webspresso 0.0.104 → 0.0.106

package/plugins/basic-auth/index.js

@@ -249,9 +249,10 @@ function basicAuthPlugin(options = {}) {
       }
 
       // Mount global middleware if global: true
-      if (applyGlobal && ctx.app) {
+      const target = ctx.http || ctx.app;
+      if (applyGlobal && target) {
         const globalMw = createBasicAuthMiddleware(options);
-        ctx.app.use(globalMw);
+        target.use(globalMw);
       }
     },
   };

package/plugins/cors.js

@@ -173,8 +173,9 @@ function corsPlugin(options = {}) {
         ctx.middlewares.cors = corsMiddleware;
       }
 
-      if (ctx.app && options.global !== false) {
-        ctx.app.use(corsMiddleware);
+      const target = ctx.http || ctx.app;
+      if (target && options.global !== false && typeof target.use === 'function') {
+        target.use(corsMiddleware);
       }
     },
   };

package/plugins/csrf/index.js

@@ -15,7 +15,8 @@ const NOOP = () => {};
 const EMPTY_OBJECT = Object.freeze({});
 const ignoreRegexCache = new Map();
 
-const { safeCompare } = require('../../core/utils/crypto');
+const { safeCompare, randomToken } = require('../../core/utils/crypto');
+const { globToRegExp } = require('../../core/utils/regex');
 
 /**
  * Check if the request path matches any ignore patterns
@@ -35,12 +36,7 @@ function isIgnored(req, ignorePaths) {
       if (pattern.includes('*')) {
         let regex = ignoreRegexCache.get(pattern);
         if (regex === undefined) {
-          const regexPattern = pattern
-            .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-            .replace(/\*\*/g, '___GLOB_STAR_STAR___')
-            .replace(/\*/g, '[^/]*')
-            .replace(/___GLOB_STAR_STAR___/g, '.*');
-          regex = new RegExp(`^${regexPattern}$`);
+          regex = globToRegExp(pattern, { separator: '/' });
           if (ignoreRegexCache.size < 500) {
             ignoreRegexCache.set(pattern, regex);
           }
@@ -149,7 +145,7 @@ function csrfPlugin(options = {}) {
       if (useCookie) {
         csrfTokenValue = cookieOptions.signed ? req.signedCookies[cookieKey] : req.cookies[cookieKey];
         if (!csrfTokenValue) {
-          csrfTokenValue = crypto.randomBytes(32).toString('hex');
+          csrfTokenValue = randomToken(32, 'hex');
           const isHttps = req.secure || req.headers?.['x-forwarded-proto'] === 'https' || process.env.NODE_ENV === 'production' || process.env.COOKIE_SECURE === 'true';
           const effectiveCookieOptions = {
             httpOnly: true,
@@ -162,7 +158,7 @@ function csrfPlugin(options = {}) {
       } else {
         // Session based
         if (!req.session[sessionKey]) {
-          req.session[sessionKey] = crypto.randomBytes(32).toString('hex');
+          req.session[sessionKey] = randomToken(32, 'hex');
         }
         csrfTokenValue = req.session[sessionKey];
       }
@@ -217,9 +213,10 @@ function csrfPlugin(options = {}) {
       ctx.addHelper('csrfToken', csrfToken);
       ctx.addHelper('csrfInput', csrfInput);
 
-      // If global validation is enabled, mount the middleware globally on the Express app
-      if (applyGlobal) {
-        ctx.app.use(createMiddleware());
+      // If global validation is enabled, mount the middleware globally
+      const target = ctx.http || ctx.app;
+      if (applyGlobal && target && typeof target.use === 'function') {
+        target.use(createMiddleware());
       }
     },
   };

package/plugins/csv/index.js

@@ -55,12 +55,14 @@ function csvPlugin(options = {}) {
       }
 
       // 2. Register built-in services (csv.generate, csv.parse, csv.exportModel)
-      if (ctx.app && ctx.app.serviceRegistry) {
+      // 2. Register built-in services (csv.generate, csv.parse, csv.exportModel)
+      const serviceRegistry = ctx.serviceRegistry || ctx.services || ctx.app?.serviceRegistry;
+      if (serviceRegistry) {
         const db = dbOption ?? ctx.db ?? ctx.app?.get?.('db') ?? null;
         const services = createCsvServices({ db, ...options });
         for (const [name, def] of Object.entries(services)) {
-          if (!ctx.app.serviceRegistry.has(name)) {
-            ctx.app.serviceRegistry.register(name, def);
+          if (!serviceRegistry.has(name)) {
+            serviceRegistry.register(name, def);
           }
         }
       }
@@ -77,8 +79,9 @@ function csvPlugin(options = {}) {
         ctx.middlewares.csv = middleware;
       }
 
