• pnpm-lock.yaml: Language not supported

src/server.ts:85

• When http2 is enabled, the code always creates a TLS server via http2.createSecureServer(...), but ssl is still optional in ProxyServerOptions. If a user sets http2: true without providing TLS credentials, the server will fail at runtime; consider validating options.ssl (or requiring it in types) and throwing a clear error early.

    if (this.options.http2) {
      this._server = http2.createSecureServer({ ...this.options.ssl, allowHTTP1: true }, closure);
    } else if (this.options.ssl) {
      this._server = https.createServer(this.options.ssl, closure);

src/server.ts:43

• _webPasses is still typed as ProxyMiddleware<http.ServerResponse>[], but when http2 is enabled the res passed through the passes can be http2.Http2ServerResponse. This mismatch is currently papered over with casts in _getPasses/listen, reducing type safety and making it easy for a pass to accidentally use HTTP/1-only APIs. Consider widening the _webPasses type (and the middleware list types) to include Http2ServerResponse so incompatibilities are caught by typecheck.

  _webPasses: ProxyMiddleware<http.ServerResponse>[] = [...webIncomingMiddleware];
  _wsPasses: ProxyMiddleware<net.Socket>[] = [...websocketIncomingMiddleware];

test/http2-proxy.test.ts:25

• undici Agent instances keep connection pools open; without closing them, the test runner can hang or report open handles. Add a top-level afterAll to close()/destroy() both http1Agent and http2Agent once the suite completes.

const http1Agent = new Agent({
  allowH2: false,
  connect: {
    // Allow to use SSL self signed
    rejectUnauthorized: false,
  },
});
const http2Agent = new Agent({
  allowH2: true,
  connect: {
    // Allow to use SSL self signed
    rejectUnauthorized: false,
  },
});

src/middleware/_utils.ts:29

• defineProxyMiddleware's generic constraint is still T extends ServerResponse | Socket, but ProxyMiddleware now supports Http2ServerResponse as well. This makes it impossible to declare a middleware explicitly typed as ProxyMiddleware<Http2ServerResponse> (it won't satisfy the constraint) and is inconsistent with the updated ProxyMiddleware type. Widen defineProxyMiddleware's constraint to include Http2ServerResponse.

export function defineProxyMiddleware<T extends ServerResponse | Socket = ServerResponse>(
  m: ProxyMiddleware<T>,
) {

test/_stubs.ts (1)

60-61: Minor type inconsistency in return cast.

The return type is ProxyServer<any, any> but the cast on line 61 uses the unparameterized ProxyServer. This works due to the as unknown intermediate cast but could be slightly cleaner.

Optional fix for type consistency

 export function stubProxyServer(overrides: Record<string, unknown> = {}): ProxyServer<any, any> {
-  return overrides as unknown as ProxyServer;
+  return overrides as unknown as ProxyServer<any, any>;
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/_stubs.ts` around lines 60 - 61, The stubProxyServer function returns
ProxyServer<any, any> but currently casts to the raw ProxyServer type; update
the return cast to match the declared generic parameters—change the final cast
to "as unknown as ProxyServer<any, any>" in the stubProxyServer function so the
returned type is consistently ProxyServer<any, any>.

test/http2-proxy.test.ts (1)

87-91: Consider awaiting source.close() for proper cleanup.

source.close() (for http.Server / https.Server) is asynchronous and accepts an optional callback. While it often works without awaiting, for deterministic test cleanup, consider wrapping it in a Promise or using a callback to ensure the server is fully closed before the test suite ends.

♻️ Optional: Await source close for consistent cleanup

     afterAll(async () => {
       // cleans up
       await new Promise<void>((resolve) => proxy.close(resolve));
-      source.close();
+      await new Promise<void>((resolve, reject) => 
+        source.close((err) => err ? reject(err) : resolve())
+      );
     });

Also applies to: 161-165

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@test/http2-proxy.test.ts` around lines 87 - 91, The afterAll cleanup
currently calls source.close() without awaiting its completion; change it to
await the server close by wrapping source.close in a Promise (or using its
callback) so the test waits for full shutdown, similar to how
proxy.close(resolve) is awaited; update all occurrences (e.g., the afterAll
blocks around source.close at the shown locations) to await the
Promise-returning close to ensure deterministic teardown.

Configuration used: defaults

Review profile: CHILL

Plan: Pro