@daloyjs/core 1.0.0-beta.0 → 1.0.0-beta.1

package/README.md

@@ -498,7 +498,7 @@ The core only ever sees `Request → Response`. Adapters live at the edge.
 
 ## Status
 
-DaloyJS is now in the **`1.0.0` beta** (`1.0.0-beta.0`). The public API is feature-complete and stable for the 1.0 line; from `1.0.0` onward, breaking changes follow SemVer and deprecations get at least one minor cycle. Small adjustments are still possible before the `1.0.0` GA if beta feedback surfaces something. The framework is already in use for production trials.
+DaloyJS is now in the **`1.0.0` beta** (`1.0.0-beta.1`). The public API is feature-complete and stable for the 1.0 line; from `1.0.0` onward, breaking changes follow SemVer and deprecations get at least one minor cycle. Small adjustments are still possible before the `1.0.0` GA if beta feedback surfaces something. The framework is already in use for production trials.
 
 **Release quality bar.** Every release ships with **≥90% line + function coverage and ≥90% branch coverage**, strict TypeScript, OpenSSF Scorecard, CodeQL + Opengrep dual SAST, zizmor workflow linting, and npm provenance. Coverage was relaxed from a former 100% gate so complex security work isn't blocked chasing throwaway tests for unreachable defensive branches or tsx source-map phantoms; see [AGENTS.md](AGENTS.md) for the policy.
 

package/dist/adapters/node.js

@@ -37,6 +37,15 @@ export function serve(app, opts = {}) {
             dispatchToApp(app, req, res, trustProxy, undefined);
             return;
         }
+        // Refuse Fetch-forbidden methods (CONNECT/TRACE/TRACK) before building a
+        // `Request` — `new Request` throws a `TypeError` for them, which would
+        // otherwise be caught and reported as a generic 500 instead of a clean,
+        // intentional method refusal. Placed after the GET/HEAD fast path so the
+        // hot path never pays for this check.
+        if (FETCH_FORBIDDEN_METHODS.has(method.toUpperCase())) {
+            writeMethodRefused(res);
+            return;
+        }
         // POST/PUT/PATCH/DELETE with a small known content-length: pre-buffer
         // bytes from the Node socket directly so the Request constructor gets a
         // Uint8Array body instead of `Readable.toWeb(req)`. This skips the
@@ -223,6 +232,45 @@ function attachClientCertificate(req, request) {
         return normalizePeerCertificate(raw, sock.authorized === true);
     });
 }
+/**
+ * Methods the WHATWG Fetch standard forbids on a `Request` (`CONNECT`,
+ * `TRACE`, `TRACK`). `new Request(url, { method })` throws a `TypeError` for
+ * these, so the Node adapter refuses them *before* constructing a `Request` —
+ * otherwise that `TypeError` surfaces as a generic `500` instead of a
+ * deliberate method refusal. Refusing `TRACE`/`TRACK` also closes Cross-Site
+ * Tracing, and `CONNECT` has no meaning for an origin server, so a categorical
+ * refusal is the correct secure default. (`CONNECT` is normally routed to
+ * Node's `connect` event rather than the request listener; it is included here
+ * defensively for runtimes/proxies that surface it as a normal request.)
+ */
+const FETCH_FORBIDDEN_METHODS = new Set([
+    "CONNECT",
+    "TRACE",
+    "TRACK",
+]);
+/**
+ * Refuse a Fetch-forbidden HTTP method with a spec-correct `501 Not
+ * Implemented`. `501` is more accurate than `405` here because the method is
+ * unsupported for *every* resource (not just the matched route), and unlike
+ * `405` it does not require an `Allow` header the adapter cannot compute before
+ * routing. Mirrors {@link writeAdapterError}'s RFC 9457 problem+json shape;
+ * `Connection: close` avoids reusing a socket whose (illegal) request body was
+ * never drained.
+ *
+ * @param res - The Node {@link ServerResponse} to write the refusal to.
+ */
+function writeMethodRefused(res) {
+    if (res.headersSent)
+        return;
+    res.statusCode = 501;
+    res.setHeader("content-type", "application/problem+json");
+    res.setHeader("connection", "close");
+    res.end(JSON.stringify({
+        type: "https://daloyjs.dev/errors/not-implemented",
+        title: "Not Implemented",
+        status: 501,
+    }));
+}
 function writeAdapterError(res, e) {
     if (!res.headersSent) {
         res.statusCode = 500;

