@zudojs/http 1.2.0 → 1.4.0

package/dist/httpRequest/httpRequest.context.js

@@ -7,6 +7,7 @@
  * The context is intentionally framework-agnostic so adapters can populate it
  * from Node.js, Bun, Deno, or another HTTP runtime.
  */
+import { AsyncLocalStorage } from "node:async_hooks";
 import { parseRequestTarget } from "./target/httpRequest.target.js";
 /* -------------------------------------------------------------------------- */
 /* Constants                                                                  */
@@ -44,6 +45,7 @@ export class HttpRequestContext {
     protocolValue;
     hostnameValue;
     portValue;
+    signalValue;
     constructor(init) {
         this.id = init.id ?? generateRequestId();
         this.method = normalizeMethod(init.method);
@@ -60,6 +62,16 @@ export class HttpRequestContext {
         this.protocolValue = init.protocol;
         this.hostnameValue = init.hostname;
         this.portValue = init.port;
+        this.signalValue = init.signal;
+    }
+    /**
+     * Aborts when the request is abandoned — for the Node adapter, when the
+     * client disconnects before the response finished. `RequestContextInit`
+     * always accepted a `signal`, but the constructor dropped it, so the
+     * router handed every handler a signal that could never fire.
+     */
+    get signal() {
+        return this.signalValue;
     }
     /* ------------------------------------------------------------------------ */
     /* Headers                                                                  */
@@ -289,6 +301,7 @@ export class HttpRequestContext {
             protocol: this.protocolValue,
             hostname: this.hostnameValue,
             port: this.portValue,
+            signal: this.signalValue,
             state: {
                 ...Object.fromEntries(this.stateMap),
             },
@@ -378,24 +391,16 @@ function validateHeaderValue(value) {
         throw new TypeError("HTTP header value cannot contain CR or LF characters.");
     }
 }
+/**
+ * Builds the request-context store.
+ *
+ * `AsyncLocalStorage` used to be reached through `globalThis.require`, which
+ * does not exist in ESM under Node. The `typeof` guard turned that into a
+ * silent `undefined`, so `runWithRequestContext` merely called its callback
+ * and `getCurrentRequestContext` always returned `undefined`. It is imported
+ * statically now, as the rest of the package imports its Node built-ins.
+ */
 function createAsyncContextStorage() {
-    /*
-     * AsyncLocalStorage is intentionally loaded lazily so the HTTP package
-     * remains usable in browser and non-Node runtimes.
-     */
-    try {
-        const runtimeRequire = globalThis.require;
-        if (typeof runtimeRequire !== "function") {
-            return undefined;
-        }
-        const asyncHooks = runtimeRequire("node:async_hooks");
-        if (!asyncHooks.AsyncLocalStorage) {
-            return undefined;
-        }
-        return new asyncHooks.AsyncLocalStorage();
-    }
-    catch {
-        return undefined;
-    }
+    return new AsyncLocalStorage();
 }
 //# sourceMappingURL=httpRequest.context.js.map

package/dist/httpRequest/index.d.ts

@@ -6,4 +6,5 @@
 export * from "./http.request.js";
 export * from "./httpRequest.context.js";
 export * from "./target/index.js";
+export * from "./requestId/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpRequest/index.js

@@ -6,4 +6,5 @@
 export * from "./http.request.js";
 export * from "./httpRequest.context.js";
 export * from "./target/index.js";
+export * from "./requestId/index.js";
 //# sourceMappingURL=index.js.map

package/dist/httpRequest/requestId/httpRequest.requestId.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Incoming request id handling.
+ *
+ * @module httpRequest/requestId
+ */
+/** Longest incoming `x-request-id` value reused as `request.id`. */
+export declare const MAX_INCOMING_REQUEST_ID_LENGTH = 128;
+/**
+ * Characters an incoming request id may contain: letters, digits and
+ * `.`, `_`, `:`, `-`. That covers UUIDs, ULIDs, W3C trace ids and the
+ * `service:counter` style many proxies emit, and rules out spaces, quotes,
+ * control characters and anything else that could forge a log field.
+ */
+export declare const INCOMING_REQUEST_ID_PATTERN: RegExp;
+/**
+ * Returns the incoming request id when it is safe to reuse, otherwise
+ * `undefined` (the caller then generates one).
+ *
+ * The header is client-controlled, so it is only trusted when it is 1 to
+ * {@link MAX_INCOMING_REQUEST_ID_LENGTH} characters from
+ * {@link INCOMING_REQUEST_ID_PATTERN}. A header sent more than once (joined
+ * with `", "` by Node) fails the pattern and is ignored.
+ */
+export declare function resolveIncomingRequestId(value: string | readonly string[] | undefined): string | undefined;
+//# sourceMappingURL=httpRequest.requestId.d.ts.map

