@zudojs/http 1.3.0 → 1.4.0

package/dist/httpRequest/requestId/httpRequest.requestId.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Incoming request id handling.
+ *
+ * @module httpRequest/requestId
+ */
+/** Longest incoming `x-request-id` value reused as `request.id`. */
+export declare const MAX_INCOMING_REQUEST_ID_LENGTH = 128;
+/**
+ * Characters an incoming request id may contain: letters, digits and
+ * `.`, `_`, `:`, `-`. That covers UUIDs, ULIDs, W3C trace ids and the
+ * `service:counter` style many proxies emit, and rules out spaces, quotes,
+ * control characters and anything else that could forge a log field.
+ */
+export declare const INCOMING_REQUEST_ID_PATTERN: RegExp;
+/**
+ * Returns the incoming request id when it is safe to reuse, otherwise
+ * `undefined` (the caller then generates one).
+ *
+ * The header is client-controlled, so it is only trusted when it is 1 to
+ * {@link MAX_INCOMING_REQUEST_ID_LENGTH} characters from
+ * {@link INCOMING_REQUEST_ID_PATTERN}. A header sent more than once (joined
+ * with `", "` by Node) fails the pattern and is ignored.
+ */
+export declare function resolveIncomingRequestId(value: string | readonly string[] | undefined): string | undefined;
+//# sourceMappingURL=httpRequest.requestId.d.ts.map

package/dist/httpRequest/requestId/httpRequest.requestId.js

@@ -0,0 +1,34 @@
+/**
+ * Incoming request id handling.
+ *
+ * @module httpRequest/requestId
+ */
+/** Longest incoming `x-request-id` value reused as `request.id`. */
+export const MAX_INCOMING_REQUEST_ID_LENGTH = 128;
+/**
+ * Characters an incoming request id may contain: letters, digits and
+ * `.`, `_`, `:`, `-`. That covers UUIDs, ULIDs, W3C trace ids and the
+ * `service:counter` style many proxies emit, and rules out spaces, quotes,
+ * control characters and anything else that could forge a log field.
+ */
+export const INCOMING_REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]+$/;
+/**
+ * Returns the incoming request id when it is safe to reuse, otherwise
+ * `undefined` (the caller then generates one).
+ *
+ * The header is client-controlled, so it is only trusted when it is 1 to
+ * {@link MAX_INCOMING_REQUEST_ID_LENGTH} characters from
+ * {@link INCOMING_REQUEST_ID_PATTERN}. A header sent more than once (joined
+ * with `", "` by Node) fails the pattern and is ignored.
+ */
+export function resolveIncomingRequestId(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const id = value.trim();
+    if (id.length === 0 || id.length > MAX_INCOMING_REQUEST_ID_LENGTH) {
+        return undefined;
+    }
+    return INCOMING_REQUEST_ID_PATTERN.test(id) ? id : undefined;
+}
+//# sourceMappingURL=httpRequest.requestId.js.map

package/dist/httpRequest/requestId/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * @zudojs/http/httpRequest/requestId
+ *
+ * Validation of an incoming `x-request-id` before it becomes `request.id`.
+ */
+export { MAX_INCOMING_REQUEST_ID_LENGTH, INCOMING_REQUEST_ID_PATTERN, resolveIncomingRequestId, } from "./httpRequest.requestId.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/httpRequest/requestId/index.js

@@ -0,0 +1,7 @@
+/**
+ * @zudojs/http/httpRequest/requestId
+ *
+ * Validation of an incoming `x-request-id` before it becomes `request.id`.
+ */
+export { MAX_INCOMING_REQUEST_ID_LENGTH, INCOMING_REQUEST_ID_PATTERN, resolveIncomingRequestId, } from "./httpRequest.requestId.js";
+//# sourceMappingURL=index.js.map

package/dist/httpResponse/httpResponse.writer.js

@@ -183,10 +183,21 @@ export function normalizeBody(body) {
 /* -------------------------------------------------------------------------- */
 export async function writeReadableStream(stream, writer) {
     const reader = stream.getReader();
+    let finished = false;
     try {
         while (true) {
+            /*
+             * A sink that stopped accepting data (the client disconnected) will
+             * never drain. Without this check an unbounded stream — server-sent
+             * events, a proxied download — kept being pulled into a dead socket
+             * for as long as its source produced.
+             */
+            if (writer.writable === false) {
+                break;
+            }
             const result = await reader.read();
             if (result.done) {
+                finished = true;
                 break;
             }
             if (result.value) {
@@ -198,6 +209,10 @@ export async function writeReadableStream(stream, writer) {
         }
     }
     finally {
+        if (!finished) {
+            /* Tell the source to stop producing; its failure is not ours. */
+            await reader.cancel().catch(() => undefined);
+        }
         reader.releaseLock();
     }
 }