package/dist/app.d.ts

@@ -13,6 +13,8 @@ import { type BehindProxyConfig } from "./conn-info.js";
 export declare function _resetCrashHandlersForTests(): void;
 /** @internal Test-only helper to reset the latch between tests. */
 export declare function _resetInsecureDefaultsLogForTests(): void;
+/** @internal Test-only helper to reset the indeterminate-env warning latch. */
+export declare function _resetIndeterminateEnvWarningForTests(): void;
 /**
  * Named security posture preset. Currently only one value is supported:
  *
@@ -992,6 +994,32 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      * a misconfigured surface.
      */
     private assertSecureHookConfig;
+    /**
+     * Whether the resolved runtime environment is indeterminate: no explicit
+     * {@link AppOptions.env} / {@link AppOptions.production} was provided AND
+     * `process.env.NODE_ENV` is unset or empty. This is the common default on
+     * edge runtimes (Cloudflare Workers, Deno Deploy, Vercel Edge), which have no
+     * `NODE_ENV`. Deliberately does not sniff the runtime — it only reports
+     * whether the environment signal is absent — so it stays runtime-portable.
+     *
+     * @returns `true` when neither an explicit option nor `NODE_ENV` resolves the
+     * environment; `false` otherwise (including when `NODE_ENV` is `development` /
+     * `test`, which is a known, non-production answer).
+     */
+    private isEnvIndeterminate;
+    /**
+     * Emit a single once-per-process warning when a production-only secure-default
+     * refusal (wildcard CORS origin, weak session secret) would not fire purely
+     * because the environment is indeterminate (see {@link isEnvIndeterminate}).
+     * Routed through the logger, so `logger: false` silences it. Only warns when a
+     * risky config is actually present, so a clean app stays quiet. Changes no
+     * enforcement; pure observability for the documented "set `env` on edge"
+     * requirement.
+     *
+     * @param record - The hook object, carrying the wildcard-CORS / session
+     * markers used by {@link assertSecureHookConfig}.
+     */
+    private warnIndeterminateEnvSecurity;
     private assertRouteAuthPayloadConfig;
     private resetBootGuardCache;
     /**

package/dist/app.js

@@ -43,6 +43,18 @@ let insecureDefaultsLoggedThisProcess = false;
 export function _resetInsecureDefaultsLogForTests() {
     insecureDefaultsLoggedThisProcess = false;
 }
+/**
+ * Once-per-process latch for the "production-only secure-default guard skipped
+ * because the runtime environment is indeterminate" warning (see
+ * {@link App.warnIndeterminateEnvSecurity}). Mirrors
+ * {@link insecureDefaultsLoggedThisProcess}: one heads-up per process, not one
+ * per `App` / per `.use()` call.
+ */
+let indeterminateEnvSecurityWarnedThisProcess = false;
+/** @internal Test-only helper to reset the indeterminate-env warning latch. */
+export function _resetIndeterminateEnvWarningForTests() {
+    indeterminateEnvSecurityWarnedThisProcess = false;
+}
 /**
  * The exact set of fields the `"internal-service"` preset flips off when
  * the caller has not set them explicitly. Surfaced through the boot
@@ -613,9 +625,22 @@ export class App {
     assertSecureHookConfig(hooks) {
         if (this.options.secureDefaults === false)
             return;
-        if (!this.isProduction())
-            return;
         const record = hooks;
+        if (!this.isProduction()) {
+            // The refusals below are production-only. When the environment is
+            // *indeterminate* (no explicit `env` / `production` option and no
+            // `NODE_ENV` — the common default on edge runtimes such as Workers /
+            // Deno Deploy / Vercel Edge), those refusals never fire, so a risky
+            // config could ship unguarded. Surface that once as a warning when such
+            // a config is actually present. Enforcement is unchanged — this only
+            // makes the silent skip observable. The runtime itself is deliberately
+            // NOT sniffed (that would couple the core to specific platforms and
+            // break runtime portability); we key only on "is the env signal absent?".
+            if (this.isEnvIndeterminate()) {
+                this.warnIndeterminateEnvSecurity(record);
+            }
+            return;
+        }
         if (record[CORS_WILDCARD_ORIGIN_MARKER] === true) {
             throw new Error('cors({ origin: "*" }) refused in production: a wildcard CORS origin exposes every state-changing route cross-origin. ' +
                 "Replace the wildcard with an explicit allowlist (string[] or predicate), or pass " +
@@ -630,6 +655,70 @@ export class App {
             }
         }
     }
+    /**
+     * Whether the resolved runtime environment is indeterminate: no explicit
+     * {@link AppOptions.env} / {@link AppOptions.production} was provided AND
+     * `process.env.NODE_ENV` is unset or empty. This is the common default on
+     * edge runtimes (Cloudflare Workers, Deno Deploy, Vercel Edge), which have no
+     * `NODE_ENV`. Deliberately does not sniff the runtime — it only reports
+     * whether the environment signal is absent — so it stays runtime-portable.
+     *
+     * @returns `true` when neither an explicit option nor `NODE_ENV` resolves the
+     * environment; `false` otherwise (including when `NODE_ENV` is `development` /
+     * `test`, which is a known, non-production answer).
+     */
+    isEnvIndeterminate() {
+        if (this.options.env !== undefined ||
+            this.options.production !== undefined) {
+            return false;
+        }
+        const nodeEnv = typeof process !== "undefined" && typeof process.env !== "undefined"
+            ? process.env.NODE_ENV
+            : undefined;
+        return nodeEnv === undefined || nodeEnv === "";
+    }
+    /**
+     * Emit a single once-per-process warning when a production-only secure-default
+     * refusal (wildcard CORS origin, weak session secret) would not fire purely
+     * because the environment is indeterminate (see {@link isEnvIndeterminate}).
+     * Routed through the logger, so `logger: false` silences it. Only warns when a
+     * risky config is actually present, so a clean app stays quiet. Changes no
+     * enforcement; pure observability for the documented "set `env` on edge"
+     * requirement.
+     *
+     * @param record - The hook object, carrying the wildcard-CORS / session
+     * markers used by {@link assertSecureHookConfig}.
+     */
+    warnIndeterminateEnvSecurity(record) {
+        if (indeterminateEnvSecurityWarnedThisProcess)
+            return;
+        const risky = [];
+        if (record[CORS_WILDCARD_ORIGIN_MARKER] === true) {
+            risky.push('cors({ origin: "*" })');
+        }
+        if (record[SESSION_HOOK_MARKER] === true) {
+            const secrets = record[SESSION_SECRETS_MARKER];
+            if (Array.isArray(secrets)) {
+                const hasWeak = secrets.some((s) => {
+                    try {
+                        assertStrongSecret(s, "session");
+                        return false;
+                    }
+                    catch {
+                        return true;
+                    }
+                });
+                if (hasWeak)
+                    risky.push("a weak session secret");
+            }
+        }
+        if (risky.length === 0)
+            return;
+        indeterminateEnvSecurityWarnedThisProcess = true;
+        this.log.warn({ event: "secure_defaults.env_indeterminate", risky }, `DaloyJS: ${risky.join(" and ")} present, but the runtime environment is indeterminate ` +
+            `(no env option and no NODE_ENV). The production-only refuse-to-boot guard is therefore ` +
+            `inactive. If this is production (e.g. an edge runtime), set app({ env: "production" }).`);
+    }
     assertRouteAuthPayloadConfig(route) {
         const auth = route.auth;
         if (!auth || auth.payload !== false)
@@ -3034,12 +3123,27 @@ async function readBody(req, ct, limit, multipart) {
         return out;
     }
     if (ct.includes("multipart/form-data")) {
-        // Multipart: rely on platform parser, but enforce content-length first.
+        // Fast-fail on an honestly-declared oversize body.
         const cl = req.headers.get("content-length");
         if (cl && Number(cl) > limit) {
             throw new PayloadTooLargeError(limit);
         }
-        const fd = await req.formData();
+        // Then cap the ACTUAL bytes before handing them to the platform
+        // formData() parser. Content-Length is not a sufficient gate on its own: a
+        // chunked upload sends none, and a lying small value slips past the check —
+        // in both cases the platform parser would otherwise buffer the whole body
+        // in memory on runtimes whose adapter does not cap at the socket layer
+        // (Workers / Deno / Vercel Edge). `readBodyLimited` streams the body and
+        // throws `PayloadTooLargeError` the instant it exceeds `limit`; we then
+        // re-parse the bounded bytes with the standard `formData()` parser,
+        // preserving the multipart boundary via the original Content-Type. This is
+        // Web-standard only (`Request` + `formData`), so it stays runtime-portable.
+        const bytes = await readBodyLimited(req, limit);
+        const fd = await new Request(req.url, {
+            method: "POST",
+            headers: { "content-type": ct },
+            body: bytes,
+        }).formData();
         const out = {};
         let fields = 0;
         let files = 0;