package/dist/httpRequest/requestId/httpRequest.requestId.js

@@ -0,0 +1,34 @@
+/**
+ * Incoming request id handling.
+ *
+ * @module httpRequest/requestId
+ */
+/** Longest incoming `x-request-id` value reused as `request.id`. */
+export const MAX_INCOMING_REQUEST_ID_LENGTH = 128;
+/**
+ * Characters an incoming request id may contain: letters, digits and
+ * `.`, `_`, `:`, `-`. That covers UUIDs, ULIDs, W3C trace ids and the
+ * `service:counter` style many proxies emit, and rules out spaces, quotes,
+ * control characters and anything else that could forge a log field.
+ */
+export const INCOMING_REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]+$/;
+/**
+ * Returns the incoming request id when it is safe to reuse, otherwise
+ * `undefined` (the caller then generates one).
+ *
+ * The header is client-controlled, so it is only trusted when it is 1 to
+ * {@link MAX_INCOMING_REQUEST_ID_LENGTH} characters from
+ * {@link INCOMING_REQUEST_ID_PATTERN}. A header sent more than once (joined
+ * with `", "` by Node) fails the pattern and is ignored.
+ */
+export function resolveIncomingRequestId(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const id = value.trim();
+    if (id.length === 0 || id.length > MAX_INCOMING_REQUEST_ID_LENGTH) {
+        return undefined;
+    }
+    return INCOMING_REQUEST_ID_PATTERN.test(id) ? id : undefined;
+}
+//# sourceMappingURL=httpRequest.requestId.js.map

package/dist/httpRequest/requestId/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @zudojs/http/httpRequest/requestId
+ *
+ * Validation of an incoming `x-request-id` before it becomes `request.id`.
+ */
+export { MAX_INCOMING_REQUEST_ID_LENGTH, INCOMING_REQUEST_ID_PATTERN, resolveIncomingRequestId, } from "./httpRequest.requestId.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpRequest/requestId/index.js

@@ -0,0 +1,7 @@
+/**
+ * @zudojs/http/httpRequest/requestId
+ *
+ * Validation of an incoming `x-request-id` before it becomes `request.id`.
+ */
+export { MAX_INCOMING_REQUEST_ID_LENGTH, INCOMING_REQUEST_ID_PATTERN, resolveIncomingRequestId, } from "./httpRequest.requestId.js";
+//# sourceMappingURL=index.js.map

package/dist/httpRequest/target/httpRequest.target.d.ts

@@ -17,8 +17,8 @@
 /**
  * Parses a request-target (origin-form, absolute-form or `*`) into a URL.
  *
- * An origin-form target is never parsed as an authority. Unparseable input
- * yields the root URL.
+ * An origin-form target is never parsed as an authority, and repeated slashes
+ * in the path are collapsed. Unparseable input yields the root URL.
  */
 export declare function parseRequestTarget(target: string): URL;
 /**

