@dnax/serve 0.0.0-stage → 0.0.1

package/src/server.ts

@@ -0,0 +1,861 @@
+import { createHash, timingSafeEqual } from "node:crypto";
+import { readFileSync, statSync } from "node:fs";
+import type { Stats } from "node:fs";
+import { createServer as createNetServer } from "node:net";
+import { stat } from "node:fs/promises";
+import { extname, join, relative, resolve, sep } from "node:path";
+import { isDotfilePath, renderDirectoryListing } from "./listing.ts";
+import { lookupMime, parseMimeTypes, withCharset, type MimeOverrides } from "./mime.ts";
+
+export interface ServeOptions {
+  /** Directory to serve. Defaults to the current directory. */
+  root?: string;
+  /** Port to listen on. Use 0 to scan from 8080 for a free port. */
+  port?: number;
+  /** Address to bind. Defaults to 0.0.0.0. */
+  address?: string;
+  /** Base path the server is mounted under. Defaults to "/". */
+  baseDir?: string;
+  /** Show directory listings. Defaults to true. */
+  showDir?: boolean;
+  /** Serve index.<ext> for directories. Defaults to true. */
+  autoIndex?: boolean;
+  /** Let -d override the magic 404.<ext> file. Defaults to false. */
+  dirOverrides404?: boolean;
+  /** Serve precompressed .gz files when accepted. */
+  gzip?: boolean;
+  /** Serve precompressed .br files when accepted. */
+  brotli?: boolean;
+  /** Default extension for extensionless requests. Defaults to "html". */
+  ext?: string | true;
+  /** Suppress request logs and startup output handled by the CLI. */
+  silent?: boolean;
+  /** Enable CORS, optionally with extra request headers. */
+  cors?: boolean | string;
+  /** Enable Cross-Origin-Opener-Policy. */
+  coop?: boolean;
+  /** Enable Private Network Access. */
+  privateNetworkAccess?: boolean;
+  /** Extra response headers, applied to every response. */
+  headers?: Record<string, string>;
+  /** Cache-Control max-age in seconds. -1 disables caching. Defaults to 3600. */
+  cache?: number;
+  /** Idle connection timeout in seconds. 0 disables it. Defaults to 120. */
+  timeout?: number;
+  /** Use UTC dates in logs. */
+  utc?: boolean;
+  /** Include the client IP in logs. */
+  logIp?: boolean;
+  /** Proxy unresolved requests to this URL. */
+  proxy?: string;
+  /** Proxy every request to `proxy`. */
+  proxyAll?: boolean;
+  /** Basic auth username. */
+  username?: string;
+  /** Basic auth password. */
+  password?: string;
+  /** Enable TLS. */
+  ssl?: boolean;
+  /** TLS certificate path. Defaults to cert.pem. */
+  cert?: string;
+  /** TLS key path. Defaults to key.pem. */
+  key?: string;
+  /** TLS key passphrase. Defaults to NODE_HTTP_SERVER_SSL_PASSPHRASE. */
+  passphrase?: string;
+  /** Reply to /robots.txt. true serves "User-agent: *\nDisallow: /"; a string is served verbatim. */
+  robots?: boolean | string;
+  /** Allow serving dotfiles. Defaults to true. */
+  dotfiles?: boolean;
+  /** Path to a .types file (or inline JSON) with custom MIME mappings. */
+  mimetypes?: string;
+  /** Hide permission columns in directory listings. */
+  hidePermissions?: boolean;
+  /** Hosts allowed to access the server. Empty means all. */
+  allowedHosts?: string[];
+  /** Request log sink. Defaults to console.log. */
+  log?: (line: string) => void;
+}
+
+export interface ResolvedServeOptions {
+  root: string;
+  port: number;
+  address: string;
+  baseDir: string;
+  showDir: boolean;
+  autoIndex: boolean;
+  dirOverrides404: boolean;
+  gzip: boolean;
+  brotli: boolean;
+  ext: string;
+  silent: boolean;
+  cors: boolean;
+  corsHeaders?: string;
+  coop: boolean;
+  privateNetworkAccess: boolean;
+  headers: Record<string, string>;
+  cache: number;
+  timeout: number;
+  utc: boolean;
+  logIp: boolean;
+  proxy?: string;
+  proxyAll: boolean;
+  username?: string;
+  password?: string;
+  ssl: boolean;
+  cert: string;
+  key: string;
+  passphrase?: string;
+  robots: boolean | string;
+  dotfiles: boolean;
+  mimeTypes: MimeOverrides;
+  hidePermissions: boolean;
+  allowedHosts: string[];
+  log: (line: string) => void;
+}
+
+export interface StaticServer {
+  server: Bun.Server<undefined>;
+  options: ResolvedServeOptions;
+  port: number;
+  url: string;
+  stop(force?: boolean): void;
+}
+
+type Resolution =
+  | { kind: "file"; path: string; stats: Stats; typePath: string; encoding?: "br" | "gzip" }
+  | { kind: "dir"; path: string; stats: Stats }
+  | { kind: "redirect"; location: string }
+  | { kind: "notFound"; magic: boolean };
+
+function asBool(value: unknown, fallback: boolean): boolean {
+  if (value === undefined || value === null) return fallback;
+  if (typeof value === "string") return value !== "false";
+  return Boolean(value);
+}
+
+function normalizeBaseDir(value: string): string {
+  let result = value.startsWith("/") ? value : `/${value}`;
+  if (!result.endsWith("/")) result += "/";
+  return result.replace(/\/+/g, "/");
+}
+
+function normalizeExt(value: ServeOptions["ext"]): string {
+  if (value === undefined || value === true) return "html";
+  return String(value).replace(/^\./, "");
+}
+
+function normalizeCache(value: ServeOptions["cache"]): number {
+  if (value === undefined) return 3600;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : 3600;
+}
+
+function normalizeTimeout(value: ServeOptions["timeout"]): number {
+  if (value === undefined) return 120;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) ? parsed : 120;
+}
+
+export function resolveOptions(options: ServeOptions = {}): ResolvedServeOptions {
+  const root = resolve(options.root ?? ".");
+  const cors = Boolean(options.cors);
+  const corsHeaders = typeof options.cors === "string" ? options.cors : undefined;
+
+  let mimeTypes: MimeOverrides = {};
+  if (options.mimetypes) {
+    let input = options.mimetypes;
+    try {
+      const trimmed = input.trim();
+      if (!trimmed.startsWith("{")) input = readFileSync(input, "utf8");
+      mimeTypes = parseMimeTypes(input);
+    } catch (error) {
+      throw new Error(`Could not read mimetypes file "${options.mimetypes}": ${(error as Error).message}`);
+    }
+  }
+
+  let proxy = options.proxy;
+  if (proxy) {
+    try {
+      new URL(proxy);
+    } catch {
+      throw new Error(`Invalid proxy url: ${proxy}`);
+    }
+  } else {
+    proxy = undefined;
+  }
+
+  const username = options.username;
+  const password = options.password;
+
+  return {
+    root,
+    port: options.port ?? 8080,
+    address: options.address ?? "0.0.0.0",
+    baseDir: normalizeBaseDir(options.baseDir ?? "/"),
+    showDir: asBool(options.showDir, true),
+    autoIndex: asBool(options.autoIndex, true),
+    dirOverrides404: asBool(options.dirOverrides404, false),
+    gzip: asBool(options.gzip, false),
+    brotli: asBool(options.brotli, false),
+    ext: normalizeExt(options.ext),
+    silent: asBool(options.silent, false),
+    cors,
+    ...(corsHeaders ? { corsHeaders } : {}),
+    coop: asBool(options.coop, false),
+    privateNetworkAccess: asBool(options.privateNetworkAccess, false),
+    headers: options.headers ?? {},
+    cache: normalizeCache(options.cache),
+    timeout: normalizeTimeout(options.timeout),
+    utc: asBool(options.utc, false),
+    logIp: asBool(options.logIp, false),
+    ...(proxy ? { proxy } : {}),
+    proxyAll: asBool(options.proxyAll, false),
+    ...(username !== undefined ? { username } : {}),
+    ...(password !== undefined ? { password } : {}),
+    ssl: asBool(options.ssl, false),
+    cert: options.cert ?? "cert.pem",
+    key: options.key ?? "key.pem",
+    ...((options.passphrase ?? process.env.NODE_HTTP_SERVER_SSL_PASSPHRASE)
+      ? { passphrase: options.passphrase ?? process.env.NODE_HTTP_SERVER_SSL_PASSPHRASE }
+      : {}),
+    robots: options.robots ?? false,
+    dotfiles: asBool(options.dotfiles, true),
+    mimeTypes,
+    hidePermissions: asBool(options.hidePermissions, false),
+    allowedHosts: (options.allowedHosts ?? []).map((host) => host.trim().toLowerCase()).filter(Boolean),
+    log: options.log ?? ((line: string) => console.log(line)),
+  };
+}
+
+function cacheControl(seconds: number): string {
+  return seconds === -1 ? "no-cache, no-store, must-revalidate" : `max-age=${seconds}`;
+}
+
+function weakEtag(stats: Stats): string {
+  return `W/"${stats.ino}-${stats.size}-${stats.mtime.toISOString()}"`;
+}
+
+function baseHeaders(opts: ResolvedServeOptions): Headers {
+  const headers = new Headers();
+  headers.set("accept-ranges", "bytes");
+
+  if (opts.cors) {
+    headers.set("access-control-allow-origin", "*");
+    const allowHeaders = "Origin, X-Requested-With, Content-Type, Accept, Range";
+    headers.set(
+      "access-control-allow-headers",
+      opts.corsHeaders ? `${allowHeaders}, ${opts.corsHeaders}` : allowHeaders,
+    );
+    headers.set("access-control-allow-methods", "GET, HEAD, PUT, PATCH, POST, DELETE, OPTIONS");
+  }
+  if (opts.coop) headers.set("cross-origin-opener-policy", "same-origin");
+  if (opts.privateNetworkAccess) headers.set("access-control-allow-private-network", "true");
+
+  for (const [key, value] of Object.entries(opts.headers)) {
+    headers.set(key, value);
+  }
+  return headers;
+}
+
+function textResponse(
+  status: number,
+  body: string,
+  opts: ResolvedServeOptions,
+  extra?: Record<string, string>,
+): Response {
+  const headers = baseHeaders(opts);
+  headers.set("content-type", "text/plain; charset=utf-8");
+  if (extra) {
+    for (const [key, value] of Object.entries(extra)) headers.set(key, value);
+  }
+  return new Response(body, { status, headers });
+}
+
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
+function errorResponse(status: number, error: unknown, opts: ResolvedServeOptions): Response {
+  const message = error instanceof Error ? (error.stack ?? error.message) : String(error);
+  const headers = baseHeaders(opts);
+  headers.set("content-type", "text/html; charset=utf-8");
+  const body = `<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8">
+    <title>${status} Internal Server Error</title>
+  </head>
+  <body>
+    <pre>${escapeHtml(message)}</pre>
+  </body>
+</html>
+`;
+  return new Response(body, { status, headers });
+}
+
+async function statOrUndefined(path: string): Promise<Stats | undefined> {
+  try {
+    return await stat(path);
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    if (code === "ENOENT" || code === "ENOTDIR") return undefined;
+    throw error;
+  }
+}
+
+function acceptsEncoding(req: Request, name: string): boolean {
+  const header = req.headers.get("accept-encoding");
+  if (!header) return false;
+  let wildcardQuality: number | undefined;
+  for (const part of header.split(",")) {
+    const [rawCoding, ...params] = part.trim().split(";");
+    const coding = rawCoding?.trim().toLowerCase();
+    if (!coding) continue;
+    let quality = 1;
+    for (const param of params) {
+      const match = /^\s*q\s*=\s*([0-9.]+)\s*$/i.exec(param);
+      if (match?.[1]) quality = Number(match[1]);
+    }
+    if (coding === name) return quality > 0;
+    if (coding === "*") wildcardQuality = quality;
+  }
+  return (wildcardQuality ?? 0) > 0;
+}
+
+async function isGzipFile(path: string): Promise<boolean> {
+  try {
+    const head = new Uint8Array(await Bun.file(path).slice(0, 2).arrayBuffer());
+    return head.length === 2 && head[0] === 0x1f && head[1] === 0x8b;
+  } catch {
+    return false;
+  }
+}
+
+async function findCompressed(
+  req: Request,
+  path: string,
+  opts: ResolvedServeOptions,
+): Promise<Resolution | undefined> {
+  if (opts.brotli && acceptsEncoding(req, "br")) {
+    const candidate = `${path}.br`;
+    const stats = await statOrUndefined(candidate);
+    if (stats?.isFile()) {
+      return { kind: "file", path: candidate, stats, typePath: path, encoding: "br" };
+    }
+  }
+  if (opts.gzip && acceptsEncoding(req, "gzip")) {
+    const candidate = `${path}.gz`;
+    const stats = await statOrUndefined(candidate);
+    if (stats?.isFile() && (await isGzipFile(candidate))) {
+      return { kind: "file", path: candidate, stats, typePath: path, encoding: "gzip" };
+    }
+  }
+  return undefined;
+}
+
+async function resolvePath(
+  req: Request,
+  target: string,
+  pathname: string,
+  opts: ResolvedServeOptions,
+): Promise<Resolution> {
+  const wantsDirectory = pathname.endsWith("/");
+
+  if (!wantsDirectory) {
+    const compressed = await findCompressed(req, target, opts);
+    if (compressed) return compressed;
+  }
+
+  let stats = await statOrUndefined(target);
+
+  if (stats?.isDirectory()) {
+    if (!wantsDirectory) {
+      return { kind: "redirect", location: `${pathname}/` };
+    }
+    if (opts.autoIndex) {
+      const indexFile = join(target, `index.${opts.ext}`);
+      const indexStats = await statOrUndefined(indexFile);
+      if (indexStats?.isFile()) {
+        return { kind: "file", path: indexFile, stats: indexStats, typePath: indexFile };
+      }
+    }
+    if (opts.showDir) return { kind: "dir", path: target, stats };
+    return { kind: "notFound", magic: !opts.dirOverrides404 };
+  }
+
+  if (stats?.isFile()) {
+    return { kind: "file", path: target, stats, typePath: target };
+  }
+
+  if (opts.ext && !wantsDirectory && !extname(pathname)) {
+    const candidate = `${target}.${opts.ext}`;
+    stats = await statOrUndefined(candidate);
+    if (stats?.isFile()) {
+      const compressed = await findCompressed(req, candidate, opts);
+      if (compressed) return compressed;
+      return { kind: "file", path: candidate, stats, typePath: candidate };
+    }
+  }
+
+  return { kind: "notFound", magic: true };
+}
+
+function isNotModified(req: Request, etag: string, mtime: Date): boolean {
+  const ifNoneMatch = req.headers.get("if-none-match");
+  if (ifNoneMatch) {
+    if (ifNoneMatch.trim() === "*") return true;
+    const normalize = (value: string) => value.trim().replace(/^W\//, "");
+    const target = normalize(etag);
+    return ifNoneMatch.split(",").some((candidate) => normalize(candidate) === target);
+  }
+
+  const ifModifiedSince = req.headers.get("if-modified-since");
+  if (ifModifiedSince) {
+    const since = Date.parse(ifModifiedSince);
+    if (Number.isNaN(since)) return false;
+    return Math.floor(mtime.getTime() / 1000) <= Math.floor(since / 1000);
+  }
+
+  return false;
+}
+
+interface ByteRange {
+  start: number;
+  end: number;
+}
+
+function parseRange(header: string | null, size: number): ByteRange | "invalid" | undefined {
+  if (!header) return undefined;
+  const match = /^bytes=(\d*)-(\d*)$/i.exec(header.trim());
+  if (!match) return "invalid";
+
+  const rawStart = match[1] ?? "";
+  const rawEnd = match[2] ?? "";
+  if (!rawStart && !rawEnd) return "invalid";
+
+  let start: number;
+  let end: number;
+
+  if (!rawStart) {
+    const suffix = Number(rawEnd);
+    if (!Number.isFinite(suffix) || suffix <= 0) return "invalid";
+    start = Math.max(size - suffix, 0);
+    end = size - 1;
+  } else {
+    start = Number(rawStart);
+    end = rawEnd ? Number(rawEnd) : size - 1;
+    if (!Number.isFinite(start) || !Number.isFinite(end)) return "invalid";
+    end = Math.min(end, size - 1);
+  }
+
+  if (start > end || start >= size || size === 0) return "invalid";
+  return { start, end };
+}
+
+async function serveFile(
+  req: Request,
+  opts: ResolvedServeOptions,
+  filePath: string,
+  stats: Stats,
+  typePath: string,
+  encoding: "br" | "gzip" | undefined,
+  status = 200,
+): Promise<Response> {
+  const headers = baseHeaders(opts);
+  const etag = weakEtag(stats);
+  headers.set("cache-control", cacheControl(opts.cache));
+  headers.set("last-modified", stats.mtime.toUTCString());
+  headers.set("etag", etag);
+  headers.set("content-type", withCharset(lookupMime(typePath, opts.mimeTypes)));
+  if (encoding) headers.set("content-encoding", encoding === "gzip" ? "gzip" : "br");
+
+  if (status === 200 && isNotModified(req, etag, stats.mtime)) {
+    return new Response(null, { status: 304, headers });
+  }
+
+  const range = status === 200 ? parseRange(req.headers.get("range"), stats.size) : undefined;
+
+  if (range === "invalid") {
+    return textResponse(416, "Requested range not satisfiable", opts, {
+      "content-range": `bytes */${stats.size}`,
+    });
+  }
+
+  if (range) {
+    const length = range.end - range.start + 1;
+    headers.set("content-range", `bytes ${range.start}-${range.end}/${stats.size}`);
+    headers.set("content-length", String(length));
+    const body = req.method === "HEAD" ? null : Bun.file(filePath).slice(range.start, range.end + 1);
+    return new Response(body, { status: 206, headers });
+  }
+
+  headers.set("content-length", String(stats.size));
+  const body = req.method === "HEAD" ? null : Bun.file(filePath);
+  return new Response(body, { status, headers });
+}
+
+async function serveDirectory(
+  req: Request,
+  opts: ResolvedServeOptions,
+  dir: string,
+  stats: Stats,
+  pathname: string,
+): Promise<Response> {
+  const html = await renderDirectoryListing(dir, opts.root, pathname, req.headers.get("host") ?? "", {
+    hidePermissions: opts.hidePermissions,
+    dotfiles: opts.dotfiles,
+  });
+  const payload = Buffer.from(html);
+  const headers = baseHeaders(opts);
+  headers.set("content-type", "text/html; charset=utf-8");
+  headers.set("cache-control", cacheControl(opts.cache));
+  headers.set("last-modified", stats.mtime.toUTCString());
+  headers.set("etag", weakEtag(stats));
+  headers.set("content-length", String(payload.byteLength));
+  return new Response(req.method === "HEAD" ? null : payload, { headers });
+}
+
+async function serveNotFound(
+  req: Request,
+  opts: ResolvedServeOptions,
+  allowMagic: boolean,
+): Promise<Response> {
+  if (allowMagic) {
+    const magicPath = join(opts.root, opts.baseDir, `404.${opts.ext}`);
+    const stats = await statOrUndefined(magicPath);
+    if (stats?.isFile()) {
+      return serveFile(req, opts, magicPath, stats, magicPath, undefined, 404);
+    }
+  }
+  return textResponse(404, "File not found. :(", opts);
+}
+
+function decodeBasicAuth(header: string): string | undefined {
+  if (!header.toLowerCase().startsWith("basic ")) return undefined;
+  try {
+    return atob(header.slice(6).trim());
+  } catch {
+    return undefined;
+  }
+}
+
+function authorized(req: Request, opts: ResolvedServeOptions): boolean {
+  const credentials = decodeBasicAuth(req.headers.get("authorization") ?? "");
+  if (credentials === undefined) return false;
+  const expected = `${opts.username ?? ""}:${opts.password ?? ""}`;
+  const receivedDigest = createHash("sha256").update(credentials).digest();
+  const expectedDigest = createHash("sha256").update(expected).digest();
+  return timingSafeEqual(receivedDigest, expectedDigest);
+}
+
+function hostAllowed(req: Request, opts: ResolvedServeOptions): boolean {
+  if (opts.allowedHosts.length === 0) return true;
+  const rawHost = (req.headers.get("host") ?? "").toLowerCase();
+  if (!rawHost) return false;
+  const hostname = rawHost.replace(/:\d+$/, "");
+
+  return opts.allowedHosts.some((pattern) => {
+    if (pattern.includes(":")) return pattern === rawHost;
+    if (pattern.startsWith("*.")) {
+      const suffix = pattern.slice(1);
+      return hostname === pattern.slice(2) || hostname.endsWith(suffix);
+    }
+    return hostname === pattern;
+  });
+}
+
+function clientIp(req: Request, server: Bun.Server<undefined>): string {
+  return req.headers.get("x-forwarded-for") ?? server.requestIP(req)?.address ?? "-";
+}
+
+async function proxyRequest(
+  req: Request,
+  opts: ResolvedServeOptions,
+  server: Bun.Server<undefined>,
+): Promise<Response> {
+  const url = new URL(req.url);
+  if (!opts.proxy) return textResponse(502, "Proxy is not configured", opts);
+  const target = new URL(url.pathname + url.search, opts.proxy);
+
+  const headers = new Headers(req.headers);
+  for (const header of [
+    "host",
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "expect",
+  ]) {
+    headers.delete(header);
+  }
+  headers.set("accept-encoding", "identity");
+  headers.set("x-forwarded-for", [req.headers.get("x-forwarded-for"), clientIp(req, server)].filter(Boolean).join(", "));
+  headers.set("x-forwarded-host", req.headers.get("host") ?? "");
+  headers.set("x-forwarded-proto", url.protocol.replace(/:$/, ""));
+
+  const init: RequestInit = { method: req.method, headers, redirect: "manual" };
+  if (req.method !== "GET" && req.method !== "HEAD" && req.body) {
+    init.body = req.body;
+  }
+
+  let upstream: Response;
+  try {
+    upstream = await fetch(target, init);
+  } catch (error) {
+    return textResponse(502, `Proxy error: ${(error as Error).message}`, opts);
+  }
+
+  const responseHeaders = new Headers(upstream.headers);
+  responseHeaders.delete("content-length");
+  const body = req.method === "HEAD" ? null : upstream.body;
+  return new Response(body, { status: upstream.status, statusText: upstream.statusText, headers: responseHeaders });
+}
+
+async function notFoundOrProxy(
+  req: Request,
+  opts: ResolvedServeOptions,
+  server: Bun.Server<undefined>,
+  allowMagic: boolean,
+): Promise<Response> {
+  if (opts.proxy) return proxyRequest(req, opts, server);
+  return serveNotFound(req, opts, allowMagic);
+}
+
+async function handleRequest(
+  req: Request,
+  server: Bun.Server<undefined>,
+  opts: ResolvedServeOptions,
+): Promise<Response> {
+  if ((opts.username !== undefined || opts.password !== undefined) && !authorized(req, opts)) {
+    return textResponse(401, "Access denied", opts, { "www-authenticate": 'Basic realm=""' });
+  }
+
+  if (!hostAllowed(req, opts)) {
+    return textResponse(403, "ACCESS DENIED", opts);
+  }
+
+  if (opts.cors || opts.privateNetworkAccess) {
+    if (req.method === "OPTIONS") {
+      return new Response(null, { status: 204, headers: baseHeaders(opts) });
+    }
+  }
+
+  if (req.method !== "GET" && req.method !== "HEAD") {
+    return textResponse(405, "", opts, { allow: "GET, HEAD" });
+  }
+
+  const url = new URL(req.url);
+
+  if (opts.robots && url.pathname === "/robots.txt") {
+    const body = opts.robots === true ? "User-agent: *\nDisallow: /" : String(opts.robots);
+    const headers = baseHeaders(opts);
+    headers.set("content-type", "text/plain");
+    return new Response(body, { headers });
+  }
+
+  if (opts.proxyAll && opts.proxy) {
+    return proxyRequest(req, opts, server);
+  }
+
+  let pathname: string;
+  try {
+    pathname = decodeURIComponent(url.pathname);
+  } catch {
+    return textResponse(400, "Malformed request.", opts);
+  }
+
+  pathname = pathname.replace(/\\/g, "/");
+  if (pathname.includes("\0")) {
+    return textResponse(400, "Malformed request.", opts);
+  }
+
+  let relativePath: string;
+  if (opts.baseDir === "/") {
+    relativePath = pathname;
+  } else {
+    const bare = opts.baseDir.slice(0, -1);
+    if (pathname === bare || pathname === opts.baseDir) {
+      relativePath = "/";
+    } else if (pathname.startsWith(opts.baseDir)) {
+      relativePath = `/${pathname.slice(opts.baseDir.length)}`;
+    } else {
+      return notFoundOrProxy(req, opts, server, true);
+    }
+  }
+
+  const target = resolve(opts.root, `.${relativePath}`);
+  const rootPrefix = opts.root.endsWith(sep) ? opts.root : `${opts.root}${sep}`;
+  if (target !== opts.root && !target.startsWith(rootPrefix)) {
+    return textResponse(403, "ACCESS DENIED", opts);
+  }
+
+  if (!opts.dotfiles && isDotfilePath(relative(opts.root, target))) {
+    return notFoundOrProxy(req, opts, server, true);
+  }
+
+  const resolution = await resolvePath(req, target, pathname, opts);
+
+  switch (resolution.kind) {
+    case "file":
+      return serveFile(req, opts, resolution.path, resolution.stats, resolution.typePath, resolution.encoding);
+    case "dir":
+      return serveDirectory(req, opts, resolution.path, resolution.stats, pathname);
+    case "redirect": {
+      const headers = baseHeaders(opts);
+      headers.set("location", `${resolution.location}${url.search}`);
+      return new Response(null, { status: 302, headers });
+    }
+    case "notFound":
+      return notFoundOrProxy(req, opts, server, resolution.magic);
+  }
+}
+
+export function createRequestHandler(
+  options: ResolvedServeOptions,
+): (req: Request, server: Bun.Server<undefined>) => Promise<Response> {
+  return async (req, server) => {
+    try {
+      const response = await handleRequest(req, server, options);
+      logRequest(req, server, options);
+      return response;
+    } catch (error) {
+      if (!options.silent) {
+        options.log(`[error] ${error instanceof Error ? error.stack ?? error.message : String(error)}`);
+      }
+      return errorResponse(500, error, options);
+    }
+  };
+}
+
+function logRequest(req: Request, server: Bun.Server<undefined>, opts: ResolvedServeOptions): void {
+  if (opts.silent) return;
+  const stamp = opts.utc ? new Date().toUTCString() : new Date().toString();
+  const ip = opts.logIp ? `${clientIp(req, server)} ` : "";
+  const url = new URL(req.url);
+  opts.log(
+    `[${stamp}] ${ip}"${req.method} ${url.pathname}${url.search}" "${req.headers.get("user-agent") ?? ""}"`,
+  );
+}
+
+function isAddressInUse(error: unknown): boolean {
+  const candidate = error as { code?: string; message?: string };
+  return candidate?.code === "EADDRINUSE" || /EADDRINUSE|address already in use/i.test(candidate?.message ?? "");
+}
+
+/**
+ * Bun sets SO_REUSEPORT, so two Bun servers can bind the same port without an
+ * error. Probe with a plain TCP listener (which does not set SO_REUSEPORT) to
+ * reproduce http-server's "port in use" detection.
+ */
+function portAvailable(port: number, hostname: string): Promise<boolean> {
+  return new Promise((resolvePort) => {
+    const probe = createNetServer();
+    const finish = (available: boolean): void => {
+      probe.removeAllListeners();
+      if (probe.listening) probe.close(() => resolvePort(available));
+      else resolvePort(available);
+    };
+    probe.once("error", () => finish(false));
+    probe.once("listening", () => finish(true));
+    try {
+      probe.listen(port, hostname);
+    } catch {
+      finish(false);
+    }
+  });
+}
+
+function* scannedPorts(start = 8080): Generator<number> {
+  for (let port = start; port <= 65535; port += 1) yield port;
+}
+
+function displayHost(address: string): string {
+  if (address === "0.0.0.0" || address === "::" || address === "") return "127.0.0.1";
+  return address;
+}
+
+export async function startStaticServer(options: ServeOptions = {}): Promise<StaticServer> {
+  const opts = resolveOptions(options);
+
+  if (opts.ssl) {
+    for (const [label, file] of [
+      ["certificate", opts.cert],
+      ["private key", opts.key],
+    ] as const) {
+      try {
+        statSyncExists(file);
+      } catch {
+        throw new Error(`Could not find ${label} ${file}`);
+      }
+    }
+  }
+
+  const handler = createRequestHandler(opts);
+  const ports = opts.port === 0 ? scannedPorts() : [opts.port];
+  let server: Bun.Server<undefined> | undefined;
+  let lastError: unknown;
+
+  for (const port of ports) {
+    const available = await portAvailable(port, opts.address);
+    if (!available) {
+      if (opts.port === 0) continue;
+      throw new Error(`Port ${port} is already in use`);
+    }
+    try {
+      server = Bun.serve({
+        port,
+        hostname: opts.address,
+        idleTimeout: opts.timeout === 0 ? 0 : Math.min(255, Math.max(1, opts.timeout)),
+        development: false,
+        ...(opts.ssl
+          ? {
+              tls: {
+                cert: Bun.file(opts.cert),
+                key: Bun.file(opts.key),
+                ...(opts.passphrase ? { passphrase: opts.passphrase } : {}),
+              },
+            }
+          : {}),
+        fetch: (req, bunServer) => handler(req, bunServer),
+      });
+      break;
+    } catch (error) {
+      lastError = error;
+      if (opts.port === 0 && isAddressInUse(error)) continue;
+      if (isAddressInUse(error)) {
+        throw new Error(`Port ${port} is already in use`);
+      }
+      throw error;
+    }
+  }
+
+  if (!server) {
+    throw new Error(`Could not find an open port: ${(lastError as Error)?.message ?? "unknown error"}`);
+  }
+
+  const protocol = opts.ssl ? "https" : "http";
+  const port = server.port ?? opts.port;
+
+  return {
+    server,
+    options: opts,
+    port,
+    url: `${protocol}://${displayHost(opts.address)}:${port}`,
+    stop(force = true) {
+      server?.stop(force);
+    },
+  };
+}
+
+function statSyncExists(path: string): void {
+  statSync(path);
+}