@daloyjs/core 0.39.0 → 0.41.0

package/README.md

@@ -438,6 +438,8 @@ if (!report.ok) process.exit(1);
 
 The contract runner verifies that declared examples actually match their schemas, flags duplicate/missing operationIds, dead routes, and accidental body schemas on safe methods.
 
+Gate it in CI two ways: `daloy inspect --check <entry>` exits non-zero on any error-level issue, or assert `report.ok` inside your test suite. **Every `create-daloy` template ships a contract-gate test** (`tests/contract.test.ts`, `tests/contract_test.ts` on Deno) wired into its `test` task, so scaffolded projects fail CI on a broken contract out of the box. For a localhost-only gate that runs before code leaves your machine, each template also ships an opt-in `pre-push` hook (`.githooks/pre-push`, enabled with `hooks:install` which points `core.hooksPath` at it); it runs `daloy inspect --check` on every `git push` and is bypassable with `git push --no-verify`.
+
 ---
 
 ## Plugin encapsulation (Fastify-style)
@@ -508,7 +510,7 @@ DaloyJS is in **public preview** (`0.x`). The public API may still change betwee
 - RFC 7231 + RFC 5789 HTTP-method allowlist enforced inside `app.route()` (WebDAV, `TRACE`, `CONNECT` rejected at the framework boundary).
 - AI-friendly route metadata via optional `meta: { examples, extensions, summary, description, tags }`; examples are validated against your schemas at build time, surfaced as OpenAPI `examples` + `x-daloy-*` extensions, and dumped as `routes.json` / `routes.yaml` via `daloy inspect --ai`.
 - API lifecycle and breaking-change detection: mark routes `deprecated` or give them a `sunset` date to emit RFC 8594 `Deprecation` / `Sunset` headers and an `x-sunset` OpenAPI extension, then gate CI with `diffOpenAPI()` / the `daloy diff` command, which fail on a breaking change versus the last published spec.
-- In-process test client (`app.request()`), contract-test runner, in-process typed client, and Hey API codegen via `pnpm gen`.
+- In-process test client (`app.request()`), contract-test runner (gated in CI via `daloy inspect --check` and shipped as a default test in every `create-daloy` template), in-process typed client, and Hey API codegen via `pnpm gen`.
 
 ### Runtimes and deployment
 

package/dist/app.d.ts

@@ -784,6 +784,14 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      * dashboards see the misconfiguration without flooding on every retry.
      */
     private trustProxyWarned;
+    /**
+     * One-shot guard for the development-mode warning about `2xx` responses
+     * that declare no body schema (OWASP API3 output filtering is absent
+     * there). Flipped on the first {@link App.fetch} so all routes are
+     * registered by the time the scan runs, and so the scan never repeats on
+     * the hot path.
+     */
+    private responseBodySchemaAuditDone;
     /**
     * Cached merge of `options.hooks` only. Used on the cold 404/405 path
     * and as the baseline for cross-origin guard decisions when no route
@@ -1324,6 +1332,15 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      *
      * @returns Array of one {@link IntrospectedRoute} per registered route.
      */
+    /**
+     * Emit a one-time development warning when any route declares a `2xx`
+     * response without a body schema, because response-field stripping
+     * (OWASP API3) does not run for those responses — a handler returning
+     * undeclared fields would leak them. Silent in production (operators run
+     * `daloy doctor` in CI for the same finding) and when
+     * `secureDefaults: false`. See {@link findRoutesMissingResponseBodySchema}.
+     */
+    private warnMissingResponseBodySchemas;
     introspect(): IntrospectedRoute[];
     /**
      * Begin graceful shutdown.
@@ -1369,6 +1386,32 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
  * @internal
  */
 export declare function topoSortExtensions(exts: ReadonlyArray<PluginExtension>): PluginExtension[];
+/**
+ * Identify registered routes whose successful (`2xx`, excluding the
+ * body-less `204`/`205`) responses declare no `body` schema.
+ *
+ * Response-body validation — and the OWASP API3 ("Broken Object Property
+ * Level Authorization") output filtering that strips fields a handler
+ * returns but the contract does not declare — only runs when a response
+ * `body` schema is present. A `2xx` response without one therefore ships
+ * whatever the handler returns verbatim: a stray `passwordHash` or a
+ * spread ORM row would leak. This helper surfaces those routes so the gap
+ * is visible rather than silent.
+ *
+ * It powers both the `daloy doctor` `audit.response.bodySchema` finding and
+ * the development-mode boot warning emitted on the first request. The result
+ * is advisory — a route may legitimately return no body — so callers treat
+ * it as a `warn`, never a hard error.
+ *
+ * @param routes - Route definitions to inspect (typically `app.routes`).
+ * @returns One entry per offending route with the affected `2xx` status codes.
+ * @since 0.40.0
+ */
+export declare function findRoutesMissingResponseBodySchema(routes: readonly Pick<RouteDefinition<any, any, any, any>, "method" | "path" | "responses">[]): Array<{
+    method: string;
+    path: string;
+    statuses: number[];
+}>;
 /**
  * Factory alias for `new App(options)`. Lets callers who prefer a
  * functional style (or who avoid `new`) write:

