@server/next 0.40.4 → 0.41.0

package/index.d.ts

@@ -41,10 +41,14 @@ declare const redirect: (...args: Params<"redirect">) => Response;
 
 type Reply = ReturnType<typeof status>;
 type Method = "get" | "post" | "put" | "patch" | "delete" | "head" | "options" | "socket";
-type ServerConfig<Session = {}, User = {}> = {
-    Session?: Session;
-    User?: User;
+type ContextTypes = {
+    session?: any;
+    user?: any;
+    params?: any;
+    query?: any;
+    body?: any;
 };
+type Field<C, K extends keyof ContextTypes, Fallback> = K extends keyof C ? SchemaOutput<C[K], C[K]> : Fallback;
 declare namespace JSX {
     interface Element {
         type: any;
@@ -55,16 +59,49 @@ declare namespace JSX {
     }
 }
 type BodyMode = "parse" | "raw" | "stream";
-type BodyOption = BodyMode | {
-    mode?: BodyMode;
-    max?: number | string | false;
+type StandardIssue = {
+    readonly message: string;
+    readonly path?: readonly (PropertyKey | {
+        readonly key: PropertyKey;
+    })[];
 };
+interface StandardSchemaV1<Input = unknown, Output = Input> {
+    readonly "~standard": {
+        readonly version: 1;
+        readonly vendor: string;
+        readonly validate: (value: unknown) => {
+            value: Output;
+            issues?: undefined;
+        } | {
+            issues: readonly StandardIssue[];
+        } | Promise<{
+            value: Output;
+            issues?: undefined;
+        } | {
+            issues: readonly StandardIssue[];
+        }>;
+        readonly types?: {
+            readonly input: Input;
+            readonly output: Output;
+        };
+    };
+}
+type SchemaOutput<S, Fallback> = [S] extends [
+    StandardSchemaV1<any, infer Output>
+] ? Output : Fallback;
 type CacheOption = string | number | false;
-type RouteOptions = {
+type RouteSchema = {
     tags?: string | string[];
     title?: string;
     description?: string;
-    body?: BodyOption;
+};
+type RouteOptions = {
+    schema?: RouteSchema;
+    parser?: BodyMode;
+    body?: StandardSchemaV1<any, any>;
+    query?: StandardSchemaV1<any, any>;
+    params?: StandardSchemaV1<any, any>;
+    response?: StandardSchemaV1<any, any>;
     cache?: CacheOption;
 };
 type Route = {
@@ -197,6 +234,7 @@ type SecurityOptions = {
     hsts?: boolean | string;
     xssProtection?: boolean;
     traversalProtection?: boolean;
+    maxBody?: number | string | false;
     csp?: boolean | string;
     coop?: boolean | string;
     corp?: boolean | string;
@@ -205,6 +243,7 @@ type SecurityOptions = {
 type SecuritySettings = {
     trustProxy: boolean;
     traversalProtection: boolean;
+    maxBody: number;
     headers: Record<string, string>;
     hsts: string | null;
 };
@@ -227,7 +266,7 @@ type Options = {
     log?: LogLevel | boolean;
     favicon?: string | BucketFile;
     security?: boolean | SecurityOptions;
-    body?: BodyOption;
+    parser?: BodyMode;
     cache?: CacheOption;
 };
 type Settings = {
@@ -249,7 +288,7 @@ type Settings = {
     log: Logger;
     favicon?: string | BucketFile;
     security: SecuritySettings;
-    body: BodyOption;
+    parser: BodyMode;
     cache?: CacheOption;
 };
 type Time = {
@@ -280,27 +319,23 @@ type BunEnv = Record<string, string> & {
 };
 interface ContextExtension {
 }
-type Context<Params extends Record<string, string | undefined> = Record<string, string>, O extends ServerConfig = object> = {
+type Context<C extends ContextTypes = {}> = {
     method: Method;
     ip: string;
     headers: Record<string, string | string[]>;
     cookies: Record<string, string>;
-    body?: SerializableValue | Buffer | ReadableStream;
+    body?: Field<C, "body", SerializableValue | Buffer | ReadableStream>;
     url: URL & {
-        params: Params;
-        query: Record<string, string>;
