@zudojs/http 1.1.0 → 1.3.0

package/dist/httpRouter/pattern/httpRoute.pattern.parse.d.ts

@@ -20,6 +20,7 @@ export interface CompiledRoutePath {
     readonly segments: readonly CompiledSegment[];
     readonly score: number;
     readonly strictTrailingSlash: boolean;
+    readonly expectsTrailingSlash: boolean;
 }
 /**
  * Compiles a route path into its segments.
@@ -35,4 +36,19 @@ export declare function compileRoute(path: string, strictTrailingSlash: boolean)
  * Scores compiled segments by specificity.
  */
 export declare function scoreSegments(segments: readonly CompiledSegment[]): number;
+/**
+ * Compares two compiled patterns by specificity, most specific first.
+ *
+ * Segments are compared left to right by kind (literal, then parameter, then
+ * wildcard), which is how a router is expected to rank patterns. Summing the
+ * kinds into one scalar — as this used to — let a longer but entirely
+ * parameterised pattern such as `/:p/:q/:r/:s` outrank a literal-anchored
+ * `/admin/*rest`, so a request to `/admin/a/b/c` bypassed the admin route and
+ * every guard registered on it.
+ *
+ * @param left - The first pattern's segments.
+ * @param right - The second pattern's segments.
+ * @returns A negative number when `left` is more specific.
+ */
+export declare function compareSegmentSpecificity(left: readonly CompiledSegment[], right: readonly CompiledSegment[]): number;
 //# sourceMappingURL=httpRoute.pattern.parse.d.ts.map

package/dist/httpRouter/pattern/httpRoute.pattern.parse.js

@@ -13,7 +13,7 @@
  * - `/assets/*path`         trailing wildcard
  */
 import { InvalidRoutePatternError } from "../core/error/httpRouter.error.js";
-import { splitPath, validateParameterName, } from "../core/util/httpRoute.util.js";
+import { hasTrailingSlash, splitRoutePattern, validateParameterName, } from "../core/util/httpRoute.util.js";
 const SEGMENT_SCORE_LITERAL = 3;
 const SEGMENT_SCORE_PARAMETER = 2;
 const SEGMENT_SCORE_WILDCARD = 1;
@@ -22,7 +22,7 @@ const SEGMENT_SCORE_WILDCARD = 1;
  */
 export function compileRouteSegments(path) {
     const segments = [];
-    const parts = splitPath(path);
+    const parts = splitRoutePattern(path);
     for (const part of parts) {
         if (part.startsWith(":")) {
             segments.push(parseParameter(part, path));
@@ -56,6 +56,7 @@ export function compileRoute(path, strictTrailingSlash) {
         segments,
         score: scoreSegments(segments),
         strictTrailingSlash,
+        expectsTrailingSlash: hasTrailingSlash(path),
     });
 }
 /**
@@ -64,18 +65,46 @@ export function compileRoute(path, strictTrailingSlash) {
 export function scoreSegments(segments) {
     let score = 0;
     for (const segment of segments) {
-        if (segment.type === "literal") {
-            score += SEGMENT_SCORE_LITERAL;
-        }
-        else if (segment.type === "parameter") {
-            score += SEGMENT_SCORE_PARAMETER;
-        }
-        else {
-            score += SEGMENT_SCORE_WILDCARD;
-        }
+        score += segmentScore(segment);
     }
     return score;
 }
+function segmentScore(segment) {
+    if (segment === undefined) {
+        return 0;
+    }
+    if (segment.type === "literal") {
+        return SEGMENT_SCORE_LITERAL;
+    }
+    if (segment.type === "parameter") {
+        return SEGMENT_SCORE_PARAMETER;
+    }
+    return SEGMENT_SCORE_WILDCARD;
+}
+/**
+ * Compares two compiled patterns by specificity, most specific first.
+ *
+ * Segments are compared left to right by kind (literal, then parameter, then
+ * wildcard), which is how a router is expected to rank patterns. Summing the
+ * kinds into one scalar — as this used to — let a longer but entirely
+ * parameterised pattern such as `/:p/:q/:r/:s` outrank a literal-anchored
+ * `/admin/*rest`, so a request to `/admin/a/b/c` bypassed the admin route and
+ * every guard registered on it.
+ *
+ * @param left - The first pattern's segments.
+ * @param right - The second pattern's segments.
+ * @returns A negative number when `left` is more specific.
+ */
+export function compareSegmentSpecificity(left, right) {
+    const length = Math.max(left.length, right.length);
+    for (let index = 0; index < length; index += 1) {
+        const difference = segmentScore(right[index]) - segmentScore(left[index]);
+        if (difference !== 0) {
+            return difference;
+        }
+    }
+    return 0;
+}
 function parseParameter(segment, path) {
     let value = segment.slice(1);
     let optional = false;

