@daloyjs/core 0.34.3 → 0.35.1

package/dist/banner.d.ts

@@ -37,4 +37,3 @@ export declare function formatStartupBanner(options: StartupBannerOptions): stri
  * replace ad-hoc `console.log("listening on …")` calls in starter templates.
  */
 export declare function printStartupBanner(options: StartupBannerOptions, write?: (s: string) => void): void;
-//# sourceMappingURL=banner.d.ts.map

package/dist/banner.js

@@ -110,4 +110,3 @@ export function formatStartupBanner(options) {
 export function printStartupBanner(options, write = (s) => process.stdout.write(s)) {
     write(`\n${formatStartupBanner(options)}\n\n`);
 }
-//# sourceMappingURL=banner.js.map

package/dist/cli.d.ts

@@ -71,6 +71,32 @@ export type DevRuntime = "node" | "bun" | "deno";
  * @since 0.3.0
  */
 export declare function detectRuntime(): DevRuntime;
+/**
+ * Validate a CLI-supplied entry path before it is handed to `import()` or
+ * forwarded as a child-process argv element. Rejects NUL bytes, CR/LF, and
+ * leading `-` characters so a hostile caller (or a misparsed positional)
+ * cannot smuggle a `--eval=...`, `--inspect-brk=...`, or similar
+ * argv-injection payload past `spawn({ shell: false })` into Node, Bun, or
+ * Deno's own argv parser.
+ *
+ * This is defense-in-depth alongside {@link parseArgs}, which already
+ * rejects `-`-prefixed positionals. The check also runs in programmatic
+ * `runCli()` callers and tests so the invariant holds regardless of how the
+ * entry value was produced.
+ *
+ * @internal
+ */
+export declare function assertSafeEntryPath(entry: string, context: string): void;
+/**
+ * Normalize a relative entry path so the host runtime always sees an
+ * unambiguous file path, never a possible flag. Absolute paths and paths
+ * already anchored with `./` or `../` are returned unchanged; bare relative
+ * paths like `src/server.ts` are rewritten to `./src/server.ts`. This is
+ * the second half of the {@link assertSafeEntryPath} defense.
+ *
+ * @internal
+ */
+export declare function normalizeEntryArg(entry: string): string;
 /**
  * Build the `(command, args)` pair `daloy dev` should spawn for the given
  * runtime and entry file. Pure function so tests can assert exact argv
@@ -84,6 +110,12 @@ export declare function detectRuntime(): DevRuntime;
  *   reading the source tree; users who need more should run `deno run`
  *   directly).
  *
+ * The entry is validated via {@link assertSafeEntryPath} and anchored with
+ * {@link normalizeEntryArg} so a future caller cannot smuggle a flag past
+ * `spawn({ shell: false })` into the runtime's argv parser. See
+ * `SECURITY.md` § "CLI threat model" for the full rationale (and why we
+ * are not vulnerable to the class of bug Snyk reported as CVE-2022-22984).
+ *
  * @since 0.3.0
  */
 export declare function buildDevCommand(runtime: DevRuntime, entry: string): {
@@ -114,4 +146,3 @@ export declare function runCli(argv: readonly string[], io: CliIO): Promise<CliR
  * @since 0.14.0
  */
 export declare function buildAiDump(app: App, opts: CliOptions): Record<string, unknown>;
-//# sourceMappingURL=cli.d.ts.map

