@zudojs/http 0.1.0 → 1.1.0

package/dist/httpSecurityHeaders/httpSecurityHeader.recommended.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Recommended security headers factory.
+ *
+ * @module httpSecurityHeaders/recommended
+ */
+import type { PermissionsPolicy, SecurityHeaders, SecurityHeadersOptions } from "./core/httpSecurityHeader.type.js";
+export interface RecommendedSecurityHeadersOptions {
+    readonly csp?: boolean | string;
+    readonly hsts?: boolean | {
+        readonly maxAge?: number;
+    };
+    readonly xFrameOptions?: boolean | "DENY" | "SAMEORIGIN";
+    readonly referrerPolicy?: boolean;
+    readonly permissionsPolicy?: boolean;
+    readonly crossOriginPolicies?: boolean;
+}
+/**
+ * Creates a recommended set of security headers.
+ *
+ * Called with no options this now emits a genuinely protective set —
+ * `Content-Security-Policy`, `Strict-Transport-Security`, `nosniff`,
+ * `X-Frame-Options: DENY`, `Referrer-Policy`, a deny-by-default
+ * `Permissions-Policy`, the three cross-origin isolation headers, and
+ * `X-Permitted-Cross-Domain-Policies: none`. Each can be disabled explicitly
+ * with `false`.
+ *
+ * `?? ` is deliberately not used for the booleans below: it would make
+ * `csp: false` indistinguishable from "unset" only for `undefined`, which is
+ * what is wanted, but the previous defaults were `false`, so a caller who
+ * passed nothing got almost nothing.
+ */
+export declare function createRecommendedSecurityHeaders(options?: RecommendedSecurityHeadersOptions): SecurityHeaders;
+/**
+ * The option set `createSecurityMiddleware()` (and any other zero-config
+ * caller) should use when it is given nothing.
+ *
+ * Exposed so a middleware does not have to re-derive a safe baseline and
+ * cannot accidentally emit an empty one.
+ */
+export declare function createDefaultSecurityHeaderOptions(): SecurityHeadersOptions;
+/**
+ * The zero-config header set. Never empty.
+ */
+export declare function createDefaultSecurityHeaders(): SecurityHeaders;
+/**
+ * Creates default CSP options for a web application.
+ */
+export declare function createDefaultCSPOptions(): Record<string, readonly string[]>;
+/**
+ * Creates default HSTS options.
+ */
+export declare function createDefaultHSTSOptions(): {
+    readonly maxAge: number;
+    readonly includeSubDomains: boolean;
+    readonly preload: boolean;
+};
+/**
+ * Creates a default Permissions-Policy that denies the high-risk features a
+ * typical application never uses.
+ *
+ * `permissionsPolicy: true` previously formatted `{}` into the empty string,
+ * emitting a header that permits everything while appearing to be configured.
+ */
+export declare function createDefaultPermissionsPolicy(): PermissionsPolicy;
+//# sourceMappingURL=httpSecurityHeader.recommended.d.ts.map

