@zudojs/http 1.1.0 → 1.2.0

package/dist/httpMiddleware/builtin/image/httpMiddleware.image.js

@@ -5,23 +5,14 @@
  *
  * Requires: npm install sharp
  */
-import { applyHeadersToResponse } from "../helpers/index.js";
+import { applyCompressedBody, getResponseBytes, getResponseMediaType, loadOptionalModule, } from "../helpers/index.js";
 const DEFAULT_QUALITY = 80;
 const DEFAULT_FORMAT = "jpeg";
-async function getSharp() {
-    try {
-        const mod = await import("sharp");
-        return mod.default ?? mod;
-    }
-    catch {
-        throw new Error("Sharp is not installed. Run: npm install sharp");
-    }
-}
 export async function compressImage(buffer, options = {}) {
-    const sharpInstance = await getSharp();
+    const sharp = await loadOptionalModule("sharp", "npm install sharp");
     const quality = options.quality ?? DEFAULT_QUALITY;
     const format = options.format ?? DEFAULT_FORMAT;
-    let pipeline = sharpInstance(buffer);
+    let pipeline = sharp(buffer);
     if (options.width || options.height) {
         pipeline = pipeline.resize({
             width: options.width,
@@ -30,59 +21,46 @@ export async function compressImage(buffer, options = {}) {
             withoutEnlargement: true,
         });
     }
-    switch (format) {
-        case "jpeg":
-            return pipeline.jpeg({ quality }).toBuffer();
-        case "png":
-            return pipeline.png({ quality }).toBuffer();
-        case "webp":
-            return pipeline.webp({ quality }).toBuffer();
-        case "avif":
-            return pipeline.avif({ quality }).toBuffer();
-        default:
-            return pipeline.toBuffer();
+    return pipeline[format]({ quality }).toBuffer();
+}
+function capDimension(requested, max) {
+    if (max === undefined) {
+        return requested;
     }
+    return requested === undefined ? max : Math.min(requested, max);
 }
+/**
+ * Compresses `image/*` responses. Status, headers and body are read from the
+ * response returned by `next()`, and `maxWidth` / `maxHeight` cap every
+ * output.
+ */
 export function createImageCompressionMiddleware(options = {}) {
     const enabled = options.enabled ?? true;
-    const defaultQuality = options.defaultQuality ?? DEFAULT_QUALITY;
-    const defaultFormat = options.defaultFormat ?? DEFAULT_FORMAT;
     const contentTypeMap = options.contentTypeMap ?? {};
-    return async (context, next) => {
-        if (!enabled) {
-            return next();
-        }
+    return async (_context, next) => {
         const response = await next();
-        const contentType = context.response.headers["content-type"];
-        if (!contentType || !contentType.startsWith("image/")) {
+        const mediaType = getResponseMediaType(response);
+        if (!enabled || !mediaType?.startsWith("image/")) {
             return response;
         }
-        const body = context.response.body;
-        if (!Buffer.isBuffer(body) && typeof body !== "string") {
+        const buffer = getResponseBytes(response);
+        if (!buffer || buffer.length === 0) {
             return response;
         }
-        const buffer = Buffer.isBuffer(body) ? body : Buffer.from(body);
-        const compressionOptions = contentTypeMap[contentType] ?? {
-            quality: defaultQuality,
-            format: defaultFormat,
-        };
+        const mapped = contentTypeMap[mediaType] ?? {};
+        const format = mapped.format ?? options.defaultFormat ?? DEFAULT_FORMAT;
         try {
-            const compressed = await compressImage(buffer, compressionOptions);
-            const newContentType = compressionOptions.format === "jpeg"
-                ? "image/jpeg"
-                : compressionOptions.format === "png"
-                    ? "image/png"
-                    : compressionOptions.format === "webp"
-                        ? "image/webp"
-                        : compressionOptions.format === "avif"
-                            ? "image/avif"
-                            : contentType;
-            const headers = new Headers(response.headers);
-            headers.set("content-type", newContentType);
-            headers.set("cache-control", headers.get("cache-control") ?? "public, max-age=86400");
-            return applyHeadersToResponse(response, headers).setBody(compressed);
+            const compressed = await compressImage(buffer, {
+                ...mapped,
+                quality: mapped.quality ?? options.defaultQuality ?? DEFAULT_QUALITY,
+                format,
+                width: capDimension(mapped.width, options.maxWidth),
+                height: capDimension(mapped.height, options.maxHeight),
+            });
+            return applyCompressedBody(response, compressed, `image/${format}`);
         }
-        catch {
+        catch (error) {
+            options.onError?.(error, response);
             return response;
         }
     };

