@zudojs/http 1.1.0 → 1.3.0

package/dist/httpRequest/http.request.js

@@ -1,5 +1,7 @@
 import { HTTP_HEADERS } from "../httpConstants/http.constants.js";
 import { InvalidJSONError } from "../httpErrors/httpError.helper.js";
+import { parseQueryString as parseHardenedQueryString } from "../httpQuery/queryParse/index.js";
+import { getClientIp, isTrustedPeer, } from "../httpTrustProxy/httpTrustProxy.helper.js";
 /* -------------------------------------------------------------------------- */
 /* Request Headers                                                            */
 /* -------------------------------------------------------------------------- */
@@ -72,7 +74,8 @@ export class NodeHTTPRequest {
     cachedJSON;
     jsonParsed = false;
     constructor(request, options = {}) {
-        const protocol = getRequestProtocol(request);
+        const trustProxy = options.trustProxy ?? false;
+        const protocol = getRequestProtocol(request, trustProxy);
         const host = getRequestHost(request);
         const path = getRequestPath(request);
         this.method = normalizeHTTPMethod(request.method);
@@ -84,9 +87,9 @@ export class NodeHTTPRequest {
         this.params = options.params ?? {};
         this.protocol = protocol;
         this.hostname = getHostname(host);
-        this.ip = options.ip ?? getRequestIP(request);
+        this.ip = options.ip ?? getRequestIP(request, trustProxy);
         this.ips = options.ips;
-        this.secure = protocol === "https" || protocol === "wss";
+        this.secure = protocol === "https";
         this.rawBody = options.rawBody;
         this.body = options.body;
         this.signal = options.signal;
@@ -229,10 +232,41 @@ export function getHostname(host) {
 /* -------------------------------------------------------------------------- */
 /* Protocol                                                                   */
 /* -------------------------------------------------------------------------- */
-export function getRequestProtocol(request) {
-    const forwarded = request.headers[HTTP_HEADERS.X_FORWARDED_PROTO];
-    if (typeof forwarded === "string") {
-        return (forwarded.split(",", 1)[0] ?? "").trim().toLowerCase();
+/** The only schemes a forwarded proto may name. */
+const FORWARDED_PROTOCOLS = Object.freeze(["http", "https"]);
+/**
+ * Presents an `IncomingMessage` in the shape `httpTrustProxy` works on, so
+ * this path and the Node adapter share one implementation of the hop logic.
+ */
+function toProxyRequest(request) {
+    return {
+        headers: request.headers,
+        socket: { remoteAddress: request.socket?.remoteAddress },
+    };
+}
+/**
+ * Resolves the scheme the client used.
+ *
+ * `X-Forwarded-Proto` is written by whoever opened the socket, so it is read
+ * only when that peer is a configured trusted proxy, and only when it names
+ * `http` or `https` — a value such as `wss` is discarded rather than
+ * propagated. With the default `trustProxy` of `false` the socket's own TLS
+ * state is the only input.
+ *
+ * @param request - The incoming Node request.
+ * @param trustProxy - Which peers may speak through `X-Forwarded-Proto`.
+ * @returns `"https"` or `"http"`.
+ */
+export function getRequestProtocol(request, trustProxy = false) {
+    if (isTrustedPeer(toProxyRequest(request), trustProxy)) {
+        const forwarded = request.headers[HTTP_HEADERS.X_FORWARDED_PROTO];
+        const value = Array.isArray(forwarded) ? forwarded[0] : forwarded;
+        if (typeof value === "string") {
+            const proto = (value.split(",", 1)[0] ?? "").trim().toLowerCase();
+            if (FORWARDED_PROTOCOLS.includes(proto)) {
+                return proto;
+            }
+        }
     }
     if ("encrypted" in request.socket &&
         request.socket.encrypted) {
@@ -243,43 +277,60 @@ export function getRequestProtocol(request) {
 /* -------------------------------------------------------------------------- */
