expressjs/express
Data enters as a raw Node `IncomingMessage`, is re-prototyped in `app.handle` so that Express getters become available, then flows through the external router's middleware stack where `body-parser` populates `req.body` and the router populates `req.params`, `req.baseUrl` and `req.next`. Derived request values are computed lazily and are never cached — every read of `req.query`, `req.ip` or `req.host` re-runs its parser against the raw headers, gated by the compiled `trust proxy fn`. Output converges on `res.send`, which is where Content-Type, Content-Length, ETag and freshness negotiation are decided before `res.end`. Template rendering is a side channel: `res.render` → `app.render` → `View#render` produces a string that is then fed back into `res.send`. Anything that escapes the stack terminates in `finalhandler`.
- The input boundary is `app.handle(req, res, callback)`, which mutates the incoming Node objects in place via `Object.setPrototypeOf(req, this.request)` / `(res, this.response)` — Express never wraps or copies the request.
- `res.locals` is lazily initialised to `Object.create(null)` on each dispatch only if absent, so a sub-app mount reuses the parent's locals object rather than resetting it.
- `req.query` is recomputed on every property read: it fetches `query parser fn` from app settings, extracts the raw string with `parseurl`, and returns `Object.create(null)` when parsing is disabled (`query parser` set to `false`).
- The `extended` query parser routes through `qs.parse(str, { allowPrototypes: true })`, while the default `simple` parser is `node:querystring.parse` — two materially different object shapes behind one setting.
- All proxy-derived values funnel through one compiled predicate: `compileTrust` turns `true`, a hop count, a comma-separated string, an array or a function into `trust(addr, index)`, consumed identically by `req.protocol`, `req.ip`, `req.ips` and `req.host`.
- `req.protocol` and `req.host` both defensively split their `X-Forwarded-*` header on the first comma, taking only the left-most value.
- `req.ips` reverses `proxyaddr.all()` and pops the socket address, so the returned array is farthest-to-closest and excludes the direct peer.
- On the way out, `res.set('Content-Type', ...)` always runs the value through `mime.contentType()` to append a charset, and throws `TypeError` if an array is supplied for Content-Type.
- ETag generation is a two-step: `compileETag` picks `wetag`/`etag` from `lib/utils.js`, `res.send` calls it only when no ETag header is already present and a length was computed, and the buffer conversion is skipped for chunks under 1000 bytes when no ETag is needed.
- Render data is merged in a fixed precedence — `app.locals`, then `res.locals` (passed as `opts._locals`), then the caller's options — with `cache` defaulting to the `view cache` setting when not explicitly provided.
- Compiled views are memoised by name in `app.cache` only when `renderOptions.cache` is truthy, which is why development mode re-stats the filesystem on every render.
- `View#render` normalises synchronous engine callbacks by copying `arguments` and deferring through `process.nextTick`, guaranteeing the caller always sees an async callback.
- Static file responses bypass `res.send` entirely — `sendfile()` attaches listeners for `directory`, `end`, `error`, `file`, `stream` plus `on-finished`, applies `options.headers` on the `headers` event, and then `file.pipe(res)`.
- The terminal output boundary for unhandled requests and errors is `finalhandler(req, res, { env, onerror: logerror })`, constructed per-dispatch unless the caller supplied its own callback.
- Settings inheritance for mounted apps is prototype-chain based, not copy based: `Object.setPrototypeOf(this.settings, parent.settings)` means later parent mutations are visible to already-mounted children. (inferred)