@zudojs/http 1.0.0 → 1.1.0

package/README.md

@@ -11,19 +11,27 @@ npm install @zudojs/http
 ## Quick Start
 
 ```typescript
-import { createHTTPServer } from "@zudojs/http";
-
-const server = createHTTPServer({
-  handler: {
-    async fetch(request) {
-      return new Response("Hello from Zudojs");
-    },
+import {
+  createHttpServer,
+  createNodeHttpAdapter,
+  createResponseContext,
+} from "@zudojs/http";
+
+const server = createHttpServer({
+  adapter: createNodeHttpAdapter({ host: "127.0.0.1", port: 3000 }),
+  handler: async (request) => {
+    return createResponseContext().text(`Hello from Zudojs (${request.path})`);
   },
 });
 
 await server.start();
 ```
 
+A handler receives an `HttpRequestContext` and may return an
+`HttpResponseContext`, a plain `{ status, headers, body }` object, or any JSON
+value (which is sent as `application/json`). Throwing an `HttpError` created by
+`notFound()`, `unauthorized()` and friends answers with that error's status.
+
 ## Features
 
 - Runtime-independent HTTP server abstraction

package/dist/httpAdapter/http.adapter.js

@@ -11,6 +11,7 @@
 import { HttpRequestContext, createRequestContext, } from "../httpRequest/httpRequest.context.js";
 import { HttpResponseContext, createResponseContext, } from "../httpResponse/httpResponse.context.js";
 import { writeResponse } from "../httpResponse/httpResponse.writer.js";
+import { resolveErrorResponse } from "./httpAdapter.errorResponse.js";
 /* -------------------------------------------------------------------------- */
 /* Adapter Error                                                              */
 /* -------------------------------------------------------------------------- */
@@ -85,10 +86,11 @@ export class BaseHttpAdapter {
             mergeResponseContext(response, context);
         }
         else {
-            response.internalServerError();
-            response.json({
-                error: "Internal Server Error",
-            });
+            const resolved = resolveErrorResponse(error);
+            for (const [name, value] of Object.entries(resolved.headers)) {
+                response.setHeader(name, value);
+            }
+            response.setStatus(resolved.status).json(resolved.body);
         }
         await this.write(input, response);
     }

package/dist/httpAdapter/httpAdapter.errorResponse.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Default error-to-response mapping shared by the adapters.
+ *
+ * An error thrown from a handler used to be answered with a generic 500 no
+ * matter what it was, so `throw notFound()` — the documented way to fail a
+ * request — reached the client as `500 Internal Server Error` with the
+ * error's status, message and headers (`WWW-Authenticate`, `Allow`,
+ * `Retry-After`) all discarded. Middleware wrappers made it worse: the
+ * pipeline wraps every failure in `HttpMiddlewareError` /
+ * `HttpMiddlewarePipelineError`, both of which report status 500, so the
+ * original error's status was hidden even from a custom error handler that
+ * only looked one level deep.
+ *
+ * This module is deliberately internal: it is not part of the public API.
+ *
+ * @module httpAdapter/errorResponse
+ */
+export interface ResolvedErrorResponse {
+    readonly status: number;
+    readonly body: Readonly<Record<string, unknown>>;
+    readonly headers: Readonly<Record<string, string>>;
+}
+/**
+ * Builds the default response for an unhandled error.
+ *
+ * - An error (or any error in its `cause` / `errors` chain) with a 4xx/5xx
+ *   `statusCode` is answered with that status.
+ * - Its `message` and `code` are included only when the error opts in with
+ *   `expose: true` (the `@zudojs/errors` default for 4xx); otherwise the
+ *   body carries the status text alone, so a 5xx never leaks internals.
+ * - Its `headers` are applied when they are valid header values.
+ * - Anything else is a generic `500 Internal Server Error`.
+ */
+export declare function resolveErrorResponse(error: unknown): ResolvedErrorResponse;
+//# sourceMappingURL=httpAdapter.errorResponse.d.ts.map