package/dist/httpRequest/target/httpRequest.target.js

@@ -17,21 +17,39 @@
 const TARGET_BASE = "http://zudojs.invalid";
 const ABSOLUTE_FORM = /^https?:\/\//i;
 const ENCODED_DOT = /%2e/gi;
+const REPEATED_SLASH = /\/{2,}/g;
+/**
+ * Collapses repeated slashes in a parsed target's path.
+ *
+ * The router normalises `/{2,}` away before matching, while the request
+ * context kept them, so `//admin/secret` dispatched to the route registered
+ * at `/admin/secret` while a guard reading `request.path` saw a path that did
+ * not start with `/admin/`. Both sides parse here, so collapsing once here
+ * keeps them in agreement. The query and fragment are untouched.
+ */
+function collapsePathSlashes(url) {
+    if (!url.pathname.includes("//")) {
+        return url;
+    }
+    const collapsed = new URL(url.href);
+    collapsed.pathname = url.pathname.replace(REPEATED_SLASH, "/");
+    return collapsed;
+}
 /**
  * Parses a request-target (origin-form, absolute-form or `*`) into a URL.
  *
- * An origin-form target is never parsed as an authority. Unparseable input
- * yields the root URL.
+ * An origin-form target is never parsed as an authority, and repeated slashes
+ * in the path are collapsed. Unparseable input yields the root URL.
  */
 export function parseRequestTarget(target) {
     try {
         if (target.startsWith("/")) {
-            return new URL(`${TARGET_BASE}${target}`);
+            return collapsePathSlashes(new URL(`${TARGET_BASE}${target}`));
         }
         if (ABSOLUTE_FORM.test(target)) {
-            return new URL(target);
+            return collapsePathSlashes(new URL(target));
         }
-        return new URL(`${TARGET_BASE}/${target === "*" ? "" : target}`);
+        return collapsePathSlashes(new URL(`${TARGET_BASE}/${target === "*" ? "" : target}`));
     }
     catch {
         return new URL(`${TARGET_BASE}/`);

package/dist/httpResponse/httpResponse.writer.js

@@ -183,10 +183,21 @@ export function normalizeBody(body) {
 /* -------------------------------------------------------------------------- */
 export async function writeReadableStream(stream, writer) {
     const reader = stream.getReader();
+    let finished = false;
     try {
         while (true) {
+            /*
+             * A sink that stopped accepting data (the client disconnected) will
+             * never drain. Without this check an unbounded stream — server-sent
+             * events, a proxied download — kept being pulled into a dead socket
+             * for as long as its source produced.
+             */
+            if (writer.writable === false) {
+                break;
+            }
             const result = await reader.read();
             if (result.done) {
+                finished = true;
                 break;
             }
             if (result.value) {
@@ -198,6 +209,10 @@ export async function writeReadableStream(stream, writer) {
         }
     }
     finally {
+        if (!finished) {
+            /* Tell the source to stop producing; its failure is not ours. */
+            await reader.cancel().catch(() => undefined);
+        }
         reader.releaseLock();
     }
 }

package/dist/httpRouter/core/factory/httpRoute.factory.base.d.ts

@@ -4,12 +4,23 @@
  * Internal normalization, validation, execution, and response utilities for
  * route creation and dispatch.
  */
-import type { HttpMethod, MatchedRoute, CompiledRoute, HttpRouterContext, HttpRouterRequestContext } from "../types/httpRouter.type.js";
+import type { HttpMethod, MatchedRoute, CompiledRoute, HttpRouterContext, HttpRouterRequestContext, RouterHandlerResult } from "../types/httpRouter.type.js";
 import { type HttpResponseContext as ResponseContext } from "../../../httpResponse/httpResponse.context.js";
 export declare function normalizeMethod(method: string): HttpMethod | "*";
 export declare function normalizeMethods(method: HttpMethod | readonly HttpMethod[] | "*"): readonly (HttpMethod | "*")[];
 export declare function isHttpMethod(value: string): value is HttpMethod;
-export declare function collectAllowedMethods(routes: readonly CompiledRoute[], path: string): HttpMethod[];
+/**
+ * Collects the methods registered for a path.
+ *
+ * @param routes - The compiled routes to consider.
+ * @param path - The request path.
+ * @param caseSensitive - The router's case sensitivity. This used to be
+ *   hardcoded to `false`, so a case-sensitive router advertised `Allow`
+ *   methods belonging to a route that only differed by case — a method the
+ *   client would then get a 404 from, and a disclosure of the other route.
+ * @returns The allowed methods, with `HEAD` implied by `GET`.
+ */
+export declare function collectAllowedMethods(routes: readonly CompiledRoute[], path: string, caseSensitive?: boolean): HttpMethod[];
 /**
  * Extracts the monotonic registration sequence from a generated route id.
  *
@@ -22,9 +33,12 @@ export declare function extractRouteSequence(id: string): number;
  */
 export declare function createFallbackRoute(path: string, method: string): MatchedRoute;
 /**
- * Coerces a handler result into a response context.
+ * Coerces a handler result into a response context: a response context or
+ * web `Response` as built, `undefined`/`null` as `204`, and any other value
+ * as a `200` JSON body, the way server handlers treat a plain value. A
+ * plain object used to be dropped for an empty `204`.
  */
-export declare function normalizeResponse(value: ResponseContext | Response | void): Promise<ResponseContext>;
+export declare function normalizeResponse(value: RouterHandlerResult): Promise<ResponseContext>;
 /**
  * Builds the automatic `OPTIONS` response for a matched path.
  */
@@ -39,6 +53,12 @@ export declare function defaultNotFoundHandler(context: HttpRouterRequestContext
 export declare function defaultMethodNotAllowedHandler(context: HttpRouterRequestContext, allowedMethods: readonly HttpMethod[]): ResponseContext;
 /**
  * Runs a matched route's middleware chain followed by its handler.
+ *
+ * Every result is folded into the ambient response context
+ * (`context.middleware.response`), which is the object route middleware
+ * writes to. Returning the handler's brand new response instead — as this
+ * used to — silently discarded every header, cookie and status a route
+ * middleware had set before calling `next()`.
  */
 export declare function executeRoute(route: MatchedRoute, context: HttpRouterContext): Promise<ResponseContext>;
 //# sourceMappingURL=httpRoute.factory.base.d.ts.map

