@nifrajs/core 3.5.0 → 4.0.2

package/src/server/server.ts

@@ -31,23 +31,25 @@ import {
   type InternalHandler,
   type RawAfterHandle,
   type RawAround,
+  type RawAuthStage,
   type RawBeforeHandle,
   type RawDerive,
   type RawErrorHandler,
   type RouteEntry,
 } from "../internal/route-execution.ts"
-import type { RouteProgramStage } from "../internal/route-program.ts"
+import type { ProgramValidationKind, RouteProgramStage } from "../internal/route-program.ts"
 import { compileRouteProgram, executeRouteProgram } from "../internal/route-program.ts"
 import { isSameOriginRequest } from "../internal/same-origin.ts"
 import type { ResponseObserverPlugin } from "../response-observer.ts"
-import { decodeRouteParams } from "../router/pattern.ts"
-import { EMPTY_PARAMS, type Method, Router } from "../router/router.ts"
+import { decodeRouteParams, expandOptionalParams } from "../router/pattern.ts"
+import { EMPTY_PARAMS, METHODS, type Method, Router } from "../router/router.ts"
 import type {
   InferOutput,
   StandardIssue,
   StandardResult,
   StandardSchemaV1,
 } from "../schema/standard.ts"
+import type { AuthenticationStage } from "./auth.ts"
 import { emitRequestErrorLog, renderBareError } from "./bare-error-lane.ts"
 import {
   assertByteLimit,
@@ -56,20 +58,33 @@ import {
   type RawBodyReaders,
   UNLIMITED_BODY_BYTES,
 } from "./body.ts"
-import { type ClientIpTrust, resolveClientIp } from "./client-ip.ts"
+import {
+  type ClientIpTrust,
+  NIFRA_PLATFORM_CLIENT_IP_DERIVED,
+  resolveClientIp,
+} from "./client-ip.ts"
 import type { Context, Platform, ResponseControls, RouteSchema } from "./context.ts"
+import "./core-copies.ts"
 import {
   hasLowercaseHeaderKeysMark,
   headerKeysAllLowercase,
   markLowercaseHeaderKeys,
 } from "./header-case.ts"
 import { headerObjectOf } from "./headers.ts"
-import { jsonError, pathnameOf, plainError, type UrlParts, urlPartsOf } from "./http.ts"
+import {
+  isRoutableMethod,
+  jsonError,
+  pathnameOf,
+  plainError,
+  type UrlParts,
+  urlPartsOf,
+} from "./http.ts"
 import { type NodeServeOutcome, withStaticNodeHeaders } from "./node-outcome.ts"
 import type {
   NodeOutcomeRuntime,
   NodeRequestContext,
   NodeRequestHook,
+  NodeResponseBodyHook,
   NodeResponseContext,
   NodeResponseHook,
   ResponseBodyHook,
@@ -78,7 +93,14 @@ import type {
   ResponseHeadersView,
 } from "./node-outcome-hook.ts"
 import { type QueryValue, queryObjectOf, searchOf } from "./query.ts"
-import { RequestContext, readBodyFramed } from "./request-context.ts"
+import {
+  type PeerPlatform,
+  PLATFORM_PEER,
+  RequestContext,
+  readBodyFramed,
+} from "./request-context.ts"
+import { recordRequestReplacement } from "./request-lineage.ts"
+import { hasDotSegment, resolveDotSegments } from "./request-target.ts"
 import {
   applyStaticResponseHeaders,
   buildStaticResponseHeaders,
@@ -114,6 +136,7 @@ import { plainValidationError } from "./validation.ts"
 export type {
   NodeRequestContext,
   NodeRequestHook,
+  NodeResponseBodyHook,
   NodeResponseContext,
   NodeResponseHook,
   NodeServeOutcome,
@@ -123,12 +146,15 @@ export type {
   ResponseHeadersView,
 }
 
+import { NIFRA_BACKEND_WS_RUNTIME } from "../mount.ts"
 import type { IdempotencyRuntime } from "./idempotency-lane.ts"
 import {
+  GET_WS_RUNTIME,
   INSTALL_EFFECT_LEDGER,
   INSTALL_IDEMPOTENCY,
   INSTALL_MCP,
   INSTALL_NODE_DIRECT,
+  INSTALL_NOT_FOUND,
   INSTALL_RESPONSE_CONTRACT,
   INSTALL_RESPONSE_OBSERVER,
   INSTALL_SSE,
@@ -139,16 +165,20 @@ import {
 import type { EffectLedgerRuntime } from "./ledger-lane.ts"
 import { jsonLogger, type Logger } from "./logger.ts"
 import type { McpRuntime } from "./mcp-hook.ts"
+import type { NotFoundLane } from "./not-found-answer.ts"
 import type {
   ContextPlugin,
   IdentityPlugin,
+  MethodRoutesPlugin,
   PluginTypeCollapsed,
   ServerTypeUnpinned,
+  WithMethodRoutes,
 } from "./plugin.ts"
 import type {
   AddRoute,
   EmptyRegistry,
   OutputOf,
+  PrefixRegistry,
   Registry,
   RouteInfoFor,
   WsRouteInfoFor,
@@ -157,10 +187,13 @@ import type {
   AdmissionController,
   AdmissionDecision,
   FetchHandler,
+  ListenTlsOptions,
   McpPromptDescriptor,
   McpResourceDescriptor,
   Middleware,
+  MountableApp,
   MountFetchOptions,
+  MountOptions,
   PromptArgument,
   PromptMessage,
   ResponseFinalization,
@@ -183,6 +216,11 @@ import type { WsRuntime } from "./ws-hook.ts"
 
 export type MaybePromise<T> = T | Promise<T>
 
+// CORS uses this marker to say its request hook only handles OPTIONS preflight. Bun can keep
+// ordinary registered routes on its native table and send unmatched OPTIONS requests through the
+// normal fetch fallback where the hook still runs.
+const BUN_NATIVE_REQUEST_SAFE = Symbol.for("@nifrajs/core/bun-native-request-safe")
+
 /**
  * Internal request view. A real Web `Request` already satisfies this shape, so Web/edge runtimes pass
  * their `Request` **directly** (zero wrapper allocation on the hot path - `request` is simply absent and
@@ -234,15 +272,18 @@ export interface RawContext {
   readonly request: Request
   readonly json: (body: unknown, init?: ResponseInit | number) => Response
   readonly text: (body: string, init?: ResponseInit | number) => Response
-  // Writable: the lifecycle replaces it with the validated/coerced value when a `params` schema is
-  // declared (handlers still see it `readonly` via the public `Context` interface).
+  // Writable: the lifecycle replaces each with the validated/coerced value when its schema is
+  // declared (handlers still see them `readonly` via the public `Context` interface).
   params: Record<string, string>
   headers: Record<string, string>
   query: unknown
-  readonly cookies: Readonly<Record<string, string>>
+  cookies: Readonly<Record<string, string>>
   body: unknown
   readonly set: ResponseControls
   readonly [CONTEXT_SET]: () => CtxSet | undefined
+  /** The last `json()` reply and the value it was built from, for the response-contract lane. */
+  readonly jsonReply?: Response | undefined
+  readonly jsonBody?: unknown
   readonly [CONTEXT_SEARCH]: string
   readonly signal: AbortSignal
   readonly budget: RequestBudget
@@ -266,13 +307,21 @@ interface WsEntry {
   readonly handler: WebSocketHandler
 }
 
+/** Structural view of the socket-peer lookup on the Bun `Server`, so any Bun `Server` (WS or not)
+ * satisfies it. */
+interface BunPeerServer {
+  requestIP(request: Request): { readonly address: string } | null
+}
+
 /** Structural view of the Bun `Server` the `fetch` 2nd arg exposes (`upgrade` + the socket peer). */
-interface BunUpgradeServer {
+interface BunUpgradeServer extends BunPeerServer {
   upgrade(request: Request, options?: { data?: BunWsData }): boolean
-  requestIP(request: Request): { readonly address: string } | null
 }
 
-type MountedFetchHandler = (request: Request, platform?: Platform) => MaybePromise<Response>
+type MountedFetchHandler<Env = unknown> = (
+  request: Request,
+  platform?: Platform<Env>,
+) => MaybePromise<Response>
 
 /** Structural native mount contract. The serving adapter owns the concrete Node request/response
  * types; the kernel only selects a handler after proving that taking this lane cannot skip its
@@ -290,21 +339,31 @@ interface NativeMountSelection {
   readonly stripPrefix: boolean
 }
 
-interface FetchMount {
+interface FetchMount<Env = unknown> {
   readonly path: string
-  readonly handler: MountedFetchHandler
+  readonly handler: MountedFetchHandler<Env>
+  readonly resolveWebSocketUpgrade?: (
+    request: Request,
+    platform?: Platform<Env>,
+  ) => MaybePromise<WebSocketUpgradeOutcome>
+  /** Set with the resolver: the runtime the child's WebSocket upgrades need (see `[GET_WS_RUNTIME]`). */
+  readonly wsRuntime?: (seen: Set<unknown>) => WsRuntime | null | undefined
   readonly stripPrefix: boolean
+  readonly priority: number
+  readonly fallbackOn404: boolean
+  readonly beforeRoutes: boolean
+  readonly order: number
+  /** The declared reason this child is not analyzed (`MountOptions.opaque`), checked by reflection. */
+  readonly opaque: string | undefined
+  /** The mounted app (`mount()` only), for reflection to tell a composed child from an opaque one. */
+  readonly app?: object
 }
 
-/** The socket peer Bun observed, as a `Platform` for the request lifecycle (`undefined` if unknown).
- * Typed structurally on `requestIP` alone so any Bun `Server` (WS or not) satisfies it. */
-function bunPeerPlatform(
-  server: { requestIP(request: Request): { readonly address: string } | null },
-  req: Request,
-): Platform {
-  // Bun's requestIP() is surprisingly expensive (~20 us on the SSR benchmark machine). Keep the
+/** The socket peer Bun observed, as a `Platform` for the request lifecycle (`undefined` if unknown). */
+function bunPeerPlatform(server: BunPeerServer, req: Request): Platform {
+  // Bun's requestIP() costs ~0.5 us per call, about 7% of a bare GET's server time. Keep the
   // documented raw-peer c.clientIp behavior, but resolve it lazily: most routes never read c.clientIp,
-  // and paying for the socket lookup on every request erased Bun's native HTTP advantage. A getter also
+  // so they should not pay for the socket lookup on every request. A getter also
   // preserves middleware that inspects the platform argument directly and trust-mode routes, which
   // resolve the value in deriveClientIp before the handler runs.
   let resolved = false
@@ -320,13 +379,42 @@ function bunPeerPlatform(
   }
 }
 
-type BunNativeHandler = (request: Request) => MaybePromise<Response>
+type BunNativeHandler = (request: Request, server: BunPeerServer) => MaybePromise<Response>
 type BunNativeMethodTable = Partial<Record<Method, BunNativeHandler>>
 type BunNativeRoutes = Record<string, BunNativeMethodTable>
 type BunRequestWithParams = Request & { readonly params?: Record<string, string> }
 
+/**
+ * Whether the portable router gives `other` a request that `route` also matches: the two patterns can
+ * match one path, and `other` is the more specific at the first segment where they differ. `route`
+ * holds static and `:param` segments only; `other` has a wildcard or a part-literal segment.
+ *
+ * It errs toward `true`. A segment that is part literal, part parameter is taken to match whatever
+ * `route` has in that position.
+ */
+function outranks(
+  other: CatalogRoute["pattern"]["segments"],
+  route: CatalogRoute["pattern"]["segments"],
+): boolean {
+  let ahead = false
+  for (let i = 0; i < route.length; i++) {
+    const theirs = other[i]
+    if (theirs === undefined) return false
+    if (theirs.kind === "wildcard") return ahead
+    const ours = route[i]!
+    if (ours.kind === "static") {
+      if (theirs.kind === "static" ? theirs.value !== ours.value : !ahead) return false
+    } else if (theirs.kind !== "param") ahead = true
+  }
+  return ahead && other.length === route.length
+}
+
 const WS_PASS: WebSocketUpgradeOutcome = { kind: "pass" }
 const DEFAULT_WS_UPGRADE_TIMEOUT_MS = 10_000
+/** Counts `ws()` routes and `mount()`s across every app in this copy of core: the only
+ * changes that can make a mounted app take WebSocket upgrades. An app's answer to that question
+ * (`mountsTakeUpgrades`) is kept until this moves. */
+let wsChanges = 0
 
 /** `app.ws()` (and everything downstream of it) needs the runtime `@nifrajs/core/ws` registers. */
 function requireWsRuntime(runtime: WsRuntime | undefined): WsRuntime {
@@ -408,10 +496,13 @@ export type {
   AdmissionController,
   AdmissionDecision,
   FetchHandler,
+  ListenTlsOptions,
   McpPromptDescriptor,
   McpResourceDescriptor,
   Middleware,
+  MountableApp,
   MountFetchOptions,
+  MountOptions,
   PromptArgument,
   PromptMessage,
   ResponseFinalization,
@@ -436,8 +527,10 @@ export {
   defineIdentityPlugin,
   definePlugin,
   defineRouterPlugin,
+  type MethodRoutesPlugin,
   type NifraPlugin,
   type PluginTypeCollapsed,
+  type WithMethodRoutes,
 } from "./plugin.ts"
 export type { IdentityPlugin }
 
@@ -462,13 +555,31 @@ export { plainValidationError } from "./validation.ts"
 // importers keep resolving `searchOf`/`queryObjectOf`/`QueryValue` from here.
 export { type QueryValue, queryObjectOf, searchOf }
 
-function hasReplacementParam(params: Record<string, string>): boolean {
+/**
+ * A param value Bun's native route table matched but the portable router must decide: an invalid
+ * escape, or a piece of path Bun matched raw while its own parsed URL says otherwise - a `.` / `..`
+ * segment (Bun hands `%2e` over decoded), or a backslash, which the parsed URL reads as `/`.
+ */
+const unroutedParam = (value: string | undefined): boolean =>
+  value !== undefined &&
+  (value.includes("\uFFFD") || value.includes("\\") || value === "." || value === "..")
+
+function hasUnroutedParam(params: Record<string, string>): boolean {
   for (const key in params) {
-    if (params[key]!.includes("\uFFFD")) return true
+    if (unroutedParam(params[key])) return true
   }
   return false
 }
 
+/**
+ * Deno is the runtime that hands an app a `Request` whose `url` is the target as the client sent it;
+ * Bun, workerd and every `new Request()` parse it first. Only there does `fetch` read the URL up front.
+ */
+const rawRequestTargets = typeof (globalThis as { Deno?: unknown }).Deno !== "undefined"
+
+/** `req` as Bun or workerd would have delivered it: the same request, its URL's dot segments resolved. */
+const withResolvedTarget = (req: Request): Request => new Request(resolveDotSegments(req.url), req)
+
 function normalizeMountPrefix(path: string): string {
   if (!path.startsWith("/") || path.includes("?") || path.includes("#")) {
     throw new TypeError("mountFetch path must be an absolute pathname without a query or hash")
@@ -487,6 +598,18 @@ function underMountPrefix(pathname: string, prefix: string): boolean {
   return prefix === "/" || pathname === prefix || pathname.startsWith(`${prefix}/`)
 }
 
+function mountPriorityOf(priority: number | undefined): number {
+  if (priority === undefined) return 0
+  if (!Number.isSafeInteger(priority)) {
+    throw new TypeError("mount priority must be a safe integer")
+  }
+  return priority
+}
+
+function compareMounts<Env>(a: FetchMount<Env>, b: FetchMount<Env>): number {
+  return b.priority - a.priority || b.path.length - a.path.length || a.order - b.order
+}
+
 function stripMountPrefix(request: Request, prefix: string): Request {
   if (prefix === "/") return request
   const url = new URL(request.url)
@@ -536,6 +659,88 @@ export type NifraFeatureVersion = FeatureVersionOf<Version>
 const webResponseOf = (result: Response | ResponseResult): Response =>
   result instanceof Response ? result : toResponse(result, EMPTY_RESPONSE_CONTROLS)
 
+/** Which requests a scoped (group/merged) hook runs for, judged from the request the hook sees. */
+type HookScope = (req: { readonly method: string; readonly url: string }) => boolean
+
+/** A `group(prefix)` hook's scope: every request whose path is the prefix or lies under it - served,
+ * 404, 405, or preflight alike (Hono's `use("/api/*")` reach). The router matches static segments
+ * byte-exactly and case-sensitively, with the same path scanner used here, so no spelling a group
+ * route answers to can fall outside this test. */
+const underPrefix = (prefix: string): HookScope => {
+  const nested = `${prefix}/`
+  return (req) => {
+    const path = pathnameOf(req.url)
+    return path === prefix || path.startsWith(nested)
+  }
+}
+
+/** A merged server's hook scope: exactly the routes MERGED, snapshotted into a dedicated matcher so
+ * the guard never reflects whatever the source's own catalog grows into afterwards. */
+const servedBy = (routes: readonly CatalogRoute[]): HookScope => {
+  const scope = new RouteCatalog()
+  scope.addBatch(routes)
+  return (req) => scope.find(req.method, pathnameOf(req.url)).found
+}
+
+type AdoptedHook = ((first: never, second: never) => unknown) | undefined
+
+/** Gate adopted hooks to `inScope` (`undefined`: adopt them unchanged). The request is a request
+ * hook's first argument (`reqAt` 0) and every response-side hook's second; out of scope a hook
+ * declines, except a Web response hook, which must hand the response on (`passFirst`). An
+ * `undefined` slot marks an unpaired Node twin, position-aligned with its Web list, and stays
+ * `undefined` - wrapping it would fabricate a twin that never existed. */
+const scopeHooks = <H extends AdoptedHook>(
+  hooks: readonly H[],
+  inScope: HookScope | undefined,
+  reqAt: 0 | 1,
+  passFirst?: true,
+): readonly H[] =>
+  inScope === undefined
+    ? hooks
+    : hooks.map((hook) =>
+        hook === undefined
+          ? hook
+          : (((first: never, second: never) =>
+              inScope(reqAt === 0 ? first : second)
+                ? hook(first, second)
+                : passFirst && first) as H),
+      )
+
+/** A `group()` prefix: `/`-led segments of RFC 3986 `pchar` minus `%` and `:`, none of them `.` or
+ * `..`. That is text the router compares byte-for-byte as static, so a prefix can never smuggle a
+ * param, a wildcard, or an escape, and never spells a path (dot or empty segment, trailing slash)
+ * that no normalized client URL reaches. Segments are delimited by a `/` the class excludes, so the
+ * match is linear. */
+const GROUP_PREFIX = /^(?:\/(?!\.\.?(?:\/|$))[\w.~!$&'()+,;=@-]+)+$/
+
+/** The order-scoped chain a group scope inherits - copied, so what the group adds stays its own. */
+const GROUP_CHAIN = [
+  "derives",
+  "authStages",
+  "beforeHandleHooks",
+  "afterHandleHooks",
+  "onErrorHooks",
+  "aroundHooks",
+  "activeAssurance",
+  // Inherited so a group route computes `authenticated` (idempotency principal scoping) exactly as a
+  // parent route would; only the evidence the group adds is folded at adoption.
+  "globalAssurance",
+  "capabilityInterceptors",
+  "capabilityObservers",
+] as const
+
+/** Installed runtimes: a group scope inherits them, and adoption hoists a source's into a server that
+ * has none, so composing servers cannot silently disable a safety lane. */
+const SERVER_RUNTIMES = [
+  "responseContractRuntime",
+  "idempotencyRuntime",
+  "effectLedgerRuntime",
+  "mcpRuntime",
+  "nodeOutcomeRuntime",
+  "sseRuntime",
+  "wsRuntime",
+] as const
+
 // Stable module-level finalizers so `fetch`/`resolveNode` allocate no per-request closures.
 const IDENTITY_RESPONSE = (response: Response | ResponseResult): Response => webResponseOf(response)
 const RESPONSE_TIMEOUT = (): Response => jsonError(503, "request_timeout")
@@ -661,6 +866,10 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   /** WebSocket routes, matched separately at upgrade time (a GET + `Upgrade: websocket`). */
   private readonly wsRouter: Router<WsEntry>
   private wsRouteCount: number
+  /** `wsChanges` when `wsMountsLive` was last worked out; -1 until then. */
+  private wsMountsCheckedAt = -1
+  /** Whether an app mounted here takes WebSocket upgrades, as of `wsMountsCheckedAt`. */
+  private wsMountsLive = false
   /** In-process pub/sub backing `ws.subscribe(topic)` + `app.publish(topic, data)` (single-instance).
    * Created by the first `app.ws()` via the `@nifrajs/core/ws` runtime - `undefined` until then, so a
    * no-WebSocket app never constructs (or bundles) it. */
@@ -670,7 +879,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    * rather than delegate to Bun's native `server.publish`. */
   private wsHasValidatedSend = false
   /** Bun's native topic broadcast, bound by `listen()` in native-pubsub mode; `app.publish` uses it
-   * instead of the JS registry. `undefined` off Bun, before `listen()`, or with a validated-send route. */
+   * instead of the JS registry. `undefined` off Bun, before `listen()`, with a validated-send route,
+   * or when a mounted app takes upgrades. */
   private nativePublish:
     | ((topic: string, data: string | ArrayBufferView | ArrayBuffer) => void)
     | undefined
@@ -691,7 +901,10 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   private readonly deadlineAdmissionOptions: DeadlineAdmissionOptions
   private readonly gracefulSignals: boolean
   private readonly stopHooks: StopHook[]
-  private readonly fetchMounts: FetchMount[]
+  private readonly fetchMounts: FetchMount<EnvOf<Ctx>>[]
+  private mountOrder: number
+  /** Number of composed mounts that must run before the parent route table. Keeps legacy mounts off the hot path. */
+  private preRouteMountCount: number
   /** Capacity-admission gate; `undefined` = off (the request path pays nothing). */
   private readonly capacityGate: AdmissionController | undefined
   private readonly onCapabilityUse: ((event: CapabilityUseEvent) => void) | undefined
@@ -705,6 +918,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   private idempotencyRuntime: IdempotencyRuntime | undefined
   /** Installed opt-in runtime for `.tool()`/`.resource()`/`.prompt()`; `undefined` until `.use(mcp())`. */
   private mcpRuntime: McpRuntime | undefined
+  /** Installed answer for a request no route matched; `undefined` (the plain 404) until `.use(notFound())`. */
+  private notFoundLane: NotFoundLane | undefined
   /** Installed Node-direct renderer for direct `resolveNode()` callers; `undefined` until `.use(nodeDirect())`. */
   private nodeOutcomeRuntime: NodeOutcomeRuntime | undefined
   /** Installed streaming runtime for `.sse()` routes; `undefined` until `.use(streaming())`. */
@@ -719,6 +934,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   private bunServer: RunningServer | undefined
   private sealed: boolean
   private readonly derives: RawDerive[]
+  /** Dedicated authentication stages captured by subsequent routes. */
+  private readonly authStages: RawAuthStage[]
   private readonly decorations: Record<string, unknown>
   private readonly beforeHandleHooks: RawBeforeHandle[]
   private readonly afterHandleHooks: RawAfterHandle[]
@@ -728,10 +945,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   private readonly onNodeRequestHooks: Array<NodeRequestHook | undefined>
   /** Registration-time eligibility for the Node request twin lane. */
   private nodeRequestHooksComplete: boolean
+  /** True when every request hook is safe to skip on a Bun native route. */
+  private bunNativeRequestHooksSafe: boolean
   private readonly onResponseHooks: RawOnResponse[]
   private readonly onNodeResponseHooks: Array<NodeResponseHook | undefined>
   /** Registration-time eligibility for the Node response twin lane. */
   private nodeResponseHooksComplete: boolean
+  /** True when every response hook only mutates headers and can run after a Bun fused response. */
+  private bunNativeResponseHeadersOnly: boolean
   /**
    * True once a bundle registers a RAW `onNodeResponse` twin - one handed the outcome's header
    * record itself rather than the case-normalizing view. Their names are contractually the wire
@@ -747,6 +968,11 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    * `onResponse` hook would have disabled.
    */
   private staticResponseHeaders: StaticResponseHeaders | undefined
+  /** A group's view of the static headers its enclosing scopes declared before it was created. */
+  private declare inheritedStatics: Readonly<Record<string, string>> | undefined
+  /** A group's view of the plugins its enclosing scopes applied before it was created; unset while
+   * a plugin applies, so its own dependency `use()` shares the parent's copy. */
+  private declare inheritedPlugins: ReadonlyMap<string, unknown> | undefined
   /** `wrapResponse` for the Web lanes: identity until static headers exist to fold into the
    * framework's own error/404/timeout renders, which are built outside the header init. */
   private wrapWebResponse: (response: Response | ResponseResult) => Response
@@ -761,8 +987,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   private readonly responseSources: WeakMap<object, Request>
   /** Memoized NodeRequestContext per plain-`Request` source - see {@link nodeRequestContextOf}. */
   private readonly nodeContexts: WeakMap<object, NodeRequestContext>
-  /** Names of plugins/middleware already applied via `use` - for idempotent dedupe. */
-  private readonly appliedPlugins: Set<string>
+  /** Plugins/middleware already applied via `use`, by name - for idempotent dedupe. */
+  private readonly appliedPlugins: Map<string, unknown>
   /** Order-scoped evidence captured by routes registered after an assured plugin. */
   private readonly activeAssurance: AssuranceDeclaration[]
   /** App-wide evidence from global hooks; applies retroactively to every route. */
@@ -770,7 +996,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   /** App-declared MCP resources / prompts (via {@link resource} / {@link prompt}), read by `nifra mcp`. */
   private readonly mcpResourceList: McpResourceDescriptor[]
   private readonly mcpPromptList: McpPromptDescriptor[]
+  /** Kept so a {@link group} scope is built with exactly this server's settings: fused lanes read
+   * several of them at request time, so a group route must never run under different ones. */
+  private readonly options: ServerOptions
+  /** Static prefix joined onto every route this server registers; non-empty only on a group scope. */
+  private routePrefix: string
   constructor(options: ServerOptions = {}) {
+    this.options = options
+    this.routePrefix = ""
     this.catalog = new RouteCatalog()
     this.wsRouter = new Router<WsEntry>()
     this.wsRouteCount = 0
@@ -804,6 +1037,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     this.gracefulSignals = options.gracefulSignals ?? false
     this.stopHooks = []
     this.fetchMounts = []
+    this.mountOrder = 0
+    this.preRouteMountCount = 0
     this.capacityGate = options.admission
     this.onCapabilityUse = options.onCapabilityUse
     this.capabilityInterceptors = []
@@ -826,6 +1061,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       beginHookAudit(this, options.unusedScopedHooks ?? "warn", options.logger !== undefined)
     }
     this.derives = []
+    this.authStages = []
     this.decorations = {}
     this.beforeHandleHooks = []
     this.afterHandleHooks = []
@@ -834,9 +1070,11 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     this.onRequestHooks = []
     this.onNodeRequestHooks = []
     this.nodeRequestHooksComplete = true
+    this.bunNativeRequestHooksSafe = true
     this.onResponseHooks = []
     this.onNodeResponseHooks = []
     this.nodeResponseHooksComplete = true
+    this.bunNativeResponseHeadersOnly = true
     this.hasRawNodeResponseHook = false
     this.onResponseFinalizedHooks = []
     this.staticResponseHeaders = undefined
@@ -847,7 +1085,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     this.responseRequests = new WeakMap()
     this.responseSources = new WeakMap()
     this.nodeContexts = new WeakMap()
-    this.appliedPlugins = new Set()
+    this.appliedPlugins = new Map()
     this.activeAssurance = []
     this.globalAssurance = []
     this.mcpResourceList = []
@@ -858,7 +1096,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     if (this.sealed) {
       throw new FrameworkError(
         "SERVER_SEALED",
-        `server configuration is sealed after listen(); call ${operation} before listen()`,
+        `server configuration is sealed after listen() (a group once its builder returns); call ${operation} before`,
       )
     }
   }
@@ -883,13 +1121,76 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   ): this {
     this.assertConfigurable("mountFetch()")
     if (typeof handler !== "function") throw new TypeError("mountFetch handler must be a function")
-    const mount: FetchMount = {
+    const mount: FetchMount<EnvOf<Ctx>> = {
       path: normalizeMountPrefix(path),
-      handler: handler as MountedFetchHandler,
+      handler: handler as MountedFetchHandler<EnvOf<Ctx>>,
+      stripPrefix: options.stripPrefix === true,
+      priority: mountPriorityOf(options.priority),
+      fallbackOn404: options.fallbackOn === 404,
+      beforeRoutes: false,
+      order: this.mountOrder++,
+      opaque: options.opaque,
+    }
+    this.fetchMounts.push(mount)
+    this.fetchMounts.sort(compareMounts)
+    return this
+  }
+
+  /**
+   * Compose a child fetch app under a literal path prefix.
+   *
+   * Composed mounts run after the app-global request phase and before the parent's route table. This
+   * makes them safe to use in an SSR shell whose `/*` page route would otherwise swallow an API mount.
+   * If the child exposes `resolveWebSocketUpgrade`, the same mount also participates in adapter-owned
+   * WebSocket upgrades; the serving adapter still upgrades its original socket, while the child sees
+   * the mounted request path (stripped when requested).
+   *
+   * `fallbackOn: 404` is deliberately limited to GET/HEAD/OPTIONS at dispatch time. Those methods are
+   * replayable without buffering an untrusted request body; POST/PUT/PATCH and streaming requests
+   * never get retried after a child has had a chance to consume them.
+   */
+  mount(options: MountOptions<EnvOf<Ctx>>): this {
+    this.assertConfigurable("mount()")
+    if (options === null || typeof options !== "object") {
+      throw new TypeError("mount() requires { path, app }")
+    }
+    const app = options.app as MountableApp<EnvOf<Ctx>> & Record<symbol, unknown>
+    if (app === null || typeof app !== "object") {
+      throw new TypeError("mount() app must be an object with fetch()")
+    }
+    if (typeof app.fetch !== "function") {
+      throw new TypeError("mount() app.fetch must be a function")
+    }
+    const resolver =
+      typeof app.resolveWebSocketUpgrade === "function"
+        ? app.resolveWebSocketUpgrade.bind(app)
+        : undefined
+    // Bun needs a websocket callback table in the parent process. A composed Nifra app names the
+    // runtime its upgrades need through this internal seam, which `listen()` asks (see
+    // `[GET_WS_RUNTIME]`); a resolver without it names none. Adapters that wire standard sockets use
+    // the resolver outcome's own `attach`.
+    const getRuntime = app[GET_WS_RUNTIME] ?? app[NIFRA_BACKEND_WS_RUNTIME]
+    const mount: FetchMount<EnvOf<Ctx>> = {
+      path: normalizeMountPrefix(options.path),
+      handler: app.fetch.bind(app) as MountedFetchHandler<EnvOf<Ctx>>,
+      ...(resolver === undefined
+        ? {}
+        : {
+            resolveWebSocketUpgrade: resolver,
+            wsRuntime: typeof getRuntime === "function" ? getRuntime.bind(app) : () => null,
+          }),
       stripPrefix: options.stripPrefix === true,
+      priority: mountPriorityOf(options.priority),
+      fallbackOn404: options.fallbackOn === 404,
+      beforeRoutes: true,
+      order: this.mountOrder++,
+      opaque: options.opaque,
+      app,
     }
     this.fetchMounts.push(mount)
-    this.fetchMounts.sort((a, b) => b.path.length - a.path.length)
+    this.fetchMounts.sort(compareMounts)
+    this.preRouteMountCount += 1
+    wsChanges += 1
     return this
   }
 
