@daloyjs/core 0.35.1 → 0.36.0

package/dist/safe-redirect.d.ts

@@ -38,7 +38,7 @@
  * });
  * ```
  *
- * @since 0.35.1
+ * @since 0.36.0
  */
 /** Reason an open-redirect candidate was refused. */
 export type SafeRedirectBlockReason = "empty-target" | "invalid-control-characters" | "protocol-relative" | "backslash-path" | "path-not-allowed" | "origin-not-allowed" | "scheme-not-allowed" | "parse-failed";
@@ -86,6 +86,6 @@ export interface SafeRedirectOptions {
  * @param target - User-supplied URL candidate (path or absolute URL).
  * @param options - Allowlist + response configuration.
  *
- * @since 0.35.1
+ * @since 0.36.0
  */
 export declare function safeRedirect(target: string, options?: SafeRedirectOptions): Response;

package/dist/safe-redirect.js

@@ -38,7 +38,7 @@
  * });
  * ```
  *
- * @since 0.35.1
+ * @since 0.36.0
  */
 /** Thrown when {@link safeRedirect} refuses a candidate URL and no `fallback` is configured. */
 export class OpenRedirectBlockedError extends Error {
@@ -126,7 +126,7 @@ function classify(target, allowedPaths, allowedOrigins) {
  * @param target - User-supplied URL candidate (path or absolute URL).
  * @param options - Allowlist + response configuration.
  *
- * @since 0.35.1
+ * @since 0.36.0
  */
 export function safeRedirect(target, options = {}) {
     const allowedPaths = options.allowedPaths ?? [];

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3d46c2b6-0b38-564b-9dd2-79098e99155b",
+  "serialNumber": "urn:uuid:7079f846-98da-5195-89ad-4f54c8938289",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-26T23:20:20.188Z",
+    "timestamp": "2026-05-28T20:50:52.884Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.35.1"
+        "version": "0.36.0"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@0.35.1",
+      "bom-ref": "pkg:npm/@daloyjs/core@0.36.0",
       "name": "@daloyjs/core",
-      "version": "0.35.1",
+      "version": "0.36.0",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@0.35.1",
+      "purl": "pkg:npm/@daloyjs/core@0.36.0",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-0.35.1",
+        "tagId": "swidtag--daloyjs-core-0.36.0",
         "name": "@daloyjs/core",
-        "version": "0.35.1",
+        "version": "0.36.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@0.35.1",
+      "ref": "pkg:npm/@daloyjs/core@0.36.0",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-0.35.1",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.35.1-3d46c2b6-0b38-564b-9dd2-79098e99155b",
+  "name": "@daloyjs/core-0.36.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.36.0-7079f846-98da-5195-89ad-4f54c8938289",
   "creationInfo": {
-    "created": "2026-05-26T23:20:20.188Z",
+    "created": "2026-05-28T20:50:52.884Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "0.35.1",
+      "versionInfo": "0.36.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@0.35.1"
+          "referenceLocator": "pkg:npm/@daloyjs/core@0.36.0"
         }
       ]
     }

package/dist/security.d.ts

@@ -85,21 +85,6 @@ export declare function sanitizeHeaderValue(value: string): string;
  * @since 0.1.0
  */
 export declare function timingSafeEqual(a: string, b: string): boolean;
-/**
- * Generate a cryptographically strong, URL-safe identifier (~22 chars).
- *
- * Uses Web Crypto's `crypto.randomUUID()` when available, falling back to
- * 16 random bytes via `crypto.getRandomValues()`. The last-resort fallback
- * (timestamp + `Math.random()`) only triggers in environments without
- * WebCrypto, which is none of Node 20+/Bun/Deno/Cloudflare Workers/Vercel
- * Edge.
- *
- * Suitable for request ids, session ids, and short-lived correlation tokens.
- * Do not use for long-lived secrets unless you also sign or wrap them.
- *
- * @returns A random URL-safe id string.
- * @since 0.1.0
- */
 export declare function randomId(): string;
 /**
  * Header names that MUST appear at most once on a request per RFC 7230.
@@ -338,7 +323,7 @@ export declare function signWebhookPayload(opts: {
  * @returns A sanitized basename safe to combine with a trusted directory.
  * @throws {BadRequestError} When the input reduces to an empty string or
  *   matches a Windows-reserved device name.
- * @since 0.35.1
+ * @since 0.35.0
  */
 export declare function sanitizeFilename(name: string): string;
 /**
@@ -365,7 +350,7 @@ export declare function sanitizeFilename(name: string): string;
  * @param input - The candidate relative path.
  * @returns The input unchanged when safe.
  * @throws {BadRequestError} When the path could escape its base directory.
- * @since 0.35.1
+ * @since 0.35.0
  */
 export declare function assertSafeRelativePath(input: string): string;
 /**
@@ -376,7 +361,7 @@ export declare function assertSafeRelativePath(input: string): string;
  * Returns `true` on the first hit. Use before passing untrusted data
  * into a query object that may be interpreted as an operator expression.
  *
- * @since 0.35.1
+ * @since 0.35.0
  */
 export declare function hasMongoOperatorKeys(value: unknown): boolean;
 /**
@@ -385,6 +370,6 @@ export declare function hasMongoOperatorKeys(value: unknown): boolean;
  * threading it into a NoSQL driver — closes the
  * `{"password": {"$ne": null}}` authentication-bypass class of bug.
  *
- * @since 0.35.1
+ * @since 0.35.0
  */
 export declare function assertNoMongoOperators(value: unknown): void;

