@nextrush/router 4.0.0-beta.0 → 4.0.0-beta.2

package/src/__tests__/helpers/differential-corpus.ts

@@ -29,9 +29,7 @@ import { createRouter, Router } from '../../router';
 
 /** A tagged no-op handler so a match result's `handler` is identifiable. */
 function h(tag: string): RouteHandler {
-  const fn = (async (_ctx: Context) => {
-    /* no-op */
-  }) as RouteHandler & { tag: string };
+  const fn = (async (_ctx: Context) => {}) as RouteHandler & { tag: string };
   fn.tag = tag;
   return fn;
 }

package/src/__tests__/match-node-indexed-unpooled.test.ts

@@ -0,0 +1,83 @@
+/**
+ * @nextrush/router - matchNodeIndexed's unpooled fallback stays correct
+ * (`reduce-router-match-allocations`)
+ *
+ * `Router` always supplies a `WalkPool` once it has any param/wildcard route
+ * (via `Router.addRoute`'s pool-rebuild hook), so the unpooled branch of
+ * `matchNodeIndexed` has no reachable caller through the public API today.
+ * It is kept as an explicit, documented fallback for any future direct caller
+ * that doesn't have a pool — this file is that caller, proving the fallback
+ * itself is still correct (same results as the pooled path) rather than
+ * leaving it as untested dead code.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { matchNodeIndexed } from '../matching';
+import { createNode, NodeType, type HandlerEntry } from '../segment-trie';
+import { compileExecutor } from '../segment-trie';
+
+const noop = async (): Promise<void> => {};
+
+function buildTrie() {
+  const root = createNode('');
+  const files = createNode('files');
+  root.children.set('files', files);
+  const executor = compileExecutor(noop, []);
+  const entry: HandlerEntry = { handler: noop, middleware: [], executor };
+
+  const idNode = createNode(':id', NodeType.PARAM);
+  idNode.paramName = 'id';
+  idNode.handlers.set('GET', entry);
+  files.paramChild = idNode;
+
+  const wildcard = createNode('*', NodeType.WILDCARD);
+  wildcard.handlers.set('GET', entry);
+  root.wildcardChild = wildcard;
+
+  return { root, entry };
+}
+
+describe('matchNodeIndexed — unpooled fallback (no WalkPool argument)', () => {
+  it('matches a param route without a pool', () => {
+    const { root, entry } = buildTrie();
+    const bindNames: string[] = [];
+    const bindValues: string[] = [];
+    const result = matchNodeIndexed(root, '/files/42', 1, bindNames, bindValues, 'GET', true);
+    expect(result).toBe(entry);
+    expect(bindNames).toEqual(['id']);
+    expect(bindValues).toEqual(['42']);
+  });
+
+  it('returns the empty-segment terminal handler on a bare trailing slash', () => {
+    const root = createNode('');
+    const executor = compileExecutor(noop, []);
+    const entry: HandlerEntry = { handler: noop, middleware: [], executor };
+    root.handlers.set('GET', entry);
+    const bindNames: string[] = [];
+    const bindValues: string[] = [];
+    // Position 1 on '/' lands on an empty segment at the root itself.
+    const result = matchNodeIndexed(root, '/', 1, bindNames, bindValues, 'GET', true);
+    expect(result).toBe(entry);
+  });
+
+  it('backtracks from a failed param branch to a wildcard without a pool', () => {
+    const { root, entry } = buildTrie();
+    const bindNames: string[] = [];
+    const bindValues: string[] = [];
+    // No 'files' segment here — falls through directly to the root's own wildcard.
+    const result = matchNodeIndexed(root, '/anything/here', 1, bindNames, bindValues, 'GET', true);
+    expect(result).toBe(entry);
+    expect(bindNames).toEqual(['*']);
+    expect(bindValues).toEqual(['anything/here']);
+  });
+
+  it('returns null cleanly on a miss without a pool', () => {
+    const root = createNode('');
+    const bindNames: string[] = [];
+    const bindValues: string[] = [];
+    const result = matchNodeIndexed(root, '/nope', 1, bindNames, bindValues, 'GET', true);
+    expect(result).toBeNull();
+    expect(bindNames).toEqual([]);
+    expect(bindValues).toEqual([]);
+  });
+});

package/src/__tests__/match-normalize-fastpath.test.ts

@@ -14,9 +14,7 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 import { normalizePathForMatch } from '../matching';
 import { createRouter } from '../router';
 