package/dist/httpRouter/core/factory/httpRoute.factory.base.d.ts

@@ -4,7 +4,7 @@
  * Internal normalization, validation, execution, and response utilities for
  * route creation and dispatch.
  */
-import type { HttpMethod, MatchedRoute, CompiledRoute, HttpRouterContext, HttpRouterRequestContext } from "../types/httpRouter.type.js";
+import type { HttpMethod, MatchedRoute, CompiledRoute, HttpRouterContext, HttpRouterRequestContext, RouterHandlerResult } from "../types/httpRouter.type.js";
 import { type HttpResponseContext as ResponseContext } from "../../../httpResponse/httpResponse.context.js";
 export declare function normalizeMethod(method: string): HttpMethod | "*";
 export declare function normalizeMethods(method: HttpMethod | readonly HttpMethod[] | "*"): readonly (HttpMethod | "*")[];
@@ -33,9 +33,12 @@ export declare function extractRouteSequence(id: string): number;
  */
 export declare function createFallbackRoute(path: string, method: string): MatchedRoute;
 /**
- * Coerces a handler result into a response context.
+ * Coerces a handler result into a response context: a response context or
+ * web `Response` as built, `undefined`/`null` as `204`, and any other value
+ * as a `200` JSON body, the way server handlers treat a plain value. A
+ * plain object used to be dropped for an empty `204`.
  */
-export declare function normalizeResponse(value: ResponseContext | Response | void): Promise<ResponseContext>;
+export declare function normalizeResponse(value: RouterHandlerResult): Promise<ResponseContext>;
 /**
  * Builds the automatic `OPTIONS` response for a matched path.
  */

package/dist/httpRouter/core/factory/httpRoute.factory.base.js

@@ -4,10 +4,13 @@
  * Internal normalization, validation, execution, and response utilities for
  * route creation and dispatch.
  */
+import { isGuardResponse } from "@zudojs/middleware";
 import { HttpRouterError } from "../error/httpRouter.error.js";
 import { formatAllowHeader } from "../../../httpMethods/http.methods.js";
 import { matchCompiledRoute } from "../../matching/httpRoute.matcher.core.js";
 import { HttpResponseContext, } from "../../../httpResponse/httpResponse.context.js";
+import { bufferWebResponse } from "../../../httpResponse/httpResponse.fromWeb.js";
+import { applyGuardResponse } from "../../../httpMiddleware/pipeline/httpPipeline.guardResponse.js";
 /* -------------------------------------------------------------------------- */
 /* Method Helpers                                                             */
 /* -------------------------------------------------------------------------- */
@@ -99,24 +102,27 @@ export function createFallbackRoute(path, method) {
 /* Response Helpers                                                           */
 /* -------------------------------------------------------------------------- */
 /**
- * Coerces a handler result into a response context.
+ * Coerces a handler result into a response context: a response context or
+ * web `Response` as built, `undefined`/`null` as `204`, and any other value
+ * as a `200` JSON body, the way server handlers treat a plain value. A
+ * plain object used to be dropped for an empty `204`.
  */
 export async function normalizeResponse(value) {
     if (value instanceof HttpResponseContext) {
         return value;
     }
     if (typeof Response !== "undefined" && value instanceof Response) {
-        const body = value.body === null
-            ? undefined
-            : new Uint8Array(await value.arrayBuffer());
-        return new HttpResponseContext({
-            status: value.status,
-            statusText: value.statusText,
-            headers: Object.fromEntries(value.headers.entries()),
-            body,
-        });
+        /*
+         * `Object.fromEntries(headers.entries())` folded every `Set-Cookie` into
+         * one comma-joined value, which browsers read as a single malformed
+         * cookie. `bufferWebResponse` keeps each cookie separate.
+         */
+        return bufferWebResponse(value);
+    }
+    if (value === undefined || value === null) {
+        return new HttpResponseContext({ status: 204 });
     }
-    return new HttpResponseContext({ status: 204 });
+    return new HttpResponseContext({ status: 200 }).json(value);
 }
 /**
  * Builds the automatic `OPTIONS` response for a matched path.
@@ -219,6 +225,13 @@ export async function executeRoute(route, context) {
         if (result instanceof HttpResponseContext) {
             return mergeRouteResponse(ambient, result);
         }
+        /*
+         * A guard (permissions, tenancy) refusing the request. Before this was
+         * honoured the returned object was ignored and the ambient 200 went out.
+         */
+        if (isGuardResponse(result)) {
+            return applyGuardResponse(ambient, result);
+        }
         if (typeof Response !== "undefined" && result instanceof Response) {
             return mergeRouteResponse(ambient, await normalizeResponse(result));
         }

