@daloyjs/core 0.35.2 → 0.36.0

package/README.md

@@ -466,6 +466,7 @@ The framework refuses to start (or to construct) when configuration is unsafe:
 
 - Weak session secrets, `cors({ origin: "*" })` with credentials, `session()` + state-changing route without `csrf()`, and unconfigured `X-Forwarded-*` in production.
 - `secureDefaults: false` in production unless `acknowledgeInsecureDefaults: true` is set, plus a once-per-process `error` log naming every disabled default.
+- `preset: "internal-service"` topology preset for service-to-service deployments behind a mesh / sidecar / private network: turns OFF the browser-only guards (auto `secureHeaders`, `corsCrossOriginGuard`, `csrf` boot guard, unconfigured `X-Forwarded-*` guard) while keeping every input, parser, credential, SSRF, weak-secret, and refuse-to-boot guard ON. Per-knob options still win, the choice is logged at boot under `event: "security.preset.applied"`, and the live posture is auditable via `app.getSecurityPosture()`.
 - `createJwtSigner()` / `createJwtVerifier()` refuse `alg: "none"`, accept only an explicit allowlist, refuse HS + JWK combinations, refuse to sign without `exp`, and refuse HS-shaped secrets under 32 bytes (RFC 7518 §3.2).
 - `secureHeaders()` refuses to construct with `frameOptions: false` AND no CSP `frame-ancestors` directive (no clickjacking defense).
 - `cors()` refuses `methods: ['*']` at construction; default `allowMethods` narrowed to `[GET, HEAD, POST]` so `PUT` / `PATCH` / `DELETE` become explicit opt-ins.

package/dist/app.d.ts

@@ -10,6 +10,33 @@ import { type BehindProxyConfig } from "./conn-info.js";
 export declare function _resetCrashHandlersForTests(): void;
 /** @internal Test-only helper to reset the latch between tests. */
 export declare function _resetInsecureDefaultsLogForTests(): void;
+/**
+ * Named security posture preset. Currently only one value is supported:
+ *
+ * - `"internal-service"` — relaxes the *topology-dependent* defaults that
+ *   only make sense when an HTTP boundary faces a browser or the public
+ *   internet (auto `secureHeaders`, cross-origin write guard, the
+ *   session+state-changing-route CSRF boot guard, and the unconfigured
+ *   `X-Forwarded-*` guard). Everything that protects the service from
+ *   malformed input, confused dependencies, or compromised callers —
+ *   body limits, request timeouts, JWT algorithm allowlists, weak-secret
+ *   refuse-to-boot, `cors({ origin: '*' })` refuse-to-boot, anonymous
+ *   stateful plugin refuse-to-boot, `crashOnUnhandledRejection`, schema
+ *   strictness, prototype-pollution-safe parsers, SSRF-safe `fetchGuard`
+ *   defaults, RFC 9457 problem+json redaction — stays on. Per-knob
+ *   options still win (`secureHeaders: { ... }` re-enables it on top of
+ *   the preset). The preset choice is logged once at boot under the
+ *   `security.preset.applied` event so operators can audit the posture
+ *   without reading code.
+ *
+ * Topology presets are intentionally a small, curated set — they are NOT
+ * a master "disable everything" knob. If you really need to disable the
+ * entire secure-by-default surface, use the explicit
+ * {@link AppOptions.secureDefaults} `false` escape hatch.
+ *
+ * @since 0.34.0
+ */
+export type SecurityPreset = "internal-service";
 /**
  * Configuration accepted by {@link App}'s constructor. Every field is
  * optional; sensible production defaults are applied.
@@ -21,6 +48,23 @@ export interface AppOptions {
     title?: string;
     version?: string;
     description?: string;
+    /**
+     * Topology-aware security posture preset. See {@link SecurityPreset}.
+     *
+     * - `"internal-service"` — for service-to-service deployments behind a
+     *   service mesh, sidecar, or private network. Turns off the
+     *   browser-/edge-only guards (auto `secureHeaders`, cross-origin write
+     *   guard, session+state-changing CSRF boot guard, unconfigured
+     *   `X-Forwarded-*` guard) while keeping every input-, parser-,
+     *   credential-, and SSRF-level guard on. The choice is logged once at
+     *   boot under the `security.preset.applied` event. Per-knob options
+     *   you pass alongside the preset still win.
+     *
+     * Omit (default) for browser-facing / public APIs.
+     *
+     * @since 0.34.0
+     */
+    preset?: SecurityPreset;
     /** Validate handler responses against declared response schemas. Default: true. */
     validateResponses?: boolean;
     /** Hard cap on request body size in bytes. Default: 1 MiB. */
@@ -642,6 +686,41 @@ export declare class App {
      *    set deep in shared configuration.
      */
     private assertInsecureDefaultsAcknowledged;
+    /**
+     * Emit the one-time boot audit entry for an applied security preset.
+     * Called from the constructor with the *original* (pre-preset) options
+     * so the log captures which fields the preset filled in vs. which the
+     * caller set explicitly. Logged at `info` so the line shows up in
+     * standard production log shipping without being noisy.
+     *
+     * Operators can audit the live posture at any time through
+     * {@link App.getSecurityPosture}.
+     *
+     * @since 0.34.0
+     */
+    private logSecurityPresetIfApplied;
+    /**
+     * Structured snapshot of the live security posture. Returns the same
+     * data the constructor logs under the `security.preset.applied` audit
+     * event plus the resolved values of every secure-by-default knob, so
+     * operators can build a `/__security` introspection route or a CI
+     * audit without parsing the framework source.
+     *
+     * @since 0.34.0
+     */
+    getSecurityPosture(): {
+        preset: SecurityPreset | undefined;
+        secureDefaults: boolean;
+        secureHeaders: boolean;
+        corsCrossOriginGuard: boolean;
+        csrf: "off" | "on";
+        crashOnUnhandledRejection: boolean | "default";
+        trustProxy: true | false | "unconfigured";
+        bodyLimitBytes: number;
+        requestTimeoutMs: number;
+        stripServerHeaders: boolean;
+        production: boolean;
+    };
     /**
      * Install the secure-by-default global hooks. Currently:
      *  - {@link secureHeaders} as a group-level hook so every response carries

