castrum 0.9.8 → 0.9.10

package/dist/index.js

@@ -36,6 +36,13 @@ function detectRuntimeName() {
 function isBunRuntime() {
   return detectedRuntime === "bun";
 }
+function forceGc() {
+  if (detectedRuntime === "bun") {
+    Bun.gc(true);
+    return;
+  }
+  globalThis.gc?.();
+}
 var detectedRuntime;
 var init_detect = __esm(() => {
   detectedRuntime = detectRuntimeName();
@@ -638,10 +645,11 @@ function buildFFISymbolMap(useBufferLength) {
 }
 
 // src/shared/runtime.ts
-var isBun;
+var isBun, forceGc2;
 var init_runtime = __esm(() => {
   init_detect();
   isBun = isBunRuntime;
+  forceGc2 = forceGc;
 });
 
 // src/shared/codec.ts
@@ -3609,6 +3617,24 @@ var init_options = __esm(() => {
 });
 
 // src/rust-ffi/context.ts
+function evictOldestHalf(map) {
+  if (map.size < MIME_CACHE_MAX)
+    return [];
+  const drop = Math.ceil(map.size / 2);
+  const dropped = [];
+  for (const key of map.keys()) {
+    if (dropped.length >= drop)
+      break;
+    dropped.push(key);
+  }
+  for (const key of dropped)
+    map.delete(key);
+  return dropped;
+}
+function clearMimeCaches() {
+  mimeByText.clear();
+  mimeStrCache.clear();
+}
 function resolveNative(ctx, name) {
   let f = nativeFnCache.get(name);
   if (f === undefined) {
@@ -3637,7 +3663,6 @@ function memoizeFfi(transport) {
   };
 }
 function createContext(options) {
-  const mimeByText = new Map;
   const hmacSigners = new WeakMap;
   const state = {
     mimeCache: options.mimeCache !== false,
@@ -3667,6 +3692,7 @@ function createContext(options) {
     const key = normalizeExt(ext);
     let val = mimeByText.get(key);
     if (!val) {
+      evictOldestHalf(mimeByText);
       val = addon.mimeFromExtension(ext);
       mimeByText.set(key, val);
     }
@@ -3687,7 +3713,6 @@ function createContext(options) {
     addon,
     runtime: runtimeNative,
     state,
-    mimeByText,
     hmacSigners,
     ensurePool,
     isPoolInitialized,
@@ -3697,12 +3722,14 @@ function createContext(options) {
     hmacSigner
   };
 }
-var nativeFnCache;
+var nativeFnCache, MIME_CACHE_MAX = 1024, mimeByText, mimeStrCache;
 var init_context = __esm(() => {
   init_native2();
   init_addon();
   init_options();
   nativeFnCache = new Map;
+  mimeByText = new Map;
+  mimeStrCache = new Map;
 });
 
 // src/rust-ffi/batch/build.ts
@@ -4533,6 +4560,10 @@ function buildFactories(ctx) {
     },
     rayonNumThreads() {
       return asNumber(addon.rayonNumThreads());
+    },
+    clearSchemaCache() {
+      const native = addon;
+      native.clearSchemaCache?.();
     }
   };
 }
@@ -5218,13 +5249,13 @@ var init_scalar = __esm(() => {
 // src/rust-ffi/text.ts
 function buildText(ctx) {
   const { builtins, transport } = ctx.runtime;
-  const mimeStrCache = new Map;
   return {
     mimeFromExtension(ext) {
       let mime = mimeStrCache.get(ext);
       if (mime === undefined) {
         const f = transport.ffi;
         mime = f ? f.mimeFromExtension(ext) ?? "application/octet-stream" : decoder.decode(ctx.cachedMime(encoder.encode(ext)));
+        evictOldestHalf(mimeStrCache);
         mimeStrCache.set(ext, mime);
       }
       return mime;
@@ -5549,6 +5580,15 @@ function compileNapi(descriptor) {
   }
 }
 
+// src/ingress/abort.ts
+var ABORT_CODE = "REQUEST_ABORTED";
+function isAbortError(err) {
+  return err?.code === ABORT_CODE;
+}
+function abortResponse() {
+  return new Response(null, { status: 499 });
+}
+
 // src/ingress/headers/memoized-headers.ts
 var CACHE = new WeakMap;
 function memoizedHeaders(entries) {
@@ -5607,7 +5647,11 @@ function buildSuccessInit(ingress, result, ctx, status = 200) {
   return { status, headers };
 }
 function runBaked(ingress, opts, respond) {
-  return (req, srv) => ingress.run(req, resolveIp(req, srv, opts), null, respond);
+  return (req, srv) => {
+    if (req.signal?.aborted)
+      return abortResponse();
+    return ingress.run(req, resolveIp(req, srv, opts), null, respond);
+  };
 }
 // src/ingress/routes/read.ts
 function readHandler(ingress, opts = {}) {
@@ -5658,6 +5702,44 @@ function bodyTooLargeError() {
   err.code = "BODY_TOO_LARGE";
   return err;
 }
+function abortError() {
+  const err = new Error(ABORT_CODE);
+  err.code = ABORT_CODE;
+  return err;
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted)
+    throw abortError();
+}
+function createAbortGuard(signal) {
+  if (!signal)
+    return null;
+  if (signal.aborted) {
+    return { promise: Promise.reject(abortError()), cancel: () => {} };
+  }
+  let listener = null;
+  const promise = new Promise((_resolve, reject) => {
+    listener = () => reject(abortError());
+    signal.addEventListener("abort", listener, { once: true });
+  });
+  return {
+    promise,
+    cancel: () => {
+      if (listener !== null) {
+        signal.removeEventListener("abort", listener);
+        listener = null;
+      }
+    }
+  };
+}
+function raceRead(read, guards) {
+  if (guards.length === 0)
+    return read;
+  const racers = [read];
+  for (const guard of guards)
+    racers.push(guard.promise);
+  return Promise.race(racers);
+}
 var bodyWatchdog = (() => {
   const inflight = new Set;
   let timer = null;
@@ -5709,6 +5791,7 @@ function createDeadline(deadlineMs) {
   return { promise, cancel: () => bodyWatchdog.untrack(entry) };
 }
 async function readBodyWithLimit(req, maxBytes, guard, timeoutMs) {
+  throwIfAborted(req.signal);
   const deadline = timeoutMs && timeoutMs > 0 ? timeoutMs : 0;
   const declared = req.headers.get("content-length");
   if (declared !== null) {
@@ -5718,45 +5801,67 @@ async function readBodyWithLimit(req, maxBytes, guard, timeoutMs) {
         throw bodyTooLargeError();
       }
       if (deadline <= 0) {
-        const bytes = await readBodyBytes(req);
-        if (guard && bytes.byteLength > maxBytes) {
-          throw bodyTooLargeError();
+        const buffered = peekBufferedBody(req);
+        if (buffered !== false && "bytes" in buffered) {
+          throwIfAborted(req.signal);
+          if (guard && buffered.bytes.byteLength > maxBytes) {
+            throw bodyTooLargeError();
+          }
+          return buffered.bytes;
+        }
+        const abort = createAbortGuard(req.signal);
+        try {
+          const bytes = await raceRead(buffered === false ? readBodyBytes(req) : buffered, abort !== null ? [abort] : []);
+          throwIfAborted(req.signal);
+          if (guard && bytes.byteLength > maxBytes) {
+            throw bodyTooLargeError();
+          }
+          return bytes;
+        } finally {
+          abort?.cancel();
         }
-        return bytes;
       }
       const buffered = peekBufferedBody(req);
       if (buffered === false) {
         const dl = createDeadline(deadline);
+        const abort = createAbortGuard(req.signal);
         try {
-          const bytes = await Promise.race([readBodyBytes(req), dl.promise]);
+          const bytes = await raceRead(readBodyBytes(req), abort !== null ? [dl, abort] : [dl]);
+          throwIfAborted(req.signal);
           if (guard && bytes.byteLength > maxBytes) {
             throw bodyTooLargeError();
           }
           return bytes;
         } finally {
           dl.cancel();
+          abort?.cancel();
         }
       }
       if ("bytes" in buffered) {
+        throwIfAborted(req.signal);
         if (guard && buffered.bytes.byteLength > maxBytes) {
           throw bodyTooLargeError();
         }
         return buffered.bytes;
       }
       const dl = createDeadline(deadline);
+      const abort = createAbortGuard(req.signal);
       try {
-        const bytes = await Promise.race([buffered, dl.promise]);
+        const bytes = await raceRead(buffered, abort !== null ? [dl, abort] : [dl]);
+        throwIfAborted(req.signal);
         if (guard && bytes.byteLength > maxBytes) {
           throw bodyTooLargeError();
         }
         return bytes;
       } finally {
         dl.cancel();
+        abort?.cancel();
       }
     }
   }
   const body = req.body;
   if (!body) {
+    throwIfAborted(req.signal);
     return EMPTY_BODY;
   }
   const reader = body.getReader();
@@ -5764,9 +5869,15 @@ async function readBodyWithLimit(req, maxBytes, guard, timeoutMs) {
   let total = 0;
   let completed = false;
   const dl = deadline > 0 ? createDeadline(deadline) : null;
+  const abort = createAbortGuard(req.signal);
+  const guards = [];
+  if (dl !== null)
+    guards.push(dl);
+  if (abort !== null)
+    guards.push(abort);
   try {
     for (;; ) {
-      const { done, value } = dl !== null ? await Promise.race([reader.read(), dl.promise]) : await reader.read();
+      const { done, value } = await raceRead(reader.read(), guards);
       if (done) {
         completed = true;
         break;
@@ -5781,6 +5892,7 @@ async function readBodyWithLimit(req, maxBytes, guard, timeoutMs) {
     }
   } finally {
     dl?.cancel();
+    abort?.cancel();
