@zudojs/http 1.2.0 → 1.4.0

package/dist/httpRouter/pattern/httpRoute.pattern.parse.js

@@ -13,7 +13,7 @@
  * - `/assets/*path`         trailing wildcard
  */
 import { InvalidRoutePatternError } from "../core/error/httpRouter.error.js";
-import { splitPath, validateParameterName, } from "../core/util/httpRoute.util.js";
+import { hasTrailingSlash, splitRoutePattern, validateParameterName, } from "../core/util/httpRoute.util.js";
 const SEGMENT_SCORE_LITERAL = 3;
 const SEGMENT_SCORE_PARAMETER = 2;
 const SEGMENT_SCORE_WILDCARD = 1;
@@ -22,7 +22,7 @@ const SEGMENT_SCORE_WILDCARD = 1;
  */
 export function compileRouteSegments(path) {
     const segments = [];
-    const parts = splitPath(path);
+    const parts = splitRoutePattern(path);
     for (const part of parts) {
         if (part.startsWith(":")) {
             segments.push(parseParameter(part, path));
@@ -56,6 +56,7 @@ export function compileRoute(path, strictTrailingSlash) {
         segments,
         score: scoreSegments(segments),
         strictTrailingSlash,
+        expectsTrailingSlash: hasTrailingSlash(path),
     });
 }
 /**
@@ -64,18 +65,46 @@ export function compileRoute(path, strictTrailingSlash) {
 export function scoreSegments(segments) {
     let score = 0;
     for (const segment of segments) {
-        if (segment.type === "literal") {
-            score += SEGMENT_SCORE_LITERAL;
-        }
-        else if (segment.type === "parameter") {
-            score += SEGMENT_SCORE_PARAMETER;
-        }
-        else {
-            score += SEGMENT_SCORE_WILDCARD;
-        }
+        score += segmentScore(segment);
     }
     return score;
 }
+function segmentScore(segment) {
+    if (segment === undefined) {
+        return 0;
+    }
+    if (segment.type === "literal") {
+        return SEGMENT_SCORE_LITERAL;
+    }
+    if (segment.type === "parameter") {
+        return SEGMENT_SCORE_PARAMETER;
+    }
+    return SEGMENT_SCORE_WILDCARD;
+}
+/**
+ * Compares two compiled patterns by specificity, most specific first.
+ *
+ * Segments are compared left to right by kind (literal, then parameter, then
+ * wildcard), which is how a router is expected to rank patterns. Summing the
+ * kinds into one scalar — as this used to — let a longer but entirely
+ * parameterised pattern such as `/:p/:q/:r/:s` outrank a literal-anchored
+ * `/admin/*rest`, so a request to `/admin/a/b/c` bypassed the admin route and
+ * every guard registered on it.
+ *
+ * @param left - The first pattern's segments.
+ * @param right - The second pattern's segments.
+ * @returns A negative number when `left` is more specific.
+ */
+export function compareSegmentSpecificity(left, right) {
+    const length = Math.max(left.length, right.length);
+    for (let index = 0; index < length; index += 1) {
+        const difference = segmentScore(right[index]) - segmentScore(left[index]);
+        if (difference !== 0) {
+            return difference;
+        }
+    }
+    return 0;
+}
 function parseParameter(segment, path) {
     let value = segment.slice(1);
     let optional = false;

package/dist/httpRouter/pattern/index.d.ts

@@ -14,6 +14,6 @@ export { parseSegments } from "./core/httpPattern.segmentParsing.js";
 export { buildRegex } from "./core/httpPattern.regexBuilding.js";
 export { testRoutePattern, matchRoutePattern, matchRoutePatterns, testRoutePatterns, } from "./core/httpPattern.matching.js";
 export { createRoutePattern, createStrictRoutePattern, createCaseInsensitiveRoutePattern, } from "./httpPattern.factory.js";
-export { compileRoute, compileRouteSegments, scoreSegments, } from "./httpRoute.pattern.parse.js";
+export { compileRoute, compileRouteSegments, scoreSegments, compareSegmentSpecificity, } from "./httpRoute.pattern.parse.js";
 export type { CompiledRoutePath } from "./httpRoute.pattern.parse.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/httpRouter/pattern/index.js