package/dist/httpMiddleware/builtin/index.d.ts

@@ -13,6 +13,7 @@ export * from "./helpers/index.js";
 export * from "./static/index.js";
 export * from "./image/index.js";
 export * from "./video/index.js";
+export * from "./rateLimit/index.js";
 /** State middleware — identity pass-through. */
 export declare function createStateMiddleware(): import("../httpMiddleware.type.js").HttpMiddleware;
 //# sourceMappingURL=index.d.ts.map

package/dist/httpMiddleware/builtin/index.js

@@ -13,6 +13,7 @@ export * from "./helpers/index.js";
 export * from "./static/index.js";
 export * from "./image/index.js";
 export * from "./video/index.js";
+export * from "./rateLimit/index.js";
 /** State middleware — identity pass-through. */
 export function createStateMiddleware() {
     return async (_context, next) => {

package/dist/httpMiddleware/builtin/rateLimit/httpMiddleware.rateLimit.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Rate limiting middleware built on `@zudojs/security`.
+ *
+ * AGENTS.md requires public endpoints to be rate limited with
+ * `createRateLimiter` from `@zudojs/security`, and `@zudojs/http` offered no
+ * way to do that. This wraps the shared limiter; it does not re-implement it.
+ *
+ * The client key is `request.remoteAddress`, which the Node adapter has
+ * already resolved through its `trustProxy` setting, so forwarded headers
+ * only count when the adapter trusts the peer that sent them.
+ *
+ * A request with no usable client address (a Unix-socket peer, a context
+ * built without `remoteAddress`, a destroyed socket) is counted in one
+ * shared bucket, {@link UNKNOWN_CLIENT_RATE_LIMIT_IP}. The `@zudojs/security`
+ * default key generator refuses such a request with a `ConfigurationError`,
+ * which would otherwise surface as a 500, and skipping the limiter for it
+ * would give it unlimited requests.
+ *
+ * @module httpMiddleware/builtin/rateLimit
+ */
+import { createRateLimiter, type RateLimiterOptions } from "@zudojs/security";
+import type { HttpMiddleware } from "../../httpMiddleware.type.js";
+/**
+ * The `ip` given to the limiter for a request whose `remoteAddress` is
+ * missing or is not an IP address. `0.0.0.0` is never a real peer address,
+ * so these requests share one bucket without colliding with a client.
+ */
+export declare const UNKNOWN_CLIENT_RATE_LIMIT_IP = "0.0.0.0";
+/**
+ * The limiter instance returned by `@zudojs/security`'s `createRateLimiter`.
+ */
+export type HttpRateLimiter = ReturnType<typeof createRateLimiter>;
+/**
+ * Options for {@link createRateLimitMiddleware}: either the
+ * `@zudojs/security` limiter options, or an existing `limiter` to share
+ * between routes.
+ */
+export type RateLimitMiddlewareOptions = RateLimiterOptions | {
+    readonly limiter: HttpRateLimiter;
+};
+/**
+ * Creates middleware that answers `429 Too Many Requests` (with
+ * `Retry-After`, from the `@zudojs/security` handler) once a client exceeds
+ * its allowance, and otherwise passes the request on.
+ */
+export declare function createRateLimitMiddleware(options: RateLimitMiddlewareOptions): HttpMiddleware;
+//# sourceMappingURL=httpMiddleware.rateLimit.d.ts.map

