@daloyjs/core 1.0.0-beta.7 → 1.0.0-rc.1

package/dist/http-signatures.js

@@ -48,6 +48,14 @@ export const DEFAULT_SIGNATURE_CLOCK_SKEW_SECONDS = 60;
 const MAX_HEADER_LENGTH = 8192;
 /** Minimum byte length for a raw HMAC secret (RFC 7518 §3.2). */
 const MIN_HMAC_KEY_BYTES = 32;
+/**
+ * Minimum RSA modulus size accepted for `rsa-*` signature algorithms. NIST
+ * SP 800-131A has disallowed RSA keys shorter than 2048 bits since 2014; the
+ * JWT verifier ({@link file://./jwt.ts}) enforces the same floor, so the HTTP
+ * Message Signatures path holds the parity to keep undersized (crackable) RSA
+ * keys out of every signature-verification surface in the framework.
+ */
+const MIN_RSA_KEY_BITS = 2048;
 const ENC = new TextEncoder();
 // ---------------------------------------------------------------------------
 // WebCrypto + encoding helpers
@@ -132,11 +140,37 @@ function algSpec(alg) {
             };
     }
 }
+/**
+ * Refuse RSA keys whose modulus is shorter than {@link MIN_RSA_KEY_BITS}.
+ *
+ * Only applies to the `rsa-*` algorithms — non-RSA keys are ignored. Every RSA
+ * `CryptoKey` carries a numeric `algorithm.modulusLength`; when WebCrypto
+ * reports a length below the floor the key is refused for both signing and
+ * verification. Mirrors the JWT verifier's `assertRsaModulusFloor` so no
+ * signature surface in the framework accepts an undersized RSA key.
+ *
+ * @param alg - The HTTP signature algorithm the key will be used with.
+ * @param key - The imported (or caller-supplied) `CryptoKey`.
+ * @throws {TypeError} When `alg` is RSA and the modulus is under the floor.
+ */
+function assertRsaModulusFloor(alg, key) {
+    if (alg !== "rsa-pss-sha512" && alg !== "rsa-v1_5-sha256")
+        return;
+    const algorithm = key.algorithm;
+    const modulusLength = algorithm?.modulusLength;
+    if (typeof modulusLength !== "number" || !Number.isFinite(modulusLength))
+        return;
+    if (modulusLength < MIN_RSA_KEY_BITS) {
+        throw new TypeError(`http-signatures: ${alg} key modulus must be at least ${MIN_RSA_KEY_BITS} bits (NIST SP 800-131A); got ${modulusLength}.`);
+    }
+}
 async function importKey(alg, material, usage) {
     const spec = algSpec(alg);
     const c = getCrypto();
-    if (isCryptoKey(material))
+    if (isCryptoKey(material)) {
+        assertRsaModulusFloor(alg, material);
         return material;
+    }
     if (material instanceof Uint8Array) {
         if (!spec.symmetric) {
             throw new TypeError(`http-signatures: raw byte keys are only supported for hmac-sha256; got ${alg}.`);
@@ -147,9 +181,11 @@ async function importKey(alg, material, usage) {
         return c.subtle.importKey("raw", material, spec.importParams, false, [usage]);
     }
     if (isJsonWebKey(material)) {
-        return c.subtle.importKey("jwk", material, spec.importParams, false, [
+        const key = await c.subtle.importKey("jwk", material, spec.importParams, false, [
             usage,
         ]);
+        assertRsaModulusFloor(alg, key);
+        return key;
     }
     throw new TypeError("http-signatures: unsupported key material.");
 }
@@ -731,7 +767,7 @@ export function verifyRequest(request, opts) {
 export function httpSignatureAuth(opts) {
     const stateKey = opts.stateKey ?? "httpSignature";
     const message = opts.message ?? "Valid HTTP message signature required";
-    return {
+    const authHooks = {
         async beforeHandle(ctx) {
             const headers = ctx.request.headers;
             if (opts.optional && !headers.has("signature"))
@@ -744,6 +780,11 @@ export function httpSignatureAuth(opts) {
             return undefined;
         },
     };
+    // Same global symbol as middleware's AUTH_HOOK_MARKER (stamped inline to keep
+    // the middleware module out of this bundle): lets the route-auth boot guard
+    // recognize that a route declaring `auth:` is actually enforced here.
+    authHooks[Symbol.for("daloyjs.auth.hook")] = true;
+    return authHooks;
 }
 const CONTENT_DIGEST_HASH = {
     "sha-256": "SHA-256",

