@morojs/moro 1.6.6 → 1.7.0

package/dist/core/http/http-server.js

@@ -1,8 +1,6 @@
 // src/core/http-server.ts
 import { createServer } from 'http';
 import * as zlib from 'zlib';
-import { createReadStream } from 'fs';
-import * as crypto from 'crypto';
 import { promisify } from 'util';
 import { createFrameworkLogger } from '../logger/index.js';
 import { PathMatcher } from '../routing/path-matcher.js';
@@ -38,40 +36,6 @@ export class MoroHttpServer {
         methodNotAllowed: Buffer.from('{"success":false,"error":"Method not allowed"}'),
         rateLimited: Buffer.from('{"success":false,"error":"Rate limit exceeded"}'),
     };
-    // Buffer pool for zero-copy operations
-    static BUFFER_SIZES = [64, 256, 1024, 4096, 16384];
-    static BUFFER_POOLS = new Map();
-    static {
-        // Pre-allocate buffer pools for zero-allocation responses
-        for (const size of MoroHttpServer.BUFFER_SIZES) {
-            MoroHttpServer.BUFFER_POOLS.set(size, []);
-            for (let i = 0; i < 50; i++) {
-                // 50 buffers per size
-                MoroHttpServer.BUFFER_POOLS.get(size).push(Buffer.allocUnsafe(size));
-            }
-        }
-    }
-    static getOptimalBuffer(size) {
-        // Find the smallest buffer that fits
-        for (const poolSize of MoroHttpServer.BUFFER_SIZES) {
-            if (size <= poolSize) {
-                const pool = MoroHttpServer.BUFFER_POOLS.get(poolSize);
-                return pool.length > 0 ? pool.pop() : Buffer.allocUnsafe(poolSize);
-            }
-        }
-        return Buffer.allocUnsafe(size);
-    }
-    static returnBuffer(buffer) {
-        // Return buffer to appropriate pool
-        const size = buffer.length;
-        if (MoroHttpServer.BUFFER_POOLS.has(size)) {
-            const pool = MoroHttpServer.BUFFER_POOLS.get(size);
-            if (pool.length < 50) {
-                // Don't let pools grow too large
-                pool.push(buffer);
-            }
-        }
-    }
     constructor() {
         this.server = createServer(this.handleRequest.bind(this));
         // Optimize server for high performance (conservative settings for compatibility)
@@ -147,6 +111,7 @@ export class MoroHttpServer {
             if (!this.routesBySegmentCount.has(segmentCount)) {
                 this.routesBySegmentCount.set(segmentCount, []);
             }
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
             this.routesBySegmentCount.get(segmentCount).push(route);
         }
     }
@@ -165,6 +130,7 @@ export class MoroHttpServer {
         const originalParams = httpReq.params;
         try {
             // Optimized URL and query parsing with object pooling
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
             const urlString = req.url;
             const queryIndex = urlString.indexOf('?');
             if (queryIndex === -1) {
@@ -200,6 +166,7 @@ export class MoroHttpServer {
                 return;
             }
             // Find matching route
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
             const route = this.findRoute(req.method, httpReq.path);
             if (!route) {
                 // 404 response with pre-compiled buffer
@@ -282,11 +249,12 @@ export class MoroHttpServer {
             }
         }
         finally {
-            // CRITICAL: Always release pooled objects back to the pool
+            // Always release pooled objects back to the pool
             // This prevents memory leaks and ensures consistent performance
-            // Optimized: Check if object is empty without Object.keys()
+            // Check if object is empty without Object.keys()
             if (originalParams) {
                 let isEmpty = true;
+                // eslint-disable-next-line @typescript-eslint/no-unused-vars
                 for (const _key in originalParams) {
                     isEmpty = false;
                     break;
@@ -297,6 +265,7 @@ export class MoroHttpServer {
             }
             if (httpReq.params && httpReq.params !== originalParams) {
                 let isEmpty = true;
+                // eslint-disable-next-line @typescript-eslint/no-unused-vars
                 for (const _key in httpReq.params) {
                     isEmpty = false;
                     break;
@@ -308,9 +277,10 @@ export class MoroHttpServer {
         }
         // Additional cleanup on response completion to ensure objects are returned to pool
         res.once('finish', () => {
-            // Optimized: Check if object is empty without Object.keys()
+            // Check if object is empty without Object.keys()
             if (originalParams) {
                 let isEmpty = true;
+                // eslint-disable-next-line @typescript-eslint/no-unused-vars
                 for (const _key in originalParams) {
                     isEmpty = false;
                     break;
@@ -321,6 +291,7 @@ export class MoroHttpServer {
             }
             if (httpReq.params && httpReq.params !== originalParams) {
                 let isEmpty = true;
+                // eslint-disable-next-line @typescript-eslint/no-unused-vars
                 for (const _key in httpReq.params) {
                     isEmpty = false;
                     break;
@@ -356,18 +327,45 @@ export class MoroHttpServer {
     streamLargeResponse(res, data) {
         res.setHeader('Content-Type', 'application/json; charset=utf-8');
         res.setHeader('Transfer-Encoding', 'chunked');
-        // Stream the response in chunks
-        const jsonString = JSON.stringify(data);
-        const chunkSize = 8192; // 8KB chunks
-        for (let i = 0; i < jsonString.length; i += chunkSize) {
-            const chunk = jsonString.substring(i, i + chunkSize);
-            res.write(chunk);
+        // Stream large JSON responses to prevent memory issues
+        if (Array.isArray(data) && data.length > 100) {
+            // Stream large arrays element by element
+            res.write('[');
+            // Stream each array element
+            let first = true;
+            for (const item of data) {
+                if (!first)
+                    res.write(',');
+                res.write(JSON.stringify(item));
+                first = false;
+            }
+            // Write closing bracket and end
+            res.end(']');
+        }
+        else if (typeof data === 'object' && data !== null && Object.keys(data).length > 50) {
+            // For large objects, stream key-value pairs
+            res.write('{');
+            const keys = Object.keys(data);
+            let first = true;
+            for (const key of keys) {
+                if (!first)
+                    res.write(',');
+                // Properly escape the key using JSON.stringify
+                res.write(`${JSON.stringify(key)}:${JSON.stringify(data[key])}`);
+                first = false;
+            }
+            res.end('}');
+        }
+        else {
+            // For smaller data, still avoid the old chunking approach
+            const jsonString = JSON.stringify(data);
+            res.end(jsonString);
         }
-        res.end();
     }
     normalizePath(path) {
         // Check cache first
         if (this.pathNormalizationCache.has(path)) {
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
             return this.pathNormalizationCache.get(path);
         }
         // Normalization: remove trailing slash (except root), decode once
@@ -460,76 +458,21 @@ export class MoroHttpServer {
         httpRes.json = async (data) => {
             if (httpRes.headersSent)
                 return;
-            // JSON serialization with zero-copy buffers
-            let jsonString;
-            // Enhanced JSON optimization for common API patterns
-            // Fast path for common 2-3 key objects without Object.keys() overhead
-            if (data && typeof data === 'object' && 'success' in data) {
-                // Check for common patterns using 'in' operator (faster than Object.keys for small objects)
-                const hasData = 'data' in data;
-                const hasError = 'error' in data;
-                const hasTotal = 'total' in data;
-                // Fast path: {success, data} - most common pattern
-                if (hasData && !hasError && !hasTotal) {
-                    // Verify it's exactly 2 keys by checking no other common keys exist
-                    if (!('message' in data) && !('code' in data) && !('status' in data)) {
-                        jsonString = `{"success":${data.success},"data":${JSON.stringify(data.data)}}`;
-                    }
-                    else {
-                        jsonString = JSON.stringify(data);
-                    }
-                }
-                else if (hasError && !hasData && !hasTotal) {
-                    // Fast path: {success, error}
-                    if (!('message' in data) && !('code' in data) && !('status' in data)) {
-                        jsonString = `{"success":${data.success},"error":${JSON.stringify(data.error)}}`;
-                    }
-                    else {
-                        jsonString = JSON.stringify(data);
-                    }
-                }
-                else if (hasData && hasError && !hasTotal) {
-                    // Fast path: {success, data, error}
-                    if (!('message' in data) && !('code' in data) && !('status' in data)) {
-                        jsonString = `{"success":${data.success},"data":${JSON.stringify(data.data)},"error":${JSON.stringify(data.error)}}`;
-                    }
-                    else {
-                        jsonString = JSON.stringify(data);
-                    }
-                }
-                else if (hasData && hasTotal && !hasError) {
-                    // Fast path: {success, data, total}
-                    if (!('message' in data) && !('code' in data) && !('status' in data)) {
-                        jsonString = `{"success":${data.success},"data":${JSON.stringify(data.data)},"total":${data.total}}`;
-                    }
-                    else {
-                        jsonString = JSON.stringify(data);
-                    }
-                }
-                else {
-                    // Complex object - use standard JSON.stringify
-                    jsonString = JSON.stringify(data);
-                }
-            }
-            else {
-                jsonString = JSON.stringify(data);
-            }
-            // Use buffer pool for zero-allocation responses
-            const estimatedSize = jsonString.length;
-            if (estimatedSize > 32768) {
+            // Simple, optimized JSON serialization - let V8 handle the optimization
+            const jsonString = JSON.stringify(data);
+            // Large response check - stream if needed
+            if (jsonString.length > 32768) {
                 // Large response - stream it
                 return this.streamLargeResponse(httpRes, data);
             }
-            const buffer = MoroHttpServer.getOptimalBuffer(estimatedSize);
-            const actualLength = buffer.write(jsonString, 0, 'utf8');
-            // Slice to actual size to avoid sending extra bytes
-            const finalBuffer = actualLength === buffer.length ? buffer : buffer.subarray(0, actualLength);
+            // Use efficient buffer allocation - let Node.js handle optimization
+            const finalBuffer = Buffer.from(jsonString, 'utf8');
             // Optimized header setting - set multiple headers at once when possible
             const headers = {
                 'Content-Type': 'application/json; charset=utf-8',
             };
             // Compression with buffer pool - EARLY EXIT if disabled or below threshold
-            // CRITICAL: Only make this async if compression is actually happening
+            // Only make this async if compression is actually happening
             if (this.compressionEnabled && finalBuffer.length > this.compressionThreshold) {
                 const acceptEncoding = httpRes.req.headers['accept-encoding'];
                 if (acceptEncoding && acceptEncoding.includes('gzip')) {
@@ -540,8 +483,6 @@ export class MoroHttpServer {
                         // Batch write all headers at once (50-100% faster)
                         httpRes.writeHead(httpRes.statusCode || 200, headers);
                         httpRes.end(compressed);
-                        // Return buffer to pool after response
-                        process.nextTick(() => MoroHttpServer.returnBuffer(buffer));
                     });
                     return;
                 }
@@ -553,8 +494,6 @@ export class MoroHttpServer {
                         // Batch write all headers at once
                         httpRes.writeHead(httpRes.statusCode || 200, headers);
                         httpRes.end(compressed);
-                        // Return buffer to pool after response
-                        process.nextTick(() => MoroHttpServer.returnBuffer(buffer));
                     });
                     return;
                 }
@@ -564,8 +503,6 @@ export class MoroHttpServer {
             // Batch write all headers at once
             httpRes.writeHead(httpRes.statusCode || 200, headers);
             httpRes.end(finalBuffer);
-            // Return buffer to pool after response (zero-copy achievement!)