-      if (ctx.app && typeof ctx.app.use === 'function') {
-        ctx.app.use(middleware);
+      const target = ctx.http || ctx.app;
+      if (target && typeof target.use === 'function') {
+        target.use(middleware);
       }
     },
   };

package/plugins/dashboard/app.js

@@ -363,11 +363,11 @@ const ConfigView = {
         m('.table-container', [
           m('.config-item', [
             m('.config-key', 'Port'),
-            m('.config-value', config.server?.port || '3000')
+            m('.config-value', config.server?.port || '7331')
           ]),
           m('.config-item', [
             m('.config-key', 'Base URL'),
-            m('.config-value', config.server?.baseUrl || 'http://localhost:3000')
+            m('.config-value', config.server?.baseUrl || 'http://localhost:7331')
           ])
         ])
       ])

package/plugins/dashboard/index.js

@@ -164,16 +164,16 @@ function dashboardPlugin(options = {}) {
       const config = {
         env: filterSensitiveEnv({
           NODE_ENV: process.env.NODE_ENV || 'development',
-          PORT: process.env.PORT || '3000',
-          BASE_URL: process.env.BASE_URL || 'http://localhost:3000',
+          PORT: process.env.PORT || '7331',
+          BASE_URL: process.env.BASE_URL || 'http://localhost:7331',
         }),
         i18n: {
           defaultLocale: process.env.DEFAULT_LOCALE || 'en',
           supportedLocales: (process.env.SUPPORTED_LOCALES || 'en').split(','),
         },
         server: {
-          port: process.env.PORT || '3000',
-          baseUrl: process.env.BASE_URL || 'http://localhost:3000',
+          port: process.env.PORT || '7331',
+          baseUrl: process.env.BASE_URL || 'http://localhost:7331',
         },
         database: {
           connected: hasDb(),
@@ -232,7 +232,7 @@ function dashboardPlugin(options = {}) {
       });
 
       // Log dashboard URL
-      console.log(`\n📊 Dashboard available at: http://localhost:${process.env.PORT || 3000}${dashboardPath}\n`);
+      console.log(`\n📊 Dashboard available at: http://localhost:${process.env.PORT || 7331}${dashboardPath}\n`);
     },
   };
 }

package/plugins/data-exchange/record-selection.js

@@ -4,6 +4,7 @@
  */
 
 const { buildFilteredQuery } = require('../admin-panel/core/api-extensions');
+const { safeJsonParse } = require('../../core/utils/json');
 
 /**
  * @param {import('../../core/orm/database').Database} db
@@ -17,11 +18,7 @@ async function resolveExportRecords(db, modelName, req) {
   let filters = body.filters ?? req.query.filters;
   if (typeof selectAll === 'string') selectAll = selectAll === 'true';
   if (typeof filters === 'string') {
-    try {
-      filters = JSON.parse(filters);
-    } catch {
-      filters = undefined;
-    }
+    filters = safeJsonParse(filters, undefined);
   }
 
   const trashedOnly =

package/plugins/email/api-handlers.js

@@ -4,6 +4,7 @@
  */
 
 const { purgeEmailLogs } = require('./purge');
+const { safeJsonParse } = require('../../core/utils/json');
 
 /**
  * @param {Object} options
@@ -44,14 +45,7 @@ function createEmailApiHandlers(options) {
         return res.status(400).json({ error: 'to and subject are required' });
       }
 
-      let parsedData = data;
-      if (typeof data === 'string') {
-        try {
-          parsedData = JSON.parse(data);
-        } catch {
-          parsedData = {};
-        }
-      }
+      const parsedData = safeJsonParse(data, {}) || {};
 
       const result = await emailService.send({
         to,
@@ -59,7 +53,7 @@ function createEmailApiHandlers(options) {
         template,
         mjml,
         html,
-        data: parsedData || {},
+        data: parsedData,
       });
 
       res.json({ ok: true, ...result });
@@ -73,17 +67,10 @@ function createEmailApiHandlers(options) {
       const body = req.body || {};
       const { template, mjml, html, data } = body;
 
