@zudojs/http 1.1.0 → 1.3.0

package/dist/httpAdapter/node/httpNode.request.js

@@ -6,7 +6,8 @@
 import { HttpRequestContext, createRequestContext, } from "../../httpRequest/httpRequest.context.js";
 import { getClientIp, isTrustedProxy, } from "../../httpTrustProxy/httpTrustProxy.core.js";
 import { removePort, extractPort } from "./httpNode.server.js";
-import { decodeQueryComponent } from "../../httpQuery/http.query.js";
+import { parseQueryString } from "../../httpQuery/index.js";
+import { findRequestTargetViolation } from "../../httpRequest/target/httpRequest.target.js";
 /* -------------------------------------------------------------------------- */
 /* Proxy Trust                                                                */
 /* -------------------------------------------------------------------------- */
@@ -122,53 +123,42 @@ export function getNodeRemoteAddress(request, options = {}) {
 /**
  * Parses the request-target's query string into a flat record.
  *
- * Every value is attacker-controlled. `decodeURIComponent` throws on a
- * malformed sequence such as `%E0`, and this ran before the adapter's
- * try/catch, so one such request tore the connection down instead of being
- * answered. Decoding is delegated to the query module's non-throwing
- * decoder, which also gives `+` its form-encoding meaning. A pair is split on
- * its **first** `=` so `a=b=c` keeps the value `b=c`.
+ * Every value is attacker-controlled, so decoding never throws (a malformed
+ * `%E0` is kept raw) and `+` has its form-encoding meaning. This uses the same
+ * parser as the router's `ctx.query` (`parseQueryString`), so both agree: a
+ * repeated name is an array (`?role=user&role=admin` gives
+ * `["user", "admin"]`), the record has a `null` prototype, and
+ * `__proto__` / `constructor` / `prototype` are dropped. Previously the last
+ * value silently won here while the router returned the array.
  */
 export function parseNodeQuery(request) {
     const url = request.url;
     if (!url) {
-        return Object.freeze({});
+        return Object.freeze(Object.create(null));
     }
     const questionIndex = url.indexOf("?");
     if (questionIndex === -1) {
-        return Object.freeze({});
+        return Object.freeze(Object.create(null));
     }
     const hashIndex = url.indexOf("#", questionIndex + 1);
     const queryString = url.slice(questionIndex + 1, hashIndex === -1 ? undefined : hashIndex);
-    if (!queryString) {
-        return Object.freeze({});
-    }
-    const params = {};
-    for (const pair of queryString.split("&")) {
-        if (pair === "") {
-            continue;
-        }
-        const separator = pair.indexOf("=");
-        const rawKey = separator === -1 ? pair : pair.slice(0, separator);
-        const rawValue = separator === -1 ? "" : pair.slice(separator + 1);
-        const key = decodeQueryComponent(rawKey);
-        if (key) {
-            params[key] = decodeQueryComponent(rawValue);
-        }
-    }
-    return Object.freeze(params);
+    return Object.freeze(parseQueryString(queryString));
 }
 /* -------------------------------------------------------------------------- */
 /* Request Context                                                            */
 /* -------------------------------------------------------------------------- */
 export function createNodeRequestContext(request, options = {}) {
+    const url = request.url ?? "/";
+    const violation = findRequestTargetViolation(url);
+    if (violation !== undefined) {
+        throw new TypeError(violation);
+    }
     const headers = getNodeRequestHeaders(request);
     const protocol = getNodeRequestProtocol(request, options);
     const hostname = getNodeRequestHostname(request, options);
     const port = getNodeRequestPort(request, options);
     const remoteAddress = getNodeRemoteAddress(request, options);
     const query = parseNodeQuery(request);
-    const url = request.url ?? "/";
     return createRequestContext({
         method: request.method?.toUpperCase() ?? "GET",
         url,

package/dist/httpAdapter/node/httpNode.server.d.ts

@@ -43,6 +43,12 @@ export declare function getSearchPart(url: string): string;
 import { RequestBodyTooLargeError as NodeRequestBodyTooLargeError } from "@zudojs/errors";
 export { NodeRequestBodyTooLargeError };
 export declare function readNodeRequestBody(request: IncomingMessage, maxBodySize?: number): Promise<Uint8Array>;
+/**
+ * Whether a value has the shape of a response init.
+ *
+ * @deprecated No longer used by the Node adapter: a plain object returned
+ * from a handler is always sent as JSON. Kept for API compatibility.
+ */
 export declare function isResponseContextLike(value: unknown): value is {
     readonly status?: number;
     readonly statusText?: string;