package/dist/httpRouter/core/factory/httpRoute.factory.base.js

@@ -4,10 +4,13 @@
  * Internal normalization, validation, execution, and response utilities for
  * route creation and dispatch.
  */
+import { isGuardResponse } from "@zudojs/middleware";
 import { HttpRouterError } from "../error/httpRouter.error.js";
 import { formatAllowHeader } from "../../../httpMethods/http.methods.js";
 import { matchCompiledRoute } from "../../matching/httpRoute.matcher.core.js";
 import { HttpResponseContext, } from "../../../httpResponse/httpResponse.context.js";
+import { bufferWebResponse } from "../../../httpResponse/httpResponse.fromWeb.js";
+import { applyGuardResponse } from "../../../httpMiddleware/pipeline/httpPipeline.guardResponse.js";
 /* -------------------------------------------------------------------------- */
 /* Method Helpers                                                             */
 /* -------------------------------------------------------------------------- */
@@ -36,10 +39,21 @@ export function isHttpMethod(value) {
         value === "CONNECT" ||
         value === "TRACE");
 }
-export function collectAllowedMethods(routes, path) {
+/**
+ * Collects the methods registered for a path.
+ *
+ * @param routes - The compiled routes to consider.
+ * @param path - The request path.
+ * @param caseSensitive - The router's case sensitivity. This used to be
+ *   hardcoded to `false`, so a case-sensitive router advertised `Allow`
+ *   methods belonging to a route that only differed by case — a method the
+ *   client would then get a 404 from, and a disclosure of the other route.
+ * @returns The allowed methods, with `HEAD` implied by `GET`.
+ */
+export function collectAllowedMethods(routes, path, caseSensitive = false) {
     const methods = new Set();
     for (const route of routes) {
-        if (!matchCompiledRoute(route, path, false)) {
+        if (!matchCompiledRoute(route, path, caseSensitive)) {
             continue;
         }
         if (isHttpMethod(route.definition.method)) {
@@ -88,24 +102,27 @@ export function createFallbackRoute(path, method) {
 /* Response Helpers                                                           */
 /* -------------------------------------------------------------------------- */
 /**
- * Coerces a handler result into a response context.
+ * Coerces a handler result into a response context: a response context or
+ * web `Response` as built, `undefined`/`null` as `204`, and any other value
+ * as a `200` JSON body, the way server handlers treat a plain value. A
+ * plain object used to be dropped for an empty `204`.
  */
 export async function normalizeResponse(value) {
     if (value instanceof HttpResponseContext) {
         return value;
     }
     if (typeof Response !== "undefined" && value instanceof Response) {
-        const body = value.body === null
-            ? undefined
-            : new Uint8Array(await value.arrayBuffer());
-        return new HttpResponseContext({
-            status: value.status,
-            statusText: value.statusText,
-            headers: Object.fromEntries(value.headers.entries()),
-            body,
-        });
+        /*
+         * `Object.fromEntries(headers.entries())` folded every `Set-Cookie` into
+         * one comma-joined value, which browsers read as a single malformed
+         * cookie. `bufferWebResponse` keeps each cookie separate.
+         */
+        return bufferWebResponse(value);
     }
-    return new HttpResponseContext({ status: 204 });
+    if (value === undefined || value === null) {
+        return new HttpResponseContext({ status: 204 });
+    }
+    return new HttpResponseContext({ status: 200 }).json(value);
 }
 /**
  * Builds the automatic `OPTIONS` response for a matched path.
@@ -153,11 +170,43 @@ export function defaultMethodNotAllowedHandler(context, allowedMethods) {
 /* -------------------------------------------------------------------------- */
 /* Route Execution                                                            */
 /* -------------------------------------------------------------------------- */
