@nifrajs/core 5.11.0 → 5.12.0

package/dist/server/server.js

@@ -14,11 +14,11 @@ import { withAnswerSteps } from "./answer-step.js";
 import { isAuthenticatedRequest, markAuthenticatedRequest, } from "./auth.js";
 import { emitRequestErrorLog, renderBareError } from "./bare-error-lane.js";
 import { LAST_BEFORE_HANDLE } from "./before-handler.js";
-import { assertByteLimit, clientBodyErrorCode, hasTrustedBodyFraming, markTransportCap, markTrustedBodyFraming, UNLIMITED_BODY_BYTES, } from "./body.js";
+import { assertByteLimit, clientBodyErrorCode, DEFAULT_MAX_BODY_BYTES, hasTrustedBodyFraming, markTransportCap, markTrustedBodyFraming, UNLIMITED_BODY_BYTES, } from "./body.js";
 import { NIFRA_PLATFORM_CLIENT_IP_DERIVED, resolveClientIp, } from "./client-ip.js";
 import { mergeRefusal, recordCopyVersion } from "./core-copies.js";
 import { hasLowercaseHeaderKeysMark, headerKeysAllLowercase, markLowercaseHeaderKeys, } from "./header-case.js";
-import { declaredHeaders, headerObjectOf } from "./headers.js";
+import { declaredHeaderNames, declaredHeaders, headerObjectOf } from "./headers.js";
 import { isRoutableMethod, jsonError, pathnameOf, plainError, urlPartsOf, } from "./http.js";
 import { withStaticNodeHeaders } from "./node-outcome.js";
 import { queryObjectOf, searchOf } from "./query.js";
@@ -29,6 +29,7 @@ import { needsResolving, resolveDotSegments } from "./request-target.js";
 import { applyStaticResponseHeaders, buildStaticResponseHeaders, claimHandedOver, fusedRespond, fusedRespondNoSet, handedBackResponse, recordResidentTexts, toResponse, writableResponse, } from "./respond.js";
 import { CONTEXT_REQUEST, CONTEXT_SEARCH, CONTEXT_SET, EMPTY_RESPONSE_CONTROLS, getNeverAbortSignal, getUnboundedRequestBudget, headerOf, isResponseResult, requestOf, } from "./runtime-core.js";
 import { normalizeStaticResponseHeaders } from "./static-headers.js";
+import { createStaticResponse, staticResponseDefinition } from "./static-response.js";
 import { withTextSlots } from "./text-slots.js";
 import { plainValidationError } from "./validation.js";
 import { NIFRA_BACKEND_WS_RUNTIME } from "../mount.js";
@@ -155,7 +156,6 @@ function requireMcpRuntime(runtime) {
 // Plugin definers + their types now live in `./plugin.ts`; re-exported here so `.use()` callers and
 // existing importers keep resolving them from the server module.
 export { defineContextPlugin, defineIdentityPlugin, definePlugin, defineRouterPlugin, } from "./plugin.js";
-const DEFAULT_MAX_BODY_BYTES = 1_000_000;
 const BODY_RESPONSE = (response) => response;
 const BODY_ERROR = (error) => Promise.reject(error);
 const DEFAULT_DRAIN_MS = 10_000;
@@ -359,6 +359,78 @@ function stripMountPrefix(request, prefix) {
 function responseSet(ctx) {
     return ctx[CONTEXT_SET]() ?? EMPTY_RESPONSE_CONTROLS;
 }
+/** Compile the non-body validation stages in the same order as the route program. The selected
+ * fused lane runs this only for routes whose recovery behavior is the ordinary 422 response. */
+function compileFusedValidationStages(schema) {
+    if (schema === undefined)
+        return [];
+    const stages = [];
+    if (schema.headers !== undefined) {
+        stages.push({
+            schema: schema.headers,
+            kind: "headers",
+            headerNames: declaredHeaderNames(schema.headers),
+        });
+    }
+    if (schema.cookies !== undefined) {
+        stages.push({ schema: schema.cookies, kind: "cookies" });
+    }
+    if (schema.params !== undefined) {
+        stages.push({ schema: schema.params, kind: "params" });
+    }
+    if (schema.query !== undefined) {
+        stages.push({ schema: schema.query, kind: "query" });
+    }
+    return stages;
+}
+/** Run a registration-compiled input sequence without allocating a lifecycle-program continuation
+ * for each synchronous schema. Only an asynchronous validator creates a Promise continuation. */
+function runFusedValidationStages(stages, source, ctx, wrapResponse, onError, next, startIndex = 0) {
+    if (stages.length === 0)
+        return next();
+    const validationContext = ctx;
+    for (let index = startIndex; index < stages.length; index++) {
+        const stage = stages[index];
+        let validation;
+        try {
+            const input = stage.kind === "headers"
+                ? stage.headerNames === undefined
+                    ? headerObjectOf(source.headers)
+                    : declaredHeaders(source.headers, stage.headerNames)
+                : stage.kind === "cookies"
+                    ? ctx.cookies
+                    : stage.kind === "params"
+                        ? ctx.params
+                        : queryObjectOf(ctx[CONTEXT_SEARCH]);
+            validation = stage.schema["~standard"].validate(input);
+        }
+        catch (error) {
+            return onError(error);
+        }
+        if (validation instanceof Promise) {
+            return validation.then((result) => {
+                if (result.issues !== undefined)
+                    return wrapResponse(plainValidationError(result.issues));
+                try {
+                    validationContext[stage.kind] = result.value;
+                }
+                catch (error) {
+                    return onError(error);
+                }
+                return runFusedValidationStages(stages, source, ctx, wrapResponse, onError, next, index + 1);
+            }, onError);
+        }
+        if (validation.issues !== undefined)
+            return wrapResponse(plainValidationError(validation.issues));
+        try {
+            validationContext[stage.kind] = validation.value;
+        }
+        catch (error) {
+            return onError(error);
+        }
+    }
+    return next();
+}
 /** The error hooks of the many fused routes that have none, shared so each does not allocate its own. */
 const NO_ERROR_HOOKS = [];
 const WEB_STAGES = new WeakMap();
@@ -701,17 +773,15 @@ export class Server {
     wsMountsCheckedAt = -1;
     /** Whether an app mounted here takes WebSocket upgrades, as of `wsMountsCheckedAt`. */
     wsMountsLive = false;
-    /** In-process pub/sub backing `ws.subscribe(topic)` + `app.publish(topic, data)` (single-instance).
