@ndiinginc/router 4.5.0 → 4.6.1

package/README.md

@@ -11,9 +11,9 @@ Router HTTP kecil, cepat, dan **zero-dependency** untuk Node.js. Dibangun langsu
 - Nested router dengan `use(path, router)`
 - Middleware global dan per-path, mendukung `async`
 - Error handler dengan signature `(err, req, res)`
-- Timeout per request (`req.timeout`) yang menghasilkan `504`
+- Timeout per request yang menghasilkan `504`, dengan `req.signal` untuk pembatalan kooperatif
 - `req.path`, `req.query`, `req.params`, `req.body`
-- Helper `res.send()` dan `res.json()`
+- Helper `res.status()`, `res.send()`, dan `res.json()`
 - Middleware bawaan: `json()` (dengan limit dan proteksi prototype pollution) dan `cors()`
 - Semua HTTP method, termasuk `QUERY`
 
@@ -43,7 +43,7 @@ app.get("/users/:id", (req, res) => {
 });
 
 app.post("/users", (req, res) => {
-    res.json({ received: req.body });
+    res.status(201).json({ received: req.body });
 });
 
 app.listen(3000);
@@ -82,6 +82,8 @@ app.get("/profile", authenticate, loadUser, (req, res) => {
 
 ### Parameter dinamis
 
+Nilai parameter otomatis di-decode dengan `decodeURIComponent`. Jika formatnya tidak valid (misalnya `%`), nilai mentah dipakai apa adanya.
+
 ```js
 app.get("/posts/:postId/comments/:commentId", (req, res) => {
     const { postId, commentId } = req.params;
@@ -118,8 +120,7 @@ app.use((req, res) => {
 // Scoped: jalan untuk /admin dan semua sub-path-nya
 app.use("/admin", async (req, res) => {
     if (req.headers.authorization !== "secret") {
-        res.statusCode = 401;
-        res.json({ error: "Unauthorized" });
+        res.status(401).json({ error: "Unauthorized" });
     }
 });
 ```
@@ -149,7 +150,7 @@ app.use("/admin", admin);
 // GET /admin/users/42   -> { id: "42" }
 ```
 
-> Tree sub-router digabungkan saat `use()` dipanggil. Daftarkan semua route ke sub-router **sebelum** di-mount; route yang ditambahkan setelahnya tidak ikut. Satu instance sub-router sebaiknya hanya di-mount satu kali.
+> Isi sub-router disalin saat `use()` dipanggil. Daftarkan semua route ke sub-router **sebelum** di-mount; route yang ditambahkan setelahnya tidak ikut. Sub-router yang sama boleh di-mount di beberapa path.
 
 ## Error Handling
 
@@ -161,8 +162,7 @@ app.get("/boom", () => {
 });
 
 app.use((err, req, res) => {
-    res.statusCode = err.statusCode || 500;
-    res.json({ error: { message: err.message } });
+    res.status(err.statusCode || 500).json({ error: { message: err.message } });
 });
 ```
 
@@ -170,23 +170,18 @@ app.use((err, req, res) => {
 
 ### Menentukan status code
 
-Ada dua cara:
+Status code diambil dari properti `statusCode` pada error. Tanpa properti itu, hasilnya `500`.
 
 ```js
-// 1. Properti statusCode pada error
 app.get("/admin", () => {
     const err = new Error("Forbidden");
     err.statusCode = 403;
     throw err;
 });
-
-// 2. Set res.statusCode sebelum throw
-app.get("/limit", (req, res) => {
-    res.statusCode = 429;
-    throw new Error("Too Many Requests");
-});
 ```
 
+> `res.statusCode` atau `res.status()` yang diset **sebelum** error dilempar tidak dipakai oleh respons default. Gunakan `err.statusCode`, atau tangani sendiri di error handler.
+
 ### Respons default
 
 Jika tidak ada handler yang mengirim response, router mengirim JSON otomatis:
@@ -196,35 +191,44 @@ Jika tidak ada handler yang mengirim response, router mengirim JSON otomatis:
 ```
 
 - Tidak ada route cocok: `404 Not Found`
-- Error tanpa status code: `500`
-- Jika `res.statusCode` sudah `>= 400`, nilainya dipertahankan
+- Error dengan `statusCode`: status tersebut dipakai
+- Error tanpa `statusCode`: `500`
 - Jika error handler sendiri melempar error, error baru dibuat dengan `cause` menunjuk error asli
-
 - Field `stack` hanya disertakan saat `NODE_ENV=development`
 
 ## Timeout
 
-Set `req.timeout` (milidetik) untuk membatasi waktu eksekusi handler. Jika terlampaui, error `504 Gateway Timeout` dilempar dan diteruskan ke error handler.
+Aktifkan lewat opsi `timeout` (milidetik) pada `App`. Jika seluruh chain handler melebihi waktu tersebut, error `504 Gateway Timeout` dilempar dan diteruskan ke error handler.
 
 ```js
-app.use((req) => {
-    req.timeout = 5000;
+const app = new App({ timeout: 5000 });
+```
+
+- Tanpa opsi `timeout` (atau bernilai `0`), tidak ada batas waktu
+- Handler yang sudah berjalan tidak dihentikan paksa. Tetapi setelah response dikirim, `res.json()` dan `res.send()` mengabaikan penulisan berikutnya, dan handler selanjutnya di chain tidak dipanggil
+
+### `req.signal`
+
+Saat `timeout` aktif, `req.signal` adalah `AbortSignal` yang di-abort ketika timeout terjadi (reason-nya error 504) atau ketika salah satu handler melempar error (reason-nya error tersebut). Teruskan ke operasi yang mendukungnya agar pekerjaan ikut dibatalkan:
+
+```js
+app.get("/proxy", async (req, res) => {
+    const upstream = await fetch("https://example.com/api", { signal: req.signal });
+    res.json(await upstream.json());
 });
 ```
 
-- Nilai default `0` (tanpa timeout)
-- Harus diset **secara sinkron di middleware pertama** pada chain, karena dibaca sesaat setelah chain mulai berjalan
-- Timeout tidak membatalkan handler yang sedang berjalan; hanya menghentikan penantian dan mengirim error
+`req.signal` bernilai `undefined` jika `timeout` tidak diaktifkan.
 
 ## Request
 
 | Properti | Keterangan |
 | --- | --- |
 | `req.path` | Pathname tanpa query string |
-| `req.query` | Object query string, di-parse secara lazy. Key yang berulang menjadi array |
-| `req.params` | Parameter dari route dinamis (sudah di-decode dengan `decodeURIComponent`) |
+| `req.query` | Object query string, di-parse secara lazy. Key yang berulang menjadi array, dan `+` di-decode menjadi spasi |
+| `req.params` | Parameter dari route dinamis (sudah di-decode) |
 | `req.body` | Hasil parse body (butuh middleware `json()`) |
-| `req.timeout` | Batas waktu handler dalam ms (default `0`) |
+| `req.signal` | `AbortSignal` yang di-abort saat timeout atau error handler (hanya jika `timeout` aktif) |
 
