@morojs/moro 1.8.6 → 1.8.8

package/dist/core/http/http-server.d.ts

@@ -1,7 +1,8 @@
-import { IncomingMessage, ServerResponse, Server } from 'http';
+import type { Server } from 'http';
 import type { HttpRuntimeLimits } from './utils/size.js';
 import { HttpRequest, HttpResponse, HttpHandler, Middleware } from '../../types/http.js';
-export declare class MoroIncomingMessage extends IncomingMessage {
+declare const http: typeof import("http");
+export declare class MoroIncomingMessage extends http.IncomingMessage {
     /** Bound on the per-server subclass prototype - no per-request write needed */
     _server: MoroHttpServer;
     params: Record<string, string>;
@@ -39,7 +40,7 @@ export declare class MoroIncomingMessage extends IncomingMessage {
     accepts(types?: string | string[]): string | false;
     acceptsLanguages(langs?: string | string[]): string | false;
 }
-export declare class MoroServerResponse extends ServerResponse {
+export declare class MoroServerResponse extends http.ServerResponse {
     /** Bound on the per-server subclass prototype - no per-request write needed */
     _server: MoroHttpServer;
     _locals: Record<string, any> | undefined;
@@ -256,3 +257,4 @@ export declare class MoroHttpServer {
         };
     };
 }
+export {};

package/dist/core/http/http-server.js

@@ -1,7 +1,4 @@
-// src/core/http-server.ts
-import { IncomingMessage, ServerResponse, createServer } from 'http';
-import { createServer as createHttpsServer } from 'https';
-import * as zlib from 'zlib';
+import { createRequire } from 'module';
 import { promisify } from 'util';
 import { randomUUID } from 'crypto';
 import { createFrameworkLogger } from '../logger/index.js';
@@ -9,8 +6,35 @@ import { parseMultipart as parseMultipartBuffer, } from './utils/multipart-parse
 import { parseRawQueryString } from './utils/query-parser.js';
 import { PathMatcher } from '../routing/path-matcher.js';
 import { ObjectPoolManager } from '../pooling/object-pool-manager.js';
-const gzip = promisify(zlib.gzip);
-const deflate = promisify(zlib.deflate);
+// `node:https` and `node:zlib` are resolved on first use rather than at import
+// time. This module is on every app's startup path, but plaintext HTTP apps
+// never touch https (~1.9 MB RSS, it drags in tls) and uncompressed responses
+// never touch zlib (~0.3 MB). Builtins are always synchronously requirable, so
+// the secure-server and compression paths stay fully synchronous.
+// Resolves Node builtins ONLY, so the base passed to createRequire is
+// irrelevant - 'file:///' is used instead of import.meta.url so this file still
+// compiles under the CJS transform Jest applies to the test suite.
+const requireBuiltin = createRequire('file:///');
+// `node:http` is pulled through createRequire rather than `import`. In an ESM
+// package the two are NOT equivalent: building the ESM facade for node:http
+// drags in http2, tls, zlib and worker_threads and costs ~10.4 MB RSS, while
+// require('http') costs ~0.9 MB and pulls only net. Same objects, same
+// semantics - measurably less memory. See also the lazy https/zlib below.
+const http = requireBuiltin('http');
+const createServer = http.createServer;
+let gzipFn;
+let deflateFn;
+function compressors() {
+    if (!gzipFn) {
+        const zlib = requireBuiltin('zlib');
+        gzipFn = promisify(zlib.gzip);
+        deflateFn = promisify(zlib.deflate);
+    }
+    return {
+        gzip: gzipFn,
+        deflate: deflateFn,
+    };
+}
 const JSON_CONTENT_TYPE = 'application/json; charset=utf-8';
 const STATUS_MESSAGES = {
     200: 'OK',
@@ -83,7 +107,7 @@ function parseCookieHeader(cookieHeader) {
 // the `_server` back-reference, so methods can reach server config (logger,
 // compression settings) without any per-request allocation.
 // ---------------------------------------------------------------------------
-export class MoroIncomingMessage extends IncomingMessage {
+export class MoroIncomingMessage extends http.IncomingMessage {
     // Hot per-request fields (assigned in handleRequest; declared here for
     // stable shape). Everything else lives behind the single `_lazy` slot -
     // per-request construction pays 5 field initializations instead of 16.
@@ -327,7 +351,7 @@ export class MoroIncomingMessage extends IncomingMessage {
         return false;
     }
 }
-export class MoroServerResponse extends ServerResponse {
+export class MoroServerResponse extends http.ServerResponse {
     _locals = undefined;
     get locals() {
         let l = this._locals;
@@ -354,7 +378,8 @@ export class MoroServerResponse extends ServerResponse {
             const acceptEncoding = this.req?.headers['accept-encoding'];
             if (acceptEncoding && acceptEncoding.includes('gzip')) {
                 const buffer = Buffer.from(jsonString, 'utf8');
-                gzip(buffer)
+                compressors()
+                    .gzip(buffer)
                     .then(compressed => {
                     if (this.headersSent)
                         return;
@@ -385,7 +410,8 @@ export class MoroServerResponse extends ServerResponse {
             }
             else if (acceptEncoding && acceptEncoding.includes('deflate')) {
                 const buffer = Buffer.from(jsonString, 'utf8');
-                deflate(buffer)
+                compressors()
+                    .deflate(buffer)
                     .then(compressed => {
                     if (this.headersSent)
                         return;
@@ -935,7 +961,8 @@ export class MoroHttpServer {
         if (options?.ssl) {
             // In-process HTTPS. The https ServerOptions extends the http one, so the
             // IncomingMessage/ServerResponse subclass injection carries over.
-            this.server = createHttpsServer({ ...serverOpts, ...options.ssl }, this.handleRequest.bind(this));
+            const https = requireBuiltin('https');
+            this.server = https.createServer({ ...serverOpts, ...options.ssl }, this.handleRequest.bind(this));
             this.logger.info('HTTPS server created (in-process TLS)', 'HttpServer');
         }
         else {
@@ -1201,6 +1228,10 @@ export class MoroHttpServer {
                     });
                 }
             }
+            // A request hook may answer the request itself (rate limiting, auth
+            // rejection). Registration of the response hooks above still stands.
+            if (httpRes.headersSent)
+                return;
             // executeMiddleware returns undefined when the whole chain completed
             // synchronously, so a sync chain costs zero promise allocations.
             if (this.globalMiddleware.length > 0) {