-     * Created by the first `app.ws()` via the `@nifrajs/core/ws` runtime - `undefined` until then, so a
-     * no-WebSocket app never constructs (or bundles) it. */
+    /** Configured topic adapter, or the in-process default created by the first `app.ws()` route. */
     topics;
     /** True once any `app.ws()` route sets `validateSend: true` - the one case where a broadcast frame
-     * is validated (and possibly dropped) per socket, so `app.publish` must stay on the JS registry loop
+     * is validated (and possibly dropped) per socket, so `app.publish` must stay on the JS adapter loop
      * rather than delegate to Bun's native `server.publish`. */
     wsHasValidatedSend = false;
     /** Bun's native topic broadcast, bound by `listen()` in native-pubsub mode; `app.publish` uses it
-     * instead of the JS registry. `undefined` off Bun, before `listen()`, with a validated-send route,
-     * or when a mounted app takes upgrades. */
+     * instead of the JS registry. `undefined` off Bun, before `listen()`, with a custom topic adapter,
+     * a validated-send route, or when a mounted app takes upgrades. */
     nativePublish;
     maxBodyBytes;
     protoPoisoning;
@@ -846,7 +916,7 @@ export class Server {
         this.catalog = new RouteCatalog();
         this.wsRouter = new Router();
         this.wsRoutes = [];
-        this.topics = undefined;
+        this.topics = options.topicAdapter;
         const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
         assertByteLimit(maxBodyBytes, "maxBodyBytes");
         this.protoPoisoning = options.protoPoisoning ?? "reject";
@@ -1573,7 +1643,7 @@ export class Server {
             throw new RouteConfigError("INVALID_WS_SEND_VALIDATION", `route WS ${path}: validateSend requires sendSchema`);
         }
         // A validated-send route makes broadcast bytes route-dependent (drop-on-invalid per socket), so the
-        // whole app forgoes native pub/sub and keeps the JS registry loop that runs each send through the sender.
+        // whole app forgoes native pub/sub and keeps the JS adapter loop that runs each send through the sender.
         if (handler.validateSend === true)
             this.wsHasValidatedSend = true;
         this.topics ??= runtime.createTopics();
@@ -1598,18 +1668,18 @@ export class Server {
     }
     /**
      * Broadcast `data` to every WebSocket connection subscribed to `topic` (via `ws.subscribe(topic)`).
-     * In-process and **single-instance** (see {@link TopicRegistry}) - a multi-instance deploy must bridge
-     * an external fan-out (Redis, a Durable Object) to this. A no-op when nobody is subscribed.
+     * Uses the configured {@link ServerOptions.topicAdapter}, or the in-process topic registry by
+     * default. Await the result when a custom adapter publishes asynchronously.
      */
     publish(topic, data) {
         // Native-pubsub mode (Bun, no validated-send route): one native broadcast to every subscriber, no
-        // per-connection JS loop. Bound only after `listen()`; before that (or off Bun) the registry runs.
+        // per-connection JS loop. Bound only after `listen()`; before that (or off Bun) the adapter runs.
         if (this.nativePublish !== undefined) {
             this.nativePublish(topic, data);
             return;
         }
-        // No `app.ws()` yet ⇒ no registry and necessarily no subscribers - a publish is a no-op anyway.
-        this.topics?.publish(topic, data);
+        // With no custom adapter and no `app.ws()` route, no registry exists and this is a no-op.
+        return this.topics?.publish(topic, data);
     }
     route(method, path, schemaOrHandler, handler) {
         let rawHandler;
@@ -1665,6 +1735,7 @@ export class Server {
         throw new RouteConfigError("INVALID_PATH", `group(${JSON.stringify(prefix)}) route path must start with "/": ${JSON.stringify(path)}`);
     }
     prepareRoute(method, path, schema, handler) {
+        const staticResponse = staticResponseDefinition(handler);
         schema = withTextSlots(schema);
         // Route provenance for the CLI's capability walk, which sets NIFRA_ROUTE_SITES while it loads the
         // app: the module that registered the route, read where a static scan cannot see the path.