-            process.nextTick(() => MoroHttpServer.returnBuffer(buffer));
         };
         httpRes.send = (data) => {
             if (httpRes.headersSent)
@@ -626,15 +563,31 @@ export class MoroHttpServer {
             if (options.path)
                 cookieString += `; Path=${options.path}`;
             const existingCookies = httpRes.getHeader('Set-Cookie') || [];
+            // Avoid spread operator - direct array manipulation
             const cookies = Array.isArray(existingCookies)
-                ? [...existingCookies]
+                ? existingCookies
                 : [existingCookies];
             cookies.push(cookieString);
             httpRes.setHeader('Set-Cookie', cookies);
             return httpRes;
         };
         httpRes.clearCookie = (name, options = {}) => {
-            const clearOptions = { ...options, expires: new Date(0), maxAge: 0 };
+            // Avoid spread operator - manually set properties
+            const clearOptions = {
+                expires: new Date(0),
+                maxAge: 0,
+            };
+            // Copy other options manually
+            if (options.path !== undefined)
+                clearOptions.path = options.path;
+            if (options.domain !== undefined)
+                clearOptions.domain = options.domain;
+            if (options.httpOnly !== undefined)
+                clearOptions.httpOnly = options.httpOnly;
+            if (options.secure !== undefined)
+                clearOptions.secure = options.secure;
+            if (options.sameSite !== undefined)
+                clearOptions.sameSite = options.sameSite;
             return httpRes.cookie(name, '', clearOptions);
         };
         httpRes.redirect = (url, status = 302) => {
@@ -665,7 +618,7 @@ export class MoroHttpServer {
                 httpRes.setHeader('Cache-Control', 'public, max-age=31536000'); // 1 year for static files
                 httpRes.end(data);
             }
-            catch (error) {
+            catch {
                 httpRes.status(404).json({ success: false, error: 'File not found' });
             }
         };
@@ -676,15 +629,17 @@ export class MoroHttpServer {
         // Note: removeHeader is inherited from ServerResponse, we don't override it
         httpRes.setBulkHeaders = (headers) => {
             if (httpRes.headersSent) {
+                // Only enumerate keys for warning if headers were already sent
+                const attemptedHeaderKeys = [];
+                for (const key in headers) {
+                    attemptedHeaderKeys.push(key);
+                }
                 this.logger.warn('Cannot set headers - headers already sent', 'HeaderWarning', {
-                    attemptedHeaders: Object.keys(headers),
+                    attemptedHeaders: attemptedHeaderKeys,
                 });
                 return httpRes;
             }
-            const headerKeys = Object.keys(headers);
-            const headerKeysLen = headerKeys.length;
-            for (let i = 0; i < headerKeysLen; i++) {
-                const key = headerKeys[i];
+            for (const key in headers) {
                 httpRes.setHeader(key, headers[key]);
             }
             return httpRes;
@@ -753,10 +708,18 @@ export class MoroHttpServer {
         return mimeType;
     }
     async parseBody(req) {
+        const contentType = req.headers['content-type'] || '';
+        const contentLength = parseInt(req.headers['content-length'] || '0');
+        const maxSize = 10 * 1024 * 1024; // 10MB limit
+        // For very large payloads, return a streaming interface instead of buffering
+        if (contentLength > maxSize / 2) {
+            // Stream for payloads > 5MB
+            return this.createStreamingBodyParser(req, contentType, maxSize);
+        }
+        // Standard buffered parsing for smaller payloads
         return new Promise((resolve, reject) => {
             const chunks = [];
             let totalLength = 0;
-            const maxSize = 10 * 1024 * 1024; // 10MB limit
             req.on('data', (chunk) => {
                 totalLength += chunk.length;
                 if (totalLength > maxSize) {
@@ -768,7 +731,6 @@ export class MoroHttpServer {
             req.on('end', () => {
                 try {
                     const body = Buffer.concat(chunks);
-                    const contentType = req.headers['content-type'] || '';
                     if (contentType.includes('application/json')) {
                         resolve(JSON.parse(body.toString()));
                     }
@@ -789,6 +751,132 @@ export class MoroHttpServer {
             req.on('error', reject);
         });
     }
+    /**
+     * Create a streaming body parser for large payloads
+     * Returns a streaming interface instead of buffering
+     */
+    createStreamingBodyParser(req, contentType, maxSize) {
+        let totalLength = 0;
+        const chunks = [];
+        return new Promise((resolve, reject) => {
+            const streamParser = {
+                // Streaming JSON parser for large JSON payloads
+                json: () => this.streamJsonParse(req, maxSize),
+                // Streaming form data parser
+                form: () => this.streamFormParse(req, maxSize),
+                // Raw stream access
+                stream: () => ({
+                    onData: (callback) => {
+                        req.on('data', (chunk) => {
+                            totalLength += chunk.length;
+                            if (totalLength > maxSize) {
+                                reject(new Error('Request body too large'));
+                                return;
+                            }
+                            callback(chunk);
+                        });
+                    },
+                    onEnd: (callback) => {
+                        req.on('end', callback);
+                    },
+                    onError: (callback) => {
+                        req.on('error', callback);
+                    },
+                }),
+                // Traditional buffered parsing (fallback)
+                buffer: async () => {
+                    return new Promise((resolveBuffer, rejectBuffer) => {
+                        req.on('data', (chunk) => {
+                            totalLength += chunk.length;
+                            if (totalLength > maxSize) {
+                                rejectBuffer(new Error('Request body too large'));
+                                return;
+                            }
+                            chunks.push(chunk);
+                        });
+                        req.on('end', () => {
+                            try {
+                                const body = Buffer.concat(chunks);