 ```js
 // GET /search?tag=a&tag=b&page=2
@@ -233,15 +237,22 @@ app.get("/search", (req, res) => {
 });
 ```
 
+`req.query` dan `req.params` memakai object tanpa prototype, jadi gunakan `Object.hasOwn(req.query, "key")` atau `"key" in req.query`, bukan `req.query.hasOwnProperty(...)`.
+
 `Request` adalah turunan `http.IncomingMessage`, jadi `req.headers`, `req.method`, dan lainnya tetap tersedia.
 
 ## Response
 
 | Method | Keterangan |
 | --- | --- |
+| `res.status(code)` | Set status code, mengembalikan `res` sehingga bisa di-chain |
 | `res.send(chunk)` | Kirim response dan akhiri |
 | `res.json(value)` | Set `Content-Type: application/json`, serialize, lalu kirim |
 
+```js
+res.status(201).json({ created: true });
+```
+
 `Response` adalah turunan `http.ServerResponse`, jadi `res.statusCode`, `res.setHeader()`, dan lainnya tetap tersedia.
 
 ## Middleware Bawaan
@@ -280,7 +291,7 @@ app.use(
 
 | Opsi | Default | Keterangan |
 | --- | --- | --- |
-| `origin` | `"*"` | `"*"`, string origin, atau `null` |
+| `origin` | `"*"` | `"*"`, satu origin, daftar dipisah koma, pola dengan `*` (misalnya `https://*.example.com`), atau `null` |
 | `credentials` | `false` | Mengirim `Access-Control-Allow-Credentials: true` |
 | `headers` | - | `"*"` atau array nama header |
 | `methods` | - | `"*"` atau array nama method |
@@ -289,25 +300,31 @@ app.use(
 Perilaku:
 
 - Request `OPTIONS` dijawab langsung dengan `204` dan chain berhenti
-- Dengan `origin: "*"` dan `credentials: true`, origin dari request dipantulkan dan header `Vary: Origin` ditambahkan
+- `Access-Control-Allow-Headers` dan `Access-Control-Allow-Methods` hanya dikirim pada preflight, jika nilai yang diminta ada di daftar
+- Jika `origin` berupa daftar atau pola (atau `"*"` dengan `credentials: true`), origin dari request dipantulkan bila cocok. Pencocokan dilakukan pada seluruh string (tanpa memperhatikan huruf besar/kecil), dan header `Vary: Origin` ditambahkan pada request non-preflight
 - Nilai `"*"` untuk `headers` dan `methods` diabaikan saat `credentials: true`, sesuai spesifikasi CORS
 - Pada request non-preflight, `headers` (jika array) dikirim sebagai `Access-Control-Expose-Headers`
 
-## Opsi Router
+> `origin: "*"` bersama `credentials: true` memantulkan **semua** origin dengan credentials. Pakai hanya untuk development; di production sebutkan origin secara eksplisit.
+
+## Opsi
 