package/dist/security.js

@@ -9,6 +9,12 @@
  * - randomId: cryptographically strong request id.
  */
 import { PayloadTooLargeError, BadRequestError, } from "./errors.js";
+// Resolved once at module load. Mirror of `DALOY_REQUEST_RAW_BODY` in
+// app.ts; defined here via the global Symbol registry to avoid an import
+// cycle (app.ts -> security.ts). Adapters attach a pre-validated
+// Uint8Array under this key so readBodyLimited can skip the WHATWG stream
+// reader loop.
+const REQUEST_RAW_BODY = Symbol.for("daloyjs.request.rawBody");
 /**
  * Read a `Request` body to a `Uint8Array` while enforcing a hard byte cap.
  *
@@ -36,6 +42,15 @@ export async function readBodyLimited(req, limit) {
         if (n > limit)
             throw new PayloadTooLargeError(limit);
     }
+    // Fast path: adapter pre-buffered the body and stashed it via the
+    // REQUEST_RAW_BODY symbol. Re-check the limit (defense-in-depth) and
+    // return zero-copy. Skips the WHATWG ReadableStream reader loop entirely.
+    const cached = req[REQUEST_RAW_BODY];
+    if (cached instanceof Uint8Array) {
+        if (cached.byteLength > limit)
+            throw new PayloadTooLargeError(limit);
+        return cached;
+    }
     if (!req.body)
         return new Uint8Array(0);
     const reader = req.body.getReader();
@@ -177,8 +192,20 @@ export function timingSafeEqual(a, b) {
  * @returns A random URL-safe id string.
  * @since 0.1.0
  */
+// Cache the Web Crypto entry points at module load so randomId() doesn't pay
+// for a `globalThis.crypto` + optional-chain property lookup per request.
+// Falls back to the runtime lookup path if Web Crypto is patched/replaced
+// after module load (test harnesses, custom runtimes) — the cache is only
+// trusted when `globalThis.crypto` is still the same reference, otherwise
+// the stubbed object would be silently bypassed.
+const _webCrypto = globalThis.crypto;
+const _randomUUID = _webCrypto && typeof _webCrypto.randomUUID === "function"
+    ? _webCrypto.randomUUID.bind(_webCrypto)
+    : undefined;
 export function randomId() {
     const c = globalThis.crypto;
+    if (c === _webCrypto && _randomUUID !== undefined)
+        return _randomUUID();
     if (c?.randomUUID)
         return c.randomUUID();
     if (c?.getRandomValues) {
@@ -263,11 +290,13 @@ export const RESERVED_INBOUND_HEADER_PREFIXES = Object.freeze([
  * @since 0.36.0
  */
 export function assertNoReservedInternalHeaders(headers) {
+    // WHATWG Headers.forEach() yields lowercased names, so the per-header
+    // .toLowerCase() call this function used to do was dead work on every
+    // request. Skip it.
     headers.forEach((_value, name) => {
-        const lower = name.toLowerCase();
         for (const prefix of RESERVED_INBOUND_HEADER_PREFIXES) {
-            if (lower.startsWith(prefix)) {
-                throw new BadRequestError(`Reserved internal header rejected: ${lower}`);
+            if (name.startsWith(prefix)) {
+                throw new BadRequestError(`Reserved internal header rejected: ${name}`);
             }
         }
     });
@@ -631,7 +660,7 @@ const WINDOWS_RESERVED_NAMES = new Set([
  * @returns A sanitized basename safe to combine with a trusted directory.
  * @throws {BadRequestError} When the input reduces to an empty string or
  *   matches a Windows-reserved device name.
- * @since 0.35.1
+ * @since 0.35.0
  */
 export function sanitizeFilename(name) {
     if (typeof name !== "string") {
@@ -683,7 +712,7 @@ export function sanitizeFilename(name) {
  * @param input - The candidate relative path.
  * @returns The input unchanged when safe.
  * @throws {BadRequestError} When the path could escape its base directory.
- * @since 0.35.1
+ * @since 0.35.0
  */
 export function assertSafeRelativePath(input) {
     if (typeof input !== "string" || input.length === 0) {
@@ -744,7 +773,7 @@ function walkForMongoOperators(value) {
  * Returns `true` on the first hit. Use before passing untrusted data
  * into a query object that may be interpreted as an operator expression.
  *
- * @since 0.35.1
+ * @since 0.35.0
  */
 export function hasMongoOperatorKeys(value) {
     return walkForMongoOperators(value);
@@ -755,7 +784,7 @@ export function hasMongoOperatorKeys(value) {
  * threading it into a NoSQL driver — closes the
  * `{"password": {"$ne": null}}` authentication-bypass class of bug.
  *
- * @since 0.35.1
+ * @since 0.35.0
  */
 export function assertNoMongoOperators(value) {
     if (walkForMongoOperators(value)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "0.35.1",
+  "version": "0.36.0",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {