@zudojs/http 1.1.0 → 1.2.0

package/dist/httpProxy/httpProxy.pathGuard.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Proxy request-path containment.
+ *
+ * A gateway mounts an upstream under `target.pathname` (for example
+ * `/public-api`) to expose only that subtree. The path builders used to
+ * concatenate the client's path onto the base and collapse `//` only, so
+ * `/../admin/keys` or `/%2e%2e/admin/keys` was forwarded as
+ * `/public-api/../admin/keys`, which the upstream resolves to `/admin/keys`.
+ *
+ * @module httpProxy/pathGuard
+ */
+/**
+ * Whether a request path contains a `.` / `..` segment once percent-encoded
+ * dots and separators (`%2e`, `%2f`, `%5c`) and backslashes are taken into
+ * account, i.e. whether an upstream might resolve it outside its base.
+ */
+export declare function hasProxyDotSegment(path: string): boolean;
+/**
+ * Throws a `400 Bad Request` `HttpError` when the client-supplied path could
+ * escape the proxy target's base path.
+ */
+export declare function assertProxyPathContained(path: string): void;
+//# sourceMappingURL=httpProxy.pathGuard.d.ts.map

package/dist/httpProxy/httpProxy.pathGuard.js

@@ -0,0 +1,43 @@
+/**
+ * Proxy request-path containment.
+ *
+ * A gateway mounts an upstream under `target.pathname` (for example
+ * `/public-api`) to expose only that subtree. The path builders used to
+ * concatenate the client's path onto the base and collapse `//` only, so
+ * `/../admin/keys` or `/%2e%2e/admin/keys` was forwarded as
+ * `/public-api/../admin/keys`, which the upstream resolves to `/admin/keys`.
+ *
+ * @module httpProxy/pathGuard
+ */
+import { badRequest } from "../httpErrors/factories/httpError.clientError.js";
+const ENCODED_SEPARATORS = /%2e|%2f|%5c/gi;
+function decodeSeparator(match) {
+    const code = match.toLowerCase();
+    if (code === "%2e") {
+        return ".";
+    }
+    return code === "%2f" ? "/" : "\\";
+}
+/**
+ * Whether a request path contains a `.` / `..` segment once percent-encoded
+ * dots and separators (`%2e`, `%2f`, `%5c`) and backslashes are taken into
+ * account, i.e. whether an upstream might resolve it outside its base.
+ */
+export function hasProxyDotSegment(path) {
+    const end = path.search(/[?#]/);
+    const pathOnly = end === -1 ? path : path.slice(0, end);
+    const decoded = pathOnly.replace(ENCODED_SEPARATORS, decodeSeparator);
+    return decoded
+        .split(/[\\/]/)
+        .some((segment) => segment === "." || segment === "..");
+}
+/**
+ * Throws a `400 Bad Request` `HttpError` when the client-supplied path could
+ * escape the proxy target's base path.
+ */
+export function assertProxyPathContained(path) {
+    if (hasProxyDotSegment(path)) {
+        throw badRequest("Proxy request path contains a dot segment.");
+    }
+}
+//# sourceMappingURL=httpProxy.pathGuard.js.map

package/dist/httpProxy/index.d.ts

@@ -5,4 +5,5 @@
  * and proxy request helpers.
  */
 export * from "./http.proxy.js";
+export * from "./httpProxy.pathGuard.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpProxy/index.js

@@ -5,4 +5,5 @@
  * and proxy request helpers.
  */
 export * from "./http.proxy.js";
+export * from "./httpProxy.pathGuard.js";
 //# sourceMappingURL=index.js.map

package/dist/httpRequest/httpRequest.context.d.ts

@@ -117,6 +117,13 @@ export declare function runWithRequestContext<T>(context: HttpRequestContext, ca
 export declare function getCurrentRequestContext(): HttpRequestContext | undefined;
 export declare function assertRequestContext(context: HttpRequestContext | undefined | null): asserts context is HttpRequestContext;
 export declare function isRequestContext(value: unknown): value is HttpRequestContext;
+/**
+ * Returns the canonical path of a request-target. An origin-form target such
+ * as `//host/admin` stays a path; it is never parsed as an authority.
+ */
 export declare function getPathname(url: string): string;
+/**
+ * Returns the search parameters of a request-target.
+ */
 export declare function getSearchParams(url: string): URLSearchParams;
 //# sourceMappingURL=httpRequest.context.d.ts.map

package/dist/httpRequest/httpRequest.context.js

@@ -7,6 +7,7 @@
  * The context is intentionally framework-agnostic so adapters can populate it
  * from Node.js, Bun, Deno, or another HTTP runtime.
  */
+import { parseRequestTarget } from "./target/httpRequest.target.js";
 /* -------------------------------------------------------------------------- */
 /* Constants                                                                  */
 /* -------------------------------------------------------------------------- */
@@ -98,7 +99,11 @@ export class HttpRequestContext {
     /* Query                                                                    */
     /* ------------------------------------------------------------------------ */
     get query() {
-        return Object.freeze(Object.fromEntries(this.queryMap));
+        const query = Object.create(null);
+        for (const [name, value] of this.queryMap) {
+            query[name] = value;
+        }
+        return Object.freeze(query);
     }
     hasQuery(name) {
         return this.queryMap.has(name);
@@ -326,24 +331,18 @@ export function isRequestContext(value) {
 /* -------------------------------------------------------------------------- */
 /* URL Helpers                                                                */
 /* -------------------------------------------------------------------------- */
+/**
+ * Returns the canonical path of a request-target. An origin-form target such
+ * as `//host/admin` stays a path; it is never parsed as an authority.
+ */
 export function getPathname(url) {
-    try {
-        const parsed = new URL(url, "http://zudojs.invalid");
-        return parsed.pathname || "/";
-    }
-    catch {
-        const pathname = url.split("?", 1)[0];
-        return pathname || "/";
-    }
+    return parseRequestTarget(url).pathname || "/";
 }
+/**
+ * Returns the search parameters of a request-target.
+ */
 export function getSearchParams(url) {
-    try {
-        return new URL(url, "http://zudojs.invalid").searchParams;
-    }
-    catch {
-        const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
-        return new URLSearchParams(query);
-    }
+    return parseRequestTarget(url).searchParams;
 }
 /* -------------------------------------------------------------------------- */
 /* Internal Helpers                                                           */

package/dist/httpRequest/index.d.ts

@@ -5,4 +5,5 @@
  */
 export * from "./http.request.js";
 export * from "./httpRequest.context.js";
+export * from "./target/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpRequest/index.js

@@ -5,4 +5,5 @@
  */
 export * from "./http.request.js";
 export * from "./httpRequest.context.js";
+export * from "./target/index.js";
 //# sourceMappingURL=index.js.map

package/dist/httpRequest/target/httpRequest.target.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Canonical request-target parsing.
+ *
+ * Every place that derives a path or query from `request.url` (the request
+ * context, the router, path-scoped middleware, static files) parses it here,
+ * so routing and middleware can never disagree about which path a request
+ * addresses.
+ *
+ * `new URL(target, base)` is the wrong tool for an origin-form target:
+ * `//evil/admin` is read as a scheme-relative URL with authority `evil`, so
+ * the path silently became `/admin` while `request.url` still said
+ * `//evil/admin`. Prefixing the base as a string keeps an origin-form target
+ * a path.
+ *
+ * @module httpRequest/target
+ */
+/**
+ * Parses a request-target (origin-form, absolute-form or `*`) into a URL.
+ *
+ * An origin-form target is never parsed as an authority. Unparseable input
+ * yields the root URL.
+ */
+export declare function parseRequestTarget(target: string): URL;
+/**
+ * Returns the canonical path of a request-target.
+ */
+export declare function getCanonicalPath(target: string): string;
+/**
+ * Explains why a request-target is refused, or returns `undefined` when it is
+ * acceptable.
+ *
+ * Refused: anything that is not origin-form, absolute-form (`http(s)://`) or
+ * the asterisk-form `*`; a backslash (WHATWG URL parsing treats it as a
+ * separator); and any `.` / `..` segment, plain or percent-encoded
+ * (`%2e%2e`). Those segments are resolved away by URL parsing, so a front
+ * proxy matching `/admin*` on the raw target and the router dispatching on
+ * the resolved path would otherwise disagree about the same request.
+ */
+export declare function findRequestTargetViolation(target: string): string | undefined;
+/**
+ * Whether a request-target is acceptable (see
+ * {@link findRequestTargetViolation}).
+ */
+export declare function isCanonicalRequestTarget(target: string): boolean;
+//# sourceMappingURL=httpRequest.target.d.ts.map

