@zudojs/http 1.4.4 → 1.5.0

package/dist/httpValidation/httpValidationHostname.js

@@ -24,4 +24,3 @@ export function isValidHostname(hostname) {
         label.length <= 63 &&
         /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label));
 }
-//# sourceMappingURL=httpValidationHostname.js.map

package/dist/httpValidation/httpValidationMessage.d.ts

@@ -10,4 +10,3 @@ export declare function validateHTTPMessage(options: {
     readonly headers?: Readonly<Record<string, string>>;
     readonly statusCode?: number;
 }): HTTPValidationResult;
-//# sourceMappingURL=httpValidationMessage.d.ts.map

package/dist/httpValidation/httpValidationMessage.js

@@ -42,4 +42,3 @@ export function validateHTTPMessage(options) {
         valid: true,
     };
 }
-//# sourceMappingURL=httpValidationMessage.js.map

package/dist/httpValidation/httpValidationMethod.d.ts

@@ -6,4 +6,3 @@
 import type { HTTPValidationResult } from "./httpValidationTypes.type.js";
 export declare function isValidHTTPMethod(method: string | undefined | null): boolean;
 export declare function validateHTTPMethod(method: string): HTTPValidationResult;
-//# sourceMappingURL=httpValidationMethod.d.ts.map

package/dist/httpValidation/httpValidationMethod.js

@@ -22,4 +22,3 @@ export function validateHTTPMethod(method) {
         value: method.toUpperCase(),
     };
 }
-//# sourceMappingURL=httpValidationMethod.js.map

package/dist/httpValidation/httpValidationPort.d.ts

@@ -6,4 +6,3 @@
 import type { HTTPValidationResult } from "./httpValidationTypes.type.js";
 export declare function isValidPort(port: number | string | undefined | null): boolean;
 export declare function validatePort(port: number | string): HTTPValidationResult;
-//# sourceMappingURL=httpValidationPort.d.ts.map

package/dist/httpValidation/httpValidationPort.js

@@ -22,4 +22,3 @@ export function validatePort(port) {
         value: String(port),
     };
 }
-//# sourceMappingURL=httpValidationPort.js.map

package/dist/httpValidation/httpValidationRange.d.ts

@@ -4,4 +4,3 @@
  * Validates byte-range request headers (e.g. bytes=0-499).
  */
 export declare function isValidRange(value: string | undefined | null): boolean;
-//# sourceMappingURL=httpValidationRange.d.ts.map

package/dist/httpValidation/httpValidationRange.js

@@ -38,4 +38,3 @@ function isValidByteRange(range) {
     }
     return start.length > 0 || end.length > 0;
 }
-//# sourceMappingURL=httpValidationRange.js.map

package/dist/httpValidation/httpValidationRequestTarget.d.ts

@@ -7,4 +7,3 @@
 import type { HTTPValidationResult } from "./httpValidationTypes.type.js";
 export declare function isValidRequestTarget(target: string | undefined | null): boolean;
 export declare function validateRequestTarget(target: string): HTTPValidationResult;
-//# sourceMappingURL=httpValidationRequestTarget.d.ts.map

package/dist/httpValidation/httpValidationRequestTarget.js

@@ -45,4 +45,3 @@ export function validateRequestTarget(target) {
         value: target,
     };
 }
-//# sourceMappingURL=httpValidationRequestTarget.js.map

package/dist/httpValidation/httpValidationStatusCode.d.ts

@@ -6,4 +6,3 @@
 import type { HTTPValidationResult } from "./httpValidationTypes.type.js";
 export declare function isValidStatusCode(status: number | string | undefined | null): boolean;
 export declare function validateStatusCode(status: number | string): HTTPValidationResult;
-//# sourceMappingURL=httpValidationStatusCode.d.ts.map