package/dist/app.js

@@ -40,6 +40,36 @@ let insecureDefaultsLoggedThisProcess = false;
 export function _resetInsecureDefaultsLogForTests() {
     insecureDefaultsLoggedThisProcess = false;
 }
+/**
+ * The exact set of fields the `"internal-service"` preset flips off when
+ * the caller has not set them explicitly. Surfaced through the boot
+ * audit log entry so operators can see which guards the preset turned
+ * off without re-reading the framework source.
+ */
+const INTERNAL_SERVICE_PRESET_DISABLED = Object.freeze([
+    "secureHeaders auto-install",
+    "corsCrossOriginGuard (state-changing cross-origin write rejection)",
+    "csrf boot guard (session() + state-changing route)",
+    "unconfigured X-Forwarded-* / trustProxy guard",
+]);
+/**
+ * Defaults that the `"internal-service"` preset keeps on. Logged at boot
+ * alongside the disabled list so the audit entry shows the full posture.
+ */
+const INTERNAL_SERVICE_PRESET_KEPT = Object.freeze([
+    "bodyLimitBytes (1 MiB default)",
+    "requestTimeoutMs (30 s default)",
+    "crashOnUnhandledRejection (production)",
+    "weak session secret refuse-to-boot",
+    "cors({ origin: '*' }) refuse-to-boot",
+    "anonymous stateful plugin refuse-to-boot",
+    "stripServerHeaders",
+    "RFC 9457 problem+json prod redaction",
+    "JWT algorithm allowlist + timingSafeEqual credential comparison",
+    "prototype-pollution-safe parsers + isForbiddenObjectKey",
+    "fetchGuard() SSRF defaults",
+    "schema .strict() + response validation when enabled",
+]);
 /**
  * List of secure-by-default surfaces disabled when `secureDefaults: false`
  * is set. Surfaced through the once-per-process `error` log so the operator
@@ -74,6 +104,46 @@ const CANONICAL_HTTP_METHODS = new Set([
     "HEAD",
     "OPTIONS",
 ]);
+/**
+ * Apply a topology-aware security preset on top of caller-supplied
+ * options. Returns a new options object where preset defaults fill in
+ * any field the caller left `undefined`; explicit caller values always
+ * win. Pure / no side effects — the boot audit log is emitted
+ * separately by {@link App.logSecurityPresetIfApplied} so this helper is
+ * safe to call from `new App({ preset: ... })` in test setups.
+ *
+ * The `"internal-service"` preset turns off:
+ *  - `secureHeaders` auto-install (browser-only headers)
+ *  - `corsCrossOriginGuard` (no browser Origin to guard against)
+ *  - `csrf` (set to `"off"` — service-to-service callers aren't browsers)
+ *  - `trustProxy` (set to `false` — explicitly ignore `X-Forwarded-*`
+ *    and silence the unconfigured-proxy 500 guard; the immediate peer
+ *    inside the mesh *is* the caller)
+ *
+ * Everything else (body limits, request timeouts, JWT allowlist,
+ * `crashOnUnhandledRejection`, weak-secret refuse-to-boot, cors-wildcard
+ * refuse-to-boot, anonymous stateful plugin refuse-to-boot,
+ * `stripServerHeaders`, RFC 9457 prod redaction, schema strictness,
+ * `fetchGuard`, parser safety) stays at its standard secure-by-default
+ * value.
+ *
+ * @internal
+ */
+function applySecurityPreset(options) {
+    if (options.preset !== "internal-service")
+        return options;
+    const out = { ...options };
+    if (out.secureHeaders === undefined)
+        out.secureHeaders = false;
+    if (out.corsCrossOriginGuard === undefined)
+        out.corsCrossOriginGuard = false;
+    if (out.csrf === undefined)
+        out.csrf = "off";
