@zudojs/http 1.0.0 → 1.2.0

package/dist/httpMiddleware/builtin/video/httpMiddleware.video.js

@@ -3,79 +3,58 @@
  *
  * @module httpMiddleware/builtin/video
  *
- * Requires: npm install fluent-ffmpeg
+ * Requires: npm install fluent-ffmpeg (and an ffmpeg binary)
+ */
+import { Readable } from "node:stream";
+import { applyCompressedBody, getResponseBytes, getResponseMediaType, loadOptionalModule, } from "../helpers/index.js";
+import { CONTAINER_TYPES, DEFAULT_VIDEO_FORMAT as DEFAULT_FORMAT, buildOutputOptions, } from "./httpMiddleware.video.options.js";
+/**
+ * Transcodes a video held in memory.
+ *
+ * `fluent-ffmpeg`'s export is a factory: `input()` exists only on the
+ * command it returns. Calling it on the module (as this did) threw
+ * `ffmpegInstance.input is not a function` on every call.
  */
-import { applyHeadersToResponse } from "../helpers/index.js";
-const DEFAULT_CRF = 28;
-const DEFAULT_PRESET = "medium";
-const DEFAULT_FORMAT = "mp4";
-async function getFfmpeg() {
-    try {
-        const mod = await import("fluent-ffmpeg");
-        return mod.default ?? mod;
-    }
-    catch {
-        throw new Error("fluent-ffmpeg is not installed. Run: npm install fluent-ffmpeg");
-    }
-}
 export async function compressVideo(inputBuffer, options = {}) {
-    const ffmpegInstance = await getFfmpeg();
-    const crf = options.crf ?? DEFAULT_CRF;
-    const preset = options.preset ?? DEFAULT_PRESET;
-    const format = options.format ?? DEFAULT_FORMAT;
+    const ffmpeg = await loadOptionalModule("fluent-ffmpeg", "npm install fluent-ffmpeg");
     return new Promise((resolve, reject) => {
-        const outputBuffer = [];
-        ffmpegInstance
-            .input(inputBuffer)
-            .inputFormat("mp4")
-            .outputOptions([
-            `-crf ${crf}`,
-            `-preset ${preset}`,
-            "-movflags +faststart",
-        ])
-            .format(format)
-            .on("end", () => {
-            resolve(Buffer.concat(outputBuffer));
-        })
-            .on("error", (err) => {
-            reject(err);
-        })
-            .pipe((err, stdout) => {
-            if (err) {
-                reject(err);
-                return;
-            }
-            stdout.on("data", (chunk) => {
-                outputBuffer.push(chunk);
-            });
-        });
+        const chunks = [];
+        const output = ffmpeg()
+            .input(Readable.from([inputBuffer]))
+            .inputFormat(options.inputFormat ?? "mp4")
+            .outputOptions(buildOutputOptions(options))
+            .format(options.format ?? DEFAULT_FORMAT)
+            .on("error", reject)
+            .pipe();
+        output.on("data", (chunk) => chunks.push(chunk));
+        output.on("end", () => resolve(Buffer.concat(chunks)));
+        output.on("error", reject);
     });
 }
+/**
+ * Compresses `video/*` responses, reading status, headers and body from the
+ * response returned by `next()`.
+ */
 export function createVideoCompressionMiddleware(options = {}) {
     const enabled = options.enabled ?? true;
-    return async (context, next) => {
-        if (!enabled) {
-            return next();
-        }
+    return async (_context, next) => {
         const response = await next();
-        const contentType = context.response.headers["content-type"];
-        if (!contentType || !contentType.startsWith("video/")) {
+        const mediaType = getResponseMediaType(response);
+        if (!enabled || !mediaType?.startsWith("video/")) {
             return response;
         }
-        const body = context.response.body;
-        if (!Buffer.isBuffer(body)) {
+        const body = getResponseBytes(response);
+        if (!body || body.length === 0) {
             return response;
         }
-        const compressionOptions = options.contentTypeMap?.[contentType] ?? {};
+        const compression = options.contentTypeMap?.[mediaType] ?? {};
+        const format = compression.format ?? DEFAULT_FORMAT;
         try {
-            const compressed = await compressVideo(body, compressionOptions);
-            const newContentType = "video/mp4";
-            const headers = new Headers(response.headers);
-            headers.set("content-type", newContentType);
-            headers.set("cache-control", headers.get("cache-control") ?? "public, max-age=86400");
-            return applyHeadersToResponse(response, headers).setBody(compressed);
+            const compressed = await compressVideo(body, compression);
+            return applyCompressedBody(response, compressed, CONTAINER_TYPES[format] ?? "video/mp4");
         }
-        catch {
+        catch (error) {
+            options.onError?.(error, response);
             return response;
         }
     };

