keight 0.2.0 → 0.3.0

data/keight.gemspec

@@ -3,12 +3,12 @@
 
 Gem::Specification.new do |o|
   o.name          = "keight"
-  o.version       = "$Release: 0.2.0 $".split[1]
+  o.version       = "$Release: 0.3.0 $".split[1]
   o.author        = "makoto kuwata"
   o.email         = "kwa(at)kuwata-lab.com"
   o.platform      = Gem::Platform::RUBY
   o.homepage      = "https://github.com/kwatch/keight/tree/ruby"
-  o.license       = "MIT Lisense"
+  o.license       = "MIT"   # ref: http://spdx.org/licenses/
   o.summary       = "Jet-speed webapp framework for Ruby"
   o.description   = <<'END'
 Keight.rb is the crazy-fast webapp framework for Ruby.
@@ -18,9 +18,9 @@ See https://github.com/kwatch/keight/tree/ruby for details.
 END
 
   o.files         = Dir[*%w[
-                      README.md CHANGES.txt MIT-LICENSE keight.gemspec setup.rb Rakefile
+                      README.md CHANGES.md MIT-LICENSE keight.gemspec Rakefile
                       bin/k8rb
-                      lib/keight.rb lib/keight/**/*.{[a-z]*} lib/keight/**/.{[a-z]*}
+                      lib/keight.rb
                       test/*_test.rb test/data/* test/oktest.rb
                       bench/bench.rb bench/benchmarker.rb
                     ]]
@@ -30,8 +30,6 @@ END
   o.test_file     = "test/keight_test.rb"
 
   o.required_ruby_version = '>= 2.0'
-  o.add_runtime_dependency 'rack', '~> 1.6'
-  o.add_runtime_dependency 'baby_erubis', '~> 2.1', '>= 2.1.1'
   #o.add_development_dependency "oktest", "~> 0"
   o.add_development_dependency 'rack-test_app', '~> 1.0', '>= 1.0.0'
 end

data/lib/keight.rb

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 
 ###
-### $Release: 0.2.0 $
+### $Release: 0.3.0 $
 ### $Copyright: copyright(c) 2014-2016 kuwata-lab.com all rights reserved $
 ### $License: MIT License $
 ###
@@ -15,7 +15,7 @@ require 'digest/sha1'
 
 module K8
 
-  RELEASE  = '$Release: 0.2.0 $'.split()[1]
+  RELEASE  = '$Release: 0.3.0 $'.split()[1]
 
   FILEPATH = __FILE__
 
@@ -30,60 +30,93 @@ module K8
     "TRACE"   => :TRACE,
   }
 
+  ## ref: https://en.wikipedia.org/wiki/List_of_HTTP_status_codes
   HTTP_RESPONSE_STATUS = {
     100 => "Continue",
     101 => "Switching Protocols",
-    102 => "Processing",
+    102 => "Processing",                           # WebDAV; RFC 2518
+    103 => "Checkpoint",                           # Unofficial
     200 => "OK",
     201 => "Created",
     202 => "Accepted",
-    203 => "Non-Authoritative Information",
+    203 => "Non-Authoritative Information",        # since HTTP/1.1
     204 => "No Content",
     205 => "Reset Content",
-    206 => "Partial Content",
-    207 => "Multi-Status",
-    208 => "Already Reported",
-    226 => "IM Used",
+    206 => "Partial Content",                      # RFC 7233
+    207 => "Multi-Status",                         # WebDAV; RFC 4918
+    208 => "Already Reported",                     # WebDAV; RFC 5842
+    226 => "IM Used",                              # RFC 3229
     300 => "Multiple Choices",
     301 => "Moved Permanently",
     302 => "Found",
-    303 => "See Other",
-    304 => "Not Modified",
-    305 => "Use Proxy",
-    307 => "Temporary Redirect",
+    303 => "See Other",                            # since HTTP/1.1
+    304 => "Not Modified",                         # RFC 7232
+    305 => "Use Proxy",                            # since HTTP/1.1
+    306 => "Switch Proxy",
+    307 => "Temporary Redirect",                   # since HTTP/1.1
+    308 => "Permanent Redirect",                   # RFC 7538
     400 => "Bad Request",
-    401 => "Unauthorized",
+    401 => "Unauthorized",                         # RFC 7235
     402 => "Payment Required",
     403 => "Forbidden",
     404 => "Not Found",
     405 => "Method Not Allowed",
     406 => "Not Acceptable",
-    407 => "Proxy Authentication Required",
+    407 => "Proxy Authentication Required",        # RFC 7235
     408 => "Request Timeout",
     409 => "Conflict",
     410 => "Gone",
     411 => "Length Required",
-    412 => "Precondition Failed",
-    413 => "Request Entity Too Large",
-    414 => "Request-URI Too Long",
+    412 => "Precondition Failed",                  # RFC 7232
+    413 => "Payload Too Large",                    # RFC 7231
+    414 => "URI Too Long",                         # RFC 7231
     415 => "Unsupported Media Type",
-    416 => "Requested Range Not Satisfiable",
+    416 => "Range Not Satisfiable",                # RFC 7233
     417 => "Expectation Failed",
-    418 => "I'm a teapot",
-    422 => "Unprocessable Entity",
-    423 => "Locked",
-    424 => "Failed Dependency",
+    418 => "I'm a teapot",                         # RFC 2324
+   #420 => "Enhance Your Calm",                    # Twitter
+   #420 => "Method Failure",                       # Spring Framework
+    421 => "Misdirected Request",                  # RFC 7540
+    422 => "Unprocessable Entity",                 # WebDAV; RFC 4918
+    423 => "Locked",                               # WebDAV; RFC 4918
+    424 => "Failed Dependency",                    # WebDAV; RFC 4918
     426 => "Upgrade Required",
+    428 => "Precondition Required",                # RFC 6585
+    429 => "Too Many Requests",                    # RFC 6585
+    431 => "Request Header Fields Too Large",      # RFC 6585
+   #440 => "Login Timeout",                        # IIS
+    444 => "No Response",                          # nginx
+   #449 => "Retry With",                           # IIS
+   #450 => "Blocked by Windows Parental Controls", # Microsoft
+   #451 => "Redirect",                             # IIS
+    451 => "Unavailable For Legal Reasons",
+    495 => "SSL Certificate Error",                # nginx
+    496 => "SSL Certificate Required",             # nginx
+    497 => "HTTP Request Sent to HTTPS Port",      # nginx
+   #498 => "Invalid Token",                        # Esri
+    499 => "Client Closed Request",                # nginx
+   #499 => "Request has been forbidden by antivirus",
+   #499 => "Token Required",                       # Esri
     500 => "Internal Server Error",
     501 => "Not Implemented",
     502 => "Bad Gateway",
     503 => "Service Unavailable",
     504 => "Gateway Timeout",
     505 => "HTTP Version Not Supported",
-    506 => "Variant Also Negotiates",
-    507 => "Insufficient Storage",
-    508 => "Loop Detected",
-    510 => "Not Extended",
+    506 => "Variant Also Negotiates",              # RFC 2295
+    507 => "Insufficient Storage",                 # WebDAV; RFC 4918
+    508 => "Loop Detected",                        # WebDAV; RFC 5842
+    509 => "Bandwidth Limit Exceeded",             # Apache Web Server/cPanel
+    510 => "Not Extended",                         # RFC 2774
+    511 => "Network Authentication Required",      # RFC 6585
+    520 => "Unknown Error",                        # CloudFlare
+    521 => "Web Server Is Down",                   # CloudFlare
+    522 => "Connection Timed Out",                 # CloudFlare
+    523 => "Origin Is Unreachable",                # CloudFlare
+    524 => "A Timeout Occurred",                   # CloudFlare
+    525 => "SSL Handshake Failed",                 # CloudFlare
+    526 => "Invalid SSL Certificate",              # CloudFlare
+   #530 => "Site is frozen",                       # Unofficial
   }.each {|_, v| v.freeze }
 
   MIME_TYPES = {
@@ -210,10 +243,10 @@ module K8
     end
 
     def _parse(query_str, separator)
-      #; [!engr6] returns empty Hash object when query string is empty.
+      #; [!engr6] returns empty Hash/dict object when query string is empty.
       d = {}
       return d if query_str.empty?
-      #; [!fzt3w] parses query string and returns Hahs object.
+      #; [!fzt3w] parses query string and returns Hash/dict object.
       equal    = '='
       brackets = '[]'
       query_str.split(separator).each do |s|
@@ -363,15 +396,204 @@ module K8
     MONTHS   = [nil, 'Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun',
                      'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'].freeze
 