package/dist/httpRouter/pattern/index.d.ts

@@ -14,6 +14,6 @@ export { parseSegments } from "./core/httpPattern.segmentParsing.js";
 export { buildRegex } from "./core/httpPattern.regexBuilding.js";
 export { testRoutePattern, matchRoutePattern, matchRoutePatterns, testRoutePatterns, } from "./core/httpPattern.matching.js";
 export { createRoutePattern, createStrictRoutePattern, createCaseInsensitiveRoutePattern, } from "./httpPattern.factory.js";
-export { compileRoute, compileRouteSegments, scoreSegments, } from "./httpRoute.pattern.parse.js";
+export { compileRoute, compileRouteSegments, scoreSegments, compareSegmentSpecificity, } from "./httpRoute.pattern.parse.js";
 export type { CompiledRoutePath } from "./httpRoute.pattern.parse.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpRouter/pattern/index.js

@@ -13,5 +13,5 @@ export { parseSegments } from "./core/httpPattern.segmentParsing.js";
 export { buildRegex } from "./core/httpPattern.regexBuilding.js";
 export { testRoutePattern, matchRoutePattern, matchRoutePatterns, testRoutePatterns, } from "./core/httpPattern.matching.js";
 export { createRoutePattern, createStrictRoutePattern, createCaseInsensitiveRoutePattern, } from "./httpPattern.factory.js";
-export { compileRoute, compileRouteSegments, scoreSegments, } from "./httpRoute.pattern.parse.js";
+export { compileRoute, compileRouteSegments, scoreSegments, compareSegmentSpecificity, } from "./httpRoute.pattern.parse.js";
 //# sourceMappingURL=index.js.map

package/dist/httpSecurity/httpSecurity.config.d.ts

@@ -26,6 +26,12 @@ export interface HTTPSecurityConfig {
     readonly maxQueryLength?: number;
     /** Allowed Host header values. Empty = allow all. */
     readonly allowedHosts?: readonly string[];
+    /**
+     * Whether a request without a Host header is rejected (default: true).
+     * The Node adapter relaxes this for HTTP/1.0 requests, where Host is
+     * optional and some load-balancer health checks omit it.
+     */
+    readonly requireHost?: boolean;
     /**
      * Whether `X-Forwarded-*` headers may be trusted (default: `false`).
      *

package/dist/httpSecurity/httpSecurity.config.js

@@ -20,6 +20,7 @@ export const DEFAULT_SECURITY_CONFIG = Object.freeze({
     maxUrlLength: 2048,
     maxQueryLength: 4096,
     allowedHosts: [],
+    requireHost: true,
     trustProxy: false,
     maxRequestIdLength: 128,
     requestIdPattern: /^[a-zA-Z0-9_-]+$/,

package/dist/httpSecurity/httpSecurity.guard.d.ts

@@ -5,6 +5,7 @@
  * first security boundary. Rejects malformed, oversized, or
  * suspicious requests before they reach the router.
  */
+import { HttpRequestGuardError } from "@zudojs/errors";
 import type { HTTPSecurityConfig } from "./httpSecurity.config.js";
 /** A request-like object for validation (keeps the guard decoupled from HTTP types). */
 export interface GuardableRequest {
@@ -39,16 +40,13 @@ export declare function guardRequest(request: GuardableRequest, config?: Partial
  */
 export declare function createRequestGuard(config?: Partial<HTTPSecurityConfig>): (request: GuardableRequest) => GuardResult;
 /**
- * Error thrown by {@link assertRequestAllowed}.
- *
- * Carries the status the response should use and the individual validation
- * failures, so a caller can log the detail without returning it to the client.
+ * Error thrown by {@link assertRequestAllowed}: the shared
+ * `HttpRequestGuardError` from `@zudojs/errors` (a `BaseError`, code
+ * `HTTP_REQUEST_REJECTED`, not exposed). It carries the status the response
+ * should use and the individual validation failures, so a caller can log
+ * the detail without returning it to the client.
  */
-export declare class HttpRequestGuardError extends Error {
-    readonly statusCode: number;
-    readonly errors: readonly string[];
-    constructor(result: GuardResult);
-}
+export { HttpRequestGuardError };
 /**
  * Runs the guard and throws {@link HttpRequestGuardError} when the request is
  * rejected.