package/dist/httpMiddleware/builtin/video/httpMiddleware.video.options.d.ts

@@ -0,0 +1,12 @@
+/**
+ * FFmpeg argument building for the video compression middleware.
+ *
+ * @module httpMiddleware/builtin/video/options
+ */
+import type { VideoCompressionOptions } from "./httpMiddleware.video.js";
+export declare const DEFAULT_VIDEO_FORMAT = "mp4";
+/** Media type per output container. */
+export declare const CONTAINER_TYPES: Readonly<Record<string, string>>;
+/** Builds the ffmpeg output options for a compression request. */
+export declare function buildOutputOptions(options: VideoCompressionOptions): string[];
+//# sourceMappingURL=httpMiddleware.video.options.d.ts.map

package/dist/httpMiddleware/builtin/video/httpMiddleware.video.options.js

@@ -0,0 +1,31 @@
+/**
+ * FFmpeg argument building for the video compression middleware.
+ *
+ * @module httpMiddleware/builtin/video/options
+ */
+const DEFAULT_CRF = 28;
+const DEFAULT_PRESET = "medium";
+export const DEFAULT_VIDEO_FORMAT = "mp4";
+/** Media type per output container. */
+export const CONTAINER_TYPES = Object.freeze({
+    mp4: "video/mp4",
+    webm: "video/webm",
+    mov: "video/quicktime",
+});
+/** Builds the ffmpeg output options for a compression request. */
+export function buildOutputOptions(options) {
+    const output = [
+        `-crf ${options.crf ?? DEFAULT_CRF}`,
+        `-preset ${options.preset ?? DEFAULT_PRESET}`,
+        /* A pipe is not seekable, so the moov atom must be fragmented. */
+        "-movflags frag_keyframe+empty_moov",
+    ];
+    if (options.bitrate) {
+        output.push(`-b:v ${options.bitrate}`);
+    }
+    if (options.scale?.width || options.scale?.height) {
+        output.push(`-vf scale=${options.scale.width ?? -2}:${options.scale.height ?? -2}`);
+    }
+    return output;
+}
+//# sourceMappingURL=httpMiddleware.video.options.js.map

package/dist/httpMiddleware/httpMiddleware.error.d.ts

@@ -1,38 +1,12 @@
 /**
  * HTTP middleware error types.
  *
- * Extends the shared MiddlewareError from @zudojs/errors with
- * HTTP-specific middleware error information.
+ * `HttpMiddlewareError` and `HttpMiddlewarePipelineError` live in
+ * `@zudojs/errors` (both `BaseError`s, 500, not exposed, codes
+ * `HTTP_MIDDLEWARE_ERROR` / `MIDDLEWARE_PIPELINE_ERROR`); they are
+ * re-exported here so existing imports keep working.
  *
  * @module httpMiddleware/errors
  */
-import { BaseError } from "@zudojs/errors";
-/**
- * Error raised by an HTTP middleware function.
- */
-export declare class HttpMiddlewareError extends BaseError {
-    /**
-     * The unique identifier of the middleware.
-     */
-    readonly middlewareId: string | undefined;
-    /**
-     * The name of the middleware.
-     */
-    readonly middlewareName: string | undefined;
-    constructor(message: string, options?: {
-        readonly middlewareId?: string;
-        readonly middlewareName?: string;
-        readonly cause?: unknown;
-    });
-}
-/**
- * Error raised when the HTTP middleware pipeline fails.
- */
-export declare class HttpMiddlewarePipelineError extends BaseError {
-    /**
-     * The errors that occurred during pipeline execution.
-     */
-    readonly errors: readonly HttpMiddlewareError[];
-    constructor(errors: readonly HttpMiddlewareError[]);
-}
+export { HttpMiddlewareError, HttpMiddlewarePipelineError, type HttpMiddlewareErrorOptions, } from "@zudojs/errors";
 //# sourceMappingURL=httpMiddleware.error.d.ts.map