+/**
+ * Merges one response context into another.
+ *
+ * Status, status text, headers, cookies, metadata and body are all carried
+ * over, so nothing a handler produced is lost.
+ *
+ * @param target - The response that stays authoritative.
+ * @param source - The response to fold into it.
+ * @returns The target response.
+ */
+function mergeRouteResponse(target, source) {
+    if (source === target) {
+        return target;
+    }
+    target.setStatus(source.status, source.statusText);
+    target.headers_obj(source.headers);
+    for (const cookie of source.cookies) {
+        target.setCookie(cookie);
+    }
+    for (const [key, value] of Object.entries(source.metadata)) {
+        target.setMetadata(key, value);
+    }
+    target.setBody(source.body);
+    return target;
+}
 /**
  * Runs a matched route's middleware chain followed by its handler.
+ *
+ * Every result is folded into the ambient response context
+ * (`context.middleware.response`), which is the object route middleware
+ * writes to. Returning the handler's brand new response instead — as this
+ * used to — silently discarded every header, cookie and status a route
+ * middleware had set before calling `next()`.
  */
 export async function executeRoute(route, context) {
     const layers = route.middleware;
+    const ambient = context.middleware.response;
     let invoked = -1;
     const run = async (index) => {
         if (index <= invoked) {
@@ -166,7 +215,7 @@ export async function executeRoute(route, context) {
         invoked = index;
         const layer = layers[index];
         if (layer === undefined) {
-            return normalizeResponse(await route.handler(context));
+            return mergeRouteResponse(ambient, await normalizeResponse(await route.handler(context)));
         }
         let downstream;
         const result = await layer(context.middleware, async () => {
@@ -174,12 +223,19 @@ export async function executeRoute(route, context) {
             return downstream;
         });
         if (result instanceof HttpResponseContext) {
-            return result;
+            return mergeRouteResponse(ambient, result);
+        }
+        /*
+         * A guard (permissions, tenancy) refusing the request. Before this was
+         * honoured the returned object was ignored and the ambient 200 went out.
+         */
+        if (isGuardResponse(result)) {
+            return applyGuardResponse(ambient, result);
         }
         if (typeof Response !== "undefined" && result instanceof Response) {
-            return normalizeResponse(result);
+            return mergeRouteResponse(ambient, await normalizeResponse(result));
         }
-        return downstream ?? context.middleware.response;
+        return downstream ?? ambient;
     };
     return run(0);
 }

package/dist/httpRouter/core/factory/httpRoute.factory.js

@@ -4,7 +4,7 @@
 import { HttpRouter } from "../register/httpRouter.register.js";
 import { HttpRouterGroup } from "../group/httpRouterGroup.core.js";
 import { RouteConflictError, InvalidRoutePatternError, } from "../error/httpRouter.error.js";
-import { normalizePath } from "../util/httpRoute.util.js";
+import { normalizeRoutePattern } from "../util/httpRoute.util.js";
 /**
  * Creates a new HTTP router instance.
  */
@@ -17,7 +17,7 @@ export function createRouter(options = {}) {
 export function createRoute(definition) {
     return {
         ...definition,
-        path: normalizePath(definition.path),
+        path: normalizeRoutePattern(definition.path),
         middleware: Object.freeze([...(definition.middleware ?? [])]),
         metadata: Object.freeze({ ...(definition.metadata ?? {}) }),
     };
@@ -26,7 +26,7 @@ export function createRoute(definition) {
  * Builds a route path from a pattern and parameters.
  */
 export function buildRoutePath(pattern, params = {}) {
-    const normalized = normalizePath(pattern);
+    const normalized = normalizeRoutePattern(pattern);
     return normalized
         .replace(/:([a-zA-Z_][a-zA-Z0-9_-]*)(\?)?/g, (_match, name, optional) => {
         const value = params[name];