package/dist/httpValidation/httpValidationStatusCode.js

@@ -22,4 +22,3 @@ export function validateStatusCode(status) {
         value: String(status),
     };
 }
-//# sourceMappingURL=httpValidationStatusCode.js.map

package/dist/httpValidation/httpValidationToken.d.ts

@@ -7,4 +7,3 @@
 import type { HTTPValidationResult } from "./httpValidationTypes.type.js";
 export declare function isHTTPToken(value: string | undefined | null): value is string;
 export declare function validateHTTPToken(value: string): HTTPValidationResult;
-//# sourceMappingURL=httpValidationToken.d.ts.map

package/dist/httpValidation/httpValidationToken.js

@@ -22,4 +22,3 @@ export function validateHTTPToken(value) {
         reason: "Value contains characters that are not valid in an HTTP token.",
     };
 }
-//# sourceMappingURL=httpValidationToken.js.map

package/dist/httpValidation/httpValidationTypes.type.d.ts

@@ -12,4 +12,3 @@ export interface HTTPHeaderValidationResult extends HTTPValidationResult {
     readonly name?: string;
     readonly headerValue?: string;
 }
-//# sourceMappingURL=httpValidationTypes.type.d.ts.map

package/dist/httpValidation/httpValidationTypes.type.js

@@ -4,4 +4,3 @@
  * Shared result types used across all HTTP validation modules.
  */
 export {};
-//# sourceMappingURL=httpValidationTypes.type.js.map

package/dist/httpValidation/httpValidationUrl.d.ts

@@ -8,4 +8,3 @@ export declare function isValidURL(value: string | undefined | null, base?: stri
 export declare function validateURL(value: string, base?: string | URL): HTTPValidationResult;
 export declare function isValidHTTPURL(value: string | undefined | null): boolean;
 export declare function validateHTTPURL(value: string): HTTPValidationResult;
-//# sourceMappingURL=httpValidationUrl.d.ts.map

package/dist/httpValidation/httpValidationUrl.js

@@ -59,4 +59,3 @@ export function validateHTTPURL(value) {
         value: new URL(value).href,
     };
 }
-//# sourceMappingURL=httpValidationUrl.js.map

package/dist/httpValidation/index.d.ts

@@ -26,4 +26,3 @@ export * from "./httpValidationAuthorization.js";
 export * from "./httpValidationCookie.js";
 export * from "./httpValidationAssertion.js";
 export * from "./httpValidationMessage.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/httpValidation/index.js

@@ -26,4 +26,3 @@ export * from "./httpValidationAuthorization.js";
 export * from "./httpValidationCookie.js";
 export * from "./httpValidationAssertion.js";
 export * from "./httpValidationMessage.js";
-//# sourceMappingURL=index.js.map

package/dist/index.d.ts

@@ -83,4 +83,3 @@ export { HTTP_METHODS } from "./httpTypes/index.js";
 export type { HTTPHeaders, HTTPHeadersInit, HTTPMethod, HTTPStatusCode, } from "./httpTypes/index.js";
 export { normalizePath } from "./httpUrl/index.js";
 export { validateContentLength } from "./httpValidation/index.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -81,4 +81,3 @@ export { REDIRECT_STATUS_CODES, assertValidStatusCode, getStatusText, isClientEr
 export { HTTP_METHODS } from "./httpTypes/index.js";
 export { normalizePath } from "./httpUrl/index.js";
 export { validateContentLength } from "./httpValidation/index.js";
-//# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/http",
-  "version": "1.4.4",
+  "version": "1.5.0",
   "description": "HTTP primitives, request handling, routing, middleware, and server infrastructure for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -24,16 +24,16 @@
     "!dist/.tsbuildinfo"
   ],
   "dependencies": {
-    "@zudojs/crypto": "1.3.3",
-    "@zudojs/errors": "1.3.2",
-    "@zudojs/logger": "1.4.3",
-    "@zudojs/middleware": "1.1.2",
-    "@zudojs/openapi": "1.5.2",
-    "@zudojs/security": "1.3.3"
+    "@zudojs/crypto": "1.4.0",
+    "@zudojs/errors": "1.4.0",
+    "@zudojs/logger": "1.5.0",
+    "@zudojs/middleware": "1.1.3",
+    "@zudojs/openapi": "1.6.0",
+    "@zudojs/security": "1.3.4"
   },
   "devDependencies": {
     "@types/node": "^26.6.2",
-    "@zudojs/schema": "1.2.3",
+    "@zudojs/schema": "1.3.0",
     "fluent-ffmpeg": "^2.1.3",
     "sharp": "^0.35.4",
     "typescript": "7.0.2",

