fulmine.js 5.0.0 → 5.1.1

package/src/router.js

@@ -25,6 +25,7 @@ const {
     canBeOptimizedWithParams,
     pathsCanOverlap,
     uwsPrefersEarlier,
+    regexpGroupKeys,
     NullObject,
     EMPTY_REGEX
 } = require("./utils.js");
@@ -77,6 +78,9 @@ class Walk {
         this.skipUntil = skipUntil;
         this.resolve = resolve;
         this.reject = reject;
+        // read only by the native pair below, which has no promise to settle once for it; the
+        // promise path leaves it false. Initialized here to keep every walk the same shape
+        this.settled = false;
         this.routeIndex = 0;
         this.route = null;
         this.callbackIndex = 0;
@@ -126,7 +130,7 @@ class Walk {
             useApp(req, router);
             // a chain that went into a mount never left it, since keepMount stops the pop, so the
             // path is still relative to it. /alone/skip must not be offered to the app as /skip
-            if (req._stack.length > 0) {
+            if (req._stack !== null && req._stack.length > 0) {
                 req._stack.length = 0;
                 req._stackMounted = 0;
                 req.path = req._originalPath;
@@ -160,7 +164,9 @@ class Walk {
             // the walk instead of becoming an unhandled rejection
             Promise.resolve(continueRoute)
                 .then((resumed) => this.runRoute(resumed))
-                .catch(this.reject);
+                // wrapped so the native pair keeps the walk as receiver; a promise's reject
+                // would not have cared
+                .catch((err) => this.reject(err));
             return;
         }
         return this.runRoute(continueRoute);
@@ -182,7 +188,7 @@ class Walk {
             return false;
         }
         this.skipUntil = startIndex > 0 ? this.routes[startIndex - 1] : undefined;
-        if (req._stack.length > 0) {
+        if (req._stack !== null && req._stack.length > 0) {
             req._stack.length = 0;
             req._stackMounted = 0;
             req.path = req._originalPath;
@@ -215,7 +221,7 @@ class Walk {
                 // Application, but the compiled mount route has no callback to do it
                 useApp(req, route.mountApp);
             }
-            req._stack.push(route.regexMount ? regexMountEntry(router, route, req) : route.path);
+            (req._stack ??= []).push(route.regexMount ? regexMountEntry(router, route, req) : route.path);
             // a use with no path consumes nothing, so everything below would work out the values
             // that are already there. Only skipped without a trailing slash, where the rules about
             // one cannot bite. An application is mostly pathless middleware, and this is per hop
@@ -232,7 +238,7 @@ class Walk {
                 req.url = req._opPath + req.urlQuery;
                 req.path = req._opPath;
                 if (req._opPath === "") {
-                    req.url = "/";
+                    req.url = "/" + req.urlQuery;
                     req.path = "/";
                 }
                 req._lastUrl = req.url;
@@ -248,6 +254,32 @@ class Walk {
         }
     }
 
+    /**
+     * A hop while the request carries an error, or over an error handler it cannot run: the
+     * handler is invoked when the error is its to catch, everything else is skipped.
+     *
+     * @param {number} kind what the callback is, one of the CALLBACK_ constants
+     * @param {Function} callback
+     */
+    errorHop(kind, callback) {
+        const req = this.req;
+        const route = this.route;
+        if (req._error && kind === CALLBACK_ERROR && route.routeKey >= req._errorKey) {
+            const out = this.router._handleError(req._error, callback, req, this.res);
+            if (out instanceof Promise) {
+                // an error handler's rejected promise moves on to the next error handler, and
+                // a bare rejection gets the error express invents for it
+                out.catch((err) => {
+                    req._error = err || new Error("Rejected promise");
+                    req._errorKey = route.routeKey;
+                    return this.step(undefined);
+                });
+            }
+            return;
+        }
+        return this.step(undefined);
+    }
+
     /**
      * One hop, which is what next() does: with nothing, run the route's next callback; with "route",
      * leave the route; with anything else, remember it as the error and carry on.
@@ -260,8 +292,13 @@ class Walk {
         const route = this.route;
         const router = this.router;
         if (thingamabob) {
-            if (thingamabob === "route") {
+            if (thingamabob === "route" || thingamabob === "router") {
                 if (route.use && !route.keepMount) {
+                    // a rewrite done inside this middleware is taken now: the pop below recomputes
+                    // req.url from the original path and would silently revert it
+                    if (req.url !== req._lastUrl) {
+                        req._absorbUrlRewrite();
+                    }
                     if (req._stack.pop() !== "") {
                         req._stackMounted--;
                     }
@@ -280,7 +317,7 @@ class Walk {
                     req.url = req._opPath + req.urlQuery;
                     req.path = req._opPath;
                     if (req._opPath === "") {
-                        req.url = "/";
+                        req.url = "/" + req.urlQuery;
                         req.path = "/";
                     }
                     req._lastUrl = req.url;
@@ -296,6 +333,16 @@ class Walk {
                         useApp(req, req.app.parent);
                     }
                 }
+                if (thingamabob === "router") {
+                    if (this.skipCheck) {
+                        // on a compiled chain, leaving the router is what running out of chain
+                        // already means: ordinary routing takes over after the mount
+                        return this.dispatch(this.routes.length);
+                    }
+                    // out of this router entirely, so whoever mounted it carries on after the
+                    // mount. The app's own walk has nobody after it, and answers 404
+                    return this.resolve(false);
+                }
                 req.routeCount++;
                 // dispatch is a plain call, so a synchronous throw would escape here instead of
                 // rejecting, as it used to when this recursed through the async _routeRequest
@@ -326,8 +373,11 @@ class Walk {
             }
             const pushedParams = callback.settings.mergeParams;
             if (pushedParams) {
-                req._paramStack.push(req.params);
+                (req._paramStack ??= []).push(req.params);
             }
+            // express restores req.params when a router hands back, so what runs after the mount
+            // sees the params it had before it
+            const parentParams = req.params;
             if (
                 callback.settings["strict routing"] &&
                 req.endsWithSlash &&
@@ -342,27 +392,36 @@ class Walk {
                     if (pushedParams) {
                         req._paramStack.pop();
                     }
+                    req.params = parentParams;
                     if (req._error) {
                         req._errorKey = route.routeKey;
                     }
                     if (routed) return this.resolve(true);
                     if (req._isOptions && req._matchedMethods.size) {
-                        // OPTIONS routing is different, it stops in the router if matched
+                        // OPTIONS routing is different, it stops in the router if matched.
+                        // Express answers as the router hands back, so a throw while answering,
+                        // a head already written being the way, walks on to later error handlers
+                        if (!req._error) {
+                            try {
+                                router._sendOptionsReply(req, res);
+                                return this.resolve(true);
+                            } catch (err) {
+                                return this.step(err);
+                            }
+                        }
                         return this.resolve(false);
                     }
                     this.step(undefined);
                 })
                 // a rejection out of the nested walk, or a throw above, must reject this one
-                // instead of dying as an unhandled rejection
-                .catch(this.reject);
+                // instead of dying as an unhandled rejection; wrapped for the native pair's
+                // receiver
+                .catch((err) => this.reject(err));
         } else {
-            // handle errors and error handlers
+            // errors and error handlers live out of line: this is the cold path, and its size
+            // was pushing step past the inlining threshold
             if (req._error || kind === CALLBACK_ERROR) {
-                if (req._error && kind === CALLBACK_ERROR && route.routeKey >= req._errorKey) {
-                    return router._handleError(req._error, callback, req, res);
-                } else {
-                    return this.step(undefined);
-                }
+                return this.errorHop(kind, callback);
             }
 
             try {
@@ -379,9 +438,10 @@ class Walk {
                 if (out instanceof Promise) {
                     // Express 5 forwards a rejected handler promise to the error middleware on its
                     // own, so there is nothing left for the "catch async errors" setting or for
-                    // express-async-errors to opt into
+                    // express-async-errors to opt into. A bare rejection carries no error, and
+                    // express invents this one for it
                     out.catch((err) => {
-                        req._error = err;
+                        req._error = err || new Error("Rejected promise");
                         req._errorKey = route.routeKey;
                         return this.step(undefined);
                     });
@@ -395,6 +455,61 @@ class Walk {
     }
 }
 
+/**
+ * The native handler's resolve, invoked as this.resolve(matched) with the walk as receiver. The
+ * promise pair _routeRequest allocates exists for callers that await; the uWS handler never did,
+ * and on the common path, where the handler answers and next() is never called, that promise
+ * never even settled: an async frame and two promises of floating garbage per request.
+ *
+ * The 404 epilogue stays on a microtask, exactly where the await used to resume: a middleware
+ * that writes after calling next() must still win the headersSent check, as it does in express.
+ * @this {Walk}
+ */
+function nativeDone(matched) {
+    if (this.settled) {
+        return;
+    }
+    this.settled = true;
+    if (!matched) {
+        queueMicrotask(() => {
+            const response = this.res;
+            if (response.headersSent || response.aborted) {
+                return;
+            }
+            try {
+                this.router._endUnmatched(this.req, response);
+            } catch (err) {
+                if (response.aborted || response.finished) {
+                    console.error(err);
+                } else {
+                    this.router._handleError(err, null, this.req, response);
+                }
+            }
+        });
+    }
+}
+
+/**
+ * The native handler's reject: answers 500 as express's final handler would, instead of dying as
+ * an unhandled rejection. Deferred like the resolve, since every rejection used to reach the
+ * handler's catch through an await.
+ * @this {Walk}
+ */
+function nativeFail(err) {
+    if (this.settled) {
+        return;
+    }
+    this.settled = true;
+    queueMicrotask(() => {
+        const response = this.res;
+        if (response.aborted || response.finished) {
+            console.error(err);
+        } else {
+            this.router._handleError(err, null, this.req, response);
+        }
+    });
+}
+
 /**
  * What a RegExp mount consumed of the path, escaped so the mount-stack join can compile it as a
  * literal. Exec runs on the same fixed-up path _pathMatches tested: a parent mount that consumed
@@ -414,6 +529,119 @@ function regexMountEntry(router, route, req) {
     return matched ? escapePathLiteral(matched[0]) : "";
 }
 
+/**
+ * The route's own params merged with those of the mounts it sits under, in express's order: an
+ * outer mount first, the route's own last. Numbered captures do not overwrite each other, they
+ * shift, so a RegExp mount capturing one group leaves the route's own group numbered from one.
+ *
+ * @param {Record<string, any>} own what this route's own pattern captured
+ * @param {Record<string, any>[]} stack the mounts, outermost first
+ * @returns {Record<string, any>}
+ */
+function mergeParams(own, stack) {
+    const merged = Object.create(null);
+    for (const params of stack) {
+        Object.assign(merged, params);
+    }
+    // both sides numbering from zero means the outer ones keep their places and these move up
+    if (own[0] !== undefined && merged[0] !== undefined) {
+        let count = 0;
+        while (merged[count] !== undefined) {
+            count++;
+        }
+        let last = 0;
+        while (own[last] !== undefined) {
+            last++;
+        }
+        for (last--; last >= 0; last--) {
+            own[last + count] = own[last];
+            if (last < count) {
+                delete own[last];
+            }
+        }
+    }
+    return Object.assign(merged, own);
+}
+
+/**
+ * The scheme and authority of an absolute request target, or "" for the ordinary kind.
+ *
+ * A request line may carry the whole URI, and express matches on the path while leaving req.url as
+ * it arrived. Same rule it uses: a "://" before any "?" means everything up to the slash after it
+ * is not path.
+ *
+ * @param {string} url
+ * @returns {string}
+ */
+function protohostOf(url) {
+    if (url.length === 0 || url.charCodeAt(0) === 0x2f) {
+        return "";
+    }
+    const searchIndex = url.indexOf("?");
+    const pathLength = searchIndex === -1 ? url.length : searchIndex;
+    const fqdnIndex = url.slice(0, pathLength).indexOf("://");
+    if (fqdnIndex === -1) {
+        return "";
+    }
+    const slash = url.indexOf("/", fqdnIndex + 3);
+    return slash === -1 ? url : url.slice(0, slash);
+}
+
+/**
+ * Fills in what dispatch reads on a request that did not come from µWS.
+ *
+ * express's router can be driven with a plain object, `router.handle({ url, method }, res, next)`,
+ * and its own tests do exactly that; so does anything mounting a router on a server of its own.
+ * Only ever called for such a request: one of ours arrives with these fields already set.
+ *
+ * req.url becomes an accessor, so the router goes on writing plain paths to it while a reader sees
+ * the absolute URI it arrived as. That keeps the protohost out of the dispatch itself.
+ *
+ * @param {any} req
+ * @param {any} router
+ */
+function adoptPlainRequest(req, router) {
+    const arrived = typeof req.url === "string" ? req.url : "";
+    const protohost = protohostOf(arrived);
+    let raw = arrived.slice(protohost.length);
+    if (protohost !== "") {
+        Object.defineProperty(req, "url", {
+            configurable: true,
+            enumerable: true,
+            get() {
+                return protohost + raw;
+            },
+            set(value) {
+                const written = String(value);
+                raw = written.startsWith(protohost) ? written.slice(protohost.length) : written;
+            }
+        });
+    }
+
+    const queryIndex = raw.indexOf("?");
+    const path = queryIndex === -1 ? raw : raw.slice(0, queryIndex);
+    req.urlQuery = queryIndex === -1 ? "" : raw.slice(queryIndex);
+    req._rawQuery = req.urlQuery.slice(1);
+    req.path = path;
+    req.originalUrl = req.originalUrl ?? arrived;
+    req._originalPath = path;
+    req.endsWithSlash = path.charCodeAt(path.length - 1) === 0x2f;
+    req._opPath = req.endsWithSlash && path !== "/" && !router.get("strict routing") ? path.slice(0, -1) : path;
+    req._lastUrl = req.url;
+    req._isOptions = req.method === "OPTIONS";
+    req._isHead = req.method === "HEAD";
+    req.params = req.params ?? Object.create(null);
+    // null, not fresh arrays: the push sites materialize them on the first mount, and most
+    // requests never see one, same as the Request constructor
+    req._stack = null;
+    req._stackMounted = 0;
+    req._paramStack = null;
+    req._matchedMethods = req._isOptions ? new Set() : null;
+    req.routeCount = 1;
+    // read when a mount is left, and there is no application here to read it from
+    req.app = req.app ?? router;
+}
+
 /**
  * Refuses a handler that could never be called, where it was written rather than on the first
  * request that reaches it. Express words both of these and applications match on the text.
@@ -421,6 +649,31 @@ function regexMountEntry(router, route, req) {
  * @param {any[]} handlers
  * @param {string} [emptyMessage] app.use() says it its own way
  */
+/**
+ * The uWS onAborted handler, bound to the response: a closure here captured two locals and cost
+ * a context plus a function per request, for a path that only ever runs on a client abort.
+ * @this {any} the response, with the request linked as this.req
+ */
+function onNativeAborted() {
+    const response = this;
+    const request = response.req;
+    // node's wording for a client abort, which is what body consumers match on
+    /** @type {NodeJS.ErrnoException} */
+    const err = new Error("aborted");
+    err.code = "ECONNRESET";
+    response.aborted = true;
+    response.finished = true;
+    // node's order on the request: 'aborted', then the stream dies, then 'close'. The
+    // error goes only to whoever listens for it, since a destroy(err) with no listener
+    // would take down the process
+    request.emit("aborted");
+    request.destroy(request.listenerCount("error") > 0 ? err : undefined);
+    response.socket?.emit("error", err);
+}
+
+/**
+ *
+ */
 function checkHandlers(handlers, emptyMessage = "argument handler is required") {
     if (handlers.length === 0) {
         throw new TypeError(emptyMessage);
@@ -449,6 +702,14 @@ function useApp(req, app) {
     if (req.res) {
         req.res.app = app;
     }
+    // an app's own request/response extensions apply while it runs: express re-parents both
+    // objects on entering a mounted app, and this is the equivalent hop
+    if (app.request && Object.getPrototypeOf(req) !== app.request) {
+        Object.setPrototypeOf(req, app.request);
+    }
+    if (app.response && req.res && Object.getPrototypeOf(req.res) !== app.response) {
+        Object.setPrototypeOf(req.res, app.response);
+    }
 }
 
 // Every verb node knows about, which is the list the methods package hands Express, and "all" on
@@ -541,10 +802,10 @@ module.exports = class Router extends EventEmitter {
         /** @type {string|string[]} */
         this.mountpath = "/";
         this.settings = settings;
+        // the base classes; an Application replaces these with its own per-app subclasses, and a
+        // plain router has no request/response prototype layer, as in Express
         this._request = Request;
         this._response = Response;
-        this.request = this._request.prototype;
-        this.response = this._response.prototype;
 
         if (typeof settings.caseSensitive !== "undefined") {
             this.settings["case sensitive routing"] = settings.caseSensitive;
@@ -554,10 +815,6 @@ module.exports = class Router extends EventEmitter {
             this.settings["strict routing"] = settings.strict;
             delete this.settings.strict;
         }
-
-        if (typeof this.settings["case sensitive routing"] === "undefined") {
-            this.settings["case sensitive routing"] = true;
-        }
     }
 
     /**
@@ -597,12 +854,35 @@ module.exports = class Router extends EventEmitter {
         // req.app.get("view engine") inside a sub-app reads the sub-app's settings and not the
         // settings of whatever handed the request over. A plain router is not an app and leaves it
         // alone, which is what Express's router.handle does too.
+        // a plain object, which is how express's router can be driven and how its own tests drive
+        // it. One of ours arrives with these set, so this costs a property read
+        if (req._opPath === undefined) {
+            if (typeof req.url !== "string" || req.url === "") {
+                // express reads the path with parseurl, which answers nothing for these, and it
+                // hands the request straight back rather than running its pathless middleware
+                return next ? next() : undefined;
+            }
+            adoptPlainRequest(req, this);
+        }
         if (this.constructor.name === "Application") {
             useApp(req, this);
         }
+        // express restores req.params when a router hands back, so the caller that ran this one
+        // sees the params it had before
+        const callerParams = req.params;
         const routed = await this._routeRequest(req, res, 0);
-        if (!routed && next) {
-            next();
+        if (!routed) {
+            req.params = callerParams;
+            if (next) {
+                // an error nobody handled belongs to the caller, as it does in express
+                const err = req._error;
+                if (err !== undefined) {
+                    delete req._error;
+                    delete req._errorKey;
+                    return next(err);
+                }
+                next();
+            }
         }
     }
 
@@ -641,8 +921,9 @@ module.exports = class Router extends EventEmitter {
     getFullMountpath(req) {
         // path-less app.use() pushes "", so a stack of only those joins to "" no matter how deep it is.
         // patternToRegex("", true) is EMPTY_REGEX, so this returns exactly what the join path would,
-        // without walking the whole stack on every hop
-        if (!req._stack.length || req._stackMounted === 0) {
+        // without walking the whole stack on every hop. _stackMounted first: it is 0 whenever
+        // _stack is still null, and req.baseUrl asks from unmounted requests too
+        if (req._stackMounted === 0 || req._stack.length === 0) {
             return EMPTY_REGEX;
         }
         const fullStack = req._stack.join("");
@@ -654,9 +935,12 @@ module.exports = class Router extends EventEmitter {
                 this._mountpathCache.clear();
             }
             // two mounts in the stack may reuse a name, which a named-group compile refuses.
-            // Nothing ever reads these groups, so they are renamed by position
-            const stackPattern = fullStack.includes(":") ? fullStack.replace(/:\w+/g, (m, at) => ":m" + at) : fullStack;
-            fullMountpath = patternToRegex(stackPattern, true);
+            // Nothing ever reads these groups, so they are renamed by position. An escaped colon
+            // is a literal one, out of a RegExp mount's matched text, and is left alone
+            const stackPattern = fullStack.includes(":")
+                ? fullStack.replace(/(\\?):(\w+)/g, (whole, escaped, name, at) => (escaped ? whole : ":m" + at))
+                : fullStack;
+            fullMountpath = patternToRegex(stackPattern, true, Boolean(this.get("case sensitive routing")));
             this._mountpathCache.set(fullStack, fullMountpath);
         }
         return fullMountpath;
@@ -675,7 +959,13 @@ module.exports = class Router extends EventEmitter {
         let path = req._opPath;
         let pattern = route.pattern;
 
-        if (req.endsWithSlash && path.endsWith("/") && !this.get("strict routing")) {
+        if (route.userRegexp) {
+            // a RegExp the application wrote is matched against the path as it arrived: express
+            // relaxes a trailing slash only for the paths it compiled itself
+            if (req.endsWithSlash && !path.endsWith("/")) {
+                path += "/";
+            }
+        } else if (req.endsWithSlash && path.endsWith("/") && !this.get("strict routing")) {
             path = path.slice(0, -1);
         }
         // the line above turns the root path into the empty string, which no pattern is written
@@ -698,6 +988,16 @@ module.exports = class Router extends EventEmitter {
         if (pattern === EMPTY_REGEX) {
             return true;
         }
+        if (route.regexMount) {
+            // a mount consumes what it matched, so the match has to start the path and break on a
+            // separator: express refuses /api/ as a mount of /test/api/1234 for that reason
+            const matched = pattern.exec(path);
+            if (!matched || path.slice(0, matched[0].length) !== matched[0]) {
+                return false;
+            }
+            const after = path[matched[0].length];
+            return after === undefined || after === "/";
+        }
         return pattern.test(path);
     }
 
@@ -720,7 +1020,14 @@ module.exports = class Router extends EventEmitter {
         const paths = Array.isArray(path) ? path : [path];
         const routes = [];
         for (let path of paths) {
-            if (!this.get("strict routing") && typeof path === "string" && path.endsWith("/") && path !== "/") {
+            // a mount always drops it, strict routing or not: strictness is about the end of a
+            // path, and a mount has none. Express registers its use layers with strict off
+            if (
+                (method === "USE" || !this.get("strict routing")) &&
+                typeof path === "string" &&
+                path.endsWith("/") &&
+                path !== "/"
+            ) {
                 path = path.slice(0, -1);
             }
             if (path === "*") {
@@ -730,7 +1037,11 @@ module.exports = class Router extends EventEmitter {
                 method: method === "USE" ? "ALL" : method,
                 path,
                 pattern:
-                    method === "USE" || needsConversionToRegex(path) ? patternToRegex(path, method === "USE") : path,
+                    method === "USE" || needsConversionToRegex(path)
+                        ? // Boolean, not the raw value: an unset setting reads undefined, which a
+                          // default parameter would silently turn back into case-sensitive
+                          patternToRegex(path, method === "USE", Boolean(this.get("case sensitive routing")))
+                        : path,
                 callbacks,
                 // instanceof walks a prototype chain and length is a property load, and both used
                 // to run for every callback of every hop
@@ -744,6 +1055,8 @@ module.exports = class Router extends EventEmitter {
                 // a mount written as a RegExp matches a piece of path that is not known until a
                 // request comes in, so its stack entry cannot be the path itself
                 regexMount: method === "USE" && path instanceof RegExp,
+                // written by the application, so express matches it as it stands
+                userRegexp: path instanceof RegExp,
                 routeKey: routeKey++,
                 // the router this was registered on. Ordinary dispatch is done by that router, so
                 // it could ask itself, but an optimized chain is walked by the app whatever it
@@ -758,9 +1071,11 @@ module.exports = class Router extends EventEmitter {
                 gettable: method === "GET" || method === "HEAD"
             };
             if (
-                typeof route.path === "string" &&
-                (route.path.includes(":") || route.path.includes("*") || route.path.includes("{")) &&
-                route.pattern instanceof RegExp
+                route.pattern instanceof RegExp &&
+                // a RegExp the application wrote: its capture groups are params too
+                (path instanceof RegExp ||
+                    (typeof route.path === "string" &&
+                        (route.path.includes(":") || route.path.includes("*") || route.path.includes("{"))))
             ) {
                 route.complex = true;
             }
@@ -785,6 +1100,12 @@ module.exports = class Router extends EventEmitter {
         // a route with a parameter matches paths its own text does not, so what an earlier route
         // could answer is compared shape against shape and not against that text
         const withParams = typeof route.path === "string" && route.path.includes(":");
+        // under insensitive routing two paths that differ only in case answer the same requests,
+        // so the text comparisons below run on the folded form. µWS itself still matches bytes:
+        // a request in the registered case takes the chain, any other case takes the fallback,
+        // and both answer as express would as long as the chain agrees with registration order
+        const caseSensitive = Boolean(this.get("case sensitive routing"));
+        const routePathFolded = caseSensitive || typeof route.path !== "string" ? route.path : route.path.toLowerCase();
 
         for (let i = 0; i < routes.length; i++) {
             const r = routes[i];
@@ -802,11 +1123,38 @@ module.exports = class Router extends EventEmitter {
                 }
             }
 
+            // a RegExp mount runs only where its match starts the path and breaks on a separator,
+            // which is decidable here against a literal path and not against one with a parameter
+            if (r.regexMount) {
+                const matched = typeof route.path === "string" ? r.pattern.exec(route.path) : null;
+                const runsAlways =
+                    matched !== null &&
+                    !matched[0].includes(":") &&
+                    route.path.slice(0, matched[0].length) === matched[0] &&
+                    (route.path.length === matched[0].length || route.path[matched[0].length] === "/");
+                if (runsAlways) {
+                    if (r.callbacks.some((c) => c instanceof Router)) {
+                        return false;
+                    }
+                    optimizedPath.push(r);
+                    continue;
+                }
+                // it may still answer some of the paths this route matches, and the chain has no
+                // way to say "only sometimes"
+                if (matched !== null || withParams) {
+                    return false;
+                }
+                continue;
+            }
+
             // check if the paths match. A route with parameters is excluded from the text test:
             // its literal ":name" text would let an earlier regex in on requests it never matches
             if (
                 (r.pattern instanceof RegExp && (!withParams || r.use) && r.pattern.test(route.path)) ||
-                (typeof r.pattern === "string" && (r.pattern === route.path || r.pattern === "/*"))
+                (typeof r.pattern === "string" &&
+                    (r.pattern === route.path ||
+                        (!caseSensitive && r.pattern.toLowerCase() === routePathFolded) ||
+                        r.pattern === "/*"))
             ) {
                 if (r.callbacks.some((c) => c instanceof Router)) {
                     return false; // cant optimize nested routers with matches
@@ -822,15 +1170,17 @@ module.exports = class Router extends EventEmitter {
             if (typeof r.path !== "string" || !canBeOptimizedWithParams(r.path)) {
                 return false;
             }
-            if (!pathsCanOverlap(r.path, route.path, r.use)) {
+            const rPathFolded = caseSensitive ? r.path : r.path.toLowerCase();
+            if (!pathsCanOverlap(rPathFolded, routePathFolded, r.use)) {
                 continue;
             }
             if (r.use) {
                 return false;
             }
             // the same path lands on the same µWS registration, so the earlier route runs first
-            // from inside the chain, under its own parameter names
-            if (r.path === route.path) {
+            // from inside the chain, under its own parameter names; a case variant of it lands on
+            // its own registration, whose chain was computed the same way, or on the fallback
+            if (rPathFolded === routePathFolded) {
                 if (r.callbacks.some((c) => c instanceof Router)) {
                     return false;
                 }
@@ -838,8 +1188,14 @@ module.exports = class Router extends EventEmitter {
                 continue;
             }
             // otherwise the two overlap only where µWS itself hands the request to the earlier,
-            // more specific registration, so this chain never sees those paths
-            if (!r.optimizedPath || !uwsPrefersEarlier(r.path, route.path)) {
+            // more specific registration, so this chain never sees those paths. That argument is
+            // about bytes, so under insensitive routing it only holds when no literal hides
+            // behind a case difference
+            if (
+                !r.optimizedPath ||
+                !uwsPrefersEarlier(r.path, route.path) ||
+                (!caseSensitive && (r.path !== rPathFolded || route.path !== routePathFolded))
+            ) {
                 return false;
             }
         }
@@ -854,7 +1210,7 @@ module.exports = class Router extends EventEmitter {
      * needs every route to have been registered first.
      */
     _compileOptimizedRoutes() {
-        if (!this.uwsApp || !this.get("case sensitive routing")) {
+        if (!this.uwsApp) {
             return;
         }
 
@@ -862,15 +1218,16 @@ module.exports = class Router extends EventEmitter {
         const walk = (router, pathPrefix, chainPrefix) => {
             for (const route of router._routes) {
                 if (route.use) {
-                    // only sole-callback mounts, and only into routers that match with the same
-                    // case rules as µWS: the Walk fallback honours the child's setting, µWS cannot
+                    // only sole-callback mounts. Case rules do not gate the walk: each level's
+                    // _optimizeRoute guards its own routes under its own setting, and a request
+                    // in any other case than the registered one takes the fallback, which
+                    // honours the child's setting on its own
                     if (
                         !route.complex &&
                         canBeOptimized(route.path) &&
                         route.path !== "/*" &&
                         route.callbacks.length === 1 &&
-                        route.callbacks[0] instanceof Router &&
-                        route.callbacks[0].get("case sensitive routing")
+                        route.callbacks[0] instanceof Router
                     ) {
                         let pathToMount = router._optimizeRoute(route, router._routes);
                         if (!pathToMount) {
@@ -921,6 +1278,10 @@ module.exports = class Router extends EventEmitter {
                             continue;
                         }
                     }
+                    // the prefix goes in whether or not the mount had a path: a pathless mount
+                    // adds nothing to the path and everything to the chain, the middlewares in
+                    // front of it and the mount entry that says where to resume
+                    const chain = chainPrefix.length > 0 ? [...chainPrefix, ...leafPath] : leafPath;
                     if (pathPrefix) {
                         const registered = {
                             ...route,
@@ -928,7 +1289,7 @@ module.exports = class Router extends EventEmitter {
                             pattern: pathPrefix + route.path,
                             optimizedRouter: true
                         };
-                        this._registerUwsRoute(registered, [...chainPrefix, ...leafPath]);
+                        this._registerUwsRoute(registered, chain);
                         // the chain holds the original object, so the request-time guard has to
                         // find the computed fields there, or a mounted param route extracts its
                         // params twice. The names match: the prefix is static, so the copy's path
@@ -936,7 +1297,7 @@ module.exports = class Router extends EventEmitter {
                         route.optimizedParams = registered.optimizedParams;
                         route.optimizedPath = registered.optimizedPath;
                     } else {
-                        this._registerUwsRoute(route, leafPath);
+                        this._registerUwsRoute(route, chain);
                     }
                 }
             }
@@ -947,33 +1308,21 @@ module.exports = class Router extends EventEmitter {
 
     /**
      * Wraps a uWS request and response in ours and links them, which is the first thing every
-     * request does whichever path serves it.
+     * request does whichever path serves it. The response rides back as request.res: returning
+     * a `{ request, response }` pair was one throwaway object per request.
      *
      * @param {any} res uWS response
      * @param {any} req uWS request, readable only during this call
-     * @returns {{request: any, response: any}}
+     * @returns {any} the request, with the response reachable as request.res
      */
     handleRequest(res, req) {
         const request = new this._request(req, res, this);
         const response = new this._response(res, request, this);
         request.res = response;
         response.req = request;
-        res.onAborted(() => {
-            // node's wording for a client abort, which is what body consumers match on
-            /** @type {NodeJS.ErrnoException} */
-            const err = new Error("aborted");
-            err.code = "ECONNRESET";
-            response.aborted = true;
-            response.finished = true;
-            // node's order on the request: 'aborted', then the stream dies, then 'close'. The
-            // error goes only to whoever listens for it, since a destroy(err) with no listener
-            // would take down the process
-            request.emit("aborted");
-            request.destroy(request.listenerCount("error") > 0 ? err : undefined);
-            response.socket?.emit("error", err);
-        });
+        res.onAborted(onNativeAborted.bind(response));
 
-        return { request, response };
+        return request;
     }
 
     /**
@@ -989,6 +1338,9 @@ module.exports = class Router extends EventEmitter {
      * @returns {boolean}
      */
     _isFollowedByAnOverlap(route, routes) {
+        // folded under insensitive routing, where a case variant answers the same requests
+        const caseSensitive = Boolean(this.get("case sensitive routing"));
+        const routePath = caseSensitive ? route.path : route.path.toLowerCase();
         for (let i = routes.length - 1; i >= 0; i--) {
             const later = routes[i];
             if (later.routeKey <= route.routeKey) {
@@ -1002,7 +1354,7 @@ module.exports = class Router extends EventEmitter {
                 return true;
             }
             if (typeof later.path === "string" && canBeOptimizedWithParams(later.path)) {
-                if (pathsCanOverlap(route.path, later.path)) {
+                if (pathsCanOverlap(routePath, caseSensitive ? later.path : later.path.toLowerCase())) {
                     return true;
                 }
                 continue;
@@ -1030,34 +1382,36 @@ module.exports = class Router extends EventEmitter {
             route.optimizedParams = route.path.match(regExParam).map((p) => p.slice(1));
         }
         const makeHandler = (chain) => {
-            // both are registration-time constants: computing them in the handler was a closure
-            // and a scan of the chain on every native request.
+            // all three are registration-time constants: computing them in the handler was a
+            // closure and a scan of the chain on every native request.
             // Falling back resumes after the mount, not after the router's leaf: the leaf can have
             // a lower routeKey than the parent's middlewares, and an error handler declared before
             // the mount must not catch what the router threw
             const mount = chain.find((r) => r.keepMount);
             const skipUntil = mount ?? chain[chain.length - 1];
-            return async (res, req) => {
-                const { request, response } = this.handleRequest(res, req);
-                if (route.optimizedParams) {
+            const optimizedParams = route.optimizedParams;
+            // not async, and no _routeRequest: its promise pair exists for callers that await,
+            // and this one never did. nativeDone and nativeFail defer their epilogues to a
+            // microtask, which is where the await used to resume, so the visible order holds
+            return (res, req) => {
+                const request = this.handleRequest(res, req);
+                const response = request.res;
+                if (optimizedParams) {
                     request.optimizedParams = new NullObject();
-                    for (let i = 0; i < route.optimizedParams.length; i++) {
-                        request.optimizedParams[route.optimizedParams[i]] = req.getParameter(i);
+                    for (let i = 0; i < optimizedParams.length; i++) {
+                        request.optimizedParams[optimizedParams[i]] = req.getParameter(i);
                     }
                 }
+                const walk = new Walk(this, request, response, chain, true, skipUntil, nativeDone, nativeFail);
                 try {
-                    const matchedRoute = await this._routeRequest(request, response, 0, chain, true, skipUntil);
-                    if (!matchedRoute && !response.headersSent && !response.aborted) {
-                        this._endUnmatched(request, response);
-                    }
+                    walk.dispatch(0);
                 } catch (err) {
-                    // an internal throw answers 500 as express's final handler would, instead of
-                    // dying as an unhandled rejection
-                    if (response.aborted || response.finished) {
-                        console.error(err);
-                    } else {
-                        this._handleError(err, null, request, response);
-                    }
+                    // what a throw inside a promise executor did: reject, once
+                    nativeFail.call(walk, err);
+                } finally {
+                    // whatever runs after this line is outside the cork uWS held for this
+                    // callback, so later writes have to open their own
+                    response._corkNeeded = true;
                 }
             };
         };
@@ -1072,13 +1426,16 @@ module.exports = class Router extends EventEmitter {
         const realFn = fn;
         const headFn = getChain.length === optimizedPath.length ? realFn : makeHandler(optimizedPath);
 
+        // the response prototype the route will really run under: its own app's, which sees a
+        // method patched there or inherited from a parent app, falling back to the registering app
+        const responseProto = /** @type {any} */ (route.owner)?.response ?? /** @type {any} */ (this).response;
         // check if route is declarative
         if (
             optimizedPath.length === 1 && // must not have middlewares
             route.callbacks.length === 1 && // must not have multiple callbacks
             typeof route.callbacks[0] === "function" && // must be a function
             route.paramCallbacks.size === 0 && // a param callback has to run, and this answers without running anything
-            !resDecMethods.some((method) => resCodes[method] !== this.response[method].toString()) && // must not have injected methods
+            !resDecMethods.some((method) => resCodes[method] !== responseProto[method].toString()) && // must not have injected methods
             this.get("declarative responses") // must have declarative responses enabled
         ) {
             const decRes = compileDeclarative(route.callbacks[0], this);
@@ -1116,11 +1473,18 @@ module.exports = class Router extends EventEmitter {
      */
     _handleError(err, handler, request, response) {
         if (handler) {
-            return handler(err, request, response, (pass) => {
+            const next = (pass) => {
                 delete request._error;
                 delete request._errorKey;
                 return request.next(pass);
-            });
+            };
+            try {
+                return handler(err, request, response, next);
+            } catch (thrown) {
+                // what an error handler throws is the error the next one gets
+                request._error = thrown;
+                return request.next(thrown);
+            }
         }
         console.error(err);
         if (response.statusCode === 200) {
@@ -1165,23 +1529,30 @@ module.exports = class Router extends EventEmitter {
         // Object.create(null) rather than the { __proto__: null } literal, which is the same object
         // for 9ns more. Null-prototyped either way, as Express 5 makes params.
         const obj = Object.create(null);
-        if (!match?.groups) {
+        if (!match) {
             return obj;
         }
 
-        const groups = match.groups;
         const meta = getPatternMeta(pattern);
         if (meta === undefined) {
-            // a RegExp the application supplied itself, which was never compiled here
-            for (const name in groups) {
-                const value = groups[name];
+            // a RegExp the application supplied itself, which was never compiled here: every
+            // capture group lands in params, named ones under their name and the rest under their
+            // position, which is what express does with one
+            const keys = regexpGroupKeys(pattern);
+            for (let i = 1; i < match.length; i++) {
+                const value = match[i];
                 if (value === undefined) {
                     continue;
                 }
-                obj[name] = decodeParam(value);
+                obj[keys[i - 1]] = decodeParam(value);
             }
             return obj;
         }
+        if (!match.groups) {
+            return obj;
+        }
+
+        const groups = match.groups;
 
         // asking for each name in turn rather than walking the groups object, which is a
         // null-prototype dictionary and slow to enumerate, and reading the wildcard answer that was
@@ -1229,7 +1600,7 @@ module.exports = class Router extends EventEmitter {
             }
         } else if (route.complex) {
             let path = req._originalPath;
-            if (req._stack.length > 0) {
+            if (req._stack !== null && req._stack.length > 0) {
                 const fullMountpath = this.getFullMountpath(req);
                 if (fullMountpath !== EMPTY_REGEX) {
                     path = path.replace(fullMountpath, "");
@@ -1245,29 +1616,15 @@ module.exports = class Router extends EventEmitter {
                 req._errorKey = route.routeKey;
                 return "route";
             }
-            if (req._paramStack.length > 0) {
-                // express's mergeParams order: later mounts override earlier ones, and the
-                // route's own extraction wins over all of them
-                const own = req.params;
-                const merged = Object.create(null);
-                for (const params of req._paramStack) {
-                    Object.assign(merged, params);
-                }
-                req.params = Object.assign(merged, own);
+            if (req._paramStack !== null && req._paramStack.length > 0) {
+                req.params = mergeParams(req.params, req._paramStack);
             }
         } else {
             // express 5 gives every matched route null-prototype params; only a pathless
             // middleware layer keeps the plain object, as its router hands one to fast_slash
             req.params = route.use && route.path === "" ? {} : Object.create(null);
-            if (req._paramStack.length > 0) {
-                // express's mergeParams order: later mounts override earlier ones, and the
-                // route's own extraction wins over all of them
-                const own = req.params;
-                const merged = Object.create(null);
-                for (const params of req._paramStack) {
-                    Object.assign(merged, params);
-                }
-                req.params = Object.assign(merged, own);
+            if (req._paramStack !== null && req._paramStack.length > 0) {
+                req.params = mergeParams(req.params, req._paramStack);
             }
         }
 
@@ -1389,6 +1746,12 @@ module.exports = class Router extends EventEmitter {
         if (typeof name !== "string" && !Array.isArray(name)) {
             throw new TypeError("argument name must be a string");
         }
+        if (fn === undefined) {
+            throw new TypeError("argument fn is required");
+        }
+        if (typeof fn !== "function") {
+            throw new TypeError("argument fn must be a function");
+        }
         const names = Array.isArray(name) ? name : [name];
         for (const key of names) {
             if (!this._paramCallbacks.has(key)) {
@@ -1490,6 +1853,29 @@ module.exports = class Router extends EventEmitter {
         response.send(err);
     }
 
+    /**
+     * The automatic OPTIONS reply, built from the methods the walk collected. Throws instead of
+     * answering when the head has already been written, which is what node's setHeader would do
+     * and what lets an error handler see it, as in Express.
+     *
+     * @param {any} request
+     * @param {any} response
+     */
+    _sendOptionsReply(request, response) {
+        if (response._headWritten) {
+            throw new Error("Cannot set headers after they are sent to the client");
+        }
+        // Express 5 sorts the methods and joins them with ", ", so the header reads the same
+        // regardless of the order the routes happened to be registered in
+        const allowedMethods = Array.from(request._matchedMethods).sort().join(", ");
+        response.setHeader("Allow", allowedMethods);
+        // the router package answers this one itself, with a plain-text body, the nosniff
+        // header and end() rather than send(), so no ETag comes with it
+        response.setHeader("Content-Type", "text/plain");
+        response.setHeader("X-Content-Type-Options", "nosniff");
+        response.end(allowedMethods);
+    }
+
     /**
      * How a request that nothing answered ends: with the error it carries, with the automatic
      * OPTIONS reply, or with a 404. The native chain, the app's catch-all handler and the node shim
@@ -1503,15 +1889,12 @@ module.exports = class Router extends EventEmitter {
             return this._handleError(request._error, null, request, response);
         }
         if (request._isOptions && request._matchedMethods.size > 0) {
-            // Express 5 sorts the methods and joins them with ", ", so the header reads the same
-            // regardless of the order the routes happened to be registered in
-            const allowedMethods = Array.from(request._matchedMethods).sort().join(", ");
-            response.setHeader("Allow", allowedMethods);
-            // the router package answers this one itself, with a plain-text body, the nosniff
-            // header and end() rather than send(), so no ETag comes with it
-            response.setHeader("Content-Type", "text/plain");
-            response.setHeader("X-Content-Type-Options", "nosniff");
-            response.end(allowedMethods);
+            try {
+                this._sendOptionsReply(request, response);
+            } catch (err) {
+                // a head already written: the error answers instead, as express's does
+                this._handleError(err, null, request, response);
+            }
             return;
         }
         response.status(404);