-const noop: RouteHandler = async () => {
-  /* no-op */
-};
+const noop: RouteHandler = async () => {};
 
 afterEach(() => {
   vi.restoreAllMocks();

package/src/__tests__/match-prenormalized.test.ts

@@ -0,0 +1,95 @@
+/**
+ * @nextrush/router - F-10 preNormalized fast-path
+ *
+ * Pins the fix for F-10 (reconciliation report, Week 2): on the real HTTP
+ * dispatch path (`Router.routes()` -> `createRoutesMiddleware`), the request
+ * path is already canonicalized via `canonicalizePath()` before `match()` is
+ * ever called, so `matchRoute`'s own independent fold+collapse re-derivation
+ * (HP-12's `caseStable`/`isProvablyLowerAscii` decision) is pure repeated
+ * work on that path. `resolveMatch`/`matchRoute` gain a `preNormalized`
+ * parameter (default `false`) that, when `true`, trusts the input as already
+ * canonical and skips the fold+collapse re-derivation entirely. `Router.
+ * match()` — the public two-argument method used by tests and direct API
+ * callers, none of which canonicalize first — is unaffected: it still omits
+ * the argument and gets today's behavior exactly.
+ *
+ * Note: this test intentionally does not assert on path-parameter casing —
+ * a pre-existing, separate behavior (confirmed present before this change,
+ * unrelated to F-10) where `Router.routes()`'s dispatch path already
+ * publishes a case-folded `ctx.path` upstream of `match()` for a
+ * case-insensitive router, regardless of this fix. F-10 is about redundant
+ * computation, not about that param-casing question — out of this change's
+ * scope.
+ */
+
+import type { RouteHandler } from '@nextrush/types';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { resolveMatch, type MatchState } from '../match-route';
+import { createRouter } from '../router';
+
+const noop: RouteHandler = async () => {};
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+function buildState(overrides: Partial<MatchState> = {}): MatchState {
+  const router = createRouter();
+  router.get('/users/:id', noop);
+  const state = (router as unknown as { state: MatchState }).state;
+  return { ...state, ...overrides };
+}
+
+describe("F-10 — preNormalized skips matchRoute's redundant fold+collapse re-derivation", () => {
+  it('preNormalized: true skips the fold entirely, even on an uppercase path a fold would normally catch', () => {
+    const state = buildState();
+    const spy = vi.spyOn(String.prototype, 'toLowerCase');
+
+    // A caller passing preNormalized: true is asserting "I already
+    // canonicalized this" — matchRoute must trust that and never re-fold,
+    // even though '/USERS/ID' looks like it would otherwise trigger HP-12's
+    // fold branch. This is the direct, unambiguous proof the flag suppresses
+    // the fold step itself, independent of any caller's actual behavior.
+    resolveMatch(state, true, 'GET', '/USERS/ID', true);
+
+    expect(spy).not.toHaveBeenCalled();
+  });
+
+  it('preNormalized omitted (default false) behaves identically to today — still folds when needed', () => {
+    const state = buildState();
+    const match = resolveMatch(state, true, 'GET', '/Users/AbC');
+
+    expect(match).not.toBeNull();
+    expect(match?.params).toEqual({ id: 'AbC' });
+  });
+
+  it("Router.routes()'s internal dispatch wires preNormalized: true (no toLowerCase inside matchRoute for an already-canonical path)", async () => {
+    const router = createRouter();
+    router.get('/users/:id', noop);
+    const middleware = router.routes();
+
+    const ctx = {
+      path: '/users/abc',
+      originalPath: '/users/abc',
+      method: 'GET',
+      params: {},
+      set: () => undefined,
+    } as unknown as import('@nextrush/types').Context;
+
+    const spy = vi.spyOn(String.prototype, 'toLowerCase');
+    await middleware(ctx, undefined);
+
+    // canonicalizePath's own upstream fold call (for ctx.path) is the only
+    // toLowerCase attributable to this dispatch — matchRoute must add none.
+    expect(spy.mock.calls.length).toBeLessThanOrEqual(1);
+  });
+
+  it("Router.match() — the public two-argument method — is unaffected: still folds its own raw input", () => {
+    const router = createRouter();
+    router.get('/users/:id', noop);
+
+    const match = router.match('GET', '/Users/AbC');
+    expect(match).not.toBeNull();
+    expect(match?.params).toEqual({ id: 'AbC' });
+  });
+});