package/dist/app.js

@@ -267,6 +267,14 @@ export class App {
      * dashboards see the misconfiguration without flooding on every retry.
      */
     trustProxyWarned = false;
+    /**
+     * One-shot guard for the development-mode warning about `2xx` responses
+     * that declare no body schema (OWASP API3 output filtering is absent
+     * there). Flipped on the first {@link App.fetch} so all routes are
+     * registered by the time the scan runs, and so the scan never repeats on
+     * the hot path.
+     */
+    responseBodySchemaAuditDone = false;
     /**
     * Cached merge of `options.hooks` only. Used on the cold 404/405 path
     * and as the baseline for cross-origin guard decisions when no route
@@ -1772,6 +1780,10 @@ export class App {
      *   to RFC 9457 `application/problem+json` automatically.
      */
     fetch = async (request) => {
+        if (!this.responseBodySchemaAuditDone) {
+            this.responseBodySchemaAuditDone = true;
+            this.warnMissingResponseBodySchemas();
+        }
         const response = await this.dispatch(request);
         // In-flight responses that finish during draining advertise
         // `Connection: close` so HTTP/1.1 load balancers stop re-using the
@@ -1915,6 +1927,9 @@ export class App {
                         body: undefined,
                         state: { ...this.decorations, requestId, log },
                         set: { headers: new Headers() },
+                        // Cast through `unknown`: this is a deliberately minimal bootstrap
+                        // context for the cold 404 path (no user state populated yet), so
+                        // it must compile even when a consumer augments `AppState`.
                     };
                     ctx.set.headers.set("x-request-id", requestId);
                 }
@@ -1922,6 +1937,8 @@ export class App {
                     if (method === "OPTIONS") {
                         // Synthesize a preflight: let global hooks (e.g. CORS) intercept;
                         // otherwise return 204 with Allow header.
+                        // Cast through `unknown` so the synthetic preflight context still
+                        // compiles when a consumer augments `AppState` (no user state here).
                         const synthCtx = {
                             request,
                             params: {},
@@ -2127,6 +2144,31 @@ export class App {
      *
      * @returns Array of one {@link IntrospectedRoute} per registered route.
      */
+    /**
+     * Emit a one-time development warning when any route declares a `2xx`
+     * response without a body schema, because response-field stripping
+     * (OWASP API3) does not run for those responses — a handler returning
+     * undeclared fields would leak them. Silent in production (operators run
+     * `daloy doctor` in CI for the same finding) and when
+     * `secureDefaults: false`. See {@link findRoutesMissingResponseBodySchema}.
+     */
+    warnMissingResponseBodySchemas() {
+        if (this.isProduction())
+            return;
+        if (this.options.secureDefaults === false)
+            return;
+        const offending = findRoutesMissingResponseBodySchema(this.routes);
+        if (offending.length === 0)
+            return;
+        this.log.warn({
+            event: "security.response.bodySchemaMissing",
+            count: offending.length,
+            routes: offending.slice(0, 20),
+        }, `${offending.length} route(s) declare a 2xx response with no body schema; ` +
+            "response field-level stripping (OWASP API3) is not applied there, so a handler that " +
+            "returns undeclared fields will leak them. Declare a response body schema, or ignore if " +
+            "the route intentionally returns no body. Run `daloy doctor` to list them.");
+    }
     introspect() {
         return this.routes.map((r) => {
             const route = {
@@ -2628,6 +2670,51 @@ function copyContextHeaders(ctx, res) {
 function hasRequestSchema(request, key) {
     return !!request && !!request[key];
 }
+/**
+ * Identify registered routes whose successful (`2xx`, excluding the
+ * body-less `204`/`205`) responses declare no `body` schema.
+ *
+ * Response-body validation — and the OWASP API3 ("Broken Object Property
+ * Level Authorization") output filtering that strips fields a handler
+ * returns but the contract does not declare — only runs when a response
+ * `body` schema is present. A `2xx` response without one therefore ships
+ * whatever the handler returns verbatim: a stray `passwordHash` or a
+ * spread ORM row would leak. This helper surfaces those routes so the gap
+ * is visible rather than silent.
+ *
+ * It powers both the `daloy doctor` `audit.response.bodySchema` finding and
+ * the development-mode boot warning emitted on the first request. The result
+ * is advisory — a route may legitimately return no body — so callers treat
+ * it as a `warn`, never a hard error.
+ *
+ * @param routes - Route definitions to inspect (typically `app.routes`).
+ * @returns One entry per offending route with the affected `2xx` status codes.
+ * @since 0.40.0
+ */
+export function findRoutesMissingResponseBodySchema(routes) {