package/dist/httpAdapter/node/httpNode.server.js

@@ -250,6 +250,12 @@ export function readNodeRequestBody(request, maxBodySize = DEFAULT_MAX_BODY_SIZE
 /* -------------------------------------------------------------------------- */
 /* Response Result Detection                                                  */
 /* -------------------------------------------------------------------------- */
+/**
+ * Whether a value has the shape of a response init.
+ *
+ * @deprecated No longer used by the Node adapter: a plain object returned
+ * from a handler is always sent as JSON. Kept for API compatibility.
+ */
 export function isResponseContextLike(value) {
     if (value === null || typeof value !== "object") {
         return false;

package/dist/httpAdapter/node/httpNode.type.d.ts

@@ -6,7 +6,8 @@
 import type { Server } from "node:http";
 import type { HttpAdapterOptions } from "../http.adapter.js";
 import type { TrustProxy } from "../../httpTrustProxy/httpTrustProxy.core.js";
-export interface NodeAdapterOptions extends HttpAdapterOptions {
+import type { NodeAdapterSecurityOptions } from "../../httpSecurity/httpSecurity.nodeGuard.js";
+export interface NodeAdapterOptions extends HttpAdapterOptions, NodeAdapterSecurityOptions {
     readonly host?: string;
     readonly port?: number;
     readonly server?: Server;

package/dist/httpAgent/http.agent.d.ts

@@ -46,9 +46,28 @@ export interface AgentRegistryKey {
     readonly name?: string;
 }
 export declare function getOrCreateAgent(key: string | AgentRegistryKey, options?: HTTPAgentConfig | HTTPSAgentConfig): HTTPAgentInstance;
-export declare function getAgent(key: string | AgentRegistryKey): HTTPAgentInstance | undefined;
-export declare function hasAgent(key: string | AgentRegistryKey): boolean;
-export declare function removeAgent(key: string | AgentRegistryKey, destroy?: boolean): boolean;
+/**
+ * Looks up a registered agent.
+ *
+ * `options` must be the same TLS-relevant options `getOrCreateAgent` was
+ * given, because they are part of the key; omitting them looks up the agent
+ * created with no options.
+ */
+export declare function getAgent(key: string | AgentRegistryKey, options?: HTTPAgentConfig | HTTPSAgentConfig): HTTPAgentInstance | undefined;
+/**
+ * Whether an agent is registered for this key and TLS option set.
+ */
+export declare function hasAgent(key: string | AgentRegistryKey, options?: HTTPAgentConfig | HTTPSAgentConfig): boolean;
+/**
+ * Removes registered agents for a key.
+ *
+ * With `options` the single matching agent is removed; without them every
+ * agent registered for that host is removed, whatever TLS options it was
+ * created with, so a per-host teardown releases all of its sockets.
+ *
+ * @returns Whether anything was removed.
+ */
+export declare function removeAgent(key: string | AgentRegistryKey, destroy?: boolean, options?: HTTPAgentConfig | HTTPSAgentConfig): boolean;
 export declare function clearAgents(destroy?: boolean): void;
 export declare function getRegisteredAgentKeys(): string[];
 export declare function getDefaultHTTPAgent(): HTTPAgent;

package/dist/httpAgent/http.agent.js

@@ -113,7 +113,7 @@ export function getOrCreateAgent(key, options = {}) {
      * passing `rejectUnauthorized: false` would have disabled certificate
      * verification for a caller that had pinned a CA, with no way to detect it.
      */
-    const cacheKey = `${registryKey}|${tlsFingerprint(options)}`;
+    const cacheKey = agentCacheKey(registryKey, options);
     const existing = agentRegistry.get(cacheKey);
     if (existing) {
         return existing;
@@ -127,6 +127,18 @@ export function getOrCreateAgent(key, options = {}) {
     agentRegistry.set(cacheKey, agent);
     return agent;
 }
+/**
+ * Builds the registry key an agent is stored under.
+ *
+ * Every read and write goes through this one helper. `getOrCreateAgent` used
+ * to append the TLS fingerprint while `getAgent`, `hasAgent` and
+ * `removeAgent` looked up the bare registry key, so every lookup missed and
+ * the documented per-host teardown silently leaked the agent and its
+ * keep-alive sockets.
+ */
+function agentCacheKey(registryKey, options) {
+    return `${registryKey}|${tlsFingerprint(options)}`;
+}
 /**
  * Builds a stable fingerprint of the TLS-relevant fields of an agent config.
  */
@@ -156,23 +168,49 @@ function describeCredential(value) {
     }
     return "opaque";
 }
-export function getAgent(key) {
-    return agentRegistry.get(normalizeRegistryKey(key));
+/**
+ * Looks up a registered agent.
+ *
+ * `options` must be the same TLS-relevant options `getOrCreateAgent` was
+ * given, because they are part of the key; omitting them looks up the agent
+ * created with no options.
+ */
+export function getAgent(key, options = {}) {
+    return agentRegistry.get(agentCacheKey(normalizeRegistryKey(key), options));
 }
-export function hasAgent(key) {
-    return agentRegistry.has(normalizeRegistryKey(key));
+/**
+ * Whether an agent is registered for this key and TLS option set.
+ */
+export function hasAgent(key, options = {}) {
+    return agentRegistry.has(agentCacheKey(normalizeRegistryKey(key), options));
 }
-export function removeAgent(key, destroy = true) {
+/**
+ * Removes registered agents for a key.
+ *
+ * With `options` the single matching agent is removed; without them every
+ * agent registered for that host is removed, whatever TLS options it was
+ * created with, so a per-host teardown releases all of its sockets.
+ *
+ * @returns Whether anything was removed.
+ */
+export function removeAgent(key, destroy = true, options) {
     const registryKey = normalizeRegistryKey(key);
-    const agent = agentRegistry.get(registryKey);
-    if (!agent) {
-        return false;
-    }
-    agentRegistry.delete(registryKey);
-    if (destroy) {
-        agent.destroy();
+    const cacheKeys = options === undefined
+        ? Array.from(agentRegistry.keys()).filter((candidate) => candidate.startsWith(`${registryKey}|`))
+        : [agentCacheKey(registryKey, options)];
+    let removed = false;
+    for (const cacheKey of cacheKeys) {
+        const agent = agentRegistry.get(cacheKey);
+        if (!agent) {
+            continue;
+        }
+        agentRegistry.delete(cacheKey);
+        if (destroy) {
+            agent.destroy();
+        }
+        removed = true;
     }
-    return true;
+    return removed;
 }
 export function clearAgents(destroy = true) {
     if (destroy) {

package/dist/httpCacheControl/httpCacheControl.freshness.d.ts

@@ -12,11 +12,17 @@ import type { CacheFreshness } from "./core/httpCacheControl.type.js";
  * the origin marked must-revalidate-before-reuse must never be reported
  * fresh.
  *
+ * The response's current age follows RFC 9111 section 4.2.3: the `Age`
+ * header plus the time elapsed since the response's `Date`. Reading `Age`
+ * alone — as this used to — left every response without that header aged
+ * `0` forever, so `isFresh()` answered `true` for a response of any age.
+ *
  * @param responseHeaders - The cached response's headers.
  * @param responseDate - The response's `Date`, if already parsed.
+ * @param now - The current time, defaulting to `Date.now()`.
  * @returns The freshness calculation.
  */
-export declare function calculateFreshness(responseHeaders: Readonly<Record<string, string>>, responseDate?: Date): CacheFreshness;
+export declare function calculateFreshness(responseHeaders: Readonly<Record<string, string>>, responseDate?: Date, now?: Date): CacheFreshness;
 /**
  * Determines if a cached response is still fresh.
  */