-    t = Time.now.utc
-    if t.strftime('%a') != WEEKDAYS[t.wday] || t.strftime('%b') != MONTHS[t.month]
-      def http_utc_time(utc_time)
-        utc_time.utc?  or
-          raise ArgumentError.new("http_utc_time(#{utc_time.inspect}): expected UTC time but got local time.")
-        return utc_time.strftime("#{WEEKDAYS[utc_time.wday]}, %d #{MONTHS[utc_time.month]} %Y %H:%M:%S GMT")
+    def _http_utc_time_without_locale(utc_time)
+      utc_time.utc?  or
+        raise ArgumentError.new("http_utc_time(#{utc_time.inspect}): expected UTC time but got local time.")
+      return utc_time.strftime("#{WEEKDAYS[utc_time.wday]}, %d #{MONTHS[utc_time.month]} %Y %H:%M:%S GMT")
+    end
+
+    has_diff = (1..12).collect {|mo| Time.utc(2000, mo, 1) }.any? {|t|
+      http_utc_time(t) != _http_utc_time_without_locale(t)
+    }
+    alias http_utc_time _http_utc_time_without_locale if has_diff
+
+
+    ##
+    ## Temporary file which is removed automatically at end of response.
+    ##
+    ## Example:
+    ##
+    ##     def do_download_csv()
+    ##       ## generate temporary filepath
+    ##       tmpfile = K8::Util::TemporaryFile.new
+    ##       p tmpfile.path      #=> ex: '/var/tmp/tmp-0372042668525.tmp'
+    ##       p File.exist?(tmpfile.path)   #=> false
+    ##       ## create temporary file and content
+    ##       sql = "select * from table1"
+    ##       system("psql dbname -A -F',' -c \"#{sql}\" | gzip > #{tmpfile.path}")
+    ##       p File.exist?(tmpfile.path)   #=> true
+    ##       ## set resonse headers
+    ##       @resp.headers['Content-Type']        = 'text/csv;charset=UTF-8'
+    ##       @resp.headers['Content-Length']      = File.size(tmpfile.path)
+    ##       @resp.headers['Content-Disposition'] = 'attachment;filename="file1.csv"'
+    ##       @resp.headers['Content-Encoding']    = "gzip"
+    ##       ## return temporary file
+    ##       return tmpfile  # will be removed automatically at end of response!!
+    ##     end
+    ##
+    class TemporaryFile
+
+      TMPDIR     = (ENV['TMPDIR'] || proc {require 'etc'; Etc.systmpdir}.call || '/tmp').chomp('/')
+      CHUNK_SIZE = 8 * 1024   # 8KB
+
+      def self.new_path(tmpdir=nil)
+        #; [!hvnzd] generates new temorary filepath under temporary directory.
+        #; [!ulb2e] uses default temporary directory path if tmpdir is not specified.
+        tmpdir ||= TMPDIR
+        randstr = rand().to_s[2..14]
+        return "#{tmpdir}/tmp-#{randstr}.tmp"
+      end
+
+      def initialize(path=nil, tmpdir: nil, chunk_size: nil)
+        #; [!ljilm] generates temporary filepath automatically when filepath is not specified.
+        @path       = path || self.class.new_path(tmpdir)
+        @tmpdir     = tmpdir if tmpdir
+        @chunk_size = chunk_size if chunk_size
+      end
+
+      attr_reader :path
+
+      def each
+        #; [!d9suq] opens temporary file with binary mode.
+        #; [!68xdj] reads chunk size data from temporary file per iteration.
+        size = @chunk_size || CHUNK_SIZE
+        File.open(@path, 'rb') do |f|
+          yield f.read(size)
+        end
+      ensure
+        #; [!i0dmd] removes temporary file automatically at end of loop.
+        #; [!347an] removes temporary file even if error raised in block.
+        File.unlink @path
+        self
+      end
+
+    end
+
+
+    ##
+    ## Invoke shell command and responses it's output to client.
+    ##
+    ## Example:
+    ##
+    ##     def do_download_csv()
+    ##       ## for example, run SQL and generate CSV file (for postgresql)
+    ##       sql = "select * from table1"
+    ##       cmd = "psql -AF',' -U dbuser dbname | iconv -f UTF-8 -t CP932 -c | gzip"
+    ##       shell_command = K8::Util::ShellCommand.new(cmd, input: sql) do
+    ##         ## callback after sending response body
+    ##         File.unlink(tempfile) if File.exist?(templfile)  # for example
+    ##       end
+    ##       begin
+    ##         return shell_command.start() do
+    ##           ## callback before sending response body
+    ##           @resp.headers['Content-Type']        = "text/csv;charset=Shift_JIS"
+    ##           @resp.headers['Content-Disposition'] = 'attachment;filename="file.csv"'
+    ##           @resp.headers['Content-Encoding']    = "gzip"
+    ##         end
+    ##       rescue K8::Util::ShellCommandError => ex
+    ##         logger = @req.env['rack.logger']
+    ##         logger.error(ex.message) if logger
+    ##         @resp.status = 500
+    ##         @resp.headers['Content-Type'] = "text/plain;charset=UTF-8"
+    ##         return ex.message
+    ##       end
+    ##     end
+    ##
+    class ShellCommand
+
+      CHUNK_SIZE = 8 * 1024
+
+      def initialize(command, input: nil, chunk_size: nil, &teardown)
+        #; [!j95pi] takes shell command and input string.
+        @command    = command  # ex: "psql -AF',' dbname | gzip"
+        @input      = input    # ex: "select * from table1"
+        @chunk_size = chunk_size || CHUNK_SIZE
+        @teardown   = teardown
+        @process_id = nil
+        @tuple      = nil
+      end
+
+      attr_reader :command, :input, :process_id
+
+      def start
+        #; [!66uck] not allowed to start more than once.
+        @process_id.nil?  or    # TODO: close sout and serr
+          raise ShellCommandError.new("Already started (comand: #{@command.inspect})")
+        #; [!9seos] invokes shell command.
+        require 'open3' unless defined?(::Open3)
+        sin, sout, serr, waiter = ::Open3.popen3(@command)
+        @process_id = waiter.pid
+        size = @chunk_size
+        begin
+          #; [!d766y] writes input string if provided to initializer.
+          sin.write(input) if input
+          sin.close()
+          #; [!f651x] reads first chunk data.
+          #; [!cjstj] raises ShellCommandError when command prints something to stderr.
+          chunk = sout.read(size)
+          if chunk.nil?
+            error = serr.read()
+            log_error(error.to_s)
+            error = "Command failed: #{@command}" if ! error || error.empty?
+            raise ShellCommandError.new(error)
+          end
+          #; [!bt12n] saves stdout, stderr, command process, and first chunk data.
+          @tuple = [sout, serr, waiter, chunk]
+          #; [!kgnel] yields callback (if given) when command invoked successfully.
+          yield if block_given?
+        #; [!2989u] closes both stdout and stderr when error raised.
+        rescue => ex
+          sout.close()
+          serr.close()
+          raise
+        end
+        #; [!fp98i] returns self.
+        self
+      end
+
+      def each
+        #; [!ssgmm] '#start()' should be called before '#each()'.
+        @process_id  or
+          raise ShellCommandError.new("Not started yet (command: #{@command.inspect}).")
+        #; [!vpmbw] yields each chunk data.
+        sout, serr, waiter, chunk = @tuple
+        @tuple = nil
+        yield chunk
+        size = @chunk_size
+        ex = nil
+        begin
+          while (chunk = sout.read(size))
+            yield chunk
+          end
+          #; [!70xdy] logs stderr output.
+          error = serr.read()
+          log_error(error) if error && ! error.empty?
+        rescue => ex
+          raise
+        ensure
+          #; [!2wll8] closes stdout and stderr, even if error raised.
+          sout.close()
+          serr.close()
+          #; [!0ebq5] calls callback specified at initializer with error object.
+          @teardown.yield(ex) if @teardown
+        end
+        #; [!ln8we] returns self.
+        self
+      end
+
+      def log_error(message)
+        $stderr.write("[ERROR] ShellCommand: #{@command.inspect} #-------\n")
+        $stderr.write(message); $stderr.write("\n") unless message.end_with?("\n")
+        $stderr.write("--------------------\n")
       end
+
     end
 
+
+    class ShellCommandError < StandardError
+    end
+
+
   end
 
 
@@ -426,300 +648,27 @@ module K8
   end
 
 
-  class BaseError < Exception
-  end
-
-
-  class ContentTypeRequiredError < BaseError
+  class BaseError < StandardError
   end
 
 
-  class UnknownActionMethodError < BaseError
+  class ActionMappingError < BaseError
   end
 
 
-  class UnknownContentError < BaseError
+  class ContentTypeRequiredError < BaseError
   end
 