 ```js
-const app = new App({ size: 1000 });
+const app = new App({ size: 1000, timeout: 5000 });
 ```
 
 | Opsi | Default | Keterangan |
 | --- | --- | --- |
 | `size` | `1000` | Jumlah maksimum entri LRU cache untuk hasil lookup `METHOD path` |
+| `timeout` | - | Batas waktu handler dalam ms (khusus `App`). Lihat bagian [Timeout](#timeout) |
+
+`Router` hanya menerima `size`.
 
 ## API
 
 ### `new App([options])` / `new Router([options])`
 
-Membuat instance baru. `App` adalah `Router` ditambah `listen()`.
+Membuat instance baru. `App` adalah `Router` ditambah `listen()` dan dukungan `timeout`.
 
 ### `router.use([path], ...handlers | router)`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ndiinginc/router",
-  "version": "4.5.0",
+  "version": "4.6.1",
   "description": "",
   "main": "./src/index.js",
   "scripts": {

package/src/app.js

@@ -11,13 +11,32 @@ const SERVER_OPTIONS = {
 };
 
 class App extends Router {
-    async withTimeout(handlerPromise, delay) {
-        let timeout;
+    async withTimeout(req, handlerPromise) {
+        const controller = new AbortController();
+        const { signal } = controller;
+
+        req.signal = signal;
+
+        const timeout = setTimeout(() => {
+            controller.abort(ErrorResponse.status(504));
+        }, this.timeout);
+
+        let handleAbort;
         const timeoutPromise = new Promise((_, reject) => {
-            timeout = setTimeout(() => reject(ErrorResponse.status(504)), delay);
+            handleAbort = () => reject(signal.reason);
+            signal.addEventListener("abort", handleAbort, { once: true });
         });
 
-        await Promise.race([handlerPromise, timeoutPromise]).finally(() => clearTimeout(timeout));
+        const promise = handlerPromise().catch((error) => {
+            if (!signal.aborted) {
+                controller.abort(error);
+            }
+        });
+
+        await Promise.race([promise, timeoutPromise]).finally(() => {
+            signal.removeEventListener("abort", handleAbort);
+            clearTimeout(timeout);
+        });
     }
 
     /**
@@ -26,22 +45,19 @@ class App extends Router {
      */
     async handle(req, res) {
         const { params, handlers, errorHandlers } = this.find(req.method, req.path);
-        req.params = params;
-
+        req.params = Object.assign(Object.create(null), params);
         let err;
         try {
-            const handlerPromise = (async () => {
+            const handlerPromise = async () => {
                 for (const handler of handlers) {
                     if (res.writableEnded) break;
                     await handler(req, res);
                 }
-            })();
-
-            if (req.timeout) await this.withTimeout(handlerPromise, req.timeout);
-            else await handlerPromise;
+            };
+            if (this.timeout) await this.withTimeout(req, handlerPromise);
+            else await handlerPromise();
         } catch (error) {
             err = error;
-
             try {
                 for (const handler of errorHandlers) {
                     if (res.writableEnded) break;
@@ -51,14 +67,9 @@ class App extends Router {
                 err = new Error(error.message, { cause: err });
             }
         }
-
         if (!res.writableEnded) {
             if (!err) err = ErrorResponse.status(404);
-
-            if (!res.statusCode || res.statusCode < 400) {
-                res.statusCode = err.statusCode || 500;
-            }
-
+            res.statusCode = err.statusCode || 500;
             const error = { message: err.message };
             if (process.env.NODE_ENV === "development") {
                 error.stack = err.stack;

package/src/error.js

@@ -5,21 +5,21 @@ const http = require("node:http");
 class ErrorResponse extends Error {
     constructor({ statusCode, message } = {}, options) {
         super(message, options);
-
         this.name = this.constructor.name;
-
         if (Error.captureStackTrace) {
             Error.captureStackTrace(this, this.constructor);
         }
-
         this.statusCode = statusCode;
     }
 
-    static status(statusCode) {
-        return new ErrorResponse({
-            statusCode,
-            message: http.STATUS_CODES[statusCode],
-        });
+    static status(statusCode, options) {
+        return new ErrorResponse(
+            {
+                statusCode,