package/dist/httpSecurity/httpSecurity.guard.js

@@ -5,6 +5,7 @@
  * first security boundary. Rejects malformed, oversized, or
  * suspicious requests before they reach the router.
  */
+import { HttpRequestGuardError } from "@zudojs/errors";
 import { validateHeaders, validateHost, validateUrl, validateQuery, validateContentLength, validateRequestId, validateTransferEncoding, } from "./httpSecurity.validator.js";
 /**
  * Run all security validations against an incoming request.
@@ -52,21 +53,13 @@ export function createRequestGuard(config) {
     return (request) => guardRequest(request, config);
 }
 /**
- * Error thrown by {@link assertRequestAllowed}.
- *
- * Carries the status the response should use and the individual validation
- * failures, so a caller can log the detail without returning it to the client.
+ * Error thrown by {@link assertRequestAllowed}: the shared
+ * `HttpRequestGuardError` from `@zudojs/errors` (a `BaseError`, code
+ * `HTTP_REQUEST_REJECTED`, not exposed). It carries the status the response
+ * should use and the individual validation failures, so a caller can log
+ * the detail without returning it to the client.
  */
-export class HttpRequestGuardError extends Error {
-    statusCode;
-    errors;
-    constructor(result) {
-        super(`Request rejected by security guard: ${result.errors.join("; ")}`);
-        this.name = "HttpRequestGuardError";
-        this.statusCode = result.statusCode;
-        this.errors = result.errors;
-    }
-}
+export { HttpRequestGuardError };
 /**
  * Runs the guard and throws {@link HttpRequestGuardError} when the request is
  * rejected.

package/dist/httpSecurity/httpSecurity.nodeGuard.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Request guard wiring for the Node adapter.
+ *
+ * `guardRequest` (Host, request-ID, header-count, header-size, URL/query
+ * length and `Transfer-Encoding`/`Content-Length` checks) had no call site,
+ * so every one of those checks was inert unless an application wired it by
+ * hand. The Node adapter now runs it on every request before the request
+ * context is built or the body is read, and answers `400` when it refuses.
+ *
+ * @module httpSecurity/nodeGuard
+ */
+import type { IncomingMessage } from "node:http";
+import type { HTTPSecurityConfig } from "./httpSecurity.config.js";
+import { type GuardResult } from "./httpSecurity.guard.js";
+/**
+ * The adapter's `security` option.
+ *
+ * - `true` / omitted (default): run the guard with its defaults.
+ * - an object: run the guard with that configuration.
+ * - `false`: do not run the guard.
+ */
+export type NodeAdapterSecurityOption = boolean | Partial<HTTPSecurityConfig>;
+/**
+ * Adapter options contributed by the request guard.
+ */
+export interface NodeAdapterSecurityOptions {
+    /**
+     * Request guard applied before dispatch (on by default). See
+     * {@link NodeAdapterSecurityOption}.
+     *
+     * The guard's `maxBodySize` defaults to "no limit" here so the adapter's own
+     * `maxBodySize` keeps answering oversized bodies with `413`; set it
+     * explicitly to have the guard refuse a too-large `Content-Length` with
+     * `400` before any body is read. `requireHost` defaults to `true` except for
+     * HTTP/1.0 requests, where Host is optional.
+     */
+    readonly security?: NodeAdapterSecurityOption;
+}
+/**
+ * A per-request guard for Node requests.
+ */
+export type NodeRequestGuard = (request: IncomingMessage) => GuardResult;
+/**
+ * Builds the guard the adapter runs on each request, or `undefined` when the
+ * guard is disabled with `security: false`.
+ */
+export declare function createNodeRequestGuard(option: NodeAdapterSecurityOption | undefined): NodeRequestGuard | undefined;
+//# sourceMappingURL=httpSecurity.nodeGuard.d.ts.map

