@zudojs/http 1.0.0 → 1.2.0

package/dist/httpAdapter/node/httpNode.adapter.js

@@ -9,12 +9,15 @@
 import { IncomingMessage, Server, ServerResponse, createServer, } from "node:http";
 import { HttpRequestContext } from "../../httpRequest/httpRequest.context.js";
 import { HttpResponseContext, createResponseContext, } from "../../httpResponse/httpResponse.context.js";
-import { BaseHttpAdapter } from "../http.adapter.js";
+import { BaseHttpAdapter, normalizeHandlerResult } from "../http.adapter.js";
 import { writeResponse } from "../../httpResponse/httpResponse.writer.js";
 import { DEFAULT_HOST, DEFAULT_PORT, DEFAULT_MAX_BODY_SIZE, NODE_DEFAULT_HEADERS_TIMEOUT, NODE_DEFAULT_REQUEST_TIMEOUT, NODE_DEFAULT_KEEP_ALIVE_TIMEOUT, validatePort, validateMaxBodySize, } from "./httpNode.type.js";
 import { NodeResponseWriter } from "./httpNode.response.js";
+import { compileTrustProxy } from "../../httpTrustProxy/httpTrustProxy.compilation.js";
+import { createNodeRequestGuard } from "../../httpSecurity/httpSecurity.nodeGuard.js";
 import { createNodeRequestContext } from "./httpNode.request.js";
-import { isIncomingMessage, isServerResponse, isNodeRequestResponsePair, configureServer, listen, closeServer, readNodeRequestBody, NodeRequestBodyTooLargeError, isResponseContextLike, } from "./httpNode.server.js";
+import { resolveErrorResponse } from "../httpAdapter.errorResponse.js";
+import { isIncomingMessage, isServerResponse, isNodeRequestResponsePair, configureServer, listen, closeServer, readNodeRequestBody, NodeRequestBodyTooLargeError, } from "./httpNode.server.js";
 /* -------------------------------------------------------------------------- */
 /* Node HTTP Adapter                                                          */
 /* -------------------------------------------------------------------------- */
@@ -31,8 +34,16 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
     connectionsCheckingInterval;
     shutdownGraceMs;
     events;
+    requestGuard;
     server;
     ownsServer = false;
+    /**
+     * The `clientError` listener installed by `start()`, kept so `stop()` can
+     * remove it. On an externally supplied server the instance survives a
+     * stop/start cycle, and re-adding the listener on every start leaked one
+     * per restart.
+     */
+    clientErrorListener;
     constructor(options = {}) {
         super({
             ...options,
@@ -65,7 +76,11 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
                 Math.min(30_000, this.headersTimeout);
         this.shutdownGraceMs = options.shutdownGraceMs;
         this.trustProxy = options.trustProxy;
+        if (options.trustProxy !== undefined) {
+            compileTrustProxy(options.trustProxy);
+        }
         this.events = options.events ?? {};
+        this.requestGuard = createNodeRequestGuard(options.security);
         this.server = options.server;
         this.ownsServer = !options.server;
     }
@@ -124,7 +139,25 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
         }
         const request = input.request;
         const response = input.response;
-        const context = this.createRequest(request);
+        if (this.requestGuard && !this.requestGuard(request).allowed) {
+            await this.writeBadRequest(response);
+            return;
+        }
+        let context;
+        try {
+            context = this.createRequest(request);
+        }
+        catch (error) {
+            /*
+             * The request could not even be described (an unparseable request
+             * target, a header the context refuses). It is the client's fault, so
+             * answer 400 rather than letting the rejection destroy the socket
+             * without a response.
+             */
+            this.emitAdapterError(error);
+            await this.writeBadRequest(response);
+            return;
+        }
         try {
             await this.attachNodeBody(request, context);
             const result = await this.executeNodeHandler(context);
@@ -161,17 +194,12 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
         }
         return this.handler(request);
     }
+    /**
+     * Plain objects are data and are sent as JSON; see
+     * `normalizeHandlerResult`.
+     */
     normalizeResult(result) {
-        if (result instanceof HttpResponseContext) {
-            return result;
-        }
-        if (result === undefined || result === null) {
-            return createResponseContext();
-        }
-        if (isResponseContextLike(result)) {
-            return createResponseContext(result);
-        }
-        return createResponseContext().json(result);
+        return normalizeHandlerResult(result);
     }
     async handleNodeError(error, request, response) {
         if (response.headersSent) {
@@ -199,11 +227,27 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
                 // Fall through to the safe internal server error response.
             }
         }
-        context.internalServerError().json({
-            error: "Internal Server Error",
-        });
+        /*
+         * A thrown `HttpError` (or one buried under the middleware pipeline's
+         * wrappers) is answered with its own status, exposed message and headers;
+         * anything else stays a generic 500.
+         */
+        const resolved = resolveErrorResponse(error);
+        for (const [name, value] of Object.entries(resolved.headers)) {
+            context.setHeader(name, value);
+        }
+        context.setStatus(resolved.status).json(resolved.body);
         await this.writeNodeResponse(response, context);
     }
+    async writeBadRequest(response) {
+        if (response.headersSent) {
+            response.destroy();
+            return;
+        }
+        const context = createResponseContext();
+        context.setHeader("connection", "close");
+        await this.writeNodeResponse(response, context.setStatus(400).json({ error: "Bad Request" }));
+    }
     async writeNodeResponse(response, context) {
         const writer = this.createWriter(response);
         await writeResponse(context, writer);
@@ -265,13 +309,17 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
             connectionTimeout: this.connectionTimeout,
             maxConnections: this.maxConnections,
         });
-        this.server.on("clientError", (error, socket) => {
+        if (this.clientErrorListener) {
+            this.server.off("clientError", this.clientErrorListener);
+        }
+        this.clientErrorListener = (error, socket) => {
             this.emitAdapterError(error);
             if (socket.writable) {
                 socket.end("HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n");
             }
             socket.destroy();
-        });
+        };
+        this.server.on("clientError", this.clientErrorListener);
         await listen(this.server, this.port, this.host);
         const address = this.address;
         if (address && this.events.onListening) {
@@ -284,12 +332,24 @@ export class NodeHttpAdapter extends BaseHttpAdapter {
         }
         await super.start();
     }
-    async stop() {
+    /**
+     * Closes the server. The grace period is `options.graceMs` (the server's
+     * `gracefulShutdownTimeout`), capped by an explicit `shutdownGraceMs`;
+     * with neither it is 10 s.
+     */
+    async stop(options = {}) {
         if (!this.server || !this.server.listening) {
             await super.stop();
             return;
         }
-        await closeServer(this.server, { graceMs: this.shutdownGraceMs });
+        const graceMs = options.graceMs === undefined
+            ? this.shutdownGraceMs
+            : Math.min(options.graceMs, this.shutdownGraceMs ?? Infinity);
+        await closeServer(this.server, { graceMs });
+        if (this.clientErrorListener) {
+            this.server.off("clientError", this.clientErrorListener);
+            this.clientErrorListener = undefined;
+        }
         if (this.ownsServer) {
             this.server = undefined;
         }

package/dist/httpAdapter/node/httpNode.request.d.ts

@@ -18,6 +18,17 @@ export declare function getNodeRequestPort(request: IncomingMessage, options?: N
  * `getClientIp` so there is a single implementation of the hop logic.
  */
 export declare function getNodeRemoteAddress(request: IncomingMessage, options?: NodeRequestOptions): string | undefined;
-export declare function parseNodeQuery(request: IncomingMessage): Readonly<Record<string, string>>;
+/**
+ * Parses the request-target's query string into a flat record.
+ *
+ * Every value is attacker-controlled, so decoding never throws (a malformed
+ * `%E0` is kept raw) and `+` has its form-encoding meaning. This uses the same
+ * parser as the router's `ctx.query` (`parseQueryString`), so both agree: a
+ * repeated name is an array (`?role=user&role=admin` gives
+ * `["user", "admin"]`), the record has a `null` prototype, and
+ * `__proto__` / `constructor` / `prototype` are dropped. Previously the last
+ * value silently won here while the router returned the array.
+ */
+export declare function parseNodeQuery(request: IncomingMessage): Readonly<Record<string, string | readonly string[]>>;
 export declare function createNodeRequestContext(request: IncomingMessage, options?: NodeRequestOptions): HttpRequestContext;
 //# sourceMappingURL=httpNode.request.d.ts.map