+                message: http.STATUS_CODES[statusCode],
+            },
+            options,
+        );
     }
 }
 

package/src/index.js

@@ -1,4 +1,4 @@
-require('./polyfill.js')
+require("./polyfill.js");
 const { json } = require("./middleware/json.js");
 const { cors } = require("./middleware/cors.js");
 const { App } = require("./app.js");

package/src/middleware/cors.js

@@ -1,10 +1,10 @@
 function pattern(string) {
     return new RegExp(
-        `(${String(string)
+        `^(${String(string)
             .replace(/[.*+?^${}()|[\]\\]/g, "\\$&")
             .replace(/ /g, "")
             .replace(/,/g, "|")
-            .replace(/\\\*/g, ".*")})`,
+            .replace(/\\\*/g, ".*")})$`,
         "i",
     );
 }
@@ -42,7 +42,6 @@ function cors({ origin = "*", credentials = false, headers, maxAge = 0, methods
     function setAllowHeaders(req, res) {
         const reqHeaders = req.headers["access-control-request-headers"];
         if (!reqHeaders) return;
-
         let value;
         if (headers === "*" && !credentials) {
             value = "*";
@@ -59,7 +58,6 @@ function cors({ origin = "*", credentials = false, headers, maxAge = 0, methods
     function setAllowMethods(req, res) {
         const reqMethod = req.headers["access-control-request-method"];
         if (!reqMethod) return;
-
         let value;
         if (methods === "*" && !credentials) {
             value = "*";
@@ -73,25 +71,21 @@ function cors({ origin = "*", credentials = false, headers, maxAge = 0, methods
      * @param {import('http').IncomingMessage} req
      * @param {import('http').ServerResponse} res
      */
-    function setAllowOrigin(req, res) {
+    function setAllowOrigin(req, res, preflight = true) {
         const reqOrigin = req.headers["origin"];
 
         let value;
         let explicit;
-        if (origin === "*") {
-            if (!credentials) value = "*";
-            else {
-                value = reqOrigin;
-                explicit = true;
-            }
+        if (origin === "*" && !credentials) {
+            value = "*";
         } else if (origin === null) {
             value = "null";
-        } else if (typeof origin === "string" && ORIGIN_PATTERN.test(reqOrigin)) {
-            value = origin;
+        } else if (ORIGIN_PATTERN.test(reqOrigin)) {
+            value = reqOrigin;
             explicit = true;
         }
         if (value) res.setHeader("Access-Control-Allow-Origin", value);
-        if (explicit) res.appendHeader("Vary", "Origin");
+        if (!preflight && explicit) res.appendHeader("Vary", "Origin");
     }
 
     /**
@@ -122,16 +116,16 @@ function cors({ origin = "*", credentials = false, headers, maxAge = 0, methods
      */
     return (req, res) => {
         setAllowCredentials(res);
-        setAllowOrigin(req, res);
         if (req.method === "OPTIONS") {
+            setAllowOrigin(req, res);
             setAllowHeaders(req, res);
             setAllowMethods(req, res);
             setMaxAge(res);
-
             res.statusCode = 204;
             res.setHeader("Content-Length", "0");
             res.end();
         } else {
+            setAllowOrigin(req, res, false);
             setExposeHeaders(res);
         }
     };

package/src/middleware/json.js

@@ -1,6 +1,6 @@
 const http = require("node:http");
+const { ErrorResponse } = require("../error.js");
 
-// middleware
 function json({ limit = 100 * 1024 } = {}) {
     const reviver = (key, value) => {
         if (key === "__proto__" || key === "constructor" || key === "prototype") {
@@ -8,46 +8,35 @@ function json({ limit = 100 * 1024 } = {}) {
         }
         return value;
     };
-
     return async (req, res) => {
         if (!["POST", "PUT", "PATCH", "QUERY"].includes(req.method)) {
             return;
         }
-
         const contentType = req.headers["content-type"];
         if (!contentType || !contentType.includes("application/json")) {
             return;
         }
-
         const contentLength = parseInt(req.headers["content-length"], 10);
         if (contentLength && contentLength > limit) {
-            res.statusCode = 413;
-            throw new Error(http.STATUS_CODES[res.statusCode]);
+            throw ErrorResponse.status(413);
         }
-
         let chunkLength = 0;
-
         const chunks = [];
-
         for await (const chunk of req) {