+    if (out.trustProxy === undefined && out.behindProxy === undefined) {
+        out.trustProxy = false;
+    }
+    return out;
+}
 const DEFAULTS = {
     bodyLimitBytes: 1024 * 1024,
     requestTimeoutMs: 30_000,
@@ -245,11 +315,12 @@ export class App {
         return this._globalCorsAllowsCache;
     }
     constructor(options = {}) {
+        const resolved = applySecurityPreset(options);
         this.options = {
-            validateResponses: options.validateResponses ?? DEFAULTS.validateResponses,
-            bodyLimitBytes: options.bodyLimitBytes ?? DEFAULTS.bodyLimitBytes,
-            requestTimeoutMs: options.requestTimeoutMs ?? DEFAULTS.requestTimeoutMs,
-            ...options,
+            validateResponses: resolved.validateResponses ?? DEFAULTS.validateResponses,
+            bodyLimitBytes: resolved.bodyLimitBytes ?? DEFAULTS.bodyLimitBytes,
+            requestTimeoutMs: resolved.requestTimeoutMs ?? DEFAULTS.requestTimeoutMs,
+            ...resolved,
         };
         this.log =
             options.logger === false
@@ -264,6 +335,7 @@ export class App {
         if (this.options.hooks)
             this.assertSecureHookConfig(this.options.hooks);
         this.assertInsecureDefaultsAcknowledged();
+        this.logSecurityPresetIfApplied(options);
         this.installSecureDefaults();
         this.maybeInstallCrashHandlers();
         this.maybeMountDocs();
@@ -318,6 +390,68 @@ export class App {
             }, `app({ secureDefaults: false }) disables: ${DISABLED_BY_INSECURE_DEFAULTS.join(", ")}.`);
         }
     }
+    /**
+     * Emit the one-time boot audit entry for an applied security preset.
+     * Called from the constructor with the *original* (pre-preset) options
+     * so the log captures which fields the preset filled in vs. which the
+     * caller set explicitly. Logged at `info` so the line shows up in
+     * standard production log shipping without being noisy.
+     *
+     * Operators can audit the live posture at any time through
+     * {@link App.getSecurityPosture}.
+     *
+     * @since 0.34.0
+     */
+    logSecurityPresetIfApplied(originalOptions) {
+        if (originalOptions.preset !== "internal-service")
+            return;
+        const userOverrode = [];
+        if (originalOptions.secureHeaders !== undefined)
+            userOverrode.push("secureHeaders");
+        if (originalOptions.corsCrossOriginGuard !== undefined) {
+            userOverrode.push("corsCrossOriginGuard");
+        }
+        if (originalOptions.csrf !== undefined)
+            userOverrode.push("csrf");
+        if (originalOptions.trustProxy !== undefined)
+            userOverrode.push("trustProxy");
+        if (originalOptions.behindProxy !== undefined)
+            userOverrode.push("behindProxy");
+        this.log.info({
+            event: "security.preset.applied",
+            preset: "internal-service",
+            disabled: INTERNAL_SERVICE_PRESET_DISABLED,
+            kept: INTERNAL_SERVICE_PRESET_KEPT,
+            userOverrode,
+        }, `Applied security preset "internal-service": disabled ${INTERNAL_SERVICE_PRESET_DISABLED.length} topology-dependent guards; kept ${INTERNAL_SERVICE_PRESET_KEPT.length} input/credential/SSRF guards on. See app.getSecurityPosture() for the live snapshot.`);
+    }
+    /**
+     * Structured snapshot of the live security posture. Returns the same
+     * data the constructor logs under the `security.preset.applied` audit
