validHeaders;
     if (validators.headers) {
       const headersObj = Object.fromEntries(ctx.req.headers.entries());
-      await validators.headers(headersObj);
+      validHeaders = await validators.headers(headersObj);
+      Object.defineProperty(ctx, "headers", {
+        value: new Headers(validHeaders),
+        writable: true,
+        configurable: true
+      });
     }
     let validBody;
     if (validators.body) {
@@ -11612,6 +11714,7 @@ function validate(config) {
     const validatedData = { ...dataToValidate };
     if (config.params) validatedData.params = ctx.params;
     if (config.query) validatedData.query = validQuery;
+    if (config.headers) validatedData.headers = validHeaders;
     if (config.body) validatedData.body = validBody;
     await ctx.app.runHooks("afterValidate", ctx, validatedData);
     return next();
@@ -11852,6 +11955,9 @@ function Proxy$1(options) {
     if (!["http:", "https:"].includes(url.protocol)) {
       return ctx.text("Invalid protocol in proxied URL", 400);
     }
+    if (options.allowedHosts && !options.allowedHosts.includes(url.hostname)) {
+      return ctx.text("Proxied hostname not in allowlist", 403);
+    }
     const headers = new Headers(req.headers);
     if (options.changeOrigin) {
       headers.set("host", targetUrl.host);
@@ -11945,7 +12051,16 @@ function handleWSDrain(ws) {
 }
 function SecurityHeaders(options = {}) {
   const securityHeadersMiddleware = async function SecurityHeadersMiddleware(ctx, next) {
-    const set = (k, v) => ctx.response.set(k, v);
+    const response = await next();
+    const set = (k, v) => {
+      if (response instanceof Response) {
+        try {
+          response.headers.set(k, v);
+        } catch (e) {
+        }
+      }
+      ctx.response.headers.set(k, v);
+    };
     if (options.dnsPrefetchControl !== false) {
       const allow = options.dnsPrefetchControl?.allow;
       set("X-DNS-Prefetch-Control", allow ? "on" : "off");
@@ -11956,7 +12071,7 @@ function SecurityHeaders(options = {}) {
       if (action === "sameorigin") set("X-Frame-Options", "SAMEORIGIN");
       else if (action === "deny") set("X-Frame-Options", "DENY");
     }
-    if (options.hsts !== false) {
+    if (options.hsts !== false && ctx.secure === true) {
       const opt = options.hsts || {};
       const maxAge = opt.maxAge || 15552e3;
       let header = `max-age=${maxAge}`;
@@ -11983,20 +12098,39 @@ function SecurityHeaders(options = {}) {
       if (opt === void 0 || opt === true) {
         set("Content-Security-Policy", "default-src 'self';base-uri 'self';font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests");
       } else if (typeof opt === "object") {
-        const optEntries = Object.entries(opt);
-        for (let i = 0; i < optEntries.length; i++) {
-          const [key, val] = optEntries[i];
+        const parts = [];
+        for (const [key, val] of Object.entries(opt)) {
+          if (val === false) continue;
+          const directive = key.replace(/([A-Z])/g, "-$1").toLowerCase();
+          if (val === true) {
+            parts.push(directive);
+          } else {
+            const sources = Array.isArray(val) ? val.join(" ") : String(val);
+            parts.push(`${directive} ${sources}`);
+          }
+        }
+        if (parts.length > 0) {
+          set("Content-Security-Policy", parts.join(";"));
         }
       }
     }
-    if (options.hidePoweredBy !== false) ;
-    const response = await next();
+    if (options.hidePoweredBy !== false) {
+      if (response instanceof Response) {
+        try {
+          response.headers.delete("X-Powered-By");
+        } catch (e) {
+        }
+      }
+      ctx.response.headers.delete("X-Powered-By");
+    }
     return response;
   };
   securityHeadersMiddleware.isBuiltin = true;