package/dist/cli.js

@@ -115,6 +115,52 @@ export function detectRuntime() {
         return "deno";
     return "node";
 }
+/**
+ * Validate a CLI-supplied entry path before it is handed to `import()` or
+ * forwarded as a child-process argv element. Rejects NUL bytes, CR/LF, and
+ * leading `-` characters so a hostile caller (or a misparsed positional)
+ * cannot smuggle a `--eval=...`, `--inspect-brk=...`, or similar
+ * argv-injection payload past `spawn({ shell: false })` into Node, Bun, or
+ * Deno's own argv parser.
+ *
+ * This is defense-in-depth alongside {@link parseArgs}, which already
+ * rejects `-`-prefixed positionals. The check also runs in programmatic
+ * `runCli()` callers and tests so the invariant holds regardless of how the
+ * entry value was produced.
+ *
+ * @internal
+ */
+export function assertSafeEntryPath(entry, context) {
+    if (typeof entry !== "string" || entry.length === 0) {
+        throw new Error(`${context}: entry path must be a non-empty string.`);
+    }
+    if (entry.includes("\0") || /[\r\n]/.test(entry)) {
+        throw new Error(`${context}: entry path must not contain NUL bytes or newlines (got: ${JSON.stringify(entry)}).`);
+    }
+    if (entry.startsWith("-")) {
+        throw new Error(`${context}: entry path must not start with "-" — runtimes parse leading dashes as flags ` +
+            `(got: ${JSON.stringify(entry)}). Prefix the path with "./" to disambiguate.`);
+    }
+}
+/**
+ * Normalize a relative entry path so the host runtime always sees an
+ * unambiguous file path, never a possible flag. Absolute paths and paths
+ * already anchored with `./` or `../` are returned unchanged; bare relative
+ * paths like `src/server.ts` are rewritten to `./src/server.ts`. This is
+ * the second half of the {@link assertSafeEntryPath} defense.
+ *
+ * @internal
+ */
+export function normalizeEntryArg(entry) {
+    if (entry.startsWith("./") || entry.startsWith("../"))
+        return entry;
+    if (entry.startsWith("/"))
+        return entry;
+    // Windows drive letter (C:\, D:/, ...).
+    if (/^[A-Za-z]:[\\/]/.test(entry))
+        return entry;
+    return `./${entry}`;
+}
 /**
  * Build the `(command, args)` pair `daloy dev` should spawn for the given
  * runtime and entry file. Pure function so tests can assert exact argv
@@ -128,20 +174,28 @@ export function detectRuntime() {
  *   reading the source tree; users who need more should run `deno run`
  *   directly).
  *
+ * The entry is validated via {@link assertSafeEntryPath} and anchored with
+ * {@link normalizeEntryArg} so a future caller cannot smuggle a flag past
+ * `spawn({ shell: false })` into the runtime's argv parser. See
+ * `SECURITY.md` § "CLI threat model" for the full rationale (and why we
+ * are not vulnerable to the class of bug Snyk reported as CVE-2022-22984).
+ *
  * @since 0.3.0
  */
 export function buildDevCommand(runtime, entry) {
+    assertSafeEntryPath(entry, "daloy dev");
+    const safe = normalizeEntryArg(entry);
     switch (runtime) {
         case "bun":
-            return { command: "bun", args: ["--hot", entry] };
+            return { command: "bun", args: ["--hot", safe] };
         case "deno":
             return {
                 command: "deno",
-                args: ["run", "--watch", "--allow-net", "--allow-env", "--allow-read", entry],
+                args: ["run", "--watch", "--allow-net", "--allow-env", "--allow-read", safe],
             };
         case "node":
         default:
-            return { command: "node", args: ["--import", "tsx", "--watch", entry] };
+            return { command: "node", args: ["--import", "tsx", "--watch", safe] };
     }
 }
 /**
@@ -151,8 +205,10 @@ export function buildDevCommand(runtime, entry) {
  * first candidate.
  */
 async function resolveDevEntry(entry) {
-    if (entry)
+    if (entry) {
+        assertSafeEntryPath(entry, "daloy dev");
         return entry;
+    }
     try {
         const fs = await import("node:fs");
         const path = await import("node:path");
@@ -725,6 +781,8 @@ function aiSchema(schema) {
     return {};
 }
 async function loadApp(entry, io) {
+    if (entry !== undefined)
+        assertSafeEntryPath(entry, "daloy inspect");
     const candidates = entry ? [entry] : DEFAULT_ENTRIES.slice();
     let lastErr;
     for (const candidate of candidates) {
@@ -790,4 +848,3 @@ function isApp(value) {
         typeof value.introspect === "function" &&
         typeof value.fetch === "function");
 }
-//# sourceMappingURL=cli.js.map

package/dist/client.d.ts

@@ -74,4 +74,3 @@ export interface ClientOptions {
  */
 export declare function createClient<A extends App>(app: A, opts: ClientOptions): ClientFor<A>;
 export {};
-//# sourceMappingURL=client.d.ts.map

package/dist/client.js

@@ -85,4 +85,3 @@ function safeJson(text) {
         return text;
     }
 }
-//# sourceMappingURL=client.js.map

package/dist/combine.d.ts

@@ -94,4 +94,3 @@ export type ExceptPredicate = string | string[] | ((ctx: BaseContext<any, any>)
  * @since 0.19.0
  */
 export declare function except(when: ExceptPredicate, hooks: Hooks): Hooks;
-//# sourceMappingURL=combine.d.ts.map