-      let parsedData = data;
-      if (typeof data === 'string') {
-        try {
-          parsedData = JSON.parse(data);
-        } catch {
-          parsedData = {};
-        }
-      }
+      const parsedData = safeJsonParse(data, {}) || {};
 
       const result = await emailService.preview(
-        template ? { template, data: parsedData || {} } : { mjml, html, data: parsedData || {} }
+        template ? { template, data: parsedData } : { mjml, html, data: parsedData }
       );
 
       res.json(result);

package/plugins/email/auth-bridge.js

@@ -5,6 +5,7 @@
 
 const { createKnexAuthTokensAdapter } = require('../../core/auth/tokens');
 const { registerBundledAuthTemplates } = require('./bundled-templates');
+const { stripTrailingSlash } = require('../../core/utils/url');
 
 const DEFAULT_AUTH_EMAILS = {
   passwordReset: {
@@ -62,7 +63,7 @@ function wireAuthEmails(authManager, emailService, registry, config, db) {
     authManager.authTokens = createKnexAuthTokensAdapter(db);
   }
 
-  const baseUrl = (merged.baseUrl || process.env.BASE_URL || 'http://localhost:3000').replace(/\/$/, '');
+  const baseUrl = stripTrailingSlash(merged.baseUrl || process.env.BASE_URL || 'http://localhost:7331');
   const identifierField = authManager.identifierField || 'email';
 
   function userDisplayName(user) {
@@ -153,7 +154,7 @@ function registerAuthEmailRoutes(options) {
   const guest = ctx.middlewares?.guest;
   const authMw = ctx.middlewares?.auth;
 
-  const base = (authEmailsConfig.baseUrl || process.env.BASE_URL || 'http://localhost:3000').replace(/\/$/, '');
+  const base = stripTrailingSlash(authEmailsConfig.baseUrl || process.env.BASE_URL || 'http://localhost:7331');
 
   async function forgotPasswordHandler(req, res) {
     try {

package/plugins/email/index.js

@@ -241,16 +241,18 @@ function emailPlugin(options = {}) {
       setAppContext({ mailer });
       if (ctx.app) {
         ctx.app.mailer = mailer;
-        if (typeof ctx.app.use === 'function') {
-          ctx.app.use((req, res, next) => {
-            req.mailer = mailer;
-            next();
-          });
-        }
+      }
+      const target = ctx.http || ctx.app;
+      if (target && typeof target.use === 'function') {
+        target.use((req, res, next) => {
+          req.mailer = mailer;
+          next();
+        });
       }
       ctx.mailer = mailer;
 
-      if (ctx.app && ctx.app.serviceRegistry) {
+      const registry = ctx.serviceRegistry || ctx.services || ctx.app?.serviceRegistry;
+      if (registry) {
         const { createMailServices } = require('../../src/services/builtins/mail');
         const mailServices = createMailServices({
           emailService,
@@ -259,8 +261,8 @@ function emailPlugin(options = {}) {
           tableName,
         });
         for (const [name, def] of Object.entries(mailServices)) {
-          if (!ctx.app.serviceRegistry.has(name)) {
-            ctx.app.serviceRegistry.register(name, def);
+          if (!registry.has(name)) {
+            registry.register(name, def);
           }
         }
       }

package/plugins/health-check.js

@@ -4,6 +4,7 @@
 
 const pathMod = require('path');
 const PKG = require(pathMod.join(__dirname, '..', 'package.json'));
+const { ensureLeadingSlash } = require('../core/utils/url');
 
 /**
  * @param {Object} [options]
@@ -23,7 +24,7 @@ function healthCheckPlugin(options = {}) {
   } = options;
 
   const isEnabled = enabled !== undefined ? enabled : true;
-  const normalizedPath = routePath.startsWith('/') ? routePath : `/${routePath}`;
+  const normalizedPath = ensureLeadingSlash(routePath);
 
   return {
     name: 'health-check',

package/plugins/index.js

@@ -23,6 +23,9 @@ module.exports = {
   get ormCacheAdminPlugin() { return require('./orm-cache-admin'); },
   get uploadPlugin() { return require('./upload').uploadPlugin; },
   get createLocalFileProvider() { return require('./upload').createLocalFileProvider; },
+  get createR2FileProvider() { return require('./upload').createR2FileProvider; },
+  get createS3FileProvider() { return require('./upload').createS3FileProvider; },
+  get createGcsFileProvider() { return require('./upload').createGcsFileProvider; },
   get dataExchangePlugin() { return require('./data-exchange').dataExchangePlugin; },
   get redirectPlugin() { return require('./redirect').redirectPlugin; },
   get rateLimitPlugin() { return require('./rate-limit').rateLimitPlugin; },
@@ -63,6 +66,8 @@ module.exports = {
   get WebhookDispatcher() { return require('./webhooks').WebhookDispatcher; },
   get lazyPlugin() { return require('./lazy').lazyPlugin; },
   get defineLazyPlugin() { return require('./lazy').defineLazyPlugin; },
+  get rlsPlugin() { return require('./rls').rlsPlugin; },
+  get createRlsMiddleware() { return require('./rls').createRlsMiddleware; },
 };
 