+    const offending = [];
+    for (const route of routes) {
+        const statuses = [];
+        const responses = route.responses;
+        for (const key of Object.keys(responses)) {
+            const status = Number(key);
+            // Only successful responses can carry an over-exposing body, and 204/205
+            // are body-less by HTTP semantics so they are never flagged.
+            if (!Number.isInteger(status) || status < 200 || status > 299)
+                continue;
+            if (status === 204 || status === 205)
+                continue;
+            const spec = responses[status];
+            if (spec && spec.body === undefined)
+                statuses.push(status);
+        }
+        if (statuses.length > 0) {
+            statuses.sort((a, b) => a - b);
+            offending.push({ method: route.method, path: route.path, statuses });
+        }
+    }
+    return offending;
+}
 /**
  * Stable-shape per-request context. All fields are initialised in fixed
  * order in the constructor so every dispatched request produces an instance
@@ -2868,7 +2955,16 @@ function serializeResult(result, def, validateResponses) {
     if (!spec) {
         throw new InternalError(`Handler returned status ${result.status} which is not declared in responses for ${def.method} ${def.path}`);
     }
-    const finish = () => {
+    // `outputBody` is the value actually serialized onto the wire. It defaults
+    // to the raw handler return, but when response-body validation runs it is
+    // replaced with the validator's parsed `value` (e.g. a Zod object with
+    // unknown keys stripped). This closes the OWASP API3 "excessive data
+    // exposure" hole: a handler that returns extra fields not declared in the
+    // response schema must not leak them — only declared fields are emitted,
+    // exactly as the OpenAPI contract and the security docs promise. Schemas
+    // that opt into pass-through (e.g. Zod `.passthrough()`) keep their extra
+    // keys because the validator itself returns them in `value`.
+    const finish = (outputBody) => {
         const headers = new Headers(result.headers);
         const explicitCt = headers.get("content-type");
         const treatAsJson = !explicitCt || explicitCt.includes("application/json");
@@ -2887,31 +2983,31 @@ function serializeResult(result, def, validateResponses) {
         let body;
         let rawBody = null;
         let isStream = false;
-        if (result.body === undefined || result.body === null) {
+        if (outputBody === undefined || outputBody === null) {
             body = null;
         }
-        else if (!treatAsJson && typeof result.body === "string") {
-            const bytes = TEXT_ENCODER.encode(result.body);
+        else if (!treatAsJson && typeof outputBody === "string") {
+            const bytes = TEXT_ENCODER.encode(outputBody);
             setContentLength(headers, bytes.byteLength);
             body = bytes;
             rawBody = bytes;
         }
-        else if (!treatAsJson && result.body instanceof Uint8Array) {
-            setContentLength(headers, result.body.byteLength);
-            body = result.body;
-            rawBody = result.body;
+        else if (!treatAsJson && outputBody instanceof Uint8Array) {
+            setContentLength(headers, outputBody.byteLength);
+            body = outputBody;
+            rawBody = outputBody;
         }
-        else if (!treatAsJson && result.body instanceof ArrayBuffer) {
-            setContentLength(headers, result.body.byteLength);
-            body = result.body;
-            rawBody = new Uint8Array(result.body);
+        else if (!treatAsJson && outputBody instanceof ArrayBuffer) {
+            setContentLength(headers, outputBody.byteLength);
+            body = outputBody;
+            rawBody = new Uint8Array(outputBody);
         }
-        else if (!treatAsJson && result.body instanceof ReadableStream) {
-            body = result.body;
+        else if (!treatAsJson && outputBody instanceof ReadableStream) {
+            body = outputBody;
             isStream = true;
         }
         else {
-            const bytes = TEXT_ENCODER.encode(JSON.stringify(result.body));
+            const bytes = TEXT_ENCODER.encode(JSON.stringify(outputBody));
             setContentLength(headers, bytes.byteLength);
             body = bytes;
             rawBody = bytes;
@@ -2935,7 +3031,9 @@ function serializeResult(result, def, validateResponses) {
                         .map((i) => i.message)
                         .join("; ")}`);
                 }
-                return finish();
+                // Serialize the validated (and, for object schemas, key-stripped)
+                // value so undeclared fields never reach the client.
+                return finish(resolved.value);
             });
         }
         else {
@@ -2944,9 +3042,10 @@ function serializeResult(result, def, validateResponses) {
                     .map((i) => i.message)
                     .join("; ")}`);
             }
+            return finish(r.value);
         }
     }
-    return finish();
+    return finish(result.body);
 }
 function setContentLength(headers, byteLength) {
     if (!headers.has("content-length"))

