@nifrajs/core 3.3.0 → 3.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nifrajs/core",
-  "version": "3.3.0",
+  "version": "3.5.0",
   "description": "Bun-native, contract-first HTTP framework - the router, server, and route descriptor.",
   "keywords": [
     "bun",

package/src/diff.ts

@@ -18,6 +18,7 @@
  * yield `info` - never a silent pass presented as proof.
  */
 
+import { type ProjectEvidenceSnapshot, reflectedRoutesFromEvidence } from "./evidence.ts"
 import {
   type JsonSchema,
   type ReflectedRoute,
@@ -35,6 +36,7 @@ export interface RouteSnapshotSchema {
   readonly headers?: SchemaSnapshot
   readonly body?: SchemaSnapshot
   readonly query?: SchemaSnapshot
+  readonly params?: SchemaSnapshot
   readonly response?: SchemaSnapshot
   readonly sse?: SchemaSnapshot
   readonly errors?: Readonly<Record<string, SchemaSnapshot>>
@@ -54,7 +56,15 @@ export interface RouteChange {
   readonly method: string
   readonly path: string
   /** Which part of the contract changed; "route" for add/remove of the whole route. */
-  readonly section: "route" | "headers" | "body" | "query" | "response" | "sse" | "errors"
+  readonly section:
+    | "route"
+    | "headers"
+    | "body"
+    | "query"
+    | "params"
+    | "response"
+    | "sse"
+    | "errors"
   /** The top-level field (or error status) the change is about, when field-granular. */
   readonly field?: string
   readonly message: string
@@ -87,9 +97,19 @@ const schemaSnapshot = (
  * `JSON.stringify` unchanged.
  */
 export function snapshotRoutes(source: unknown): readonly RouteSnapshot[] {
+  // Preserve the historical registration order of this low-level helper. The canonical evidence
+  // seam intentionally sorts routes for persistence, while callers using snapshotRoutes directly
+  // may use the order to compare a live reflection with an older baseline.
   return reflectRoutes(source).map((route) => snapshotRoute(route))
 }
 
+/** Snapshot routes from an existing canonical project-evidence pass. */
+export function snapshotRoutesFromEvidence(
+  evidence: ProjectEvidenceSnapshot,
+): readonly RouteSnapshot[] {
+  return reflectedRoutesFromEvidence(evidence).map((route) => snapshotRoute(route))
+}
+
 const snapshotRoute = (route: ReflectedRoute): RouteSnapshot => {
   const schema = route.schema
   if (schema === undefined) return { method: route.method, path: route.path }
@@ -101,12 +121,14 @@ const snapshotRoute = (route: ReflectedRoute): RouteSnapshot => {
   const body = schemaSnapshot(schema.body)
   const headers = schemaSnapshot(schema.headers)
   const query = schemaSnapshot(schema.query)
+  const params = schemaSnapshot(schema.params)
   const response = schemaSnapshot(schema.response)
   const sse = schemaSnapshot(schema.sse)
   const snapped: RouteSnapshotSchema = {
     ...(headers !== undefined ? { headers } : {}),
     ...(body !== undefined ? { body } : {}),
     ...(query !== undefined ? { query } : {}),
+    ...(params !== undefined ? { params } : {}),
     ...(response !== undefined ? { response } : {}),
     ...(sse !== undefined ? { sse } : {}),
     ...(Object.keys(errors).length > 0 ? { errors } : {}),
@@ -356,7 +378,7 @@ export function diffRouteSnapshots(
     const path = beforeRoute.path
     const beforeSchema = beforeRoute.schema ?? {}
     const afterSchema = afterRoute.schema ?? {}
-    for (const section of ["headers", "body", "query"] as const) {
+    for (const section of ["headers", "body", "query", "params"] as const) {
       diffSchemaSection(
         { method, path, section, direction: "request", changes },
         beforeSchema[section],

package/src/evidence.ts

@@ -100,6 +100,12 @@ export interface ProjectEvidenceSnapshot {
 export interface ProjectEvidenceOptions {
   readonly assurance?: AssuranceReport
   readonly capabilities?: CapabilityAssuranceReport
+  /**
+   * An existing reflection pass. Supplying it lets several offline projections share one pass
+   * without asking the runtime source for `.routes()` again. Validators are consumed only while
+   * building the token-only snapshot and never cross this seam.
+   */
+  readonly routes?: readonly ReflectedRoute[]
   /** Optional static source locations keyed by `${METHOD}\n${path}`. */
   readonly sourceLocations?: ReadonlyMap<string, readonly ProjectEvidenceSourceLocation[]>
 }
@@ -262,6 +268,64 @@ function capabilitiesOf(
   })
 }
 