@@ -1708,9 +1779,11 @@ export class Server {
             handler = this.idempotencyRuntime.wrapHandler(handler);
         }
         const { bare, fusedQuery, fusedBody } = lanes;
-        // `selectRouteLanes` admits the fused hook lanes only for derive, before and after hooks, so the
-        // three arrays below are the route's whole lifecycle.
-        const fusedLifecycle = lanes.fusedLane === "hooks" || lanes.fusedLane === "body-hooks";
+        // Composite-input routes and hook-only routes share the lifecycle builders; simple shapes use
+        // their narrower runners.
+        const fusedLifecycle = lanes.fusedLane === "hooks" ||
+            lanes.fusedLane === "inputs" ||
+            (lanes.fusedLane === "query" && schema?.params !== undefined);
         // The fused chains keep the arrays they are built from, and `beforeHandle()` inserts into the live
         // ones ahead of `beforeHandler()` guards, so the entry and the fused chains share one snapshot of
         // this route's.
@@ -1731,18 +1804,18 @@ export class Server {
         // The Node-direct dispatcher (`!webFast`) prefers these runners over the generic program. Only the
         // body-only runner also feeds the Web wrapper; the lifecycle lanes build their own Web closure.
         const fusedBodyRunner = fusedBody
-            ? this.buildFusedBodyRunner(handler, schema?.body, hasDecorations ? routeDecorations : undefined, bodyLimit ?? UNLIMITED_BODY_BYTES)
+            ? this.buildFusedBodyRunner(handler, schema?.body, schema?.params, hasDecorations ? routeDecorations : undefined, bodyLimit ?? UNLIMITED_BODY_BYTES)
             : fusedHooks !== undefined
-                ? this.buildFusedLifecycleRunner(fusedHooks, schema?.query, schema?.body, bodyLimit ?? UNLIMITED_BODY_BYTES)
+                ? this.buildFusedLifecycleRunner(fusedHooks, schema, bodyLimit ?? UNLIMITED_BODY_BYTES)
                 : undefined;
         const fusedWeb = bare && this.aroundHooks.length === 0
             ? this.buildFusedWeb(handler, hasDecorations ? routeDecorations : undefined, isContextlessNoArgArrow(handler), bodyLimit ?? UNLIMITED_BODY_BYTES)
             : fusedQuery
-                ? this.buildFusedQueryWeb(handler, hasDecorations ? routeDecorations : undefined, schema?.query, bodyLimit ?? UNLIMITED_BODY_BYTES)
+                ? this.buildFusedQueryWeb(handler, hasDecorations ? routeDecorations : undefined, schema?.query, schema?.params, bodyLimit ?? UNLIMITED_BODY_BYTES)
                 : fusedBody
                     ? this.buildFusedBodyWeb(fusedBodyRunner)
                     : fusedHooks !== undefined
-                        ? this.buildFusedLifecycleWeb(fusedHooks, schema?.query, schema?.body, bodyLimit ?? UNLIMITED_BODY_BYTES)
+                        ? this.buildFusedLifecycleWeb(fusedHooks, schema, bodyLimit ?? UNLIMITED_BODY_BYTES)
                         : undefined;
         const program = compileRouteProgram({
             schema,
@@ -1770,6 +1843,7 @@ export class Server {
         });
         const registeredEntry = {
             handler: handler,
+            staticResponse,
             schema,
             bodyLimit,
             idempotent,
@@ -2182,7 +2256,9 @@ export class Server {
         const lane = entry.execution.fusedLane;
         // Type-erase the lane so each `===` branch sees the full union, not the narrowed remainder.
         const laneName = lane;
-        const lifecycle = laneName === "hooks" || laneName === "body-hooks";
+        const lifecycle = laneName === "hooks" ||
+            laneName === "inputs" ||
+            (laneName === "query" && entry.schema?.params !== undefined);
         const hooks = lifecycle
             ? {
                 handler: entry.handler,
@@ -2194,16 +2270,16 @@ export class Server {
             }
             : undefined;
         const fusedBody = laneName === "body"
-            ? this.buildFusedBodyRunner(entry.handler, entry.schema?.body, entry.hasDecorations ? entry.decorations : undefined, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+            ? this.buildFusedBodyRunner(entry.handler, entry.schema?.body, entry.schema?.params, entry.hasDecorations ? entry.decorations : undefined, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
             : hooks !== undefined
-                ? this.buildFusedLifecycleRunner(hooks, entry.schema?.query, entry.schema?.body, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+                ? this.buildFusedLifecycleRunner(hooks, entry.schema, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
                 : undefined;
         const fusedWeb = laneName === "body"
             ? this.buildFusedBodyWeb(fusedBody)
             : laneName === "query"
-                ? this.buildFusedQueryWeb(entry.handler, entry.hasDecorations ? entry.decorations : undefined, entry.schema?.query, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+                ? this.buildFusedQueryWeb(entry.handler, entry.hasDecorations ? entry.decorations : undefined, entry.schema?.query, entry.schema?.params, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
                 : hooks !== undefined
-                    ? this.buildFusedLifecycleWeb(hooks, entry.schema?.query, entry.schema?.body, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+                    ? this.buildFusedLifecycleWeb(hooks, entry.schema, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
                     : this.buildFusedWeb(entry.handler, entry.hasDecorations ? entry.decorations : undefined, isContextlessNoArgArrow(entry.handler), entry.bodyLimit ?? UNLIMITED_BODY_BYTES);
         return {
             ...route,
@@ -2704,7 +2780,7 @@ export class Server {
             if (params === null)
                 return refuse(jsonError(400, "malformed_path"));
             const { handler, chain } = match.payload;
-            // Non-null: a socket route ⇒ ws() ran ⇒ `.use(websocket())` installed the runtime + registry.
