@zudojs/http 1.2.0 → 1.4.0

package/dist/httpCacheControl/httpCacheControl.freshness.js

@@ -12,24 +12,37 @@ import { parseCacheControl } from "./core/httpCacheControl.parse.js";
  * the origin marked must-revalidate-before-reuse must never be reported
  * fresh.
  *
+ * The response's current age follows RFC 9111 section 4.2.3: the `Age`
+ * header plus the time elapsed since the response's `Date`. Reading `Age`
+ * alone — as this used to — left every response without that header aged
+ * `0` forever, so `isFresh()` answered `true` for a response of any age.
+ *
  * @param responseHeaders - The cached response's headers.
  * @param responseDate - The response's `Date`, if already parsed.
+ * @param now - The current time, defaulting to `Date.now()`.
  * @returns The freshness calculation.
  */
-export function calculateFreshness(responseHeaders, responseDate) {
+export function calculateFreshness(responseHeaders, responseDate, now = new Date()) {
     const cacheControl = responseHeaders["cache-control"];
     const directives = parseCacheControl(cacheControl);
-    const date = responseDate ?? new Date(responseHeaders["date"] ?? Date.now());
+    const date = responseDate ?? parseDateHeader(responseHeaders["date"], now);
     /*
      * RFC 9111 section 5.1: Age is a non-negative delta-seconds. A negative or
      * suffixed value would otherwise inflate freshness without bound, which
      * pins a poisoned response in cache far past the origin's TTL.
      */
     const rawAge = (responseHeaders["age"] ?? "").trim();
-    const age = /^\d+$/.test(rawAge) ? Number(rawAge) : 0;
+    const ageHeader = /^\d+$/.test(rawAge) ? Number(rawAge) : 0;
+    const residentSeconds = Math.max(0, Math.floor((now.getTime() - date.getTime()) / 1_000));
+    const age = ageHeader + residentSeconds;
     const expiresHeader = responseHeaders["expires"];
     const expires = expiresHeader ? parseExpires(expiresHeader) : undefined;
     const effectiveMaxAge = resolveMaxAge(directives, expires, date);
+    /*
+     * With an `Expires`-derived lifetime this reduces to `expires - now`,
+     * because the lifetime is measured from `Date` and the age is measured to
+     * `now`.
+     */
     const remaining = Math.max(0, effectiveMaxAge - age);
     const stale = remaining <= 0 ||
         directives.noCache === true ||
@@ -43,6 +56,20 @@ export function calculateFreshness(responseHeaders, responseDate) {
         remaining,
     };
 }
+/**
+ * Parses a `Date` header, falling back to the current time.
+ *
+ * @param value - The raw `Date` value.
+ * @param now - The fallback instant.
+ * @returns The parsed date.
+ */
+function parseDateHeader(value, now) {
+    if (value === undefined) {
+        return now;
+    }
+    const parsed = new Date(value);
+    return Number.isNaN(parsed.getTime()) ? now : parsed;
+}
 /**
  * Parses an `Expires` header, treating an unparseable value as expired.
  *