package/dist/httpMiddleware/httpMiddleware.error.js

@@ -1,60 +1,12 @@
 /**
  * HTTP middleware error types.
  *
- * Extends the shared MiddlewareError from @zudojs/errors with
- * HTTP-specific middleware error information.
+ * `HttpMiddlewareError` and `HttpMiddlewarePipelineError` live in
+ * `@zudojs/errors` (both `BaseError`s, 500, not exposed, codes
+ * `HTTP_MIDDLEWARE_ERROR` / `MIDDLEWARE_PIPELINE_ERROR`); they are
+ * re-exported here so existing imports keep working.
  *
  * @module httpMiddleware/errors
  */
-import { BaseError } from "@zudojs/errors";
-/* -------------------------------------------------------------------------- */
-/* Errors                                                                     */
-/* -------------------------------------------------------------------------- */
-/**
- * Error raised by an HTTP middleware function.
- */
-export class HttpMiddlewareError extends BaseError {
-    /**
-     * The unique identifier of the middleware.
-     */
-    middlewareId;
-    /**
-     * The name of the middleware.
-     */
-    middlewareName;
-    constructor(message, options = {}) {
-        super(message, {
-            code: "HTTP_MIDDLEWARE_ERROR",
-            statusCode: 500,
-            expose: false,
-            cause: options.cause,
-        });
-        this.name = "HttpMiddlewareError";
-        this.middlewareId = options.middlewareId;
-        this.middlewareName = options.middlewareName;
-    }
-}
-/**
- * Error raised when the HTTP middleware pipeline fails.
- */
-export class HttpMiddlewarePipelineError extends BaseError {
-    /**
-     * The errors that occurred during pipeline execution.
-     */
-    errors;
-    constructor(errors) {
-        const message = errors.length === 1
-            ? `HTTP middleware pipeline failed: ${errors[0]?.message ?? "Unknown error"}`
-            : `HTTP middleware pipeline failed with ${errors.length} errors: ${errors
-                .map((e) => e.message)
-                .join(", ")}`;
-        super(message, {
-            code: "MIDDLEWARE_PIPELINE_ERROR",
-            statusCode: 500,
-            expose: false,
-        });
-        this.name = "HttpMiddlewarePipelineError";
-        this.errors = Object.freeze([...errors]);
-    }
-}
+export { HttpMiddlewareError, HttpMiddlewarePipelineError, } from "@zudojs/errors";
 //# sourceMappingURL=httpMiddleware.error.js.map

package/dist/httpProxy/http.proxy.d.ts

@@ -128,6 +128,13 @@ export declare function assertSafeProxyTarget(target: string | URL, options?: Pr
 export declare function assertSafeProxyRedirect(location: string | URL, currentURL: string | URL, options?: ProxySecurityOptions): URL;
 export declare function resolveProxyTarget(target: string | URL, options?: ProxySecurityOptions): ProxyTarget;
 export declare function isValidProxyTarget(target: string | URL | undefined | null): boolean;
+/**
+ * Joins a request path onto a proxy base path.
+ *
+ * @throws {HttpError} 400 when `requestPath` contains a `.` / `..` segment
+ *   (plain or percent-encoded), which an upstream would resolve outside
+ *   `basePath`.
+ */
 export declare function joinProxyPath(basePath: string, requestPath: string): string;
 export declare function rewriteProxyPath(path: string, options?: ProxyRewriteOptions): string;
 export declare function normalizeProxyPath(path: string): string;

