@morojs/moro 1.8.5 → 1.8.7

package/README.md

@@ -8,9 +8,9 @@
 
 [![npm version](https://badge.fury.io/js/@morojs%2Fmoro.svg)](https://badge.fury.io/js/@morojs%2Fmoro)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Node.js Version](https://img.shields.io/badge/node-%3E%3D18.0.0-brightgreen)](https://nodejs.org/)
+[![Node.js Version](https://img.shields.io/badge/node-%3E%3D20.0.0-brightgreen)](https://nodejs.org/)
 
-[**Website**](https://morojs.com) • [**Documentation**](https://morojs.com/docs) • [**Quick Start**](https://morojs.com/docs/getting-started) • [**Discord**](https://morojs.com/discord)
+[**Website**](https://morojs.com) • [**Documentation**](https://morojs.com/docs) • [**Quick Start**](https://morojs.com/docs/quick-start) • [**Discord**](https://morojs.com/discord)
 
 </div>
 
@@ -18,12 +18,12 @@
 
 ## Why MoroJS?
 
-Build high-performance APIs with intelligent routing that automatically orders middleware execution. Deploy anywhere: Node.js, Vercel Edge, AWS Lambda, or Cloudflare Workers - same code, zero configuration.
+Build high-performance APIs with intelligent routing: declare what a route needs and MoroJS runs it in the optimal, security-first order every time — rate limiting sheds floods before auth, auth gates the cache. Middleware ordering stops being something you can get wrong. Deploy anywhere: Node.js, Vercel Edge, AWS Lambda, or Cloudflare Workers - same code, zero configuration.
 
 **Key Features:**
 
 - **Native C++ Engine** - ~102k req/s real-world through the full framework, 572k pipelined, on a single thread
-- **Intelligent Routing** - Automatic middleware ordering, no configuration needed
+- **Intelligent Routing** - Declare auth, validation, rate limits and caching in any order; they always execute in the optimal, security-first one
 - **Enterprise Auth** - Built-in Better Auth with OAuth & RBAC
 - **Universal Validation** - Works with Zod, Joi, Yup, or Class Validator
 - **Message Queues** - Production-ready queues (Bull, RabbitMQ, SQS, Kafka)
@@ -53,6 +53,7 @@ import { createApp, z } from '@morojs/moro';
   const app = await createApp();
 
   // Intelligent routing - order doesn't matter!
+  // (rate limit -> auth -> validation -> cache -> handler)
   app
     .post('/users')
     .body(
@@ -196,7 +197,7 @@ Check out [working examples](https://github.com/Moro-JS/examples) for:
 
 ## Why Choose MoroJS?
 
-**vs Express** - Intelligent middleware ordering eliminates configuration complexity and race conditions
+**vs Express** - Intelligent security-first middleware pipeline eliminates ordering bugs and configuration complexity
 
 **vs Fastify** - ~1.5x the throughput out of the box (Moro's native engine), plus multi-runtime deployment without adapters
 
@@ -216,6 +217,6 @@ MIT © [Moro Framework Team](https://morojs.com)
 
 **Ready to build high-performance APIs?**
 
-[Get Started](https://morojs.com/docs/getting-started) • [GitHub](https://github.com/Moro-JS/moro) • [npm](https://www.npmjs.com/package/@morojs/moro) • [Discord](https://morojs.com/discord)
+[Get Started](https://morojs.com/docs/quick-start) • [GitHub](https://github.com/Moro-JS/moro) • [npm](https://www.npmjs.com/package/@morojs/moro) • [Discord](https://morojs.com/discord)
 
 </div>

package/dist/core/http/http-server.d.ts

@@ -1,7 +1,8 @@
-import { IncomingMessage, ServerResponse, Server } from 'http';
+import type { Server } from 'http';
 import type { HttpRuntimeLimits } from './utils/size.js';
 import { HttpRequest, HttpResponse, HttpHandler, Middleware } from '../../types/http.js';
-export declare class MoroIncomingMessage extends IncomingMessage {
+declare const http: typeof import("http");
+export declare class MoroIncomingMessage extends http.IncomingMessage {
     /** Bound on the per-server subclass prototype - no per-request write needed */
     _server: MoroHttpServer;
     params: Record<string, string>;
@@ -39,7 +40,7 @@ export declare class MoroIncomingMessage extends IncomingMessage {
     accepts(types?: string | string[]): string | false;
     acceptsLanguages(langs?: string | string[]): string | false;
 }
-export declare class MoroServerResponse extends ServerResponse {
+export declare class MoroServerResponse extends http.ServerResponse {
     /** Bound on the per-server subclass prototype - no per-request write needed */
     _server: MoroHttpServer;
     _locals: Record<string, any> | undefined;
@@ -256,3 +257,4 @@ export declare class MoroHttpServer {
         };
     };
 }
+export {};

package/dist/core/http/http-server.js

@@ -1,7 +1,4 @@
-// src/core/http-server.ts
-import { IncomingMessage, ServerResponse, createServer } from 'http';
-import { createServer as createHttpsServer } from 'https';
-import * as zlib from 'zlib';
+import { createRequire } from 'module';
 import { promisify } from 'util';
 import { randomUUID } from 'crypto';
 import { createFrameworkLogger } from '../logger/index.js';
@@ -9,8 +6,35 @@ import { parseMultipart as parseMultipartBuffer, } from './utils/multipart-parse
 import { parseRawQueryString } from './utils/query-parser.js';
 import { PathMatcher } from '../routing/path-matcher.js';
 import { ObjectPoolManager } from '../pooling/object-pool-manager.js';
-const gzip = promisify(zlib.gzip);
-const deflate = promisify(zlib.deflate);
+// `node:https` and `node:zlib` are resolved on first use rather than at import
+// time. This module is on every app's startup path, but plaintext HTTP apps
+// never touch https (~1.9 MB RSS, it drags in tls) and uncompressed responses
+// never touch zlib (~0.3 MB). Builtins are always synchronously requirable, so
+// the secure-server and compression paths stay fully synchronous.
+// Resolves Node builtins ONLY, so the base passed to createRequire is
+// irrelevant - 'file:///' is used instead of import.meta.url so this file still
+// compiles under the CJS transform Jest applies to the test suite.
+const requireBuiltin = createRequire('file:///');
+// `node:http` is pulled through createRequire rather than `import`. In an ESM
+// package the two are NOT equivalent: building the ESM facade for node:http
+// drags in http2, tls, zlib and worker_threads and costs ~10.4 MB RSS, while
+// require('http') costs ~0.9 MB and pulls only net. Same objects, same
+// semantics - measurably less memory. See also the lazy https/zlib below.
+const http = requireBuiltin('http');
+const createServer = http.createServer;
+let gzipFn;
+let deflateFn;
+function compressors() {
+    if (!gzipFn) {
+        const zlib = requireBuiltin('zlib');
+        gzipFn = promisify(zlib.gzip);
+        deflateFn = promisify(zlib.deflate);
+    }
+    return {
+        gzip: gzipFn,
+        deflate: deflateFn,
+    };
+}
 const JSON_CONTENT_TYPE = 'application/json; charset=utf-8';
 const STATUS_MESSAGES = {
     200: 'OK',
@@ -83,7 +107,7 @@ function parseCookieHeader(cookieHeader) {
 // the `_server` back-reference, so methods can reach server config (logger,
 // compression settings) without any per-request allocation.
 // ---------------------------------------------------------------------------
-export class MoroIncomingMessage extends IncomingMessage {
+export class MoroIncomingMessage extends http.IncomingMessage {
     // Hot per-request fields (assigned in handleRequest; declared here for
     // stable shape). Everything else lives behind the single `_lazy` slot -
     // per-request construction pays 5 field initializations instead of 16.
@@ -327,7 +351,7 @@ export class MoroIncomingMessage extends IncomingMessage {
         return false;
     }
 }
-export class MoroServerResponse extends ServerResponse {
+export class MoroServerResponse extends http.ServerResponse {
     _locals = undefined;
     get locals() {
         let l = this._locals;
@@ -354,7 +378,8 @@ export class MoroServerResponse extends ServerResponse {
             const acceptEncoding = this.req?.headers['accept-encoding'];
             if (acceptEncoding && acceptEncoding.includes('gzip')) {
                 const buffer = Buffer.from(jsonString, 'utf8');
-                gzip(buffer)
+                compressors()
+                    .gzip(buffer)
                     .then(compressed => {
                     if (this.headersSent)
                         return;
@@ -385,7 +410,8 @@ export class MoroServerResponse extends ServerResponse {
             }
             else if (acceptEncoding && acceptEncoding.includes('deflate')) {
                 const buffer = Buffer.from(jsonString, 'utf8');
-                deflate(buffer)
+                compressors()
+                    .deflate(buffer)
                     .then(compressed => {
                     if (this.headersSent)
                         return;
@@ -935,7 +961,8 @@ export class MoroHttpServer {
         if (options?.ssl) {
             // In-process HTTPS. The https ServerOptions extends the http one, so the
             // IncomingMessage/ServerResponse subclass injection carries over.
-            this.server = createHttpsServer({ ...serverOpts, ...options.ssl }, this.handleRequest.bind(this));
+            const https = requireBuiltin('https');
+            this.server = https.createServer({ ...serverOpts, ...options.ssl }, this.handleRequest.bind(this));
             this.logger.info('HTTPS server created (in-process TLS)', 'HttpServer');
         }
         else {