+            // Non-null: a socket route ⇒ ws() ran ⇒ `.use(websocket())` installed the runtime + adapter.
             const pubsub = this.topics;
             const runtime = this.wsRuntime;
             // CSWSH guard, before any per-connection work or the user's upgrade(): reject a disallowed
@@ -3466,10 +3542,10 @@ export class Server {
             return this.bareError(err, ctx, (value, set) => this.wrapWebResponse(toResponse(value, set)), this.wrapWebResponse);
         }
     }
-    /** Compile the eligible body-only route's parser → validator → handler continuation once. The
+    /** Compile the eligible body route's params → parser → validator → handler continuation once. The
      * bounded parser remains shared with the generic lane; only the route-invariant entry lookups and
      * lifecycle dispatch disappear from the common synchronous-validator/synchronous-handler case. */
-    buildFusedBodyRunner(handler, bodySchema, decorations, maxBodyBytes) {
+    buildFusedBodyRunner(handler, bodySchema, paramsSchema, decorations, maxBodyBytes) {
         const logError = (err, ctx, finalize, wrapResponse) => this.bareError(err, ctx, finalize, wrapResponse);
         const runHandler = (ctx, finalize, wrapResponse) => {
             if (decorations !== undefined)
@@ -3529,12 +3605,34 @@ export class Server {
                 return logError(err, ctx, finalize, wrapResponse);
             }
         };
+        const readBody = (source, ctx, finalize, wrapResponse) => readBodyFramed(source, maxBodyBytes, this.protoPoisoning, (parsed) => runParsed(parsed, ctx, finalize, wrapResponse), wrapResponse, (err) => logError(err, ctx, finalize, wrapResponse), bodySchema, this.formOrigins);
         return (source, params, search, signal, budget, platform, nativeContext, finalize, wrapResponse) => {
             const ctx = nativeContext
                 ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
                 : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
-            const finish = (value) => runParsed(value, ctx, finalize, wrapResponse);
-            return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, finish, wrapResponse, (err) => logError(err, ctx, finalize, wrapResponse), bodySchema, this.formOrigins);
+            if (paramsSchema === undefined)
+                return readBody(source, ctx, finalize, wrapResponse);
+            let validation;
+            try {
+                validation = paramsSchema["~standard"].validate(ctx.params);
+            }
+            catch (err) {
+                return logError(err, ctx, finalize, wrapResponse);
+            }
+            if (validation instanceof Promise) {
+                return validation.then((settled) => {
+                    if (settled.issues !== undefined)
+                        return wrapResponse(plainValidationError(settled.issues));
+                    // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: the route's params schema defines this validated output; RawContext erases its route-specific type.
+                    ctx.params = settled.value;
+                    return readBody(source, ctx, finalize, wrapResponse);
+                }, (err) => logError(err, ctx, finalize, wrapResponse));
+            }
+            if (validation.issues !== undefined)
+                return wrapResponse(plainValidationError(validation.issues));
+            // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: the route's params schema defines this validated output; RawContext erases its route-specific type.
+            ctx.params = validation.value;
+            return readBody(source, ctx, finalize, wrapResponse);
         };
     }
     /** Web adapter wrapper for the shared body runner. Node passes its native finalizer directly through
@@ -3542,20 +3640,16 @@ export class Server {
     buildFusedBodyWeb(body) {
         return (source, params, search, signal, budget, platform, nativeContext) => body(source, params, search, signal, budget, platform, nativeContext, (result, _set, ctx) => fusedRespond(result, ctx, this.responseBodyTag, this.staticResponseHeaders, this.onResponseHooks.length === 0), this.wrapWebResponse);
     }
-    /** The fused Web lane for a route whose only lifecycle step is a query schema: parse + validate +
-     * handler + respond in one closure, no lifecycle promise when the validator and handler are sync.
-     * Eligibility is decided at registration (see `fusedQuery` in {@link register}); the semantics here
-     * are exactly `runQueryOnly`'s for that eligible shape - invalid input returns
-     * `validationError(issues)` (recovery hooks disqualify the route from this lane), a thrown
-     * `Response` passes through, anything else logs and returns a flat 500, and an async validator
-     * falls to a then-chain with the same steps. */
-    buildFusedQueryWeb(handler, decorations, querySchema, maxBodyBytes) {
+    /** The fused Web lane for routes with path params and/or a query schema: validate + handler + respond
+     * in one closure, with no lifecycle promise when the validators and handler are sync. */
+    buildFusedQueryWeb(handler, decorations, querySchema, paramsSchema, maxBodyBytes) {
         // Same thrown-value contract as the generic lane (`bare-error-lane.ts` via `bareError`); the fused
         // lane only injects its renderer, so a thrown `status(...)` and the flat 500 fold in static headers
         // through `wrapWebResponse`. One source of truth for the error surface, no per-lane copy to drift.