package/dist/combine.js

@@ -244,4 +244,3 @@ function mergeCombineHooks(layers) {
     }
     return merged;
 }
-//# sourceMappingURL=combine.js.map

package/dist/compression.d.ts

@@ -124,4 +124,3 @@ export declare function _resetCompressionRuntimeProbeForTests(): void;
  * @since 0.25.0
  */
 export declare function compression(opts?: CompressionOptions): Hooks;
-//# sourceMappingURL=compression.d.ts.map

package/dist/compression.js

@@ -365,4 +365,3 @@ export function compression(opts = {}) {
     hooks[COMPRESSION_HOOK_MARKER] = true;
     return hooks;
 }
-//# sourceMappingURL=compression.js.map

package/dist/config.d.ts

@@ -95,4 +95,3 @@ export interface DefineConfigOptions<S extends StandardSchemaV1> {
  * @since 0.20.0
  */
 export declare function defineConfig<S extends StandardSchemaV1>(opts: DefineConfigOptions<S>): Promise<StandardSchemaV1.InferOutput<S>>;
-//# sourceMappingURL=config.d.ts.map

package/dist/config.js

@@ -130,4 +130,3 @@ export async function defineConfig(opts) {
     }
     return result.value;
 }
-//# sourceMappingURL=config.js.map

package/dist/conn-info.d.ts

@@ -118,4 +118,3 @@ export declare function readRemotePort(ctx: BaseContext<any, any>): number | und
 /** @internal Test-only helper. */
 export declare function _makeConnInfoForTests(info: ConnInfo): MutableConnInfo;
 export {};
-//# sourceMappingURL=conn-info.d.ts.map

package/dist/conn-info.js

@@ -142,4 +142,3 @@ export function readRemotePort(ctx) {
 export function _makeConnInfoForTests(info) {
     return { ...info };
 }
-//# sourceMappingURL=conn-info.js.map

package/dist/contract.d.ts

@@ -47,4 +47,3 @@ export interface ContractTestOptions {
  * @returns A {@link ContractReport}. In CI, exit non-zero when `report.ok` is `false`.
  */
 export declare function runContractTests(app: App, opts?: ContractTestOptions): Promise<ContractReport>;
-//# sourceMappingURL=contract.d.ts.map

package/dist/contract.js

@@ -133,4 +133,3 @@ export async function runContractTests(app, opts = {}) {
         issues,
     };
 }
-//# sourceMappingURL=contract.js.map

package/dist/cookie.d.ts

@@ -123,4 +123,3 @@ export declare function serializeClearCookie(name: string, attributes?: CookieAt
 export declare function readRequestCookie(header: string | null | undefined, name: string): string | null;
 /** @internal Re-exported for tests. */
 export declare const __COOKIE_FRAMEWORK_PREFIX__ = "daloy.cookie";
-//# sourceMappingURL=cookie.d.ts.map

package/dist/cookie.js

@@ -202,4 +202,3 @@ export function readRequestCookie(header, name) {
 }
 /** @internal Re-exported for tests. */
 export const __COOKIE_FRAMEWORK_PREFIX__ = FRAMEWORK_PREFIX;
-//# sourceMappingURL=cookie.js.map

package/dist/dependency.d.ts

@@ -45,4 +45,3 @@ export interface DependencyHooks extends Hooks {
  * @since 0.24.0
  */
 export declare function defineDependency<TName extends string, TValue, TStateKey extends string = TName>(opts: DependencyOptions<TName, TValue, TStateKey>): DependencyHooks;
-//# sourceMappingURL=dependency.d.ts.map

package/dist/dependency.js

@@ -65,4 +65,3 @@ export function defineDependency(opts) {
     });
     return hooks;
 }
-//# sourceMappingURL=dependency.js.map

package/dist/discriminator.d.ts

@@ -71,4 +71,3 @@ export type DiscriminatedUnion<V extends Record<string, StandardSchemaV1>> = Sta
  */
 export declare function discriminatedUnion<P extends string, V extends Record<string, StandardSchemaV1>>(propertyName: P, variants: V, opts?: DiscriminatedUnionOptions): DiscriminatedUnion<V>;
 export {};
-//# sourceMappingURL=discriminator.d.ts.map

package/dist/discriminator.js

@@ -111,4 +111,3 @@ function variantToJsonSchema(schema) {
     }
     return {};
 }
-//# sourceMappingURL=discriminator.js.map