package/dist/httpSecurityHeaders/httpSecurityHeader.recommended.js

@@ -0,0 +1,120 @@
+/**
+ * Recommended security headers factory.
+ *
+ * @module httpSecurityHeaders/recommended
+ */
+import { DEFAULT_REFERRER_POLICY } from "./core/httpSecurityHeader.type.js";
+import { createSecurityHeaders } from "./httpSecurityHeader.factory.js";
+/**
+ * Creates a recommended set of security headers.
+ *
+ * Called with no options this now emits a genuinely protective set —
+ * `Content-Security-Policy`, `Strict-Transport-Security`, `nosniff`,
+ * `X-Frame-Options: DENY`, `Referrer-Policy`, a deny-by-default
+ * `Permissions-Policy`, the three cross-origin isolation headers, and
+ * `X-Permitted-Cross-Domain-Policies: none`. Each can be disabled explicitly
+ * with `false`.
+ *
+ * `?? ` is deliberately not used for the booleans below: it would make
+ * `csp: false` indistinguishable from "unset" only for `undefined`, which is
+ * what is wanted, but the previous defaults were `false`, so a caller who
+ * passed nothing got almost nothing.
+ */
+export function createRecommendedSecurityHeaders(options = {}) {
+    return createSecurityHeaders({
+        contentSecurityPolicy: options.csp ?? true,
+        strictTransportSecurity: options.hsts ?? true,
+        xContentTypeOptions: true,
+        xFrameOptions: options.xFrameOptions ?? "DENY",
+        referrerPolicy: options.referrerPolicy ?? true,
+        permissionsPolicy: options.permissionsPolicy ?? true,
+        crossOriginEmbedderPolicy: options.crossOriginPolicies ?? true,
+        crossOriginOpenerPolicy: options.crossOriginPolicies ?? true,
+        crossOriginResourcePolicy: options.crossOriginPolicies ?? true,
+        xPermittedCrossDomainPolicies: true,
+    });
+}
+/**
+ * The option set `createSecurityMiddleware()` (and any other zero-config
+ * caller) should use when it is given nothing.
+ *
+ * Exposed so a middleware does not have to re-derive a safe baseline and
+ * cannot accidentally emit an empty one.
+ */
+export function createDefaultSecurityHeaderOptions() {
+    return {
+        contentSecurityPolicy: true,
+        strictTransportSecurity: true,
+        xContentTypeOptions: true,
+        xFrameOptions: "DENY",
+        referrerPolicy: DEFAULT_REFERRER_POLICY,
+        permissionsPolicy: createDefaultPermissionsPolicy(),
+        crossOriginOpenerPolicy: "same-origin",
+        crossOriginResourcePolicy: "same-site",
+        xPermittedCrossDomainPolicies: "none",
+    };
+}
+/**
+ * The zero-config header set. Never empty.
+ */
+export function createDefaultSecurityHeaders() {
+    return createSecurityHeaders(createDefaultSecurityHeaderOptions());
+}
+/**
+ * Creates default CSP options for a web application.
+ */
+export function createDefaultCSPOptions() {
+    return {
+        "default-src": ["'self'"],
+        "script-src": ["'self'"],
+        "style-src": ["'self'", "'unsafe-inline'"],
+        "img-src": ["'self'", "data:", "https:"],
+        "font-src": ["'self'"],
+        "connect-src": ["'self'"],
+        "frame-ancestors": ["'none'"],
+        "base-uri": ["'self'"],
+        "form-action": ["'self'"],
+    };
+}
+/**
+ * Creates default HSTS options.
+ */
+export function createDefaultHSTSOptions() {
+    return {
+        maxAge: 31536000,
+        includeSubDomains: true,
+        preload: true,
+    };
+}
+/**
+ * Creates a default Permissions-Policy that denies the high-risk features a
+ * typical application never uses.
+ *
+ * `permissionsPolicy: true` previously formatted `{}` into the empty string,
+ * emitting a header that permits everything while appearing to be configured.
+ */
+export function createDefaultPermissionsPolicy() {
+    return {
+        accelerometer: false,
+        "ambient-light-sensor": false,
+        autoplay: false,
+        battery: false,
+        camera: false,
+        "display-capture": false,
+        "document-domain": false,
+        "encrypted-media": false,
+        fullscreen: false,
+        geolocation: false,
+        gyroscope: false,
+        magnetometer: false,
+        microphone: false,
+        midi: false,
+        payment: false,
+        "picture-in-picture": false,
+        "publickey-credentials-get": false,
+        "screen-wake-lock": false,
+        usb: false,
+        "xr-spatial-tracking": false,
+    };
+}
+//# sourceMappingURL=httpSecurityHeader.recommended.js.map

