4.13.2

closes #2717

.gitignore

@@ -1,19 +1,26 @@
-coverage.html
-.DS_Store
-lib-cov
-*.seed
+# OS X
+.DS_Store*
+Icon?
+._*
+
+# Windows
+Thumbs.db
+ehthumbs.db
+Desktop.ini
+
+# Linux
+.directory
+*~
+
+
+# npm
+node_modules
 *.log
-*.csv
-*.dat
-*.out
-*.pid
-*.swp
-*.swo
+*.gz
+
+
+# Coveralls
+coverage
+
+# Benchmarking
 benchmarks/graphs
-testing
-node_modules/
-testing
-.coverage_data
-cover_html
-test.js
-.idea

.npmignore

@@ -1,9 +0,0 @@
-.git*
-docs/
-examples/
-support/
-test/
-testing.js
-.DS_Store
-coverage.html
-lib-cov

.travis.yml

@@ -1,4 +1,12 @@
 language: node_js
 node_js:
-  - "0.8"
   - "0.10"
+  - "0.12"
+  - "1.0"
+  - "1.8"
+  - "2.0"
+  - "2.3"
+sudo: false
+before_install: "npm rm --save-dev connect-redis"
+script: "npm run-script test-ci"
+after_script: "npm install coveralls@2.10.0 && cat ./coverage/lcov.info | coveralls"

Contributing.md

@@ -0,0 +1,25 @@
+
+## Website Issues
+
+Issues for the expressjs.com website go here https://github.com/strongloop/expressjs.com
+
+## PRs and Code contributions
+
+* Tests must pass.
+* Follow existing coding style.
+* If you fix a bug, add a test.
+
+
+## Issues which are questions
+
+We will typically close any vague issues or questions that are specific to some app you are writing. Please double check the docs and other references before being trigger happy with posting a question issue.
+
+Things that will help get your question issue looked at:
+
+* Full and runnable JS code.
+* Clear description of the problem or unexpected behavior.
+* Clear description of the expected result.
+* Steps you have taken to debug it yourself.
+
+If you post a question and do not outline the above items or make it easy for us to understand and reproduce your issue, it will be closed.
+

LICENSE

@@ -1,6 +1,8 @@
 (The MIT License)
 
-Copyright (c) 2009-2011 TJ Holowaychuk <tj@vision-media.ca>
+Copyright (c) 2009-2014 TJ Holowaychuk <tj@vision-media.ca>
+Copyright (c) 2013-2014 Roman Shtylman <shtylman+expressjs@gmail.com>
+Copyright (c) 2014-2015 Douglas Christopher Wilson <doug@somethingdoug.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the
@@ -19,4 +21,4 @@ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
 IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
 CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
 TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Makefile

@@ -1,33 +0,0 @@
-
-MOCHA_OPTS= --check-leaks
-REPORTER = dot
-
-check: test
-
-test: test-unit test-acceptance
-
-test-unit:
-	@NODE_ENV=test ./node_modules/.bin/mocha \
-		--reporter $(REPORTER) \
-		$(MOCHA_OPTS)
-
-test-acceptance:
-	@NODE_ENV=test ./node_modules/.bin/mocha \
-		--reporter $(REPORTER) \
-		--bail \
-		test/acceptance/*.js
-
-test-cov: lib-cov
-	@EXPRESS_COV=1 $(MAKE) test REPORTER=html-cov > coverage.html
-
-lib-cov:
-	@jscoverage lib lib-cov
-
-benchmark:
-	@./support/bench
-
-clean:
-	rm -f coverage.html
-	rm -fr lib-cov
-
-.PHONY: test test-unit test-acceptance benchmark clean

Readme.md

@@ -1,179 +1,138 @@
-![express logo](http://f.cl.ly/items/0V2S1n0K1i3y1c122g04/Screen%20Shot%202012-04-11%20at%209.59.42%20AM.png)
+[![Express Logo](https://i.cloudup.com/zfY6lL7eFa-3000x3000.png)](http://expressjs.com/)
 
-  Fast, unopinionated, minimalist web framework for [node](http://nodejs.org). [![Build Status](https://secure.travis-ci.org/visionmedia/express.png)](http://travis-ci.org/visionmedia/express) [![Dependency Status](https://gemnasium.com/visionmedia/express.png)](https://gemnasium.com/visionmedia/express)
+  Fast, unopinionated, minimalist web framework for [node](http://nodejs.org).
+
+  [![NPM Version][npm-image]][npm-url]
+  [![NPM Downloads][downloads-image]][downloads-url]
+  [![Linux Build][travis-image]][travis-url]
+  [![Windows Build][appveyor-image]][appveyor-url]
+  [![Test Coverage][coveralls-image]][coveralls-url]
 
 ```js
-var express = require('express');
-var app = express();
+var express = require('express')
+var app = express()
 
-app.get('/', function(req, res){
-  res.send('Hello World');
-});
+app.get('/', function (req, res) {
+  res.send('Hello World')
+})
 
-app.listen(3000);
+app.listen(3000)
 ```
 
 ## Installation
 
-    $ npm install -g express
-
-## Quick Start
-
- The quickest way to get started with express is to utilize the executable `express(1)` to generate an application as shown below:
-
- Create the app:
-
-    $ npm install -g express
-    $ express /tmp/foo && cd /tmp/foo
-
- Install dependencies:
-
-    $ npm install
-
- Start the server:
-
-    $ node app
+```bash
+$ npm install express
+```
 
 ## Features
 
-  * Built on [Connect](http://github.com/senchalabs/connect)
   * Robust routing
+  * Focus on high performance
+  * Super-high test coverage
   * HTTP helpers (redirection, caching, etc)
   * View system supporting 14+ template engines
   * Content negotiation
-  * Focus on high performance
-  * Environment based configuration
   * Executable for generating applications quickly
-  * High test coverage
+
+## Docs & Community
+
+  * [Website and Documentation](http://expressjs.com/) - [[website repo](https://github.com/strongloop/expressjs.com)]
+  * [#express](https://webchat.freenode.net/?channels=express) on freenode IRC
+  * [Github Organization](https://github.com/expressjs) for Official Middleware & Modules
+  * Visit the [Wiki](https://github.com/strongloop/express/wiki)
+  * [Google Group](https://groups.google.com/group/express-js) for discussion
+  * [Русскоязычная документация](http://jsman.ru/express/)
+  * [한국어 문서](http://expressjs.kr) - [[website repo](https://github.com/Hanul/expressjs.kr)]
+
+**PROTIP** Be sure to read [Migrating from 3.x to 4.x](https://github.com/strongloop/express/wiki/Migrating-from-3.x-to-4.x) as well as [New features in 4.x](https://github.com/strongloop/express/wiki/New-features-in-4.x).
+
+## Quick Start
+
+  The quickest way to get started with express is to utilize the executable [`express(1)`](https://github.com/expressjs/generator) to generate an application as shown below:
+
+  Install the executable. The executable's major version will match Express's:
+
+```bash
+$ npm install -g express-generator@4
+```
+
+  Create the app:
+
+```bash
+$ express /tmp/foo && cd /tmp/foo
+```
+
+  Install dependencies:
+
+```bash
+$ npm install
+```
+
+  Start the server:
+
+```bash
+$ npm start
+```
 
 ## Philosophy
 
-  The Express philosophy is to provide small, robust tooling for HTTP servers. Making
+  The Express philosophy is to provide small, robust tooling for HTTP servers, making
   it a great solution for single page applications, web sites, hybrids, or public
   HTTP APIs.
 
-  Built on Connect you can use _only_ what you need, and nothing more, applications
-  can be as big or as small as you like, even a single file. Express does
-  not force you to use any specific ORM or template engine. With support for over
-  14 template engines via [Consolidate.js](http://github.com/visionmedia/consolidate.js)
+  Express does not force you to use any specific ORM or template engine. With support for over
+  14 template engines via [Consolidate.js](https://github.com/tj/consolidate.js),
   you can quickly craft your perfect framework.
 
-## More Information
+## Examples
 
-  * Join #express on freenode
-  * [Google Group](http://groups.google.com/group/express-js) for discussion
-  * Follow [tjholowaychuk](http://twitter.com/tjholowaychuk) on twitter for updates
-  * Visit the [Wiki](http://github.com/visionmedia/express/wiki)
-  * [Русскоязычная документация](http://jsman.ru/express/)
-  * Run express examples [online](https://runnable.com/express)
-
-## Viewing Examples
-
-Clone the Express repo, then install the dev dependencies to install all the example / test suite deps:
-
-    $ git clone git://github.com/visionmedia/express.git --depth 1
-    $ cd express
-    $ npm install
-
-then run whichever tests you want:
-
-    $ node examples/content-negotiation
-
-## Running Tests
-
-To run the test suite first invoke the following command within the repo, installing the development dependencies:
-
-    $ npm install
-
-then run the tests:
-
-    $ make test
-
-## Contributors
+  To view the examples, clone the Express repo and install the dependencies:
 
+```bash
+$ git clone git://github.com/strongloop/express.git --depth 1
+$ cd express
+$ npm install
 ```
-project: express
-commits: 3559
-active : 468 days
-files  : 237
-authors:
- 1891	Tj Holowaychuk          53.1%
- 1285	visionmedia             36.1%
-  182	TJ Holowaychuk          5.1%
-   54	Aaron Heckmann          1.5%
-   34	csausdev                1.0%
-   26	ciaranj                 0.7%
-   21	Robert Sköld            0.6%
-    6	Guillermo Rauch         0.2%
-    3	Dav Glass               0.1%
-    3	Nick Poulden            0.1%
-    2	Randy Merrill           0.1%
-    2	Benny Wong              0.1%
-    2	Hunter Loftis           0.1%
-    2	Jake Gordon             0.1%
-    2	Brian McKinney          0.1%
-    2	Roman Shtylman          0.1%
-    2	Ben Weaver              0.1%
-    2	Dave Hoover             0.1%
-    2	Eivind Fjeldstad        0.1%
-    2	Daniel Shaw             0.1%
-    1	Matt Colyer             0.0%
-    1	Pau Ramon               0.0%
-    1	Pero Pejovic            0.0%
-    1	Peter Rekdal Sunde      0.0%
-    1	Raynos                  0.0%
-    1	Teng Siong Ong          0.0%
-    1	Viktor Kelemen          0.0%
-    1	ctide                   0.0%
-    1	8bitDesigner            0.0%
-    1	isaacs                  0.0%
-    1	mgutz                   0.0%
-    1	pikeas                  0.0%
-    1	shuwatto                0.0%
-    1	tstrimple               0.0%
-    1	ewoudj                  0.0%
-    1	Adam Sanderson          0.0%
-    1	Andrii Kostenko         0.0%
-    1	Andy Hiew               0.0%
-    1	Arpad Borsos            0.0%
-    1	Ashwin Purohit          0.0%
-    1	Benjen                  0.0%
-    1	Darren Torpey           0.0%
-    1	Greg Ritter             0.0%
-    1	Gregory Ritter          0.0%
-    1	James Herdman           0.0%
-    1	Jim Snodgrass           0.0%
-    1	Joe McCann              0.0%
-    1	Jonathan Dumaine        0.0%
-    1	Jonathan Palardy        0.0%
-    1	Jonathan Zacsh          0.0%
-    1	Justin Lilly            0.0%
-    1	Ken Sato                0.0%
-    1	Maciej Małecki          0.0%
-    1	Masahiro Hayashi        0.0%
+
+  Then run whichever example you want:
+
+```bash
+$ node examples/content-negotiation
 ```
 
+## Tests
+
+  To run the test suite, first install the dependencies, then run `npm test`:
+
+```bash
+$ npm install
+$ npm test
+```
+
+## People
+
+The original author of Express is [TJ Holowaychuk](https://github.com/tj) [![TJ's Gratipay][gratipay-image-visionmedia]][gratipay-url-visionmedia]
+
+The current lead maintainer is [Douglas Christopher Wilson](https://github.com/dougwilson) [![Doug's Gratipay][gratipay-image-dougwilson]][gratipay-url-dougwilson]
+
+[List of all contributors](https://github.com/strongloop/express/graphs/contributors)
+
 ## License
 
-(The MIT License)
+  [MIT](LICENSE)
 
-Copyright (c) 2009-2012 TJ Holowaychuk <tj@vision-media.ca>
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-'Software'), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
-IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
-CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
-SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+[npm-image]: https://img.shields.io/npm/v/express.svg
+[npm-url]: https://npmjs.org/package/express
+[downloads-image]: https://img.shields.io/npm/dm/express.svg
+[downloads-url]: https://npmjs.org/package/express
+[travis-image]: https://img.shields.io/travis/strongloop/express/master.svg?label=linux
+[travis-url]: https://travis-ci.org/strongloop/express
+[appveyor-image]: https://img.shields.io/appveyor/ci/dougwilson/express/master.svg?label=windows
+[appveyor-url]: https://ci.appveyor.com/project/dougwilson/express
+[coveralls-image]: https://img.shields.io/coveralls/strongloop/express/master.svg
+[coveralls-url]: https://coveralls.io/r/strongloop/express?branch=master
+[gratipay-image-visionmedia]: https://img.shields.io/gratipay/visionmedia.svg
+[gratipay-url-visionmedia]: https://gratipay.com/visionmedia/
+[gratipay-image-dougwilson]: https://img.shields.io/gratipay/dougwilson.svg
+[gratipay-url-dougwilson]: https://gratipay.com/dougwilson/

appveyor.yml

@@ -0,0 +1,18 @@
+environment:
+  matrix:
+    - nodejs_version: "0.10"
+    - nodejs_version: "0.12"
+    - nodejs_version: "1.0"
+    - nodejs_version: "1.8"
+    - nodejs_version: "2.0"
+    - nodejs_version: "2.3"
+install:
+  - ps: Install-Product node $env:nodejs_version
+  - npm rm --save-dev connect-redis
+  - npm install
+build: off
+test_script:
+  - node --version
+  - npm --version
+  - npm run test-ci
+version: "{build}"

benchmarks/Makefile

@@ -0,0 +1,13 @@
+
+all:
+	@./run 1 middleware
+	@./run 5 middleware
+	@./run 10 middleware
+	@./run 15 middleware
+	@./run 20 middleware
+	@./run 30 middleware
+	@./run 50 middleware
+	@./run 100 middleware
+	@echo
+
+.PHONY: all

benchmarks/middleware.js

@@ -0,0 +1,23 @@
+
+var http = require('http');
+var express = require('..');
+var app = express();
+
+// number of middleware
+
+var n = parseInt(process.env.MW || '1', 10);
+console.log('  %s middleware', n);
+
+while (n--) {
+  app.use(function(req, res, next){
+    next();
+  });
+}
+
+var body = new Buffer('Hello World');
+
+app.use(function(req, res, next){
+  res.send(body);
+});
+
+app.listen(3333);

benchmarks/run

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+echo
+MW=$1 node $2 &
+pid=$!
+
+sleep 2
+
+wrk 'http://localhost:3333/?foo[bar]=baz' \
+  -d 3 \
+  -c 50 \
+  -t 8 \
+  | grep 'Requests/sec' \
+  | awk '{ print "  " $2 }'
+
+kill $pid