package/dist/docs.d.ts

@@ -153,4 +153,3 @@ export declare function docsContentSecurityPolicy(opts?: DocsContentSecurityPoli
  * {@link docsContentSecurityPolicy} (or a caller-supplied override).
  */
 export declare function htmlResponse(html: string, opts?: HtmlResponseOptions): Response;
-//# sourceMappingURL=docs.d.ts.map

package/dist/docs.js

@@ -113,4 +113,3 @@ function scalarConfigurationAttr(specUrl, configuration) {
     const { content: _content, fetch: _fetch, plugins: _plugins, sources: _sources, spec: _spec, url: _url, ...uiConfiguration } = configuration;
     return ` data-configuration='${escapeHtml(JSON.stringify({ ...uiConfiguration, url: specUrl }))}'`;
 }
-//# sourceMappingURL=docs.js.map

package/dist/errors.d.ts

@@ -327,4 +327,3 @@ export declare class RequestTimeoutError extends HttpError {
 export declare class InternalError extends HttpError {
     constructor(detail?: string);
 }
-//# sourceMappingURL=errors.d.ts.map

package/dist/errors.js

@@ -444,4 +444,3 @@ export class InternalError extends HttpError {
         this.name = "InternalError";
     }
 }
-//# sourceMappingURL=errors.js.map

package/dist/etag.d.ts

@@ -45,4 +45,3 @@ export interface ETagOptions {
  * @since 0.21.0
  */
 export declare function etag(opts?: ETagOptions): Hooks;
-//# sourceMappingURL=etag.d.ts.map

package/dist/etag.js

@@ -114,4 +114,3 @@ export function etag(opts = {}) {
         },
     };
 }
-//# sourceMappingURL=etag.js.map

package/dist/fetch-guard.d.ts

@@ -24,18 +24,63 @@
  * Plus an always-deny floor that no flag can lift:
  *
  * - `0.0.0.0/8` (this-network), `100.64.0.0/10` (carrier-grade NAT — covers
- *   Alibaba `100.100.100.200`), `192.0.0.0/24` (covers Oracle Cloud
- *   `192.0.0.192`), `192.0.2.0/24`, `198.18.0.0/15`, `198.51.100.0/24`,
- *   `203.0.113.0/24` (IANA-reserved), `224.0.0.0/4` (multicast),
- *   `240.0.0.0/4` (reserved), `255.255.255.255` (broadcast).
- * - IPv6: `::/128` (unspecified), `ff00::/8` (multicast), IPv4-mapped
+ *   Alibaba `100.100.100.200`), `169.254.169.254/32` (AWS / Azure /
+ *   DigitalOcean / GCP IMDS), `169.254.170.2/32` and `169.254.170.23/32`
+ *   (AWS ECS task metadata / EKS Pod Identity), `192.0.0.0/24` (covers
+ *   Oracle Cloud `192.0.0.192`), `192.0.2.0/24`, `198.18.0.0/15`,
+ *   `198.51.100.0/24`, `203.0.113.0/24` (IANA-reserved), `224.0.0.0/4`
+ *   (multicast), `240.0.0.0/4` (reserved), `255.255.255.255` (broadcast).
+ * - IPv6: `::/128` (unspecified), `ff00::/8` (multicast),
+ *   `fd00:ec2::254/128` (AWS IMDSv2 IPv6), IPv4-mapped
  *   `::ffff:0:0/96` is re-checked against the embedded IPv4 address.
  *
+ * The floor also picks up any user-supplied `denyAddresses` — these win
+ * over `allowAddresses` and over the soft-deny class flags, so an
+ * operator-pinned internal range is never accidentally re-exposed by a
+ * later `allowAddresses` carveout.
+ *
  * Redirects are followed **manually** with re-validation at each hop so
  * an attacker cannot bypass the check via a `302 → http://169.254...`.
  * `non-http(s)` protocols (`file:`, `ftp:`, `gopher:`, `data:`) are
  * rejected before any network call.
  *
+ * ## Residual DNS-rebinding (TOCTOU) caveat
+ *
+ * `fetchGuard()` resolves the hostname, validates every returned address
+ * against the deny / allow set, and only then hands the original
+ * `Request` to the underlying `fetch`. The underlying `fetch` performs
+ * its **own** DNS lookup when it opens the socket. An attacker that
+ * controls a TTL=0 record can return a public IP at validation time and
+ * a `127.0.0.1` / `169.254.169.254` at connect time, slipping past the
+ * library-level check. This residual TOCTOU window cannot be closed at
+ * the `fetch()` boundary without injecting a custom HTTP dispatcher
+ * (e.g. `undici.Agent({ connect: { lookup } })`) — and Daloy
+ * deliberately ships **zero** runtime dependencies, so we do not bundle
+ * `undici`. To fully close the window:
+ *
+ *  1. **Operator-side** (recommended): block egress to RFC1918 /
+ *     loopback / link-local at the VPC / firewall layer. This neutralises
+ *     the rebinding even if the application is naïve.
+ *  2. **Caller-side, Node only**: install `undici` and pass a custom
+ *     `fetch` that wires a dispatcher with a pinned-IP `connect.lookup`,
+ *     e.g.
+ *     ```ts
+ *     import { Agent, fetch as undiciFetch } from "undici";
+ *     import * as dns from "node:dns/promises";
+ *     const safeFetch = fetchGuard({
+ *       fetch: async (input, init) => {
+ *         const url = new URL(typeof input === "string" ? input : input.url);
+ *         const { address, family } = await dns.lookup(url.hostname, { verbatim: true });
+ *         const dispatcher = new Agent({
+ *           connect: { lookup: (_h, _o, cb) => cb(null, address, family) },
+ *         });
+ *         return undiciFetch(input, { ...init, dispatcher });
+ *       },
+ *     });
+ *     ```
+ *     The pre-resolved IP is what the socket connects to; TLS SNI /
+ *     cert validation still uses the original hostname.
+ *
  * @since 0.34.0
  * @module
  */
@@ -160,4 +205,3 @@ export interface FetchGuardOptions {
  * @since 0.34.0
  */
 export declare function fetchGuard(options?: FetchGuardOptions): typeof fetch;
-//# sourceMappingURL=fetch-guard.d.ts.map