+                                if (contentType.includes('application/json')) {
+                                    resolveBuffer(JSON.parse(body.toString()));
+                                }
+                                else {
+                                    resolveBuffer(body.toString());
+                                }
+                            }
+                            catch (error) {
+                                rejectBuffer(error);
+                            }
+                        });
+                        req.on('error', rejectBuffer);
+                    });
+                },
+            };
+            // Auto-detect and return appropriate parser
+            if (contentType.includes('application/json')) {
+                resolve({ type: 'json', parser: streamParser.json });
+            }
+            else if (contentType.includes('application/x-www-form-urlencoded')) {
+                resolve({ type: 'form', parser: streamParser.form });
+            }
+            else {
+                resolve({ type: 'stream', parser: streamParser.stream });
+            }
+        });
+    }
+    /**
+     * Streaming JSON parser for large payloads
+     */
+    async streamJsonParse(req, maxSize) {
+        return new Promise((resolve, reject) => {
+            let jsonString = '';
+            let totalLength = 0;
+            req.on('data', (chunk) => {
+                totalLength += chunk.length;
+                if (totalLength > maxSize) {
+                    reject(new Error('Request body too large'));
+                    return;
+                }
+                jsonString += chunk.toString();
+            });
+            req.on('end', () => {
+                try {
+                    // For very large JSON, consider streaming JSON parsing in the future
+                    resolve(JSON.parse(jsonString));
+                }
+                catch (error) {
+                    reject(error);
+                }
+            });
+            req.on('error', reject);
+        });
+    }
+    /**
+     * Streaming form data parser
+     */
+    async streamFormParse(req, maxSize) {
+        return new Promise((resolve, reject) => {
+            let formData = '';
+            let totalLength = 0;
+            req.on('data', (chunk) => {
+                totalLength += chunk.length;
+                if (totalLength > maxSize) {
+                    reject(new Error('Request body too large'));
+                    return;
+                }
+                formData += chunk.toString();
+            });
+            req.on('end', () => {
+                try {
+                    resolve(this.parseUrlEncoded(formData));
+                }
+                catch (error) {
+                    reject(error);
+                }
+            });
+            req.on('error', reject);
+        });
+    }
     parseMultipart(buffer, contentType) {
         const boundary = contentType.split('boundary=')[1];
         if (!boundary) {
@@ -875,6 +963,7 @@ export class MoroHttpServer {
         const cacheKey = `${method}:${path}`;
         // Check cache first (hot path optimization) - BEFORE any other work
         if (this.routeCache.has(cacheKey)) {
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
             return this.routeCache.get(cacheKey);
         }
         // Normalize path for consistent matching (only if not cached)
@@ -882,9 +971,10 @@ export class MoroHttpServer {
         const normalizedCacheKey = normalizedPath !== path ? `${method}:${normalizedPath}` : cacheKey;
         // Check cache again with normalized path
         if (normalizedPath !== path && this.routeCache.has(normalizedCacheKey)) {
+            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
             return this.routeCache.get(normalizedCacheKey);
         }
-        // Phase 1: O(1) static route lookup
+        // O(1) static route lookup
         const staticRoute = this.staticRoutes.get(normalizedCacheKey);
         if (staticRoute) {
             this.routeCache.set(normalizedCacheKey, staticRoute);
@@ -893,7 +983,7 @@ export class MoroHttpServer {
             }
             return staticRoute;
         }
-        // Phase 2: Optimized dynamic route matching by segment count
+        // Dynamic route matching by segment count
         let route = null;
         const dynamicRoutesLen = this.dynamicRoutes.length;
         if (dynamicRoutesLen > 0) {
@@ -997,659 +1087,4 @@ export class MoroHttpServer {
         };
     }
 }
-// Built-in middleware
-export const middleware = {
-    cors: (options = {}) => {
-        return (req, res, next) => {
-            res.setHeader('Access-Control-Allow-Origin', options.origin || '*');
-            res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
-            res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
-            if (options.credentials) {
-                res.setHeader('Access-Control-Allow-Credentials', 'true');
-            }
-            if (req.method === 'OPTIONS') {
-                res.status(200).send('');
-                return;
-            }
-            next();
-        };
-    },
-    helmet: () => {
-        return (req, res, next) => {
-            res.setHeader('X-Content-Type-Options', 'nosniff');
-            res.setHeader('X-Frame-Options', 'DENY');
-            res.setHeader('X-XSS-Protection', '1; mode=block');
-            res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
-            res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
-            res.setHeader('Content-Security-Policy', "default-src 'self'");
-            next();
-        };
-    },
-    compression: (options = {}) => {
-        const threshold = options.threshold || 1024;
-        const level = options.level || 6;
-        return (req, res, next) => {
-            const acceptEncoding = req.headers['accept-encoding'] || '';
-            // Override res.json to compress responses
-            const originalJson = res.json;
-            const originalSend = res.send;
-            const compressResponse = (data, isJson = false) => {
-                const content = isJson ? JSON.stringify(data) : data;
-                const buffer = Buffer.from(content);
-                if (buffer.length < threshold) {
-                    return isJson ? originalJson.call(res, data) : originalSend.call(res, data);
-                }
-                if (acceptEncoding.includes('gzip')) {
-                    zlib.gzip(buffer, { level }, (err, compressed) => {
-                        if (err) {
-                            return isJson ? originalJson.call(res, data) : originalSend.call(res, data);
-                        }
-                        if (!res.headersSent) {
-                            res.setHeader('Content-Encoding', 'gzip');
-                            res.setHeader('Content-Length', compressed.length);
-                        }
-                        res.end(compressed);
-                    });
-                }
-                else if (acceptEncoding.includes('deflate')) {
-                    zlib.deflate(buffer, { level }, (err, compressed) => {
-                        if (err) {
-                            return isJson ? originalJson.call(res, data) : originalSend.call(res, data);
-                        }
-                        if (!res.headersSent) {
-                            res.setHeader('Content-Encoding', 'deflate');
-                            res.setHeader('Content-Length', compressed.length);
-                        }
-                        res.end(compressed);
-                    });
-                }
-                else {
-                    return isJson ? originalJson.call(res, data) : originalSend.call(res, data);
-                }
-            };
-            res.json = function (data) {
-                // Ensure charset is set for Safari compatibility
-                this.setHeader('Content-Type', 'application/json; charset=utf-8');
-                compressResponse(data, true);
-                return this;
-            };
-            res.send = function (data) {
-                compressResponse(data, false);
-                return this;
-            };
-            next();
-        };
-    },
-    requestLogger: () => {
-        return (req, res, next) => {
-            const start = Date.now();
-            res.on('finish', () => {
-                const duration = Date.now() - start;
-                // Request completed - logged by framework
-            });
-            next();
-        };
-    },
-    bodySize: (options = {}) => {
-        const limit = options.limit || '10mb';
-        const limitBytes = parseSize(limit);
-        return (req, res, next) => {
-            const contentLength = parseInt(req.headers['content-length'] || '0');
-            if (contentLength > limitBytes) {
-                res.status(413).json({
-                    success: false,
-                    error: 'Request entity too large',
-                    limit: limit,
-                });
-                return;
-            }
-            next();
-        };
-    },
-    static: (options) => {
-        return async (req, res, next) => {
-            // Only handle GET and HEAD requests
-            if (req.method !== 'GET' && req.method !== 'HEAD') {
-                next();
-                return;
-            }
-            try {
-                const fs = await import('fs/promises');
-                const path = await import('path');
-                const crypto = await import('crypto');
-                let filePath = path.join(options.root, req.path);
-                // Security: prevent directory traversal
-                if (!filePath.startsWith(path.resolve(options.root))) {
-                    res.status(403).json({ success: false, error: 'Forbidden' });
-                    return;
-                }
-                // Handle dotfiles
-                const basename = path.basename(filePath);
-                if (basename.startsWith('.')) {
-                    if (options.dotfiles === 'deny') {
-                        res.status(403).json({ success: false, error: 'Forbidden' });
-                        return;
-                    }
-                    else if (options.dotfiles === 'ignore') {
-                        next();
-                        return;
-                    }
-                }
-                let stats;
-                try {
-                    stats = await fs.stat(filePath);
-                }
-                catch (error) {
-                    next(); // File not found, let other middleware handle
-                    return;
-                }
-                // Handle directories
-                if (stats.isDirectory()) {
-                    const indexFiles = options.index || ['index.html', 'index.htm'];
-                    let indexFound = false;
-                    for (const indexFile of indexFiles) {
-                        const indexPath = path.join(filePath, indexFile);
-                        try {
-                            const indexStats = await fs.stat(indexPath);
-                            if (indexStats.isFile()) {
-                                filePath = indexPath;
-                                stats = indexStats;
-                                indexFound = true;
-                                break;
-                            }
-                        }
-                        catch (error) {
-                            // Continue to next index file
-                        }
-                    }
-                    if (!indexFound) {
-                        next();
-                        return;
-                    }
-                }
-                // Set headers with proper mime type and charset
-                const ext = path.extname(filePath);
-                const mimeTypes = {
-                    '.html': 'text/html',
-                    '.css': 'text/css',
-                    '.js': 'application/javascript',
-                    '.json': 'application/json',
-                    '.png': 'image/png',
-                    '.jpg': 'image/jpeg',
-                    '.jpeg': 'image/jpeg',
-                    '.gif': 'image/gif',
-                    '.svg': 'image/svg+xml',
-                    '.ico': 'image/x-icon',
-                    '.pdf': 'application/pdf',
-                    '.txt': 'text/plain',
-                    '.xml': 'application/xml',
-                };
-                const baseMimeType = mimeTypes[ext.toLowerCase()] || 'application/octet-stream';
-                // Add charset for text-based files
-                const textTypes = [
-                    'text/',
-                    'application/json',
-                    'application/javascript',
-                    'application/xml',
-                    'image/svg+xml',
-                ];
-                const needsCharset = textTypes.some(type => baseMimeType.startsWith(type));
-                const contentType = needsCharset ? `${baseMimeType}; charset=utf-8` : baseMimeType;
-                res.setHeader('Content-Type', contentType);
-                res.setHeader('Content-Length', stats.size);
-                // Cache headers
-                if (options.maxAge) {
-                    res.setHeader('Cache-Control', `public, max-age=${options.maxAge}`);
-                }
-                // ETag support
-                if (options.etag !== false) {
-                    const etag = crypto
-                        .createHash('md5')
-                        .update(`${stats.mtime.getTime()}-${stats.size}`)
-                        .digest('hex');
-                    res.setHeader('ETag', `"${etag}"`);
-                    // Handle conditional requests
-                    const ifNoneMatch = req.headers['if-none-match'];
-                    if (ifNoneMatch === `"${etag}"`) {
-                        res.statusCode = 304;
-                        res.end();
-                        return;
-                    }
-                }
-                // Handle HEAD requests
-                if (req.method === 'HEAD') {
-                    res.end();
-                    return;
-                }
-                // Send file
-                const data = await fs.readFile(filePath);
-                res.end(data);
-            }
-            catch (error) {
-                res.status(500).json({ success: false, error: 'Internal server error' });
-            }
-        };
-    },
-    upload: (options = {}) => {
-        return (req, res, next) => {
-            const contentType = req.headers['content-type'] || '';
-            if (!contentType.includes('multipart/form-data')) {
-                next();
-                return;
-            }
-            // File upload handling is now built into parseBody method
-            // This middleware can add additional validation
-            if (req.body && req.body.files) {
-                const files = req.body.files;
-                const maxFileSize = options.maxFileSize || 5 * 1024 * 1024; // 5MB default
-                const maxFiles = options.maxFiles || 10;
-                const allowedTypes = options.allowedTypes;
-                // Validate file count
-                if (Object.keys(files).length > maxFiles) {
-                    res.status(400).json({
-                        success: false,
-                        error: `Too many files. Maximum ${maxFiles} allowed.`,
-                    });
-                    return;
-                }
-                // Validate each file
-                for (const [fieldName, file] of Object.entries(files)) {
-                    const fileData = file;
-                    // Validate file size
-                    if (fileData.size > maxFileSize) {
-                        res.status(400).json({
-                            success: false,
-                            error: `File ${fileData.filename} is too large. Maximum ${maxFileSize} bytes allowed.`,
-                        });
-                        return;
-                    }
-                    // Validate file type
-                    if (allowedTypes && !allowedTypes.includes(fileData.mimetype)) {
-                        res.status(400).json({
-                            success: false,
-                            error: `File type ${fileData.mimetype} not allowed.`,
-                        });
-                        return;
-                    }
-                }
-                // Store files in request for easy access
-                req.files = files;
-            }
-            next();
-        };
-    },
-    template: (options) => {
-        const templateCache = new Map();
-        return async (req, res, next) => {
-            // Add render method to response
-            res.render = async (template, data = {}) => {
-                try {
-                    const fs = await import('fs/promises');
-                    const path = await import('path');
-                    const templatePath = path.join(options.views, `${template}.html`);
-                    let templateContent;
-                    // Check cache first
-                    if (options.cache && templateCache.has(templatePath)) {
-                        templateContent = templateCache.get(templatePath);
-                    }
-                    else {
-                        templateContent = await fs.readFile(templatePath, 'utf-8');
-                        if (options.cache) {
-                            templateCache.set(templatePath, templateContent);
-                        }
-                    }
-                    // Simple template engine - replace {{variable}} with values
-                    let rendered = templateContent;
-                    // Handle basic variable substitution
-                    rendered = rendered.replace(/\{\{(\w+)\}\}/g, (match, key) => {
-                        return data[key] !== undefined ? String(data[key]) : match;
-                    });
-                    // Handle nested object properties like {{user.name}}
-                    rendered = rendered.replace(/\{\{([\w.]+)\}\}/g, (match, key) => {
-                        const value = key.split('.').reduce((obj, prop) => obj?.[prop], data);
-                        return value !== undefined ? String(value) : match;
-                    });
-                    // Handle loops: {{#each items}}{{name}}{{/each}}
-                    rendered = rendered.replace(/\{\{#each (\w+)\}\}(.*?)\{\{\/each\}\}/gs, (match, arrayKey, template) => {
-                        const array = data[arrayKey];
-                        if (!Array.isArray(array))
-                            return '';
-                        return array
-                            .map(item => {
-                            let itemTemplate = template;
-                            // Replace variables in the loop template
-                            itemTemplate = itemTemplate.replace(/\{\{(\w+)\}\}/g, (match, key) => {
-                                return item[key] !== undefined ? String(item[key]) : match;
-                            });
-                            return itemTemplate;
-                        })
-                            .join('');
-                    });
-                    // Handle conditionals: {{#if condition}}content{{/if}}
-                    rendered = rendered.replace(/\{\{#if (\w+)\}\}(.*?)\{\{\/if\}\}/gs, (match, conditionKey, content) => {
-                        const condition = data[conditionKey];
-                        return condition ? content : '';
-                    });
-                    // Handle layout
-                    if (options.defaultLayout) {
-                        const layoutPath = path.join(options.views, 'layouts', `${options.defaultLayout}.html`);
-                        try {
-                            let layoutContent;
-                            if (options.cache && templateCache.has(layoutPath)) {
-                                layoutContent = templateCache.get(layoutPath);
-                            }
-                            else {
-                                layoutContent = await fs.readFile(layoutPath, 'utf-8');
-                                if (options.cache) {
-                                    templateCache.set(layoutPath, layoutContent);
-                                }
-                            }
-                            rendered = layoutContent.replace(/\{\{body\}\}/, rendered);
-                        }
-                        catch (error) {
-                            // Layout not found, use template as-is
-                        }
-                    }
-                    res.setHeader('Content-Type', 'text/html');
-                    res.end(rendered);
-                }
-                catch (error) {
-                    res.status(500).json({ success: false, error: 'Template rendering failed' });
-                }
-            };
-            next();
-        };
-    },
-    // HTTP/2 Server Push middleware
-    http2Push: (options = {}) => {
-        return (req, res, next) => {
-            // Add HTTP/2 push capability to response
-            res.push = (path, options = {}) => {
-                // Check if HTTP/2 is supported
-                if (req.httpVersion === '2.0' && res.stream && res.stream.pushAllowed) {
-                    try {
-                        const pushStream = res.stream.pushStream({
-                            ':method': 'GET',
-                            ':path': path,
-                            ...options.headers,
-                        });
-                        if (pushStream) {
-                            // Handle push stream
-                            return pushStream;
-                        }
-                    }
-                    catch (error) {
-                        // Push failed, continue normally
-                    }
-                }
-                return null;
-            };
-            // Auto-push configured resources
-            if (options.resources && (!options.condition || options.condition(req))) {
-                for (const resource of options.resources) {
-                    res.push?.(resource.path, {
-                        headers: {
-                            'content-type': resource.type || 'text/plain',
-                        },
-                    });
-                }
-            }
-            next();
-        };
-    },
-    // Server-Sent Events middleware
-    sse: (options = {}) => {
-        return (req, res, next) => {
-            // Only handle SSE requests
-            if (req.headers.accept?.includes('text/event-stream')) {
-                // Set SSE headers
-                if (!res.headersSent) {
-                    res.writeHead(200, {
-                        'Content-Type': 'text/event-stream',
-                        'Cache-Control': 'no-cache',
-                        Connection: 'keep-alive',
-                        'Access-Control-Allow-Origin': options.cors ? '*' : undefined,
-                        'Access-Control-Allow-Headers': options.cors ? 'Cache-Control' : undefined,
-                    });
-                }
-                // Add SSE methods to response
-                res.sendEvent = (data, event, id) => {
-                    if (id)
-                        res.write(`id: ${id}\n`);
-                    if (event)
-                        res.write(`event: ${event}\n`);
-                    res.write(`data: ${typeof data === 'string' ? data : JSON.stringify(data)}\n\n`);
-                };
-                res.sendComment = (comment) => {
-                    res.write(`: ${comment}\n\n`);
-                };
-                res.sendRetry = (ms) => {
-                    res.write(`retry: ${ms}\n\n`);
-                };
-                // Set up heartbeat if configured
-                let heartbeatInterval = null;
-                if (options.heartbeat) {
-                    heartbeatInterval = setInterval(() => {
-                        res.sendComment('heartbeat');
-                    }, options.heartbeat);
-                }
-                // Set retry if configured
-                if (options.retry) {
-                    res.sendRetry(options.retry);
-                }
-                // Clean up on close
-                req.on('close', () => {
-                    if (heartbeatInterval) {
-                        clearInterval(heartbeatInterval);
-                    }
-                });
-                // Don't call next() - this middleware handles the response
-                return;
-            }
-            next();
-        };
-    },
-    // Range request middleware for streaming
-    range: (options = {}) => {
-        return async (req, res, next) => {
-            // Add range support to response
-            res.sendRange = async (filePath, stats) => {
-                try {
-                    const fs = await import('fs/promises');
-                    const path = await import('path');
-                    if (!stats) {
-                        stats = await fs.stat(filePath);
-                    }
-                    const fileSize = stats.size;
-                    const range = req.headers.range;
-                    // Set Accept-Ranges header
-                    res.setHeader('Accept-Ranges', options.acceptRanges || 'bytes');
-                    if (!range) {
-                        // No range requested, send entire file
-                        res.setHeader('Content-Length', fileSize);
-                        const data = await fs.readFile(filePath);
-                        res.end(data);
-                        return;
-                    }
-                    // Parse range header
-                    const ranges = range
-                        .replace(/bytes=/, '')
-                        .split(',')
-                        .map(r => {
-                        const [start, end] = r.split('-');
-                        return {
-                            start: start ? parseInt(start) : 0,
-                            end: end ? parseInt(end) : fileSize - 1,
-                        };
-                    });
-                    // Validate ranges
-                    if (options.maxRanges && ranges.length > options.maxRanges) {
-                        res.status(416).json({ success: false, error: 'Too many ranges' });
-                        return;
-                    }
-                    if (ranges.length === 1) {
-                        // Single range
-                        const { start, end } = ranges[0];
-                        const chunkSize = end - start + 1;
-                        if (start >= fileSize || end >= fileSize) {
-                            res.status(416);
-                            res.setHeader('Content-Range', `bytes */${fileSize}`);
-                            res.json({ success: false, error: 'Range not satisfiable' });
-                            return;
-                        }
-                        res.status(206);
-                        res.setHeader('Content-Range', `bytes ${start}-${end}/${fileSize}`);
-                        res.setHeader('Content-Length', chunkSize);
-                        // Stream the range
-                        const stream = createReadStream(filePath, {
-                            start,
-                            end,
-                        });
-                        stream.pipe(res);
-                    }
-                    else {
-                        // Multiple ranges - multipart response
-                        const boundary = 'MULTIPART_BYTERANGES';
-                        res.status(206);
-                        res.setHeader('Content-Type', `multipart/byteranges; boundary=${boundary}`);
-                        for (const { start, end } of ranges) {
-                            if (start >= fileSize || end >= fileSize)
-                                continue;
-                            const chunkSize = end - start + 1;
-                            res.write(`\r\n--${boundary}\r\n`);
-                            res.write(`Content-Range: bytes ${start}-${end}/${fileSize}\r\n\r\n`);
-                            const stream = createReadStream(filePath, {
-                                start,
-                                end,
-                            });
-                            await new Promise(resolve => {
-                                stream.on('end', () => resolve());
-                                stream.pipe(res, { end: false });
-                            });
-                        }
-                        res.write(`\r\n--${boundary}--\r\n`);
-                        res.end();
-                    }
-                }
-                catch (error) {
-                    res.status(500).json({ success: false, error: 'Range request failed' });
-                }
-            };
-            next();
-        };
-    },
-    // CSRF Protection middleware
-    csrf: (options = {}) => {
-        const secret = options.secret || 'moro-csrf-secret';
-        const tokenLength = options.tokenLength || 32;
-        const cookieName = options.cookieName || '_csrf';
-        const headerName = options.headerName || 'x-csrf-token';
-        const ignoreMethods = options.ignoreMethods || ['GET', 'HEAD', 'OPTIONS'];
-        const generateToken = () => {
-            return crypto.randomBytes(tokenLength).toString('hex');
-        };
-        const verifyToken = (token, sessionToken) => {
-            return token && sessionToken && token === sessionToken;
-        };
-        return (req, res, next) => {
-            // Add CSRF token generation method
-            req.csrfToken = () => {
-                if (!req._csrfToken) {
-                    req._csrfToken = generateToken();
-                    // Set token in cookie
-                    res.cookie(cookieName, req._csrfToken, {
-                        httpOnly: true,
-                        sameSite: options.sameSite !== false ? 'strict' : undefined,
-                        secure: req.headers['x-forwarded-proto'] === 'https' || req.socket.encrypted,
-                    });
-                }
-                return req._csrfToken;
-            };
-            // Skip verification for safe methods
-            if (ignoreMethods.includes(req.method)) {
-                next();
-                return;
-            }
-            // Get token from header or body
-            const token = req.headers[headerName] || (req.body && req.body._csrf) || (req.query && req.query._csrf);
-            // Get session token from cookie
-            const sessionToken = req.cookies?.[cookieName];
-            if (!verifyToken(token, sessionToken || '')) {
-                res.status(403).json({
-                    success: false,
-                    error: 'Invalid CSRF token',
-                    code: 'CSRF_TOKEN_MISMATCH',
-                });
-                return;
-            }
-            next();
-        };
-    },
-    // Content Security Policy middleware
-    csp: (options = {}) => {
-        return (req, res, next) => {
-            const directives = options.directives || {
-                defaultSrc: ["'self'"],
-                scriptSrc: ["'self'"],
-                styleSrc: ["'self'", "'unsafe-inline'"],
-                imgSrc: ["'self'", 'data:', 'https:'],
-                connectSrc: ["'self'"],
-                fontSrc: ["'self'"],
-                objectSrc: ["'none'"],
-                mediaSrc: ["'self'"],
-                frameSrc: ["'none'"],
-            };
-            // Generate nonce if requested
-            let nonce;
-            if (options.nonce) {
-                nonce = crypto.randomBytes(16).toString('base64');
-                req.cspNonce = nonce;
-            }
-            // Build CSP header value
-            const cspParts = [];
-            for (const [directive, sources] of Object.entries(directives)) {
-                if (directive === 'upgradeInsecureRequests' && sources === true) {
-                    cspParts.push('upgrade-insecure-requests');
-                }
-                else if (directive === 'blockAllMixedContent' && sources === true) {
-                    cspParts.push('block-all-mixed-content');
-                }
-                else if (Array.isArray(sources)) {
-                    let sourceList = sources.join(' ');
-                    // Add nonce to script-src and style-src if enabled
-                    if (nonce && (directive === 'scriptSrc' || directive === 'styleSrc')) {
-                        sourceList += ` 'nonce-${nonce}'`;
-                    }
-                    // Convert camelCase to kebab-case
-                    const kebabDirective = directive.replace(/([A-Z])/g, '-$1').toLowerCase();
-                    cspParts.push(`${kebabDirective} ${sourceList}`);
-                }
-            }
-            // Add report-uri if specified
-            if (options.reportUri) {
-                cspParts.push(`report-uri ${options.reportUri}`);
-            }
-            const cspValue = cspParts.join('; ');
-            const headerName = options.reportOnly
-                ? 'Content-Security-Policy-Report-Only'
-                : 'Content-Security-Policy';
-            res.setHeader(headerName, cspValue);
-            next();
-        };
-    },
-};
-function parseSize(size) {
-    const units = {
-        b: 1,
-        kb: 1024,
-        mb: 1024 * 1024,
-        gb: 1024 * 1024 * 1024,
-    };
-    const match = size.toLowerCase().match(/^(\d+(?:\.\d+)?)\s*(b|kb|mb|gb)?$/);
-    if (!match)
-        return 1024 * 1024; // Default 1MB
-    const value = parseFloat(match[1]);
-    const unit = match[2] || 'b';
-    return Math.round(value * units[unit]);
-}
 //# sourceMappingURL=http-server.js.map