package/dist/httpProxy/http.proxy.js

@@ -11,6 +11,7 @@ import { appendHeader, deleteHeader, getHeader, setHeader, } from "../httpProtoc
 import { isValidHTTPURL, isValidHeaderValue } from "../httpValidation/index.js";
 import { isLinkLocalAddress, isLoopbackAddress, isUniqueLocalAddress, parseIpAddress, } from "../httpTrustProxy/httpTrustProxy.ip.js";
 import { assertSafeHeaderValue } from "../httpHeaders/security/index.js";
+import { assertProxyPathContained } from "./httpProxy.pathGuard.js";
 /* -------------------------------------------------------------------------- */
 /* Target                                                                     */
 /* -------------------------------------------------------------------------- */
@@ -204,7 +205,15 @@ function parseProxyURL(target) {
 /* -------------------------------------------------------------------------- */
 /* Path Handling                                                              */
 /* -------------------------------------------------------------------------- */
+/**
+ * Joins a request path onto a proxy base path.
+ *
+ * @throws {HttpError} 400 when `requestPath` contains a `.` / `..` segment
+ *   (plain or percent-encoded), which an upstream would resolve outside
+ *   `basePath`.
+ */
 export function joinProxyPath(basePath, requestPath) {
+    assertProxyPathContained(requestPath);
     const base = normalizeProxyPath(basePath);
     const request = requestPath.startsWith("/") ? requestPath : `/${requestPath}`;
     if (base === "/") {

package/dist/httpProxy/httpProxy.pathGuard.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Proxy request-path containment.
+ *
+ * A gateway mounts an upstream under `target.pathname` (for example
+ * `/public-api`) to expose only that subtree. The path builders used to
+ * concatenate the client's path onto the base and collapse `//` only, so
+ * `/../admin/keys` or `/%2e%2e/admin/keys` was forwarded as
+ * `/public-api/../admin/keys`, which the upstream resolves to `/admin/keys`.
+ *
+ * @module httpProxy/pathGuard
+ */
+/**
+ * Whether a request path contains a `.` / `..` segment once percent-encoded
+ * dots and separators (`%2e`, `%2f`, `%5c`) and backslashes are taken into
+ * account, i.e. whether an upstream might resolve it outside its base.
+ */
+export declare function hasProxyDotSegment(path: string): boolean;
+/**
+ * Throws a `400 Bad Request` `HttpError` when the client-supplied path could
+ * escape the proxy target's base path.
+ */
+export declare function assertProxyPathContained(path: string): void;
+//# sourceMappingURL=httpProxy.pathGuard.d.ts.map