package/dist/httpRequest/target/httpRequest.target.js

@@ -0,0 +1,93 @@
+/**
+ * Canonical request-target parsing.
+ *
+ * Every place that derives a path or query from `request.url` (the request
+ * context, the router, path-scoped middleware, static files) parses it here,
+ * so routing and middleware can never disagree about which path a request
+ * addresses.
+ *
+ * `new URL(target, base)` is the wrong tool for an origin-form target:
+ * `//evil/admin` is read as a scheme-relative URL with authority `evil`, so
+ * the path silently became `/admin` while `request.url` still said
+ * `//evil/admin`. Prefixing the base as a string keeps an origin-form target
+ * a path.
+ *
+ * @module httpRequest/target
+ */
+const TARGET_BASE = "http://zudojs.invalid";
+const ABSOLUTE_FORM = /^https?:\/\//i;
+const ENCODED_DOT = /%2e/gi;
+/**
+ * Parses a request-target (origin-form, absolute-form or `*`) into a URL.
+ *
+ * An origin-form target is never parsed as an authority. Unparseable input
+ * yields the root URL.
+ */
+export function parseRequestTarget(target) {
+    try {
+        if (target.startsWith("/")) {
+            return new URL(`${TARGET_BASE}${target}`);
+        }
+        if (ABSOLUTE_FORM.test(target)) {
+            return new URL(target);
+        }
+        return new URL(`${TARGET_BASE}/${target === "*" ? "" : target}`);
+    }
+    catch {
+        return new URL(`${TARGET_BASE}/`);
+    }
+}
+/**
+ * Returns the canonical path of a request-target.
+ */
+export function getCanonicalPath(target) {
+    return parseRequestTarget(target).pathname || "/";
+}
+function rawPathOf(target) {
+    let path = target;
+    if (ABSOLUTE_FORM.test(path)) {
+        const afterScheme = path.indexOf("//") + 2;
+        const slash = path.indexOf("/", afterScheme);
+        path = slash === -1 ? "/" : path.slice(slash);
+    }
+    const end = path.search(/[?#]/);
+    return end === -1 ? path : path.slice(0, end);
+}
+/**
+ * Explains why a request-target is refused, or returns `undefined` when it is
+ * acceptable.
+ *
+ * Refused: anything that is not origin-form, absolute-form (`http(s)://`) or
+ * the asterisk-form `*`; a backslash (WHATWG URL parsing treats it as a
+ * separator); and any `.` / `..` segment, plain or percent-encoded
+ * (`%2e%2e`). Those segments are resolved away by URL parsing, so a front
+ * proxy matching `/admin*` on the raw target and the router dispatching on
+ * the resolved path would otherwise disagree about the same request.
+ */
+export function findRequestTargetViolation(target) {
+    if (target === "*") {
+        return undefined;
+    }
+    if (!target.startsWith("/") && !ABSOLUTE_FORM.test(target)) {
+        return "Request target is not in origin-form or absolute-form.";
+    }
+    const path = rawPathOf(target);
+    if (path.includes("\\")) {
+        return "Request target contains a backslash.";
+    }
+    for (const segment of path.split("/")) {
+        const decoded = segment.replace(ENCODED_DOT, ".");
+        if (decoded === "." || decoded === "..") {
+            return "Request target contains a dot segment.";
+        }
+    }
+    return undefined;
+}
+/**
+ * Whether a request-target is acceptable (see
+ * {@link findRequestTargetViolation}).
+ */
+export function isCanonicalRequestTarget(target) {
+    return findRequestTargetViolation(target) === undefined;
+}
+//# sourceMappingURL=httpRequest.target.js.map