package/dist/httpAdapter/node/httpNode.request.js

@@ -6,6 +6,8 @@
 import { HttpRequestContext, createRequestContext, } from "../../httpRequest/httpRequest.context.js";
 import { getClientIp, isTrustedProxy, } from "../../httpTrustProxy/httpTrustProxy.core.js";
 import { removePort, extractPort } from "./httpNode.server.js";
+import { parseQueryString } from "../../httpQuery/http.query.js";
+import { findRequestTargetViolation } from "../../httpRequest/target/httpRequest.target.js";
 /* -------------------------------------------------------------------------- */
 /* Proxy Trust                                                                */
 /* -------------------------------------------------------------------------- */
@@ -118,40 +120,45 @@ export function getNodeRemoteAddress(request, options = {}) {
     };
     return getClientIp(proxyRequest, trustProxy) ?? peer;
 }
+/**
+ * Parses the request-target's query string into a flat record.
+ *
+ * Every value is attacker-controlled, so decoding never throws (a malformed
+ * `%E0` is kept raw) and `+` has its form-encoding meaning. This uses the same
+ * parser as the router's `ctx.query` (`parseQueryString`), so both agree: a
+ * repeated name is an array (`?role=user&role=admin` gives
+ * `["user", "admin"]`), the record has a `null` prototype, and
+ * `__proto__` / `constructor` / `prototype` are dropped. Previously the last
+ * value silently won here while the router returned the array.
+ */
 export function parseNodeQuery(request) {
     const url = request.url;
     if (!url) {
-        return Object.freeze({});
+        return Object.freeze(Object.create(null));
     }
     const questionIndex = url.indexOf("?");
     if (questionIndex === -1) {
-        return Object.freeze({});
+        return Object.freeze(Object.create(null));
     }
-    const queryString = url.slice(questionIndex + 1);
-    if (!queryString) {
-        return Object.freeze({});
-    }
-    const params = {};
-    for (const pair of queryString.split("&")) {
-        const [key, value] = pair.split("=");
-        if (key) {
-            params[decodeURIComponent(key)] =
-                value !== undefined ? decodeURIComponent(value) : "";
-        }
-    }
-    return Object.freeze(params);
+    const hashIndex = url.indexOf("#", questionIndex + 1);
+    const queryString = url.slice(questionIndex + 1, hashIndex === -1 ? undefined : hashIndex);
+    return Object.freeze(parseQueryString(queryString));
 }
 /* -------------------------------------------------------------------------- */
 /* Request Context                                                            */
 /* -------------------------------------------------------------------------- */
 export function createNodeRequestContext(request, options = {}) {
+    const url = request.url ?? "/";
+    const violation = findRequestTargetViolation(url);
+    if (violation !== undefined) {
+        throw new TypeError(violation);
+    }
     const headers = getNodeRequestHeaders(request);
     const protocol = getNodeRequestProtocol(request, options);
     const hostname = getNodeRequestHostname(request, options);
     const port = getNodeRequestPort(request, options);
     const remoteAddress = getNodeRemoteAddress(request, options);
     const query = parseNodeQuery(request);
-    const url = request.url ?? "/";
     return createRequestContext({
         method: request.method?.toUpperCase() ?? "GET",
         url,

package/dist/httpAdapter/node/httpNode.server.d.ts

@@ -43,6 +43,12 @@ export declare function getSearchPart(url: string): string;
 import { RequestBodyTooLargeError as NodeRequestBodyTooLargeError } from "@zudojs/errors";
 export { NodeRequestBodyTooLargeError };
 export declare function readNodeRequestBody(request: IncomingMessage, maxBodySize?: number): Promise<Uint8Array>;
+/**
+ * Whether a value has the shape of a response init.
+ *
+ * @deprecated No longer used by the Node adapter: a plain object returned
+ * from a handler is always sent as JSON. Kept for API compatibility.
+ */
 export declare function isResponseContextLike(value: unknown): value is {
     readonly status?: number;
     readonly statusText?: string;

package/dist/httpAdapter/node/httpNode.server.js

@@ -250,6 +250,12 @@ export function readNodeRequestBody(request, maxBodySize = DEFAULT_MAX_BODY_SIZE
 /* -------------------------------------------------------------------------- */
 /* Response Result Detection                                                  */
 /* -------------------------------------------------------------------------- */
+/**
+ * Whether a value has the shape of a response init.
+ *
+ * @deprecated No longer used by the Node adapter: a plain object returned
+ * from a handler is always sent as JSON. Kept for API compatibility.
+ */
 export function isResponseContextLike(value) {
     if (value === null || typeof value !== "object") {
         return false;