             chunkLength += chunk.length;
             if (chunkLength > limit) {
-                res.statusCode = 413;
-                throw new Error(http.STATUS_CODES[res.statusCode]);
+                throw ErrorResponse.status(413);
             }
             chunks.push(chunk);
         }
-
         if (chunks.length === 0) {
             req.body = null;
             return;
         }
-
         try {
             req.body = JSON.parse(Buffer.concat(chunks), reviver);
         } catch (error) {
-            res.statusCode = 400;
-            throw new Error("Invalid JSON body");
+            throw new ErrorResponse({ statusCode: 400, message: "Invalid JSON body" }, { cause: error });
         }
     };
 }

package/src/node.js

@@ -1,6 +1,5 @@
 const { Pattern } = require("./pattern.js");
 
-
 class Node {
     constructor(segment = "") {
         this.hasRegExpChildren = false;
@@ -11,58 +10,37 @@ class Node {
     }
 
     add(segment) {
-        const node = new Node(segment);
-        if (node.pattern) this.hasRegExpChildren = true; // node.hasRegExp;
-        return this.children.getOrInsert(segment,node);
+        return this.children.getOrInsertComputed(segment, () => {
+            const node = new Node(segment);
+            if (node.pattern) this.hasRegExpChildren = true;
+            return node;
+        });
     }
 
-    /**
-     * @param {Node} node
-     */
     merge(node, offset) {
-        for (const [method, handlers] of node.handlers) {
-            for (const handler of handlers) {
-                handler.seq += offset;
-                this.handlers.getOrInsert(method,[]).push(handler);
+        for (const [method, entries] of node.handlers) {
+            const target = this.handlers.getOrInsert(method, []);
+            for (const entry of entries) {
+                target.push({ ...entry, seq: entry.seq + offset });
             }
         }
-
         for (const [segment, child] of node.children) {
-            if (child.pattern) this.hasRegExpChildren = true; // child.hasRegExp;
-            if (!this.children.has(segment)) {
-                child.setSeqOffset(offset);
-                this.children.set(segment, child);
-            } else {
-                this.children.get(segment).merge(child, offset);
-            }
-        }
-    }
-
-    setSeqOffset(offset) {
-        for (const [, handlers] of this.handlers) {
-            for (const handler of handlers) {
-                handler.seq += offset;
-            }
-        }
-
-        for (const [, child] of this.children) {
-            child.setSeqOffset(offset);
+            const target = this.children.getOrInsertComputed(segment, () => new Node(segment));
+            if (target.pattern) this.hasRegExpChildren = true;
+            target.merge(child, offset);
         }
     }
 
     getMaxSeq() {
         let max = -1;
-
         for (const [, handlers] of this.handlers) {
-            for (const handler of handlers) {
-                max = Math.max(max, handler.seq);
+            for (const entry of handlers) {
+                max = Math.max(max, entry.seq);
             }
         }
-
         for (const [, child] of this.children) {
             max = Math.max(max, child.getMaxSeq());
         }
-
         return max;
     }
 }

package/src/polyfill.js

@@ -1,21 +1,21 @@
-// Polyfill for Map.prototype.getOrInsert
-if (!Map.prototype.getOrInsert) {
-    Map.prototype.getOrInsert = function (key, defaultValue) {
-        if (!this.has(key)) {
-            this.set(key, defaultValue);
-        }
-        return this.get(key);
-    };
-}
-// Polyfill for Map.prototype.getOrInsertComputed
-if (!Map.prototype.getOrInsertComputed) {
-    Map.prototype.getOrInsertComputed = function (key, callbackFunction) {
-        if (typeof callbackFunction !== 'function') {
-            throw new TypeError('The callback argument must be a function');
-        }
-        if (!this.has(key)) {
-            this.set(key, callbackFunction(key));
-        }
-        return this.get(key);
-    };
-}
+// Polyfill for Map.prototype.getOrInsert
+if (!Map.prototype.getOrInsert) {
+    Map.prototype.getOrInsert = function (key, defaultValue) {
+        if (!this.has(key)) {
+            this.set(key, defaultValue);
+        }
+        return this.get(key);
+    };
+}
+// Polyfill for Map.prototype.getOrInsertComputed
+if (!Map.prototype.getOrInsertComputed) {