     if (!completed) {
       await reader.cancel().catch(() => {});
     }
@@ -6000,6 +6112,8 @@ function echoHandler(ingress, opts = {}) {
   const bodyTimeoutMs = opts.bodyTimeoutMs ?? DEFAULT_BODY_TIMEOUT_MS;
   return async (req, srv) => {
     const ip = resolveIp(req, srv, opts);
+    if (req.signal?.aborted)
+      return abortResponse();
     const prep = ingress.run(req, ip, null, (result, ctx) => {
       const terminal = ingress.terminalResponse(req, result, ctx);
       if (terminal)
@@ -6014,6 +6128,8 @@ function echoHandler(ingress, opts = {}) {
     });
     if (prep.terminal)
       return prep.terminal;
+    if (req.signal?.aborted)
+      return abortResponse();
     const baseHeaders = prep.headers ?? [];
     const requestedContentType = safeEchoContentType(req.headers.get("content-type") ?? "application/octet-stream");
     const withEchoHeaders = (contentType) => {
@@ -6045,11 +6161,15 @@ function echoHandler(ingress, opts = {}) {
     }
     try {
       const bodyBytes = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs);
+      if (req.signal?.aborted)
+        return abortResponse();
       return new Response(bodyBytes.byteLength > 0 ? bodyBytes : null, {
         status: 200,
         headers: withEchoHeaders(requestedContentType)
       });
     } catch (err) {
+      if (isAbortError(err))
+        return abortResponse();
       const code = err?.code;
       const isTooLarge = code === "BODY_TOO_LARGE";
       const isTimeout = code === "REQUEST_TIMEOUT";
@@ -6106,6 +6226,8 @@ function jsonWriteHandler(ingress, opts = {}) {
   const jsonValid = opts.jsonValid ?? ingress.jsonValid ?? defaultJsonValid;
   return async (req, srv) => {
     const ip = resolveIp(req, srv, opts);
+    if (req.signal?.aborted)
+      return abortResponse();
     const contentType = req.headers.get("content-type") ?? "";
     if (!isJsonContentType(contentType)) {
       return fallback.run(req, ip, null, (result, ctx) => fallback.errorResponse(req, result, 415, "unsupported_media_type", "Content-Type must be application/json", ctx));
@@ -6114,6 +6236,8 @@ function jsonWriteHandler(ingress, opts = {}) {
     try {
       bodyBytes = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs);
     } catch (err) {
+      if (isAbortError(err))
+        return abortResponse();
       const code = err?.code;
       const isTooLarge = code === "BODY_TOO_LARGE";
       return fallback.run(req, ip, null, (result, ctx) => {
@@ -6123,6 +6247,8 @@ function jsonWriteHandler(ingress, opts = {}) {
         return fallback.errorResponse(req, result, isTooLarge ? 413 : 408, isTooLarge ? "body_too_large" : "request_timeout", isTooLarge ? "Request body is too large" : "Request body read timed out", ctx);
       });
     }
+    if (req.signal?.aborted)
+      return abortResponse();
     return ingress.run(req, ip, bodyBytes, (result, ctx) => {
       const terminal = ingress.terminalResponse(req, result, ctx);
       if (terminal)
@@ -6144,12 +6270,16 @@ function jsonWriteHandler(ingress, opts = {}) {
 }
 // src/ingress/routes/options.ts
 function optionsHandler(ingress, opts = {}) {
-  return (req, srv) => ingress.run(req, resolveIp(req, srv, opts), null, (result, ctx) => {
-    const terminal = ingress.terminalResponse(req, result, ctx);
-    if (terminal)
-      return terminal;
-    return new Response(null, buildSuccessInit(ingress, result, ctx, 204));
-  });
+  return (req, srv) => {
+    if (req.signal?.aborted)
+      return abortResponse();
+    return ingress.run(req, resolveIp(req, srv, opts), null, (result, ctx) => {
+      const terminal = ingress.terminalResponse(req, result, ctx);
+      if (terminal)
+        return terminal;
+      return new Response(null, buildSuccessInit(ingress, result, ctx, 204));
+    });
+  };
 }
 // src/ingress/routes/responder.ts
 init_bytes();
@@ -6315,8 +6445,8 @@ function buildIgngexTerminal(result, _ctx) {
 }
 function parseSection(json) {
   try {
-    const v = JSON.parse(json);
-    return v !== null && typeof v === "object" && !Array.isArray(v) ? v : {};
+    const parsed = JSON.parse(json);
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
   }
@@ -6328,12 +6458,16 @@ function nativeResponderRoute(ingress, responder, opts = {}) {
   const bodyTimeoutMs = opts.bodyTimeoutMs ?? DEFAULT_BODY_TIMEOUT_MS;
   return async (req, srv, _params) => {
     const ip = resolveIp(req, srv, opts);
+    if (req.signal?.aborted)