package/dist/httpAdapter/node/httpNode.type.d.ts

@@ -6,7 +6,8 @@
 import type { Server } from "node:http";
 import type { HttpAdapterOptions } from "../http.adapter.js";
 import type { TrustProxy } from "../../httpTrustProxy/httpTrustProxy.core.js";
-export interface NodeAdapterOptions extends HttpAdapterOptions {
+import type { NodeAdapterSecurityOptions } from "../../httpSecurity/httpSecurity.nodeGuard.js";
+export interface NodeAdapterOptions extends HttpAdapterOptions, NodeAdapterSecurityOptions {
     readonly host?: string;
     readonly port?: number;
     readonly server?: Server;

package/dist/httpClient/httpClient.executor.js

@@ -60,9 +60,20 @@ async function executeOnce(context, client) {
         }, timeout);
     }
     const signal = combineAbortSignals(context.config.signal, controller?.signal);
-    const request = signal === context.request.signal
-        ? context.request
-        : new Request(context.request, { signal });
+    /*
+     * A `Request` body can be dispatched once. Every attempt used to be built
+     * from `context.request` itself, which consumed its body on the first try
+     * and made the first *retry* of any body-bearing request fail with
+     * "Request object that has already been used" — so `retryMethods: ["POST"]`
+     * could never retry. Each attempt now works on a clone, and the original
+     * is left untouched for the next one.
+     */
+    const attemptRequest = context.request.body !== null && !context.request.bodyUsed
+        ? context.request.clone()
+        : context.request;
+    const request = signal === attemptRequest.signal
+        ? attemptRequest
+        : new Request(attemptRequest, { signal });
     try {
         const raw = await fetchFollowingRedirects(request, client);
         const response = await parseResponse(raw, context.config.responseType ?? "auto");

package/dist/httpCookies/http.cookies.d.ts

@@ -57,7 +57,14 @@ export declare const MAX_COOKIE_HEADER_LENGTH: number;
  * @returns The parsed cookie jar.
  */
 export declare function parseCookies(header: string | undefined): CookieCollection;
-export declare function serializeCookie(name: string, value: CookieValue, options?: CookieOptions): string;
+/**
+ * Serializes a `Set-Cookie` header value.
+ *
+ * Unset attributes take the secure defaults (`Path=/; HttpOnly; Secure;
+ * SameSite=Lax`, see `DEFAULT_COOKIE_ATTRIBUTES`); pass `httpOnly: false`,
+ * `secure: false`, another `sameSite` or `path` to override them.
+ */
+export declare function serializeCookie(name: string, value: CookieValue, cookieOptions?: CookieOptions): string;
 export interface CookieManager {
     get(name: string): string | undefined;
     has(name: string): boolean;
@@ -78,11 +85,31 @@ export interface SignedCookie {
     readonly value: string;
     readonly signature: string;
 }
+/**
+ * Serializes a signed cookie. The MAC covers the cookie **name** as well as
+ * the value, so a signature minted for one cookie is not accepted for
+ * another; read it back with `parseSignedCookie(value, secret, name)`.
+ */
 export declare function serializeSignedCookie(name: string, value: string, options: SignedCookieOptions): string;
-export declare function parseSignedCookie(value: string | undefined, secret: string): string | undefined;
+/**
+ * Verifies a signed cookie value and returns the original value, or
+ * `undefined` when the signature does not match.
+ *
+ * Pass the cookie's `name`: the signature produced by
+ * `serializeSignedCookie` is bound to it, so a value lifted from another
+ * signed cookie (for example a user-chosen display name replayed as
+ * `session_user`) is rejected. Without `name` only a legacy, value-only
+ * signature (from `signCookieValue(value, secret)`) verifies, and
+ * name-bound signatures never do.
+ */
+export declare function parseSignedCookie(value: string | undefined, secret: string, name?: string): string | undefined;
 /**
  * Signs a cookie value with HMAC-SHA256.
  *
+ * Synchronous by contract, so the MAC is computed with `node:crypto`: every
+ * `@zudojs/crypto` HMAC helper is asynchronous. Verification compares with
+ * `@zudojs/crypto`'s constant-time `timingSafeEqualString`.
+ *
  * @param value - The value to authenticate.
  * @param secret - The signing key.
  * @returns The base64url signature.

