@daloyjs/core 0.14.1 → 0.15.0

package/dist/security.js

@@ -173,4 +173,189 @@ export function randomId() {
     // Last-resort fallback (should never trigger on Node 20+/Bun/Deno/Workers).
     return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
 }
+/**
+ * Header names that MUST appear at most once on a request per RFC 7230.
+ * Duplicate values for these headers are a classic HTTP-request-smuggling
+ * vector — front-end and back-end proxies can disagree on which value
+ * "wins", letting an attacker desync the connection.
+ *
+ * Exported for adapter authors that need the same set.
+ *
+ * @since 0.15.0
+ */
+export const SMUGGLING_SINGLETON_HEADERS = Object.freeze([
+    "host",
+    "content-length",
+]);
+/**
+ * Reject requests that carry more than one value for any header in
+ * {@link SMUGGLING_SINGLETON_HEADERS}. Because the standard `Headers`
+ * collection normalizes duplicates to a comma-joined string for these
+ * fields, the check is "value contains a comma at the top level".
+ *
+ * Throws {@link BadRequestError} so the framework returns a structured
+ * `400 problem+json` instead of forwarding a smuggling-class request.
+ *
+ * @since 0.15.0
+ */
+export function assertNoDuplicateSingletonHeaders(headers) {
+    for (const name of SMUGGLING_SINGLETON_HEADERS) {
+        const v = headers.get(name);
+        if (v !== null && v.indexOf(",") !== -1) {
+            throw new BadRequestError(`Duplicate ${name} header rejected`);
+        }
+    }
+}
+const HEX_RE = /^[0-9a-fA-F]+$/;
+const WEBHOOK_HMAC_ALGORITHMS = {
+    sha256: { hashName: "SHA-256", signatureBytes: 32 },
+    sha384: { hashName: "SHA-384", signatureBytes: 48 },
+    sha512: { hashName: "SHA-512", signatureBytes: 64 },
+};
+function resolveWebhookAlgorithm(algorithm) {
+    if (algorithm !== "sha256" && algorithm !== "sha384" && algorithm !== "sha512") {
+        return null;
+    }
+    return { name: algorithm, ...WEBHOOK_HMAC_ALGORITHMS[algorithm] };
+}
+function hexToBytes(hex) {
+    if (hex.length === 0 || hex.length % 2 !== 0 || !HEX_RE.test(hex))
+        return null;
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(hex.substr(i * 2, 2), 16);
+    }
+    return out;
+}
+function base64ToBytes(b64) {
+    // Accept both standard and URL-safe base64, with or without padding.
+    if (b64.length === 0 || b64.length % 4 === 1)
+        return null;
+    if (!/^[A-Za-z0-9+/_-]+={0,2}$/.test(b64))
+        return null;
+    try {
+        const normalized = b64.replace(/-/g, "+").replace(/_/g, "/");
+        const pad = normalized.length % 4 === 0 ? "" : "=".repeat(4 - (normalized.length % 4));
+        const bin = atob(normalized + pad);
+        const out = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++)
+            out[i] = bin.charCodeAt(i);
+        return out;
+    }
+    catch {
+        return null;
+    }
+}
+function bytesToHex(buf) {
+    let s = "";
+    for (let i = 0; i < buf.length; i++)
+        s += (buf[i] ?? 0).toString(16).padStart(2, "0");
+    return s;
+}
+function timingSafeEqualBytes(a, b) {
+    const len = Math.max(a.length, b.length);
+    let mismatch = a.length ^ b.length;
+    for (let i = 0; i < len; i++) {
+        mismatch |= (a[i] ?? 0) ^ (b[i] ?? 0);
+    }
+    return mismatch === 0;
+}
+function decodeWebhookSignature(signature, expected, expectedBytes) {
+    if (signature instanceof Uint8Array) {
+        return signature.length === expectedBytes ? signature : null;
+    }
+    let value = signature.trim();
+    const prefixed = /^(sha1|sha256|sha384|sha512)=/i.exec(value);
+    if (prefixed) {
+        const prefix = prefixed[1]?.toLowerCase();
+        if (prefix !== expected)
+            return null;
+        value = value.slice(prefixed[0].length);
+    }
+    const hex = hexToBytes(value);
+    if (hex && hex.length === expectedBytes)
+        return hex;
+    const b64 = base64ToBytes(value);
+    return b64 && b64.length === expectedBytes ? b64 : null;
+}
+/**
+ * Verify an HMAC signature for a webhook payload in constant time.
+ *
+ * Accepts the four common signature shapes seen in the wild:
+ *
+ *  - Raw hex (`"a1b2..."`)
+ *  - Raw base64 / base64url (`"oRY..."`, with or without padding)
+ *  - Matching GitHub-style prefixed (`"sha256=..."`, `"sha384=..."`, `"sha512=..."`)
+ *  - A `Uint8Array` of raw signature bytes
+ *
+ * Returns `false` for every malformed input — never throws on bad
+ * signatures so the caller cannot distinguish "wrong format" from "wrong
+ * key" through exception side channels.
+ *
+ * @example
+ * ```ts
+ * import { verifyWebhookSignature } from "@daloyjs/core";
+ *
+ * app.route({
+ *   method: "POST",
+ *   path: "/webhook",
+ *   handler: async ({ request }) => {
+ *     const raw = new Uint8Array(await request.arrayBuffer());
+ *     const sig = request.headers.get("x-hub-signature-256") ?? "";
+ *     if (!await verifyWebhookSignature({
+ *       payload: raw, signature: sig, secret: process.env.WEBHOOK_SECRET!,
+ *     })) {
+ *       return { status: 401 as const, body: { ok: false } };
+ *     }
+ *     // safe to parse
+ *   },
+ * });
+ * ```
+ *
+ * @since 0.15.0
+ */
+export async function verifyWebhookSignature(opts) {
+    const algo = resolveWebhookAlgorithm(opts.algorithm ?? "sha256");
+    if (!algo)
+        return false;
+    const payloadBytes = typeof opts.payload === "string"
+        ? new TextEncoder().encode(opts.payload)
+        : opts.payload;
+    const secretBytes = typeof opts.secret === "string"
+        ? new TextEncoder().encode(opts.secret)
+        : opts.secret;
+    const providedBytes = decodeWebhookSignature(opts.signature, algo.name, algo.signatureBytes);
+    if (!providedBytes)
+        return false;
+    const c = globalThis.crypto;
+    if (!c?.subtle)
+        return false;
+    const key = await c.subtle.importKey("raw", secretBytes, { name: "HMAC", hash: algo.hashName }, false, ["sign"]);
+    const computed = new Uint8Array(await c.subtle.sign("HMAC", key, payloadBytes));
+    return timingSafeEqualBytes(computed, providedBytes);
+}
+/**
+ * Compute an HMAC signature over `payload` and return it hex-encoded. The
+ * companion of {@link verifyWebhookSignature}; useful for tests, for
+ * outbound webhook senders, and for diffing implementations.