package/dist/httpRequest/target/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @zudojs/http/httpRequest/target
+ *
+ * Canonical request-target parsing shared by the request context, router and
+ * path-scoped middleware, plus the dot-segment / non-origin-form check the
+ * Node adapter applies before a request is dispatched.
+ */
+export * from "./httpRequest.target.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpRequest/target/index.js

@@ -0,0 +1,9 @@
+/**
+ * @zudojs/http/httpRequest/target
+ *
+ * Canonical request-target parsing shared by the request context, router and
+ * path-scoped middleware, plus the dot-segment / non-origin-form check the
+ * Node adapter applies before a request is dispatched.
+ */
+export * from "./httpRequest.target.js";
+//# sourceMappingURL=index.js.map

package/dist/httpResponse/httpResponse.helper.js

@@ -3,6 +3,7 @@
  *
  * @module httpResponse/helpers
  */
+import { withSecureCookieDefaults } from "../httpCookies/httpCookies.defaults.js";
 import { assertSafeRedirect } from "../httpRedirect/http.redirect.js";
 /**
  * Creates a JSON response.
@@ -110,7 +111,7 @@ export function serializeResponseCookie(cookie) {
     if (!name || !COOKIE_NAME_TOKEN.test(name)) {
         throw new TypeError(`Invalid cookie name: ${JSON.stringify(name)}`);
     }
-    const opts = cookie.options ?? {};
+    const opts = withSecureCookieDefaults(cookie.options, "Lax");
     if (name.startsWith("__Host-")) {
         if (!opts.secure) {
             throw new TypeError("A __Host- cookie requires the Secure attribute.");

package/dist/httpRouter/core/util/httpRoute.util.d.ts

@@ -8,7 +8,21 @@ import type { HttpRequestContext as RequestContext } from "../../../httpRequest/
 export declare function getRequestMethod(request: RequestContext): string;
 export declare function getRequestUrl(request: RequestContext): string;
 export declare function getRequestSignal(request: RequestContext): AbortSignal | undefined;
+/**
+ * Parses a request-target with the canonical parser shared by the request
+ * context and path-scoped middleware.
+ */
 export declare function parseUrl(value: string): URL;
+/**
+ * Builds the router's query record.
+ *
+ * Uses the same parser as the Node adapter's `request.query`
+ * (`parseQueryString`): a repeated name is an array, the record has a `null`
+ * prototype, and `__proto__` / `constructor` / `prototype` are dropped. The
+ * two used to disagree (`ctx.query.role` an array, `request.getQuery("role")`
+ * the last value), which let middleware and handlers read different values
+ * for the same parameter.
+ */
 export declare function parseQuery(params: URLSearchParams): Readonly<Record<string, string | string[]>>;
 export declare function normalizePath(path: string): string;
 export declare function splitPath(path: string): string[];