 /* IP                                                                         */
 /* -------------------------------------------------------------------------- */
-export function getRequestIP(request) {
-    const forwarded = request.headers[HTTP_HEADERS.X_FORWARDED_FOR];
-    if (typeof forwarded === "string") {
-        const first = forwarded.split(",", 1)[0]?.trim();
-        if (first) {
-            return first;
-        }
+/**
+ * Resolves the client address.
+ *
+ * The socket peer is authoritative. `X-Forwarded-For` is consulted only when
+ * that peer is a configured trusted proxy, and the chain walk is delegated to
+ * `getClientIp` so there is a single implementation of the hop logic. With
+ * the default `trustProxy` of `false` the peer address is returned unchanged,
+ * which is what an allowlist, per-IP rate limit or audit trail keyed on
+ * `req.ip` needs.
+ *
+ * @param request - The incoming Node request.
+ * @param trustProxy - Which peers may speak through `X-Forwarded-For`.
+ * @returns The client address, or `undefined` when the socket has none.
+ */
+export function getRequestIP(request, trustProxy = false) {
+    const proxyRequest = toProxyRequest(request);
+    const peer = proxyRequest.socket?.remoteAddress;
+    if (!isTrustedPeer(proxyRequest, trustProxy)) {
+        return peer ?? undefined;
     }
-    return request.socket.remoteAddress ?? undefined;
+    return getClientIp(proxyRequest, trustProxy) ?? peer ?? undefined;
 }
 /* -------------------------------------------------------------------------- */
 /* Query                                                                      */
 /* -------------------------------------------------------------------------- */
+/**
+ * Parses the query component of a request-target into a flat record.
+ *
+ * Delegates to the hardened `httpQuery` parser, the same one behind the Node
+ * adapter's `request.query` and the router's `ctx.query`. This function used
+ * to carry its own loop that accumulated into an object literal and read
+ * `result[key]` without an own-property check, which had two consequences on
+ * fully attacker-controlled input:
+ *
+ * - `?__proto__=a&__proto__=b` assigned an array through the `__proto__`
+ *   setter, so the returned query object's prototype became that array. The
+ *   parameter vanished from its own keys while the object silently gained
+ *   `length`, `map` and the rest of `Array.prototype`.
+ * - `?constructor=x` read the inherited `Object` constructor as the "existing"
+ *   value and stored it in the result, handing a handler
+ *   `query.constructor === [Function: Object], "x"]`.
+ *
+ * It also applied none of the four documented query limits, so a request with
+ * 50,000 parameters was parsed in full. Delegating fixes all three, and makes
+ * a limit breach throw {@link HTTPQueryLimitError} (414) as it already did on
+ * every other request path.
+ */
 export function parseQueryString(url) {
     const queryIndex = url.indexOf("?");
     if (queryIndex < 0) {
-        return {};
-    }
-    const queryString = url.slice(queryIndex + 1);
-    if (!queryString) {
-        return {};
-    }
-    const searchParams = new URLSearchParams(queryString);
-    const result = {};
-    for (const [key, value] of searchParams.entries()) {
-        const existing = result[key];
-        if (existing === undefined) {
-            result[key] = value;
-            continue;
-        }
-        if (Array.isArray(existing)) {
-            result[key] = [...existing, value];
-            continue;
-        }
-        result[key] = [existing, value];
+        return parseHardenedQueryString(undefined);
     }
-    return result;
+    const hashIndex = url.indexOf("#", queryIndex + 1);
+    return parseHardenedQueryString(url.slice(queryIndex + 1, hashIndex === -1 ? undefined : hashIndex));
 }
 /* -------------------------------------------------------------------------- */
 /* Method                                                                     */