         const logError = (err, ctx) => this.bareError(err, ctx, (result, set) => this.wrapWebResponse(toResponse(result, set)), this.wrapWebResponse);
         const runHandler = (ctx, value) => {
-            ctx.query = value;
+            if (querySchema !== undefined)
+                ctx.query = value;
             let result;
             try {
                 result = handler(ctx);
@@ -3568,27 +3662,54 @@ export class Server {
             }
             return this.respondFused(result, ctx, this.onResponseHooks.length === 0);
         };
+        const runQuery = (ctx) => {
+            if (querySchema === undefined)
+                return runHandler(ctx, undefined);
+            let validation;
+            try {
+                validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
+            }
+            catch (err) {
+                return logError(err, ctx);
+            }
+            if (validation instanceof Promise) {
+                return validation.then((settled) => settled.issues !== undefined
+                    ? this.wrapWebResponse(plainValidationError(settled.issues))
+                    : runHandler(ctx, settled.value), (err) => logError(err, ctx));
+            }
+            if (validation.issues !== undefined)
+                return this.wrapWebResponse(plainValidationError(validation.issues));
+            return runHandler(ctx, validation.value);
+        };
         return (source, params, search, signal, budget, platform, nativeContext) => {
             const ctx = nativeContext
                 ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
                 : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
             if (decorations !== undefined)
                 Object.assign(ctx, decorations);
+            if (paramsSchema === undefined)
+                return runQuery(ctx);
             let validation;
             try {
-                validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
+                validation = paramsSchema["~standard"].validate(ctx.params);
             }
             catch (err) {
                 return logError(err, ctx);
             }
             if (validation instanceof Promise) {
-                return validation.then((settled) => settled.issues !== undefined
-                    ? this.wrapWebResponse(plainValidationError(settled.issues))
-                    : runHandler(ctx, settled.value), (err) => logError(err, ctx));
+                return validation.then((settled) => {
+                    if (settled.issues !== undefined)
+                        return this.wrapWebResponse(plainValidationError(settled.issues));
+                    // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: the route's params schema defines this validated output; RawContext erases its route-specific type.
+                    ctx.params = settled.value;
+                    return runQuery(ctx);
+                }, (err) => logError(err, ctx));
             }
             if (validation.issues !== undefined)
                 return this.wrapWebResponse(plainValidationError(validation.issues));
-            return runHandler(ctx, validation.value);
+            // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: the route's params schema defines this validated output; RawContext erases its route-specific type.
+            ctx.params = validation.value;
+            return runQuery(ctx);
         };
     }
     /**
@@ -3792,13 +3913,12 @@ export class Server {
     /**
      * Compile a fused lifecycle route's entry closure: parse (body) → validate → the shared stage chain
      * of its hook shape (derive → before → handler → after → respond, see {@link fusedWebStages}) in a
-     * single frame, where the generic program walks staged hook loops. `selectRouteLanes` admits only
-     * derive, before and after hooks - no params or headers schema, onError, around, decorations,
-     * response contract or recovery hook, and never a query schema beside a body schema - so the behavior
-     * is the compiled program's: the same stage order, the same thrown-value contract (`Response` is
-     * control flow, anything else logs and 500s), the same `c.set` semantics and `fusedRespond` render.
-     * The route's own closure holds only its `FusedHooks` and schemas and takes the request's context as
-     * an argument, so a request allocates no step closures.
+     * single frame, where the generic program walks staged hook loops. `selectRouteLanes` admits ordinary
+     * validation stages and derive/before/after/error hooks, while excluding auth-first ordering, custom
+     * validation recovery, outer wrappers and response contracts. The shared input sequence preserves
+     * the program's validation order around body parsing; the hook chain preserves thrown-value, `c.set`
+     * and response-rendering semantics. The route's closure holds its `FusedHooks` and schemas, so a
+     * request allocates no step closures.