package/dist/httpClient/httpClient.retry.d.ts

@@ -4,17 +4,8 @@
  * Handles retry configuration, status-based retry decisions,
  * exponential backoff, and delay utilities.
  */
-import type { HttpClientMethod } from "./httpClient.type.js";
-/** Retry options for the HTTP client. */
-export interface HttpRetryOptions {
-    readonly retries?: number;
-    readonly retryDelay?: number;
-    readonly maxRetryDelay?: number;
-    readonly retryStatusCodes?: readonly number[];
-    readonly retryMethods?: readonly HttpClientMethod[];
-    readonly retryOnNetworkError?: boolean;
-    readonly backoff?: "fixed" | "exponential";
-}
+import type { HttpRetryOptions } from "./httpClient.type.js";
+export type { HttpRetryOptions } from "./httpClient.type.js";
 /**
  * Normalize retry options with defaults.
  */
@@ -25,10 +16,24 @@ export declare function normalizeRetryOptions(options?: HttpRetryOptions): HttpR
 export declare function shouldRetryStatus(status: number, method: string, retry?: HttpRetryOptions): boolean;
 /**
  * Check if an error should trigger a retry.
+ *
+ * Transport failures are retried when `retryOnNetworkError` is on, and
+ * timeouts when `retryOnTimeout` is on (it defaults to
+ * `retryOnNetworkError`). Both apply only to `retryMethods`, which default
+ * to the idempotent `GET`, `HEAD` and `OPTIONS`. A caller's own abort is
+ * never retried.
  */
 export declare function shouldRetryError(error: unknown, method: string, retry?: HttpRetryOptions): boolean;
 /**
- * Calculate retry delay with exponential backoff.
+ * Calculate the wait before retry number `attempt + 1`.
+ *
+ * The delay is `retryDelay` (fixed backoff) or `retryDelay * 2^attempt`
+ * (exponential), capped at `maxRetryDelay`. With `jitter` (the default) the
+ * wait is drawn uniformly from 0 up to that delay ("full jitter"), so a
+ * burst of clients that failed together does not retry in lockstep;
+ * `jitter: false` waits exactly the delay. Jitter used to add up to a
+ * fixed 1000 ms whatever `retryDelay` was, so `retryDelay: 50` could wait
+ * a second.
  */
 export declare function calculateRetryDelay(attempt: number, retry: HttpRetryOptions): number;
 /**

package/dist/httpClient/httpClient.retry.js

@@ -4,6 +4,7 @@
  * Handles retry configuration, status-based retry decisions,
  * exponential backoff, and delay utilities.
  */
+import { HttpClientTimeoutError } from "./httpClient.error.js";
 /**
  * Normalize retry options with defaults.
  */
@@ -17,7 +18,9 @@ export function normalizeRetryOptions(options) {
         retryStatusCodes: options.retryStatusCodes ?? [429, 502, 503, 504],
         retryMethods: options.retryMethods ?? ["GET", "HEAD", "OPTIONS"],
         retryOnNetworkError: options.retryOnNetworkError ?? true,
+        retryOnTimeout: options.retryOnTimeout ?? options.retryOnNetworkError ?? true,
         backoff: options.backoff ?? "exponential",
+        jitter: options.jitter ?? true,
     };
 }
 /**
@@ -32,20 +35,35 @@ export function shouldRetryStatus(status, method, retry) {
 }
 /**
  * Check if an error should trigger a retry.
+ *
+ * Transport failures are retried when `retryOnNetworkError` is on, and
+ * timeouts when `retryOnTimeout` is on (it defaults to
+ * `retryOnNetworkError`). Both apply only to `retryMethods`, which default
+ * to the idempotent `GET`, `HEAD` and `OPTIONS`. A caller's own abort is
+ * never retried.
  */
 export function shouldRetryError(error, method, retry) {
     if (!retry?.retries)
         return false;
-    if (!retry.retryOnNetworkError)
-        return false;
     /*
-     * A connection that drops after the server processed the request is
-     * indistinguishable from one that never arrived, so replaying a
-     * non-idempotent method duplicates its side effects. `retryMethods` exists
-     * for exactly this and was honoured only on the status path.
+     * A connection that drops (or a request that times out) after the server
+     * processed it is indistinguishable from one that never arrived, so
+     * replaying a non-idempotent method duplicates its side effects.
+     * `retryMethods` exists for exactly this and was honoured only on the
+     * status path.
      */
     if (!retry.retryMethods?.includes(method))
         return false;
+    /*
+     * Timeouts were never retried: `isRetryableNetworkError` does not match
+     * `HttpClientTimeoutError`, so `retryOnNetworkError` had no effect on the
+     * most common transient failure.
+     */
+    if (error instanceof HttpClientTimeoutError) {
+        return retry.retryOnTimeout ?? retry.retryOnNetworkError ?? true;
+    }
+    if (!retry.retryOnNetworkError)
+        return false;
     return isRetryableNetworkError(error);
 }
 /**
@@ -71,15 +89,22 @@ function isRetryableNetworkError(error) {
     return !/body|disturbed|already (been )?(used|read)/i.test(error.message);
 }
 /**
- * Calculate retry delay with exponential backoff.
+ * Calculate the wait before retry number `attempt + 1`.
+ *
+ * The delay is `retryDelay` (fixed backoff) or `retryDelay * 2^attempt`
+ * (exponential), capped at `maxRetryDelay`. With `jitter` (the default) the
+ * wait is drawn uniformly from 0 up to that delay ("full jitter"), so a
+ * burst of clients that failed together does not retry in lockstep;
+ * `jitter: false` waits exactly the delay. Jitter used to add up to a
+ * fixed 1000 ms whatever `retryDelay` was, so `retryDelay: 50` could wait
+ * a second.
  */
 export function calculateRetryDelay(attempt, retry) {
     const base = retry.retryDelay ?? 1000;
     const max = retry.maxRetryDelay ?? 30_000;
     const ms = retry.backoff === "fixed" ? base : base * Math.pow(2, attempt);
-    /* Clamp *after* jitter, and on the fixed branch too, or `maxRetryDelay`
-     * is not actually a maximum. */
-    return Math.min(ms + Math.random() * 1000, max);
+    const capped = Math.max(0, Math.min(ms, max));
+    return retry.jitter === false ? capped : Math.random() * capped;
 }
 /**
  * Delay for a given number of milliseconds.

package/dist/httpClient/httpClient.type.d.ts

@@ -8,14 +8,28 @@ export type HttpClientBody = BodyInit | Record<string, unknown> | readonly unkno
 export type HttpClientQueryValue = string | number | boolean | bigint | null | undefined | readonly (string | number | boolean | bigint)[];
 export type HttpClientQuery = Readonly<Record<string, HttpClientQueryValue>> | URLSearchParams;
 export type HttpResponseType = "auto" | "json" | "text" | "arrayBuffer" | "blob" | "response";
+/**
+ * Retry policy for the HTTP client. See the README's "Retries and backoff".
+ */
 export interface HttpRetryOptions {
+    /** Retries after the first attempt (default 0: no retries). */
     readonly retries?: number;
+    /** Base delay in ms (default 1000). */
     readonly retryDelay?: number;
+    /** Upper bound on any single wait, in ms (default 30000). */
     readonly maxRetryDelay?: number;
+    /** Statuses that are retried (default 429, 502, 503, 504). */
     readonly retryStatusCodes?: readonly number[];
+    /** Methods that may be retried at all (default GET, HEAD, OPTIONS). */
     readonly retryMethods?: readonly HttpClientMethod[];
+    /** Retry transport failures such as a refused connection (default true). */
     readonly retryOnNetworkError?: boolean;
+    /** Retry a request that hit `timeout` (default: `retryOnNetworkError`). */
+    readonly retryOnTimeout?: boolean;
+    /** `"exponential"` doubles the delay per attempt (default); `"fixed"` does not. */
     readonly backoff?: "fixed" | "exponential";
+    /** Wait a random 0..delay instead of exactly the delay (default true). */
+    readonly jitter?: boolean;
 }
 export interface HttpClientResponse<T = unknown> {
     readonly data: T;

package/dist/httpErrors/httpError.base.js

@@ -7,7 +7,7 @@
  * @module httpErrors/base
  */
 import { HttpError as BaseHttpError } from "@zudojs/errors";
-import { normalizeHeaders, getStatusText } from "./httpError.util.js";
+import { defaultErrorCode, normalizeHeaders, getStatusText, } from "./httpError.util.js";
 /**
  * HTTP error with response-specific properties.
  *
@@ -31,7 +31,7 @@ export class HttpError extends BaseHttpError {
         const statusText = getStatusText(status);
         super(message ?? statusText, {
             statusCode: status,
-            code: options.code,
+            code: options.code ?? defaultErrorCode(status),
             expose: options.expose ?? status < 500,
             metadata: options.metadata,
             cause: options.cause,

package/dist/httpErrors/httpError.util.d.ts

@@ -19,4 +19,12 @@ export declare function normalizeHeaders(headers: Record<string, string> | undef
  * `statusText` and `message` as "Unknown Status".
  */
 export declare function getStatusText(status: number): string;
+/**
+ * The default error code for a status: its symbolic name, as the factories
+ * use (`415` gives `"UNSUPPORTED_MEDIA_TYPE"`, `404` `"NOT_FOUND"`).
+ * `undefined` for a status with no name, which keeps the shared default.
+ * `new HttpError(415, msg)` without a code used to report
+ * `ERR_OPERATION_FAILED`.
+ */
+export declare function defaultErrorCode(status: number): string | undefined;
 //# sourceMappingURL=httpError.util.d.ts.map