package/dist/httpRequest/httpRequest.context.d.ts

@@ -117,6 +117,13 @@ export declare function runWithRequestContext<T>(context: HttpRequestContext, ca
 export declare function getCurrentRequestContext(): HttpRequestContext | undefined;
 export declare function assertRequestContext(context: HttpRequestContext | undefined | null): asserts context is HttpRequestContext;
 export declare function isRequestContext(value: unknown): value is HttpRequestContext;
+/**
+ * Returns the canonical path of a request-target. An origin-form target such
+ * as `//host/admin` stays a path; it is never parsed as an authority.
+ */
 export declare function getPathname(url: string): string;
+/**
+ * Returns the search parameters of a request-target.
+ */
 export declare function getSearchParams(url: string): URLSearchParams;
 //# sourceMappingURL=httpRequest.context.d.ts.map

package/dist/httpRequest/httpRequest.context.js

@@ -7,6 +7,8 @@
  * The context is intentionally framework-agnostic so adapters can populate it
  * from Node.js, Bun, Deno, or another HTTP runtime.
  */
+import { AsyncLocalStorage } from "node:async_hooks";
+import { parseRequestTarget } from "./target/httpRequest.target.js";
 /* -------------------------------------------------------------------------- */
 /* Constants                                                                  */
 /* -------------------------------------------------------------------------- */
@@ -98,7 +100,11 @@ export class HttpRequestContext {
     /* Query                                                                    */
     /* ------------------------------------------------------------------------ */
     get query() {
-        return Object.freeze(Object.fromEntries(this.queryMap));
+        const query = Object.create(null);
+        for (const [name, value] of this.queryMap) {
+            query[name] = value;
+        }
+        return Object.freeze(query);
     }
     hasQuery(name) {
         return this.queryMap.has(name);
@@ -326,24 +332,18 @@ export function isRequestContext(value) {
 /* -------------------------------------------------------------------------- */
 /* URL Helpers                                                                */
 /* -------------------------------------------------------------------------- */
+/**
+ * Returns the canonical path of a request-target. An origin-form target such
+ * as `//host/admin` stays a path; it is never parsed as an authority.
+ */
 export function getPathname(url) {
-    try {
-        const parsed = new URL(url, "http://zudojs.invalid");
-        return parsed.pathname || "/";
-    }
-    catch {
-        const pathname = url.split("?", 1)[0];
-        return pathname || "/";
-    }
+    return parseRequestTarget(url).pathname || "/";
 }
+/**
+ * Returns the search parameters of a request-target.
+ */
 export function getSearchParams(url) {
-    try {
-        return new URL(url, "http://zudojs.invalid").searchParams;
-    }
-    catch {
-        const query = url.includes("?") ? url.slice(url.indexOf("?") + 1) : "";
-        return new URLSearchParams(query);
-    }
+    return parseRequestTarget(url).searchParams;
 }
 /* -------------------------------------------------------------------------- */
 /* Internal Helpers                                                           */
@@ -379,24 +379,16 @@ function validateHeaderValue(value) {
         throw new TypeError("HTTP header value cannot contain CR or LF characters.");
     }
 }
+/**
+ * Builds the request-context store.
+ *
+ * `AsyncLocalStorage` used to be reached through `globalThis.require`, which
+ * does not exist in ESM under Node. The `typeof` guard turned that into a
+ * silent `undefined`, so `runWithRequestContext` merely called its callback
+ * and `getCurrentRequestContext` always returned `undefined`. It is imported
+ * statically now, as the rest of the package imports its Node built-ins.
+ */
 function createAsyncContextStorage() {
-    /*
-     * AsyncLocalStorage is intentionally loaded lazily so the HTTP package
-     * remains usable in browser and non-Node runtimes.
-     */
-    try {
-        const runtimeRequire = globalThis.require;
-        if (typeof runtimeRequire !== "function") {
-            return undefined;
-        }
-        const asyncHooks = runtimeRequire("node:async_hooks");
-        if (!asyncHooks.AsyncLocalStorage) {
-            return undefined;
-        }
-        return new asyncHooks.AsyncLocalStorage();
-    }
-    catch {
-        return undefined;
-    }
+    return new AsyncLocalStorage();
 }
 //# sourceMappingURL=httpRequest.context.js.map

package/dist/httpRequest/index.d.ts

@@ -5,4 +5,5 @@
  */
 export * from "./http.request.js";
 export * from "./httpRequest.context.js";
+export * from "./target/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpRequest/index.js

@@ -5,4 +5,5 @@
  */
 export * from "./http.request.js";
 export * from "./httpRequest.context.js";
+export * from "./target/index.js";
 //# sourceMappingURL=index.js.map

package/dist/httpRequest/target/httpRequest.target.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Canonical request-target parsing.
+ *
+ * Every place that derives a path or query from `request.url` (the request
+ * context, the router, path-scoped middleware, static files) parses it here,
+ * so routing and middleware can never disagree about which path a request
+ * addresses.
+ *
+ * `new URL(target, base)` is the wrong tool for an origin-form target:
+ * `//evil/admin` is read as a scheme-relative URL with authority `evil`, so
+ * the path silently became `/admin` while `request.url` still said
+ * `//evil/admin`. Prefixing the base as a string keeps an origin-form target
+ * a path.
+ *
+ * @module httpRequest/target
+ */
+/**
+ * Parses a request-target (origin-form, absolute-form or `*`) into a URL.
+ *
+ * An origin-form target is never parsed as an authority, and repeated slashes
+ * in the path are collapsed. Unparseable input yields the root URL.
+ */
+export declare function parseRequestTarget(target: string): URL;
+/**
+ * Returns the canonical path of a request-target.
+ */
+export declare function getCanonicalPath(target: string): string;
+/**
+ * Explains why a request-target is refused, or returns `undefined` when it is
+ * acceptable.
+ *
+ * Refused: anything that is not origin-form, absolute-form (`http(s)://`) or
+ * the asterisk-form `*`; a backslash (WHATWG URL parsing treats it as a
+ * separator); and any `.` / `..` segment, plain or percent-encoded
+ * (`%2e%2e`). Those segments are resolved away by URL parsing, so a front
+ * proxy matching `/admin*` on the raw target and the router dispatching on
+ * the resolved path would otherwise disagree about the same request.
+ */
+export declare function findRequestTargetViolation(target: string): string | undefined;
+/**
+ * Whether a request-target is acceptable (see
+ * {@link findRequestTargetViolation}).
+ */
+export declare function isCanonicalRequestTarget(target: string): boolean;
+//# sourceMappingURL=httpRequest.target.d.ts.map

