@morojs/moro 1.7.29 → 1.8.0

package/dist/core/http/http-server.js

@@ -1,9 +1,12 @@
 // src/core/http-server.ts
 import { IncomingMessage, ServerResponse, createServer } from 'http';
+import { createServer as createHttpsServer } from 'https';
 import * as zlib from 'zlib';
 import { promisify } from 'util';
 import { randomUUID } from 'crypto';
 import { createFrameworkLogger } from '../logger/index.js';
+import { parseMultipart as parseMultipartBuffer, } from './utils/multipart-parser.js';
+import { parseRawQueryString } from './utils/query-parser.js';
 import { PathMatcher } from '../routing/path-matcher.js';
 import { ObjectPoolManager } from '../pooling/object-pool-manager.js';
 const gzip = promisify(zlib.gzip);
@@ -39,26 +42,9 @@ const TYPE_SHORTHANDS = {
     css: 'text/css; charset=utf-8',
     form: 'application/x-www-form-urlencoded',
 };
-function parseQueryString(queryString) {
-    const result = {};
-    if (!queryString)
-        return result;
-    const pairs = queryString.split('&');
-    const pairsLen = pairs.length;
-    for (let i = 0; i < pairsLen; i++) {
-        const pair = pairs[i];
-        const equalIndex = pair.indexOf('=');
-        if (equalIndex === -1) {
-            result[decodeURIComponent(pair)] = '';
-        }
-        else {
-            const key = decodeURIComponent(pair.substring(0, equalIndex));
-            const value = decodeURIComponent(pair.substring(equalIndex + 1));
-            result[key] = value;
-        }
-    }
-    return result;
-}
+// Canonical query parsing shared with the uWS/engine transports - identical
+// req.query semantics everywhere ('+' as space, malformed escapes tolerated).
+const parseQueryString = parseRawQueryString;
 function parseCookieHeader(cookieHeader) {
     const cookies = {};
     if (!cookieHeader)
@@ -96,103 +82,104 @@ function parseCookieHeader(cookieHeader) {
 // compression settings) without any per-request allocation.
 // ---------------------------------------------------------------------------
 export class MoroIncomingMessage extends IncomingMessage {
-    // Hot per-request fields (assigned in handleRequest; declared here for stable shape)
+    // Hot per-request fields (assigned in handleRequest; declared here for
+    // stable shape). Everything else lives behind the single `_lazy` slot -
+    // per-request construction pays 5 field initializations instead of 16.
     params = {};
     body = null;
     path = '';
-    // Lazy backing fields - single hidden-class shape, created at construction
     _queryString = null;
-    _query = undefined;
-    _cookies = undefined;
-    _context = undefined;
-    _requestId = undefined;
-    _ip = undefined;
-    _originalUrl = undefined;
-    _hostname = undefined;
-    _protocol = undefined;
-    _secure = undefined;
-    _xhr = undefined;
-    _ips = undefined;
-    _subdomains = undefined;
+    // Single slot for every lazily-computed/assigned helper value (query,
+    // cookies, requestId, hostname, ...). Allocated on first access - a plain
+    // JSON GET that never touches the helpers never allocates it, and the
+    // request object keeps one stable hidden-class shape either way.