package/dist/httpSecurity/httpSecurity.nodeGuard.js

@@ -0,0 +1,32 @@
+/**
+ * Request guard wiring for the Node adapter.
+ *
+ * `guardRequest` (Host, request-ID, header-count, header-size, URL/query
+ * length and `Transfer-Encoding`/`Content-Length` checks) had no call site,
+ * so every one of those checks was inert unless an application wired it by
+ * hand. The Node adapter now runs it on every request before the request
+ * context is built or the body is read, and answers `400` when it refuses.
+ *
+ * @module httpSecurity/nodeGuard
+ */
+import { guardRequest, } from "./httpSecurity.guard.js";
+/**
+ * Builds the guard the adapter runs on each request, or `undefined` when the
+ * guard is disabled with `security: false`.
+ */
+export function createNodeRequestGuard(option) {
+    if (option === false) {
+        return undefined;
+    }
+    const configured = typeof option === "object" ? option : {};
+    return (request) => guardRequest({
+        method: request.method ?? "GET",
+        url: request.url ?? "/",
+        headers: request.headers,
+    }, {
+        maxBodySize: Number.MAX_SAFE_INTEGER,
+        requireHost: request.httpVersion !== "1.0",
+        ...configured,
+    });
+}
+//# sourceMappingURL=httpSecurity.nodeGuard.js.map

package/dist/httpSecurity/httpSecurity.validator.js

@@ -20,14 +20,23 @@ export function validateHeaders(headers, config) {
     if (entries.length > cfg.maxHeaders) {
         errors.push(`Too many headers: ${entries.length} > ${cfg.maxHeaders}`);
     }
+    /*
+     * `IncomingMessage.headers` returns an array for `set-cookie` and for any
+     * header a non-Node caller supplies as a list. Checking only `typeof value
+     * === "string"` let every one of those values past the size cap and the
+     * CRLF filter while the guard still reported `allowed: true`.
+     */
     for (const [key, value] of entries) {
-        if (typeof value === "string" && value.length > cfg.maxHeaderValueSize) {
-            errors.push(`Header "${key}" value too large: ${value.length} > ${cfg.maxHeaderValueSize}`);
-        }
-        if (cfg.enableCrlfProtection &&
-            typeof value === "string" &&
-            /[\r\n]/.test(value)) {
-            errors.push(`Header "${key}" contains CRLF characters`);
+        for (const element of Array.isArray(value) ? value : [value]) {
+            if (typeof element !== "string") {
+                continue;
+            }
+            if (element.length > cfg.maxHeaderValueSize) {
+                errors.push(`Header "${key}" value too large: ${element.length} > ${cfg.maxHeaderValueSize}`);
+            }
+            if (cfg.enableCrlfProtection && /[\r\n]/.test(element)) {
+                errors.push(`Header "${key}" contains CRLF characters`);
+            }
         }
     }
     return { valid: errors.length === 0, errors };
@@ -36,10 +45,12 @@ export function validateHeaders(headers, config) {
  * Validate the Host header against allowed hosts.
  */
 export function validateHost(host, config) {
+    const cfg = resolveConfig(config);
     if (!host) {
-        return { valid: false, errors: ["Missing Host header"] };
+        return cfg.requireHost
+            ? { valid: false, errors: ["Missing Host header"] }
+            : { valid: true, errors: [] };
     }
-    const cfg = resolveConfig(config);
     if (cfg.allowedHosts.length === 0) {
         return { valid: true, errors: [] };
     }

package/dist/httpSecurity/index.d.ts

@@ -11,4 +11,6 @@ export type { SecurityValidationResult } from "./httpSecurity.validator.js";
 export { validateHeaders, validateHost, validateUrl, validateQuery, validateContentLength, validateRequestId, validateTransferEncoding, } from "./httpSecurity.validator.js";
 export type { GuardableRequest, GuardResult } from "./httpSecurity.guard.js";
 export { guardRequest, createRequestGuard, assertRequestAllowed, HttpRequestGuardError, } from "./httpSecurity.guard.js";
+export type { NodeAdapterSecurityOption, NodeAdapterSecurityOptions, NodeRequestGuard, } from "./httpSecurity.nodeGuard.js";
+export { createNodeRequestGuard } from "./httpSecurity.nodeGuard.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpSecurity/index.js