+        params: Field<C, "params", Record<string, any>>;
+        query: Field<C, "query", Record<string, any>>;
     };
     options: Settings;
     platform: Platform;
     time?: Time;
     socket?: WebSocket;
     sockets?: WebSocket[];
-    session: O extends {
-        Session?: infer S;
-    } ? S extends Record<"Session", infer Inner> ? Inner : Record<string, any> : Record<string, any>;
-    user?: O extends {
-        User?: infer U;
-    } ? U extends Record<"User", infer Inner> ? Inner : AuthUser : AuthUser;
+    session: Field<C, "session", Record<string, any>>;
+    user?: Field<C, "user", Record<string, any>>;
     init: number;
     req?: Request;
     res?: Response & {
@@ -313,7 +348,7 @@ type InlineReply = Response | Reply | BucketFile | {
     headers?: Headers;
 } | SerializableValue | JSX.Element | Buffer | ReadableStream;
 type Body = InlineReply;
-type Middleware<O extends ServerConfig = object, Params extends Record<string, string | undefined> = Record<string, string>> = (ctx: Context<Params, O>) => InlineReply | Promise<InlineReply> | void | Promise<void>;
+type Middleware<C extends ContextTypes = {}> = (ctx: Context<C>) => InlineReply | Promise<InlineReply> | void | Promise<void>;
 
 type Variables = Record<string, string | string[]>;
 type ExtendError = string | {
@@ -336,50 +371,68 @@ declare global {
     var env: Record<string, any>;
 }
 
-type Mids<O extends ServerConfig, Path extends string> = Middleware<O, PathToParams<Path>>[];
-declare class Router<O extends ServerConfig = object> {
+type Fn<C extends ContextTypes> = (ctx: Context<C>) => ReturnType<Middleware>;
+type RouteCtx<C extends ContextTypes, RO extends RouteOptions, Params> = Omit<C, "params" | "query" | "body"> & {
+    params: [RO["params"]] extends [StandardSchemaV1<any, any>] ? RO["params"] : Params;
+} & Pick<RO, keyof RO & ("query" | "body")>;
+type Mids<C extends ContextTypes, Path extends string, RO extends RouteOptions = {}> = Fn<RouteCtx<C, RO, PathToParams<Path>>>[];
+type Exact<RO> = RouteOptions & {
+    [K in Exclude<keyof RO, keyof RouteOptions>]: never;
+};
+declare class Router<C extends ContextTypes = {}> {
     middleware: Middleware[];
     handlers: Record<Method, Route[]>;
     self(): this;
     handle(method: Method, pathOrFn?: any, ...rest: any[]): this;
-    socket<Path extends string>(path: Path, ...middleware: Mids<O, Path>): this;
-    socket<Path extends string>(path: Path, options: RouteOptions, ...middleware: Mids<O, Path>): this;
-    socket(...middleware: Middleware<O>[]): this;
-    socket(options: RouteOptions, ...middleware: Middleware<O>[]): this;
-    get<Path extends string>(path: Path, ...middleware: Mids<O, Path>): this;
-    get<Path extends string>(path: Path, options: RouteOptions, ...middleware: Mids<O, Path>): this;
-    get(...middleware: Middleware<O>[]): this;
-    get(options: RouteOptions, ...middleware: Middleware<O>[]): this;
-    head<Path extends string>(path: Path, ...middleware: Mids<O, Path>): this;
-    head<Path extends string>(path: Path, options: RouteOptions, ...middleware: Mids<O, Path>): this;
-    head(...middleware: Middleware<O>[]): this;
-    head(options: RouteOptions, ...middleware: Middleware<O>[]): this;
-    post<Path extends string>(path: Path, ...middleware: Mids<O, Path>): this;
-    post<Path extends string>(path: Path, options: RouteOptions, ...middleware: Mids<O, Path>): this;
-    post(...middleware: Middleware<O>[]): this;
-    post(options: RouteOptions, ...middleware: Middleware<O>[]): this;
-    put<Path extends string>(path: Path, ...middleware: Mids<O, Path>): this;
-    put<Path extends string>(path: Path, options: RouteOptions, ...middleware: Mids<O, Path>): this;
-    put(...middleware: Middleware<O>[]): this;
-    put(options: RouteOptions, ...middleware: Middleware<O>[]): this;