@@ -13,5 +13,5 @@ export { parseSegments } from "./core/httpPattern.segmentParsing.js";
 export { buildRegex } from "./core/httpPattern.regexBuilding.js";
 export { testRoutePattern, matchRoutePattern, matchRoutePatterns, testRoutePatterns, } from "./core/httpPattern.matching.js";
 export { createRoutePattern, createStrictRoutePattern, createCaseInsensitiveRoutePattern, } from "./httpPattern.factory.js";
-export { compileRoute, compileRouteSegments, scoreSegments, } from "./httpRoute.pattern.parse.js";
+export { compileRoute, compileRouteSegments, scoreSegments, compareSegmentSpecificity, } from "./httpRoute.pattern.parse.js";
 //# sourceMappingURL=index.js.map

package/dist/httpSecurity/httpSecurity.config.js

@@ -12,6 +12,7 @@
  * adapter has its own, separately named timeout options, and those are the
  * ones that take effect.
  */
+import { INCOMING_REQUEST_ID_PATTERN } from "../httpRequest/requestId/httpRequest.requestId.js";
 /** Default security configuration. */
 export const DEFAULT_SECURITY_CONFIG = Object.freeze({
     maxBodySize: 1_048_576, // 1MB
@@ -23,7 +24,9 @@ export const DEFAULT_SECURITY_CONFIG = Object.freeze({
     requireHost: true,
     trustProxy: false,
     maxRequestIdLength: 128,
-    requestIdPattern: /^[a-zA-Z0-9_-]+$/,
+    // Same rule the adapter uses to reuse an incoming x-request-id, so an id
+    // it would accept (trace ids like `svc.a:123`) is not refused here first.
+    requestIdPattern: INCOMING_REQUEST_ID_PATTERN,
     enableCrlfProtection: true,
     enableSmugglingProtection: true,
 });

package/dist/httpSecurity/httpSecurity.validator.js

@@ -20,14 +20,23 @@ export function validateHeaders(headers, config) {
     if (entries.length > cfg.maxHeaders) {
         errors.push(`Too many headers: ${entries.length} > ${cfg.maxHeaders}`);
     }
+    /*
+     * `IncomingMessage.headers` returns an array for `set-cookie` and for any
+     * header a non-Node caller supplies as a list. Checking only `typeof value
+     * === "string"` let every one of those values past the size cap and the
+     * CRLF filter while the guard still reported `allowed: true`.
+     */
     for (const [key, value] of entries) {
-        if (typeof value === "string" && value.length > cfg.maxHeaderValueSize) {
-            errors.push(`Header "${key}" value too large: ${value.length} > ${cfg.maxHeaderValueSize}`);
-        }
-        if (cfg.enableCrlfProtection &&
-            typeof value === "string" &&
-            /[\r\n]/.test(value)) {
-            errors.push(`Header "${key}" contains CRLF characters`);
+        for (const element of Array.isArray(value) ? value : [value]) {
+            if (typeof element !== "string") {
+                continue;
+            }
+            if (element.length > cfg.maxHeaderValueSize) {
+                errors.push(`Header "${key}" value too large: ${element.length} > ${cfg.maxHeaderValueSize}`);
+            }
+            if (cfg.enableCrlfProtection && /[\r\n]/.test(element)) {
+                errors.push(`Header "${key}" contains CRLF characters`);
+            }
         }
     }
     return { valid: errors.length === 0, errors };