package/dist/httpMiddleware/builtin/rateLimit/httpMiddleware.rateLimit.js

@@ -0,0 +1,61 @@
+/**
+ * Rate limiting middleware built on `@zudojs/security`.
+ *
+ * AGENTS.md requires public endpoints to be rate limited with
+ * `createRateLimiter` from `@zudojs/security`, and `@zudojs/http` offered no
+ * way to do that. This wraps the shared limiter; it does not re-implement it.
+ *
+ * The client key is `request.remoteAddress`, which the Node adapter has
+ * already resolved through its `trustProxy` setting, so forwarded headers
+ * only count when the adapter trusts the peer that sent them.
+ *
+ * A request with no usable client address (a Unix-socket peer, a context
+ * built without `remoteAddress`, a destroyed socket) is counted in one
+ * shared bucket, {@link UNKNOWN_CLIENT_RATE_LIMIT_IP}. The `@zudojs/security`
+ * default key generator refuses such a request with a `ConfigurationError`,
+ * which would otherwise surface as a 500, and skipping the limiter for it
+ * would give it unlimited requests.
+ *
+ * @module httpMiddleware/builtin/rateLimit
+ */
+import { createRateLimiter, parseClientIp, } from "@zudojs/security";
+import { createResponseContext } from "../../../httpResponse/httpResponse.context.js";
+/**
+ * The `ip` given to the limiter for a request whose `remoteAddress` is
+ * missing or is not an IP address. `0.0.0.0` is never a real peer address,
+ * so these requests share one bucket without colliding with a client.
+ */
+export const UNKNOWN_CLIENT_RATE_LIMIT_IP = "0.0.0.0";
+/**
+ * Creates middleware that answers `429 Too Many Requests` (with
+ * `Retry-After`, from the `@zudojs/security` handler) once a client exceeds
+ * its allowance, and otherwise passes the request on.
+ */
+export function createRateLimitMiddleware(options) {
+    const limiter = "limiter" in options ? options.limiter : createRateLimiter(options);
+    return async (context, next) => {
+        const request = context.request;
+        const limitRequest = {
+            ip: clientIpOf(request.remoteAddress),
+            method: request.method,
+            path: request.path,
+            headers: request.headers,
+        };
+        const rejection = { statusCode: 429, headers: {} };
+        if (limiter.middleware(limitRequest, rejection).allowed) {
+            return next();
+        }
+        const response = createResponseContext().setStatus(rejection.statusCode);
+        for (const [name, value] of Object.entries(rejection.headers)) {
+            response.setHeader(name.toLowerCase(), value);
+        }
+        return response.setBody(rejection.body ?? "Too Many Requests");
+    };
+}
+function clientIpOf(remoteAddress) {
+    return typeof remoteAddress === "string" &&
+        parseClientIp(remoteAddress) !== undefined
+        ? remoteAddress
+        : UNKNOWN_CLIENT_RATE_LIMIT_IP;
+}
+//# sourceMappingURL=httpMiddleware.rateLimit.js.map

package/dist/httpMiddleware/builtin/rateLimit/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @zudojs/http/httpMiddleware/builtin/rateLimit
+ *
+ * Rate limiting middleware wrapping `@zudojs/security`'s `createRateLimiter`.
+ */
+export { createRateLimitMiddleware, UNKNOWN_CLIENT_RATE_LIMIT_IP, type HttpRateLimiter, type RateLimitMiddlewareOptions, } from "./httpMiddleware.rateLimit.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpMiddleware/builtin/rateLimit/index.js

@@ -0,0 +1,7 @@
+/**
+ * @zudojs/http/httpMiddleware/builtin/rateLimit
+ *
+ * Rate limiting middleware wrapping `@zudojs/security`'s `createRateLimiter`.
+ */
+export { createRateLimitMiddleware, UNKNOWN_CLIENT_RATE_LIMIT_IP, } from "./httpMiddleware.rateLimit.js";
+//# sourceMappingURL=index.js.map