-    patch<Path extends string>(path: Path, ...middleware: Mids<O, Path>): this;
-    patch<Path extends string>(path: Path, options: RouteOptions, ...middleware: Mids<O, Path>): this;
-    patch(...middleware: Middleware<O>[]): this;
-    patch(options: RouteOptions, ...middleware: Middleware<O>[]): this;
-    delete<Path extends string>(path: Path, ...middleware: Mids<O, Path>): this;
-    delete<Path extends string>(path: Path, options: RouteOptions, ...middleware: Mids<O, Path>): this;
-    delete(...middleware: Middleware<O>[]): this;
-    delete(options: RouteOptions, ...middleware: Middleware<O>[]): this;
-    options<Path extends string>(path: Path, ...middleware: Mids<O, Path>): this;
-    options<Path extends string>(path: Path, options: RouteOptions, ...mid: Mids<O, Path>): this;
-    options(...middleware: Middleware<O>[]): this;
-    options(options: RouteOptions, ...middleware: Middleware<O>[]): this;
-    use(...middleware: Middleware[]): this;
-    use(router: Router): this;
+    socket<Path extends string>(path: Path, ...middleware: Mids<C, Path>): this;
+    socket(...middleware: Fn<C>[]): this;
+    socket<RO extends Exact<RO>>(options: RO, ...middleware: Fn<RouteCtx<C, RO, Record<string, string>>>[]): this;
+    socket<Path extends string, RO extends Exact<RO>>(path: Path, options: RO, ...middleware: Mids<C, Path, RO>): this;
+    get<Path extends string>(path: Path, ...middleware: Mids<C, Path>): this;
+    get(...middleware: Fn<C>[]): this;
+    get<RO extends Exact<RO>>(options: RO, ...middleware: Fn<RouteCtx<C, RO, Record<string, string>>>[]): this;
+    get<Path extends string, RO extends Exact<RO>>(path: Path, options: RO, ...middleware: Mids<C, Path, RO>): this;
+    head<Path extends string>(path: Path, ...middleware: Mids<C, Path>): this;
+    head(...middleware: Fn<C>[]): this;
+    head<RO extends Exact<RO>>(options: RO, ...middleware: Fn<RouteCtx<C, RO, Record<string, string>>>[]): this;
+    head<Path extends string, RO extends Exact<RO>>(path: Path, options: RO, ...middleware: Mids<C, Path, RO>): this;
+    post<Path extends string>(path: Path, ...middleware: Mids<C, Path>): this;
+    post(...middleware: Fn<C>[]): this;
+    post<RO extends Exact<RO>>(options: RO, ...middleware: Fn<RouteCtx<C, RO, Record<string, string>>>[]): this;
+    post<Path extends string, RO extends Exact<RO>>(path: Path, options: RO, ...middleware: Mids<C, Path, RO>): this;
+    put<Path extends string>(path: Path, ...middleware: Mids<C, Path>): this;
+    put(...middleware: Fn<C>[]): this;
+    put<RO extends Exact<RO>>(options: RO, ...middleware: Fn<RouteCtx<C, RO, Record<string, string>>>[]): this;
+    put<Path extends string, RO extends Exact<RO>>(path: Path, options: RO, ...middleware: Mids<C, Path, RO>): this;
+    patch<Path extends string>(path: Path, ...middleware: Mids<C, Path>): this;
+    patch(...middleware: Fn<C>[]): this;
+    patch<RO extends Exact<RO>>(options: RO, ...middleware: Fn<RouteCtx<C, RO, Record<string, string>>>[]): this;
+    patch<Path extends string, RO extends Exact<RO>>(path: Path, options: RO, ...middleware: Mids<C, Path, RO>): this;
+    delete<Path extends string>(path: Path, ...middleware: Mids<C, Path>): this;
+    delete(...middleware: Fn<C>[]): this;
+    delete<RO extends Exact<RO>>(options: RO, ...middleware: Fn<RouteCtx<C, RO, Record<string, string>>>[]): this;
+    delete<Path extends string, RO extends Exact<RO>>(path: Path, options: RO, ...middleware: Mids<C, Path, RO>): this;
+    options<Path extends string>(path: Path, ...middleware: Mids<C, Path>): this;
+    options(...middleware: Fn<C>[]): this;
+    options<RO extends Exact<RO>>(options: RO, ...middleware: Fn<RouteCtx<C, RO, Record<string, string>>>[]): this;
