@zudojs/http 0.1.0 → 1.1.0

package/dist/httpValidation/httpValidationAssertion.d.ts

@@ -0,0 +1,9 @@
+/**
+ * HTTP validation assertions.
+ *
+ * Throws on invalid HTTP values for use in strict validation paths.
+ */
+export declare function assertValidHeader(name: string, value: string): void;
+export declare function assertValidURL(value: string): void;
+export declare function assertValidStatusCode(status: number): void;
+//# sourceMappingURL=httpValidationAssertion.d.ts.map

package/dist/httpValidation/httpValidationAssertion.js

@@ -0,0 +1,26 @@
+/**
+ * HTTP validation assertions.
+ *
+ * Throws on invalid HTTP values for use in strict validation paths.
+ */
+import { validateHeader } from "./httpValidationHeader.js";
+import { validateURL } from "./httpValidationUrl.js";
+import { isValidStatusCode } from "./httpValidationStatusCode.js";
+export function assertValidHeader(name, value) {
+    const result = validateHeader(name, value);
+    if (!result.valid) {
+        throw new TypeError(result.reason ?? "Invalid HTTP header.");
+    }
+}
+export function assertValidURL(value) {
+    const result = validateURL(value);
+    if (!result.valid) {
+        throw new TypeError(result.reason ?? "Invalid URL.");
+    }
+}
+export function assertValidStatusCode(status) {
+    if (!isValidStatusCode(status)) {
+        throw new RangeError(`Invalid HTTP status code: ${status}`);
+    }
+}
+//# sourceMappingURL=httpValidationAssertion.js.map

package/dist/httpValidation/httpValidationAuthority.d.ts

@@ -0,0 +1,8 @@
+/**
+ * HTTP authority validation.
+ *
+ * Validates authority-form (host:port) as used in
+ * CONNECT requests and absolute-form URIs.
+ */
+export declare function isValidAuthority(authority: string | undefined | null): boolean;
+//# sourceMappingURL=httpValidationAuthority.d.ts.map

package/dist/httpValidation/httpValidationAuthority.js

@@ -0,0 +1,43 @@
+/**
+ * HTTP authority validation.
+ *
+ * Validates authority-form (host:port) as used in
+ * CONNECT requests and absolute-form URIs.
+ */
+import { isValidHostname } from "./httpValidationHostname.js";
+import { isValidPort } from "./httpValidationPort.js";
+export function isValidAuthority(authority) {
+    if (authority === undefined ||
+        authority === null ||
+        authority.length === 0 ||
+        /[\r\n\s]/.test(authority)) {
+        return false;
+    }
+    /*
+     * IPv6 literal.
+     */
+    if (authority.startsWith("[")) {
+        const match = /^\[[^\]]+\](?::\d{1,5})?$/.exec(authority);
+        if (!match) {
+            return false;
+        }
+        const colonIdx = authority.lastIndexOf(":");
+        const port = colonIdx >= 0 ? Number(authority.slice(colonIdx + 1)) : undefined;
+        return port === undefined || isValidPort(port);
+    }
+    const separator = authority.lastIndexOf(":");
+    if (separator === -1) {
+        return isValidHostname(authority);
+    }
+    const hostname = authority.slice(0, separator);
+    const portValue = authority.slice(separator + 1);
+    if (!isValidHostname(hostname)) {
+        return false;
+    }
+    if (portValue.length === 0) {
+        return false;
+    }
+    const port = Number(portValue);
+    return Number.isInteger(port) && isValidPort(port);
+}
+//# sourceMappingURL=httpValidationAuthority.js.map

package/dist/httpValidation/httpValidationAuthorization.d.ts

@@ -0,0 +1,7 @@
+/**
+ * HTTP Authorization header validation.
+ *
+ * Validates Authorization header format (scheme credentials) per RFC 7235.
+ */
+export declare function isValidAuthorization(value: string | undefined | null): boolean;
+//# sourceMappingURL=httpValidationAuthorization.d.ts.map