package/dist/httpAdapter/httpAdapter.errorResponse.js

@@ -0,0 +1,120 @@
+/**
+ * Default error-to-response mapping shared by the adapters.
+ *
+ * An error thrown from a handler used to be answered with a generic 500 no
+ * matter what it was, so `throw notFound()` — the documented way to fail a
+ * request — reached the client as `500 Internal Server Error` with the
+ * error's status, message and headers (`WWW-Authenticate`, `Allow`,
+ * `Retry-After`) all discarded. Middleware wrappers made it worse: the
+ * pipeline wraps every failure in `HttpMiddlewareError` /
+ * `HttpMiddlewarePipelineError`, both of which report status 500, so the
+ * original error's status was hidden even from a custom error handler that
+ * only looked one level deep.
+ *
+ * This module is deliberately internal: it is not part of the public API.
+ *
+ * @module httpAdapter/errorResponse
+ */
+import { getStatusText } from "../httpResponse/core/httpResponse.statusText.js";
+import { isValidHeaderFieldValue } from "../httpHeaders/security/index.js";
+/* -------------------------------------------------------------------------- */
+/* Constants                                                                  */
+/* -------------------------------------------------------------------------- */
+/**
+ * How many levels of `cause` / `errors` nesting are inspected. Deep enough
+ * for the pipeline's two wrappers plus a few application layers; bounded so a
+ * cyclic `cause` chain cannot loop.
+ */
+const MAX_UNWRAP_DEPTH = 8;
+/* -------------------------------------------------------------------------- */
+/* Resolution                                                                 */
+/* -------------------------------------------------------------------------- */
+/**
+ * Locates the innermost error that carries an HTTP status.
+ *
+ * The innermost one wins because outer errors are wrappers added on the way
+ * out (middleware, pipeline, adapter); the error the application actually
+ * threw sits at the bottom of the chain.
+ */
+function findStatusError(error, depth, seen) {
+    if (error === null || typeof error !== "object" || depth > MAX_UNWRAP_DEPTH) {
+        return undefined;
+    }
+    if (seen.has(error)) {
+        return undefined;
+    }
+    seen.add(error);
+    const candidate = error;
+    const nested = [];
+    if (Array.isArray(candidate.errors)) {
+        nested.push(...candidate.errors);
+    }
+    if (candidate.cause !== undefined) {
+        nested.push(candidate.cause);
+    }
+    for (const inner of nested) {
+        const found = findStatusError(inner, depth + 1, seen);
+        if (found) {
+            return found;
+        }
+    }
+    if (isHttpStatus(candidate.statusCode)) {
+        return candidate;
+    }
+    return undefined;
+}
+function isHttpStatus(value) {
+    return (typeof value === "number" &&
+        Number.isInteger(value) &&
+        value >= 400 &&
+        value <= 599);
+}
+/**
+ * Builds the default response for an unhandled error.
+ *
+ * - An error (or any error in its `cause` / `errors` chain) with a 4xx/5xx
+ *   `statusCode` is answered with that status.
+ * - Its `message` and `code` are included only when the error opts in with
+ *   `expose: true` (the `@zudojs/errors` default for 4xx); otherwise the
+ *   body carries the status text alone, so a 5xx never leaks internals.
+ * - Its `headers` are applied when they are valid header values.
+ * - Anything else is a generic `500 Internal Server Error`.
+ */
+export function resolveErrorResponse(error) {
+    const statusError = findStatusError(error, 0, new Set());
+    if (!statusError) {
+        return {
+            status: 500,
+            body: { error: "Internal Server Error" },
+            headers: {},
+        };
+    }
+    const status = statusError.statusCode;
+    const expose = statusError.expose === true;
+    const message = expose && typeof statusError.message === "string" && statusError.message
+        ? statusError.message
+        : getStatusText(status);
+    const body = { error: message };
+    if (expose && typeof statusError.code === "string" && statusError.code) {
+        body.code = statusError.code;
+    }
+    return {
+        status,
+        body,
+        headers: collectHeaders(statusError.headers),
+    };
+}
+function collectHeaders(value) {
+    if (value === null || typeof value !== "object") {
+        return {};
+    }
+    const headers = {};
+    for (const [name, entry] of Object.entries(value)) {
+        if (typeof entry !== "string" || !isValidHeaderFieldValue(entry)) {
+            continue;
+        }
+        headers[name] = entry;
+    }
+    return headers;
+}
+//# sourceMappingURL=httpAdapter.errorResponse.js.map