package/dist/httpRouter/core/util/httpRoute.util.js

@@ -4,6 +4,8 @@
  * Request accessors, URL/query parsing, and path normalization shared by the
  * router core.
  */
+import { parseRequestTarget } from "../../../httpRequest/target/httpRequest.target.js";
+import { parseQueryString } from "../../../httpQuery/http.query.js";
 import { InvalidRoutePatternError } from "../error/httpRouter.error.js";
 export function getRequestMethod(request) {
     const value = request.method;
@@ -19,23 +21,25 @@ export function getRequestUrl(request) {
 export function getRequestSignal(request) {
     return request.signal;
 }
+/**
+ * Parses a request-target with the canonical parser shared by the request
+ * context and path-scoped middleware.
+ */
 export function parseUrl(value) {
-    try {
-        return new URL(value, "http://zudojs.local");
-    }
-    catch {
-        return new URL("/", "http://zudojs.local");
-    }
+    return parseRequestTarget(value);
 }
+/**
+ * Builds the router's query record.
+ *
+ * Uses the same parser as the Node adapter's `request.query`
+ * (`parseQueryString`): a repeated name is an array, the record has a `null`
+ * prototype, and `__proto__` / `constructor` / `prototype` are dropped. The
+ * two used to disagree (`ctx.query.role` an array, `request.getQuery("role")`
+ * the last value), which let middleware and handlers read different values
+ * for the same parameter.
+ */
 export function parseQuery(params) {
-    const result = {};
-    for (const key of new Set(Array.from(params.keys()))) {
-        const values = params.getAll(key);
-        result[key] = values.length > 1 ? values : (values[0] ?? "");
-    }
-    return Object.freeze({
-        ...result,
-    });
+    return Object.freeze(parseQueryString(params.toString()));
 }
 /* -------------------------------------------------------------------------- */
 /* Path Helpers                                                               */

package/dist/httpSecurity/httpSecurity.config.d.ts

@@ -26,6 +26,12 @@ export interface HTTPSecurityConfig {
     readonly maxQueryLength?: number;
     /** Allowed Host header values. Empty = allow all. */
     readonly allowedHosts?: readonly string[];
+    /**
+     * Whether a request without a Host header is rejected (default: true).
+     * The Node adapter relaxes this for HTTP/1.0 requests, where Host is
+     * optional and some load-balancer health checks omit it.
+     */
+    readonly requireHost?: boolean;
     /**
      * Whether `X-Forwarded-*` headers may be trusted (default: `false`).
      *

package/dist/httpSecurity/httpSecurity.config.js

@@ -20,6 +20,7 @@ export const DEFAULT_SECURITY_CONFIG = Object.freeze({
     maxUrlLength: 2048,
     maxQueryLength: 4096,
     allowedHosts: [],
+    requireHost: true,
     trustProxy: false,
     maxRequestIdLength: 128,
     requestIdPattern: /^[a-zA-Z0-9_-]+$/,

package/dist/httpSecurity/httpSecurity.guard.d.ts

@@ -5,6 +5,7 @@
  * first security boundary. Rejects malformed, oversized, or
  * suspicious requests before they reach the router.
  */
+import { HttpRequestGuardError } from "@zudojs/errors";
 import type { HTTPSecurityConfig } from "./httpSecurity.config.js";
 /** A request-like object for validation (keeps the guard decoupled from HTTP types). */
 export interface GuardableRequest {
@@ -39,16 +40,13 @@ export declare function guardRequest(request: GuardableRequest, config?: Partial
  */
 export declare function createRequestGuard(config?: Partial<HTTPSecurityConfig>): (request: GuardableRequest) => GuardResult;
 /**
- * Error thrown by {@link assertRequestAllowed}.
- *
- * Carries the status the response should use and the individual validation
- * failures, so a caller can log the detail without returning it to the client.
+ * Error thrown by {@link assertRequestAllowed}: the shared
+ * `HttpRequestGuardError` from `@zudojs/errors` (a `BaseError`, code
+ * `HTTP_REQUEST_REJECTED`, not exposed). It carries the status the response
+ * should use and the individual validation failures, so a caller can log
+ * the detail without returning it to the client.
  */
-export declare class HttpRequestGuardError extends Error {
-    readonly statusCode: number;
-    readonly errors: readonly string[];
-    constructor(result: GuardResult);
-}
+export { HttpRequestGuardError };
 /**
  * Runs the guard and throws {@link HttpRequestGuardError} when the request is
  * rejected.