 

package/plugins/lazy.js

@@ -13,6 +13,7 @@
  */
 
 const express = require('express');
+const { ensureArray } = require('../core/utils/object');
 
 /**
  * Wraps a plugin definition or factory function into an on-demand lazy plugin.
@@ -43,9 +44,7 @@ function lazyPlugin(pluginFactory, lazyOptions = {}) {
     (typeof pluginFactory === 'object' && pluginFactory ? pluginFactory.name : null) ||
     'anonymous-lazy-plugin';
 
-  const rawPrefixes = lazyOptions.prefix
-    ? (Array.isArray(lazyOptions.prefix) ? lazyOptions.prefix : [lazyOptions.prefix])
-    : [];
+  const rawPrefixes = ensureArray(lazyOptions.prefix);
   // Normalize prefixes: ensure leading slash, remove trailing slash (except root '/')
   const prefixes = rawPrefixes.map(p => {
     let norm = String(p).trim();
@@ -54,9 +53,9 @@ function lazyPlugin(pluginFactory, lazyOptions = {}) {
     return norm;
   });
 
-  const lazyServices = Array.isArray(lazyOptions.services) ? lazyOptions.services : [];
-  const lazyHelpers = Array.isArray(lazyOptions.helpers) ? lazyOptions.helpers : [];
-  const lazyEvents = Array.isArray(lazyOptions.events) ? lazyOptions.events : [];
+  const lazyServices = ensureArray(lazyOptions.services);
+  const lazyHelpers = ensureArray(lazyOptions.helpers);
+  const lazyEvents = ensureArray(lazyOptions.events);
 
   function hydrate() {
     if (isHydrated) return realPlugin;

package/plugins/mcp/discovery.js

@@ -6,6 +6,7 @@
 
 const fs = require('fs');
 const path = require('path');
+const { walkDirectory } = require('../../core/utils/fs');
 
 /**
  * Scan a directory for JS files and require them
@@ -13,27 +14,27 @@ const path = require('path');
  * @returns {Array<Object>}
  */
 function scanModuleDir(dirPath) {
-  if (!fs.existsSync(dirPath)) return [];
-  const entries = fs.readdirSync(dirPath, { withFileTypes: true });
+  const files = walkDirectory(dirPath, {
+    recursive: false,
+    extensions: ['.js', '.cjs'],
+    ignorePrefixes: ['_', '.'],
+    ignoreTests: true,
+  });
   const items = [];
 
-  for (const entry of entries) {
-    if (entry.isFile() && (entry.name.endsWith('.js') || entry.name.endsWith('.cjs'))) {
-      if (entry.name.startsWith('_') || entry.name.startsWith('.')) continue;
-      const fullPath = path.join(dirPath, entry.name);
-      try {
-        const mod = require(fullPath);
-        if (mod && typeof mod === 'object') {
-          // If mod doesn't have a name, default to filename without extension
-          if (!mod.name && !mod.uri) {
-            const baseName = path.basename(entry.name, path.extname(entry.name));
-            mod.name = baseName;
-          }
-          items.push(mod);
+  for (const fullPath of files) {
+    try {
+      const mod = require(fullPath);
+      if (mod && typeof mod === 'object') {
+        // If mod doesn't have a name, default to filename without extension
+        if (!mod.name && !mod.uri) {
+          const baseName = path.basename(fullPath, path.extname(fullPath));
+          mod.name = baseName;
         }
-      } catch (err) {
-        console.warn(`[mcp-discovery] Failed to load module at ${fullPath}:`, err.message);
+        items.push(mod);
       }
+    } catch (err) {
+      console.warn(`[mcp-discovery] Failed to load module at ${fullPath}:`, err.message);
     }
   }
 

package/plugins/polar/src/api.js

@@ -1,6 +1,7 @@
 'use strict';
 
 const { fetchWithTimeout } = require('../../../core/utils/fetch');
+const { ensureLeadingSlash } = require('../../../core/utils/url');
 
 function getPolarApiBase(sandbox) {
   return sandbox ? 'https://sandbox-api.polar.sh/v1' : 'https://api.polar.sh/v1';
@@ -21,7 +22,7 @@ async function polarApiRequest(path, { method = 'GET', body, accessToken, sandbo
     throw new Error('POLAR_ACCESS_TOKEN is not configured');
   }
 