package/dist/httpProxy/httpProxy.pathGuard.js

@@ -0,0 +1,43 @@
+/**
+ * Proxy request-path containment.
+ *
+ * A gateway mounts an upstream under `target.pathname` (for example
+ * `/public-api`) to expose only that subtree. The path builders used to
+ * concatenate the client's path onto the base and collapse `//` only, so
+ * `/../admin/keys` or `/%2e%2e/admin/keys` was forwarded as
+ * `/public-api/../admin/keys`, which the upstream resolves to `/admin/keys`.
+ *
+ * @module httpProxy/pathGuard
+ */
+import { badRequest } from "../httpErrors/factories/httpError.clientError.js";
+const ENCODED_SEPARATORS = /%2e|%2f|%5c/gi;
+function decodeSeparator(match) {
+    const code = match.toLowerCase();
+    if (code === "%2e") {
+        return ".";
+    }
+    return code === "%2f" ? "/" : "\\";
+}
+/**
+ * Whether a request path contains a `.` / `..` segment once percent-encoded
+ * dots and separators (`%2e`, `%2f`, `%5c`) and backslashes are taken into
+ * account, i.e. whether an upstream might resolve it outside its base.
+ */
+export function hasProxyDotSegment(path) {
+    const end = path.search(/[?#]/);
+    const pathOnly = end === -1 ? path : path.slice(0, end);
+    const decoded = pathOnly.replace(ENCODED_SEPARATORS, decodeSeparator);
+    return decoded
+        .split(/[\\/]/)
+        .some((segment) => segment === "." || segment === "..");
+}
+/**
+ * Throws a `400 Bad Request` `HttpError` when the client-supplied path could
+ * escape the proxy target's base path.
+ */
+export function assertProxyPathContained(path) {
+    if (hasProxyDotSegment(path)) {
+        throw badRequest("Proxy request path contains a dot segment.");
+    }
+}
+//# sourceMappingURL=httpProxy.pathGuard.js.map

package/dist/httpProxy/index.d.ts

@@ -5,4 +5,5 @@
  * and proxy request helpers.
  */
 export * from "./http.proxy.js";
+export * from "./httpProxy.pathGuard.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpProxy/index.js

@@ -5,4 +5,5 @@
  * and proxy request helpers.
  */
 export * from "./http.proxy.js";
+export * from "./httpProxy.pathGuard.js";
 //# sourceMappingURL=index.js.map

package/dist/httpRequest/httpRequest.context.d.ts

@@ -117,6 +117,13 @@ export declare function runWithRequestContext<T>(context: HttpRequestContext, ca
 export declare function getCurrentRequestContext(): HttpRequestContext | undefined;
 export declare function assertRequestContext(context: HttpRequestContext | undefined | null): asserts context is HttpRequestContext;
 export declare function isRequestContext(value: unknown): value is HttpRequestContext;
+/**
+ * Returns the canonical path of a request-target. An origin-form target such
+ * as `//host/admin` stays a path; it is never parsed as an authority.
+ */
 export declare function getPathname(url: string): string;
+/**
+ * Returns the search parameters of a request-target.
+ */
 export declare function getSearchParams(url: string): URLSearchParams;
 //# sourceMappingURL=httpRequest.context.d.ts.map

package/dist/httpRequest/httpRequest.context.js

@@ -7,6 +7,7 @@
  * The context is intentionally framework-agnostic so adapters can populate it
  * from Node.js, Bun, Deno, or another HTTP runtime.
  */
+import { parseRequestTarget } from "./target/httpRequest.target.js";
 /* -------------------------------------------------------------------------- */
 /* Constants                                                                  */
 /* -------------------------------------------------------------------------- */
@@ -98,7 +99,11 @@ export class HttpRequestContext {
     /* Query                                                                    */
     /* ------------------------------------------------------------------------ */
     get query() {
-        return Object.freeze(Object.fromEntries(this.queryMap));
+        const query = Object.create(null);
+        for (const [name, value] of this.queryMap) {
+            query[name] = value;
+        }
+        return Object.freeze(query);
     }
     hasQuery(name) {
         return this.queryMap.has(name);
@@ -326,24 +331,18 @@ export function isRequestContext(value) {
 /* -------------------------------------------------------------------------- */
 /* URL Helpers                                                                */
 /* -------------------------------------------------------------------------- */
+/**
+ * Returns the canonical path of a request-target. An origin-form target such
+ * as `//host/admin` stays a path; it is never parsed as an authority.
+ */
 export function getPathname(url) {
-    try {
-        const parsed = new URL(url, "http://zudojs.invalid");
-        return parsed.pathname || "/";
-    }
-    catch {
-        const pathname = url.split("?", 1)[0];
-        return pathname || "/";
-    }
+    return parseRequestTarget(url).pathname || "/";
 }
+/**
+ * Returns the search parameters of a request-target.
+ */
 export function getSearchParams(url) {
-    try {
-        return new URL(url, "http://zudojs.invalid").searchParams;
-    }
-    catch {
-        const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
-        return new URLSearchParams(query);
-    }
+    return parseRequestTarget(url).searchParams;
 }
 /* -------------------------------------------------------------------------- */
 /* Internal Helpers                                                           */

package/dist/httpRequest/index.d.ts

@@ -5,4 +5,5 @@
  */
 export * from "./http.request.js";
 export * from "./httpRequest.context.js";
+export * from "./target/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpRequest/index.js

@@ -5,4 +5,5 @@
  */
 export * from "./http.request.js";
 export * from "./httpRequest.context.js";
+export * from "./target/index.js";
 //# sourceMappingURL=index.js.map

package/dist/httpRequest/target/httpRequest.target.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Canonical request-target parsing.
+ *
+ * Every place that derives a path or query from `request.url` (the request
+ * context, the router, path-scoped middleware, static files) parses it here,
+ * so routing and middleware can never disagree about which path a request
+ * addresses.
+ *
+ * `new URL(target, base)` is the wrong tool for an origin-form target:
+ * `//evil/admin` is read as a scheme-relative URL with authority `evil`, so
+ * the path silently became `/admin` while `request.url` still said
+ * `//evil/admin`. Prefixing the base as a string keeps an origin-form target
+ * a path.
+ *
+ * @module httpRequest/target
+ */
+/**
+ * Parses a request-target (origin-form, absolute-form or `*`) into a URL.
+ *
+ * An origin-form target is never parsed as an authority. Unparseable input
+ * yields the root URL.
+ */
+export declare function parseRequestTarget(target: string): URL;
+/**
+ * Returns the canonical path of a request-target.
+ */
+export declare function getCanonicalPath(target: string): string;
+/**
+ * Explains why a request-target is refused, or returns `undefined` when it is
+ * acceptable.
+ *
+ * Refused: anything that is not origin-form, absolute-form (`http(s)://`) or
+ * the asterisk-form `*`; a backslash (WHATWG URL parsing treats it as a
+ * separator); and any `.` / `..` segment, plain or percent-encoded
+ * (`%2e%2e`). Those segments are resolved away by URL parsing, so a front
+ * proxy matching `/admin*` on the raw target and the router dispatching on
+ * the resolved path would otherwise disagree about the same request.
+ */
+export declare function findRequestTargetViolation(target: string): string | undefined;
+/**
+ * Whether a request-target is acceptable (see
+ * {@link findRequestTargetViolation}).
+ */
+export declare function isCanonicalRequestTarget(target: string): boolean;
+//# sourceMappingURL=httpRequest.target.d.ts.map