+function schemaPartToReflection(
+  value: ProjectEvidenceSchemaPart | undefined,
+): SchemaReflection | undefined {
+  return value === undefined
+    ? undefined
+    : { standard: undefined, jsonSchema: value.jsonSchema, fields: value.fields }
+}
+
+function schemaFromEvidence(schema: ProjectEvidenceSchema | undefined): ReflectedRoute["schema"] {
+  if (schema === undefined) return undefined
+  const errors = Object.fromEntries(
+    Object.entries(schema.errors ?? {}).map(([status, value]) => [
+      status,
+      schemaPartToReflection(value) as SchemaReflection,
+    ]),
+  )
+  const headers = schemaPartToReflection(schema.headers)
+  const body = schemaPartToReflection(schema.body)
+  const query = schemaPartToReflection(schema.query)
+  const params = schemaPartToReflection(schema.params)
+  const response = schemaPartToReflection(schema.response)
+  const sse = schemaPartToReflection(schema.sse)
+  return {
+    ...(schema.bodyLimit !== undefined ? { bodyLimit: schema.bodyLimit } : {}),
+    ...(schema.bodyLimitReason !== undefined ? { bodyLimitReason: schema.bodyLimitReason } : {}),
+    ...(headers !== undefined ? { headers } : {}),
+    ...(body !== undefined ? { body } : {}),
+    ...(query !== undefined ? { query } : {}),
+    ...(params !== undefined ? { params } : {}),
+    ...(response !== undefined ? { response } : {}),
+    ...(Object.keys(errors).length > 0 ? { errors } : {}),
+    ...(sse !== undefined ? { sse } : {}),
+  }
+}
+
+/**
+ * Adapt the canonical token-only snapshot to the runtime-reflection shape used by projections.
+ * The returned schemas deliberately have no `standard` validator: this adapter is for offline
+ * contract views, not request validation or mock generation.
+ */
+export function reflectedRoutesFromEvidence(
+  evidence: ProjectEvidenceSnapshot,
+): readonly ReflectedRoute[] {
+  return evidence.routes.map((route) => {
+    const schema = schemaFromEvidence(route.schema)
+    return {
+      method: route.method,
+      path: route.path,
+      ...(schema !== undefined ? { schema } : {}),
+      ...(route.assurance !== undefined ? { assurance: route.assurance } : {}),
+      ...(route.capabilities !== undefined ? { capabilities: route.capabilities } : {}),
+      ...(route.family === true ? { family: true } : {}),
+      ...(route.classification !== undefined ? { classification: route.classification } : {}),
+      ...(route.tool !== undefined ? { tool: route.tool } : {}),
+    }
+  })
+}
+
 /** Build the canonical snapshot from reflection and already-evaluated offline reports. */
 export function snapshotProjectEvidence(
   source: unknown,
@@ -270,10 +334,11 @@ export function snapshotProjectEvidence(
   const locations = options.sourceLocations
   const assurance = assuranceOf(options.assurance)
   const capabilities = capabilitiesOf(options.capabilities)
+  const reflected = options.routes ?? reflectRoutes(source)
   const routes = sortByRoute(
     // Importantly, this is the only reflection pass for this snapshot. Every projection can consume
     // the result instead of independently asking the app for `.routes()` and re-shaping schemas.
-    reflectRoutes(source).map((route) =>
+    reflected.map((route) =>
       evidenceRouteOf(route, locations?.get(keyOf(route.method, route.path))),
     ),
   )