package/dist/cli.js

@@ -9,6 +9,7 @@
  * a child process. The thin shim in `bin/daloy.mjs` wires this up to
  * `process.argv`, `process.stdout`, dynamic `import()`, and `process.exit`.
  */
+import { findRoutesMissingResponseBodySchema } from "./app.js";
 import { runContractTests } from "./contract.js";
 import { diffOpenAPI } from "./openapi-diff.js";
 import { generateOpenAPI, openapiToYAML } from "./openapi.js";
@@ -726,6 +727,27 @@ async function runDoctor(opts, io) {
                     "Disable or gate behind authenticated routes.",
             });
         }
+        // Response-body-schema coverage audit (OWASP API3 — Broken Object
+        // Property Level Authorization). Response-field stripping only runs when
+        // a 2xx response declares a body schema; a schema-less 2xx ships whatever
+        // the handler returns, so a stray `passwordHash` or spread ORM row would
+        // leak. Advisory (warn) because a route may legitimately return no body.
+        const routes = app.routes ?? [];
+        const missingBody = findRoutesMissingResponseBodySchema(routes);
+        if (missingBody.length > 0) {
+            const sample = missingBody
+                .slice(0, 5)
+                .map((r) => `${r.method} ${r.path} (${r.statuses.join("/")})`)
+                .join(", ");
+            findings.push({
+                level: "warn",
+                code: "audit.response.bodySchema",
+                message: `${missingBody.length} route(s) declare a 2xx response with no body schema, so ` +
+                    `response field-level stripping (OWASP API3) is not applied: ${sample}` +
+                    `${missingBody.length > 5 ? ", …" : ""}. Declare a response body schema so undeclared ` +
+                    "handler fields cannot leak, or ignore if the route intentionally returns no body.",
+            });
+        }
     }
     if (opts.auditSecrets === true) {
         const env = globalThis.process?.env ?? {};

