@zudojs/http 1.4.4 → 1.5.0

package/dist/httpAdapter/errorResponse/httpAdapterError.headers.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Headers the adapters add to the responses they build themselves.
+ *
+ * A response that never passes through the middleware pipeline — a request
+ * refused by the guard, the adapter's own `413`, an unhandled error, the
+ * response a custom `errorHandler` returns — used to leave without a single
+ * security header, because `createSecurityMiddleware` only decorates
+ * responses that flow back through it. Those are exactly the responses an
+ * attacker provokes on purpose.
+ *
+ * @module httpAdapter/errorResponse/headers
+ */
+import type { HttpResponseContext } from "../../httpResponse/httpResponse.context.js";
+/**
+ * The adapter's `securityHeaders` option.
+ *
+ * - `true` / omitted (default): the package's default security header set
+ *   ({@link createDefaultSecurityHeaders}).
+ * - an object: exactly those headers instead.
+ * - `false`: none.
+ */
+export type AdapterSecurityHeadersOption = boolean | Readonly<Record<string, string>>;
+/**
+ * Resolves the option to the header set the adapter applies.
+ *
+ * @throws {TypeError} If a configured value contains a control character.
+ */
+export declare function resolveAdapterSecurityHeaders(option: AdapterSecurityHeadersOption | undefined): Readonly<Record<string, string>>;
+/**
+ * Sets each header the response does not already carry.
+ *
+ * A custom error handler that set its own `Retry-After` or `Cache-Control`
+ * keeps it; only the gaps are filled.
+ */
+export declare function applyMissingHeaders(response: HttpResponseContext, headers: Readonly<Record<string, string>>): HttpResponseContext;
+/**
+ * Finishes a response the adapter built for a failed request: the thrown
+ * error's own headers (`Retry-After`, `WWW-Authenticate`, `Allow`) where the
+ * response lacks them — a custom `errorHandler` used to have to copy them by
+ * hand — and then the adapter's security headers.
+ *
+ * @param response - The response about to be written.
+ * @param securityHeaders - The adapter's resolved header set.
+ * @param error - The error being answered, if any.
+ */
+export declare function finalizeErrorResponse(response: HttpResponseContext, securityHeaders: Readonly<Record<string, string>>, error?: unknown): HttpResponseContext;

package/dist/httpAdapter/errorResponse/httpAdapterError.headers.js

@@ -0,0 +1,68 @@
+/**
+ * Headers the adapters add to the responses they build themselves.
+ *
+ * A response that never passes through the middleware pipeline — a request
+ * refused by the guard, the adapter's own `413`, an unhandled error, the
+ * response a custom `errorHandler` returns — used to leave without a single
+ * security header, because `createSecurityMiddleware` only decorates
+ * responses that flow back through it. Those are exactly the responses an
+ * attacker provokes on purpose.
+ *
+ * @module httpAdapter/errorResponse/headers
+ */
+import { isValidHeaderFieldValue } from "../../httpHeaders/security/index.js";
+import { createDefaultSecurityHeaders } from "../../httpSecurityHeaders/httpSecurityHeader.recommended.js";
+import { resolveErrorResponse } from "./httpAdapterError.response.js";
+/**
+ * Resolves the option to the header set the adapter applies.
+ *
+ * @throws {TypeError} If a configured value contains a control character.
+ */
+export function resolveAdapterSecurityHeaders(option) {
+    if (option === false) {
+        return Object.freeze({});
+    }
+    const headers = option === undefined || option === true
+        ? { ...createDefaultSecurityHeaders() }
+        : {};
+    if (typeof option === "object") {
+        for (const [name, value] of Object.entries(option)) {
+            if (!isValidHeaderFieldValue(value)) {
+                throw new TypeError(`Invalid value for security header "${name}": it contains a control character or surrounding whitespace.`);
+            }
+            headers[name.toLowerCase()] = value;
+        }
+    }
+    return Object.freeze(headers);
+}
+/**
+ * Sets each header the response does not already carry.
+ *
+ * A custom error handler that set its own `Retry-After` or `Cache-Control`
+ * keeps it; only the gaps are filled.
+ */
+export function applyMissingHeaders(response, headers) {
+    const existing = response.headers;
+    for (const [name, value] of Object.entries(headers)) {
+        if (existing[name.toLowerCase()] === undefined) {
+            response.setHeader(name, value);
+        }
+    }
+    return response;
+}
+/**
+ * Finishes a response the adapter built for a failed request: the thrown
+ * error's own headers (`Retry-After`, `WWW-Authenticate`, `Allow`) where the
+ * response lacks them — a custom `errorHandler` used to have to copy them by
+ * hand — and then the adapter's security headers.
+ *
+ * @param response - The response about to be written.
+ * @param securityHeaders - The adapter's resolved header set.
+ * @param error - The error being answered, if any.
+ */
+export function finalizeErrorResponse(response, securityHeaders, error) {
+    if (error !== undefined) {
+        applyMissingHeaders(response, resolveErrorResponse(error).headers);
+    }
+    return applyMissingHeaders(response, securityHeaders);
+}