package/src/idempotency.ts

@@ -240,7 +240,14 @@ async function boundedResponseBytes(response: Response, maxBytes: number): Promi
       if (done) break
       total += value.byteLength
       if (total > maxBytes) {
-        await reader.cancel()
+        // `Response.clone()` tees the body. Cancelling only the clone branch leaves the live branch
+        // unread, so a streaming producer can keep the tee pending forever. This path stores no
+        // response and the caller will replace it with a terminal error, so cancel both branches.
+        const liveBody = response.body
+        await Promise.allSettled([
+          reader.cancel(),
+          liveBody === null ? Promise.resolve() : liveBody.cancel(),
+        ])
         throw new IdempotencyResponseTooLargeError(maxBytes)
       }
       chunks.push(value)

package/src/index.ts

@@ -16,7 +16,7 @@
  * read its own package.json at runtime. `scripts/version.ts` rewrites it on every release bump and
  * `check:publish` asserts it equals `@nifrajs/core`'s package version.
  */
-export const VERSION = "3.3.0" as const
+export const VERSION = "3.5.0" as const
 
 export type Version = typeof VERSION
 
@@ -45,6 +45,7 @@ export {
   type CookieOptions,
   type CookieSecret,
   cookieNamePrefix,
+  hasDuplicateCookie,
   parseCookies,
   serializeCookie,
   signValue,

package/src/manifest.ts

@@ -12,10 +12,8 @@ import {
   diffRouteSnapshots,
   type RouteChange,
   type RouteSnapshotSchema,
-  snapshotRoutes,
 } from "./diff.ts"
-import type { ProjectEvidenceSnapshot } from "./evidence.ts"
-import { reflectRoutes } from "./reflection.ts"
+import { type ProjectEvidenceSnapshot, snapshotProjectEvidence } from "./evidence.ts"
 
 export interface NifraManifestAssurance {
   readonly rule?: string
@@ -190,25 +188,28 @@ export async function buildNifraManifest(input: BuildNifraManifestInput): Promis
   if (input.evidence?.capabilities !== undefined && !input.evidence.capabilities.ok) {
     throw new Error("nifra manifest: refusing to emit failing capability assurance")
   }
+  const evidence =
+    input.evidence ??
+    snapshotProjectEvidence(input.source, {
+      ...(input.assurance === undefined ? {} : { assurance: input.assurance }),
+      ...(input.capabilities === undefined ? {} : { capabilities: input.capabilities }),
+    })
   const reflected = new Map(
-    (input.evidence?.routes ?? reflectRoutes(input.source)).map((route) => [
-      routeKey(route.method, route.path),
-      route,
-    ]),
+    evidence.routes.map((route) => [routeKey(route.method, route.path), route]),
   )
   const assured = new Map(
-    (input.evidence?.assurance?.routes ?? input.assurance?.routes ?? []).map((route) => [
+    (evidence.assurance?.routes ?? input.assurance?.routes ?? []).map((route) => [
       routeKey(route.method, route.path),
       route,
     ]),
   )
   const capable = new Map(
-    (input.evidence?.capabilities?.routes ?? input.capabilities?.routes ?? []).map((route) => [
+    (evidence.capabilities?.routes ?? input.capabilities?.routes ?? []).map((route) => [
       routeKey(route.method, route.path),
       route,
     ]),
   )
-  const routes = (input.evidence?.routes ?? snapshotRoutes(input.source))
+  const routes = evidence.routes
     .map((route): NifraManifestRoute => {
       const key = routeKey(route.method, route.path)
       const reflection = reflected.get(key)

package/src/server/cookies.ts

@@ -66,7 +66,8 @@ const safeDecode = (v: string): string => {
  *
  * Hand-rolled index walk instead of `split(";")` + `trim()` chains: those allocated an array + up
  * to three substrings per pair and showed up at ~6% of a realistic (auth + cookie) request. Same
- * semantics, two slices per pair, no intermediate array. */
+ * semantics, two slices per pair, no intermediate array. Duplicate names use the first value
+ * deterministically; security-sensitive callers can use {@link hasDuplicateCookie} and fail closed. */
 export function parseCookies(header: string | null | undefined): Record<string, string> {
   // Null-prototype: cookie NAMES come straight from the untrusted header, so a cookie named
   // `constructor`/`__proto__`/`toString` must be an inert own key, not a shadow of a prototype
@@ -106,7 +107,11 @@ export function parseCookies(header: string | null | undefined): Record<string,
         }
         // Interned: cookie names repeat across requests, and V8 pays ~300ns to internalize a
         // fresh sliced key on a null-proto store (see internParseKey).
-        out[internParseKey(name)] = safeDecode(value)
+        const key = internParseKey(name)
+        // Cookie headers can contain same-name cookies from different paths/domains. Do not let a
+        // later value silently replace the first one: session/auth callers can separately reject the
+        // ambiguity, while ordinary callers get deterministic first-value semantics.
+        if (!Object.hasOwn(out, key)) out[key] = safeDecode(value)
       }
     }
     pos = end + 1
@@ -114,6 +119,33 @@ export function parseCookies(header: string | null | undefined): Record<string,
   return out
 }
 
+/** True when a raw Cookie header contains the same exact cookie name more than once. */
+export function hasDuplicateCookie(header: string | null | undefined, targetName: string): boolean {
+  if (!header || targetName.length === 0) return false
+  let found = false
+  const len = header.length
+  let pos = 0
+  while (pos < len) {
+    let end = header.indexOf(";", pos)
+    if (end === -1) end = len
+    let start = pos
+    while (start < end && header.charCodeAt(start) === 32) start++
+    let stop = end
+    while (stop > start && header.charCodeAt(stop - 1) === 32) stop--
+    const eq = header.indexOf("=", start)
+    if (eq > start && eq < stop) {
+      let nameEnd = eq
+      while (nameEnd > start && header.charCodeAt(nameEnd - 1) === 32) nameEnd--
+      if (header.slice(start, nameEnd) === targetName) {
+        if (found) return true
+        found = true
+      }
+    }
+    pos = end + 1
+  }
+  return false
+}
+
 /**
  * Serialize a `Set-Cookie` header value. Pure - applies **no** security defaults (the caller, e.g.
  * `c.set.cookie`, layers `HttpOnly`/`Secure`/`SameSite` on). Throws on an invalid cookie name, a

package/src/server/server-types.ts

@@ -85,6 +85,8 @@ export interface ServerOptions {
   readonly wsMaxPayloadBytes?: number
   /** Per-request timeout (ms): a slower request gets a 503 and `ctx.signal` aborts. 0 disables (default). */
   readonly requestTimeoutMs?: number
+  /** WebSocket upgrade admission/guard timeout (ms). Default 10_000; set to 0 only for a deliberate unbounded guard. */
+  readonly wsUpgradeTimeoutMs?: number
   /**
    * How to derive `c.clientIp` behind a reverse proxy or CDN. Omit (default) to trust only the raw
    * socket peer and never believe a forwarded header. Set `{ trustedHops: n }` when the app sits

package/src/server/server.ts

@@ -326,6 +326,7 @@ type BunNativeRoutes = Record<string, BunNativeMethodTable>
 type BunRequestWithParams = Request & { readonly params?: Record<string, string> }
 
 const WS_PASS: WebSocketUpgradeOutcome = { kind: "pass" }
+const DEFAULT_WS_UPGRADE_TIMEOUT_MS = 10_000
 