-  const normalizedPath = path.startsWith('/') ? path : `/${path}`;
+  const normalizedPath = ensureLeadingSlash(path);
 
   const res = await fetchWithTimeout(`${getPolarApiBase(sandbox)}${normalizedPath}`, {
     method,

package/plugins/polar/src/webhooks.js

@@ -1,7 +1,6 @@
 'use strict';
 
-const crypto = require('crypto');
-const { safeCompare } = require('../../../core/utils/crypto');
+const { safeCompare, hmacSha256 } = require('../../../core/utils/crypto');
 const { syncPolarBillingForUser, applyPolarProSubscription } = require('./sync');
 const {
   collectPolarMetadata,
@@ -38,10 +37,10 @@ function verifyPolarWebhook(rawPayload, headers, secret) {
     ? Buffer.from(secret.slice(6), 'base64')
     : secret;
 
-  const expectedBase64 = crypto.createHmac('sha256', cleanSecret).update(standardToSign).digest('base64');
-  const expectedHex = crypto.createHmac('sha256', cleanSecret).update(standardToSign).digest('hex');
-  const rawExpectedBase64 = crypto.createHmac('sha256', cleanSecret).update(payloadStr).digest('base64');
-  const rawExpectedHex = crypto.createHmac('sha256', cleanSecret).update(payloadStr).digest('hex');
+  const expectedBase64 = hmacSha256(standardToSign, cleanSecret, 'base64');
+  const expectedHex = hmacSha256(standardToSign, cleanSecret, 'hex');
+  const rawExpectedBase64 = hmacSha256(payloadStr, cleanSecret, 'base64');
+  const rawExpectedHex = hmacSha256(payloadStr, cleanSecret, 'hex');
 
   const expectedList = [expectedBase64, expectedHex, rawExpectedBase64, rawExpectedHex];
 

package/plugins/queue/index.js

@@ -12,13 +12,17 @@ const {
   MemoryQueueAdapter,
   DatabaseQueueAdapter,
   RedisQueueAdapter,
+  WaitUntilQueueAdapter,
+  CloudflareQueueAdapter,
 } = require('../../core/queue');
 
 /**
  * @param {Object} [options]
- * @param {'memory'|'database'|'redis'|Object} [options.adapter='memory'] - Queue backend adapter or name
+ * @param {'memory'|'database'|'redis'|'wait-until'|'cloudflare'|Object} [options.adapter='memory'] - Queue backend adapter or name
  * @param {Object} [options.db] - Knex/ORM database instance for database adapter
  * @param {Object} [options.redisClient] - Redis client instance for redis adapter
+ * @param {Object} [options.queue] - Cloudflare Queue binding for cloudflare adapter
+ * @param {Function} [options.waitUntil] - Optional global waitUntil handler for wait-until adapter
  * @param {string} [options.tableName='webspresso_jobs'] - Database queue table name
  * @param {number} [options.concurrency=2] - Worker concurrency
  * @param {number} [options.pollInterval=500] - Idle poll interval in ms
@@ -37,7 +41,7 @@ function queuePlugin(options = {}) {
   return {
     name: 'queue',
     version: '1.0.0',
-    description: 'Background Job Queue Engine with Memory, DB, and Redis adapters',
+    description: 'Background Job Queue Engine with Memory, DB, Redis, WaitUntil, and Cloudflare adapters',
 
     register(ctx) {
       const { app, db } = ctx;
@@ -46,6 +50,18 @@ function queuePlugin(options = {}) {
 
       if (!adapter || adapter === 'memory') {
         adapter = new MemoryQueueAdapter();
+      } else if (adapter === 'wait-until' || adapter === 'edge') {
+        adapter = new WaitUntilQueueAdapter({
+          waitUntil: options.waitUntil,
+        });
+      } else if (adapter === 'cloudflare' || adapter === 'cf') {
+        const cfQueue = options.queue || options.cfQueue;
+        if (!cfQueue) {
+          throw new Error('[queuePlugin] Cloudflare queue adapter requires a valid queue binding in options.queue.');
+        }
+        adapter = new CloudflareQueueAdapter({
+          queue: cfQueue,
+        });
       } else if (adapter === 'database' || adapter === 'db') {
         const knexInstance = options.db?.knex || db?.knex || options.knex;
         if (!knexInstance) {