package/dist/httpValidation/httpValidationAuthorization.js

@@ -0,0 +1,22 @@
+/**
+ * HTTP Authorization header validation.
+ *
+ * Validates Authorization header format (scheme credentials) per RFC 7235.
+ */
+import { isHTTPToken } from "./httpValidationToken.js";
+import { isValidHeaderValue } from "./httpValidationHeader.js";
+export function isValidAuthorization(value) {
+    if (!value) {
+        return false;
+    }
+    const separator = value.indexOf(" ");
+    if (separator <= 0) {
+        return false;
+    }
+    const scheme = value.slice(0, separator);
+    const credentials = value.slice(separator + 1);
+    return (isHTTPToken(scheme) &&
+        credentials.trim().length > 0 &&
+        isValidHeaderValue(value));
+}
+//# sourceMappingURL=httpValidationAuthorization.js.map

package/dist/httpValidation/httpValidationCacheControl.d.ts

@@ -0,0 +1,7 @@
+/**
+ * HTTP Cache-Control validation.
+ *
+ * Validates Cache-Control directive syntax per RFC 7234.
+ */
+export declare function isValidCacheControl(value: string | undefined | null): boolean;
+//# sourceMappingURL=httpValidationCacheControl.d.ts.map

package/dist/httpValidation/httpValidationCacheControl.js

@@ -0,0 +1,26 @@
+/**
+ * HTTP Cache-Control validation.
+ *
+ * Validates Cache-Control directive syntax per RFC 7234.
+ */
+import { isHTTPToken } from "./httpValidationToken.js";
+export function isValidCacheControl(value) {
+    if (value === undefined || value === null || value.trim().length === 0) {
+        return false;
+    }
+    const directives = value.split(",");
+    return directives.every((directive) => {
+        const trimmed = directive.trim();
+        if (trimmed.length === 0) {
+            return false;
+        }
+        const separator = trimmed.indexOf("=");
+        if (separator === -1) {
+            return isHTTPToken(trimmed);
+        }
+        const name = trimmed.slice(0, separator).trim();
+        const valuePart = trimmed.slice(separator + 1).trim();
+        return isHTTPToken(name) && valuePart.length > 0;
+    });
+}
+//# sourceMappingURL=httpValidationCacheControl.js.map

package/dist/httpValidation/httpValidationContentLength.d.ts

@@ -0,0 +1,9 @@
+/**
+ * HTTP Content-Length validation.
+ *
+ * Validates Content-Length header values (non-negative safe integers).
+ */
+import type { HTTPValidationResult } from "./httpValidationTypes.type.js";
+export declare function isValidContentLength(value: number | string | undefined | null): boolean;
+export declare function validateContentLength(value: number | string): HTTPValidationResult;
+//# sourceMappingURL=httpValidationContentLength.d.ts.map

package/dist/httpValidation/httpValidationContentLength.js

@@ -0,0 +1,25 @@
+/**
+ * HTTP Content-Length validation.
+ *
+ * Validates Content-Length header values (non-negative safe integers).
+ */
+export function isValidContentLength(value) {
+    if (value === undefined || value === null) {
+        return false;
+    }
+    const length = typeof value === "number" ? value : Number(value);
+    return Number.isSafeInteger(length) && length >= 0;
+}
+export function validateContentLength(value) {
+    if (!isValidContentLength(value)) {
+        return {
+            valid: false,
+            reason: "Content-Length must be a non-negative safe integer.",
+        };
+    }
+    return {
+        valid: true,
+        value: String(value),
+    };
+}
+//# sourceMappingURL=httpValidationContentLength.js.map

package/dist/httpValidation/httpValidationContentType.d.ts

@@ -0,0 +1,9 @@
+/**
+ * HTTP Content-Type validation.
+ *
+ * Validates media-type syntax (type/subtype) per RFC 7231.
+ */
+import type { HTTPValidationResult } from "./httpValidationTypes.type.js";
+export declare function isValidContentType(value: string | undefined | null): boolean;
+export declare function validateContentType(value: string): HTTPValidationResult;
+//# sourceMappingURL=httpValidationContentType.d.ts.map