package/dist/httpRouter/core/group/httpRouterGroup.core.js

@@ -4,6 +4,7 @@
  * Registers routes against a parent router under a shared path prefix and a
  * shared set of default route options.
  */
+import { mergeRouteOpenAPI } from "../../../httpOpenApi/routeTable/routeTable.merge.js";
 export class HttpRouterGroup {
     router;
     prefix;
@@ -51,7 +52,15 @@ export class HttpRouterGroup {
         return `${left}/${right}` || "/";
     }
     mergeOptions(options) {
+        /*
+         * `metadata.openapi` is the same setting as `openapi` (the router stores
+         * one as the other). Reading only `openapi` let a group's documentation
+         * defaults replace a route's `metadata: { openapi: false }`, publishing
+         * a route its author had hidden.
+         */
+        const openapi = mergeRouteOpenAPI(openAPIOf(this.defaults), openAPIOf(options));
         return {
+            ...(openapi === undefined ? {} : { openapi }),
             name: options.name ?? this.defaults.name,
             middleware: [
                 ...(this.defaults.middleware ?? []),
@@ -65,4 +74,8 @@ export class HttpRouterGroup {
         };
     }
 }
+function openAPIOf(options) {
+    return options.openapi ??
+        options.metadata?.["openapi"];
+}
 //# sourceMappingURL=httpRouterGroup.core.js.map

package/dist/httpRouter/core/register/httpRouter.register.js

@@ -4,7 +4,7 @@
 import { HttpRouterError, RouteConflictError, } from "../error/httpRouter.error.js";
 import { HttpRouterGroup } from "../group/httpRouterGroup.core.js";
 import { collectAllowedMethods, createFallbackRoute, createOptionsResponse, defaultMethodNotAllowedHandler, defaultNotFoundHandler, executeRoute, extractRouteSequence, isHttpMethod, normalizeMethod, normalizeMethods, normalizeResponse, } from "../factory/httpRoute.factory.base.js";
-import { getRequestMethod, getRequestSignal, getRequestUrl, normalizeMatchPath, normalizePath, normalizeRoutePattern, parseQuery, parseUrl, } from "../util/httpRoute.util.js";
+import { getRequestMethod, getRequestSignal, applyRouteParams, getRequestUrl, normalizeMatchPath, normalizePath, normalizeRoutePattern, parseQuery, parseUrl, } from "../util/httpRoute.util.js";
 import { matchCompiledRoute } from "../../matching/httpRoute.matcher.core.js";
 import { compareSegmentSpecificity, compileRoute, } from "../../pattern/httpRoute.pattern.parse.js";
 import { createRouterMiddlewareContext } from "../../httpRouter.context.js";
@@ -36,6 +36,7 @@ export class HttpRouter {
                 middleware: definition.middleware,
                 metadata: definition.metadata,
                 strictTrailingSlash: definition.strictTrailingSlash,
+                openapi: definition.openapi,
             });
         }
         return () => {
@@ -211,6 +212,7 @@ export class HttpRouter {
             signal,
         };
         if (match.matched && match.route) {
+            applyRouteParams(request, match.params);
             const response = await executeRoute(match.route, routerContext);
             return {
                 response: await normalizeResponse(response),
@@ -275,6 +277,7 @@ export class HttpRouter {
             params: {},
             metadata: Object.freeze({
                 ...(options.metadata ?? {}),
+                ...(options.openapi === undefined ? {} : { openapi: options.openapi }),
             }),
             handler,
             middleware: Object.freeze([...(options.middleware ?? [])]),