      */
     /**
      * Keep the common one-derive/one-before shape bound to its hooks. Inline its synchronous path to
@@ -3910,8 +4030,10 @@ export class Server {
             return this.respondFused(transformed, ctx, this.onResponseHooks.length === 0);
         };
     }
-    buildFusedLifecycleWeb(route, querySchema, bodySchema, maxBodyBytes) {
-        if (querySchema === undefined &&
+    buildFusedLifecycleWeb(route, schema, maxBodyBytes) {
+        const validationStages = compileFusedValidationStages(schema);
+        const bodySchema = schema?.body;
+        if (validationStages.length === 0 &&
             bodySchema === undefined &&
             route.errors.length === 0 &&
             route.decorations === undefined &&
@@ -3926,48 +4048,28 @@ export class Server {
         }
         const runDerive = sharedStages(WEB_STAGES, this, route, (d, b, a) => this.fusedWebStages(d, b, a));
         const decorations = route.decorations;
-        if (bodySchema !== undefined) {
-            const onParsed = (parsed, ctx) => {
-                let validation;
-                try {
-                    validation = bodySchema["~standard"].validate(parsed);
-                }
-                catch (err) {
-                    return this.fusedWebRouteFail(err, ctx, route);
-                }
-                if (validation instanceof Promise) {
-                    return validation.then((settled) => {
-                        if (settled.issues !== undefined)
-                            return this.wrapWebResponse(plainValidationError(settled.issues));
-                        ctx.body = settled.value;
-                        return runDerive(ctx, route, 0);
-                    }, (err) => this.fusedWebRouteFail(err, ctx, route));
-                }
-                if (validation.issues !== undefined)
-                    return this.wrapWebResponse(plainValidationError(validation.issues));
-                ctx.body = validation.value;
-                return runDerive(ctx, route, 0);
-            };
+        if (bodySchema === undefined) {
             return (source, params, search, signal, budget, platform, nativeContext) => {
                 const ctx = nativeContext
                     ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
                     : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
                 if (decorations !== undefined)
                     Object.assign(ctx, decorations);
-                return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, (parsed) => onParsed(parsed, ctx), this.wrapWebResponse, (err) => this.fusedWebRouteFail(err, ctx, route), bodySchema, this.formOrigins);
+                if (validationStages.length === 0)
+                    return runDerive(ctx, route, 0);
+                return runFusedValidationStages(validationStages, source, ctx, this.wrapWebResponse, (err) => this.fusedWebRouteFail(err, ctx, route), () => runDerive(ctx, route, 0));
             };
         }
-        return (source, params, search, signal, budget, platform, nativeContext) => {
-            const ctx = nativeContext
-                ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
-                : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
-            if (decorations !== undefined)
-                Object.assign(ctx, decorations);
-            if (querySchema === undefined)
-                return runDerive(ctx, route, 0);
+        const queryIndex = schema?.query === undefined ? validationStages.length : validationStages.length - 1;
+        const beforeBodyStages = validationStages.slice(0, queryIndex);
+        const afterBodyStages = validationStages.slice(queryIndex);
+        const runAfterBody = (source, ctx) => afterBodyStages.length === 0
+            ? runDerive(ctx, route, 0)
+            : runFusedValidationStages(afterBodyStages, source, ctx, this.wrapWebResponse, (err) => this.fusedWebRouteFail(err, ctx, route), () => runDerive(ctx, route, 0));
+        const onParsed = (parsed, source, ctx) => {
             let validation;
             try {
-                validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
+                validation = bodySchema["~standard"].validate(parsed);
             }
             catch (err) {
                 return this.fusedWebRouteFail(err, ctx, route);
@@ -3976,14 +4078,25 @@ export class Server {
                 return validation.then((settled) => {
                     if (settled.issues !== undefined)
                         return this.wrapWebResponse(plainValidationError(settled.issues));
-                    ctx.query = settled.value;
-                    return runDerive(ctx, route, 0);
+                    ctx.body = settled.value;
+                    return runAfterBody(source, ctx);
                 }, (err) => this.fusedWebRouteFail(err, ctx, route));
             }
             if (validation.issues !== undefined)
                 return this.wrapWebResponse(plainValidationError(validation.issues));
-            ctx.query = validation.value;
-            return runDerive(ctx, route, 0);
+            ctx.body = validation.value;
+            return runAfterBody(source, ctx);
+        };
+        const readBody = (source, ctx) => readBodyFramed(source, maxBodyBytes, this.protoPoisoning, (parsed) => onParsed(parsed, source, ctx), this.wrapWebResponse, (err) => this.fusedWebRouteFail(err, ctx, route), bodySchema, this.formOrigins);
+        return (source, params, search, signal, budget, platform, nativeContext) => {
+            const ctx = nativeContext
+                ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+                : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
+            if (decorations !== undefined)
+                Object.assign(ctx, decorations);
+            if (beforeBodyStages.length === 0)
+                return readBody(source, ctx);
+            return runFusedValidationStages(beforeBodyStages, source, ctx, this.wrapWebResponse, (err) => this.fusedWebRouteFail(err, ctx, route), () => readBody(source, ctx));
         };
     }
     /**
@@ -4196,70 +4309,60 @@ export class Server {
      * terminal `finalize` throw (an unstringifiable handler return on the Node lane) is caught as
      * `finishLifecycleContract` catches it; the body's 415/400 renders take `wrapResponse` directly.