package/plugins/rate-limit/index.js

@@ -3,6 +3,8 @@
  * @module plugins/rate-limit
  */
 
+const { ensureArray } = require('../../core/utils/object');
+
 const PLUGIN_ONLY_KEYS = new Set(['global', 'globalOverrides', 'globalSkipPaths']);
 
 const DEFAULT_BASE = {
@@ -95,7 +97,7 @@ function combineSkip(userSkip, builtin) {
  * @returns {import('express').RequestHandler}
  */
 function createDefaultGlobalSkip(extraPathPrefixes = []) {
-  const extras = (Array.isArray(extraPathPrefixes) ? extraPathPrefixes : []).filter(Boolean);
+  const extras = ensureArray(extraPathPrefixes).filter(Boolean);
   /** @type {string[]} */
   const prefixes = [
     '/__webspresso/client-runtime',

package/plugins/redirect/index.js

@@ -4,6 +4,8 @@
  */
 
 const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
+const { stripTrailingSlash, ensureTrailingSlash } = require('../../core/utils/url');
+const { ensureArray } = require('../../core/utils/object');
 
 /**
  * @param {string} to
@@ -32,10 +34,10 @@ function normalizePathForTrailingSlash(mode, path) {
   if (!path || mode === false || mode == null) return path;
   if (path === '/') return path;
   if (mode === 'strip') {
-    return path.endsWith('/') ? path.slice(0, -1) || '/' : path;
+    return stripTrailingSlash(path, { preserveRoot: true });
   }
   if (mode === 'add') {
-    return path.endsWith('/') ? path : `${path}/`;
+    return ensureTrailingSlash(path);
   }
   return path;
 }
@@ -119,8 +121,8 @@ function pathMatches(compiled, pathForMatch, rawPath) {
   if (compiled.kind === 'string') {
     if (pathForMatch === compiled.fromNorm) return true;
     if (!compiled.trailing) {
-      const a = rawPath.replace(/\/$/, '') || '/';
-      const b = compiled.fromRaw.replace(/\/$/, '') || '/';
+      const a = stripTrailingSlash(rawPath, { preserveRoot: true });
+      const b = stripTrailingSlash(compiled.fromRaw, { preserveRoot: true });
       if (a === b) return true;
     }
     return false;
@@ -173,7 +175,7 @@ function redirectPlugin(options = {}) {
   const stringRulesMap = new Map();
   let hasRegexRules = false;
 
-  const ruleList = Array.isArray(rules) ? rules : [];
+  const ruleList = ensureArray(rules);
   for (const rule of ruleList) {
     const c = compileRule(rule, pluginOpts);
     if (!c) continue;
@@ -181,7 +183,7 @@ function redirectPlugin(options = {}) {
     if (c.kind === 'string') {
       const keys = [c.fromNorm];
       if (!c.trailing) {
-        const alt = c.fromRaw.replace(/\/$/, '') || '/';
+        const alt = stripTrailingSlash(c.fromRaw, { preserveRoot: true });
         if (!keys.includes(alt)) keys.push(alt);
       }
       for (const k of keys) {
@@ -205,7 +207,7 @@ function redirectPlugin(options = {}) {
 
     // Fast O(1) path when all configured rules are string based
     if (!hasRegexRules) {
-      const candidates = stringRulesMap.get(pathForMatch) || (!pluginOpts.trailingSlash ? stringRulesMap.get(rawPath.replace(/\/$/, '') || '/') : null);
+      const candidates = stringRulesMap.get(pathForMatch) || (!pluginOpts.trailingSlash ? stringRulesMap.get(stripTrailingSlash(rawPath, { preserveRoot: true })) : null);
       if (candidates) {
         for (const c of candidates) {
           if (!methodMatches(c, method)) continue;
@@ -251,8 +253,13 @@ function redirectPlugin(options = {}) {
     description: 'Configurable HTTP redirects before file-based routes',
 
     register(ctx) {
-      if (compiled.length === 0) return;
-      ctx.app.use(redirectMiddleware);
+      if (compiled.length === 0) {
+        return;
+      }
+      const target = ctx.http || ctx.app;
+      if (target && typeof target.use === 'function') {
+        target.use(redirectMiddleware);
+      }
     },
   };
 }