Replace Express servers with Fastify

[DamianReeves]

Summary

Replaces Morphir-Elm's first-party Express web servers with Fastify while preserving the existing public route behavior.

This PR migrates:

• morphir-elm develop dev server
• morphir-elm treeview server
• standalone server/server.js
• generated Dapr app shell template in cli/assets/DaprAppShell.js

It also updates direct dependencies so first-party code no longer depends on Express or body-parser for these server entrypoints, while leaving transitive third-party Express dependencies untouched.

Motivation

Express is no longer the recommended web server for this codebase. The goal is to move first-party server code to Fastify without changing the behavior expected by existing CLI/web workflows.

Details

CLI develop server

• Replaces express with fastify and @fastify/static.
• Preserves the 100mb JSON body limit.
• Preserves existing /server/* JSON endpoints.
• Preserves SPA fallback behavior for unmatched GET routes.
• Preserves the startup log format.

CLI treeview server

• Replaces express with fastify and @fastify/static.
• Preserves morphir.json and morphir-ir.json JSON routes.
• Preserves SVG logo serving.
• Supports project-specific treeview logo overrides and falls back to the packaged logo when a project has no logo.
• Preserves SPA fallback behavior.

Standalone server

• Replaces express with fastify and @fastify/static.
• Preserves host 0.0.0.0, port 8080, and the 50mb JSON body limit.
• Preserves /insight, /insight.html, /insight.js, /server/morphir-ir.json, and logo asset routes.
• Preserves POST /insight behavior by writing the posted IR and returning the HTML app body.
• Preserves /verify response behavior by avoiding Fastify's special handling of raw Error instances.

Generated Dapr app shell

• Replaces Express and body-parser with Fastify.
• Adds a Fastify content-type parser for application/*+json, which is needed for Dapr CloudEvents-style payloads.
• Uses Fastify 5-compatible listen({ port }) startup.

Regression Coverage

Adds tests-integration/cli/fastify-server-smoke.test.ts to cover the migrated server behavior:

• develop server JSON routes and SPA fallback
• treeview packaged SVG serving
• treeview project SVG override
• treeview packaged SVG fallback when the project has no logo
• standalone POST /insight returning HTML and writing IR JSON
• generated Dapr app shell startup and application/*+json topic POST handling

The regression tests were also copied into known-bad intermediate worktrees during development to confirm they catch real migration failures:

• treeview missing-logo fallback returned HTTP 500
• standalone POST /insight returned an empty body
• generated Dapr app shell crashed with Fastify 5 positional listen(...)

Validation

• rg -n 'require\("express"\)|require\('\''express'\''\)|from "express"|from '\''express'\''' cli server package.json returned no first-party direct Express imports
• bun test tests-integration/cli/fastify-server-smoke.test.ts - 6 pass, 0 fail
• bun test tests-integration/cli - 56 pass, 3 skip, 0 fail
• mise run test:check-package-lock
• mise run build:cli
• mise run build:bundle
• node --check on migrated JavaScript entrypoints
• git diff --check main..HEAD

Notes

• Transitive Express dependencies remain in lockfiles where they are owned by third-party packages.
• The new tests use path.join, path.delimiter, and process.execPath to avoid Unix-only assumptions and keep the smoke suite portable across Windows and Unix-like environments.
• No AI co-author trailers were added to commits.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d0b8d28f13

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".