package/dist/httpAdapter/node/httpNode.adapter.d.ts

@@ -27,6 +27,13 @@ export declare class NodeHttpAdapter extends BaseHttpAdapter {
     private readonly events;
     private server;
     private ownsServer;
+    /**
+     * The `clientError` listener installed by `start()`, kept so `stop()` can
+     * remove it. On an externally supplied server the instance survives a
+     * stop/start cycle, and re-adding the listener on every start leaked one
+     * per restart.
+     */
+    private clientErrorListener;
     constructor(options?: NodeAdapterOptions);
     get httpServer(): Server | undefined;
     get address(): NodeServerAddress | undefined;
@@ -45,6 +52,7 @@ export declare class NodeHttpAdapter extends BaseHttpAdapter {
     private executeNodeHandler;
     private normalizeResult;
     private handleNodeError;
+    private writeBadRequest;
     private writeNodeResponse;
     /**
      * Runs `handle` for a Node request/response pair without ever letting the

package/dist/httpAdapter/node/httpNode.adapter.js

@@ -14,6 +14,7 @@ import { writeResponse } from "../../httpResponse/httpResponse.writer.js";
 import { DEFAULT_HOST, DEFAULT_PORT, DEFAULT_MAX_BODY_SIZE, NODE_DEFAULT_HEADERS_TIMEOUT, NODE_DEFAULT_REQUEST_TIMEOUT, NODE_DEFAULT_KEEP_ALIVE_TIMEOUT, validatePort, validateMaxBodySize, } from "./httpNode.type.js";
 import { NodeResponseWriter } from "./httpNode.response.js";
 import { createNodeRequestContext } from "./httpNode.request.js";
+import { resolveErrorResponse } from "../httpAdapter.errorResponse.js";
 import { isIncomingMessage, isServerResponse, isNodeRequestResponsePair, configureServer, listen, closeServer, readNodeRequestBody, NodeRequestBodyTooLargeError, isResponseContextLike, } from "./httpNode.server.js";
 /* -------------------------------------------------------------------------- */
 /* Node HTTP Adapter                                                          */
@@ -33,6 +34,13 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
     events;
     server;
     ownsServer = false;
+    /**
+     * The `clientError` listener installed by `start()`, kept so `stop()` can
+     * remove it. On an externally supplied server the instance survives a
+     * stop/start cycle, and re-adding the listener on every start leaked one
+     * per restart.
+     */
+    clientErrorListener;
     constructor(options = {}) {
         super({
             ...options,
@@ -124,7 +132,21 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
         }
         const request = input.request;
         const response = input.response;
-        const context = this.createRequest(request);
+        let context;
+        try {
+            context = this.createRequest(request);
+        }
+        catch (error) {
+            /*
+             * The request could not even be described (an unparseable request
+             * target, a header the context refuses). It is the client's fault, so
+             * answer 400 rather than letting the rejection destroy the socket
+             * without a response.
+             */
+            this.emitAdapterError(error);
+            await this.writeBadRequest(response);
+            return;
+        }
         try {
             await this.attachNodeBody(request, context);
             const result = await this.executeNodeHandler(context);
@@ -199,11 +221,27 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
                 // Fall through to the safe internal server error response.
             }
         }
-        context.internalServerError().json({
-            error: "Internal Server Error",
-        });
+        /*
+         * A thrown `HttpError` (or one buried under the middleware pipeline's
+         * wrappers) is answered with its own status, exposed message and headers;
+         * anything else stays a generic 500.
+         */
+        const resolved = resolveErrorResponse(error);
+        for (const [name, value] of Object.entries(resolved.headers)) {
+            context.setHeader(name, value);
+        }
+        context.setStatus(resolved.status).json(resolved.body);
         await this.writeNodeResponse(response, context);
     }
+    async writeBadRequest(response) {
+        if (response.headersSent) {
+            response.destroy();
+            return;
+        }
+        const context = createResponseContext();
+        context.setHeader("connection", "close");
+        await this.writeNodeResponse(response, context.setStatus(400).json({ error: "Bad Request" }));
+    }
     async writeNodeResponse(response, context) {
         const writer = this.createWriter(response);
         await writeResponse(context, writer);
@@ -265,13 +303,17 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
             connectionTimeout: this.connectionTimeout,
             maxConnections: this.maxConnections,
         });
-        this.server.on("clientError", (error, socket) => {
+        if (this.clientErrorListener) {
+            this.server.off("clientError", this.clientErrorListener);
+        }
+        this.clientErrorListener = (error, socket) => {
             this.emitAdapterError(error);
             if (socket.writable) {
                 socket.end("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
             }
             socket.destroy();
-        });
+        };
+        this.server.on("clientError", this.clientErrorListener);
         await listen(this.server, this.port, this.host);
         const address = this.address;
         if (address && this.events.onListening) {
@@ -290,6 +332,10 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
             return;
         }
         await closeServer(this.server, { graceMs: this.shutdownGraceMs });
+        if (this.clientErrorListener) {
+            this.server.off("clientError", this.clientErrorListener);
+            this.clientErrorListener = undefined;
+        }
         if (this.ownsServer) {
             this.server = undefined;
         }