package/dist/httpRouter/core/group/httpRouterGroup.core.js

@@ -4,6 +4,7 @@
  * Registers routes against a parent router under a shared path prefix and a
  * shared set of default route options.
  */
+import { mergeRouteOpenAPI } from "../../../httpOpenApi/routeTable/routeTable.merge.js";
 export class HttpRouterGroup {
     router;
     prefix;
@@ -51,7 +52,15 @@ export class HttpRouterGroup {
         return `${left}/${right}` || "/";
     }
     mergeOptions(options) {
+        /*
+         * `metadata.openapi` is the same setting as `openapi` (the router stores
+         * one as the other). Reading only `openapi` let a group's documentation
+         * defaults replace a route's `metadata: { openapi: false }`, publishing
+         * a route its author had hidden.
+         */
+        const openapi = mergeRouteOpenAPI(openAPIOf(this.defaults), openAPIOf(options));
         return {
+            ...(openapi === undefined ? {} : { openapi }),
             name: options.name ?? this.defaults.name,
             middleware: [
                 ...(this.defaults.middleware ?? []),
@@ -65,4 +74,8 @@ export class HttpRouterGroup {
         };
     }
 }
+function openAPIOf(options) {
+    return options.openapi ??
+        options.metadata?.["openapi"];
+}
 //# sourceMappingURL=httpRouterGroup.core.js.map