package/dist/idempotency.d.ts

@@ -31,7 +31,7 @@
  * @module
  * @since 0.37.0
  */
-import type { Hooks } from "./types.js";
+import type { BaseContext, Hooks } from "./types.js";
 /**
  * Test-only helper that clears the process-wide shared stores used by
  * `idempotency({ groupId })`. Not part of the documented public API.
@@ -149,6 +149,24 @@ export interface IdempotencyOptions {
      * store; supply an explicit `store` to coordinate across processes.
      */
     groupId?: string;
+    /**
+     * Namespace idempotency keys by the calling principal so one client can
+     * never replay another client's stored response by reusing the same key
+     * (CWE-524 — cross-tenant cached-response disclosure). The returned string
+     * is mixed into the store key, so two principals using the *same*
+     * `Idempotency-Key` get independent reservations.
+     *
+     * Defaults to the request's `Authorization` header value, which scopes the
+     * common bearer- / API-key-authenticated case (Stripe-style idempotency)
+     * out of the box. Override it when identity lives elsewhere, e.g.
+     * `scope: (ctx) => ctx.state.session?.id` for cookie-based sessions, or
+     * return `undefined` to opt a request out of scoping (e.g. truly public,
+     * unauthenticated idempotent writes). Returning a stable per-user id is
+     * preferable to the raw credential when tokens rotate between retries.
+     *
+     * @since 0.40.0
+     */
+    scope?: (ctx: BaseContext<any, any>) => string | undefined | Promise<string | undefined>;
 }
 /**
  * In-memory {@link IdempotencyStore}. Suitable for tests and single-process
@@ -157,10 +175,14 @@ export interface IdempotencyOptions {
  */
 export declare class MemoryIdempotencyStore implements IdempotencyStore {
     private readonly map;
+    /**
+     * @inheritDoc
+     * `_ttlMs` is part of the {@link IdempotencyStore} contract but unused here:
+     * the in-memory store derives expiry from `record.expiresAt`.
+     */
+    reserve(key: string, record: IdempotencyRecord, _ttlMs?: number): IdempotencyRecord | null;
     /** @inheritDoc */
-    reserve(key: string, record: IdempotencyRecord): IdempotencyRecord | null;
-    /** @inheritDoc */
-    complete(key: string, record: IdempotencyRecord): void;
+    complete(key: string, record: IdempotencyRecord, _ttlMs?: number): void;
     /** @inheritDoc */
     release(key: string): void;
     private read;

package/dist/idempotency.js

@@ -61,8 +61,12 @@ export function _resetSharedIdempotencyStoresForTests() {
  */
 export class MemoryIdempotencyStore {
     map = new Map();
-    /** @inheritDoc */
-    reserve(key, record) {
+    /**
+     * @inheritDoc
+     * `_ttlMs` is part of the {@link IdempotencyStore} contract but unused here:
+     * the in-memory store derives expiry from `record.expiresAt`.
+     */
+    reserve(key, record, _ttlMs) {
         const existing = this.read(key);
         if (existing)
             return existing;
@@ -72,7 +76,7 @@ export class MemoryIdempotencyStore {
         return null;
     }
     /** @inheritDoc */
-    complete(key, record) {
+    complete(key, record, _ttlMs) {
         this.map.set(key, record);
     }
     /** @inheritDoc */
@@ -154,7 +158,16 @@ function stableStringify(value) {
 async function computeFingerprint(method, ctx) {
     const url = new URL(ctx.request.url);
     const material = `${method}\n${url.pathname}${url.search}\n${stableStringify(ctx.body)}`;
-    const digest = new Uint8Array(await getSubtle().digest("SHA-256", enc.encode(material)));
+    return sha256Hex(material);
+}
+/**
+ * SHA-256 hex of an arbitrary string. Used to fingerprint requests and to
+ * derive a fixed-length, delimiter-safe tag for the caller-scope namespace so
+ * a long or attacker-controlled `Authorization` value cannot inject into or
+ * bloat the store key.
+ */
+async function sha256Hex(input) {
+    const digest = new Uint8Array(await getSubtle().digest("SHA-256", enc.encode(input)));
     return bytesToHex(digest);
 }
 // Printable ASCII only (no control chars / whitespace). Anchored + bounded to
@@ -271,7 +284,14 @@ export function idempotency(opts = {}) {
             const key = rawKey.trim();
             validateKey(key, headerName, maxKeyLength);
             const fingerprint = await computeFingerprint(method, ctx);
-            const storeKey = `${keyPrefix}${key}`;
+            // Namespace the key by the calling principal so client B can never
+            // replay client A's stored response by reusing the same Idempotency-Key
+            // (CWE-524). Defaults to the Authorization header; `scope` overrides.
+            const scopeRaw = opts.scope
+                ? await opts.scope(ctx)
+                : (ctx.request.headers.get("authorization") ?? undefined);
+            const scopeTag = scopeRaw ? `${await sha256Hex(scopeRaw)}:` : "";
+            const storeKey = `${keyPrefix}${scopeTag}${key}`;
             const now = Date.now();
             const record = {
                 fingerprint,