package/dist/httpServer/factory/httpServer.factory.d.ts

@@ -4,15 +4,16 @@
  * @module httpServer/factory
  */
 import { HttpServer } from "../core/httpServer.core.js";
-import type { HttpServerState, HttpServerAddress } from "../types/httpServer.type.js";
-export declare function createHttpServer(options: {
-    readonly name?: string;
-    readonly adapter: unknown;
-    readonly handler?: unknown;
-    readonly errorHandler?: unknown;
-    readonly gracefulShutdownTimeout?: number;
-    readonly metadata?: Readonly<Record<string, unknown>>;
-}): HttpServer;
+import type { HttpServerState, HttpServerAddress, HttpServerOptions } from "../types/httpServer.type.js";
+/**
+ * Creates an HTTP server around an adapter.
+ *
+ * The options are `HttpServerOptions`, so `handler: async (request) => ...`
+ * infers `request` as `HttpRequestContext` (it used to be typed `unknown`,
+ * which made the quick start fail under `strict` with TS7006), and
+ * `errorHandler` receives the thrown error and the request.
+ */
+export declare function createHttpServer(options: HttpServerOptions): HttpServer;
 export declare function startServer(server: HttpServer): Promise<HttpServer>;
 export declare function stopServer(server: HttpServer): Promise<HttpServer>;
 export declare function restartServer(server: HttpServer): Promise<HttpServer>;

package/dist/httpServer/factory/httpServer.factory.js

@@ -5,6 +5,14 @@
  */
 import { HttpServerLifecycleError } from "@zudojs/errors";
 import { HttpServer } from "../core/httpServer.core.js";
+/**
+ * Creates an HTTP server around an adapter.
+ *
+ * The options are `HttpServerOptions`, so `handler: async (request) => ...`
+ * infers `request` as `HttpRequestContext` (it used to be typed `unknown`,
+ * which made the quick start fail under `strict` with TS7006), and
+ * `errorHandler` receives the thrown error and the request.
+ */
 export function createHttpServer(options) {
     return new HttpServer(options);
 }

package/dist/index.d.ts

@@ -49,6 +49,8 @@ export * from "./httpAgent/index.js";
 export * from "./httpProxy/index.js";
 export * from "./httpSecurity/index.js";
 export * from "./httpRouter/index.js";
+export * from "./httpOpenApi/index.js";
+export * from "./httpFetchMount/index.js";
 /**
  * Several sub-modules export the same name. A star export alone would make
  * those names unavailable (TS2308), so ownership is declared explicitly here.

package/dist/index.js

@@ -49,6 +49,8 @@ export * from "./httpAgent/index.js";
 export * from "./httpProxy/index.js";
 export * from "./httpSecurity/index.js";
 export * from "./httpRouter/index.js";
+export * from "./httpOpenApi/index.js";
+export * from "./httpFetchMount/index.js";
 /* -------------------------------------------------------------------------- */
 /* Ambiguous re-exports                                                       */
 /* -------------------------------------------------------------------------- */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/http",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "HTTP primitives, request handling, routing, middleware, and server infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -24,17 +24,20 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/crypto": "1.2.0",
-    "@zudojs/errors": "1.1.0",
-    "@zudojs/logger": "1.2.0",
-    "@zudojs/security": "1.1.0"
+    "@zudojs/crypto": "1.3.1",
+    "@zudojs/errors": "1.3.0",
+    "@zudojs/logger": "1.4.0",
+    "@zudojs/middleware": "1.1.0",
+    "@zudojs/openapi": "1.5.0",
+    "@zudojs/security": "1.3.0"
   },
   "devDependencies": {
-    "@types/node": "^26.4.1",
+    "@types/node": "^26.6.2",
+    "@zudojs/schema": "1.2.0",
     "fluent-ffmpeg": "^2.1.3",
     "sharp": "^0.35.4",
     "typescript": "7.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.1"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -49,7 +52,7 @@
     "middleware",
     "routing"
   ],
-  "homepage": "https://github.com/oyinlola-tech/zudo#readme",
+  "homepage": "https://zudojs.oyinlola.site/docs/packages-http",
   "bugs": {
     "url": "https://github.com/oyinlola-tech/zudo/issues"
   },