+    _lazy = undefined;
     get query() {
-        let q = this._query;
+        const L = this._lazy ?? (this._lazy = {});
+        let q = L.query;
         if (q === undefined) {
             const qs = this._queryString;
             q = qs ? parseQueryString(qs) : {};
-            this._query = q;
+            L.query = q;
         }
         return q;
     }
     set query(value) {
-        this._query = value;
+        (this._lazy ?? (this._lazy = {})).query = value;
     }
     get cookies() {
-        let c = this._cookies;
+        const L = this._lazy ?? (this._lazy = {});
+        let c = L.cookies;
         if (c === undefined) {
             const header = this.headers.cookie;
             c = header ? parseCookieHeader(header) : {};
-            this._cookies = c;
+            L.cookies = c;
         }
         return c;
     }
     set cookies(value) {
-        this._cookies = value;
+        (this._lazy ?? (this._lazy = {})).cookies = value;
     }
     get context() {
-        let ctx = this._context;
+        const L = this._lazy ?? (this._lazy = {});
+        let ctx = L.context;
         if (ctx === undefined) {
             ctx = {};
-            this._context = ctx;
+            L.context = ctx;
         }
         return ctx;
     }
     set context(value) {
-        this._context = value;
+        (this._lazy ?? (this._lazy = {})).context = value;
     }
     get requestId() {
-        let id = this._requestId;
+        const L = this._lazy ?? (this._lazy = {});
+        let id = L.requestId;
         if (id === undefined) {
             const server = this._server;
             id = server && server.requestTrackingEnabled ? randomUUID() : '';
-            this._requestId = id;
+            L.requestId = id;
         }
         return id;
     }
     set requestId(value) {
-        this._requestId = value;
+        (this._lazy ?? (this._lazy = {})).requestId = value;
     }
     get ip() {
-        let v = this._ip;
+        const L = this._lazy ?? (this._lazy = {});
+        let v = L.ip;
         if (v === undefined) {
             v = (this.socket && this.socket.remoteAddress) || '';
-            this._ip = v;
+            L.ip = v;
         }
         return v;
     }
     set ip(value) {
-        this._ip = value;
+        (this._lazy ?? (this._lazy = {})).ip = value;
     }
     get originalUrl() {
-        const v = this._originalUrl;
+        const v = this._lazy?.originalUrl;
         return v !== undefined ? v : this.url || '';
     }
     set originalUrl(value) {
-        this._originalUrl = value;
+        (this._lazy ?? (this._lazy = {})).originalUrl = value;
     }
     get hostname() {
-        let v = this._hostname;
+        const L = this._lazy ?? (this._lazy = {});
+        let v = L.hostname;
         if (v === undefined) {
             const host = (this.headers.host || '');
             v = host ? host.split(':')[0] : '';
-            this._hostname = v;
+            L.hostname = v;
         }
         return v;
     }
     set hostname(value) {
-        this._hostname = value;
+        (this._lazy ?? (this._lazy = {})).hostname = value;
     }
     get protocol() {
-        let v = this._protocol;
+        const L = this._lazy ?? (this._lazy = {});
+        let v = L.protocol;
         if (v === undefined) {
             const forwardedProto = this.headers['x-forwarded-proto'];
             v = forwardedProto
@@ -200,34 +187,36 @@ export class MoroIncomingMessage extends IncomingMessage {
                 : this.socket?.encrypted
                     ? 'https'
                     : 'http';
-            this._protocol = v;
+            L.protocol = v;
         }
         return v;
     }
     set protocol(value) {
-        this._protocol = value;
+        (this._lazy ?? (this._lazy = {})).protocol = value;
     }
     get secure() {
-        const v = this._secure;
+        const v = this._lazy?.secure;
         return v !== undefined ? v : this.protocol === 'https';
     }
     set secure(value) {
-        this._secure = value;
+        (this._lazy ?? (this._lazy = {})).secure = value;
     }
     get xhr() {
-        let v = this._xhr;
+        const L = this._lazy ?? (this._lazy = {});
+        let v = L.xhr;
         if (v === undefined) {
             const xrw = this.headers['x-requested-with'];
             v = !!xrw && xrw.toLowerCase() === 'xmlhttprequest';
-            this._xhr = v;
+            L.xhr = v;
         }
         return v;
     }
     set xhr(value) {
-        this._xhr = value;
+        (this._lazy ?? (this._lazy = {})).xhr = value;
     }
     get ips() {
-        let v = this._ips;
+        const L = this._lazy ?? (this._lazy = {});
+        let v = L.ips;
         if (v === undefined) {
             const forwardedFor = this.headers['x-forwarded-for'];
             v = forwardedFor
@@ -236,26 +225,27 @@ export class MoroIncomingMessage extends IncomingMessage {
                     .map(s => s.trim())
                     .filter(Boolean)
                 : [];
-            this._ips = v;
+            L.ips = v;
         }
         return v;
     }
     set ips(value) {
-        this._ips = value;
+        (this._lazy ?? (this._lazy = {})).ips = value;
     }
     get subdomains() {
-        let v = this._subdomains;
+        const L = this._lazy ?? (this._lazy = {});
+        let v = L.subdomains;
         if (v === undefined) {
             const hostnameParts = this.hostname.split('.');
             // Matches Express: subdomains are parts before the last two (domain + tld),
             // reversed (closest subdomain first).