bin/express

@@ -1,422 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Module dependencies.
- */
-
-var exec = require('child_process').exec
-  , program = require('commander')
-  , mkdirp = require('mkdirp')
-  , pkg = require('../package.json')
-  , version = pkg.version
-  , os = require('os')
-  , fs = require('fs');
-
-// CLI
-
-program
-  .version(version)
-  .option('-s, --sessions', 'add session support')
-  .option('-e, --ejs', 'add ejs engine support (defaults to jade)')
-  .option('-J, --jshtml', 'add jshtml engine support (defaults to jade)')
-  .option('-H, --hogan', 'add hogan.js engine support')
-  .option('-c, --css <engine>', 'add stylesheet <engine> support (less|stylus) (defaults to plain css)')
-  .option('-f, --force', 'force on non-empty directory')
-  .parse(process.argv);
-
-// Path
-
-var path = program.args.shift() || '.';
-
-// end-of-line code
-
-var eol = os.EOL
-
-// Template engine
-
-program.template = 'jade';
-if (program.ejs) program.template = 'ejs';
-if (program.jshtml) program.template = 'jshtml';
-if (program.hogan) program.template = 'hjs';
-
-/**
- * Routes index template.
- */
-
-var index = [
-    ''
-  , '/*'
-  , ' * GET home page.'
-  , ' */'
-  , ''
-  , 'exports.index = function(req, res){'
-  , '  res.render(\'index\', { title: \'Express\' });'
-  , '};'
-].join(eol);
-
-/**
- * Routes users template.
- */
-
-var users = [
-    ''
-  , '/*'
-  , ' * GET users listing.'
-  , ' */'
-  , ''
-  , 'exports.list = function(req, res){'
-  , '  res.send("respond with a resource");'
-  , '};'
-].join(eol);
-
-/**
- * Jade layout template.
- */
-
-var jadeLayout = [
-    'doctype 5'
-  , 'html'
-  , '  head'
-  , '    title= title'
-  , '    link(rel=\'stylesheet\', href=\'/stylesheets/style.css\')'
-  , '  body'
-  , '    block content'
-].join(eol);
-
-/**
- * Jade index template.
- */
-
-var jadeIndex = [
-    'extends layout'
-  , ''
-  , 'block content'
-  , '  h1= title'
-  , '  p Welcome to #{title}'
-].join(eol);
-
-/**
- * EJS index template.
- */
-
-var ejsIndex = [
-    '<!DOCTYPE html>'
-  , '<html>'
-  , '  <head>'
-  , '    <title><%= title %></title>'
-  , '    <link rel=\'stylesheet\' href=\'/stylesheets/style.css\' />'
-  , '  </head>'
-  , '  <body>'
-  , '    <h1><%= title %></h1>'
-  , '    <p>Welcome to <%= title %></p>'
-  , '  </body>'
-  , '</html>'
-].join(eol);
-
-/**
- * JSHTML layout template.
- */
-
-var jshtmlLayout = [
-    '<!DOCTYPE html>'
-  , '<html>'
-  , '  <head>'
-  , '    <title> @write(title) </title>'
-  , '    <link rel=\'stylesheet\' href=\'/stylesheets/style.css\' />'
-  , '  </head>'
-  , '  <body>'
-  , '    @write(body)'
-  , '  </body>'
-  , '</html>'
-].join(eol);
-
-/**
- * JSHTML index template.
- */
-
-var jshtmlIndex = [
-    '<h1>@write(title)</h1>'
-  , '<p>Welcome to @write(title)</p>'
-].join(eol);
-
-/**
- * Hogan.js index template.
- */
-var hoganIndex = [
-    '<!DOCTYPE html>'
-  , '<html>'
-  , '  <head>'
-  , '    <title>{{ title }}</title>'
-  , '    <link rel=\'stylesheet\' href=\'/stylesheets/style.css\' />'
-  , '  </head>'
-  , '  <body>'
-  , '    <h1>{{ title }}</h1>'
-  , '    <p>Welcome to {{ title }}</p>'
-  , '  </body>'
-  , '</html>'
-].join(eol);
-
-/**
- * Default css template.
- */
-
-var css = [
-    'body {'
-  , '  padding: 50px;'
-  , '  font: 14px "Lucida Grande", Helvetica, Arial, sans-serif;'
-  , '}'
-  , ''
-  , 'a {'
-  , '  color: #00B7FF;'
-  , '}'
-].join(eol);
-
-/**
- * Default less template.
- */
-
-var less = [
-    'body {'
-  , '  padding: 50px;'
-  , '  font: 14px "Lucida Grande", Helvetica, Arial, sans-serif;'
-  , '}'
-  , ''
-  , 'a {'
-  , '  color: #00B7FF;'
-  , '}'
-].join(eol);
-
-/**
- * Default stylus template.
- */
-
-var stylus = [
-    'body'
-  , '  padding: 50px'
-  , '  font: 14px "Lucida Grande", Helvetica, Arial, sans-serif'
-  , 'a'
-  , '  color: #00B7FF'
-].join(eol);
-
-/**
- * App template.
- */
-
-var app = [
-    ''
-  , '/**'
-  , ' * Module dependencies.'
-  , ' */'
-  , ''
-  , 'var express = require(\'express\')'
-  , '  , routes = require(\'./routes\')'
-  , '  , user = require(\'./routes/user\')'
-  , '  , http = require(\'http\')'
-  , '  , path = require(\'path\');'
-  , ''
-  , 'var app = express();'
-  , ''
-  , '// all environments'
-  , 'app.set(\'port\', process.env.PORT || 3000);'
-  , 'app.set(\'views\', __dirname + \'/views\');'
-  , 'app.set(\'view engine\', \':TEMPLATE\');'
-  , 'app.use(express.favicon());'
-  , 'app.use(express.logger(\'dev\'));'
-  , 'app.use(express.bodyParser());'
-  , 'app.use(express.methodOverride());{sess}'
-  , 'app.use(app.router);{css}'
-  , 'app.use(express.static(path.join(__dirname, \'public\')));'
-  , ''
-  , '// development only'
-  , 'if (\'development\' == app.get(\'env\')) {'
-  , '  app.use(express.errorHandler());'
-  , '}'
-  , ''
-  , 'app.get(\'/\', routes.index);'
-  , 'app.get(\'/users\', user.list);'
-  , ''
-  , 'http.createServer(app).listen(app.get(\'port\'), function(){'
-  , '  console.log(\'Express server listening on port \' + app.get(\'port\'));'
-  , '});'
-  , ''
-].join(eol);
-
-// Generate application
-
-(function createApplication(path) {
-  emptyDirectory(path, function(empty){
-    if (empty || program.force) {
-      createApplicationAt(path);
-    } else {
-      program.confirm('destination is not empty, continue? ', function(ok){
-        if (ok) {
-          process.stdin.destroy();
-          createApplicationAt(path);
-        } else {
-          abort('aborting');
-        }
-      });
-    }
-  });
-})(path);
-
-/**
- * Create application at the given directory `path`.
- *
- * @param {String} path
- */
-
-function createApplicationAt(path) {
-  console.log();
-  process.on('exit', function(){
-    console.log();
-    console.log('   install dependencies:');
-    console.log('     $ cd %s && npm install', path);
-    console.log();
-    console.log('   run the app:');
-    console.log('     $ node app');
-    console.log();
-  });
-
-  mkdir(path, function(){
-    mkdir(path + '/public');
-    mkdir(path + '/public/javascripts');
-    mkdir(path + '/public/images');
-    mkdir(path + '/public/stylesheets', function(){
-      switch (program.css) {
-        case 'less':
-          write(path + '/public/stylesheets/style.less', less);
-          break;
-        case 'stylus':
-          write(path + '/public/stylesheets/style.styl', stylus);
-          break;
-        default:
-          write(path + '/public/stylesheets/style.css', css);
-      }
-    });
-
-    mkdir(path + '/routes', function(){
-      write(path + '/routes/index.js', index);
-      write(path + '/routes/user.js', users);
-    });
-
-    mkdir(path + '/views', function(){
-      switch (program.template) {
-        case 'ejs':
-          write(path + '/views/index.ejs', ejsIndex);
-          break;
-        case 'jade':
-          write(path + '/views/layout.jade', jadeLayout);
-          write(path + '/views/index.jade', jadeIndex);
-          break;
-        case 'jshtml':
-          write(path + '/views/layout.jshtml', jshtmlLayout);
-          write(path + '/views/index.jshtml', jshtmlIndex);
-          break;
-        case 'hjs':
-          write(path + '/views/index.hjs', hoganIndex);
-          break;
-
-      }
-    });
-
-    // CSS Engine support
-    switch (program.css) {
-      case 'less':
-        app = app.replace('{css}', eol + 'app.use(require(\'less-middleware\')({ src: __dirname + \'/public\' }));');
-        break;
-      case 'stylus':
-        app = app.replace('{css}', eol + 'app.use(require(\'stylus\').middleware(__dirname + \'/public\'));');
-        break;
-      default:
-        app = app.replace('{css}', '');
-    }
-
-    // Session support
-    app = app.replace('{sess}', program.sessions
-      ? eol + 'app.use(express.cookieParser(\'your secret here\'));' + eol + 'app.use(express.session());'
-      : '');
-
-    // Template support
-    app = app.replace(':TEMPLATE', program.template);
-
-    // package.json
-    var pkg = {
-        name: 'application-name'
-      , version: '0.0.1'
-      , private: true
-      , scripts: { start: 'node app.js' }
-      , dependencies: {
-        express: version
-      }
-    }
-
-    if (program.template) pkg.dependencies[program.template] = '*';
-
-    // CSS Engine support
-    switch (program.css) {
-      case 'less':
-        pkg.dependencies['less-middleware'] = '*';
-        break;
-      default:
-        if (program.css) {
-          pkg.dependencies[program.css] = '*';
-        }
-    }
-
-    write(path + '/package.json', JSON.stringify(pkg, null, 2));
-    write(path + '/app.js', app);
-  });
-}
-
-/**
- * Check if the given directory `path` is empty.
- *
- * @param {String} path
- * @param {Function} fn
- */
-
-function emptyDirectory(path, fn) {
-  fs.readdir(path, function(err, files){
-    if (err && 'ENOENT' != err.code) throw err;
-    fn(!files || !files.length);
-  });
-}
-
-/**
- * echo str > path.
- *
- * @param {String} path
- * @param {String} str
- */
-
-function write(path, str) {
-  fs.writeFile(path, str);
-  console.log('   \x1b[36mcreate\x1b[0m : ' + path);
-}
-
-/**
- * Mkdir -p.
- *
- * @param {String} path
- * @param {Function} fn
- */
-
-function mkdir(path, fn) {
-  mkdirp(path, 0755, function(err){
-    if (err) throw err;
-    console.log('   \033[36mcreate\033[0m : ' + path);
-    fn && fn();
-  });
-}
-
-/**
- * Exit with the given `str`.
- *
- * @param {String} str
- */
-
-function abort(str) {
-  console.error(str);
-  process.exit(1);
-}

examples/auth/index.js

@@ -2,8 +2,10 @@
  * Module dependencies.
  */
 
-var express = require('../..')
-  , hash = require('./pass').hash;
+var express = require('../..');
+var hash = require('./pass').hash;
+var bodyParser = require('body-parser');
+var session = require('express-session');
 
 var app = module.exports = express();
 
@@ -14,15 +16,18 @@ app.set('views', __dirname + '/views');
 
 // middleware
 
-app.use(express.bodyParser());
-app.use(express.cookieParser('shhhh, very secret'));
-app.use(express.session());
+app.use(bodyParser.urlencoded({ extended: false }));
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'shhhh, very secret'
+}));
 
 // Session-persisted message middleware
 
 app.use(function(req, res, next){
-  var err = req.session.error
-    , msg = req.session.success;
+  var err = req.session.error;
+  var msg = req.session.success;
   delete req.session.error;
   delete req.session.success;
   res.locals.message = '';
@@ -62,7 +67,7 @@ function authenticate(name, pass, fn) {
     if (err) return fn(err);
     if (hash == user.hash) return fn(null, user);
     fn(new Error('invalid password'));
-  })
+  });
 }
 
 function restrict(req, res, next) {
@@ -75,7 +80,7 @@ function restrict(req, res, next) {
 }
 
 app.get('/', function(req, res){
-  res.redirect('login');
+  res.redirect('/login');
 });
 
 app.get('/restricted', restrict, function(req, res){
@@ -98,9 +103,9 @@ app.post('/login', function(req, res){
   authenticate(req.body.username, req.body.password, function(err, user){
     if (user) {
       // Regenerate session when signing in
-      // to prevent fixation 
+      // to prevent fixation
       req.session.regenerate(function(){
-        // Store the user's primary key 
+        // Store the user's primary key
         // in the session store to be retrieved,
         // or in this case the entire user object
         req.session.user = user;
@@ -113,11 +118,12 @@ app.post('/login', function(req, res){
       req.session.error = 'Authentication failed, please check your '
         + ' username and password.'
         + ' (use "tj" and "foobar")';
-      res.redirect('login');
+      res.redirect('/login');
     }
   });
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');

examples/auth/pass.js

@@ -1,5 +1,5 @@
 
-// check out https://github.com/visionmedia/node-pwd
+// check out https://github.com/tj/node-pwd
 
 /**
  * Module dependencies.
@@ -32,7 +32,7 @@ var iterations = 12000;
 exports.hash = function (pwd, salt, fn) {
   if (3 == arguments.length) {
     crypto.pbkdf2(pwd, salt, iterations, len, function(err, hash){
-      fn(err, (new Buffer(hash, 'binary')).toString('base64'));
+      fn(err, hash.toString('base64'));
     });
   } else {
     fn = salt;
@@ -41,8 +41,8 @@ exports.hash = function (pwd, salt, fn) {
       salt = salt.toString('base64');
       crypto.pbkdf2(pwd, salt, iterations, len, function(err, hash){
         if (err) return fn(err);
-        fn(null, salt, (new Buffer(hash, 'binary')).toString('base64'));
+        fn(null, salt, hash.toString('base64'));
       });
     });
   }
-};
+};

examples/big-view/index.js

@@ -1,6 +1,10 @@
+/**
+ * Module dependencies.
+ */
 
-var express = require('../..')
-  , app = express();
+var express = require('../..');
+var logger = require('morgan');
+var app = express();
 
 app.set('views', __dirname);
 app.set('view engine', 'jade');
@@ -14,11 +18,14 @@ while (n--) {
   pets.push({ name: 'Jane', age: 6, species: 'ferret' });
 }
 
-app.use(express.logger('dev'));
+app.use(logger('dev'));
 
 app.get('/', function(req, res){
   res.render('pets', { pets: pets });
 });
 
-app.listen(3000);
-console.log('Express listening on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/content-negotiation/db.js

@@ -1,4 +1,3 @@
-
 var users = [];
 
 users.push({ name: 'Tobi' });

examples/content-negotiation/index.js

@@ -1,8 +1,9 @@
+var express = require('../../');
+var app = module.exports = express();
+var users = require('./db');
 
-var express = require('../../')
-  , app = module.exports = express()
-  , users = require('./db');
-
+// so either you can deal with different types of formatting
+// for expected response in index.js
 app.get('/', function(req, res){
   res.format({
     html: function(){
@@ -20,22 +21,24 @@ app.get('/', function(req, res){
     json: function(){
       res.json(users);
     }
-  })
+  });
 });
 
 // or you could write a tiny middleware like
-// this to abstract make things a bit more declarative:
+// this to add a layer of abstraction
+// and make things a bit more declarative:
 
-function format(mod) {
-  var obj = require(mod);
+function format(path) {
+  var obj = require(path);
   return function(req, res){
     res.format(obj);
-  }
+  };
 }
 
 app.get('/users', format('./users'));
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  console.log('listening on port 3000');
-}
+  console.log('Express started on port 3000');
+}

examples/cookie-sessions/index.js

@@ -1,20 +1,14 @@
-
 /**
  * Module dependencies.
  */
 
+var cookieSession = require('cookie-session');
 var express = require('../../');
 
 var app = module.exports = express();
 
-// ignore GET /favicon.ico
-app.use(express.favicon());
-
-// pass a secret to cookieParser() for signed cookies
-app.use(express.cookieParser('manny is cool'));
-
 // add req.session cookie support
-app.use(express.cookieSession());
+app.use(cookieSession({ secret: 'manny is cool' }));
 
 // do something with the session
 app.use(count);
@@ -26,7 +20,8 @@ function count(req, res) {
   res.send('viewed ' + n + ' times\n');
 }
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  console.log('Express server listening on port 3000');
-}
+  console.log('Express started on port 3000');
+}

examples/cookies/index.js

@@ -1,31 +1,24 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../../')
-  , app = module.exports = express();
-
-
-// add favicon() before logger() so
-// GET /favicon.ico requests are not
-// logged, because this middleware
-// reponds to /favicon.ico and does not
-// call next()
-app.use(express.favicon());
+var express = require('../../');
+var app = module.exports = express();
+var logger = require('morgan');
+var cookieParser = require('cookie-parser');
+var bodyParser = require('body-parser');
 
 // custom log format
-if ('test' != process.env.NODE_ENV)
-  app.use(express.logger(':method :url'));
+if ('test' != process.env.NODE_ENV) app.use(logger(':method :url'));
 
 // parses request cookies, populating
 // req.cookies and req.signedCookies
-// when the secret is passed, used 
+// when the secret is passed, used
 // for signing the cookies.
-app.use(express.cookieParser('my secret here'));
+app.use(cookieParser('my secret here'));
 
-// parses json, x-www-form-urlencoded, and multipart/form-data
-app.use(express.bodyParser());
+// parses x-www-form-urlencoded
+app.use(bodyParser.urlencoded({ extended: false }));
 
 app.get('/', function(req, res){
   if (req.cookies.remember) {
@@ -48,7 +41,8 @@ app.post('/', function(req, res){
   res.redirect('back');
 });
 
-if (!module.parent){
+/* istanbul ignore next */
+if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
+}

examples/cors/index.js

@@ -1,46 +0,0 @@
-/**
- * Module dependencies.
- */
-
-var express = require('../..')
-  , app = express()
-  , api = express();
-
-// app middleware
-
-app.use(express.static(__dirname + '/public'));
-
-// api middleware
-
-api.use(express.logger('dev'));
-api.use(express.bodyParser());
-
-/**
- * CORS support.
- */
-
-api.all('*', function(req, res, next){
-  if (!req.get('Origin')) return next();
-  // use "*" here to accept any origin
-  res.set('Access-Control-Allow-Origin', 'http://localhost:3000');
-  res.set('Access-Control-Allow-Methods', 'GET, POST');
-  res.set('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type');
-  // res.set('Access-Control-Allow-Max-Age', 3600);
-  if ('OPTIONS' == req.method) return res.send(200);
-  next();
-});
-
-/**
- * POST a user.
- */
-
-api.post('/user', function(req, res){
-  console.log(req.body);
-  res.send(201);
-});
-
-app.listen(3000);
-api.listen(3001);
-
-console.log('app listening on 3000');
-console.log('api listening on 3001');

examples/cors/public/index.html

@@ -1,12 +0,0 @@
-<!DOCTYPE html>
-<html>
-  <body>
-    <script>
-      var req = new XMLHttpRequest;
-      req.open('POST', 'http://localhost:3001/user', false);
-      req.setRequestHeader('Content-Type', 'application/json');
-      req.send('{"name":"tobi","species":"ferret"}');
-      console.log(req.responseText);
-    </script>
-  </body>
-</html>

examples/downloads/files/CCTV大赛上海分赛区.txt

@@ -0,0 +1,2 @@
+Only for test.
+The file name is faked.

examples/downloads/index.js

@@ -1,44 +1,35 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../../')
-  , app = module.exports = express();
+var express = require('../../');
+var app = module.exports = express();
 
 app.get('/', function(req, res){
   res.send('<ul>'
     + '<li>Download <a href="/files/amazing.txt">amazing.txt</a>.</li>'
     + '<li>Download <a href="/files/missing.txt">missing.txt</a>.</li>'
+    + '<li>Download <a href="/files/CCTV大赛上海分赛区.txt">CCTV大赛上海分赛区.txt</a>.</li>'
     + '</ul>');
 });
 
 // /files/* is accessed via req.params[0]
 // but here we name it :file
 app.get('/files/:file(*)', function(req, res, next){
-  var file = req.params.file
-    , path = __dirname + '/files/' + file;
+  var file = req.params.file;
+  var path = __dirname + '/files/' + file;
 
-  res.download(path);
-});
-
-// error handling middleware. Because it's
-// below our routes, you will be able to
-// "intercept" errors, otherwise Connect
-// will respond with 500 "Internal Server Error".
-app.use(function(err, req, res, next){
-  // special-case 404s,
-  // remember you could
-  // render a 404 template here
-  if (404 == err.status) {
+  res.download(path, function(err){
+    if (!err) return; // file sent
+    if (err && err.status !== 404) return next(err); // non-404 error
+    // file for download not found
     res.statusCode = 404;
     res.send('Cant find that file, sorry!');
-  } else {
-    next(err);
-  }
+  });
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
+}

examples/ejs/index.js

@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
@@ -44,7 +43,8 @@ app.get('/', function(req, res){
   });
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  console.log('Express app started on port 3000');
+  console.log('Express started on port 3000');
 }

examples/error-pages/index.js

@@ -2,13 +2,14 @@
  * Module dependencies.
  */
 
-var express = require('../../')
-  , app = module.exports = express()
-  , silent = 'test' == process.env.NODE_ENV;
+var express = require('../../');
+var app = module.exports = express();
+var logger = require('morgan');
+var silent = 'test' == process.env.NODE_ENV;
 
 // general config
 app.set('views', __dirname + '/views');
-app.set('view engine', 'jade');
+app.set('view engine', 'ejs');
 
 // our custom "verbose errors" setting
 // which we can use in the templates
@@ -17,22 +18,36 @@ app.enable('verbose errors');
 
 // disable them in production
 // use $ NODE_ENV=production node examples/error-pages
-if ('production' == app.settings.env) {
-  app.disable('verbose errors');
-}
+if ('production' == app.settings.env) app.disable('verbose errors');
 
-app.use(express.favicon());
+silent || app.use(logger('dev'));
 
-silent || app.use(express.logger('dev'));
+// Routes
 
-// "app.router" positions our routes 
-// above the middleware defined below,
-// this means that Express will attempt
-// to match & call routes _before_ continuing
-// on, at which point we assume it's a 404 because
-// no route has handled the request.
+app.get('/', function(req, res){
+  res.render('index.ejs');
+});
 
-app.use(app.router);
+app.get('/404', function(req, res, next){
+  // trigger a 404 since no other middleware
+  // will match /404 after this one, and we're not
+  // responding here
+  next();
+});
+
+app.get('/403', function(req, res, next){
+  // trigger a 403 error
+  var err = new Error('not allowed!');
+  err.status = 403;
+  next(err);
+});
+
+app.get('/500', function(req, res, next){
+  // trigger a generic (500) error
+  next(new Error('keyboard cat!'));
+});
+
+// Error handlers
 
 // Since this is the last non-error-handling
 // middleware use()d, we assume 404, as nothing else
@@ -44,7 +59,7 @@ app.use(app.router);
 
 app.use(function(req, res, next){
   res.status(404);
-  
+
   // respond with html page
   if (req.accepts('html')) {
     res.render('404', { url: req.url });
@@ -81,32 +96,8 @@ app.use(function(err, req, res, next){
   res.render('500', { error: err });
 });
 
-// Routes
-
-app.get('/', function(req, res){
-  res.render('index.jade');
-});
-
-app.get('/404', function(req, res, next){
-  // trigger a 404 since no other middleware
-  // will match /404 after this one, and we're not
-  // responding here
-  next();
-});
-
-app.get('/403', function(req, res, next){
-  // trigger a 403 error
-  var err = new Error('not allowed!');
-  err.status = 403;
-  next(err);
-});
-
-app.get('/500', function(req, res, next){
-  // trigger a generic (500) error
-  next(new Error('keyboard cat!'));
-});
-
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  silent || console.log('Express started on port 3000');
-}
+  console.log('Express started on port 3000');
+}

examples/error-pages/views/404.ejs

@@ -0,0 +1,3 @@
+<% include error_header %>
+<h2>Cannot find <%= url %></h2>
+<% include footer %>

examples/error-pages/views/404.jade

@@ -1,5 +0,0 @@
-
-extends error
-
-block content
-  h2 Cannot find #{url}

examples/error-pages/views/500.ejs

@@ -0,0 +1,8 @@
+<% include error_header %>
+<h2>Error: <%= error.message %></h2>
+<% if (settings['verbose errors']) { %>
+  <pre><%= error.stack %></pre>
+<% } else { %>
+  <p>An error occurred!</p>
+<% } %>
+<% include footer %>

examples/error-pages/views/500.jade

@@ -1,13 +0,0 @@
-
-// note that we extend a different
-// layout with jade for 4xx & 5xx
-// responses
-
-extends error
-
-block content
-  h1 Error: #{error.message}
-  if settings['verbose errors']
-    pre= error.stack
-  else
-    p An error ocurred!

examples/error-pages/views/error.jade

@@ -1,6 +0,0 @@
-html
-  head 
-    title Error
-  body
-    h1 An error occurred!
-    block content

examples/error-pages/views/error_header.ejs

@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Error</title>
+</head>
+
+<body>
+<h1>An error occurred!</h1>

examples/error-pages/views/footer.ejs

@@ -0,0 +1,2 @@
+</body>
+</html>

examples/error-pages/views/index.ejs

@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Custom Pages Example</title>
+</head>
+
+<body>
+<h1>My Site</h1>
+<h2>Pages Example</h2>
+
+<ul>
+<li>visit <a href="/500">500</a></li>
+<li>visit <a href="/404">404</a></li>
+<li>visit <a href="/403">403</a></li>
+</ul>
+
+</body>
+</html>

examples/error-pages/views/index.jade

@@ -1,15 +0,0 @@
-
-extends layout
-
-block content
-  h2 Pages Example
-  ul
-    li 
-      | visit 
-      a(href="/500") 500
-    li
-      | visit 
-      a(href="/404") 404
-    li
-      | visit 
-      a(href='/403') 403

examples/error-pages/views/layout.jade

@@ -1,6 +0,0 @@
-html
-  head 
-    title Custom Pages Example
-  body
-    h1 My Site
-    block content

examples/error/index.js

@@ -1,20 +1,13 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../../')
-  , app = module.exports = express()
-  , test = app.get('env') == 'test';
+var express = require('../../');
+var logger = require('morgan');
+var app = module.exports = express();
+var test = app.get('env') == 'test';
 
-if (!test) app.use(express.logger('dev'));
-app.use(app.router);
-
-// the error handler is strategically
-// placed *below* the app.router; if it
-// were above it would not receive errors
-// from app.get() etc 
-app.use(error);
+if (!test) app.use(logger('dev'));
 
 // error handling middleware have an arity of 4
 // instead of the typical (req, res, next),
@@ -27,7 +20,8 @@ function error(err, req, res, next) {
   if (!test) console.error(err.stack);
 
   // respond with 500 "Internal Server Error".
-  res.send(500);
+  res.status(500);
+  res.send('Internal Server Error');
 }
 
 app.get('/', function(req, res){
@@ -42,7 +36,13 @@ app.get('/next', function(req, res, next){
   });
 });
 
+// the error handler is placed after routes
+// if it were above it would not receive errors
+// from app.get() etc
+app.use(error);
+
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
+}

examples/expose-data-to-client/index.js

@@ -1,6 +1,7 @@
 
-var express = require('../..')
-  , app = express();
+var express = require('../..');
+var logger = require('morgan');
+var app = express();
 
 app.set('view engine', 'jade');
 app.set('views', __dirname + '/views');
@@ -20,10 +21,10 @@ User.prototype.toJSON = function(){
   return {
     id: this.id,
     name: this.name
-  }
+  };
 };
 
-app.use(express.logger('dev'));
+app.use(logger('dev'));
 
 // earlier on expose an object
 // that we can tack properties on.
@@ -56,5 +57,8 @@ app.get('/user', function(req, res){
   res.render('page');
 });
 
-app.listen(3000);
-console.log('app listening on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/hello-world/index.js

@@ -1,4 +1,3 @@
-
 var express = require('../../');
 
 var app = express();
@@ -7,5 +6,8 @@ app.get('/', function(req, res){
   res.send('Hello World');
 });
 
-app.listen(3000);
-console.log('Express started on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/jade/index.js

@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
@@ -12,9 +11,7 @@ var pub = __dirname + '/public';
 // setup middleware
 
 var app = express();
-app.use(app.router);
 app.use(express.static(pub));
-app.use(express.errorHandler());
 
 // Optional since express defaults to CWD/views
 
@@ -41,5 +38,14 @@ app.get('/', function(req, res){
   res.render('users', { users: users });
 });
 
-app.listen(3000);
-console.log('Express app started on port 3000');
+// change this to a better error handler in your code
+// sending stacktrace to users in production is not good
+app.use(function(err, req, res, next) {
+  res.send(err.stack);
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/jade/views/layout.jade

@@ -1,5 +1,5 @@
-!!! 5
+doctype html
 html
   include header
   body
-    block content
+    block content

examples/markdown/index.js

@@ -1,11 +1,10 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../..')
-  , fs = require('fs')
-  , md = require('marked').parse;
+var express = require('../..');
+var fs = require('fs');
+var md = require('marked').parse;
 
 var app = module.exports = express();
 
@@ -18,13 +17,13 @@ app.engine('md', function(path, options, fn){
       var html = md(str);
       html = html.replace(/\{([^}]+)\}/g, function(_, name){
         return options[name] || '';
-      })
+      });
       fn(null, html);
     } catch(err) {
       fn(err);
     }
   });
-})
+});
 
 app.set('views', __dirname + '/views');
 
@@ -33,12 +32,13 @@ app.set('view engine', 'md');
 
 app.get('/', function(req, res){
   res.render('index', { title: 'Markdown Example' });
-})
+});
 
 app.get('/fail', function(req, res){
   res.render('missing', { title: 'Markdown Example' });
-})
+});
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');

examples/multi-router/controllers/api_v1.js

@@ -0,0 +1,13 @@
+var express = require('../../..');
+
+var apiv1 = express.Router();
+
+apiv1.get('/', function(req, res) {
+  res.send('Hello from APIv1 root route.');
+});
+
+apiv1.get('/users', function(req, res) {
+  res.send('List of APIv1 users.');
+});
+
+module.exports = apiv1;

examples/multi-router/controllers/api_v2.js

@@ -0,0 +1,13 @@
+var express = require('../../..');
+
+var apiv2 = express.Router();
+
+apiv2.get('/', function(req, res) {
+  res.send('Hello from APIv2 root route.');
+});
+
+apiv2.get('/users', function(req, res) {
+  res.send('List of APIv2 users.');
+});
+
+module.exports = apiv2;

examples/multi-router/index.js

@@ -0,0 +1,16 @@
+var express = require('../..');
+
+var app = module.exports = express();
+
+app.use('/api/v1', require('./controllers/api_v1'));
+app.use('/api/v2', require('./controllers/api_v2'));
+
+app.get('/', function(req, res) {
+  res.send('Hello form root route.');
+});
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/multipart/index.js

@@ -1,16 +1,12 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../..')
-  , format = require('util').format;
+var express = require('../..');
+var multiparty = require('multiparty');
+var format = require('util').format;
 
-var app = module.exports = express()
-
-// bodyParser in connect 2.x uses node-formidable to parse 
-// the multipart form data.
-app.use(express.bodyParser())
+var app = module.exports = express();
 
 app.get('/', function(req, res){
   res.send('<form method="post" enctype="multipart/form-data">'
@@ -21,16 +17,44 @@ app.get('/', function(req, res){
 });
 
 app.post('/', function(req, res, next){
-  // the uploaded file can be found as `req.files.image` and the
-  // title field as `req.body.title`
-  res.send(format('\nuploaded %s (%d Kb) to %s as %s'
-    , req.files.image.name
-    , req.files.image.size / 1024 | 0 
-    , req.files.image.path
-    , req.body.title));
+  // create a form to begin parsing
+  var form = new multiparty.Form();
+  var image;
+  var title;
+
+  form.on('error', next);
+  form.on('close', function(){
+    res.send(format('\nuploaded %s (%d Kb) as %s'
+      , image.filename
+      , image.size / 1024 | 0
+      , title));
+  });
+
+  // listen on field event for title
+  form.on('field', function(name, val){
+    if (name !== 'title') return;
+    title = val;
+  });
+
+  // listen on part event for image file
+  form.on('part', function(part){
+    if (!part.filename) return;
+    if (part.name !== 'image') return part.resume();
+    image = {};
+    image.filename = part.filename;
+    image.size = 0;
+    part.on('data', function(buf){
+      image.size += buf.length;
+    });
+  });
+
+
+  // parse the form
+  form.parse(req);
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
-  app.listen(3000);
-  console.log('Express started on port 3000');
-}
+  app.listen(4000);
+  console.log('Express started on port 4000');
+}

examples/mvc/controllers/main/index.js

@@ -1,4 +1,3 @@
-
 exports.index = function(req, res){
   res.redirect('/users');
 };

examples/mvc/controllers/pet/index.js

@@ -1,11 +1,14 @@
+/**
+ * Module dependencies.
+ */
 
 var db = require('../../db');
 
-exports.engine = 'jade';
+exports.engine = 'ejs';
 
 exports.before = function(req, res, next){
   var pet = db.pets[req.params.pet_id];
-  if (!pet) return next(new Error('Pet not found'));
+  if (!pet) return next('route');
   req.pet = pet;
   next();
 };
@@ -20,7 +23,7 @@ exports.edit = function(req, res, next){
 
 exports.update = function(req, res, next){
   var body = req.body;
-  req.pet.name = body.user.name;
+  req.pet.name = body.pet.name;
   res.message('Information updated!');
   res.redirect('/pet/' + req.pet.id);
 };

examples/mvc/controllers/pet/views/edit.ejs

@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link rel="stylesheet" href="/style.css">
+<title>Edit <%= pet.name %></title>
+</head>
+
+<body>
+<h1><%= pet.name %></h1>
+<form action="/pet/<%= pet.id %>?_method=put" method="post">
+  <label>Name: <input type="text" name="pet[name]" value="<%= pet.name %>"></label>
+  <input type="submit" value="Update">
+</form>
+</body>
+</html>

examples/mvc/controllers/pet/views/edit.jade

@@ -1,7 +0,0 @@
-link(rel='stylesheet', href='/style.css')
-h1= pet.name
-form(action='/pet/#{pet.id}', method='post')
-  input(type='hidden', name='_method', value='put')
-  label Name: 
-    input(type='text', name='user[name]', value=pet.name)
-  input(type='submit', value='Update')

examples/mvc/controllers/pet/views/show.ejs

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+<link rel="stylesheet" href="/style.css">
+<title><%= pet.name %></title>
+</head>
+
+<body>
+<h1><%= pet.name %> <a href="/pet/<%= pet.id %>/edit">edit</a></h1>
+
+<p>You are viewing <%= pet.name %></p>
+</body>
+</html>

examples/mvc/controllers/pet/views/show.jade

@@ -1,6 +0,0 @@
-link(rel='stylesheet', href='/style.css')
-
-h1= pet.name
-  a(href='/pet/#{pet.id}/edit')  edit
-
-p You are viewing #{pet.name}

examples/mvc/controllers/user-pet/index.js

@@ -1,3 +1,6 @@
+/**
+ * Module dependencies.
+ */
 
 var db = require('../../db');
 
@@ -8,7 +11,7 @@ exports.create = function(req, res, next){
   var id = req.params.user_id;
   var user = db.users[id];
   var body = req.body;
-  if (!user) return next(new Error('User not found'));
+  if (!user) return next('route');
   var pet = { name: body.pet.name };
   pet.id = db.pets.push(pet) - 1;
   user.pets.push(pet);

examples/mvc/controllers/user/index.js

@@ -1,3 +1,6 @@
+/**
+ * Module dependencies.
+ */
 
 var db = require('../../db');
 
@@ -8,11 +11,11 @@ exports.before = function(req, res, next){
   process.nextTick(function(){
     req.user = db.users[id];
     // cant find that user
-    if (!req.user) return next(new Error('User not found'));
+    if (!req.user) return next('route');
     // found it, move on to the routes
     next();
   });
-}
+};
 
 exports.list = function(req, res, next){
   res.render('list', { users: db.users });

examples/mvc/controllers/user/views/edit.html

@@ -1,12 +0,0 @@
-<link rel="stylesheet" href="/style.css" />
-<h1><%= user.name %></h1>
-<form action='/user/<%= user.id %>' method='post'>
-  <input type="hidden" name="_method" value="put" />
-  <label>Name: <input type="text" name="user[name]" value="<%= user.name %>" /></label>
-  <input type="submit" value="Update" />
-</form>
-
-<form action='/user/<%= user.id %>/pet' method='post'>
-  <label>Pet: <input type="text" name="pet[name]" placeholder="name" /></label>
-  <input type="submit" value="Add" />
-</form>

examples/mvc/controllers/user/views/edit.jade

@@ -0,0 +1,11 @@
+link(rel='stylesheet', href='/style.css')
+h1= user.name
+form(action='/user/#{user.id}?_method=put', method='post')
+  label= 'Name: '
+    input(type='text', name='user[name]', value='#{user.name}')
+  input(type='submit', value='Update')
+
+form(action='/user/#{user.id}/pet', method='post')
+  label= 'Pet: '
+    input(type='text', name='pet[name]', placeholder='Name')
+  input(type='submit', value='Add')

examples/mvc/controllers/user/views/list.html

@@ -1,8 +0,0 @@
-<link rel="stylesheet" href="/style.css" />
-<h1>Users</h1>
-<p>Click a user below to view their pets.</p>
-<ul>
-  <% users.forEach(function(user){ %>
-    <li><a href="/user/<%= user.id %>"><%= user.name %></a></li>
-  <% }) %>
-</ul>

examples/mvc/controllers/user/views/list.jade

@@ -0,0 +1,7 @@
+link(rel='stylesheet', href='/style.css')
+h1 Users
+p Click a user below to view their pets.
+ul
+  each user in users
+    li
+      a(href='/user/#{user.id}')= user.name

examples/mvc/controllers/user/views/show.html

@@ -1,21 +0,0 @@
-<link rel="stylesheet" href="/style.css" />
-<h1><%= user.name %> <a href="/user/<%= user.id %>/edit">edit</a></h1>
-
-<% if (hasMessages) { %>
-  <ul id="messages">
-    <% messages.forEach(function(msg){ %>
-      <li><%= msg %></li>
-    <% }) %>
-  </ul>
-<% } %>
-
-<% if (user.pets.length) { %>
-  <p>View <%= user.name %>s pets:</p>
-  <ul>
-    <% user.pets.forEach(function(pet){ %>
-      <li><a href="/pet/<%= pet.id %>"><%= pet.name %></a></li>
-    <% }) %>
-  </ul>
-<% } else { %>
-  <p>No pets!</p>
-<% } %>

examples/mvc/controllers/user/views/show.jade

@@ -0,0 +1,17 @@
+link(rel='stylesheet', href='/style.css')
+h1= user.name + ' '
+  a(href='/user/#{user.id}/edit') edit
+
+if (hasMessages)
+  ul#messages
+    each msg in messages
+      li= msg
+
+if (user.pets.length)
+  p View #{user.name}'s pets:
+  ul
+    each pet in user.pets
+      li
+        a(href='/pet/#{pet.id}')= pet.name
+else
+  p No pets!

examples/mvc/db.js

@@ -1,4 +1,3 @@
-
 // faux database
 
 var pets = exports.pets = [];

examples/mvc/index.js

@@ -1,14 +1,20 @@
+/**
+ * Module dependencies.
+ */
+
 var express = require('../..');
+var logger = require('morgan');
+var session = require('express-session');
+var bodyParser = require('body-parser');
+var methodOverride = require('method-override');
 
 var app = module.exports = express();
 
 // settings
 
-// map .renderFile to ".html" files
-app.engine('html', require('ejs').renderFile);
-
-// make ".html" the default
-app.set('view engine', 'html');
+// set our default template engine to "jade"
+// which prevents the need for extensions
+app.set('view engine', 'jade');
 
 // set views for error and 404 pages
 app.set('views', __dirname + '/views');
@@ -25,20 +31,23 @@ app.response.message = function(msg){
 };
 
 // log
-if (!module.parent) app.use(express.logger('dev'));
+if (!module.parent) app.use(logger('dev'));
 
 // serve static files
 app.use(express.static(__dirname + '/public'));
 
 // session support
-app.use(express.cookieParser('some secret here'));
-app.use(express.session());
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'some secret here'
+}));
 
 // parse request bodies (req.body)
-app.use(express.bodyParser());
+app.use(bodyParser.urlencoded({ extended: true }));
 
-// support _method (PUT in forms etc)
-app.use(express.methodOverride());
+// allow overriding methods in query (?_method=put)
+app.use(methodOverride('_method'));
 
 // expose the "messages" local variable when views are rendered
 app.use(function(req, res, next){
@@ -66,16 +75,9 @@ app.use(function(req, res, next){
 // load controllers
 require('./lib/boot')(app, { verbose: !module.parent });
 
-// assume "not found" in the error msgs
-// is a 404. this is somewhat silly, but
-// valid, you can do whatever you like, set
-// properties, use instanceof etc.
 app.use(function(err, req, res, next){
-  // treat as 404
-  if (~err.message.indexOf('not found')) return next();
-
   // log it
-  console.error(err.stack);
+  if (!module.parent) console.error(err.stack);
 
   // error page
   res.status(500).render('5xx');
@@ -86,7 +88,8 @@ app.use(function(req, res, next){
   res.status(404).render('404', { url: req.originalUrl });
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  console.log('\n  listening on port 3000\n');
+  console.log('Express started on port 3000');
 }

examples/mvc/lib/boot.js

@@ -1,32 +1,26 @@
+/**
+ * Module dependencies.
+ */
 
-var express = require('../../..')
-  , fs = require('fs');
+var express = require('../../..');
+var fs = require('fs');
 
 module.exports = function(parent, options){
   var verbose = options.verbose;
   fs.readdirSync(__dirname + '/../controllers').forEach(function(name){
     verbose && console.log('\n   %s:', name);
-    var obj = require('./../controllers/' + name)
-      , name = obj.name || name
-      , prefix = obj.prefix || ''
-      , app = express()
-      , method
-      , path;
+    var obj = require('./../controllers/' + name);
+    var name = obj.name || name;
+    var prefix = obj.prefix || '';
+    var app = express();
+    var handler;
+    var method;
+    var path;
 
     // allow specifying the view engine
     if (obj.engine) app.set('view engine', obj.engine);
     app.set('views', __dirname + '/../controllers/' + name + '/views');
 
-    // before middleware support
-    if (obj.before) {
-      path = '/' + name + '/:' + name + '_id';
-      app.all(path, obj.before);
-      verbose && console.log('     ALL %s -> before', path);
-      path = '/' + name + '/:' + name + '_id/*';
-      app.all(path, obj.before);
-      verbose && console.log('     ALL %s -> before', path);
-    }
-
     // generate routes based
     // on the exported methods
     for (var key in obj) {
@@ -59,15 +53,25 @@ module.exports = function(parent, options){
           path = '/';
           break;
         default:
+          /* istanbul ignore next */
           throw new Error('unrecognized route: ' + name + '.' + key);
       }
 
+      // setup
+      handler = obj[key];
       path = prefix + path;
-      app[method](path, obj[key]);
-      verbose && console.log('     %s %s -> %s', method.toUpperCase(), path, key);
+
+      // before middleware support
+      if (obj.before) {
+        app[method](path, obj.before, handler);
+        verbose && console.log('     %s %s -> before -> %s', method.toUpperCase(), path, key);
+      } else {
+        app[method](path, handler);
+        verbose && console.log('     %s %s -> %s', method.toUpperCase(), path, key);
+      }
     }
 
     // mount the app
     parent.use(app);
   });
-};
+};

examples/mvc/views/404.html

@@ -1,3 +0,0 @@
-<link rel="stylesheet" href="/style.css" />
-<h1>404: Not Found</h1>
-<p>Sorry we can't find <%= url %></p>

examples/mvc/views/404.jade

@@ -0,0 +1,3 @@
+link(rel='stylesheet', href='/style.css')
+h1 404: Not Found
+p Sorry we can't find #{url}

examples/mvc/views/5xx.html

@@ -1,3 +0,0 @@
-<link rel="stylesheet" href="/style.css" />
-<h1>500: Internal Server Error</h1>
-<p>Looks like something blew up!</p>

examples/mvc/views/5xx.jade

@@ -0,0 +1,3 @@
+link(rel='stylesheet', href='/style.css')
+h1 500: Internal Server Error
+p Looks like something blew up!

examples/online/index.js

@@ -1,4 +1,3 @@
-
 // first:
 // $ npm install redis online
 // $ redis-server
@@ -7,10 +6,10 @@
  * Module dependencies.
  */
 
-var express = require('../..')
-  , online = require('online')
-  , redis = require('redis')
-  , db = redis.createClient();
+var express = require('../..');
+var online = require('online');
+var redis = require('redis');
+var db = redis.createClient();
 
 // online
 
@@ -50,5 +49,8 @@ app.get('/', function(req, res, next){
   });
 });
 
-app.listen(3000);
-console.log('listening on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/params/index.js

@@ -1,10 +1,9 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../../')
-  , app = module.exports = express();
+var express = require('../../');
+var app = module.exports = express();
 
 // Faux database
 
@@ -16,12 +15,20 @@ var users = [
   , { name: 'bandit' }
 ];
 
+// Create HTTP error
+
+function createError(status, message) {
+  var err = new Error(message);
+  err.status = status;
+  return err;
+}
+
 // Convert :to and :from to integers
 
-app.param(['to', 'from'], function(req, res, next, num, name){ 
-  req.params[name] = num = parseInt(num, 10);
-  if( isNaN(num) ){
-    next(new Error('failed to parseInt '+num));
+app.param(['to', 'from'], function(req, res, next, num, name){
+  req.params[name] = parseInt(num, 10);
+  if( isNaN(req.params[name]) ){
+    next(createError(400, 'failed to parseInt '+num));
   } else {
     next();
   }
@@ -33,7 +40,7 @@ app.param('user', function(req, res, next, id){
   if (req.user = users[id]) {
     next();
   } else {
-    next(new Error('failed to find user'));
+    next(createError(404, 'failed to find user'));
   }
 });
 
@@ -58,13 +65,14 @@ app.get('/user/:user', function(req, res, next){
  */
 
 app.get('/users/:from-:to', function(req, res, next){
-  var from = req.params.from
-    , to = req.params.to
-    , names = users.map(function(user){ return user.name; });
+  var from = req.params.from;
+  var to = req.params.to;
+  var names = users.map(function(user){ return user.name; });
   res.send('users ' + names.slice(from, to).join(', '));
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
+}

examples/resource/index.js

@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
@@ -12,13 +11,16 @@ var app = module.exports = express();
 app.resource = function(path, obj) {
   this.get(path, obj.index);
   this.get(path + '/:a..:b.:format?', function(req, res){
-    var a = parseInt(req.params.a, 10)
-      , b = parseInt(req.params.b, 10)
-      , format = req.params.format;
+    var a = parseInt(req.params.a, 10);
+    var b = parseInt(req.params.b, 10);
+    var format = req.params.format;
     obj.range(req, res, a, b, format);
   });
   this.get(path + '/:id', obj.show);
-  this.del(path + '/:id', obj.destroy);
+  this.delete(path + '/:id', function(req, res){
+    var id = parseInt(req.params.id, 10);
+    obj.destroy(req, res, id);
+  });
 };
 
 // Fake records
@@ -41,8 +43,7 @@ var User = {
   show: function(req, res){
     res.send(users[req.params.id] || { error: 'Cannot find user' });
   },
-  destroy: function(req, res){
-    var id = req.params.id;
+  destroy: function(req, res, id){
     var destroyed = id in users;
     delete users[id];
     res.send(destroyed ? 'destroyed' : 'Cannot find user');
@@ -82,10 +83,11 @@ app.get('/', function(req, res){
     , '<li>GET /users/1..3.json</li>'
     , '<li>DELETE /users/4</li>'
     , '</ul>'
-  ].join('\n')); 
+  ].join('\n'));
 });
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');
-}
+}

examples/route-map/index.js

@@ -1,7 +1,12 @@
+/**
+ * Module dependencies.
+ */
 
-var express = require('../../lib/express')
-  , verbose = process.env.NODE_ENV != 'test'
-  , app = module.exports = express();
+var express = require('../../lib/express');
+
+var verbose = process.env.NODE_ENV != 'test';
+
+var app = module.exports = express();
 
 app.map = function(a, route){
   route = route || '';
@@ -29,7 +34,7 @@ var users = {
     res.send('user ' + req.params.uid);
   },
 
-  del: function(req, res){
+  delete: function(req, res){
     res.send('delete users');
   }
 };
@@ -39,7 +44,7 @@ var pets = {
     res.send('user ' + req.params.uid + '\'s pets');
   },
 
-  del: function(req, res){
+  delete: function(req, res){
     res.send('delete ' + req.params.uid + '\'s pet ' + req.params.pid);
   }
 };
@@ -47,17 +52,21 @@ var pets = {
 app.map({
   '/users': {
     get: users.list,
-    del: users.del,
+    delete: users.delete,
     '/:uid': {
       get: users.get,
       '/pets': {
         get: pets.list,
         '/:pid': {
-          del: pets.del
+          delete: pets.delete
         }
       }
     }
   }
 });
 
-app.listen(3000);
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/route-middleware/index.js

@@ -77,9 +77,12 @@ app.get('/user/:id/edit', loadUser, andRestrictToSelf, function(req, res){
   res.send('Editing user ' + req.user.name);
 });
 
-app.del('/user/:id', loadUser, andRestrictTo('admin'), function(req, res){
+app.delete('/user/:id', loadUser, andRestrictTo('admin'), function(req, res){
   res.send('Deleted user ' + req.user.name);
 });
 
-app.listen(3000);
-console.log('Express app started on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/route-separation/index.js

@@ -1,22 +1,32 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../..')
-  , app = express()
-  , site = require('./site')
-  , post = require('./post')
-  , user = require('./user');
+var express = require('../..');
+var app = express();
+var logger = require('morgan');
+var cookieParser = require('cookie-parser');
+var bodyParser = require('body-parser');
+var methodOverride = require('method-override');
+var site = require('./site');
+var post = require('./post');
+var user = require('./user');
+
+module.exports = app;
 
 // Config
 
 app.set('view engine', 'jade');
 app.set('views', __dirname + '/views');
-app.use(express.logger('dev'));
-app.use(express.cookieParser());
-app.use(express.bodyParser());
-app.use(express.methodOverride());
+
+/* istanbul ignore next */
+if (!module.parent) {
+  app.use(logger('dev'));
+}
+
+app.use(methodOverride('_method'));
+app.use(cookieParser());
+app.use(bodyParser.urlencoded({ extended: true }));
 app.use(express.static(__dirname + '/public'));
 
 // General
@@ -25,7 +35,7 @@ app.get('/', site.index);
 
 // User
 
-app.all('/users', user.list);
+app.get('/users', user.list);
 app.all('/user/:id/:op?', user.load);
 app.get('/user/:id', user.view);
 app.get('/user/:id/view', user.view);
@@ -36,5 +46,8 @@ app.put('/user/:id/edit', user.update);
 
 app.get('/posts', post.list);
 
-app.listen(3000);
-console.log('Express app started on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/route-separation/post.js

@@ -1,4 +1,3 @@
-
 // Fake posts database
 
 var posts = [

examples/route-separation/site.js

@@ -1,4 +1,3 @@
-
 exports.index = function(req, res){
   res.render('index', { title: 'Route Separation Example' });
 };

examples/route-separation/user.js

@@ -1,4 +1,3 @@
-
 // Fake user database
 
 var users = [
@@ -16,7 +15,9 @@ exports.load = function(req, res, next){
   if (req.user) {
     next();
   } else {
-    next(new Error('cannot find user ' + id));
+    var err = new Error('cannot find user ' + id);
+    err.status = 404;
+    next(err);
   }
 };
 
@@ -41,4 +42,4 @@ exports.update = function(req, res){
   req.user.name = user.name;
   req.user.email = user.email;
   res.redirect('back');
-};
+};

examples/route-separation/views/users/edit.jade

@@ -3,8 +3,7 @@ extends ../layout
 block content
   h1 Editing #{user.name}
   #user
-    form(method="post")
-      input(type="hidden", value="put", name="_method")
+    form(action="?_method=put", method="post")
       p Name: 
         input(type="text", value= user.name, name="user[name]")
       p Email: 

examples/search/client.js

@@ -1,4 +1,3 @@
-
 var search = document.querySelector('[type=search]');
 var code = document.querySelector('pre');
 

examples/search/index.js

@@ -1,4 +1,3 @@
-
 // first:
 // $ npm install redis
 // $ redis-server
@@ -7,9 +6,10 @@
  * Module dependencies.
  */
 
-var express = require('../..')
-  , redis = require('redis')
-  , db = redis.createClient();
+var express = require('../..');
+var redis = require('redis');
+
+var db = redis.createClient();
 
 // npm install redis
 
@@ -47,15 +47,18 @@ app.get('/search/:query?', function(req, res){
 });
 
 /**
- * GET client javascript. Here we use sendfile()
+ * GET client javascript. Here we use sendFile()
  * because serving __dirname with the static() middleware
  * would also mean serving our server "index.js" and the "search.jade"
  * template.
  */
 
 app.get('/client.js', function(req, res){
-  res.sendfile(__dirname + '/client.js');
+  res.sendFile(__dirname + '/client.js');
 });
 
-app.listen(3000);
-console.log('app listening on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/search/search.jade

@@ -1,4 +1,4 @@
-!!! 5
+doctype
 html
   head
     title Search example

examples/session/index.js

@@ -1,21 +1,18 @@
-
 // first:
 // $ npm install redis
 // $ redis-server
 
 var express = require('../..');
+var session = require('express-session');
 
 var app = express();
 
-app.use(express.logger('dev'));
-
-// Required by session() middleware
-// pass the secret for signed cookies
-// (required by session())
-app.use(express.cookieParser('keyboard cat'));
-
 // Populates req.session
-app.use(express.session());
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'keyboard cat'
+}));
 
 app.get('/', function(req, res){
   var body = '';
@@ -28,5 +25,8 @@ app.get('/', function(req, res){
   res.send(body + '<p>viewed <strong>' + req.session.views + '</strong> times.</p>');
 });
 
-app.listen(3000);
-console.log('Express app started on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/session/redis.js

@@ -1,22 +1,26 @@
-
+/**
+ * Module dependencies.
+ */
 
 var express = require('../..');
+var logger = require('morgan');
+var session = require('express-session');
 
 // pass the express to the connect redis module
-// allowing it to inherit from express.session.Store
-var RedisStore = require('connect-redis')(express);
+// allowing it to inherit from session.Store
+var RedisStore = require('connect-redis')(session);
 
 var app = express();
 
-app.use(express.logger('dev'));
-
-// Required by session() middleware
-// pass the secret for signed cookies
-// (required by session())
-app.use(express.cookieParser('keyboard cat'));
+app.use(logger('dev'));
 
 // Populates req.session
-app.use(express.session({ store: new RedisStore }));
+app.use(session({
+  resave: false, // don't save session if unmodified
+  saveUninitialized: false, // don't create session until something stored
+  secret: 'keyboard cat',
+  store: new RedisStore
+}));
 
 app.get('/', function(req, res){
   var body = '';

examples/static-files/index.js

@@ -1,9 +1,13 @@
+/**
+ * Module dependencies.
+ */
 
 var express = require('../..');
+var logger = require('morgan');
 var app = express();
 
 // log requests
-app.use(express.logger('dev'));
+app.use(logger('dev'));
 
 // express on its own has no notion
 // of a "file". The express.static()
@@ -28,17 +32,9 @@ app.use('/static', express.static(__dirname + '/public'));
 // this will allow "GET /style.css" instead of "GET /css/style.css":
 app.use(express.static(__dirname + '/public/css'));
 
-// this examples does not have any routes, however
-// you may `app.use(app.router)` before or after these
-// static() middleware. If placed before them your routes
-// will be matched BEFORE file serving takes place. If placed
-// after as shown here then file serving is performed BEFORE
-// any routes are hit:
-app.use(app.router);
-
 app.listen(3000);
 console.log('listening on port 3000');
 console.log('try:');
 console.log('  GET /hello.txt');
 console.log('  GET /js/app.js');
-console.log('  GET /css/style.css');
+console.log('  GET /css/style.css');

examples/vhost/index.js

@@ -3,6 +3,8 @@
  */
 
 var express = require('../..');
+var logger = require('morgan');
+var vhost = require('vhost');
 
 /*
 edit /etc/hosts:
@@ -16,31 +18,34 @@ edit /etc/hosts:
 
 var main = express();
 
-main.use(express.logger('dev'));
+if (!module.parent) main.use(logger('dev'));
 
 main.get('/', function(req, res){
-  res.send('Hello from main app!')
+  res.send('Hello from main app!');
 });
 
 main.get('/:sub', function(req, res){
-  res.send('requsted ' + req.params.sub);
+  res.send('requested ' + req.params.sub);
 });
 
 // Redirect app
 
 var redirect = express();
 
-redirect.all('*', function(req, res){
-  console.log(req.subdomains);
-  res.redirect('http://example.com:3000/' + req.subdomains[0]);
+redirect.use(function(req, res){
+  if (!module.parent) console.log(req.vhost);
+  res.redirect('http://example.com:3000/' + req.vhost[0]);
 });
 
 // Vhost app
 
-var app = express();
+var app = module.exports = express();
 