package/dist/httpRequest/target/httpRequest.target.js

@@ -0,0 +1,111 @@
+/**
+ * Canonical request-target parsing.
+ *
+ * Every place that derives a path or query from `request.url` (the request
+ * context, the router, path-scoped middleware, static files) parses it here,
+ * so routing and middleware can never disagree about which path a request
+ * addresses.
+ *
+ * `new URL(target, base)` is the wrong tool for an origin-form target:
+ * `//evil/admin` is read as a scheme-relative URL with authority `evil`, so
+ * the path silently became `/admin` while `request.url` still said
+ * `//evil/admin`. Prefixing the base as a string keeps an origin-form target
+ * a path.
+ *
+ * @module httpRequest/target
+ */
+const TARGET_BASE = "http://zudojs.invalid";
+const ABSOLUTE_FORM = /^https?:\/\//i;
+const ENCODED_DOT = /%2e/gi;
+const REPEATED_SLASH = /\/{2,}/g;
+/**
+ * Collapses repeated slashes in a parsed target's path.
+ *
+ * The router normalises `/{2,}` away before matching, while the request
+ * context kept them, so `//admin/secret` dispatched to the route registered
+ * at `/admin/secret` while a guard reading `request.path` saw a path that did
+ * not start with `/admin/`. Both sides parse here, so collapsing once here
+ * keeps them in agreement. The query and fragment are untouched.
+ */
+function collapsePathSlashes(url) {
+    if (!url.pathname.includes("//")) {
+        return url;
+    }
+    const collapsed = new URL(url.href);
+    collapsed.pathname = url.pathname.replace(REPEATED_SLASH, "/");
+    return collapsed;
+}
+/**
+ * Parses a request-target (origin-form, absolute-form or `*`) into a URL.
+ *
+ * An origin-form target is never parsed as an authority, and repeated slashes
+ * in the path are collapsed. Unparseable input yields the root URL.
+ */
+export function parseRequestTarget(target) {
+    try {
+        if (target.startsWith("/")) {
+            return collapsePathSlashes(new URL(`${TARGET_BASE}${target}`));
+        }
+        if (ABSOLUTE_FORM.test(target)) {
+            return collapsePathSlashes(new URL(target));
+        }
+        return collapsePathSlashes(new URL(`${TARGET_BASE}/${target === "*" ? "" : target}`));
+    }
+    catch {
+        return new URL(`${TARGET_BASE}/`);
+    }
+}
+/**
+ * Returns the canonical path of a request-target.
+ */
+export function getCanonicalPath(target) {
+    return parseRequestTarget(target).pathname || "/";
+}
+function rawPathOf(target) {
+    let path = target;
+    if (ABSOLUTE_FORM.test(path)) {
+        const afterScheme = path.indexOf("//") + 2;
+        const slash = path.indexOf("/", afterScheme);
+        path = slash === -1 ? "/" : path.slice(slash);
+    }
+    const end = path.search(/[?#]/);
+    return end === -1 ? path : path.slice(0, end);
+}
+/**
+ * Explains why a request-target is refused, or returns `undefined` when it is
+ * acceptable.
+ *
+ * Refused: anything that is not origin-form, absolute-form (`http(s)://`) or
+ * the asterisk-form `*`; a backslash (WHATWG URL parsing treats it as a
+ * separator); and any `.` / `..` segment, plain or percent-encoded
+ * (`%2e%2e`). Those segments are resolved away by URL parsing, so a front
+ * proxy matching `/admin*` on the raw target and the router dispatching on
+ * the resolved path would otherwise disagree about the same request.
+ */
+export function findRequestTargetViolation(target) {
+    if (target === "*") {
+        return undefined;
+    }
+    if (!target.startsWith("/") && !ABSOLUTE_FORM.test(target)) {
+        return "Request target is not in origin-form or absolute-form.";
+    }
+    const path = rawPathOf(target);
+    if (path.includes("\\")) {
+        return "Request target contains a backslash.";
+    }
+    for (const segment of path.split("/")) {
+        const decoded = segment.replace(ENCODED_DOT, ".");
+        if (decoded === "." || decoded === "..") {
+            return "Request target contains a dot segment.";
+        }
+    }
+    return undefined;
+}
+/**
+ * Whether a request-target is acceptable (see
+ * {@link findRequestTargetViolation}).
+ */
+export function isCanonicalRequestTarget(target) {
+    return findRequestTargetViolation(target) === undefined;
+}
+//# sourceMappingURL=httpRequest.target.js.map

package/dist/httpRequest/target/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @zudojs/http/httpRequest/target
+ *
+ * Canonical request-target parsing shared by the request context, router and
+ * path-scoped middleware, plus the dot-segment / non-origin-form check the
+ * Node adapter applies before a request is dispatched.
+ */
+export * from "./httpRequest.target.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpRequest/target/index.js