package/dist/httpCookies/http.cookies.js

@@ -1,4 +1,6 @@
-import { createHmac, timingSafeEqual as cryptoTimingSafeEqual, } from "node:crypto";
+import { createHmac } from "node:crypto";
+import { timingSafeEqualString } from "@zudojs/crypto";
+import { withSecureCookieDefaults } from "./httpCookies.defaults.js";
 /* -------------------------------------------------------------------------- */
 /* Cookie Collection                                                          */
 /* -------------------------------------------------------------------------- */
@@ -123,7 +125,15 @@ export function parseCookies(header) {
 /* -------------------------------------------------------------------------- */
 /* Serialize Cookie                                                           */
 /* -------------------------------------------------------------------------- */
-export function serializeCookie(name, value, options = {}) {
+/**
+ * Serializes a `Set-Cookie` header value.
+ *
+ * Unset attributes take the secure defaults (`Path=/; HttpOnly; Secure;
+ * SameSite=Lax`, see `DEFAULT_COOKIE_ATTRIBUTES`); pass `httpOnly: false`,
+ * `secure: false`, another `sameSite` or `path` to override them.
+ */
+export function serializeCookie(name, value, cookieOptions = {}) {
+    const options = withSecureCookieDefaults(cookieOptions, "lax");
     validateCookieName(name);
     validateCookiePrefix(name, options);
     const encodedName = name;
@@ -229,11 +239,27 @@ export function createCookieManager(request, response) {
         },
     };
 }
+/**
+ * Serializes a signed cookie. The MAC covers the cookie **name** as well as
+ * the value, so a signature minted for one cookie is not accepted for
+ * another; read it back with `parseSignedCookie(value, secret, name)`.
+ */
 export function serializeSignedCookie(name, value, options) {
-    const signature = signCookieValue(value, options.secret);
+    const signature = signCookieValue(bindCookieName(name, value), options.secret);
     return serializeCookie(name, `${value}.${signature}`, options);
 }
-export function parseSignedCookie(value, secret) {
+/**
+ * Verifies a signed cookie value and returns the original value, or
+ * `undefined` when the signature does not match.
+ *
+ * Pass the cookie's `name`: the signature produced by
+ * `serializeSignedCookie` is bound to it, so a value lifted from another
+ * signed cookie (for example a user-chosen display name replayed as
+ * `session_user`) is rejected. Without `name` only a legacy, value-only
+ * signature (from `signCookieValue(value, secret)`) verifies, and
+ * name-bound signatures never do.
+ */
+export function parseSignedCookie(value, secret, name) {
     if (!value) {
         return undefined;
     }
@@ -243,15 +269,27 @@ export function parseSignedCookie(value, secret) {
     }
     const originalValue = value.slice(0, separator);
     const signature = value.slice(separator + 1);
-    const expected = signCookieValue(originalValue, secret);
-    if (!timingSafeEqual(signature, expected)) {
+    const expected = signCookieValue(name === undefined ? originalValue : bindCookieName(name, originalValue), secret);
+    if (!timingSafeEqualString(signature, expected)) {
         return undefined;
     }
     return originalValue;
 }
+/**
+ * The MAC input for a name-bound signature. A cookie name is an RFC 6265
+ * token and cannot contain `=`, so the encoding is unambiguous.
+ */
+function bindCookieName(name, value) {
+    validateCookieName(name);
+    return `${name}=${value}`;
+}
 /**
  * Signs a cookie value with HMAC-SHA256.
  *
+ * Synchronous by contract, so the MAC is computed with `node:crypto`: every
+ * `@zudojs/crypto` HMAC helper is asynchronous. Verification compares with
+ * `@zudojs/crypto`'s constant-time `timingSafeEqualString`.
+ *
  * @param value - The value to authenticate.
  * @param secret - The signing key.
  * @returns The base64url signature.
@@ -396,22 +434,4 @@ function normalizePriority(value) {
             throw new TypeError(`Invalid cookie priority: ${String(value)}`);
     }
 }
-/* -------------------------------------------------------------------------- */
-/* Hash Helpers                                                               */
-/* -------------------------------------------------------------------------- */
-/**
- * Compares two signatures in constant time.
- *
- * @param left - The candidate signature.
- * @param right - The expected signature.
- * @returns `true` if the two are byte-identical.
- */
-function timingSafeEqual(left, right) {
-    const leftBuffer = Buffer.from(left, "utf8");
-    const rightBuffer = Buffer.from(right, "utf8");
-    if (leftBuffer.length !== rightBuffer.length) {
-        return false;
-    }
-    return cryptoTimingSafeEqual(leftBuffer, rightBuffer);
-}
 //# sourceMappingURL=http.cookies.js.map