+    options<Path extends string, RO extends Exact<RO>>(path: Path, options: RO, ...mid: Mids<C, Path, RO>): this;
+    use(...middleware: Fn<C>[]): this;
+    use(router: Router<any>): this;
+}
+declare function router<C extends ContextTypes = {}>(): Router<C>;
+
+declare class StatusError extends Error {
+    status: number;
+    constructor(msg: string, status?: number);
+}
+
+declare class ValidationError extends StatusError {
+    source: "body" | "query" | "params" | "response";
+    issues: readonly StandardIssue[];
+    constructor(source: "body" | "query" | "params" | "response", issues: readonly StandardIssue[]);
 }
-declare function router(): Router;
 
-declare class Server<O extends ServerConfig = {}> extends Router<O> {
+declare class Server<C extends ContextTypes = {}> extends Router<C> {
     settings: Settings;
     platform: Platform;
     sockets: any[];
@@ -397,111 +450,111 @@ declare class Server<O extends ServerConfig = {}> extends Router<O> {
     callback(request: Request, context: unknown): Promise<Response>;
     test(): {
         get: (path: string, options?: {
+            method?: string;
+            headers?: HeadersInit;
             cache?: RequestCache;
+            redirect?: RequestRedirect;
             credentials?: RequestCredentials;
-            headers?: HeadersInit;
             integrity?: string;
             keepalive?: boolean;
-            method?: string;
             mode?: RequestMode;
             priority?: RequestPriority;
-            redirect?: RequestRedirect;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
             signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
         head: (path: string, options?: {
+            method?: string;
+            headers?: HeadersInit;
             cache?: RequestCache;
+            redirect?: RequestRedirect;
             credentials?: RequestCredentials;
-            headers?: HeadersInit;
             integrity?: string;
             keepalive?: boolean;
-            method?: string;
             mode?: RequestMode;
             priority?: RequestPriority;
-            redirect?: RequestRedirect;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
             signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
-        post: (path: string, body?: string | number | boolean | ArrayBuffer | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams | {
+        post: (path: string, body?: string | number | boolean | ArrayBuffer | {
             [key: string]: SerializableValue;
-        } | SerializableValue[], options?: {
+        } | SerializableValue[] | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams, options?: {
+            method?: string;
+            headers?: HeadersInit;
             cache?: RequestCache;
+            redirect?: RequestRedirect;
             credentials?: RequestCredentials;
-            headers?: HeadersInit;
             integrity?: string;
             keepalive?: boolean;
-            method?: string;
             mode?: RequestMode;
             priority?: RequestPriority;
-            redirect?: RequestRedirect;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
             signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
-        put: (path: string, body?: string | number | boolean | ArrayBuffer | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams | {
+        put: (path: string, body?: string | number | boolean | ArrayBuffer | {
             [key: string]: SerializableValue;
-        } | SerializableValue[], options?: {
+        } | SerializableValue[] | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams, options?: {
+            method?: string;
+            headers?: HeadersInit;
             cache?: RequestCache;
+            redirect?: RequestRedirect;
             credentials?: RequestCredentials;
