@zudojs/http 1.4.0 → 1.4.2

package/README.md

@@ -83,8 +83,9 @@ answers 502 and never exposes the cause.
   UUID is generated, so an id copied into logs can never carry spaces,
   quotes or control characters. `createNodeHttpAdapter({ trustRequestId:
   false })` always generates one. The request guard's own `X-Request-Id`
-  check (letters, digits, `_`, `-`) still answers 400 to a malformed header
-  first unless it is tuned or turned off.
+  check uses the same character set and length, so an id the adapter would
+  reuse is never refused first; anything else is answered with 400 unless the
+  guard is tuned or turned off.
 - Signed-cookie signatures are compared with `@zudojs/crypto`'s constant-time
   `timingSafeEqualString`.
 - Contexts built by the stock adapters log through a `@zudojs/logger` console

package/dist/httpMiddleware/pipeline/httpPipeline.helper.js

@@ -8,7 +8,7 @@ import { HttpRequestContext as RequestContext } from "../../httpRequest/httpRequ
 import { HttpResponseContext as ResponseContext } from "../../httpResponse/httpResponse.context.js";
 import { isWebResponse, webResponseToContext, } from "../../httpResponse/httpResponse.fromWeb.js";
 import { HttpMiddlewareError } from "../httpMiddleware.error.js";
-import { guardResponseToContext } from "./httpPipeline.guardResponse.js";
+import { applyGuardResponse, guardResponseToContext, } from "./httpPipeline.guardResponse.js";
 export async function nextResult(context, dispatch, index) {
     return dispatch(index + 1);
 }
@@ -32,7 +32,12 @@ export function normalizeResult(result, fallback) {
      * were a response context.
      */
     if (isGuardResponse(result)) {
-        return guardResponseToContext(result);
+        // Written onto the ambient response when there is one, so headers an
+        // outer middleware set before `next()` (CORS, request id, security
+        // headers) survive a refusal, as they do on the router path.
+        return fallback instanceof ResponseContext
+            ? applyGuardResponse(fallback, result)
+            : guardResponseToContext(result);
     }
     /*
      * The `Response` check must come first. `isResponseContext` tests for a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/http",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "HTTP primitives, request handling, routing, middleware, and server infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -26,14 +26,14 @@
   "dependencies": {
     "@zudojs/crypto": "1.3.1",
     "@zudojs/errors": "1.3.0",
-    "@zudojs/logger": "1.4.0",
+    "@zudojs/logger": "1.4.1",
     "@zudojs/middleware": "1.1.0",
     "@zudojs/openapi": "1.5.0",
-    "@zudojs/security": "1.3.0"
+    "@zudojs/security": "1.3.1"
   },
   "devDependencies": {
     "@types/node": "^26.6.2",
-    "@zudojs/schema": "1.2.0",
+    "@zudojs/schema": "1.2.1",
     "fluent-ffmpeg": "^2.1.3",
     "sharp": "^0.35.4",
     "typescript": "7.0.2",