package/dist/httpRouter/core/types/httpRouter.type.d.ts

@@ -3,11 +3,25 @@
  *
  * Core types for routing, route definitions, and router context.
  */
+import type { RouteOpenAPIMetadata } from "@zudojs/openapi";
 import type { HttpRequestContext as RequestContext } from "../../../httpRequest/httpRequest.context.js";
 import type { HttpResponseContext as ResponseContext } from "../../../httpResponse/httpResponse.context.js";
 import type { HttpMiddleware, HttpMiddlewareContext } from "../../../httpMiddleware/httpMiddleware.type.js";
 export type HttpMethod = "GET" | "HEAD" | "POST" | "PUT" | "PATCH" | "DELETE" | "OPTIONS" | "CONNECT" | "TRACE";
-export type RouterHandler = (context: HttpRouterContext) => ResponseContext | Response | void | Promise<ResponseContext | Response | void>;
+/**
+ * A plain, JSON-serialisable value a route handler may return: an object,
+ * array, string, number, boolean or `null`.
+ */
+export type RouterJsonValue = object | string | number | boolean | null;
+/**
+ * What a route handler may return, as server handlers do:
+ * - an `HttpResponseContext` or a web `Response`: sent as built;
+ * - a plain value: sent as `200` with a JSON body
+ *   (`return { id }` is `ctx.middleware.response.json({ id })`);
+ * - `undefined` / `null`: `204 No Content`.
+ */
+export type RouterHandlerResult = ResponseContext | Response | RouterJsonValue | void;
+export type RouterHandler = (context: HttpRouterContext) => RouterHandlerResult | Promise<RouterHandlerResult>;
 export type RouterHandlerLike = RouterHandler | HttpMiddleware;
 export interface HttpRouterContext {
     readonly request: RequestContext;
@@ -18,6 +32,14 @@ export interface HttpRouterContext {
     readonly middleware: HttpMiddlewareContext;
     readonly signal: AbortSignal;
 }
+/**
+ * OpenAPI documentation a route carries: summary, tags, operationId,
+ * `params` / `query` / `headers` / `body` schemas, responses, security,
+ * `deprecated`, `hidden`. It is `@zudojs/openapi`'s `RouteOpenAPIMetadata`,
+ * so the schemas it names document the route in `generateOpenAPIDocument`.
+ * `false` hides the route from the generated document.
+ */
+export type HttpRouteOpenAPI = RouteOpenAPIMetadata | false;
 export interface RouteDefinition {
     readonly method: HttpMethod | readonly HttpMethod[] | "*";
     readonly path: string;
@@ -26,12 +48,20 @@ export interface RouteDefinition {
     readonly name?: string;
     readonly metadata?: Readonly<Record<string, unknown>>;
     readonly strictTrailingSlash?: boolean;
+    /** OpenAPI documentation; stored as `metadata.openapi`. */
+    readonly openapi?: HttpRouteOpenAPI;
 }
 export interface RouteOptions {
     readonly name?: string;
     readonly middleware?: readonly HttpMiddleware[];
     readonly metadata?: Readonly<Record<string, unknown>>;
     readonly strictTrailingSlash?: boolean;
+    /**
+     * OpenAPI documentation; stored as `metadata.openapi`, where
+     * `generateOpenAPIDocument` reads it. Takes precedence over a
+     * `metadata.openapi` passed alongside it.
+     */
+    readonly openapi?: HttpRouteOpenAPI;
 }
 export interface MatchedRoute {
     readonly id: string;

package/dist/httpRouter/core/util/httpRoute.util.d.ts

@@ -8,6 +8,14 @@ import type { HttpRequestContext as RequestContext } from "../../../httpRequest/
 export declare function getRequestMethod(request: RequestContext): string;
 export declare function getRequestUrl(request: RequestContext): string;
 export declare function getRequestSignal(request: RequestContext): AbortSignal | undefined;
+/**
+ * Copies the matched route's parameters onto the request before any route
+ * middleware runs, so `request.getParam("id")` / `request.params` see them
+ * in middleware as well as in the handler. They were only on the router
+ * context, so a guard reading the request (a permissions
+ * `extractResource`, an ownership check) always saw `undefined` and denied.
+ */
+export declare function applyRouteParams(request: RequestContext, params: Readonly<Record<string, string>>): void;
 /**
  * Parses a request-target with the canonical parser shared by the request
  * context and path-scoped middleware.

