refactor: replace express and cors with plain node http handlers

Drop express and cors dependencies. Static file serving (ETag, range requests, 404 fallback, directory redirect, MIME types via mrmime) now lives in src/static.ts, request routing in src/router.ts, CORS headers in src/cors.ts. Test fixtures moved to test/fixtures/.

🤖 Generated with [OpenCode](https://opencode.ai) (Smart-router)

Author: daquinoaldo

package.json

@@ -68,13 +68,10 @@
     "start": "node src/cli.ts"
   },
   "dependencies": {
-    "cors": "^2.8.6",
-    "express": "^5.2.1",
+    "mrmime": "^2.0.1",
     "zod": "^4.5.4"
   },
   "devDependencies": {
-    "@types/cors": "^2.8.19",
-    "@types/express": "^5.0.6",
     "@types/node": "^26.4.1",
     "oxfmt": "^0.66.0",
     "oxlint": "^1.81.0",

pnpm-lock.yaml

@@ -0,0 +1,20 @@
+import type { IncomingMessage, ServerResponse } from "node:http"
+
+const CORS_HEADERS: Record<string, string> = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS",
+  "Access-Control-Allow-Headers": "*",
+  "Access-Control-Max-Age": "86400",
+}
+
+function applyCors(req: IncomingMessage, res: ServerResponse): boolean {
+  for (const [header, value] of Object.entries(CORS_HEADERS)) {
+    res.setHeader(header, value)
+  }
+  if (req.method !== "OPTIONS") return false
+  res.writeHead(204)
+  res.end()
+  return true
+}
+
+export { applyCors }

src/cors.ts

@@ -1,88 +1,65 @@
 #!/usr/bin/env node
 
-import fs from "node:fs"
 import http from "node:http"
+import type { Server } from "node:http"
 import https from "node:https"
-import path from "node:path"
-
-import cors from "cors"
-import express from "express"
-import type { Express, Request, Response } from "express"
 
 import { getCerts } from "./certs.ts"
+import { createRouter, type RouteHandler } from "./router.ts"
+import { createStaticHandler } from "./static.ts"
 
-export type HttpsLocalhostApp = Omit<Express, "listen"> & {
-  server?: https.Server
-  http?: http.Server
-  listen: (port?: number) => Promise<https.Server>
+export type HttpsLocalhostApp = {
+  server?: Server
+  http?: Server
+  get: (route: string, handler: RouteHandler) => void
+  listen: (port?: number) => Promise<Server>
   redirect: (httpPort?: number, httpsPort?: number) => void
   serve: (staticPath?: string, port?: number) => void
 }
 
-const createServer = ({
+export function createServer({
   domain = "localhost",
   certPath,
   reinstall,
 }: {
   domain?: string
   certPath?: string
   reinstall?: boolean
-} = {}): HttpsLocalhostApp => {
-  const app = express() as unknown as HttpsLocalhostApp
-
-  app.use(cors())
-  app.listen = async function (port = 443) {
-    app.server = https
-      .createServer(
-        await getCerts({
-          domain,
-          certPath,
-          reinstall,
-        }),
-        app as unknown as Express,
-      )
-      .listen(port)
-    console.info("Server running on port " + port + ".")
-    return app.server
-  }
+} = {}): HttpsLocalhostApp {
+  const router = createRouter()
 