+      return abortResponse();
     const requestId = decoder.decode(generateRequestId());
     let body = null;
     if (readBody) {
       try {
         body = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs);
       } catch (err) {
+        if (isAbortError(err))
+          return abortResponse();
         const code = err.code;
         const status = code === "REQUEST_TIMEOUT" ? 408 : code === "BODY_TOO_LARGE" ? 413 : 400;
         const payload = JSON.stringify({ error: "Bad Request", status, code: "BAD_REQUEST" });
@@ -6341,6 +6475,8 @@ function nativeResponderRoute(ingress, responder, opts = {}) {
         headers.set("content-type", "application/json; charset=utf-8");
         return new Response(payload, { status, headers });
       }
+      if (req.signal?.aborted)
+        return abortResponse();
     }
     let terminal = null;
     let snapshot = null;
@@ -6375,10 +6511,30 @@ function nativeResponderRoute(ingress, responder, opts = {}) {
 }
 // src/ingress/routes/native.ts
 init_bytes();
+
+// src/ingress/routes/safe-record.ts
+var PROTO_KEY = "__proto__";
+function safeRecord() {
+  return {};
+}
+function assignOwn(target, key, value) {
+  if (key === PROTO_KEY) {
+    Object.defineProperty(target, key, {
+      value,
+      enumerable: true,
+      writable: true,
+      configurable: true
+    });
+    return;
+  }
+  target[key] = value;
+}
+
+// src/ingress/routes/native.ts
 function pairsToRecord(pairs) {
-  const out = {};
+  const out = safeRecord();
   for (const [k, v] of pairs)
-    out[k] = v;
+    assignOwn(out, k, v);
   return out;
 }
 function nativeRouteHandler(route, responder, opts = {}) {
@@ -6390,16 +6546,22 @@ function nativeRouteHandler(route, responder, opts = {}) {
   const terminal = (status, code, message) => Response.json({ ok: false, error: { code, message } }, { status, headers: { "content-type": "application/json" } });
   return async (req, srv, _params) => {
     const ip = resolveIp(req, srv, opts);
+    if (req.signal?.aborted)
+      return abortResponse();
     const requestId = decoder.decode(generateRequestId());
     let body = null;
     if (readBody) {
       try {
         body = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs);
       } catch (err) {
+        if (isAbortError(err))
+          return abortResponse();
         const code = err.code;
         const status = code === "REQUEST_TIMEOUT" ? 408 : code === "BODY_TOO_LARGE" ? 413 : 400;
         return terminal(status, "BAD_REQUEST", "Request body read failed");
       }
+      if (req.signal?.aborted)
+        return abortResponse();
     }
     const url = req.url;
     const qIndex = url.indexOf("?");
@@ -6435,6 +6597,49 @@ function nativeRouteHandler(route, responder, opts = {}) {
   };
 }
 
+// src/ingress/server-error.ts
+function toError(value) {
+  return value instanceof Error ? value : new Error(String(value));
+}
+var INTERNAL_HEADERS = [
+  ["content-type", "application/json; charset=utf-8"]
+];
+function createServerErrorHandler(opts) {
+  const headers = memoizedHeaders(INTERNAL_HEADERS);
+  return (error, req) => {
+    const err = toError(error);
+    if (opts.onError) {
+      try {
+        opts.onError({ error: err, request: req });
+      } catch {}
+    }
+    if (opts.logger) {
+      try {
+        opts.logger(JSON.stringify({
+          level: "error",
+          msg: "unhandled_handler_error",
+          error: err.message
+        }));
+      } catch {}
+    }
+    return new Response(ERROR_BODIES.internal, { status: 500, headers });
+  };
+}
+function guardRouteHandler(handler, onServerError) {
+  return (req, srv, params) => {
+    try {
+      const out = handler(req, srv, params);
+      const thenable = out;
+      if (thenable !== null && thenable !== undefined && typeof thenable.then === "function") {
+        return thenable.catch((e) => onServerError(e, req));
+      }
+      return out;
+    } catch (e) {
+      return onServerError(e, req);
+    }
+  };
+}
+
 // src/ingress/path-matcher.ts
 function buildPathMatcher(routes) {
   const exact = new Map;
@@ -6542,6 +6747,10 @@ function buildRouteHandlers(options) {
     getIp: options.getIp,
     copyBody: options.copyBody
   };
+  const onServerError = createServerErrorHandler({
+    onError: options.onError,
+    logger: options.logger
+  });
   const serverRoutes = {};
   for (const [path, spec] of Object.entries(options.routes)) {
     const routeOpts = {