package/dist/httpMiddleware/builtin/static/httpMiddleware.static.js

@@ -7,6 +7,8 @@ import { readFile, stat } from "node:fs/promises";
 import { createHash } from "node:crypto";
 import { extname, join, resolve, sep } from "node:path";
 import { applyHeadersToResponse } from "../helpers/index.js";
+import { parseRequestTarget } from "../../../httpRequest/target/httpRequest.target.js";
+import { evaluateConditionalRequest } from "../../../httpConditional/httpConditional.core.js";
 const DEFAULT_INDEX = "index.html";
 const DEFAULT_MAX_AGE = 3600;
 const DEFAULT_MAX_FILE_SIZE = 10 * 1024 * 1024;
@@ -141,7 +143,7 @@ export function createStaticMiddleware(options) {
          */
         let url;
         try {
-            url = new URL(context.request.url, "http://zudojs.invalid");
+            url = parseRequestTarget(context.request.url);
         }
         catch {
             return next();
@@ -200,9 +202,21 @@ export function createStaticMiddleware(options) {
          * returns the whole body and has no 206 path, so advertising range
          * support makes range-aware clients misbehave.
          */
-        const ifNoneMatch = context.request.headers["if-none-match"];
-        if (ifNoneMatch === etag) {
-            return applyHeadersToResponse(context.response, responseHeaders).setStatus(304);
+        /*
+         * RFC 9110 section 13.2.2 evaluation: `If-None-Match` lists, weak tags
+         * and `*`, then `If-Modified-Since`, plus `If-Match` /
+         * `If-Unmodified-Since` (412). An exact string compare missed all of
+         * those and re-sent the whole file.
+         */
+        const headers = context.request.headers;
+        const conditional = evaluateConditionalRequest(context.request.method, {
+            ifMatch: headers["if-match"],
+            ifNoneMatch: headers["if-none-match"],
+            ifModifiedSince: headers["if-modified-since"],
+            ifUnmodifiedSince: headers["if-unmodified-since"],
+        }, { etag, lastModified });
+        if (conditional.statusCode !== undefined) {
+            return applyHeadersToResponse(context.response, responseHeaders).setStatus(conditional.statusCode);
         }
         return applyHeadersToResponse(context.response, responseHeaders).setBody(fileData);
     };

package/dist/httpMiddleware/builtin/video/httpMiddleware.video.d.ts

@@ -3,14 +3,17 @@
  *
  * @module httpMiddleware/builtin/video
  *
- * Requires: npm install fluent-ffmpeg
+ * Requires: npm install fluent-ffmpeg (and an ffmpeg binary)
  */
 import type { HttpMiddleware } from "../../httpMiddleware.type.js";
+import { type MediaCompressionErrorHandler } from "../helpers/index.js";
 export interface VideoCompressionOptions {
     readonly bitrate?: string;
     readonly preset?: "ultrafast" | "superfast" | "veryfast" | "faster" | "fast" | "medium" | "slow" | "slower" | "veryslow";
     readonly crf?: number;
     readonly format?: "mp4" | "webm" | "mov";
+    /** Input container; defaults to `mp4`. */
+    readonly inputFormat?: string;
     readonly scale?: {
         readonly width?: number;
         readonly height?: number;
@@ -20,7 +23,22 @@ export interface VideoCompressionMiddlewareOptions {
     readonly enabled?: boolean;
     readonly contentTypeMap?: Record<string, VideoCompressionOptions>;
     readonly tempDir?: string;
+    /**
+     * Called when compression fails. The original response is still served.
+     */
+    readonly onError?: MediaCompressionErrorHandler;
 }
+/**
+ * Transcodes a video held in memory.
+ *
+ * `fluent-ffmpeg`'s export is a factory: `input()` exists only on the
+ * command it returns. Calling it on the module (as this did) threw
+ * `ffmpegInstance.input is not a function` on every call.
+ */
 export declare function compressVideo(inputBuffer: Buffer, options?: VideoCompressionOptions): Promise<Buffer>;
+/**
+ * Compresses `video/*` responses, reading status, headers and body from the
+ * response returned by `next()`.
+ */
 export declare function createVideoCompressionMiddleware(options?: VideoCompressionMiddlewareOptions): HttpMiddleware;
 //# sourceMappingURL=httpMiddleware.video.d.ts.map

