@zudojs/http 1.0.0 → 1.2.0

package/dist/httpTrustProxy/httpTrustProxy.compilation.js

@@ -88,10 +88,13 @@ function buildListPredicate(trustProxy) {
  * - `"loopback"`, `"linklocal"`, `"uniquelocal"` / `"private"` — named ranges.
  * - an IP address, a CIDR range, a comma-separated list of either, or an array
  *   of the same.
+ * - a hop count `n`: trust the `n` hops nearest the server (the socket peer
+ *   is hop `0`), as Express/`proxy-addr` do. `0` trusts nothing.
  * - a custom predicate `(address, hopIndexFromPeer) => boolean`.
  *
- * Throws `TypeError` on a string that is none of the above rather than
- * returning a predicate that can never match.
+ * Throws `TypeError` on a string that is none of the above, or on a hop
+ * count that is not a non-negative integer, rather than returning a
+ * predicate that can never match.
  */
 export function compileTrustProxy(trustProxy) {
     if (typeof trustProxy === "function") {
@@ -100,6 +103,9 @@ export function compileTrustProxy(trustProxy) {
     if (trustProxy === true) {
         return () => true;
     }
+    if (typeof trustProxy === "number") {
+        return compileHopCount(trustProxy);
+    }
     /* Anything that is not a string or a list (including `false`, `undefined`
      * and any malformed runtime value) trusts nothing. */
     if (typeof trustProxy !== "string" && !Array.isArray(trustProxy)) {
@@ -116,4 +122,15 @@ export function compileTrustProxy(trustProxy) {
     compilationCache.set(trustProxy, predicate);
     return predicate;
 }
+/**
+ * Hop-count trust. The numeric form was typed and documented ("trust N
+ * proxies") but fell through to "trust nothing", so behind a load balancer
+ * every client shared the balancer's address.
+ */
+function compileHopCount(hops) {
+    if (!Number.isSafeInteger(hops) || hops < 0) {
+        throw new TypeError(`trustProxy hop count must be a non-negative integer, got ${hops}.`);
+    }
+    return (_address, index) => index < hops;
+}
 //# sourceMappingURL=httpTrustProxy.compilation.js.map

package/dist/httpTrustProxy/httpTrustProxy.type.d.ts

@@ -3,7 +3,9 @@
  *
  * @module httpTrustProxy/types
  */
-export type TrustProxy = boolean | "all" | "linklocal" | "loopback" | string | readonly string[] | ((value: string, index: number) => boolean);
+export type TrustProxy = boolean
+/** Hop count: trust the `n` hops nearest the server (the peer is hop 0). */
+ | number | "all" | "linklocal" | "loopback" | string | readonly string[] | ((value: string, index: number) => boolean);
 export interface TrustProxyOptions {
     readonly trustProxy?: TrustProxy;
     readonly maxDepth?: number;

package/dist/index.js

@@ -7,7 +7,6 @@
  * TypeScript reports TS2308 (ambiguous re-exports) for these duplicates.
  * This is intentional — consumers can import from either path.
  */
-/* eslint-disable @typescript-eslint/no-explicit-any */
 export * from "./httpProtocol/index.js";
 export * from "./httpTypes/index.js";
 export * from "./httpConstants/index.js";

package/package.json

@@ -1,8 +1,12 @@
 {
   "name": "@zudojs/http",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "HTTP primitives, request handling, routing, middleware, and server infrastructure for Zudojs applications.",
   "license": "MIT",
+  "author": {
+    "name": "Oluwayemi Oyinlola",
+    "url": "https://github.com/oyinlola-tech"
+  },
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -20,10 +24,10 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/core": "1.0.0",
-    "@zudojs/errors": "1.0.0",
-    "@zudojs/logger": "1.0.0",
-    "@zudojs/security": "1.0.0"
+    "@zudojs/crypto": "1.2.0",
+    "@zudojs/errors": "1.1.0",
+    "@zudojs/logger": "1.2.0",
+    "@zudojs/security": "1.1.0"
   },
   "devDependencies": {
     "@types/node": "^26.4.1",