@nifrajs/core 5.7.0 → 5.9.0

package/dist/server/server.js

@@ -8,7 +8,7 @@ import { adoptRouteRuntimes, compileRouteOptions } from "../internal/route-compi
 import { compileRouteExecutionPlan, } from "../internal/route-execution.js";
 import { authenticateMount, compileRouteProgram, executeRouteProgram, } from "../internal/route-program.js";
 import { isSameOriginRequest } from "../internal/same-origin.js";
-import { decodeRouteParams, expandOptionalParams, } from "../router/pattern.js";
+import { compileRoutePattern, decodeRouteParams, expandOptionalParams, } from "../router/pattern.js";
 import { EMPTY_PARAMS, METHODS, Router } from "../router/router.js";
 import { withAnswerSteps } from "./answer-step.js";
 import { isAuthenticatedRequest, markAuthenticatedRequest, } from "./auth.js";
@@ -22,8 +22,9 @@ import { declaredHeaders, headerObjectOf } from "./headers.js";
 import { isRoutableMethod, jsonError, pathnameOf, plainError, urlPartsOf, } from "./http.js";
 import { withStaticNodeHeaders } from "./node-outcome.js";
 import { queryObjectOf, searchOf } from "./query.js";
-import { PLATFORM_PEER, RequestContext, readBodyFramed, } from "./request-context.js";
+import { PLATFORM_IDLE_TIMEOUT, PLATFORM_PEER, PLATFORM_REQUEST, RequestContext, readBodyFramed, } from "./request-context.js";
 import { recordRequestReplacement } from "./request-lineage.js";
+import { carryToCopy } from "./request-local.js";
 import { needsResolving, resolveDotSegments } from "./request-target.js";
 import { applyStaticResponseHeaders, buildStaticResponseHeaders, claimHandedOver, fusedRespond, fusedRespondNoSet, handedBackResponse, recordResidentTexts, toResponse, writableResponse, } from "./respond.js";
 import { CONTEXT_REQUEST, CONTEXT_SEARCH, CONTEXT_SET, EMPTY_RESPONSE_CONTROLS, getNeverAbortSignal, getUnboundedRequestBudget, headerOf, isResponseResult, requestOf, } from "./runtime-core.js";
@@ -39,24 +40,32 @@ import { jsonLogger } from "./logger.js";
 const BUN_NATIVE_REQUEST_SAFE = Symbol.for("@nifrajs/core/bun-native-request-safe");
 const functionToString = Function.prototype.toString;
 const CONTEXTLESS_ARROW = /^(?:async\s*)?\(\s*\)\s*(?::[\s\S]*?)?=>/;
-/** The socket peer Bun observed, as a `Platform` for the request lifecycle (`undefined` if unknown). */
-function bunPeerPlatform(server, req) {
+/**
+ * The socket peer Bun observed (`undefined` if unknown) and its connection's idle timeout, as a
+ * `Platform` for one request. A class, not an object literal: JSC builds a literal holding a getter
+ * or a symbol key on a slow path, measured at about 5x the instructions of this instance.
+ */
+class BunPeerPlatform {
+    #server;
+    #resolved = false;
+    #address;
+    constructor(server, req, setIdleTimeout) {
+        this.#server = server;
+        this[PLATFORM_IDLE_TIMEOUT] = setIdleTimeout;
+        this[PLATFORM_REQUEST] = req;
+    }
     // Bun's requestIP() costs ~0.5 us per call, about 7% of a bare GET's server time. Keep the
     // documented raw-peer c.clientIp behavior, but resolve it lazily: most routes never read c.clientIp,
     // so they should not pay for the socket lookup on every request. A getter also
     // preserves middleware that inspects the platform argument directly and trust-mode routes, which
     // resolve the value in deriveClientIp before the handler runs.
-    let resolved = false;
-    let address;
-    return {
-        get clientIp() {
-            if (!resolved) {
-                resolved = true;
-                address = server.requestIP(req)?.address;
-            }
-            return address;
-        },
-    };
+    get clientIp() {
+        if (!this.#resolved) {
+            this.#resolved = true;
+            this.#address = this.#server.requestIP(this[PLATFORM_REQUEST])?.address;
+        }
+        return this.#address;
+    }
 }
 // Bun's route table has a slot for each of these; a QUERY entry is ignored and the request falls
 // through to the table's fetch, so QUERY routes stay on the portable dispatcher.
@@ -87,6 +96,20 @@ function outranks(other, route) {
     }
     return ahead && other.length === route.length;
 }
+/** Whether one request can match both patterns: no two static segments differ before either ends
+ * in a wildcard, and the lengths agree otherwise. Errs toward `true`. */
+function mayShareRequest(a, b) {
+    const shared = Math.min(a.length, b.length);
+    for (let i = 0; i < shared; i++) {
+        const left = a[i];
+        const right = b[i];
+        if (left.kind === "wildcard" || right.kind === "wildcard")
+            return true;
+        if (left.kind === "static" && right.kind === "static" && left.value !== right.value)
+            return false;
+    }
+    return a.length === b.length;
+}
 /**
  * The key Bun's route table holds `path` under. Bun refuses one with a character outside printable
  * ASCII, so such a path is spelled as the portable router matches it: percent-encoded static
@@ -138,6 +161,8 @@ const BODY_ERROR = (error) => Promise.reject(error);
 const DEFAULT_DRAIN_MS = 10_000;
 const DRAIN_POLL_MS = 10;
 const STOP_HOOK_TIMEOUT_MS = 5_000;
+/** Bun's own `idleTimeout` when `listen()` is given none. */
+const BUN_IDLE_TIMEOUT_SEC = 10;
 /** Same-origin check for a WebSocket handshake (CSWSH default). {@link isSameOriginRequest} is the one
  * owner, shared with the server-function mount in `@nifrajs/web` - the two used to answer differently
  * for the same request, so a browser that could open a socket was told its POST was cross-origin. */
@@ -173,8 +198,8 @@ function hasUnroutedParam(params) {
     return false;
 }
 /**
- * Deno is the runtime that hands an app a `Request` whose `url` is the target as the client sent it;
- * Bun, workerd and every `new Request()` parse it first. Only there does `fetch` read the URL up front.
+ * Deno's server builds `Request.url` from the Host and target as received, without normalizing the
+ * target first. Bun, workerd, and `new Request()` parse it before core sees it.
  */
 const rawRequestTargets = typeof globalThis.Deno !== "undefined";
 /**
@@ -200,6 +225,7 @@ function withResolvedTarget(req, url) {
     // The same body, so the same framing: a runtime still delimited it.
     if (hasTrustedBodyFraming(req))
         markTrustedBodyFraming(rebuilt);
+    carryToCopy(req, rebuilt);
     return rebuilt;
 }
 /**
@@ -232,7 +258,8 @@ function resolvedSource(req, url) {
 // request for `/public` into one for `/admin`. Node refuses such a Host before routing; so does this.
 const HOST_AUTHORITY = /^(?:\[[0-9a-f:.%]+\]|[\w.-]+)(?::(\d{1,5}))?$/i;
 // Clients repeat one Host on every request; comparing to the last valid one is ~7x cheaper than the regex.
-let lastValidHost = "";
+// `null` until one passes, so an empty Host is never taken as the cached one.
+let lastValidHost = null;
 // A port past 65535, or an IPv6 literal no URL parser takes (`[1:2]`), is refused as Node refuses it:
 // no URL can be built on either, so resolving a dot segment against one threw out of `fetch`.
 const invalidHost = (host) => {
@@ -253,26 +280,35 @@ const invalidHost = (host) => {
  * Host (400), a URL replaces the target, `false` keeps it. Deno hands the target over as sent, so
  * its dot segments are resolved; so does Bun when HTTP/1.0 leaves the Host out, and its route table
  * matched `/files/..` raw. Such a request is served as `localhost`, as Node and Deno serve it.
- * `headerOf`, not `req.headers`: on Deno that reads the Host alone instead of building every
- * header.
+ * `headerOf`, not `req.headers`: on Deno it reads Host only when `validateHost` is set, and dot
+ * segments are resolved only when `normalizeTarget` is. On Bun only a target that needs resolving
+ * is checked unless `validateHost` is set.
  */
-const requestTarget = (req) => {
-    if (!rawRequestTargets && !unparsedBunTargets)
+const requestTarget = (req, validateHost, normalizeTarget) => {
+    if (rawRequestTargets) {
+        const host = validateHost ? headerOf(req, "host") : null;
+        if (host !== null && invalidHost(host))
+            return true;
+        if (!normalizeTarget || !needsResolving(req.url))
+            return false;
+        // Deno can preserve an unparseable absolute URL when Host is malformed. Do not route its
+        // unresolved dot segments through the raw-target fallback.
+        if (!URL.canParse(req.url, "http://localhost"))
+            return true;
+        return resolveDotSegments(req.url);
+    }
+    if (!(unparsedBunTargets && (validateHost || needsResolving(req.url))))
         return false;
     const host = headerOf(req, "host");
     if (host !== null && invalidHost(host)) {
-        if (rawRequestTargets)
-            return true;
         // Bun served it anyway: it could not read the Host, so it left the target unparsed, or it
         // built the URL on it - sent twice (joined with ", ", the URL on the first; RFC 9112 section
-        // 3.2 answers 400), percent-encoded (`%61.example` routed as `a.example`), or with a
-        // sub-delimiter (`a!b`). A request built in process keeps the URL its caller built, unless Bun
+        // 3.2 answers 400), percent-encoded (%61.example routed as a.example), or with a
+        // sub-delimiter (a!b). A request built in process keeps the URL its caller built, unless Bun
         // would have built it so.
         const routed = URL.parse(req.url)?.host;
         return routed === undefined || URL.parse(`//${host.split(", ")[0]}`, req.url)?.host === routed;
     }
-    if (rawRequestTargets)
-        return needsResolving(req.url) && resolveDotSegments(req.url);
     // A request built in process carries an absolute URL whatever its headers say.
     return (host === null &&
         req.url.charCodeAt(0) === 47 /* / */ &&
@@ -306,7 +342,8 @@ function mountPriorityOf(priority) {
 function compareMounts(a, b) {
     return b.priority - a.priority || b.path.length - a.path.length || a.order - b.order;
 }
-/** Rebase a mounted request's path without losing the authentication mark used by child caches. */
+/** Rebase a mounted request's path without losing the authentication mark used by child caches, or
+ * its request locals. */
 function stripMountPrefix(request, prefix) {
     if (prefix === "/")
         return request;
@@ -316,11 +353,39 @@ function stripMountPrefix(request, prefix) {
     const childRequest = new Request(url.href, request);
     if (isAuthenticatedRequest(request))
         markAuthenticatedRequest(childRequest);
+    carryToCopy(request, childRequest);
     return childRequest;
 }
 function responseSet(ctx) {
     return ctx[CONTEXT_SET]() ?? EMPTY_RESPONSE_CONTROLS;
 }
+/** The error hooks of the many fused routes that have none, shared so each does not allocate its own. */
+const NO_ERROR_HOOKS = [];
+const WEB_STAGES = new WeakMap();
+const NODE_STAGES = new WeakMap();
+const hookCount = (hooks) => hooks.length > 1 ? 2 : hooks.length;
+/**
+ * The fused stage chain of a hook shape, built once per server and handed to every route with the same
+ * number of derive, before and after hooks (none, one or several of each). The chain reads a route's
+ * hooks and handler from the `FusedHooks` it is called with, so sharing it changes no answer.
+ */
+function sharedStages(cache, owner, route, build) {
+    const derives = hookCount(route.derives);
+    const befores = hookCount(route.befores);
+    const afters = hookCount(route.afters);
+    const key = derives * 9 + befores * 3 + afters;
+    let chains = cache.get(owner);
+    if (chains === undefined) {
+        chains = new Map();
+        cache.set(owner, chains);
+    }
+    let stages = chains.get(key);
+    if (stages === undefined) {
+        stages = build(derives, befores, afters);
+        chains.set(key, stages);
+    }
+    return stages;
+}
 function isContextlessNoArgArrow(handler) {
     if (handler.length !== 0)
         return false;
@@ -653,6 +718,8 @@ export class Server {
     formOrigins;
     /** `trustBodyFraming`: mark every `app.fetch` request as runtime-framed (see ServerOptions). */
     trustBodyFraming;
+    validateHost;
+    normalizeTarget;
     wsMaxPayloadBytes;
     requestTimeoutMs;
     wsUpgradeTimeoutMs;
@@ -785,6 +852,8 @@ export class Server {
         this.protoPoisoning = options.protoPoisoning ?? "reject";
         this.formOrigins = options.formOrigins;
         this.trustBodyFraming = options.trustBodyFraming ?? false;
+        this.validateHost = options.validateHost ?? false;
+        this.normalizeTarget = options.normalizeTarget ?? false;
         const wsMaxPayloadBytes = options.wsMaxPayloadBytes ?? maxBodyBytes;
         assertByteLimit(wsMaxPayloadBytes, "wsMaxPayloadBytes");
         this.maxBodyBytes = maxBodyBytes;
@@ -1639,39 +1708,42 @@ export class Server {
             handler = this.idempotencyRuntime.wrapHandler(handler);
         }
         const { bare, fusedQuery, fusedBody } = lanes;
-        // Fused lifecycle lanes: derive + before (with or without an after), and body + the same shape.
-        // The lane selectors in `selectRouteLanes` are exhaustive about the lifecycleHookLane /
-        // body-derive-before-after eligibility, so we only need to check the lane and the hook counts.
-        const lifecycleHookLane = lanes.lifecycleHookLane;
-        const isFusedLifecycle = lifecycleHookLane !== undefined && this.derives.length === 1;
-        const isFusedBodyLifecycle = lanes.fusedLane === "body-derive-before" || lanes.fusedLane === "body-derive-before-after";
-        // The generic runners below are the Node-direct twins of the fused Web lanes built further
-        // down: same single-frame lifecycle, finalizing through the caller's own `finalize` instead of
-        // building a `Response`, so the `!webFast` dispatcher prefers them over the generic program
-        // exactly as it prefers the body-only runner. Only the original body-only lane may feed the Web
-        // wrapper; every other runner here preserves its derive/before/after stages.
+        // `selectRouteLanes` admits the fused hook lanes only for derive, before and after hooks, so the
+        // three arrays below are the route's whole lifecycle.
+        const fusedLifecycle = lanes.fusedLane === "hooks" || lanes.fusedLane === "body-hooks";
+        // The fused chains keep the arrays they are built from, and `beforeHandle()` inserts into the live
+        // ones ahead of `beforeHandler()` guards, so the entry and the fused chains share one snapshot of
+        // this route's.
+        const derivesSnapshot = [...this.derives];
+        const beforesSnapshot = [...beforeHandle];
+        const aftersSnapshot = [...afterHandle];
+        const onErrorSnapshot = onError.length === 0 ? NO_ERROR_HOOKS : [...onError];
+        const fusedHooks = fusedLifecycle
+            ? {
+                handler: handler,
+                derives: derivesSnapshot,
+                befores: beforesSnapshot,
+                afters: aftersSnapshot,
+                errors: onErrorSnapshot,
+                decorations: hasDecorations ? routeDecorations : undefined,
+            }
+            : undefined;
+        // The Node-direct dispatcher (`!webFast`) prefers these runners over the generic program. Only the
+        // body-only runner also feeds the Web wrapper; the lifecycle lanes build their own Web closure.
         const fusedBodyRunner = fusedBody
             ? this.buildFusedBodyRunner(handler, schema?.body, hasDecorations ? routeDecorations : undefined, bodyLimit ?? UNLIMITED_BODY_BYTES)
-            : isFusedBodyLifecycle
-                ? this.buildFusedBodyDeriveBeforeAfterRunner(handler, this.derives[0], beforeHandle[0], afterHandle[0], schema?.body, bodyLimit ?? UNLIMITED_BODY_BYTES)
-                : isFusedLifecycle && lifecycleHookLane === "derive-before"
-                    ? this.buildFusedDeriveBeforeRunner(handler, this.derives[0], beforeHandle[0], undefined, schema?.query, bodyLimit ?? UNLIMITED_BODY_BYTES)
-                    : isFusedLifecycle && lifecycleHookLane === "derive-before-after"
-                        ? this.buildFusedDeriveBeforeRunner(handler, this.derives[0], beforeHandle[0], afterHandle[0], schema?.query, bodyLimit ?? UNLIMITED_BODY_BYTES)
-                        : undefined;
+            : fusedHooks !== undefined
+                ? this.buildFusedLifecycleRunner(fusedHooks, schema?.query, schema?.body, bodyLimit ?? UNLIMITED_BODY_BYTES)
+                : undefined;
         const fusedWeb = bare && this.aroundHooks.length === 0
             ? this.buildFusedWeb(handler, hasDecorations ? routeDecorations : undefined, isContextlessNoArgArrow(handler), bodyLimit ?? UNLIMITED_BODY_BYTES)
             : fusedQuery
                 ? this.buildFusedQueryWeb(handler, hasDecorations ? routeDecorations : undefined, schema?.query, bodyLimit ?? UNLIMITED_BODY_BYTES)
                 : fusedBody
                     ? this.buildFusedBodyWeb(fusedBodyRunner)
-                    : isFusedBodyLifecycle
-                        ? this.buildFusedBodyDeriveBeforeAfter(handler, this.derives[0], beforeHandle[0], afterHandle[0], schema?.body, bodyLimit ?? UNLIMITED_BODY_BYTES)
-                        : isFusedLifecycle && lifecycleHookLane === "derive-before"
-                            ? this.buildFusedDeriveBefore(handler, this.derives[0], beforeHandle[0], schema?.query, bodyLimit ?? UNLIMITED_BODY_BYTES)
-                            : isFusedLifecycle && lifecycleHookLane === "derive-before-after"
-                                ? this.buildFusedDeriveBeforeAfter(handler, this.derives[0], beforeHandle[0], afterHandle[0], schema?.query, bodyLimit ?? UNLIMITED_BODY_BYTES)
-                                : undefined;
+                    : fusedHooks !== undefined
+                        ? this.buildFusedLifecycleWeb(fusedHooks, schema?.query, schema?.body, bodyLimit ?? UNLIMITED_BODY_BYTES)
+                        : undefined;
         const program = compileRouteProgram({
             schema,
             handler: handler,
@@ -1703,13 +1775,13 @@ export class Server {
             idempotent,
             ledgered,
             responseContract,
-            derives: [...this.derives],
+            derives: derivesSnapshot,
             authStages: [...compiled.authStages],
             decorations: routeDecorations,
             hasDecorations,
-            beforeHandle: [...beforeHandle],
-            afterHandle: [...afterHandle],
-            onError: [...onError],
+            beforeHandle: beforesSnapshot,
+            afterHandle: aftersSnapshot,
+            onError: onErrorSnapshot,
             lifecycleHookLane: lanes.lifecycleHookLane,
             around: [...this.aroundHooks],
             execution,
@@ -2110,49 +2182,29 @@ export class Server {
         const lane = entry.execution.fusedLane;
         // Type-erase the lane so each `===` branch sees the full union, not the narrowed remainder.
         const laneName = lane;
-        // Body+lifecycle routes have a fused Web renderer, and - unlike before - a generic fused
-        // runner too: it preserves derive/before/after (it IS the lifecycle, single-framed), so the
-        // Node-direct dispatcher's preference for the generic slot over the execution plan stays
-        // semantics-preserving. Only the original body-only lane may feed the Web wrapper below.
-        const derive = entry.derives[0];
-        const before = entry.beforeHandle[0];
-        const after = entry.afterHandle[0];
+        const lifecycle = laneName === "hooks" || laneName === "body-hooks";
+        const hooks = lifecycle
+            ? {
+                handler: entry.handler,
+                derives: entry.derives,
+                befores: entry.beforeHandle,
+                afters: entry.afterHandle,
+                errors: entry.onError,
+                decorations: entry.hasDecorations ? entry.decorations : undefined,
+            }
+            : undefined;
         const fusedBody = laneName === "body"
             ? this.buildFusedBodyRunner(entry.handler, entry.schema?.body, entry.hasDecorations ? entry.decorations : undefined, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-            : laneName === "body-derive-before" && derive !== undefined && before !== undefined
-                ? this.buildFusedBodyDeriveBeforeAfterRunner(entry.handler, derive, before, undefined, entry.schema?.body, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-                : laneName === "body-derive-before-after" &&
-                    derive !== undefined &&
-                    before !== undefined &&
-                    after !== undefined
-                    ? this.buildFusedBodyDeriveBeforeAfterRunner(entry.handler, derive, before, after, entry.schema?.body, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-                    : laneName === "derive-before" && derive !== undefined && before !== undefined
-                        ? this.buildFusedDeriveBeforeRunner(entry.handler, derive, before, undefined, entry.schema?.query, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-                        : laneName === "derive-before-after" &&
-                            derive !== undefined &&
-                            before !== undefined &&
-                            after !== undefined
-                            ? this.buildFusedDeriveBeforeRunner(entry.handler, derive, before, after, entry.schema?.query, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-                            : undefined;
+            : hooks !== undefined
+                ? this.buildFusedLifecycleRunner(hooks, entry.schema?.query, entry.schema?.body, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+                : undefined;
         const fusedWeb = laneName === "body"
             ? this.buildFusedBodyWeb(fusedBody)
             : laneName === "query"
                 ? this.buildFusedQueryWeb(entry.handler, entry.hasDecorations ? entry.decorations : undefined, entry.schema?.query, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-                : laneName === "body-derive-before" && derive !== undefined && before !== undefined
-                    ? this.buildFusedBodyDeriveBeforeAfter(entry.handler, derive, before, undefined, entry.schema?.body, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-                    : laneName === "body-derive-before-after" &&
-                        derive !== undefined &&
-                        before !== undefined &&
-                        after !== undefined
-                        ? this.buildFusedBodyDeriveBeforeAfter(entry.handler, derive, before, after, entry.schema?.body, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-                        : laneName === "derive-before" && derive !== undefined && before !== undefined
-                            ? this.buildFusedDeriveBefore(entry.handler, derive, before, entry.schema?.query, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-                            : laneName === "derive-before-after" &&
-                                derive !== undefined &&
-                                before !== undefined &&
-                                after !== undefined
-                                ? this.buildFusedDeriveBeforeAfter(entry.handler, derive, before, after, entry.schema?.query, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
-                                : this.buildFusedWeb(entry.handler, entry.hasDecorations ? entry.decorations : undefined, isContextlessNoArgArrow(entry.handler), entry.bodyLimit ?? UNLIMITED_BODY_BYTES);
+                : hooks !== undefined
+                    ? this.buildFusedLifecycleWeb(hooks, entry.schema?.query, entry.schema?.body, entry.bodyLimit ?? UNLIMITED_BODY_BYTES)
+                    : this.buildFusedWeb(entry.handler, entry.hasDecorations ? entry.decorations : undefined, isContextlessNoArgArrow(entry.handler), entry.bodyLimit ?? UNLIMITED_BODY_BYTES);
         return {
             ...route,
             entry: {
@@ -2185,7 +2237,7 @@ export class Server {
     fetch(req, platform) {
         // Deno's `Request.url` is the target as sent; Bun, workerd and every `new Request()` parse it.
         // Route what the parsed URL says, so `/users/../admin` is `/admin` on every runtime.
-        const target = requestTarget(req);
+        const target = requestTarget(req, this.validateHost, this.normalizeTarget);
         if (target === true)
             return jsonError(400, "invalid_host");
         if (target !== false) {
@@ -2235,6 +2287,23 @@ export class Server {
         }
         return this.admitGated(requestOf(source), () => this.fetchMatchedInner(source, entry, params, platform));
     }
+    /** {@link fetchMatched} for an app whose `onRequest` hooks run before the route does: the hooks see
+     * the request first, and the route Bun matched runs unless one of them replaced the request. */
+    fetchMatchedHooked(source, entry, params, platform) {
+        if (this.capacityGate === undefined) {
+            return this.fetchMatchedHookedInner(source, entry, params, platform);
+        }
+        return this.admitGated(source, () => this.fetchMatchedHookedInner(source, entry, params, platform));
+    }
+    fetchMatchedHookedInner(source, entry, params, platform) {
+        const outcome = this.runWithOnRequest(source, this.trustedPlatform(source, platform), this.finalizeResponse, this.wrapWebResponse, this.webResponseTimeout, true, { entry, params });
+        if (this.onResponseHooks.length === 0 && this.onResponseFinalizedHooks.length === 0) {
+            return outcome;
+        }
+        return outcome instanceof Promise
+            ? outcome.then((response) => this.applyOnResponseAndFinalize(response, this.takeResponseRequest(source)))
+            : this.applyOnResponseAndFinalize(outcome, this.takeResponseRequest(source));
+    }
     fetchMatchedInner(source, entry, params, platform) {
         const outcome = this.runMatched(source, platform, entry, params, undefined, this.finalizeResponse, this.wrapWebResponse, this.webResponseTimeout, true);
         if (this.onResponseHooks.length === 0 && this.onResponseFinalizedHooks.length === 0) {
@@ -2594,7 +2663,7 @@ export class Server {
         // The adapter answers a pass by handing this same object to `fetch`.
         const received = req;
         // The handshake routes the path `fetch` would: Host checked, dot segments resolved (see `fetch`).
-        const target = requestTarget(req);
+        const target = requestTarget(req, this.validateHost, this.normalizeTarget);
         if (target === true) {
             return { kind: "reject", response: this.wrapWebResponse(jsonError(400, "invalid_host")) };
         }
@@ -2783,10 +2852,10 @@ export class Server {
     /** Bun `fetch` when WS routes exist: try a WS upgrade first, else run the normal HTTP lifecycle.
      * `undefined` ⇒ Bun owns the upgraded socket; a `Response` ⇒ a normal reply or a rejected upgrade.
      * (The socket dispatch itself lives in `ws-bun.ts`, loaded via `@nifrajs/core/ws`.) */
-    bunFetchWithWebSocket(req, server) {
+    bunFetchWithWebSocket(req, server, setIdleTimeout) {
         const handle = (o) => {
             if (o.kind === "pass")
-                return this.fetch(req, bunPeerPlatform(server, req));
+                return this.fetch(req, new BunPeerPlatform(server, req, setIdleTimeout));
             if (o.kind === "reject")
                 return o.response;
             // A copy: the Bun socket keeps per-connection state on it, and a hand-built outcome may be shared.
@@ -2794,7 +2863,7 @@ export class Server {
                 ? undefined
                 : jsonError(426, "upgrade_required");
         };
-        const outcome = this.resolveWebSocketUpgrade(req, bunPeerPlatform(server, req));
+        const outcome = this.resolveWebSocketUpgrade(req, new BunPeerPlatform(server, req, setIdleTimeout));
         return outcome instanceof Promise ? outcome.then(handle) : handle(outcome);
     }
     /**
@@ -2895,7 +2964,7 @@ export class Server {
      * at ~13% of a realistic request. The first hook that returns a Promise hands the REMAINING
      * hooks to the async continuation; behavior is identical.
      */
-    runWithOnRequest(source, platform, finalize, wrapResponse, onTimeout, webFast) {
+    runWithOnRequest(source, platform, finalize, wrapResponse, onTimeout, webFast, matched) {
         const hooks = this.onRequestHooks;
         const originalRequest = requestOf(source);
         // A Web Request is already the exact object visible to the hooks and the response walk. Only
@@ -2914,7 +2983,7 @@ export class Server {
                 return this.onRequestFailure(err, current, platform, finalize, wrapResponse);
             }
             if (outcome instanceof Promise) {
-                return outcome.then((early) => this.continueOnRequest(early, i + 1, originalRequest, current, platform, finalize, wrapResponse, onTimeout, webFast), (err) => this.onRequestFailure(err, current, platform, finalize, wrapResponse));
+                return outcome.then((early) => this.continueOnRequest(early, i + 1, originalRequest, current, platform, finalize, wrapResponse, onTimeout, webFast, matched), (err) => this.onRequestFailure(err, current, platform, finalize, wrapResponse));
             }
             if (outcome instanceof Request) {
                 if (outcome !== seen)
@@ -2927,11 +2996,11 @@ export class Server {
             if (outcome !== undefined)
                 return earlyAnswer(outcome, wrapResponse);
         }
-        return this.routeAndRun(current, platform, finalize, wrapResponse, onTimeout, webFast);
+        return this.routeAndRun(current, platform, finalize, wrapResponse, onTimeout, webFast, current === originalRequest ? matched : undefined);
     }
     /** Async tail of {@link runWithOnRequest}: applies the first awaited hook's outcome, then runs
      * the remaining hooks (awaiting freely - we're already async here). */
-    async continueOnRequest(first, nextIndex, originalRequest, sourceAtAwait, platform, finalize, wrapResponse, onTimeout, webFast) {
+    async continueOnRequest(first, nextIndex, originalRequest, sourceAtAwait, platform, finalize, wrapResponse, onTimeout, webFast, matched) {
         let current = sourceAtAwait;
         let seen = requestOf(sourceAtAwait);
         let early = first;
@@ -2959,7 +3028,7 @@ export class Server {
             }
             index++;
         }
-        return this.routeAndRun(current, platform, finalize, wrapResponse, onTimeout, webFast);
+        return this.routeAndRun(current, platform, finalize, wrapResponse, onTimeout, webFast, current === originalRequest ? matched : undefined);
     }
     takeResponseRequest(source) {
         const tracked = this.responseSources.get(source);
@@ -3028,7 +3097,12 @@ export class Server {
      * (selected by its compiled plan), so a sync handler produces its result with zero promise allocations;
      * routes with validation/hooks keep the full compiled route program, unchanged.
      */
-    routeAndRun(source, platform, finalize, wrapResponse, onTimeout, webFast) {
+    routeAndRun(source, platform, finalize, wrapResponse, onTimeout, webFast, 
+    // The route Bun's table already matched for this very request, which routing would find again.
+    matched) {
+        if (matched !== undefined) {
+            return this.runMatched(source, platform, matched.entry, matched.params, undefined, finalize, wrapResponse, onTimeout, webFast);
+        }
         // Native delimiter searches keep path/query splitting out of a character-by-character JS loop.
         // Keep the slices in locals instead of allocating the public helper's pathname/search pair.
         let pathname;
@@ -3518,53 +3592,244 @@ export class Server {
         };
     }
     /**
-     * Compile a route's `derive + before` lifecycle to a single closure: the per-request walk through
-     * `runSync` → `runHooksSync` is a stack of 3 frames and 2 `Object.assign`s for what is by far the
-     * most common middleware shape (auth/trace/id derivation, an auth/policy `beforeHandle`). Folding
-     * the same steps into one closure hits the same monomorphic inline-cache site as `buildFusedWeb`,
-     * and `Object.assign(ctx, deriveResult)` becomes one extra property write on the context's already
-     * hot hidden class. Behavior is byte-identical to the compiled route program: the same thrown-value
-     * contract (`Response` is control flow, anything else logs + 500), the same `c.set` semantics, the
-     * same `fusedRespond` for the rendered body. The `LifecycleExecutionLane` guarantee
-     * (`schema.params === undefined && schema.headers === undefined && derives === 1 &&
-     * beforeHandle === 1 && afterHandle === 0 && onError === 0 && !hasResponseContract &&
-     * !hasDecorations`) is enforced by `selectRouteLanes`; this lane is selected ONLY when all of those
-     * hold. A `query` schema (the route declares `{ query }` alongside the hooks) is validated FIRST,
-     * mirroring the compiled route program's stage order; the fused builder runs validate → derive →
-     * before → handler in one frame.
+     * The stage chain a hook shape runs - derive, before, handler, after, respond - for the Web lane,
+     * built once per server and shared by every route with the same number of hooks in each phase (none,
+     * one or several). The chain reads a route's handler and hooks from its `FusedHooks` per request, so
+     * a route's own closure (see {@link buildFusedLifecycleWeb}) holds only that record and its schemas,
+     * and memory grows with the number of distinct shapes, not routes or hook functions.
      */
-    buildFusedDeriveBefore(handler, derive, before, querySchema, maxBodyBytes) {
-        return this.buildFusedDeriveBeforeAfter(handler, derive, before, undefined, querySchema, maxBodyBytes);
-    }
-    // Both hook variants share one registered chain; request contexts stay in arguments.
-    buildFusedDeriveBeforeAfter(handler, derive, before, after, querySchema, maxBodyBytes) {
-        const logError = (err, ctx) => this.bareError(err, ctx, (result, set) => this.wrapWebResponse(toResponse(result, set)), this.wrapWebResponse);
-        // Continuations capture route state once; each request supplies its own context.
-        const runAfter = (result, ctx) => {
-            if (after === undefined)
-                return this.respondFused(result, ctx, this.onResponseHooks.length === 0);
-            let transformed;
+    fusedWebStages(deriveCount, beforeCount, afterCount) {
+        let runAfter;
+        if (afterCount === 0) {
+            runAfter = (result, ctx, route) => this.respondHooks(result, ctx, route, this.onResponseHooks.length === 0);
+        }
+        else if (afterCount === 1) {
+            runAfter = (result, ctx, route) => {
+                let transformed;
+                try {
+                    transformed = route.afters[0](result, ctx);
+                }
+                catch (err) {
+                    return this.fusedWebRouteFail(err, ctx, route);
+                }
+                if (transformed instanceof Promise) {
+                    return transformed.then((value) => this.respondHooks(value, ctx, route, this.onResponseHooks.length === 0), (err) => this.fusedWebRouteFail(err, ctx, route));
+                }
+                return this.respondHooks(transformed, ctx, route, this.onResponseHooks.length === 0);
+            };
+        }
+        else {
+            runAfter = (result, ctx, route, index) => {
+                const lastAfter = route.afters.length - 1;
+                for (;;) {
+                    let transformed;
+                    try {
+                        transformed = route.afters[index](result, ctx);
+                    }
+                    catch (err) {
+                        return this.fusedWebRouteFail(err, ctx, route);
+                    }
+                    if (transformed instanceof Promise) {
+                        return transformed.then((value) => index < lastAfter
+                            ? runAfter(value, ctx, route, index + 1)
+                            : this.respondHooks(value, ctx, route, this.onResponseHooks.length === 0), (err) => this.fusedWebRouteFail(err, ctx, route));
+                    }
+                    if (index === lastAfter) {
+                        return this.respondHooks(transformed, ctx, route, this.onResponseHooks.length === 0);
+                    }
+                    result = transformed;
+                    index++;
+                }
+            };
+        }
+        const runHandler = (ctx, route) => {
+            let result;
             try {
-                transformed = after(result, ctx);
+                result = route.handler(ctx);
             }
             catch (err) {
-                return logError(err, ctx);
+                return this.fusedWebRouteFail(err, ctx, route);
             }
-            if (transformed instanceof Promise) {
-                return transformed.then((value) => this.respondFused(value, ctx, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
+            if (result instanceof Promise) {
+                return result.then((value) => runAfter(value, ctx, route, 0), (err) => this.fusedWebRouteFail(err, ctx, route));
             }
-            return this.respondFused(transformed, ctx, this.onResponseHooks.length === 0);
+            return runAfter(result, ctx, route, 0);
         };
+        let runBefore;
+        if (beforeCount === 0) {
+            runBefore = runHandler;
+        }
+        else if (beforeCount === 1) {
+            runBefore = (ctx, route) => {
+                let early;
+                try {
+                    early = route.befores[0](ctx);
+                }
+                catch (err) {
+                    return this.fusedWebRouteFail(err, ctx, route);
+                }
+                if (early instanceof Promise) {
+                    return early.then((settled) => settled === undefined
+                        ? runHandler(ctx, route, 0)
+                        : this.respondHooks(settled, ctx, route), (err) => this.fusedWebRouteFail(err, ctx, route));
+                }
+                if (early === undefined)
+                    return runHandler(ctx, route, 0);
+                return this.respondHooks(early, ctx, route);
+            };
+        }
+        else {
+            runBefore = (ctx, route, index) => {
+                const lastBefore = route.befores.length - 1;
+                for (;;) {
+                    let early;
+                    try {
+                        early = route.befores[index](ctx);
+                    }
+                    catch (err) {
+                        return this.fusedWebRouteFail(err, ctx, route);
+                    }
+                    if (early instanceof Promise) {
+                        return early.then((settled) => {
+                            if (settled !== undefined)
+                                return this.respondHooks(settled, ctx, route);
+                            return index < lastBefore
+                                ? runBefore(ctx, route, index + 1)
+                                : runHandler(ctx, route, 0);
+                        }, (err) => this.fusedWebRouteFail(err, ctx, route));
+                    }
+                    if (early !== undefined)
+                        return this.respondHooks(early, ctx, route);
+                    if (index === lastBefore)
+                        return runHandler(ctx, route, 0);
+                    index++;
+                }
+            };
+        }
+        let runDerive;
+        if (deriveCount === 0) {
+            runDerive = runBefore;
+        }
+        else if (deriveCount === 1) {
+            runDerive = (ctx, route) => {
+                let derived;
+                try {
+                    derived = route.derives[0](ctx);
+                }
+                catch (err) {
+                    return this.fusedWebRouteFail(err, ctx, route);
+                }
+                if (derived instanceof Promise) {
+                    return derived.then((settled) => {
+                        if (isResponseResult(settled) || settled instanceof Response) {
+                            return this.respondHooks(settled, ctx, route);
+                        }
+                        try {
+                            Object.assign(ctx, settled);
+                        }
+                        catch (err) {
+                            return this.fusedWebRouteFail(err, ctx, route);
+                        }
+                        return runBefore(ctx, route, 0);
+                    }, (err) => this.fusedWebRouteFail(err, ctx, route));
+                }
+                if (isResponseResult(derived) || derived instanceof Response) {
+                    return this.respondHooks(derived, ctx, route);
+                }
+                try {
+                    Object.assign(ctx, derived);
+                }
+                catch (err) {
+                    return this.fusedWebRouteFail(err, ctx, route);
+                }
+                return runBefore(ctx, route, 0);
+            };
+        }
+        else {
+            runDerive = (ctx, route, index) => {
+                const lastDerive = route.derives.length - 1;
+                for (;;) {
+                    let derived;
+                    try {
+                        derived = route.derives[index](ctx);
+                    }
+                    catch (err) {
+                        return this.fusedWebRouteFail(err, ctx, route);
+                    }
+                    if (derived instanceof Promise) {
+                        return derived.then((settled) => {
+                            if (isResponseResult(settled) || settled instanceof Response) {
+                                return this.respondHooks(settled, ctx, route);
+                            }
+                            try {
+                                Object.assign(ctx, settled);
+                            }
+                            catch (err) {
+                                return this.fusedWebRouteFail(err, ctx, route);
+                            }
+                            return index < lastDerive
+                                ? runDerive(ctx, route, index + 1)
+                                : runBefore(ctx, route, 0);
+                        }, (err) => this.fusedWebRouteFail(err, ctx, route));
+                    }
+                    if (isResponseResult(derived) || derived instanceof Response) {
+                        return this.respondHooks(derived, ctx, route);
+                    }
+                    try {
+                        Object.assign(ctx, derived);
+                    }
+                    catch (err) {
+                        return this.fusedWebRouteFail(err, ctx, route);
+                    }
+                    if (index === lastDerive)
+                        return runBefore(ctx, route, 0);
+                    index++;
+                }
+            };
+        }
+        return runDerive;
+    }
+    /**
+     * Compile a fused lifecycle route's entry closure: parse (body) → validate → the shared stage chain
+     * of its hook shape (derive → before → handler → after → respond, see {@link fusedWebStages}) in a
+     * single frame, where the generic program walks staged hook loops. `selectRouteLanes` admits only
+     * derive, before and after hooks - no params or headers schema, onError, around, decorations,
+     * response contract or recovery hook, and never a query schema beside a body schema - so the behavior
+     * is the compiled program's: the same stage order, the same thrown-value contract (`Response` is
+     * control flow, anything else logs and 500s), the same `c.set` semantics and `fusedRespond` render.
+     * The route's own closure holds only its `FusedHooks` and schemas and takes the request's context as
+     * an argument, so a request allocates no step closures.
+     */
+    /**
+     * Keep the common one-derive/one-before shape bound to its hooks. Inline its synchronous path to
+     * avoid stage calls; retain helper closures only for promise continuations.
+     */
+    buildFusedLifecycleWebSingle(handler, derive, before, after, maxBodyBytes) {
+        const runAfter = after === undefined
+            ? (result, ctx) => this.respondFused(result, ctx, this.onResponseHooks.length === 0)
+            : (result, ctx) => {
+                let transformed;
+                try {
+                    transformed = after(result, ctx);
+                }
+                catch (err) {
+                    return this.fusedWebFail(err, ctx);
+                }
+                if (transformed instanceof Promise) {
+                    return transformed.then((value) => this.respondFused(value, ctx, this.onResponseHooks.length === 0), (err) => this.fusedWebFail(err, ctx));
+                }
+                return this.respondFused(transformed, ctx, this.onResponseHooks.length === 0);
+            };
         const runHandler = (ctx) => {
             let result;
             try {
                 result = handler(ctx);
             }
             catch (err) {
-                return logError(err, ctx);
+                return this.fusedWebFail(err, ctx);
             }
             if (result instanceof Promise) {
-                return result.then((value) => runAfter(value, ctx), (err) => logError(err, ctx));
+                return result.then((value) => runAfter(value, ctx), (err) => this.fusedWebFail(err, ctx));
             }
             return runAfter(result, ctx);
         };
@@ -3574,461 +3839,463 @@ export class Server {
                 early = before(ctx);
             }
             catch (err) {
-                return logError(err, ctx);
+                return this.fusedWebFail(err, ctx);
             }
             if (early instanceof Promise) {
-                return early.then((settled) => {
-                    if (settled === undefined)
-                        return runHandler(ctx);
-                    return this.respondFused(settled, ctx);
-                }, (err) => logError(err, ctx));
+                return early.then((settled) => (settled === undefined ? runHandler(ctx) : this.respondFused(settled, ctx)), (err) => this.fusedWebFail(err, ctx));
             }
             if (early === undefined)
                 return runHandler(ctx);
             return this.respondFused(early, ctx);
         };
-        const runDerive = (ctx) => {
+        return (source, params, search, signal, budget, platform, nativeContext) => {
+            const ctx = nativeContext
+                ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+                : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
             let derived;
             try {
                 derived = derive(ctx);
             }
             catch (err) {
-                return logError(err, ctx);
+                return this.fusedWebFail(err, ctx);
             }
             if (derived instanceof Promise) {
                 return derived.then((settled) => {
-                    if (isResponseResult(settled) || settled instanceof Response) {
+                    if (isResponseResult(settled) || settled instanceof Response)
                         return this.respondFused(settled, ctx);
+                    try {
+                        Object.assign(ctx, settled);
+                    }
+                    catch (err) {
+                        return this.fusedWebFail(err, ctx);
                     }
-                    Object.assign(ctx, settled);
                     return runBefore(ctx);
-                }, (err) => logError(err, ctx));
+                }, (err) => this.fusedWebFail(err, ctx));
             }
-            if (isResponseResult(derived) || derived instanceof Response) {
+            if (isResponseResult(derived) || derived instanceof Response)
                 return this.respondFused(derived, ctx);
+            let early;
+            let result;
+            let transformed;
+            let handlerPromise;
+            try {
+                Object.assign(ctx, derived);
+                early = before(ctx);
+                if (early === undefined) {
+                    result = handler(ctx);
+                    if (result instanceof Promise)
+                        handlerPromise = result;
+                    else if (after !== undefined)
+                        transformed = after(result, ctx);
+                }
+            }
+            catch (err) {
+                return this.fusedWebFail(err, ctx);
+            }
+            if (early instanceof Promise) {
+                return early.then((settled) => (settled === undefined ? runHandler(ctx) : this.respondFused(settled, ctx)), (err) => this.fusedWebFail(err, ctx));
             }
-            Object.assign(ctx, derived);
-            return runBefore(ctx);
+            if (early !== undefined)
+                return this.respondFused(early, ctx);
+            if (handlerPromise !== undefined) {
+                return handlerPromise.then((value) => after === undefined
+                    ? this.respondFused(value, ctx, this.onResponseHooks.length === 0)
+                    : runAfter(value, ctx), (err) => this.fusedWebFail(err, ctx));
+            }
+            if (after === undefined)
+                return this.respondFused(result, ctx, this.onResponseHooks.length === 0);
+            if (transformed instanceof Promise) {
+                return transformed.then((value) => this.respondFused(value, ctx, this.onResponseHooks.length === 0), (err) => this.fusedWebFail(err, ctx));
+            }
+            return this.respondFused(transformed, ctx, this.onResponseHooks.length === 0);
         };
+    }
+    buildFusedLifecycleWeb(route, querySchema, bodySchema, maxBodyBytes) {
+        if (querySchema === undefined &&
+            bodySchema === undefined &&
+            route.errors.length === 0 &&
+            route.decorations === undefined &&
+            route.derives.length === 1 &&
+            route.befores.length === 1 &&
+            route.afters.length <= 1) {
+            const derive = route.derives[0];
+            const before = route.befores[0];
+            if (derive !== undefined && before !== undefined) {
+                return this.buildFusedLifecycleWebSingle(route.handler, derive, before, route.afters[0], maxBodyBytes);
+            }
+        }
+        const runDerive = sharedStages(WEB_STAGES, this, route, (d, b, a) => this.fusedWebStages(d, b, a));
+        const decorations = route.decorations;
+        if (bodySchema !== undefined) {
+            const onParsed = (parsed, ctx) => {
+                let validation;
+                try {
+                    validation = bodySchema["~standard"].validate(parsed);
+                }
+                catch (err) {
+                    return this.fusedWebRouteFail(err, ctx, route);
+                }
+                if (validation instanceof Promise) {
+                    return validation.then((settled) => {
+                        if (settled.issues !== undefined)
+                            return this.wrapWebResponse(plainValidationError(settled.issues));
+                        ctx.body = settled.value;
+                        return runDerive(ctx, route, 0);
+                    }, (err) => this.fusedWebRouteFail(err, ctx, route));
+                }
+                if (validation.issues !== undefined)
+                    return this.wrapWebResponse(plainValidationError(validation.issues));
+                ctx.body = validation.value;
+                return runDerive(ctx, route, 0);
+            };
+            return (source, params, search, signal, budget, platform, nativeContext) => {
+                const ctx = nativeContext
+                    ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+                    : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
+                if (decorations !== undefined)
+                    Object.assign(ctx, decorations);
+                return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, (parsed) => onParsed(parsed, ctx), this.wrapWebResponse, (err) => this.fusedWebRouteFail(err, ctx, route), bodySchema, this.formOrigins);
+            };
+        }
         return (source, params, search, signal, budget, platform, nativeContext) => {
             const ctx = nativeContext
                 ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
                 : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
+            if (decorations !== undefined)
+                Object.assign(ctx, decorations);
             if (querySchema === undefined)
-                return runDerive(ctx);
+                return runDerive(ctx, route, 0);
             let validation;
             try {
                 validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
             }
             catch (err) {
-                return logError(err, ctx);
+                return this.fusedWebRouteFail(err, ctx, route);
             }
             if (validation instanceof Promise) {
                 return validation.then((settled) => {
                     if (settled.issues !== undefined)
                         return this.wrapWebResponse(plainValidationError(settled.issues));
                     ctx.query = settled.value;
-                    return runDerive(ctx);
-                }, (err) => logError(err, ctx));
+                    return runDerive(ctx, route, 0);
+                }, (err) => this.fusedWebRouteFail(err, ctx, route));
             }
             if (validation.issues !== undefined)
                 return this.wrapWebResponse(plainValidationError(validation.issues));
             ctx.query = validation.value;
-            return runDerive(ctx);
+            return runDerive(ctx, route, 0);
         };
     }
     /**
-     * Body + lifecycle hooks fused: parse → validate → derive → before → handler → (after) in one
-     * closure, the same win `buildFusedBodyRunner` gives for the no-hooks body shape. The shape is
-     * `lifecycleHookLane` PLUS a body schema with no other validation conflicts; the lane is selected
-     * ONLY when `schema.body !== undefined && schema.query/params/headers === undefined &&
-     * schema.onValidationError === undefined && !defaultOnValidationError && !hasIdempotency &&
-     * !hasLedger && derives === 1 && beforeHandle === 1 && afterHandle <= 1 && onError === 0 &&
-     * !hasResponseContract && !hasDecorations && around === 0`. The same single `querySchema === undefined`
-     * trick used in the no-body lane lets the build path stay simple: a query + body route falls back
-     * to the generic program (this is rare in practice - validated query + validated body is usually a
-     * "search results" route with a middleware chain on top, and the generic lane is fine there).
+     * The Node-direct twin of {@link fusedWebStages}: the same chain, finalizing through the caller's
+     * own `finalize`, shared by every route with the same hook shape. A terminal `finalize` throw (an
+     * unstringifiable handler return on the Node lane) is caught as `finishLifecycleContract` catches it.
      */
-    buildFusedBodyDeriveBeforeAfter(handler, derive, before, after, bodySchema, maxBodyBytes) {
-        const logError = (err, ctx) => this.bareError(err, ctx, (result, set) => this.wrapWebResponse(toResponse(result, set)), this.wrapWebResponse);
-        return (source, params, search, signal, budget, platform, nativeContext) => {
-            const ctx = nativeContext
-                ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
-                : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
-            const runHandlerValidated = () => {
-                const runAfter = (result) => {
-                    if (after === undefined) {
-                        return this.respondFused(result, ctx, this.onResponseHooks.length === 0);
-                    }
+    fusedNodeStages(deriveCount, beforeCount, afterCount) {
+        const finishResult = (result, ctx, route, finalize, wrapResponse) => {
+            try {
+                return finalize(result, responseSet(ctx), ctx);
+            }
+            catch (err) {
+                return this.fusedFail(err, ctx, route, finalize, wrapResponse);
+            }
+        };
+        let runAfter;
+        if (afterCount === 0) {
+            runAfter = (result, ctx, route, finalize, wrapResponse) => finishResult(result, ctx, route, finalize, wrapResponse);
+        }
+        else if (afterCount === 1) {
+            runAfter = (result, ctx, route, finalize, wrapResponse) => {
+                let transformed;
+                try {
+                    transformed = route.afters[0](result, ctx);
+                }
+                catch (err) {
+                    return this.fusedFail(err, ctx, route, finalize, wrapResponse);
+                }
+                if (transformed instanceof Promise) {
+                    return transformed.then((value) => finishResult(value, ctx, route, finalize, wrapResponse), (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse));
+                }
+                return finishResult(transformed, ctx, route, finalize, wrapResponse);
+            };
+        }
+        else {
+            runAfter = (result, ctx, route, finalize, wrapResponse, index) => {
+                const lastAfter = route.afters.length - 1;
+                for (;;) {
                     let transformed;
                     try {
-                        transformed = after(result, ctx);
+                        transformed = route.afters[index](result, ctx);
                     }
                     catch (err) {
-                        return logError(err, ctx);
+                        return this.fusedFail(err, ctx, route, finalize, wrapResponse);
                     }
                     if (transformed instanceof Promise) {
-                        return transformed.then((value) => this.respondFused(value, ctx, this.onResponseHooks.length === 0), (err) => logError(err, ctx));
+                        return transformed.then((value) => index < lastAfter
+                            ? runAfter(value, ctx, route, finalize, wrapResponse, index + 1)
+                            : finishResult(value, ctx, route, finalize, wrapResponse), (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse));
                     }
-                    return this.respondFused(transformed, ctx, this.onResponseHooks.length === 0);
-                };
-                const runHandler = () => {
-                    let result;
-                    try {
-                        result = handler(ctx);
-                    }
-                    catch (err) {
-                        return logError(err, ctx);
-                    }
-                    if (result instanceof Promise) {
-                        return result.then((value) => runAfter(value), (err) => logError(err, ctx));
-                    }
-                    return runAfter(result);
-                };
-                const runBefore = () => {
+                    if (index === lastAfter)
+                        return finishResult(transformed, ctx, route, finalize, wrapResponse);
+                    result = transformed;
+                    index++;
+                }
+            };
+        }
+        const runHandler = (ctx, route, finalize, wrapResponse) => {
+            let result;
+            try {
+                result = route.handler(ctx);
+            }
+            catch (err) {
+                return this.fusedFail(err, ctx, route, finalize, wrapResponse);
+            }
+            if (result instanceof Promise) {
+                return result.then((value) => runAfter(value, ctx, route, finalize, wrapResponse, 0), (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse));
+            }
+            return runAfter(result, ctx, route, finalize, wrapResponse, 0);
+        };
+        let runBefore;
+        if (beforeCount === 0) {
+            runBefore = runHandler;
+        }
+        else if (beforeCount === 1) {
+            runBefore = (ctx, route, finalize, wrapResponse) => {
+                let early;
+                try {
+                    early = route.befores[0](ctx);
+                }
+                catch (err) {
+                    return this.fusedFail(err, ctx, route, finalize, wrapResponse);
+                }
+                if (early instanceof Promise) {
+                    return early.then((settled) => settled === undefined
+                        ? runHandler(ctx, route, finalize, wrapResponse, 0)
+                        : finishResult(settled, ctx, route, finalize, wrapResponse), (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse));
+                }
+                if (early === undefined)
+                    return runHandler(ctx, route, finalize, wrapResponse, 0);
+                return finishResult(early, ctx, route, finalize, wrapResponse);
+            };
+        }
+        else {
+            runBefore = (ctx, route, finalize, wrapResponse, index) => {
+                const lastBefore = route.befores.length - 1;
+                for (;;) {
                     let early;
                     try {
-                        early = before(ctx);
+                        early = route.befores[index](ctx);
                     }
                     catch (err) {
-                        return logError(err, ctx);
+                        return this.fusedFail(err, ctx, route, finalize, wrapResponse);
                     }
                     if (early instanceof Promise) {
                         return early.then((settled) => {
-                            if (settled === undefined)
-                                return runHandler();
-                            return this.respondFused(settled, ctx);
-                        }, (err) => logError(err, ctx));
+                            if (settled !== undefined)
+                                return finishResult(settled, ctx, route, finalize, wrapResponse);
+                            return index < lastBefore
+                                ? runBefore(ctx, route, finalize, wrapResponse, index + 1)
+                                : runHandler(ctx, route, finalize, wrapResponse, 0);
+                        }, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse));
                     }
-                    if (early === undefined)
-                        return runHandler();
-                    return this.respondFused(early, ctx);
-                };
+                    if (early !== undefined)
+                        return finishResult(early, ctx, route, finalize, wrapResponse);
+                    if (index === lastBefore)
+                        return runHandler(ctx, route, finalize, wrapResponse, 0);
+                    index++;
+                }
+            };
+        }
+        let runDerive;
+        if (deriveCount === 0) {
+            runDerive = runBefore;
+        }
+        else if (deriveCount === 1) {
+            runDerive = (ctx, route, finalize, wrapResponse) => {
                 let derived;
                 try {
-                    derived = derive(ctx);
+                    derived = route.derives[0](ctx);
                 }
                 catch (err) {
-                    return logError(err, ctx);
+                    return this.fusedFail(err, ctx, route, finalize, wrapResponse);
                 }
                 if (derived instanceof Promise) {
                     return derived.then((settled) => {
                         if (isResponseResult(settled) || settled instanceof Response) {
-                            return this.respondFused(settled, ctx);
+                            return finishResult(settled, ctx, route, finalize, wrapResponse);
                         }
-                        Object.assign(ctx, settled);
-                        return runBefore();
-                    }, (err) => logError(err, ctx));
+                        try {
+                            Object.assign(ctx, settled);
+                        }
+                        catch (err) {
+                            return this.fusedFail(err, ctx, route, finalize, wrapResponse);
+                        }
+                        return runBefore(ctx, route, finalize, wrapResponse, 0);
+                    }, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse));
                 }
                 if (isResponseResult(derived) || derived instanceof Response) {
-                    return this.respondFused(derived, ctx);
+                    return finishResult(derived, ctx, route, finalize, wrapResponse);
                 }
-                Object.assign(ctx, derived);
-                return runBefore();
+                try {
+                    Object.assign(ctx, derived);
+                }
+                catch (err) {
+                    return this.fusedFail(err, ctx, route, finalize, wrapResponse);
+                }
+                return runBefore(ctx, route, finalize, wrapResponse, 0);
             };
-            const onParsed = (parsed) => {
+        }
+        else {
+            runDerive = (ctx, route, finalize, wrapResponse, index) => {
+                const lastDerive = route.derives.length - 1;
+                for (;;) {
+                    let derived;
+                    try {
+                        derived = route.derives[index](ctx);
+                    }
+                    catch (err) {
+                        return this.fusedFail(err, ctx, route, finalize, wrapResponse);
+                    }
+                    if (derived instanceof Promise) {
+                        return derived.then((settled) => {
+                            if (isResponseResult(settled) || settled instanceof Response) {
+                                return finishResult(settled, ctx, route, finalize, wrapResponse);
+                            }
+                            try {
+                                Object.assign(ctx, settled);
+                            }
+                            catch (err) {
+                                return this.fusedFail(err, ctx, route, finalize, wrapResponse);
+                            }
+                            return index < lastDerive
+                                ? runDerive(ctx, route, finalize, wrapResponse, index + 1)
+                                : runBefore(ctx, route, finalize, wrapResponse, 0);
+                        }, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse));
+                    }
+                    if (isResponseResult(derived) || derived instanceof Response) {
+                        return finishResult(derived, ctx, route, finalize, wrapResponse);
+                    }
+                    try {
+                        Object.assign(ctx, derived);
+                    }
+                    catch (err) {
+                        return this.fusedFail(err, ctx, route, finalize, wrapResponse);
+                    }
+                    if (index === lastDerive)
+                        return runBefore(ctx, route, finalize, wrapResponse, 0);
+                    index++;
+                }
+            };
+        }
+        return runDerive;
+    }
+    /**
+     * The Node-direct twin of {@link buildFusedLifecycleWeb}: the same steps, finalizing through the
+     * caller's own `finalize` (the Node outcome on the direct lane) instead of building a `Response`, so
+     * the `!webFast` dispatcher runs these routes in one frame rather than the generic program. A
+     * terminal `finalize` throw (an unstringifiable handler return on the Node lane) is caught as
+     * `finishLifecycleContract` catches it; the body's 415/400 renders take `wrapResponse` directly.
+     */
+    buildFusedLifecycleRunner(route, querySchema, bodySchema, maxBodyBytes) {
+        const runDerive = sharedStages(NODE_STAGES, this, route, (d, b, a) => this.fusedNodeStages(d, b, a));
+        const decorations = route.decorations;
+        if (bodySchema !== undefined) {
+            const onParsed = (parsed, ctx, finalize, wrapResponse) => {
                 let validation;
                 try {
                     validation = bodySchema["~standard"].validate(parsed);
                 }
                 catch (err) {
-                    return logError(err, ctx);
+                    return this.fusedFail(err, ctx, route, finalize, wrapResponse);
                 }
                 if (validation instanceof Promise) {
                     return validation.then((settled) => {
                         if (settled.issues !== undefined)
-                            return this.wrapWebResponse(plainValidationError(settled.issues));
+                            return wrapResponse(plainValidationError(settled.issues));
                         ctx.body = settled.value;
-                        return runHandlerValidated();
-                    }, (err) => logError(err, ctx));
+                        return runDerive(ctx, route, finalize, wrapResponse, 0);
+                    }, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse));
                 }
                 if (validation.issues !== undefined)
-                    return this.wrapWebResponse(plainValidationError(validation.issues));
+                    return wrapResponse(plainValidationError(validation.issues));
                 ctx.body = validation.value;
-                return runHandlerValidated();
+                return runDerive(ctx, route, finalize, wrapResponse, 0);
             };
-            return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, onParsed, (response) => this.wrapWebResponse(response), (err) => Promise.resolve(logError(err, ctx)), bodySchema, this.formOrigins);
-        };
-    }
-    /**
-     * Generic (finalize/wrapResponse-parameterized) fused runner for the derive-before(-after) lane:
-     * the Node-direct counterpart of `buildFusedDeriveBefore` / `buildFusedDeriveBeforeAfter`.
-     *
-     * The Web fused builders above return a `Response`, so the Node dispatcher (`webFast === false`)
-     * cannot use them and a derive+before route falls back to the generic route program there - two
-     * staged loops, per-stage dispatch, and the async-continuation machinery - while Bun rides the
-     * single closure. That asymmetry is the realistic-route Node deficit against Fastify: this runner
-     * closes it by running validate → derive → before → handler → (after) in one frame and finalizing
-     * through the caller's own `finalize` (the Node outcome on the direct lane, `toResponse` on Web),
-     * so the same registration feeds both runtimes with no per-lane copy of the lifecycle to drift.
-     *
-     * Semantics mirror the generic program stage-for-stage for the shapes this lane admits (exactly
-     * one derive, one beforeHandle, zero-or-one afterHandle, no onError/around/decorations/contracts/
-     * recovery hooks - enforced by `selectRouteLanes`): thrown `Response`/`status(...)` are control
-     * flow through `wrapResponse`/`finalize`, anything else logs + 500s via the shared `bareError`
-     * lane (identical to `handleLifecycleError` with no `onError` hooks), and a terminal `finalize`
-     * throw (e.g. an unstringifiable handler return on the Node lane) is caught exactly as
-     * `finishLifecycleContract` catches it. Step functions close over registration state only and take
-     * the request state as arguments, so the hot path allocates no per-request closures.
-     */
-    buildFusedDeriveBeforeRunner(handler, derive, before, after, querySchema, maxBodyBytes) {
-        const logError = (err, ctx, finalize, wrapResponse) => this.bareError(err, ctx, finalize, wrapResponse);
-        const runFinish = (result, ctx, finalize, wrapResponse) => {
-            if (after === undefined) {
-                try {
-                    return finalize(result, responseSet(ctx), ctx);
-                }
-                catch (err) {
-                    return logError(err, ctx, finalize, wrapResponse);
-                }
-            }
-            let transformed;
-            try {
-                transformed = after(result, ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-            if (transformed instanceof Promise) {
-                return transformed.then((value) => {
-                    try {
-                        return finalize(value, responseSet(ctx), ctx);
-                    }
-                    catch (err) {
-                        return logError(err, ctx, finalize, wrapResponse);
-                    }
-                }, (err) => logError(err, ctx, finalize, wrapResponse));
-            }
-            try {
-                return finalize(transformed, responseSet(ctx), ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-        };
-        const finalizeEarly = (result, ctx, finalize, wrapResponse) => {
-            try {
-                return finalize(result, responseSet(ctx), ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-        };
-        const runHandler = (ctx, finalize, wrapResponse) => {
-            let result;
-            try {
-                result = handler(ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-            if (result instanceof Promise) {
-                return result.then((value) => runFinish(value, ctx, finalize, wrapResponse), (err) => logError(err, ctx, finalize, wrapResponse));
-            }
-            return runFinish(result, ctx, finalize, wrapResponse);
-        };
-        const runBefore = (ctx, finalize, wrapResponse) => {
-            let early;
-            try {
-                early = before(ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-            if (early instanceof Promise) {
-                return early.then((settled) => settled === undefined
-                    ? runHandler(ctx, finalize, wrapResponse)
-                    : finalizeEarly(settled, ctx, finalize, wrapResponse), (err) => logError(err, ctx, finalize, wrapResponse));
-            }
-            if (early === undefined)
-                return runHandler(ctx, finalize, wrapResponse);
-            return finalizeEarly(early, ctx, finalize, wrapResponse);
-        };
-        const runDerive = (ctx, finalize, wrapResponse) => {
-            let derived;
-            try {
-                derived = derive(ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-            if (derived instanceof Promise) {
-                return derived.then((settled) => {
-                    if (isResponseResult(settled) || settled instanceof Response) {
-                        return finalizeEarly(settled, ctx, finalize, wrapResponse);
-                    }
-                    Object.assign(ctx, settled);
-                    return runBefore(ctx, finalize, wrapResponse);
-                }, (err) => logError(err, ctx, finalize, wrapResponse));
-            }
-            if (isResponseResult(derived) || derived instanceof Response) {
-                return finalizeEarly(derived, ctx, finalize, wrapResponse);
-            }
-            Object.assign(ctx, derived);
-            return runBefore(ctx, finalize, wrapResponse);
-        };
+            return (source, params, search, signal, budget, platform, nativeContext, finalize, wrapResponse) => {
+                const ctx = nativeContext
+                    ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
+                    : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
+                if (decorations !== undefined)
+                    Object.assign(ctx, decorations);
+                return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, (parsed) => onParsed(parsed, ctx, finalize, wrapResponse), wrapResponse, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse), bodySchema, this.formOrigins);
+            };
+        }
         const runValidated = (validation, ctx, finalize, wrapResponse) => {
             if (validation instanceof Promise) {
                 return validation.then((settled) => {
                     if (settled.issues !== undefined)
                         return wrapResponse(plainValidationError(settled.issues));
                     ctx.query = settled.value;
-                    return runDerive(ctx, finalize, wrapResponse);
-                }, (err) => logError(err, ctx, finalize, wrapResponse));
+                    return runDerive(ctx, route, finalize, wrapResponse, 0);
+                }, (err) => this.fusedFail(err, ctx, route, finalize, wrapResponse));
             }
             if (validation.issues !== undefined)
                 return wrapResponse(plainValidationError(validation.issues));
             ctx.query = validation.value;
-            return runDerive(ctx, finalize, wrapResponse);
+            return runDerive(ctx, route, finalize, wrapResponse, 0);
         };
         return (source, params, search, signal, budget, platform, nativeContext, finalize, wrapResponse) => {
             const ctx = nativeContext
                 ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
                 : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
+            if (decorations !== undefined)
+                Object.assign(ctx, decorations);
             if (querySchema === undefined)
-                return runDerive(ctx, finalize, wrapResponse);
+                return runDerive(ctx, route, finalize, wrapResponse, 0);
             let validation;
             try {
                 validation = querySchema["~standard"].validate(queryObjectOf(ctx[CONTEXT_SEARCH]));
             }
             catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
+                return this.fusedFail(err, ctx, route, finalize, wrapResponse);
             }
             return runValidated(validation, ctx, finalize, wrapResponse);
         };
     }
-    /**
-     * Generic fused runner for the body+derive-before(-after) lane: the Node-direct counterpart of
-     * `buildFusedBodyDeriveBeforeAfter`. Same contract as `buildFusedDeriveBeforeRunner` above - one
-     * frame running parse → validate → derive → before → handler → (after) through the caller's own
-     * `finalize` - with the body read ahead of validation, exactly as the generic program orders its
-     * body stage before the derive/before stages. `readBodyFramed` keeps the shared bounded-read,
-     * content-type, and prototype-poisoning contracts; the 415/400 renders take `wrapResponse`
-     * directly, which is what the generic lane's wrap-after-identity amounts to.
-     */
-    buildFusedBodyDeriveBeforeAfterRunner(handler, derive, before, after, bodySchema, maxBodyBytes) {
-        const logError = (err, ctx, finalize, wrapResponse) => this.bareError(err, ctx, finalize, wrapResponse);
-        const runFinish = (result, ctx, finalize, wrapResponse) => {
-            if (after === undefined) {
-                try {
-                    return finalize(result, responseSet(ctx), ctx);
-                }
-                catch (err) {
-                    return logError(err, ctx, finalize, wrapResponse);
-                }
-            }
-            let transformed;
-            try {
-                transformed = after(result, ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-            if (transformed instanceof Promise) {
-                return transformed.then((value) => {
-                    try {
-                        return finalize(value, responseSet(ctx), ctx);
-                    }
-                    catch (err) {
-                        return logError(err, ctx, finalize, wrapResponse);
-                    }
-                }, (err) => logError(err, ctx, finalize, wrapResponse));
-            }
-            try {
-                return finalize(transformed, responseSet(ctx), ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-        };
-        const finalizeEarly = (result, ctx, finalize, wrapResponse) => {
-            try {
-                return finalize(result, responseSet(ctx), ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-        };
-        const runHandler = (ctx, finalize, wrapResponse) => {
-            let result;
-            try {
-                result = handler(ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-            if (result instanceof Promise) {
-                return result.then((value) => runFinish(value, ctx, finalize, wrapResponse), (err) => logError(err, ctx, finalize, wrapResponse));
-            }
-            return runFinish(result, ctx, finalize, wrapResponse);
-        };
-        const runBefore = (ctx, finalize, wrapResponse) => {
-            let early;
-            try {
-                early = before(ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-            if (early instanceof Promise) {
-                return early.then((settled) => settled === undefined
-                    ? runHandler(ctx, finalize, wrapResponse)
-                    : finalizeEarly(settled, ctx, finalize, wrapResponse), (err) => logError(err, ctx, finalize, wrapResponse));
-            }
-            if (early === undefined)
-                return runHandler(ctx, finalize, wrapResponse);
-            return finalizeEarly(early, ctx, finalize, wrapResponse);
-        };
-        const runDerive = (ctx, finalize, wrapResponse) => {
-            let derived;
-            try {
-                derived = derive(ctx);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
-            }
-            if (derived instanceof Promise) {
-                return derived.then((settled) => {
-                    if (isResponseResult(settled) || settled instanceof Response) {
-                        return finalizeEarly(settled, ctx, finalize, wrapResponse);
-                    }
-                    Object.assign(ctx, settled);
-                    return runBefore(ctx, finalize, wrapResponse);
-                }, (err) => logError(err, ctx, finalize, wrapResponse));
-            }
-            if (isResponseResult(derived) || derived instanceof Response) {
-                return finalizeEarly(derived, ctx, finalize, wrapResponse);
-            }
-            Object.assign(ctx, derived);
-            return runBefore(ctx, finalize, wrapResponse);
-        };
-        const onParsed = (parsed, ctx, finalize, wrapResponse) => {
-            let validation;
+    /** The thrown-value render of the Web fused lifecycle lanes for a route with no error hooks: a
+     * `Response` is control flow, anything else is logged and answered with a plain 500. */
+    fusedWebFail(err, ctx) {
+        return this.bareError(err, ctx, this.finalizeResponse, this.wrapWebResponse);
+    }
+    /** {@link fusedWebFail} for a fused route that may have error hooks. */
+    fusedWebRouteFail(err, ctx, route) {
+        return this.fusedFail(err, ctx, route, this.finalizeResponse, this.wrapWebResponse);
+    }
+    /** The thrown-value render of a fused lifecycle route. A `Response` or `status(...)` is control flow
+     * that no error hook sees, unless it cannot render, which is a fault like any other. Anything else
+     * goes to the route's error hooks; with none it is logged and answered with a plain 500. */
+    fusedFail(err, ctx, route, finalize, wrapResponse) {
+        if (route.errors.length === 0)
+            return this.bareError(err, ctx, finalize, wrapResponse);
+        let fault = err;
+        if (err instanceof Response || isResponseResult(err)) {
             try {
-                validation = bodySchema["~standard"].validate(parsed);
-            }
-            catch (err) {
-                return logError(err, ctx, finalize, wrapResponse);
+                return finalize(err, responseSet(ctx), ctx);
             }
-            if (validation instanceof Promise) {
-                return validation.then((settled) => {
-                    if (settled.issues !== undefined)
-                        return wrapResponse(plainValidationError(settled.issues));
-                    ctx.body = settled.value;
-                    return runDerive(ctx, finalize, wrapResponse);
-                }, (err) => logError(err, ctx, finalize, wrapResponse));
+            catch (renderError) {
+                fault = renderError;
             }
-            if (validation.issues !== undefined)
-                return wrapResponse(plainValidationError(validation.issues));
-            ctx.body = validation.value;
-            return runDerive(ctx, finalize, wrapResponse);
-        };
-        return (source, params, search, signal, budget, platform, nativeContext, finalize, wrapResponse) => {
-            const ctx = nativeContext
-                ? RequestContext.native(source, params, search, maxBodyBytes, platform, this.protoPoisoning)
-                : new RequestContext(source, params, search, signal, budget, platform, maxBodyBytes, this.protoPoisoning);
-            return readBodyFramed(source, maxBodyBytes, this.protoPoisoning, (parsed) => onParsed(parsed, ctx, finalize, wrapResponse), wrapResponse, (err) => logError(err, ctx, finalize, wrapResponse), bodySchema, this.formOrigins);
-        };
+        }
+        return this.runErrorHooks(route.errors, undefined, fault, ctx, (result, set) => finalize(result, set, ctx), wrapResponse);
+    }
+    /** {@link respondFused} for a fused lifecycle route, whose failures reach its error hooks. */
+    respondHooks(result, ctx, route, unstamped) {
+        try {
+            return fusedRespond(result, ctx, this.responseBodyTag, this.staticResponseHeaders, unstamped);
+        }
+        catch (err) {
+            return this.fusedWebRouteFail(err, ctx, route);
+        }
     }
     bareError(err, ctx, finalize, wrapResponse) {
         // The thrown-value contract lives in `bare-error-lane.ts`, one source of truth for both this
@@ -4554,11 +4821,12 @@ export class Server {
     }
     /** Adapt one route's compiled execution plan to Bun's already-matched request shape. Route
      * semantics remain in the plan; this closure only supplies native params and deadline fallback. */
-    compileBunNativeHandler(entry, paramNames, fused, signal, budget, peer, fallback) {
+    compileBunNativeHandler(entry, method, paramNames, fused, signal, budget, peer, fallback, hookedPlatform) {
         // This callback is reached only from Bun's compiled native route table. Bun has already parsed
         // the HTTP framing, so the JSON lane may retain its native fused `json()` parse without weakening
-        // the portable/adapted source contract (those sources are never marked).
-        const markFramed = (request) => markTrustedBodyFraming(request);
+        // the portable/adapted source contract (those sources are never marked). Bun hands a GET or
+        // HEAD slot no body, so it skips the symbol write on every request.
+        const markFramed = method === "GET" || method === "HEAD" ? () => undefined : markTrustedBodyFraming;
         // The direct native lanes bypass `runMatched`, so the route's transport byte cap must be
         // marked here too - otherwise a Bun `listen()` fused route would leave direct `c.req` body
         // reads uncapped. The fallback branches go through `fetchMatched` -> `runMatched`, which marks.
@@ -4572,7 +4840,9 @@ export class Server {
             (signal && budget
                 ? (source, params, search, activeSignal, activeBudget, platform, nativeContext) => entry.execution.run(this, entry, source, params, search, activeSignal, activeBudget, platform, nativeContext, this.finalizeResponse, this.wrapWebResponse)
                 : undefined);
-        const capped = inner === undefined || bodyLimit === undefined
+        // The cap is never marked on a GET or HEAD, the only methods a GET or HEAD slot is handed, so those
+        // slots skip the wrapper and its read of the method on every request.
+        const capped = inner === undefined || bodyLimit === undefined || method === "GET" || method === "HEAD"
             ? inner
             : (source, params, search, fusedSignal, fusedBudget, platform, nativeContext) => {
                 const method = source.method;
@@ -4600,6 +4870,12 @@ export class Server {
                 : finishNative(request, outcome);
         };
         if (paramNames.length === 0) {
+            if (hookedPlatform !== undefined) {
+                return (request, server) => {
+                    markFramed(request);
+                    return this.fetchMatchedHooked(request, entry, EMPTY_PARAMS, hookedPlatform(request, server));
+                };
+            }
             if (capped === undefined) {
                 return (request) => {
                     markFramed(request);
@@ -4622,6 +4898,16 @@ export class Server {
         const malformed = paramNames.length === 1
             ? (params) => unroutedParam(params[paramNames[0]])
             : hasUnroutedParam;
+        if (hookedPlatform !== undefined) {
+            return (request, server) => {
+                markFramed(request);
+                // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: Bun's route table hands each handler a Request carrying the `params` it matched.
+                const params = request.params ?? EMPTY_PARAMS;
+                if (malformed(params))
+                    return fallback(request, server);
+                return this.fetchMatchedHooked(request, entry, params, hookedPlatform(request, server));
+            };
+        }
         if (capped === undefined) {
             return (request, server) => {
                 markFramed(request);
@@ -4650,26 +4936,25 @@ export class Server {
             return runNative(request, params);
         };
     }
-    /** Compile portable route registrations into Bun's native route table. Apps with request-rewrite
-     * hooks or WebSockets retain the single portable dispatcher because those features must run before
-     * route selection/upgrade.
+    /** Compile portable route registrations into Bun's native route table. Paths a composed mount or
+     * a WebSocket handshake may reach stay with the portable dispatcher; provably disjoint HTTP routes
+     * keep native matching. Request hooks run before the matched route and rewrites return to dispatch.
      *
      * Bun and the portable router agree on which of two static-and-`:param` paths wins a request, so
      * the table is kept to those paths. Where Bun would otherwise pass a request on to a less specific
      * path, the more specific one carries `fallback`, the portable dispatcher, under that method.
      * `peer` is the platform every request served from the table shares. */
-    buildBunNativeRoutes(fallback, peer) {
-        // A `clientIp` trust declaration must run the resolver in `dispatch`, which the fused native lane
-        // bypasses - so an app that declares trust routes through the fetch lane (where `c.clientIp`
-        // resolves) instead of Bun's native table. The allocation-free default keeps native fusion.
-        if ((this.onRequestHooks.length > 0 && !this.bunNativeRequestHooksSafe) ||
-            this.wsRoutes.length > 0 ||
-            this.preRouteMountCount > 0 ||
-            this.clientIpTrust !== undefined) {
+    buildBunNativeRoutes(fallback, peer, platformFor) {
+        const hooked = this.onRequestHooks.length > 0 && !this.bunNativeRequestHooksSafe;
+        if ((hooked && platformFor === undefined) ||
+            // A hook may rewrite a handshake onto a socket path, which only the dispatcher's upgrade check follows.
+            (hooked && this.wsRoutes.length > 0) ||
+            this.mountsTakeUpgrades()) {
             return undefined;
         }
         const routes = Object.create(null);
-        const mayUseFusedNative = this.requestTimeoutMs === 0 &&
+        const mayUseFusedNative = !hooked &&
+            this.requestTimeoutMs === 0 &&
             (this.onResponseHooks.length === 0 || this.bunNativeResponseHeadersOnly) &&
             this.onResponseFinalizedHooks.length === 0 &&
             // The capacity gate must wrap every request; the fused lane bypasses fetchMatched, so enabling
@@ -4679,28 +4964,49 @@ export class Server {
         const unboundedBudget = mayUseFusedNative ? getUnboundedRequestBudget() : undefined;
         let count = 0;
         const all = this.catalog.entries();
+        const preRouteMounts = this.fetchMounts.filter((mount) => mount.beforeRoutes);
         // A path with a wildcard or a part-literal segment cannot go in the table: Bun reads `/:name.json`
         // as one parameter named `name.json`. These are filed under each run of static segments they
         // start with, which is where a table path they could outrank looks for them.
         const under = new Map();
+        const fileUnder = (segments) => {
+            let prefix = "";
+            for (const segment of segments) {
+                let bucket = under.get(prefix);
+                if (bucket === undefined) {
+                    bucket = [];
+                    under.set(prefix, bucket);
+                }
+                bucket.push(segments);
+                if (segment.kind !== "static")
+                    break;
+                prefix += `/${segment.value}`;
+            }
+        };
+        // A handshake is a GET the portable dispatcher gives to a socket route before any HTTP route, so a
+        // socket path is outside the table like a wildcard path, and a GET route a request may share with
+        // one stays with the dispatcher.
+        const sockets = this.wsRoutes.map((route) => compileRoutePattern(route.path).segments);
+        for (const segments of sockets)
+            fileUnder(segments);
         const lead = all.map((route) => {
             const segments = route.pattern.segments;
             const plain = segments.every((segment) => segment.kind === "static" || segment.kind === "param");
+            if (!plain)
+                fileUnder(segments);
             let prefix = "";
             for (const segment of segments) {
-                if (!plain) {
-                    let bucket = under.get(prefix);
-                    if (bucket === undefined) {
-                        bucket = [];
-                        under.set(prefix, bucket);
-                    }
-                    bucket.push(route);
-                }
                 if (segment.kind !== "static")
                     break;
                 prefix += `/${segment.value}`;
             }
-            return plain ? prefix : undefined;
+            // Mounts take every method under their literal prefix before route matching. A parameter may
+            // fill the rest of that prefix, but a static route ending above the mount cannot reach it.
+            // Conservative by design: only the leading static run proves a dynamic route disjoint.
+            const mayHitMount = preRouteMounts.some((mount) => underMountPrefix(prefix, mount.path) ||
+                (route.pattern.paramNames.length > 0 &&
+                    (prefix === "" || underMountPrefix(mount.path, prefix))));
+            return plain && !mayHitMount ? prefix : undefined;
         });
         // A preflight hook is intentionally handled by the fallback fetch path. Keeping OPTIONS out
         // of the native lane means Bun dispatches it through CORS's onRequest hook even when the
@@ -4726,14 +5032,21 @@ export class Server {
                 entry.idempotent !== undefined ||
                 !BUN_TABLE_METHODS.includes(method) ||
                 (preflightOnFallback && method === "OPTIONS") ||
-                under.get(run)?.some((other) => outranks(other.pattern.segments, pattern.segments))) {
+                under.get(run)?.some((other) => outranks(other, pattern.segments)) ||
+                (method === "GET" && sockets.some((socket) => mayShareRequest(socket, pattern.segments)))) {
                 continue;
             }
             const paramNames = pattern.paramNames;
             const fused = mayUseFusedNative ? entry.execution.fusedWeb : undefined;
-            const handler = this.compileBunNativeHandler(entry, paramNames, fused, unboundedSignal, unboundedBudget, peer, fallback);
-            // The table matched the target as sent; one `fetch` refuses or rewrites goes through it.
-            tableAt(path, pattern.segments)[method] = (request, server) => requestTarget(request) ? fallback(request, server) : handler(request, server);
+            const handler = this.compileBunNativeHandler(entry, method, paramNames, fused, unboundedSignal, unboundedBudget, peer, fallback, hooked ? platformFor : undefined);
+            // The table matched the target as sent; one `fetch` refuses or rewrites goes through it. Left
+            // off, `validateHost` costs nothing here: the table holds no wildcard, a `..` parameter falls
+            // back, and reading the Host on every request measured about 6% of a bare route.
+            tableAt(path, pattern.segments)[method] = this.validateHost
+                ? (request, server) => requestTarget(request, true, this.normalizeTarget)
+                    ? fallback(request, server)
+                    : handler(request, server)
+                : handler;
             count += 1;
             if (paramNames.length > 0) {
                 below.add(pattern.segments.length + method);
@@ -4787,11 +5100,17 @@ export class Server {
      * nothing - so any endpoint slower than 10s (a render, an export, a long upstream call) has its
      * connection cut mid-flight regardless of `requestTimeoutMs`. Apps with such endpoints must raise
      * this above their slowest expected response, which is why it is a first-class option and not a
-     * reason to drop down to `Bun.serve`. `0` disables the timeout entirely; max 255.
+     * reason to drop down to `Bun.serve`, or hold those requests' connections alone with
+     * `withIdleTimeout()` from `@nifrajs/core/idle-timeout`. `0` disables the timeout entirely; max 255.
      *
      * `tls` serves HTTPS directly: `app.listen(443, { tls: { cert, key } })` with PEM text or bytes.
      * Requests then arrive with `https:` URLs. Behind a proxy or a platform that terminates TLS, leave
      * it unset.
+     *
+     * `static` sees every request before the app does, the ones Bun's route table serves included, so
+     * a file it answers wins over any route at the same path. It returns the file's response, or
+     * `undefined` to let the app route the request. No hook of the app runs for a request it answers.
+     * `@nifrajs/web`'s Bun build serves its client bundle and public files this way.
      */
     listen(port, options) {
         if (typeof Bun === "undefined") {
@@ -4844,6 +5163,10 @@ export class Server {
                 return jsonError(500, "internal_error");
             },
         };
+        const idleTimeoutSec = options?.idleTimeoutSec ?? BUN_IDLE_TIMEOUT_SEC;
+        const setIdleTimeout = (request, seconds) => 
+        // biome-ignore lint/plugin/noChainedTypeAssertions lint/plugin/requireSafetyCommentForTypeAssertion: `running` is the Bun `Server` this call started (`RunningServer` publishes a subset of it), and every source a Bun listener routes is a `Request`.
+        running.timeout(request, seconds ?? idleTimeoutSec);
         const fallback = (req, server) => {
             // Bun has already framed and bounded this request body in its HTTP parser. Mark the
             // source before the portable fallback runs so body schemas use Bun's native `json()`
@@ -4851,25 +5174,59 @@ export class Server {
             // Requests. Native route handlers mark themselves in compileBunNativeHandler; this
             // covers every request the native lane does not serve.
             markTrustedBodyFraming(req);
-            return this.fetch(req, bunPeerPlatform(server, req));
+            return this.fetch(req, new BunPeerPlatform(server, req, setIdleTimeout));
         };
         // Bun names the socket peer of a request when its server is asked. A request served from the
         // native table carries this one platform, which asks only when a handler reads `c.clientIp`.
+        const socketPeer = (request) => running.requestIP(request)?.address;
+        // A `clientIp` trust declaration resolves here too, from the request's headers, when a handler reads
+        // the address; only a declaration of zero hops names the socket peer.
+        const trust = this.clientIpTrust;
         const peer = {
-            [PLATFORM_PEER]: (request) => running.requestIP(request)?.address,
+            [PLATFORM_PEER]: trust === undefined
+                ? socketPeer
+                : (request) => resolveClientIp(!("header" in trust) && trust.trustedHops === 0 ? socketPeer(request) : undefined, 
+                // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: every source a Bun listener routes is a `Request`.
+                request, trust),
+            [PLATFORM_IDLE_TIMEOUT]: setIdleTimeout,
         };
-        const nativeRoutes = wsHandlers === undefined ? this.buildBunNativeRoutes(fallback, peer) : undefined;
+        const nativeRoutes = this.buildBunNativeRoutes(fallback, peer, (request, server) => 
+        // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: `fallback` hands `fetch` the same platform, which holds no environment.
+        new BunPeerPlatform(server, request, setIdleTimeout));
+        const first = options?.static;
+        const before = (inner) => first === undefined
+            ? inner
+            : (req, server) => {
+                const answer = first(req);
+                if (answer === undefined)
+                    return inner(req, server);
+                return answer instanceof Promise
+                    ? answer.then((response) => response ?? inner(req, server))
+                    : answer;
+            };
+        // Bun runs a table handler without `fetch`, so each one gets the same front as the fallback.
+        if (first !== undefined && nativeRoutes !== undefined) {
+            for (const path in nativeRoutes) {
+                const methods = nativeRoutes[path];
+                for (const method of BUN_TABLE_METHODS) {
+                    const handler = methods[method];
+                    if (handler !== undefined)
+                        methods[method] = before(handler);
+                }
+            }
+        }
         const sockets = new Set();
         this.bunSockets = sockets;
         const running = (wsHandlers === undefined
             ? Bun.serve({
                 ...listening,
                 ...(nativeRoutes === undefined ? {} : { routes: nativeRoutes }),
-                fetch: fallback,
+                fetch: before(fallback),
             })
             : Bun.serve({
                 ...listening,
-                fetch: (req, server) => this.bunFetchWithWebSocket(req, server),
+                ...(nativeRoutes === undefined ? {} : { routes: nativeRoutes }),
+                fetch: before((req, server) => this.bunFetchWithWebSocket(req, server, setIdleTimeout)),
                 // Bun's `ServerWebSocket<BunWsData>` is runtime-compatible with the handlers' structural
                 // `BunSocket` view (kept local so `Bun.*` types never leak into the published .d.ts); the
                 // `unknown` params bridge a TS structural-variance quirk. Round-trip covered by websocket.test.ts.