package/dist/httpAdapter/node/httpNode.request.d.ts

@@ -18,6 +18,16 @@ export declare function getNodeRequestPort(request: IncomingMessage, options?: N
  * `getClientIp` so there is a single implementation of the hop logic.
  */
 export declare function getNodeRemoteAddress(request: IncomingMessage, options?: NodeRequestOptions): string | undefined;
+/**
+ * Parses the request-target's query string into a flat record.
+ *
+ * Every value is attacker-controlled. `decodeURIComponent` throws on a
+ * malformed sequence such as `%E0`, and this ran before the adapter's
+ * try/catch, so one such request tore the connection down instead of being
+ * answered. Decoding is delegated to the query module's non-throwing
+ * decoder, which also gives `+` its form-encoding meaning. A pair is split on
+ * its **first** `=` so `a=b=c` keeps the value `b=c`.
+ */
 export declare function parseNodeQuery(request: IncomingMessage): Readonly<Record<string, string>>;
 export declare function createNodeRequestContext(request: IncomingMessage, options?: NodeRequestOptions): HttpRequestContext;
 //# sourceMappingURL=httpNode.request.d.ts.map

package/dist/httpAdapter/node/httpNode.request.js

@@ -6,6 +6,7 @@
 import { HttpRequestContext, createRequestContext, } from "../../httpRequest/httpRequest.context.js";
 import { getClientIp, isTrustedProxy, } from "../../httpTrustProxy/httpTrustProxy.core.js";
 import { removePort, extractPort } from "./httpNode.server.js";
+import { decodeQueryComponent } from "../../httpQuery/http.query.js";
 /* -------------------------------------------------------------------------- */
 /* Proxy Trust                                                                */
 /* -------------------------------------------------------------------------- */
@@ -118,6 +119,16 @@ export function getNodeRemoteAddress(request, options = {}) {
     };
     return getClientIp(proxyRequest, trustProxy) ?? peer;
 }
+/**
+ * Parses the request-target's query string into a flat record.
+ *
+ * Every value is attacker-controlled. `decodeURIComponent` throws on a
+ * malformed sequence such as `%E0`, and this ran before the adapter's
+ * try/catch, so one such request tore the connection down instead of being
+ * answered. Decoding is delegated to the query module's non-throwing
+ * decoder, which also gives `+` its form-encoding meaning. A pair is split on
+ * its **first** `=` so `a=b=c` keeps the value `b=c`.
+ */
 export function parseNodeQuery(request) {
     const url = request.url;
     if (!url) {
@@ -127,16 +138,22 @@ export function parseNodeQuery(request) {
     if (questionIndex === -1) {
         return Object.freeze({});
     }
-    const queryString = url.slice(questionIndex + 1);
+    const hashIndex = url.indexOf("#", questionIndex + 1);
+    const queryString = url.slice(questionIndex + 1, hashIndex === -1 ? undefined : hashIndex);
     if (!queryString) {
         return Object.freeze({});
     }
     const params = {};
     for (const pair of queryString.split("&")) {
-        const [key, value] = pair.split("=");
+        if (pair === "") {
+            continue;
+        }
+        const separator = pair.indexOf("=");
+        const rawKey = separator === -1 ? pair : pair.slice(0, separator);
+        const rawValue = separator === -1 ? "" : pair.slice(separator + 1);