package/dist/fetch-guard.js

@@ -24,18 +24,63 @@
  * Plus an always-deny floor that no flag can lift:
  *
  * - `0.0.0.0/8` (this-network), `100.64.0.0/10` (carrier-grade NAT — covers
- *   Alibaba `100.100.100.200`), `192.0.0.0/24` (covers Oracle Cloud
- *   `192.0.0.192`), `192.0.2.0/24`, `198.18.0.0/15`, `198.51.100.0/24`,
- *   `203.0.113.0/24` (IANA-reserved), `224.0.0.0/4` (multicast),
- *   `240.0.0.0/4` (reserved), `255.255.255.255` (broadcast).
- * - IPv6: `::/128` (unspecified), `ff00::/8` (multicast), IPv4-mapped
+ *   Alibaba `100.100.100.200`), `169.254.169.254/32` (AWS / Azure /
+ *   DigitalOcean / GCP IMDS), `169.254.170.2/32` and `169.254.170.23/32`
+ *   (AWS ECS task metadata / EKS Pod Identity), `192.0.0.0/24` (covers
+ *   Oracle Cloud `192.0.0.192`), `192.0.2.0/24`, `198.18.0.0/15`,
+ *   `198.51.100.0/24`, `203.0.113.0/24` (IANA-reserved), `224.0.0.0/4`
+ *   (multicast), `240.0.0.0/4` (reserved), `255.255.255.255` (broadcast).
+ * - IPv6: `::/128` (unspecified), `ff00::/8` (multicast),
+ *   `fd00:ec2::254/128` (AWS IMDSv2 IPv6), IPv4-mapped
  *   `::ffff:0:0/96` is re-checked against the embedded IPv4 address.
  *
+ * The floor also picks up any user-supplied `denyAddresses` — these win
+ * over `allowAddresses` and over the soft-deny class flags, so an
+ * operator-pinned internal range is never accidentally re-exposed by a
+ * later `allowAddresses` carveout.
+ *
  * Redirects are followed **manually** with re-validation at each hop so
  * an attacker cannot bypass the check via a `302 → http://169.254...`.
  * `non-http(s)` protocols (`file:`, `ftp:`, `gopher:`, `data:`) are
  * rejected before any network call.
  *
+ * ## Residual DNS-rebinding (TOCTOU) caveat
+ *
+ * `fetchGuard()` resolves the hostname, validates every returned address
+ * against the deny / allow set, and only then hands the original
+ * `Request` to the underlying `fetch`. The underlying `fetch` performs
+ * its **own** DNS lookup when it opens the socket. An attacker that
+ * controls a TTL=0 record can return a public IP at validation time and
+ * a `127.0.0.1` / `169.254.169.254` at connect time, slipping past the
+ * library-level check. This residual TOCTOU window cannot be closed at
+ * the `fetch()` boundary without injecting a custom HTTP dispatcher
+ * (e.g. `undici.Agent({ connect: { lookup } })`) — and Daloy
+ * deliberately ships **zero** runtime dependencies, so we do not bundle
+ * `undici`. To fully close the window:
+ *
+ *  1. **Operator-side** (recommended): block egress to RFC1918 /
+ *     loopback / link-local at the VPC / firewall layer. This neutralises
+ *     the rebinding even if the application is naïve.
+ *  2. **Caller-side, Node only**: install `undici` and pass a custom
+ *     `fetch` that wires a dispatcher with a pinned-IP `connect.lookup`,
+ *     e.g.
+ *     ```ts
+ *     import { Agent, fetch as undiciFetch } from "undici";
+ *     import * as dns from "node:dns/promises";
+ *     const safeFetch = fetchGuard({
+ *       fetch: async (input, init) => {
+ *         const url = new URL(typeof input === "string" ? input : input.url);
+ *         const { address, family } = await dns.lookup(url.hostname, { verbatim: true });
+ *         const dispatcher = new Agent({
+ *           connect: { lookup: (_h, _o, cb) => cb(null, address, family) },
+ *         });
+ *         return undiciFetch(input, { ...init, dispatcher });
+ *       },
+ *     });
+ *     ```
+ *     The pre-resolved IP is what the socket connects to; TLS SNI /
+ *     cert validation still uses the original hostname.
+ *
  * @since 0.34.0
  * @module
  */
@@ -65,6 +110,9 @@ export class SsrfBlockedError extends Error {
 const ALWAYS_DENY = [
     "0.0.0.0/8", // "this network"
     "100.64.0.0/10", // CGNAT (Alibaba metadata 100.100.100.200)
+    "169.254.169.254/32", // AWS / Azure / DigitalOcean / GCP IMDS — hard floor