package/dist/httpMiddleware/builtin/video/httpMiddleware.video.js

@@ -3,79 +3,58 @@
  *
  * @module httpMiddleware/builtin/video
  *
- * Requires: npm install fluent-ffmpeg
+ * Requires: npm install fluent-ffmpeg (and an ffmpeg binary)
+ */
+import { Readable } from "node:stream";
+import { applyCompressedBody, getResponseBytes, getResponseMediaType, loadOptionalModule, } from "../helpers/index.js";
+import { CONTAINER_TYPES, DEFAULT_VIDEO_FORMAT as DEFAULT_FORMAT, buildOutputOptions, } from "./httpMiddleware.video.options.js";
+/**
+ * Transcodes a video held in memory.
+ *
+ * `fluent-ffmpeg`'s export is a factory: `input()` exists only on the
+ * command it returns. Calling it on the module (as this did) threw
+ * `ffmpegInstance.input is not a function` on every call.
  */
-import { applyHeadersToResponse } from "../helpers/index.js";
-const DEFAULT_CRF = 28;
-const DEFAULT_PRESET = "medium";
-const DEFAULT_FORMAT = "mp4";
-async function getFfmpeg() {
-    try {
-        const mod = await import("fluent-ffmpeg");
-        return mod.default ?? mod;
-    }
-    catch {
-        throw new Error("fluent-ffmpeg is not installed. Run: npm install fluent-ffmpeg");
-    }
-}
 export async function compressVideo(inputBuffer, options = {}) {
-    const ffmpegInstance = await getFfmpeg();
-    const crf = options.crf ?? DEFAULT_CRF;
-    const preset = options.preset ?? DEFAULT_PRESET;
-    const format = options.format ?? DEFAULT_FORMAT;
+    const ffmpeg = await loadOptionalModule("fluent-ffmpeg", "npm install fluent-ffmpeg");
     return new Promise((resolve, reject) => {
-        const outputBuffer = [];
-        ffmpegInstance
-            .input(inputBuffer)
-            .inputFormat("mp4")
-            .outputOptions([
-            `-crf ${crf}`,
-            `-preset ${preset}`,
-            "-movflags +faststart",
-        ])
-            .format(format)
-            .on("end", () => {
-            resolve(Buffer.concat(outputBuffer));
-        })
-            .on("error", (err) => {
-            reject(err);
-        })
-            .pipe((err, stdout) => {
-            if (err) {
-                reject(err);
-                return;
-            }
-            stdout.on("data", (chunk) => {
-                outputBuffer.push(chunk);
-            });
-        });
+        const chunks = [];
+        const output = ffmpeg()
+            .input(Readable.from([inputBuffer]))
+            .inputFormat(options.inputFormat ?? "mp4")
+            .outputOptions(buildOutputOptions(options))
+            .format(options.format ?? DEFAULT_FORMAT)
+            .on("error", reject)
+            .pipe();
+        output.on("data", (chunk) => chunks.push(chunk));
+        output.on("end", () => resolve(Buffer.concat(chunks)));
+        output.on("error", reject);
     });
 }
+/**
+ * Compresses `video/*` responses, reading status, headers and body from the
+ * response returned by `next()`.
+ */
 export function createVideoCompressionMiddleware(options = {}) {
     const enabled = options.enabled ?? true;
-    return async (context, next) => {
-        if (!enabled) {
-            return next();
-        }
+    return async (_context, next) => {
         const response = await next();
-        const contentType = context.response.headers["content-type"];
-        if (!contentType || !contentType.startsWith("video/")) {
+        const mediaType = getResponseMediaType(response);
+        if (!enabled || !mediaType?.startsWith("video/")) {
             return response;
         }
-        const body = context.response.body;
-        if (!Buffer.isBuffer(body)) {
+        const body = getResponseBytes(response);
+        if (!body || body.length === 0) {
             return response;
         }
-        const compressionOptions = options.contentTypeMap?.[contentType] ?? {};
+        const compression = options.contentTypeMap?.[mediaType] ?? {};
+        const format = compression.format ?? DEFAULT_FORMAT;
         try {
-            const compressed = await compressVideo(body, compressionOptions);
-            const newContentType = "video/mp4";
-            const headers = new Headers(response.headers);
-            headers.set("content-type", newContentType);
-            headers.set("cache-control", headers.get("cache-control") ?? "public, max-age=86400");
-            return applyHeadersToResponse(response, headers).setBody(compressed);
+            const compressed = await compressVideo(body, compression);
+            return applyCompressedBody(response, compressed, CONTAINER_TYPES[format] ?? "video/mp4");
         }
-        catch {
+        catch (error) {
+            options.onError?.(error, response);
             return response;
         }
     };