-app.use(express.vhost('*.example.com', redirect)) // Serves all subdomains via Redirect app
-app.use(express.vhost('example.com', main)); // Serves top level domain via Main server app 
+app.use(vhost('*.example.com', redirect)); // Serves all subdomains via Redirect app
+app.use(vhost('example.com', main)); // Serves top level domain via Main server app
 
-app.listen(3000);
-console.log('Express app started on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/view-constructor/github-view.js

@@ -1,11 +1,10 @@
-
 /**
  * Module dependencies.
  */
 
-var http = require('http')
-  , path = require('path')
-  , extname = path.extname
+var http = require('http');
+var path = require('path');
+var extname = path.extname;
 
 /**
  * Expose `GithubView`.
@@ -35,13 +34,13 @@ function GithubView(name, options){
 GithubView.prototype.render = function(options, fn){
   var self = this;
   var opts = {
-    host: 'rawgithub.com',
-    port: 80,
+    host: 'raw.githubusercontent.com',
+    port: 443,
     path: this.path,
     method: 'GET'
   };
 
-  http.request(opts, function(res) {
+  https.request(opts, function(res) {
     var buf = '';
     res.setEncoding('utf8');
     res.on('data', function(str){ buf += str });

examples/view-constructor/index.js

@@ -1,12 +1,11 @@
-
 /**
  * Module dependencies.
  */
 
-var express = require('../../')
-  , http = require('http')
-  , GithubView = require('./github-view')
-  , md = require('marked').parse;
+var express = require('../../');
+var http = require('http');
+var GithubView = require('./github-view');
+var md = require('marked').parse;
 
 var app = module.exports = express();
 
@@ -16,15 +15,15 @@ app.engine('md', function(str, options, fn){
     var html = md(str);
     html = html.replace(/\{([^}]+)\}/g, function(_, name){
       return options[name] || '';
-    })
+    });
     fn(null, html);
   } catch(err) {
     fn(err);
   }
-})
+});
 
 // pointing to a particular github repo to load files from it
-app.set('views', 'visionmedia/express');
+app.set('views', 'strongloop/express');
 
 // register a new view constructor
 app.set('view', GithubView);
@@ -34,13 +33,14 @@ app.get('/', function(req, res){
   // app.locals, res.locals, and locals passed
   // work like they normally would
   res.render('examples/markdown/views/index.md', { title: 'Example' });
-})
+});
 
 app.get('/Readme.md', function(req, res){
-  // rendering a view from https://github.com/visionmedia/express/blob/master/Readme.md
+  // rendering a view from https://github.com/strongloop/express/blob/master/Readme.md
   res.render('Readme.md');
-})
+});
 
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
   console.log('Express started on port 3000');

examples/view-locals/index.js

@@ -1,7 +1,10 @@
+/**
+ * Module dependencies.
+ */
 
-var express = require('../..')
-  , User = require('./user')
-  , app = express();
+var express = require('../..');
+var User = require('./user');
+var app = express();
 
 app.set('views', __dirname);
 app.set('view engine', 'jade');
@@ -69,7 +72,7 @@ app.get('/middleware', count, users, function(req, res, next){
 // this approach is much like the last
 // however we're explicitly exposing
 // the locals within each middleware
-// 
+//
 // note that this may not always work
 // well, for example here we filter
 // the users in the middleware, which
@@ -142,5 +145,8 @@ app.all('/api/*', function(req, res, next){
 
 */
 
-app.listen(3000);
-console.log('Application listening on port 3000');
+/* istanbul ignore next */
+if (!module.parent) {
+  app.listen(3000);
+  console.log('Express started on port 3000');
+}

examples/view-locals/layout.jade

@@ -1,4 +1,4 @@
-doctype 5
+doctype html
 html
   head
     title= title

examples/view-locals/user.js

@@ -1,4 +1,3 @@
-
 module.exports = User;
 
 // faux model

examples/web-service/index.js

@@ -1,4 +1,3 @@
-
 /**
  * Module dependencies.
  */
@@ -29,7 +28,7 @@ function error(status, msg) {
 app.use('/api', function(req, res, next){
   var key = req.query['api-key'];
 
-  // key isnt present
+  // key isn't present
   if (!key) return next(error(400, 'api key required'));
 
   // key is invalid
@@ -40,29 +39,6 @@ app.use('/api', function(req, res, next){
   next();
 });
 
-// position our routes above the error handling middleware,
-// and below our API middleware, since we want the API validation
-// to take place BEFORE our routes
-app.use(app.router);
-
-// middleware with an arity of 4 are considered
-// error handling middleware. When you next(err)
-// it will be passed through the defined middleware
-// in order, but ONLY those with an arity of 4, ignoring
-// regular middleware.
-app.use(function(err, req, res, next){
-  // whatever you want here, feel free to populate
-  // properties on `err` to treat it differently in here.
-  res.send(err.status || 500, { error: err.message });
-});
-
-// our custom JSON 404 middleware. Since it's placed last
-// it will be the last middleware called, if all others
-// invoke next() and do not respond.
-app.use(function(req, res){
-  res.send(404, { error: "Lame, can't find that" });
-});
-
 // map of valid api keys, typically mapped to
 // account info with some sort of database like redis.
 // api keys do _not_ serve as authentication, merely to
@@ -73,7 +49,7 @@ var apiKeys = ['foo', 'bar', 'baz'];
 // these two objects will serve as our faux database
 
 var repos = [
-    { name: 'express', url: 'http://github.com/visionmedia/express' }
+    { name: 'express', url: 'http://github.com/strongloop/express' }
   , { name: 'stylus', url: 'http://github.com/learnboost/stylus' }
   , { name: 'cluster', url: 'http://github.com/learnboost/cluster' }
 ];
@@ -102,14 +78,35 @@ app.get('/api/repos', function(req, res, next){
 });
 
 app.get('/api/user/:name/repos', function(req, res, next){
-  var name = req.params.name
-    , user = userRepos[name];
-  
+  var name = req.params.name;
+  var user = userRepos[name];
+
   if (user) res.send(user);
   else next();
 });
 
+// middleware with an arity of 4 are considered
+// error handling middleware. When you next(err)
+// it will be passed through the defined middleware
+// in order, but ONLY those with an arity of 4, ignoring
+// regular middleware.
+app.use(function(err, req, res, next){
+  // whatever you want here, feel free to populate
+  // properties on `err` to treat it differently in here.
+  res.status(err.status || 500);
+  res.send({ error: err.message });
+});
+
+// our custom JSON 404 middleware. Since it's placed last
+// it will be the last middleware called, if all others
+// invoke next() and do not respond.
+app.use(function(req, res){
+  res.status(404);
+  res.send({ error: "Lame, can't find that" });
+});
+
+/* istanbul ignore next */
 if (!module.parent) {
   app.listen(3000);
-  console.log('Express server listening on port 3000');
-}
+  console.log('Express started on port 3000');
+}

index.js

@@ -1,4 +1,11 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
 
-module.exports = process.env.EXPRESS_COV
-  ? require('./lib-cov/express')
-  : require('./lib/express');
+'use strict';
+
+module.exports = require('./lib/express');

lib/application.js

@@ -1,18 +1,34 @@
-/**
- * Module dependencies.
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
  */
 
-var connect = require('connect')
-  , Router = require('./router')
-  , methods = require('methods')
-  , middleware = require('./middleware')
-  , debug = require('debug')('express:application')
-  , locals = require('./utils').locals
-  , View = require('./view')
-  , utils = connect.utils
-  , path = require('path')
-  , http = require('http')
-  , join = path.join;
+'use strict';
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var finalhandler = require('finalhandler');
+var Router = require('./router');
+var methods = require('methods');
+var middleware = require('./middleware/init');
+var query = require('./middleware/query');
+var debug = require('debug')('express:application');
+var View = require('./view');
+var http = require('http');
+var compileETag = require('./utils').compileETag;
+var compileQueryParser = require('./utils').compileQueryParser;
+var compileTrust = require('./utils').compileTrust;
+var deprecate = require('depd')('express');
+var flatten = require('array-flatten');
+var merge = require('utils-merge');
+var resolve = require('path').resolve;
+var slice = Array.prototype.slice;
 
 /**
  * Application prototype.
@@ -20,6 +36,13 @@ var connect = require('connect')
 
 var app = exports = module.exports = {};
 
+/**
+ * Variable for trust proxy inheritance back-compat
+ * @private
+ */
+
+var trustProxyDefaultSymbol = '@@symbol:trust_proxy_default';
+
 /**
  * Initialize the server.
  *
@@ -27,114 +50,211 @@ var app = exports = module.exports = {};
  *   - setup default middleware
  *   - setup route reflection methods
  *
- * @api private
+ * @private
  */
 
-app.init = function(){
+app.init = function init() {
   this.cache = {};
-  this.settings = {};
   this.engines = {};
+  this.settings = {};
+
   this.defaultConfiguration();
 };
 
 /**
  * Initialize application configuration.
- *
- * @api private
+ * @private
  */
 
-app.defaultConfiguration = function(){
+app.defaultConfiguration = function defaultConfiguration() {
+  var env = process.env.NODE_ENV || 'development';
+
   // default settings
   this.enable('x-powered-by');
-  this.set('env', process.env.NODE_ENV || 'development');
+  this.set('etag', 'weak');
+  this.set('env', env);
+  this.set('query parser', 'extended');
   this.set('subdomain offset', 2);
-  debug('booting in %s mode', this.get('env'));
+  this.set('trust proxy', false);
 
-  // implicit middleware
-  this.use(connect.query());
-  this.use(middleware.init(this));
+  // trust proxy inherit back-compat
+  Object.defineProperty(this.settings, trustProxyDefaultSymbol, {
+    configurable: true,
+    value: true
+  });
 
-  // inherit protos
-  this.on('mount', function(parent){
+  debug('booting in %s mode', env);
+
+  this.on('mount', function onmount(parent) {
+    // inherit trust proxy
+    if (this.settings[trustProxyDefaultSymbol] === true
+      && typeof parent.settings['trust proxy fn'] === 'function') {
+      delete this.settings['trust proxy'];
+      delete this.settings['trust proxy fn'];
+    }
+
+    // inherit protos
     this.request.__proto__ = parent.request;
     this.response.__proto__ = parent.response;
     this.engines.__proto__ = parent.engines;
     this.settings.__proto__ = parent.settings;
   });
 
-  // router
-  this._router = new Router(this);
-  this.routes = this._router.map;
-  this.__defineGetter__('router', function(){
-    this._usedRouter = true;
-    this._router.caseSensitive = this.enabled('case sensitive routing');
-    this._router.strict = this.enabled('strict routing');
-    return this._router.middleware;
-  });
-
   // setup locals
-  this.locals = locals(this);
+  this.locals = Object.create(null);
+
+  // top-most app is mounted at /
+  this.mountpath = '/';
 
   // default locals
   this.locals.settings = this.settings;
 
   // default configuration
   this.set('view', View);
-  this.set('views', process.cwd() + '/views');
+  this.set('views', resolve('views'));
   this.set('jsonp callback name', 'callback');
 
-  this.configure('development', function(){
-    this.set('json spaces', 2);
-  });
-
-  this.configure('production', function(){
+  if (env === 'production') {
     this.enable('view cache');
+  }
+
+  Object.defineProperty(this, 'router', {
+    get: function() {
+      throw new Error('\'app.router\' is deprecated!\nPlease see the 3.x to 4.x migration guide for details on how to update your app.');
+    }
   });
 };
 
 /**
- * Proxy `connect#use()` to apply settings to
- * mounted applications.
+ * lazily adds the base router if it has not yet been added.
  *
- * @param {String|Function|Server} route
- * @param {Function|Server} fn
- * @return {app} for chaining
- * @api public
+ * We cannot add the base router in the defaultConfiguration because
+ * it reads app settings which might be set after that has run.
+ *
+ * @private
+ */
+app.lazyrouter = function lazyrouter() {
+  if (!this._router) {
+    this._router = new Router({
+      caseSensitive: this.enabled('case sensitive routing'),
+      strict: this.enabled('strict routing')
+    });
+
+    this._router.use(query(this.get('query parser fn')));
+    this._router.use(middleware.init(this));
+  }
+};
+
+/**
+ * Dispatch a req, res pair into the application. Starts pipeline processing.
+ *
+ * If no callback is provided, then default error handlers will respond
+ * in the event of an error bubbling through the stack.
+ *
+ * @private
  */
 
-app.use = function(route, fn){
-  var app;
+app.handle = function handle(req, res, callback) {
+  var router = this._router;
 
-  // default route to '/'
-  if ('string' != typeof route) fn = route, route = '/';
+  // final handler
+  var done = callback || finalhandler(req, res, {
+    env: this.get('env'),
+    onerror: logerror.bind(this)
+  });
 
-  // express app
-  if (fn.handle && fn.set) app = fn;
+  // no routes
+  if (!router) {
+    debug('no routes defined on app');
+    done();
+    return;
+  }
 
-  // restore .app property on req and res
-  if (app) {
-    app.route = route;
-    fn = function(req, res, next) {
+  router.handle(req, res, done);
+};
+
+/**
+ * Proxy `Router#use()` to add middleware to the app router.
+ * See Router#use() documentation for details.
+ *
+ * If the _fn_ parameter is an express app, then it will be
+ * mounted at the _route_ specified.
+ *
+ * @public
+ */
+
+app.use = function use(fn) {
+  var offset = 0;
+  var path = '/';
+
+  // default path to '/'
+  // disambiguate app.use([fn])
+  if (typeof fn !== 'function') {
+    var arg = fn;
+
+    while (Array.isArray(arg) && arg.length !== 0) {
+      arg = arg[0];
+    }
+
+    // first arg is the path
+    if (typeof arg !== 'function') {
+      offset = 1;
+      path = fn;
+    }
+  }
+
+  var fns = flatten(slice.call(arguments, offset));
+
+  if (fns.length === 0) {
+    throw new TypeError('app.use() requires middleware functions');
+  }
+
+  // setup router
+  this.lazyrouter();
+  var router = this._router;
+
+  fns.forEach(function (fn) {
+    // non-express app
+    if (!fn || !fn.handle || !fn.set) {
+      return router.use(path, fn);
+    }
+
+    debug('.use app under %s', path);
+    fn.mountpath = path;
+    fn.parent = this;
+
+    // restore .app property on req and res
+    router.use(path, function mounted_app(req, res, next) {
       var orig = req.app;
-      app.handle(req, res, function(err){
+      fn.handle(req, res, function (err) {
         req.__proto__ = orig.request;
         res.__proto__ = orig.response;
         next(err);
       });
-    };
-  }
+    });
 
-  connect.proto.use.call(this, route, fn);
-
-  // mounted an app
-  if (app) {
-    app.parent = this;
-    app.emit('mount', this);
-  }
+    // mounted an app
+    fn.emit('mount', this);
+  }, this);
 
   return this;
 };
 
+/**
+ * Proxy to the app `Router#route()`
+ * Returns a new `Route` instance for the _path_.
+ *
+ * Routes are isolated middleware stacks for specific paths.
+ * See the Route api docs for details.
+ *
+ * @public
+ */
+
+app.route = function route(path) {
+  this.lazyrouter();
+  return this._router.route(path);
+};
+
 /**
  * Register the given template engine callback `fn`
  * as `ext`.
@@ -158,7 +278,7 @@ app.use = function(route, fn){
  * so if you're using ".ejs" extensions you dont need to do anything.
  *
  * Some template engines do not follow this convention, the
- * [Consolidate.js](https://github.com/visionmedia/consolidate.js)
+ * [Consolidate.js](https://github.com/tj/consolidate.js)
  * library was created to map all of node's popular template
  * engines to follow this convention, thus allowing them to
  * work seamlessly within Express.
@@ -166,70 +286,50 @@ app.use = function(route, fn){
  * @param {String} ext
  * @param {Function} fn
  * @return {app} for chaining
- * @api public
+ * @public
  */
 
-app.engine = function(ext, fn){
-  if ('function' != typeof fn) throw new Error('callback function required');
-  if ('.' != ext[0]) ext = '.' + ext;
-  this.engines[ext] = fn;
+app.engine = function engine(ext, fn) {
+  if (typeof fn !== 'function') {
+    throw new Error('callback function required');
+  }
+
+  // get file extension
+  var extension = ext[0] !== '.'
+    ? '.' + ext
+    : ext;
+
+  // store engine
+  this.engines[extension] = fn;
+
   return this;
 };
 
 /**
- * Map the given param placeholder `name`(s) to the given callback(s).
+ * Proxy to `Router#param()` with one added api feature. The _name_ parameter
+ * can be an array of names.
  *
- * Parameter mapping is used to provide pre-conditions to routes
- * which use normalized placeholders. For example a _:user_id_ parameter
- * could automatically load a user's information from the database without
- * any additional code,
- *
- * The callback uses the samesignature as middleware, the only differencing
- * being that the value of the placeholder is passed, in this case the _id_
- * of the user. Once the `next()` function is invoked, just like middleware
- * it will continue on to execute the route, or subsequent parameter functions.
- *
- *      app.param('user_id', function(req, res, next, id){
- *        User.find(id, function(err, user){
- *          if (err) {
- *            next(err);
- *          } else if (user) {
- *            req.user = user;
- *            next();
- *          } else {
- *            next(new Error('failed to load user'));
- *          }
- *        });
- *      });
+ * See the Router#param() docs for more details.
  *
  * @param {String|Array} name
  * @param {Function} fn
  * @return {app} for chaining
- * @api public
+ * @public
  */
 
-app.param = function(name, fn){
-  var self = this
-    , fns = [].slice.call(arguments, 1);
+app.param = function param(name, fn) {
+  this.lazyrouter();
 
-  // array
   if (Array.isArray(name)) {
-    name.forEach(function(name){
-      fns.forEach(function(fn){
-        self.param(name, fn);
-      });
-    });
-  // param logic
-  } else if ('function' == typeof name) {
-    this._router.param(name);
-  // single
-  } else {
-    if (':' == name[0]) name = name.substr(1);
-    fns.forEach(function(fn){
-      self._router.param(name, fn);
-    });
+    for (var i = 0; i < name.length; i++) {
+      this.param(name[i], fn);
+    }
+
+    return this;
   }
 
+  this._router.param(name, fn);
+
   return this;
 };
 