@@ -927,6 +1228,33 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    * by none before; one added after the last route reaches nothing
    * (see {@link ServerOptions.unusedScopedHooks}).
    */
+  /**
+   * Register a dedicated authentication stage for subsequent routes.
+   *
+   * Unlike `derive`, this stage receives a body-blind authentication capsule and is compiled before
+   * route validation. Keeping it separate prevents an unrelated derive from accidentally becoming a
+   * security gate and lets the route compiler retain a protected fast lane.
+   */
+  authenticate<Principal>(
+    stage: AuthenticationStage<Principal, EnvOf<Ctx>>,
+  ): Server<R, Ctx & { readonly principal: Principal }, HookOutput> {
+    this.assertConfigurable("authenticate()")
+    if (stage === null || typeof stage !== "object") {
+      throw new TypeError("authenticate() requires an authentication stage")
+    }
+    if (typeof stage.id !== "string" || stage.id.trim() === "") {
+      throw new TypeError("authenticate() stage id must be a non-empty string")
+    }
+    if (typeof stage.run !== "function") {
+      throw new TypeError("authenticate() stage run must be a function")
+    }
+    if (stage.mode !== undefined && stage.mode !== "sync" && stage.mode !== "async") {
+      throw new TypeError('authenticate() stage mode must be "sync" or "async"')
+    }
+    this.authStages.push(stage as unknown as RawAuthStage)
+    return this as unknown as Server<R, Ctx & { readonly principal: Principal }, HookOutput>
+  }
+
   decorate<const K extends string, V>(key: K, value: V): Server<R, Ctx & Record<K, V>, HookOutput> {
     this.assertConfigurable("decorate()")
     this.decorations[key] = value
@@ -946,6 +1274,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     this.onRequestHooks.push(fn as RawOnRequest)
     this.onNodeRequestHooks.push(undefined)
     this.nodeRequestHooksComplete = false
+    this.bunNativeRequestHooksSafe = false
     return this
   }
 
@@ -1050,6 +1379,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     this.onResponseHooks.push(fn)
     this.onNodeResponseHooks.push(undefined)
     this.nodeResponseHooksComplete = false
+    this.bunNativeResponseHeadersOnly = false
     return this
   }
 
@@ -1067,7 +1397,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    *   app.responseHeaders({ "x-frame-options": "DENY", "referrer-policy": "no-referrer" })
    *
    * They are DEFAULTS: a value the request itself produced (`c.set.headers`, or a response hook)
-   * wins, whatever casing it used. Names are lowercased once here; a non-string value, an invalid
+   * wins, whatever casing it used. In a group, a name the group declares replaces the value its
+   * enclosing scopes declared before the group, on the group's routes. Names are lowercased once here; a non-string value, an invalid
    * name, `__proto__`, or a name the render owns (`content-type`, `content-length`,
    * `transfer-encoding`, `set-cookie`) throws a `TypeError` at wire-up.
    *
@@ -1101,7 +1432,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       // serialized-body marker survives for later `onResponseBody`/`onResponseRaw` observers and the
       // Node writer; reconstructing a `Response` here would strip that marker and reclassify the Node
       // outcome from `json` to a generic `response`. A guarded foreign response takes its clone path.
-      const statics = buildStaticResponseHeaders(record)
+      const statics = buildStaticResponseHeaders(record, this.inheritedStatics)
       this.onResponseHooks.push((response) => applyStaticResponseHeaders(response, statics))
       this.onNodeResponseHooks.push(undefined)
       this.nodeResponseHooksComplete = false
@@ -1111,7 +1442,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       this.staticResponseHeaders === undefined
         ? record
         : { ...this.staticResponseHeaders.record, ...record }
-    this.staticResponseHeaders = buildStaticResponseHeaders(merged)
+    this.staticResponseHeaders = buildStaticResponseHeaders(merged, this.inheritedStatics)
     const statics = this.staticResponseHeaders
     this.wrapWebResponse = (response) =>
       applyStaticResponseHeaders(webResponseOf(response), statics)
@@ -1150,6 +1481,16 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     return this
   }
 
+  /**
+   * Apply `all()` or `method()` from `@nifrajs/core/methods`: one handler registered under several
+   * methods, or under a method outside the standard seven. The standard methods join the registry.
+   *
+   * Declared first on purpose. The plugin's handler is typed against this app's context, which
+   * TypeScript reads from the first overload it tries.
+   */
+  use<M extends string, Path extends string, S extends RouteSchema, Output>(
+    plugin: MethodRoutesPlugin<M, Path, S, Output, Ctx>,
+  ): Server<WithMethodRoutes<R, M, Path, S, Output, HookOutput>, Ctx, HookOutput>
   /** Enable the opt-in portable response observer methods. */
   use(plugin: ResponseObserverPlugin): this & ResponseObserverMethods
   /**
@@ -1174,7 +1515,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    * Apply a **plugin function** - `(app) => app`, typically built with {@link definePlugin}. It's
    * called with `this` and its result is returned, so an inline plugin's `derive`/`decorate` thread
    * the added context to handlers defined after `use` (the overload is generic over the concrete
-   * `this`). A named plugin already applied is skipped (idempotent dedupe).
+   * `this`). A named plugin already applied is skipped (idempotent dedupe), however it was configured,
+   * so a plugin meant to stack - a second, stricter guard - needs a name of its own per instance.
    *
    * If the plugin's return type is unpinned - `Server<any, any>`, as a hand-rolled `(app) => app` or a
    * `NifraPlugin<AnyServer, AnyServer>` infers (e.g. an auth plugin whose own types collapsed) - this
@@ -1195,22 +1537,43 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    */
   use<M extends Middleware>(mw: M): Server<R, Ctx, HookOutput | MiddlewareOutputOf<M>>
   use(mw: Middleware): this
-  use(arg: Middleware | ((app: this) => AnyServer)): AnyServer {
+  use(
+    input:
+      | Middleware
+      | ((app: this) => AnyServer)
+      | MethodRoutesPlugin<string, string, RouteSchema, unknown, Ctx>,
+  ): AnyServer {
+    // A method-routes plugin is an ordinary plugin function; only its type is opaque.
+    const arg = input as Middleware | ((app: this) => AnyServer)
     this.assertConfigurable("use()")
-    if (typeof arg === "function") {
-      const name = (arg as { pluginName?: string }).pluginName
-      if (name !== undefined) {
-        if (this.appliedPlugins.has(name)) return this // idempotent: already applied
-        this.appliedPlugins.add(name)
+    const name = typeof arg === "function" ? (arg as { pluginName?: string }).pluginName : arg.name
+    if (name !== undefined) {
+      if (this.appliedPlugins.has(name)) {
+        const parent = this.inheritedPlugins?.get(name)
+        // A group's builder passing another instance of a plugin its parent applied would have it
+        // dropped, configuration and all. A plugin's own dependency use() shares the parent's copy.
+        if (parent !== undefined && parent !== arg) {
+          throw new RouteConfigError(
+            "PLUGIN_RECONFIGURED",
+            `use() of ${JSON.stringify(name)} in a group: its parent applied another instance`,
+          )
+        }
+        return this // idempotent: already applied
       }
+      this.appliedPlugins.set(name, arg)
+    }
+    if (typeof arg === "function") {
       const evidence = assuranceDeclarationsOf(arg)
       const pluginOnly = evidence.filter((item) => item.scope === "plugin")
       this.globalAssurance.push(...evidence.filter((item) => item.scope === "global"))
       this.activeAssurance.push(...evidence.filter((item) => item.scope === "subsequent"))
       this.activeAssurance.push(...pluginOnly)
+      const inherited = this.inheritedPlugins
+      this.inheritedPlugins = undefined
       try {
         return arg(this)
       } finally {
+        this.inheritedPlugins = inherited
         // Remove only this plugin's temporary evidence. Nested assured plugins may deliberately leave
         // subsequent evidence active, so truncating the whole array would lose real ordering semantics.
         for (const item of pluginOnly) {
@@ -1219,10 +1582,6 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
         }
       }
     }
-    if (arg.name !== undefined) {
-      if (this.appliedPlugins.has(arg.name)) return this
-      this.appliedPlugins.add(arg.name)
-    }
     const evidence = assuranceDeclarationsOf(arg)
     if (evidence.some((item) => item.scope === "plugin")) {
       throw new Error('route assurance: scope "plugin" may only annotate a plugin function')
@@ -1245,6 +1604,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       this.onRequestHooks.push(arg.onRequest as RawOnRequest)
       this.onNodeRequestHooks.push(arg.onNodeRequest)
       if (arg.onNodeRequest === undefined) this.nodeRequestHooksComplete = false
+      if (!(arg as unknown as Record<symbol, unknown>)[BUN_NATIVE_REQUEST_SAFE]) {
+        this.bunNativeRequestHooksSafe = false
+      }
     } else if (arg.onNodeRequest !== undefined) {
       throw new TypeError("onNodeRequest() requires a paired onRequest() hook")
     }
@@ -1257,16 +1619,26 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       this.onNodeResponseHooks.push(arg.onNodeResponse)
       if (arg.onNodeResponse === undefined) this.nodeResponseHooksComplete = false
       else this.hasRawNodeResponseHook = true
+      this.bunNativeResponseHeadersOnly = false
     } else if (arg.onNodeResponse !== undefined) {
       throw new TypeError("onNodeResponse() requires a paired onResponse() hook")
     }
     // Before the bundle's own hooks: a bundle declaring both means its static values are the
     // defaults its hook may then override, which is the order a single bundle reads in.
     if (arg.responseHeaders !== undefined) this.responseHeaders(arg.responseHeaders)
-    if (arg.onResponseHeaders !== undefined)
-      this.responseObserverMethods().onResponseHeaders(arg.onResponseHeaders)
-    if (arg.onResponseBody !== undefined)
-      this.responseObserverMethods().onResponseBody(arg.onResponseBody)
+    if (arg.onResponseHeaders !== undefined) {
+      this.responseObserverMethods().onResponseHeaders(
+        arg.onResponseHeaders,
+        arg.onNodeResponseHeaders,
+      )
+    } else if (arg.onNodeResponseHeaders !== undefined) {
+      throw new TypeError("onNodeResponseHeaders() requires a paired onResponseHeaders() hook")
+    }
+    if (arg.onResponseBody !== undefined) {
+      this.responseObserverMethods().onResponseBody(arg.onResponseBody, arg.onNodeResponseBody)
+    } else if (arg.onNodeResponseBody !== undefined) {
+      throw new TypeError("onNodeResponseBody() requires a paired onResponseBody() hook")
+    }
     if (arg.onResponseRaw !== undefined)
       this.responseObserverMethods().onResponseRaw(arg.onResponseRaw)
     if (arg.onResponseFinalized !== undefined) this.onResponseFinalized(arg.onResponseFinalized)
@@ -1595,10 +1967,10 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     this.topics ??= runtime.createTopics()
     // A `messageSchema` wraps `message` with validation once, here - every adapter then dispatches
     // already-validated, typed messages (Bun/Deno/Node/Workers) with no per-adapter code.
-    this.wsRouter.add("GET", path, {
-      handler: runtime.wrapHandler(handler as WebSocketHandler),
-    })
+    const entry = { handler: runtime.wrapHandler(handler as WebSocketHandler, this.protoPoisoning) }
+    for (const form of expandOptionalParams(path)) this.wsRouter.add("GET", form, entry)
     this.wsRouteCount += 1
+    wsChanges += 1
     return this as never
   }
 
@@ -1645,34 +2017,54 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    * is the "compiled", order-scoped per-route chain.
    */
   register(
-    method: Method,
+    method: string,
     path: string,
     schema: RouteSchema | undefined,
     handler: (context: never) => unknown,
   ): void {
-    this.assertConfigurable("route registration")
-    this.catalog.add(this.prepareRoute(method, path, schema, handler))
+    this.registerBatch([{ method, path, schema, handler }])
   }
 
   /** Register a contract/group route batch atomically. Every route captures the same current chain it
-   * would capture through {@link register}; no route becomes visible unless the full batch validates. */
+   * would capture through {@link register}; no route becomes visible unless the full batch validates.
+   *
+   * A path ending in optional parameters (`/users/:id?`) is one catalog route per concrete pattern,
+   * so reflection, OpenAPI, evidence and the typed client all see ordinary routes. */
   registerBatch(
     routes: readonly {
-      readonly method: Method
+      readonly method: string
       readonly path: string
       readonly schema: RouteSchema | undefined
       readonly handler: (context: never) => unknown
     }[],
   ): void {
     this.assertConfigurable("route registration")
-    const staged = routes.map(({ method, path, schema, handler }) =>
-      this.prepareRoute(method, path, schema, handler),
-    )
+    const staged: CatalogRoute[] = []
+    for (const { method, path, schema, handler } of routes) {
+      for (const form of expandOptionalParams(this.prefixed(path))) {
+        staged.push(this.prepareRoute(method, form, schema, handler))
+      }
+    }
     this.catalog.addBatch(staged)
   }
 
+  /** Join a group scope's prefix BEFORE compilation, so the pattern, the reflected descriptor, the
+   * capability guard, the ledger record, and assurance path matching all see the one served path. */
+  private prefixed(path: string): string {
+    const prefix = this.routePrefix
+    if (prefix === "") return path
+    if (path === "/") return prefix
+    // Checked here, not left to the pattern compiler: `"/api" + "users"` is a valid-looking path
+    // (`/apiusers`) that would silently escape the group instead of failing.
+    if (path[0] === "/") return prefix + path
+    throw new RouteConfigError(
+      "INVALID_PATH",
+      `group(${JSON.stringify(prefix)}) route path must start with "/": ${JSON.stringify(path)}`,
+    )
+  }
+
   private prepareRoute(
-    method: Method,
+    method: string,
     path: string,
     schema: RouteSchema | undefined,
     handler: (context: never) => unknown,
@@ -1690,6 +2082,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
         idempotencyRuntime: this.idempotencyRuntime,
         responseContractRuntime: this.responseContractRuntime,
         derives: this.derives,
+        authStages: this.authStages,
         beforeHandleHooks: this.beforeHandleHooks,
         afterHandleHooks: this.afterHandleHooks,
         onErrorHooks: this.onErrorHooks,
@@ -1713,15 +2106,10 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       lanes,
       routeAssurance,
     } = compiled
+    if (idempotent !== undefined && this.idempotencyRuntime !== undefined) {
+      handler = this.idempotencyRuntime.wrapHandler(handler)
+    }
     const { bare, fusedQuery, fusedBody } = lanes
-    const fusedBodyRunner = fusedBody
-      ? this.buildFusedBodyRunner(
-          handler as unknown as InternalHandler,
-          schema?.body as StandardSchemaV1,
-          hasDecorations ? routeDecorations : undefined,
-          bodyLimit ?? UNLIMITED_BODY_BYTES,
-        )
-      : undefined
     // Fused lifecycle lanes: derive + before (with or without an after), and body + the same shape.
     // The lane selectors in `selectRouteLanes` are exhaustive about the lifecycleHookLane /
     // body-derive-before-after eligibility, so we only need to check the lane and the hook counts.
@@ -1729,6 +2117,46 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     const isFusedLifecycle = lifecycleHookLane !== undefined && this.derives.length === 1
     const isFusedBodyLifecycle =
       lanes.fusedLane === "body-derive-before" || lanes.fusedLane === "body-derive-before-after"
+    // The generic runners below are the Node-direct twins of the fused Web lanes built further
+    // down: same single-frame lifecycle, finalizing through the caller's own `finalize` instead of
+    // building a `Response`, so the `!webFast` dispatcher prefers them over the generic program
+    // exactly as it prefers the body-only runner. Only the original body-only lane may feed the Web
+    // wrapper; every other runner here preserves its derive/before/after stages.
+    const fusedBodyRunner = fusedBody
+      ? this.buildFusedBodyRunner(
+          handler as unknown as InternalHandler,
+          schema?.body as StandardSchemaV1,
+          hasDecorations ? routeDecorations : undefined,
+          bodyLimit ?? UNLIMITED_BODY_BYTES,
+        )
+      : isFusedBodyLifecycle
+        ? this.buildFusedBodyDeriveBeforeAfterRunner(
+            handler as unknown as InternalHandler,
+            this.derives[0]!,
+            this.beforeHandleHooks[0]!,
+            this.afterHandleHooks[0],
+            schema?.body as StandardSchemaV1,
+            bodyLimit ?? UNLIMITED_BODY_BYTES,
+          )
+        : isFusedLifecycle && lifecycleHookLane === "derive-before"
+          ? this.buildFusedDeriveBeforeRunner(
+              handler as unknown as InternalHandler,
+              this.derives[0]!,
+              this.beforeHandleHooks[0]!,
+              undefined,
+              schema?.query,
+              bodyLimit ?? UNLIMITED_BODY_BYTES,
+            )
+          : isFusedLifecycle && lifecycleHookLane === "derive-before-after"
+            ? this.buildFusedDeriveBeforeRunner(
+                handler as unknown as InternalHandler,
+                this.derives[0]!,
+                this.beforeHandleHooks[0]!,
+                this.afterHandleHooks[0],
+                schema?.query,
+                bodyLimit ?? UNLIMITED_BODY_BYTES,
+              )
+            : undefined
     const fusedWeb =
       bare && this.aroundHooks.length === 0
         ? this.buildFusedWeb(
@@ -1777,6 +2205,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       schema,
       handler: handler as unknown as InternalHandler,
       derives: this.derives,
+      authStages: compiled.authStages,
       beforeHandle: this.beforeHandleHooks,
       afterHandle: this.afterHandleHooks,
       onError: this.onErrorHooks,
@@ -1805,6 +2234,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       ledgered,
       responseContract,
       derives: [...this.derives],
+      authStages: [...compiled.authStages],
       decorations: routeDecorations,
       hasDecorations,
       beforeHandle: [...this.beforeHandleHooks],
@@ -1819,6 +2249,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       method,
       path,
       schema,
+      ...(responseContract === undefined
+        ? {}
+        : { responseContract: responseContract.runtime.mode }),
       ...(capabilities.length > 0 ? { capabilities } : {}),
       ...(schema?.family === true ? { family: true } : {}),
     }
@@ -1867,10 +2300,11 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     this.assertConfigurable("responseObserver()")
     const methods = runtime.install({
       assertConfigurable: (operation) => this.assertConfigurable(operation),
-      addResponseHook: (web, node) => {
+      addResponseHook: (web, node, headerOnly = false) => {
         this.onResponseHooks.push(web)
         this.onNodeResponseHooks.push(node)
         if (node === undefined) this.nodeResponseHooksComplete = false
+        if (!headerOnly) this.bunNativeResponseHeadersOnly = false
       },
       enableResponseBodyTagging: () => {
         if (this.responseBodyTag === undefined) {
@@ -1897,6 +2331,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     this.mcpRuntime = runtime
   }
 
+  /** @internal Symbol-keyed install seam for the `notFound()` plugin. Off the public typed surface. */
+  [INSTALL_NOT_FOUND](lane: NotFoundLane): void {
+    this.assertConfigurable("notFound()")
+    this.notFoundLane = lane
+  }
+
   /** @internal Symbol-keyed install seam for the `nodeDirect()` plugin. Off the public typed surface. */
   [INSTALL_NODE_DIRECT](runtime: NodeOutcomeRuntime): void {
     this.assertConfigurable("nodeDirect()")
@@ -1915,6 +2355,41 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     this.wsRuntime = runtime
   }
 
+  /**
+   * @internal The runtime Bun serves this app's WebSocket upgrades with, asked by `listen()` and by a
+   * parent that mounts this app: `undefined` while nothing here can take one, `null` when something
+   * can but no runtime is at hand. A mounted Nifra app answers through this same seam, so mounting an
+   * app without a WebSocket route needs no runtime; a resolver without the seam cannot say, so it
+   * counts. `seen` ends a mount cycle (an app mounted under itself to alias a prefix).
+   */
+  [GET_WS_RUNTIME](seen?: Set<unknown>): WsRuntime | null | undefined {
+    return this.wsRouteCount > 0 ? this.wsRuntime : this.mountedWsRuntime(seen)
+  }
+
+  /** The `[GET_WS_RUNTIME]` answer for the apps mounted here alone, whatever this app's own routes. */
+  private mountedWsRuntime(seen: Set<unknown> = new Set()): WsRuntime | null | undefined {
+    if (seen.has(this)) return
+    seen.add(this)
+    let found: WsRuntime | null | undefined
+    for (const mount of this.fetchMounts) {
+      const runtime = mount.wsRuntime?.(seen)
+      if (runtime === undefined) continue
+      found = this.wsRuntime ?? runtime
+      if (found) return found
+    }
+    return found
+  }
+
+  /** Whether an app mounted here takes WebSocket upgrades. Worked out again only after a `ws()` or a
+   * `mount()` somewhere, so the upgrade check on a plain request costs one comparison. */
+  private mountsTakeUpgrades(): boolean {
+    if (this.wsMountsCheckedAt !== wsChanges) {
+      this.wsMountsLive = this.mountedWsRuntime() !== undefined
+      this.wsMountsCheckedAt = wsChanges
+    }
+    return this.wsMountsLive
+  }
+
   /**
    * Merge another server's routes into this one - the composition escape hatch for large apps.
    *
@@ -1943,6 +2418,19 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     other: Server<R2, Ctx2, HookOutput2>,
   ): Server<R & R2, Ctx, HookOutput> {
     this.assertConfigurable("merge()")
+    if (!(other instanceof Server)) {
+      // A server from another copy of this package reaches this copy's private request state through
+      // symbols it does not share, and would fail per request. The boot warning names the copies.
+      throw new TypeError("merge() requires a server() from this copy of @nifrajs/core")
+    }
+    if (this.routePrefix !== "") {
+      // The merged routes were compiled under their own paths; adopting them here would publish them
+      // OUTSIDE the prefix while looking like part of the group.
+      throw new RouteConfigError(
+        "INVALID_PATH",
+        "merge() inside a group cannot prefix compiled routes - merge on the parent",
+      )
+    }
     const source = other as unknown as Server<Registry, EmptyContext>
     if (source.wsRouteCount > 0) {
       throw new RouteConfigError(
@@ -1950,83 +2438,190 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
         "merge() does not carry WebSocket routes - register .ws() routes on the parent server",
       )
     }
+    this.adopt(source, undefined, 0)
+    return this as unknown as Server<R & R2, Ctx, HookOutput>
+  }
+
+  /**
+   * Declare routes under a static path prefix, with the prefix in the typed client, `routes()`,
+   * OpenAPI, capability events, and the effect ledger - the counterpart of Hono's `route()`,
+   * Elysia's `group()`, and Fastify's `register({ prefix })`.
+   *
+   *   app
+   *     .derive(session)
+   *     .group("/admin", (admin) =>
+   *       admin.beforeHandle(requireAdmin).get("/users", listUsers).get("/users/:id", getUser),
+   *     )
+   *     .get("/", home)          // not covered by requireAdmin
+   *
+   * The builder receives a scope that INHERITS this server's route chain as it stands at the call
+   * (`derive`/`decorate`/`authenticate`/`beforeHandle`/`afterHandle`/`onError`/`around`, assurance,
+   * capability interceptors, installed runtimes, applied plugins), exactly as a route declared here
+   * would. A plugin this server already applied is in effect for the group: the group's `use()` of
+   * that same instance does nothing, and its `use()` of another instance under the same name throws a
+   * `RouteConfigError` (`PLUGIN_RECONFIGURED`), because that instance could never replace the parent's.
+   * A plugin the group applies still shares the parent's copy of a dependency it `use()`s itself.
+   * What it adds stays in the group: its chain additions apply only to its own routes, and its
+   * request/response hooks (`onRequest`, `onResponse`, `responseHeaders`, `onResponseFinalized`, and
+   * middleware bundles that use them) run only for requests whose path is the prefix or below it.
+   * Per-route authorization belongs in `authenticate`/`beforeHandle`, which are compiled into each
+   * route; request hooks are path prefilters.
+   *
+   * The prefix is static text - `"/api"`, `"/api/v1"` - validated when declared: no params,
+   * wildcards, empty or dot segments, percent-escapes, or trailing slash. A group's `"/"` route
+   * serves the prefix itself. Groups nest (`"/api"` then `"/v1"` serves `/api/v1/...`).
+   *
+   * Fail closed: the builder must synchronously return the scope it was given; a collision with an
+   * existing route throws `RouteConfigError` and adds none of the group's routes; `.ws()`, mounts,
+   * MCP `.tool()`s, and `merge()` inside a group are refused (register them on the parent). Once the
+   * builder returns, the scope is closed - a leaked reference cannot add routes later.
+   */
+  group<const P extends string, R2 extends Registry, Ctx2, HookOutput2>(
+    prefix: P,
+    build: (group: Server<EmptyRegistry, Ctx, HookOutput>) => Server<R2, Ctx2, HookOutput2>,
+  ): Server<R & PrefixRegistry<P, R2>, Ctx, HookOutput> {
+    this.assertConfigurable("group()")
+    if (typeof prefix !== "string" || !GROUP_PREFIX.test(prefix)) {
+      throw new RouteConfigError(
+        "INVALID_PATH",
+        `group() prefix must be a static path like "/api/v1": ${JSON.stringify(prefix)}`,
+      )
+    }
+    const fullPrefix = this.routePrefix + prefix
+    const scope = new Server<Registry, EmptyContext>(this.options)
+    scope.routePrefix = fullPrefix
+    scope.inheritedStatics = { ...this.inheritedStatics, ...this.staticResponseHeaders?.record }
+    for (const key of GROUP_CHAIN) (scope[key] as unknown[]).push(...this[key])
+    for (const key of SERVER_RUNTIMES)
+      (scope as unknown as Record<string, unknown>)[key] = this[key]
+    Object.assign(scope.decorations, this.decorations)
+    // A plugin already applied here is already in effect for the group (its chain was copied above
+    // and its request hooks are app-wide), so re-applying it would run it twice per request. The
+    // group's own plugins are NOT copied back: they are scoped, and a parent `use()` of the same
+    // plugin must still apply it to the parent's routes. The response observer is the exception: it
+    // installs methods bound to the server it is applied to, so the scope must be free to install its
+    // own (re-applying it registers no hook, so nothing can run twice).
+    for (const [name, plugin] of this.appliedPlugins) {
+      if (name !== "nifra:response-observer") scope.appliedPlugins.set(name, plugin)
+    }
+    scope.inheritedPlugins = new Map(scope.appliedPlugins)
+    let built: unknown
+    try {
+      built = build(scope as never)
+      // Only `listen()` seals a server, so a scope sealed here was served on its own - without this
+      // server's request hooks - which a group must never be.
+      if (scope.sealed) built = undefined
+    } finally {
+      // Closed on every exit, including a throw: an async continuation or a leaked reference must
+      // not register routes that nothing will ever adopt.
+      scope.sealed = true
+    }
+    const label = `group(${JSON.stringify(fullPrefix)})`
+    if (built !== scope) {
+      throw new TypeError(`${label} builder must return its group synchronously`)
+    }
+    if (
+      scope.wsRouteCount > 0 ||
+      scope.fetchMounts.length > 0 ||
+      scope.catalog.entries().some((route) => route.descriptor.tool !== undefined)
+    ) {
+      throw new RouteConfigError(
+        "INVALID_PATH",
+        `${label} cannot hold ws(), mount, or MCP tool routes - add them to the parent`,
+      )
+    }
+    if (hookAuditRuntime && process.env.NODE_ENV !== "production")
+      sealHookAudit(scope, scope.catalog.size, this.logger)
+    this.adopt(scope, fullPrefix, this.globalAssurance.length)
+    return this as unknown as Server<R & PrefixRegistry<P, R2>, Ctx, HookOutput>
+  }
+
+  /**
+   * Take over another server's routes and hooks - the shared core of {@link merge} and {@link group}.
+   * `prefix` selects group semantics: hooks are scoped to requests under the prefix (response hooks
+   * included), and the source's global assurance past `inheritedGlobal` (what it copied from this
+   * server) is folded into its routes. Without a prefix, merge semantics: request hooks are scoped to
+   * the source's routes when it has any, response hooks are appended app-wide.
+   */
+  private adopt(
+    source: Server<Registry, EmptyContext>,
+    prefix: string | undefined,
+    inheritedGlobal: number,
+  ): void {
     const sourceRoutes = source.catalog.entries()
     // Hooks and global assurance stay LOCAL to a group that has routes; a route-less group is a
     // middleware bundle whose hooks can only mean app-wide intent, so it keeps the global append.
-    const scoped = sourceRoutes.length > 0
-    // A group's global assurance rides its (route-scoped) hooks: folded into each merged route's
-    // own evidence rather than the parent's global list, so `routes()` never claims the group's
+    // A prefix group is always local: its hooks mean "under this path", routes or not.
+    const scoped = prefix !== undefined || sourceRoutes.length > 0
+    const ownGlobal = source.globalAssurance.slice(inheritedGlobal)
+    // A group's global assurance rides its (scoped) hooks: folded into each adopted route's own
+    // evidence rather than the parent's global list, so `routes()` never claims the group's
     // enforcement for parent routes the group's hooks do not see.
     const foldedAssurance =
-      scoped && source.globalAssurance.length > 0
+      scoped && ownGlobal.length > 0
         ? (route: CatalogRoute): CatalogRoute => ({
             ...route,
-            assurance: [...route.assurance, ...source.globalAssurance],
+            assurance: [...route.assurance, ...ownGlobal],
           })
         : (route: CatalogRoute): CatalogRoute => route
     this.catalog.addBatch(
       sourceRoutes.map((route) => this.bindFusedRuntime(foldedAssurance(route))),
     )
     // Resolved idempotency/ledger route entries carry their own store/sink configuration, while the
-    // runtime object supplies the generic execution machinery. Preserve a group's installed runtime
-    // when the parent has none so merging cannot silently disable a safety lane. If the parent already
-    // has a runtime, either implementation can execute every resolved entry because route-specific
-    // options were pinned during registration.
-    this.responseContractRuntime ??= source.responseContractRuntime
-    this.idempotencyRuntime ??= source.idempotencyRuntime
-    this.effectLedgerRuntime ??= source.effectLedgerRuntime
-    this.mcpRuntime ??= source.mcpRuntime
-    this.nodeOutcomeRuntime ??= source.nodeOutcomeRuntime
-    this.sseRuntime ??= source.sseRuntime
-    this.wsRuntime ??= source.wsRuntime
-    if (scoped && source.onRequestHooks.length > 0) {
-      // Snapshot the group's routes into a dedicated matcher: the guard must reflect what was
-      // MERGED, not whatever the group's own catalog grows into afterwards. One probe against it
-      // gates each group hook to requests the group would serve; everything else passes untouched.
-      const scope = new RouteCatalog()
-      scope.addBatch(sourceRoutes)
-      this.onRequestHooks.push(
-        ...source.onRequestHooks.map(
-          (hook): RawOnRequest =>
-            (req, platform) =>
-              scope.find(req.method, pathnameOf(req.url)).found ? hook(req, platform) : undefined,
-        ),
-      )
-      // An `undefined` slot marks an unpaired hook (position-aligned with `onRequestHooks`) and
-      // must stay `undefined` - wrapping it would fabricate a Node twin that never existed.
-      this.onNodeRequestHooks.push(
-        ...source.onNodeRequestHooks.map((hook): NodeRequestHook | undefined =>
-          hook === undefined
-            ? undefined
-            : (req, platform) =>
-                scope.find(req.method, pathnameOf(req.url)).found ? hook(req, platform) : undefined,
-        ),
-      )
-    } else {
-      this.onRequestHooks.push(...source.onRequestHooks)
-      this.onNodeRequestHooks.push(...source.onNodeRequestHooks)
-    }
+    // runtime object supplies the generic execution machinery. If the parent already has a runtime,
+    // either implementation can execute every resolved entry because route-specific options were
+    // pinned during registration.
+    const runtimes = this as unknown as Record<string, unknown>
+    for (const key of SERVER_RUNTIMES) runtimes[key] ??= source[key]
+    // Which requests a scoped hook sees: under the prefix for a group; for a merged server with
+    // routes, a snapshot of exactly the routes MERGED (not whatever its own catalog grows into later).
+    const inScope =
+      prefix !== undefined
+        ? underPrefix(prefix)
+        : scoped && source.onRequestHooks.length > 0
+          ? servedBy(sourceRoutes)
+          : undefined
+    this.onRequestHooks.push(...scopeHooks(source.onRequestHooks, inScope, 0))
+    this.onNodeRequestHooks.push(...scopeHooks(source.onNodeRequestHooks, inScope, 0))
     this.nodeRequestHooksComplete &&= source.nodeRequestHooksComplete
-    // The group's static declarations came before its own response hooks, so they are folded in
-    // first - and fold themselves into a hook here if this server already has one (same ordering
-    // rule as a direct `responseHeaders()` call).
-    if (source.staticResponseHeaders !== undefined) {
-      this.addStaticResponseHeaders({ ...source.staticResponseHeaders.record })
-    }
-    this.onResponseHooks.push(...source.onResponseHooks)
-    this.onNodeResponseHooks.push(...source.onNodeResponseHooks)
+    this.bunNativeRequestHooksSafe &&= source.bunNativeRequestHooksSafe
+    // A merged server's response hooks are app-wide; a group's run only under its prefix.
+    const responseScope = prefix === undefined ? undefined : inScope
+    const statics = source.staticResponseHeaders
+    if (statics !== undefined) {
+      if (responseScope === undefined) {
+        // The group's static declarations came before its own response hooks, so they are folded in
+        // first - and fold themselves into a hook here if this server already has one (same ordering
+        // rule as a direct `responseHeaders()` call).
+        this.addStaticResponseHeaders({ ...statics.record })
+      } else {
+        // The static tier is folded into EVERY response this server builds, so a group's static
+        // headers cannot join it. A hook ahead of the group's own (the sealed scope is discarded
+        // after adoption) keeps their meaning - defaults a value already on the response wins over.
+        source.onResponseHooks.unshift((response) => applyStaticResponseHeaders(response, statics))
+        source.onNodeResponseHooks.unshift(undefined)
+        source.nodeResponseHooksComplete = false
+      }
+    }
+    this.onResponseHooks.push(...scopeHooks(source.onResponseHooks, responseScope, 1, true))
+    this.onNodeResponseHooks.push(...scopeHooks(source.onNodeResponseHooks, responseScope, 1))
+    this.onResponseFinalizedHooks.push(
+      ...scopeHooks(source.onResponseFinalizedHooks, responseScope, 1),
+    )
     this.nodeResponseHooksComplete &&= source.nodeResponseHooksComplete
+    this.bunNativeResponseHeadersOnly &&= source.bunNativeResponseHeadersOnly
     this.hasRawNodeResponseHook ||= source.hasRawNodeResponseHook
-    this.onResponseFinalizedHooks.push(...source.onResponseFinalizedHooks)
     if (source.responseBodyTag !== undefined) {
       const owner = this.enableResponseBodyTagging()
       this.responseBodyOwners.add(source.responseBodyTag)
       source.responseBodyOwners.add(owner)
     }
-    if (!scoped) this.globalAssurance.push(...source.globalAssurance)
+    if (!scoped) this.globalAssurance.push(...ownGlobal)
+    // Cleanup the source registered (a pool, a queue consumer) belongs to the server that now runs
+    // its routes; dropping it would leak the resource past `stop()`.
+    this.stopHooks.push(...source.stopHooks)
     this.mcpResourceList.push(...source.mcpResourceList)
     this.mcpPromptList.push(...source.mcpPromptList)
-    return this as unknown as Server<R & R2, Ctx, HookOutput>
   }
 