+    Map.prototype.getOrInsertComputed = function (key, callback) {
+        if (typeof callback !== "function") {
+            throw new TypeError("The callback argument must be a function");
+        }
+        if (!this.has(key)) {
+            this.set(key, callback(key));
+        }
+        return this.get(key);
+    };
+}

package/src/request.js

@@ -6,16 +6,13 @@ class Request extends http.IncomingMessage {
     _parsed;
     _query;
     params = {};
-    timeout = 0;
-
+    signal;
     get path() {
         if (this._path) return this._path;
-
-        if (this.url.indexOf("?") === -1) {
+        if (!/[?#]/.test(this.url)) {
             this._path = this.url;
             return this._path;
         }
-
         this._parsed = parseUrl(this.url);
         this._path = this._parsed.path;
         return this._path;
@@ -23,12 +20,10 @@ class Request extends http.IncomingMessage {
 
     get query() {
         if (this._query) return this._query;
-
         if (!this._parsed) {
-            this._query = {};
+            this._query = Object.create(null);
             return this._query;
         }
-
         this._query = parseQueryString(this._parsed.queryString);
         return this._query;
     }

package/src/response.js

@@ -1,11 +1,20 @@
 const http = require("node:http");
 
 class Response extends http.ServerResponse {
+    status(statusCode) {
+        this.statusCode = statusCode;
+        return this;
+    }
     send(chunk) {
+        if (this.writableEnded) return;
         this.end(chunk);
     }
-
     json(value) {
+        if (this.writableEnded) return;
+        if (this.headersSent) {
+            this.end();
+            return;
+        }
         this.setHeader("Content-Type", "application/json");
         this.end(JSON.stringify(value));
     }

package/src/router.js

@@ -1,10 +1,11 @@
 const { Node } = require("./node.js");
 const { Cache } = require("./cache.js");
+const {  decodePathParam } = require("./util.js");
 
 class Router {
     constructor(options = {}) {
+        this.timeout = options.timeout ?? 0;
         this.cacheSize = options.size ?? 1000;
-
         this.root = new Node();
         this.seq = 0;
         this.cache = new Cache(this.cacheSize);
@@ -19,9 +20,7 @@ class Router {
             handlers = [path, ...handlers];
             path = null;
         }
-
         let node = this.root;
-
         if (path !== null) {
             for (const segment of this.split(path)) {
                 node = node.add(segment);
@@ -31,10 +30,13 @@ class Router {
         for (const handler of handlers) {
             if (handler.root) {
                 node.merge(handler.root, this.seq);
-                this.seq = node.getMaxSeq() + 1;
+                this.seq += handler.root.getMaxSeq() + 1;
             } else {
-                handler.seq = this.seq++;
-                node.handlers.getOrInsert(method,[]).push(handler);
+                node.handlers.getOrInsert(method, []).push({
+                    handler,
+                    seq: this.seq++,
+                    isErrorHandler: handler.length === 3,
+                });
             }
         }
     }
@@ -94,6 +96,22 @@ class Router {
         return this;
     }
 
+    matchRegExp(node, input, params) {
+        let matched;
+        for (const [, child] of node.children) {
+            if (!child.pattern) continue;
+            const match = child.pattern.exec(input);
+            if (match) {
+                matched = child;
+                for (const name in match.groups) {
+                    params[name] = decodePathParam(match.groups[name]);
+                }
+                break;
+            }
+        }
+        return matched;
+    }
+
     /**
      * @param {'GET'|'QUERY'|'HEAD'|'OPTIONS'|'TRACE'|'PUT'|'DELETE'|'POST'|'PATCH'|'CONNECT'} method
      * @param {String} path
@@ -101,73 +119,47 @@ class Router {
      */
     find(method, path) {
         const key = `${method} ${path}`;
-
         const cached = this.cache.get(key);
         if (cached) return cached;
-
         let node = this.root;
-
         let params = Object.create(null);
         const handlers = {};
         const errorHandlers = {};
-
         for (const input of this.split(path)) {
             let matched = node.children.get(input);
-
             if (!matched && node.hasRegExpChildren) {