@@ -0,0 +1,9 @@
+/**
+ * @zudojs/http/httpRequest/target
+ *
+ * Canonical request-target parsing shared by the request context, router and
+ * path-scoped middleware, plus the dot-segment / non-origin-form check the
+ * Node adapter applies before a request is dispatched.
+ */
+export * from "./httpRequest.target.js";
+//# sourceMappingURL=index.js.map

package/dist/httpResponse/httpResponse.helper.js

@@ -3,6 +3,7 @@
  *
  * @module httpResponse/helpers
  */
+import { withSecureCookieDefaults } from "../httpCookies/httpCookies.defaults.js";
 import { assertSafeRedirect } from "../httpRedirect/http.redirect.js";
 /**
  * Creates a JSON response.
@@ -110,7 +111,7 @@ export function serializeResponseCookie(cookie) {
     if (!name || !COOKIE_NAME_TOKEN.test(name)) {
         throw new TypeError(`Invalid cookie name: ${JSON.stringify(name)}`);
     }
-    const opts = cookie.options ?? {};
+    const opts = withSecureCookieDefaults(cookie.options, "Lax");
     if (name.startsWith("__Host-")) {
         if (!opts.secure) {
             throw new TypeError("A __Host- cookie requires the Secure attribute.");

package/dist/httpRouter/core/factory/httpRoute.factory.base.d.ts

@@ -9,7 +9,18 @@ import { type HttpResponseContext as ResponseContext } from "../../../httpRespon
 export declare function normalizeMethod(method: string): HttpMethod | "*";
 export declare function normalizeMethods(method: HttpMethod | readonly HttpMethod[] | "*"): readonly (HttpMethod | "*")[];
 export declare function isHttpMethod(value: string): value is HttpMethod;
-export declare function collectAllowedMethods(routes: readonly CompiledRoute[], path: string): HttpMethod[];
+/**
+ * Collects the methods registered for a path.
+ *
+ * @param routes - The compiled routes to consider.
+ * @param path - The request path.
+ * @param caseSensitive - The router's case sensitivity. This used to be
+ *   hardcoded to `false`, so a case-sensitive router advertised `Allow`
+ *   methods belonging to a route that only differed by case — a method the
+ *   client would then get a 404 from, and a disclosure of the other route.
+ * @returns The allowed methods, with `HEAD` implied by `GET`.
+ */
+export declare function collectAllowedMethods(routes: readonly CompiledRoute[], path: string, caseSensitive?: boolean): HttpMethod[];
 /**
  * Extracts the monotonic registration sequence from a generated route id.
  *
@@ -39,6 +50,12 @@ export declare function defaultNotFoundHandler(context: HttpRouterRequestContext
 export declare function defaultMethodNotAllowedHandler(context: HttpRouterRequestContext, allowedMethods: readonly HttpMethod[]): ResponseContext;
 /**
  * Runs a matched route's middleware chain followed by its handler.
+ *
+ * Every result is folded into the ambient response context
+ * (`context.middleware.response`), which is the object route middleware
+ * writes to. Returning the handler's brand new response instead — as this
+ * used to — silently discarded every header, cookie and status a route
+ * middleware had set before calling `next()`.
  */
 export declare function executeRoute(route: MatchedRoute, context: HttpRouterContext): Promise<ResponseContext>;
 //# sourceMappingURL=httpRoute.factory.base.d.ts.map