-            headers?: HeadersInit;
             integrity?: string;
             keepalive?: boolean;
-            method?: string;
             mode?: RequestMode;
             priority?: RequestPriority;
-            redirect?: RequestRedirect;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
             signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
-        patch: (path: string, body?: string | number | boolean | ArrayBuffer | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams | {
+        patch: (path: string, body?: string | number | boolean | ArrayBuffer | {
             [key: string]: SerializableValue;
-        } | SerializableValue[], options?: {
+        } | SerializableValue[] | ReadableStream<any> | Blob | ArrayBufferView<ArrayBuffer> | FormData | URLSearchParams, options?: {
+            method?: string;
+            headers?: HeadersInit;
             cache?: RequestCache;
+            redirect?: RequestRedirect;
             credentials?: RequestCredentials;
-            headers?: HeadersInit;
             integrity?: string;
             keepalive?: boolean;
-            method?: string;
             mode?: RequestMode;
             priority?: RequestPriority;
-            redirect?: RequestRedirect;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
             signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
         delete: (path: string, options?: {
+            method?: string;
+            headers?: HeadersInit;
             cache?: RequestCache;
+            redirect?: RequestRedirect;
             credentials?: RequestCredentials;
-            headers?: HeadersInit;
             integrity?: string;
             keepalive?: boolean;
-            method?: string;
             mode?: RequestMode;
             priority?: RequestPriority;
-            redirect?: RequestRedirect;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
             signal?: AbortSignal | null;
             window?: null;
         }) => Promise<Response>;
         options: (path: string, options?: {
+            method?: string;
+            headers?: HeadersInit;
             cache?: RequestCache;
+            redirect?: RequestRedirect;
             credentials?: RequestCredentials;
-            headers?: HeadersInit;
             integrity?: string;
             keepalive?: boolean;
-            method?: string;
             mode?: RequestMode;
             priority?: RequestPriority;
-            redirect?: RequestRedirect;
             referrer?: string;
             referrerPolicy?: ReferrerPolicy;
             signal?: AbortSignal | null;
@@ -509,6 +562,6 @@ declare class Server<O extends ServerConfig = {}> extends Router<O> {
         }) => Promise<Response>;
     };
 }
-declare function server<Session extends Record<string, any> = {}, User extends Record<string, any> = {}>(options?: Options): Server<ServerConfig<Session, User>>;
+declare function server<C extends ContextTypes = {}>(options?: Options): Server<C>;
 
-export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type BodyMode, type BodyOption, type Bucket, type BucketFile, type BunEnv, type CacheOption, type Context, type ContextExtension, type Cookie, type CorsSettings, type ExtractPathParams, type FileInfo, type InferParamType, type InlineReply, type KVStore, type LogLevel, type Logger, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type ProfileUser, type Provider, type Route, type RouteOptions, type RouterMethod, type SecurityOptions, type SecuritySettings, type SerializableValue, Server, type ServerConfig, TypedServerError as ServerError, type Settings, type StoreSource, type Strategy, type Time, type UploadOptions, type UploadedFile, cache, cookies, server as default, download, file, headers, json, redirect, router, send, status, type };