package/dist/httpRequest/target/httpRequest.target.js

@@ -0,0 +1,93 @@
+/**
+ * Canonical request-target parsing.
+ *
+ * Every place that derives a path or query from `request.url` (the request
+ * context, the router, path-scoped middleware, static files) parses it here,
+ * so routing and middleware can never disagree about which path a request
+ * addresses.
+ *
+ * `new URL(target, base)` is the wrong tool for an origin-form target:
+ * `//evil/admin` is read as a scheme-relative URL with authority `evil`, so
+ * the path silently became `/admin` while `request.url` still said
+ * `//evil/admin`. Prefixing the base as a string keeps an origin-form target
+ * a path.
+ *
+ * @module httpRequest/target
+ */
+const TARGET_BASE = "http://zudojs.invalid";
+const ABSOLUTE_FORM = /^https?:\/\//i;
+const ENCODED_DOT = /%2e/gi;
+/**
+ * Parses a request-target (origin-form, absolute-form or `*`) into a URL.
+ *
+ * An origin-form target is never parsed as an authority. Unparseable input
+ * yields the root URL.
+ */
+export function parseRequestTarget(target) {
+    try {
+        if (target.startsWith("/")) {
+            return new URL(`${TARGET_BASE}${target}`);
+        }
+        if (ABSOLUTE_FORM.test(target)) {
+            return new URL(target);
+        }
+        return new URL(`${TARGET_BASE}/${target === "*" ? "" : target}`);
+    }
+    catch {
+        return new URL(`${TARGET_BASE}/`);
+    }
+}
+/**
+ * Returns the canonical path of a request-target.
+ */
+export function getCanonicalPath(target) {
+    return parseRequestTarget(target).pathname || "/";
+}
+function rawPathOf(target) {
+    let path = target;
+    if (ABSOLUTE_FORM.test(path)) {
+        const afterScheme = path.indexOf("//") + 2;
+        const slash = path.indexOf("/", afterScheme);
+        path = slash === -1 ? "/" : path.slice(slash);
+    }
+    const end = path.search(/[?#]/);
+    return end === -1 ? path : path.slice(0, end);
+}
+/**
+ * Explains why a request-target is refused, or returns `undefined` when it is
+ * acceptable.
+ *
+ * Refused: anything that is not origin-form, absolute-form (`http(s)://`) or
+ * the asterisk-form `*`; a backslash (WHATWG URL parsing treats it as a
+ * separator); and any `.` / `..` segment, plain or percent-encoded
+ * (`%2e%2e`). Those segments are resolved away by URL parsing, so a front
+ * proxy matching `/admin*` on the raw target and the router dispatching on
+ * the resolved path would otherwise disagree about the same request.
+ */
+export function findRequestTargetViolation(target) {
+    if (target === "*") {
+        return undefined;
+    }
+    if (!target.startsWith("/") && !ABSOLUTE_FORM.test(target)) {
+        return "Request target is not in origin-form or absolute-form.";
+    }
+    const path = rawPathOf(target);
+    if (path.includes("\\")) {
+        return "Request target contains a backslash.";
+    }
+    for (const segment of path.split("/")) {
+        const decoded = segment.replace(ENCODED_DOT, ".");
+        if (decoded === "." || decoded === "..") {
+            return "Request target contains a dot segment.";
+        }
+    }
+    return undefined;
+}
+/**
+ * Whether a request-target is acceptable (see
+ * {@link findRequestTargetViolation}).
+ */
+export function isCanonicalRequestTarget(target) {
+    return findRequestTargetViolation(target) === undefined;
+}
+//# sourceMappingURL=httpRequest.target.js.map

package/dist/httpRequest/target/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @zudojs/http/httpRequest/target
+ *
+ * Canonical request-target parsing shared by the request context, router and
+ * path-scoped middleware, plus the dot-segment / non-origin-form check the
+ * Node adapter applies before a request is dispatched.
+ */
+export * from "./httpRequest.target.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpRequest/target/index.js

@@ -0,0 +1,9 @@
+/**
+ * @zudojs/http/httpRequest/target
+ *
+ * Canonical request-target parsing shared by the request context, router and
+ * path-scoped middleware, plus the dot-segment / non-origin-form check the
+ * Node adapter applies before a request is dispatched.
+ */
+export * from "./httpRequest.target.js";
+//# sourceMappingURL=index.js.map

package/dist/httpResponse/httpResponse.context.d.ts

@@ -29,6 +29,16 @@ export declare class HttpResponseContext {
     html(content: string): this;
     cookie(name: string, value: string, options?: ResponseCookie["options"]): this;
     removeCookie(name: string): this;
+    /**
+     * Redirects to `url`.
+     *
+     * The destination goes through `assertSafeRedirect`: a `javascript:` or
+     * `data:` URL, a scheme-relative `//evil.com`, or a value carrying a
+     * control character throws instead of being emitted as `Location`. An
+     * absolute `http(s)` URL and a same-origin path reference are accepted.
+     *
+     * @throws {TypeError} If the destination is not a safe redirect target.
+     */
     redirect(url: string, status?: number): this;
     markSent(): void;
     assertMutable(): void;