package/dist/httpMiddleware/builtin/video/httpMiddleware.video.options.d.ts

@@ -0,0 +1,12 @@
+/**
+ * FFmpeg argument building for the video compression middleware.
+ *
+ * @module httpMiddleware/builtin/video/options
+ */
+import type { VideoCompressionOptions } from "./httpMiddleware.video.js";
+export declare const DEFAULT_VIDEO_FORMAT = "mp4";
+/** Media type per output container. */
+export declare const CONTAINER_TYPES: Readonly<Record<string, string>>;
+/** Builds the ffmpeg output options for a compression request. */
+export declare function buildOutputOptions(options: VideoCompressionOptions): string[];
+//# sourceMappingURL=httpMiddleware.video.options.d.ts.map

package/dist/httpMiddleware/builtin/video/httpMiddleware.video.options.js

@@ -0,0 +1,31 @@
+/**
+ * FFmpeg argument building for the video compression middleware.
+ *
+ * @module httpMiddleware/builtin/video/options
+ */
+const DEFAULT_CRF = 28;
+const DEFAULT_PRESET = "medium";
+export const DEFAULT_VIDEO_FORMAT = "mp4";
+/** Media type per output container. */
+export const CONTAINER_TYPES = Object.freeze({
+    mp4: "video/mp4",
+    webm: "video/webm",
+    mov: "video/quicktime",
+});
+/** Builds the ffmpeg output options for a compression request. */
+export function buildOutputOptions(options) {
+    const output = [
+        `-crf ${options.crf ?? DEFAULT_CRF}`,
+        `-preset ${options.preset ?? DEFAULT_PRESET}`,
+        /* A pipe is not seekable, so the moov atom must be fragmented. */
+        "-movflags frag_keyframe+empty_moov",
+    ];
+    if (options.bitrate) {
+        output.push(`-b:v ${options.bitrate}`);
+    }
+    if (options.scale?.width || options.scale?.height) {
+        output.push(`-vf scale=${options.scale.width ?? -2}:${options.scale.height ?? -2}`);
+    }
+    return output;
+}
+//# sourceMappingURL=httpMiddleware.video.options.js.map

package/dist/httpMiddleware/httpMiddleware.error.d.ts

@@ -1,38 +1,12 @@
 /**
  * HTTP middleware error types.
  *
- * Extends the shared MiddlewareError from @zudojs/errors with
- * HTTP-specific middleware error information.
+ * `HttpMiddlewareError` and `HttpMiddlewarePipelineError` live in
+ * `@zudojs/errors` (both `BaseError`s, 500, not exposed, codes
+ * `HTTP_MIDDLEWARE_ERROR` / `MIDDLEWARE_PIPELINE_ERROR`); they are
+ * re-exported here so existing imports keep working.
  *
  * @module httpMiddleware/errors
  */
-import { BaseError } from "@zudojs/errors";
-/**
- * Error raised by an HTTP middleware function.
- */
-export declare class HttpMiddlewareError extends BaseError {
-    /**
-     * The unique identifier of the middleware.
-     */
-    readonly middlewareId: string | undefined;
-    /**
-     * The name of the middleware.
-     */
-    readonly middlewareName: string | undefined;
-    constructor(message: string, options?: {
-        readonly middlewareId?: string;
-        readonly middlewareName?: string;
-        readonly cause?: unknown;
-    });
-}
-/**
- * Error raised when the HTTP middleware pipeline fails.
- */
-export declare class HttpMiddlewarePipelineError extends BaseError {
-    /**
-     * The errors that occurred during pipeline execution.
-     */
-    readonly errors: readonly HttpMiddlewareError[];
-    constructor(errors: readonly HttpMiddlewareError[]);
-}
+export { HttpMiddlewareError, HttpMiddlewarePipelineError, type HttpMiddlewareErrorOptions, } from "@zudojs/errors";
 //# sourceMappingURL=httpMiddleware.error.d.ts.map