+     * event plus the resolved values of every secure-by-default knob, so
+     * operators can build a `/__security` introspection route or a CI
+     * audit without parsing the framework source.
+     *
+     * @since 0.34.0
+     */
+    getSecurityPosture() {
+        const o = this.options;
+        return Object.freeze({
+            preset: o.preset,
+            secureDefaults: o.secureDefaults !== false,
+            secureHeaders: o.secureDefaults !== false && o.secureHeaders !== false,
+            corsCrossOriginGuard: o.secureDefaults !== false && o.corsCrossOriginGuard !== false,
+            csrf: o.csrf === "off" ? "off" : "on",
+            crashOnUnhandledRejection: o.crashOnUnhandledRejection === undefined
+                ? "default"
+                : o.crashOnUnhandledRejection,
+            trustProxy: o.trustProxy === undefined ? "unconfigured" : o.trustProxy,
+            bodyLimitBytes: this.options.bodyLimitBytes,
+            requestTimeoutMs: this.options.requestTimeoutMs,
+            stripServerHeaders: o.stripServerHeaders !== false,
+            production: this.isProduction(),
+        });
+    }
     /**
      * Install the secure-by-default global hooks. Currently:
      *  - {@link secureHeaders} as a group-level hook so every response carries
@@ -1499,7 +1633,7 @@ export class App {
             });
         }
         this.inflight++;
-        const requestId = randomId();
+        let requestId = randomId();
         // Skip the per-request child-logger allocation when the app was
         // constructed with `{ logger: false }`. noopLogger.child() returns
         // itself, so the binding is wasted work on every request.
@@ -1662,6 +1796,13 @@ export class App {
             if (allHooks.beforeHandle !== undefined) {
                 const beforeResult = allHooks.beforeHandle(ctx);
                 const before = isPromiseLike(beforeResult) ? await beforeResult : beforeResult;
+                // Honor any request id override applied by middleware (e.g. the
+                // `requestId()` Hooks bundle replaces the framework-generated value
+                // with a trusted incoming header or a user-supplied generator).
+                const overriddenId = state.requestId;
+                if (typeof overriddenId === "string" && overriddenId.length > 0) {
+                    requestId = overriddenId;
+                }
                 if (before instanceof Response) {
                     copyContextHeaders(ctx, before);
                     if (!before.headers.has("x-request-id"))
@@ -1686,8 +1827,10 @@ export class App {
             const serializeResultRes = serializeResult(result, def, this.options.validateResponses ?? true);
             let response = isPromiseLike(serializeResultRes) ? await serializeResultRes : serializeResultRes;
             copyContextHeaders(ctx, response);
-            if (!response.headers.has("x-request-id"))
-                response.headers.set("x-request-id", requestId);
+            // `serializeResult` always builds a fresh Response with no request id —
+            // skip the `has()` probe and set directly. Saves one undici contains()
+            // call per request on the hot path.
+            response.headers.set("x-request-id", requestId);
             let finalized;
             if (hasFinalizeHook) {
                 const fin = finalizeResponse(response, ctx, allHooks, stripFingerprint);