+    "169.254.170.2/32", // AWS ECS task metadata v2 / EKS Pod Identity
+    "169.254.170.23/32", // AWS EKS Pod Identity (IPv4)
     "192.0.0.0/24", // IANA reserved (Oracle metadata 192.0.0.192)
     "192.0.2.0/24", // TEST-NET-1
     "198.18.0.0/15", // benchmarking
@@ -74,6 +122,7 @@ const ALWAYS_DENY = [
     "240.0.0.0/4", // reserved (includes 255.255.255.255)
     "::/128", // unspecified
     "ff00::/8", // IPv6 multicast
+    "fd00:ec2::254/128", // AWS IMDSv2 IPv6
 ];
 const LOOPBACK = ["127.0.0.0/8", "::1/128"];
 const LINK_LOCAL = ["169.254.0.0/16", "fe80::/10"];
@@ -107,7 +156,17 @@ const UNIQUE_LOCAL = ["fc00::/7"];
  */
 export function fetchGuard(options = {}) {
     const allowProtocols = new Set((options.allowProtocols ?? ["http:", "https:"]).map((s) => s.toLowerCase()));
-    const denyMatchers = [];
+    // Hard-deny floor: ALWAYS_DENY (cloud metadata + reserved) plus any
+    // user-supplied `denyAddresses`. No allow flag, including
+    // `allowAddresses`, can lift these — this is what keeps a misconfigured
+    // egress allow-list from accidentally re-exposing 169.254.169.254 or
+    // an operator-pinned internal range.
+    const hardDenyMatchers = [];
+    // Soft-deny class defaults: loopback / private / link-local /
+    // unique-local. These reflect "off by default" classes that the
+    // matching `allow*` flag — or an explicit `allowAddresses` range —
+    // is allowed to opt into.
+    const softDenyMatchers = [];
     const allowMatchers = [];
     const allowHosts = new Set((options.allowHosts ?? []).map((h) => h.toLowerCase()));
     const maxRedirects = options.maxRedirects ?? 5;
@@ -117,28 +176,35 @@ export function fetchGuard(options = {}) {
     }
     const resolveFn = options.resolve ?? createDefaultResolver();
     for (const c of ALWAYS_DENY)
-        denyMatchers.push(compileCidrMatcher(c));
-    if (!options.allowLoopback)
+        hardDenyMatchers.push(compileCidrMatcher(c));
+    for (const c of options.denyAddresses ?? [])
+        hardDenyMatchers.push(compileCidrMatcher(c));
+    if (!options.allowLoopback) {
         for (const c of LOOPBACK)
-            denyMatchers.push(compileCidrMatcher(c));
-    if (!options.allowPrivate)
+            softDenyMatchers.push(compileCidrMatcher(c));
+    }
+    if (!options.allowPrivate) {
         for (const c of PRIVATE)
-            denyMatchers.push(compileCidrMatcher(c));
-    if (!options.allowLinkLocal)
+            softDenyMatchers.push(compileCidrMatcher(c));
+    }
+    if (!options.allowLinkLocal) {
         for (const c of LINK_LOCAL)
-            denyMatchers.push(compileCidrMatcher(c));
+            softDenyMatchers.push(compileCidrMatcher(c));
+    }
     if (!options.allowUniqueLocal) {
         for (const c of UNIQUE_LOCAL)
-            denyMatchers.push(compileCidrMatcher(c));
+            softDenyMatchers.push(compileCidrMatcher(c));
     }
-    for (const c of options.denyAddresses ?? [])
-        denyMatchers.push(compileCidrMatcher(c));
     for (const c of options.allowAddresses ?? [])
         allowMatchers.push(compileCidrMatcher(c));
     function isAddressAllowed(parsed) {
+        // Hard-deny wins over every allow knob — cloud metadata IPs and
+        // operator-pinned `denyAddresses` are non-negotiable.
+        if (hardDenyMatchers.some((m) => matchesMatcher(parsed, m)))
+            return false;
         if (allowMatchers.some((m) => matchesMatcher(parsed, m)))
             return true;
-        return !denyMatchers.some((m) => matchesMatcher(parsed, m));
+        return !softDenyMatchers.some((m) => matchesMatcher(parsed, m));
     }
     async function validateUrl(url) {
         const proto = url.protocol.toLowerCase();
@@ -262,4 +328,3 @@ function createDefaultResolver() {
         return results.map((r) => r.address);
     };
 }
-//# sourceMappingURL=fetch-guard.js.map