package/src/__tests__/match-safety.test.ts

@@ -19,21 +19,68 @@ import { afterEach, describe, expect, it, vi } from 'vitest';
 import { EMPTY_PARAMS } from '../constants';
 import { createRouter } from '../router';
 
-const noop: RouteHandler = async () => {
-  /* no-op */
-};
+const noop: RouteHandler = async () => {};
 
 afterEach(() => {
   vi.restoreAllMocks();
 });
 
-describe('HP-11 — null-prototype params (D8)', () => {
-  it('materializes a populated params object with a null prototype', () => {
+describe('HP-11 — params expose no Object.prototype (D8)', () => {
+  it('materializes a populated params object whose chain excludes Object.prototype', () => {
     const router = createRouter();
     router.get('/users/:id', noop);
     const match = router.match('GET', '/users/42');
     expect(match?.params).toEqual({ id: '42' });
-    expect(Object.getPrototypeOf(match?.params)).toBeNull();
+
+    // The requirement is that `Object.prototype` is unreachable, NOT that the
+    // immediate prototype is literally `null` — params are built on a shared
+    // null-prototype base so V8 keeps them in fast-property mode. Walk the whole
+    // chain: it must terminate, and never pass through `Object.prototype`.
+    let proto: unknown = Object.getPrototypeOf(match?.params);
+    let hops = 0;
+    while (proto !== null) {
+      expect(proto).not.toBe(Object.prototype);
+      proto = Object.getPrototypeOf(proto as object);
+      expect(++hops).toBeLessThan(10);
+    }
+    expect(match?.params instanceof Object).toBe(false);
+  });
+
+  it('keeps the params container in V8 fast-property mode', () => {
+    // %HasFastProperties needs --allow-natives-syntax, which vitest's threads
+    // pool cannot enable; the enforced gate is
+    // apps/benchmark/scripts/alloc/params-shape-gate.mjs. This asserts the
+    // structural precondition that gate depends on: params derive from a shared
+    // base object, not from `null`.
+    const router = createRouter();
+    router.get('/a/:x', noop);
+    router.get('/b/:y', noop);
+
+    const first = Object.getPrototypeOf(router.match('GET', '/a/1')?.params);
+    const second = Object.getPrototypeOf(router.match('GET', '/b/2')?.params);
+    expect(first).not.toBeNull();
+    expect(first).toBe(second);
+    expect(Object.getPrototypeOf(first as object)).toBeNull();
+    expect(Object.keys(first as object)).toHaveLength(0);
+  });
+
+  it('behaves identically to a plain object under every enumeration path', () => {
+    const router = createRouter();
+    router.get('/u/:id/:tab', noop);
+    const params = router.match('GET', '/u/42/profile')?.params as Record<string, string>;
+
+    expect(JSON.stringify(params)).toBe('{"id":"42","tab":"profile"}');
+    expect({ ...params }).toEqual({ id: '42', tab: 'profile' });
+    expect(Object.keys(params)).toEqual(['id', 'tab']);
+    expect(Object.entries(params)).toEqual([
+      ['id', '42'],
+      ['tab', 'profile'],
+    ]);
+    const seen: string[] = [];
+    for (const k in params) seen.push(k);
+    expect(seen).toEqual(['id', 'tab']);
+    expect(structuredClone(params)).toEqual({ id: '42', tab: 'profile' });
+    expect(Object.assign({}, params)).toEqual({ id: '42', tab: 'profile' });
   });
 