+ *
+ * @since 0.15.0
+ */
+export async function signWebhookPayload(opts) {
+    const algo = resolveWebhookAlgorithm(opts.algorithm ?? "sha256");
+    if (!algo)
+        throw new TypeError("unsupported webhook HMAC algorithm");
+    const payloadBytes = typeof opts.payload === "string"
+        ? new TextEncoder().encode(opts.payload)
+        : opts.payload;
+    const secretBytes = typeof opts.secret === "string"
+        ? new TextEncoder().encode(opts.secret)
+        : opts.secret;
+    const c = globalThis.crypto;
+    if (!c?.subtle)
+        throw new Error("WebCrypto unavailable: cannot sign webhook payload");
+    const key = await c.subtle.importKey("raw", secretBytes, { name: "HMAC", hash: algo.hashName }, false, ["sign"]);
+    const computed = new Uint8Array(await c.subtle.sign("HMAC", key, payloadBytes));
+    return bytesToHex(computed);
+}
 //# sourceMappingURL=security.js.map

package/dist/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,KAAa;IAEb,iDAAiD;IACjD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,KAAK;YAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACrC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,qEAAqE;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,EAAE,UAAU;QAAE,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC;IACzC,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,4EAA4E;IAC5E,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,oBAAoB,EACpB,eAAe,GAChB,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAY,EACZ,KAAa;IAEb,iDAAiD;IACjD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC7C,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,wBAAwB,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,KAAK;YAAE,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,iDAAiD;IACjD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;QAC1B,IAAI,KAAK,GAAG,KAAK,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACnB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YACrC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC9C,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAExD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,qEAAqE;IACrE,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,QAAQ;IACtB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,EAAE,UAAU;QAAE,OAAO,CAAC,CAAC,UAAU,EAAE,CAAC;IACzC,IAAI,CAAC,EAAE,eAAe,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,4EAA4E;IAC5E,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB,MAAM,CAAC,MAAM,CAAC;IAC1E,MAAM;IACN,gBAAgB;CACjB,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iCAAiC,CAAC,OAAgB;IAChE,KAAK,MAAM,IAAI,IAAI,2BAA2B,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,eAAe,CAAC,aAAa,IAAI,kBAAkB,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAEhC,MAAM,uBAAuB,GAGzB;IACF,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;IACnD,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE;CACpD,CAAC;AAEF,SAAS,uBAAuB,CAC9B,SAAkB;IAElB,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,qEAAqE;IACrE,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAe;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAa,EAAE,CAAa;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAA8B,EAC9B,QAA8B,EAC9B,aAAqB;IAErB,IAAI,SAAS,YAAY,UAAU,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,CAAC;IAED,IAAI,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACrC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa;QAAE,OAAO,GAAG,CAAC;IACpD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAYD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAK5C;IACC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAElB,MAAM,aAAa,GAAG,sBAAsB,CAC1C,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,cAAc,CACpB,CAAC;IACF,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IAEjC,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,WAA2B,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EACrC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAIxC;IACC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACrE,MAAM,YAAY,GAChB,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAC9B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;IACnB,MAAM,WAAW,GACf,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;QAC7B,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACvC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;IAClB,MAAM,CAAC,GAAwB,UAAkB,CAAC,MAAM,CAAC;IACzD,IAAI,CAAC,CAAC,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,SAAS,CAClC,KAAK,EACL,WAA2B,EAC3B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EACrC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,YAA4B,CAAC,CAAC,CAAC;IAChG,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "0.14.1",
+  "version": "0.15.0",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -37,7 +37,7 @@
     "daloy": "bin/daloy.mjs"
   },
   "engines": {
-    "node": ">=24.15.0",
+    "node": ">=24.0.0",
     "pnpm": ">=11.0.0"
   },
   "exports": {
@@ -120,6 +120,10 @@
     "./banner": {
       "types": "./dist/banner.d.ts",
       "import": "./dist/banner.js"
+    },
+    "./hashing": {
+      "types": "./dist/hashing.d.ts",
+      "import": "./dist/hashing.js"
     }
   },
   "devDependencies": {
@@ -143,7 +147,7 @@
     "bench": "node --import tsx bench/router.bench.ts",
     "test": "node --import tsx --test tests/**/*.test.ts",
     "coverage": "node --import tsx --test --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-lines=99.9 --test-coverage-functions=100 tests/**/*.test.ts",
-    "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include='dist-coverage/src/**' --test-coverage-branches=94 dist-coverage/tests/**/*.test.js",
+    "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include='dist-coverage/src/**' --test-coverage-branches=93 dist-coverage/tests/**/*.test.js",
     "typecheck": "tsc --noEmit",
     "gen:openapi": "node --import tsx scripts/dump-openapi.ts",
     "gen:client": "openapi-ts",