v1.8.3WebSocket routing by URL path, ESM fixes→

Sixty seconds from now, your API is running.

One command scaffolds a typed, validated, production-ready backend. Auth, docs, WebSockets if you want them, and Moro's native engine already inside. There's nothing left to wire together before you write your first route.

$npx @morojs/cli init my-apiRead the docs

v1.8.3 on npm0 dependencies4 runtimesMIT licensed

The whole first minute, nothing skipped.

terminal

➜  npx @morojs/cli init my-api
✔ template · api
✔ validation · zod
✔ features · auth, docs
✔ project scaffolded
✔ dependencies installed

next: cd my-api && npm run dev

Interactive prompts, or pass --fast and skip them all.

my-api/

my-api/
├── moro.config.ts
└── src/
    ├── app.ts
    ├── routes/         ← your endpoints
    ├── modules/        ← versioned features
    ├── middleware/
    ├── validation/
    └── types/

Nothing exotic in here. Auth and docs are already wired up because you picked them at the prompt.

terminal

➜  npm run dev

moro v1.8.3 · engine moro (native)
✔ auth ready
✔ openapi docs at /docs

listening on http://localhost:3000

The native engine boots by default. On hosts where it can't load, plain Node takes over silently.

terminal

➜  curl localhost:3000/health
{ "status": "ok", "engine": "moro" }

➜  open http://localhost:3000/docs
# your API, documented, before you wrote a line

Under a minute, and every project after this one starts the same way.

The tradeoff

Every Node framework makes you choose

Picking a framework mostly means picking which compromise you can live with. There are production apps sitting in every corner of this chart.

speed →batteries included →fast, but emptyeverything, and fastneither, but familiareverything, but slow

Positioning, not a benchmark. The benchmark is further down the page.

The API

The parts you always build are already built

Auth, validation, real-time, middleware ordering. The things every project ends up rebuilding are a few declared lines here. Each tab below is a whole file, not a snippet.

Schema-first routing. Validate, type, and handle a route in one chain, without separate middleware files, DTO classes or decorators.

src/routes/users.ts

1import { createApp, z } from '@morojs/moro';2 3const app = await createApp();4 5app.post('/users')6  .body(z.object({7    name: z.string().min(1),8    email: z.string().email(),9    age: z.number().int().min(18),10  }))11  .handler((req) => {12    // req.body is typed and already validated13    return { id: crypto.randomUUID(), ...req.body };14  });15 16app.listen(3000);

The schema is the type

req.body and req.query are fully typed from the schema. No interfaces to keep in sync.

Validation before your code

Bad requests get a 400 with structured field errors before the handler ever runs.

Bring your validator

Zod, Joi, Yup, or Class Validator. Swap without rewriting routes.

Middleware that orders itself. Declare rate limits, validation, and caching in any order. Moro sorts them into ten fixed execution phases, every time.

src/routes/login.ts

1const app = await createApp({ cors: true, helmet: true });2 3// add these in any order you like4app.post('/auth/login')5  .body(z.object({6    email: z.string().email(),7    password: z.string().min(8),8  }))9  .rateLimit({ requests: 5, window: 60_000 })10  .cache({ ttl: 0 })11  .handler(login);12 13// declared after body and cache, still runs as14// security → parsing → rate limit → validation → handler

Ten fixed phases

Security, parsing, rate limit, auth, validation, then your handler. Moro applies that order however you declared them.

Reordering is safe

Move the calls around in the chain and the execution order stays exactly the same.

Built-ins included

cors, helmet, compression, body parsing. Nothing extra to install.

Real-time, in the same app. Sockets share your API's auth, sessions and middleware, so there's no second server to run and no plugin to go find.

src/routes/chat.ts

1app.websocket('/chat', {2  'join-room': (socket, { room, username }) => {3    socket.data.username = username;4    socket.join(room);5    socket.to(room).emit('user-joined', { username });6  },7 8  'send-message': (socket, { room, message }) => {9    socket.to(room).emit('new-message', {10      user: socket.data.username, message,11    });12  },13});

One app instance

WebSockets share the auth, sessions, and middleware of your HTTP routes.

Pluggable transports

Socket.IO, ws, or uWebSockets. Pick what fits, keep the same code.

Pick your protocol

WebSockets, SSE, GraphQL subscriptions, gRPC streaming. Same app.