   it('exposes no inherited Object.prototype members on params', () => {
@@ -51,7 +98,6 @@ describe('HP-11 — null-prototype params (D8)', () => {
     expect(match).not.toBeNull();
     expect(Object.prototype.hasOwnProperty.call(match?.params, '__proto__')).toBe(true);
     expect((match?.params as Record<string, string>)['__proto__']).toBe('danger');
-    // No global prototype pollution.
     expect(({} as Record<string, unknown>)['danger']).toBeUndefined();
     expect((Object.prototype as Record<string, unknown>)['danger']).toBeUndefined();
   });

package/src/__tests__/match-single-alloc.test.ts

@@ -18,9 +18,7 @@ import { matchRoute } from '../match-route';
 import { compileExecutor, createNode, NodeType, type HandlerEntry, type StaticRouteMap } from '../segment-trie';
 import { createRouter } from '../router';
 
-const noop: RouteHandler = async () => {
-  /* no-op */
-};
+const noop: RouteHandler = async () => {};
 
 describe('HP-10 — single RouteMatch allocation', () => {
   it('matchRoute attaches routerMiddleware to its own returned object (param walk)', () => {

package/src/__tests__/match-walk-pool-safety.test.ts

@@ -0,0 +1,103 @@
+/**
+ * @nextrush/router - reused walk-frame pool safety (`reduce-router-match-allocations`)
+ *
+ * `matchNodeIndexed`'s `WalkFrame[]` stack and `matchRoute`'s `bindNames`/
+ * `bindValues` arrays are pooled per-router-instance to avoid a fresh
+ * allocation on every call (F-02). Pinned here, per the new `router`
+ * capability requirement ("Reused internal walk state is never shared across
+ * concurrent in-flight matches"): pooling must never let one match observe or
+ * corrupt another's in-progress walk, and the walk must stay fully
+ * synchronous end-to-end for that guarantee to hold.
+ *
+ * `match-safety.test.ts`'s existing "concurrency isolation (D10)" describe
+ * block already proves the returned `params` object is never shared across
+ * matches — that stays true unchanged by this pool, since `params` is still
+ * materialized fresh via `Object.create(null)` regardless of pooling. This
+ * file adds the pool-specific contract the existing suite doesn't cover:
+ * sequential reuse safety and synchronous-only execution.
+ */
+
+import type { RouteHandler } from '@nextrush/types';
+import { describe, expect, it } from 'vitest';
+import { createRouter } from '../router';
+
+const noop: RouteHandler = async () => {};
+
+describe('reused walk state — sequential matches reuse pooled scratch safely', () => {
+  it('a second match on the same router is unaffected by the first match’s path or params', () => {
+    const router = createRouter();
+    router.get('/users/:id', noop);
+    router.get('/orgs/:orgId/teams/:teamId', noop);
+
+    const first = router.match('GET', '/orgs/42/teams/7');
+    const second = router.match('GET', '/users/99');
+
+    expect(first?.params).toEqual({ orgId: '42', teamId: '7' });
+    expect(second?.params).toEqual({ id: '99' });
+  });
+
+  it('a miss followed by a hit on the same router produces a clean, uncontaminated result', () => {
+    const router = createRouter();
+    router.get('/a/:x/c', noop);
+    router.get('/a/b/d', noop);
+
+    const miss = router.match('GET', '/a/zz/zz');
+    const hit = router.match('GET', '/a/b/c');