@@ -6550,9 +6759,12 @@ function buildRouteHandlers(options) {
       bodyTimeoutMs: spec.bodyTimeoutMs
     };
     const methods = {};
-    if (spec.read) {
+    const hasStatic = spec.static !== undefined;
+    if (hasStatic) {
+      methods.GET = typeof spec.static === "function" ? guardRouteHandler(spec.static, onServerError) : spec.static;
+    } else if (spec.read) {
       if (typeof spec.read === "function") {
-        methods.GET = spec.read;
+        methods.GET = guardRouteHandler(spec.read, onServerError);
       } else {
         methods.GET = readHandler(spec.read, routeOpts);
         methods.HEAD = headHandler(spec.read, routeOpts);
@@ -6570,34 +6782,40 @@ function buildRouteHandlers(options) {
     if (spec.echo) {
       methods.POST = echoHandler(spec.echo, routeOpts);
     }
-    if (spec.cookies) {
+    if (spec.cookies && !hasStatic) {
       methods.GET = readHandler(spec.cookies, routeOpts);
     }
     if (spec.delete) {
       methods.DELETE = deleteHandler(spec.delete, routeOpts);
     }
     if (spec.responder) {
-      const responderRoute = nativeResponderRoute(spec.responder.ingress, spec.responder.handler, {
-        ...routeOpts,
-        terminalStyle: spec.responder.terminalStyle,
-        readBody: spec.responder.readBody
-      });
-      const responderMethods = spec.responder.methods ?? ["GET"];
-      for (const m of responderMethods) {
-        methods[m] = responderRoute;
+      const responderMethods = (spec.responder.methods ?? ["GET"]).filter((m) => !(hasStatic && m === "GET"));
+      if (responderMethods.length > 0) {
+        const responderRoute = nativeResponderRoute(spec.responder.ingress, spec.responder.handler, {
+          ...routeOpts,
+          terminalStyle: spec.responder.terminalStyle,
+          readBody: spec.responder.readBody
+        });
+        const guardedResponderRoute = guardRouteHandler(responderRoute, onServerError);
+        for (const m of responderMethods) {
+          methods[m] = guardedResponderRoute;
+        }
       }
     }
     if (spec.native) {
-      const nativeRoute = nativeRouteHandler(createNativeRoute(spec.native.plan), spec.native.handler, {
-        ...routeOpts,
-        readBody: spec.native.readBody
-      });
-      const nativeMethods = spec.native.methods ?? ["GET"];
-      for (const m of nativeMethods) {
-        methods[m] = nativeRoute;
+      const nativeMethods = (spec.native.methods ?? ["GET"]).filter((m) => !(hasStatic && m === "GET"));
+      if (nativeMethods.length > 0) {
+        const nativeRoute = nativeRouteHandler(createNativeRoute(spec.native.plan), spec.native.handler, {
+          ...routeOpts,
+          readBody: spec.native.readBody
+        });
+        const guardedNativeRoute = guardRouteHandler(nativeRoute, onServerError);
+        for (const m of nativeMethods) {
+          methods[m] = guardedNativeRoute;
+        }
       }
     }
-    const primary = spec.delete ?? (spec.read && typeof spec.read !== "function" ? spec.read : undefined) ?? spec.cookies ?? spec.write ?? spec.echo;
+    const primary = spec.delete ?? (!hasStatic && spec.read && typeof spec.read !== "function" ? spec.read : undefined) ?? (!hasStatic ? spec.cookies : undefined) ?? spec.write ?? spec.echo;
     if (primary) {
       methods.OPTIONS = optionsHandler(primary, routeOpts);
     }
@@ -6610,12 +6828,17 @@ function createIngressServer(options) {
     throw new TypeError("createIngressServer is Bun-only (it builds a Bun.serve config). " + "On Node.js use createIngressServerNode with the same route handlers.");
   }
   const { routes: serverRoutes, baseOpts } = buildRouteHandlers(options);
+  const onServerError = createServerErrorHandler({
+    onError: options.onError,
+    logger: options.logger
+  });
   const serverOptions = {
     hostname: options.hostname ?? "0.0.0.0",
     port: options.port,
     idleTimeout: options.idleTimeout ?? 30,
     routes: serverRoutes,
-    maxRequestBodySize: options.maxRequestBodySize ?? DEFAULT_MAX_REQUEST_BODY_SIZE
+    maxRequestBodySize: options.maxRequestBodySize ?? DEFAULT_MAX_REQUEST_BODY_SIZE,
+    error: (error, req) => onServerError(error, req)
   };
   if (options.reusePort) {
     serverOptions.reusePort = true;
@@ -6670,6 +6893,13 @@ function nodeRequestToWebRequest(req) {
   const bodyForbidden = method === "GET" || method === "HEAD";
   const hasBody = requestHasBody(req);
   const init = { method, headers };