package/dist/httpCookies/httpCookies.defaults.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Secure cookie defaults.
+ *
+ * Both cookie serializers (`serializeCookie` in this module and the
+ * `serializeResponseCookie` the adapters use for `response.cookie()`) start
+ * from these defaults, so a cookie set "the obvious way" is `HttpOnly`,
+ * `Secure`, `SameSite=Lax` and `Path=/`, matching the defaults of
+ * `@zudojs/security`'s `serializeCookie` and the AGENTS.md secure-defaults
+ * rule. Every default can be overridden explicitly (`httpOnly: false`,
+ * `secure: false`, `sameSite: "none"`, `path: "/app"`); an option left
+ * `undefined` keeps the default.
+ *
+ * @module httpCookies/defaults
+ */
+/**
+ * The attributes every cookie gets unless the caller overrides them.
+ */
+export declare const DEFAULT_COOKIE_ATTRIBUTES: Readonly<{
+    readonly path: "/";
+    readonly httpOnly: true;
+    readonly secure: true;
+    readonly sameSite: "lax";
+}>;
+interface DefaultableCookieOptions<S extends string> {
+    readonly path?: string;
+    readonly httpOnly?: boolean;
+    readonly secure?: boolean;
+    readonly sameSite?: S;
+}
+/**
+ * Returns `options` with the secure defaults filled in for every attribute
+ * the caller left `undefined`.
+ *
+ * @param options - The caller's cookie options.
+ * @param sameSite - The default `SameSite` value in the option type's own
+ *   spelling (`"lax"` or `"Lax"`).
+ */
+export declare function withSecureCookieDefaults<S extends string, T extends DefaultableCookieOptions<S>>(options: T | undefined, sameSite: S): T;
+export {};
+//# sourceMappingURL=httpCookies.defaults.d.ts.map

package/dist/httpCookies/httpCookies.defaults.js

@@ -0,0 +1,42 @@
+/**
+ * Secure cookie defaults.
+ *
+ * Both cookie serializers (`serializeCookie` in this module and the
+ * `serializeResponseCookie` the adapters use for `response.cookie()`) start
+ * from these defaults, so a cookie set "the obvious way" is `HttpOnly`,
+ * `Secure`, `SameSite=Lax` and `Path=/`, matching the defaults of
+ * `@zudojs/security`'s `serializeCookie` and the AGENTS.md secure-defaults
+ * rule. Every default can be overridden explicitly (`httpOnly: false`,
+ * `secure: false`, `sameSite: "none"`, `path: "/app"`); an option left
+ * `undefined` keeps the default.
+ *
+ * @module httpCookies/defaults
+ */
+/**
+ * The attributes every cookie gets unless the caller overrides them.
+ */
+export const DEFAULT_COOKIE_ATTRIBUTES = Object.freeze({
+    path: "/",
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+});
+/**
+ * Returns `options` with the secure defaults filled in for every attribute
+ * the caller left `undefined`.
+ *
+ * @param options - The caller's cookie options.
+ * @param sameSite - The default `SameSite` value in the option type's own
+ *   spelling (`"lax"` or `"Lax"`).
+ */
+export function withSecureCookieDefaults(options, sameSite) {
+    const source = (options ?? {});
+    return {
+        ...source,
+        path: source.path ?? DEFAULT_COOKIE_ATTRIBUTES.path,
+        httpOnly: source.httpOnly ?? DEFAULT_COOKIE_ATTRIBUTES.httpOnly,
+        secure: source.secure ?? DEFAULT_COOKIE_ATTRIBUTES.secure,
+        sameSite: source.sameSite ?? sameSite,
+    };
+}
+//# sourceMappingURL=httpCookies.defaults.js.map

package/dist/httpCookies/index.d.ts

@@ -4,4 +4,5 @@
  * HTTP httpCookies module.
  */
 export * from "./http.cookies.js";
+export * from "./httpCookies.defaults.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpCookies/index.js