package/dist/httpRouter/core/register/httpRouter.register.js

@@ -4,9 +4,9 @@
 import { HttpRouterError, RouteConflictError, } from "../error/httpRouter.error.js";
 import { HttpRouterGroup } from "../group/httpRouterGroup.core.js";
 import { collectAllowedMethods, createFallbackRoute, createOptionsResponse, defaultMethodNotAllowedHandler, defaultNotFoundHandler, executeRoute, extractRouteSequence, isHttpMethod, normalizeMethod, normalizeMethods, normalizeResponse, } from "../factory/httpRoute.factory.base.js";
-import { getRequestMethod, getRequestSignal, getRequestUrl, normalizePath, parseQuery, parseUrl, } from "../util/httpRoute.util.js";
+import { getRequestMethod, getRequestSignal, applyRouteParams, getRequestUrl, normalizeMatchPath, normalizePath, normalizeRoutePattern, parseQuery, parseUrl, } from "../util/httpRoute.util.js";
 import { matchCompiledRoute } from "../../matching/httpRoute.matcher.core.js";
-import { compileRoute } from "../../pattern/httpRoute.pattern.parse.js";
+import { compareSegmentSpecificity, compileRoute, } from "../../pattern/httpRoute.pattern.parse.js";
 import { createRouterMiddlewareContext } from "../../httpRouter.context.js";
 export class HttpRouter {
     routes = [];
@@ -36,6 +36,7 @@ export class HttpRouter {
                 middleware: definition.middleware,
                 metadata: definition.metadata,
                 strictTrailingSlash: definition.strictTrailingSlash,
+                openapi: definition.openapi,
             });
         }
         return () => {
@@ -90,7 +91,7 @@ export class HttpRouter {
     remove(method, path) {
         const normalizedMethod = normalizeMethod(method);
         const index = this.routes.findIndex((route) => route.definition.method === normalizedMethod &&
-            route.definition.path === normalizePath(path));
+            route.definition.path === normalizeRoutePattern(path));
         if (index === -1) {
             return false;
         }
@@ -122,11 +123,13 @@ export class HttpRouter {
     match(method, path) {
         const normalizedMethod = method.toUpperCase();
         const normalizedPath = normalizePath(path);
+        const matchPath = normalizeMatchPath(path);
         const candidates = this.sortedRoutes();
+        const allowedForPath = () => collectAllowedMethods(candidates, matchPath, this.routerOptions.caseSensitive);
         const allowed = new Set();
         let pathMatched = false;
         for (const route of candidates) {
-            const params = matchCompiledRoute(route, normalizedPath, this.routerOptions.caseSensitive);
+            const params = matchCompiledRoute(route, matchPath, this.routerOptions.caseSensitive);
             if (!params) {
                 continue;
             }
@@ -137,9 +140,7 @@ export class HttpRouter {
                     matched: true,
                     route: route.definition,
                     params,
-                    allowedMethods: Object.freeze([
-                        ...collectAllowedMethods(candidates, normalizedPath),
-                    ]),
+                    allowedMethods: Object.freeze([...allowedForPath()]),
                     path: normalizedPath,
                     method: normalizedMethod,
                 };
@@ -153,16 +154,13 @@ export class HttpRouter {
                 if (route.definition.method !== "GET") {
                     continue;
                 }
-                const params = matchCompiledRoute(route, normalizedPath, this.routerOptions.caseSensitive);
+                const params = matchCompiledRoute(route, matchPath, this.routerOptions.caseSensitive);
                 if (params) {
                     return {
                         matched: true,
                         route: route.definition,
                         params,
-                        allowedMethods: Object.freeze([
-                            ...collectAllowedMethods(candidates, normalizedPath),
-                            "HEAD",
-                        ]),
+                        allowedMethods: Object.freeze([...allowedForPath(), "HEAD"]),
                         path: normalizedPath,
                         method: normalizedMethod,
                     };
@@ -176,10 +174,7 @@ export class HttpRouter {
                 matched: true,
                 route: undefined,
                 params: {},
-                allowedMethods: Object.freeze([
-                    ...collectAllowedMethods(candidates, normalizedPath),
-                    "OPTIONS",
-                ]),
+                allowedMethods: Object.freeze([...allowedForPath(), "OPTIONS"]),
                 path: normalizedPath,
                 method: normalizedMethod,
             };
@@ -217,6 +212,7 @@ export class HttpRouter {
             signal,
         };
         if (match.matched && match.route) {
+            applyRouteParams(request, match.params);
             const response = await executeRoute(match.route, routerContext);
             return {
                 response: await normalizeResponse(response),
@@ -261,11 +257,11 @@ export class HttpRouter {
     /* ------------------------------------------------------------------------ */
     register(method, path, handler, options) {
         const normalizedMethod = normalizeMethod(method);
-        const normalizedPath = normalizePath(path);
+        const normalizedPath = normalizeRoutePattern(path);
         if (typeof handler !== "function") {
             throw new HttpRouterError("Route handler must be a function.");
         }
-        const compiled = compileRoute(normalizedPath, this.routerOptions.strictTrailingSlash ||
+        const compiled = compileRoute(path, this.routerOptions.strictTrailingSlash ||
             options.strictTrailingSlash === true);
         const existing = this.routes.find((route) => route.definition.method === normalizedMethod &&
             route.definition.path === normalizedPath);
@@ -281,6 +277,7 @@ export class HttpRouter {
             params: {},
             metadata: Object.freeze({
                 ...(options.metadata ?? {}),
+                ...(options.openapi === undefined ? {} : { openapi: options.openapi }),
             }),
             handler,
             middleware: Object.freeze([...(options.middleware ?? [])]),
@@ -290,6 +287,7 @@ export class HttpRouter {
             segments: compiled.segments,
             score: compiled.score,
             strictTrailingSlash: compiled.strictTrailingSlash,
+            expectsTrailingSlash: compiled.expectsTrailingSlash,
         });
         return () => {
             this.remove(normalizedMethod, normalizedPath);
@@ -297,9 +295,9 @@ export class HttpRouter {
     }
     sortedRoutes() {
         return [...this.routes].sort((left, right) => {
-            const score = right.score - left.score;
-            if (score !== 0) {
-                return score;
+            const specificity = compareSegmentSpecificity(left.segments, right.segments);
+            if (specificity !== 0) {
+                return specificity;
             }
             return (extractRouteSequence(left.definition.id) -
                 extractRouteSequence(right.definition.id));