 /** `app.ws()` (and everything downstream of it) needs the runtime `@nifrajs/core/ws` registers. */
 function requireWsRuntime(runtime: WsRuntime | undefined): WsRuntime {
@@ -679,6 +680,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   private readonly trustBodyFraming: boolean
   private readonly wsMaxPayloadBytes: number
   private readonly requestTimeoutMs: number
+  private readonly wsUpgradeTimeoutMs: number
   /** Installed by the `responseContract()` plugin; `undefined` = not installed, which is the default
    * and the state in which a declared `response` schema stays a compile-time contract only. */
   private responseContractRuntime: ResponseContractRuntime | undefined
@@ -782,6 +784,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     this.maxBodyBytes = maxBodyBytes
     this.wsMaxPayloadBytes = wsMaxPayloadBytes
     this.requestTimeoutMs = options.requestTimeoutMs ?? 0
+    this.wsUpgradeTimeoutMs = options.wsUpgradeTimeoutMs ?? DEFAULT_WS_UPGRADE_TIMEOUT_MS
     this.clientIpTrust = options.clientIp
     this.acceptInboundDeadlines = options.acceptInboundDeadlines ?? false
     this.maxInboundDeadlineMs = options.maxInboundDeadlineMs ?? 30_000
@@ -792,6 +795,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     if (!Number.isFinite(this.requestTimeoutMs) || this.requestTimeoutMs < 0) {
       throw new RangeError("requestTimeoutMs must be a finite non-negative number")
     }
+    if (!Number.isFinite(this.wsUpgradeTimeoutMs) || this.wsUpgradeTimeoutMs < 0) {
+      throw new RangeError("wsUpgradeTimeoutMs must be a finite non-negative number")
+    }
     if (!Number.isFinite(this.maxInboundDeadlineMs) || this.maxInboundDeadlineMs <= 0) {
       throw new RangeError("maxInboundDeadlineMs must be a finite positive number")
     }
@@ -2558,83 +2564,173 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    * `data`). Runs the route's `upgrade(c)` guard in a real request context. Synchronous unless
    * `upgrade()` is async; a throw rejects with a flat 500 (no detail leaked).
    */
+  private runWebSocketRequestHooks(
+    req: Request,
+    platform?: Platform<EnvOf<Ctx>>,
+  ): MaybePromise<Request | Response> {
+    let current = req
+    for (let i = 0; i < this.onRequestHooks.length; i++) {
+      const hook = this.onRequestHooks[i]
+      if (hook === undefined) return current
+      const outcome = hook(current, platform)
+      if (outcome instanceof Promise) {
+        return outcome.then((first) =>
+          this.continueWebSocketRequestHooks(first, i + 1, current, platform),
+        )
+      }
+      if (outcome instanceof Request) {
+        current = outcome
+        continue
+      }
+      if (outcome !== undefined) return outcome
+    }
+    return current
+  }
+
+  private async continueWebSocketRequestHooks(
+    first: OnRequestResult,
+    start: number,
+    current: Request,
+    platform?: Platform<EnvOf<Ctx>>,
+  ): Promise<Request | Response> {
+    let next = current
+    let outcome = first
+    for (let i = start; ; i++) {
+      if (outcome instanceof Request) next = outcome
+      else if (outcome !== undefined) return outcome
+      if (i >= this.onRequestHooks.length) return next
+      const hook = this.onRequestHooks[i]
+      if (hook === undefined) return next
+      outcome = await hook(next, platform)
+    }
+  }
+
   resolveWebSocketUpgrade(
     req: Request,
     platform?: Platform<EnvOf<Ctx>>,
   ): MaybePromise<WebSocketUpgradeOutcome> {
     if (this.wsRouteCount === 0) return WS_PASS
     if (req.headers.get("upgrade")?.toLowerCase() !== "websocket") return WS_PASS
-    const url = urlPartsOf(req.url)
-    const match = this.wsRouter.find("GET", url.pathname)
-    if (!match.found) return WS_PASS // upgrade header, no WS route here → normal routing decides
-    // Inspect only captured values for escapes. Scanning the full pathname repeated work the router
-    // already did and made every plain dynamic route pay for unrelated static path bytes.
-    const params = match.params === EMPTY_PARAMS ? match.params : decodeRouteParams(match.params)
-    if (params === null) return { kind: "reject", response: jsonError(400, "malformed_path") }
-    const handler = match.payload.handler
-    // Non-null: wsRouteCount > 0 ⇒ ws() ran ⇒ `.use(websocket())` installed the runtime + registry.
-    const pubsub = this.topics as TopicRegistry
-    const attach = (this.wsRuntime as WsRuntime).attach
-    // CSWSH guard, before any per-connection work or the user's upgrade(): reject a disallowed
-    // Origin with 403. Browsers don't CORS-protect WS handshakes but do send cookies, so this
-    // blocks cross-site authenticated sockets when the route opts in via `allowedOrigins`.
-    const origin = req.headers.get("origin")
-    if (handler.allowedOrigins !== undefined) {
-      const allowed =
-        typeof handler.allowedOrigins === "function"
-          ? handler.allowedOrigins(origin)
-          : origin !== null && handler.allowedOrigins.includes(origin)
-      if (!allowed) return { kind: "reject", response: jsonError(403, "forbidden_origin") }
-    } else if (origin !== null && !wsSameOrigin(origin, req)) {
-      // Secure default (no explicit `allowedOrigins`): reject a CROSS-ORIGIN browser handshake - the
-      // CSWSH case, since browsers send cookies on WS handshakes and don't apply CORS. Non-browser
-      // clients send no `Origin` and pass; same-origin browsers pass. Set `allowedOrigins` to permit
-      // specific cross-origin clients (or `() => true` for a genuinely public socket).
-      return { kind: "reject", response: jsonError(403, "forbidden_origin") }
-    }
-    if (handler.upgrade === undefined) {
-      return {
-        kind: "upgrade",
-        handler,
-        data: undefined,
-        pubsub,
-        attach,
-        maxPayloadBytes: this.wsMaxPayloadBytes,
+
+    const timeoutMs =
+      this.wsUpgradeTimeoutMs === 0
+        ? 0
+        : this.requestTimeoutMs > 0
+          ? Math.min(this.wsUpgradeTimeoutMs, this.requestTimeoutMs)
+          : this.wsUpgradeTimeoutMs
+    const controller = timeoutMs > 0 ? new AbortController() : undefined
+    const signal = controller?.signal ?? getNeverAbortSignal()
+    const deadline = timeoutMs > 0 ? Date.now() + timeoutMs : undefined
+    const timeoutResponse = jsonError(503, "request_timeout")
+    const onTimeout = (): WebSocketUpgradeOutcome => ({
+      kind: "reject",
+      response: timeoutResponse,
+    })
+    const bounded = <T>(work: Promise<T>, onDone: () => T): Promise<T> =>
+      controller === undefined
+        ? work
+        : this.withTimeout(work, controller, onDone, Math.max(0, deadline! - Date.now()))
+
+    const resolveMatched = (request: Request): MaybePromise<WebSocketUpgradeOutcome> => {
+      const url = urlPartsOf(request.url)
+      const match = this.wsRouter.find("GET", url.pathname)
+      if (!match.found) return WS_PASS // upgrade header, no WS route here → normal routing decides
+      // Inspect only captured values for escapes. Scanning the full pathname repeated work the router
+      // already did and made every plain dynamic route pay for unrelated static path bytes.
+      const params = match.params === EMPTY_PARAMS ? match.params : decodeRouteParams(match.params)
+      if (params === null) return { kind: "reject", response: jsonError(400, "malformed_path") }
+      const handler = match.payload.handler
+      // Non-null: wsRouteCount > 0 ⇒ ws() ran ⇒ `.use(websocket())` installed the runtime + registry.
+      const pubsub = this.topics as TopicRegistry
+      const attach = (this.wsRuntime as WsRuntime).attach
+      // CSWSH guard, before any per-connection work or the user's upgrade(): reject a disallowed
+      // Origin with 403. Browsers don't CORS-protect WS handshakes but do send cookies, so this
+      // blocks cross-site authenticated sockets when the route opts in via `allowedOrigins`.
+      const origin = request.headers.get("origin")
+      if (handler.allowedOrigins !== undefined) {
+        const allowed =
+          typeof handler.allowedOrigins === "function"
+            ? handler.allowedOrigins(origin)
+            : origin !== null && handler.allowedOrigins.includes(origin)
+        if (!allowed) return { kind: "reject", response: jsonError(403, "forbidden_origin") }
+      } else if (origin !== null && !wsSameOrigin(origin, request)) {
+        // Secure default (no explicit `allowedOrigins`): reject a CROSS-ORIGIN browser handshake - the
+        // CSWSH case, since browsers send cookies on WS handshakes and don't apply CORS. Non-browser