      */
-    buildFusedLifecycleRunner(route, querySchema, bodySchema, maxBodyBytes) {
+    buildFusedLifecycleRunner(route, schema, maxBodyBytes) {
+        const validationStages = compileFusedValidationStages(schema);
+        const bodySchema = schema?.body;
         const runDerive = sharedStages(NODE_STAGES, this, route, (d, b, a) => this.fusedNodeStages(d, b, a));
         const decorations = route.decorations;
-        if (bodySchema !== undefined) {
-            const onParsed = (parsed, ctx, finalize, wrapResponse) => {
-                let validation;
-                try {
-                    validation = bodySchema["~standard"].validate(parsed);
-                }
-                catch (err) {
-                    return this.fusedFail(err, ctx, route, finalize, wrapResponse);
-                }
-                if (validation instanceof Promise) {
-                    return validation.then((settled) => {
-                        if (settled.issues !== undefined)
-                            return wrapResponse(plainValidationError(settled.issues));
-                        ctx.body = settled.value;
-                        return runDerive(ctx, route, finalize, wrapResponse, 0);
-                    }, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse));
-                }
-                if (validation.issues !== undefined)
-                    return wrapResponse(plainValidationError(validation.issues));
-                ctx.body = validation.value;
-                return runDerive(ctx, route, finalize, wrapResponse, 0);
-            };
+        if (bodySchema === undefined) {
             return (source, params, search, signal, budget, platform, nativeContext, finalize, wrapResponse) => {
                 const ctx = nativeContext
                     ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
                     : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
                 if (decorations !== undefined)
                     Object.assign(ctx, decorations);
-                return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, (parsed) => onParsed(parsed, ctx, finalize, wrapResponse), wrapResponse, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse), bodySchema, this.formOrigins);
+                if (validationStages.length === 0)
+                    return runDerive(ctx, route, finalize, wrapResponse, 0);
+                return runFusedValidationStages(validationStages, source, ctx, wrapResponse, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse), () => runDerive(ctx, route, finalize, wrapResponse, 0));
             };
         }
-        const runValidated = (validation, ctx, finalize, wrapResponse) => {
+        const queryIndex = schema?.query === undefined ? validationStages.length : validationStages.length - 1;
+        const beforeBodyStages = validationStages.slice(0, queryIndex);
+        const afterBodyStages = validationStages.slice(queryIndex);
+        const runAfterBody = (source, ctx, finalize, wrapResponse) => afterBodyStages.length === 0
+            ? runDerive(ctx, route, finalize, wrapResponse, 0)
+            : runFusedValidationStages(afterBodyStages, source, ctx, wrapResponse, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse), () => runDerive(ctx, route, finalize, wrapResponse, 0));
+        const onParsed = (parsed, source, ctx, finalize, wrapResponse) => {
+            let validation;
+            try {
+                validation = bodySchema["~standard"].validate(parsed);
+            }
+            catch (err) {
+                return this.fusedFail(err, ctx, route, finalize, wrapResponse);
+            }
             if (validation instanceof Promise) {
                 return validation.then((settled) => {
                     if (settled.issues !== undefined)
                         return wrapResponse(plainValidationError(settled.issues));
-                    ctx.query = settled.value;
-                    return runDerive(ctx, route, finalize, wrapResponse, 0);
+                    ctx.body = settled.value;
+                    return runAfterBody(source, ctx, finalize, wrapResponse);
                 }, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse));
             }
             if (validation.issues !== undefined)
                 return wrapResponse(plainValidationError(validation.issues));
-            ctx.query = validation.value;
-            return runDerive(ctx, route, finalize, wrapResponse, 0);
+            ctx.body = validation.value;
+            return runAfterBody(source, ctx, finalize, wrapResponse);
         };
+        const readBody = (source, ctx, finalize, wrapResponse) => readBodyFramed(source, maxBodyBytes, this.protoPoisoning, (parsed) => onParsed(parsed, source, ctx, finalize, wrapResponse), wrapResponse, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse), bodySchema, this.formOrigins);
         return (source, params, search, signal, budget, platform, nativeContext, finalize, wrapResponse) => {
             const ctx = nativeContext
                 ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
                 : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
             if (decorations !== undefined)
                 Object.assign(ctx, decorations);
-            if (querySchema === undefined)
-                return runDerive(ctx, route, finalize, wrapResponse, 0);
-            let validation;
-            try {
-                validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
-            }
-            catch (err) {
-                return this.fusedFail(err, ctx, route, finalize, wrapResponse);
-            }
-            return runValidated(validation, ctx, finalize, wrapResponse);
+            if (beforeBodyStages.length === 0)
+                return readBody(source, ctx, finalize, wrapResponse);
+            return runFusedValidationStages(beforeBodyStages, source, ctx, wrapResponse, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse), () => readBody(source, ctx, finalize, wrapResponse));
         };
     }
     /** The thrown-value render of the Web fused lifecycle lanes for a route with no error hooks: a
@@ -4944,7 +5047,7 @@ export class Server {
      * the table is kept to those paths. Where Bun would otherwise pass a request on to a less specific
      * path, the more specific one carries `fallback`, the portable dispatcher, under that method.
      * `peer` is the platform every request served from the table shares. */
-    buildBunNativeRoutes(fallback, peer, platformFor) {
+    buildBunNativeRoutes(fallback, peer, platformFor, allowStaticResponses = true) {
         const hooked = this.onRequestHooks.length > 0 && !this.bunNativeRequestHooksSafe;
         if ((hooked && platformFor === undefined) ||
             // A hook may rewrite a handshake onto a socket path, which only the dispatcher's upgrade check follows.
@@ -4960,6 +5063,18 @@ export class Server {
             // The capacity gate must wrap every request; the fused lane bypasses fetchMatched, so enabling
             // admission drops fusion (native matching stays) and routes through the gated matched lane.
             this.capacityGate === undefined;
+        // A response value skips every request callback, so every policy that could inspect it must be absent.