Auth without glue code. OAuth providers, role-based access, JWT or database sessions are all part of the framework already.

src/app.ts

1import { createApp, auth, providers } from '@morojs/moro';2 3const app = await createApp();4 5app.use(auth({6  secret: process.env.AUTH_SECRET!,7  providers: [8    providers.github({ ... }),9    providers.google({ ... }),10  ],11  session: { strategy: 'jwt' },12}));13 14// github, google, microsoft, discord, apple, custom oidc

Production ready

Email and password, magic links, 2FA, organization roles.

No glue code

No passport, no next-auth, no separate auth server to run.

Provider agnostic

GitHub, Google, Microsoft, Discord, Apple, or any custom OIDC.

Performance

Every new project boots on the fast engine

It's Moro's own, and it falls back to plain Node automatically on hosts where it can't load. There's no flag to set and no tuning step. The numbers below are the same hello-world app measured with wrk, 100 connections, 40 seconds, on an Apple M-series box.

Requests per second, plaintextnon-pipelined

node http

68k

uWebSockets

101k

@morojs/engine

102k

July 2026 run. Expect different absolute numbers on your own hardware. Full methodology →

raw output · @morojs/engine 1.1.3

➜  wrk -c100 -d40s http://127.0.0.1:3000/Running 40s test @ http://127.0.0.1:3000/  2 threads and 100 connections  Latency    avg 0.90ms · p99 1.60ms  Req/Sec    51.2k per thread  4,096,360 requests in 40.00sRequests/sec:  102,409.23

pipelined x10 peaks at 584k req/s (clustered)measured jul 2026 · moro 1.8.0

Write once, deploy anywhere

Same code. Every runtime.

Your business logic doesn't care where it runs. Move from Node to the edge to Lambda by swapping the entry file. The routes never change.

src/app.ts

1export const app = await createApp();2 3app.get('/users/:id')4  .params(z.object({ id: z.string().uuid() }))5  .handler((req) => ({ id: req.params.id }));6 7app.post('/users')8  .body(z.object({ name: z.string(), email: z.string().email() }))9  .handler((req) => ({ id: crypto.randomUUID(), ...req.body }));

server.ts

1app.listen(3000, () => {2  console.log('Ready on :3000');3});

Long-running server on Moro's native engine.

no cold start

app/api/[...path]/route.ts

1export const runtime = 'edge';2const app = await createAppEdge();3export default app.getHandler();

Streaming responses at the edge, globally.

~15ms cold

handler.ts

1const app = await createAppLambda();2export const handler = app.getHandler();

API Gateway plus Lambda, zero-config handler.

~95ms cold

worker.ts

1const app = await createAppWorker();2export default { fetch: app.getHandler() };

300+ POPs, V8 isolates, KV and Durable Objects.

~8ms cold

Past the first minute

It grows the way projects actually grow

Everything below ships with the framework and loads the first time you call it. Until then it costs nothing, in bytes or in boot time.

Modules with versions

Group routes into modules and versioning happens for you.

defineModule({ name: 'users',
version: '1.0.0', ... })
// mounted at /api/v1.0.0/users

Jobs, same file

Cron, macros, or intervals. No second service to deploy.

app.job('cleanup', '0 2 * * *',
() => db.sessions.sweep())

One line of npm ls

The whole third-party audit surface of a new app:

$ npm ls @morojs/moro
└── @morojs/[email protected]
0 transitive dependencies

Docs write themselves

Routes self-describe, so OpenAPI docs exist the moment the server boots.

GET /docs → your API, documented

One config file

moro.config.ts drives every environment. Env vars override it cleanly, and the CLI validates it.

my-api/
└── moro.config.ts ← the whole story

One canonical shape

Routes, modules and jobs each have exactly one way to be written, so reviews get shorter, new people get productive sooner, and coding assistants stop inventing APIs that were never there.

// there is no second way to do this

And the rest of a backend

Each of these is a first call away. None of them load before that.

AuthGraphQLgRPCQueuesEmailHTTP/2Circuit breakerDIOpenAPISSECaching// lazy, all of it

No install required

Or try it right here

The playground runs a full Moro app in your browser tab. Nothing to install, no account to make, and closing the tab is all the cleanup there is.

Open the playground

playground.ts▶ RUN

1app.get('/', () => ({ hello: 'moro' }));2 3// → { "hello": "moro" }  ·  2ms

Start

Give it sixty seconds

If it turns out not to be what you wanted, delete the folder. You're out one minute.

$npx @morojs/cli init my-apiGet started