+
+    expect(miss).toBeNull();
+    expect(hit?.params).toEqual({ x: 'b' });
+  });
+
+  it('many interleaved matches at varying depth never bleed state into each other', () => {
+    const router = createRouter();
+    router.get('/x/:a', noop);
+    router.get('/y/:a/:b/:c', noop);
+    router.get('/z', noop);
+
+    const results = Array.from({ length: 500 }, (_, i) => {
+      const variant = i % 3;
+      if (variant === 0) return router.match('GET', `/x/v${i}`);
+      if (variant === 1) return router.match('GET', `/y/p${i}/q${i}/r${i}`);
+      return router.match('GET', '/z');
+    });
+
+    results.forEach((m, i) => {
+      const variant = i % 3;
+      if (variant === 0) expect(m?.params).toEqual({ a: `v${i}` });
+      else if (variant === 1) expect(m?.params).toEqual({ a: `p${i}`, b: `q${i}`, c: `r${i}` });
+      else expect(m).not.toBeNull();
+    });
+  });
+});
+
+describe('reused walk state — the walk never suspends mid-frame', () => {
+  it('router.match returns synchronously (never a Promise) for a hit', () => {
+    const router = createRouter();
+    router.get('/users/:id', noop);
+    const result = router.match('GET', '/users/1');
+    expect(result).not.toBeInstanceOf(Promise);
+  });
+
+  it('router.match returns synchronously (never a Promise) for a miss', () => {
+    const router = createRouter();
+    router.get('/users/:id', noop);
+    const result = router.match('GET', '/nope');
+    expect(result).not.toBeInstanceOf(Promise);
+  });
+
+  it('a deep param match completes entirely within one synchronous call (no microtask boundary)', () => {
+    const router = createRouter();
+    router.get('/' + Array.from({ length: 50 }, () => ':p').join('/'), noop);
+    const path = '/' + Array.from({ length: 50 }, (_, i) => `x${i}`).join('/');
+
+    let sawMicrotask = false;
+    queueMicrotask(() => {
+      sawMicrotask = true;
+    });
+    const result = router.match('GET', path);
+    // If the walk had suspended on a promise, the queued microtask above
+    // would have had a chance to run before match() returned.
+    expect(sawMicrotask).toBe(false);
+    expect(result).not.toBeNull();
+  });
+});

package/src/__tests__/public-surface.test.ts

@@ -30,7 +30,20 @@ describe('Public API surface (runtime exports)', () => {
     // `createNode`/`NodeType`/`parseSegments` are internal segment-trie
     // helpers exposed for advanced usage (see the barrel's own comment) —
     // locked as-is here; renaming any of them is a separate breaking change.
-    const expectedRuntime = ['createRouter', 'endpoint', 'Router', 'createNode', 'NodeType', 'parseSegments'].sort();
+    // `canonicalizePath`/`hasDotSegment` are RFC-029's canonical-path surface:
+    // the single normalization owner every path-based consumer (mount-prefix
+    // matching, CSRF exclude paths, a hand-written policy guard) should call
+    // instead of re-deriving its own fold/collapse/strip.
+    const expectedRuntime = [
+      'createRouter',
+      'endpoint',
+      'Router',
+      'createNode',
+      'NodeType',
+      'parseSegments',
+      'canonicalizePath',
+      'hasDotSegment',
+    ].sort();
 
     expect(actualExports).toEqual(expectedRuntime);
     expect(typeof NodeType).toBe('object');

package/src/__tests__/registration-max-depth.test.ts

@@ -0,0 +1,56 @@
+/**
+ * @nextrush/router - registration-time max-depth tracking
+ *
+ * `addRoute` inserts each route's `:param`/static segments as a chain of trie
+ * nodes. The reused walk-frame pool (`reduce-router-match-allocations`) needs
+ * this chain's worst-case length known at registration time, not guessed —
+ * an attacker's request path can never make the walk descend deeper than the
+ * trie's own real depth (a mismatched segment backtracks, it never pushes),
+ * so sizing the pool from registered-route depth preserves the walk's
+ * existing recursion-depth DoS guard rather than reintroducing it.
+ */
+
+import { describe, expect, it } from 'vitest';
+import { addRoute, type RegistrationState } from '../registration';
+import { createNode } from '../segment-trie';
+
+function createState(): RegistrationState & { maxDepth: number } {
+  return {
+    root: createNode(''),
+    caseSensitive: false,
+    staticRoutes: new Map(),
+    routeDefinitions: [],
+    maxDepth: 0,
+  };
+}
+
+const noop = async (): Promise<void> => {};
+
+describe('registration tracks the deepest registered route', () => {
+  it('a single-segment route has depth 1', () => {
+    const state = createState();
+    addRoute('GET', '/a', [noop], [], state);
+    expect(state.maxDepth).toBe(1);
+  });
+
+  it('tracks the deepest of several routes, not the last registered', () => {
+    const state = createState();
+    addRoute('GET', '/a', [noop], [], state);
+    addRoute('GET', '/a/b/c/:id', [noop], [], state);
+    addRoute('GET', '/x', [noop], [], state);
+    expect(state.maxDepth).toBe(4);
+  });
+
+  it('a wildcard segment counts toward depth but never pushes beyond it', () => {
+    const state = createState();
+    addRoute('GET', '/files/*', [noop], [], state);
+    expect(state.maxDepth).toBe(2);
+  });
+
+  it('registering a shallower route after a deeper one does not shrink maxDepth', () => {
+    const state = createState();
+    addRoute('GET', '/a/b/c', [noop], [], state);
+    addRoute('GET', '/x', [noop], [], state);
+    expect(state.maxDepth).toBe(3);
+  });
+});

package/src/__tests__/router-audit.test.ts

@@ -19,7 +19,6 @@ describe('Router audit', () => {
     router = createRouter();
   });
 
-  // ── Phase 1: route path syntax ──────────────────────────────────────────
   describe('phase 1 — path syntax support', () => {
     it('supports the colon param syntax /users/:id', () => {
       router.get('/users/:id', h());
@@ -28,7 +27,6 @@ describe('Router audit', () => {
 
     it('CHARACTERIZATION: brace syntax /users/{id} is a LITERAL static segment (not a param)', () => {
       router.get('/users/{id}', h());
-      // Only the literal path matches; it does NOT capture a param.
       expect(router.match('GET', '/users/{id}')).not.toBeNull();
       expect(router.match('GET', '/users/{id}')?.params).toEqual({});
       expect(router.match('GET', '/users/42')).toBeNull();
@@ -43,7 +41,6 @@ describe('Router audit', () => {
     });
   });
 
-  // ── Phase 2: routing correctness ─────────────────────────────────────────
   describe('phase 2 — correctness', () => {
     it('matches the root route', () => {
       router.get('/', h());
@@ -106,7 +103,6 @@ describe('Router audit', () => {
     });
   });
 
-  // ── Phase 3: priority ────────────────────────────────────────────────────
   describe('phase 3 — priority (static > param > wildcard)', () => {
     it('prefers a static route over a param route', () => {
       const staticH = h();
@@ -147,7 +143,6 @@ describe('Router audit', () => {
     });
   });
 
-  // ── Phase 4: nested / deep routes ────────────────────────────────────────
   describe('phase 4 — nested & deep routes', () => {
     it('matches deeply nested param chains', () => {
       router.get('/api/v1/orgs/:orgId/teams/:teamId/members/:memberId', h());
@@ -171,7 +166,6 @@ describe('Router audit', () => {
     });
   });
 
-  // ── Phase 6: query strings must not affect matching ──────────────────────
   describe('phase 6 — query strings are ignored during matching', () => {
     it('matches a static route with a query string', () => {
       router.get('/users', h());
@@ -189,7 +183,6 @@ describe('Router audit', () => {
     });
   });
 