package/dist/httpAdapter/httpAdapter.errorResponse.js

@@ -1,137 +0,0 @@
-/**
- * Default error-to-response mapping shared by the adapters.
- *
- * An error thrown from a handler used to be answered with a generic 500 no
- * matter what it was, so `throw notFound()` — the documented way to fail a
- * request — reached the client as `500 Internal Server Error` with the
- * error's status, message and headers (`WWW-Authenticate`, `Allow`,
- * `Retry-After`) all discarded. Middleware wrappers made it worse: the
- * pipeline wraps every failure in `HttpMiddlewareError` /
- * `HttpMiddlewarePipelineError`, both of which report status 500, so the
- * original error's status was hidden even from a custom error handler that
- * only looked one level deep.
- *
- * This module is deliberately internal: it is not part of the public API.
- *
- * @module httpAdapter/errorResponse
- */
-import { getStatusText } from "../httpResponse/core/httpResponse.statusText.js";
-import { isValidHeaderFieldValue } from "../httpHeaders/security/index.js";
-import { HttpMiddlewareError, HttpMiddlewarePipelineError, } from "../httpMiddleware/httpMiddleware.error.js";
-/* -------------------------------------------------------------------------- */
-/* Constants                                                                  */
-/* -------------------------------------------------------------------------- */
-/**
- * How many levels of `cause` / `errors` nesting are inspected. Deep enough
- * for the pipeline's two wrappers plus a few application layers; bounded so a
- * cyclic `cause` chain cannot loop.
- */
-const MAX_UNWRAP_DEPTH = 8;
-/* -------------------------------------------------------------------------- */
-/* Resolution                                                                 */
-/* -------------------------------------------------------------------------- */
-/**
- * Whether `error` is one of the pipeline's own wrappers. These are added by
- * the framework on the way out and always report 500, so they are looked
- * through; nothing else is.
- */
-function isFrameworkWrapper(error) {
-    return (error instanceof HttpMiddlewareError ||
-        error instanceof HttpMiddlewarePipelineError);
-}
-/**
- * Locates the error whose status answers the request.
- *
- * The **outermost** error that carries a status wins. Only the framework's
- * own wrappers (`HttpMiddlewareError`, `HttpMiddlewarePipelineError`) are
- * unwrapped. An application that throws
- * `new HttpError(502, "Bad Gateway", { cause: upstream401 })` is mapping an
- * upstream failure on purpose; taking the innermost status sent the client
- * the upstream's 401, its message and its `WWW-Authenticate` header.
- * An error that is neither a wrapper nor carries a status ends the search
- * (generic 500), so a `cause` the application attached is never exposed.
- */
-function findStatusError(error, depth, seen) {
-    if (error === null || typeof error !== "object" || depth > MAX_UNWRAP_DEPTH) {
-        return undefined;
-    }
-    if (seen.has(error)) {
-        return undefined;
-    }
-    seen.add(error);
-    const candidate = error;
-    if (!isFrameworkWrapper(error)) {
-        return isHttpStatus(candidate.statusCode)
-            ? candidate
-            : undefined;
-    }
-    const nested = [];
-    if (Array.isArray(candidate.errors)) {
-        nested.push(...candidate.errors);
-    }
-    if (candidate.cause !== undefined) {
-        nested.push(candidate.cause);
-    }
-    for (const inner of nested) {
-        const found = findStatusError(inner, depth + 1, seen);
-        if (found) {
-            return found;
-        }
-    }
-    return undefined;
-}
-function isHttpStatus(value) {
-    return (typeof value === "number" &&
-        Number.isInteger(value) &&
-        value >= 400 &&
-        value <= 599);
-}
-/**
- * Builds the default response for an unhandled error.
- *
- * - The outermost error with a 4xx/5xx `statusCode` (looking through the
- *   pipeline's own wrappers only) is answered with that status.
- * - Its `message` and `code` are included only when the error opts in with
- *   `expose: true` (the `@zudojs/errors` default for 4xx); otherwise the
- *   body carries the status text alone, so a 5xx never leaks internals.
- * - Its `headers` are applied when they are valid header values.
- * - Anything else is a generic `500 Internal Server Error`.
- */
-export function resolveErrorResponse(error) {
-    const statusError = findStatusError(error, 0, new Set());
-    if (!statusError) {
-        return {
-            status: 500,
-            body: { error: "Internal Server Error" },
-            headers: {},
-        };
-    }
-    const status = statusError.statusCode;
-    const expose = statusError.expose === true;
-    const message = expose && typeof statusError.message === "string" && statusError.message
-        ? statusError.message
-        : getStatusText(status);
-    const body = { error: message };
-    if (expose && typeof statusError.code === "string" && statusError.code) {
-        body.code = statusError.code;
-    }
-    return {
-        status,
-        body,
-        headers: collectHeaders(statusError.headers),
-    };
-}
-function collectHeaders(value) {
-    if (value === null || typeof value !== "object") {
-        return {};
-    }
-    const headers = {};
-    for (const [name, entry] of Object.entries(value)) {
-        if (typeof entry !== "string" || !isValidHeaderFieldValue(entry)) {
-            continue;
-        }
-        headers[name] = entry;
-    }
-    return headers;
-}
-//# sourceMappingURL=httpAdapter.errorResponse.js.map