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export { App } from "./app.js";
 export { createApp } from "./app.js";
+export { findRoutesMissingResponseBodySchema } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
 export { _resetCrashHandlersForTests } from "./app.js";
 export { _resetInsecureDefaultsLogForTests } from "./app.js";

package/dist/index.js

@@ -1,5 +1,6 @@
 export { App } from "./app.js";
 export { createApp } from "./app.js";
+export { findRoutesMissingResponseBodySchema } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
 export { _resetCrashHandlersForTests } from "./app.js";
 export { _resetInsecureDefaultsLogForTests } from "./app.js";

package/dist/response-cache.d.ts

@@ -141,6 +141,26 @@ export interface ResponseCacheOptions {
      * store.
      */
     groupId?: string;
+    /**
+     * Whether to cache responses to requests that carry an `Authorization`
+     * header. Default: `false`.
+     *
+     * A shared response cache keyed on method + URL (the default) does not
+     * include the credential, so caching an authenticated response would serve
+     * one user's private data to the next user requesting the same URL
+     * (CWE-524 — cross-tenant cached-response disclosure). For that reason, and
+     * per RFC 9111 §3.5 (a shared cache MUST NOT reuse a response to an
+     * `Authorization`-bearing request unless explicitly permitted), such
+     * requests bypass the cache entirely by default.
+     *
+     * Set this to `true` only when the response is genuinely shareable across
+     * principals (e.g. public reference data served behind a bearer gate) — and
+     * then also add the credential to {@link varyHeaders} or a custom
+     * {@link keyGenerator} so distinct callers cannot collide.
+     *
+     * @since 0.40.0
+     */
+    cacheAuthenticatedRequests?: boolean;
 }
 /**
  * In-memory {@link ResponseCacheStore}. Suitable for tests and single-process
@@ -151,8 +171,12 @@ export declare class MemoryResponseCacheStore implements ResponseCacheStore {
     private readonly map;
     /** @inheritDoc */
     get(key: string): CachedResponse | null;
-    /** @inheritDoc */
-    set(key: string, entry: CachedResponse): void;
+    /**
+     * @inheritDoc
+     * `_ttlMs` is part of the {@link ResponseCacheStore} contract but unused
+     * here: the in-memory store derives freshness from `entry.freshUntil`.
+     */
+    set(key: string, entry: CachedResponse, _ttlMs?: number): void;
     /** @inheritDoc */
     delete(key: string): void;
     private prune;