package/dist/httpCacheControl/httpCacheControl.freshness.js

@@ -12,24 +12,37 @@ import { parseCacheControl } from "./core/httpCacheControl.parse.js";
  * the origin marked must-revalidate-before-reuse must never be reported
  * fresh.
  *
+ * The response's current age follows RFC 9111 section 4.2.3: the `Age`
+ * header plus the time elapsed since the response's `Date`. Reading `Age`
+ * alone — as this used to — left every response without that header aged
+ * `0` forever, so `isFresh()` answered `true` for a response of any age.
+ *
  * @param responseHeaders - The cached response's headers.
  * @param responseDate - The response's `Date`, if already parsed.
+ * @param now - The current time, defaulting to `Date.now()`.
  * @returns The freshness calculation.
  */
-export function calculateFreshness(responseHeaders, responseDate) {
+export function calculateFreshness(responseHeaders, responseDate, now = new Date()) {
     const cacheControl = responseHeaders["cache-control"];
     const directives = parseCacheControl(cacheControl);
-    const date = responseDate ?? new Date(responseHeaders["date"] ?? Date.now());
+    const date = responseDate ?? parseDateHeader(responseHeaders["date"], now);
     /*
      * RFC 9111 section 5.1: Age is a non-negative delta-seconds. A negative or
      * suffixed value would otherwise inflate freshness without bound, which
      * pins a poisoned response in cache far past the origin's TTL.
      */
     const rawAge = (responseHeaders["age"] ?? "").trim();
-    const age = /^\d+$/.test(rawAge) ? Number(rawAge) : 0;
+    const ageHeader = /^\d+$/.test(rawAge) ? Number(rawAge) : 0;
+    const residentSeconds = Math.max(0, Math.floor((now.getTime() - date.getTime()) / 1_000));
+    const age = ageHeader + residentSeconds;
     const expiresHeader = responseHeaders["expires"];
     const expires = expiresHeader ? parseExpires(expiresHeader) : undefined;
     const effectiveMaxAge = resolveMaxAge(directives, expires, date);
+    /*
+     * With an `Expires`-derived lifetime this reduces to `expires - now`,
+     * because the lifetime is measured from `Date` and the age is measured to
+     * `now`.
+     */
     const remaining = Math.max(0, effectiveMaxAge - age);
     const stale = remaining <= 0 ||
         directives.noCache === true ||
@@ -43,6 +56,20 @@ export function calculateFreshness(responseHeaders, responseDate) {
         remaining,
     };
 }
+/**
+ * Parses a `Date` header, falling back to the current time.
+ *
+ * @param value - The raw `Date` value.
+ * @param now - The fallback instant.
+ * @returns The parsed date.
+ */
+function parseDateHeader(value, now) {
+    if (value === undefined) {
+        return now;
+    }
+    const parsed = new Date(value);
+    return Number.isNaN(parsed.getTime()) ? now : parsed;
+}
 /**
  * Parses an `Expires` header, treating an unparseable value as expired.
  *

package/dist/httpCookies/http.cookies.d.ts

@@ -57,7 +57,14 @@ export declare const MAX_COOKIE_HEADER_LENGTH: number;
  * @returns The parsed cookie jar.
  */
 export declare function parseCookies(header: string | undefined): CookieCollection;
-export declare function serializeCookie(name: string, value: CookieValue, options?: CookieOptions): string;
+/**
+ * Serializes a `Set-Cookie` header value.
+ *
+ * Unset attributes take the secure defaults (`Path=/; HttpOnly; Secure;
+ * SameSite=Lax`, see `DEFAULT_COOKIE_ATTRIBUTES`); pass `httpOnly: false`,
+ * `secure: false`, another `sameSite` or `path` to override them.
+ */
+export declare function serializeCookie(name: string, value: CookieValue, cookieOptions?: CookieOptions): string;
 export interface CookieManager {
     get(name: string): string | undefined;
     has(name: string): boolean;
@@ -78,11 +85,31 @@ export interface SignedCookie {
     readonly value: string;
     readonly signature: string;
 }
+/**
+ * Serializes a signed cookie. The MAC covers the cookie **name** as well as
+ * the value, so a signature minted for one cookie is not accepted for
+ * another; read it back with `parseSignedCookie(value, secret, name)`.
+ */
 export declare function serializeSignedCookie(name: string, value: string, options: SignedCookieOptions): string;
-export declare function parseSignedCookie(value: string | undefined, secret: string): string | undefined;
+/**
+ * Verifies a signed cookie value and returns the original value, or
+ * `undefined` when the signature does not match.
+ *
+ * Pass the cookie's `name`: the signature produced by
+ * `serializeSignedCookie` is bound to it, so a value lifted from another
+ * signed cookie (for example a user-chosen display name replayed as
+ * `session_user`) is rejected. Without `name` only a legacy, value-only
+ * signature (from `signCookieValue(value, secret)`) verifies, and
+ * name-bound signatures never do.
+ */
+export declare function parseSignedCookie(value: string | undefined, secret: string, name?: string): string | undefined;
 /**
  * Signs a cookie value with HMAC-SHA256.
  *
+ * Synchronous by contract, so the MAC is computed with `node:crypto`: every
+ * `@zudojs/crypto` HMAC helper is asynchronous. Verification compares with
+ * `@zudojs/crypto`'s constant-time `timingSafeEqualString`.
+ *
  * @param value - The value to authenticate.
  * @param secret - The signing key.
  * @returns The base64url signature.