@@ -243,18 +343,43 @@ app.param = function(name, fn){
  * Mounted servers inherit their parent server's settings.
  *
  * @param {String} setting
- * @param {String} val
+ * @param {*} [val]
  * @return {Server} for chaining
- * @api public
+ * @public
  */
 
-app.set = function(setting, val){
-  if (1 == arguments.length) {
+app.set = function set(setting, val) {
+  if (arguments.length === 1) {
+    // app.get(setting)
     return this.settings[setting];
-  } else {
-    this.settings[setting] = val;
-    return this;
   }
+
+  debug('set "%s" to %o', setting, val);
+
+  // set value
+  this.settings[setting] = val;
+
+  // trigger matched settings
+  switch (setting) {
+    case 'etag':
+      this.set('etag fn', compileETag(val));
+      break;
+    case 'query parser':
+      this.set('query parser fn', compileQueryParser(val));
+      break;
+    case 'trust proxy':
+      this.set('trust proxy fn', compileTrust(val));
+
+      // trust proxy inherit back-compat
+      Object.defineProperty(this.settings, trustProxyDefaultSymbol, {
+        configurable: true,
+        value: false
+      });
+
+      break;
+  }
+
+  return this;
 };
 
 /**
@@ -268,12 +393,12 @@ app.set = function(setting, val){
  * return value would be "/blog/admin".
  *
  * @return {String}
- * @api private
+ * @private
  */
 
-app.path = function(){
+app.path = function path() {
   return this.parent
-    ? this.parent.path() + this.route
+    ? this.parent.path() + this.mountpath
     : '';
 };
 
@@ -289,11 +414,11 @@ app.path = function(){
  *
  * @param {String} setting
  * @return {Boolean}
- * @api public
+ * @public
  */
 
-app.enabled = function(setting){
-  return !!this.set(setting);
+app.enabled = function enabled(setting) {
+  return Boolean(this.set(setting));
 };
 
 /**
@@ -308,10 +433,10 @@ app.enabled = function(setting){
  *
  * @param {String} setting
  * @return {Boolean}
- * @api public
+ * @public
  */
 
-app.disabled = function(setting){
+app.disabled = function disabled(setting) {
   return !this.set(setting);
 };
 
@@ -320,10 +445,10 @@ app.disabled = function(setting){
  *
  * @param {String} setting
  * @return {app} for chaining
- * @api public
+ * @public
  */
 
-app.enable = function(setting){
+app.enable = function enable(setting) {
   return this.set(setting, true);
 };
 
@@ -332,85 +457,28 @@ app.enable = function(setting){
  *
  * @param {String} setting
  * @return {app} for chaining
- * @api public
+ * @public
  */
 
-app.disable = function(setting){
+app.disable = function disable(setting) {
   return this.set(setting, false);
 };
 
-/**
- * Configure callback for zero or more envs,
- * when no `env` is specified that callback will
- * be invoked for all environments. Any combination
- * can be used multiple times, in any order desired.
- *
- * Examples:
- *
- *    app.configure(function(){
- *      // executed for all envs
- *    });
- *
- *    app.configure('stage', function(){
- *      // executed staging env
- *    });
- *
- *    app.configure('stage', 'production', function(){
- *      // executed for stage and production
- *    });
- *
- * Note:
- *
- *  These callbacks are invoked immediately, and
- *  are effectively sugar for the following:
- *
- *     var env = process.env.NODE_ENV || 'development';
- *
- *      switch (env) {
- *        case 'development':
- *          ...
- *          break;
- *        case 'stage':
- *          ...
- *          break;
- *        case 'production':
- *          ...
- *          break;
- *      }
- *
- * @param {String} env...
- * @param {Function} fn
- * @return {app} for chaining
- * @api public
- */
-
-app.configure = function(env, fn){
-  var envs = 'all'
-    , args = [].slice.call(arguments);
-  fn = args.pop();
-  if (args.length) envs = args;
-  if ('all' == envs || ~envs.indexOf(this.settings.env)) fn.call(this);
-  return this;
-};
-
 /**
  * Delegate `.VERB(...)` calls to `router.VERB(...)`.
  */
 
 methods.forEach(function(method){
   app[method] = function(path){
-    if ('get' == method && 1 == arguments.length) return this.set(path);
-
-    // deprecated
-    if (Array.isArray(path)) {
-      console.trace('passing an array to app.VERB() is deprecated and will be removed in 4.0');
+    if (method === 'get' && arguments.length === 1) {
+      // app.get(setting)
+      return this.set(path);
     }
 
-    // if no router attached yet, attach the router
-    if (!this._usedRouter) this.use(this.router);
+    this.lazyrouter();
 
-    // setup route
-    this._router[method].apply(this._router, arguments);
+    var route = this._router.route(path);
+    route[method].apply(route, slice.call(arguments, 1));
     return this;
   };
 });
@@ -422,20 +490,25 @@ methods.forEach(function(method){
  * @param {String} path
  * @param {Function} ...
  * @return {app} for chaining
- * @api public
+ * @public
  */
 
-app.all = function(path){
-  var args = arguments;
-  methods.forEach(function(method){
-    app[method].apply(this, args);
-  }, this);
+app.all = function all(path) {
+  this.lazyrouter();
+
+  var route = this._router.route(path);
+  var args = slice.call(arguments, 1);
+
+  for (var i = 0; i < methods.length; i++) {
+    route[methods[i]].apply(route, args);
+  }
+
   return this;
 };
 
 // del -> delete alias
 
-app.del = app.delete;
+app.del = deprecate.function(app.delete, 'app.del: Use app.delete instead');
 
 /**
  * Render the given view `name` name with `options`
@@ -450,62 +523,72 @@ app.del = app.delete;
  *
  * @param {String} name
  * @param {String|Function} options or fn
- * @param {Function} fn
- * @api public
+ * @param {Function} callback
+ * @public
  */
 
-app.render = function(name, options, fn){
-  var opts = {}
-    , cache = this.cache
-    , engines = this.engines
-    , view;
+app.render = function render(name, options, callback) {
+  var cache = this.cache;
+  var done = callback;
+  var engines = this.engines;
+  var opts = options;
+  var renderOptions = {};
+  var view;
 
   // support callback function as second arg
-  if ('function' == typeof options) {
-    fn = options, options = {};
+  if (typeof options === 'function') {
+    done = options;
+    opts = {};
   }
 
   // merge app.locals
-  utils.merge(opts, this.locals);
+  merge(renderOptions, this.locals);
 
   // merge options._locals
-  if (options._locals) utils.merge(opts, options._locals);
+  if (opts._locals) {
+    merge(renderOptions, opts._locals);
+  }
 
   // merge options
-  utils.merge(opts, options);
+  merge(renderOptions, opts);
 
   // set .cache unless explicitly provided
-  opts.cache = null == opts.cache
-    ? this.enabled('view cache')
-    : opts.cache;
+  if (renderOptions.cache == null) {
+    renderOptions.cache = this.enabled('view cache');
+  }
 
   // primed cache
-  if (opts.cache) view = cache[name];
+  if (renderOptions.cache) {
+    view = cache[name];
+  }
 
   // view
   if (!view) {
-    view = new (this.get('view'))(name, {
+    var View = this.get('view');
+
+    view = new View(name, {
       defaultEngine: this.get('view engine'),
       root: this.get('views'),
       engines: engines
     });
 
     if (!view.path) {
-      var err = new Error('Failed to lookup view "' + name + '"');
+      var dirs = Array.isArray(view.root) && view.root.length > 1
+        ? 'directories "' + view.root.slice(0, -1).join('", "') + '" or "' + view.root[view.root.length - 1] + '"'
+        : 'directory "' + view.root + '"'
+      var err = new Error('Failed to lookup view "' + name + '" in views ' + dirs);
       err.view = view;
-      return fn(err);
+      return done(err);
     }
 
     // prime the cache
-    if (opts.cache) cache[name] = view;
+    if (renderOptions.cache) {
+      cache[name] = view;
+    }
   }
 
   // render
-  try {
-    view.render(opts, fn);
-  } catch (err) {
-    fn(err);
-  }
+  tryRender(view, renderOptions, done);
 };
 
 /**
@@ -526,10 +609,35 @@ app.render = function(name, options, fn){
  *    https.createServer({ ... }, app).listen(443);
  *
  * @return {http.Server}
- * @api public
+ * @public
  */
 
-app.listen = function(){
+app.listen = function listen() {
   var server = http.createServer(this);
   return server.listen.apply(server, arguments);
 };
+
+/**
+ * Log error using console.error.
+ *
+ * @param {Error} err
+ * @private
+ */
+
+function logerror(err) {
+  /* istanbul ignore next */
+  if (this.get('env') !== 'test') console.error(err.stack || err.toString());
+}
+
+/**
+ * Try rendering a view.
+ * @private
+ */
+
+function tryRender(view, options, callback) {
+  try {
+    view.render(options, callback);
+  } catch (err) {
+    callback(err);
+  }
+}

lib/express.js

@@ -1,14 +1,24 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict';
+
 /**
  * Module dependencies.
  */
 
-var connect = require('connect')
-  , proto = require('./application')
-  , Route = require('./router/route')
-  , Router = require('./router')
-  , req = require('./request')
-  , res = require('./response')
-  , utils = connect.utils;
+var EventEmitter = require('events').EventEmitter;
+var mixin = require('merge-descriptors');
+var proto = require('./application');
+var Route = require('./router/route');
+var Router = require('./router');
+var req = require('./request');
+var res = require('./response');
 
 /**
  * Expose `createApplication()`.
@@ -16,12 +26,6 @@ var connect = require('connect')
 
 exports = module.exports = createApplication;
 
-/**
- * Expose mime.
- */
-
-exports.mime = connect.mime;
-
 /**
  * Create an express application.
  *
@@ -30,41 +34,19 @@ exports.mime = connect.mime;
  */
 
 function createApplication() {
-  var app = connect();
-  utils.merge(app, proto);
+  var app = function(req, res, next) {
+    app.handle(req, res, next);
+  };
+
+  mixin(app, EventEmitter.prototype, false);
+  mixin(app, proto, false);
+
   app.request = { __proto__: req, app: app };
   app.response = { __proto__: res, app: app };
   app.init();
   return app;
 }
 
-/**
- * Expose connect.middleware as express.*
- * for example `express.logger` etc.
- */
-
-for (var key in connect.middleware) {
-  Object.defineProperty(
-      exports
-    , key
-    , Object.getOwnPropertyDescriptor(connect.middleware, key));
-}
-
-/**
- * Error on createServer().
- */
-
-exports.createServer = function(){
-  console.warn('Warning: express.createServer() is deprecated, express');
-  console.warn('applications no longer inherit from http.Server,');
-  console.warn('please use:');
-  console.warn('');
-  console.warn('  var express = require("express");');
-  console.warn('  var app = express();');
-  console.warn('');
-  return createApplication();
-};
-
 /**
  * Expose the prototypes.
  */
@@ -80,7 +62,42 @@ exports.response = res;
 exports.Route = Route;
 exports.Router = Router;
 
-// Error handler title
+/**
+ * Expose middleware
+ */
 
-exports.errorHandler.title = 'Express';
+exports.query = require('./middleware/query');
+exports.static = require('serve-static');
 
+/**
+ * Replace removed middleware with an appropriate error message.
+ */
+
+[
+  'json',
+  'urlencoded',
+  'bodyParser',
+  'compress',
+  'cookieSession',
+  'session',
+  'logger',
+  'cookieParser',
+  'favicon',
+  'responseTime',
+  'errorHandler',
+  'timeout',
+  'methodOverride',
+  'vhost',
+  'csrf',
+  'directory',
+  'limit',
+  'multipart',
+  'staticCache',
+].forEach(function (name) {
+  Object.defineProperty(exports, name, {
+    get: function () {
+      throw new Error('Most middleware (like ' + name + ') is no longer bundled with Express and must be installed separately. Please see https://github.com/senchalabs/connect#middleware.');
+    },
+    configurable: true
+  });
+});

lib/middleware/init.js

@@ -1,13 +1,16 @@
-
-/**
- * Module dependencies.
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
  */
 
-var utils = require('./utils');
+'use strict';
 
 /**
  * Initialization middleware, exposing the
- * request and response to eachother, as well
+ * request and response to each other, as well
  * as defaulting the X-Powered-By header field.
  *
  * @param {Function} app
@@ -25,8 +28,9 @@ exports.init = function(app){
     req.__proto__ = app.request;
     res.__proto__ = app.response;
 
-    res.locals = res.locals || utils.locals(res);
+    res.locals = res.locals || Object.create(null);
 
     next();
-  }
+  };
 };
+

lib/middleware/query.js

@@ -0,0 +1,51 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict';
+
+/**
+ * Module dependencies.
+ */
+
+var parseUrl = require('parseurl');
+var qs = require('qs');
+
+/**
+ * @param {Object} options
+ * @return {Function}
+ * @api public
+ */
+
+module.exports = function query(options) {
+  var opts = Object.create(options || null);
+  var queryparse = qs.parse;
+
+  if (typeof options === 'function') {
+    queryparse = options;
+    opts = undefined;
+  }
+
+  if (opts !== undefined) {
+    if (opts.allowDots === undefined) {
+      opts.allowDots = false;
+    }
+
+    if (opts.allowPrototypes === undefined) {
+      opts.allowPrototypes = true;
+    }
+  }
+
+  return function query(req, res, next){
+    if (!req.query) {
+      var val = parseUrl(req).query;
+      req.query = queryparse(val, opts);
+    }
+
+    next();
+  };
+};

lib/request.js

@@ -1,15 +1,27 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict';
 
 /**
  * Module dependencies.
+ * @private
  */
 
-var http = require('http')
-  , utils = require('./utils')
-  , connect = require('connect')
-  , fresh = require('fresh')
-  , parseRange = require('range-parser')
-  , parse = connect.utils.parseUrl
-  , mime = connect.mime;
+var accepts = require('accepts');
+var deprecate = require('depd')('express');
+var isIP = require('net').isIP;
+var typeis = require('type-is');
+var http = require('http');
+var fresh = require('fresh');
+var parseRange = require('range-parser');
+var parse = require('parseurl');
+var proxyaddr = require('proxy-addr');
 
 /**
  * Request prototype.
@@ -40,31 +52,36 @@ var req = exports = module.exports = {
  *
  * @param {String} name
  * @return {String}
- * @api public
+ * @public
  */
 
 req.get =
-req.header = function(name){
-  switch (name = name.toLowerCase()) {
+req.header = function header(name) {
+  var lc = name.toLowerCase();
+
+  switch (lc) {
     case 'referer':
     case 'referrer':
       return this.headers.referrer
         || this.headers.referer;
     default:
-      return this.headers[name];
+      return this.headers[lc];
   }
 };
 
 /**
+ * To do: update docs.
+ *
  * Check if the given `type(s)` is acceptable, returning
  * the best match when true, otherwise `undefined`, in which
  * case you should respond with 406 "Not Acceptable".
  *
- * The `type` value may be a single mime type string
- * such as "application/json", the extension name
- * such as "json", a comma-delimted list such as "json, html, text/plain",
+ * The `type` value may be a single MIME type string
+ * such as "application/json", an extension name
+ * such as "json", a comma-delimited list such as "json, html, text/plain",
+ * an argument list such as `"json", "html", "text/plain"`,
  * or an array `["json", "html", "text/plain"]`. When a list
- * or array is given the _best_ match, if any is returned.
+ * or array is given, the _best_ match, if any is returned.
  *
  * Examples:
  *
@@ -89,62 +106,70 @@ req.header = function(name){
  *
  *     // Accept: text/*;q=.5, application/json
  *     req.accepts(['html', 'json']);
+ *     req.accepts('html', 'json');
  *     req.accepts('html, json');
  *     // => "json"
  *
  * @param {String|Array} type(s)
- * @return {String}
- * @api public
+ * @return {String|Array|Boolean}
+ * @public
  */
 
-req.accepts = function(type){
-  return utils.accepts(type, this.get('Accept'));
+req.accepts = function(){
+  var accept = accepts(this);
+  return accept.types.apply(accept, arguments);
 };
 
 /**
- * Check if the given `encoding` is accepted.
+ * Check if the given `encoding`s are accepted.
  *
- * @param {String} encoding
- * @return {Boolean}
- * @api public
+ * @param {String} ...encoding
+ * @return {String|Array}
+ * @public
  */
 
-req.acceptsEncoding = function(encoding){
-  return !! ~this.acceptedEncodings.indexOf(encoding);
+req.acceptsEncodings = function(){
+  var accept = accepts(this);
+  return accept.encodings.apply(accept, arguments);
 };
 
+req.acceptsEncoding = deprecate.function(req.acceptsEncodings,
+  'req.acceptsEncoding: Use acceptsEncodings instead');
+
 /**
- * Check if the given `charset` is acceptable,
+ * Check if the given `charset`s are acceptable,
  * otherwise you should respond with 406 "Not Acceptable".
  *
- * @param {String} charset
- * @return {Boolean}
- * @api public
+ * @param {String} ...charset
+ * @return {String|Array}
+ * @public
  */
 
-req.acceptsCharset = function(charset){
-  var accepted = this.acceptedCharsets;
-  return accepted.length
-    ? !! ~accepted.indexOf(charset)
-    : true;
+req.acceptsCharsets = function(){
+  var accept = accepts(this);
+  return accept.charsets.apply(accept, arguments);
 };
 
+req.acceptsCharset = deprecate.function(req.acceptsCharsets,
+  'req.acceptsCharset: Use acceptsCharsets instead');
+
 /**
- * Check if the given `lang` is acceptable,
+ * Check if the given `lang`s are acceptable,
  * otherwise you should respond with 406 "Not Acceptable".
  *
- * @param {String} lang
- * @return {Boolean}
- * @api public
+ * @param {String} ...lang
+ * @return {String|Array}
+ * @public
  */
 
-req.acceptsLanguage = function(lang){
-  var accepted = this.acceptedLanguages;
-  return accepted.length
-    ? !! ~accepted.indexOf(lang)
-    : true;
+req.acceptsLanguages = function(){
+  var accept = accepts(this);
+  return accept.languages.apply(accept, arguments);
 };
 
+req.acceptsLanguage = deprecate.function(req.acceptsLanguages,
+  'req.acceptsLanguage: Use acceptsLanguages instead');
+
 /**
  * Parse Range header field,
  * capping to the given `size`.
@@ -162,7 +187,7 @@ req.acceptsLanguage = function(lang){
  *
  * @param {Number} size
  * @return {Array}
- * @api public
+ * @public
  */
 
 req.range = function(size){
@@ -171,98 +196,6 @@ req.range = function(size){
   return parseRange(size, range);
 };
 