+export { type AuthOption, type AuthSession, type AuthSettings, type AuthUser, type BasicValue, type Body, type BodyMode, type Bucket, type BucketFile, type BunEnv, type CacheOption, type Context, type ContextExtension, type ContextTypes, type Cookie, type CorsSettings, type ExtractPathParams, type FileInfo, type InferParamType, type InlineReply, type KVStore, type LogLevel, type Logger, type Method, type Middleware, type Options, type ParamTypeMap, type ParamsToObject, type PathToParams, type Platform, type ProfileUser, type Provider, type Route, type RouteOptions, type RouteSchema, type RouterMethod, type SchemaOutput, type SecurityOptions, type SecuritySettings, type SerializableValue, Server, TypedServerError as ServerError, type Settings, type StandardIssue, type StandardSchemaV1, type StoreSource, type Strategy, type Time, type UploadOptions, type UploadedFile, ValidationError, cache, cookies, server as default, download, file, headers, json, redirect, router, send, status, type };

package/index.js

@@ -220,7 +220,7 @@ function human(bytes) {
   return `${rounded}${UNITS[i]}`;
 }
 var tooLarge = (max) => new StatusError(
-  `Request body exceeds the ${human(max)} limit. Raise it with body: { max: '10mb' } on the route or server, or set max: false to disable.`,
+  `Request body exceeds the ${human(max)} limit. Raise it with security: { maxBody: '10mb' }, or maxBody: false to disable it.`,
   413
 );
 
@@ -577,11 +577,9 @@ var sources = /* @__PURE__ */ new WeakMap();
 function setBodySource(ctx, source) {
   sources.set(ctx, source);
 }
-async function resolveBody(ctx, body) {
+async function resolveBody(ctx, mode = "parse", max = resolveMax(void 0)) {
   const source = sources.get(ctx);
   if (!source) return void 0;
-  const mode = typeof body === "string" ? body : body?.mode ?? "parse";
-  const max = resolveMax(typeof body === "object" ? body?.max : void 0);
   const contentType = String(ctx.headers["content-type"] || "");
   const isMultipart = /multipart\/form-data/i.test(contentType);
   const declared = Number(ctx.headers["content-length"]);
@@ -1631,6 +1629,9 @@ function resolveSecurity(security) {
   return {
     trustProxy: o.trustProxy ?? true,
     traversalProtection: off ? false : o.traversalProtection !== false,
+    // Cap on the bytes buffered per request (see bodyLimit). `false` (or
+    // turning security off entirely) resolves to Infinity, meaning no limit.
+    maxBody: off ? INF : resolveMax(o.maxBody),
     headers: headers2,
     hsts: off ? null : val(o.hsts, "max-age=15552000; includeSubDomains")
   };
@@ -1661,6 +1662,19 @@ function applySecurity(res, ctx) {
 // src/helpers/config.ts
 function config(options = {}) {
   const env2 = globalThis.env;
+  const opts = options;
+  if (typeof opts.body === "string") {
+    throw new Error(
+      `The root \`body: '${opts.body}'\` option is now \`parser: '${opts.body}'\`.`
+    );
+  }
+  for (const key of ["body", "query", "params", "response"]) {
+    if (opts[key] !== void 0) {
+      throw new Error(
+        `\`${key}\` is a route option, not a root one; pass it per route, like .post('/', { ${key} }, handler).`
+      );
+    }
+  }
   const raw = options.log ?? env2.LOG_LEVEL;
   const level = raw === true ? "info" : raw === false ? void 0 : raw;
   const log = createLogger(level);
@@ -1670,7 +1684,7 @@ function config(options = {}) {
     log,
     // How request bodies are read: parsed into ctx.body by default; `raw` keeps
     // the Buffer, `stream` hands the handler the unread web ReadableStream.
-    body: options.body ?? "parse",
+    parser: options.parser ?? "parse",
     // Secure-by-default response headers + trustProxy for ctx.ip. `false` turns
     // the added headers off; see resolveSecurity for the defaults.