package/dist/httpErrors/httpError.util.js

@@ -8,6 +8,7 @@
  * @module httpErrors/util
  */
 import { getStatusText as lookupStatusText } from "../httpStatus/httpStatus.lookup.js";
+import { statusName } from "../httpStatus/httpStatus.name.js";
 /**
  * Normalizes header keys to lowercase.
  */
@@ -33,4 +34,15 @@ export function normalizeHeaders(headers) {
 export function getStatusText(status) {
     return lookupStatusText(status);
 }
+/**
+ * The default error code for a status: its symbolic name, as the factories
+ * use (`415` gives `"UNSUPPORTED_MEDIA_TYPE"`, `404` `"NOT_FOUND"`).
+ * `undefined` for a status with no name, which keeps the shared default.
+ * `new HttpError(415, msg)` without a code used to report
+ * `ERR_OPERATION_FAILED`.
+ */
+export function defaultErrorCode(status) {
+    const name = statusName(status);
+    return name === "UNKNOWN" ? undefined : name;
+}
 //# sourceMappingURL=httpError.util.js.map

package/dist/httpFetchMount/httpFetchMount.core.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Serving web-standard fetch handlers from an `@zudojs/http` router.
+ */
+import type { HttpFetchHandler, HttpFetchMountTarget, MountFetchHandlerOptions } from "./httpFetchMount.type.js";
+/**
+ * Serves a web-standard `(request: Request) => Promise<Response>` handler —
+ * an `@zudojs/rpc` server, `@zudojs/api` operations, any fetch-style app —
+ * under `basePath` of an `@zudojs/http` router or router group.
+ *
+ * The handler receives a `Request` with the original method, headers
+ * (connection-scoped ones removed), body and query, and a `signal` that
+ * aborts when the client disconnects. Its `Response` is streamed back with
+ * status, status text and headers intact, every `Set-Cookie` kept separate.
+ * A handler that throws, or returns something that is not a `Response`,
+ * fails the request like any other route (500 unless the error carries a
+ * status).
+ *
+ * ```ts
+ * mountFetchHandler(router, "/rpc", createRPCFetchHandler(rpcServer));
+ * ```
+ *
+ * @returns A function that removes the mount.
+ */
+export declare function mountFetchHandler(target: HttpFetchMountTarget, basePath: string, handler: HttpFetchHandler, options?: MountFetchHandlerOptions): () => void;
+//# sourceMappingURL=httpFetchMount.core.d.ts.map