package/dist/httpAdapter/errorResponse/httpAdapterError.issues.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Public projection of validation issues.
+ *
+ * @module httpAdapter/errorResponse/issues
+ */
+/**
+ * Reduces validation issues to the fields a client may see: where
+ * (`path` / `field`), what (`code`) and why (`message`). Submitted values
+ * (`value`, `received`, `input`) are never echoed.
+ */
+export declare function publicIssues(value: unknown): readonly Record<string, unknown>[] | undefined;

package/dist/httpAdapter/errorResponse/httpAdapterError.issues.js

@@ -0,0 +1,37 @@
+/**
+ * Public projection of validation issues.
+ *
+ * @module httpAdapter/errorResponse/issues
+ */
+/**
+ * Reduces validation issues to the fields a client may see: where
+ * (`path` / `field`), what (`code`) and why (`message`). Submitted values
+ * (`value`, `received`, `input`) are never echoed.
+ */
+export function publicIssues(value) {
+    if (!Array.isArray(value) || value.length === 0) {
+        return undefined;
+    }
+    const issues = [];
+    for (const entry of value) {
+        if (entry === null || typeof entry !== "object") {
+            continue;
+        }
+        const issue = entry;
+        const safe = {};
+        if (Array.isArray(issue.path)) {
+            safe.path = issue.path.filter((part) => typeof part === "string" || typeof part === "number");
+        }
+        if (typeof issue.field === "string") {
+            safe.field = issue.field;
+        }
+        if (typeof issue.code === "string") {
+            safe.code = issue.code;
+        }
+        if (typeof issue.message === "string") {
+            safe.message = issue.message;
+        }
+        issues.push(safe);
+    }
+    return issues.length > 0 ? issues : undefined;
+}

package/dist/httpAdapter/errorResponse/httpAdapterError.locate.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Locating the error whose status answers a request.
+ *
+ * @module httpAdapter/errorResponse/locate
+ */
+/**
+ * An error carrying an HTTP status, as {@link findStatusError} reports it.
+ */
+export interface StatusErrorLike {
+    readonly statusCode: number;
+    readonly message?: unknown;
+    readonly expose?: unknown;
+    readonly code?: unknown;
+    readonly headers?: unknown;
+    readonly issues?: unknown;
+}
+/**
+ * Locates the error whose status answers the request.
+ *
+ * The **outermost** error that carries a status wins. Only the framework's
+ * own wrappers (`HttpMiddlewareError`, `HttpMiddlewarePipelineError`) are
+ * unwrapped. An application that throws
+ * `new HttpError(502, "Bad Gateway", { cause: upstream401 })` is mapping an
+ * upstream failure on purpose; taking the innermost status sent the client
+ * the upstream's 401, its message and its `WWW-Authenticate` header.
+ * An error that is neither a wrapper nor carries a status ends the search
+ * (generic 500), so a `cause` the application attached is never exposed.
+ */
+export declare function findStatusError(error: unknown, depth: number, seen: Set<unknown>): StatusErrorLike | undefined;