package/dist/httpSecurity/httpSecurity.guard.js

@@ -5,6 +5,7 @@
  * first security boundary. Rejects malformed, oversized, or
  * suspicious requests before they reach the router.
  */
+import { HttpRequestGuardError } from "@zudojs/errors";
 import { validateHeaders, validateHost, validateUrl, validateQuery, validateContentLength, validateRequestId, validateTransferEncoding, } from "./httpSecurity.validator.js";
 /**
  * Run all security validations against an incoming request.
@@ -52,21 +53,13 @@ export function createRequestGuard(config) {
     return (request) => guardRequest(request, config);
 }
 /**
- * Error thrown by {@link assertRequestAllowed}.
- *
- * Carries the status the response should use and the individual validation
- * failures, so a caller can log the detail without returning it to the client.
+ * Error thrown by {@link assertRequestAllowed}: the shared
+ * `HttpRequestGuardError` from `@zudojs/errors` (a `BaseError`, code
+ * `HTTP_REQUEST_REJECTED`, not exposed). It carries the status the response
+ * should use and the individual validation failures, so a caller can log
+ * the detail without returning it to the client.
  */
-export class HttpRequestGuardError extends Error {
-    statusCode;
-    errors;
-    constructor(result) {
-        super(`Request rejected by security guard: ${result.errors.join("; ")}`);
-        this.name = "HttpRequestGuardError";
-        this.statusCode = result.statusCode;
-        this.errors = result.errors;
-    }
-}
+export { HttpRequestGuardError };
 /**
  * Runs the guard and throws {@link HttpRequestGuardError} when the request is
  * rejected.

package/dist/httpSecurity/httpSecurity.nodeGuard.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Request guard wiring for the Node adapter.
+ *
+ * `guardRequest` (Host, request-ID, header-count, header-size, URL/query
+ * length and `Transfer-Encoding`/`Content-Length` checks) had no call site,
+ * so every one of those checks was inert unless an application wired it by
+ * hand. The Node adapter now runs it on every request before the request
+ * context is built or the body is read, and answers `400` when it refuses.
+ *
+ * @module httpSecurity/nodeGuard
+ */
+import type { IncomingMessage } from "node:http";
+import type { HTTPSecurityConfig } from "./httpSecurity.config.js";
+import { type GuardResult } from "./httpSecurity.guard.js";
+/**
+ * The adapter's `security` option.
+ *
+ * - `true` / omitted (default): run the guard with its defaults.
+ * - an object: run the guard with that configuration.
+ * - `false`: do not run the guard.
+ */
+export type NodeAdapterSecurityOption = boolean | Partial<HTTPSecurityConfig>;
+/**
+ * Adapter options contributed by the request guard.
+ */
+export interface NodeAdapterSecurityOptions {
+    /**
+     * Request guard applied before dispatch (on by default). See
+     * {@link NodeAdapterSecurityOption}.
+     *
+     * The guard's `maxBodySize` defaults to "no limit" here so the adapter's own
+     * `maxBodySize` keeps answering oversized bodies with `413`; set it
+     * explicitly to have the guard refuse a too-large `Content-Length` with
+     * `400` before any body is read. `requireHost` defaults to `true` except for
+     * HTTP/1.0 requests, where Host is optional.
+     */
+    readonly security?: NodeAdapterSecurityOption;
+}
+/**
+ * A per-request guard for Node requests.
+ */
+export type NodeRequestGuard = (request: IncomingMessage) => GuardResult;
+/**
+ * Builds the guard the adapter runs on each request, or `undefined` when the
+ * guard is disabled with `security: false`.
+ */
+export declare function createNodeRequestGuard(option: NodeAdapterSecurityOption | undefined): NodeRequestGuard | undefined;
+//# sourceMappingURL=httpSecurity.nodeGuard.d.ts.map