package/dist/response-cache.js

@@ -76,8 +76,12 @@ export class MemoryResponseCacheStore {
         }
         return entry;
     }
-    /** @inheritDoc */
-    set(key, entry) {
+    /**
+     * @inheritDoc
+     * `_ttlMs` is part of the {@link ResponseCacheStore} contract but unused
+     * here: the in-memory store derives freshness from `entry.freshUntil`.
+     */
+    set(key, entry, _ttlMs) {
         this.map.set(key, entry);
         if (this.map.size > 10_000)
             this.prune();
@@ -245,6 +249,7 @@ export function responseCache(opts = {}) {
         throw new Error("responseCache(): maxBodyBytes must be a positive integer.");
     }
     const methods = new Set((opts.methods ?? ["GET", "HEAD"]).map((m) => m.toUpperCase()));
+    const cacheAuthenticatedRequests = opts.cacheAuthenticatedRequests === true;
     const cacheableStatus = opts.cacheableStatus ?? ((status) => status === 200);
     const varyHeaders = (opts.varyHeaders ?? []).map((h) => h.toLowerCase());
     const statusHeaderName = opts.statusHeaderName === null ? null : (opts.statusHeaderName ?? "x-cache").toLowerCase();
@@ -289,6 +294,13 @@ export function responseCache(opts = {}) {
             const method = ctx.request.method.toUpperCase();
             if (!methods.has(method))
                 return undefined;
+            // RFC 9111 §3.5 / CWE-524: a shared cache keyed on method+URL must not
+            // store or reuse a response to an Authorization-bearing request, or it
+            // would serve one principal's private data to the next caller. Opt in
+            // via `cacheAuthenticatedRequests` for genuinely shareable content.
+            if (!cacheAuthenticatedRequests && ctx.request.headers.has("authorization")) {
+                return undefined;
+            }
             const reqCc = parseCacheControl(ctx.request.headers.get("cache-control"));
             if (reqCc.has("no-store"))
                 return undefined;

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:deb5f2f9-6f46-5dd8-9ab5-2c301ddf6df0",
+  "serialNumber": "urn:uuid:b6ab6390-9d08-59eb-80b2-e39452c91f11",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-17T18:06:01.531Z",
+    "timestamp": "2026-06-18T16:40:32.542Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "0.39.0"
+        "version": "0.41.0"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@0.39.0",
+      "bom-ref": "pkg:npm/@daloyjs/core@0.41.0",
       "name": "@daloyjs/core",
-      "version": "0.39.0",
+      "version": "0.41.0",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@0.39.0",
+      "purl": "pkg:npm/@daloyjs/core@0.41.0",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-0.39.0",
+        "tagId": "swidtag--daloyjs-core-0.41.0",
         "name": "@daloyjs/core",
-        "version": "0.39.0",
+        "version": "0.41.0",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@0.39.0",
+      "ref": "pkg:npm/@daloyjs/core@0.41.0",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-0.39.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.39.0-deb5f2f9-6f46-5dd8-9ab5-2c301ddf6df0",
+  "name": "@daloyjs/core-0.41.0",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-0.41.0-b6ab6390-9d08-59eb-80b2-e39452c91f11",
   "creationInfo": {
-    "created": "2026-06-17T18:06:01.531Z",
+    "created": "2026-06-18T16:40:32.542Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "0.39.0",
+      "versionInfo": "0.41.0",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@0.39.0"
+          "referenceLocator": "pkg:npm/@daloyjs/core@0.41.0"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -241,9 +241,11 @@
     "example": "node --import tsx examples/basic.ts",
     "bench": "node --import tsx bench/router.bench.ts",
     "test": "node --import tsx --test tests/**/*.test.ts",
+    "test:red-team": "node --import tsx --test tests/red-team-attacks.test.ts tests/red-team-attacks-2.test.ts tests/red-team-attacks-3.test.ts tests/red-team-attacks-4.test.ts tests/red-team-attacks-5.test.ts tests/red-team-attacks-6.test.ts tests/red-team-attacks-7.test.ts",
     "coverage": "node --import tsx --test --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-lines=90 --test-coverage-functions=90 tests/**/*.test.ts",
     "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include='dist-coverage/src/**' --test-coverage-branches=92 dist-coverage/tests/**/*.test.js",
-    "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json && tsc -p tests/tsconfig.json --noEmit",
+    "typecheck:tests": "tsc -p tests/tsconfig.json --noEmit",
     "format": "prettier --write .",
     "gen:openapi": "node --import tsx scripts/dump-openapi.ts",
     "gen:client": "openapi-ts",