package/dist/httpRouter/core/util/httpRoute.util.js

@@ -21,6 +21,22 @@ export function getRequestUrl(request) {
 export function getRequestSignal(request) {
     return request.signal;
 }
+/**
+ * Copies the matched route's parameters onto the request before any route
+ * middleware runs, so `request.getParam("id")` / `request.params` see them
+ * in middleware as well as in the handler. They were only on the router
+ * context, so a guard reading the request (a permissions
+ * `extractResource`, an ownership check) always saw `undefined` and denied.
+ */
+export function applyRouteParams(request, params) {
+    const target = request;
+    if (typeof target.setParam !== "function") {
+        return;
+    }
+    for (const [name, value] of Object.entries(params)) {
+        target.setParam(name, value);
+    }
+}
 /**
  * Parses a request-target with the canonical parser shared by the request
  * context and path-scoped middleware.

package/dist/httpRouter/dispatch/httpRoute.dispatcher.js

@@ -5,10 +5,13 @@
  * handler pipeline. Route registration and route matching remain separate
  * concerns.
  */
+import { isGuardResponse } from "@zudojs/middleware";
+import { applyGuardResponse } from "../../httpMiddleware/pipeline/httpPipeline.guardResponse.js";
 import { HttpResponseContext } from "../../httpResponse/httpResponse.context.js";
 import { createRouterContext } from "../httpRouter.context.js";
+import { normalizeResponse } from "../core/factory/httpRoute.factory.base.js";
 import { RouterMiddlewareState } from "../httpRouter.state.js";
-import { getRequestSignal } from "../core/util/httpRoute.util.js";
+import { applyRouteParams, getRequestSignal, } from "../core/util/httpRoute.util.js";
 /* -------------------------------------------------------------------------- */
 /* Route Dispatcher                                                           */
 /* -------------------------------------------------------------------------- */
@@ -177,6 +180,8 @@ export async function dispatchRoute(dispatcher, request, response) {
 /* Context Creation                                                           */
 /* -------------------------------------------------------------------------- */
 function createDispatchContext(request, response, match) {
+    /* Route middleware reads params from the request, so set them first. */
+    applyRouteParams(request, match.params);
     return Object.freeze({
         request,
         response,
@@ -222,12 +227,20 @@ function normalizeHandler(handler) {
  */
 function toDispatchHandler(handler, context, preserveResponse = false) {
     return async (request, response) => {
-        const result = await handler(createRouterContext({
+        const returned = await handler(createRouterContext({
             request,
             route: context.route,
             params: context.params,
             signal: getRequestSignal(request),
         }));
+        /* A web Response or a plain value becomes a response context, exactly
+         * as the router treats it (a plain value is a 200 JSON body). */
+        const result = preserveResponse ||
+            returned === undefined ||
+            returned === null ||
+            returned instanceof HttpResponseContext
+            ? returned
+            : await normalizeResponse(returned);
         if (!preserveResponse &&
             result instanceof HttpResponseContext &&
             result !== response) {
@@ -254,7 +267,7 @@ function toDispatchHandler(handler, context, preserveResponse = false) {
  */
 function toRouteMiddleware(middleware, route, state) {
     return async (request, response, next) => {
-        await middleware({
+        const result = await middleware({
             request,
             response,
             state,
@@ -264,6 +277,10 @@ function toRouteMiddleware(middleware, route, state) {
             await next();
             return response;
         });
+        /* A guard's refusal is written onto the dispatch response, not dropped. */
+        if (isGuardResponse(result)) {
+            applyGuardResponse(response, result);
+        }
     };
 }
 function normalizeMiddleware(middleware) {

package/dist/httpSecurity/httpSecurity.config.js

@@ -12,6 +12,7 @@
  * adapter has its own, separately named timeout options, and those are the
  * ones that take effect.
  */
+import { INCOMING_REQUEST_ID_PATTERN } from "../httpRequest/requestId/httpRequest.requestId.js";
 /** Default security configuration. */
 export const DEFAULT_SECURITY_CONFIG = Object.freeze({
     maxBodySize: 1_048_576, // 1MB
@@ -23,7 +24,9 @@ export const DEFAULT_SECURITY_CONFIG = Object.freeze({
     requireHost: true,
     trustProxy: false,
     maxRequestIdLength: 128,
-    requestIdPattern: /^[a-zA-Z0-9_-]+$/,
+    // Same rule the adapter uses to reuse an incoming x-request-id, so an id
+    // it would accept (trace ids like `svc.a:123`) is not refused here first.
+    requestIdPattern: INCOMING_REQUEST_ID_PATTERN,
     enableCrlfProtection: true,
     enableSmugglingProtection: true,
 });