@@ -8,4 +8,5 @@
 export { DEFAULT_SECURITY_CONFIG } from "./httpSecurity.config.js";
 export { validateHeaders, validateHost, validateUrl, validateQuery, validateContentLength, validateRequestId, validateTransferEncoding, } from "./httpSecurity.validator.js";
 export { guardRequest, createRequestGuard, assertRequestAllowed, HttpRequestGuardError, } from "./httpSecurity.guard.js";
+export { createNodeRequestGuard } from "./httpSecurity.nodeGuard.js";
 //# sourceMappingURL=index.js.map

package/dist/httpServer/core/httpServer.core.d.ts

@@ -45,6 +45,12 @@ export declare class HttpServer {
     close(): Promise<this>;
     setHandler(handler: HttpHandler): this;
     setErrorHandler(handler: HttpErrorHandler): this;
+    /**
+     * Installs `handler` on the adapter, wrapped so every dispatch is counted
+     * (`requests`, `onRequest`) and its completion reported (`onResponse`).
+     * Nothing called `recordRequest`/`recordResponse` before, so the counter
+     * and both events stayed at zero.
+     */
     private adapterHandler;
     private adapterErrorHandler;
     recordRequest(): void;
@@ -61,6 +67,11 @@ export declare class HttpServer {
     snapshot(): HttpServerSnapshot;
     toJSON(): HttpServerSnapshot;
     private performStart;
+    /**
+     * The adapter is told the shutdown timeout as its grace period, so
+     * in-flight requests get the documented `gracefulShutdownTimeout` rather
+     * than the Node adapter's hidden 10 s default.
+     */
     private performStop;
     private refreshAddress;
 }

package/dist/httpServer/core/httpServer.core.js

@@ -6,6 +6,7 @@
 import { isHttpAdapter, startAdapter, stopAdapter, } from "../../httpAdapter/http.adapter.js";
 import { HttpServerLifecycleError, InvalidHttpServerStateError, HttpServerStartError, HttpServerStopError, } from "@zudojs/errors";
 import { withTimeout, validateShutdownTimeout, } from "../factory/httpServer.factory.js";
+const SHUTDOWN_CLOSE_MARGIN_MS = 1_000;
 export class HttpServer {
     name;
     adapter;
@@ -170,7 +171,22 @@ export class HttpServer {
         this.adapterErrorHandler(handler);
         return this;
     }
-    adapterHandler(handler) {
+    /**
+     * Installs `handler` on the adapter, wrapped so every dispatch is counted
+     * (`requests`, `onRequest`) and its completion reported (`onResponse`).
+     * Nothing called `recordRequest`/`recordResponse` before, so the counter
+     * and both events stayed at zero.
+     */
+    adapterHandler(application) {
+        const handler = async (request) => {
+            this.recordRequest();
+            try {
+                return await application(request);
+            }
+            finally {
+                this.recordResponse();
+            }
+        };
         const adapter = this.adapter;
         if (typeof adapter.setHandler === "function") {
             adapter.setHandler(handler);
@@ -262,13 +278,23 @@ export class HttpServer {
     async performStart() {
         await startAdapter(this.adapter);
     }
+    /**
+     * The adapter is told the shutdown timeout as its grace period, so
+     * in-flight requests get the documented `gracefulShutdownTimeout` rather
+     * than the Node adapter's hidden 10 s default.
+     */
+    /*
+     * The adapter gets the full timeout as its grace period and then destroys
+     * the remaining sockets; the margin only lets that close complete before
+     * the stop is reported as timed out.
+     */
     async performStop(force, timeout) {
         if (force) {
-            await stopAdapter(this.adapter);
+            await stopAdapter(this.adapter, { graceMs: 0 });
             return;
         }
         try {
-            await withTimeout(stopAdapter(this.adapter), timeout, "HTTP server shutdown timed out.");
+            await withTimeout(stopAdapter(this.adapter, { graceMs: timeout }), timeout + SHUTDOWN_CLOSE_MARGIN_MS, "HTTP server shutdown timed out.");
         }
         catch (error) {
             /*
@@ -277,7 +303,7 @@ export class HttpServer {
              * rebind the port. Escalate to a forced stop before rethrowing.
              */
             try {
-                await stopAdapter(this.adapter);
+                await stopAdapter(this.adapter, { graceMs: 0 });
             }
             catch {
                 /* The original timeout is the more useful error. */