package/dist/httpFetchMount/httpFetchMount.core.js

@@ -0,0 +1,84 @@
+/**
+ * Serving web-standard fetch handlers from an `@zudojs/http` router.
+ */
+import { webResponseToContext } from "../httpResponse/httpResponse.fromWeb.js";
+import { normalizeRoutePattern } from "../httpRouter/core/util/httpRoute.util.js";
+import { contextUrl, toWebRequest } from "./httpFetchMount.request.js";
+/** The wildcard every mount registers; its name is reserved for mounts. */
+const MOUNT_WILDCARD = "*fetchMountPath";
+function segments(path) {
+    return path.split("/").filter((segment) => segment !== "");
+}
+/**
+ * Removes the first `count` path segments, keeping a trailing slash.
+ *
+ * Counted in segments rather than characters so it holds for a mount under
+ * a group prefix, a parameterised mount path and a case-insensitive match.
+ */
+function splitPrefix(pathname, count) {
+    const parts = segments(pathname);
+    const prefix = `/${parts.slice(0, count).join("/")}`;
+    const rest = parts.slice(count);
+    if (rest.length === 0)
+        return [prefix, "/"];
+    return [prefix, `/${rest.join("/")}${pathname.endsWith("/") ? "/" : ""}`];
+}
+/**
+ * Serves a web-standard `(request: Request) => Promise<Response>` handler —
+ * an `@zudojs/rpc` server, `@zudojs/api` operations, any fetch-style app —
+ * under `basePath` of an `@zudojs/http` router or router group.
+ *
+ * The handler receives a `Request` with the original method, headers
+ * (connection-scoped ones removed), body and query, and a `signal` that
+ * aborts when the client disconnects. Its `Response` is streamed back with
+ * status, status text and headers intact, every `Set-Cookie` kept separate.
+ * A handler that throws, or returns something that is not a `Response`,
+ * fails the request like any other route (500 unless the error carries a
+ * status).
+ *
+ * ```ts
+ * mountFetchHandler(router, "/rpc", createRPCFetchHandler(rpcServer));
+ * ```
+ *
+ * @returns A function that removes the mount.
+ */
+export function mountFetchHandler(target, basePath, handler, options = {}) {
+    if (typeof handler !== "function") {
+        throw new TypeError("mountFetchHandler requires a handler function.");
+    }
+    const base = normalizeRoutePattern(basePath);
+    const pattern = base === "/" ? `/${MOUNT_WILDCARD}` : `${base}/${MOUNT_WILDCARD}`;
+    const strip = options.stripPrefix ?? true;
+    const routeHandler = async (context) => {
+        const url = contextUrl(context.request, options.origin);
+        const headers = {};
+        if (strip) {
+            const mounted = segments(context.route.path).length - 1;
+            const [prefix, rest] = splitPrefix(url.pathname, mounted);
+            url.pathname = rest;
+            if (mounted > 0)
+                headers["x-forwarded-prefix"] = prefix;
+        }
+        const request = toWebRequest(context.request, {
+            url,
+            signal: context.signal,
+            headers,
+        });
+        const response = await handler(request);
+        if (!(response instanceof Response)) {
+            throw new TypeError(`The fetch handler mounted at ${base} returned ${typeof response}, not a Response.`);
+        }
+        return webResponseToContext(response);
+    };
+    const routeOptions = {
+        openapi: options.openapi ?? false,
+        ...(options.name === undefined ? {} : { name: options.name }),
+        ...(options.middleware ? { middleware: options.middleware } : {}),
+    };
+    const removers = (options.methods ?? ["*"]).map((method) => target.on(method, pattern, routeHandler, routeOptions));
+    return () => {
+        for (const remove of removers)
+            remove();
+    };
+}
+//# sourceMappingURL=httpFetchMount.core.js.map

package/dist/httpFetchMount/httpFetchMount.request.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Conversion of a request context into a WHATWG `Request`.
+ */
+import type { HttpRequestContext } from "../httpRequest/httpRequest.context.js";
+import type { ToWebRequestOptions } from "./httpFetchMount.type.js";
+/**
+ * The context's URL as an absolute URL. The request target is never read
+ * as an authority; the origin is `origin` when given, else the context's.
+ */
+export declare function contextUrl(context: HttpRequestContext, origin?: string): URL;
+/**
+ * Builds a web `Request` from a request context.
+ *
+ * Headers are copied except connection-scoped ones; the body is the one the
+ * adapter read (bytes, text, a stream, or a parsed value re-encoded as JSON,
+ * labelled `application/json` unless it already had a JSON content type)
+ * and is never attached to `GET` / `HEAD`; the signal aborts the request
+ * when the client disconnects.
+ */
+export declare function toWebRequest(context: HttpRequestContext, options?: ToWebRequestOptions): Request;
+//# sourceMappingURL=httpFetchMount.request.d.ts.map