+        // clients send no `Origin` and pass; same-origin browsers pass. Set `allowedOrigins` to permit
+        // specific cross-origin clients (or `() => true` for a genuinely public socket).
+        return { kind: "reject", response: jsonError(403, "forbidden_origin") }
+      }
+      if (handler.upgrade === undefined) {
+        return {
+          kind: "upgrade",
+          handler,
+          data: undefined,
+          pubsub,
+          attach,
+          maxPayloadBytes: this.wsMaxPayloadBytes,
+        }
+      }
+      const budget =
+        controller === undefined
+          ? createUnboundedRequestBudget(signal)
+          : createRequestBudget({ deadline: deadline!, signal })
+      const ctx = new RequestContext(
+        request,
+        params,
+        url.search,
+        signal,
+        budget,
+        platform,
+        this.maxBodyBytes,
+        this.protoPoisoning,
+      )
+      const settle = (value: unknown): WebSocketUpgradeOutcome =>
+        value instanceof Response
+          ? { kind: "reject", response: value }
+          : {
+              kind: "upgrade",
+              handler,
+              data: value,
+              pubsub,
+              attach,
+              maxPayloadBytes: this.wsMaxPayloadBytes,
+            }
+      try {
+        const result = handler.upgrade(ctx as unknown as WebSocketContext<EnvOf<Ctx>>)
+        if (!(result instanceof Promise)) return settle(result)
+        const pending = result.then(settle, () => ({
+          kind: "reject" as const,
+          response: jsonError(500, "internal_error"),
+        }))
+        return bounded(pending, onTimeout)
+      } catch {
+        return { kind: "reject", response: jsonError(500, "internal_error") }
       }
     }
-    const upgradeSignal = getNeverAbortSignal()
-    const ctx = new RequestContext(
-      req,
-      params,
-      url.search,
-      upgradeSignal,
-      createUnboundedRequestBudget(upgradeSignal),
-      platform,
-      this.maxBodyBytes,
-      this.protoPoisoning,
-    )
-    const settle = (value: unknown): WebSocketUpgradeOutcome =>
-      value instanceof Response
-        ? { kind: "reject", response: value }
-        : {
-            kind: "upgrade",
-            handler,
-            data: value,
-            pubsub,
-            attach,
-            maxPayloadBytes: this.wsMaxPayloadBytes,
-          }
+
+    if (this.onRequestHooks.length === 0) return resolveMatched(req)
+    let hooked: MaybePromise<Request | Response>
     try {
-      const result = handler.upgrade(ctx as unknown as WebSocketContext<EnvOf<Ctx>>)
-      return result instanceof Promise
-        ? result.then(settle, () => ({
-            kind: "reject" as const,
-            response: jsonError(500, "internal_error"),
-          }))
-        : settle(result)
+      hooked = this.runWebSocketRequestHooks(req, platform)
     } catch {
       return { kind: "reject", response: jsonError(500, "internal_error") }
     }
+    if (!(hooked instanceof Promise)) {
+      return hooked instanceof Response
+        ? { kind: "reject", response: hooked }
+        : resolveMatched(hooked)
+    }
+    const pending = hooked.then(
+      (result) =>
+        result instanceof Response
+          ? { kind: "reject" as const, response: result }
+          : resolveMatched(result),
+      () => ({ kind: "reject" as const, response: jsonError(500, "internal_error") }),
+    )
+    return bounded(
+      Promise.resolve(pending).then((result) => result),
+      onTimeout,
+    )
   }
 
   /** Bun `fetch` when WS routes exist: try a WS upgrade first, else run the normal HTTP lifecycle.
@@ -2652,7 +2748,10 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
         ? undefined
         : jsonError(426, "upgrade_required")
     }
-    const outcome = this.resolveWebSocketUpgrade(req)
+    const outcome = this.resolveWebSocketUpgrade(
+      req,
+      bunPeerPlatform(server, req) as Platform<EnvOf<Ctx>>,
+    )
     return outcome instanceof Promise ? outcome.then(handle) : handle(outcome)
   }
 

package/src/server.ts

@@ -33,6 +33,7 @@ export {
   type CookieOptions,
   type CookieSecret,
   cookieNamePrefix,
+  hasDuplicateCookie,
   parseCookies,
   serializeCookie,
   signValue,