CodeVetter · Repo Unpack · System map
expressjs/express
A single npm entrypoint (`index.js` → `lib/express.js`) exposes a factory, `createApplication()`, that returns a callable function decorated with the application prototype and EventEmitter. Five runtime modules split responsibility: `application.js` (settings, dispatch, mounting, rendering), `request.js` and `response.js` (prototypes grafted onto `http.IncomingMessage`/`http.ServerResponse`), `view.js` (template lookup), and `utils.js` (compilers for etag/query/trust). The runtime boundary is deliberately thin — routing, body parsing and static file serving are re-exported from sibling npm packages rather than implemented here. There is no persistent storage; all state is per-app in-memory objects. Distribution is npm-only, driven by a GitHub release event.
- `index.js` is a three-line re-export of `lib/express.js`, and `package.json` restricts the published tarball to `LICENSE`, `Readme.md`, `index.js` and `lib/` — so `test/` and `examples/` never ship.
- `createApplication()` builds `app` as a closure that forwards to `app.handle(req, res, next)`, then uses `merge-descriptors` to mixin `EventEmitter.prototype` and the `application` proto (both with `redefine=false`), and finally calls `app.init()`.
- Per-app request/response prototypes are created with `Object.create(req, { app: {...value: app} })`, which is why every `req`/`res` getter can reach `this.app.get('trust proxy fn')` without a closure.
- Routing is not implemented in this repo: `lib/express.js` requires the external `router` package and re-exports `Router` and `Router.Route`; `app.router` is a lazy getter that instantiates `new Router({ caseSensitive, strict })` on first access.
- Body parsing is a pure re-export — `express.json`, `express.raw`, `express.text`, `express.urlencoded` all point straight at `body-parser`, and `express.static` at `serve-static`.
- All per-app state lives in three null-prototype objects created in `app.init()` — `this.cache` (compiled views), `this.engines` (extension→renderer), `this.settings` — plus `this.locals`; there is no database or persistence layer anywhere in `lib/`.
- `app.handle()` is the single dispatch boundary: it builds a `finalhandler` terminator, sets `X-Powered-By`, wires the `req.res`/`res.req` circular refs, swaps both prototypes with `Object.setPrototypeOf`, and delegates to `this.router.handle`.
- The external integration surface is 28 runtime dependencies, of which the load-bearing ones are `proxy-addr` (trust proxy), `qs`/`node:querystring` (query), `send`+`serve-static` (file IO), `etag`+`fresh` (conditional GET), `cookie`+`cookie-signature`, and `finalhandler`.
- There is no build step. The npm scripts are `lint` (eslint), `test` (mocha over `test/` and `test/acceptance/` with `--check-leaks`), `test-ci` (nyc → lcovonly), `test-cov` (nyc → html) and `test-tap`.
- CI runs a 2-OS × 9-Node matrix (ubuntu/windows × Node 18–26) in `ci.yml`, with a separate `legacy.yml` still exercising Node 16 and 17 despite `engines.node` declaring `>= 18`.
- Deployment is npm publish triggered by GitHub release `published`; the workflow derives the dist-tag from `package.json` version rather than the release branch (`next` for prereleases, `latest` for the newest major, `latest-<major>` for maintenance lines).
- Supply-chain hardening is explicit: `.npmrc` disables lockfiles, enforces a 7-day minimum release age, sets `ignore-scripts=true` and `allow-git=none`; every Action in CI is pinned to a full commit SHA.
- `app.listen()` is a thin wrapper over `http.createServer(this)` that only adds `once`-wrapped error forwarding when the last argument is a callback — HTTPS is left to the caller.
- Observability is limited to two `debug` namespaces, `express:application` and `express:view`; runtime errors reaching `finalhandler` are console-logged via `logerror` unless `env === 'test'`.