package/dist/httpSecurity/httpSecurity.nodeGuard.js

@@ -0,0 +1,32 @@
+/**
+ * Request guard wiring for the Node adapter.
+ *
+ * `guardRequest` (Host, request-ID, header-count, header-size, URL/query
+ * length and `Transfer-Encoding`/`Content-Length` checks) had no call site,
+ * so every one of those checks was inert unless an application wired it by
+ * hand. The Node adapter now runs it on every request before the request
+ * context is built or the body is read, and answers `400` when it refuses.
+ *
+ * @module httpSecurity/nodeGuard
+ */
+import { guardRequest, } from "./httpSecurity.guard.js";
+/**
+ * Builds the guard the adapter runs on each request, or `undefined` when the
+ * guard is disabled with `security: false`.
+ */
+export function createNodeRequestGuard(option) {
+    if (option === false) {
+        return undefined;
+    }
+    const configured = typeof option === "object" ? option : {};
+    return (request) => guardRequest({
+        method: request.method ?? "GET",
+        url: request.url ?? "/",
+        headers: request.headers,
+    }, {
+        maxBodySize: Number.MAX_SAFE_INTEGER,
+        requireHost: request.httpVersion !== "1.0",
+        ...configured,
+    });
+}
+//# sourceMappingURL=httpSecurity.nodeGuard.js.map

package/dist/httpSecurity/httpSecurity.validator.js

@@ -36,10 +36,12 @@ export function validateHeaders(headers, config) {
  * Validate the Host header against allowed hosts.
  */
 export function validateHost(host, config) {
+    const cfg = resolveConfig(config);
     if (!host) {
-        return { valid: false, errors: ["Missing Host header"] };
+        return cfg.requireHost
+            ? { valid: false, errors: ["Missing Host header"] }
+            : { valid: true, errors: [] };
     }
-    const cfg = resolveConfig(config);
     if (cfg.allowedHosts.length === 0) {
         return { valid: true, errors: [] };
     }

package/dist/httpSecurity/index.d.ts

@@ -11,4 +11,6 @@ export type { SecurityValidationResult } from "./httpSecurity.validator.js";
 export { validateHeaders, validateHost, validateUrl, validateQuery, validateContentLength, validateRequestId, validateTransferEncoding, } from "./httpSecurity.validator.js";
 export type { GuardableRequest, GuardResult } from "./httpSecurity.guard.js";
 export { guardRequest, createRequestGuard, assertRequestAllowed, HttpRequestGuardError, } from "./httpSecurity.guard.js";
+export type { NodeAdapterSecurityOption, NodeAdapterSecurityOptions, NodeRequestGuard, } from "./httpSecurity.nodeGuard.js";
+export { createNodeRequestGuard } from "./httpSecurity.nodeGuard.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpSecurity/index.js

@@ -8,4 +8,5 @@
 export { DEFAULT_SECURITY_CONFIG } from "./httpSecurity.config.js";
 export { validateHeaders, validateHost, validateUrl, validateQuery, validateContentLength, validateRequestId, validateTransferEncoding, } from "./httpSecurity.validator.js";
 export { guardRequest, createRequestGuard, assertRequestAllowed, HttpRequestGuardError, } from "./httpSecurity.guard.js";
+export { createNodeRequestGuard } from "./httpSecurity.nodeGuard.js";
 //# sourceMappingURL=index.js.map

package/dist/httpServer/core/httpServer.core.d.ts

@@ -45,6 +45,12 @@ export declare class HttpServer {
     close(): Promise<this>;
     setHandler(handler: HttpHandler): this;
     setErrorHandler(handler: HttpErrorHandler): this;
+    /**
+     * Installs `handler` on the adapter, wrapped so every dispatch is counted
+     * (`requests`, `onRequest`) and its completion reported (`onResponse`).
+     * Nothing called `recordRequest`/`recordResponse` before, so the counter
+     * and both events stayed at zero.
+     */
     private adapterHandler;
     private adapterErrorHandler;
     recordRequest(): void;
@@ -61,6 +67,11 @@ export declare class HttpServer {
     snapshot(): HttpServerSnapshot;
     toJSON(): HttpServerSnapshot;
     private performStart;
+    /**
+     * The adapter is told the shutdown timeout as its grace period, so
+     * in-flight requests get the documented `gracefulShutdownTimeout` rather
+     * than the Node adapter's hidden 10 s default.
+     */
     private performStop;
     private refreshAddress;
 }