@rangojs/router 0.0.0-experimental.1878aa49 → 0.0.0-experimental.190fb30d

package/src/host/cookie-handler.ts

@@ -1,9 +1,3 @@
-/**
- * Cookie Override Handler
- *
- * Manages cookie-based host override for development environments.
- */
-
 import type { HostOverrideConfig } from "./types.js";
 import type { RouterRequestInput } from "../router/router-interfaces.js";
 import { matchPattern, parseRequest } from "./pattern-matcher.js";
@@ -12,52 +6,21 @@ import {
   InvalidHostnameError,
   HostValidationError,
 } from "./errors.js";
+import { parseCookiesFromHeader } from "../server/cookie-parse.js";
 
-/**
- * Parse cookies from request
- */
 export function parseCookies(request: Request): Record<string, string> {
-  const cookieHeader = request.headers.get("cookie");
-  if (!cookieHeader) {
-    return {};
-  }
-
-  const cookies: Record<string, string> = {};
-  const pairs = cookieHeader.split(";");
-
-  for (const pair of pairs) {
-    const [name, ...rest] = pair.trim().split("=");
-    if (name && rest.length > 0) {
-      const value = rest.join("=");
-      try {
-        cookies[name] = decodeURIComponent(value);
-      } catch {
-        cookies[name] = value;
-      }
-    }
-  }
-
-  return cookies;
+  return parseCookiesFromHeader(request.headers.get("cookie"));
 }
 
-/**
- * Get cookie value from request
- */
 export function getCookie(request: Request, name: string): string | undefined {
   const cookies = parseCookies(request);
   return cookies[name];
 }
 
-/**
- * Create Set-Cookie header to delete a cookie
- */
 export function createDeleteCookieHeader(name: string): string {
   return `${name}=; Max-Age=0; Path=/; Secure; HttpOnly`;
 }
 
-/**
- * Create error response with cookie deletion
- */
 export function createCookieErrorResponse(
   cookieName: string,
   message: string,
@@ -77,9 +40,6 @@ export function createCookieErrorResponse(
   );
 }
 
-/**
- * Check if current host is allowed to use override
- */
 export function isHostAllowed(
   request: Request,
   allowedHosts: string[],
@@ -95,12 +55,6 @@ export function isHostAllowed(
   return false;
 }
 
-/**
- * Handle cookie override logic
- *
- * Returns overridden hostname if valid, original hostname if no override.
- * Throws errors for invalid overrides.
- */
 export function handleCookieOverride(
   request: Request,
   config: HostOverrideConfig | undefined,
@@ -115,51 +69,46 @@ export function handleCookieOverride(
   const cookieValue = getCookie(request, cookieName);
   const { hostname: originalHostname } = parseRequest(request);
 
-  // No cookie - return original hostname
   if (!cookieValue) {
     return originalHostname;
   }
 
-  // Check if current host is allowed
   const allowed = isHostAllowed(request, allowedHosts);
 
-  // If not allowed, throw error
   if (!allowed) {
     throw new HostOverrideNotAllowedError(originalHostname, cookieName, {
       cause: { cookieValue, currentHost: originalHostname },
     });
   }
 
-  // If allowed and has custom validation, run it
   if (validate) {
     try {
       const validatedHostname = validate(request, cookieValue, input);
       return validatedHostname;
     } catch (error) {
-      // Wrap in HostValidationError
       const message = error instanceof Error ? error.message : String(error);
       throw new HostValidationError(message, error);
     }
   }
 
-  // Default validation - verify it's a valid hostname using URL constructor
+  // URL.hostname ASCII-lowercases the host, so compare the cookie value against
+  // its canonical lowercase form (a mixed-case host is valid) and reject only
+  // when it carries a path/port. Return the canonical host so downstream
+  // matching, which assumes lowercase, sees a consistent value.
   try {
-    // Try to construct a URL with the hostname to validate it
     const testUrl = new URL(`https://${cookieValue}`);
 