package/dist/httpValidation/httpValidationContentType.js

@@ -0,0 +1,32 @@
+/**
+ * HTTP Content-Type validation.
+ *
+ * Validates media-type syntax (type/subtype) per RFC 7231.
+ */
+import { isHTTPToken } from "./httpValidationToken.js";
+export function isValidContentType(value) {
+    if (value === undefined || value === null || value.trim().length === 0) {
+        return false;
+    }
+    const mediaType = (value.split(";", 1)[0] ?? "").trim();
+    const separator = mediaType.indexOf("/");
+    if (separator <= 0 || separator === mediaType.length - 1) {
+        return false;
+    }
+    const type = mediaType.slice(0, separator);
+    const subtype = mediaType.slice(separator + 1);
+    return isHTTPToken(type) && isHTTPToken(subtype);
+}
+export function validateContentType(value) {
+    if (!isValidContentType(value)) {
+        return {
+            valid: false,
+            reason: "Invalid Content-Type value.",
+        };
+    }
+    return {
+        valid: true,
+        value: value.trim(),
+    };
+}
+//# sourceMappingURL=httpValidationContentType.js.map

package/dist/httpValidation/httpValidationCookie.d.ts

@@ -0,0 +1,8 @@
+/**
+ * HTTP Cookie validation.
+ *
+ * Validates cookie names (token format) and values per RFC 6265.
+ */
+export declare function isValidCookieName(name: string | undefined | null): boolean;
+export declare function isValidCookieValue(value: string | undefined | null): boolean;
+//# sourceMappingURL=httpValidationCookie.d.ts.map

package/dist/httpValidation/httpValidationCookie.js

@@ -0,0 +1,19 @@
+/**
+ * HTTP Cookie validation.
+ *
+ * Validates cookie names (token format) and values per RFC 6265.
+ */
+import { isHTTPToken } from "./httpValidationToken.js";
+export function isValidCookieName(name) {
+    return isHTTPToken(name);
+}
+export function isValidCookieValue(value) {
+    if (value === undefined || value === null) {
+        return false;
+    }
+    if (value.startsWith('"') && value.endsWith('"')) {
+        return !/[\r\n]/.test(value);
+    }
+    return !/[()\s",;\\\r\n]/.test(value);
+}
+//# sourceMappingURL=httpValidationCookie.js.map

package/dist/httpValidation/httpValidationDate.d.ts

@@ -0,0 +1,7 @@
+/**
+ * HTTP Date header validation.
+ *
+ * Validates HTTP-date format per RFC 7231 Section 7.1.1.1.
+ */
+export declare function isValidHTTPDate(value: string | undefined | null): boolean;
+//# sourceMappingURL=httpValidationDate.d.ts.map

package/dist/httpValidation/httpValidationDate.js

@@ -0,0 +1,13 @@
+/**
+ * HTTP Date header validation.
+ *
+ * Validates HTTP-date format per RFC 7231 Section 7.1.1.1.
+ */
+export function isValidHTTPDate(value) {
+    if (!value) {
+        return false;
+    }
+    const timestamp = Date.parse(value);
+    return !Number.isNaN(timestamp);
+}
+//# sourceMappingURL=httpValidationDate.js.map

package/dist/httpValidation/httpValidationETag.d.ts

@@ -0,0 +1,7 @@
+/**
+ * HTTP ETag validation.
+ *
+ * Validates ETag header format (strong and weak) per RFC 7232.
+ */
+export declare function isValidETag(value: string | undefined | null): boolean;
+//# sourceMappingURL=httpValidationETag.d.ts.map