package/dist/httpCookies/http.cookies.js

@@ -1,4 +1,6 @@
-import { createHmac, timingSafeEqual as cryptoTimingSafeEqual, } from "node:crypto";
+import { createHmac } from "node:crypto";
+import { timingSafeEqualString } from "@zudojs/crypto";
+import { withSecureCookieDefaults } from "./httpCookies.defaults.js";
 /* -------------------------------------------------------------------------- */
 /* Cookie Collection                                                          */
 /* -------------------------------------------------------------------------- */
@@ -123,7 +125,15 @@ export function parseCookies(header) {
 /* -------------------------------------------------------------------------- */
 /* Serialize Cookie                                                           */
 /* -------------------------------------------------------------------------- */
-export function serializeCookie(name, value, options = {}) {
+/**
+ * Serializes a `Set-Cookie` header value.
+ *
+ * Unset attributes take the secure defaults (`Path=/; HttpOnly; Secure;
+ * SameSite=Lax`, see `DEFAULT_COOKIE_ATTRIBUTES`); pass `httpOnly: false`,
+ * `secure: false`, another `sameSite` or `path` to override them.
+ */
+export function serializeCookie(name, value, cookieOptions = {}) {
+    const options = withSecureCookieDefaults(cookieOptions, "lax");
     validateCookieName(name);
     validateCookiePrefix(name, options);
     const encodedName = name;
@@ -229,11 +239,27 @@ export function createCookieManager(request, response) {
         },
     };
 }
+/**
+ * Serializes a signed cookie. The MAC covers the cookie **name** as well as
+ * the value, so a signature minted for one cookie is not accepted for
+ * another; read it back with `parseSignedCookie(value, secret, name)`.
+ */
 export function serializeSignedCookie(name, value, options) {
-    const signature = signCookieValue(value, options.secret);
+    const signature = signCookieValue(bindCookieName(name, value), options.secret);
     return serializeCookie(name, `${value}.${signature}`, options);
 }
-export function parseSignedCookie(value, secret) {
+/**
+ * Verifies a signed cookie value and returns the original value, or
+ * `undefined` when the signature does not match.
+ *
+ * Pass the cookie's `name`: the signature produced by
+ * `serializeSignedCookie` is bound to it, so a value lifted from another
+ * signed cookie (for example a user-chosen display name replayed as
+ * `session_user`) is rejected. Without `name` only a legacy, value-only
+ * signature (from `signCookieValue(value, secret)`) verifies, and
+ * name-bound signatures never do.
+ */
+export function parseSignedCookie(value, secret, name) {
     if (!value) {
         return undefined;
     }
@@ -243,15 +269,27 @@ export function parseSignedCookie(value, secret) {
     }
     const originalValue = value.slice(0, separator);
     const signature = value.slice(separator + 1);
-    const expected = signCookieValue(originalValue, secret);
-    if (!timingSafeEqual(signature, expected)) {
+    const expected = signCookieValue(name === undefined ? originalValue : bindCookieName(name, originalValue), secret);
+    if (!timingSafeEqualString(signature, expected)) {
         return undefined;
     }
     return originalValue;
 }
+/**
+ * The MAC input for a name-bound signature. A cookie name is an RFC 6265
+ * token and cannot contain `=`, so the encoding is unambiguous.
+ */
+function bindCookieName(name, value) {
+    validateCookieName(name);
+    return `${name}=${value}`;
+}
 /**
  * Signs a cookie value with HMAC-SHA256.
  *
+ * Synchronous by contract, so the MAC is computed with `node:crypto`: every
+ * `@zudojs/crypto` HMAC helper is asynchronous. Verification compares with
+ * `@zudojs/crypto`'s constant-time `timingSafeEqualString`.
+ *
  * @param value - The value to authenticate.
  * @param secret - The signing key.
  * @returns The base64url signature.
@@ -396,22 +434,4 @@ function normalizePriority(value) {
             throw new TypeError(`Invalid cookie priority: ${String(value)}`);
     }
 }
-/* -------------------------------------------------------------------------- */
-/* Hash Helpers                                                               */
-/* -------------------------------------------------------------------------- */
-/**
- * Compares two signatures in constant time.
- *
- * @param left - The candidate signature.
- * @param right - The expected signature.
- * @returns `true` if the two are byte-identical.
- */
-function timingSafeEqual(left, right) {
-    const leftBuffer = Buffer.from(left, "utf8");
-    const rightBuffer = Buffer.from(right, "utf8");
-    if (leftBuffer.length !== rightBuffer.length) {
-        return false;
-    }
-    return cryptoTimingSafeEqual(leftBuffer, rightBuffer);
-}
 //# sourceMappingURL=http.cookies.js.map

