Router
HTTP route registration + dispatch. Operators register handlers against method+pattern pairs, the router compiles each pattern once at registration time and walks the table linearly per request — first match wins.
Patterns are segment-based (/users/:id); named parameters land on req.params. Handler dispatch follows arity: - handler.length >= 3 is middleware (req, res, next) — the chain stops unless next() is called. - handler.length <= 2 is a terminal handler (req, res) — the chain falls through to the next entry unless the response is already ended.
Before the middleware chain runs, the router matches the request against the table and publishes the matched pattern on req.routeLabel, or (unrouted) when no pattern matches. A middleware that rewrites req.pathname or req.method is matched again after the chain, and the dispatched route and the label both follow the rewrite.
When no pattern matches, the registered onNotFound handler runs; the framework default is a 404 with a small text/html body. The router boots an HTTP/2 + HTTP/1.1 ALPN server on listen() when given TLS options, an HTTP/1.1 server otherwise.
Zero npm runtime deps — this primitive replaces express / koa / fastify entirely while keeping the framework's security defaults (TLS 1.3 minimum, 0-RTT anti-replay, Slowloris timeouts, h2 CONTINUATION-flood + Rapid-Reset caps) wired in by default.
b.router.serveStatic(dir) #
Returns a middleware function that serves files from dir for GET requests whose req.pathname resolves inside dir. Path traversal (..) and NUL-byte filenames bypass the middleware (next()), as do directory listings and missing files. Sniffed Content-Type comes from a small extension table; unknown extensions fall back to application/octet-stream. Versioned URLs (?v=...) ship with a one-year immutable Cache-Control; un-versioned files get one hour.
For richer content-safety, byte-range requests, and the framework's full guard wiring, prefer b.staticServe.create over this helper.
var router = b.router.create();
router.use(b.router.serveStatic("/var/www/public"));
router.listen(3000);b.router.create(opts?) #
{
tls0Rtt: "refuse" | "replay-cache", // RFC 8446 §8 anti-replay; default "refuse"
allowedRedirectOrigins: string[], // exact-match HTTPS origins for cross-origin res.redirect()
}Builds a Router instance with the framework's security-on-by- default posture. Returned object exposes get / post / put / patch / delete for route registration, use(...) for middleware, ws(path, handler, opts?) for WebSocket routes, onNotFound(fn) and onError(fn) for fallthrough hooks, inspectRoutes() and openapi() for introspection, closeWebSockets({ timeoutMs }) for graceful shutdown, and listen(port, cb?, tlsOptions?, host?) which boots an HTTP/2-capable TLS server (ALPN h2 + http/1.1) when tlsOptions is provided, an HTTP/1.1 server otherwise.
use has two forms. use(mw) (and use(mw1, mw2, ...)) mounts global middleware that runs on every request. use(prefix, mw1, mw2, ...) mounts path-scoped middleware that runs only when the request path is at or beneath prefix, matched on segment boundaries — "/admin" covers "/admin" and "/admin/x" but not "/administrator". The prefix may be an array of strings to scope a gate to several path roots at once. Global and scoped middleware interleave in registration order, so a gate registered before a route still runs before it. A non-string / non-array prefix, a prefix not beginning with "/", or a non-function middleware throws at registration time rather than dropping the gate or 500-ing every request — scope a security middleware (csrf, bearerAuth, requireAal, requireMtls) to a path with confidence it runs exactly where mounted.
var router = b.router.create({
tls0Rtt: "refuse",
allowedRedirectOrigins: ["https://idp.example.com"],
});
router.get("/users/:id", function (req, res) {
res.json({ id: req.params.id });
});
// Global middleware — runs on every request.
router.use(b.middleware.securityHeaders());
// Path-scoped middleware — the step-up gate runs only under /admin.
router.use("/admin", b.middleware.requireAal({ minimum: "AAL2" }));
router.listen(3000);