package/dist/httpFetchMount/httpFetchMount.request.js

@@ -0,0 +1,100 @@
+/**
+ * Conversion of a request context into a WHATWG `Request`.
+ */
+import { parseRequestTarget } from "../httpRequest/target/httpRequest.target.js";
+/**
+ * Connection-scoped headers. They describe the hop between the client and
+ * this server, not the request, and `content-length` is recomputed from the
+ * body actually passed on.
+ */
+const HOP_BY_HOP = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-connection",
+    "transfer-encoding",
+    "te",
+    "trailer",
+    "upgrade",
+    "content-length",
+]);
+const DEFAULT_ORIGIN = "http://localhost";
+const JSON_TYPE = /^application\/(?:[\w.+-]+\+)?json(?:\s*;|$)/i;
+/**
+ * The origin of the web request: `pinned` when the caller configured one,
+ * otherwise the context's own (from the `Host` header, or a trusted
+ * proxy's `X-Forwarded-Host`), otherwise `http://localhost`.
+ */
+function resolveOrigin(context, pinned) {
+    for (const candidate of [pinned, context.origin, DEFAULT_ORIGIN]) {
+        if (candidate === undefined)
+            continue;
+        try {
+            return new URL(candidate).origin;
+        }
+        catch {
+            continue;
+        }
+    }
+    return DEFAULT_ORIGIN;
+}
+/**
+ * The context's URL as an absolute URL. The request target is never read
+ * as an authority; the origin is `origin` when given, else the context's.
+ */
+export function contextUrl(context, origin) {
+    const target = parseRequestTarget(context.url);
+    const url = new URL(resolveOrigin(context, origin));
+    url.pathname = target.pathname;
+    url.search = target.search;
+    return url;
+}
+function toBody(body, headers) {
+    if (body === undefined || body === null)
+        return undefined;
+    if (typeof body === "string")
+        return body;
+    if (body instanceof Uint8Array)
+        return body;
+    if (body instanceof ArrayBuffer)
+        return body;
+    if (body instanceof ReadableStream ||
+        body instanceof Blob ||
+        body instanceof FormData ||
+        body instanceof URLSearchParams) {
+        return body;
+    }
+    if (!JSON_TYPE.test(headers.get("content-type") ?? "")) {
+        headers.set("content-type", "application/json");
+    }
+    return JSON.stringify(body);
+}
+/**
+ * Builds a web `Request` from a request context.
+ *
+ * Headers are copied except connection-scoped ones; the body is the one the
+ * adapter read (bytes, text, a stream, or a parsed value re-encoded as JSON,
+ * labelled `application/json` unless it already had a JSON content type)
+ * and is never attached to `GET` / `HEAD`; the signal aborts the request
+ * when the client disconnects.
+ */
+export function toWebRequest(context, options = {}) {
+    const method = context.method.toUpperCase();
+    const headers = new Headers();
+    for (const [name, value] of Object.entries(context.headers)) {
+        if (!HOP_BY_HOP.has(name.toLowerCase()))
+            headers.append(name, value);
+    }
+    for (const [name, value] of Object.entries(options.headers ?? {})) {
+        headers.set(name, value);
+    }
+    const body = method === "GET" || method === "HEAD" ? undefined : toBody(context.body, headers);
+    const init = {
+        method,
+        headers,
+        ...(body === undefined ? {} : { body }),
+        ...(body instanceof ReadableStream ? { duplex: "half" } : {}),
+        ...(options.signal ? { signal: options.signal } : {}),
+    };
+    return new Request(options.url ?? contextUrl(context, options.origin), init);
+}
+//# sourceMappingURL=httpFetchMount.request.js.map

package/dist/httpFetchMount/httpFetchMount.type.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Types for serving web-standard fetch handlers from a router.
+ */
+import type { HttpMethod, HttpRouteOpenAPI, RouteOptions, RouterHandler } from "../httpRouter/core/types/httpRouter.type.js";
+import type { HttpMiddleware } from "../httpMiddleware/httpMiddleware.type.js";
+/** A web-standard handler: `Request` in, `Response` out. */
+export type HttpFetchHandler = (request: Request) => Response | Promise<Response>;
+/** Anything routes can be registered on: an `HttpRouter` or a router group. */
+export interface HttpFetchMountTarget {
+    on(method: HttpMethod | "*", path: string, handler: RouterHandler, options?: RouteOptions): () => void;
+}
+/** Options for `mountFetchHandler`. */
+export interface MountFetchHandlerOptions {
+    /** Methods routed to the handler. Default: every method. */
+    readonly methods?: readonly HttpMethod[];
+    /**
+     * Remove the mount path from the URL the handler sees, so a handler
+     * mounted at `/rpc` receives `/users.get` for `/rpc/users.get`. The
+     * removed prefix is passed as `x-forwarded-prefix`. Default: `true`.
+     */
+    readonly stripPrefix?: boolean;
+    /**
+     * Origin of the handler's `request.url`, e.g. `https://api.example.com`.
+     * When set it is used for every request. When not, the origin comes from
+     * the request — its `Host` header, or `X-Forwarded-Host` from a trusted
+     * proxy — which the client chooses; set this whenever the handler builds
+     * absolute URLs (redirects, callback or reset links) or checks
+     * `Origin` against its own. Falls back to `http://localhost`.
+     */
+    readonly origin?: string;
+    /** Middleware run before the handler. */
+    readonly middleware?: readonly HttpMiddleware[];
+    /** Route name. */
+    readonly name?: string;
+    /**
+     * OpenAPI documentation for the mount. Default: `false` — a mounted
+     * handler documents its own operations (see `@zudojs/openapi`'s
+     * `createOpenAPIDocumentFromRoutes`).
+     */
+    readonly openapi?: HttpRouteOpenAPI;
+}
+/** Options for `toWebRequest`. */
+export interface ToWebRequestOptions {
+    /** Overrides the request URL (absolute). */
+    readonly url?: string | URL;
+    /** Aborts the web request; normally the router context's signal. */
+    readonly signal?: AbortSignal;
+    /**
+     * Origin of the web request. Overrides the context's protocol and host
+     * (which come from the client's `Host` header) when set.
+     */
+    readonly origin?: string;
+    /** Extra headers set on the web request, replacing same-named ones. */
+    readonly headers?: Readonly<Record<string, string>>;
+}
+//# sourceMappingURL=httpFetchMount.type.d.ts.map