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export { findRoutesMissingResponseBodySchema } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
 export { _resetCrashHandlersForTests } from "./app.js";
 export { _resetInsecureDefaultsLogForTests } from "./app.js";
+export { _resetIndeterminateEnvWarningForTests } from "./app.js";
 export type { AppOptions, AppOpenAPIOptions, DocsRouteOptions, AsyncAPIRouteOptions, HealthRouteOptions, CspReportRouteOptions, MetricsRouteOptions, IntrospectedRoute, PluginInstalledEvent, PluginExtension, ShutdownEvent, SecurityPreset, } from "./app.js";
 export { getConnInfo, setConnInfo, assertBehindProxy, resolveClientIp, readRemoteAddress, readRemotePort, pickForwardedForByHops, } from "./conn-info.js";
 export type { BehindProxyConfig, ConnInfo } from "./conn-info.js";

package/dist/index.js

@@ -4,6 +4,7 @@ export { findRoutesMissingResponseBodySchema } from "./app.js";
 export { _resetPackageJsonCacheForTests } from "./app.js";
 export { _resetCrashHandlersForTests } from "./app.js";
 export { _resetInsecureDefaultsLogForTests } from "./app.js";
+export { _resetIndeterminateEnvWarningForTests } from "./app.js";
 export { getConnInfo, setConnInfo, assertBehindProxy, resolveClientIp, readRemoteAddress, readRemotePort, pickForwardedForByHops, } from "./conn-info.js";
 export { subdomains, PSL_SNAPSHOT_DATE, PSL_PUBLIC_SUFFIXES, MAX_SNAPSHOT_AGE_DAYS, } from "./subdomains.js";
 export { defineDependency, DEPENDENCY_MARKER } from "./dependency.js";

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:24c97016-8019-52fa-bf46-65a4325559ec",
+  "serialNumber": "urn:uuid:3322791e-92a4-5b93-a136-5a15b3fe53aa",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-21T08:21:23.570Z",
+    "timestamp": "2026-06-21T13:50:39.481Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-beta.0"
+        "version": "1.0.0-beta.1"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-beta.0",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-beta.1",
       "name": "@daloyjs/core",
-      "version": "1.0.0-beta.0",
+      "version": "1.0.0-beta.1",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-beta.0",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-beta.1",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-beta.0",
+        "tagId": "swidtag--daloyjs-core-1.0.0-beta.1",
         "name": "@daloyjs/core",
-        "version": "1.0.0-beta.0",
+        "version": "1.0.0-beta.1",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-beta.0",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-beta.1",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-beta.0",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-beta.0-24c97016-8019-52fa-bf46-65a4325559ec",
+  "name": "@daloyjs/core-1.0.0-beta.1",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-beta.1-3322791e-92a4-5b93-a136-5a15b3fe53aa",
   "creationInfo": {
-    "created": "2026-06-21T08:21:23.570Z",
+    "created": "2026-06-21T13:50:39.481Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-beta.0",
+      "versionInfo": "1.0.0-beta.1",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-beta.0"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-beta.1"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-beta.0",
+  "version": "1.0.0-beta.1",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {