inertjs-core 1.0.0-beta.0

package/package.json

@@ -0,0 +1,12 @@
+{
+  "name": "inertjs-core",
+  "version": "1.0.0-beta.0",
+  "type": "module",
+  "main": "src/index.js",
+  "dependencies": {
+    "inertjs-optimizer": "^1.0.0-beta.0"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  }
+}

package/src/index.js

@@ -0,0 +1,2 @@
+export { CoreServer } from './server.js';
+export { getScope } from './scope.js';

package/src/pipeline.js

@@ -0,0 +1,390 @@
+import { Readable } from 'node:stream';
+import { pathToFileURL } from 'node:url';
+import { getScope } from './scope.js';
+import { renderToStream } from '../../vector/src/stream.js';
+import { raw } from '../../vector/src/index.js';
+import { getCspHeader, validateCsrfToken } from '../../shield/src/index.js';
+import { serveStatic } from './static.js';
+import path from 'node:path';
+import fs from 'node:fs/promises';
+import { optimizeImage } from 'inertjs-optimizer';
+
+function parseCookies(cookieStr) {
+  if (!cookieStr) return {};
+  return cookieStr.split(';').reduce((acc, str) => {
+    const [k, v] = str.split('=');
+    if (k && v) acc[k.trim()] = v.trim();
+    return acc;
+  }, {});
+}
+
+const flashCache = new Map();
+
+export async function handleRequest(req, res, config, trie) {
+  const scope = getScope();
+  const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
+  
+  if (req.method === 'GET' && !req.headers['accept']?.includes('application/vnd.inert.pulse+json') && flashCache.has(url.pathname)) {
+    const start = performance.now();
+    const cachedHtml = flashCache.get(url.pathname);
+    // Securely inject the unique nonce for this request
+    const safeHtml = cachedHtml.replace(/nonce="[^"]*"/g, `nonce="${scope.nonce}"`);
+    const csp = getCspHeader(scope.nonce, config);
+    res.writeHead(200, {
+      'Content-Type': 'text/html; charset=utf-8',
+      'Content-Security-Policy': csp,
+      'X-Content-Type-Options': 'nosniff',
+      'X-Frame-Options': 'DENY',
+      'X-Inert-Flash': 'Hit',
+      'X-Inert-Flash-Time': `${(performance.now() - start).toFixed(2)}ms`
+    });
+    res.end(safeHtml);
+    return;
+  }
+  
+  if (url.pathname === '/_inert/dev/stream') {
+    res.writeHead(200, {
+      'Content-Type': 'text/event-stream',
+      'Cache-Control': 'no-cache',
+      'Connection': 'keep-alive'
+    });
+    res.write('data: connected\n\n');
+    // Keep connection alive to detect disconnects instantly
+    const keepAlive = setInterval(() => res.write(':\n\n'), 15000);
+    req.on('close', () => clearInterval(keepAlive));
+    return;
+  }
+
+  if (url.pathname.startsWith('/_inert/pulse/')) {
+    const filename = url.pathname.replace('/_inert/pulse/', '');
+    const filePath = path.resolve(process.cwd(), 'packages/pulse/src', filename);
+    const served = await serveStatic(req, res, filePath);
+    if (!served) {
+      res.writeHead(404);
+      res.end('Not Found');
+    }
+    return;
+  }
+
+  if (url.pathname.startsWith('/_inert/image')) {
+    const src = url.searchParams.get('src');
+    const width = url.searchParams.get('w');
+    const height = url.searchParams.get('h');
+    const quality = url.searchParams.get('q');
+
+    if (!src) {
+      res.writeHead(400);
+      res.end('Missing src parameter');
+      return;
+    }
+
+    try {
+      const filePath = path.join(process.cwd(), src.replace(/^\/+/, ''));
+      // Basic security check to prevent directory traversal
+      if (!filePath.startsWith(process.cwd())) {
+        res.writeHead(403);
+        res.end('Forbidden');
+        return;
+      }
+
+      const buffer = await fs.readFile(filePath);
+      const optimizedBuffer = await optimizeImage(buffer, { width, height, quality });
+      
+      res.writeHead(200, {
+        'Content-Type': 'image/webp',
+        'Cache-Control': 'public, max-age=31536000, immutable'
+      });
+      res.end(optimizedBuffer);
+    } catch (err) {
+      console.error(`[InertJS] Image optimization failed:`, err);
+      res.writeHead(500);
+      res.end('Error optimizing image');
+    }
+    return;
+  }
+
+  if (url.pathname.startsWith('/public/')) {
+    const filename = url.pathname.replace('/public/', '');
+    // Need to detect content type based on extension
+    const ext = path.extname(filename).toLowerCase();
+    const contentTypes = {
+      '.jpg': 'image/jpeg',
+      '.jpeg': 'image/jpeg',
+      '.png': 'image/png',
+      '.svg': 'image/svg+xml',
+      '.css': 'text/css',
+      '.webp': 'image/webp',
+      '.ico': 'image/x-icon'
+    };
+    const cType = contentTypes[ext] || 'application/octet-stream';
+    const filePath = path.resolve(process.cwd(), 'public', filename);
+    const served = await serveStatic(req, res, filePath, cType);
+    if (!served) {
+      res.writeHead(404);
+      res.end('Not Found');
+    }
+    return;
+  }
+
+  if (url.pathname.startsWith('/node_modules/')) {
+    const filePath = path.resolve(process.cwd(), url.pathname.slice(1));
+    const served = await serveStatic(req, res, filePath);
+    if (!served) {
+      res.writeHead(404);
+      res.end('Not Found');
+    }
+    return;
+  }
+
+  const segments = url.pathname.split('/').filter(Boolean);
+
+  let match = trie.match(segments);
+  let is404 = false;
+
+  if (!match) {
+    match = trie.match(['404']);
+    is404 = true;
+    if (!match) {
+      res.writeHead(404, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end(`<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>404 Not Found - InertJS</title>
+  <style>
+    body { font-family: system-ui, -apple-system, sans-serif; background-color: #0f172a; color: #f8fafc; display: flex; flex-direction: column; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
+    .container { text-align: center; max-width: 600px; padding: 2rem; }
+    h1 { font-size: 5rem; margin: 0; background: linear-gradient(to right, #818cf8, #22d3ee); -webkit-background-clip: text; color: transparent; font-weight: 900; }
+    p { color: #94a3b8; font-size: 1.25rem; margin-bottom: 2rem; }
+    a { background: #1e293b; color: #f8fafc; text-decoration: none; padding: 0.75rem 2rem; border-radius: 9999px; font-weight: 600; border: 1px solid #334155; transition: all 0.2s; }
+    a:hover { background: #4f46e5; border-color: #4f46e5; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <h1>404</h1>
+    <p>The route could not be resolved by the InertJS router.</p>
+    <a href="/">Return Home</a>
+  </div>
+</body>
+</html>`);
+      return;
+    }
+  }
+
+  const { route, params } = match;
+
+  try {
+    // 1. Run guard() chain
+    if (route.guard) {
+      const guardModule = await import(pathToFileURL(route.guard).href);
+      if (guardModule.guard) {
+        const allowed = await guardModule.guard({ req, params, scope });
+        if (!allowed) {
+          res.writeHead(403, { 'Content-Type': 'text/plain' });
+          res.end('Forbidden');
+          return;
+        }
+      }
+    }
+
+    // 2. Wire handling (API endpoint)
+    if (route.wire && !route.view) {
+      const method = req.method.toUpperCase();
+      
+      // CSRF Protection for mutating methods
+      if (['POST', 'PUT', 'DELETE', 'PATCH'].includes(method)) {
+        const cookies = parseCookies(req.headers.cookie);
+        const headerToken = req.headers['x-inert-csrf'];
+        if (!validateCsrfToken(cookies['__inert_csrf'], headerToken)) {
+          res.writeHead(403, { 'Content-Type': 'text/plain' });
+          res.end('CSRF Validation Failed');
+          return;
+        }
+      }
+
+      const wireModule = await import(pathToFileURL(route.wire).href);
+      if (wireModule[method]) {
+        // Execute the method handler
+        const responseData = await wireModule[method]({ req, res, params, scope });
+        if (!res.headersSent && responseData) {
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify(responseData));
+        }
+      } else {
+        res.writeHead(405, { 'Content-Type': 'text/plain' });
+        res.end('Method Not Allowed');
+      }
+      return;
+    }
+
+    // 3. Run flux()
+    let data = {};
+    if (route.flux) {
+      const fluxModule = await import(pathToFileURL(route.flux).href);
+      if (fluxModule.flux) {
+        data = await fluxModule.flux({ req, params, scope });
+      }
+    }
+
+    const isPulse = req.headers['accept']?.includes('application/vnd.inert.pulse+json');
+
+    // 4. View rendering
+    if (!isPulse) {
+      const csp = getCspHeader(scope.nonce, config);
+      res.writeHead(is404 ? 404 : 200, { 
+        'Content-Type': 'text/html; charset=utf-8',
+        'Content-Security-Policy': csp,
+        'X-Content-Type-Options': 'nosniff',
+        'X-Frame-Options': 'DENY'
+      });
+    }
+
+    let viewResult = '';
+    let isFlashMode = false;
+    if (route.view) {
+      const viewModule = await import(pathToFileURL(route.view).href);
+      if (viewModule.flash === true) isFlashMode = true;
+      if (viewModule.render) {
+        viewResult = viewModule.render({ data, params, scope });
+      }
+    }
+
+    // 5. Wrap in shells (from inside out) if not a pulse navigation
+    let finalResult = viewResult;
+    
+    if (isPulse) {
+      const { resolveToString } = await import('../../vector/src/index.js');
+      const viewHtml = await resolveToString(viewResult);
+      
+      res.writeHead(200, { 
+        'Content-Type': 'application/vnd.inert.pulse+json',
+        'X-Content-Type-Options': 'nosniff'
+      });
+      
+      res.end(JSON.stringify({
+        title: data.title || 'InertJS',
+        shellIdsToUpdate: [],
+        viewHtml,
+        data
+      }));
+      return;
+    }
+
+    if (route.shells && route.shells.length > 0) {
+      for (let i = route.shells.length - 1; i >= 0; i--) {
+        const shellModule = await import(pathToFileURL(route.shells[i]).href);
+        if (shellModule.render) {
+          // Preserve VecStream and RawString objects, only wrap plain strings
+          const childrenArg = (finalResult && (finalResult.type === 'VecStream' || finalResult.value !== undefined))
+            ? finalResult
+            : raw(String(finalResult));
+          finalResult = shellModule.render({ children: childrenArg, data, params, scope });
+        }
+      }
+    }
+
+    // 6. Stream to response
+    if (isFlashMode && !isPulse && req.method === 'GET') {
+      const { resolveToString } = await import('../../vector/src/index.js');
+      const finalHtml = await resolveToString(finalResult);
+      // Cache it for the next request
+      flashCache.set(url.pathname, finalHtml);
+      res.end(finalHtml);
+      return;
+    }
+
+    const webStream = renderToStream(finalResult, scope.nonce);
+    const nodeStream = Readable.fromWeb(webStream);
+    
+    // Pipe handles backpressure natively
+    nodeStream.pipe(res);
+
+  } catch (err) {
+    console.error(`[InertJS] Pipeline Error:`, err);
+    
+    // Fallback handling
+    if (route && route.fallback) {
+      try {
+        const fallbackModule = await import(pathToFileURL(route.fallback).href);
+        if (fallbackModule.fallback && !res.headersSent) {
+          const fallbackRes = await fallbackModule.fallback(err);
+          res.writeHead(500, { 'Content-Type': 'text/html; charset=utf-8' });
+          res.end(fallbackRes);
+          return;
+        }
+      } catch (fallbackErr) {
+        console.error(`[InertJS] Fallback failed:`, fallbackErr);
+      }
+    }
+
+    if (!res.headersSent) {
+      // Global 500 handler
+      const errorMatch = trie.match(['500']);
+      if (errorMatch && errorMatch.route.view) {
+        try {
+          const viewModule = await import(pathToFileURL(errorMatch.route.view).href);
+          let finalResult = '';
+          if (viewModule.render) {
+            finalResult = viewModule.render({ data: { error: err.message, stack: err.stack, title: 'Server Error' }, params: {}, scope });
+          }
+          
+          if (errorMatch.route.shells && errorMatch.route.shells.length > 0) {
+            for (let i = errorMatch.route.shells.length - 1; i >= 0; i--) {
+              const shellModule = await import(pathToFileURL(errorMatch.route.shells[i]).href);
+              if (shellModule.render) {
+                finalResult = shellModule.render({ children: raw(finalResult instanceof Object && finalResult.value ? finalResult.value : String(finalResult)), data: { error: err.message, stack: err.stack, title: 'Server Error' }, params: {}, scope });
+              }
+            }
+          }
+          
+          const csp = getCspHeader(scope.nonce, config);
+          res.writeHead(500, { 
+            'Content-Type': 'text/html; charset=utf-8',
+            'Content-Security-Policy': csp,
+            'X-Content-Type-Options': 'nosniff',
+            'X-Frame-Options': 'DENY'
+          });
+          
+          const webStream = renderToStream(finalResult, scope.nonce);
+          const nodeStream = Readable.fromWeb(webStream);
+          nodeStream.pipe(res);
+          return;
+        } catch (globalErr) {
+          console.error(`[InertJS] Global 500 handler failed:`, globalErr);
+        }
+      }
+
+      res.writeHead(500, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end(`<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>500 Internal Error - InertJS</title>
+  <style>
+    body { font-family: system-ui, -apple-system, sans-serif; background-color: #0f172a; color: #f8fafc; display: flex; flex-direction: column; align-items: center; justify-content: center; min-height: 100vh; margin: 0; padding: 2rem; box-sizing: border-box; }
+    .container { width: 100%; max-width: 800px; }
+    .header { text-align: center; margin-bottom: 2rem; }
+    h1 { font-size: 3rem; margin: 0; color: #f87171; font-weight: 800; }
+    p { color: #94a3b8; font-size: 1.1rem; }
+    .error-box { background: rgba(0,0,0,0.3); border: 1px solid rgba(248,113,113,0.3); border-radius: 0.5rem; overflow: hidden; }
+    .error-msg { background: rgba(127,29,29,0.4); padding: 1rem; color: #fca5a5; font-family: monospace; font-weight: bold; border-bottom: 1px solid rgba(248,113,113,0.3); word-wrap: break-word; }
+    pre { padding: 1rem; margin: 0; color: #cbd5e1; font-family: monospace; font-size: 0.875rem; overflow-x: auto; }
+  </style>
+</head>
+<body>
+  <div class="container">
+    <div class="header">
+      <h1>Internal Server Error</h1>
+      <p>The application encountered an unexpected condition.</p>
+    </div>
+    <div class="error-box">
+      <div class="error-msg">${err.message.replace(/</g, '&lt;').replace(/>/g, '&gt;')}</div>
+      <pre>${err.stack.replace(/</g, '&lt;').replace(/>/g, '&gt;')}</pre>
+    </div>
+  </div>
+</body>
+</html>`);
+    } else {
+      res.end(); // just close it
+    }
+  }
+}

package/src/scope.js

@@ -0,0 +1,17 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+
+export const requestScope = new AsyncLocalStorage();
+
+/**
+ * Gets the current request scope.
+ * 
+ * @returns {object} The RequestScope object
+ * @throws {Error} If called outside of a request scope
+ */
+export function getScope() {
+  const scope = requestScope.getStore();
+  if (!scope) {
+    throw new Error('E_INERT_SCOPE: Accessed outside of request scope');
+  }
+  return scope;
+}

package/src/server.js

@@ -0,0 +1,108 @@
+import http from 'node:http';
+import http2 from 'node:http2';
+import crypto from 'node:crypto';
+import { requestScope } from './scope.js';
+import { handleRequest } from './pipeline.js';
+import { RateLimiter } from '../../shield/src/index.js';
+
+export class CoreServer {
+  /**
+   * Initializes the InertJS Core server.
+   * 
+   * @param {object} config Validated config object
+   * @param {RouterTrie} trie Loaded router trie
+   */
+  constructor(config, trie) {
+    this.config = config;
+    this.trie = trie;
+    
+    // Browsers do not support HTTP/2 without TLS (h2c).
+    // To support Chrome in local dev, we fall back to HTTP/1.1 for plain text.
+    this.server = http.createServer();
+    
+    const reqPerSec = config?.shield?.rateLimit || 100;
+    this.rateLimiter = new RateLimiter(reqPerSec);
+    
+    this.connections = new Set();
+    
+    this.server.on('connection', (conn) => {
+      this.connections.add(conn);
+      conn.once('close', () => this.connections.delete(conn));
+    });
+
+    this.server.on('request', this._onRequest.bind(this));
+  }
+
+  _onRequest(req, res) {
+    const ip = req.socket.remoteAddress || '127.0.0.1';
+    if (!this.rateLimiter.check(ip)) {
+      res.writeHead(429, { 'Content-Type': 'text/plain', 'Retry-After': '1' });
+      res.end('Too Many Requests');
+      return;
+    }
+
+    const scope = {
+      reqId: crypto.randomUUID(),
+      nonce: crypto.randomBytes(16).toString('base64'),
+      startedAt: performance.now(),
+      vaultHandle: null,
+      conduitAgent: null,
+      lens: null
+    };
+
+    // Every stage is wrapped in an AsyncLocalStorage RequestScope
+    requestScope.run(scope, () => {
+      handleRequest(req, res, this.config, this.trie).catch(err => {
+        console.error(`[InertJS] Unhandled request error:`, err);
+        if (!res.headersSent) {
+          res.writeHead(500, { 'Content-Type': 'text/plain' });
+          res.end('Internal Server Error');
+        } else {
+          res.end();
+        }
+      });
+    });
+  }
+
+  async start() {
+    let port = this.config.core.port;
+    const host = this.config.core.host;
+    
+    return new Promise((resolve, reject) => {
+      this.server.on('error', (err) => {
+        if (err.code === 'EADDRINUSE') {
+          console.warn(`[InertJS] Port ${port} is in use, trying ${port + 1}...`);
+          port++;
+          this.config.core.port = port; // Update config
+          this.server.listen(port, host);
+        } else {
+          reject(err);
+        }
+      });
+
+      this.server.listen(port, host, () => {
+        resolve();
+      });
+    });
+  }
+
+  async stop() {
+    return new Promise((resolve, reject) => {
+      let timeout;
+      if (this.config.core.gracefulShutdownMs) {
+        timeout = setTimeout(() => {
+          console.warn('[InertJS] Graceful shutdown timeout, forcing close');
+          for (const conn of this.connections) {
+            conn.destroy();
+          }
+        }, this.config.core.gracefulShutdownMs);
+      }
+
+      this.server.close((err) => {
+        if (timeout) clearTimeout(timeout);
+        if (err) reject(err);
+        else resolve();
+      });
+    });
+  }
+}

package/src/static.js

@@ -0,0 +1,50 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { minifyAsset } from 'inertjs-optimizer';
+
+const ETAG_CACHE = new Map();
+
+/**
+ * Serves a static file with ETag caching and proper cache headers.
+ */
+export async function serveStatic(req, res, filePath, contentType = 'application/javascript') {
+  try {
+    const stat = await fs.stat(filePath);
+    
+    let cacheEntry = ETAG_CACHE.get(filePath);
+    if (!cacheEntry || cacheEntry.mtime !== stat.mtimeMs) {
+      let content = await fs.readFile(filePath);
+      
+      if (contentType === 'application/javascript' || contentType === 'text/css') {
+        const type = contentType === 'text/css' ? 'css' : 'js';
+        const minified = await minifyAsset(content.toString('utf8'), type);
+        content = Buffer.from(minified, 'utf8');
+      }
+
+      const hash = crypto.createHash('sha1').update(content).digest('hex');
+      cacheEntry = { 
+        etag: `"${hash}"`, 
+        mtime: stat.mtimeMs,
+        content 
+      };
+      ETAG_CACHE.set(filePath, cacheEntry);
+    }
+
+    if (req.headers['if-none-match'] === cacheEntry.etag) {
+      res.writeHead(304);
+      res.end();
+      return true;
+    }
+
+    res.writeHead(200, {
+      'Content-Type': contentType,
+      'Cache-Control': 'public, max-age=31536000, immutable',
+      'ETag': cacheEntry.etag
+    });
+    res.end(cacheEntry.content);
+    return true;
+  } catch (err) {
+    return false;
+  }
+}

package/test/server.test.js

@@ -0,0 +1,167 @@
+import test from 'node:test';
+import assert from 'node:assert';
+import http2 from 'node:http2';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { pathToFileURL } from 'node:url';
+import { CoreServer } from '../src/server.js';
+import { RouterTrie } from '../../router/src/trie.js';
+
+function fetchH2C(url) {
+  return new Promise((resolve, reject) => {
+    const client = http2.connect(url);
+    const u = new URL(url);
+    const req = client.request({ ':path': u.pathname });
+
+    let data = '';
+    req.setEncoding('utf8');
+    
+    req.on('response', (headers) => {
+      req.on('data', chunk => data += chunk);
+      req.on('end', () => {
+        client.close();
+        resolve({ status: headers[':status'], data, headers });
+      });
+    });
+    
+    req.on('error', err => {
+      client.close();
+      reject(err);
+    });
+    
+    req.end();
+  });
+}
+
+test('Core Kernel - Server Pipeline', async (t) => {
+  const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'inert-core-test-'));
+  
+  try {
+    // Scaffold test routes
+    await fs.mkdir(path.join(tmpDir, 'basic'), { recursive: true });
+    
+    const vectorPath = pathToFileURL(path.resolve(process.cwd(), 'packages/vector/src/index.js')).href;
+    
+    // Mock view.js
+    await fs.writeFile(
+      path.join(tmpDir, 'basic', 'view.js'), 
+      `import { vec } from '${vectorPath}'; export const render = ({ data }) => vec\`<main>\${data.title}</main>\`;`
+    );
+    
+    // Mock shell.js
+    await fs.writeFile(
+      path.join(tmpDir, 'basic', 'shell.js'), 
+      `import { vec } from '${vectorPath}'; export const render = ({ children }) => vec\`<html><body>\${children}</body></html>\`;`
+    );
+
+    // Mock flux.js
+    await fs.writeFile(
+      path.join(tmpDir, 'basic', 'flux.js'), 
+      `export const flux = async () => { return { title: 'Hello Flux' }; };`
+    );
+
+    // Mock guard.js
+    await fs.writeFile(
+      path.join(tmpDir, 'basic', 'guard.js'), 
+      `export const guard = async ({ req }) => req.headers['x-allow'] === 'yes';`
+    );
+
+    const trie = new RouterTrie();
+    
+    // The manifest stores absolute paths
+    const toUrl = p => path.join(tmpDir, p).split(path.sep).join('/');
+
+    trie.insert(['basic'], {
+      view: toUrl('basic/view.js'),
+      shell: toUrl('basic/shell.js'), // Wait, it's an array of shells
+      shells: [toUrl('basic/shell.js')],
+      flux: toUrl('basic/flux.js'),
+      guard: toUrl('basic/guard.js'),
+    });
+
+    const config = {
+      core: { port: 0, host: '127.0.0.1', gracefulShutdownMs: 1000 }
+    };
+
+    const server = new CoreServer(config, trie);
+    await server.start();
+    const port = server.server.address().port;
+
+    await t.test('403 when guard fails', async () => {
+      const res = await fetchH2C(`http://127.0.0.1:${port}/basic`);
+      assert.strictEqual(res.status, 403);
+    });
+
+    await t.test('200 pipeline success (guard -> flux -> view -> shell)', async () => {
+      return new Promise((resolve, reject) => {
+        const client = http2.connect(`http://127.0.0.1:${port}`);
+        const req = client.request({ ':path': '/basic', 'x-allow': 'yes' });
+
+        let data = '';
+        req.setEncoding('utf8');
+        
+        req.on('response', (headers) => {
+          assert.strictEqual(headers[':status'], 200);
+          assert.strictEqual(headers['content-type'], 'text/html; charset=utf-8');
+          assert.ok(headers['content-security-policy'].includes('default-src \'none\''));
+          
+          req.on('data', chunk => data += chunk);
+          req.on('end', () => {
+            client.close();
+            // It should render shell wrapping view wrapping flux data
+            assert.strictEqual(data, '<html><body><main>Hello Flux</main></body></html>');
+            resolve();
+          });
+        });
+        
+        req.on('error', err => {
+          client.close();
+          reject(err);
+        });
+        
+        req.end();
+      });
+    });
+
+    await t.test('200 Pulse JSON manifest', async () => {
+      return new Promise((resolve, reject) => {
+        const client = http2.connect(`http://127.0.0.1:${port}`);
+        const req = client.request({ 
+          ':path': '/basic', 
+          'x-allow': 'yes',
+          'accept': 'application/vnd.inert.pulse+json'
+        });
+
+        let data = '';
+        req.setEncoding('utf8');
+        
+        req.on('response', (headers) => {
+          assert.strictEqual(headers[':status'], 200);
+          assert.strictEqual(headers['content-type'], 'application/vnd.inert.pulse+json');
+          
+          req.on('data', chunk => data += chunk);
+          req.on('end', () => {
+            client.close();
+            const manifest = JSON.parse(data);
+            assert.strictEqual(manifest.title, 'Hello Flux');
+            assert.strictEqual(manifest.viewHtml, '<main>Hello Flux</main>');
+            assert.deepStrictEqual(manifest.data, { title: 'Hello Flux' });
+            resolve();
+          });
+        });
+        
+        req.on('error', err => {
+          client.close();
+          reject(err);
+        });
+        
+        req.end();
+      });
+    });
+
+    await server.stop();
+  } finally {
+    await fs.rm(tmpDir, { recursive: true, force: true });
+  }
+});

package/test/stress.test.js

@@ -0,0 +1,48 @@
+import test from 'node:test';
+import assert from 'node:assert';
+import http2 from 'node:http2';
+import crypto from 'node:crypto';
+import { CoreServer } from '../src/server.js';
+import { RouterTrie } from '../../router/src/index.js';
+
+test('CoreServer Rate Limiter E2E (100 reqs/sec limit)', async (t) => {
+  const trie = new RouterTrie();
+  trie.insert(['test'], {
+    view: 'file://' + process.cwd() + '/packages/core/test/mock/view.js'
+  });
+
+  const server = new CoreServer({
+    core: { port: 0, host: '127.0.0.1' },
+    shield: { rateLimit: 100 }
+  }, trie);
+
+  await server.start();
+  const port = server.server.address().port;
+  
+  const client = http2.connect(`http://127.0.0.1:${port}`);
+  
+  let successCount = 0;
+  let limitedCount = 0;
+
+  // Spam 200 requests concurrently
+  const reqs = Array.from({ length: 200 }).map(() => {
+    return new Promise((resolve) => {
+      const req = client.request({ ':path': '/test' });
+      req.on('response', (headers) => {
+        if (headers[':status'] === 200) successCount++;
+        if (headers[':status'] === 429) limitedCount++;
+        req.resume(); // consume data
+      });
+      req.on('end', resolve);
+      req.end();
+    });
+  });
+
+  await Promise.all(reqs);
+
+  assert.ok(successCount > 0 && successCount <= 100, `Expected some success, got ${successCount}`);
+  assert.ok(limitedCount >= 100, `Expected at least 100 429s, got ${limitedCount}`);
+
+  client.close();
+  await server.stop();
+});