 
-  class Request
-
-    def initialize(env)
-      #; [!yb9k9] sets @env.
-      @env = env
-      #; [!yo22o] sets @method as Symbol value.
-      @method = HTTP_REQUEST_METHODS[env['REQUEST_METHOD']]  or
-        raise HTTPException.new(400, "#{env['REQUEST_METHOD'].inspect}: unknown request method.")
-      #; [!twgmi] sets @path.
-      @path = (x = env['PATH_INFO'])
-      #; [!ae8ws] uses SCRIPT_NAME as urlpath when PATH_INFO is not provided.
-      @path = env['SCRIPT_NAME'] if x.nil? || x.empty?
-    end
-
-    attr_reader :env, :method, :path
-
-    def method(name=nil)
-      #; [!084jo] returns current request method when argument is not specified.
-      #; [!gwskf] calls Object#method() when argument specified.
-      return name ? super : @method
-    end
-
-    def header(name)
-      #; [!1z7wj] returns http header value from environment.
-      return @env["HTTP_#{name.upcase.sub('-', '_')}"]
-    end
-
-    def request_method
-      #; [!y8eos] returns env['REQUEST_METHOD'] as string.
-      return @env['REQUEST_METHOD']
-    end
-
-    ##--
-    #def get?         ; @method == :GET           ; end
-    #def post?        ; @method == :POST          ; end
-    #def put?         ; @method == :PUT           ; end
-    #def delete?      ; @method == :DELETE        ; end
-    #def head?        ; @method == :HEAD          ; end
-    #def patch?       ; @method == :PATCH         ; end
-    #def options?     ; @method == :OPTIONS       ; end
-    #def trace?       ; @method == :TRACE         ; end
-    ##++
-
-    def script_name  ; @env['SCRIPT_NAME' ] || ''; end   # may be empty
-    def path_info    ; @env['PATH_INFO'   ] || ''; end   # may be empty
-    def query_string ; @env['QUERY_STRING'] || ''; end   # may be empty
-    def server_name  ; @env['SERVER_NAME' ]      ; end   # should NOT be empty
-    def server_port  ; @env['SERVER_PORT' ].to_i ; end   # should NOT be empty
-
-    def content_type
-      #; [!95g9o] returns env['CONTENT_TYPE'].
-      return @env['CONTENT_TYPE']
-    end
-
-    def content_length
-      #; [!0wbek] returns env['CONTENT_LENGHT'] as integer.
-      len = @env['CONTENT_LENGTH']
-      return len ? len.to_i : len
-    end
-
-    def referer          ; @env['HTTP_REFERER']         ; end
-    def user_agent       ; @env['HTTP_USER_AGENT']      ; end
-    def x_requested_with ; @env['HTTP_X_REQUESTED_WITH']; end
-
-    def xhr?
-      #; [!hsgkg] returns true when 'X-Requested-With' header is 'XMLHttpRequest'.
-      return self.x_requested_with == 'XMLHttpRequest'
-    end
-
-    def client_ip_addr
-      #; [!e1uvg] returns 'X-Real-IP' header value if provided.
-      addr = @env['HTTP_X_REAL_IP']          # nginx
-      return addr if addr
-      #; [!qdlyl] returns first item of 'X-Forwarded-For' header if provided.
-      addr = @env['HTTP_X_FORWARDED_FOR']    # apache, squid, etc
-      return addr.split(',').first if addr
-      #; [!8nzjh] returns 'REMOTE_ADDR' if neighter 'X-Real-IP' nor 'X-Forwarded-For' provided.
-      addr = @env['REMOTE_ADDR']             # http standard
-      return addr
-    end
-
-    def scheme
-      #; [!jytwy] returns 'https' when env['HTTPS'] is 'on'.
-      return 'https' if @env['HTTPS'] == 'on'
-      #; [!zg8r2] returns env['rack.url_scheme'] ('http' or 'https').
-      return @env['rack.url_scheme']
-    end
-
-    def rack_version      ; @env['rack.version']      ; end  # ex: [1, 3]
-    def rack_url_scheme   ; @env['rack.url_scheme']   ; end  # ex: 'http' or 'https'
-    def rack_input        ; @env['rack.input']        ; end  # ex: $stdout
-    def rack_errors       ; @env['rack.errors']       ; end  # ex: $stderr
-    def rack_multithread  ; @env['rack.multithread']  ; end  # ex: true
-    def rack_multiprocess ; @env['rack.multiprocess'] ; end  # ex: true
-    def rack_run_once     ; @env['rack.run_once']     ; end  # ex: false
-    def rack_session      ; @env['rack.session']      ; end  # ex: {}
-    def rack_logger       ; @env['rack.logger']       ; end  # ex: Logger.new
-    def rack_hijack       ; @env['rack.hijack']       ; end  # ex: callable object
-    def rack_hijack?      ; @env['rack.hijack?']      ; end  # ex: true or false
-    def rack_hijack_io    ; @env['rack.hijack_io']    ; end  # ex: socket object
-
-    def params_query
-      #; [!6ezqw] parses QUERY_STRING and returns it as Hash object.
-      #; [!o0ws7] unquotes both keys and values.
-      return @params_query ||= Util.parse_query_string(@env['QUERY_STRING'] || "")
-    end
-    alias query params_query
-
-    MAX_POST_SIZE      =  10*1024*1024
-    MAX_MULTIPART_SIZE = 100*1024*1024
-
-    def params_form
-      d = @params_form
-      return d if d
-      #
-      d = @params_form = _parse_post_data(:form)
-      return d
-    end
-    alias form params_form
-
-    def params_multipart
-      d1 = @params_form
-      d2 = @params_file
-      return d1, d2 if d1 && d2
-      d1, d2 = _parse_post_data(:multipart)
-      @params_form = d1; @params_file = d2
-      return d1, d2
-    end
-    alias multipart params_multipart
-
-    def params_json
-      d = @params_json
-      return d if d
-      d = @params_json = _parse_post_data(:json)
-      return d
-    end
-    alias json params_json
-
-    def _parse_post_data(kind)
-      #; [!q88w9] raises error when content length is missing.
-      cont_len = @env['CONTENT_LENGTH']  or
-        raise HttpException.new(400, 'Content-Length header expected.')
-      #; [!gi4qq] raises error when content length is invalid.
-      cont_len =~ /\A\d+\z/  or
-        raise HttpException.new(400, 'Content-Length should be an integer.')
-      #
-      len = cont_len.to_i
-      case @env['CONTENT_TYPE']
-      #; [!59ad2] parses form parameters and returns it as Hash object when form requested.
-      when 'application/x-www-form-urlencoded'
-        kind == :form  or
-          raise HttpException.new(400, 'unexpected form data (expected multipart).')
-        #; [!puxlr] raises error when content length is too long (> 10MB).
-        len <= MAX_POST_SIZE  or
-          raise HttpException.new(400, 'Content-Length is too long.')
-        qstr = @env['rack.input'].read(len)
-        d = Util.parse_query_string(qstr)
-        return d
-      #; [!y1jng] parses multipart when multipart form requested.
-      when /\Amultipart\/form-data(?:;\s*boundary=(.*))?/
-        kind == :multipart  or
-          raise HttpException.new(400, 'unexpected multipart data.')
-        boundary = $1  or
-          raise HttpException.new(400, 'bounday attribute of multipart required.')
-        #; [!mtx6t] raises error when content length of multipart is too long (> 100MB).
-        len <= MAX_MULTIPART_SIZE  or
-          raise HttpException.new(400, 'Content-Length of multipart is too long.')
-        d1, d2 = Util.parse_multipart(@env['rack.input'], boundary, len, nil, nil)
-        return d1, d2
-      #; [!ugik5] parses json data and returns it as hash object when json data is sent.
-      when /\Aapplication\/json\b/
-        kind == :json  or
-          raise HttpException.new(400, 'unexpected JSON data.')
-        json_str = @env['rack.input'].read(10*1024*1024)   # TODO
-        d = JSON.parse(json_str)
-      #; [!p9ybb] raises error when not a form data.
-      else
-        raise HttpException.new(400, 'POST data expected, but not.')
-      end
-    end
-    private :_parse_post_data
-
-    def params
-      #; [!erlc7] parses QUERY_STRING when request method is GET or HEAD.
-      #; [!cr0zj] parses JSON when content type is 'application/json'.
-      #; [!j2lno] parses form parameters when content type is 'application/x-www-form-urlencoded'.
-      #; [!4rmn9] parses multipart when content type is 'multipart/form-data'.
-      if @method == :GET || @method == :HEAD
-        return params_query()
-      end
-      case @env['CONTENT_TYPE']
-      when /\Aapplication\/json\b/
-        return params_json()
-      when /\Aapplication\/x-www-form-urlencoded\b/
-        return params_form()
-      when /\Amultipart\/form-data\b/
-        return params_multipart()
-      else
-        return {}
-      end
-    end
-
-    def cookies
-      #; [!c9pwr] parses cookie data and returns it as hash object.
-      return @cookies ||= Util.parse_cookie_string(@env['HTTP_COOKIE'] || "")
-    end
-
-    def clear
-      #; [!0jdal] removes uploaded files.
-      d = nil
-      d.each {|_, uploaded| uploaded.clean() } if (d = @params_file)
-    end
-
+  class UnknownActionMethodError < BaseError
   end
 
 
-  class Response
-
-    def initialize
-      @status_code = 200
-      @headers = {}
-    end
-
-    attr_accessor :status_code
-    attr_reader :headers
-    ## for compatibility with Rack::Response
-    alias status status_code
-    alias status= status_code=
-
-    def content_type
-      return @headers['Content-Type']
-    end
-
-    def content_type=(content_type)
-      @headers['Content-Type'] = content_type
-    end
-
-    def content_length
-      s = @headers['Content-Length']
-      return s ? s.to_i : nil
-    end
-
-    def content_length=(length)
-      @headers['Content-Length'] = length.to_s
-    end
-
-    def set_cookie(name, value, domain: nil, path: nil, expires: nil, max_age: nil, httponly: nil, secure: nil)
-      s = "#{name}=#{value}"
-      s << "; Domain=#{domain}"   if domain
-      s << "; Path=#{path}"       if path
-      s << "; Expires=#{expires}" if expires
-      s << "; Max-Age=#{max_age}" if max_age
-      s << "; HttpOnly"           if httponly
-      s << "; Secure"             if secure
-      value = @headers['Set-Cookie']
-      @headers['Set-Cookie'] = value ? (value << "\n" << s) : s
-      return value
-    end
-
-    def clear
-    end
-
+  class UnknownContentError < BaseError
   end
 
 
-  REQUEST_CLASS  = Request
-  RESPONSE_CLASS = Response
-
-  def self.REQUEST_CLASS=(klass)
-    #; [!7uqb4] changes default request class.
-    remove_const :REQUEST_CLASS
-    const_set :REQUEST_CLASS, klass
-  end
-
-  def self.RESPONSE_CLASS=(klass)
-    #; [!c1bd0] changes default response class.
-    remove_const :RESPONSE_CLASS
-    const_set :RESPONSE_CLASS, klass
+  class PayloadParseError < BaseError
   end
 
 
@@ -730,20 +679,19 @@ module K8
       #; [!uotpb] accepts request and response objects.
       @req  = req
       @resp = resp
-      #; [!7sfyf] sets session object.
-      @sess = req.env['rack.session']
     end
 
     attr_reader :req, :resp, :sess
 
-    def handle_action(action_method, urlpath_params)
-      @current_action = action_method
+    def handle_action(action_name, urlpath_args)
+      @action_name = action_name
+      @action_args = urlpath_args
       ex = nil
       begin
         #; [!5jnx6] calls '#before_action()' before handling request.
         before_action()
         #; [!ddgx3] invokes action method with urlpath params.
-        content = invoke_action(action_method, urlpath_params)
+        content = invoke_action(action_name, urlpath_args)
         #; [!aqa4e] returns content.
         return handle_content(content)
       rescue Exception => ex
@@ -763,8 +711,8 @@ module K8
     def after_action(ex)
     end
 
-    def invoke_action(action_method, urlpath_params)
-      return self.__send__(action_method, *urlpath_params)
+    def invoke_action(action_name, urlpath_args)
+      return self.__send__(action_name, *urlpath_args)
     end
 
     def handle_content(content)
@@ -776,32 +724,39 @@ module K8
     ##   mapping '/',     :GET=>:do_index, :POST=>:do_create
     ##   mapping '/{id}', :GET=>:do_show, :PUT=>:do_update, :DELETE=>:do_delete
     ##
-    def self.mapping(urlpath_pattern, methods={})
+    def self.mapping(urlpath_pattern, action_methods={})
+      action_methods.each do |req_meth, action_name|
+        HTTP_REQUEST_METHODS[req_meth.to_s]  or
+          raise ArgumentError.new("#{req_meth.inspect}: unknown request method.")
+        req_meth.is_a?(Symbol)  or
+          raise ArgumentError.new("#{req_meth.inspect}: should be a Symbol but got #{req_meth.class.name}")
+      end
       #; [!o148k] maps urlpath pattern and request methods.
-      self._action_method_mapping.map(urlpath_pattern, methods)
+      self._mappings << [urlpath_pattern, action_methods]
+      return self
     end
 
-    def self._action_method_mapping
-      return @action_method_mapping ||= ActionMethodMapping.new
+    def self._mappings
+      return @action_method_mapping ||= []
     end
 
     def self._build_action_info(full_urlpath_pattern)   # :nodoc:
       #; [!ordhc] build ActionInfo objects for each action methods.
       parent = full_urlpath_pattern
-      @action_infos = {}
-      _action_method_mapping().each do |urlpath_pat, methods|
-        methods.each do |req_meth, action_method_name|
+      d = {}
+      self._mappings.each do |urlpath_pat, action_methods|
+        action_methods.each do |req_meth, action_name|
           info = ActionInfo.create(req_meth, "#{parent}#{urlpath_pat}")
-          @action_infos[action_method_name] = info
+          d[action_name] = info
         end
       end
-      @action_infos
+      @action_infos = d
     end
 
-    def self.[](action_method_name)
+    def self.[](action_name)
       #; [!1tq8z] returns ActionInfo object corresponding to action method.
       #; [!6g2iw] returns nil when not mounted yet.
-      return (@action_infos || {})[action_method_name]
+      return (@action_infos || {})[action_name]
     end
 
   end
@@ -817,9 +772,15 @@ module K8
     alias response resp   # just for compatibility with other frameworks; use @resp!
     alias session  sess   # just for compatibility with other frameworks; use @sess!
 
-    protected
-
-    def before_action
+    def initialize(req, res)
+      super
+      #; [!7sfyf] sets session object.
+      @sess = req.env['rack.session']
+    end
+
+    protected
+
+    def before_action
       csrf_protection() if csrf_protection_required?()
     end
 
@@ -833,7 +794,7 @@ module K8
       end
     end
 
-    def invoke_action(action_method, urlpath_params)
+    def invoke_action(action_name, urlpath_args)
       begin
         return super
       #; [!d5v0l] handles exception when handler method defined.
@@ -942,7 +903,7 @@ module K8
       return false if @req.env['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest'
       #; [!vwrqv] returns true when request method is one of POST, PUT, or DELETE.
       #; [!jfhla] returns true when request method is GET or HEAD.
-      req_meth = @req.method
+      req_meth = @req.meth
       return req_meth == :POST || req_meth == :PUT || req_meth == :DELETE
     end
 
@@ -1032,27 +993,28 @@ module K8
   class ActionInfo
 
     def initialize(method, urlpath_format)
-      @method = method
+      @meth = method
       @urlpath_format = urlpath_format   # ex: '/books/%s/comments/%s'
     end
 
-    attr_reader :method
+    attr_reader :meth
 
-    def method(name=nil)
-      return name ? super : @method
+    ## (experimental; use #meth instead)
+    def method(name=nil)    # :nodoc:
+      return name ? super : @meth
     end
 
-    def urlpath(*args)
+    def path(*args)
       return @urlpath_format % args
     end
 
     def form_action_attr(*args)
       #; [!qyhkm] returns '/api/books/123' when method is POST.
       #; [!kogyx] returns '/api/books/123?_method=PUT' when method is not POST.
-      if @method == 'POST'
-        return urlpath(*args)
+      if @meth == 'POST'
+        return path(*args)
       else
-        return "#{urlpath(*args)}?_method=#{@method}"
+        return "#{path(*args)}?_method=#{@meth}"
       end
     end
 
@@ -1079,153 +1041,252 @@ module K8
   end
 
   class ActionInfo0 < ActionInfo    # :nodoc:
-    def urlpath(); @urlpath_format; end
+    def path(); @urlpath_format; end
   end
 
   class ActionInfo1 < ActionInfo    # :nodoc:
-    def urlpath(a); @urlpath_format % [a]; end
+    def path(a); @urlpath_format % [a]; end
   end
 
   class ActionInfo2 < ActionInfo    # :nodoc:
-    def urlpath(a, b); @urlpath_format % [a, b]; end
+    def path(a, b); @urlpath_format % [a, b]; end
   end
 
   class ActionInfo3 < ActionInfo    # :nodoc:
-    def urlpath(a, b, c); @urlpath_format % [a, b, c]; end
+    def path(a, b, c); @urlpath_format % [a, b, c]; end
   end
 
   class ActionInfo4 < ActionInfo    # :nodoc:
-    def urlpath(a, b, c, d); @urlpath_format % [a, b, c, d]; end
+    def path(a, b, c, d); @urlpath_format % [a, b, c, d]; end
   end
 
   ActionInfo::SUBCLASSES << ActionInfo0 << ActionInfo1 << ActionInfo2 << ActionInfo3 << ActionInfo4
 
 
-  class DefaultPatterns
+  class ActionMapping
 
-    def initialize
-      @patterns = []
+    def initialize(urlpath_mapping, urlpath_cache_size: 0,
+                                    enable_urlpath_param_range: true)
+      #; [!34o67] keyword arg 'enable_urlpath_param_range' controls to generate range object or not.
+      @enable_urlpath_param_range = enable_urlpath_param_range
+      #; [!buj0d] prepares LRU cache if cache size specified.
+      @urlpath_cache_size = urlpath_cache_size
+      @urlpath_lru_cache  = urlpath_cache_size > 0 ? {} : nil
+      #; [!wsz8g] compiles urlpath mapping passed.
+      @fixed_endpoints    = {}  # urlpath patterns which have no urlpath params
+      @variable_endpoints = []  # urlpath patterns which have any ulrpath param
+      @all_endpoints      = []  # all urlpath patterns (fixed + variable)
+      @urlpath_rexp       = build(urlpath_mapping)
     end
 
-    def register(urlpath_param_name, default_pattern='[^/]*?', &converter)
-      #; [!yfsom] registers urlpath param name, default pattern and converter block.
-      @patterns << [urlpath_param_name, default_pattern, converter]
-      self
-    end
+    attr_reader :urlpath_rexp
 
-    def unregister(urlpath_param_name)
-      #; [!3gplv] deletes matched record.
-      @patterns.delete_if {|tuple| tuple[0] == urlpath_param_name }
-      self
-    end
+    private
 
-    def lookup(urlpath_param_name)
-      #; [!dvbqx] returns default pattern string and converter proc when matched.
-      #; [!6hblo] returns '[^/]+?' and nil as default pattern and converter proc when nothing matched.
-      for str_or_rexp, default_pat, converter in @patterns
-        return default_pat, converter if str_or_rexp === urlpath_param_name
+    def build(urlpath_mapping)
+      #; [!6f3vl] compiles urlpath mapping.
+      empty_pargs = [].freeze
+      rexp_str = traverse(urlpath_mapping, "") do |full_urlpath, action_class, action_methods|
+        #; [!z2iax] classifies urlpath contains any parameter as variable one.
+        if has_urlpath_param?(full_urlpath)
+          pattern, pnames, procs = compile_urlpath(full_urlpath, true)
+          rexp  = Regexp.compile("\\A#{pattern}\\z")
+          range = @enable_urlpath_param_range ? range_of_urlpath_param(full_urlpath) : nil
+          tuple = [full_urlpath, action_class, action_methods, rexp, pnames, procs, range]
+          @variable_endpoints << tuple
+        #; [!rvdes] classifies urlpath contains no parameters as fixed one.
+        else
+          tuple = [full_urlpath, action_class, action_methods, empty_pargs]
+          @fixed_endpoints[full_urlpath] = tuple
+        end
+        #
+        @all_endpoints << tuple
       end
-      return '[^/]+?', nil
+      return Regexp.compile("\\A#{rexp_str}\\z")
     end
 
-  end
-
-
-  DEFAULT_PATTERNS = proc {
-    x = DefaultPatterns.new
-    #; [!i51id] registers '\d+' as default pattern of param 'id' or /_id\z/.
-    x.register('id',    '\d+') {|val| val.to_i }
-    x.register(/_id\z/, '\d+') {|val| val.to_i }
-    #; [!2g08b] registers '(?:\.\w+)?' as default pattern of param 'ext'.
-    x.register('ext',   '(?:\.\w+)?')
-    #; [!8x5mp] registers '\d\d\d\d-\d\d-\d\d' as default pattern of param 'date' or /_date\z/.
-    to_date = proc {|val|
-      #; [!wg9vl] raises 404 error when invalid date (such as 2012-02-30).
-      yr, mo, dy = val.split(/-/).map(&:to_i)
-      Date.new(yr, mo, dy)  rescue
-        raise HttpException.new(404, "#{val}: invalid date.")
-    }
-    x.register('date',    '\d\d\d\d-\d\d-\d\d', &to_date)
-    x.register(/_date\z/, '\d\d\d\d-\d\d-\d\d', &to_date)
-    x
-  }.call()
+    def traverse(urlpath_mapping, base_urlpath="", &block)
+      buf = []
+      urlpath_mapping.each do |urlpath, target|
+        curr_urlpath = "#{base_urlpath}#{urlpath}"
+        rexp_str = nil
+        #; [!w45ad] can compile nested array.
+        if target.is_a?(Array)
+          rexp_str = traverse(target, curr_urlpath, &block)
+        #; [!wd2eb] accepts subclass of Action class.
+        else
+          #; [!l2kz5] requires library when filepath and classname specified.
+          klass = target.is_a?(String) ? require_action_class(target) : target
+          #; [!irt5g] raises TypeError when unknown object specified.
+          klass.is_a?(Class) && klass < BaseAction  or
+            raise TypeError.new("Action class or nested array expected, but got #{klass.inspect}")
+          #; [!6xwhq] builds action infos for each action methods.
+          action_class = klass
+          action_class._build_action_info(curr_urlpath)
+          #
+          buf2 = []
+          action_class._mappings.each do |upath, action_methods|
+            validate(action_class, action_methods)
+            #; [!m51yy] regards '.*' at end of urlpath pattern as extension.
+            upath = upath.sub(/\.\*\z/, '{_:<(?:\.\w+)?>}')
+            #
+            full_urlpath = "#{curr_urlpath}#{upath}"
+            if has_urlpath_param?(full_urlpath)
+              buf2 << "#{compile_urlpath(upath)[0]}(\\z)"  # ex: /{id} -> /\d+(\z)
+            end
+            yield full_urlpath, action_class, action_methods
+          end
+          n = buf2.length
+          rexp_str = (n == 0 ? nil : n == 1 ? buf2[0] : union_urlpaths(buf2))
+        end
+        buf << "#{compile_urlpath(urlpath)[0]}#{rexp_str}" if rexp_str
+      end
+      #; [!169ad] removes unnecessary grouping.
+      n = buf.length
+      rexp_string = (n == 0 ? nil : n == 1 ? buf[0] : "(?:#{buf.join('|')})")
+      return rexp_string   # ex: '/books/\d+(?:(\z)|/edit(\z))'
+    end
 
+    def union_urlpaths(upaths)
+      #; [!abj34] ex: (?:/\d+(\z)|/\d+/edit(\z)) -> /d+(?:(\z)|/edit(\z))
+      prefixes = URLPATH_PARAM_PREFIXES  # ex: ['/\d+', '/[^/]+']
+      prefix   = prefixes.find {|s| upaths.all? {|x| x.start_with?(s) } }
+      upaths   = upaths.map {|x| x[prefix.length..-1] } if prefix
+      return "#{prefix}(?:#{upaths.join('|')})"
+    end
 
-  class ActionMethodMapping
+    #; [!92jcn] '{' and '}' are available in urlpath param pattern.
+    #; [!do1zi] param type is optional (ex: '{id}' or '{id:<\d+>}').
+    #; [!my6as] param pattern is optional (ex: '{id}' or '{id:int}').
+    URLPATH_PARAM_REXP = /\{(\w*)(?::(\w*))?(?:<(.*?)>)?\}/
 
-    def initialize
-      @mappings = []
+    def has_urlpath_param?(urlpath)
+      return urlpath.include?('{')
     end
 
-    ##
-    ## ex:
-    ##   map '/',         :GET=>:do_index, :POST=>:do_create
-    ##   map '/{id:\d+}', :GET=>:do_show, :PUT=>:do_update, :DELETE=>:do_delete
-    ##
-    def map(urlpath_pattern, action_methods={})
-      action_methods = _normalize(action_methods)
-      #; [!s7cs9] maps urlpath and methods.
-      #; [!o6cxr] returns self.
-      @mappings << [urlpath_pattern, action_methods]
-      return self
+    ## ex: '/books/{id}', true  ->  ['/books/(\d+)', [['id', 'int', proc{|x| x.to_i}]]]
+    def compile_urlpath(urlpath_pat, enable_capture=false)
+      #; [!iln54] param names and conveter procs are nil when no urlpath params.
+      pnames = nil   # urlpath parameter names  (ex: ['id'])
+      procs  = nil   # proc objects to convert parameter value (ex: [proc{|x| x.to_i}])
+      #
+      rexp_str = urlpath_pat.gsub(URLPATH_PARAM_REXP) {
+        #; [!3diea] '{id:<\d+>}' is ok but '{id<\d+>}' raises error.
+        pname, ptype, pat  = $1, $2, $3
+        if ! ptype && pat   # when ':ptype' is missing but '<pat>' exists
+          raise ActionMappingError.new("'#{urlpath_pat}': missing ':' between param name and pattern (ex: '{id:<\\d+>}' is OK but '{id<\\d+>}' is not).")
+        end
+        ptype, pat, proc_ = resolve_param_type(pname, ptype, pat, urlpath_pat)
+        #; [!lhtiz] skips empty param name.
+        #; [!66zas] skips param name starting with '_'.
+        skip = pname.empty? || pname.start_with?('_')
+        pnames ||= []; pnames << pname unless skip
+        procs  ||= []; procs  << proc_ unless skip
+        #; [!bi7gr] captures urlpath params when 2nd argument is truthy.
+        #; [!mprbx] ex: '/{id:x|y}' -> '/(x|y)', '/{:x|y}' -> '/(?:x|y)'
+        if enable_capture && ! skip
+          pat = "(#{pat})"
+        elsif pat =~ /\|/
+          pat = "(?:#{pat})"
+        end
+        pat
+      }
+      #; [!awfgs] returns regexp string, param names, and converter procs.
+      return rexp_str, pnames, procs   # ex: '/books/(\d+)', ['id'], [proc{|x| x.to_i}]}]
     end
 
-    def _normalize(action_methods)
-      d = {}
-      action_methods.each do |req_meth, action_method|
-        k = HTTP_REQUEST_METHODS[req_meth.to_s]  or
-          raise ArgumentError.new("#{req_meth.inspect}: unknown request method.")
-        v = action_method
-        d[k] = v.is_a?(Symbol) ? v : v.to_s.intern
+    _to_date = proc {|s|
+      begin
+        yr, mo, dy = s.split('-')
+        Date.new(yr.to_i, mo.to_i, dy.to_i)
+      rescue
+        raise HttpException.new(404)
+      end
+    }
+    URLPATH_PARAM_TYPES = [
+      # ptype , pname regexp    , urlpath pattern      , converter
+      ['int'  , /(?:^|_)id\z/   , '\d+'                , proc {|s| s.to_i }],
+      ['date' , /(?:^|_)date\z/ , '\d\d\d\d-\d\d-\d\d' , _to_date          ],
+      ['str'  , nil             , '[^/]+'              , nil               ],
+    ]
+    _to_date = nil
+    URLPATH_PARAM_PREFIXES = URLPATH_PARAM_TYPES.collect {|t| "/#{t[2]}" }
+
+    def resolve_param_type(pname, ptype, pattern, urlpath)
+      tuple = nil
+      if ! ptype || ptype.empty?
+        tuple = URLPATH_PARAM_TYPES.find {|t| pname =~ t[1] }
+        ptype = tuple ? tuple[0] : 'str'
       end
-      return d   # ex: {:GET=>:do_index, :POST=>:do_create}
+      tuple ||= URLPATH_PARAM_TYPES.find {|t| t[0] == ptype }  or
+        raise ActionMappingError.new("'#{urlpath}': unknown param type '#{ptype}'.")
+      pattern   = tuple[2] if ! pattern || pattern.empty?
+      converter = tuple[3]   # ex: '123' -> 123, '2000-01-01' -> Date.new(2000, 1, 1)
+      return ptype, pattern, converter
     end
-    private :_normalize
 
-    def each
-      #; [!62y5q] yields each urlpath pattern and action methods.
-      @mappings.each do |urlpath_pattern, action_methods|
-        yield urlpath_pattern, action_methods
+    ## range object to retrieve urlpath parameter value faster than Regexp matching
+    ## ex:
+    ##   urlpath_pat == '/books/{id}/edit'
+    ##   range = _range_of_urlpath_param(urlpath_pat)
+    ##   p range                       #=> 7..-6 (Range object)
+    ##   p "/books/123/edit"[range]    #=> '123'
+    def range_of_urlpath_param(urlpath)
+      i = 0
+      m = nil
+      urlpath.scan(URLPATH_PARAM_REXP) do
+        i += 1
+        m = Regexp.last_match
       end
-      self
+      return nil unless i == 1
+      return m.begin(0) .. (m.end(0) - urlpath.length - 1)  # ex: 7..-6 (Range object)
     end
 
-  end
-
-
-  class ActionMapping
-
-    def initialize(urlpath_mapping, default_patterns: DEFAULT_PATTERNS, urlpath_cache_size: 0,
-                                    enable_urlpath_param_range: true)
-      @default_patterns   = default_patterns || DefaultPatterns.new
-      #; [!34o67] keyword arg 'enable_urlpath_param_range' controls to generate range object or not.
-      @enable_urlpath_param_range = enable_urlpath_param_range
-      #; [!buj0d] prepares LRU cache if cache size specified.
-      @urlpath_cache_size = urlpath_cache_size
-      @urlpath_lru_cache  = urlpath_cache_size > 0 ? {} : nil
-      #; [!wsz8g] compiles urlpath mapping passed.
-      compile(urlpath_mapping)
+    ## ex: './api/admin/books:Admin::BookAPI'  ->  Admin::BookAPI
+    def require_action_class(filepath_and_classname)
+      #; [!px9jy] requires file and finds class object.
+      str = filepath_and_classname   # ex: './admin/api/book:Admin::BookAPI'
+      filepath, classname = filepath_and_classname.split(':', 2)
+      begin
+        require filepath
+      rescue LoadError => ex
+        #; [!dlcks] don't rescue LoadError when it is not related to argument.
+        raise unless ex.path == filepath
+        #; [!mngjz] raises error when failed to load file.
+        raise LoadError.new("'#{str}': cannot load '#{filepath}'.")
+      end
+      #; [!8n6pf] class name may have module prefix name.
+      #; [!6lv7l] raises error when action class not found.
+      begin
+        klass = classname.split('::').inject(Object) {|cls, x| cls.const_get(x) }
+      rescue NameError
+        raise NameError.new("'#{str}': class not found (#{classname}).")
+      end
+      #; [!thf7t] raises TypeError when not a class.
+      klass.is_a?(Class)  or
+        raise TypeError.new("'#{str}': class name expected but got #{klass.inspect}.")
+      #; [!yqcgx] raises TypeError when not a subclass of K8::Action.
+      klass < Action  or
+        raise TypeError.new("'#{str}': expected subclass of K8::Action but not.")
+      #
+      return klass
     end
 
-    def compile(urlpath_mapping)
-      #; [!6f3vl] compiles urlpath mapping.
-      @fixed_endpoints    = {}  # urlpath patterns which have no urlpath params
-      @variable_endpoints = []  # urlpath patterns which have any ulrpath param
-      @all_endpoints      = []  # all urlpath patterns (fixed + variable)
-      rexp_str = _compile_array(urlpath_mapping, '', '')
-      @urlpath_rexp       = Regexp.compile("\\A#{rexp_str}\\z")
-      return self
+    ## raises error when action method is not defined in action class
+    def validate(action_class, action_methods)
+      #; [!ue766] raises error when action method is not defined in action class.
+      action_methods.each do |req_meth, action_name|
+        action_class.method_defined?(action_name)  or
+          raise UnknownActionMethodError.new("#{req_meth.inspect}=>#{action_name.inspect}: unknown action method in #{action_class}.")
+      end
     end
 
-    EMPTY_ARRAY = [].freeze     # :nodoc:
+    public
 
-    def lookup(req_urlpath)
+    def find(req_urlpath)
       #; [!j34yh] finds from fixed urlpaths at first.
-      if (tuple = @fixed_endpoints[req_urlpath])
-        _, action_class, action_methods = tuple
-        pnames = pvalues = EMPTY_ARRAY
-        return action_class, action_methods, pnames, pvalues
-      end
+      tuple = @fixed_endpoints[req_urlpath]
+      return tuple[1..-1] if tuple     # ex: [BooksAction, {:GET=>:do_index}, []]
       #; [!uqwr7] uses LRU as cache algorithm.
       cache = @urlpath_lru_cache
       if cache && (result = cache.delete(req_urlpath))
@@ -1256,8 +1317,8 @@ module K8
           else  ; procs.zip(strs).map {|pr, v| pr ? pr.call(v) : v }
           end    # ex: ["123"] -> [123]
       end
-      #; [!jyxlm] returns action class and methods, parameter names and values.
-      result = [action_class, action_methods, pnames, pvalues]
+      #; [!jyxlm] returns action class, action methods and urlpath param args.
+      result = [action_class, action_methods, pvalues]
       #; [!uqwr7] stores result into cache if cache is enabled.
       if cache
         cache[req_urlpath] = result
@@ -1279,162 +1340,292 @@ module K8
       self
     end
 
-    private
+  end
 
-    def _compile_array(mapping, base_urlpath_pat, urlpath_pat)
-      buf = []
-      curr_urlpath_pat = "#{base_urlpath_pat}#{urlpath_pat}"
-      mapping.each do |child_urlpath_pat, target|
-        child = child_urlpath_pat
-        #; [!w45ad] can compile nested array.
-        if target.is_a?(Array)
-          buf << _compile_array(target, curr_urlpath_pat, child)
-        #; [!wd2eb] accepts subclass of Action class.
-        elsif target.is_a?(Class) && target < Action
-          buf << _compile_class(target, curr_urlpath_pat, child)
-        #; [!l2kz5] requires library when filepath and classname specified.
-        elsif target.is_a?(String)
-          klass = _require_action_class(target)
-          buf << _compile_class(klass,  curr_urlpath_pat, child)
-        #; [!irt5g] raises TypeError when unknown object specified.
-        else
-          raise TypeError.new("Action class or nested array expected, but got #{target.inspect}")
-        end
-      end
-      #; [!bcgc9] skips classes which have only fixed urlpaths.
-      buf.compact!
-      rexp_str = _build_rexp_str(urlpath_pat, buf)
-      return rexp_str   # ex: '/api(?:/books/\d+(\z)|/authors/\d+(\z))'
+
+  class RackRequest
+
+    def initialize(env)
+      #; [!yb9k9] sets @env.
+      @env = env
+      #; [!yo22o] sets @meth as Symbol value.
+      @meth = HTTP_REQUEST_METHODS[env['REQUEST_METHOD']]  or
+        raise HTTPException.new(400, "#{env['REQUEST_METHOD'].inspect}: unknown request method.")
+      #; [!twgmi] sets @path.
+      @path = (x = env['PATH_INFO'])
+      #; [!ae8ws] uses SCRIPT_NAME as urlpath when PATH_INFO is not provided.
+      @path = env['SCRIPT_NAME'] if x.nil? || x.empty?
     end
 
-    def _compile_class(action_class, base_urlpath_pat, urlpath_pat)
-      buf = []
-      curr_urlpath_pat = "#{base_urlpath_pat}#{urlpath_pat}"
-      action_class._action_method_mapping.each do |child_urlpath_pat, methods|
-        #; [!ue766] raises error when action method is not defined in action class.
-        _validate_action_method_existence(action_class, methods)
-        #; ex: '/api/books/{id}' -> '\A/api/books/(\d+)\z', ['id'], [proc{|x| x.to_i}]
-        fullpath_pat = "#{curr_urlpath_pat}#{child_urlpath_pat}"
-        rexp_str, pnames, procs = _compile_urlpath_pat(fullpath_pat, true)
-        #; [!z2iax] classifies urlpath contains any parameter as variable one.
-        if pnames
-          fullpath_rexp = Regexp.compile("\\A#{rexp_str}\\z")
-          range = @enable_urlpath_param_range ? _range_of_urlpath_param(fullpath_pat) : nil
-          tuple = [fullpath_pat, action_class, methods, fullpath_rexp, pnames.freeze, procs, range]
-          @variable_endpoints << tuple
-          buf << (_compile_urlpath_pat(child_urlpath_pat).first << '(\z)')
-        #; [!rvdes] classifies urlpath contains no parameters as fixed one.
-        else
-          tuple = [fullpath_pat, action_class, methods]
-          @fixed_endpoints[fullpath_pat] = tuple
-        end
-        #
-        @all_endpoints << tuple
-      end
-      #; [!6xwhq] builds action infos for each action methods.
-      action_class._build_action_info(curr_urlpath_pat) if action_class
-      #
-      rexp_str = _build_rexp_str(urlpath_pat, buf)
-      return rexp_str    # ex: '/books(?:/\d+(\z)|/\d+/edit(\z))'
+    attr_reader :env, :meth, :path
+
+    ## (experimental; use #meth instead)
+    def method(name=nil)    # :nodoc:
+      #; [!084jo] returns current request method when argument is not specified.
+      #; [!gwskf] calls Object#method() when argument specified.
+      return name ? super : @meth
     end
 
-    ## ex: '/books', ['/\d+', '/\d+/edit']  ->  '/books(?:/\d+|/\d+/edit)'
-    def _build_rexp_str(urlpath_pat, buf)
-      return nil if buf.empty?
-      prefix = _compile_urlpath_pat(urlpath_pat).first
-      #; [!169ad] removes unnecessary grouping.
-      return "#{prefix}#{buf.first}" if buf.length == 1
-      return "#{prefix}(?:#{buf.join('|')})"
-    ensure
-      buf.clear()   # for GC
+    def path_ext
+      #; [!tf6yz] returns extension of request path such as '.html' or '.json'.
+      #; [!xnurj] returns empty string when no extension.
+      return File.extname(@path)
     end
 
-    #; [!92jcn] '{' and '}' are available in urlpath param pattern.
-    #URLPATH_PARAM_REXP = /\{(\w*)(?::(.*?))?\}/
-    #URLPATH_PARAM_REXP = /\{(\w*)(?::(.*?(?:\{.*?\}.*?)*))?\}/
-    URLPATH_PARAM_REXP = /\{(\w*)(?::([^{}]*?(?:\{[^{}]*?\}[^{}]*?)*))?\}/
-    URLPATH_PARAM_REXP_NOGROUP = /\{(?:\w*)(?::(?:[^{}]*?(?:\{[^{}]*?\}[^{}]*?)*))?\}/
-    proc {|rx1, rx2|
-      rx1.source.gsub(/\(([^?])/, '(?:\1') == rx2.source  or
-        raise "*** assertion failed: #{rx1.source.inspect} != #{rx2.source.inspect}"
-    }.call(URLPATH_PARAM_REXP, URLPATH_PARAM_REXP_NOGROUP)
-
-    ## ex: '/books/{id}', true  ->  ['/books/(\d+)', ['id'], [proc{|x| x.to_i}]]
-    def _compile_urlpath_pat(urlpath_pat, enable_capture=false)
-      #; [!iln54] param names and conveter procs are nil when no urlpath params.
-      pnames = nil   # urlpath parameter names  (ex: ['id'])
-      procs  = nil   # proc objects to convert parameter value (ex: [proc{|x| x.to_i}])
-      #
-      rexp_str = urlpath_pat.gsub(URLPATH_PARAM_REXP) {
-        pname, s, proc_ = $1, $2, nil
-        s, proc_ = @default_patterns.lookup(pname) if s.nil?
-        #; [!lhtiz] skips empty param name.
-        #; [!66zas] skips param name starting with '_'.
-        skip = pname.empty? || pname.start_with?('_')
-        pnames ||= []; pnames << pname unless skip
-        procs  ||= []; procs  << proc_ unless skip
-        #; [!bi7gr] captures urlpath params when 2nd argument is truthy.
-        #; [!mprbx] ex: '/{id:x|y}' -> '/(x|y)', '/{:x|y}' -> '/(?:x|y)'
-        if enable_capture && ! skip
-          s = "(#{s})"
-        elsif s =~ /\|/
-          s = "(?:#{s})"
-        end
-        s
-      }
-      #; [!awfgs] returns regexp string, param names, and converter procs.
-      return rexp_str, pnames, procs   # ex: '/books/(\d+)', ['id'], [proc{|x| x.to_i}]}]
+    def header(name)
+      #; [!1z7wj] returns http header value from environment.
+      return @env["HTTP_#{name.upcase.sub('-', '_')}"]
     end
 
-    ## raises error when action method is not defined in action class
-    def _validate_action_method_existence(action_class, action_methods)
-      action_methods.each do |req_meth, action_method_name|
-        action_class.method_defined?(action_method_name)  or
-          raise UnknownActionMethodError.new("#{req_meth.inspect}=>#{action_method_name.inspect}: unknown action method in #{action_class}.")
-      end
+    def request_method
+      #; [!y8eos] returns env['REQUEST_METHOD'] as string.
+      return @env['REQUEST_METHOD']
     end
 
-    ## range object to retrieve urlpath parameter value faster than Regexp matching
-    ## ex:
-    ##   urlpath_pat == '/books/{id}/edit'
-    ##   arr = urlpath_pat.split(/\{.*?\}/, -1)           #=> ['/books/', '/edit']
-    ##   range = (arr[0].length .. - (arr[01].length+1))  #=> 7..-6 (Range object)
-    ##   p "/books/123/edit"[range]                       #=> '123'
-    def _range_of_urlpath_param(urlpath_pattern)
-      rexp = URLPATH_PARAM_REXP_NOGROUP
-      arr = urlpath_pattern.split(rexp, -1)            # ex: ['/books/', '/edit']
-      return nil unless arr.length == 2
-      return (arr[0].length .. - (arr[1].length+1))    # ex: 7..-6  (Range object)
+    ##--
+    #def get?         ; @meth == :GET           ; end
+    #def post?        ; @meth == :POST          ; end
+    #def put?         ; @meth == :PUT           ; end
+    #def delete?      ; @meth == :DELETE        ; end
+    #def head?        ; @meth == :HEAD          ; end
+    #def patch?       ; @meth == :PATCH         ; end
+    #def options?     ; @meth == :OPTIONS       ; end
+    #def trace?       ; @meth == :TRACE         ; end
+    ##++
+
+    def script_name  ; @env['SCRIPT_NAME' ] || ''; end   # may be empty
+    def path_info    ; @env['PATH_INFO'   ] || ''; end   # may be empty
+    def query_string ; @env['QUERY_STRING'] || ''; end   # may be empty
+    def server_name  ; @env['SERVER_NAME' ]      ; end   # should NOT be empty
+    def server_port  ; @env['SERVER_PORT' ].to_i ; end   # should NOT be empty
+
+    def content_type
+      #; [!95g9o] returns env['CONTENT_TYPE'].
+      return @env['CONTENT_TYPE']
     end
 
-    ## ex: './api/admin/books:Admin::BookAPI'  ->  Admin::BookAPI
-    def _require_action_class(filepath_and_classname)
-      #; [!px9jy] requires file and finds class object.
-      str = filepath_and_classname   # ex: './admin/api/book:Admin::BookAPI'
-      filepath, classname = filepath_and_classname.split(':', 2)
-      begin
-        require filepath
-      rescue LoadError => ex
-        #; [!dlcks] don't rescue LoadError when it is not related to argument.
-        raise unless ex.path == filepath
-        #; [!mngjz] raises error when failed to load file.
-        raise LoadError.new("'#{str}': cannot load '#{filepath}'.")
+    def content_length
+      #; [!0wbek] returns env['CONTENT_LENGHT'] as integer.
+      len = @env['CONTENT_LENGTH']
+      return len ? len.to_i : len
+    end
+
+    def referer          ; @env['HTTP_REFERER']         ; end
+    def user_agent       ; @env['HTTP_USER_AGENT']      ; end
+    def x_requested_with ; @env['HTTP_X_REQUESTED_WITH']; end
+
+    def xhr?
+      #; [!hsgkg] returns true when 'X-Requested-With' header is 'XMLHttpRequest'.
+      return self.x_requested_with == 'XMLHttpRequest'
+    end
+
+    def client_ip_addr
+      #; [!e1uvg] returns 'X-Real-IP' header value if provided.
+      addr = @env['HTTP_X_REAL_IP']          # nginx
+      return addr if addr
+      #; [!qdlyl] returns first item of 'X-Forwarded-For' header if provided.
+      addr = @env['HTTP_X_FORWARDED_FOR']    # apache, squid, etc
+      return addr.split(',').first if addr
+      #; [!8nzjh] returns 'REMOTE_ADDR' if neighter 'X-Real-IP' nor 'X-Forwarded-For' provided.
+      addr = @env['REMOTE_ADDR']             # http standard
+      return addr
+    end
+
+    def scheme
+      #; [!jytwy] returns 'https' when env['HTTPS'] is 'on'.
+      return 'https' if @env['HTTPS'] == 'on'
+      #; [!zg8r2] returns env['rack.url_scheme'] ('http' or 'https').
+      return @env['rack.url_scheme']
+    end
+
+    def rack_version      ; @env['rack.version']      ; end  # ex: [1, 3]
+    def rack_url_scheme   ; @env['rack.url_scheme']   ; end  # ex: 'http' or 'https'
+    def rack_input        ; @env['rack.input']        ; end  # ex: $stdout
+    def rack_errors       ; @env['rack.errors']       ; end  # ex: $stderr
+    def rack_multithread  ; @env['rack.multithread']  ; end  # ex: true
+    def rack_multiprocess ; @env['rack.multiprocess'] ; end  # ex: true
+    def rack_run_once     ; @env['rack.run_once']     ; end  # ex: false
+    def rack_session      ; @env['rack.session']      ; end  # ex: {}
+    def rack_logger       ; @env['rack.logger']       ; end  # ex: Logger.new
+    def rack_hijack       ; @env['rack.hijack']       ; end  # ex: callable object
+    def rack_hijack?      ; @env['rack.hijack?']      ; end  # ex: true or false
+    def rack_hijack_io    ; @env['rack.hijack_io']    ; end  # ex: socket object
+
+    MAX_FORM_SIZE      =  10*1024*1024
+    MAX_JSON_SIZE      =  10*1024*1024
+    MAX_MULTIPART_SIZE = 100*1024*1024
+
+    def params_query
+      #; [!6ezqw] parses QUERY_STRING and returns it as Hash/dict object.
+      #; [!o0ws7] unquotes both keys and values.
+      #; [!2fhrk] returns same value when called more than once.
+      return @params_query ||= Util.parse_query_string(@env['QUERY_STRING'] || "")
+    end
+    alias query params_query
+
+    def params_form(max_content_length=nil)
+      #; [!iultp] returns same value when called more than once.
+      d = @params_form
+      return d if d
+      #; [!uq46o] raises 400 error when payload is not form data.
+      self.content_type == 'application/x-www-form-urlencoded'  or
+        raise HttpException.new(400, "expected form data, but Content-Type header is #{self.content_type.inspect}.")
+      #; [!puxlr] raises 400 error when content length is too large (> 10MB).
+      clen = get_content_length(max_content_length || MAX_FORM_SIZE)
+      #; [!59ad2] parses form parameters and returns it as Hash object.
+      payload = get_input_stream().read(clen)
+      d = @params_form = Util.parse_query_string(payload)
+      return d
+    end
+    alias form params_form
+
+    def params_multipart(max_content_length=nil)
+      #; [!gbdxu] returns same values when called more than once.
+      d1 = @params_form
+      d2 = @params_file
+      return d1, d2 if d1 && d2
+      #; [!ho5ii] raises 400 error when not multipart data.
+      self.content_type =~ /\Amultipart\/form-data(?:;\s*boundary=(.+))?/  or
+        raise HttpException.new(400, "expected multipart data, but Content-Type header is #{self.content_type.inspect}.")
+      #; [!davzs] raises 400 error when boundary is missing.
+      boundary = $1  or
+        raise HttpException.new(400, 'bounday attribute of multipart required.')
+      #; [!mtx6t] raises error when content length of multipart is too large (> 100MB).
+      clen = get_content_length(max_content_length || MAX_MULTIPART_SIZE)
+      #; [!y1jng] parses multipart when multipart data posted.
+      d1, d2 = Util.parse_multipart(get_input_stream(), boundary, clen, nil, nil)
+      @params_form = d1; @params_file = d2
+      return d1, d2
+    end
+    alias multipart params_multipart
+
+    def params_json(max_content_length=nil)
+      #; [!5kwij] returns same value when called more than once.
+      d = @params_json
+      return d if d
+      #; [!qjgfz] raises 400 error when not JSON data.
+      self.content_type =~ /\Aapplication\/json\b/  or
+        raise HttpException.new(400, "expected JSON data, but Content-Type header is #{self.content_type.inspect}.")
+      #; [!on107] raises error when content length of JSON is too large (> 10MB).
+      clen = get_content_length(max_content_length || MAX_JSON_SIZE)
+      #; [!ugik5] parses json data and returns it as hash object when json data is sent.
+      payload = get_input_stream().read(clen)
+      d = @params_json = JSON.parse(payload)
+      return d
+    end
+    alias json params_json
+
+    def get_content_length(max_size)
+      #; [!q88w9] raises error when content length is missing.
+      clen = self.content_length  or
+        raise HttpException.new(400, 'Content-Length header expected.')
+      #; [!ls6ir] raises error when content length is too large.
+      clen <= max_size  or
+        raise HttpException.new(400, "Content-Length is too large (max: #{max_size}, actual: #{clen}).")
+      return clen
+    end
+    private :get_content_length
+
+    def get_input_stream
+      #; [!2buc6] returns input stream.
+      return @env['rack.input']
+    end
+    protected :get_input_stream
+
+    def params
+      #; [!erlc7] parses QUERY_STRING when request method is GET or HEAD.
+      #; [!j2lno] parses form parameters when content type is 'application/x-www-form-urlencoded'.
+      #; [!z5w4k] raises error when content type is 'multipart/form-data' (because params_multipart() returns two values).
+      #; [!td6fw] raises error when content type is 'application/json' (because JSON data can contain non-string values).
+      if @meth == :GET || @meth == :HEAD
+        return params_query()       # hash object
       end
-      #; [!8n6pf] class name may have module prefix name.
-      #; [!6lv7l] raises error when action class not found.
-      begin
-        klass = classname.split('::').inject(Object) {|cls, x| cls.const_get(x) }
-      rescue NameError
-        raise NameError.new("'#{str}': class not found (#{classname}).")
+      case @env['CONTENT_TYPE']
+      when /\Aapplication\/x-www-form-urlencoded\b/
+        return params_form()        # hash object
+      when /\Amultipart\/form-data\b/
+        #return params_multipart()  # array of hash objects
+        raise PayloadParseError.new("don't use `@req.params' for multipart data; use `@req.params_multipart' instead.")
+      when /\Aapplication\/json\b/
+        #return params_json()       # hash object
+        raise PayloadParseError.new("use `@req.json' for JSON data instead of `@req.params'.")
+      else
+        return {}                   # hash object
       end
-      #; [!thf7t] raises TypeError when not a class.
-      klass.is_a?(Class)  or
-        raise TypeError.new("'#{str}': class name expected but got #{klass.inspect}.")
-      #; [!yqcgx] raises TypeError when not a subclass of K8::Action.
-      klass < Action  or
-        raise TypeError.new("'#{str}': expected subclass of K8::Action but not.")
-      #
-      return klass
+    end
+
+    def cookies
+      #; [!c9pwr] parses cookie data and returns it as hash object.
+      return @cookies ||= Util.parse_cookie_string(@env['HTTP_COOKIE'] || "")
+    end
+
+    def clear
+      #; [!0jdal] removes uploaded files.
+      d = @params_file
+      d.each {|_, uploaded| uploaded.clean() } if d
+      self
+    end
+
+  end
+
+
+  class RackResponse
+
+    def initialize
+      #; [!ehdkl] default status code is 200.
+      @status_code = 200
+      @headers = {}
+    end
+
+    attr_accessor :status_code
+    attr_reader :headers
+    ## for compatibility with Rack::Response
+    alias status status_code
+    alias status= status_code=
+
+    def status_line
+      #; [!apy81] returns status line such as '200 OK'.
+      return "#{@status_code} #{HTTP_RESPONSE_STATUS[@status_code] || 'UNKNOWN'}"
+    end
+
+    def content_type
+      return @headers['Content-Type']
+    end
+
+    def content_type=(content_type)
+      @headers['Content-Type'] = content_type
+    end
+
+    def content_length
+      s = @headers['Content-Length']
+      return s ? s.to_i : nil
+    end
+
+    def content_length=(length)
+      @headers['Content-Length'] = length.to_s
+    end
+
+    def set_cookie(name, value, domain: nil, path: nil, expires: nil, max_age: nil, httponly: nil, secure: nil)
+      #; [!oanme] converts Time object into HTTP timestamp string.
+      if expires && expires.is_a?(Time)
+        expires = Util.http_utc_time(expires)
+      end
+      #; [!58tby] adds 'Set-Cookie' response header.
+      s = "#{name}=#{value}"
+      s << "; Domain=#{domain}"   if domain
+      s << "; Path=#{path}"       if path
+      s << "; Expires=#{expires}" if expires
+      s << "; Max-Age=#{max_age}" if max_age
+      s << "; HttpOnly"           if httponly
+      s << "; Secure"             if secure
+      #; [!u9w9l] supports multiple cookies.
+      value = @headers['Set-Cookie']
+      @headers['Set-Cookie'] = value ? (value << "\n" << s) : s
+      #; [!7otip] returns cookie string.
+      return s
+    end
+
+    def clear
     end
 
   end
@@ -1442,59 +1633,84 @@ module K8
 
   class RackApplication
 
-    def initialize(urlpath_mapping=[], default_patterns: DEFAULT_PATTERNS, urlpath_cache_size: 0,
+    REQUEST_CLASS  = RackRequest
+    RESPONSE_CLASS = RackResponse
+
+    def self.REQUEST_CLASS=(klass)
+      #; [!7uqb4] changes default request class.
+      remove_const :REQUEST_CLASS
+      const_set :REQUEST_CLASS, klass
+    end
+
+    def self.RESPONSE_CLASS=(klass)
+      #; [!c1bd0] changes default response class.
+      remove_const :RESPONSE_CLASS
+      const_set :RESPONSE_CLASS, klass
+    end
+
+    def initialize(urlpath_mapping=[], urlpath_cache_size: 0,
                                        enable_urlpath_param_range: true)
       #; [!vkp65] mounts urlpath mappings.
       @mapping = ActionMapping.new(urlpath_mapping,
-                                   default_patterns:    default_patterns,
-                                   urlpath_cache_size:  urlpath_cache_size,
+                                   urlpath_cache_size: urlpath_cache_size,
                                    enable_urlpath_param_range: enable_urlpath_param_range)
     end
 