package/dist/httpValidation/httpValidationETag.js

@@ -0,0 +1,16 @@
+/**
+ * HTTP ETag validation.
+ *
+ * Validates ETag header format (strong and weak) per RFC 7232.
+ */
+export function isValidETag(value) {
+    if (!value) {
+        return false;
+    }
+    /*
+     * Strong: "abc"
+     * Weak:   W/"abc"
+     */
+    return /^(?:W\/)?"[^"\r\n]*"$/.test(value);
+}
+//# sourceMappingURL=httpValidationETag.js.map

package/dist/httpValidation/httpValidationHeader.d.ts

@@ -0,0 +1,16 @@
+/**
+ * HTTP header validation.
+ *
+ * These are thin, result-returning wrappers over the single hardened
+ * definition of "valid header name/value" in `httpHeaders/security`. They
+ * deliberately do not carry their own character classes: this module used to
+ * check only CR/LF, which let every other C0 control and DEL through into
+ * header values built by `httpProtocol` and `httpProxy`.
+ */
+import type { HTTPHeaderValidationResult, HTTPValidationResult } from "./httpValidationTypes.type.js";
+export declare function isValidHeaderName(name: string | undefined | null): name is string;
+export declare function validateHeaderName(name: string): HTTPValidationResult;
+export declare function isValidHeaderValue(value: string | undefined | null): value is string;
+export declare function validateHeaderValue(value: string): HTTPValidationResult;
+export declare function validateHeader(name: string, value: string): HTTPHeaderValidationResult;
+//# sourceMappingURL=httpValidationHeader.d.ts.map

package/dist/httpValidation/httpValidationHeader.js

@@ -0,0 +1,77 @@
+/**
+ * HTTP header validation.
+ *
+ * These are thin, result-returning wrappers over the single hardened
+ * definition of "valid header name/value" in `httpHeaders/security`. They
+ * deliberately do not carry their own character classes: this module used to
+ * check only CR/LF, which let every other C0 control and DEL through into
+ * header values built by `httpProtocol` and `httpProxy`.
+ */
+import { containsForbiddenHeaderChars, isValidHeaderFieldName, } from "../httpHeaders/security/index.js";
+export function isValidHeaderName(name) {
+    if (name === undefined || name === null) {
+        return false;
+    }
+    return isValidHeaderFieldName(name);
+}
+export function validateHeaderName(name) {
+    if (!isValidHeaderName(name)) {
+        return {
+            valid: false,
+            reason: "Invalid HTTP header name.",
+        };
+    }
+    return {
+        valid: true,
+        value: name.toLowerCase(),
+    };
+}
+export function isValidHeaderValue(value) {
+    if (value === undefined || value === null) {
+        return false;
+    }
+    /*
+     * Rejects CR, LF, NUL, every other C0 control and DEL. Horizontal tab is
+     * permitted by HTTP field-value rules.
+     */
+    return !containsForbiddenHeaderChars(value);
+}
+export function validateHeaderValue(value) {
+    if (!isValidHeaderValue(value)) {
+        return {
+            valid: false,
+            reason: "Header value contains a control character that is invalid in an HTTP field value.",
+        };
+    }
+    return {
+        valid: true,
+        value,
+    };
+}
+export function validateHeader(name, value) {
+    const nameResult = validateHeaderName(name);
+    if (!nameResult.valid) {
+        return {
+            valid: false,
+            name,
+            headerValue: value,
+            reason: nameResult.reason,
+        };
+    }
+    const valueResult = validateHeaderValue(value);
+    if (!valueResult.valid) {
+        return {
+            valid: false,
+            name: nameResult.value,
+            headerValue: value,
+            reason: valueResult.reason,
+        };
+    }
+    return {
+        valid: true,
+        name: nameResult.value,
+        headerValue: value,
+        value: `${nameResult.value}: ${value}`,
+    };
+}
+//# sourceMappingURL=httpValidationHeader.js.map

package/dist/httpValidation/httpValidationHostname.d.ts

@@ -0,0 +1,7 @@
+/**
+ * HTTP hostname validation.
+ *
+ * Validates DNS hostnames and localhost per RFC 1123 Section 2.1.
+ */
+export declare function isValidHostname(hostname: string | undefined | null): boolean;
+//# sourceMappingURL=httpValidationHostname.d.ts.map

package/dist/httpValidation/httpValidationHostname.js

@@ -0,0 +1,27 @@
+/**
+ * HTTP hostname validation.
+ *
+ * Validates DNS hostnames and localhost per RFC 1123 Section 2.1.
+ */
+export function isValidHostname(hostname) {
+    if (hostname === undefined ||
+        hostname === null ||
+        hostname.length === 0 ||
+        hostname.length > 253) {
+        return false;
+    }
+    if (hostname === "localhost") {
+        return true;
+    }
+    if (hostname.endsWith(".")) {
+        hostname = hostname.slice(0, -1);
+    }
+    const labels = hostname.split(".");
+    if (labels.length === 0) {
+        return false;
+    }
+    return labels.every((label) => label.length > 0 &&
+        label.length <= 63 &&
+        /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label));
+}
+//# sourceMappingURL=httpValidationHostname.js.map

package/dist/httpValidation/httpValidationMessage.d.ts

@@ -0,0 +1,13 @@
+/**
+ * HTTP message validation.
+ *
+ * Validates a complete HTTP message (method, URL, headers, status code).
+ */
+import type { HTTPValidationResult } from "./httpValidationTypes.type.js";
+export declare function validateHTTPMessage(options: {
+    readonly method?: string;
+    readonly url?: string;
+    readonly headers?: Readonly<Record<string, string>>;
+    readonly statusCode?: number;
+}): HTTPValidationResult;
+//# sourceMappingURL=httpValidationMessage.d.ts.map

package/dist/httpValidation/httpValidationMessage.js

@@ -0,0 +1,45 @@
+/**
+ * HTTP message validation.
+ *
+ * Validates a complete HTTP message (method, URL, headers, status code).
+ */
+import { isValidHTTPMethod } from "./httpValidationMethod.js";
+import { validateHeader } from "./httpValidationHeader.js";
+import { isValidURL } from "./httpValidationUrl.js";
+import { isValidStatusCode } from "./httpValidationStatusCode.js";
+export function validateHTTPMessage(options) {
+    if (options.method !== undefined && !isValidHTTPMethod(options.method)) {
+        return {
+            valid: false,
+            reason: "Invalid HTTP method.",
+        };
+    }
+    if (options.url !== undefined && !isValidURL(options.url)) {
+        return {
+            valid: false,
+            reason: "Invalid HTTP URL.",
+        };
+    }
+    if (options.statusCode !== undefined &&
+        !isValidStatusCode(options.statusCode)) {
+        return {
+            valid: false,
+            reason: "Invalid HTTP status code.",
+        };
+    }
+    if (options.headers) {
+        for (const [name, value] of Object.entries(options.headers)) {
+            const result = validateHeader(name, value);
+            if (!result.valid) {
+                return {
+                    valid: false,
+                    reason: result.reason,
+                };
+            }
+        }
+    }
+    return {
+        valid: true,
+    };
+}
+//# sourceMappingURL=httpValidationMessage.js.map

package/dist/httpValidation/httpValidationMethod.d.ts

@@ -0,0 +1,9 @@
+/**
+ * HTTP method validation.
+ *
+ * Validates that a string is a valid HTTP method per RFC 7230.
+ */
+import type { HTTPValidationResult } from "./httpValidationTypes.type.js";
+export declare function isValidHTTPMethod(method: string | undefined | null): boolean;
+export declare function validateHTTPMethod(method: string): HTTPValidationResult;
+//# sourceMappingURL=httpValidationMethod.d.ts.map

package/dist/httpValidation/httpValidationMethod.js

@@ -0,0 +1,25 @@
+/**
+ * HTTP method validation.
+ *
+ * Validates that a string is a valid HTTP method per RFC 7230.
+ */
+import { isHTTPToken } from "./httpValidationToken.js";
+export function isValidHTTPMethod(method) {
+    if (method === undefined || method === null || method.length === 0) {
+        return false;
+    }
+    return isHTTPToken(method);
+}
+export function validateHTTPMethod(method) {
+    if (!isValidHTTPMethod(method)) {
+        return {
+            valid: false,
+            reason: "Invalid HTTP method.",
+        };
+    }
+    return {
+        valid: true,
+        value: method.toUpperCase(),
+    };
+}
+//# sourceMappingURL=httpValidationMethod.js.map

package/dist/httpValidation/httpValidationPort.d.ts

@@ -0,0 +1,9 @@
+/**
+ * HTTP port validation.
+ *
+ * Validates TCP port numbers (0–65535).
+ */
+import type { HTTPValidationResult } from "./httpValidationTypes.type.js";
+export declare function isValidPort(port: number | string | undefined | null): boolean;
+export declare function validatePort(port: number | string): HTTPValidationResult;
+//# sourceMappingURL=httpValidationPort.d.ts.map

package/dist/httpValidation/httpValidationPort.js

@@ -0,0 +1,25 @@
+/**
+ * HTTP port validation.
+ *
+ * Validates TCP port numbers (0–65535).
+ */
+export function isValidPort(port) {
+    if (port === undefined || port === null) {
+        return false;
+    }
+    const numeric = typeof port === "number" ? port : Number(port);
+    return Number.isInteger(numeric) && numeric >= 0 && numeric <= 65535;
+}
+export function validatePort(port) {
+    if (!isValidPort(port)) {
+        return {
+            valid: false,
+            reason: "Port must be an integer between 0 and 65535.",
+        };
+    }
+    return {
+        valid: true,
+        value: String(port),
+    };
+}
+//# sourceMappingURL=httpValidationPort.js.map

package/dist/httpValidation/httpValidationRange.d.ts

@@ -0,0 +1,7 @@
+/**
+ * HTTP Range header validation.
+ *
+ * Validates byte-range request headers (e.g. bytes=0-499).
+ */
+export declare function isValidRange(value: string | undefined | null): boolean;
+//# sourceMappingURL=httpValidationRange.d.ts.map

package/dist/httpValidation/httpValidationRange.js

@@ -0,0 +1,41 @@
+/**
+ * HTTP Range header validation.
+ *
+ * Validates byte-range request headers (e.g. bytes=0-499).
+ */
+export function isValidRange(value) {
+    if (!value) {
+        return false;
+    }
+    /*
+     * Supports common byte-range forms:
+     *
+     * bytes=0-499
+     * bytes=500-
+     * bytes=-500
+     * bytes=0-499,500-999
+     */
+    if (!value.startsWith("bytes=")) {
+        return false;
+    }
+    const ranges = value
+        .slice(6)
+        .split(",")
+        .map((range) => range.trim());
+    if (ranges.length === 0) {
+        return false;
+    }
+    return ranges.every(isValidByteRange);
+}
+function isValidByteRange(range) {
+    const match = /^(\d*)-(\d*)$/.exec(range);
+    if (!match) {
+        return false;
+    }
+    const [, start, end] = match;
+    if (start === undefined || end === undefined) {
+        return false;
+    }
+    return start.length > 0 || end.length > 0;
+}
+//# sourceMappingURL=httpValidationRange.js.map

package/dist/httpValidation/httpValidationRequestTarget.d.ts

@@ -0,0 +1,10 @@
+/**
+ * HTTP request target validation.
+ *
+ * Validates origin-form, absolute-form, authority-form, and asterisk-form
+ * request targets per RFC 7230 Section 5.3.
+ */
+import type { HTTPValidationResult } from "./httpValidationTypes.type.js";
+export declare function isValidRequestTarget(target: string | undefined | null): boolean;
+export declare function validateRequestTarget(target: string): HTTPValidationResult;
+//# sourceMappingURL=httpValidationRequestTarget.d.ts.map