package/dist/httpAdapter/errorResponse/httpAdapterError.locate.js

@@ -0,0 +1,74 @@
+/**
+ * Locating the error whose status answers a request.
+ *
+ * @module httpAdapter/errorResponse/locate
+ */
+import { HttpMiddlewareError, HttpMiddlewarePipelineError, } from "../../httpMiddleware/httpMiddleware.error.js";
+/* -------------------------------------------------------------------------- */
+/* Constants                                                                  */
+/* -------------------------------------------------------------------------- */
+/**
+ * How many levels of `cause` / `errors` nesting are inspected. Deep enough
+ * for the pipeline's two wrappers plus a few application layers; bounded so a
+ * cyclic `cause` chain cannot loop.
+ */
+const MAX_UNWRAP_DEPTH = 8;
+/* -------------------------------------------------------------------------- */
+/* Resolution                                                                 */
+/* -------------------------------------------------------------------------- */
+/**
+ * Whether `error` is one of the pipeline's own wrappers. These are added by
+ * the framework on the way out and always report 500, so they are looked
+ * through; nothing else is.
+ */
+function isFrameworkWrapper(error) {
+    return (error instanceof HttpMiddlewareError ||
+        error instanceof HttpMiddlewarePipelineError);
+}
+/**
+ * Locates the error whose status answers the request.
+ *
+ * The **outermost** error that carries a status wins. Only the framework's
+ * own wrappers (`HttpMiddlewareError`, `HttpMiddlewarePipelineError`) are
+ * unwrapped. An application that throws
+ * `new HttpError(502, "Bad Gateway", { cause: upstream401 })` is mapping an
+ * upstream failure on purpose; taking the innermost status sent the client
+ * the upstream's 401, its message and its `WWW-Authenticate` header.
+ * An error that is neither a wrapper nor carries a status ends the search
+ * (generic 500), so a `cause` the application attached is never exposed.
+ */
+export function findStatusError(error, depth, seen) {
+    if (error === null || typeof error !== "object" || depth > MAX_UNWRAP_DEPTH) {
+        return undefined;
+    }
+    if (seen.has(error)) {
+        return undefined;
+    }
+    seen.add(error);
+    const candidate = error;
+    if (!isFrameworkWrapper(error)) {
+        return isHttpStatus(candidate.statusCode)
+            ? candidate
+            : undefined;
+    }
+    const nested = [];
+    if (Array.isArray(candidate.errors)) {
+        nested.push(...candidate.errors);
+    }
+    if (candidate.cause !== undefined) {
+        nested.push(candidate.cause);
+    }
+    for (const inner of nested) {
+        const found = findStatusError(inner, depth + 1, seen);
+        if (found) {
+            return found;
+        }
+    }
+    return undefined;
+}
+function isHttpStatus(value) {
+    return (typeof value === "number" &&
+        Number.isInteger(value) &&
+        value >= 400 &&
+        value <= 599);
+}

package/dist/httpAdapter/{httpAdapter.errorResponse.d.ts → errorResponse/httpAdapterError.response.d.ts}

@@ -13,7 +13,7 @@
  *
  * This module is deliberately internal: it is not part of the public API.
  *
- * @module httpAdapter/errorResponse
+ * @module httpAdapter/errorResponse/response
  */
 export interface ResolvedErrorResponse {
     readonly status: number;
@@ -25,11 +25,16 @@ export interface ResolvedErrorResponse {
  *
  * - The outermost error with a 4xx/5xx `statusCode` (looking through the
  *   pipeline's own wrappers only) is answered with that status.
- * - Its `message` and `code` are included only when the error opts in with
- *   `expose: true` (the `@zudojs/errors` default for 4xx); otherwise the
- *   body carries the status text alone, so a 5xx never leaks internals.
+ * - Its `message`, `code` and validation `issues` are included only when
+ *   the error opts in with `expose: true` (the `@zudojs/errors` default for
+ *   4xx); otherwise the body carries the status text and the status's
+ *   symbolic name as `code`, so a 5xx never leaks internals.
  * - Its `headers` are applied when they are valid header values.
  * - Anything else is a generic `500 Internal Server Error`.
+ *
+ * Every body has the same shape, `{ error, code, issues? }`: `code` used to
+ * be present only on exposed errors, and a thrown validation error lost its
+ * issues, so a client saw `{"error":"Validation failed"}` with nothing to
+ * act on.
  */
 export declare function resolveErrorResponse(error: unknown): ResolvedErrorResponse;
-//# sourceMappingURL=httpAdapter.errorResponse.d.ts.map