+        const key = decodeQueryComponent(rawKey);
         if (key) {
-            params[decodeURIComponent(key)] =
-                value !== undefined ? decodeURIComponent(value) : "";
+            params[key] = decodeQueryComponent(rawValue);
         }
     }
     return Object.freeze(params);

package/dist/httpClient/httpClient.executor.js

@@ -60,9 +60,20 @@ async function executeOnce(context, client) {
         }, timeout);
     }
     const signal = combineAbortSignals(context.config.signal, controller?.signal);
-    const request = signal === context.request.signal
-        ? context.request
-        : new Request(context.request, { signal });
+    /*
+     * A `Request` body can be dispatched once. Every attempt used to be built
+     * from `context.request` itself, which consumed its body on the first try
+     * and made the first *retry* of any body-bearing request fail with
+     * "Request object that has already been used" — so `retryMethods: ["POST"]`
+     * could never retry. Each attempt now works on a clone, and the original
+     * is left untouched for the next one.
+     */
+    const attemptRequest = context.request.body !== null && !context.request.bodyUsed
+        ? context.request.clone()
+        : context.request;
+    const request = signal === attemptRequest.signal
+        ? attemptRequest
+        : new Request(attemptRequest, { signal });
     try {
         const raw = await fetchFollowingRedirects(request, client);
         const response = await parseResponse(raw, context.config.responseType ?? "auto");

package/dist/httpMiddleware/builtin/static/httpMiddleware.static.js

@@ -133,7 +133,19 @@ export function createStaticMiddleware(options) {
         if (method !== undefined && method !== "GET" && method !== "HEAD") {
             return next();
         }
-        const url = new URL(context.request.url);
+        /*
+         * `context.request.url` is the request-target as the adapter received
+         * it — `/pub/app.js`, not an absolute URL — so it must be parsed against
+         * a base. `new URL(url)` alone threw `Invalid URL` for every request the
+         * Node adapter delivered, and the middleware answered 500 to all of them.
+         */
+        let url;
+        try {
+            url = new URL(context.request.url, "http://zudojs.invalid");
+        }
+        catch {
+            return next();
+        }
         const decodedPathname = decodePathname(url.pathname);
         if (decodedPathname === undefined) {
             return next();

package/dist/httpResponse/httpResponse.context.d.ts

@@ -29,6 +29,16 @@ export declare class HttpResponseContext {
     html(content: string): this;
     cookie(name: string, value: string, options?: ResponseCookie["options"]): this;
     removeCookie(name: string): this;
+    /**
+     * Redirects to `url`.
+     *
+     * The destination goes through `assertSafeRedirect`: a `javascript:` or
+     * `data:` URL, a scheme-relative `//evil.com`, or a value carrying a
+     * control character throws instead of being emitted as `Location`. An
+     * absolute `http(s)` URL and a same-origin path reference are accepted.
+     *
+     * @throws {TypeError} If the destination is not a safe redirect target.
+     */
     redirect(url: string, status?: number): this;
     markSent(): void;
     assertMutable(): void;

package/dist/httpResponse/httpResponse.context.js

@@ -5,6 +5,7 @@
  */
 import { DEFAULT_RESPONSE_STATUS } from "./core/httpResponse.type.js";
 import { getStatusText } from "./core/httpResponse.statusText.js";
+import { assertSafeRedirect } from "../httpRedirect/http.redirect.js";
 export class HttpResponseContext {
     _status;
     _statusText;
@@ -86,10 +87,21 @@ export class HttpResponseContext {
         this._cookies = this._cookies.filter((c) => c.name !== name);
         return this;
     }
+    /**
+     * Redirects to `url`.
+     *
+     * The destination goes through `assertSafeRedirect`: a `javascript:` or
+     * `data:` URL, a scheme-relative `//evil.com`, or a value carrying a
+     * control character throws instead of being emitted as `Location`. An
+     * absolute `http(s)` URL and a same-origin path reference are accepted.
+     *
+     * @throws {TypeError} If the destination is not a safe redirect target.
+     */
     redirect(url, status = 302) {
+        const location = assertSafeRedirect(url);
         this._status = status;
         this._statusText = getStatusText(status);
-        this._headers["location"] = url;
+        this._headers["location"] = location;
         return this;
     }
     markSent() {

package/dist/httpResponse/httpResponse.helper.d.ts

@@ -30,6 +30,12 @@ export declare function htmlResponse(html: string, status?: number, headers?: Re
 };
 /**
  * Creates a redirect response.
+ *
+ * The destination goes through {@link assertSafeRedirect}: a `javascript:` or
+ * `data:` URL, a scheme-relative `//evil.com`, or a value carrying a control
+ * character throws instead of being emitted as `Location`.
+ *
+ * @throws {TypeError} If the destination is not a safe redirect target.
  */
 export declare function redirectResponse(url: string, status?: number, headers?: ResponseHeaders): {
     readonly status: number;
@@ -46,6 +52,22 @@ export declare function emptyResponse(status?: number, headers?: ResponseHeaders
 };
 /**
  * Serializes a response cookie into a Set-Cookie header string.
+ *
+ * This is the serializer the adapters use for `response.cookie()` and it
+ * previously concatenated every field verbatim, so a value such as
+ * `x; Domain=evil.com` became a second attribute and a `__Host-` cookie
+ * missing `Secure` was emitted (and silently dropped by the browser). It now
+ * applies the same rules as `serializeCookie()` in the cookies module:
+ *
+ * - the name must be an RFC 6265 token;
+ * - `__Host-` / `__Secure-` prefix constraints are enforced;
+ * - `Domain` and `Path` may not contain `;` or a control character;
+ * - a value that is not made only of `cookie-octet` characters is
+ *   percent-encoded, so it can neither inject an attribute nor split the
+ *   header (a value that is already valid is emitted unchanged);
+ * - `maxAge` must be finite and `expires` must be a valid `Date`.
+ *
+ * @throws {TypeError} If the name, a prefix rule or an attribute is invalid.
  */
 export declare function serializeResponseCookie(cookie: ResponseCookie): string;
 //# sourceMappingURL=httpResponse.helper.d.ts.map

package/dist/httpResponse/httpResponse.helper.js

@@ -3,6 +3,7 @@
  *
  * @module httpResponse/helpers
  */
+import { assertSafeRedirect } from "../httpRedirect/http.redirect.js";
 /**
  * Creates a JSON response.
  */
@@ -44,12 +45,18 @@ export function htmlResponse(html, status = 200, headers = {}) {
 }
 /**
  * Creates a redirect response.
+ *
+ * The destination goes through {@link assertSafeRedirect}: a `javascript:` or
+ * `data:` URL, a scheme-relative `//evil.com`, or a value carrying a control
+ * character throws instead of being emitted as `Location`.
+ *
+ * @throws {TypeError} If the destination is not a safe redirect target.
  */
 export function redirectResponse(url, status = 302, headers = {}) {
     return {
         status,
         headers: {
-            location: url,
+            location: assertSafeRedirect(url),
             ...headers,
         },
         body: undefined,
@@ -65,40 +72,102 @@ export function emptyResponse(status = 204, headers = {}) {
         body: undefined,
     };
 }
+/**
+ * RFC 6265 `cookie-name`, which is an RFC 9110 `token`.
+ */
+const COOKIE_NAME_TOKEN = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;
+/**
+ * RFC 6265 `cookie-octet`: printable US-ASCII minus CTLs, SP, DQUOTE, comma,
+ * semicolon and backslash.
+ */
+const COOKIE_OCTETS = /^[\u0021\u0023-\u002b\u002d-\u003a\u003c-\u005b\u005d-\u007e]*$/;
+/**
+ * Characters that must never appear in a cookie attribute value: `;` starts
+ * the next attribute, and any control character can split the header.
+ */
+const COOKIE_ATTRIBUTE_FORBIDDEN = /[;\u0000-\u001f\u007f]/;
 /**
  * Serializes a response cookie into a Set-Cookie header string.
+ *
+ * This is the serializer the adapters use for `response.cookie()` and it
+ * previously concatenated every field verbatim, so a value such as
+ * `x; Domain=evil.com` became a second attribute and a `__Host-` cookie
+ * missing `Secure` was emitted (and silently dropped by the browser). It now
+ * applies the same rules as `serializeCookie()` in the cookies module:
+ *
+ * - the name must be an RFC 6265 token;
+ * - `__Host-` / `__Secure-` prefix constraints are enforced;
+ * - `Domain` and `Path` may not contain `;` or a control character;
+ * - a value that is not made only of `cookie-octet` characters is
+ *   percent-encoded, so it can neither inject an attribute nor split the
+ *   header (a value that is already valid is emitted unchanged);
+ * - `maxAge` must be finite and `expires` must be a valid `Date`.
+ *
+ * @throws {TypeError} If the name, a prefix rule or an attribute is invalid.
  */
 export function serializeResponseCookie(cookie) {
-    let str = `${cookie.name}=${cookie.value}`;
-    if (cookie.options) {
-        const opts = cookie.options;
-        if (opts.domain) {
-            str += `; Domain=${opts.domain}`;
-        }
-        if (opts.path) {
-            str += `; Path=${opts.path}`;
-        }
-        if (opts.expires instanceof Date) {
-            str += `; Expires=${opts.expires.toUTCString()}`;
+    const name = cookie.name;
+    if (!name || !COOKIE_NAME_TOKEN.test(name)) {
+        throw new TypeError(`Invalid cookie name: ${JSON.stringify(name)}`);
+    }
+    const opts = cookie.options ?? {};
+    if (name.startsWith("__Host-")) {
+        if (!opts.secure) {
+            throw new TypeError("A __Host- cookie requires the Secure attribute.");
         }
-        if (typeof opts.maxAge === "number") {
-            str += `; Max-Age=${opts.maxAge}`;
+        if (opts.domain) {
+            throw new TypeError("A __Host- cookie must not set a Domain attribute.");
         }
-        if (opts.httpOnly) {
-            str += "; HttpOnly";
+        if ((opts.path ?? "/") !== "/") {
+            throw new TypeError("A __Host- cookie requires Path=/.");
         }
-        if (opts.secure) {
-            str += "; Secure";
+    }
+    else if (name.startsWith("__Secure-") && !opts.secure) {
+        throw new TypeError("A __Secure- cookie requires the Secure attribute.");
+    }
+    const rawValue = String(cookie.value);
+    const value = COOKIE_OCTETS.test(rawValue)
+        ? rawValue
+        : encodeURIComponent(rawValue);
+    let str = `${name}=${value}`;
+    if (opts.domain) {
+        if (COOKIE_ATTRIBUTE_FORBIDDEN.test(opts.domain)) {
+            throw new TypeError("Invalid cookie domain.");
         }
-        if (opts.sameSite) {
-            str += `; SameSite=${opts.sameSite}`;
+        str += `; Domain=${opts.domain}`;
+    }
+    if (opts.path) {
+        if (COOKIE_ATTRIBUTE_FORBIDDEN.test(opts.path)) {
+            throw new TypeError("Invalid cookie path.");
         }
-        if (opts.priority) {
-            str += `; Priority=${opts.priority}`;
+        str += `; Path=${opts.path}`;
+    }
+    if (opts.expires instanceof Date) {
+        if (Number.isNaN(opts.expires.getTime())) {
+            throw new TypeError("Cookie expires must be a valid Date.");
         }
-        if (opts.partitioned) {
-            str += "; Partitioned";
+        str += `; Expires=${opts.expires.toUTCString()}`;
+    }
+    if (typeof opts.maxAge === "number") {
+        if (!Number.isFinite(opts.maxAge)) {
+            throw new TypeError("Cookie maxAge must be a finite number.");
         }
+        str += `; Max-Age=${Math.floor(opts.maxAge)}`;
+    }
+    if (opts.httpOnly) {
+        str += "; HttpOnly";
+    }
+    if (opts.secure) {
+        str += "; Secure";
+    }
+    if (opts.sameSite) {
+        str += `; SameSite=${opts.sameSite}`;
+    }
+    if (opts.priority) {
+        str += `; Priority=${opts.priority}`;
+    }
+    if (opts.partitioned) {
+        str += "; Partitioned";
     }
     return str;
 }

package/dist/httpRouter/core/registry/core/httpRegistry.helper.js

@@ -42,7 +42,7 @@ export function normalizePath(path, options) {
         normalized = normalized.toLowerCase();
     }
     if (!options.strict) {
-        normalized = normalized.replace(/\/+$/, "") || "/";
+        normalized = normalized.replace(/(?<!\/)\/+$/, "") || "/";
     }
     return normalized;
 }

package/dist/httpRouter/dispatch/httpRoute.dispatcher.js

@@ -229,8 +229,19 @@ function toDispatchHandler(handler, context) {
             signal: getRequestSignal(request),
         }));
         if (result instanceof HttpResponseContext && result !== response) {
-            response.status_code(result.status);
+            /*
+             * Everything the handler put on its response must survive the merge.
+             * Copying only status, headers and body dropped every cookie the
+             * handler set, its custom status text and its metadata.
+             */
+            response.setStatus(result.status, result.statusText);
             response.headers_obj(result.headers);
+            for (const cookie of result.cookies) {
+                response.setCookie(cookie);
+            }
+            for (const [key, value] of Object.entries(result.metadata)) {
+                response.setMetadata(key, value);
+            }
             response.setBody(result.body);
         }
     };

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "@zudojs/http",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "HTTP primitives, request handling, routing, middleware, and server infrastructure for Zudojs applications.",
   "license": "MIT",
+  "author": {
+    "name": "Oluwayemi Oyinlola",
+    "url": "https://github.com/oyinlola-tech"
+  },
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -20,10 +24,10 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/core": "1.0.0",
-    "@zudojs/errors": "1.0.0",
-    "@zudojs/logger": "1.0.0",
-    "@zudojs/security": "1.0.0"
+    "@zudojs/core": "1.1.0",
+    "@zudojs/errors": "1.0.1",
+    "@zudojs/logger": "1.1.0",
+    "@zudojs/security": "1.0.1"
   },
   "devDependencies": {
     "@types/node": "^26.4.1",