package/dist/httpRouter/core/factory/httpRoute.factory.base.js

@@ -36,10 +36,21 @@ export function isHttpMethod(value) {
         value === "CONNECT" ||
         value === "TRACE");
 }
-export function collectAllowedMethods(routes, path) {
+/**
+ * Collects the methods registered for a path.
+ *
+ * @param routes - The compiled routes to consider.
+ * @param path - The request path.
+ * @param caseSensitive - The router's case sensitivity. This used to be
+ *   hardcoded to `false`, so a case-sensitive router advertised `Allow`
+ *   methods belonging to a route that only differed by case — a method the
+ *   client would then get a 404 from, and a disclosure of the other route.
+ * @returns The allowed methods, with `HEAD` implied by `GET`.
+ */
+export function collectAllowedMethods(routes, path, caseSensitive = false) {
     const methods = new Set();
     for (const route of routes) {
-        if (!matchCompiledRoute(route, path, false)) {
+        if (!matchCompiledRoute(route, path, caseSensitive)) {
             continue;
         }
         if (isHttpMethod(route.definition.method)) {
@@ -153,11 +164,43 @@ export function defaultMethodNotAllowedHandler(context, allowedMethods) {
 /* -------------------------------------------------------------------------- */
 /* Route Execution                                                            */
 /* -------------------------------------------------------------------------- */
+/**
+ * Merges one response context into another.
+ *
+ * Status, status text, headers, cookies, metadata and body are all carried
+ * over, so nothing a handler produced is lost.
+ *
+ * @param target - The response that stays authoritative.
+ * @param source - The response to fold into it.
+ * @returns The target response.
+ */
+function mergeRouteResponse(target, source) {
+    if (source === target) {
+        return target;
+    }
+    target.setStatus(source.status, source.statusText);
+    target.headers_obj(source.headers);
+    for (const cookie of source.cookies) {
+        target.setCookie(cookie);
+    }
+    for (const [key, value] of Object.entries(source.metadata)) {
+        target.setMetadata(key, value);
+    }
+    target.setBody(source.body);
+    return target;
+}
 /**
  * Runs a matched route's middleware chain followed by its handler.
+ *
+ * Every result is folded into the ambient response context
+ * (`context.middleware.response`), which is the object route middleware
+ * writes to. Returning the handler's brand new response instead — as this
+ * used to — silently discarded every header, cookie and status a route
+ * middleware had set before calling `next()`.
  */
 export async function executeRoute(route, context) {
     const layers = route.middleware;
+    const ambient = context.middleware.response;
     let invoked = -1;
     const run = async (index) => {
         if (index <= invoked) {
@@ -166,7 +209,7 @@ export async function executeRoute(route, context) {
         invoked = index;
         const layer = layers[index];
         if (layer === undefined) {
-            return normalizeResponse(await route.handler(context));
+            return mergeRouteResponse(ambient, await normalizeResponse(await route.handler(context)));
         }
         let downstream;
         const result = await layer(context.middleware, async () => {
@@ -174,12 +217,12 @@ export async function executeRoute(route, context) {
             return downstream;
         });
         if (result instanceof HttpResponseContext) {
-            return result;
+            return mergeRouteResponse(ambient, result);
         }
         if (typeof Response !== "undefined" && result instanceof Response) {
-            return normalizeResponse(result);
+            return mergeRouteResponse(ambient, await normalizeResponse(result));
         }
-        return downstream ?? context.middleware.response;
+        return downstream ?? ambient;
     };
     return run(0);
 }

package/dist/httpRouter/core/factory/httpRoute.factory.js

@@ -4,7 +4,7 @@
 import { HttpRouter } from "../register/httpRouter.register.js";
 import { HttpRouterGroup } from "../group/httpRouterGroup.core.js";
 import { RouteConflictError, InvalidRoutePatternError, } from "../error/httpRouter.error.js";
-import { normalizePath } from "../util/httpRoute.util.js";
+import { normalizeRoutePattern } from "../util/httpRoute.util.js";
 /**
  * Creates a new HTTP router instance.
  */
@@ -17,7 +17,7 @@ export function createRouter(options = {}) {
 export function createRoute(definition) {
     return {
         ...definition,
-        path: normalizePath(definition.path),
+        path: normalizeRoutePattern(definition.path),
         middleware: Object.freeze([...(definition.middleware ?? [])]),
         metadata: Object.freeze({ ...(definition.metadata ?? {}) }),
     };
@@ -26,7 +26,7 @@ export function createRoute(definition) {
  * Builds a route path from a pattern and parameters.
  */
 export function buildRoutePath(pattern, params = {}) {
-    const normalized = normalizePath(pattern);
+    const normalized = normalizeRoutePattern(pattern);
     return normalized
         .replace(/:([a-zA-Z_][a-zA-Z0-9_-]*)(\?)?/g, (_match, name, optional) => {
         const value = params[name];