-  app.redirect = function (httpPort = 80, httpsPort = 443) {
-    app.http = http
-      .createServer((req, res) => {
-        const reqHost = req.headers.host ? req.headers.host.replace(":" + httpPort, "") : domain
-        res.writeHead(301, {
-          Location:
-            "https://" + reqHost + (httpsPort !== 443 ? ":" + httpsPort : "") + (req.url || ""),
+  const app: HttpsLocalhostApp = {
+    get(route, handler) {
+      router.get(route, handler)
+    },
+    listen: async function (port = 443) {
+      app.server = https
+        .createServer(await getCerts({ domain, certPath, reinstall }), router.handleRequest)
+        .listen(port)
+      console.info("Server running on port " + port + ".")
+      return app.server
+    },
+    redirect: function (httpPort = 80, httpsPort = 443) {
+      app.http = http
+        .createServer((req, res) => {
+          const reqHost = req.headers.host ? req.headers.host.replace(":" + httpPort, "") : domain
+          res.writeHead(301, {
+            Location:
+              "https://" + reqHost + (httpsPort !== 443 ? ":" + httpsPort : "") + (req.url || ""),
+          })
+          res.end()
         })
-        res.end()
-      })
-      .listen(httpPort)
-    console.info("http to https redirection active.")
-  }
-
-  app.serve = function (staticPath = process.cwd(), port = 443) {
-    const p404 = staticPath + "/404.html"
-    const index = staticPath + "/index.html"
-    const fallback = fs.existsSync(p404)
-      ? { status: 404, content: fs.readFileSync(path.resolve(p404)) }
-      : fs.existsSync(index)
-        ? { status: 200, content: fs.readFileSync(path.resolve(index)) }
-        : undefined
-
-    app.use(express.static(staticPath))
-    app.use((_req: Request, res: Response) => {
-      if (fallback) {
-        res.status(fallback.status).type("html").send(fallback.content)
-      } else {
-        res.status(404).send("Not found.")
-      }
-    })
-    console.info("Serving static path: " + staticPath)
-    void app.listen(port)
+        .listen(httpPort)
+      console.info("http to https redirection active.")
+    },
+    serve: function (staticPath = process.cwd(), port = 443) {
+      router.setStaticHandler(createStaticHandler(staticPath))
+      console.info("Serving static path: " + staticPath)
+      void app.listen(port)
+    },
   }
 
   return app
 }
 
 export default createServer
-export { createServer }

src/index.ts

@@ -0,0 +1,40 @@
+import type { IncomingMessage, RequestListener, ServerResponse } from "node:http"
+
+import { applyCors } from "./cors.ts"
+
+export type RouteHandler = (req: IncomingMessage, res: ServerResponse) => void
+
+export function createRouter(): {
+  handleRequest: RequestListener
+  get: (route: string, handler: RouteHandler) => void
+  setStaticHandler: (handler: RequestListener | undefined) => void
+} {
+  const routes: Array<{ route: string; handler: RouteHandler }> = []
+
+  let staticHandler: RequestListener | undefined
+
+  function handleRequest(req: IncomingMessage, res: ServerResponse): void {
+    if (applyCors(req, res)) return
+    const route = routes.find(candidate => candidate.route === req.url?.split("?")[0])
+    if (route && req.method === "GET") {
+      route.handler(req, res)
+      return
+    }
+    if (staticHandler) {
+      staticHandler(req, res)
+      return
+    }
+    res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" })
+    res.end("Not found.")
+  }
+
+  function get(route: string, handler: RouteHandler): void {
+    routes.push({ route, handler })
+  }
+
+  function setStaticHandler(handler: RequestListener | undefined): void {
+    staticHandler = handler
+  }
+
+  return { handleRequest, get, setStaticHandler }
+}

src/router.ts

@@ -0,0 +1,137 @@
+import fs from "node:fs"
+import type { IncomingMessage, RequestListener, ServerResponse } from "node:http"
+import path from "node:path"
+
+import { lookup } from "mrmime"
+
+const DEFAULT_INDEX = "index.html"
+const DEFAULT_404 = "404.html"
+
+function mime(filePath: string): string {
+  const type = lookup(filePath)
+  return type
+    ? type + (type.startsWith("text/") || type === "image/svg+xml" ? "; charset=utf-8" : "")
+    : "application/octet-stream"
+}
+
+function sanitize(staticPath: string, urlPath: string): string | null {
+  const base = path.resolve(staticPath)
+  const decoded = decodeURIComponent(urlPath.split("?")[0]?.split("#")[0] ?? "/")
+  const resolved = path.resolve(base, "." + path.posix.normalize("/" + decoded))
+  if (resolved !== base && !resolved.startsWith(base + path.sep)) return null
+  return resolved
+}
+
+function parseRange(header: string, size: number): { start: number; end: number } | null {
+  const match = /^bytes=(\d*)-(\d*)$/.exec(header.trim())
+  if (!match || (match[1] === "" && match[2] === "")) return null
+  if (match[1] === "") {
+    const n = Number(match[2])
+    if (n === 0) return null
+    return { start: Math.max(0, size - n), end: size - 1 }
+  }
+  const start = Number(match[1])
+  const end = match[2] === "" ? size - 1 : Math.min(Number(match[2]), size - 1)
+  if (start > end || start >= size) return null
+  return { start, end }
+}
+
+function serve404(staticPath: string, req: IncomingMessage, res: ServerResponse): void {
+  try {
+    const content = fs.readFileSync(path.join(staticPath, DEFAULT_404))
+    res.writeHead(404, { "Content-Type": "text/html; charset=utf-8" })
+    if (req.method === "HEAD") return void res.end()
+    res.end(content)
+  } catch {
+    res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" })
+    res.end("Not found.")
+  }
+}
+
+function serveFile(
+  target: string,
+  req: IncomingMessage,
+  res: ServerResponse,
+  range: { start: number; end: number } | null,
+): void {
+  const stat = fs.statSync(target)
+  const etag = '"' + stat.size.toString(16) + "-" + stat.mtimeMs.toString(16) + '"'
+  res.setHeader("ETag", etag)
+  res.setHeader("Last-Modified", stat.mtime.toUTCString())
+  res.setHeader("Accept-Ranges", "bytes")
+
+  const ifNoneMatch = req.headers["if-none-match"]
+  if (
+    ifNoneMatch &&
+    ifNoneMatch.split(",").some(tag => tag.trim() === etag || tag.trim() === "W/" + etag)
+  ) {
+    res.writeHead(304)
+    res.end()
+    return
+  }
+  const ifModifiedSince = req.headers["if-modified-since"]
+  if (!ifNoneMatch && ifModifiedSince && stat.mtime <= new Date(ifModifiedSince)) {
+    res.writeHead(304)
+    res.end()
+    return
+  }
+
+  const size = stat.size
+  const status = range ? 206 : 200
+  const content = fs.readFileSync(target)
+  const body = range ? content.subarray(range.start, range.end + 1) : content
+  res.writeHead(status, {
+    "Content-Type": mime(target),
+    "Content-Length": range ? range.end - range.start + 1 : size,
+    ...(range ? { "Content-Range": `bytes ${range.start}-${range.end}/${size}` } : {}),
+  })
+  if (req.method === "HEAD") return void res.end()
+  res.end(body)
+}
+
+export function createStaticHandler(staticPath: string): RequestListener {
+  return function handleStatic(req, res) {
+    if (req.method === "OPTIONS") {
+      res.writeHead(204)
+      res.end()
+      return
+    }
+    if (req.method !== "GET" && req.method !== "HEAD") {
+      res.writeHead(405, { Allow: "GET, HEAD, OPTIONS" })
+      res.end()
+      return
+    }
+    const filePath = sanitize(staticPath, req.url ?? "/")
+    if (filePath === null) {
+      res.writeHead(403)
+      res.end()
+      return
+    }
+    let target = filePath
+    try {
+      let stat = fs.statSync(target)
+      if (stat.isDirectory()) {
+        if (!req.url?.endsWith("/")) {
+          res.writeHead(301, { Location: encodeURI(req.url + "/") })
+          res.end()
+          return
+        }
+        target = path.join(target, DEFAULT_INDEX)
+      }
+    } catch {
+      serve404(staticPath, req, res)
+      return
+    }
+    let range: { start: number; end: number } | null = null
+    const rangeHeader = req.headers.range
+    if (rangeHeader) {
+      range = parseRange(rangeHeader, fs.statSync(target).size)
+      if (range === null) {
+        res.writeHead(416, { "Content-Range": "bytes */" + fs.statSync(target).size })
+        res.end()
+        return
+      }
+    }
+    serveFile(target, req, res, range)
+  }
+}

src/static.ts

@@ -7,8 +7,8 @@ describe("cli", () => {
   const cliPath = path.resolve("src/cli.ts")
 
   it("CLI flags override environment", async () => {
-    const testDir = path.resolve("test")
-    const proc = spawn("node", [cliPath, "--port", "4448", testDir], {
+    const fixtureDir = path.resolve("test/fixtures")
+    const proc = spawn("node", [cliPath, "--port", "4448", fixtureDir], {
       env: { ...process.env, PORT: "4447" },
       stdio: ["ignore", "pipe", "pipe"],
     })

test/cli.test.ts

@@ -0,0 +1,8 @@
+<html>
+  <head>
+    <title>Sub</title>
+  </head>
+  <body>
+    <p>Subdirectory index.</p>
+  </body>
+</html>