package/dist/httpAdapter/errorResponse/httpAdapterError.response.js

@@ -0,0 +1,83 @@
+/**
+ * Default error-to-response mapping shared by the adapters.
+ *
+ * An error thrown from a handler used to be answered with a generic 500 no
+ * matter what it was, so `throw notFound()` — the documented way to fail a
+ * request — reached the client as `500 Internal Server Error` with the
+ * error's status, message and headers (`WWW-Authenticate`, `Allow`,
+ * `Retry-After`) all discarded. Middleware wrappers made it worse: the
+ * pipeline wraps every failure in `HttpMiddlewareError` /
+ * `HttpMiddlewarePipelineError`, both of which report status 500, so the
+ * original error's status was hidden even from a custom error handler that
+ * only looked one level deep.
+ *
+ * This module is deliberately internal: it is not part of the public API.
+ *
+ * @module httpAdapter/errorResponse/response
+ */
+import { getStatusText } from "../../httpResponse/core/httpResponse.statusText.js";
+import { statusName } from "../../httpStatus/httpStatus.name.js";
+import { isValidHeaderFieldValue } from "../../httpHeaders/security/index.js";
+import { findStatusError } from "./httpAdapterError.locate.js";
+import { publicIssues } from "./httpAdapterError.issues.js";
+/* -------------------------------------------------------------------------- */
+/* Resolution                                                                 */
+/* -------------------------------------------------------------------------- */
+/**
+ * Builds the default response for an unhandled error.
+ *
+ * - The outermost error with a 4xx/5xx `statusCode` (looking through the
+ *   pipeline's own wrappers only) is answered with that status.
+ * - Its `message`, `code` and validation `issues` are included only when
+ *   the error opts in with `expose: true` (the `@zudojs/errors` default for
+ *   4xx); otherwise the body carries the status text and the status's
+ *   symbolic name as `code`, so a 5xx never leaks internals.
+ * - Its `headers` are applied when they are valid header values.
+ * - Anything else is a generic `500 Internal Server Error`.
+ *
+ * Every body has the same shape, `{ error, code, issues? }`: `code` used to
+ * be present only on exposed errors, and a thrown validation error lost its
+ * issues, so a client saw `{"error":"Validation failed"}` with nothing to
+ * act on.
+ */
+export function resolveErrorResponse(error) {
+    const statusError = findStatusError(error, 0, new Set());
+    if (!statusError) {
+        return {
+            status: 500,
+            body: { error: "Internal Server Error", code: "INTERNAL_SERVER_ERROR" },
+            headers: {},
+        };
+    }
+    const status = statusError.statusCode;
+    const expose = statusError.expose === true;
+    const message = expose && typeof statusError.message === "string" && statusError.message
+        ? statusError.message
+        : getStatusText(status);
+    const code = expose && typeof statusError.code === "string" && statusError.code
+        ? statusError.code
+        : statusName(status);
+    const body = { error: message, code };
+    const issues = expose ? publicIssues(statusError.issues) : undefined;
+    if (issues !== undefined) {
+        body.issues = issues;
+    }
+    return {
+        status,
+        body,
+        headers: collectHeaders(statusError.headers),
+    };
+}
+function collectHeaders(value) {
+    if (value === null || typeof value !== "object") {
+        return {};
+    }
+    const headers = {};
+    for (const [name, entry] of Object.entries(value)) {
+        if (typeof entry !== "string" || !isValidHeaderFieldValue(entry)) {
+            continue;
+        }
+        headers[name] = entry;
+    }
+    return headers;
+}

package/dist/httpAdapter/errorResponse/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @zudojs/http/httpAdapter/errorResponse
+ *
+ * Error-to-response mapping shared by the adapters, and the headers added to
+ * every response an adapter builds itself. Internal to the package.
+ */
+export * from "./httpAdapterError.locate.js";
+export * from "./httpAdapterError.issues.js";
+export * from "./httpAdapterError.response.js";
+export * from "./httpAdapterError.headers.js";

package/dist/httpAdapter/errorResponse/index.js

@@ -0,0 +1,10 @@
+/**
+ * @zudojs/http/httpAdapter/errorResponse
+ *
+ * Error-to-response mapping shared by the adapters, and the headers added to
+ * every response an adapter builds itself. Internal to the package.
+ */
+export * from "./httpAdapterError.locate.js";
+export * from "./httpAdapterError.issues.js";
+export * from "./httpAdapterError.response.js";
+export * from "./httpAdapterError.headers.js";