package/dist/httpCookies/httpCookies.defaults.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Secure cookie defaults.
+ *
+ * Both cookie serializers (`serializeCookie` in this module and the
+ * `serializeResponseCookie` the adapters use for `response.cookie()`) start
+ * from these defaults, so a cookie set "the obvious way" is `HttpOnly`,
+ * `Secure`, `SameSite=Lax` and `Path=/`, matching the defaults of
+ * `@zudojs/security`'s `serializeCookie` and the AGENTS.md secure-defaults
+ * rule. Every default can be overridden explicitly (`httpOnly: false`,
+ * `secure: false`, `sameSite: "none"`, `path: "/app"`); an option left
+ * `undefined` keeps the default.
+ *
+ * @module httpCookies/defaults
+ */
+/**
+ * The attributes every cookie gets unless the caller overrides them.
+ */
+export declare const DEFAULT_COOKIE_ATTRIBUTES: Readonly<{
+    readonly path: "/";
+    readonly httpOnly: true;
+    readonly secure: true;
+    readonly sameSite: "lax";
+}>;
+interface DefaultableCookieOptions<S extends string> {
+    readonly path?: string;
+    readonly httpOnly?: boolean;
+    readonly secure?: boolean;
+    readonly sameSite?: S;
+}
+/**
+ * Returns `options` with the secure defaults filled in for every attribute
+ * the caller left `undefined`.
+ *
+ * @param options - The caller's cookie options.
+ * @param sameSite - The default `SameSite` value in the option type's own
+ *   spelling (`"lax"` or `"Lax"`).
+ */
+export declare function withSecureCookieDefaults<S extends string, T extends DefaultableCookieOptions<S>>(options: T | undefined, sameSite: S): T;
+export {};
+//# sourceMappingURL=httpCookies.defaults.d.ts.map

package/dist/httpCookies/httpCookies.defaults.js

@@ -0,0 +1,42 @@
+/**
+ * Secure cookie defaults.
+ *
+ * Both cookie serializers (`serializeCookie` in this module and the
+ * `serializeResponseCookie` the adapters use for `response.cookie()`) start
+ * from these defaults, so a cookie set "the obvious way" is `HttpOnly`,
+ * `Secure`, `SameSite=Lax` and `Path=/`, matching the defaults of
+ * `@zudojs/security`'s `serializeCookie` and the AGENTS.md secure-defaults
+ * rule. Every default can be overridden explicitly (`httpOnly: false`,
+ * `secure: false`, `sameSite: "none"`, `path: "/app"`); an option left
+ * `undefined` keeps the default.
+ *
+ * @module httpCookies/defaults
+ */
+/**
+ * The attributes every cookie gets unless the caller overrides them.
+ */
+export const DEFAULT_COOKIE_ATTRIBUTES = Object.freeze({
+    path: "/",
+    httpOnly: true,
+    secure: true,
+    sameSite: "lax",
+});
+/**
+ * Returns `options` with the secure defaults filled in for every attribute
+ * the caller left `undefined`.
+ *
+ * @param options - The caller's cookie options.
+ * @param sameSite - The default `SameSite` value in the option type's own
+ *   spelling (`"lax"` or `"Lax"`).
+ */
+export function withSecureCookieDefaults(options, sameSite) {
+    const source = (options ?? {});
+    return {
+        ...source,
+        path: source.path ?? DEFAULT_COOKIE_ATTRIBUTES.path,
+        httpOnly: source.httpOnly ?? DEFAULT_COOKIE_ATTRIBUTES.httpOnly,
+        secure: source.secure ?? DEFAULT_COOKIE_ATTRIBUTES.secure,
+        sameSite: source.sameSite ?? sameSite,
+    };
+}
+//# sourceMappingURL=httpCookies.defaults.js.map

package/dist/httpCookies/index.d.ts

@@ -4,4 +4,5 @@
  * HTTP httpCookies module.
  */
 export * from "./http.cookies.js";
+export * from "./httpCookies.defaults.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpCookies/index.js