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export { createApp } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
 export { _resetCrashHandlersForTests } from "./app.js";
 export { _resetInsecureDefaultsLogForTests } from "./app.js";
-export type { AppOptions, AppOpenAPIOptions, DocsRouteOptions, HealthRouteOptions, CspReportRouteOptions, IntrospectedRoute, PluginInstalledEvent, PluginExtension, ShutdownEvent, } from "./app.js";
+export type { AppOptions, AppOpenAPIOptions, DocsRouteOptions, HealthRouteOptions, CspReportRouteOptions, IntrospectedRoute, PluginInstalledEvent, PluginExtension, ShutdownEvent, SecurityPreset, } from "./app.js";
 export { getConnInfo, setConnInfo, assertBehindProxy, resolveClientIp, readRemoteAddress, readRemotePort, pickForwardedForByHops, } from "./conn-info.js";
 export type { BehindProxyConfig, ConnInfo } from "./conn-info.js";
 export { subdomains, PSL_SNAPSHOT_DATE, PSL_PUBLIC_SUFFIXES, MAX_SNAPSHOT_AGE_DAYS, } from "./subdomains.js";

package/dist/safe-redirect.d.ts

@@ -38,7 +38,7 @@
  * });
  * ```
  *
- * @since 0.35.2
+ * @since 0.36.0
  */
 /** Reason an open-redirect candidate was refused. */
 export type SafeRedirectBlockReason = "empty-target" | "invalid-control-characters" | "protocol-relative" | "backslash-path" | "path-not-allowed" | "origin-not-allowed" | "scheme-not-allowed" | "parse-failed";
@@ -86,6 +86,6 @@ export interface SafeRedirectOptions {
  * @param target - User-supplied URL candidate (path or absolute URL).
  * @param options - Allowlist + response configuration.
  *
- * @since 0.35.2
+ * @since 0.36.0
  */
 export declare function safeRedirect(target: string, options?: SafeRedirectOptions): Response;

package/dist/safe-redirect.js

@@ -38,7 +38,7 @@
  * });
  * ```
  *
- * @since 0.35.2
+ * @since 0.36.0
  */
 /** Thrown when {@link safeRedirect} refuses a candidate URL and no `fallback` is configured. */
 export class OpenRedirectBlockedError extends Error {
@@ -126,7 +126,7 @@ function classify(target, allowedPaths, allowedOrigins) {
  * @param target - User-supplied URL candidate (path or absolute URL).
  * @param options - Allowlist + response configuration.
  *
- * @since 0.35.2
+ * @since 0.36.0
  */
 export function safeRedirect(target, options = {}) {
     const allowedPaths = options.allowedPaths ?? [];

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1d9fa950-874b-5a89-9b39-98f1bbdfdb30",
+  "serialNumber": "urn:uuid:7079f846-98da-5195-89ad-4f54c8938289",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-28T07:51:16.251Z",
+    "timestamp": "2026-05-28T20:50:52.884Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.35.2"
+        "version": "0.36.0"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@0.35.2",
+      "bom-ref": "pkg:npm/@daloyjs/core@0.36.0",
       "name": "@daloyjs/core",
-      "version": "0.35.2",
+      "version": "0.36.0",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@0.35.2",
+      "purl": "pkg:npm/@daloyjs/core@0.36.0",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-0.35.2",
+        "tagId": "swidtag--daloyjs-core-0.36.0",
         "name": "@daloyjs/core",
-        "version": "0.35.2",
+        "version": "0.36.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@0.35.2",
+      "ref": "pkg:npm/@daloyjs/core@0.36.0",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-0.35.2",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.35.2-1d9fa950-874b-5a89-9b39-98f1bbdfdb30",
+  "name": "@daloyjs/core-0.36.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.36.0-7079f846-98da-5195-89ad-4f54c8938289",
   "creationInfo": {
-    "created": "2026-05-28T07:51:16.251Z",
+    "created": "2026-05-28T20:50:52.884Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "0.35.2",
+      "versionInfo": "0.36.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@0.35.2"
+          "referenceLocator": "pkg:npm/@daloyjs/core@0.36.0"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "0.35.2",
+  "version": "0.36.0",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {