fulmine.js 5.19.2 → 5.19.4

package/src/router.js

@@ -22,1543 +22,68 @@ const {
     getPatternMeta,
     decodeParam,
     needsConversionToRegex,
-    canBeOptimized,
     canBeOptimizedWithParams,
     pathsCanOverlap,
-    uwsPrefersEarlier,
     regexpGroupKeys,
     NullObject,
+    headersSentError,
     EMPTY_REGEX,
     settingsEpoch
 } = require("./utils.js");
 const Response = require("./response.js");
 const Request = require("./request.js");
 const { EventEmitter } = require("tseep");
-const compileDeclarative = require("./declarative.js");
 const statuses = require("statuses");
 const { METHODS } = require("http");
 const { isNodeRequest, serveNodeRequest } = require("./node-shim.js");
-const { chainUsage, kGetSafe } = require("./usage.js");
+const { kGetSafe } = require("./usage.js");
 const { checkBehavior } = require("./websocket.js");
-
-// whether a registered path could be asked for in another case, which is what decides whether the
-// native router can be trusted to prefer it, see _optimizeRoute
-const HAS_LETTER = /[a-zA-Z]/;
+const { HotSettings, settingsWriteTraps } = require("./hot-settings.js");
+const Walk = require("./walk.js");
+const { useRouterClass, optimizeRoute, compileOptimizedRoutes, registerUwsRoute } = require("./optimizer.js");
+const {
+    layerFor,
+    routeLayer,
+    nativeDone,
+    nativeFail,
+    ownParamNames,
+    mergesParams,
+    EMPTY_INDICES,
+    buildLiteralIndex,
+    firstAtLeast,
+    mergeParams,
+    adoptPlainRequest,
+    logError,
+    onNativeAborted,
+    checkHandlers,
+    CALLBACK_PLAIN,
+    CALLBACK_ERROR,
+    CALLBACK_ROUTER,
+    raiseDecodeFailure,
+    stepsOver,
+    useApp,
+    methods,
+    callablePrototypeFor,
+    generateErrorPageHtml
+} = require("./router-utils.js");
+
+/** @typedef {import("./router-utils.js").RouteEntry} RouteEntry */
+/** @typedef {import("./router-utils.js").SkipHolder} SkipHolder */
+/** @typedef {import("./router-utils.js").NativePreset} NativePreset */
+/** @typedef {import("./router-utils.js").Layer} Layer */
+/** @typedef {import("./router-utils.js").WsRoute} WsRoute */
+/** @typedef {import("uWebSockets.js").HttpRequest} UwsRequest */
+/** @typedef {import("uWebSockets.js").HttpResponse} UwsResponse */
 
 // hands out one number per app.route(), so the routes it creates know they belong together
 let routeGroups = 0;
 
-// The settings the request and response hot paths read, resolved to plain fields: each read was a
-// variadic get() whose rest array escapes into createRoute, plus a dictionary miss per mount level
-// for the json keys, which have no default. One shape for every router, stale when the epoch moves.
-class HotSettings {
-    /** Every field declared up front, one hidden class for every router's copy. */
-    constructor() {
-        this.epoch = 0;
-        this.xPoweredBy = false;
-        this.etagFn = undefined;
-        // null means every method, which is express's behaviour and the default
-        this.etagMethods = null;
-        this.queryParserFn = undefined;
-        this.trustProxyFn = undefined;
-        this.trustProxyProtocol = false;
-        this.jsonEscape = undefined;
-        this.jsonReplacer = undefined;
-        this.jsonSpaces = undefined;
-    }
-}
-
-/**
- * Whether an earlier route would have answered this path had case not mattered. A guard is a
- * folded string when the earlier path is a literal, and an insensitive pattern when it has
- * parameters of its own.
- *
- * The string side is compared character by character rather than through toLowerCase, because it
- * sits on the hot path of every parameter route that has an earlier literal, and saying no must
- * allocate nothing.
- *
- * @param {(string|RegExp)[]} guards
- * @param {string} path the path as it arrived
- * @returns {boolean}
- */
-function anyGuardHits(guards, path) {
-    for (let i = 0; i < guards.length; i++) {
-        const guard = guards[i];
-        if (typeof guard !== "string") {
-            if (guard.test(path)) {
-                return true;
-            }
-            continue;
-        }
-        // the guard is a registered path, which under the default routing answers the same path
-        // with one trailing slash as well: "/x1" registered is what serves "/x1/", so "/X1/" is
-        // just as much a case variant of it as "/X1" is. Missing that answered "/X1/" from the
-        // parameter route behind it while express answered from the literal.
-        //
-        // The regex guards, for earlier paths that carry parameters of their own, are built
-        // non-strict and already accept it. Erring wide costs nothing here either: a guard that
-        // hits only hands the request to the generic router, which is where express's own order
-        // decides anyway
-        const slashed = path.length === guard.length + 1 && path.charCodeAt(guard.length) === 0x2f;
-        if (guard.length !== path.length && !slashed) {
-            continue;
-        }
-        let same = true;
-        for (let j = 0; j < guard.length; j++) {
-            let code = path.charCodeAt(j);
-            // A to Z only, which is the fold express's insensitive routing does
-            if (code >= 65 && code <= 90) {
-                code += 32;
-            }
-            if (code !== guard.charCodeAt(j)) {
-                same = false;
-                break;
-            }
-        }
-        if (same) {
-            return true;
-        }
-    }
-    return false;
-}
-
-// every method the declarative compiler can emit: a patched one must disable compilation, or the
-// patch would be honoured everywhere but on compiled routes
-const resCodes = {},
-    resDecMethods = ["set", "setHeader", "header", "send", "end", "append", "status", "json", "sendStatus"];
-for (const method of resDecMethods) {
-    resCodes[method] = Response.prototype[method].toString();
-}
-
 let routeKey = 0;
 
-/**
- * One walk of one router's routes, for one request.
- *
- * next() is made once here instead of once per hop. As a closure per hop it captured eleven
- * bindings, one of them mutable, which is a context on the heap every time a middleware hands over.
- * The hop's own state is three fields on this instead.
- *
- * A nested router gets its own walk, through its own _routeRequest, so req.next belongs to whoever
- * is running the request at that moment.
- */
-/**
- * The layer Express makes for one mounted handler. `name` is what a caller matches on: a function's
- * own name, "router" for a mounted router, and "<anonymous>" for the rest, exactly as express reads
- * them off the handle.
- *
- * @param {any} route
- * @param {any} callback
- * @returns {any}
- */
-function layerFor(route, callback) {
-    const layer = {
-        handle: callback,
-        // express reads the name off the handle, and its own handles are named: a mounted
-        // application is "app" and a mounted router "router", whatever this project happens
-        // to call the function underneath
-        name: Array.isArray(callback._routes)
-            ? callback._isApplication
-                ? "app"
-                : "router"
-            : callback.name || "<anonymous>",
-        params: undefined,
-        path: undefined,
-        keys: [],
-        route: undefined
-    };
-    route._layers.set(callback, layer);
-    return layer;
-}
-
-/**
- * The layer Express makes for a route, whose handle runs the route's own handlers one after
- * another. Express calls that handle `handle`, and a caller that looks for a route layer looks for
- * that name.
- *
- * @param {any} route
- * @returns {any}
- */
-function routeLayer(route) {
-    const handle = function handle(req, res, next) {
-        let index = 0;
-        const step = (err) => {
-            const callback = route.callbacks[index++];
-            if (callback === undefined) {
-                return next(err);
-            }
-            const isErrorHandler = callback.length === 4;
-            if ((err === undefined || err === null) === isErrorHandler) {
-                return step(err);
-            }
-            try {
-                return isErrorHandler ? callback(err, req, res, step) : callback(req, res, step);
-            } catch (thrown) {
-                return step(thrown);
-            }
-        };
-        step();
-    };
-    return { handle, name: "handle", params: undefined, path: undefined, keys: [], route: route.exposed };
-}
-
-class Walk {
-    /**
-     * @param {any} router
-     * @param {any} req
-     * @param {any} res
-     * @param {any[]} routes
-     * @param {boolean} skipCheck take the route at the index without matching it, which is how an
-     *   already-decided chain is walked
-     * @param {any} skipUntil route to resume after when this chain runs out, or undefined
-     * @param {(value: any) => void} resolve
-     * @param {(err: any) => void} reject
-     */
-    constructor(router, req, res, routes, skipCheck, skipUntil, resolve, reject) {
-        this.router = router;
-        this.req = req;
-        this.res = res;
-        this.routes = routes;
-        this.skipCheck = skipCheck;
-        this.skipUntil = skipUntil;
-        this.resolve = resolve;
-        this.reject = reject;
-        // read only by the native pair below, which has no promise to settle once for it; the
-        // promise path leaves it false. Initialized here to keep every walk the same shape
-        this.settled = false;
-        this.routeIndex = 0;
-        this.route = null;
-        this.callbackIndex = 0;
-        // bound, not wrapped in an arrow: an arrow forwarding into step() is one more call on every
-        // hop, and it measured 495 microseconds per thousand requests of nothing else
-        this.next = this.step.bind(this);
-        // What res.sendFile reports a failure to. Express hands it req.next, which is the router
-        // next and not the route one, so a file that cannot be served leaves the route and its
-        // error reaches the router error handlers rather than a four argument handler written
-        // inside the route. req.next itself is left alone: making it mean this everywhere is what
-        // express does, and it breaks express own res.format and app.routes.error tests here, so
-        // that stays open rather than half done.
-        //
-        // Null here and bound on the first route that has more than one callback, which is the
-        // only shape that ever reads it: a request that never meets one paid a bind for nothing
-        this.leaveRoute = null;
-    }
-
-    /**
-     * Leaves the rest of this route, with the error if there is one, and carries on with the route
-     * after it.
-     *
-     * @param {any} [err]
-     */
-    stepOutOfRoute(err) {
-        if (err) {
-            const req = this.req;
-            req._error = err;
-            req._errorKey = this.route.routeKey;
-            req._errorGroup = this.route.group;
-        }
-        this.step("route");
-    }
-
-    /**
-     * Finds the next route that matches and runs it. next() comes back here for the route after, so
-     * a chain of N middlewares costs one promise instead of N nested ones.
-     *
-     * @param {number} startIndex where to resume the scan
-     */
-    dispatch(startIndex) {
-        const req = this.req;
-        const routes = this.routes;
-        const router = this.router;
-        // a middleware assigned req.url, which express honours: the rest of the walk matches the
-        // new path. One identity compare per hop, since the router writes both sides itself; the
-        // handling lives out of line so this function stays small enough to inline
-        if (req.url !== req._lastUrl && this.takeUrlRewrite(startIndex)) {
-            return;
-        }
-        // and the same for req.method, which method-override assigns: the compiled chain was
-        // picked by the verb the request arrived with, so it no longer stands for this one
-        if (req.method !== req._lastMethod && this.takeMethodRewrite(startIndex)) {
-            return;
-        }
-        let routeIndex = startIndex;
-        // a compiled chain runs what is in it without matching again, so this is where a layer that
-        // provably has nothing to do for this request is stepped over rather than entered
-        if (this.skipCheck) {
-            while (routeIndex < routes.length && routes[routeIndex].bodyParserOnly === true) {
-                if (!stepsOver(routes[routeIndex], req)) {
-                    break;
-                }
-                routeIndex++;
-            }
-        }
-        if (!this.skipCheck) {
-            // express matches a layer's path before it looks at the method, and decodes the
-            // parameters there, so a malformed escape answers 400 even when no route of this
-            // method exists. Only a path carrying a percent can produce one, and that check keeps
-            // every other request from matching routes it could never run. Scanned once per
-            // rewrite and kept on the request: a middleware-heavy chain scanned it per hop
-            const mayFailDecode = (req._mayFailDecode ??= req._originalPath.indexOf("%") !== -1);
-            // frozen here, once per scan: _pathMatches reads the two flags as bare fields, and
-            // calling this per route measured 0.45us of a scan of four hundred
-            router._freezeRoutingFlags();
-            if (routes === router._routes) {
-                // the router's own table has an index over its literal routes, so the scan visits
-                // the handful that could match instead of every one, see _scanFrom
-                routeIndex = router._scanFrom(req, routeIndex, mayFailDecode);
-            } else {
-                // a compiled chain's own array, always short: the linear scan stays.
-                // Written out rather than through a predicate handed to findIndexStartingFrom,
-                // which was one closure per hop of every request not on a compiled chain
-                const method = req.method;
-                const length = routes.length;
-                for (; routeIndex < length; routeIndex++) {
-                    const r = routes[routeIndex];
-                    // A HEAD request enters a route whose path matched even when its verb cannot
-                    // serve one: express exempts HEAD from the method check ("if (!hasMethod &&
-                    // method !== 'HEAD')" in router/index.js), so the layer's parameters are
-                    // captured and its param() callbacks run before the route is dropped. Only
-                    // asked when the router has callbacks to run, since entering a route to step
-                    // straight back out of it is otherwise pure cost. runRoute steps over it.
-                    if (!(
-                        r.all ||
-                        r.method === method ||
-                        req._isOptions ||
-                        (req._isHead && (r.gettable || r.paramCallbacks.size > 0))
-                    )) {
-                        // taken only to fail: _preprocessRequest decodes again and turns it into
-                        // the error, so the handlers of a route this request cannot run never see it
-                        if (mayFailDecode && router._pathMatches(r, req) && router._paramsFailToDecode(r, req)) {
-                            break;
-                        }
-                        continue;
-                    }
-                    if (router._pathMatches(r, req)) {
-                        // matched, and then stepped over: a body parser this request gets nothing
-                        // out of costs a hop and answers with next() at the end of it
-                        if (r.bodyParserOnly === true && stepsOver(r, req)) {
-                            continue;
-                        }
-                        break;
-                    }
-                }
-            }
-        }
-        const route = routes[routeIndex];
-        if (!route) {
-            if (!this.skipCheck) {
-                // on normal unoptimized routes, if theres no match then there is no route
-                return this.resolve(false);
-            }
-            // the chain ran out, so ordinary routing takes over from the top and skips what has
-            // already run
-            useApp(req, router);
-            // a chain that went into a mount never left it, since keepMount stops the pop, so the
-            // path is still relative to it. /alone/skip must not be offered to the app as /skip
-            if (req._stack !== null && req._stack.length > 0) {
-                req._stack.length = 0;
-                req._consumed = 0;
-                setMountedPath(req);
-            }
-            // an error out of a mount is attributed to the mount, so error handlers declared before
-            // it do not catch it, as in ordinary dispatch
-            if (req._error && this.skipUntil && this.skipUntil.keepMount && this.skipUntil.routeKey > req._errorKey) {
-                req._errorKey = this.skipUntil.routeKey;
-                req._errorGroup = this.skipUntil.group;
-            }
-            this.routes = router._routes;
-            this.skipCheck = false;
-            return this.dispatch(0);
-        }
-
-        this.routeIndex = routeIndex;
-        this.route = route;
-        this.callbackIndex = 0;
-
-        // _preprocessRequest returns a promise only when param callbacks will really run, so the
-        // common case stays synchronous even in an app that uses app.param. A microtask every 300
-        // routes resets the stack, which a long chain would otherwise blow
-        const continueRoute = router._preprocessRequest(req, this.res, route);
-        if (continueRoute instanceof Promise || req.routeCount % 300 === 0) {
-            // .catch and not a rejection argument: a throw inside runRoute itself must reject
-            // the walk instead of becoming an unhandled rejection
-            Promise.resolve(continueRoute)
-                .then((resumed) => this.runRoute(resumed))
-                // wrapped so the native pair keeps the walk as receiver; a promise's reject
-                // would not have cared
-                .catch((err) => this.reject(err));
-            return;
-        }
-        return this.runRoute(continueRoute);
-    }
-
-    /**
-     * Takes over a req.url a middleware assigned. On an ordinary walk the scan simply continues
-     * against the new path; a compiled chain was computed for the old one, so ordinary routing
-     * takes over, skipping only what has already run.
-     *
-     * @param {number} startIndex where dispatch was about to resume
-     * @returns {boolean} whether this rerouted the walk itself
-     */
-    takeUrlRewrite(startIndex) {
-        const req = this.req;
-        const router = this.router;
-        req._absorbUrlRewrite();
-        if (!this.skipCheck) {
-            return false;
-        }
-        this.skipUntil = startIndex > 0 ? this.routes[startIndex - 1] : undefined;
-        if (req._stack !== null && req._stack.length > 0) {
-            req._stack.length = 0;
-            req._consumed = 0;
-            setMountedPath(req);
-        }
-        this.routes = router._routes;
-        this.skipCheck = false;
-        this.dispatch(0);
-        return true;
-    }
-
-    /**
-     * Takes over a req.method a middleware assigned, which method-override is written to do. The
-     * ordinary scan reads req.method per route and is right from the next hop on; a compiled chain
-     * was chosen by the method µWS dispatched on, so ordinary routing takes over from the top the
-     * way a url rewrite does.
-     *
-     * @param {number} startIndex where dispatch was about to resume
-     * @returns {boolean} whether this rerouted the walk itself
-     */
-    takeMethodRewrite(startIndex) {
-        const req = this.req;
-        const router = this.router;
-        req._absorbMethodRewrite();
-        if (!this.skipCheck) {
-            return false;
-        }
-        this.skipUntil = startIndex > 0 ? this.routes[startIndex - 1] : undefined;
-        if (req._stack !== null && req._stack.length > 0) {
-            req._stack.length = 0;
-            req._consumed = 0;
-            setMountedPath(req);
-        }
-        this.routes = router._routes;
-        this.skipCheck = false;
-        this.dispatch(0);
-        return true;
-    }
-
-    /**
-     * Enters the route the walk is on: a mount adjusts req.url, req.path and the mount stack on the
-     * way in, and then the route's callbacks run one after another through next().
-     *
-     * @param {any} continueRoute what _preprocessRequest decided: true to run, "route" to skip
-     */
-    runRoute(continueRoute) {
-        const req = this.req;
-        const route = this.route;
-        // A compiled chain walks into a mount rather than entering it, so the rule above needs
-        // saying here as well: everything after this marker is inside the mount, and a mount is
-        // stepped over while an error is in flight. Leaving the chain is what running out of it
-        // already means, and ordinary routing takes over after the mount.
-        if (route.keepMount === true && req._error) {
-            return this.dispatch(this.routes.length);
-        }
-        if (route.use) {
-            if (route.mountApp) {
-                // optimized chain: normal dispatch swaps req.app when it enters a mounted
-                // Application, but the compiled mount route has no callback to do it
-                rememberApp(this, route, req);
-                useApp(req, route.mountApp);
-            }
-            const taken = mountPrefixLength(route, req);
-            // pushed negative when this mount consumes the whole remaining path: express invents
-            // the "/" the routes below see, and the pop has to know, see leaveHop and issue #17
-            (req._stack ??= []).push(
-                taken !== 0 && req._consumed + taken === req._originalPath.length ? -taken : taken
-            );
-            // a use with no path consumes nothing, so everything below would work out the values
-            // that are already there. Only skipped without a trailing slash, where the rules about
-            // one cannot bite. An application is mostly pathless middleware, and this is per hop
-            if (taken !== 0 || req.endsWithSlash) {
-                req._consumed += taken;
-                // a mount that took a trailing slash: req.baseUrl then has to join the pieces
-                // rather than slice the path, which is the slower half of its getter
-                if (taken !== 0 && req._originalPath.charCodeAt(req._consumed - 1) === 0x2f) {
-                    req._mountSlash = true;
-                }
-                setMountedPath(req);
-            }
-        }
-        req.next = this.next;
-        // the same step when the route has one callback, and then it has to be the same object:
-        // express hands res.format's handlers the next its own layer received, and its test asserts
-        // that identity. With more than one callback the two differ for real, and what express
-        // hands over is the one that leaves the route
-        req._leaveRoute = route.callbacks.length > 1 ? (this.leaveRoute ??= this.stepOutOfRoute.bind(this)) : this.next;
-        if (continueRoute === "route") {
-            this.step("route");
-        } else if (continueRoute) {
-            this.step(undefined);
-        } else {
-            this.resolve(true);
-        }
-    }
-
-    /**
-     * A hop while the request carries an error, or over an error handler it cannot run: the
-     * handler is invoked when the error is its to catch, everything else is skipped.
-     *
-     * @param {number} kind what the callback is, one of the CALLBACK_ constants
-     * @param {Function} callback
-     */
-    errorHop(kind, callback) {
-        const req = this.req;
-        const route = this.route;
-        // A four argument handler written inside a route only ever sees what that route raised:
-        // express skips a route layer entirely while an error is in flight, so an error from a
-        // middleware before it, or out of a mount, walks past to the router's own error handlers.
-        // Middleware error handlers keep the ordinary rule, which is that they catch what was
-        // raised before them.
-        const reachable = route.use
-            ? route.routeKey >= req._errorKey
-            : route.routeKey === req._errorKey || (route.group !== undefined && route.group === req._errorGroup);
-        if (req._error && kind === CALLBACK_ERROR && reachable) {
-            const out = this.router._handleError(req._error, callback, req, this.res);
-            if (out instanceof Promise) {
-                // an error handler's rejected promise moves on to the next error handler, and
-                // a bare rejection gets the error express invents for it
-                out.catch((err) => {
-                    req._error = err || new Error("Rejected promise");
-                    req._errorKey = route.routeKey;
-                    req._errorGroup = route.group;
-                    return this.step(undefined);
-                });
-            }
-            return;
-        }
-        return this.step(undefined);
-    }
-
-    /**
-     * Leaves the route the walk is on: the mount pop, the router hand-back, and the hop to the
-     * route after. Out of step so the commonest hop, callbacks exhausted by a plain next(), goes
-     * here without re-running step's prologue and compares.
-     *
-     * @param {boolean} isRouter next("router") rather than next("route")
-     */
-    leaveHop(isRouter) {
-        const req = this.req;
-        const route = this.route;
-        if (route.use && !route.keepMount) {
-            const pushed = req._stack.pop();
-            const taken = pushed < 0 ? -pushed : pushed;
-            // a rewrite done inside this middleware is taken now: the pop below recomputes
-            // req.url from the original path and would silently revert it. The slashAdded
-            // mangle belongs to the mount that consumed a prefix, not to a pathless use
-            if (req.url !== req._lastUrl) {
-                req._absorbUrlRewrite(taken !== 0);
-                req._consumed -= taken;
-                setMountedPath(req);
-            } else {
-                if (pushed < 0 && req._originalPath.length > req._consumed) {
-                    // a rewrite below this mount left a remainder where entry had none: express
-                    // strips the first character of it when it rejoins, see issue #17
-                    req._originalPath =
-                        req._originalPath.slice(0, req._consumed) + req._originalPath.slice(req._consumed + 1);
-                    req._mayFailDecode = null;
-                }
-                if (taken !== 0) {
-                    // a pathless use consumed nothing and rewrote nothing, so the recompute would
-                    // write back the very values it reads
-                    req._consumed -= taken;
-                    setMountedPath(req);
-                }
-            }
-            restoreApp(route, req);
-        }
-        if (isRouter) {
-            if (this.skipCheck) {
-                // on a compiled chain, leaving the router is what running out of chain
-                // already means: ordinary routing takes over after the mount. With no
-                // mount in the chain the router being left is the app's own, and nothing
-                // of it may run afterwards, not even a middleware registered later
-                if (this.skipUntil?.keepMount) {
-                    return this.dispatch(this.routes.length);
-                }
-                return this.resolve(false);
-            }
-            // out of this router entirely, so whoever mounted it carries on after the
-            // mount. The app's own walk has nobody after it, and answers 404
-            return this.resolve(false);
-        }
-        req.routeCount++;
-        // dispatch is a plain call, so a synchronous throw would escape here instead of
-        // rejecting, as it used to when this recursed through the async _routeRequest
-        try {
-            return this.dispatch(this.routeIndex + 1);
-        } catch (err) {
-            return this.reject(err);
-        }
-    }
-
-    /**
-     * One hop, which is what next() does: with nothing, run the route's next callback; with "route",
-     * leave the route; with anything else, remember it as the error and carry on.
-     *
-     * @param {any} thingamabob
-     */
-    step(thingamabob) {
-        const req = this.req;
-        const res = this.res;
-        const route = this.route;
-        const router = this.router;
-        if (thingamabob) {
-            if (thingamabob === "route" || thingamabob === "router") {
-                return this.leaveHop(thingamabob === "router");
-            } else {
-                req._error = thingamabob;
-                req._errorKey = route.routeKey;
-                req._errorGroup = route.group;
-            }
-        }
-        const kind = route.callbackKinds[this.callbackIndex];
-        const callback = route.callbacks[this.callbackIndex++];
-        if (!callback) {
-            return this.leaveHop(false);
-        }
-        // skipping routes we already went through via optimized path. Before the Router branch
-        // below and not after it: a mount whose chain was compiled has already run, and running it
-        // again would answer from inside the router a request that had just left it
-        if (!this.skipCheck && this.skipUntil && this.skipUntil.routeKey >= route.routeKey) {
-            return this.step(undefined);
-        }
-        // A mounted router or application is stepped over while an error is in flight. Its handle
-        // takes three arguments, so express's Layer#handleError hands the error straight on without
-        // entering it: what a mount catches is what it raised itself. Entering it ran the error
-        // handlers written inside the mount, and left req.app pointing at a mounted application,
-        // whose settings then answered. A 500 carried an ETag under app.set("etag", false).
-        if (kind === CALLBACK_ROUTER && !req._error) {
-            if (callback._isApplication) {
-                rememberApp(this, route, req);
-                useApp(req, callback);
-            }
-            const pushedParams = callback._settings.mergeParams;
-            if (pushedParams) {
-                (req._paramStack ??= []).push(req.params);
-            }
-            // express restores req.params when a router hands back, so what runs after the mount
-            // sees the params it had before it
-            const parentParams = req.params;
-            // each router answers OPTIONS with the verbs it knows itself, so the one being entered
-            // starts its own list: express keeps that list per router, and a router that hands back
-            // without answering leaves the outer one's untouched
-            const parentMethods = req._matchedMethods;
-            if (parentMethods !== null) {
-                req._matchedMethods = new Set();
-            }
-            callback
-                ._routeRequest(req, res, 0)
-                .then((routed) => {
-                    // the child's params are scoped to it, and must not leak into the routes after
-                    if (pushedParams) {
-                        req._paramStack.pop();
-                    }
-                    req.params = parentParams;
-                    if (req._error) {
-                        req._errorKey = route.routeKey;
-                        req._errorGroup = route.group;
-                    }
-                    if (routed) {
-                        if (parentMethods !== null) {
-                            req._matchedMethods = parentMethods;
-                        }
-                        return this.resolve(true);
-                    }
-                    const childMethods = req._matchedMethods;
-                    if (parentMethods !== null) {
-                        req._matchedMethods = parentMethods;
-                    }
-                    if (req._isOptions && childMethods.size && !req._error) {
-                        // OPTIONS routing is different, it stops in the router if matched.
-                        // Express answers as the router hands back, so a throw while answering,
-                        // a head already written being the way, walks on to later error handlers
-                        try {
-                            router._sendOptionsReply(req, res, childMethods);
-                            return this.resolve(true);
-                        } catch (err) {
-                            return this.step(err);
-                        }
-                    }
-                    // An error carried out of the mount is not answered by the automatic reply, and
-                    // stopping here handed it to the default page: express walks on to the error
-                    // handlers written after the mount, for OPTIONS as for any other method.
-                    this.step(undefined);
-                })
-                // a rejection out of the nested walk, or a throw above, must reject this one
-                // instead of dying as an unhandled rejection; wrapped for the native pair's
-                // receiver
-                .catch((err) => this.reject(err));
-        } else {
-            // errors and error handlers live out of line: this is the cold path, and its size
-            // was pushing step past the inlining threshold
-            if (req._error || kind === CALLBACK_ERROR) {
-                return this.errorHop(kind, callback);
-            }
-
-            try {
-                // handling OPTIONS method
-                if (req._isOptions && !route.all && route.method !== "OPTIONS") {
-                    req._matchedMethods.add(route.method);
-                    if (route.gettable) {
-                        req._matchedMethods.add("HEAD");
-                    }
-                    return this.step(undefined);
-                }
-                // entered only so its param callbacks could run, see the scan in dispatch: the verb
-                // cannot serve a HEAD, so nothing here answers it
-                if (req._isHead && !route.all && !route.gettable && route.method !== "HEAD") {
-                    return this.step(undefined);
-                }
-
-                const out = callback(req, res, this.next);
-                if (out instanceof Promise) {
-                    // Express 5 forwards a rejected handler promise to the error middleware on its
-                    // own, so there is nothing left for the "catch async errors" setting or for
-                    // express-async-errors to opt into. A bare rejection carries no error, and
-                    // express invents this one for it
-                    out.catch((err) => {
-                        req._error = err || new Error("Rejected promise");
-                        req._errorKey = route.routeKey;
-                        req._errorGroup = route.group;
-                        return this.step(undefined);
-                    });
-                }
-            } catch (err) {
-                req._error = err;
-                req._errorKey = route.routeKey;
-                req._errorGroup = route.group;
-                return this.step(undefined);
-            }
-        }
-    }
-}
-
-/**
- * The native handler's resolve, invoked as this.resolve(matched) with the walk as receiver. The
- * promise pair _routeRequest allocates exists for callers that await; the uWS handler never did,
- * and on the common path, where the handler answers and next() is never called, that promise
- * never even settled: an async frame and two promises of floating garbage per request.
- *
- * The 404 epilogue stays on a microtask, exactly where the await used to resume: a middleware
- * that writes after calling next() must still win the headersSent check, as it does in express.
- * @this {Walk}
- */
-function nativeDone(matched) {
-    if (this.settled) {
-        return;
-    }
-    this.settled = true;
-    if (!matched) {
-        queueMicrotask(() => {
-            const response = this.res;
-            if (response.headersSent || response.aborted) {
-                return;
-            }
-            try {
-                this.router._endUnmatched(this.req, response);
-            } catch (err) {
-                if (response.aborted || response.finished) {
-                    logError(this.router, err);
-                } else {
-                    this.router._handleError(err, null, this.req, response);
-                }
-            }
-        });
-    }
-}
-
-/**
- * The native handler's reject: answers 500 as express's final handler would, instead of dying as
- * an unhandled rejection. Deferred like the resolve, since every rejection used to reach the
- * handler's catch through an await.
- * @this {Walk}
- */
-function nativeFail(err) {
-    if (this.settled) {
-        return;
-    }
-    this.settled = true;
-    queueMicrotask(() => {
-        const response = this.res;
-        if (response.aborted || response.finished) {
-            logError(this.router, err);
-        } else {
-            this.router._handleError(err, null, this.req, response);
-        }
-    });
-}
-
-/**
- * How much of the path a mount takes, which is what its own pattern matched and never more than
- * there is. Exec runs on the same fixed-up path _pathMatches tested: a parent mount that consumed
- * everything leaves "", where the pattern was matched against "/".
- *
- * Counting what each mount took, rather than rebuilding one pattern out of the whole stack and
- * matching that against the original path, is the difference between a sum and a guess: a mount
- * written as an optional group composes into a pattern the path no longer satisfies, and the
- * prefix stayed on.
- *
- * @param {any} route
- * @param {any} req
- * @returns {number}
- */
-function mountPrefixLength(route, req) {
-    // a use with no path is EMPTY_REGEX, which matches "" at 0 whatever the path is. Answered
-    // without the exec, since this runs per hop and most middleware is pathless
-    if (route.pattern === EMPTY_REGEX) {
-        return 0;
-    }
-    // the registration-time constant of a literal mount, exec-free. See createRoute
-    if (route.mountLen !== undefined) {
-        return route.mountLen;
-    }
-    if (typeof route.pattern === "string") {
-        return route.pattern.length;
-    }
-    const path = req._opPath;
-    const matched = route.pattern.exec(path === "" ? "/" : path);
-    return matched ? Math.min(matched[0].length, path.length) : 0;
-}
-
-/**
- * Writes the path the routes below a mount see: the original with what the mounts took off the
- * front. The root reads as "/" rather than as nothing, which is how express hands it over.
- *
- * @param {any} req
- */
-function setMountedPath(req) {
-    req._opPath = req._consumed === 0 ? req._originalPath : req._originalPath.slice(req._consumed);
-    req._opPathLower = null;
-    req.url = req._opPath === "" ? "/" + req.urlQuery : req._opPath + req.urlQuery;
-    req._path = req._opPath === "" ? "/" : req._opPath;
-    req._lastUrl = req.url;
-}
-
-// req.path as the request class declares it, taken off the prototype rather than written out a
-// second time. A request the router adopts is a plain object and gets it defined on itself, see
-// adoptPlainRequest. Enumerable, as express's own is.
-const PATH_PROPERTY = {
-    .../** @type {PropertyDescriptor} */ (Object.getOwnPropertyDescriptor(Request.prototype, "path")),
-    enumerable: true
-};
-
-// and the two the walk calls when a middleware rewrote req.url or req.method, for the same reason:
-// an adopted request has no prototype of ours to find them on, and a rewrite through one of those
-// routers threw instead of being taken over
-const ABSORB_URL = Request.prototype._absorbUrlRewrite;
-const ABSORB_METHOD = Request.prototype._absorbMethodRewrite;
-
-const NO_PARAM_NAMES = [];
-
-/**
- * The parameter names a route captures with its own pattern.
- *
- * This is the set express runs param callbacks for. A name that reached req.params from a mount
- * above, through mergeParams, belongs to that mount's router and not to this one, and express does
- * not call this router's param() for it: it walks the keys the layer itself matched. Reading
- * req.params instead ran a callback for every inherited name too, which is visible whenever such a
- * callback does anything, and turned a 200 into a 500 when one of them refused the value.
- *
- * Worked out once per route and kept, since it follows from the pattern and never changes.
- *
- * @param {any} route
- * @returns {string[]}
- */
-function ownParamNames(route) {
-    let names = route._ownParamNames;
-    if (names !== undefined) {
-        return names;
-    }
-    if (route.optimizedParams) {
-        // µWS matched the pattern and hands the values back by position, under these names
-        names = route.optimizedParams;
-    } else if (route.pattern instanceof RegExp) {
-        const meta = getPatternMeta(route.pattern);
-        // outputNames is what _extractParams writes into params; a RegExp the application wrote
-        // itself was never compiled here, so its capture groups are the names
-        names = meta ? meta.outputNames : regexpGroupKeys(route.pattern);
-    } else {
-        names = NO_PARAM_NAMES;
-    }
-    route._ownParamNames = names;
-    return names;
-}
-
-/**
- * Whether this route reads the parameters of the mounts above it, which is its own router asking
- * for them. The stack holds what a mergeParams router captured on the way in, and a plain router
- * mounted inside one must not read it: express asks each router in turn, not the outermost.
- *
- * @param {any} route
- * @param {any} fallback the router dispatching, when the route names no owner
- * @returns {boolean}
- */
-function mergesParams(route, fallback) {
-    const owner = route.owner ?? fallback;
-    return Boolean(owner?._settings?.mergeParams);
-}
-
-// shared empty candidate list, so _scanFrom never tests for a missing map entry twice
-const EMPTY_INDICES = /** @type {number[]} */ ([]);
-
-/**
- * The generic scan's index over a router's literal routes: route positions by folded pattern, so
- * a scan visits the routes registered for this exact path instead of comparing every one. String
- * patterns are pure literals, everything else, "/*" included, stays in alwaysVisit and is still
- * matched per request by _pathMatches.
- *
- * @param {any[]} routes the router's own table
- * @param {boolean} caseFlag the frozen case-sensitivity flag
- * @returns {{map: Map<string, number[]>, alwaysVisit: number[]}}
- */
-function buildLiteralIndex(routes, caseFlag) {
-    const map = new Map();
-    const alwaysVisit = [];
-    for (let i = 0; i < routes.length; i++) {
-        const pattern = routes[i].pattern;
-        if (typeof pattern === "string" && pattern !== "/*") {
-            const key = caseFlag ? pattern : routes[i].patternLower;
-            const list = map.get(key);
-            if (list === undefined) {
-                map.set(key, [i]);
-            } else {
-                list.push(i);
-            }
-        } else {
-            alwaysVisit.push(i);
-        }
-    }
-    return { map, alwaysVisit };
-}
-
-/**
- * The position of the first value >= from in an ascending list, which is list.length when there
- * is none: where a scan resuming at `from` enters a candidate list.
- *
- * @param {number[]} list
- * @param {number} from
- * @returns {number}
- */
-function firstAtLeast(list, from) {
-    let low = 0;
-    let high = list.length;
-    while (low < high) {
-        const mid = (low + high) >> 1;
-        if (list[mid] < from) {
-            low = mid + 1;
-        } else {
-            high = mid;
-        }
-    }
-    return low;
-}
-
-/**
- * The route's own params merged with those of the mounts it sits under, in express's order: an
- * outer mount first, the route's own last. Numbered captures do not overwrite each other, they
- * shift, so a RegExp mount capturing one group leaves the route's own group numbered from one.
- *
- * @param {Record<string, any>} own what this route's own pattern captured
- * @param {Record<string, any>[]} stack the mounts, outermost first
- * @returns {Record<string, any>}
- */
-function mergeParams(own, stack) {
-    const merged = Object.create(null);
-    for (const params of stack) {
-        Object.assign(merged, params);
-    }
-    // both sides numbering from zero means the outer ones keep their places and these move up
-    if (own[0] !== undefined && merged[0] !== undefined) {
-        let count = 0;
-        while (merged[count] !== undefined) {
-            count++;
-        }
-        let last = 0;
-        while (own[last] !== undefined) {
-            last++;
-        }
-        for (last--; last >= 0; last--) {
-            own[last + count] = own[last];
-            if (last < count) {
-                delete own[last];
-            }
-        }
-    }
-    return Object.assign(merged, own);
-}
-
-/**
- * The scheme and authority of an absolute request target, or "" for the ordinary kind.
- *
- * A request line may carry the whole URI, and express matches on the path while leaving req.url as
- * it arrived. Same rule it uses: a "://" before any "?" means everything up to the slash after it
- * is not path.
- *
- * @param {string} url
- * @returns {string}
- */
-function protohostOf(url) {
-    if (url.length === 0 || url.charCodeAt(0) === 0x2f) {
-        return "";
-    }
-    const searchIndex = url.indexOf("?");
-    const pathLength = searchIndex === -1 ? url.length : searchIndex;
-    const fqdnIndex = url.slice(0, pathLength).indexOf("://");
-    if (fqdnIndex === -1) {
-        return "";
-    }
-    const slash = url.indexOf("/", fqdnIndex + 3);
-    return slash === -1 ? url : url.slice(0, slash);
-}
-
-/**
- * Fills in what dispatch reads on a request that did not come from µWS.
- *
- * express's router can be driven with a plain object, `router.handle({ url, method }, res, next)`,
- * and its own tests do exactly that; so does anything mounting a router on a server of its own.
- * Only ever called for such a request: one of ours arrives with these fields already set.
- *
- * req.url becomes an accessor, so the router goes on writing plain paths to it while a reader sees
- * the absolute URI it arrived as. That keeps the protohost out of the dispatch itself.
- *
- * @param {any} req
- * @param {any} router
- */
-function adoptPlainRequest(req, router) {
-    const arrived = typeof req.url === "string" ? req.url : "";
-    const protohost = protohostOf(arrived);
-    let raw = arrived.slice(protohost.length);
-    if (protohost !== "") {
-        Object.defineProperty(req, "url", {
-            configurable: true,
-            enumerable: true,
-            get() {
-                return protohost + raw;
-            },
-            set(value) {
-                const written = String(value);
-                raw = written.startsWith(protohost) ? written.slice(protohost.length) : written;
-            }
-        });
-    }
-
-    const queryIndex = raw.indexOf("?");
-    const path = queryIndex === -1 ? raw : raw.slice(0, queryIndex);
-    req.urlQuery = queryIndex === -1 ? "" : raw.slice(queryIndex);
-    req._rawQuery = req.urlQuery.slice(1);
-    req._path = path;
-    // an adopted request is a plain object, so it carries no prototype of ours and reads its path
-    // off a property of its own. The class's getter itself, so there is one of it
-    Object.defineProperty(req, "path", PATH_PROPERTY);
-    req._absorbUrlRewrite = ABSORB_URL;
-    req._absorbMethodRewrite = ABSORB_METHOD;
-    req.originalUrl = req.originalUrl ?? arrived;
-    req._originalPath = path;
-    req.endsWithSlash = path.charCodeAt(path.length - 1) === 0x2f;
-    req._opPath = path;
-    req._opPathLower = null;
-    req._mayFailDecode = null;
-    req._lastUrl = req.url;
-    req._lastMethod = req.method;
-    req._isOptions = req.method === "OPTIONS";
-    req._isHead = req.method === "HEAD";
-    req.params = req.params ?? Object.create(null);
-    // null, not fresh arrays: the push sites materialize them on the first mount, and most
-    // requests never see one, same as the Request constructor
-    req._stack = null;
-    req._consumed = 0;
-    req._mountSlash = false;
-    req._paramStack = null;
-    req._matchedMethods = req._isOptions ? new Set() : null;
-    req.routeCount = 1;
-    // read when a mount is left, and there is no application here to read it from
-    req.app = req.app ?? router;
-}
-
-/**
- * What express's logerror does. Its final handler prints the error it is about to answer with,
- * unless the application runs under `env: "test"`, which is how its own suite stays quiet, and it
- * prints the stack rather than the object. A falsy throw is not printed at all, since finalhandler
- * only calls onerror when there is an error to call it with.
- *
- * @param {any} router the router whose settings decide it
- * @param {any} err
- * @returns {void}
- */
-function logError(router, err) {
-    if (err && router.get("env") !== "test") {
-        console.error(err.stack || err.toString());
-    }
-}
-
-/**
- * The uWS onAborted handler, bound to the response: a closure here captured two locals and cost
- * a context plus a function per request, for a path that only ever runs on a client abort.
- * @this {any} the response, with the request linked as this.req
- */
-function onNativeAborted() {
-    const response = this;
-    const request = response.req;
-    // node's wording for a client abort, which is what body consumers match on
-    /** @type {NodeJS.ErrnoException} */
-    const err = new Error("aborted");
-    err.code = "ECONNRESET";
-    response.aborted = true;
-    response.finished = true;
-    // node's order on the request: 'aborted', then the stream dies, then 'close'. The
-    // error goes only to whoever listens for it, since a destroy(err) with no listener
-    // would take down the process
-    request.emit("aborted");
-    // and the response dies between the two, which is where node puts it. Destroyed rather than
-    // told to emit 'close', because being destroyed is the state express is in here and everything
-    // after it follows from that state rather than having to be reproduced: 'close' goes out once,
-    // a later res.write returns false and calls its callback with ERR_STREAM_DESTROYED, and no
-    // 'error' is emitted, which a destroy(err) here would.
-    //
-    // Without this a handler learnt about the abort only from a write failing, so one that had sent
-    // its head and gone quiet never learnt at all. `res.on("close")` is where cancellation hangs in
-    // every proxy and every streaming endpoint, so it never ran for exactly the shape that needs it.
-    response.destroy();
-    request.destroy(request.listenerCount("error") > 0 ? err : undefined);
-    response.socket?.emit("error", err);
-}
-
-/**
- * What app.settings is wrapped in, so a write that never went through set() still tells the hot
- * copies they are out of date. Only writes are trapped: a missing trap is the plain operation on
- * the object itself, so reads through here behave exactly as they did.
- *
- * defineProperty is here for the trust proxy default marker, which set() writes that way, and for
- * anything else reaching for Object.defineProperty rather than an assignment.
- */
-const settingsWriteTraps = {
-    /**
-     * @param {any} target
-     * @param {string|symbol} key
-     * @param {any} value
-     */
-    set(target, key, value) {
-        target[key] = value;
-        settingsEpoch.n++;
-        return true;
-    },
-    /**
-     * @param {any} target
-     * @param {string|symbol} key
-     */
-    deleteProperty(target, key) {
-        delete target[key];
-        settingsEpoch.n++;
-        return true;
-    },
-    /**
-     * @param {any} target
-     * @param {string|symbol} key
-     * @param {any} descriptor
-     */
-    defineProperty(target, key, descriptor) {
-        Object.defineProperty(target, key, descriptor);
-        settingsEpoch.n++;
-        return true;
-    }
-};
-
-/**
- * The per-request constants of a fully literal native registration. µWS matched the URL byte for
- * byte against this exact pattern and dispatches by method, so the request constructor can take
- * these as given instead of asking uWS and recomputing them on every request.
- *
- * @param {string} path the registered pattern, which is what getUrl() would have answered
- * @param {string} method uppercase, fixed by which uWS verb the registration used
- */
-function nativePreset(path, method) {
-    const endsWithSlash = path.charCodeAt(path.length - 1) === 0x2f;
-    return {
-        path,
-        method,
-        endsWithSlash,
-        opPath: path,
-        isOptions: method === "OPTIONS",
-        isHead: method === "HEAD",
-        // set at registration when the whole chain provably never reads a header, or never
-        // reads the query; mutable, because a middleware added after listen takes them back
-        skipHeaders: false,
-        skipQuery: false
-    };
-}
-
-/**
- * Whether any error middleware exists anywhere under this router, mounted routers and sub-apps
- * included. The header-skip analysis needs the answer to be no: a throw inside an analyzed
- * handler would hand the request to code nobody analyzed.
- *
- * @param {any} router
- * @returns {boolean}
- */
-function hasErrorMiddleware(router) {
-    for (const route of router._routes) {
-        for (const callback of route.callbacks) {
-            // a mounted router or a callable sub-app carries routes of its own; the callable
-            // app is also a function, so the routes are looked for first
-            if (callback && callback._routes) {
-                if (hasErrorMiddleware(callback)) {
-                    return true;
-                }
-            } else if (typeof callback === "function" && callback.length >= 4) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-
-/**
- *
- */
-function checkHandlers(handlers, emptyMessage = "argument handler is required") {
-    if (handlers.length === 0) {
-        throw new TypeError(emptyMessage);
-    }
-    for (const handler of handlers) {
-        if (typeof handler !== "function") {
-            throw new TypeError("argument handler must be a function");
-        }
-    }
-}
-
-// what a route's callback is, so that a hop reads a number instead of asking instanceof and length
-const CALLBACK_PLAIN = 0;
-const CALLBACK_ERROR = 1;
-const CALLBACK_ROUTER = 2;
-
-/**
- * Reports a parameter that will not decode, unless something is already being reported.
- *
- * Matching a route decodes its parameters, and that happens while the walk is still looking for
- * whoever should answer, including when it is looking for an error handler. Express does the same
- * and keeps the first error it has: `layerError = layerError || match` in its router. Overwriting
- * meant a middleware that had already refused the path, express.static answering Bad Request on an
- * escape it could not decode, had its answer replaced by the decode failure of a route further down
- * that was never going to run. Same status, different message, and only when a later route happens
- * to match the same path. Found by fuzzing route tables against express.
- *
- * @param {any} req
- * @param {any} route
- * @param {any} err
- */
-function raiseDecodeFailure(req, route, err) {
-    if (req._error) {
-        return;
-    }
-    req._error = err;
-    req._errorKey = route.routeKey;
-    req._errorGroup = route.group;
-}
-
-// the verbs a body is read for unless the application says otherwise, which is the parsers' own
-// list. A request with any other verb reaches a parser's method check and leaves through it
-const BODY_METHODS = new Set(["POST", "PUT", "PATCH", "QUERY"]);
-
-/**
- * Whether this layer can be stepped over for this request without changing a thing.
- *
- * Only the body parsers are ever asked. Their prologue leaves a request that said nothing about a
- * body alone, whatever content type it carries, which is what `kGetSafe` already records for the
- * header-skip analysis. Two conditions on top of that mark, and both are needed:
- *
- * The request must have said nothing about framing at all, a `content-length: 0` included. A parser
- * that can see a length answers about the body it describes even when that body is empty: a zero
- * length with a charset nobody can decode is a 415, in express and here.
- *
- * And the verb must be one no parser reads a body for. With no length and no transfer-encoding a
- * POST still walks into the read, comes back with nothing, and leaves `req.body` as the empty value
- * its parser produces, which is a thing a handler can see.
- *
- * What this is worth: a hop measured 367 microseconds per thousand requests on the machine this was
- * written on, and the parser prologue it reaches measured 38. Ten to one, for a layer that had
- * nothing to do.
- *
- * That number is also why fusing consecutive layers into one generated function keeps coming up,
- * and why it is not here. Counted over a real front, morgan, helmet, compression, cors, the two body
- * parsers, express-session, a middleware of one's own and express.static: three of the nine can be
- * fused, and the longest run of fusable ones in a row is one. Fusing needs two. The rule was relaxed
- * from "calls next once, unconditionally" to merely "calls next synchronously" and the answer did
- * not move, because the six that fail all call next from inside a callback: they are asynchronous by
- * nature, reading a body, stat-ing a file, loading a session. A layer that has not decided by the
- * time it returns cannot be fused by any design that keeps the semantics. What fuses is a run of
- * trivial middlewares, which is a benchmark shape rather than an application's.
- *
- * @param {any} route
- * @param {any} req
- * @returns {boolean}
- */
-function stepsOver(route, req) {
-    if (route.bodyParserOnly !== true || req._hasBodyHeaders === true) {
-        return false;
-    }
-    if (BODY_METHODS.has(req.method)) {
-        return false;
-    }
-    // an application can add its own. Read once and kept, which is what the parser behind this
-    // layer does with the same setting: asking on every request measured 17 microseconds per
-    // thousand, a third of what stepping over the layer saves
-    if (route.bodyMethods === undefined) {
-        route.bodyMethods = req.app.get("body methods") ?? null;
-    }
-    if (route.bodyMethods !== null && route.bodyMethods.includes(req.method)) {
-        return false;
-    }
-    // The layer is not entered, so it leaves the one mark it would have left: the parser puts
-    // `body` on the request before it works out that there is nothing to read. A library asks
-    // `"body" in req` to tell "a parser has run" from "none has", and a skip that did not leave
-    // it would answer a GET differently from express. See the same seeding in middlewares.js
-    if (!("body" in req)) {
-        req.body = undefined;
-    }
-    return true;
-}
-
-/**
- * Whether a route could answer a request for this path, judged on the pattern it was compiled to.
- * A literal answers only itself; anything with a parameter or a wildcard answers what its regex
- * says. Used where the question is "would this earlier route have had its turn first".
- *
- * @param {any} route
- * @param {string} path
- * @returns {boolean}
- */
-function couldAnswer(route, path) {
-    if (route.pattern instanceof RegExp) {
-        return route.pattern.test(path);
-    }
-    return route.pattern === path;
-}
-
-/**
- * Whether a layer written before a mount could answer a request for one of the paths inside it.
- *
- * A mount covers everything under its path, so this is a question about a subtree rather than about
- * the mount point, and the two answers differ: `/a` and `/:p0/:p1/:p2` match none of each other's
- * text, and both answer `/a/x/y`. µWS jumps straight to whichever leaf it registered, so a leaf a
- * layer like this could have answered has to stay on the generic path, which is the only place
- * express's registration order decides.
- *
- * Only layers with more segments than the mount path reach this: one with as few already matches
- * the mount point itself, and _optimizeRoute has refused the mount before the walk gets here.
- *
- * Compared folded whichever way the routers are set. A wrong yes costs a leaf its native
- * registration and nothing else.
- *
- * @param {{path: string, use: boolean, method: string, all: boolean}} guard
- * @param {string} leafPath the leaf's absolute path, parameters and all
- * @param {any} leaf
- * @returns {boolean}
- */
-function shadowsLeaf(guard, leafPath, leaf) {
-    if (!guard.all && guard.method !== leaf.method && !(guard.method === "HEAD" && leaf.method === "GET")) {
-        return false;
-    }
-    return pathsCanOverlap(guard.path.toLowerCase(), leafPath.toLowerCase(), guard.use);
-}
-
-/**
- * The layers before a mount that answer some of what is inside it and not all of it, which is the
- * one thing neither the chain nor µWS's own choice can say: the chain runs what is in it without
- * matching again, and µWS picks by specificity. They are carried down the walk instead and asked
- * about every leaf, see shadowsLeaf.
- *
- * @param {any} router the router the mount belongs to
- * @param {any} mount
- * @param {string} pathPrefix what the mounts above this one consumed
- * @param {any[]} chain the layers that always run before the mount, which need no guard
- * @param {any[]} inherited the guards from further out, since a mount two levels down is under
- *   everything written before either of them
- * @returns {any[]|null} null when a path cannot be read segment by segment, which leaves the mount
- *   to ordinary dispatch rather than guessing about it
- */
-function guardsInside(router, mount, pathPrefix, chain, inherited) {
-    let guards = inherited;
-    for (const r of router._routes) {
-        if (r.routeKey > mount.routeKey) {
-            break;
-        }
-        if (r === mount || chain.includes(r)) {
-            continue;
-        }
-        if (typeof r.path !== "string") {
-            return null;
-        }
-        if (guards === inherited) {
-            guards = [...inherited];
-        }
-        guards.push({ path: pathPrefix + r.path, use: r.use === true, method: r.method, all: r.all === true });
-    }
-    return guards;
-}
-
-/**
- * Notes which application is current before a mounted one is entered, so that exact one comes back
- * when it hands over.
- *
- * Only an application takes it back. Express restores req.app by putting the request prototype
- * back, and it wraps a mounted application to do that only in Application#use: hang one off a plain
- * Router and nothing restores it, so whatever runs afterwards still reads the settings of the
- * application that was entered. Restoring regardless made a later res.send answer with the outer
- * application's etag setting where express answers with the inner.
- *
- * And what comes back is what was current, not the entered application's parent. Those differ the
- * moment a sub-app is entered from inside another sub-app that a plain Router mounted: the outer
- * one is still current, express puts that one back, and reaching for `.parent` skipped a level.
- * A 404 from the top application then carried an ETag under `app.set("etag", false)`, because the
- * settings answering were the inner application's. Found by fuzzing three levels of routers.
- *
- * The route is remembered alongside, so the pop can only ever take back what this same route put
- * there: a mounted application that answers instead of handing over leaves its entry behind, and
- * the request is over by then.
- *
- * @param {any} walk
- * @param {any} route
- * @param {any} req
- */
-function rememberApp(walk, route, req) {
-    if (walk.router._isApplication && route.callbacks[0]?._isApplication) {
-        (req._appStack ??= []).push(route, req.app);
-    }
-}
-
-/**
- * Puts back what rememberApp noted, if this is the route that noted it.
- *
- * @param {any} route
- * @param {any} req
- */
-function restoreApp(route, req) {
-    const stack = req._appStack;
-    if (stack !== undefined && stack.length > 0 && stack[stack.length - 2] === route) {
-        const app = stack.pop();
-        stack.pop();
-        useApp(req, app);
-    }
-}
-
-/**
- * useApp
- * @param {any} req
- * @param {any} app
- */
-function useApp(req, app) {
-    req.app = app;
-    if (req.res) {
-        req.res.app = app;
-    }
-    // an app's own request/response extensions apply while it runs: express re-parents both
-    // objects on entering a mounted app, and this is the equivalent hop
-    if (app.request && Object.getPrototypeOf(req) !== app.request) {
-        Object.setPrototypeOf(req, app.request);
-    }
-    if (app.response && req.res && Object.getPrototypeOf(req.res) !== app.response) {
-        Object.setPrototypeOf(req.res, app.response);
-    }
-}
-
-// Every verb node knows about, which is the list the methods package hands Express, and "all" on
-// top of it. Taken from node rather than written out: the written out one was missing acl, bind,
-// link, rebind, source, unbind, unlink and unlock, and had four of the others twice.
-//
-// GET is left out on purpose. get() is declared in the class, because it doubles as the settings
-// reader, and the loop at the end of this file would replace it.
-const methods = ["all", ...METHODS.filter((method) => method !== "GET").map((method) => method.toLowerCase())];
-const supportedUwsMethods = new Set(["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD", "CONNECT", "TRACE"]);
-
-// the same name rule patternToRegex reads, so a unicode name is found here too
-const regExParam = /:([$_\p{ID_Start}][$\u200c\u200d\p{ID_Continue}]*)/gu;
-
-// Internals here are _underscore and not #private: a callable router is a function with the
-// router's properties copied onto it, and a # field cannot be copied, so #routes would throw
-// "Cannot read private member" on the first call.
-
-// one intermediate prototype per class, built the first time a callable of that class is made
-const callablePrototypes = new WeakMap();
-
-/**
- * The prototype for a callable router or app: the class prototype, with apply and call put back.
- *
- * Setting a function's prototype to a class prototype drops Function.prototype from the chain, and
- * node calls a request listener with handler.apply. An intermediate object, so express.application
- * stays in the chain. constructor and bind are not restored: the code asks constructor.name, and
- * BIND is an HTTP verb, so app.bind registers a route as it does in Express.
- *
- * @param {object} classPrototype
- * @returns {object}
- */
-function callablePrototypeFor(classPrototype) {
-    let prototype = callablePrototypes.get(classPrototype);
-    if (prototype) {
-        return prototype;
-    }
-    prototype = Object.create(classPrototype);
-    for (const name of ["apply", "call", "toString"]) {
-        Object.defineProperty(prototype, name, {
-            value: /** @type {any} */ (Function.prototype)[name],
-            writable: true,
-            configurable: true,
-            enumerable: false
-        });
-    }
-    callablePrototypes.set(classPrototype, prototype);
-    return prototype;
-}
-
-/**
- * The default error page, which is the one Express produces: the stack in a pre, and nothing else.
- * What reaches it has already been redacted when the environment calls for it.
- *
- * The text is escaped, which is not decoration. An error message can carry anything a client sent,
- * a path or a header among them, and writing it into the page unescaped put whatever it held into
- * the markup. The Content-Security-Policy on this response stops a script there from running, but
- * a policy is a second line and not the first. finalhandler escapes and then puts the line breaks
- * and the indentation back as markup, and this reads the same as what it produces.
- *
- * @param {any} err
- * @returns {string}
- */
-function generateErrorPageHtml(err) {
-    const text = String(err?.stack ?? err)
-        .replace(/&/g, "&amp;")
-        .replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;")
-        .replace(/"/g, "&quot;")
-        .replace(/'/g, "&#39;")
-        .replace(/\n/g, "<br>")
-        .replace(/ {2}/g, " &nbsp;");
-    return (
-        `<!DOCTYPE html>\n` +
-        `<html lang="en">\n` +
-        `<head>\n` +
-        `<meta charset="utf-8">\n` +
-        `<title>Error</title>\n` +
-        `</head>\n` +
-        `<body>\n` +
-        `<pre>${text}</pre>\n` +
-        `</body>\n` +
-        `</html>\n`
-    );
-}
-
 module.exports = class Router extends EventEmitter {
     /**
      * The router or application this one is mounted on, undefined until it is.
-     * @type {any}
+     * @type {Router|undefined}
      */
     parent;
 
@@ -1647,11 +172,11 @@ module.exports = class Router extends EventEmitter {
         this._routes = [];
         // websocket routes, kept apart from the HTTP ones: µWS serves them itself and listen()
         // hands them over whole, mount paths and all
-        /** @type {any[]|null} */
+        /** @type {WsRoute[]|null} */
         this._wsRoutes = null;
         // the native presets allowed to skip the header copy, so a late middleware or an etag
         // arriving after listen can take the permission back; null until one is granted
-        /** @type {Set<any>|null} */
+        /** @type {Set<SkipHolder>|null} */
         this._skipPresets = null;
         /** @type {boolean|undefined} */
         this._hasErrMwCache = undefined;
@@ -1660,15 +185,17 @@ module.exports = class Router extends EventEmitter {
         this.mountpath = "/";
         // The settings twice: the plain object everything inside here reads, and the Proxy the
         // outside gets. Express lets an application write app.settings["x"] straight, which set()
-        // never sees, so the hot copies in _hot() would keep answering the old value until an
-        // unrelated set() happened to bump the epoch and the change landed by surprise. The trap
-        // bumps it on the spot. Reading through a Proxy costs about 20ns, which is why the inside
-        // never does: _settings is the same object without the wrapper.
+        // never sees, so the hot copies in _hot() kept answering the old value. The trap bumps the
+        // epoch on the spot. Reading through a Proxy costs about 20ns, so the inside never does
         this._settings = settings;
         this.settings = new Proxy(settings, settingsWriteTraps);
         // the base classes; an Application replaces these with its own per-app subclasses, and a
         // plain router has no request/response prototype layer, as in Express
+        // Typed loosely because an Application replaces both with per-app subclasses of its own,
+        // and a field declared as the base class would not accept one under strictFunctionTypes
+        /** @type {any} */
         this._request = Request;
+        /** @type {any} */
         this._response = Response;
 
         if (typeof settings.caseSensitive !== "undefined") {
@@ -1704,22 +231,20 @@ module.exports = class Router extends EventEmitter {
      * Routes a request through this router, as Express's app.handle and router.handle do. next() is
      * called when nothing answered, so an unmatched request goes back to whoever is running this.
      *
-     * @param {any} req
-     * @param {any} res
-     * @param {(err?: any) => void} [next]
+     * @param {any} req a Request, or the plain object express's own router tests drive it with
+     * @param {any} res a Response, or whatever the caller is serving with
+     * @param {(err?: unknown) => void} [next]
      * @returns {Promise<void>}
      */
     async handle(req, res, next) {
         // a request from node's own server, which is what http.createServer(app) delivers
         if (isNodeRequest(req)) {
-            return serveNodeRequest(this, req, /** @type {any} */ (res), next);
+            return serveNodeRequest(this, req, res, next);
         }
         // an app taking over a request becomes that request's app, as it does when mounted, so
-        // req.app.get("view engine") inside a sub-app reads the sub-app's settings and not the
-        // settings of whatever handed the request over. A plain router is not an app and leaves it
-        // alone, which is what Express's router.handle does too.
-        // a plain object, which is how express's router can be driven and how its own tests drive
-        // it. One of ours arrives with these set, so this costs a property read
+        // req.app.get("view engine") inside a sub-app reads the sub-app's settings. A plain router
+        // is not an app and leaves it alone, as Express's router.handle does.
+        // a plain object, which is how express's router can be driven and how its own tests drive it
         if (req._opPath === undefined) {
             if (typeof req.url !== "string" || req.url === "") {
                 // express reads the path with parseurl, which answers nothing for these, and it
@@ -1854,15 +379,15 @@ module.exports = class Router extends EventEmitter {
      * what a nested router strips off the path before matching against it. Cached per stack, since
      * the same mount chain is walked by every request that reaches it.
      *
-     * @param {any} req
+     * @param {Request} req
      * @returns {RegExp}
      */
     getFullMountpath(req) {
         // path-less app.use() pushes "", so a stack of only those joins to "" no matter how deep it is.
         // patternToRegex("", true) is EMPTY_REGEX, so this returns exactly what the join path would,
-        // without walking the whole stack on every hop. _stackMounted first: it is 0 whenever
-        // _stack is still null, and req.baseUrl asks from unmounted requests too
-        if (req._stackMounted === 0 || req._stack.length === 0) {
+        // The null first: _stack stays null until a mount is entered, and this is reachable from
+        // an unmounted request. It used to read a counter that no longer exists, so it threw
+        if (req._stack === null || req._stack.length === 0) {
             return EMPTY_REGEX;
         }
         const fullStack = req._stack.join("");
@@ -1893,14 +418,12 @@ module.exports = class Router extends EventEmitter {
     /**
      * The generic scan over this router's own table, driven by the literal index: only the routes
      * registered for this exact path, plus every non-literal route, are visited, in registration
-     * order, and each visited one still answers through the same method gate and _pathMatches the
-     * plain loop used. The routes skipped are exactly the literals whose string compare provably
-     * fails, so the first index this answers is the one the plain loop found.
+     * order, and each one still answers through the same method gate and _pathMatches the plain
+     * loop used. The routes skipped are exactly the literals whose string compare provably fails.
      *
-     * Runs after _freezeRoutingFlags, which is what makes _caseFlag and _strictFlag readable here
-     * and the lazily built index stable.
+     * Runs after _freezeRoutingFlags, which is what makes _caseFlag and _strictFlag readable here.
      *
-     * @param {any} req
+     * @param {Request} req
      * @param {number} startIndex where to resume the scan
      * @param {boolean} mayFailDecode whether the path carries a percent escape
      * @returns {number} the index of the route to enter, or the table length for none
@@ -1979,8 +502,8 @@ module.exports = class Router extends EventEmitter {
      * makes a route eligible for the native router; anything carrying a parameter or a wildcard was
      * turned into a regular expression when it was registered.
      *
-     * @param {any} route
-     * @param {any} req
+     * @param {RouteEntry} route
+     * @param {Request} req
      * @returns {boolean}
      */
     _pathMatches(route, req) {
@@ -2038,16 +561,15 @@ module.exports = class Router extends EventEmitter {
 
     /**
      * The layers Express keeps on a router, in Express's own shape: one per middleware, one per
-     * route, and the route's own handlers under `route.stack`. Libraries that list an
-     * application's endpoints walk this, and so do tests that reach in for a single handler by
-     * name, which is how LibreChat pulls one middleware out of its router to exercise it.
+     * route, and the route's own handlers under `route.stack`. Libraries that list an application's
+     * endpoints walk this, and so do tests that reach in for a handler by name, which is how
+     * LibreChat pulls one middleware out of its router.
      *
-     * A view, built from the routes this router holds and rebuilt on every read, so it follows
-     * what has been registered. It is not the router's own storage: pushing a layer onto it, or
-     * splicing one out, moves nothing. The layer objects themselves are kept, so a caller that
-     * compares identities across two reads gets the same answer Express gives.
+     * A view, rebuilt on every read, not the router's own storage: pushing a layer onto it or
+     * splicing one out moves nothing. The layer objects are kept, so identities compare across two
+     * reads the way they do in Express.
      *
-     * @returns {any[]}
+     * @returns {Layer[]}
      */
     get stack() {
         const layers = [];
@@ -2070,21 +592,21 @@ module.exports = class Router extends EventEmitter {
      * anything not comparable as a string is compiled to a regular expression and marked complex.
      *
      * @param {string} method HTTP method, or USE for a mount
-     * @param {any} path one path or several
-     * @param {any} [parent] what to return, so chaining lands on the app rather than the router
-     * @param {...any} callbacks
+     * @param {string|RegExp|(string|RegExp)[]} path one path or several
+     * @param {any} [parent] what to return, so chaining lands on the app rather than the router.
+     *   Loose because it is also the builder app.route() hands back
+     * @param {...any} callbacks handlers, or arrays of them at any depth, flattened below. Loose
+     *   because a parameter keeps its declared type through that reassignment
      * @returns {any} parent
      */
     createRoute(method, path, parent = this, ...callbacks) {
         method = method.toUpperCase();
         callbacks = callbacks.flat(Infinity);
         checkHandlers(callbacks);
-        // What express hangs off req.route as its methods, and the three registrations do not
-        // agree on it: app.all() registers every verb one at a time, so the map names all of
-        // them; router.all() and app.route().all() mark the route _all instead; and everything
-        // hung off one app.route() shares one map, since express builds one Route for the lot.
-        // Built in node's own order, which is the order the methods package hands express, so
-        // the map reads back key for key as express's does.
+        // What express hangs off req.route as its methods, and the three registrations disagree:
+        // app.all() registers every verb one at a time, so the map names all of them; router.all()
+        // and app.route().all() mark the route _all instead; everything hung off one app.route()
+        // shares one map. Built in node's own order, so it reads back key for key as express's does
         let methodMap;
         let stack;
         if (method !== "USE") {
@@ -2193,7 +715,7 @@ module.exports = class Router extends EventEmitter {
                 stack,
                 // the route as a request sees it, which is the route itself unless the path was
                 // normalised. Written into the literal so every route keeps one shape
-                exposed: /** @type {any} */ (undefined),
+                exposed: /** @type {RouteEntry|undefined} */ (undefined),
                 routeKey: routeKey++,
                 // which app.route() this came from, when it came from one, so the routes it built
                 // count as one route where an error is concerned. undefined for every other route
@@ -2251,327 +773,23 @@ module.exports = class Router extends EventEmitter {
     }
 
     /**
-     * The chain a request would walk to reach this route, or false when it cannot be known ahead of
-     * time. The native router jumps straight to the route, so everything registered before it that
-     * could also match has to be in the chain, in order.
+     * The chain a request would walk to reach this route, see optimizeRoute in optimizer.js. Kept
+     * as a method because a mounted router is asked for its own through it.
      *
-     * @param {any} route
-     * @param {any[]} routes every route of this router, in registration order
-     * @returns {any[]|false} the chain, ending in the route itself
+     * @param {RouteEntry} route
+     * @param {RouteEntry[]} routes every route of this router, in registration order
+     * @returns {RouteEntry[]|false} the chain, ending in the route itself
      */
     _optimizeRoute(route, routes) {
-        const optimizedPath = [];
-        // a route with a parameter matches paths its own text does not, so what an earlier route
-        // could answer is compared shape against shape and not against that text
-        const withParams = typeof route.path === "string" && route.path.includes(":");
-        // under insensitive routing two paths that differ only in case answer the same requests,
-        // so the text comparisons below run on the folded form. µWS itself still matches bytes:
-        // a request in the registered case takes the chain, any other case takes the fallback,
-        // and both answer as express would as long as the chain agrees with registration order
-        const caseSensitive = this._caseSensitive();
-        const routePathFolded = caseSensitive || typeof route.path !== "string" ? route.path : route.path.toLowerCase();
-        // whether this route answers only the path as written, or the one with a trailing slash too
-        const strictHere = (route.owner ?? this)._strictRouting();
-        /** @type {string[]|null} earlier literals a case variant could smuggle a request past */
-        let caseGuards = null;
-
-        for (let i = 0; i < routes.length; i++) {
-            const r = routes[i];
-            if (r.routeKey > route.routeKey) {
-                break;
-            }
-            if (r === route) {
-                continue;
-            }
-            // if the methods are not the same, and its not an all method, skip it
-            if (!r.all && r.method !== route.method) {
-                // check if the methods are compatible (GET and HEAD)
-                if (!(r.method === "HEAD" && route.method === "GET")) {
-                    // A mount is registered ALL, because what lives under it can answer any
-                    // method, and this chain is computed once for all of them. So an earlier
-                    // route of some other method is not irrelevant here the way it is for a
-                    // plain route: it belongs in the chain of the leaves that share its method
-                    // and in no other, and one chain cannot say that. µWS would then jump
-                    // straight to a leaf and answer as though the earlier route did not exist,
-                    // which is what let a literal route inside a mounted router beat a parameter
-                    // route written before the mount. Leave the mount to ordinary dispatch,
-                    // where express's own order is what decides.
-                    if (route.use && typeof route.path === "string" && couldAnswer(r, route.path)) {
-                        return false;
-                    }
-                    continue;
-                }
-            }
-
-            // The same rule as the one just above, which a route of another method reaches by
-            // another road. A mount's chain is inherited by every path under it, and a route that
-            // is not itself a mount answers the mount point rather than the subtree: in the chain
-            // it ran for the whole of it, so router.all("/:p1") answered the /posts/a-b that
-            // belongs to the router mounted at /posts. guardsInside is written for this: only
-            // layers with more segments than the mount path are asked about a leaf.
-            if (route.use && !r.use && typeof route.path === "string" && couldAnswer(r, route.path)) {
-                return false;
-            }
-
-            // a RegExp mount runs only where its match starts the path and breaks on a separator,
-            // which is decidable here against a literal path and not against one with a parameter
-            if (r.regexMount) {
-                const matched = typeof route.path === "string" ? r.pattern.exec(route.path) : null;
-                const runsAlways =
-                    matched !== null &&
-                    !matched[0].includes(":") &&
-                    route.path.slice(0, matched[0].length) === matched[0] &&
-                    (route.path.length === matched[0].length || route.path[matched[0].length] === "/");
-                if (runsAlways) {
-                    if (r.callbacks.some((c) => c instanceof Router)) {
-                        return false;
-                    }
-                    optimizedPath.push(r);
-                    continue;
-                }
-                // it may still answer some of the paths this route matches, and the chain has no
-                // way to say "only sometimes"
-                if (matched !== null || withParams) {
-                    return false;
-                }
-                continue;
-            }
-
-            // check if the paths match. A route with parameters is excluded from the text test:
-            // its literal ":name" text would let an earlier regex in on requests it never matches.
-            const regexCanMatch = r.pattern instanceof RegExp && (!withParams || r.use);
-            if (
-                (regexCanMatch && r.pattern.test(route.path)) ||
-                (typeof r.pattern === "string" &&
-                    (r.pattern === route.path ||
-                        (!caseSensitive && r.pattern.toLowerCase() === routePathFolded) ||
-                        r.pattern === "/*"))
-            ) {
-                if (r.callbacks.some((c) => c instanceof Router)) {
-                    return false; // cant optimize nested routers with matches
-                }
-                optimizedPath.push(r);
-                continue;
-            }
-            // Without strict routing this registration answers "/x/" as well as "/x". An earlier
-            // pattern matching only the second answers part of what the registration takes and not
-            // the rest, which the chain has no way to say: it runs what is in it without matching
-            // again. Both spellings used to put the route in whole, so app.all("/:p0/{:o1}/{:o2}")
-            // answered a GET /list/Mixed that belonged to the route written after it. An ordinary
-            // pattern answers both spellings, so only an optional group or a wildcard reaches here.
-            if (regexCanMatch && !strictHere && r.pattern.test(route.path + "/")) {
-                return false;
-            }
-            if (!withParams) {
-                continue;
-            }
-            // an earlier route that answers only some of the paths this one matches cannot go in
-            // the chain, which runs what is in it without matching again
-            if (typeof r.path !== "string" || !canBeOptimizedWithParams(r.path)) {
-                return false;
-            }
-            const rPathFolded = caseSensitive ? r.path : r.path.toLowerCase();
-            if (!pathsCanOverlap(rPathFolded, routePathFolded, r.use)) {
-                continue;
-            }
-            if (r.use) {
-                return false;
-            }
-            // the same path lands on the same µWS registration, so the earlier route runs first
-            // from inside the chain, under its own parameter names; a case variant of it lands on
-            // its own registration, whose chain was computed the same way, or on the fallback
-            if (rPathFolded === routePathFolded) {
-                if (r.callbacks.some((c) => c instanceof Router)) {
-                    return false;
-                }
-                optimizedPath.push(r);
-                continue;
-            }
-            // otherwise the two overlap only where µWS itself hands the request to the earlier,
-            // more specific registration, so this chain never sees those paths
-            if (
-                !r.optimizedPath ||
-                !uwsPrefersEarlier(r.path, route.path) ||
-                (!caseSensitive && route.path !== routePathFolded)
-            ) {
-                return false;
-            }
-            // that argument is about bytes. Under insensitive routing "/POSTS" byte-matches no
-            // registration of "/posts", so µWS hands it here instead, where this chain would
-            // answer as if the earlier route did not exist. The literal is remembered so the
-            // registration can send those requests to the generic router, which is the only place
-            // express's own order can decide; a path with no letter in it has no other case to
-            // arrive in and needs no guard
-            if (!caseSensitive && HAS_LETTER.test(r.path)) {
-                (caseGuards ??= []).push(r.path);
-            }
-        }
-        optimizedPath.push(route);
-        route._caseGuards = caseGuards;
-
-        return optimizedPath;
+        return optimizeRoute(this, route, routes);
     }
 
     /**
-     * Hands every route reachable by path alone to the native uWS router, walking into mounted
-     * routers and carrying their prefix down. Runs once, when the app starts listening, since it
-     * needs every route to have been registered first.
+     * Hands every route reachable by path alone to the native uWS router, see
+     * compileOptimizedRoutes in optimizer.js. Runs once, when the app starts listening.
      */
     _compileOptimizedRoutes() {
-        if (!this.uwsApp) {
-            return;
-        }
-        // Everything below is what makes this framework fast, and every one of its decisions is a
-        // claim that µWS answering by itself is the same answer the chain would have given. Turned
-        // off, the claim is not made and the chain answers everything. Serving one application both
-        // ways and comparing the answers is what tests those claims: `npm run fuzz -- --self`.
-        if (this.get("native routes") === false) {
-            return;
-        }
-
-        // pathPrefix/chainPrefix accumulate across nested sole-callback mounts, and outerGuards
-        // carries what was written before them and answers only part of what is under them
-        const walk = (router, pathPrefix, chainPrefix, outerGuards) => {
-            for (const route of router._routes) {
-                if (route.use) {
-                    // only sole-callback mounts. Case rules do not gate the walk: each level's
-                    // _optimizeRoute guards its own routes under its own setting, and a request
-                    // in any other case than the registered one takes the fallback, which
-                    // honours the child's setting on its own
-                    if (
-                        !route.complex &&
-                        canBeOptimized(route.path) &&
-                        route.path !== "/*" &&
-                        route.callbacks.length === 1 &&
-                        route.callbacks[0] instanceof Router
-                    ) {
-                        let pathToMount = router._optimizeRoute(route, router._routes);
-                        if (!pathToMount) {
-                            route._whyGeneric = "something before it in the same router overlaps its paths";
-                            continue;
-                        }
-                        pathToMount = pathToMount.slice(0, -1);
-                        const guards = guardsInside(router, route, pathPrefix, pathToMount, outerGuards);
-                        if (guards === null) {
-                            route._whyGeneric = "a path written before it cannot be read segment by segment";
-                            continue;
-                        }
-                        route._walkedInto = true;
-                        walk(
-                            route.callbacks[0],
-                            pathPrefix + route.path,
-                            [
-                                ...chainPrefix,
-                                ...pathToMount,
-                                {
-                                    ...route,
-                                    callbacks: [],
-                                    callbackKinds: [],
-                                    keepMount: true,
-                                    // mounted sub-apps become req.app during their dispatch, like express
-                                    mountApp:
-                                        route.callbacks[0].constructor.name === "Application"
-                                            ? route.callbacks[0]
-                                            : undefined
-                                }
-                            ],
-                            guards
-                        );
-                    } else {
-                        // said once here rather than at each condition above: a mount is walked into
-                        // only when µWS can match its path on its own and it carries exactly one
-                        // router, and those are the two things worth telling anyone about
-                        route._whyGeneric = !(route.callbacks.length === 1 && route.callbacks[0] instanceof Router)
-                            ? "it is middleware rather than a single mounted router"
-                            : "µWS cannot match this mount path on its own";
-                    }
-                    // µWS picks by specificity and Express by registration order, so the chain
-                    // computed for whichever route µWS lands on runs everything that could have
-                    // matched before it
-                } else if (
-                    // parameters that are whole segments are matched by µWS the same way
-                    (canBeOptimized(route.path) || canBeOptimizedWithParams(route.path)) &&
-                    // Inside a mounted router, only when nothing after it could answer the same
-                    // path. This used to be asked of parameter routes alone, and a literal one
-                    // needs it just as much: µWS picks by specificity where Express picks by
-                    // registration order, and a chain carries only what runs in front of its
-                    // route, so `router.get("/a", (req, res, next) => next())` followed by
-                    // `router.get("/:x", ...)` left the mount instead of reaching the second
-                    // route, and answered 404 where Express answers it. Found by the fuzzer,
-                    // replay with --seed 221940161 --rounds 1.
-                    (!pathPrefix || !router._isFollowedByAnOverlap(route, router._routes)) &&
-                    supportedUwsMethods.has(route.method)
-                ) {
-                    // something outside this router, written before the mount it is in, that could
-                    // answer this exact path. µWS would jump here and never give it its turn
-                    if (outerGuards.length > 0 && typeof route.path === "string") {
-                        const absolute = pathPrefix + route.path;
-                        const guard = outerGuards.find((g) => shadowsLeaf(g, absolute, route));
-                        if (guard) {
-                            route._whyGeneric = `${guard.path} is written before the mount it is in and answers the same paths`;
-                            continue;
-                        }
-                    }
-                    const leafPath = router._optimizeRoute(route, router._routes);
-                    if (!leafPath) {
-                        route._whyGeneric = "something before it in the same router overlaps its paths";
-                        continue;
-                    }
-                    // param route earlier in the same router would steal this static path
-                    if (leafPath.length > 1) {
-                        const shadow = leafPath[leafPath.length - 2];
-                        if (
-                            shadow &&
-                            !shadow.use &&
-                            shadow.method === route.method &&
-                            shadow.path !== route.path &&
-                            shadow.pattern instanceof RegExp
-                        ) {
-                            route._whyGeneric = `the parameter route ${shadow.path} is written before it`;
-                            continue;
-                        }
-                    }
-                    // the prefix goes in whether or not the mount had a path: a pathless mount
-                    // adds nothing to the path and everything to the chain, the middlewares in
-                    // front of it and the mount entry that says where to resume
-                    const chain = chainPrefix.length > 0 ? [...chainPrefix, ...leafPath] : leafPath;
-                    if (pathPrefix) {
-                        const registered = {
-                            ...route,
-                            path: pathPrefix + route.path,
-                            pattern: pathPrefix + route.path,
-                            optimizedRouter: true
-                        };
-                        if (route._caseGuards) {
-                            // compared against the whole path µWS matched, so they carry the mount
-                            // prefix, folded along with the rest of it
-                            registered._caseGuards = route._caseGuards.map((p) => pathPrefix + p);
-                        }
-                        this._registerUwsRoute(registered, chain);
-                        // the chain holds the original object, so the request-time guard has to
-                        // find the computed fields there, or a mounted param route extracts its
-                        // params twice. The names match: the prefix is static, so the copy's path
-                        // adds no parameter of its own
-                        route.optimizedParams = registered.optimizedParams;
-                        route.optimizedPath = registered.optimizedPath;
-                        // and what was decided about it, for the same reason: the copy is thrown
-                        // away and the profile reads the route the application actually holds
-                        route._native = registered._native;
-                    } else {
-                        this._registerUwsRoute(route, chain);
-                    }
-                } else if (!supportedUwsMethods.has(route.method)) {
-                    route._whyGeneric = `µWS does not serve ${route.method}`;
-                } else if (canBeOptimized(route.path) || canBeOptimizedWithParams(route.path)) {
-                    // eligible but for the overlap test, which only applies inside a mount
-                    route._whyGeneric = "a route after it in the same mounted router could answer the same paths";
-                } else {
-                    route._whyGeneric = "µWS cannot match this path on its own";
-                }
-            }
-        };
-
-        walk(this, "", [], []);
+        compileOptimizedRoutes(this);
     }
 
     /**
@@ -2579,12 +797,12 @@ module.exports = class Router extends EventEmitter {
      * request does whichever path serves it. The response rides back as request.res: returning
      * a `{ request, response }` pair was one throwaway object per request.
      *
-     * @param {any} res uWS response
-     * @param {any} req uWS request, readable only during this call
-     * @param {any} [preset] a literal registration's constants, see nativePreset
-     * @param {any} [skipHolder] the object a granted header skip lives on: the preset itself
+     * @param {UwsResponse} res uWS response
+     * @param {UwsRequest} req uWS request, readable only during this call
+     * @param {NativePreset} [preset] a literal registration's constants, see nativePreset
+     * @param {SkipHolder} [skipHolder] the object a granted header skip lives on: the preset itself
      *   for a literal registration, a holder of its own for a parameterised one
-     * @returns {any} the request, with the response reachable as request.res
+     * @returns {Request} the request, with the response reachable as request.res
      */
     handleRequest(res, req, preset, skipHolder) {
         const request = new this._request(req, res, this, preset, skipHolder);
@@ -2598,19 +816,17 @@ module.exports = class Router extends EventEmitter {
      * Refuses a request whose framing cannot be trusted and hangs up without answering. No route
      * runs, so nothing downstream can be reached by one.
      *
-     * Hanging up is the whole point: uWS has already read what followed the body it believed in as
-     * a second, pipelined request, and it dispatches that one unless the socket goes. Node answers
+     * Hanging up is the point: uWS has already read what followed the body it believed in as a
+     * second, pipelined request, and it dispatches that one unless the socket goes. Node answers
      * 400 and then closes, and this cannot do both: uWS only skips the queued request when the
-     * response is closed rather than completed, and any of writeStatus, end or endWithoutBody
-     * completes it. Measured every combination, and delivering the 400 always let the smuggled
-     * request through, so the close wins and the client gets nothing. Nothing legitimate sends two
-     * content-lengths, so there is no well-behaved client to explain it to.
+     * response is closed rather than completed, and writeStatus, end and endWithoutBody all
+     * complete it. Every combination was measured and delivering the 400 always let the smuggled
+     * request through, so the close wins.
      *
      * Called once handleRequest has fully returned, never from inside it: an Application links the
-     * response into its pending list after the base call, and the 'close' emitted here is what
-     * takes it back out again.
+     * response into its pending list after the base call, and the 'close' emitted here takes it out.
      *
-     * @param {any} response
+     * @param {Response} response
      */
     _refuseRequest(response) {
         response.finished = true;
@@ -2623,8 +839,8 @@ module.exports = class Router extends EventEmitter {
      * for a response that outlives its handler callback: the native handler arms it in its
      * finally when the answer is still pending, which on a synchronous route it never is.
      *
-     * @param {any} res uWS response
-     * @param {any} response
+     * @param {UwsResponse} res uWS response
+     * @param {Response} response
      */
     _armAbort(res, response) {
         res.onAborted(onNativeAborted.bind(response));
@@ -2638,8 +854,8 @@ module.exports = class Router extends EventEmitter {
      * mount or a pattern of an unknown shape counts as an overlap; two paths µWS could match itself
      * are compared segment by segment.
      *
-     * @param {any} route
-     * @param {any[]} routes every route of the router this one belongs to
+     * @param {RouteEntry} route
+     * @param {RouteEntry[]} routes every route of the router this one belongs to
      * @returns {boolean}
      */
     _isFollowedByAnOverlap(route, routes) {
@@ -2670,244 +886,14 @@ module.exports = class Router extends EventEmitter {
     }
 
     /**
-     * Hands one route to µWS, along with the chain of everything that has to run in front of it,
-     * and records that chain on the route so the handler can walk it.
+     * Registers one route with uWS, see registerUwsRoute in optimizer.js. Kept as a method because
+     * the optimizer tests replace it to see which routes went native.
      *
-     * @param {any} route
-     * @param {any[]} optimizedPath the routes to run, in order, ending with this one
+     * @param {RouteEntry} route
+     * @param {RouteEntry[]} optimizedPath the chain the route was optimized with
      */
     _registerUwsRoute(route, optimizedPath) {
-        let method = route.method.toLowerCase();
-        if (method === "all") {
-            method = "any";
-        } else if (method === "delete") {
-            method = "del";
-        }
-        if (route.path.includes(":")) {
-            route.optimizedParams = route.path.match(regExParam).map((p) => p.slice(1));
-        }
-        // null for almost every route: only a parameter route with an earlier literal that a case
-        // variant could slip past carries one, see _optimizeRoute. Built once here, and matched
-        // insensitively, since that is the folding the guard exists for
-        const caseGuards = route._caseGuards
-            ? route._caseGuards.map((p) =>
-                  needsConversionToRegex(p) ? patternToRegex(p, false, false) : p.toLowerCase()
-              )
-            : null;
-        const makeHandler = (chain, preset, skips, wireMethod) => {
-            // the mutable object a granted skip lives on, so a middleware arriving after
-            // listen can take it back: a literal registration's preset doubles as it, and a
-            // parameterised one, which has no preset, gets a holder of its own. It also carries
-            // the registration's method, so the constructor settles it with one compare
-            let skipHolder = preset;
-            if (skipHolder === undefined && (skips.skipHeaders || skips.skipQuery || wireMethod !== null)) {
-                skipHolder = {
-                    skipHeaders: skips.skipHeaders,
-                    skipQuery: skips.skipQuery,
-                    method: wireMethod,
-                    isOptions: wireMethod === "OPTIONS",
-                    isHead: wireMethod === "HEAD"
-                };
-                if (skips.skipHeaders || skips.skipQuery) {
-                    (this._skipPresets ??= new Set()).add(skipHolder);
-                }
-            }
-            // all three are registration-time constants: computing them in the handler was a
-            // closure and a scan of the chain on every native request.
-            // Falling back resumes after the mount, not after the router's leaf: the leaf can have
-            // a lower routeKey than the parent's middlewares, and an error handler declared before
-            // the mount must not catch what the router threw
-            const mount = chain.find((r) => r.keepMount);
-            const skipUntil = mount ?? chain[chain.length - 1];
-            const optimizedParams = route.optimizedParams;
-            // not async, and no _routeRequest: its promise pair exists for callers that await,
-            // and this one never did. nativeDone and nativeFail defer their epilogues to a
-            // microtask, which is where the await used to resume, so the visible order holds
-            return (res, req) => {
-                // a request that is an earlier literal in another case: express answers it with
-                // that route, and the chain here does not contain it, so the generic router takes
-                // this one
-                if (caseGuards !== null && anyGuardHits(caseGuards, req.getUrl())) {
-                    // an application is what registers native routes, and only it serves
-                    return /** @type {any} */ (this)._serveGeneric(res, req);
-                }
-                const request = this.handleRequest(res, req, preset, skipHolder);
-                const response = request.res;
-                if (request._mustRefuse === true) {
-                    return this._refuseRequest(response);
-                }
-                if (optimizedParams) {
-                    // slicing these out of the already-fetched path instead measured a wash:
-                    // the segment scan costs what the crossing costs
-                    request.optimizedParams = new NullObject();
-                    for (let i = 0; i < optimizedParams.length; i++) {
-                        request.optimizedParams[optimizedParams[i]] = req.getParameter(i);
-                    }
-                }
-                const walk = new Walk(this, request, response, chain, true, skipUntil, nativeDone, nativeFail);
-                try {
-                    walk.dispatch(0);
-                } catch (err) {
-                    // what a throw inside a promise executor did: reject, once
-                    nativeFail.call(walk, err);
-                } finally {
-                    // whatever runs after this line is outside the cork uWS held for this
-                    // callback, so later writes have to open their own
-                    response._corkNeeded = true;
-                    // an abort can only arrive after this callback returns, so a response that
-                    // already finished inside it never needs uWS told at all
-                    if (!response.finished) {
-                        this._armAbort(res, response);
-                    }
-                }
-            };
-        };
-        // a HEAD route may sit in a GET route's chain so the head registration runs it, but a
-        // chain runs without re-matching the method, so the get registration must not see it
-        const getChain =
-            route.method === "GET" ? optimizedPath.filter((r) => r.all || r.method !== "HEAD") : optimizedPath;
-        route.optimizedPath = optimizedPath;
-        const headChain = getChain.length === optimizedPath.length ? getChain : optimizedPath;
-
-        // A fully literal registration knows path and method here, so each registration site
-        // hands the request constructor its own constants. An "any" registration serves every
-        // verb and a parameterised one matches paths it cannot spell, so both stay dynamic
-        const canPreset = !route.optimizedParams && method !== "any";
-        // the route's own router decides, not the app running the registration: a router created
-        // with { strict: true } and mounted on an app without it does not answer /things/, and
-        // registering that path here is the only way it could
-        const strictHere = (route.owner ?? this)._strictRouting();
-
-        // Whether requests served by this registration may skip the header copy: GET and its
-        // HEAD twins only, no error middleware may exist anywhere (a throw hands the request to
-        // code the analysis never saw), and every callback in the chain has to pass the source
-        // analysis in usage.js, whose default answer is no.
-        //
-        // The etag setting is not one of the conditions. It used to be, on the grounds that send
-        // consults freshness, but the skip branch reads if-none-match and if-modified-since by
-        // name whatever the setting, see the comment at request.js:527, and
-        // req.fresh reads nothing else off the request. Requiring etag off as well cost the copy
-        // to every application that left it on, which is every application that did not go
-        // looking for the setting.
-        const NO_SKIPS = { skipHeaders: false, skipQuery: false };
-        let getSkips = NO_SKIPS;
-        let headSkips = NO_SKIPS;
-        if (route.method === "GET") {
-            let hasErr = this._hasErrMwCache;
-            if (hasErr === undefined) {
-                hasErr = this._hasErrMwCache = hasErrorMiddleware(this);
-            }
-            if (!hasErr) {
-                // a terminal next() may only fall into the framework's own 404, so no later
-                // route may be able to catch the same path
-                const owner = route.owner ?? this;
-                const noLaterMatch = !owner._isFollowedByAnOverlap.call(owner, route, owner._routes);
-                getSkips = chainUsage(getChain, noLaterMatch);
-                headSkips = headChain === getChain ? getSkips : chainUsage(headChain, noLaterMatch);
-            }
-        }
-        // remembered so a middleware or setting arriving after listen can take the skips back
-        const makePreset = (path, method, skips) => {
-            const preset = nativePreset(path, method);
-            if (skips.skipHeaders || skips.skipQuery) {
-                preset.skipHeaders = skips.skipHeaders;
-                preset.skipQuery = skips.skipQuery;
-                (this._skipPresets ??= new Set()).add(preset);
-            }
-            return preset;
-        };
-
-        // the wire token this registration answers; "any" serves every verb and stays dynamic
-        const wireMethod = method === "any" ? null : route.method;
-        let fn = makeHandler(
-            getChain,
-            canPreset ? makePreset(route.path, route.method, getSkips) : undefined,
-            getSkips,
-            wireMethod
-        );
-        const jsFn = fn;
-
-        let replacedPath = route.path;
-
-        // the response prototype the route will really run under: its own app's, which sees a
-        // method patched there or inherited from a parent app, falling back to the registering app
-        const responseProto = /** @type {any} */ (route.owner)?.response ?? /** @type {any} */ (this).response;
-        // check if route is declarative
-        if (
-            optimizedPath.length === 1 && // must not have middlewares
-            route.callbacks.length === 1 && // must not have multiple callbacks
-            typeof route.callbacks[0] === "function" && // must be a function
-            route.paramCallbacks.size === 0 && // a param callback has to run, and this answers without running anything
-            // a captured value is decoded when the route runs, and one that cannot be decoded is a
-            // 400 in express and on the ordinary path here. Nothing runs to raise it on a
-            // declarative response, so GET /a-b%5Ec@d%e came back 200 from app.get("/:p12")
-            route.optimizedParams === undefined &&
-            // a declarative response is answered by µWS itself, so no javascript runs and the case
-            // guard could not: a route that needs one has to stay an ordinary handler
-            caseGuards === null &&
-            !resDecMethods.some((method) => resCodes[method] !== responseProto[method].toString()) && // must not have injected methods
-            this.get("declarative responses") // must have declarative responses enabled
-        ) {
-            const decRes = compileDeclarative(route.callbacks[0], this);
-            if (decRes) {
-                fn = decRes;
-            }
-        } else {
-            replacedPath = route.path.replace(regExParam, ":x");
-        }
-
-        // what listen() settled about this route, kept so `npx fulmine profile` can print it rather
-        // than making anyone read the source or instrument it. Written once, during compilation,
-        // so no request pays for it
-        route._native = {
-            path: replacedPath,
-            declarative: fn !== jsFn,
-            skipHeaders: getSkips.skipHeaders === true,
-            skipQuery: getSkips.skipQuery === true,
-            ahead: optimizedPath.length - 1,
-            guards: caseGuards ? caseGuards.length : 0
-        };
-
-        this.uwsApp[method](replacedPath, fn);
-        if (!strictHere && route.path[route.path.length - 1] !== "/") {
-            // a declarative response answers the twin as itself; a preset handler cannot be
-            // shared, since the twin's path is its own constant
-            const slashFn =
-                fn !== jsFn
-                    ? fn
-                    : canPreset
-                      ? makeHandler(
-                            getChain,
-                            makePreset(route.path + "/", route.method, getSkips),
-                            getSkips,
-                            wireMethod
-                        )
-                      : fn;
-            this.uwsApp[method](replacedPath + "/", slashFn);
-            if (method === "get") {
-                this.uwsApp.head(
-                    replacedPath + "/",
-                    makeHandler(
-                        headChain,
-                        canPreset ? makePreset(route.path + "/", "HEAD", headSkips) : undefined,
-                        headSkips,
-                        "HEAD"
-                    )
-                );
-            }
-        }
-        if (method === "get") {
-            // its own handler always: the shared one would carry the GET registration's method
-            this.uwsApp.head(
-                replacedPath,
-                makeHandler(
-                    headChain,
-                    canPreset ? makePreset(route.path, "HEAD", headSkips) : undefined,
-                    headSkips,
-                    "HEAD"
-                )
-            );
-        }
+        registerUwsRoute(this, route, optimizedPath);
     }
 
     /**
@@ -2915,10 +901,10 @@ module.exports = class Router extends EventEmitter {
      * Passing something to next() from an error handler clears the error and resumes routing,
      * which is how Express lets a handler decide the error was not fatal.
      *
-     * @param {any} err
+     * @param {any} err whatever was thrown, which need not be an Error
      * @param {Function|null} handler the four-argument handler to call, or null for the default
-     * @param {any} request
-     * @param {any} response
+     * @param {Request} request
+     * @param {Response} response
      */
     _handleError(err, handler, request, response) {
         if (handler) {
@@ -2936,6 +922,14 @@ module.exports = class Router extends EventEmitter {
             }
         }
         logError(this, err);
+        // no error page can follow a head that is out, so express's final handler closes the
+        // connection instead, and leaves a response that was already ended as it is
+        if (response.headersSent) {
+            if (!response.finished) {
+                response.destroy();
+            }
+            return;
+        }
         if (response.statusCode === 200) {
             // the status the error carries, as express's own final handler reads it: a body that
             // was too large or a request cut short is the client's 4xx, not a 500 from here
@@ -2949,7 +943,7 @@ module.exports = class Router extends EventEmitter {
      * The HTML for an error, which in production says only what the status means rather than what
      * went wrong, so a stack trace does not reach the client.
      *
-     * @param {any} err
+     * @param {unknown} err whatever was thrown, which need not be an Error
      * @param {number} statusCode
      * @param {boolean} [checkEnv] whether production should redact it
      * @returns {string}
@@ -3026,10 +1020,10 @@ module.exports = class Router extends EventEmitter {
      * and from any mergeParams parents, and the app.param callbacks for the parameters this route
      * matched that this request has not already seen.
      *
-     * @param {any} req
-     * @param {any} res
-     * @param {any} route
-     * @returns {any} a promise only when a param callback is involved
+     * @param {Request} req
+     * @param {Response} res
+     * @param {RouteEntry} route
+     * @returns {Promise<true|"route">|true|"route"} a promise only when a param callback is involved
      */
     _preprocessRequest(req, res, route) {
         // express sets this inside Route#dispatch, so only a route ever writes one: a middleware
@@ -3081,11 +1075,10 @@ module.exports = class Router extends EventEmitter {
         // the route's own router's callbacks: an optimized chain is walked by the app even when it
         // ends in a mounted router's route
         //
-        // A route an OPTIONS request reaches only to have its verb counted for the automatic reply
-        // is not a route this request runs, and express does not run its app.param() callbacks for
-        // it. The same condition runRoute counts the verb under, see the OPTIONS branch there. The
-        // decoding above still happens either way, because express decodes a layer whose path
-        // matched whatever its method is, which is what answers 400 for a malformed escape.
+        // A route an OPTIONS request reaches only to have its verb counted is not a route this
+        // request runs, and express does not run its app.param() callbacks for it. Same condition
+        // as the OPTIONS branch in runRoute. The decoding above happens either way, because express
+        // decodes a layer whose path matched whatever its method is
         const paramCallbacks = route.paramCallbacks;
         if (paramCallbacks.size > 0 && !(req._isOptions && !route.all && route.method !== "OPTIONS")) {
             return this._runParamCallbacks(req, res, route, paramCallbacks);
@@ -3098,8 +1091,8 @@ module.exports = class Router extends EventEmitter {
      * route whose path matched and whose method did not, which express still decodes: the 400 it
      * answers there is what this reproduces.
      *
-     * @param {any} route
-     * @param {any} req
+     * @param {RouteEntry} route
+     * @param {Request} req
      * @returns {boolean}
      */
     _paramsFailToDecode(route, req) {
@@ -3118,13 +1111,13 @@ module.exports = class Router extends EventEmitter {
      * Runs the app.param() callbacks for the parameters this route matched, and says whether the
      * route may run.
      *
-     * Express calls one once per value and not once per request: the same name matched with a
-     * different value calls it again, and a value it has already seen restores whatever that call
-     * left in req.params, its deferral or its error included, without running anything.
+     * Express calls one once per value and not once per request: the same name with a different
+     * value calls it again, and a value already seen restores what that call left in req.params,
+     * its deferral or its error included, without running anything.
      *
-     * @param {any} req
-     * @param {any} res
-     * @param {any} route
+     * @param {Request} req
+     * @param {Response} res
+     * @param {RouteEntry} route
      * @param {Map<string, Function[]>} paramCallbacks the owning router's, which is also the key of
      *   its own cache: two routers that declare the same parameter each call their own
      * @returns {Promise<true|"route">|true}
@@ -3247,7 +1240,7 @@ module.exports = class Router extends EventEmitter {
 
     /**
      * Resolves with the route that answered, or false when nothing matched.
-     * @returns {Promise<any>}
+     * @returns {Promise<RouteEntry|false>}
      */
     _routeRequest(req, res, startIndex = 0, routes = this._routes, skipCheck = false, skipUntil) {
         return new Promise((resolve, reject) => {
@@ -3260,8 +1253,8 @@ module.exports = class Router extends EventEmitter {
      * and nativeFail defer their epilogues to the microtask the await used to resume on, so the
      * visible order holds.
      *
-     * @param {any} req
-     * @param {any} res
+     * @param {Request} req
+     * @param {Response} res
      */
     _routeRequestDirect(req, res) {
         const walk = new Walk(this, req, res, this._routes, false, undefined, nativeDone, nativeFail);
@@ -3313,21 +1306,20 @@ module.exports = class Router extends EventEmitter {
                 settingsEpoch.n++;
             }
         }
-        this.createRoute("USE", path, this, ...callbacks);
+        // a handler in the path position was moved to the callbacks above
+        this.createRoute("USE", /** @type {string|RegExp|(string|RegExp)[]} */ (path), this, ...callbacks);
         return this;
     }
 
     /**
-     * Registers a websocket route, which µWS serves itself.
+     * Registers a websocket route, which uWS serves itself.
      *
-     * The behavior is µWS's, settings and socket handlers alike, plus one addition: an
-     * `upgrade(req, res)` of this project's own shape, which runs before the handshake with a
-     * real request and response. Answering with the response declines the socket, which is how
-     * a check refuses one; returning a promise holds the handshake until it settles.
+     * The behavior is uWS's, settings and socket handlers alike, plus one addition: an
+     * `upgrade(req, res)` of this project's own shape, which runs before the handshake with a real
+     * request and response. Answering with the response declines the socket; returning a promise
+     * holds the handshake until it settles.
      *
-     * The request lives as long as the socket and reaches every handler as `ws.req`, so what
-     * the upgrade learned about the client, and anything it hangs on the request, is there when
-     * a message arrives.
+     * The request lives as long as the socket and reaches every handler as `ws.req`.
      *
      * @example
      * app.ws("/room/:id", {
@@ -3340,7 +1332,7 @@ module.exports = class Router extends EventEmitter {
      * });
      *
      * @param {string} path a literal path, or one whose parameters are whole segments
-     * @param {object} behavior µWS's WebSocketBehavior, plus the optional `upgrade` above
+     * @param {Record<string, unknown>} behavior uWS's WebSocketBehavior, plus the optional `upgrade` above
      * @returns {this}
      */
     ws(path, behavior) {
@@ -3376,7 +1368,7 @@ module.exports = class Router extends EventEmitter {
             this._pendingGroupMethods = groupMethods;
             this._pendingGroupStack = groupStack;
             try {
-                return this.createRoute(method, path, /** @type {any} */ (fns), ...callbacks);
+                return this.createRoute(method, path, fns, ...callbacks);
             } finally {
                 this._pendingGroup = undefined;
                 this._pendingGroupMethods = undefined;
@@ -3394,9 +1386,9 @@ module.exports = class Router extends EventEmitter {
      * Answers with an error page, locked down: no sniffing, no ETag, and a content security policy
      * that allows nothing, since the page carries a message that came from somewhere else.
      *
-     * @param {any} request
-     * @param {any} response
-     * @param {any} err
+     * @param {Request} request
+     * @param {Response} response
+     * @param {unknown} err whatever was thrown, which need not be an Error
      * @param {boolean} [checkEnv] whether production should redact it
      */
     _sendErrorPage(request, response, err, checkEnv = false) {
@@ -3416,13 +1408,13 @@ module.exports = class Router extends EventEmitter {
      * answering when the head has already been written, which is what node's setHeader would do
      * and what lets an error handler see it, as in Express.
      *
-     * @param {any} request
-     * @param {any} response
+     * @param {Request} request
+     * @param {Response} response
      * @param {Set<string>} methods the verbs the answering router knows, which are its own
      */
     _sendOptionsReply(request, response, methods) {
-        if (response._headWritten) {
-            throw new Error("Cannot set headers after they are sent to the client");
+        if (response.headersSent) {
+            throw headersSentError("set");
         }
         // Express 5 sorts the methods and joins them with ", ", so the header reads the same
         // regardless of the order the routes happened to be registered in
@@ -3440,14 +1432,15 @@ module.exports = class Router extends EventEmitter {
      * OPTIONS reply, or with a 404. The native chain, the app's catch-all handler and the node shim
      * all end here, so that they end a request the same way.
      *
-     * @param {any} request
-     * @param {any} response
+     * @param {Request} request
+     * @param {Response} response
      */
     _endUnmatched(request, response) {
         if (request._error) {
             return this._handleError(request._error, null, request, response);
         }
-        if (request._isOptions && request._matchedMethods.size > 0) {
+        // the null test costs nothing outside an OPTIONS request, and only one carries the set
+        if (request._isOptions && request._matchedMethods !== null && request._matchedMethods.size > 0) {
             try {
                 this._sendOptionsReply(request, response, request._matchedMethods);
             } catch (err) {
@@ -3469,6 +1462,9 @@ module.exports = class Router extends EventEmitter {
 // The verb methods go on the prototype, not on each instance. As own arrows they closed over the
 // instance they were built on, so express.Router().post(...) answered with the object the callable
 // was copied from. One closure per name for the process instead of one per router, too.
+// the optimizer needs the class to tell a mounted router from a plain handler
+useRouterClass(module.exports);
+
 for (const method of methods) {
     module.exports.prototype[method] = function (path, ...callbacks) {
         return this.createRoute(method, path, this, ...callbacks);