@@ -4,4 +4,5 @@
  * HTTP httpCookies module.
  */
 export * from "./http.cookies.js";
+export * from "./httpCookies.defaults.js";
 //# sourceMappingURL=index.js.map

package/dist/httpKeepAlive/httpKeepAlive.core.js

@@ -7,6 +7,7 @@
  * Transport-specific socket management belongs to the server/client adapter
  * layer. This module only handles HTTP-level semantics.
  */
+import { assertSafeHeaderValue, escapeHeaderQuotedString, } from "../httpHeaders/security/index.js";
 /* -------------------------------------------------------------------------- */
 /* Constants                                                                  */
 /* -------------------------------------------------------------------------- */
@@ -121,7 +122,9 @@ export function formatKeepAliveHeader(parameters = {}) {
             parts.push(`${key}=${quoteIfNeeded(value)}`);
         }
     }
-    return parts.join(", ");
+    const header = parts.join(", ");
+    assertSafeHeaderValue(header);
+    return header;
 }
 /* -------------------------------------------------------------------------- */
 /* Connection Header                                                          */
@@ -348,10 +351,19 @@ function unquote(value) {
     }
     return trimmed;
 }
+/**
+ * Emits a Keep-Alive parameter value.
+ *
+ * Quoting does not neutralise a CR or LF, so the control character used to
+ * survive into the field value. `escapeHeaderQuotedString` rejects it, the
+ * same helper every other quoted-parameter emitter in this package uses.
+ *
+ * @throws {TypeError} If the value contains a forbidden control character.
+ */
 function quoteIfNeeded(value) {
     if (/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(value)) {
         return value;
     }
-    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+    return `"${escapeHeaderQuotedString(value)}"`;
 }
 //# sourceMappingURL=httpKeepAlive.core.js.map

package/dist/httpMiddleware/builtin/conditional/httpMiddleware.conditional.d.ts

@@ -7,7 +7,28 @@ import type { HttpMiddleware, HttpMiddlewareContext } from "../../httpMiddleware
 import type { HttpResponseContext as ResponseContext } from "../../../httpResponse/httpResponse.context.js";
 export declare function createAsyncMiddleware(factory: (context: HttpMiddlewareContext) => Promise<HttpMiddleware>): HttpMiddleware;
 export declare function createConditionalMiddleware(predicate: (context: HttpMiddlewareContext) => boolean | Promise<boolean>, middleware: HttpMiddleware): HttpMiddleware;
-export declare function createPathMiddleware(path: string, middleware: HttpMiddleware): HttpMiddleware;
+/**
+ * Options for {@link createPathMiddleware}.
+ */
+export interface PathMiddlewareOptions {
+    /**
+     * Match the path case-sensitively. Defaults to `false`, the router's
+     * default, so a guard scoped to `/admin` also covers `/Admin`, which the
+     * router would dispatch to the same route.
+     */
+    readonly caseSensitive?: boolean;
+}
+/**
+ * Runs `middleware` only for requests addressed to `path`.
+ *
+ * The request path is normalised exactly as the router normalises it before
+ * matching: it is read with the canonical request-target parser, repeated
+ * slashes are collapsed, a trailing slash is ignored and (by default) case is
+ * ignored. An exact, case-sensitive comparison let `/Admin`, `/admin/` and
+ * `/admin//` skip a guard on `/admin` while the router still served the
+ * protected route.
+ */
+export declare function createPathMiddleware(path: string, middleware: HttpMiddleware, options?: PathMiddlewareOptions): HttpMiddleware;
 export declare function createMethodMiddleware(method: string, middleware: HttpMiddleware): HttpMiddleware;
 export declare function createResponseMiddleware(response: Response | ResponseContext): HttpMiddleware;
 export declare function createShortCircuitMiddleware(predicate: (context: HttpMiddlewareContext) => boolean | Promise<boolean>, response: Response | ResponseContext): HttpMiddleware;