package/dist/httpTrustProxy/httpTrustProxy.compilation.d.ts

@@ -23,10 +23,13 @@ export type TrustProxyPredicate = (value: string, index: number) => boolean;
  * - `"loopback"`, `"linklocal"`, `"uniquelocal"` / `"private"` — named ranges.
  * - an IP address, a CIDR range, a comma-separated list of either, or an array
  *   of the same.
+ * - a hop count `n`: trust the `n` hops nearest the server (the socket peer
+ *   is hop `0`), as Express/`proxy-addr` do. `0` trusts nothing.
  * - a custom predicate `(address, hopIndexFromPeer) => boolean`.
  *
- * Throws `TypeError` on a string that is none of the above rather than
- * returning a predicate that can never match.
+ * Throws `TypeError` on a string that is none of the above, or on a hop
+ * count that is not a non-negative integer, rather than returning a
+ * predicate that can never match.
  */
 export declare function compileTrustProxy(trustProxy: TrustProxy): TrustProxyPredicate;
 //# sourceMappingURL=httpTrustProxy.compilation.d.ts.map

package/dist/httpTrustProxy/httpTrustProxy.compilation.js

@@ -88,10 +88,13 @@ function buildListPredicate(trustProxy) {
  * - `"loopback"`, `"linklocal"`, `"uniquelocal"` / `"private"` — named ranges.
  * - an IP address, a CIDR range, a comma-separated list of either, or an array
  *   of the same.
+ * - a hop count `n`: trust the `n` hops nearest the server (the socket peer
+ *   is hop `0`), as Express/`proxy-addr` do. `0` trusts nothing.
  * - a custom predicate `(address, hopIndexFromPeer) => boolean`.
  *
- * Throws `TypeError` on a string that is none of the above rather than
- * returning a predicate that can never match.
+ * Throws `TypeError` on a string that is none of the above, or on a hop
+ * count that is not a non-negative integer, rather than returning a
+ * predicate that can never match.
  */
 export function compileTrustProxy(trustProxy) {
     if (typeof trustProxy === "function") {
@@ -100,6 +103,9 @@ export function compileTrustProxy(trustProxy) {
     if (trustProxy === true) {
         return () => true;
     }
+    if (typeof trustProxy === "number") {
+        return compileHopCount(trustProxy);
+    }
     /* Anything that is not a string or a list (including `false`, `undefined`
      * and any malformed runtime value) trusts nothing. */
     if (typeof trustProxy !== "string" && !Array.isArray(trustProxy)) {
@@ -116,4 +122,15 @@ export function compileTrustProxy(trustProxy) {
     compilationCache.set(trustProxy, predicate);
     return predicate;
 }
+/**
+ * Hop-count trust. The numeric form was typed and documented ("trust N
+ * proxies") but fell through to "trust nothing", so behind a load balancer
+ * every client shared the balancer's address.
+ */
+function compileHopCount(hops) {
+    if (!Number.isSafeInteger(hops) || hops < 0) {
+        throw new TypeError(`trustProxy hop count must be a non-negative integer, got ${hops}.`);
+    }
+    return (_address, index) => index < hops;
+}
 //# sourceMappingURL=httpTrustProxy.compilation.js.map

package/dist/httpTrustProxy/httpTrustProxy.type.d.ts

@@ -3,7 +3,9 @@
  *
  * @module httpTrustProxy/types
  */
-export type TrustProxy = boolean | "all" | "linklocal" | "loopback" | string | readonly string[] | ((value: string, index: number) => boolean);
+export type TrustProxy = boolean
+/** Hop count: trust the `n` hops nearest the server (the peer is hop 0). */
+ | number | "all" | "linklocal" | "loopback" | string | readonly string[] | ((value: string, index: number) => boolean);
 export interface TrustProxyOptions {
     readonly trustProxy?: TrustProxy;
     readonly maxDepth?: number;

package/dist/index.js

@@ -7,7 +7,6 @@
  * TypeScript reports TS2308 (ambiguous re-exports) for these duplicates.
  * This is intentional — consumers can import from either path.
  */
-/* eslint-disable @typescript-eslint/no-explicit-any */
 export * from "./httpProtocol/index.js";
 export * from "./httpTypes/index.js";
 export * from "./httpConstants/index.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/http",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "HTTP primitives, request handling, routing, middleware, and server infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -24,10 +24,10 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/core": "1.1.0",
-    "@zudojs/errors": "1.0.1",
-    "@zudojs/logger": "1.1.0",
-    "@zudojs/security": "1.0.1"
+    "@zudojs/crypto": "1.3.0",
+    "@zudojs/errors": "1.2.0",
+    "@zudojs/logger": "1.3.0",
+    "@zudojs/security": "1.2.0"
   },
   "devDependencies": {
     "@types/node": "^26.4.1",