package/dist/httpAdapter/fetch/httpFetch.body.d.ts

@@ -17,4 +17,3 @@ export declare function readFetchBodyAsJson<T = unknown>(request: Request | Resp
  * Reads the body from a Request or Response.
  */
 export declare function readFetchBody(request: Request | Response, maxBodySize?: number): Promise<string | Buffer>;
-//# sourceMappingURL=httpFetch.body.d.ts.map

package/dist/httpAdapter/fetch/httpFetch.body.js

@@ -54,4 +54,3 @@ export async function readFetchBody(request, maxBodySize = DEFAULT_MAX_BODY_SIZE
     }
     return Buffer.concat(chunks);
 }
-//# sourceMappingURL=httpFetch.body.js.map

package/dist/httpAdapter/fetch/httpFetch.helper.d.ts

@@ -16,4 +16,3 @@ export declare function isResponse(value: unknown): value is Response;
  * Type guard for FetchRequestInput objects.
  */
 export declare function isFetchRequestInput(value: unknown): value is FetchRequestInput;
-//# sourceMappingURL=httpFetch.helper.d.ts.map

package/dist/httpAdapter/fetch/httpFetch.helper.js

@@ -32,4 +32,3 @@ export function isFetchRequestInput(value) {
         "url" in value &&
         typeof value.url === "string");
 }
-//# sourceMappingURL=httpFetch.helper.js.map

package/dist/httpAdapter/fetch/httpFetch.requestContext.d.ts

@@ -17,4 +17,3 @@ export declare function createFetchRequestContext(input: FetchRequestInput): Pro
  * Creates a FetchRequest from a FetchRequestInput.
  */
 export declare function createFetchRequest(input: FetchRequestInput, init?: Omit<RequestInit, "method" | "headers" | "body">): Request;
-//# sourceMappingURL=httpFetch.requestContext.d.ts.map

package/dist/httpAdapter/fetch/httpFetch.requestContext.js

@@ -69,4 +69,3 @@ export function createFetchRequest(input, init = {}) {
     }
     return new Request(input.url, requestInit);
 }
-//# sourceMappingURL=httpFetch.requestContext.js.map

package/dist/httpAdapter/fetch/httpFetch.responseWriter.d.ts

@@ -28,4 +28,3 @@ export declare function responseToContext(response: Response): {
     readonly headers: Record<string, string>;
     readonly body: unknown;
 };
-//# sourceMappingURL=httpFetch.responseWriter.d.ts.map

package/dist/httpAdapter/fetch/httpFetch.responseWriter.js

@@ -66,4 +66,3 @@ export function responseToContext(response) {
         body: response.body,
     };
 }
-//# sourceMappingURL=httpFetch.responseWriter.js.map

package/dist/httpAdapter/fetch/httpFetch.type.d.ts

@@ -3,6 +3,7 @@
  *
  * @module httpAdapter/fetch/types
  */
+import { DEFAULT_MAX_BODY_SIZE } from "../../httpSecurity/httpSecurity.config.js";
 export interface FetchAdapterOptions {
     readonly port?: number;
     readonly host?: string;
@@ -26,5 +27,4 @@ export interface FetchAdapterResult {
     readonly response: Response;
     readonly context: unknown;
 }
-export declare const DEFAULT_MAX_BODY_SIZE: number;
-//# sourceMappingURL=httpFetch.type.d.ts.map
+export { DEFAULT_MAX_BODY_SIZE };

package/dist/httpAdapter/fetch/httpFetch.type.js

@@ -3,5 +3,5 @@
  *
  * @module httpAdapter/fetch/types
  */
-export const DEFAULT_MAX_BODY_SIZE = 10 * 1024 * 1024; // 10MB
-//# sourceMappingURL=httpFetch.type.js.map
+import { DEFAULT_MAX_BODY_SIZE } from "../../httpSecurity/httpSecurity.config.js";
+export { DEFAULT_MAX_BODY_SIZE };

package/dist/httpAdapter/fetch/index.d.ts

@@ -8,4 +8,3 @@ export * from "./httpFetch.requestContext.js";
 export * from "./httpFetch.responseWriter.js";
 export * from "./httpFetch.body.js";
 export * from "./httpFetch.helper.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/httpAdapter/fetch/index.js

@@ -8,4 +8,3 @@ export * from "./httpFetch.requestContext.js";
 export * from "./httpFetch.responseWriter.js";
 export * from "./httpFetch.body.js";
 export * from "./httpFetch.helper.js";
-//# sourceMappingURL=index.js.map

package/dist/httpAdapter/http.adapter.d.ts

@@ -13,6 +13,7 @@ import type { RequestContextInit } from "../httpRequest/httpRequest.context.js";
 import { HttpResponseContext } from "../httpResponse/httpResponse.context.js";
 import type { ResponseContextInit } from "../httpResponse/httpResponse.context.js";
 import type { HttpResponseWriter } from "../httpResponse/httpResponse.writer.js";
+import { type AdapterSecurityHeadersOption } from "./errorResponse/index.js";
 export type HttpAdapterName = string;
 export type HttpHandlerResult = HttpResponseContext | ResponseContextInit | unknown | void;
 export type HttpHandler = (request: HttpRequestContext) => HttpHandlerResult | Promise<HttpHandlerResult>;
@@ -34,6 +35,15 @@ export interface HttpAdapterOptions {
     readonly capabilities?: HttpAdapterCapabilities;
     readonly trustProxy?: boolean | number | string | readonly string[];
     readonly metadata?: Readonly<Record<string, unknown>>;
+    /**
+     * Security headers added to every response the adapter builds itself — a
+     * request refused by the guard, its own `413`, an unhandled error, the
+     * response a custom `errorHandler` returns — for header names the response
+     * does not already carry. Defaults to the package's default security
+     * header set; an object replaces that set, `false` adds none. Responses
+     * that pass through the middleware pipeline are unaffected.
+     */
+    readonly securityHeaders?: AdapterSecurityHeadersOption;
 }
 export interface HttpAdapterContext {
     readonly adapter: HttpAdapter;
@@ -79,6 +89,8 @@ export declare abstract class BaseHttpAdapter implements HttpAdapter {
     readonly metadata: Readonly<Record<string, unknown>>;
     protected handler: HttpHandler | undefined;
     protected errorHandler: HttpErrorHandler | undefined;
+    /** The resolved {@link HttpAdapterOptions.securityHeaders}. */
+    protected readonly securityHeaders: Readonly<Record<string, string>>;
     private started;
     normalizeRequest?(input: unknown): RequestContextInit | Promise<RequestContextInit>;
     normalizeResponse?(input: unknown): ResponseContextInit | Promise<ResponseContextInit>;
@@ -164,4 +176,3 @@ export declare function normalizeHandlerResult(result: HttpHandlerResult): HttpR
  */
 export declare function isResponseContextInit(value: unknown): value is ResponseContextInit;
 export declare function mergeResponseContext(target: HttpResponseContext, source: HttpResponseContext): HttpResponseContext;
-//# sourceMappingURL=http.adapter.d.ts.map

package/dist/httpAdapter/http.adapter.js

@@ -11,7 +11,7 @@
 import { HttpRequestContext, createRequestContext, } from "../httpRequest/httpRequest.context.js";
 import { HttpResponseContext, createResponseContext, } from "../httpResponse/httpResponse.context.js";
 import { writeResponse } from "../httpResponse/httpResponse.writer.js";
-import { resolveErrorResponse } from "./httpAdapter.errorResponse.js";
+import { finalizeErrorResponse, resolveAdapterSecurityHeaders, resolveErrorResponse, } from "./errorResponse/index.js";
 /* -------------------------------------------------------------------------- */
 /* Adapter Error                                                              */
 /* -------------------------------------------------------------------------- */
@@ -26,6 +26,8 @@ export class BaseHttpAdapter {
     metadata;
     handler;
     errorHandler;
+    /** The resolved {@link HttpAdapterOptions.securityHeaders}. */
+    securityHeaders;
     started = false;
     constructor(options = {}) {
         this.name = options.name ?? this.constructor.name;
@@ -37,6 +39,7 @@ export class BaseHttpAdapter {
         });
         this.handler = options.handler;
         this.errorHandler = options.errorHandler;
+        this.securityHeaders = resolveAdapterSecurityHeaders(options.securityHeaders);
     }
     /**
      * Installs the application request handler.
@@ -92,7 +95,7 @@ export class BaseHttpAdapter {
             }
             response.setStatus(resolved.status).json(resolved.body);
         }
-        await this.write(input, response);
+        await this.write(input, finalizeErrorResponse(response, this.securityHeaders, error));
     }
     async write(input, context) {
         if (this.writeResponse) {
@@ -316,4 +319,3 @@ export function mergeResponseContext(target, source) {
 function normalizeAdapterName(name) {
     return name.trim().toLowerCase();
 }
-//# sourceMappingURL=http.adapter.js.map