+        const mayUseStaticResponse = allowStaticResponses &&
+            !this.validateHost &&
+            !this.normalizeTarget &&
+            this.requestTimeoutMs === 0 &&
+            !this.acceptInboundDeadlines &&
+            this.capacityGate === undefined &&
+            this.onRequestHooks.length === 0 &&
+            this.onResponseHooks.length === 0 &&
+            this.onResponseFinalizedHooks.length === 0 &&
+            this.staticResponseHeaders === undefined &&
+            this.responseBodyTag === undefined;
         const unboundedSignal = mayUseFusedNative ? getNeverAbortSignal() : undefined;
         const unboundedBudget = mayUseFusedNative ? getUnboundedRequestBudget() : undefined;
         let count = 0;
@@ -5021,7 +5136,8 @@ export class Server {
             return routes[key];
         };
         for (let i = 0; i < all.length; i++) {
-            const { method, path, pattern, entry } = all[i];
+            const route = all[i];
+            const { method, path, pattern, entry } = route;
             const run = lead[i];
             // The route is served from the table unless its path cannot be there, Bun's table has no slot
             // for its method, or a path outside the table outranks it: Bun would hand this route a request
@@ -5036,6 +5152,32 @@ export class Server {
                 (method === "GET" && sockets.some((socket) => mayShareRequest(socket, pattern.segments)))) {
                 continue;
             }
+            const staticResponse = entry.staticResponse;
+            if (mayUseStaticResponse &&
+                staticResponse !== undefined &&
+                (method === "GET" || method === "HEAD") &&
+                // Bun 1.3 can misframe null-body status codes in its native static table.
+                staticResponse.status !== 204 &&
+                staticResponse.status !== 205 &&
+                staticResponse.status !== 304 &&
+                pattern.paramNames.length === 0 &&
+                entry.schema === undefined &&
+                entry.idempotent === undefined &&
+                entry.ledgered === undefined &&
+                entry.responseContract === undefined &&
+                entry.derives.length === 0 &&
+                entry.authStages.length === 0 &&
+                !entry.hasDecorations &&
+                entry.beforeHandle.length === 0 &&
+                entry.afterHandle.length === 0 &&
+                entry.onError.length === 0 &&
+                entry.around.length === 0 &&
+                route.assurance.length === 0 &&
+                (route.descriptor.capabilities?.length ?? 0) === 0) {
+                tableAt(path, pattern.segments)[method] = createStaticResponse(staticResponse);
+                count += 1;
+                continue;
+            }
             const paramNames = pattern.paramNames;
             const fused = mayUseFusedNative ? entry.execution.fusedWeb : undefined;
             const handler = this.compileBunNativeHandler(entry, method, paramNames, fused, unboundedSignal, unboundedBudget, peer, fallback, hooked ? platformFor : undefined);
@@ -5133,8 +5275,8 @@ export class Server {
         // matched route's handler, set by `server.upgrade`.
         // With WS routes, the dispatcher comes from the installed `.use(websocket())` runtime - non-null
         // because a socket route means ws() ran, and ws() requires the runtime at registration.
-        // Native pub/sub when the app has WS routes and none validate outbound frames: `ws.subscribe` and
-        // `app.publish` go through Bun's own (uWebSockets) broadcast instead of the JS registry loop.
+        // Native pub/sub when the app has WS routes, no custom adapter, and none validate outbound
+        // frames: `ws.subscribe` and `app.publish` go through Bun's own (uWebSockets) broadcast.
         // A mounted app counts only while it has a WebSocket route (see `[GET_WS_RUNTIME]`), so composing
         // one without any needs no runtime here.
         const wsRuntime = this[GET_WS_RUNTIME]();
@@ -5142,10 +5284,13 @@ export class Server {
             throw new FrameworkError("INVALID_WS_RUNTIME", "a Bun server with mounted WebSocket routes needs the websocket() runtime installed on the parent or child app");
         }
         // Native pub/sub is safe only when every upgrade belongs to this app. A mounted child that takes
-        // upgrades owns a different TopicRegistry, so force the per-connection JS dispatcher and carry
-        // that registry in the upgrade outcome instead of accidentally broadcasting child sockets through
+        // upgrades owns a different topic adapter, so force the per-connection JS dispatcher and carry
+        // that adapter in the upgrade outcome instead of accidentally broadcasting child sockets through
         // the parent.
-        const nativePubsub = this.wsRoutes.length > 0 && !this.mountsTakeUpgrades() && !this.wsHasValidatedSend;
+        const nativePubsub = this.wsRoutes.length > 0 &&
+            this.options.topicAdapter === undefined &&
+            !this.mountsTakeUpgrades() &&
+            !this.wsHasValidatedSend;
         const wsHandlers = wsRuntime?.bunHandlers(this.topics ?? wsRuntime.createTopics(), nativePubsub, this);
         // Spread rather than pass `hostname: undefined` (or an undefined idle timeout or TLS) - Bun treats
         // an explicit undefined as a value on some option paths, and omitting is what selects its own
@@ -5192,7 +5337,7 @@ export class Server {
         };
         const nativeRoutes = this.buildBunNativeRoutes(fallback, peer, (request, server) => 
         // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: `fallback` hands `fetch` the same platform, which holds no environment.
-        new BunPeerPlatform(server, request, setIdleTimeout));
+        new BunPeerPlatform(server, request, setIdleTimeout), options?.static === undefined);
         const first = options?.static;
         const before = (inner) => first === undefined
             ? inner
@@ -5210,7 +5355,7 @@ export class Server {
                 const methods = nativeRoutes[path];
                 for (const method of BUN_TABLE_METHODS) {
                     const handler = methods[method];
-                    if (handler !== undefined)
+                    if (typeof handler === "function")
                         methods[method] = before(handler);
                 }
             }