     security: resolveSecurity(options.security)
@@ -1808,7 +1822,7 @@ function applyCors(res, ctx) {
 
 // src/helpers/createWebsocket.ts
 function createWebsocket(sockets, handlers) {
-  const run = (event, socket, body) => {
+  const run2 = (event, socket, body) => {
     const routes = handlers.socket?.filter((r2) => r2.path === event) ?? [];
     const user = socket.user ?? socket.data?.user;
     for (const route of routes) {
@@ -1818,14 +1832,14 @@ function createWebsocket(sockets, handlers) {
     }
   };
   return {
-    message: (socket, body) => run("message", socket, body),
+    message: (socket, body) => run2("message", socket, body),
     open: (socket) => {
       sockets.push(socket);
-      run("open", socket);
+      run2("open", socket);
     },
     close: (socket) => {
       sockets.splice(sockets.indexOf(socket), 1);
-      run("close", socket);
+      run2("close", socket);
     }
   };
 }
@@ -2009,36 +2023,48 @@ function pathPattern(pattern, path) {
   return null;
 }
 
-// src/helpers/validate.ts
-function validate(ctx, schema) {
-  if (!schema || typeof schema !== "object") return;
-  let base;
-  try {
-    if (typeof schema?.body === "function") {
-      base = "body";
-      schema.body(ctx.body || {});
-    }
-    if (typeof schema?.body?.parse === "function") {
-      base = "body";
-      schema.body.parse(ctx.body || {});
-    }
-    if (typeof schema?.query === "function") {
-      base = "query";
-      schema.query(ctx.url.query || {});
-    }
-    if (typeof schema?.query?.parse === "function") {
-      base = "query";
-      schema.query.parse(ctx.url.query || {});
-    }
-  } catch (error) {
-    if (error.name === "ZodError" || error.constructor.name === "ZodError") {
-      const message = error.issues.map(
-        ({ path, message: message2 }) => `[${base}.${path.join(".")}]: ${message2}`
-      ).sort().join("\n");
-      throw new StatusError(message, 422);
+// src/errors/ValidationError.ts
+var ValidationError = class extends StatusError {
+  source;
+  issues;
+  constructor(source, issues) {
+    if (source === "response") {
+      super("Server Error", 500);
+    } else {
+      super(`Invalid request ${source}`, 422);
     }
-    throw error;
+    this.source = source;
+    this.issues = issues;
   }
+};
+
+// src/helpers/validate.ts
+async function run(schema, value, source) {
+  const result = await schema["~standard"].validate(value);
+  if (result.issues) throw new ValidationError(source, result.issues);
+  return result.value;
+}
+async function validateRequest(ctx, options) {
+  if (options.body) {
+    ctx.body = await run(options.body, ctx.body ?? {}, "body");
+  }
+  if (options.query) {
+    const query = await run(options.query, ctx.url.query || {}, "query");
+    replace2(ctx.url.query, query);
+  }
+  if (options.params) {
+    const params = await run(options.params, ctx.url.params || {}, "params");
+    replace2(ctx.url.params, params);
+  }
+}
+async function validateResponse(out, options) {
+  if (!options.response) return out;
+  if (out?.constructor !== Object && !Array.isArray(out)) return out;
+  return await run(options.response, out, "response");
+}
+function replace2(target, values) {
+  for (const key of Object.keys(target)) delete target[key];
+  Object.assign(target, values);
 }
 
 // src/helpers/handleRequest.ts
@@ -2063,20 +2089,28 @@ async function getResponse(app, ctx) {
         ctx.options = { ...app.settings, ...route.options };
       }
       checkTraversal(params, ctx);
-      ctx.body = await resolveBody(ctx, ctx.options.body);
+      ctx.body = await resolveBody(
+        ctx,
+        ctx.options.parser,
+        ctx.options.security.maxBody
+      );
+      await validateRequest(ctx, route.options);
       for (const cb of route.fns) {
-        if (typeof cb === "function") {
-          const res = await cb(ctx);
-          const out = await parseResponse(res, ctx);
-          if (out) return out;
-        } else {
-          validate(ctx, cb);
-        }
+        const res = await cb(ctx);
+        const out = await parseResponse(
+          await validateResponse(res, route.options),
+          ctx
+        );
+        if (out) return out;
       }
       break;
     }
     if (!matched) {
-      ctx.body = await resolveBody(ctx, ctx.options.body);
+      ctx.body = await resolveBody(
+        ctx,
+        ctx.options.parser,
+        ctx.options.security.maxBody
+      );
       for (const mw of app.middleware) {
         const out = await parseResponse(await mw(ctx), ctx);
         if (out) return out;
@@ -2541,8 +2575,8 @@ var generateOpenApiPaths = (handlers) => {
     for (const route of routes) {
       const path = route.path;
       const fn = route.fns.find((p) => typeof p === "function");
-      const meta = route.fns.find((p) => typeof p === "object");
-      const config2 = getConfig(route.options);
+      const meta = route.options ?? {};
+      const config2 = getConfig(route.options?.schema);
       if (typeof path !== "string" || path === "*" || path === "/docs" || !fn) {
         continue;
       }
@@ -2595,7 +2629,7 @@ var generateOpenApiPaths = (handlers) => {
       paths[normalizedPath][method] = {
         tags: config2.tags,
         summary: config2.title || getTag("@title", fn) || `${method.toUpperCase()} ${normalizedPath}`,
-        description: getTitle(fn) || getDescription(fn),
+        description: config2.description || getTitle(fn) || getDescription(fn),
         requestBody,
         parameters,
         responses
@@ -3052,6 +3086,14 @@ var Netlify = async (app, request, context) => {
 };
 
 // src/router.ts
+function checkParserConflict(options, globalParser) {
+  const parser = options.parser ?? globalParser ?? "parse";
+  if (options.body && parser !== "parse") {
+    throw new Error(
+      `A \`parser: '${parser}'\` route never parses the body, so its \`body\` schema cannot run. Remove one, or set \`parser: 'parse'\` on the route.`
+    );
+  }
+}
 var Router = class _Router {
   // Cross-cutting middleware added with .use(); they run on every request
   middleware = [];
@@ -3085,6 +3127,7 @@ var Router = class _Router {
     if (rest[0] != null && typeof rest[0] !== "function") {
       options = rest.shift();
     }
+    checkParserConflict(options, this.settings?.parser);
     const base = method === "socket" ? [] : this.middleware;
     const fns = [...base, ...rest].filter((fn) => fn != null);
     this.handlers[method].push({ path, options, fns });
@@ -3119,6 +3162,7 @@ var Router = class _Router {
       if (arg instanceof _Router) {
         for (const m of Object.keys(arg.handlers)) {
           for (const route of arg.handlers[m]) {
+            checkParserConflict(route.options, this.settings?.parser);
             const base = m === "socket" ? [] : this.middleware;
             this.handlers[m].push({
               path: route.path,
@@ -3208,16 +3252,17 @@ var Server = class extends Router {
     } else if (this.platform.runtime === "bun") {
       this.settings.log.start(`http://localhost:${this.settings.port}/`);
     }
-    this.use(timer);
-    if (this.settings.cors) this.use(preflight);
-    this.use(assets);
-    if (this.settings.favicon) this.get("/favicon.ico", favicon);
-    this.use(session);
+    const app = this;
+    app.use(timer);
+    if (this.settings.cors) app.use(preflight);
+    app.use(assets);
+    if (this.settings.favicon) app.get("/favicon.ico", favicon);
+    app.use(session);
     if (this.settings.auth) {
-      auth(this);
+      auth(app);
     }
     if (this.settings.openapi) {
-      this.get(this.settings.openapi.path || "/docs", openapi_default);
+      app.get(this.settings.openapi.path || "/docs", openapi_default);
     }
   }
   self() {
@@ -3252,6 +3297,7 @@ function server(options) {
 export {
   Server,
   ServerError_default as ServerError,
+  ValidationError,
   default3 as bucket,
   cache,
   cookies,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@server/next",
-  "version": "0.40.4",
+  "version": "0.41.0",
   "description": "A fully-fledged web server with routing, file uploads, sessions, static files, schema validation, websockets, testing, etc.",
   "homepage": "https://server-js.com/",
   "repository": "github:franciscop/server-next",
@@ -70,9 +70,12 @@
   "devDependencies": {
     "@types/bun": "^1.3.0",
     "@types/node": "^24.10.0",
+    "arktype": "^2.2.3",
     "bun": "^1.3.13",
     "check-dts": "^0.8.2",
     "tsup": "^8.5.1",
-    "typescript": "^6.0.2"
+    "typescript": "^6.0.2",
+    "valibot": "^1.4.2",
+    "zod": "^4.4.3"
   }
 }