-    def lookup(req_path)
+    def find(req_path)
       #; [!o0rnr] returns action class, action methods, urlpath names and values.
-      return @mapping.lookup(req_path)
+      return @mapping.find(req_path)
+    end
+
+    def lookup(req_meth, req_path, query_string="")
+      #; [!7476i] uses '_method' value of query string as request method when 'POST' method.
+      if req_meth == :POST && query_string =~ /\A_method=(\w+)/
+        req_meth = HTTP_REQUEST_METHODS[$1.upcase] || $1.upcase
+      end
+      #
+      tuple = find(req_path)
+      unless tuple
+        #; [!c0job] redirects only when request method is GET or HEAD.
+        if req_meth == :GET || req_meth == :HEAD
+          #; [!u1qfv] raises 301 when urlpath not found but found with tailing '/'.
+          #; [!kbff3] raises 301 when urlpath not found but found without tailing '/'.
+          rpath  = req_path
+          rpath2 = rpath.end_with?('/') ? rpath[0..-2] : rpath + '/'
+          if find(rpath2)
+            #; [!cgxx4] adds query string to 'Location' header when redirecting.
+            qs = query_string
+            location = ! qs || qs.empty? ? rpath2 : "#{rpath2}?#{qs}"
+            status = 301              # 301 Moved Permanently
+            raise HttpException.new(status, nil, {'Location'=>location})
+          end
+        end
+        #; [!hdy1f] raises HTTP 404 when urlpath not found.
+        raise HttpException.new(404)  # 404 Not Found
+      end
+      action_class, action_methods, urlpath_args = tuple
+      #; [!0znwr] uses 'GET' method to find action when request method is 'HEAD'.
+      d = action_methods
+      action_name = d[req_meth] || (req_meth == :HEAD ? d[:GET] : nil) || d[:ANY]
+      #; [!bfpav] raises HTTP 405 when urlpath found but request method not allowed.
+      action_name  or
+        raise HttpException.new(405)  # 405 Method Not Allowed
+      return action_class, action_name, urlpath_args
     end
 
     def call(env)
       #; [!uvmxe] takes env object.
       #; [!gpe4g] returns status, headers and content.
-      return handle_request(REQUEST_CLASS.new(env), RESPONSE_CLASS.new)
-    end
-
-    protected
-
-    def handle_request(req, resp)
-      req_meth = HTTP_REQUEST_METHODS[req.env['REQUEST_METHOD']]
+      #; [!eb2ms] returns 301 when urlpath not found but found with tailing '/'.
+      #; [!02dow] returns 301 when urlpath not found but found without tailing '/'.
+      #; [!2a9c9] adds query string to 'Location' header.
+      #; [!vz07j] redirects only when request method is GET or HEAD.
       #; [!l6kmc] uses 'GET' method to find action when request method is 'HEAD'.
-      if req_meth == :HEAD
-        req_meth_ = :GET
       #; [!4vmd3] uses '_method' value of query string as request method when 'POST' method.
-      elsif req_meth == :POST && /\A_method=(\w+)/.match(req.env['QUERY_STRING'])
-        req_meth_ = HTTP_REQUEST_METHODS[$1] || $1
-      else
-        req_meth_ = req_meth
-      end
+      #; [!rz13i] returns HTTP 404 when urlpath not found.
+      #; [!rv3cf] returns HTTP 405 when urlpath found but request method not allowed.
+      req  = REQUEST_CLASS.new(env)
+      resp = RESPONSE_CLASS.new
       begin
-        tuple4 = lookup(req.path)
-        #; [!vz07j] redirects only when request method is GET or HEAD.
-        if tuple4.nil? && req_meth_ == :GET
-          #; [!eb2ms] returns 301 when urlpath not found but found with tailing '/'.
-          #; [!02dow] returns 301 when urlpath not found but found without tailing '/'.
-          location = lookup_autoredirect_location(req)
-          return [301, {'Location'=>location}, []] if location
-        end
-        #; [!rz13i] returns HTTP 404 when urlpath not found.
-        tuple4  or
-          raise HttpException.new(404)
-        action_class, action_methods, urlpath_param_names, urlpath_param_values = tuple4
-        #; [!rv3cf] returns HTTP 405 when urlpath found but request method not allowed.
-        action_method = action_methods[req_meth_]  or
-          raise HttpException.new(405)
-        #; [!0fgbd] finds action class and invokes action method with urlpath params.
-        action_obj = action_class.new(req, resp)
-        content = action_obj.handle_action(action_method, urlpath_param_values)
-        ret = [resp.status, resp.headers, content]
+        ret = handle_request(req, resp)
       rescue HttpException => ex
         ret = handle_http(ex, req, resp)
       rescue Exception => ex
@@ -1504,11 +1720,23 @@ module K8
         req.clear()  if req.respond_to?(:clear)
         resp.clear() if resp.respond_to?(:clear)
       end
-      #; [!9wp9z] returns empty body when request method is HEAD.
-      ret[2] = [""] if req_meth == :HEAD
       return ret
     end
 
+    protected
+
+    def handle_request(req, resp)
+      #; [!0fgbd] finds action class and invokes action method with urlpath params.
+      req_meth = HTTP_REQUEST_METHODS[req.env['REQUEST_METHOD']] || req.env['REQUEST_METHOD']
+      tuple = lookup(req_meth, req.path, req.env['QUERY_STRING'])
+      action_class, action_name, pargs = tuple  # ex: [BooksAction, :do_show, [123]]
+      action_obj = action_class.new(req, resp)
+      content = action_obj.handle_action(action_name, pargs)
+      #; [!9wp9z] returns empty body when request method is HEAD.
+      content = [""] if req_meth == :HEAD
+      return [resp.status, resp.headers, content]
+    end
+
     def handle_http(ex, req, resp)
       if json_expected?(req)
         content = render_http_exception_as_json(ex, req, resp)
@@ -1551,14 +1779,6 @@ END
       return false
     end
 
-    def lookup_autoredirect_location(req)
-      location = req.path.end_with?('/') ? req.path[0..-2] : "#{req.path}/"
-      return nil unless lookup(location)
-      #; [!2a9c9] adds query string to 'Location' header.
-      qs = req.env['QUERY_STRING']
-      return qs && ! qs.empty? ? "#{location}?#{qs}" : location
-    end
-
     public
 
     def each_mapping(&block)
@@ -1573,8 +1793,8 @@ END
       s = ""
       each_mapping do |full_urlpath_pat, action_class, action_methods|
         arr = req_methods.collect {|req_meth|
-          action_method = action_methods[req_meth]
-          action_method ? "#{req_meth}: #{action_method}" : nil
+          action_name = action_methods[req_meth]
+          action_name ? "#{req_meth}: #{action_name}" : nil
         }.compact()
         s << "- urlpath: #{full_urlpath_pat}\n"
         s << "  class:   #{action_class}\n"
@@ -1587,186 +1807,4 @@ END
   end
 
 
-  class SecretValue < Object
-
-    def initialize(name=nil)
-      #; [!fbwnh] takes environment variable name.
-      @name = name
-    end
-
-    attr_reader :name
-
-    def value
-      #; [!gg06v] returns environment variable value.
-      return @name ? ENV[@name] : nil
-    end
-
-    def to_s
-      #; [!7ymqq] returns '<SECRET>' string when name not eixst.
-      #; [!x6edf] returns 'ENV[<name>]' string when name exists.
-      return @name ? "ENV['#{@name}']" : "<SECRET>"
-    end
-
-    #; [!j27ji] 'inspect()' is alias of 'to_s()'.
-    alias inspect to_s
-
-    def [](name)
-      #; [!jjqmn] creates new instance object with name.
-      self.class.new(name)
-    end
-
-  end
-
-
-  class BaseConfig < Object
-
-    SECRET = SecretValue.new
-
-    def initialize(freeze: true)
-      #; [!vvd1n] copies key and values from class object.
-      self.class.each do |key, val, _, _|
-        #; [!xok12] when value is SECRET...
-        if val.is_a?(SecretValue)
-          #; [!a4a4p] raises error when key not specified.
-          val.name  or
-            raise ConfigError.new("config '#{key}' should be set, but not.")
-          #; [!w4yl7] raises error when ENV value not specified.
-          ENV[val.name]  or
-            raise ConfigError.new("config '#{key}' depends on ENV['#{val.name}'], but not set.")
-          #; [!he20d] get value from ENV.
-          val = ENV[val.name]
-        end
-        instance_variable_set("@#{key}", val)
-      end
-      #; [!6dilv] freezes self and class object if 'freeze:' is true.
-      self.class.freeze if freeze
-      self.freeze       if freeze
-    end
-
-    def self.validate_values   # :nodoc:
-      not_set = []
-      not_env = []
-      each() do |key, val, _, _|
-        if val.is_a?(SecretValue)
-          if ! val.name
-            not_set << [key, val]
-          elsif ! ENV[val.name]
-            not_env << [key, val]
-          end
-        end
-      end
-      return nil if not_set.empty? && not_env.empty?
-      sb = []
-      sb << "**"
-      sb << "** ERROR: insufficient config"
-      unless not_set.empty?
-        sb << "**"
-        sb << "** The following configs should be set, but not."
-        sb << "**"
-        not_set.each do |key, val|
-          sb <<  "**   %-25s %s" % [key, val]
-        end
-      end
-      unless not_env.empty?
-        sb << "**"
-        sb << "** The following configs expect environment variable, but not set."
-        sb << "**"
-        not_env.each do |key, val|
-          sb <<  "**   %-25s %s" % [key, val]
-        end
-      end
-      sb << "**"
-      sb << ""
-      return sb.join("\n")
-    end
-
-    private
-
-    def self.__all
-      return @__all ||= {}
-    end
-
-    public
-
-    def self.has?(key)
-      #; [!dv87n] returns true iff key is set.
-      return __all().key?(key)
-    end
-
-    def self.put(key, value, desc=nil)
-      #; [!h9b47] defines getter method.
-      attr_reader key
-      d = __all()
-      #; [!mun1v] keeps secret flag.
-      if d[key]
-        desc ||= d[key][1]
-        secret = d[key][2]
-      else
-        secret = value == SECRET
-      end
-      #; [!ncwzt] stores key with value, description and secret flag.
-      d[key] = [value, desc, secret]
-      nil
-    end
-
-    def self.add(key, value, desc=nil)
-      #; [!envke] raises error when already added.
-      ! self.has?(key)  or
-        raise K8::ConfigError.new("add(#{key.inspect}, #{value.inspect}): cannot add because already added; use set() or put() instead.")
-      #; [!6cmb4] adds new key, value and desc.
-      self.put(key, value, desc)
-    end
-
-    def self.set(key, value, desc=nil)
-      #; [!2yis0] raises error when not added yet.
-      self.has?(key)  or
-        raise K8::ConfigError.new("set(#{key.inspect}, #{value.inspect}): cannot set because not added yet; use add() or put() instead.")
-      #; [!3060g] sets key, value and desc.
-      self.put(key, value, desc)
-    end
-
-    def self.each
-      #; [!iu88i] yields with key, value, desc and secret flag.
-      __all().each do |key, (value, desc, secret)|
-        yield key, value, desc, secret
-      end
-      nil
-    end
-
-    def self.get(key, default=nil)
-      #; [!zlhnp] returns value corresponding to key.
-      #; [!o0k05] returns default value (=nil) when key is not added.
-      tuple = __all()[key]
-      return tuple ? tuple.first : default
-    end
-
-    def [](key)
-      #; [!jn9l5] returns value corresponding to key.
-      return __send__(key)
-    end
-
-    def get_all(prefix_key)
-      #; [!4ik3c] returns all keys and values which keys start with prefix as hash object.
-      prefix = "@#{prefix_key}"
-      symbol_p = prefix_key.is_a?(Symbol)
-      range = prefix.length..-1
-      d = {}
-      self.instance_variables.each do |ivar|
-        if ivar.to_s.start_with?(prefix)
-          val = self.instance_variable_get(ivar)
-          key = ivar[range].intern
-          key = key.intern if symbol_p
-          d[key] = val
-        end
-      end
-      return d
-    end
-
-  end
-
-
-  class ConfigError < StandardError
-  end
-
-
 end