   /** A fused renderer closes over runtime services to keep its seven-argument JSC fast path. Merging
@@ -2039,9 +2634,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     const lane = entry.execution.fusedLane
     // Type-erase the lane so each `===` branch sees the full union, not the narrowed remainder.
     const laneName: string | undefined = lane
-    // Body+lifecycle routes have a fused Web renderer, but no body-only Node renderer: the latter
-    // would bypass derive/before/after because the Node-direct dispatcher prefers `fusedBody` over
-    // the generic execution plan. Only the original body-only lane may populate this slot.
+    // Body+lifecycle routes have a fused Web renderer, and - unlike before - a generic fused
+    // runner too: it preserves derive/before/after (it IS the lifecycle, single-framed), so the
+    // Node-direct dispatcher's preference for the generic slot over the execution plan stays
+    // semantics-preserving. Only the original body-only lane may feed the Web wrapper below.
+    const derive = entry.derives[0]
+    const before = entry.beforeHandle[0]
+    const after = entry.afterHandle[0]
     const fusedBody =
       laneName === "body"
         ? this.buildFusedBodyRunner(
@@ -2050,10 +2649,49 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
             entry.hasDecorations ? entry.decorations : undefined,
             entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
           )
-        : undefined
-    const derive = entry.derives[0]
-    const before = entry.beforeHandle[0]
-    const after = entry.afterHandle[0]
+        : laneName === "body-derive-before" && derive !== undefined && before !== undefined
+          ? this.buildFusedBodyDeriveBeforeAfterRunner(
+              entry.handler,
+              derive,
+              before,
+              undefined,
+              entry.schema?.body as StandardSchemaV1,
+              entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+            )
+          : laneName === "body-derive-before-after" &&
+              derive !== undefined &&
+              before !== undefined &&
+              after !== undefined
+            ? this.buildFusedBodyDeriveBeforeAfterRunner(
+                entry.handler,
+                derive,
+                before,
+                after,
+                entry.schema?.body as StandardSchemaV1,
+                entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+              )
+            : laneName === "derive-before" && derive !== undefined && before !== undefined
+              ? this.buildFusedDeriveBeforeRunner(
+                  entry.handler,
+                  derive,
+                  before,
+                  undefined,
+                  entry.schema?.query,
+                  entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+                )
+              : laneName === "derive-before-after" &&
+                  derive !== undefined &&
+                  before !== undefined &&
+                  after !== undefined
+                ? this.buildFusedDeriveBeforeRunner(
+                    entry.handler,
+                    derive,
+                    before,
+                    after,
+                    entry.schema?.query,
+                    entry.bodyLimit ?? UNLIMITED_BODY_BYTES,
+                  )
+                : undefined
     const fusedWeb =
       laneName === "body"
         ? this.buildFusedBodyWeb(fusedBody as FusedBodyRunner)
@@ -2143,6 +2781,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    * Bun/Node/Deno omit it (then `c.env` is `undefined` and `c.waitUntil` runs fire-and-forget).
    */
   fetch(req: Request, platform?: Platform<EnvOf<Ctx>>): MaybePromise<Response> {
+    // Deno's `Request.url` is the target as sent; Bun, workerd and every `new Request()` parse it.
+    // Route what the parsed URL says, so `/users/../admin` is `/admin` on every runtime.
+    if (rawRequestTargets && hasDotSegment(req.url)) req = withResolvedTarget(req)
     // An edge deployment whose only ingress is this method declares its requests runtime-framed at
     // construction; everything else stays on the delivered-byte check (see `trustBodyFraming`).
     if (this.trustBodyFraming) markTrustedBodyFraming(req)
@@ -2198,19 +2839,25 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     source: RequestSource,
     entry: RouteEntry,
     params: Record<string, string>,
+    platform: Platform,
   ): MaybePromise<Response> {
-    if (this.capacityGate === undefined) return this.fetchMatchedInner(source, entry, params)
-    return this.admitGated(requestOf(source), () => this.fetchMatchedInner(source, entry, params))
+    if (this.capacityGate === undefined) {
+      return this.fetchMatchedInner(source, entry, params, platform)
+    }
+    return this.admitGated(requestOf(source), () =>
+      this.fetchMatchedInner(source, entry, params, platform),
+    )
   }
 
   private fetchMatchedInner(
     source: RequestSource,
     entry: RouteEntry,
     params: Record<string, string>,
+    platform: Platform,
   ): MaybePromise<Response> {
     const outcome = this.runMatched(
       source,
-      undefined,
+      platform,
       entry,
       params,
       undefined,
@@ -2289,18 +2936,30 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
 
     const parts = source.urlParts ?? urlPartsOf(source.url)
     const match = this.catalog.find(source.method, parts.pathname)
-    if (match.found) return undefined
+    if (match.found || !isRoutableMethod(source.method)) return undefined
+
+    // The mount the ordinary path reaches first: every `mount()` runs before any `mountFetch()`,
+    // whatever their prefix lengths. A 404 fallthrough chain stays on the ordinary path.
+    const mount =
+      this.firstMountUnder(parts.pathname, true) ?? this.firstMountUnder(parts.pathname, false)
+    if (mount === undefined || mount.fallbackOn404) return undefined
+    const candidate = (mount.handler as unknown as Record<symbol, unknown>)[NODE_NATIVE_MOUNT]
+    return typeof candidate === "function"
+      ? {
+          handler: candidate as NativeMountHandler,
+          path: mount.path,
+          stripPrefix: mount.stripPrefix,
+        }
+      : undefined
+  }
 
+  private firstMountUnder(
+    pathname: string,
+    beforeRoutes: boolean,
+  ): FetchMount<EnvOf<Ctx>> | undefined {
     for (const mount of this.fetchMounts) {
-      if (!underMountPrefix(parts.pathname, mount.path)) continue
-      const candidate = (mount.handler as unknown as Record<symbol, unknown>)[NODE_NATIVE_MOUNT]
-      return typeof candidate === "function"
-        ? {
-            handler: candidate as NativeMountHandler,
-            path: mount.path,
-            stripPrefix: mount.stripPrefix,
-          }
-        : undefined
+      if (mount.beforeRoutes === beforeRoutes && underMountPrefix(pathname, mount.path))
+        return mount
     }
     return undefined
   }
@@ -2468,6 +3127,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     const context: NodeResponseContext = {
       status: outcome.status,
       headers,
+      headersAreLowercase: !this.hasRawNodeResponseHook && lowercaseKeys,
       cookies: outcome.kind === "json" ? outcome.cookies : undefined,
       body: outcome.body,
     }
@@ -2609,8 +3269,17 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     req: Request,
     platform?: Platform<EnvOf<Ctx>>,
   ): MaybePromise<WebSocketUpgradeOutcome> {
-    if (this.wsRouteCount === 0) return WS_PASS
+    // Before any header is read: Deno only materializes a request's headers when asked, and that
+    // costs a plain request measurably.
+    if (this.wsRouteCount === 0 && !this.mountsTakeUpgrades()) return WS_PASS
     if (req.headers.get("upgrade")?.toLowerCase() !== "websocket") return WS_PASS
+    // A WebSocket handshake is a GET (RFC 6455 section 4.1). Any other method with an Upgrade header
+    // is an ordinary request: its HTTP route answers it, and normal routing refuses an unknown token.
+    if (req.method !== "GET") return WS_PASS
+    // The handshake routes the path `fetch` would: dot segments resolved (see `fetch`).
+    if (rawRequestTargets && hasDotSegment(req.url)) req = withResolvedTarget(req)
+    // The handshake's caller is the one `fetch` derives: hooks and `upgrade()` see the trusted IP.
+    platform = this.trustedPlatform(req, platform)
 
     const timeoutMs =
       this.wsUpgradeTimeoutMs === 0
@@ -2708,7 +3377,61 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       }
     }
 
-    if (this.onRequestHooks.length === 0) return resolveMatched(req)
+    const resolveMounted = (request: Request): MaybePromise<WebSocketUpgradeOutcome> => {
+      // Native pub/sub was chosen because no mounted app took upgrades when `listen()` ran. One that
+      // gains a WebSocket route later stays out: its sockets would share this server's Bun topics.
+      if (this.nativePublish !== undefined) return WS_PASS
+      const pathname = urlPartsOf(request.url).pathname
+      const dispatch = (start: number): MaybePromise<WebSocketUpgradeOutcome> => {
+        let selected: FetchMount<EnvOf<Ctx>> | undefined
+        let selectedIndex = start
+        for (let i = start; i < this.fetchMounts.length; i++) {
+          const candidate = this.fetchMounts[i]!
+          if (
+            candidate.resolveWebSocketUpgrade !== undefined &&
+            underMountPrefix(pathname, candidate.path)
+          ) {
+            selected = candidate
+            selectedIndex = i
+            break
+          }
+        }
+        if (selected === undefined) return WS_PASS
+        const childRequest = selected.stripPrefix
+          ? stripMountPrefix(request, selected.path)
+          : request
+        let child: MaybePromise<WebSocketUpgradeOutcome>
+        try {
+          child = selected.resolveWebSocketUpgrade!(childRequest, platform)
+        } catch {
+          return { kind: "reject", response: jsonError(500, "internal_error") }
+        }
+        const settle = (outcome: WebSocketUpgradeOutcome): MaybePromise<WebSocketUpgradeOutcome> =>
+          outcome.kind === "pass" ||
+          (outcome.kind === "reject" && outcome.response.status === 404 && selected!.fallbackOn404)
+            ? dispatch(selectedIndex + 1)
+            : outcome
+        return child instanceof Promise ? child.then(settle) : settle(child)
+      }
+      return dispatch(0)
+    }
+
+    const resolveRoutes = (request: Request): MaybePromise<WebSocketUpgradeOutcome> => {
+      const local = resolveMatched(request)
+      if (local instanceof Promise) {
+        return local.then((outcome) =>
+          outcome.kind === "pass" ? resolveMounted(request) : outcome,
+        )
+      }
+      return local.kind === "pass" ? resolveMounted(request) : local
+    }
+
+    const resolveWithDeadline = (request: Request): MaybePromise<WebSocketUpgradeOutcome> => {
+      const outcome = resolveRoutes(request)
+      return outcome instanceof Promise ? bounded(outcome, onTimeout) : outcome
+    }
+
+    if (this.onRequestHooks.length === 0) return resolveWithDeadline(req)
     let hooked: MaybePromise<Request | Response>
     try {
       hooked = this.runWebSocketRequestHooks(req, platform)
@@ -2718,13 +3441,13 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     if (!(hooked instanceof Promise)) {
       return hooked instanceof Response
         ? { kind: "reject", response: hooked }
-        : resolveMatched(hooked)
+        : resolveWithDeadline(hooked)
     }
     const pending = hooked.then(
       (result) =>
         result instanceof Response
           ? { kind: "reject" as const, response: result }
-          : resolveMatched(result),
+          : resolveWithDeadline(result),
       () => ({ kind: "reject" as const, response: jsonError(500, "internal_error") }),
     )
     return bounded(
@@ -2744,7 +3467,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       if (o.kind === "pass")
         return this.fetch(req, bunPeerPlatform(server, req) as Platform<EnvOf<Ctx>>)
       if (o.kind === "reject") return o.response
-      return server.upgrade(req, { data: { handler: o.handler, data: o.data } })
+      return server.upgrade(req, {
+        data: { handler: o.handler, data: o.data, pubsub: o.pubsub },
+      })
         ? undefined
         : jsonError(426, "upgrade_required")
     }
@@ -2766,15 +3491,27 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    * whose `clientIp` is the derived caller. Only called when a trust declaration is configured. */
   private deriveClientIp(
     source: RequestSource,
-    platform: Platform | undefined,
-  ): Platform | undefined {
+    platform: Platform<EnvOf<Ctx>> | undefined,
+  ): Platform<EnvOf<Ctx>> | undefined {
     const derived = resolveClientIp(platform?.clientIp, requestOf(source), this.clientIpTrust)
     return { ...platform, clientIp: derived }
   }
 
+  private trustedPlatform(
+    source: RequestSource,
+    platform: Platform<EnvOf<Ctx>> | undefined,
+  ): Platform<EnvOf<Ctx>> | undefined {
+    return this.clientIpTrust === undefined ||
+      (platform as { [NIFRA_PLATFORM_CLIENT_IP_DERIVED]?: unknown } | undefined)?.[
+        NIFRA_PLATFORM_CLIENT_IP_DERIVED
+      ] === true
+      ? platform
+      : this.deriveClientIp(source, platform)
+  }
+
   private dispatch<T>(
     source: RequestSource,
-    platform: Platform | undefined,
+    platform: Platform<EnvOf<Ctx>> | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
@@ -2785,11 +3522,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     // Resolve the trust declaration into the platform's `clientIp` ONCE, here at the shared funnel, so
     // `c.clientIp` (and every hook/derive downstream) sees the derived caller. No config ⇒ the raw
     // socket peer the adapter supplied passes through untouched (a one-property no-op on the hot path).
-    const resolved =
-      this.clientIpTrust === undefined ? platform : this.deriveClientIp(source, platform)
+    // A platform an enclosing nifra server already resolved (an in-process call from an SSR loader)
+    // keeps its `clientIp`: the synthesized request carries none of the visitor's forwarding headers.
+    const resolved = this.trustedPlatform(source, platform)
     // onRequest hooks may be async, so a hooked app takes the async path; with no hooks (the common
     // case) routing stays synchronous, letting a bare route resolve with no lifecycle promise at all.
-    if (this.onRequestHooks.length === 0) {
+    // A token no route can be registered under skips the hooks as well: it cannot match, so routing
+    // answers it 404 or 405 and no hook reads a method string it would misjudge.
+    if (this.onRequestHooks.length === 0 || !isRoutableMethod(source.method)) {
       return this.routeAndRun(source, resolved, finalize, wrapResponse, onTimeout, webFast)
     }
     if (!webFast && this.canUseNodeRequestHooks()) {
@@ -2802,7 +3542,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    * Web `Request`; arbitrary request rewrites and full Web hooks use {@link runWithOnRequest}. */
   private runWithNodeRequest<T>(
     source: RequestSource,
-    platform: Platform | undefined,
+    platform: Platform<EnvOf<Ctx>> | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
@@ -2836,7 +3576,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     nextIndex: number,
     request: NodeRequestContext,
     source: RequestSource,
-    platform: Platform | undefined,
+    platform: Platform<EnvOf<Ctx>> | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
@@ -2864,7 +3604,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    */
   private runWithOnRequest<T>(
     source: RequestSource,
-    platform: Platform | undefined,
+    platform: Platform<EnvOf<Ctx>> | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
@@ -2878,7 +3618,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     if (source !== originalRequest) this.responseSources.set(source as object, originalRequest)
     let current: RequestSource = source
     for (let i = 0; i < hooks.length; i++) {
-      const outcome = (hooks[i] as RawOnRequest)(requestOf(current), platform)
+      const seen = requestOf(current)
+      const outcome = (hooks[i] as RawOnRequest)(seen, platform)
       if (outcome instanceof Promise) {
         return outcome.then((early) =>
           this.continueOnRequest(
@@ -2895,6 +3636,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
         )
       }
       if (outcome instanceof Request) {
+        if (outcome !== seen) recordRequestReplacement(outcome, seen)
         current = outcome
         if (outcome !== originalRequest) this.responseRequests.set(originalRequest, outcome)
         continue
@@ -2911,24 +3653,27 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     nextIndex: number,
     originalRequest: Request,
     sourceAtAwait: RequestSource,
-    platform: Platform | undefined,
+    platform: Platform<EnvOf<Ctx>> | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
     webFast: boolean,
   ): Promise<T> {
     let current = sourceAtAwait
+    let seen = requestOf(sourceAtAwait)
     let early = first
     let index = nextIndex
     for (;;) {
       if (early instanceof Request) {
+        if (early !== seen) recordRequestReplacement(early, seen)
         current = early
         if (early !== originalRequest) this.responseRequests.set(originalRequest, early)
       } else if (early !== undefined) {
         return wrapResponse(early)
       }
       if (index >= this.onRequestHooks.length) break
-      const outcome = (this.onRequestHooks[index] as RawOnRequest)(requestOf(current), platform)
+      seen = requestOf(current)
+      const outcome = (this.onRequestHooks[index] as RawOnRequest)(seen, platform)
       early = outcome instanceof Promise ? await outcome : outcome
       index++
     }
@@ -3005,7 +3750,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    */
   private routeAndRun<T>(
     source: RequestSource,
-    platform: Platform | undefined,
+    platform: Platform<EnvOf<Ctx>> | undefined,
     finalize: (result: unknown, set: CtxSet) => T,
     wrapResponse: (response: Response | ResponseResult) => T,
     onTimeout: () => T,
@@ -3049,9 +3794,21 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
         search = searchStart === -1 ? "" : rawUrl.slice(searchStart, searchEnd)
       }
     }
+    // Explicit composed mounts run before the parent's route table. This is what lets an SSR shell
+    // mount an API at `/api` without its catch-all page route swallowing the request. Legacy
+    // `mountFetch()` stays behind typed routes and is checked in the existing branch below.
+    if (this.preRouteMountCount > 0) {
+      const mounted = this.fetchMount(pathname, source, platform, true)
+      if (mounted !== undefined) {
+        return mounted instanceof Promise
+          ? mounted.then((response) => wrapResponse(response))
+          : wrapResponse(mounted)
+      }
+    }
+
     const match = this.catalog.find(source.method, pathname)
     if (!match.found) {
-      const mounted = this.fetchMount(pathname, source, platform)
+      const mounted = this.fetchMount(pathname, source, platform, false)
       if (mounted !== undefined) {
         return mounted instanceof Promise
           ? mounted.then((response) => wrapResponse(response))
@@ -3064,7 +3821,10 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
           plainError(405, "method_not_allowed", { allow: match.allowed.join(", ") }),
         )
       }
-      return wrapResponse(plainError(404, "not_found"))
+      const lane = this.notFoundLane
+      return lane === undefined
+        ? wrapResponse(plainError(404, "not_found"))
+        : lane(this, source, pathname, platform, wrapResponse, onTimeout)
     }
 
     // Inspect only captured values for escapes. Scanning the full pathname repeated work the router
@@ -3090,17 +3850,48 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   private fetchMount(
     pathname: string,
     source: RequestSource,
-    platform: Platform | undefined,
+    platform: Platform<EnvOf<Ctx>> | undefined,
+    beforeRoutes: boolean,
   ): MaybePromise<Response> | undefined {
-    for (const mount of this.fetchMounts) {
-      if (!underMountPrefix(pathname, mount.path)) continue
-      const request = requestOf(source)
-      return mount.handler(
-        mount.stripPrefix ? stripMountPrefix(request, mount.path) : request,
-        platform,
-      )
+    const request = requestOf(source)
+    let first = -1
+    for (let i = 0; i < this.fetchMounts.length; i++) {
+      const mount = this.fetchMounts[i]!
+      if (mount.beforeRoutes !== beforeRoutes || !underMountPrefix(pathname, mount.path)) continue
+      first = i
+      break
     }
-    return undefined
+    // A mounted handler is arbitrary code that may read the method loosely, so it is only handed a
+    // token a route could be registered under; anything else is left to the route table to refuse.
+    if (first === -1 || !isRoutableMethod(source.method)) return undefined
+
+    // A request body is a one-shot stream. Only methods whose request semantics are replayable are
+    // eligible for 404 fallthrough; this intentionally refuses POST/PUT/PATCH even when the body is
+    // empty because an adapter may expose a delayed stream or a protocol-specific side effect.
+    const replayable =
+      source.method === "GET" || source.method === "HEAD" || source.method === "OPTIONS"
+    const dispatch = (index: number, fallback?: Response): MaybePromise<Response> => {
+      let mount: FetchMount<EnvOf<Ctx>> | undefined
+      for (let i = index; i < this.fetchMounts.length; i++) {
+        const candidate = this.fetchMounts[i]!
+        if (candidate.beforeRoutes === beforeRoutes && underMountPrefix(pathname, candidate.path)) {
+          mount = candidate
+          index = i
+          break
+        }
+      }
+      if (mount === undefined) return fallback ?? jsonError(404, "not_found")
+      const childRequest = mount.stripPrefix ? stripMountPrefix(request, mount.path) : request
+      const outcome = mount.handler(childRequest, platform)
+      if (!replayable || !mount.fallbackOn404) return outcome
+      if (outcome instanceof Promise) {
+        return outcome.then((response) =>
+          response.status === 404 ? dispatch(index + 1, response) : response,
+        )
+      }
+      return outcome.status === 404 ? dispatch(index + 1, outcome) : outcome
+    }
+    return dispatch(first)
   }
 
   /** Run a route that has already been matched by the runtime or Nifra's portable router. */
@@ -3124,8 +3915,12 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     // handler can reach `c.req`; that lane already enforces `entry.bodyLimit`. Installing the full
     // direct-reader cap on `c.req` here would allocate bound readers, closures, and a stream wrapper
     // for a body that is already consumed. Keep the lazy transport cap for raw-body routes, where a
-    // user read is the only framework-owned body boundary.
-    if (entry.bodyLimit !== undefined && entry.schema?.body === undefined) {
+    // user read is the only framework-owned body boundary, and for the auth-first lane, whose
+    // derive and beforeHandle hooks reach `c.req` before the body is read.
+    if (
+      entry.bodyLimit !== undefined &&
+      (entry.schema?.body === undefined || entry.program.authBeforeValidation)
+    ) {
       const method = source.method
       if (method !== "GET" && method !== "HEAD") markTransportCap(source, entry.bodyLimit)
     }
@@ -3639,6 +4434,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
         finish,
         wrapResponse,
         (err) => logError(err, ctx, finalize, wrapResponse),
+        bodySchema,
       )
     }
   }
@@ -4208,24 +5004,455 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
         onParsed,
         (response) => this.wrapWebResponse(response),
         (err) => Promise.resolve(logError(err, ctx)),
+        bodySchema,
       ) as MaybePromise<Response>
     }
   }
 
-  private bareError<T>(
-    err: unknown,
-    ctx: RawContext,
-    finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
-    wrapResponse: (response: Response | ResponseResult) => T,
-  ): T {
-    // The thrown-value contract lives in `bare-error-lane.ts`, one source of truth for both this
-    // lane and the fused body runner. `responseSet` and the logger are injected because they reach
-    // into class state; the closure is allocated only on the throw path, never on the hot lane.
+  /**
+   * Generic (finalize/wrapResponse-parameterized) fused runner for the derive-before(-after) lane:
+   * the Node-direct counterpart of `buildFusedDeriveBefore` / `buildFusedDeriveBeforeAfter`.
+   *
+   * The Web fused builders above return a `Response`, so the Node dispatcher (`webFast === false`)
+   * cannot use them and a derive+before route falls back to the generic route program there - two
+   * staged loops, per-stage dispatch, and the async-continuation machinery - while Bun rides the
+   * single closure. That asymmetry is the realistic-route Node deficit against Fastify: this runner
+   * closes it by running validate → derive → before → handler → (after) in one frame and finalizing
+   * through the caller's own `finalize` (the Node outcome on the direct lane, `toResponse` on Web),
+   * so the same registration feeds both runtimes with no per-lane copy of the lifecycle to drift.
+   *
+   * Semantics mirror the generic program stage-for-stage for the shapes this lane admits (exactly
+   * one derive, one beforeHandle, zero-or-one afterHandle, no onError/around/decorations/contracts/
+   * recovery hooks - enforced by `selectRouteLanes`): thrown `Response`/`status(...)` are control
+   * flow through `wrapResponse`/`finalize`, anything else logs + 500s via the shared `bareError`
+   * lane (identical to `handleLifecycleError` with no `onError` hooks), and a terminal `finalize`
+   * throw (e.g. an unstringifiable handler return on the Node lane) is caught exactly as
+   * `finishLifecycleContract` catches it. Step functions close over registration state only and take
+   * the request state as arguments, so the hot path allocates no per-request closures.
+   */
+  private buildFusedDeriveBeforeRunner(
+    handler: InternalHandler,
+    derive: RawDerive,
+    before: RawBeforeHandle,
+    after: RawAfterHandle | undefined,
+    querySchema: StandardSchemaV1 | undefined,
+    maxBodyBytes: number,
+  ): FusedBodyRunner {
+    const logError = <T>(
+      err: unknown,
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): T => this.bareError(err, ctx, finalize, wrapResponse)
+
+    const runFinish = <T>(
+      result: unknown,
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      if (after === undefined) {
+        try {
+          return finalize(result, responseSet(ctx), ctx)
+        } catch (err) {
+          return logError(err, ctx, finalize, wrapResponse)
+        }
+      }
+      let transformed: unknown
+      try {
+        transformed = after(result, ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+      if (transformed instanceof Promise) {
+        return transformed.then(
+          (value) => {
+            try {
+              return finalize(value, responseSet(ctx), ctx)
+            } catch (err) {
+              return logError(err, ctx, finalize, wrapResponse)
+            }
+          },
+          (err) => logError(err, ctx, finalize, wrapResponse),
+        )
+      }
+      try {
+        return finalize(transformed, responseSet(ctx), ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+    }
+
+    const finalizeEarly = <T>(
+      result: unknown,
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): T => {
+      try {
+        return finalize(result, responseSet(ctx), ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+    }
+
+    const runHandler = <T>(
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      let result: unknown
+      try {
+        result = handler(ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+      if (result instanceof Promise) {
+        return result.then(
+          (value) => runFinish(value, ctx, finalize, wrapResponse),
+          (err) => logError(err, ctx, finalize, wrapResponse),
+        )
+      }
+      return runFinish(result, ctx, finalize, wrapResponse)
+    }
+
+    const runBefore = <T>(
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      let early: unknown
+      try {
+        early = before(ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+      if (early instanceof Promise) {
+        return early.then(
+          (settled) =>
+            settled === undefined
+              ? runHandler(ctx, finalize, wrapResponse)
+              : finalizeEarly(settled, ctx, finalize, wrapResponse),
+          (err) => logError(err, ctx, finalize, wrapResponse),
+        )
+      }
+      if (early === undefined) return runHandler(ctx, finalize, wrapResponse)
+      return finalizeEarly(early, ctx, finalize, wrapResponse)
+    }
+
+    const runDerive = <T>(
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      let derived: unknown
+      try {
+        derived = derive(ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+      if (derived instanceof Promise) {
+        return derived.then(
+          (settled) => {
+            if (isResponseResult(settled) || settled instanceof Response) {
+              return finalizeEarly(settled, ctx, finalize, wrapResponse)
+            }
+            Object.assign(ctx, settled as object)
+            return runBefore(ctx, finalize, wrapResponse)
+          },
+          (err) => logError(err, ctx, finalize, wrapResponse),
+        )
+      }
+      if (isResponseResult(derived) || derived instanceof Response) {
+        return finalizeEarly(derived, ctx, finalize, wrapResponse)
+      }
+      Object.assign(ctx, derived as object)
+      return runBefore(ctx, finalize, wrapResponse)
+    }
+
+    const runValidated = <T>(
+      validation: StandardResult<unknown> | Promise<StandardResult<unknown>>,
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      if (validation instanceof Promise) {
+        return validation.then(
+          (settled) => {
+            if (settled.issues !== undefined)
+              return wrapResponse(plainValidationError(settled.issues))
+            ctx.query = settled.value
+            return runDerive(ctx, finalize, wrapResponse)
+          },
+          (err) => logError(err, ctx, finalize, wrapResponse),
+        )
+      }
+      if (validation.issues !== undefined)
+        return wrapResponse(plainValidationError(validation.issues))
+      ctx.query = validation.value
+      return runDerive(ctx, finalize, wrapResponse)
+    }
+
+    return <T>(
+      source: RequestSource,
+      params: Record<string, string>,
+      search: string | undefined,
+      signal: AbortSignal,
+      budget: RequestBudget,
+      platform: Platform | undefined,
+      nativeContext: boolean,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      const ctx = nativeContext
+        ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+        : new RequestContext(
+            source,
+            params,
+            search,
+            signal,
+            budget,
+            platform,
+            maxBodyBytes,
+            this.protoPoisoning,
+          )
+      if (querySchema === undefined) return runDerive(ctx, finalize, wrapResponse)
+      let validation: StandardResult<unknown> | Promise<StandardResult<unknown>>
+      try {
+        validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]))
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+      return runValidated(validation, ctx, finalize, wrapResponse)
+    }
+  }
+
+  /**
+   * Generic fused runner for the body+derive-before(-after) lane: the Node-direct counterpart of
+   * `buildFusedBodyDeriveBeforeAfter`. Same contract as `buildFusedDeriveBeforeRunner` above - one
+   * frame running parse → validate → derive → before → handler → (after) through the caller's own
+   * `finalize` - with the body read ahead of validation, exactly as the generic program orders its
+   * body stage before the derive/before stages. `readBodyFramed` keeps the shared bounded-read,
+   * content-type, and prototype-poisoning contracts; the 415/400 renders take `wrapResponse`
+   * directly, which is what the generic lane's wrap-after-identity amounts to.
+   */
+  private buildFusedBodyDeriveBeforeAfterRunner(
+    handler: InternalHandler,
+    derive: RawDerive,
+    before: RawBeforeHandle,
+    after: RawAfterHandle | undefined,
+    bodySchema: StandardSchemaV1,
+    maxBodyBytes: number,
+  ): FusedBodyRunner {
+    const logError = <T>(
+      err: unknown,
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): T => this.bareError(err, ctx, finalize, wrapResponse)
+
+    const runFinish = <T>(
+      result: unknown,
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      if (after === undefined) {
+        try {
+          return finalize(result, responseSet(ctx), ctx)
+        } catch (err) {
+          return logError(err, ctx, finalize, wrapResponse)
+        }
+      }
+      let transformed: unknown
+      try {
+        transformed = after(result, ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+      if (transformed instanceof Promise) {
+        return transformed.then(
+          (value) => {
+            try {
+              return finalize(value, responseSet(ctx), ctx)
+            } catch (err) {
+              return logError(err, ctx, finalize, wrapResponse)
+            }
+          },
+          (err) => logError(err, ctx, finalize, wrapResponse),
+        )
+      }
+      try {
+        return finalize(transformed, responseSet(ctx), ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+    }
+
+    const finalizeEarly = <T>(
+      result: unknown,
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): T => {
+      try {
+        return finalize(result, responseSet(ctx), ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+    }
+
+    const runHandler = <T>(
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      let result: unknown
+      try {
+        result = handler(ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+      if (result instanceof Promise) {
+        return result.then(
+          (value) => runFinish(value, ctx, finalize, wrapResponse),
+          (err) => logError(err, ctx, finalize, wrapResponse),
+        )
+      }
+      return runFinish(result, ctx, finalize, wrapResponse)
+    }
+
+    const runBefore = <T>(
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      let early: unknown
+      try {
+        early = before(ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+      if (early instanceof Promise) {
+        return early.then(
+          (settled) =>
+            settled === undefined
+              ? runHandler(ctx, finalize, wrapResponse)
+              : finalizeEarly(settled, ctx, finalize, wrapResponse),
+          (err) => logError(err, ctx, finalize, wrapResponse),
+        )
+      }
+      if (early === undefined) return runHandler(ctx, finalize, wrapResponse)
+      return finalizeEarly(early, ctx, finalize, wrapResponse)
+    }
+
+    const runDerive = <T>(
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      let derived: unknown
+      try {
+        derived = derive(ctx)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+      if (derived instanceof Promise) {
+        return derived.then(
+          (settled) => {
+            if (isResponseResult(settled) || settled instanceof Response) {
+              return finalizeEarly(settled, ctx, finalize, wrapResponse)
+            }
+            Object.assign(ctx, settled as object)
+            return runBefore(ctx, finalize, wrapResponse)
+          },
+          (err) => logError(err, ctx, finalize, wrapResponse),
+        )
+      }
+      if (isResponseResult(derived) || derived instanceof Response) {
+        return finalizeEarly(derived, ctx, finalize, wrapResponse)
+      }
+      Object.assign(ctx, derived as object)
+      return runBefore(ctx, finalize, wrapResponse)
+    }
+
+    const onParsed = <T>(
+      parsed: unknown,
+      ctx: RawContext,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      let validation: StandardResult<unknown> | Promise<StandardResult<unknown>>
+      try {
+        validation = bodySchema["~standard"].validate(parsed)
+      } catch (err) {
+        return logError(err, ctx, finalize, wrapResponse)
+      }
+      if (validation instanceof Promise) {
+        return validation.then(
+          (settled) => {
+            if (settled.issues !== undefined)
+              return wrapResponse(plainValidationError(settled.issues))
+            ctx.body = settled.value
+            return runDerive(ctx, finalize, wrapResponse)
+          },
+          (err) => logError(err, ctx, finalize, wrapResponse),
+        )
+      }
+      if (validation.issues !== undefined)
+        return wrapResponse(plainValidationError(validation.issues))
+      ctx.body = validation.value
+      return runDerive(ctx, finalize, wrapResponse)
+    }
+
+    return <T>(
+      source: RequestSource,
+      params: Record<string, string>,
+      search: string | undefined,
+      signal: AbortSignal,
+      budget: RequestBudget,
+      platform: Platform | undefined,
+      nativeContext: boolean,
+      finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+      wrapResponse: (response: Response | ResponseResult) => T,
+    ): MaybePromise<T> => {
+      const ctx = nativeContext
+        ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+        : new RequestContext(
+            source,
+            params,
+            search,
+            signal,
+            budget,
+            platform,
+            maxBodyBytes,
+            this.protoPoisoning,
+          )
+      return readBodyFramed(
+        source,
+        maxBodyBytes,
+        this.protoPoisoning,
+        (parsed) => onParsed(parsed, ctx, finalize, wrapResponse),
+        wrapResponse,
+        (err) => logError(err, ctx, finalize, wrapResponse),
+        bodySchema,
+      )
+    }
+  }
+
+  private bareError<T>(
+    err: unknown,
+    ctx: RawContext,
+    finalize: (result: unknown, set: CtxSet, ctx: RawContext) => T,
+    wrapResponse: (response: Response | ResponseResult) => T,
+  ): T {
+    // The thrown-value contract lives in `bare-error-lane.ts`, one source of truth for both this
+    // lane and the fused body runner. `responseSet` and the logger are injected because they reach
+    // into class state; the closure is allocated only on the throw path, never on the hot lane.
     return renderBareError(
       err,
       ctx,
       finalize,
-      wrapResponse,
       responseSet,
       (e, c) => this.logRequestError(e, c),
       () => this.internalErrorResponse(wrapResponse),
@@ -4275,19 +5502,17 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
   // @ts-expect-error TS6133 -- invoked structurally by the general route program
   private validateProgramStage(
     entry: RouteEntry,
-    stage: Extract<RouteProgramStage, { kind: "headers" | "params" | "body" | "query" }>,
+    stage: Extract<RouteProgramStage, { kind: ProgramValidationKind }>,
     source: RequestSource,
     ctx: RawContext,
   ): MaybePromise<Response | ResponseResult | undefined> {
+    if (stage.kind === "body") return this.readProgramBody(entry, source, ctx)
     const input =
       stage.kind === "headers"
         ? headerObjectOf(source.headers)
-        : stage.kind === "params"
-          ? ctx.params
-          : stage.kind === "query"
-            ? queryObjectOf(ctx[CONTEXT_SEARCH])
-            : undefined
-    if (stage.kind === "body") return this.readProgramBody(entry, source, ctx)
+        : stage.kind === "query"
+          ? queryObjectOf(ctx[CONTEXT_SEARCH])
+          : ctx[stage.kind]
     const validation = stage.schema["~standard"].validate(input)
     return validation instanceof Promise
       ? validation.then((result) => this.applyLifecycleValidation(entry, result, ctx, stage.kind))
@@ -4362,6 +5587,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       (parsed) => this.finishBodyOnly(entry, parsed, ctx, finalize, wrapResponse),
       wrapResponse,
       (err) => this.handleLifecycleError(entry, err, ctx, finalize, wrapResponse),
+      entry.schema?.body,
     )
   }
 
@@ -4726,7 +5952,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     try {
       const contract = entry.responseContract
       if (contract === undefined) return finalize(result, responseSet(ctx))
-      const checked = contract.runtime.check(contract.schema, result)
+      const checked = contract.runtime.check(contract.definition, result, ctx)
       if (checked instanceof Promise) {
         return checked.then(
           (outcome) => this.finishContractOutcome(ctx, finalize, wrapResponse, outcome),
@@ -4780,13 +6006,15 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     wrapResponse: (response: Response | ResponseResult) => T,
   ): MaybePromise<T> {
     // A *thrown* Response is deliberate control flow, not an error - a guard throws a redirect/401,
-    // an action throws an error page. Return it as-is (Remix/SvelteKit semantics); don't run onError
-    // or log it as a 500. This is what makes `throw redirect(...)` / `requireSession(...)` work from
-    // any handler or loader.
-    if (err instanceof Response) return wrapResponse(err)
+    // an action throws an error page. Send it as the same Response returned would be sent (Remix/
+    // SvelteKit semantics): as built, plus the cookies the request queued, so a session set or
+    // cleared before `throw redirect(...)` / `requireSession(...)` ships. Don't run onError or log
+    // it as a 500.
+    if (err instanceof Response) return finalize(err, responseSet(ctx))
     // Same rule for a thrown `status(...)`, but through `finalize` rather than `wrapResponse`: the
     // value is still plain data, so the ordinary JSON lane renders it and no `Response` is built.
-    if (isResponseResult(err)) return finalize(err, responseSet(ctx))
+    if (isResponseResult(err))
+      return this.finishLifecycleContract(entry, ctx, finalize, wrapResponse, err)
     if (entry.onError.length === 0) {
       // Never crash the server or leak internals. The client gets a flat 500; the detail goes to the
       // (redacting) logger. Body-read failures and around-hook failures land here too.
@@ -4846,6 +6074,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       validate,
       (response) => response,
       (error) => Promise.reject(error),
+      bodySchema,
     )
   }
 
@@ -4855,13 +6084,10 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     entry: RouteEntry,
     result: StandardResult<unknown>,
     ctx: RawContext,
-    kind: "body" | "query" | "params" | "headers",
+    kind: ProgramValidationKind,
   ): MaybePromise<Response | ResponseResult | undefined> {
     const assign = (value: unknown): void => {
-      if (kind === "body") ctx.body = value
-      else if (kind === "query") ctx.query = value
-      else if (kind === "headers") ctx.headers = value as Record<string, string>
-      else ctx.params = value as Record<string, string>
+      ;(ctx as unknown as Record<ProgramValidationKind, unknown>)[kind] = value
     }
     if (result.issues === undefined) {
       assign(result.value)
@@ -4880,22 +6106,14 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
 
   private finishLifecycleValidationRecovery(
     entry: RouteEntry,
-    kind: "body" | "query" | "params" | "headers",
+    kind: ProgramValidationKind,
     issues: ReadonlyArray<StandardIssue>,
     recovery: unknown,
     assign: (value: unknown) => void,
   ): MaybePromise<Response | ResponseResult | undefined> {
     if (recovery === undefined) return plainValidationError(issues)
     if (recovery instanceof Response) return recovery
-    const schema =
-      kind === "body"
-        ? entry.schema?.body
-        : kind === "query"
-          ? entry.schema?.query
-          : kind === "params"
-            ? entry.schema?.params
-            : entry.schema?.headers
-    const retried = schema!["~standard"].validate(recovery)
+    const retried = entry.schema![kind]!["~standard"].validate(recovery)
     if (retried instanceof Promise) {
       return retried.then((settled) => {
         if (settled.issues !== undefined) return plainValidationError(settled.issues)
@@ -4916,6 +6134,8 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     fused: FusedWebRunner | undefined,
     signal: AbortSignal | undefined,
     budget: RequestBudget | undefined,
+    peer: PeerPlatform,
+    fallback: BunNativeHandler,
   ): BunNativeHandler {
     // This callback is reached only from Bun's compiled native route table. Bun has already parsed
     // the HTTP framing, so the JSON lane may retain its native fused `json()` parse without weakening
@@ -4924,7 +6144,10 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     // The fused native lane bypasses `runMatched`, so the route's transport byte cap must be
     // marked here too - otherwise a Bun `listen()` fused route would leave direct `c.req` body
     // reads uncapped. The non-fused branches go through `fetchMatched` -> `runMatched`, which marks.
-    const bodyLimit = entry.schema?.body === undefined ? entry.bodyLimit : undefined
+    const bodyLimit =
+      entry.schema?.body === undefined || entry.program.authBeforeValidation
+        ? entry.bodyLimit
+        : undefined
     const inner = fused
     const capped: FusedWebRunner | undefined =
       inner === undefined || bodyLimit === undefined
@@ -4934,68 +6157,90 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
             if (method !== "GET" && method !== "HEAD") markTransportCap(source, bodyLimit)
             return inner(source, params, search, fusedSignal, fusedBudget, platform, nativeContext)
           }
+    const nativeResponseHooks = this.onResponseHooks.length > 0 && this.bunNativeResponseHeadersOnly
+    const finishNative = (request: Request, response: Response): MaybePromise<Response> => {
+      if (!nativeResponseHooks) return response
+      return this.applyOnResponseAndFinalize(response, request)
+    }
+    const runNative = (
+      request: Request,
+      params: Record<string, string>,
+    ): MaybePromise<Response> => {
+      const outcome = capped!(request, params, undefined, signal!, budget!, peer, true)
+      return outcome instanceof Promise
+        ? outcome.then((response) => finishNative(request, response))
+        : finishNative(request, outcome)
+    }
     if (paramNames.length === 0) {
       if (capped === undefined) {
         return (request) => {
           markFramed(request)
-          return this.fetchMatched(request, entry, EMPTY_PARAMS)
+          return this.fetchMatched(request, entry, EMPTY_PARAMS, peer)
         }
       }
       if (this.acceptInboundDeadlines) {
         return (request) => {
           markFramed(request)
           return request.headers.get(NIFRA_DEADLINE_HEADER) !== null
-            ? this.fetchMatched(request, entry, EMPTY_PARAMS)
-            : capped(request, EMPTY_PARAMS, undefined, signal!, budget!, undefined, true)
+            ? this.fetchMatched(request, entry, EMPTY_PARAMS, peer)
+            : capped(request, EMPTY_PARAMS, undefined, signal!, budget!, peer, true)
         }
       }
       return (request) => {
         markFramed(request)
-        return capped(request, EMPTY_PARAMS, undefined, signal!, budget!, undefined, true)
+        return runNative(request, EMPTY_PARAMS)
       }
     }
 