package/dist/httpServer/factory/httpServer.factory.d.ts

@@ -4,15 +4,16 @@
  * @module httpServer/factory
  */
 import { HttpServer } from "../core/httpServer.core.js";
-import type { HttpServerState, HttpServerAddress } from "../types/httpServer.type.js";
-export declare function createHttpServer(options: {
-    readonly name?: string;
-    readonly adapter: unknown;
-    readonly handler?: unknown;
-    readonly errorHandler?: unknown;
-    readonly gracefulShutdownTimeout?: number;
-    readonly metadata?: Readonly<Record<string, unknown>>;
-}): HttpServer;
+import type { HttpServerState, HttpServerAddress, HttpServerOptions } from "../types/httpServer.type.js";
+/**
+ * Creates an HTTP server around an adapter.
+ *
+ * The options are `HttpServerOptions`, so `handler: async (request) => ...`
+ * infers `request` as `HttpRequestContext` (it used to be typed `unknown`,
+ * which made the quick start fail under `strict` with TS7006), and
+ * `errorHandler` receives the thrown error and the request.
+ */
+export declare function createHttpServer(options: HttpServerOptions): HttpServer;
 export declare function startServer(server: HttpServer): Promise<HttpServer>;
 export declare function stopServer(server: HttpServer): Promise<HttpServer>;
 export declare function restartServer(server: HttpServer): Promise<HttpServer>;

package/dist/httpServer/factory/httpServer.factory.js

@@ -5,6 +5,14 @@
  */
 import { HttpServerLifecycleError } from "@zudojs/errors";
 import { HttpServer } from "../core/httpServer.core.js";
+/**
+ * Creates an HTTP server around an adapter.
+ *
+ * The options are `HttpServerOptions`, so `handler: async (request) => ...`
+ * infers `request` as `HttpRequestContext` (it used to be typed `unknown`,
+ * which made the quick start fail under `strict` with TS7006), and
+ * `errorHandler` receives the thrown error and the request.
+ */
 export function createHttpServer(options) {
     return new HttpServer(options);
 }

package/dist/index.d.ts

@@ -49,6 +49,8 @@ export * from "./httpAgent/index.js";
 export * from "./httpProxy/index.js";
 export * from "./httpSecurity/index.js";
 export * from "./httpRouter/index.js";
+export * from "./httpOpenApi/index.js";
+export * from "./httpFetchMount/index.js";
 /**
  * Several sub-modules export the same name. A star export alone would make
  * those names unavailable (TS2308), so ownership is declared explicitly here.

package/dist/index.js

@@ -49,6 +49,8 @@ export * from "./httpAgent/index.js";
 export * from "./httpProxy/index.js";
 export * from "./httpSecurity/index.js";
 export * from "./httpRouter/index.js";
+export * from "./httpOpenApi/index.js";
+export * from "./httpFetchMount/index.js";
 /* -------------------------------------------------------------------------- */
 /* Ambiguous re-exports                                                       */
 /* -------------------------------------------------------------------------- */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/http",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "HTTP primitives, request handling, routing, middleware, and server infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -24,17 +24,20 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/crypto": "1.3.0",
-    "@zudojs/errors": "1.2.0",
-    "@zudojs/logger": "1.3.0",
-    "@zudojs/security": "1.2.0"
+    "@zudojs/crypto": "1.3.1",
+    "@zudojs/errors": "1.3.0",
+    "@zudojs/logger": "1.4.0",
+    "@zudojs/middleware": "1.1.0",
+    "@zudojs/openapi": "1.5.0",
+    "@zudojs/security": "1.3.0"
   },
   "devDependencies": {
-    "@types/node": "^26.4.1",
+    "@types/node": "^26.6.2",
+    "@zudojs/schema": "1.2.0",
     "fluent-ffmpeg": "^2.1.3",
     "sharp": "^0.35.4",
     "typescript": "7.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.1"
   },
   "engines": {
     "node": ">=24.0.0"
@@ -49,7 +52,7 @@
     "middleware",
     "routing"
   ],
-  "homepage": "https://github.com/oyinlola-tech/zudo#readme",
+  "homepage": "https://zudojs.oyinlola.site/docs/packages-http",
   "bugs": {
     "url": "https://github.com/oyinlola-tech/zudo/issues"
   },