package/dist/httpFetchMount/httpFetchMount.type.js

@@ -0,0 +1,5 @@
+/**
+ * Types for serving web-standard fetch handlers from a router.
+ */
+export {};
+//# sourceMappingURL=httpFetchMount.type.js.map

package/dist/httpFetchMount/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @zudojs/http/httpFetchMount
+ *
+ * Serves web-standard fetch handlers (`Request` → `Response`) from an
+ * `@zudojs/http` router: `mountFetchHandler` registers one under a path,
+ * `toWebRequest` converts a request context into a `Request` on its own.
+ */
+export { mountFetchHandler } from "./httpFetchMount.core.js";
+export { toWebRequest, contextUrl } from "./httpFetchMount.request.js";
+export type { HttpFetchHandler, HttpFetchMountTarget, MountFetchHandlerOptions, ToWebRequestOptions, } from "./httpFetchMount.type.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpFetchMount/index.js

@@ -0,0 +1,10 @@
+/**
+ * @zudojs/http/httpFetchMount
+ *
+ * Serves web-standard fetch handlers (`Request` → `Response`) from an
+ * `@zudojs/http` router: `mountFetchHandler` registers one under a path,
+ * `toWebRequest` converts a request context into a `Request` on its own.
+ */
+export { mountFetchHandler } from "./httpFetchMount.core.js";
+export { toWebRequest, contextUrl } from "./httpFetchMount.request.js";
+//# sourceMappingURL=index.js.map

package/dist/httpKeepAlive/httpKeepAlive.core.js

@@ -7,6 +7,7 @@
  * Transport-specific socket management belongs to the server/client adapter
  * layer. This module only handles HTTP-level semantics.
  */
+import { assertSafeHeaderValue, escapeHeaderQuotedString, } from "../httpHeaders/security/index.js";
 /* -------------------------------------------------------------------------- */
 /* Constants                                                                  */
 /* -------------------------------------------------------------------------- */
@@ -121,7 +122,9 @@ export function formatKeepAliveHeader(parameters = {}) {
             parts.push(`${key}=${quoteIfNeeded(value)}`);
         }
     }
-    return parts.join(", ");
+    const header = parts.join(", ");
+    assertSafeHeaderValue(header);
+    return header;
 }
 /* -------------------------------------------------------------------------- */
 /* Connection Header                                                          */
@@ -348,10 +351,19 @@ function unquote(value) {
     }
     return trimmed;
 }
+/**
+ * Emits a Keep-Alive parameter value.
+ *
+ * Quoting does not neutralise a CR or LF, so the control character used to
+ * survive into the field value. `escapeHeaderQuotedString` rejects it, the
+ * same helper every other quoted-parameter emitter in this package uses.
+ *
+ * @throws {TypeError} If the value contains a forbidden control character.
+ */
 function quoteIfNeeded(value) {
     if (/^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(value)) {
         return value;
     }
-    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+    return `"${escapeHeaderQuotedString(value)}"`;
 }
 //# sourceMappingURL=httpKeepAlive.core.js.map