   securityHeadersMiddleware.pluginName = "SecurityHeaders";
   return securityHeadersMiddleware;
 }
+const $isDirty = /* @__PURE__ */ Symbol("isDirty");
+const $resetDirty = /* @__PURE__ */ Symbol("resetDirty");
 class Cookie {
   maxAge;
   signed;
@@ -12103,7 +12237,7 @@ function unsign(input, secret) {
   Buffer.from(expectedInput).copy(paddedExpected);
   Buffer.from(input).copy(paddedInput);
   try {
-    const valid = require("crypto").timingSafeEqual(paddedExpected, paddedInput);
+    const valid = crypto.timingSafeEqual(paddedExpected, paddedInput);
     return valid ? tentValue : false;
   } catch {
     return false;
@@ -12122,10 +12256,14 @@ function Session(options) {
     const cookies = ctx.cookies;
     const rawCookie = cookies[name];
     if (rawCookie) {
-      if (rawCookie.substr(0, 2) === "s:") {
-        const val = unsign(rawCookie.slice(2), secrets[0]);
-        if (val) {
-          reqSessionId = val;
+      if (rawCookie.slice(0, 2) === "s:") {
+        const signed = rawCookie.slice(2);
+        for (let i = 0; i < secrets.length; i++) {
+          const val = unsign(signed, secrets[i]);
+          if (val !== false) {
+            reqSessionId = val;
+            break;
+          }
         }
       } else {
         reqSessionId = rawCookie;
@@ -12181,8 +12319,6 @@ function Session(options) {
           });
         });
       };
-      sessObj.undefined = () => {
-      };
       sessObj.reload = () => {
         return new Promise((resolve, reject) => {
           store.get(sessObj.id, (err, sess2) => {
@@ -12204,7 +12340,25 @@ function Session(options) {
         sessObj.cookie.expires = new Date(Date.now() + (sessObj.cookie.maxAge || 0));
         if (store.touch) store.touch(sessObj.id, sessObj);
       };
-      return sessObj;
+      let _dirty = false;
+      const skippedKeys = /* @__PURE__ */ new Set(["id", "save", "destroy", "regenerate", "reload", "touch"]);
+      const proxy = new Proxy(sessObj, {
+        set(target, prop, value, receiver) {
+          if (typeof prop !== "symbol" && !skippedKeys.has(prop)) {
+            _dirty = true;
+          }
+          return Reflect.set(target, prop, value, receiver);
+        },
+        deleteProperty(target, prop) {
+          if (typeof prop !== "symbol" && !skippedKeys.has(prop)) _dirty = true;
+          return Reflect.deleteProperty(target, prop);
+        }
+      });
+      proxy[$isDirty] = () => _dirty;
+      proxy[$resetDirty] = () => {
+        _dirty = false;
+      };
+      return proxy;
     };
     let sessionData = null;
     if (!isNew && sessionID) {
@@ -12227,17 +12381,15 @@ function Session(options) {
     ctx.session = sess;
     ctx.sessionID = sessionID;
     ctx.sessionStore = store;
-    const originalHash = JSON.stringify(sess);
     const result = await next();
-    const currentHash = JSON.stringify(sess);
-    const isModified = originalHash !== currentHash;
+    const isModified = sess[$isDirty]?.() ?? false;
     if (!sessionID) return result;
     let shouldSave = false;
     if (isModified) {
       shouldSave = true;
     } else if (isNew && saveUninitialized) {
       shouldSave = true;
-    } else if (!isNew && resave) {
+    } else if (!isNew && resave && isModified) {
       shouldSave = true;
     }
     if (shouldSave) {
@@ -12274,6 +12426,7 @@ function Static(options, prefix = "/") {
     try {
       const result = await staticMiddleware(ctx, next);
       if (result instanceof Response && result.status === 404) {
+        ctx.response.status = 200;
         return next();
       }
       return result;
@@ -12425,4 +12578,4 @@ exports.traceMiddleware = traceMiddleware;
 exports.useExpress = useExpress;
 exports.valibot = valibot;
 exports.validate = validate;
-//# sourceMappingURL=index-46Z4ASUY.cjs.map
+//# sourceMappingURL=index-B-bQ7kZy.cjs.map