-/**
- * Return an array of encodings.
- *
- * Examples:
- *
- *     ['gzip', 'deflate']
- *
- * @return {Array}
- * @api public
- */
-
-req.__defineGetter__('acceptedEncodings', function(){
-  var accept = this.get('Accept-Encoding');
-  return accept
-    ? accept.trim().split(/ *, */)
-    : [];
-});
-
-/**
- * Return an array of Accepted media types
- * ordered from highest quality to lowest.
- *
- * Examples:
- *
- *     [ { value: 'application/json',
- *         quality: 1,
- *         type: 'application',
- *         subtype: 'json' },
- *       { value: 'text/html',
- *         quality: 0.5,
- *         type: 'text',
- *         subtype: 'html' } ]
- *
- * @return {Array}
- * @api public
- */
-
-req.__defineGetter__('accepted', function(){
-  var accept = this.get('Accept');
-  return accept
-    ? utils.parseAccept(accept)
-    : [];
-});
-
-/**
- * Return an array of Accepted languages
- * ordered from highest quality to lowest.
- *
- * Examples:
- *
- *     Accept-Language: en;q=.5, en-us
- *     ['en-us', 'en']
- *
- * @return {Array}
- * @api public
- */
-
-req.__defineGetter__('acceptedLanguages', function(){
-  var accept = this.get('Accept-Language');
-  return accept
-    ? utils
-      .parseParams(accept)
-      .map(function(obj){
-        return obj.value;
-      })
-    : [];
-});
-
-/**
- * Return an array of Accepted charsets
- * ordered from highest quality to lowest.
- *
- * Examples:
- *
- *     Accept-Charset: iso-8859-5;q=.2, unicode-1-1;q=0.8
- *     ['unicode-1-1', 'iso-8859-5']
- *
- * @return {Array}
- * @api public
- */
-
-req.__defineGetter__('acceptedCharsets', function(){
-  var accept = this.get('Accept-Charset');
-  return accept
-    ? utils
-      .parseParams(accept)
-      .map(function(obj){
-        return obj.value;
-      })
-    : [];
-});
-
 /**
  * Return the value of param `name` when present or `defaultValue`.
  *
@@ -272,21 +205,28 @@ req.__defineGetter__('acceptedCharsets', function(){
  *
  * To utilize request bodies, `req.body`
  * should be an object. This can be done by using
- * the `connect.bodyParser()` middleware.
+ * the `bodyParser()` middleware.
  *
  * @param {String} name
  * @param {Mixed} [defaultValue]
  * @return {String}
- * @api public
+ * @public
  */
 
-req.param = function(name, defaultValue){
+req.param = function param(name, defaultValue) {
   var params = this.params || {};
   var body = this.body || {};
   var query = this.query || {};
+
+  var args = arguments.length === 1
+    ? 'name'
+    : 'name, default';
+  deprecate('req.param(' + args + '): Use req.params, req.body, or req.query instead');
+
   if (null != params[name] && params.hasOwnProperty(name)) return params[name];
   if (null != body[name]) return body[name];
   if (null != query[name]) return query[name];
+
   return defaultValue;
 };
 
@@ -311,43 +251,52 @@ req.param = function(name, defaultValue){
  *      req.is('html');
  *      // => false
  *
- * @param {String} type
- * @return {Boolean}
- * @api public
+ * @param {String|Array} types...
+ * @return {String|false|null}
+ * @public
  */
 
-req.is = function(type){
-  var ct = this.get('Content-Type');
-  if (!ct) return false;
-  ct = ct.split(';')[0];
-  if (!~type.indexOf('/')) type = mime.lookup(type);
-  if (~type.indexOf('*')) {
-    type = type.split('/');
-    ct = ct.split('/');
-    if ('*' == type[0] && type[1] == ct[1]) return true;
-    if ('*' == type[1] && type[0] == ct[0]) return true;
-    return false;
+req.is = function is(types) {
+  var arr = types;
+
+  // support flattened arguments
+  if (!Array.isArray(types)) {
+    arr = new Array(arguments.length);
+    for (var i = 0; i < arr.length; i++) {
+      arr[i] = arguments[i];
+    }
   }
-  return !! ~ct.indexOf(type);
+
+  return typeis(this, arr);
 };
 
 /**
  * Return the protocol string "http" or "https"
  * when requested with TLS. When the "trust proxy"
- * setting is enabled the "X-Forwarded-Proto" header
- * field will be trusted. If you're running behind
- * a reverse proxy that supplies https for you this
- * may be enabled.
+ * setting trusts the socket address, the
+ * "X-Forwarded-Proto" header field will be trusted
+ * and used if present.
+ *
+ * If you're running behind a reverse proxy that
+ * supplies https for you this may be enabled.
  *
  * @return {String}
- * @api public
+ * @public
  */
 
-req.__defineGetter__('protocol', function(){
-  var trustProxy = this.app.get('trust proxy');
-  if (this.connection.encrypted) return 'https';
-  if (!trustProxy) return 'http';
-  var proto = this.get('X-Forwarded-Proto') || 'http';
+defineGetter(req, 'protocol', function protocol(){
+  var proto = this.connection.encrypted
+    ? 'https'
+    : 'http';
+  var trust = this.app.get('trust proxy fn');
+
+  if (!trust(this.connection.remoteAddress, 0)) {
+    return proto;
+  }
+
+  // Note: X-Forwarded-Proto is normally only ever a
+  //       single value, but this is to be safe.
+  proto = this.get('X-Forwarded-Proto') || proto;
   return proto.split(/\s*,\s*/)[0];
 });
 
@@ -357,74 +306,44 @@ req.__defineGetter__('protocol', function(){
  *    req.protocol == 'https'
  *
  * @return {Boolean}
- * @api public
+ * @public
  */
 
-req.__defineGetter__('secure', function(){
-  return 'https' == this.protocol;
+defineGetter(req, 'secure', function secure(){
+  return this.protocol === 'https';
 });
 
 /**
- * Return the remote address, or when
- * "trust proxy" is `true` return
- * the upstream addr.
+ * Return the remote address from the trusted proxy.
+ *
+ * The is the remote address on the socket unless
+ * "trust proxy" is set.
  *
  * @return {String}
- * @api public
+ * @public
  */
 
-req.__defineGetter__('ip', function(){
-  return this.ips[0] || this.connection.remoteAddress;
+defineGetter(req, 'ip', function ip(){
+  var trust = this.app.get('trust proxy fn');
+  return proxyaddr(this, trust);
 });
 
 /**
- * When "trust proxy" is `true`, parse
- * the "X-Forwarded-For" ip address list.
+ * When "trust proxy" is set, trusted proxy addresses + client.
  *
  * For example if the value were "client, proxy1, proxy2"
  * you would receive the array `["client", "proxy1", "proxy2"]`
- * where "proxy2" is the furthest down-stream.
+ * where "proxy2" is the furthest down-stream and "proxy1" and
+ * "proxy2" were trusted.
  *
  * @return {Array}
- * @api public
+ * @public
  */
 
-req.__defineGetter__('ips', function(){
-  var trustProxy = this.app.get('trust proxy');
-  var val = this.get('X-Forwarded-For');
-  return trustProxy && val
-    ? val.split(/ *, */)
-    : [];
-});
-
-/**
- * Return basic auth credentials.
- *
- * Examples:
- *
- *    // http://tobi:hello@example.com
- *    req.auth
- *    // => { username: 'tobi', password: 'hello' }
- *
- * @return {Object} or undefined
- * @api public
- */
-
-req.__defineGetter__('auth', function(){
-  // missing
-  var auth = this.get('Authorization');
-  if (!auth) return;
-
-  // malformed
-  var parts = auth.split(' ');
-  if ('basic' != parts[0].toLowerCase()) return;
-  if (!parts[1]) return;
-  auth = parts[1];
-
-  // credentials
-  auth = new Buffer(auth, 'base64').toString().match(/^([^:]*):(.*)$/);
-  if (!auth) return;
-  return { username: auth[1], password: auth[2] };
+defineGetter(req, 'ips', function ips() {
+  var trust = this.app.get('trust proxy fn');
+  var addrs = proxyaddr.all(this, trust);
+  return addrs.slice(1).reverse();
 });
 
 /**
@@ -439,53 +358,81 @@ req.__defineGetter__('auth', function(){
  * If "subdomain offset" is 3, req.subdomains is `["tobi"]`.
  *
  * @return {Array}
- * @api public
+ * @public
  */
 
-req.__defineGetter__('subdomains', function(){
+defineGetter(req, 'subdomains', function subdomains() {
+  var hostname = this.hostname;
+
+  if (!hostname) return [];
+
   var offset = this.app.get('subdomain offset');
-  return (this.host || '')
-    .split('.')
-    .reverse()
-    .slice(offset);
+  var subdomains = !isIP(hostname)
+    ? hostname.split('.').reverse()
+    : [hostname];
+
+  return subdomains.slice(offset);
 });
 
 /**
  * Short-hand for `url.parse(req.url).pathname`.
  *
  * @return {String}
- * @api public
+ * @public
  */
 
-req.__defineGetter__('path', function(){
+defineGetter(req, 'path', function path() {
   return parse(this).pathname;
 });
 
 /**
- * Parse the "Host" header field hostname.
+ * Parse the "Host" header field to a hostname.
+ *
+ * When the "trust proxy" setting trusts the socket
+ * address, the "X-Forwarded-Host" header field will
+ * be trusted.
  *
  * @return {String}
- * @api public
+ * @public
  */
 
-req.__defineGetter__('host', function(){
-  var trustProxy = this.app.get('trust proxy');
-  var host = trustProxy && this.get('X-Forwarded-Host');
-  host = host || this.get('Host');
+defineGetter(req, 'hostname', function hostname(){
+  var trust = this.app.get('trust proxy fn');
+  var host = this.get('X-Forwarded-Host');
+
+  if (!host || !trust(this.connection.remoteAddress, 0)) {
+    host = this.get('Host');
+  }
+
   if (!host) return;
-  return host.split(':')[0];
+
+  // IPv6 literal support
+  var offset = host[0] === '['
+    ? host.indexOf(']') + 1
+    : 0;
+  var index = host.indexOf(':', offset);
+
+  return index !== -1
+    ? host.substring(0, index)
+    : host;
 });
 
+// TODO: change req.host to return host in next major
+
+defineGetter(req, 'host', deprecate.function(function host(){
+  return this.hostname;
+}, 'req.host: Use req.hostname instead'));
+
 /**
  * Check if the request is fresh, aka
  * Last-Modified and/or the ETag
  * still match.
  *
  * @return {Boolean}
- * @api public
+ * @public
  */
 
-req.__defineGetter__('fresh', function(){
+defineGetter(req, 'fresh', function(){
   var method = this.method;
   var s = this.res.statusCode;
 
@@ -494,7 +441,7 @@ req.__defineGetter__('fresh', function(){
 
   // 2xx or 304 as per rfc2616 14.26
   if ((s >= 200 && s < 300) || 304 == s) {
-    return fresh(this.headers, this.res._headers);
+    return fresh(this.headers, (this.res._headers || {}));
   }
 
   return false;
@@ -506,10 +453,10 @@ req.__defineGetter__('fresh', function(){
  * resource has changed.
  *
  * @return {Boolean}
- * @api public
+ * @public
  */
 
-req.__defineGetter__('stale', function(){
+defineGetter(req, 'stale', function stale(){
   return !this.fresh;
 });
 
@@ -517,10 +464,26 @@ req.__defineGetter__('stale', function(){
  * Check if the request was an _XMLHttpRequest_.
  *
  * @return {Boolean}
- * @api public
+ * @public
  */
 
-req.__defineGetter__('xhr', function(){
+defineGetter(req, 'xhr', function xhr(){
   var val = this.get('X-Requested-With') || '';
-  return 'xmlhttprequest' == val.toLowerCase();
+  return val.toLowerCase() === 'xmlhttprequest';
 });
+
+/**
+ * Helper function for creating a getter on an object.
+ *
+ * @param {Object} obj
+ * @param {String} name
+ * @param {Function} getter
+ * @private
+ */
+function defineGetter(obj, name, getter) {
+  Object.defineProperty(obj, name, {
+    configurable: true,
+    enumerable: true,
+    get: getter
+  });
+};

lib/router/index.js

@@ -1,59 +1,115 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict';
+
 /**
  * Module dependencies.
+ * @private
  */
 
-var Route = require('./route')
-  , utils = require('../utils')
-  , methods = require('methods')
-  , debug = require('debug')('express:router')
-  , parse = require('connect').utils.parseUrl;
+var Route = require('./route');
+var Layer = require('./layer');
+var methods = require('methods');
+var mixin = require('utils-merge');
+var debug = require('debug')('express:router');
+var deprecate = require('depd')('express');
+var flatten = require('array-flatten');
+var parseUrl = require('parseurl');
 
 /**
- * Expose `Router` constructor.
+ * Module variables.
+ * @private
  */
 
-exports = module.exports = Router;
+var objectRegExp = /^\[object (\S+)\]$/;
+var slice = Array.prototype.slice;
+var toString = Object.prototype.toString;
 
 /**
  * Initialize a new `Router` with the given `options`.
  *
  * @param {Object} options
- * @api private
+ * @return {Router} which is an callable function
+ * @public
  */
 
-function Router(options) {
-  options = options || {};
-  var self = this;
-  this.map = {};
-  this.params = {};
-  this._params = [];
-  this.caseSensitive = options.caseSensitive;
-  this.strict = options.strict;
-  this.middleware = function router(req, res, next){
-    self._dispatch(req, res, next);
-  };
-}
+var proto = module.exports = function(options) {
+  var opts = options || {};
+
+  function router(req, res, next) {
+    router.handle(req, res, next);
+  }
+
+  // mixin Router class functions
+  router.__proto__ = proto;
+
+  router.params = {};
+  router._params = [];
+  router.caseSensitive = opts.caseSensitive;
+  router.mergeParams = opts.mergeParams;
+  router.strict = opts.strict;
+  router.stack = [];
+
+  return router;
+};
 
 /**
- * Register a param callback `fn` for the given `name`.
+ * Map the given param placeholder `name`(s) to the given callback.
  *
- * @param {String|Function} name
+ * Parameter mapping is used to provide pre-conditions to routes
+ * which use normalized placeholders. For example a _:user_id_ parameter
+ * could automatically load a user's information from the database without
+ * any additional code,
+ *
+ * The callback uses the same signature as middleware, the only difference
+ * being that the value of the placeholder is passed, in this case the _id_
+ * of the user. Once the `next()` function is invoked, just like middleware
+ * it will continue on to execute the route, or subsequent parameter functions.
+ *
+ * Just like in middleware, you must either respond to the request or call next
+ * to avoid stalling the request.
+ *
+ *  app.param('user_id', function(req, res, next, id){
+ *    User.find(id, function(err, user){
+ *      if (err) {
+ *        return next(err);
+ *      } else if (!user) {
+ *        return next(new Error('failed to load user'));
+ *      }
+ *      req.user = user;
+ *      next();
+ *    });
+ *  });
+ *
+ * @param {String} name
  * @param {Function} fn
- * @return {Router} for chaining
- * @api public
+ * @return {app} for chaining
+ * @public
  */
 
-Router.prototype.param = function(name, fn){
+proto.param = function param(name, fn) {
   // param logic
-  if ('function' == typeof name) {
+  if (typeof name === 'function') {
+    deprecate('router.param(fn): Refactor to use path params');
     this._params.push(name);
     return;
   }
 
   // apply param functions
-  var params = this._params
-    , len = params.length
-    , ret;
+  var params = this._params;
+  var len = params.length;
+  var ret;
+
+  if (name[0] === ':') {
+    deprecate('router.param(' + JSON.stringify(name) + ', fn): Use router.param(' + JSON.stringify(name.substr(1)) + ', fn) instead');
+    name = name.substr(1);
+  }
 
   for (var i = 0; i < len; ++i) {
     if (ret = params[i](name, fn)) {
@@ -72,202 +128,515 @@ Router.prototype.param = function(name, fn){
 };
 
 /**
- * Route dispatcher aka the route "middleware".
- *
- * @param {IncomingMessage} req
- * @param {ServerResponse} res
- * @param {Function} next
- * @api private
+ * Dispatch a req, res into the router.
+ * @private
  */
 
-Router.prototype._dispatch = function(req, res, next){
-  var params = this.params
-    , self = this;
+proto.handle = function handle(req, res, out) {
+  var self = this;
 
-  debug('dispatching %s %s (%s)', req.method, req.url, req.originalUrl);
+  debug('dispatching %s %s', req.method, req.url);
 
-  // route dispatch
-  (function pass(i, err){
-    var paramCallbacks
-      , paramIndex = 0
-      , paramVal
-      , route
-      , keys
-      , key;
+  var search = 1 + req.url.indexOf('?');
+  var pathlength = search ? search - 1 : req.url.length;
+  var fqdn = req.url[0] !== '/' && 1 + req.url.substr(0, pathlength).indexOf('://');
+  var protohost = fqdn ? req.url.substr(0, req.url.indexOf('/', 2 + fqdn)) : '';
+  var idx = 0;
+  var removed = '';
+  var slashAdded = false;
+  var paramcalled = {};
 
-    // match next route
-    function nextRoute(err) {
-      pass(req._route_index + 1, err);
+  // store options for OPTIONS request
+  // only used if OPTIONS request
+  var options = [];
+
+  // middleware and routes
+  var stack = self.stack;
+
+  // manage inter-router variables
+  var parentParams = req.params;
+  var parentUrl = req.baseUrl || '';
+  var done = restore(out, req, 'baseUrl', 'next', 'params');
+
+  // setup next layer
+  req.next = next;
+
+  // for options requests, respond with a default if nothing else responds
+  if (req.method === 'OPTIONS') {
+    done = wrap(done, function(old, err) {
+      if (err || options.length === 0) return old(err);
+      sendOptionsResponse(res, options, old);
+    });
+  }
+
+  // setup basic req values
+  req.baseUrl = parentUrl;
+  req.originalUrl = req.originalUrl || req.url;
+
+  next();
+
+  function next(err) {
+    var layerError = err === 'route'
+      ? null
+      : err;
+
+    // remove added slash
+    if (slashAdded) {
+      req.url = req.url.substr(1);
+      slashAdded = false;
     }
 