package/dist/httpMiddleware/httpMiddleware.error.js

@@ -1,60 +1,12 @@
 /**
  * HTTP middleware error types.
  *
- * Extends the shared MiddlewareError from @zudojs/errors with
- * HTTP-specific middleware error information.
+ * `HttpMiddlewareError` and `HttpMiddlewarePipelineError` live in
+ * `@zudojs/errors` (both `BaseError`s, 500, not exposed, codes
+ * `HTTP_MIDDLEWARE_ERROR` / `MIDDLEWARE_PIPELINE_ERROR`); they are
+ * re-exported here so existing imports keep working.
  *
  * @module httpMiddleware/errors
  */
-import { BaseError } from "@zudojs/errors";
-/* -------------------------------------------------------------------------- */
-/* Errors                                                                     */
-/* -------------------------------------------------------------------------- */
-/**
- * Error raised by an HTTP middleware function.
- */
-export class HttpMiddlewareError extends BaseError {
-    /**
-     * The unique identifier of the middleware.
-     */
-    middlewareId;
-    /**
-     * The name of the middleware.
-     */
-    middlewareName;
-    constructor(message, options = {}) {
-        super(message, {
-            code: "HTTP_MIDDLEWARE_ERROR",
-            statusCode: 500,
-            expose: false,
-            cause: options.cause,
-        });
-        this.name = "HttpMiddlewareError";
-        this.middlewareId = options.middlewareId;
-        this.middlewareName = options.middlewareName;
-    }
-}
-/**
- * Error raised when the HTTP middleware pipeline fails.
- */
-export class HttpMiddlewarePipelineError extends BaseError {
-    /**
-     * The errors that occurred during pipeline execution.
-     */
-    errors;
-    constructor(errors) {
-        const message = errors.length === 1
-            ? `HTTP middleware pipeline failed: ${errors[0]?.message ?? "Unknown error"}`
-            : `HTTP middleware pipeline failed with ${errors.length} errors: ${errors
-                .map((e) => e.message)
-                .join(", ")}`;
-        super(message, {
-            code: "MIDDLEWARE_PIPELINE_ERROR",
-            statusCode: 500,
-            expose: false,
-        });
-        this.name = "HttpMiddlewarePipelineError";
-        this.errors = Object.freeze([...errors]);
-    }
-}
+export { HttpMiddlewareError, HttpMiddlewarePipelineError, } from "@zudojs/errors";
 //# sourceMappingURL=httpMiddleware.error.js.map

package/dist/httpProxy/http.proxy.d.ts

@@ -128,6 +128,13 @@ export declare function assertSafeProxyTarget(target: string | URL, options?: Pr
 export declare function assertSafeProxyRedirect(location: string | URL, currentURL: string | URL, options?: ProxySecurityOptions): URL;
 export declare function resolveProxyTarget(target: string | URL, options?: ProxySecurityOptions): ProxyTarget;
 export declare function isValidProxyTarget(target: string | URL | undefined | null): boolean;
+/**
+ * Joins a request path onto a proxy base path.
+ *
+ * @throws {HttpError} 400 when `requestPath` contains a `.` / `..` segment
+ *   (plain or percent-encoded), which an upstream would resolve outside
+ *   `basePath`.
+ */
 export declare function joinProxyPath(basePath: string, requestPath: string): string;
 export declare function rewriteProxyPath(path: string, options?: ProxyRewriteOptions): string;
 export declare function normalizeProxyPath(path: string): string;

package/dist/httpProxy/http.proxy.js

@@ -11,6 +11,7 @@ import { appendHeader, deleteHeader, getHeader, setHeader, } from "../httpProtoc
 import { isValidHTTPURL, isValidHeaderValue } from "../httpValidation/index.js";
 import { isLinkLocalAddress, isLoopbackAddress, isUniqueLocalAddress, parseIpAddress, } from "../httpTrustProxy/httpTrustProxy.ip.js";
 import { assertSafeHeaderValue } from "../httpHeaders/security/index.js";
+import { assertProxyPathContained } from "./httpProxy.pathGuard.js";
 /* -------------------------------------------------------------------------- */
 /* Target                                                                     */
 /* -------------------------------------------------------------------------- */
@@ -204,7 +205,15 @@ function parseProxyURL(target) {
 /* -------------------------------------------------------------------------- */
 /* Path Handling                                                              */
 /* -------------------------------------------------------------------------- */
+/**
+ * Joins a request path onto a proxy base path.
+ *
+ * @throws {HttpError} 400 when `requestPath` contains a `.` / `..` segment
+ *   (plain or percent-encoded), which an upstream would resolve outside
+ *   `basePath`.
+ */
 export function joinProxyPath(basePath, requestPath) {
+    assertProxyPathContained(requestPath);
     const base = normalizeProxyPath(basePath);
     const request = requestPath.startsWith("/") ? requestPath : `/${requestPath}`;
     if (base === "/") {