             v = hostnameParts.length > 2 ? hostnameParts.slice(0, -2).reverse() : [];
-            this._subdomains = v;
+            L.subdomains = v;
         }
         return v;
     }
     set subdomains(value) {
-        this._subdomains = value;
+        (this._lazy ?? (this._lazy = {})).subdomains = value;
     }
     // Express-compatible request helpers (shared prototype methods, not closures)
     get(name) {
@@ -481,7 +471,8 @@ export class MoroServerResponse extends ServerResponse {
         }
         const cookieValue = encodeURIComponent(value);
         let cookieString = `${name}=${cookieValue}`;
-        if (options.maxAge)
+        // maxAge: 0 is meaningful (immediate expiry - clearCookie relies on it)
+        if (options.maxAge !== undefined && options.maxAge !== null)
             cookieString += `; Max-Age=${options.maxAge}`;
         if (options.expires)
             cookieString += `; Expires=${options.expires.toUTCString()}`;
@@ -493,8 +484,9 @@ export class MoroServerResponse extends ServerResponse {
             cookieString += `; SameSite=${options.sameSite}`;
         if (options.domain)
             cookieString += `; Domain=${options.domain}`;
-        if (options.path)
-            cookieString += `; Path=${options.path}`;
+        // Path defaults to '/' (Express behavior) so clearCookie() from a nested
+        // route can clear a cookie originally set at the site root.
+        cookieString += `; Path=${options.path ?? '/'}`;
         const existingCookies = this.getHeader('Set-Cookie') || [];
         // Avoid spread operator - direct array manipulation
         const cookies = Array.isArray(existingCookies) ? existingCookies : [existingCookies];
@@ -862,6 +854,10 @@ export class MoroServerResponse extends ServerResponse {
 }
 export class MoroHttpServer {
     server;
+    /** Multipart limits threaded to parseMultipart at the call site. */
+    multipartLimits;
+    /** TCP backlog for listen(), when configured. */
+    listenBacklog;
     routes = [];
     globalMiddleware = [];
     /** @internal read by MoroServerResponse prototype methods */
@@ -919,7 +915,23 @@ export class MoroHttpServer {
         BoundResponse.prototype._server = boundServer;
         this.RequestClass = BoundRequest;
         this.ResponseClass = BoundResponse;
-        this.server = createServer({ IncomingMessage: BoundRequest, ServerResponse: BoundResponse }, this.handleRequest.bind(this));
+        const limits = options?.limits;
+        // maxHeaderSize is a createServer option (not a mutable property), so it
+        // must be passed here.
+        const serverOpts = {
+            IncomingMessage: BoundRequest,
+            ServerResponse: BoundResponse,
+            ...(limits?.maxHeaderSize && { maxHeaderSize: limits.maxHeaderSize }),
+        };
+        if (options?.ssl) {
+            // In-process HTTPS. The https ServerOptions extends the http one, so the
+            // IncomingMessage/ServerResponse subclass injection carries over.
+            this.server = createHttpsServer({ ...serverOpts, ...options.ssl }, this.handleRequest.bind(this));
+            this.logger.info('HTTPS server created (in-process TLS)', 'HttpServer');
+        }
+        else {
+            this.server = createServer(serverOpts, this.handleRequest.bind(this));
+        }
         // Configure body size limits from options
         if (options?.maxBodySize) {
             this.maxBodySize = options.maxBodySize;
@@ -927,10 +939,24 @@ export class MoroHttpServer {
         if (options?.maxUploadSize) {
             this.maxUploadSize = options.maxUploadSize;
         }
-        // Optimize server for high performance (conservative settings for compatibility)
-        this.server.keepAliveTimeout = 5000; // 5 seconds
-        this.server.headersTimeout = 6000; // 6 seconds
-        this.server.timeout = 30000; // 30 seconds request timeout
+        if (limits?.multipart)
+            this.multipartLimits = limits.multipart;
+        // Timeouts: the previous hardcodes (keepAlive 5000, headers 6000) become
+        // the documented defaults; a configured value overrides them. Socket idle
+        // timeout stays 0 (disabled) unless set - a non-zero value arms a
+        // per-request timer that shows up in CPU profiles under load.
+        const t = limits?.timeouts ?? {};
+        this.server.keepAliveTimeout = t.keepAlive ?? 5000;
+        this.server.headersTimeout = t.headers ?? 6000;
+        this.server.timeout = t.idle ?? 0;
+        if (t.request)
+            this.server.requestTimeout = t.request;
+        if (limits?.maxConnections && limits.maxConnections > 0) {
+            this.server.maxConnections = limits.maxConnections;
+        }
+        if (limits?.maxHeaders)
+            this.server.maxHeadersCount = limits.maxHeaders;
+        this.listenBacklog = limits?.backlog;
     }
     // Direct router dispatch - called after global middleware, before the legacy
     // route table. Returning true (or a promise of true) means the request was handled.
@@ -1056,63 +1082,105 @@ export class MoroHttpServer {
             paramNames: compiled.paramNames,
         };
     }
-    async handleRequest(req, res) {
+    // Request entry point. Deliberately NOT an async function: the common case
+    // (no body, no hooks, no global middleware, sync route handler) completes
+    // fully synchronously with zero promise allocations and zero microtask
+    // hops. Anything that genuinely needs to await routes through
+    // handleRequestSlow.
+    handleRequest(req, res) {
         // req/res arrive as the per-server subclasses (MoroIncomingMessage /
         // MoroServerResponse) - all helpers are already on their prototypes.
         const httpReq = req;
         const httpRes = res;
+        // URL split - query string parsing is lazy (MoroIncomingMessage#query getter)
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        const urlString = req.url;
+        const queryIndex = urlString.indexOf('?');
+        if (queryIndex === -1) {
+            httpReq.path = urlString;
+        }
+        else {
+            httpReq.path = urlString.substring(0, queryIndex);
+            httpReq._queryString = urlString.substring(queryIndex + 1);
+        }
+        // Intern method string for fast reference equality comparison (50-100% faster)
+        switch (req.method) {
+            case 'POST':
+                httpReq.method = MoroHttpServer.METHOD_POST;
+                break;
+            case 'PUT':
+                httpReq.method = MoroHttpServer.METHOD_PUT;
+                break;
+            case 'PATCH':
+                httpReq.method = MoroHttpServer.METHOD_PATCH;
+                break;
+            case 'GET':
+                httpReq.method = MoroHttpServer.METHOD_GET;
+                break;
+            case 'DELETE':
+                httpReq.method = MoroHttpServer.METHOD_DELETE;
+                break;
+            case 'HEAD':
+                httpReq.method = MoroHttpServer.METHOD_HEAD;
+                break;
+            case 'OPTIONS':
+                httpReq.method = MoroHttpServer.METHOD_OPTIONS;
+                break;
+        }
+        const needsBody = httpReq.method === MoroHttpServer.METHOD_POST ||
+            httpReq.method === MoroHttpServer.METHOD_PUT ||
+            httpReq.method === MoroHttpServer.METHOD_PATCH;
+        const hookManager = this.hookManager;
+        const hasHooks = !!(hookManager &&
+            (hookManager.hasHooks === undefined || hookManager.hasHooks('request')));
+        if (needsBody || hasHooks || this.globalMiddleware.length > 0) {
+            // Slow path: real awaits ahead (body parse / hooks / middleware).
+            // Errors are fully handled inside - the returned promise never rejects.
+            void this.handleRequestSlow(httpReq, httpRes, req, needsBody, hasHooks);
+            return;
+        }
+        // FAST PATH - no promises unless the route handler itself is async
         try {
-            // URL split - query string parsing is lazy (MoroIncomingMessage#query getter)
-            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-            const urlString = req.url;
-            const queryIndex = urlString.indexOf('?');
-            if (queryIndex === -1) {
-                httpReq.path = urlString;
-            }
-            else {
-                httpReq.path = urlString.substring(0, queryIndex);
-                httpReq._queryString = urlString.substring(queryIndex + 1);
-            }
-            // Intern method string for fast reference equality comparison (50-100% faster)
-            switch (req.method) {
-                case 'POST':
-                    httpReq.method = MoroHttpServer.METHOD_POST;
-                    break;
-                case 'PUT':
-                    httpReq.method = MoroHttpServer.METHOD_PUT;
-                    break;
-                case 'PATCH':
-                    httpReq.method = MoroHttpServer.METHOD_PATCH;
-                    break;
-                case 'GET':
-                    httpReq.method = MoroHttpServer.METHOD_GET;
-                    break;
-                case 'DELETE':
-                    httpReq.method = MoroHttpServer.METHOD_DELETE;
-                    break;
-                case 'HEAD':
-                    httpReq.method = MoroHttpServer.METHOD_HEAD;
-                    break;
-                case 'OPTIONS':
-                    httpReq.method = MoroHttpServer.METHOD_OPTIONS;
-                    break;
+            const routerHandler = this.routerHandler;
+            if (routerHandler) {
+                const handled = routerHandler(httpReq, httpRes);
+                if (handled) {
+                    if (typeof handled.then === 'function') {
+                        handled.then(wasHandled => {
+                            if (!wasHandled && !httpRes.headersSent) {
+                                try {
+                                    this.dispatchLegacyRoute(httpReq, httpRes, req);
+                                }
+                                catch (error) {
+                                    void this.onRequestError(error, httpReq, httpRes, req);
+                                }
+                            }
+                        }, error => void this.onRequestError(error, httpReq, httpRes, req));
+                    }
+                    return;
+                }
+                if (httpRes.headersSent)
+                    return;
             }
-            // Method checking - use reference equality for interned strings
-            if (httpReq.method === MoroHttpServer.METHOD_POST ||
-                httpReq.method === MoroHttpServer.METHOD_PUT ||
-                httpReq.method === MoroHttpServer.METHOD_PATCH) {
+            this.dispatchLegacyRoute(httpReq, httpRes, req);
+        }
+        catch (error) {
+            void this.onRequestError(error, httpReq, httpRes, req);
+        }
+    }
+    // Full async pipeline for requests that need it: bodied methods, hook
+    // consumers, and apps with global middleware.
+    async handleRequestSlow(httpReq, httpRes, req, needsBody, hasHooks) {
+        try {
+            if (needsBody) {
                 httpReq.body = await this.parseBody(req);
             }
-            // Execute hooks before request processing - skipped entirely (no context
-            // object, no promise) when no 'request' hooks are registered
-            const hookManager = this.hookManager;
-            if (hookManager && (hookManager.hasHooks === undefined || hookManager.hasHooks('request'))) {
-                await hookManager.execute('request', {
+            if (hasHooks) {
+                await this.hookManager.execute('request', {
                     request: httpReq,
                     response: httpRes,
                 });
             }
-            // Execute global middleware first - EARLY EXIT if none registered.
             // executeMiddleware returns undefined when the whole chain completed
             // synchronously, so a sync chain costs zero promise allocations.
             if (this.globalMiddleware.length > 0) {
@@ -1140,41 +1208,58 @@ export class MoroHttpServer {
                 if (httpRes.headersSent)
                     return;
             }
-            // Find matching route (legacy direct-route table)
-            // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-            const route = this.findRoute(req.method, httpReq.path);
-            if (!route) {
-                // 404 response with pre-compiled buffer
-                httpRes.statusCode = 404;
-                httpRes.setHeader('Content-Type', 'application/json; charset=utf-8');
-                httpRes.setHeader('Content-Length', MoroHttpServer.RESPONSE_TEMPLATES.notFound.length);
-                httpRes.end(MoroHttpServer.RESPONSE_TEMPLATES.notFound);
-                return;
-            }
-            // Extract path parameters
-            const matches = httpReq.path.match(route.pattern);
-            if (matches) {
-                const params = {};
-                const paramNames = route.paramNames;
-                const paramNamesLen = paramNames.length;
-                for (let i = 0; i < paramNamesLen; i++) {
-                    params[paramNames[i]] = matches[i + 1];
-                }
-                httpReq.params = params;
-            }
-            // Execute middleware chain - EARLY EXIT if no route middleware
-            if (route.middleware.length > 0) {
-                const mwResult = this.executeMiddleware(route.middleware, httpReq, httpRes);
-                if (mwResult)
-                    await mwResult;
+            this.dispatchLegacyRoute(httpReq, httpRes, req);
+        }
+        catch (error) {
+            await this.onRequestError(error, httpReq, httpRes, req);
+        }
+    }
+    // Legacy direct-route table dispatch + 404 fallback. Synchronous; async
+    // route middleware/handlers are continued via promise callbacks wired to
+    // onRequestError so the sync fast path stays promise-free.
+    dispatchLegacyRoute(httpReq, httpRes, req) {
+        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+        const route = this.findRoute(req.method, httpReq.path);
+        if (!route) {
+            // 404 response with pre-compiled buffer
+            httpRes.statusCode = 404;
+            httpRes.setHeader('Content-Type', 'application/json; charset=utf-8');
+            httpRes.setHeader('Content-Length', MoroHttpServer.RESPONSE_TEMPLATES.notFound.length);
+            httpRes.end(MoroHttpServer.RESPONSE_TEMPLATES.notFound);
+            return;
+        }
+        // Extract path parameters
+        const matches = httpReq.path.match(route.pattern);
+        if (matches) {
+            const params = {};
+            const paramNames = route.paramNames;
+            const paramNamesLen = paramNames.length;
+            for (let i = 0; i < paramNamesLen; i++) {
+                params[paramNames[i]] = matches[i + 1];
             }
+            httpReq.params = params;
+        }
+        const runHandler = () => {
             // Execute handler - Don't await sync handlers
             const handlerResult = route.handler(httpReq, httpRes);
             if (handlerResult && typeof handlerResult.then === 'function') {
-                await handlerResult;
+                handlerResult.catch(error => void this.onRequestError(error, httpReq, httpRes, req));
+            }
+        };
+        // Execute middleware chain - EARLY EXIT if no route middleware
+        if (route.middleware.length > 0) {
+            const mwResult = this.executeMiddleware(route.middleware, httpReq, httpRes);
+            if (mwResult) {
+                mwResult.then(runHandler, error => void this.onRequestError(error, httpReq, httpRes, req));
+                return;
             }
         }
-        catch (error) {
+        runHandler();
+    }
+    // Shared error handling for all request paths (sync throw, slow-path catch,
+    // and promise rejections from async handlers/middleware). Never throws.
+    async onRequestError(error, httpReq, httpRes, req) {
+        try {
             // Debug: Log the actual error and where it came from
             this.logger.debug('Request error details', 'RequestHandler', {
                 errorType: typeof error,
@@ -1216,18 +1301,23 @@ export class MoroHttpServer {
                 }
             }
             if (!httpRes.headersSent) {
+                // A malformed body is a client error: default to 400 (parity with the
+                // engine/uWS transports), not the generic 500.
+                const isBadRequest = error?.statusCode === 400;
+                const defaultStatus = isBadRequest ? 400 : 500;
+                const defaultError = isBadRequest ? 'Invalid request body' : 'Internal server error';
                 // Ensure response is properly enhanced before using custom methods
                 if (typeof httpRes.status === 'function' && typeof httpRes.json === 'function') {
-                    httpRes.status(500).json({
+                    httpRes.status(defaultStatus).json({
                         success: false,
-                        error: 'Internal server error',
+                        error: defaultError,
                         requestId: httpReq.requestId,
                     });
                 }
                 else {
                     // Defensive fallback - check each method individually
                     if (typeof httpRes.setHeader === 'function') {
-                        httpRes.statusCode = 500;
+                        httpRes.statusCode = defaultStatus;
                         httpRes.setHeader('Content-Type', 'application/json');
                     }
                     else {
@@ -1240,7 +1330,7 @@ export class MoroHttpServer {
                     if (typeof httpRes.end === 'function') {
                         httpRes.end(JSON.stringify({
                             success: false,
-                            error: 'Internal server error',
+                            error: defaultError,
                             requestId: httpReq.requestId,
                         }));
                     }
@@ -1250,6 +1340,13 @@ export class MoroHttpServer {
                 }
             }
         }
+        catch (fatalError) {
+            // Error handling itself failed (e.g. the connection died mid-response) -
+            // never let this escape as an unhandled rejection
+            this.logger.error('Failed while handling request error', 'RequestHandler', {
+                error: fatalError instanceof Error ? fatalError.message : String(fatalError),
+            });
+        }
     }
     // Force cleanup of all pooled objects
     forceCleanupPools() {
@@ -1401,7 +1498,9 @@ export class MoroHttpServer {
                     // otherwise concat with the known total length to avoid a re-scan
                     const body = chunks.length === 1 ? chunks[0] : Buffer.concat(chunks, totalLength);
                     if (contentType.includes('application/json')) {
-                        resolve(JSON.parse(body.toString()));
+                        // Empty JSON body -> null (parity with the engine/uWS servers, and
+                        // avoids JSON.parse('') throwing and 500ing an empty POST).
+                        resolve(totalLength === 0 ? null : JSON.parse(body.toString()));
                     }
                     else if (contentType.includes('application/x-www-form-urlencoded')) {
                         resolve(this.parseUrlEncoded(body.toString()));
@@ -1414,6 +1513,12 @@ export class MoroHttpServer {
                     }
                 }
                 catch (error) {
+                    // A malformed body is a client error (400), not a server error (500).
+                    // Tag it so the request-error path answers 400, matching the engine
+                    // and uWS transports.
+                    if (error instanceof Error && error.statusCode === undefined) {
+                        error.statusCode = 400;
+                    }
                     reject(error);
                 }
             });
@@ -1547,76 +1652,9 @@ export class MoroHttpServer {
         });
     }
     parseMultipart(buffer, contentType) {
-        const boundary = contentType.split('boundary=')[1];
-        if (!boundary) {
-            throw new Error('Invalid multipart boundary');
-        }
-        // Work with Buffer directly - don't convert to string (corrupts binary data)
-        const boundaryBuffer = Buffer.from(`--${boundary}`);
-        const parts = this.splitBuffer(buffer, boundaryBuffer);
-        const fields = {};
-        const files = {};
-        // Skip first (empty) and last (closing boundary) parts
-        const partsLen = parts.length - 1;
-        for (let i = 1; i < partsLen; i++) {
-            const part = parts[i];
-            // Find the double CRLF that separates headers from content
-            const headerEndPos = this.findBufferSequence(part, Buffer.from('\r\n\r\n'));
-            if (headerEndPos === -1)
-                continue;
-            // Headers are always text - safe to convert to string
-            const headers = part.slice(0, headerEndPos).toString('utf8');
-            // Content stays as Buffer to preserve binary data
-            const content = part.slice(headerEndPos + 4); // Skip the \r\n\r\n
-            const nameMatch = headers.match(/name="([^"]+)"/);
-            const filenameMatch = headers.match(/filename="([^"]+)"/);
-            const contentTypeMatch = headers.match(/Content-Type: ([^\r\n]+)/);
-            if (nameMatch) {
-                const name = nameMatch[1];
-                if (filenameMatch) {
-                    // This is a file - keep as Buffer to preserve binary data
-                    const filename = filenameMatch[1];
-                    const mimeType = contentTypeMatch ? contentTypeMatch[1] : 'application/octet-stream';
-                    // Remove trailing \r\n (2 bytes) from the end
-                    const fileData = content.slice(0, content.length - 2);
-                    files[name] = {
-                        filename,
-                        mimetype: mimeType,
-                        data: fileData, // Already a Buffer - preserves binary integrity
-                        size: fileData.length,
-                    };
-                }
-                else {
-                    // This is a regular field - convert to string
-                    const fieldContent = content.slice(0, content.length - 2); // Remove trailing \r\n
-                    fields[name] = fieldContent.toString('utf8');
-                }
-            }
-        }
-        return { fields, files };
-    }
-    /**
-     * Split a Buffer by a delimiter Buffer
-     * Used for multipart boundary splitting without corrupting binary data
-     */
-    splitBuffer(buffer, delimiter) {
-        const parts = [];
-        let start = 0;
-        let pos = 0;
-        while ((pos = buffer.indexOf(delimiter, start)) !== -1) {
-            parts.push(buffer.slice(start, pos));
-            start = pos + delimiter.length;
-        }
-        // Add the remaining part
-        parts.push(buffer.slice(start));
-        return parts;
-    }
-    /**
-     * Find the position of a sequence within a Buffer
-     * Returns -1 if not found
-     */
-    findBufferSequence(buffer, sequence) {
-        return buffer.indexOf(sequence);
+        // Shared implementation - the native engine server parses uploads with
+        // the exact same code so both transports agree on body/files shape
+        return parseMultipartBuffer(buffer, contentType, this.multipartLimits);
     }
     parseUrlEncoded(body) {
         const params = new URLSearchParams(body);
@@ -1789,7 +1827,11 @@ export class MoroHttpServer {
             callback = host;
             host = undefined;
         }
-        if (host) {
+        const backlog = this.listenBacklog;
+        if (host && backlog) {
+            this.server.listen(port, host, backlog, callback);
+        }
+        else if (host) {
             this.server.listen(port, host, callback);
         }
         else {