+  const abort = new AbortController;
+  req.on("aborted", () => abort.abort());
+  req.on("close", () => {
+    if (!req.complete)
+      abort.abort();
+  });
+  init.signal = abort.signal;
   if (hasBody && !bodyForbidden) {
     init.body = Readable.toWeb(req);
     init.duplex = "half";
@@ -6723,8 +6953,36 @@ function drainUnreadBody(res) {
 function requestHasBody(req) {
   return Number(req.headers["content-length"] ?? 0) > 0 || req.headers["transfer-encoding"] !== undefined;
 }
+var STATIC_RESPONSE_CACHE = new WeakMap;
+function materializeStaticResponse(response) {
+  let cached = STATIC_RESPONSE_CACHE.get(response);
+  if (cached === undefined) {
+    cached = (async () => {
+      const body = response.body === null ? null : new Uint8Array(await response.arrayBuffer());
+      const headers = new Headers(response.headers);
+      headers.delete("content-length");
+      headers.delete("transfer-encoding");
+      return {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+        body
+      };
+    })();
+    STATIC_RESPONSE_CACHE.set(response, cached);
+  }
+  return cached.then((c) => new Response(c.body, {
+    status: c.status,
+    statusText: c.statusText,
+    headers: new Headers(c.headers)
+  }));
+}
 function makeRequestListener(options, routes, baseOpts) {
   const matchPath = buildPathMatcher(routes);
+  const onServerError = createServerErrorHandler({
+    onError: options.onError,
+    logger: options.logger
+  });
   return async (req, res) => {
     try {
       const contentLengthHeader = req.headers["content-length"];
@@ -6745,10 +7003,19 @@ function makeRequestListener(options, routes, baseOpts) {
       const pathname = new URL(webReq.url).pathname;
       const method = webReq.method ?? "GET";
       const matched = matchPath(pathname);
-      const handler = matched?.methods?.[method];
+      const entry = matched?.methods?.[method];
       let response;
-      if (handler !== undefined && matched !== undefined) {
-        response = await handler(webReq, req, matched.params);
+      if (entry !== undefined && matched !== undefined) {
+        if (typeof entry === "function") {
+          response = await entry(webReq, req, matched.params);
+        } else if (entry instanceof Response) {
+          response = await materializeStaticResponse(entry);
+        } else if (options.fallback !== undefined) {
+          const fallback = fallbackHandler(options.fallback, baseOpts);
+          response = await fallback(webReq, req);
+        } else {
+          response = new Response("Not Found", { status: 404 });
+        }
       } else if (options.fallback !== undefined) {
         const fallback = fallbackHandler(options.fallback, baseOpts);
         response = await fallback(webReq, req);
@@ -6758,21 +7025,11 @@ function makeRequestListener(options, routes, baseOpts) {
       await writeResponse(res, response);
     } catch (err) {
       if (!res.headersSent) {
-        res.statusCode = 500;
-        res.setHeader("content-type", "application/json");
-        res.end(JSON.stringify({
-          error: { code: "internal_error", message: "Internal Server Error" }
-        }));
+        await writeResponse(res, onServerError(err));
       } else {
+        onServerError(err);
         res.destroy();
       }
-      if (options.onError) {
-        try {
-          options.onError({
-            error: err instanceof Error ? err : new Error(String(err))
-          });
-        } catch {}
-      }
     }
   };
 }
@@ -7850,6 +8107,9 @@ class BufferPool {
   get createdCount() {
     return this.created;
   }
+  shrink() {
+    this.free.length = 0;
+  }
   acquire(minSize = 0) {
     if (this.maxInFlight > 0 && this.inFlight >= this.maxInFlight) {
       throw new RangeError(`BufferPool: maxInFlight (${this.maxInFlight}) exceeded — too many ` + "buffers borrowed at once (unreleased zero-copy responses?). " + "Raise maxInFlight or consume/release responses faster.");
@@ -8614,6 +8874,9 @@ function jsonResponse(status, body) {
 function livenessHandler() {
   return (_req) => jsonResponse(200, { status: "ok" });
 }
+function staticLiveness() {
+  return jsonResponse(200, { status: "ok" });
+}
 function readinessHandler(check) {
   return async (_req) => {
     if (!check)
@@ -8647,6 +8910,8 @@ var DEFAULT_BUCKETS = [
   5,
   10
 ];
+var MAX_SERIES_PER_METRIC = 1e4;
+var SERIES_DROPPED_METRIC = "castrum_metrics_series_dropped_total";