-                for (const [, child] of node.children) {
-                    if (!child.pattern) continue;
-                    const match = child.pattern.exec(input);
-                    if (match) {
-                        matched = child;
-                        for (const name in match.groups) {
-                            const raw = match.groups[name];
-                            try {
-                                params[name] = decodeURIComponent(raw);
-                            } catch {
-                                params[name] = raw;
-                            }
-                        }
-                        break;
-                    }
-                }
+                matched = this.matchRegExp(node, input, params);
             }
-
             if (!matched) {
                 node = null;
                 params = Object.create(null);
                 break;
             }
-
             node = matched;
-
-            if(node.handlers.has("ALL"))
-            for (const handler of node.handlers.get("ALL")) {
-                if (handler.length === 3) errorHandlers[handler.seq] = handler;
-                else handlers[handler.seq] = handler;
+            if (node.handlers.has("ALL")) {
+                for (const entry of node.handlers.get("ALL")) {
+                    if (entry.isErrorHandler) errorHandlers[entry.seq] = entry.handler;
+                    else handlers[entry.seq] = entry.handler;
+                }
             }
         }
-
-        if(this.root.handlers.has("ALL"))
-        for (const handler of this.root.handlers.get("ALL")) {
-            if (handler.length === 3) errorHandlers[handler.seq] = handler;
-            else handlers[handler.seq] = handler;
+        if (this.root.handlers.has("ALL")) {
+            for (const entry of this.root.handlers.get("ALL")) {
+                if (entry.isErrorHandler) errorHandlers[entry.seq] = entry.handler;
+                else handlers[entry.seq] = entry.handler;
+            }
         }
-
-        if (node&&node.handlers.has(method)) {
-            for (const handler of node.handlers.get(method)) {
-                handlers[handler.seq] = handler;
+        if (node && node.handlers.has(method)) {
+            for (const entry of node.handlers.get(method)) {
+                handlers[entry.seq] = entry.handler;
             }
         }
-
         const result = {
             params,
             handlers: Object.values(handlers),
             errorHandlers: Object.values(errorHandlers),
         };
-
         this.cache.set(key, result);
-
         return result;
     }
 }

package/src/util.js

@@ -1,39 +1,42 @@
 const URL_REGEX = /^([^?#]*)(\?([^#]*))?(#.*)?$/;
 const QUERY_STRING_REGEX = /([^=&]*)?=([^&]*)?/g;
 
+function decodeQueryParam(encoded) {
+    try {
+        return decodeURIComponent(encoded.replace(/\+/g, " "));
+    } catch (error) {
+        return encoded;
+    }
+}
+exports.decodeQueryParam = decodeQueryParam;
+
+function decodePathParam(encoded) {
+    try {
+        return decodeURIComponent(encoded);
+    } catch {
+        return encoded;
+    }
+}
+exports.decodePathParam=decodePathParam
+
 function parseQueryString(queryString) {
     const result = Object.create(null);
-
     let match;
     while ((match = QUERY_STRING_REGEX.exec(queryString)) !== null) {
         const [, rawName = "", rawValue = ""] = match;
-
-        let name 
-        try {
-            name = decodeURIComponent(rawName)
-        } catch (error) {
-            name=rawName
-        }
-        
-        let value 
-        try {
-            value = decodeURIComponent(rawValue)
-        } catch (error) {
-            value=rawValue
-        }
-
-        if (result[name]) {
+        const name = decodeQueryParam(rawName);
+        const value = decodeQueryParam(rawValue);
+        if (Object.hasOwn(result, name)) {
             if (Array.isArray(result[name])) result[name].push(value);
             else result[name] = [result[name], value];
         } else result[name] = value;
     }
-
     return result;
 }
 exports.parseQueryString = parseQueryString;
 
 function parseUrl(url) {
-    const [, path = "/", , queryString = ""] = URL_REGEX.exec(url);
-    return { path, queryString };
+    const [, rawPath = "", , queryString = ""] = URL_REGEX.exec(url);
+    return { path: rawPath || "/", queryString };
 }
 exports.parseUrl = parseUrl;