-    // Ensure the hostname matches what we provided (URL constructor normalizes it)
-    if (testUrl.hostname !== cookieValue) {
+    if (testUrl.hostname !== cookieValue.toLowerCase()) {
       throw new InvalidHostnameError(cookieValue, {
         cause: { original: cookieValue, normalized: testUrl.hostname },
       });
     }
+
+    return testUrl.hostname;
   } catch (error) {
-    // If URL constructor failed, throw InvalidHostnameError with cause
     if (error instanceof InvalidHostnameError) {
       throw error;
     }
     throw new InvalidHostnameError(cookieValue, { cause: error });
   }
-
-  return cookieValue;
 }

package/src/host/errors.ts

@@ -4,16 +4,10 @@
  * All host router errors extend HostRouterError for easy instance checking.
  */
 
-/**
- * Error options with cause
- */
 interface ErrorOptions {
   cause?: unknown;
 }
 
-/**
- * Base error class for all host router errors
- */
 export class HostRouterError extends Error {
   cause?: unknown;
 
@@ -27,9 +21,6 @@ export class HostRouterError extends Error {
   }
 }
 
-/**
- * Error thrown when pattern validation fails
- */
 export class InvalidPatternError extends HostRouterError {
   constructor(pattern: string, reason: string, options?: ErrorOptions) {
     super(`Invalid pattern "${pattern}": ${reason}`, options);
@@ -38,9 +29,6 @@ export class InvalidPatternError extends HostRouterError {
   }
 }
 
-/**
- * Error thrown when cookie override is not allowed
- */
 export class HostOverrideNotAllowedError extends HostRouterError {
   constructor(currentHost: string, cookieName: string, options?: ErrorOptions) {
     super(
@@ -52,9 +40,6 @@ export class HostOverrideNotAllowedError extends HostRouterError {
   }
 }
 
-/**
- * Error thrown when cookie hostname is invalid
- */
 export class InvalidHostnameError extends HostRouterError {
   constructor(hostname: string, options?: ErrorOptions) {
     super(`Invalid hostname format: "${hostname}"`, options);
@@ -63,9 +48,6 @@ export class InvalidHostnameError extends HostRouterError {
   }
 }
 
-/**
- * Error thrown when custom validation fails
- */
 export class HostValidationError extends HostRouterError {
   constructor(message: string, cause?: unknown) {
     super(message, { cause });
@@ -74,9 +56,6 @@ export class HostValidationError extends HostRouterError {
   }
 }
 
-/**
- * Error thrown when no route matches
- */
 export class NoRouteMatchError extends HostRouterError {
   constructor(hostname: string, pathname: string, options?: ErrorOptions) {
     super(`No route matched for ${hostname}${pathname}`, options);
@@ -86,8 +65,20 @@ export class NoRouteMatchError extends HostRouterError {
 }
 
 /**
- * Error thrown when handler type is invalid
+ * True when `err` is a NoRouteMatchError — including one thrown by a
+ * DUPLICATED @rangojs/router copy in the module graph (a workspace pinning a
+ * second version), whose class identity differs so a bare `instanceof` misses
+ * it and an unmatched-host 404 becomes an opaque 500. Use this in worker
+ * catch blocks instead of `instanceof`; it also matches by the stable `name`
+ * the constructor stamps.
  */
+export function isNoRouteMatchError(err: unknown): err is NoRouteMatchError {
+  return (
+    err instanceof NoRouteMatchError ||
+    (err instanceof Error && err.name === "NoRouteMatchError")
+  );
+}
+
 export class InvalidHandlerError extends HostRouterError {
   constructor(handler: unknown, options?: ErrorOptions) {
     super(`Invalid handler type: ${typeof handler}`, options);

package/src/host/index.ts

@@ -11,8 +11,8 @@
  *
  * const router = createHostRouter();
  *
- * router.host(['.']).map(() => import('./apps/main'));
- * router.host(['admin.*']).map(() => import('./apps/admin'));
+ * router.host(['.']).lazy(() => import('./apps/main'));
+ * router.host(['admin.*']).lazy(() => import('./apps/admin'));
  *
  * export default {
  *   fetch(request) {
@@ -20,6 +20,12 @@
  *   }
  * };
  * ```
+ *
+ * The host surface (`Handler`, `Middleware`, `match`, `HostOverrideConfig.validate`)
+ * types `input` as `RouterRequestInput<any>` by design: a host router fans out to
+ * heterogeneous sub-apps with differing env/vars shapes, so there is no single
+ * `TEnv`/`TVars` to thread through. `input.env`/`input.vars` are therefore `any`
+ * here; the typed env shape lives on each sub-app's `createRouter<TEnv>()`.
  */
 
 // Core router
@@ -36,6 +42,7 @@ export {
   InvalidHostnameError,
   HostValidationError,
   NoRouteMatchError,
+  isNoRouteMatchError,
   InvalidHandlerError,
 } from "./errors.js";
 

package/src/host/pattern-matcher.ts

@@ -12,15 +12,18 @@
  * - `**.example.com` - any depth subdomain
  * - `admin.*` - admin subdomain of any apex
  * - `example.com/admin` - specific domain with path prefix
+ *
+ * Apex vs subdomain is classified purely by dot-part COUNT (apex == exactly 2
+ * parts) — there is no Public Suffix List. A registrable domain under a
+ * multi-label public suffix (example.co.uk, shop.com.au) has 3+ parts and is
+ * therefore treated as a SUBDOMAIN, not an apex: `.`/`*` will NOT match it and
+ * `*.` WILL. If registrable-domain accuracy matters for a host-router consumer,
+ * supply an explicit apex/host hint rather than relying on the part count.
  */
 
 import { InvalidPatternError } from "./errors.js";
 
-/**
- * Normalize a pattern by removing trailing slashes from paths
- */
 export function normalizePattern(pattern: string): string {
-  // If pattern has a path component, remove trailing slash
   const slashIndex = pattern.indexOf("/");
   if (slashIndex !== -1) {
     const domain = pattern.slice(0, slashIndex);
@@ -30,9 +33,6 @@ export function normalizePattern(pattern: string): string {
   return pattern;
 }
 
-/**
- * Parse hostname and path from request URL
- */
 export function parseRequest(request: Request): {
   hostname: string;
   pathname: string;
@@ -46,26 +46,14 @@ export function parseRequest(request: Request): {
   return { hostname, pathname, parts };
 }
 
-/**
- * Count subdomain levels (0 for apex, 1+ for subdomains)
- */
 function getSubdomainLevel(parts: string[]): number {
-  // Apex domain has 2 parts (example.com)
-  // Single subdomain has 3 parts (www.example.com)
-  // Multi-level has 4+ parts (a.b.example.com)
   return Math.max(0, parts.length - 2);
 }
 
-/**
- * Check if hostname is an apex domain (no subdomains)
- */
 function isApexDomain(parts: string[]): boolean {
   return parts.length === 2;
 }
 
-/**
- * Match a single pattern against hostname and path
- */
 export function matchPattern(
   pattern: string,
   hostname: string,
@@ -74,19 +62,30 @@ export function matchPattern(
 ): boolean {
   const normalized = normalizePattern(pattern);
 
-  // Check if pattern has path component
   const slashIndex = normalized.indexOf("/");
   const hasPath = slashIndex !== -1;
-  const domainPattern = hasPath ? normalized.slice(0, slashIndex) : normalized;
+  // Hosts are case-insensitive (RFC 3986): lowercase the domain literal and the
+  // request host once so matching folds case. Wildcards (*, **, .) are
+  // unaffected by lowercasing. The path is left untouched (paths are
+  // case-sensitive).
+  const domainPattern = (
+    hasPath ? normalized.slice(0, slashIndex) : normalized
+  ).toLowerCase();
   const pathPattern = hasPath ? normalized.slice(slashIndex) : null;
 
-  // First match domain
-  const domainMatch = matchDomainPattern(domainPattern, hostname, parts);
+  const lowerHostname = hostname.toLowerCase();
+  const lowerParts =
+    lowerHostname === hostname ? parts : lowerHostname.split(".");
+
+  const domainMatch = matchDomainPattern(
+    domainPattern,
+    lowerHostname,
+    lowerParts,
+  );
   if (!domainMatch) {
     return false;
   }
 
-  // Then match path (prefix match)
   if (pathPattern) {
     return pathname === pathPattern || pathname.startsWith(pathPattern + "/");
   }
@@ -94,81 +93,62 @@ export function matchPattern(
   return true;
 }
 
-/**
- * Match domain pattern against hostname
- */
 function matchDomainPattern(
   pattern: string,
   hostname: string,
   parts: string[],
 ): boolean {
-  // Exact match
   if (pattern === hostname) {
     return true;
   }
 
-  // `.` or `*` - any apex domain
   if (pattern === "." || pattern === "*") {
     return isApexDomain(parts);
   }
 
-  // `**` - any domain (apex + all subdomains)
   if (pattern === "**") {
     return true;
   }
 
-  // `*.` - any single-level subdomain
   if (pattern === "*.") {
     return getSubdomainLevel(parts) === 1;
   }
 
-  // `**.` - any multi-level subdomain (2+ levels)
   if (pattern === "**.") {
     return getSubdomainLevel(parts) >= 2;
   }
 
-  // `*.tld` - any apex domain with specific TLD (e.g., *.com)
   if (pattern.startsWith("*.") && !pattern.includes(".", 2)) {
     const tld = pattern.slice(2);
     return isApexDomain(parts) && hostname.endsWith("." + tld);
   }
 
-  // `*.example.com` - single subdomain of specific domain
   if (pattern.startsWith("*.")) {
     const baseDomain = pattern.slice(2);
     if (hostname.endsWith("." + baseDomain)) {
-      // Count parts: if pattern is *.example.com (3 parts),
-      // hostname should have exactly 4 parts (www.example.com)
       const patternParts = baseDomain.split(".");
       return parts.length === patternParts.length + 1;
     }
     return false;
   }
 
-  // `**.example.com` - any depth subdomain of specific domain
   if (pattern.startsWith("**.")) {
     const baseDomain = pattern.slice(3);
     if (hostname.endsWith("." + baseDomain)) {
       const patternParts = baseDomain.split(".");
-      // Must have more parts than the base domain (i.e., has subdomains)
       return parts.length > patternParts.length;
     }
     return false;
   }
 
-  // `subdomain.*` - specific subdomain of any apex domain
-  // e.g., admin.* matches admin.example.com, admin.google.com
   if (pattern.endsWith(".*")) {
     const subdomain = pattern.slice(0, -2);
-    // Must be single-level subdomain (3 parts total)
     if (parts.length === 3 && parts[0] === subdomain) {
       return true;
     }
     return false;
   }
 
-  // `subdomain.**` - specific subdomain of any domain (including multi-level)
-  // e.g., admin.** matches admin.example.com, admin.sub.example.com
   if (pattern.endsWith(".**")) {
     const subdomain = pattern.slice(0, -3);
     if (parts.length >= 3 && parts[0] === subdomain) {
@@ -177,11 +157,8 @@ function matchDomainPattern(
     return false;
   }
 
-  // `subdomain.` - specific subdomain of any apex domain (no wildcard)
-  // e.g., admin. matches admin.example.com, admin.google.com
   if (pattern.endsWith(".") && !pattern.includes("*")) {
     const subdomain = pattern.slice(0, -1);
-    // Must be exactly 3 parts (subdomain.domain.tld)
     if (parts.length === 3 && parts[0] === subdomain) {
       return true;
     }
@@ -191,9 +168,6 @@ function matchDomainPattern(
   return false;
 }
 
-/**
- * Validate pattern format
- */
 export function validatePattern(pattern: string): void {
   if (!pattern || typeof pattern !== "string") {
     throw new InvalidPatternError(
@@ -203,12 +177,9 @@ export function validatePattern(pattern: string): void {
     );
   }
 
-  // Check for invalid characters (spaces, etc.)
   if (/\s/.test(pattern)) {
     throw new InvalidPatternError(pattern, "contains whitespace", {
       cause: { pattern },
     });
   }
-
-  // Additional validation can be added here
 }