package/dist/hashing.d.ts

@@ -56,4 +56,3 @@ export declare function passwordHash(password: string): Promise<string>;
  * @since 0.15.0
  */
 export declare function passwordVerify(password: string, storedHash: string): Promise<boolean>;
-//# sourceMappingURL=hashing.d.ts.map

package/dist/hashing.js

@@ -151,4 +151,3 @@ export async function passwordVerify(password, storedHash) {
         return false;
     return nodeTimingSafeEqual(derived, parsed.hash);
 }
-//# sourceMappingURL=hashing.js.map

package/dist/index.d.ts

@@ -15,9 +15,9 @@ export { HttpError, BadRequestError, ValidationError, NotFoundError, Unauthorize
 export type { ProblemDetails, ProblemRenderOptions, HttpErrorOptions } from "./errors.js";
 export type { StandardSchemaV1 } from "./schema.js";
 export { validate, isStandardSchema } from "./schema.js";
-export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, } from "./security.js";
+export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, WEBHOOK_DEFAULT_TOLERANCE_SECONDS, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, sanitizeFilename, assertSafeRelativePath, hasMongoOperatorKeys, assertNoMongoOperators, } from "./security.js";
 export type { WebhookHmacAlgorithm } from "./security.js";
-export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
+export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
 export { etag } from "./etag.js";
 export type { ETagOptions } from "./etag.js";
 export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";
@@ -36,11 +36,13 @@ export { ipRestriction } from "./ip-restriction.js";
 export type { IpRestrictionOptions } from "./ip-restriction.js";
 export { fetchGuard, SsrfBlockedError } from "./fetch-guard.js";
 export type { FetchGuardOptions, SsrfBlockReason } from "./fetch-guard.js";
+export { safeRedirect, OpenRedirectBlockedError } from "./safe-redirect.js";
+export type { SafeRedirectOptions, SafeRedirectStatus, SafeRedirectBlockReason, } from "./safe-redirect.js";
 export { loadShedding, LOAD_SHEDDING_MARKER } from "./load-shedding.js";
 export type { LoadSheddingOptions, LoadSheddingSnapshot, } from "./load-shedding.js";
 export { defineConfig, ConfigValidationError } from "./config.js";
 export type { ConfigSource, DefineConfigOptions, } from "./config.js";
-export type { RequestIdOptions, SecureHeadersOptions, CspDirectivesOptions, CorsOptions, CorsOriginAllow, RateLimitOptions, RateLimitStore, LoginThrottleOptions, CsrfOptions, CsrfCookieOptions, BasicAuthOptions, } from "./middleware.js";
+export type { RequestIdOptions, SecureHeadersOptions, CspDirectivesOptions, CorsOptions, CorsOriginAllow, RateLimitOptions, RateLimitStore, LoginThrottleOptions, CsrfOptions, CsrfCookieOptions, FetchMetadataOptions, BasicAuthOptions, } from "./middleware.js";
 export type { BearerAuthOptions, BearerAuthVerifyHook } from "./middleware.js";
 export { createLogger, noopLogger, DEFAULT_REDACT_KEYS } from "./logger.js";
 export type { Logger, LogLevel, ConsoleLoggerOptions, LoggerRedactionOptions, } from "./logger.js";
@@ -61,4 +63,3 @@ export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACI
 export type { OtelTracingOptions, TracingAttributes, TracingAttributeValue, TracingSpan, TracingStartSpanOptions, TracingTracer, } from "./tracing.js";
 export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, checkWebSocketOrigin, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
 export type { WebSocketConnection, WebSocketContext, WebSocketHandler, WebSocketRouteEntry, NormalizedWebSocketOptions, WebSocketBeforeUpgrade, HandshakeResult, ParsedFrame, MessageEvent as WebSocketMessageEvent, FrameSinkEvents, } from "./websocket.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -8,8 +8,8 @@ export { subdomains, PSL_SNAPSHOT_DATE, PSL_PUBLIC_SUFFIXES, MAX_SNAPSHOT_AGE_DA
 export { defineDependency, DEPENDENCY_MARKER } from "./dependency.js";
 export { HttpError, BadRequestError, ValidationError, NotFoundError, UnauthorizedError, ForbiddenError, MethodNotAllowedError, PayloadTooLargeError, UnsupportedMediaTypeError, TooManyRequestsError, RequestTimeoutError, InternalError, MessageLeakError, httpError, SAFE_CUSTOM_ERROR_RESPONSE_HEADERS, checkCustomErrorResponseHeaders, } from "./errors.js";
 export { validate, isStandardSchema } from "./schema.js";
-export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, } from "./security.js";
-export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
+export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, WEBHOOK_DEFAULT_TOLERANCE_SECONDS, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, sanitizeFilename, assertSafeRelativePath, hasMongoOperatorKeys, assertNoMongoOperators, } from "./security.js";
+export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
 export { etag } from "./etag.js";
 export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";
 export { createJwtSigner, createJwtVerifier, JwtError, DEFAULT_JWT_MAX_LIFETIME_SECONDS, } from "./jwt.js";
@@ -19,6 +19,7 @@ export { assertTemporalClaims, TemporalClaimError, } from "./time-claims.js";
 export { every, some, except } from "./combine.js";
 export { ipRestriction } from "./ip-restriction.js";
 export { fetchGuard, SsrfBlockedError } from "./fetch-guard.js";
+export { safeRedirect, OpenRedirectBlockedError } from "./safe-redirect.js";
 export { loadShedding, LOAD_SHEDDING_MARKER } from "./load-shedding.js";
 export { defineConfig, ConfigValidationError } from "./config.js";
 export { createLogger, noopLogger, DEFAULT_REDACT_KEYS } from "./logger.js";
@@ -30,4 +31,3 @@ export { session, rotateSession, signValue, verifySignedValue, MemorySessionStor
 export { fileField, multipartObject, isFileFieldSchema, isMultipartObjectSchema, } from "./multipart.js";
 export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACING_SPAN_STATUS_OK, TRACING_SPAN_STATUS_ERROR, } from "./tracing.js";
 export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, checkWebSocketOrigin, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
-//# sourceMappingURL=index.js.map

package/dist/ip-restriction.d.ts

@@ -89,4 +89,3 @@ export declare function matchesMatcher(ip: ParsedIp, m: IpMatcher): boolean;
 export declare function compileCidrMatcher(input: string): IpMatcher;
 /** @internal */
 export declare function parseIp(input: string): ParsedIp | undefined;
-//# sourceMappingURL=ip-restriction.d.ts.map