 function labelKey(names, values) {
   if (names.length === 0)
     return "";
@@ -8659,10 +8924,25 @@ function labelKey(names, values) {
 function escapeLabel(v) {
   return v.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n");
 }
+function evictOldestHalf2(map) {
+  if (map.size < MAX_SERIES_PER_METRIC)
+    return [];
+  const drop = Math.ceil(map.size / 2);
+  const dropped = [];
+  for (const key of map.keys()) {
+    if (dropped.length >= drop)
+      break;
+    dropped.push(key);
+  }
+  for (const key of dropped)
+    map.delete(key);
+  return dropped;
+}
 function createMetrics() {
   const counters = new Map;
   const gauges = new Map;
   const histograms = new Map;
+  let seriesDropped = 0;
   const bucketUpper = (buckets) => [
     ...buckets.map((b) => b),
     Number.POSITIVE_INFINITY
@@ -8707,6 +8987,11 @@ function createMetrics() {
       out.push(...renderGauge(e));
     for (const e of histograms.values())
       out.push(...renderHistogram(e));
+    if (seriesDropped > 0 && !counters.has(SERIES_DROPPED_METRIC) && !gauges.has(SERIES_DROPPED_METRIC) && !histograms.has(SERIES_DROPPED_METRIC)) {
+      out.push(`# HELP ${SERIES_DROPPED_METRIC} Total metric series evicted by the per-family cardinality cap.`);
+      out.push(`# TYPE ${SERIES_DROPPED_METRIC} counter`);
+      out.push(`${SERIES_DROPPED_METRIC} ${seriesDropped}`);
+    }
     return `${out.join(`
 `)}
 `;
@@ -8715,6 +9000,7 @@ function createMetrics() {
     counters.clear();
     gauges.clear();
     histograms.clear();
+    seriesDropped = 0;
   };
   return {
     counter(name, help, labelNames = []) {
@@ -8731,7 +9017,13 @@ function createMetrics() {
       return {
         inc(labels, by = 1) {
           const key = labelKey(names, names.map((n) => labels?.[n] ?? ""));
-          entry.values.set(key, (entry.values.get(key) ?? 0) + by);
+          const prev = entry.values.get(key);
+          if (prev === undefined) {
+            seriesDropped += evictOldestHalf2(entry.values).length;
+            entry.values.set(key, by);
+          } else {
+            entry.values.set(key, prev + by);
+          }
         }
       };
     },
@@ -8747,14 +9039,27 @@ function createMetrics() {
         gauges.set(name, entry);
       const names = entry.labelNames;
       const keyOf = (labels) => labelKey(names, names.map((n) => labels?.[n] ?? ""));
+      const add = (labels, delta) => {
+        const key = keyOf(labels);
+        const prev = entry.values.get(key);
+        if (prev === undefined) {
+          seriesDropped += evictOldestHalf2(entry.values).length;
+          entry.values.set(key, delta);
+        } else {
+          entry.values.set(key, prev + delta);
+        }
+      };
       return {
         inc(labels, by = 1) {
-          entry.values.set(keyOf(labels), (entry.values.get(keyOf(labels)) ?? 0) + by);
+          add(labels, by);
         },
         dec(labels, by = 1) {
-          entry.values.set(keyOf(labels), (entry.values.get(keyOf(labels)) ?? 0) - by);
+          add(labels, -by);
         },
         set(labels, value) {
+          if (!entry.values.has(keyOf(labels))) {
+            seriesDropped += evictOldestHalf2(entry.values).length;
+          }
           entry.values.set(keyOf(labels), value);
         }
       };
@@ -8777,6 +9082,10 @@ function createMetrics() {
           const key = labelKey(names, names.map((n) => labels?.[n] ?? ""));
           let counts = entry.counts.get(key);
           if (!counts) {
+            const dropped = evictOldestHalf2(entry.counts);
+            for (const k of dropped)
+              entry.sums.delete(k);
+            seriesDropped += dropped.length;
             counts = new Array(entry.buckets.length + 1).fill(0);
             entry.counts.set(key, counts);
           }
@@ -8861,6 +9170,14 @@ function createIngressRouter(options) {
   if (options.copyBody !== undefined)
     baseOpts.copyBody = options.copyBody;
   for (const [path, spec] of Object.entries(options.routes)) {
+    if (spec.static !== undefined) {
+      bakedRoutes[path] = {
+        static: spec.static,
+        maxBodyBytes: spec.maxBodyBytes,
+        bodyTimeoutMs: spec.bodyTimeoutMs
+      };
+      continue;
+    }
     if (spec.raw) {
       bakedRoutes[path] = { read: spec.raw };
       continue;
@@ -8935,6 +9252,9 @@ function createIngressRouter(options) {
     if (typeof methodHandler === "function") {