package/dist/httpServer/core/httpServer.core.d.ts

@@ -15,9 +15,14 @@ export declare class HttpServer {
     private startedAtValue;
     private stoppedAtValue;
     private requestCount;
-    private readonly events;
-    private readonly configuredHandler;
-    private readonly configuredErrorHandler;
+    /**
+     * Listeners per event.
+     *
+     * A single-slot registry (the previous shape) meant two independent
+     * subsystems could not both subscribe to `onError`: the second `on()` call
+     * threw.
+     */
+    private readonly listeners;
     private startPromise;
     private stopPromise;
     constructor(options: HttpServerOptions);
@@ -46,6 +51,13 @@ export declare class HttpServer {
     recordResponse(): void;
     resetRequestCount(): void;
     on(event: keyof HttpServerEvents, listener: NonNullable<HttpServerEvents[keyof HttpServerEvents]>): () => void;
+    /**
+     * Invokes every listener for an event.
+     *
+     * A listener that throws is isolated: it must not abort a start/stop
+     * transition or prevent the remaining listeners from running.
+     */
+    private emit;
     snapshot(): HttpServerSnapshot;
     toJSON(): HttpServerSnapshot;
     private performStart;

package/dist/httpServer/core/httpServer.core.js

@@ -16,9 +16,14 @@ export class HttpServer {
     startedAtValue;
     stoppedAtValue;
     requestCount = 0;
-    events;
-    configuredHandler;
-    configuredErrorHandler;
+    /**
+     * Listeners per event.
+     *
+     * A single-slot registry (the previous shape) meant two independent
+     * subsystems could not both subscribe to `onError`: the second `on()` call
+     * threw.
+     */
+    listeners = new Map();
     startPromise;
     stopPromise;
     constructor(options) {
@@ -31,9 +36,11 @@ export class HttpServer {
             ...(options.metadata ?? {}),
         });
         this.gracefulShutdownTimeout = validateShutdownTimeout(options.gracefulShutdownTimeout ?? 30_000);
-        this.events = {};
-        this.configuredHandler = options.handler;
-        this.configuredErrorHandler = options.errorHandler;
+        for (const [event, listener] of Object.entries(options.events ?? {})) {
+            if (typeof listener === "function") {
+                this.on(event, listener);
+            }
+        }
         if (options.handler) {
             this.adapterHandler(options.handler);
         }
@@ -87,7 +94,7 @@ export class HttpServer {
             throw new InvalidHttpServerStateError(this.stateValue, "start");
         }
         this.stateValue = "starting";
-        this.events.onStarting?.(this);
+        this.emit("onStarting", this);
         this.startPromise = this.performStart();
         try {
             await this.startPromise;
@@ -95,7 +102,7 @@ export class HttpServer {
             this.startedAtValue = new Date();
             this.stoppedAtValue = undefined;
             this.refreshAddress();
-            this.events.onStarted?.(this);
+            this.emit("onStarted", this);
             return this;
         }
         catch (error) {
@@ -103,7 +110,7 @@ export class HttpServer {
             const wrapped = error instanceof HttpServerStartError
                 ? error
                 : new HttpServerStartError("Failed to start the HTTP server.", error);
-            this.events.onError?.(wrapped, this);
+            this.emit("onError", wrapped, this);
             throw wrapped;
         }
         finally {
@@ -122,14 +129,14 @@ export class HttpServer {
             throw new InvalidHttpServerStateError(this.stateValue, "stop");
         }
         this.stateValue = "stopping";
-        this.events.onStopping?.(this);
+        this.emit("onStopping", this);
         const timeout = validateShutdownTimeout(options.timeout ?? this.gracefulShutdownTimeout);
         this.stopPromise = this.performStop(options.force ?? false, timeout);
         try {
             await this.stopPromise;
             this.stateValue = "stopped";
             this.stoppedAtValue = new Date();
-            this.events.onStopped?.(this);
+            this.emit("onStopped", this);
             return this;
         }
         catch (error) {
@@ -137,7 +144,7 @@ export class HttpServer {
             const wrapped = error instanceof HttpServerStopError
                 ? error
                 : new HttpServerStopError("Failed to stop the HTTP server.", error);
-            this.events.onError?.(wrapped, this);
+            this.emit("onError", wrapped, this);
             throw wrapped;
         }
         finally {
@@ -165,42 +172,74 @@ export class HttpServer {
     }
     adapterHandler(handler) {
         const adapter = this.adapter;
+        if (typeof adapter.setHandler === "function") {
+            adapter.setHandler(handler);
+            return;
+        }
         if ("handler" in adapter) {
             adapter.handler = handler;
             return;
         }
+        /*
+         * Returning silently here left a listening server answering every request
+         * with HTTP_HANDLER_NOT_CONFIGURED, with nothing to say the application
+         * handler had been discarded.
+         */
+        throw new HttpServerLifecycleError("The configured HTTP adapter cannot accept a request handler: it exposes neither setHandler() nor a handler property.", { code: "HTTP_SERVER_ADAPTER_HANDLER_UNSUPPORTED" });
     }
     adapterErrorHandler(handler) {
         const adapter = this.adapter;
+        if (typeof adapter.setErrorHandler === "function") {
+            adapter.setErrorHandler(handler);
+            return;
+        }
         if ("errorHandler" in adapter) {
             adapter.errorHandler = handler;
+            return;
         }
+        throw new HttpServerLifecycleError("The configured HTTP adapter cannot accept an error handler: it exposes neither setErrorHandler() nor an errorHandler property.", { code: "HTTP_SERVER_ADAPTER_ERROR_HANDLER_UNSUPPORTED" });
     }
     recordRequest() {
         this.requestCount += 1;
-        this.events.onRequest?.(this);
+        this.emit("onRequest", this);
     }
     recordResponse() {
-        this.events.onResponse?.(this);
+        this.emit("onResponse", this);
     }
     resetRequestCount() {
         this.requestCount = 0;
     }
     on(event, listener) {
-        const events = this.events;
-        const previous = events[event];
-        if (previous) {
-            throw new HttpServerLifecycleError(`A listener for "${String(event)}" is already registered.`, {
-                code: "HTTP_SERVER_EVENT_LISTENER_EXISTS",
-            });
+        let set = this.listeners.get(event);
+        if (!set) {
+            set = new Set();
+            this.listeners.set(event, set);
         }
-        events[event] = listener;
+        set.add(listener);
         return () => {
-            if (events[event] === listener) {
-                events[event] = undefined;
-            }
+            this.listeners.get(event)?.delete(listener);
         };
     }
+    /**
+     * Invokes every listener for an event.
+     *
+     * A listener that throws is isolated: it must not abort a start/stop
+     * transition or prevent the remaining listeners from running.
+     */
+    emit(event, ...args) {
+        const set = this.listeners.get(event);
+        if (!set) {
+            return;
+        }
+        for (const listener of [...set]) {
+            try {
+                listener(...args);
+            }
+            catch {
+                /* Listener failures are contained. */
+            }
+        }
+    }
     snapshot() {
         const address = this.addressValue;
         const startedAt = this.startedAtValue;
@@ -228,7 +267,23 @@ export class HttpServer {
             await stopAdapter(this.adapter);
             return;
         }
-        await withTimeout(stopAdapter(this.adapter), timeout, "HTTP server shutdown timed out.");
+        try {
+            await withTimeout(stopAdapter(this.adapter), timeout, "HTTP server shutdown timed out.");
+        }
+        catch (error) {
+            /*
+             * A graceful stop that times out used to leave the server listening and
+             * the sockets open while reporting failure, so a redeploy could not
+             * rebind the port. Escalate to a forced stop before rethrowing.
+             */
+            try {
+                await stopAdapter(this.adapter);
+            }
+            catch {
+                /* The original timeout is the more useful error. */
+            }
+            throw error;
+        }
     }
     refreshAddress() {
         const adapter = this.adapter;

package/dist/httpServer/types/httpServer.type.d.ts

@@ -4,7 +4,7 @@
  * @module httpServer/types
  */
 import { HttpServerLifecycleError as HttpServerError, InvalidHttpServerStateError, HttpServerStartError, HttpServerStopError } from "@zudojs/errors";
-import type { HttpAdapter, HttpAdapterOptions, HttpHandler, HttpErrorHandler } from "../../httpAdapter/http.adapter.js";
+import type { HttpAdapter, HttpHandler, HttpErrorHandler } from "../../httpAdapter/http.adapter.js";
 export type HttpServerState = "created" | "starting" | "running" | "stopping" | "stopped" | "failed";
 export interface HttpServerAddress {
     readonly protocol?: string;
@@ -12,11 +12,26 @@ export interface HttpServerAddress {
     readonly port?: number;
     readonly path?: string;
 }
-export interface HttpServerOptions extends HttpAdapterOptions {
+/**
+ * Options accepted by `HttpServer`.
+ *
+ * This deliberately does NOT extend `HttpAdapterOptions`. Doing so advertised
+ * `port`, `host`, `trustProxy` and `capabilities` on the server while the
+ * constructor read none of them, so `createHttpServer({ trustProxy: [...] })`
+ * compiled and silently ran with no proxy trust. Adapter-level settings
+ * belong on the adapter that is passed in.
+ */
+export interface HttpServerOptions {
     readonly adapter: HttpAdapter;
+    readonly name?: string;
     readonly handler?: HttpHandler;
     readonly errorHandler?: HttpErrorHandler;
     readonly gracefulShutdownTimeout?: number;
+    /**
+     * Lifecycle listeners registered before the server starts. Further
+     * listeners can be added at any time with `on()`.
+     */
+    readonly events?: HttpServerEvents;
     readonly metadata?: Readonly<Record<string, unknown>>;
 }
 export interface HttpServerEvents {

package/dist/httpStatus/httpStatus.categoryPredicate.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Category-level status predicates.
+ *
+ * Tests whether a numeric status code belongs to a given HTTP class (1xx–5xx).
+ */
+export declare function isInformational(status: number): boolean;
+export declare function isSuccess(status: number): boolean;
+export declare function isRedirection(status: number): boolean;
+export declare function isClientError(status: number): boolean;
+export declare function isServerError(status: number): boolean;
+export declare function isError(status: number): boolean;
+//# sourceMappingURL=httpStatus.categoryPredicate.d.ts.map

package/dist/httpStatus/httpStatus.categoryPredicate.js

@@ -0,0 +1,24 @@
+/**
+ * Category-level status predicates.
+ *
+ * Tests whether a numeric status code belongs to a given HTTP class (1xx–5xx).
+ */
+export function isInformational(status) {
+    return status >= 100 && status < 200;
+}
+export function isSuccess(status) {
+    return status >= 200 && status < 300;
+}
+export function isRedirection(status) {
+    return status >= 300 && status < 400;
+}
+export function isClientError(status) {
+    return status >= 400 && status < 500;
+}
+export function isServerError(status) {
+    return status >= 500 && status < 600;
+}
+export function isError(status) {
+    return isClientError(status) || isServerError(status);
+}
+//# sourceMappingURL=httpStatus.categoryPredicate.js.map

package/dist/httpStatus/httpStatus.clientErrorConstant.d.ts

@@ -0,0 +1,43 @@
+/**
+ * 4xx client error status codes.
+ */
+export declare const CLIENT_ERROR_STATUS_CODES: Readonly<{
+    readonly BAD_REQUEST: 400;
+    readonly UNAUTHORIZED: 401;
+    readonly PAYMENT_REQUIRED: 402;
+    readonly FORBIDDEN: 403;
+    readonly NOT_FOUND: 404;
+    readonly METHOD_NOT_ALLOWED: 405;
+    readonly NOT_ACCEPTABLE: 406;
+    readonly PROXY_AUTHENTICATION_REQUIRED: 407;
+    readonly REQUEST_TIMEOUT: 408;
+    readonly CONFLICT: 409;
+    readonly GONE: 410;
+    readonly LENGTH_REQUIRED: 411;
+    readonly PRECONDITION_FAILED: 412;
+    readonly PAYLOAD_TOO_LARGE: 413;
+    /**
+     * RFC 9110 name for 413; `PAYLOAD_TOO_LARGE` is the RFC 7231 spelling.
+     */
+    readonly CONTENT_TOO_LARGE: 413;
+    readonly URI_TOO_LONG: 414;
+    readonly UNSUPPORTED_MEDIA_TYPE: 415;
+    readonly RANGE_NOT_SATISFIABLE: 416;
+    readonly EXPECTATION_FAILED: 417;
+    readonly IM_A_TEAPOT: 418;
+    readonly MISDIRECTED_REQUEST: 421;
+    readonly UNPROCESSABLE_ENTITY: 422;
+    /**
+     * RFC 9110 name for 422; `UNPROCESSABLE_ENTITY` is the RFC 4918 spelling.
+     */
+    readonly UNPROCESSABLE_CONTENT: 422;
+    readonly LOCKED: 423;
+    readonly FAILED_DEPENDENCY: 424;
+    readonly TOO_EARLY: 425;
+    readonly UPGRADE_REQUIRED: 426;
+    readonly PRECONDITION_REQUIRED: 428;
+    readonly TOO_MANY_REQUESTS: 429;
+    readonly REQUEST_HEADER_FIELDS_TOO_LARGE: 431;
+    readonly UNAVAILABLE_FOR_LEGAL_REASONS: 451;
+}>;
+//# sourceMappingURL=httpStatus.clientErrorConstant.d.ts.map

package/dist/httpStatus/httpStatus.clientErrorConstant.js

@@ -0,0 +1,43 @@
+/**
+ * 4xx client error status codes.
+ */
+export const CLIENT_ERROR_STATUS_CODES = Object.freeze({
+    BAD_REQUEST: 400,
+    UNAUTHORIZED: 401,
+    PAYMENT_REQUIRED: 402,
+    FORBIDDEN: 403,
+    NOT_FOUND: 404,
+    METHOD_NOT_ALLOWED: 405,
+    NOT_ACCEPTABLE: 406,
+    PROXY_AUTHENTICATION_REQUIRED: 407,
+    REQUEST_TIMEOUT: 408,
+    CONFLICT: 409,
+    GONE: 410,
+    LENGTH_REQUIRED: 411,
+    PRECONDITION_FAILED: 412,
+    PAYLOAD_TOO_LARGE: 413,
+    /**
+     * RFC 9110 name for 413; `PAYLOAD_TOO_LARGE` is the RFC 7231 spelling.
+     */
+    CONTENT_TOO_LARGE: 413,
+    URI_TOO_LONG: 414,
+    UNSUPPORTED_MEDIA_TYPE: 415,
+    RANGE_NOT_SATISFIABLE: 416,
+    EXPECTATION_FAILED: 417,
+    IM_A_TEAPOT: 418,
+    MISDIRECTED_REQUEST: 421,
+    UNPROCESSABLE_ENTITY: 422,
+    /**
+     * RFC 9110 name for 422; `UNPROCESSABLE_ENTITY` is the RFC 4918 spelling.
+     */
+    UNPROCESSABLE_CONTENT: 422,
+    LOCKED: 423,
+    FAILED_DEPENDENCY: 424,
+    TOO_EARLY: 425,
+    UPGRADE_REQUIRED: 426,
+    PRECONDITION_REQUIRED: 428,
+    TOO_MANY_REQUESTS: 429,
+    REQUEST_HEADER_FIELDS_TOO_LARGE: 431,
+    UNAVAILABLE_FOR_LEGAL_REASONS: 451,
+});
+//# sourceMappingURL=httpStatus.clientErrorConstant.js.map

package/dist/httpStatus/httpStatus.clientErrorTextConstant.d.ts

@@ -0,0 +1,35 @@
+/**
+ * 4xx client error status reason phrases.
+ */
+export declare const CLIENT_ERROR_STATUS_TEXT: Readonly<{
+    readonly 400: "Bad Request";
+    readonly 401: "Unauthorized";
+    readonly 402: "Payment Required";
+    readonly 403: "Forbidden";
+    readonly 404: "Not Found";
+    readonly 405: "Method Not Allowed";
+    readonly 406: "Not Acceptable";
+    readonly 407: "Proxy Authentication Required";
+    readonly 408: "Request Timeout";
+    readonly 409: "Conflict";
+    readonly 410: "Gone";
+    readonly 411: "Length Required";
+    readonly 412: "Precondition Failed";
+    readonly 413: "Content Too Large";
+    readonly 414: "URI Too Long";
+    readonly 415: "Unsupported Media Type";
+    readonly 416: "Range Not Satisfiable";
+    readonly 417: "Expectation Failed";
+    readonly 418: "I'm a teapot";
+    readonly 421: "Misdirected Request";
+    readonly 422: "Unprocessable Content";
+    readonly 423: "Locked";
+    readonly 424: "Failed Dependency";
+    readonly 425: "Too Early";
+    readonly 426: "Upgrade Required";
+    readonly 428: "Precondition Required";
+    readonly 429: "Too Many Requests";
+    readonly 431: "Request Header Fields Too Large";
+    readonly 451: "Unavailable For Legal Reasons";
+}>;
+//# sourceMappingURL=httpStatus.clientErrorTextConstant.d.ts.map

package/dist/httpStatus/httpStatus.clientErrorTextConstant.js

@@ -0,0 +1,35 @@
+/**
+ * 4xx client error status reason phrases.
+ */
+export const CLIENT_ERROR_STATUS_TEXT = Object.freeze({
+    400: "Bad Request",
+    401: "Unauthorized",
+    402: "Payment Required",
+    403: "Forbidden",
+    404: "Not Found",
+    405: "Method Not Allowed",
+    406: "Not Acceptable",
+    407: "Proxy Authentication Required",
+    408: "Request Timeout",
+    409: "Conflict",
+    410: "Gone",
+    411: "Length Required",
+    412: "Precondition Failed",
+    413: "Content Too Large",
+    414: "URI Too Long",
+    415: "Unsupported Media Type",
+    416: "Range Not Satisfiable",
+    417: "Expectation Failed",
+    418: "I'm a teapot",
+    421: "Misdirected Request",
+    422: "Unprocessable Content",
+    423: "Locked",
+    424: "Failed Dependency",
+    425: "Too Early",
+    426: "Upgrade Required",
+    428: "Precondition Required",
+    429: "Too Many Requests",
+    431: "Request Header Fields Too Large",
+    451: "Unavailable For Legal Reasons",
+});
+//# sourceMappingURL=httpStatus.clientErrorTextConstant.js.map

package/dist/httpStatus/httpStatus.collection.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Frozen arrays of status codes grouped by category.
+ *
+ * Useful for membership checks or iteration over all codes in a class.
+ */
+export declare const INFORMATIONAL_STATUSES: readonly number[];
+export declare const SUCCESS_STATUSES: readonly number[];
+export declare const REDIRECTION_STATUSES: readonly number[];
+export declare const CLIENT_ERROR_STATUSES: readonly number[];
+export declare const SERVER_ERROR_STATUSES: readonly number[];
+//# sourceMappingURL=httpStatus.collection.d.ts.map