package/dist/httpAdapter/http.adapters.d.ts

@@ -89,4 +89,3 @@ export declare function adaptNodeContext<State extends HTTPState = HTTPState>(re
     readonly trustProxy?: TrustProxy;
 }): HTTPContext<State>;
 export declare function isHTTPAdapter(value: unknown): value is HTTPAdapter;
-//# sourceMappingURL=http.adapters.d.ts.map

package/dist/httpAdapter/http.adapters.js

@@ -113,4 +113,3 @@ export function isHTTPAdapter(value) {
         typeof candidate.createResponse === "function" &&
         typeof candidate.createContext === "function");
 }
-//# sourceMappingURL=http.adapters.js.map

package/dist/httpAdapter/httpAdapter.logger.d.ts

@@ -16,4 +16,3 @@ import { type Logger } from "@zudojs/logger";
  * logger cannot silence another's.
  */
 export declare function createDefaultContextLogger(): Logger;
-//# sourceMappingURL=httpAdapter.logger.d.ts.map

package/dist/httpAdapter/httpAdapter.logger.js

@@ -18,4 +18,3 @@ import { createDefaultLogger } from "@zudojs/logger";
 export function createDefaultContextLogger() {
     return createDefaultLogger("http");
 }
-//# sourceMappingURL=httpAdapter.logger.js.map

package/dist/httpAdapter/httpFetch.adapter.d.ts

@@ -8,4 +8,3 @@ export { FetchHttpResponseWriter } from "./fetch/httpFetch.responseWriter.js";
 export { createFetchRequestContext, createFetchRequest, } from "./fetch/httpFetch.requestContext.js";
 export { readFetchBody, readFetchBodyAsString, readFetchBodyAsJson, FetchRequestBodyTooLargeError, } from "./fetch/httpFetch.body.js";
 export { isRequest, isResponse, isFetchRequestInput, } from "./fetch/httpFetch.helper.js";
-//# sourceMappingURL=httpFetch.adapter.d.ts.map

package/dist/httpAdapter/httpFetch.adapter.js

@@ -7,4 +7,3 @@ export { FetchHttpResponseWriter } from "./fetch/httpFetch.responseWriter.js";
 export { createFetchRequestContext, createFetchRequest, } from "./fetch/httpFetch.requestContext.js";
 export { readFetchBody, readFetchBodyAsString, readFetchBodyAsJson, FetchRequestBodyTooLargeError, } from "./fetch/httpFetch.body.js";
 export { isRequest, isResponse, isFetchRequestInput, } from "./fetch/httpFetch.helper.js";
-//# sourceMappingURL=httpFetch.adapter.js.map

package/dist/httpAdapter/index.d.ts

@@ -7,4 +7,4 @@ export * from "./http.adapter.js";
 export * from "./http.adapters.js";
 export * from "./httpFetch.adapter.js";
 export * from "./node/index.js";
-//# sourceMappingURL=index.d.ts.map
+export type { AdapterSecurityHeadersOption } from "./errorResponse/index.js";

package/dist/httpAdapter/index.js

@@ -7,4 +7,3 @@ export * from "./http.adapter.js";
 export * from "./http.adapters.js";
 export * from "./httpFetch.adapter.js";
 export * from "./node/index.js";
-//# sourceMappingURL=index.js.map

package/dist/httpAdapter/node/httpNode.adapter.d.ts

@@ -59,7 +59,12 @@ export declare class NodeHttpAdapter extends BaseHttpAdapter {
      */
     private normalizeResult;
     private handleNodeError;
-    private writeBadRequest;
+    /**
+     * Answers a request the adapter refuses before any handler runs (the
+     * request guard, an undescribable request). The connection is closed
+     * because the body was never read.
+     */
+    private writeRejection;
     private writeNodeResponse;
     /**
      * Runs `handle` for a Node request/response pair without ever letting the
@@ -80,4 +85,3 @@ export declare class NodeHttpAdapter extends BaseHttpAdapter {
     stop(options?: HttpAdapterStopOptions): Promise<void>;
 }
 export declare function createNodeHttpAdapter(options?: NodeAdapterOptions): NodeHttpAdapter;
-//# sourceMappingURL=httpNode.adapter.d.ts.map