@@ -4,4 +4,5 @@
  * HTTP httpCookies module.
  */
 export * from "./http.cookies.js";
+export * from "./httpCookies.defaults.js";
 //# sourceMappingURL=index.js.map

package/dist/httpMiddleware/builtin/conditional/httpMiddleware.conditional.d.ts

@@ -7,7 +7,28 @@ import type { HttpMiddleware, HttpMiddlewareContext } from "../../httpMiddleware
 import type { HttpResponseContext as ResponseContext } from "../../../httpResponse/httpResponse.context.js";
 export declare function createAsyncMiddleware(factory: (context: HttpMiddlewareContext) => Promise<HttpMiddleware>): HttpMiddleware;
 export declare function createConditionalMiddleware(predicate: (context: HttpMiddlewareContext) => boolean | Promise<boolean>, middleware: HttpMiddleware): HttpMiddleware;
-export declare function createPathMiddleware(path: string, middleware: HttpMiddleware): HttpMiddleware;
+/**
+ * Options for {@link createPathMiddleware}.
+ */
+export interface PathMiddlewareOptions {
+    /**
+     * Match the path case-sensitively. Defaults to `false`, the router's
+     * default, so a guard scoped to `/admin` also covers `/Admin`, which the
+     * router would dispatch to the same route.
+     */
+    readonly caseSensitive?: boolean;
+}
+/**
+ * Runs `middleware` only for requests addressed to `path`.
+ *
+ * The request path is normalised exactly as the router normalises it before
+ * matching: it is read with the canonical request-target parser, repeated
+ * slashes are collapsed, a trailing slash is ignored and (by default) case is
+ * ignored. An exact, case-sensitive comparison let `/Admin`, `/admin/` and
+ * `/admin//` skip a guard on `/admin` while the router still served the
+ * protected route.
+ */
+export declare function createPathMiddleware(path: string, middleware: HttpMiddleware, options?: PathMiddlewareOptions): HttpMiddleware;
 export declare function createMethodMiddleware(method: string, middleware: HttpMiddleware): HttpMiddleware;
 export declare function createResponseMiddleware(response: Response | ResponseContext): HttpMiddleware;
 export declare function createShortCircuitMiddleware(predicate: (context: HttpMiddlewareContext) => boolean | Promise<boolean>, response: Response | ResponseContext): HttpMiddleware;

package/dist/httpMiddleware/builtin/conditional/httpMiddleware.conditional.js

@@ -4,6 +4,7 @@
  * @module httpMiddleware/builtin/conditional
  */
 import { getRequestMethod, getRequestUrl, extractPathname, } from "../helpers/index.js";
+import { normalizePath } from "../../../httpRouter/core/util/httpRoute.util.js";
 import { isWebResponse, bufferWebResponse, } from "../../../httpResponse/httpResponse.fromWeb.js";
 export function createAsyncMiddleware(factory) {
     return async (context, next) => {
@@ -19,12 +20,26 @@ export function createConditionalMiddleware(predicate, middleware) {
         return next();
     };
 }
-export function createPathMiddleware(path, middleware) {
-    const targetPath = extractPathname(path);
+/**
+ * Runs `middleware` only for requests addressed to `path`.
+ *
+ * The request path is normalised exactly as the router normalises it before
+ * matching: it is read with the canonical request-target parser, repeated
+ * slashes are collapsed, a trailing slash is ignored and (by default) case is
+ * ignored. An exact, case-sensitive comparison let `/Admin`, `/admin/` and
+ * `/admin//` skip a guard on `/admin` while the router still served the
+ * protected route.
+ */
+export function createPathMiddleware(path, middleware, options = {}) {
+    const caseSensitive = options.caseSensitive === true;
+    const canonical = (value) => {
+        const normalized = normalizePath(value);
+        return caseSensitive ? normalized : normalized.toLowerCase();
+    };
+    const targetPath = canonical(extractPathname(path));
     return createConditionalMiddleware((context) => {
         const url = getRequestUrl(context.request);
-        const pathname = extractPathname(url);
-        return pathname === targetPath;
+        return canonical(extractPathname(url)) === targetPath;
     }, middleware);
 }
 export function createMethodMiddleware(method, middleware) {

package/dist/httpMiddleware/builtin/conditional/index.d.ts

@@ -4,4 +4,5 @@
  * @module httpMiddleware/builtin/conditional
  */
 export { createAsyncMiddleware, createConditionalMiddleware, createPathMiddleware, createMethodMiddleware, createResponseMiddleware, createShortCircuitMiddleware, } from "./httpMiddleware.conditional.js";
+export type { PathMiddlewareOptions } from "./httpMiddleware.conditional.js";
 //# sourceMappingURL=index.d.ts.map