package/dist/httpQuery/http.query.d.ts

@@ -1,110 +0,0 @@
-import type { HTTPRequest } from "../httpTypes/http.types.js";
-import { HttpError } from "@zudojs/errors";
-export type QueryPrimitive = string | number | boolean | null;
-export type QueryValue = QueryPrimitive | QueryPrimitive[] | QueryObject;
-export interface QueryObject {
-    readonly [key: string]: QueryValue;
-}
-/**
- * Limits applied to every query string this module parses.
- *
- * All limits are enforced. Exceeding one throws {@link HTTPQueryLimitError},
- * which carries a 414 status code so a server layer can map it to a response
- * instead of a 500.
- */
-export interface QueryLimitOptions {
-    /** Maximum number of parameters. Default 1000. */
-    readonly maxKeys?: number;
-    /** Maximum decoded length of a parameter name. Default 4096. */
-    readonly maxKeyLength?: number;
-    /** Maximum decoded length of a parameter value. Default 16384. */
-    readonly maxValueLength?: number;
-    /** Maximum length of the whole query string. Default 1 MiB. */
-    readonly maxTotalLength?: number;
-}
-export interface QueryParseOptions extends QueryLimitOptions {
-    /** Split values on `,` into an array. Default `false`. */
-    readonly commaSeparated?: boolean;
-    /** Decode `+` as a space. Default `true`. */
-    readonly plusAsSpace?: boolean;
-    /** Percent-decode names and values. Default `true`. */
-    readonly decode?: boolean;
-    /** Maximum bracket-path nesting depth. Default 10. */
-    readonly maxDepth?: number;
-}
-export type QueryStringPrimitive = string | number | boolean | null | undefined;
-export type QueryStringValue = QueryStringPrimitive | readonly QueryStringPrimitive[];
-export interface QueryStringParseOptions extends QueryLimitOptions {
-    /** Decode `+` as a space. Default `true`. */
-    readonly decodePlusAsSpace?: boolean;
-    /** Keep parameters whose name decodes to the empty string. Default `true`. */
-    readonly allowEmptyKeys?: boolean;
-}
-export declare const DEFAULT_QUERY_MAX_KEYS = 1000;
-export declare const DEFAULT_QUERY_MAX_KEY_LENGTH = 4096;
-export declare const DEFAULT_QUERY_MAX_VALUE_LENGTH = 16384;
-export declare const DEFAULT_QUERY_MAX_TOTAL_LENGTH: number;
-export declare const DEFAULT_QUERY_MAX_DEPTH = 10;
-/**
- * Thrown when a query string exceeds one of the parser's limits.
- *
- * Carries `statusCode: 414` so an error handler can answer with
- * `414 URI Too Long` rather than treating the rejection as an internal fault.
- */
-export declare class HTTPQueryLimitError extends HttpError {
-    constructor(message: string);
-}
-export declare function isForbiddenQueryKey(key: string): boolean;
-/**
- * Percent-decodes a query component.
- *
- * A malformed sequence such as `%ZZ` makes `decodeURIComponent` throw a