-    // match route
-    req.route = route = self.matchRequest(req, i);
+    // restore altered req.url
+    if (removed.length !== 0) {
+      req.baseUrl = parentUrl;
+      req.url = protohost + removed + req.url.substr(protohost.length);
+      removed = '';
+    }
 
-    // no route
-    if (!route) return next(err);
-    debug('matched %s %s', route.method, route.path);
+    // no more matching layers
+    if (idx >= stack.length) {
+      setImmediate(done, layerError);
+      return;
+    }
 
-    // we have a route
-    // start at param 0
-    req.params = route.params;
-    keys = route.keys;
-    i = 0;
+    // get pathname of request
+    var path = getPathname(req);
 
-    // param callbacks
-    function param(err) {
-      paramIndex = 0;
-      key = keys[i++];
-      paramVal = key && req.params[key.name];
-      paramCallbacks = key && params[key.name];
+    if (path == null) {
+      return done(layerError);
+    }
 
-      try {
-        if ('route' == err) {
-          nextRoute();
-        } else if (err) {
-          i = 0;
-          callbacks(err);
-        } else if (paramCallbacks && undefined !== paramVal) {
-          paramCallback();
-        } else if (key) {
-          param();
-        } else {
-          i = 0;
-          callbacks();
-        }
-      } catch (err) {
-        param(err);
+    // find next matching layer
+    var layer;
+    var match;
+    var route;
+
+    while (match !== true && idx < stack.length) {
+      layer = stack[idx++];
+      match = matchLayer(layer, path);
+      route = layer.route;
+
+      if (typeof match !== 'boolean') {
+        // hold on to layerError
+        layerError = layerError || match;
       }
+
+      if (match !== true) {
+        continue;
+      }
+
+      if (!route) {
+        // process non-route handlers normally
+        continue;
+      }
+
+      if (layerError) {
+        // routes do not match with a pending error
+        match = false;
+        continue;
+      }
+
+      var method = req.method;
+      var has_method = route._handles_method(method);
+
+      // build up automatic options response
+      if (!has_method && method === 'OPTIONS') {
+        appendMethods(options, route._options());
+      }
+
+      // don't even bother matching route
+      if (!has_method && method !== 'HEAD') {
+        match = false;
+        continue;
+      }
+    }
+
+    // no match
+    if (match !== true) {
+      return done(layerError);
+    }
+
+    // store route for dispatch on change
+    if (route) {
+      req.route = route;
+    }
+
+    // Capture one-time layer values
+    req.params = self.mergeParams
+      ? mergeParams(layer.params, parentParams)
+      : layer.params;
+    var layerPath = layer.path;
+
+    // this should be done for the layer
+    self.process_params(layer, paramcalled, req, res, function (err) {
+      if (err) {
+        return next(layerError || err);
+      }
+
+      if (route) {
+        return layer.handle_request(req, res, next);
+      }
+
+      trim_prefix(layer, layerError, layerPath, path);
+    });
+  }
+
+  function trim_prefix(layer, layerError, layerPath, path) {
+    var c = path[layerPath.length];
+    if (c && '/' !== c && '.' !== c) return next(layerError);
+
+     // Trim off the part of the url that matches the route
+     // middleware (.use stuff) needs to have the path stripped
+    if (layerPath.length !== 0) {
+      debug('trim prefix (%s) from url %s', layerPath, req.url);
+      removed = layerPath;
+      req.url = protohost + req.url.substr(protohost.length + removed.length);
+
+      // Ensure leading slash
+      if (!fqdn && req.url[0] !== '/') {
+        req.url = '/' + req.url;
+        slashAdded = true;
+      }
+
+      // Setup base URL (no trailing slash)
+      req.baseUrl = parentUrl + (removed[removed.length - 1] === '/'
+        ? removed.substring(0, removed.length - 1)
+        : removed);
+    }
+
+    debug('%s %s : %s', layer.name, layerPath, req.originalUrl);
+
+    if (layerError) {
+      layer.handle_error(layerError, req, res, next);
+    } else {
+      layer.handle_request(req, res, next);
+    }
+  }
+};
+
+/**
+ * Process any parameters for the layer.
+ * @private
+ */
+
+proto.process_params = function process_params(layer, called, req, res, done) {
+  var params = this.params;
+
+  // captured parameters from the layer, keys and values
+  var keys = layer.keys;
+
+  // fast track
+  if (!keys || keys.length === 0) {
+    return done();
+  }
+
+  var i = 0;
+  var name;
+  var paramIndex = 0;
+  var key;
+  var paramVal;
+  var paramCallbacks;
+  var paramCalled;
+
+  // process params in order
+  // param callbacks can be async
+  function param(err) {
+    if (err) {
+      return done(err);
+    }
+
+    if (i >= keys.length ) {
+      return done();
+    }
+
+    paramIndex = 0;
+    key = keys[i++];
+
+    if (!key) {
+      return done();
+    }
+
+    name = key.name;
+    paramVal = req.params[name];
+    paramCallbacks = params[name];
+    paramCalled = called[name];
+
+    if (paramVal === undefined || !paramCallbacks) {
+      return param();
+    }
+
+    // param previously called with same value or error occurred
+    if (paramCalled && (paramCalled.match === paramVal
+      || (paramCalled.error && paramCalled.error !== 'route'))) {
+      // restore value
+      req.params[name] = paramCalled.value;
+
+      // next param
+      return param(paramCalled.error);
+    }
+
+    called[name] = paramCalled = {
+      error: null,
+      match: paramVal,
+      value: paramVal
     };
 
-    param(err);
+    paramCallback();
+  }
 
-    // single param callbacks
-    function paramCallback(err) {
-      var fn = paramCallbacks[paramIndex++];
-      if (err || !fn) return param(err);
+  // single param callbacks
+  function paramCallback(err) {
+    var fn = paramCallbacks[paramIndex++];
+
+    // store updated value
+    paramCalled.value = req.params[key.name];
+
+    if (err) {
+      // store error
+      paramCalled.error = err;
+      param(err);
+      return;
+    }
+
+    if (!fn) return param();
+
+    try {
       fn(req, res, paramCallback, paramVal, key.name);
-    }
-
-    // invoke route callbacks
-    function callbacks(err) {
-      var fn = route.callbacks[i++];
-      try {
-        if ('route' == err) {
-          nextRoute();
-        } else if (err && fn) {
-          if (fn.length < 4) return callbacks(err);
-          fn(err, req, res, callbacks);
-        } else if (fn) {
-          if (fn.length < 4) return fn(req, res, callbacks);
-          callbacks();
-        } else {
-          nextRoute(err);
-        }
-      } catch (err) {
-        callbacks(err);
-      }
-    }
-  })(0);
-};
-
-/**
- * Attempt to match a route for `req`
- * with optional starting index of `i`
- * defaulting to 0.
- *
- * @param {IncomingMessage} req
- * @param {Number} i
- * @return {Route}
- * @api private
- */
-
-Router.prototype.matchRequest = function(req, i, head){
-  var method = req.method.toLowerCase()
-    , url = parse(req)
-    , path = url.pathname
-    , routes = this.map
-    , i = i || 0
-    , route;
-
-  // HEAD support
-  if (!head && 'head' == method) {
-    route = this.matchRequest(req, i, true);
-    if (route) return route;
-     method = 'get';
-  }
-
-  // routes for this method
-  if (routes = routes[method]) {
-
-    // matching routes
-    for (var len = routes.length; i < len; ++i) {
-      route = routes[i];
-      if (route.match(path)) {
-        req._route_index = i;
-        return route;
-      }
+    } catch (e) {
+      paramCallback(e);
     }
   }
+
+  param();
 };
 
 /**
- * Attempt to match a route for `method`
- * and `url` with optional starting
- * index of `i` defaulting to 0.
+ * Use the given middleware function, with optional path, defaulting to "/".
  *
- * @param {String} method
- * @param {String} url
- * @param {Number} i
- * @return {Route}
- * @api private
+ * Use (like `.all`) will run for any http METHOD, but it will not add
+ * handlers for those methods so OPTIONS requests will not consider `.use`
+ * functions even if they could respond.
+ *
+ * The other difference is that _route_ path is stripped and not visible
+ * to the handler function. The main effect of this feature is that mounted
+ * handlers can operate without any code changes regardless of the "prefix"
+ * pathname.
+ *
+ * @public
  */
 
-Router.prototype.match = function(method, url, i, head){
-  var req = { method: method, url: url };
-  return  this.matchRequest(req, i, head);
-};
+proto.use = function use(fn) {
+  var offset = 0;
+  var path = '/';
 
-/**
- * Route `method`, `path`, and one or more callbacks.
- *
- * @param {String} method
- * @param {String} path
- * @param {Function} callback...
- * @return {Router} for chaining
- * @api private
- */
+  // default path to '/'
+  // disambiguate router.use([fn])
+  if (typeof fn !== 'function') {
+    var arg = fn;
 
-Router.prototype.route = function(method, path, callbacks){
-  var method = method.toLowerCase()
-    , callbacks = utils.flatten([].slice.call(arguments, 2));
+    while (Array.isArray(arg) && arg.length !== 0) {
+      arg = arg[0];
+    }
 
-  // ensure path was given
-  if (!path) throw new Error('Router#' + method + '() requires a path');
+    // first arg is the path
+    if (typeof arg !== 'function') {
+      offset = 1;
+      path = fn;
+    }
+  }
 
-  // ensure all callbacks are functions
-  callbacks.forEach(function(fn, i){
-    if ('function' == typeof fn) return;
-    var type = {}.toString.call(fn);
-    var msg = '.' + method + '() requires callback functions but got a ' + type;
-    throw new Error(msg);
-  });
+  var callbacks = flatten(slice.call(arguments, offset));
 
-  // create the route
-  debug('defined %s %s', method, path);
-  var route = new Route(method, path, callbacks, {
-    sensitive: this.caseSensitive,
-    strict: this.strict
-  });
+  if (callbacks.length === 0) {
+    throw new TypeError('Router.use() requires middleware functions');
+  }
+
+  for (var i = 0; i < callbacks.length; i++) {
+    var fn = callbacks[i];
+
+    if (typeof fn !== 'function') {
+      throw new TypeError('Router.use() requires middleware function but got a ' + gettype(fn));
+    }
+
+    // add the middleware
+    debug('use %s %s', path, fn.name || '<anonymous>');
+
+    var layer = new Layer(path, {
+      sensitive: this.caseSensitive,
+      strict: false,
+      end: false
+    }, fn);
+
+    layer.route = undefined;
+
+    this.stack.push(layer);
+  }
 
-  // add it
-  (this.map[method] = this.map[method] || []).push(route);
   return this;
 };
 
-methods.forEach(function(method){
-  Router.prototype[method] = function(path){
-    var args = [method].concat([].slice.call(arguments));
-    this.route.apply(this, args);
+/**
+ * Create a new Route for the given path.
+ *
+ * Each route contains a separate middleware stack and VERB handlers.
+ *
+ * See the Route api documentation for details on adding handlers
+ * and middleware to routes.
+ *
+ * @param {String} path
+ * @return {Route}
+ * @public
+ */
+
+proto.route = function route(path) {
+  var route = new Route(path);
+
+  var layer = new Layer(path, {
+    sensitive: this.caseSensitive,
+    strict: this.strict,
+    end: true
+  }, route.dispatch.bind(route));
+
+  layer.route = route;
+
+  this.stack.push(layer);
+  return route;
+};
+
+// create Router#VERB functions
+methods.concat('all').forEach(function(method){
+  proto[method] = function(path){
+    var route = this.route(path)
+    route[method].apply(route, slice.call(arguments, 1));
     return this;
   };
 });
+
+// append methods to a list of methods
+function appendMethods(list, addition) {
+  for (var i = 0; i < addition.length; i++) {
+    var method = addition[i];
+    if (list.indexOf(method) === -1) {
+      list.push(method);
+    }
+  }
+}
+
+// get pathname of request
+function getPathname(req) {
+  try {
+    return parseUrl(req).pathname;
+  } catch (err) {
+    return undefined;
+  }
+}
+
+// get type for error message
+function gettype(obj) {
+  var type = typeof obj;
+
+  if (type !== 'object') {
+    return type;
+  }
+
+  // inspect [[Class]] for objects
+  return toString.call(obj)
+    .replace(objectRegExp, '$1');
+}
+
+/**
+ * Match path to a layer.
+ *
+ * @param {Layer} layer
+ * @param {string} path
+ * @private
+ */
+
+function matchLayer(layer, path) {
+  try {
+    return layer.match(path);
+  } catch (err) {
+    return err;
+  }
+}
+
+// merge params with parent params
+function mergeParams(params, parent) {
+  if (typeof parent !== 'object' || !parent) {
+    return params;
+  }
+
+  // make copy of parent for base
+  var obj = mixin({}, parent);
+
+  // simple non-numeric merging
+  if (!(0 in params) || !(0 in parent)) {
+    return mixin(obj, params);
+  }
+
+  var i = 0;
+  var o = 0;
+
+  // determine numeric gaps
+  while (i === o || o in parent) {
+    if (i in params) i++;
+    if (o in parent) o++;
+  }
+
+  // offset numeric indices in params before merge
+  for (i--; i >= 0; i--) {
+    params[i + o] = params[i];
+
+    // create holes for the merge when necessary
+    if (i < o) {
+      delete params[i];
+    }
+  }
+
+  return mixin(parent, params);
+}
+
+// restore obj props after function
+function restore(fn, obj) {
+  var props = new Array(arguments.length - 2);
+  var vals = new Array(arguments.length - 2);
+
+  for (var i = 0; i < props.length; i++) {
+    props[i] = arguments[i + 2];
+    vals[i] = obj[props[i]];
+  }
+
+  return function(err){
+    // restore vals
+    for (var i = 0; i < props.length; i++) {
+      obj[props[i]] = vals[i];
+    }
+
+    return fn.apply(this, arguments);
+  };
+}
+
+// send an OPTIONS response
+function sendOptionsResponse(res, options, next) {
+  try {
+    var body = options.join(',');
+    res.set('Allow', body);
+    res.send(body);
+  } catch (err) {
+    next(err);
+  }
+}
+
+// wrap a function
+function wrap(old, fn) {
+  return function proxy() {
+    var args = new Array(arguments.length + 1);
+
+    args[0] = old;
+    for (var i = 0, len = arguments.length; i < len; i++) {
+      args[i + 1] = arguments[i];
+    }
+
+    fn.apply(this, args);
+  };
+}

lib/router/layer.js

@@ -0,0 +1,176 @@
+/*!
+ * express
+ * Copyright(c) 2009-2013 TJ Holowaychuk
+ * Copyright(c) 2013 Roman Shtylman
+ * Copyright(c) 2014-2015 Douglas Christopher Wilson
+ * MIT Licensed
+ */
+
+'use strict';
+
+/**
+ * Module dependencies.
+ * @private
+ */
+
+var pathRegexp = require('path-to-regexp');
+var debug = require('debug')('express:router:layer');
+
+/**
+ * Module variables.
+ * @private
+ */
+
+var hasOwnProperty = Object.prototype.hasOwnProperty;
+
+/**
+ * Module exports.
+ * @public
+ */
+
+module.exports = Layer;
+
+function Layer(path, options, fn) {
+  if (!(this instanceof Layer)) {
+    return new Layer(path, options, fn);
+  }
+
+  debug('new %s', path);
+  var opts = options || {};
+
+  this.handle = fn;
+  this.name = fn.name || '<anonymous>';
+  this.params = undefined;
+  this.path = undefined;
+  this.regexp = pathRegexp(path, this.keys = [], opts);
+
+  if (path === '/' && opts.end === false) {
+    this.regexp.fast_slash = true;
+  }
+}
+
+/**
+ * Handle the error for the layer.
+ *
+ * @param {Error} error
+ * @param {Request} req
+ * @param {Response} res
+ * @param {function} next
+ * @api private
+ */
+
+Layer.prototype.handle_error = function handle_error(error, req, res, next) {
+  var fn = this.handle;
+
+  if (fn.length !== 4) {
+    // not a standard error handler
+    return next(error);
+  }
+
+  try {
+    fn(error, req, res, next);
+  } catch (err) {
+    next(err);
+  }
+};
+
+/**
+ * Handle the request for the layer.
+ *
+ * @param {Request} req
+ * @param {Response} res
+ * @param {function} next
+ * @api private
+ */
+
+Layer.prototype.handle_request = function handle(req, res, next) {
+  var fn = this.handle;
+
+  if (fn.length > 3) {
+    // not a standard request handler
+    return next();
+  }
+
+  try {
+    fn(req, res, next);
+  } catch (err) {
+    next(err);
+  }
+};
+
+/**
+ * Check if this route matches `path`, if so
+ * populate `.params`.
+ *
+ * @param {String} path
+ * @return {Boolean}
+ * @api private
+ */
+
+Layer.prototype.match = function match(path) {
+  if (path == null) {
+    // no path, nothing matches
+    this.params = undefined;
+    this.path = undefined;
+    return false;
+  }
+
+  if (this.regexp.fast_slash) {
+    // fast path non-ending match for / (everything matches)
+    this.params = {};
+    this.path = '';
+    return true;
+  }
+
+  var m = this.regexp.exec(path);
+
+  if (!m) {
+    this.params = undefined;
+    this.path = undefined;
+    return false;
+  }
+
+  // store values
+  this.params = {};
+  this.path = m[0];
+
+  var keys = this.keys;
+  var params = this.params;
+
+  for (var i = 1; i < m.length; i++) {
+    var key = keys[i - 1];
+    var prop = key.name;
+    var val = decode_param(m[i]);
+
+    if (val !== undefined || !(hasOwnProperty.call(params, prop))) {
+      params[prop] = val;
+    }
+  }
+
+  return true;
+};
+
+/**
+ * Decode param value.
+ *
+ * @param {string} val
+ * @return {string}
+ * @private
+ */
+
+function decode_param(val) {
+  if (typeof val !== 'string' || val.length === 0) {
+    return val;
+  }
+
+  try {
+    return decodeURIComponent(val);
+  } catch (err) {
+    if (err instanceof URIError) {
+      err.message = 'Failed to decode param \'' + val + '\'';
+      err.status = err.statusCode = 400;
+    }
+
+    throw err;
+  }
+}