-  // ── Phase 7: decoding & unicode ──────────────────────────────────────────
   describe('phase 7 — decoding & unicode', () => {
     it('matches unicode path segments (raw)', () => {
       router.get('/u/:name', h());
@@ -207,7 +200,6 @@ describe('Router audit', () => {
     });
   });
 
-  // ── Phase 8: HTTP methods ────────────────────────────────────────────────
   describe('phase 8 — HTTP methods', () => {
     it('registers and matches all standard methods', () => {
       const methods: HttpMethod[] = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'];
@@ -244,7 +236,6 @@ describe('Router audit', () => {
     });
   });
 
-  // ── Phase 9: large scale ─────────────────────────────────────────────────
   describe('phase 9 — large scale', () => {
     it('stays correct with 1000 mixed static/param routes', () => {
       for (let i = 0; i < 1000; i++) {
@@ -258,7 +249,6 @@ describe('Router audit', () => {
     });
   });
 
-  // ── Phase 10: failure cases ──────────────────────────────────────────────
   describe('phase 10 — failure & graceful handling', () => {
     it('throws a clear error on duplicate route registration', () => {
       router.get('/dup', h());
@@ -286,7 +276,6 @@ describe('Router audit', () => {
     });
   });
 
-  // ── Phase 12: historical routing bugs from other frameworks ──────────────
   describe('phase 12 — hardening against known routing bugs', () => {
     it('does not confuse a param value with a similarly-named static route', () => {
       router.get('/search', h());

package/src/__tests__/router-edge-cases.test.ts

@@ -9,9 +9,6 @@ import type { Context, RouteHandler } from '@nextrush/types';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { createRouter, Router } from '../router';
 
-/**
- * Create mock context for testing
- */
 function createMockContext(overrides: Partial<Context> = {}): Context {
   return {
     method: 'GET',
@@ -260,7 +257,6 @@ describe('Router Edge Cases', () => {
 
     it('should not match wildcard if path ends at parent', () => {
       router.get('/files/*', vi.fn());
-      // Path doesn't have anything after /files
       expect(router.match('GET', '/files')).toBeNull();
     });
   });
@@ -387,7 +383,6 @@ describe('Router Edge Cases', () => {
       const ctx = createMockContext({ method: 'GET', path: '/chain' });
       await router.routes()(ctx, async () => {});
 
-      // Middleware should execute before handler
       expect(order).toEqual([1, 2, 0, 3, 4]);
     });
   });

package/src/__tests__/router.test.ts

@@ -6,9 +6,6 @@ import type { Context, HttpMethod, RouteHandler } from '@nextrush/types';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { createRouter, Router } from '../router';
 
-/**
- * Create mock context for testing
- */
 function createMockContext(overrides: Partial<Context> = {}): Context {
   return {
     method: 'GET',
@@ -269,7 +266,6 @@ describe('Router', () => {
       // the path normalization removes trailing slashes during split
       expect(r.match('GET', '/users')).not.toBeNull();
       expect(r.match('GET', '/users/')).not.toBeNull();
-      // Note: Full strict mode differentiation is a future enhancement
     });
   });
 
@@ -288,7 +284,6 @@ describe('Router', () => {
 
       await middleware(ctx, async () => {});
 
-      // Handler is called with ctx and a next function
       expect(handler).toHaveBeenCalled();
       expect(handler.mock.calls[0]?.[0]).toBe(ctx);
     });

package/src/__tests__/static-map-reset.test.ts

@@ -13,9 +13,7 @@ import type { RouteHandler } from '@nextrush/types';
 import { describe, expect, it } from 'vitest';
 import { createRouter } from '../router';
 
-const noop: RouteHandler = async () => {
-  /* no-op */
-};
+const noop: RouteHandler = async () => {};
 
 describe('HP-9 — reset() clears the method-nested static map fully', () => {
   it('clears static entries across every method and leaves no ghost matches', () => {