- * `URIError`. Any client can send one, so the raw component is returned
- * instead of propagating an unhandled error onto the request path. The raw
- * bytes are never interpolated into an error message.
- */
-export declare function decodeQueryComponent(value: string, decode?: boolean, plusAsSpace?: boolean): string;
-export declare function stripQueryPrefix(input: string): string;
-/**
- * Parses a query string into a nested object.
- *
- * The returned objects have a `null` prototype: a parameter named
- * `__proto__` can never reach `Object.prototype`, and a lookup of an
- * unrelated key can never return an inherited member.
- */
-export declare function parseQuery(query: string | URLSearchParams | undefined, options?: QueryParseOptions): QueryObject;
-/**
- * Parses a query string into a flat record of decoded values.
- *
- * Unlike {@link parseQuery} this applies no bracket-path nesting and no value
- * coercion: every value is the decoded string, and a repeated name yields an
- * array. Both functions share one tokenizer and one set of limits.
- */
-export declare function parseQueryString(input: string | undefined | null, options?: QueryStringParseOptions): Record<string, string | string[]>;
-export declare function getQuery(request: HTTPRequest, options?: QueryParseOptions): QueryObject;
-export declare function getQueryValue(request: HTTPRequest, key: string): QueryValue | undefined;
-export declare function getQueryString(request: HTTPRequest, key: string): string | undefined;
-export declare function getQueryStrings(request: HTTPRequest, key: string): string[];
-export declare function getSearchParams(request: HTTPRequest): URLSearchParams;
-export declare function stringifyQuery(query: QueryObject | Record<string, unknown>): string;
-export declare function buildQueryString(query: QueryObject | Record<string, unknown>): string;
-export declare function hasQuery(request: HTTPRequest, key: string): boolean;
-export declare function querySize(request: HTTPRequest): number;
-/**
- * Splits a bracket/dot path such as `a[b][c]` into its segments.
- *
- * A path containing `__proto__`, `constructor` or `prototype` yields an empty
- * array, which callers treat as "drop this parameter entirely".
- */
-export declare function parseQueryKey(key: string): string[];
-/**
- * Coerces the well-known literals and numbers that round-trip exactly.
- *
- * A numeric literal is only converted when `String(Number(value)) === value`,
- * so a 20-digit identifier stays the string it arrived as instead of being
- * silently rewritten to a different number.
- */
-export declare function normalizeQueryValue(value: string): QueryPrimitive;
-export declare function cloneQuery(query: QueryObject): QueryObject;
-export declare function mergeQuery(...queries: QueryObject[]): QueryObject;
-//# sourceMappingURL=http.query.d.ts.map