     const malformed =
       paramNames.length === 1
-        ? (params: Record<string, string>) => params[paramNames[0]!]?.includes("\uFFFD") === true
-        : hasReplacementParam
+        ? (params: Record<string, string>) => unroutedParam(params[paramNames[0]!])
+        : hasUnroutedParam
     if (capped === undefined) {
-      return (request) => {
+      return (request, server) => {
         markFramed(request)
         const params = (request as BunRequestWithParams).params ?? EMPTY_PARAMS
-        if (malformed(params)) return this.fetchSource(request)
-        return this.fetchMatched(request, entry, params)
+        if (malformed(params)) return fallback(request, server)
+        return this.fetchMatched(request, entry, params, peer)
       }
     }
     if (this.acceptInboundDeadlines) {
-      return (request) => {
+      return (request, server) => {
         markFramed(request)
         const params = (request as BunRequestWithParams).params ?? EMPTY_PARAMS
-        if (malformed(params)) return this.fetchSource(request)
+        if (malformed(params)) return fallback(request, server)
         return request.headers.get(NIFRA_DEADLINE_HEADER) !== null
-          ? this.fetchMatched(request, entry, params)
-          : capped(request, params, undefined, signal!, budget!, undefined, true)
+          ? this.fetchMatched(request, entry, params, peer)
+          : capped(request, params, undefined, signal!, budget!, peer, true)
       }
     }
-    return (request) => {
+    return (request, server) => {
       markFramed(request)
       const params = (request as BunRequestWithParams).params ?? EMPTY_PARAMS
-      if (malformed(params)) return this.fetchSource(request)
-      return capped(request, params, undefined, signal!, budget!, undefined, true)
+      if (malformed(params)) return fallback(request, server)
+      return runNative(request, params)
     }
   }
 
   /** Compile portable route registrations into Bun's native route table. Apps with request-rewrite
    * hooks or WebSockets retain the single portable dispatcher because those features must run before
-   * route selection/upgrade. Named wildcards also stay on the fallback until Bun exposes their raw
-   * capture semantics; static and `:param` routes take the native lane. */
-  private buildBunNativeRoutes(): BunNativeRoutes | undefined {
+   * route selection/upgrade.
+   *
+   * Bun and the portable router agree on which of two static-and-`:param` paths wins a request, so
+   * the table is kept to those paths. Where Bun would otherwise pass a request on to a less specific
+   * path, the more specific one carries `fallback`, the portable dispatcher, under that method.
+   * `peer` is the platform every request served from the table shares. */
+  private buildBunNativeRoutes(
+    fallback: BunNativeHandler,
+    peer: PeerPlatform,
+  ): BunNativeRoutes | undefined {
     // A `clientIp` trust declaration must run the resolver in `dispatch`, which the fused native lane
     // bypasses - so an app that declares trust routes through the fetch lane (where `c.clientIp`
     // resolves) instead of Bun's native table. The allocation-free default keeps native fusion.
     if (
-      this.onRequestHooks.length > 0 ||
+      (this.onRequestHooks.length > 0 && !this.bunNativeRequestHooksSafe) ||
       this.wsRouteCount > 0 ||
+      this.preRouteMountCount > 0 ||
       this.clientIpTrust !== undefined
     ) {
       return undefined
@@ -5004,7 +6249,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     const routes: BunNativeRoutes = Object.create(null) as BunNativeRoutes
     const mayUseFusedNative =
       this.requestTimeoutMs === 0 &&
-      this.onResponseHooks.length === 0 &&
+      (this.onResponseHooks.length === 0 || this.bunNativeResponseHeadersOnly) &&
       this.onResponseFinalizedHooks.length === 0 &&
       // The capacity gate must wrap every request; the fused lane bypasses fetchMatched, so enabling
       // admission drops fusion (native matching stays) and routes through the gated matched lane.
@@ -5012,23 +6257,75 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     const unboundedSignal = mayUseFusedNative ? getNeverAbortSignal() : undefined
     const unboundedBudget = mayUseFusedNative ? getUnboundedRequestBudget() : undefined
     let count = 0
-    for (const { method, path, pattern, entry } of this.catalog.entries()) {
-      if (pattern.segments.some((segment) => segment.kind === "wildcard")) continue
-      let methods = routes[path]
-      if (methods === undefined) {
-        methods = Object.create(null) as BunNativeMethodTable
-        routes[path] = methods
+    const all = this.catalog.entries()
+    // A path with a wildcard or a part-literal segment cannot go in the table: Bun reads `/:name.json`
+    // as one parameter named `name.json`. These are filed under each run of static segments they
+    // start with, which is where a table path they could outrank looks for them.
+    const under = new Map<string, CatalogRoute[]>()
+    const lead = all.map((route) => {
+      const segments = route.pattern.segments
+      const plain = segments.every(
+        (segment) => segment.kind === "static" || segment.kind === "param",
+      )
+      let prefix = ""
+      for (const segment of segments) {
+        if (!plain) {
+          let bucket = under.get(prefix)
+          if (bucket === undefined) {
+            bucket = []
+            under.set(prefix, bucket)
+          }
+          bucket.push(route)
+        }
+        if (segment.kind !== "static") break
+        prefix += `/${segment.value}`
+      }
+      return plain ? prefix : undefined
+    })
+    // A preflight hook is intentionally handled by the fallback fetch path. Keeping OPTIONS out
+    // of the native lane means Bun dispatches it through CORS's onRequest hook even when the
+    // same path has native GET/POST handlers.
+    const preflightOnFallback = this.onRequestHooks.length > 0 && this.bunNativeRequestHooksSafe
+    // Where Bun could pass a request down: the methods served natively on a path with a parameter,
+    // as segment count + method. Two table paths match one request only at the same segment count.
+    const below = new Set<string>()
+    const tableAt = (path: string): BunNativeMethodTable => {
+      routes[path] ??= Object.create(null) as BunNativeMethodTable
+      return routes[path]
+    }
+    for (let i = 0; i < all.length; i++) {
+      const { method, path, pattern, entry } = all[i]!
+      const run = lead[i]
+      // The route is served from the table unless its path cannot be there, Bun's table has no slot
+      // for its method, or a path outside the table outranks it: Bun would hand this route a request
+      // the portable router gives to that one. An idempotent route stays off it too: its lanes run on
+      // a buffered copy of the request, and Bun names the peer only of the request it delivered, so
+      // the platform the table shares could not answer `c.clientIp` there.
+      if (
+        run === undefined ||
+        entry.idempotent !== undefined ||
+        !METHODS.includes(method as Method) ||
+        (preflightOnFallback && method === "OPTIONS") ||
+        under.get(run)?.some((other) => outranks(other.pattern.segments, pattern.segments))
+      ) {
+        continue
       }
       const paramNames = pattern.paramNames
       const fused = mayUseFusedNative ? entry.execution.fusedWeb : undefined
-      methods[method] = this.compileBunNativeHandler(
+      tableAt(path)[method as Method] = this.compileBunNativeHandler(
         entry,
         paramNames,
         fused,
         unboundedSignal,
         unboundedBudget,
+        peer,
+        fallback,
       )
       count += 1
+      if (paramNames.length > 0) {
+        below.add(pattern.segments.length + method)
+        if (method === "GET") below.add(`${pattern.segments.length}HEAD`)
+      }
     }
     if (count === 0) return undefined
     // RFC 9110 §9.3.2: a GET route answers HEAD with identical status + headers (Bun strips the
@@ -5039,6 +6336,17 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       const methods = routes[path]!
       if (methods.GET !== undefined) methods.HEAD ??= methods.GET
     }
+    // Bun picks among the paths its table holds for the request's method, so a path with no entry
+    // for the method lets the request through to a less specific one. The portable router stops at
+    // the most specific path and answers 405. Every path the table could hold therefore gets the
+    // portable dispatcher under each method a less specific path might serve.
+    for (let i = 0; i < all.length; i++) {
+      if (lead[i] === undefined) continue
+      const { path, pattern } = all[i]!
+      for (const method of METHODS) {
+        if (below.has(pattern.segments.length + method)) tableAt(path)[method] ??= fallback
+      }
+    }
     return routes
   }
 
@@ -5063,6 +6371,10 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
    * connection cut mid-flight regardless of `requestTimeoutMs`. Apps with such endpoints must raise
    * this above their slowest expected response, which is why it is a first-class option and not a
    * reason to drop down to `Bun.serve`. `0` disables the timeout entirely; max 255.
+   *
+   * `tls` serves HTTPS directly: `app.listen(443, { tls: { cert, key } })` with PEM text or bytes.
+   * Requests then arrive with `https:` URLs. Behind a proxy or a platform that terminates TLS, leave
+   * it unset.
    */
   listen(
     port: number,
@@ -5070,6 +6382,7 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
       readonly reusePort?: boolean
       readonly hostname?: string
       readonly idleTimeoutSec?: number
+      readonly tls?: ListenTlsOptions
     },
   ): RunningServer {
     if (typeof Bun === "undefined") {
@@ -5097,34 +6410,63 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
     // because wsRouteCount > 0 means ws() ran, and ws() requires the runtime at registration.
     // Native pub/sub when the app has WS routes and none validate outbound frames: `ws.subscribe` and
     // `app.publish` go through Bun's own (uWebSockets) broadcast instead of the JS registry loop.
-    const nativePubsub = this.wsRouteCount > 0 && !this.wsHasValidatedSend
-    const wsHandlers =
-      this.wsRouteCount === 0
-        ? undefined
-        : (this.wsRuntime as WsRuntime).bunHandlers(this.topics as TopicRegistry, nativePubsub)
-    const reusePort = options?.reusePort === true
-    // Spread rather than pass `hostname: undefined` - Bun treats an explicit undefined as a value
-    // on some option paths, and omitting is what selects its 0.0.0.0 default.
-    const bind = options?.hostname === undefined ? {} : { hostname: options.hostname }
-    // Same reasoning as `bind`: omit rather than pass undefined, so Bun's own default applies.
-    const idle =
-      options?.idleTimeoutSec === undefined ? {} : { idleTimeout: options.idleTimeoutSec }
-    const nativeRoutes = wsHandlers === undefined ? this.buildBunNativeRoutes() : undefined
+    // A mounted app counts only while it has a WebSocket route (see `[GET_WS_RUNTIME]`), so composing
+    // one without any needs no runtime here.
+    const wsRuntime = this[GET_WS_RUNTIME]()
+    if (wsRuntime === null) {
+      throw new FrameworkError(
+        "INVALID_WS_RUNTIME",
+        "a Bun server with mounted WebSocket routes needs the websocket() runtime installed on the parent or child app",
+      )
+    }
+    // Native pub/sub is safe only when every upgrade belongs to this app. A mounted child that takes
+    // upgrades owns a different TopicRegistry, so force the per-connection JS dispatcher and carry
+    // that registry in the upgrade outcome instead of accidentally broadcasting child sockets through
+    // the parent.
+    const nativePubsub =
+      this.wsRouteCount > 0 && !this.mountsTakeUpgrades() && !this.wsHasValidatedSend
+    const wsHandlers = wsRuntime?.bunHandlers(this.topics ?? wsRuntime.createTopics(), nativePubsub)
+    // Spread rather than pass `hostname: undefined` (or an undefined idle timeout or TLS) - Bun treats
+    // an explicit undefined as a value on some option paths, and omitting is what selects its own
+    // defaults, 0.0.0.0 among them.
+    const listening = {
+      port,
+      reusePort: options?.reusePort === true,
+      ...(options?.hostname === undefined ? {} : { hostname: options.hostname }),
+      ...(options?.idleTimeoutSec === undefined ? {} : { idleTimeout: options.idleTimeoutSec }),
+      ...(options?.tls === undefined ? {} : { tls: options.tls }),
+      // A hook that throws rejects `fetch`; Bun's own answer to that is a development page carrying
+      // the message, stack and source whenever NODE_ENV is not "production".
+      error: (err: unknown) => {
+        emitRequestErrorLog(this.logger, this.errorLogDetail, err, undefined)
+        return jsonError(500, "internal_error")
+      },
+    }
+    const fallback: BunNativeHandler = (req, server) => {
+      // Bun has already framed and bounded this request body in its HTTP parser. Mark the
+      // source before the portable fallback runs so body schemas use Bun's native `json()`
+      // reader instead of the defensive arrayBuffer/decode path reserved for caller-built
+      // Requests. Native route handlers mark themselves in compileBunNativeHandler; this
+      // covers every request the native lane does not serve.
+      markTrustedBodyFraming(req)
+      return this.fetch(req, bunPeerPlatform(server, req) as Platform<EnvOf<Ctx>>)
+    }
+    // Bun names the socket peer of a request when its server is asked. A request served from the
+    // native table carries this one platform, which asks only when a handler reads `c.clientIp`.
+    const peer: PeerPlatform = {
+      [PLATFORM_PEER]: (request) =>
+        (running as unknown as BunPeerServer).requestIP(request as Request)?.address,
+    }
+    const nativeRoutes =
+      wsHandlers === undefined ? this.buildBunNativeRoutes(fallback, peer) : undefined
     const running = (wsHandlers === undefined
       ? Bun.serve({
-          port,
-          reusePort,
-          ...bind,
-          ...idle,
+          ...listening,
           ...(nativeRoutes === undefined ? {} : { routes: nativeRoutes }),
-          fetch: (req: Request, server) =>
-            this.fetch(req, bunPeerPlatform(server, req) as Platform<EnvOf<Ctx>>),
+          fetch: fallback,
         })
       : Bun.serve<BunWsData>({
-          port,
-          reusePort,
-          ...bind,
-          ...idle,
+          ...listening,
           fetch: (req, server) => this.bunFetchWithWebSocket(req, server),
           // Bun's `ServerWebSocket<BunWsData>` is runtime-compatible with the handlers' structural
           // `BunSocket` view (kept local so `Bun.*` types never leak into the published .d.ts); the
@@ -5140,7 +6482,9 @@ export class Server<R extends Registry = EmptyRegistry, Ctx = EmptyContext, Hook
         })) as unknown as RunningServer
     this.bunServer = running
     // Bind `app.publish` to Bun's native broadcast now that the server handle exists. Guarded on the
-    // method's presence so a runtime whose handle lacks it simply keeps the registry path.
+    // method's presence so a runtime whose handle lacks it simply keeps the registry path. Cleared
+    // first: a mounted app may have gained a WebSocket route since an earlier `listen()`.
+    this.nativePublish = undefined
     if (nativePubsub && typeof running.publish === "function") {
       const native = running.publish.bind(running)
       this.nativePublish = (topic, data) => {