       return methodHandler(req, srv, matched.params);
     }
+    if (methodHandler instanceof Response) {
+      return methodHandler.clone();
+    }
     if (req.method === "OPTIONS" && typeof matched.methods.OPTIONS === "function") {
       return matched.methods.OPTIONS(req, srv, matched.params);
     }
@@ -10234,6 +10554,9 @@ function createPipeline(opts = {}) {
       try {
         body = await readBodyWithLimit(req, maxBodyBytes, true, bodyTimeoutMs);
       } catch (err) {
+        if (isAbortError(err)) {
+          return { terminal: true, response: abortResponse(), result: null, ctx };
+        }
         return {
           terminal: true,
           response: bodyErrorResponse(ingress, req, requestId, err),
@@ -10401,6 +10724,19 @@ function cancelledError() {
   err.name = "TaskCancelledError";
   return err;
 }
+var TASK_SUBMIT_ACCEPTED = 1;
+var TASK_SUBMIT_OVERLOADED = 2;
+function taskSubmitError(code) {
+  if (code === TASK_SUBMIT_ACCEPTED)
+    return null;
+  if (code === TASK_SUBMIT_OVERLOADED) {
+    const err = new Error("task rejected: native work queue is full");
+    err.name = "TaskOverloadedError";
+    err.code = "OVERLOADED";
+    return err;
+  }
+  return new Error("task rejected by the native runtime");
+}
 var shared = null;
 function createTaskRuntime(options = {}) {
   if (shared)
@@ -10546,10 +10882,12 @@ function createTaskRuntime(options = {}) {
     return new Promise((resolve, reject) => {
       inflight.set(id, { out: null, keep: null, resolve, reject });
       retain();
-      if (ffi.taskSubmit(op, args, id) === 0) {
+      const rejected = taskSubmitError(ffi.taskSubmit(op, args, id));
+      if (rejected) {
         inflight.delete(id);
-        release();
-        reject(new Error("task rejected by the native runtime"));
+        if (inflight.size === 0)
+          release();
+        reject(rejected);
         return;
       }
       const signal = runOptions?.signal;
@@ -10568,10 +10906,12 @@ function createTaskRuntime(options = {}) {
     return new Promise((resolve, reject) => {
       inflight.set(id, { out: output, keep: null, resolve, reject });
       retain();
-      if (ffi.taskSubmitOut(op, args, id, output) === 0) {
+      const rejected = taskSubmitError(ffi.taskSubmitOut(op, args, id, output));
+      if (rejected) {
         inflight.delete(id);
-        release();
-        reject(new Error("task rejected by the native runtime"));
+        if (inflight.size === 0)
+          release();
+        reject(rejected);
         return;
       }
       const signal = runOptions?.signal;
@@ -10590,10 +10930,12 @@ function createTaskRuntime(options = {}) {
     return new Promise((resolve, reject) => {
       inflight.set(id, { out: null, keep: data, resolve, reject });
       retain();
-      if (ffi.taskSubmitSlice(op, hdr, data, id) === 0) {
+      const rejected = taskSubmitError(ffi.taskSubmitSlice(op, hdr, data, id));
+      if (rejected) {
         inflight.delete(id);
-        release();
-        reject(new Error("task rejected by the native runtime"));
+        if (inflight.size === 0)
+          release();
+        reject(rejected);
         return;
       }
       const signal = runOptions?.signal;
@@ -10695,12 +11037,30 @@ var opDecision = (op) => {
 
 // index.ts
 init_bytes();
+
+// src/shared/memory.ts
+init_rust_ffi();
+init_context();
+init_runtime();
+function flushMemory(options = {}) {
+  loader.clear();
+  clearMimeCaches();
+  try {
+    rust.clearSchemaCache();
+  } catch {}
+  if (options.gc !== false) {
+    forceGc2();
+  }
+}
+
+// index.ts
 init_packed();
 
 // src/shared/uuid.ts
 init_uuid();
 var uuidv7 = runtimeUuid.uuidv7;
 export {
+  ABORT_CODE,
   AdaptiveEstimate,
   BakedIngressResult,
   DEFAULT_BODY_TIMEOUT_MS,
@@ -10762,6 +11122,7 @@ export {
   TASK_STATUS_CANCELLED,
   TASK_STATUS_ERROR,
   TASK_STATUS_OK,
+  abortResponse,
   brotliCapacityGuess,
   buildResponseContext,
   buildTerminalResponse,
@@ -10796,6 +11157,7 @@ export {
   errorCodeName,
   errorMessage,
   fallbackHandler,
+  flushMemory,
   generateRequestId,
   getIngressBinding,
   gracefulShutdown,
@@ -10803,6 +11165,7 @@ export {
   headHandler,
   headersForResult,
   healthHandler,
+  isAbortError,
   isNativeOp,
   isProven,
   isValidResponseStatus,
@@ -10839,6 +11202,7 @@ export {
   safeTerminalStatus,
   serializeTraceParent,
   sseResponse,
+  staticLiveness,
   statusForErrorCode,
   unpackBitset,
   unpackByteResults,