package/dist/index.d.ts

@@ -19,11 +19,11 @@ export type { StandardSchemaV1 } from "./schema.js";
 export { validate, isStandardSchema } from "./schema.js";
 export { diffOpenAPI, hasBreakingChanges } from "./openapi-diff.js";
 export type { ChangeSeverity, OpenAPIChange, OpenAPIDiffResult } from "./openapi-diff.js";
-export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, } from "./mcp.js";
-export type { McpContent, McpEmbeddedResourceContent, McpHandler, McpHandlerOptions, McpIcon, McpImageContent, McpJsonObject, McpJsonRpcId, McpJsonSchema, McpJsonValue, McpPrompt, McpPromptArgument, McpPromptDefinition, McpPromptMessage, McpPromptResult, McpRequestContext, McpResource, McpResourceContents, McpResourceDefinition, McpResourceTemplate, McpResourceTemplateDefinition, McpServerInfo, McpTextContent, McpTool, McpToolAnnotations, McpToolHandler, McpToolResult, } from "./mcp.js";
+export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, validateMcpInput, } from "./mcp.js";
+export type { McpContent, McpEmbeddedResourceContent, McpHandler, McpHandlerOptions, McpIcon, McpImageContent, McpJsonObject, McpJsonRpcId, McpJsonSchema, McpJsonValue, McpPrompt, McpPromptArgument, McpPromptDefinition, McpPromptMessage, McpPromptResult, McpRequestContext, McpResource, McpResourceContents, McpResourceDefinition, McpResourceTemplate, McpResourceTemplateDefinition, McpRoutesOptions, McpServerInfo, McpTextContent, McpTool, McpToolAnnotations, McpToolHandler, McpToolResult, } from "./mcp.js";
 export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertHeaderCountWithinLimit, DEFAULT_MAX_HEADER_COUNT, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, WEBHOOK_DEFAULT_TOLERANCE_SECONDS, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, sanitizeFilename, assertSafeRelativePath, hasMongoOperatorKeys, assertNoMongoOperators, } from "./security.js";
 export type { WebhookHmacAlgorithm } from "./security.js";
-export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
+export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, markAuthHook, AUTH_HOOK_MARKER, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
 export { etag } from "./etag.js";
 export type { ETagOptions } from "./etag.js";
 export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";

package/dist/index.js

@@ -11,9 +11,9 @@ export { defineDependency, DEPENDENCY_MARKER } from "./dependency.js";
 export { HttpError, BadRequestError, ValidationError, NotFoundError, ConflictError, UnauthorizedError, ForbiddenError, MethodNotAllowedError, PayloadTooLargeError, RequestHeaderFieldsTooLargeError, UnsupportedMediaTypeError, TooManyRequestsError, RequestTimeoutError, InternalError, MessageLeakError, httpError, SAFE_CUSTOM_ERROR_RESPONSE_HEADERS, checkCustomErrorResponseHeaders, } from "./errors.js";
 export { validate, isStandardSchema } from "./schema.js";
 export { diffOpenAPI, hasBreakingChanges } from "./openapi-diff.js";
-export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, } from "./mcp.js";
+export { MCP_DEFAULT_MAX_BODY_BYTES, MCP_PROTOCOL_VERSION, MCP_PROTOCOL_VERSIONS, McpToolError, createMcpHandler, mcpRoutes, validateMcpInput, } from "./mcp.js";
 export { readBodyLimited, safeJsonParse, isForbiddenObjectKey, sanitizeHeaderName, sanitizeHeaderValue, timingSafeEqual, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertHeaderCountWithinLimit, DEFAULT_MAX_HEADER_COUNT, RESERVED_INBOUND_HEADER_PREFIXES, SMUGGLING_SINGLETON_HEADERS, verifyWebhookSignature, signWebhookPayload, WEBHOOK_DEFAULT_TOLERANCE_SECONDS, assertStrongSecret, MIN_PROD_SECRET_BYTES, WEAK_SECRET_STRINGS, sanitizeFilename, assertSafeRelativePath, hasMongoOperatorKeys, assertNoMongoOperators, } from "./security.js";
-export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
+export { requestId, secureHeaders, SECURE_HEADERS_MARKER, cors, CORS_HOOK_MARKER, CORS_ORIGIN_ALLOW_MARKER, CORS_WILDCARD_ORIGIN_MARKER, rateLimit, loginThrottle, timing, bearerAuth, basicAuth, markAuthHook, AUTH_HOOK_MARKER, csrf, CSRF_HOOK_MARKER, fetchMetadata, requireScopes, REQUIRE_SCOPES_AGGREGATE_KEY, REQUIRE_SCOPES_HOOK_MARKER, _resetSharedRateLimitStoresForTests, } from "./middleware.js";
 export { etag } from "./etag.js";
 export { compression, COMPRESSION_HOOK_MARKER, _resetCompressionRuntimeProbeForTests, } from "./compression.js";
 export { createJwtSigner, createJwtVerifier, JwtError, DEFAULT_JWT_MAX_LIFETIME_SECONDS, } from "./jwt.js";

package/dist/ip-reputation.d.ts

@@ -160,8 +160,12 @@ export interface UrlFeedOptions {
     /** Feed name. Defaults to the URL. */
     name?: string;
     /**
-     * Custom `fetch` implementation. Defaults to the platform `fetch`. Provide an
-     * SSRF-guarded fetch or a non-standard-runtime client here.
+     * Custom `fetch` implementation. Defaults to an SSRF-hardened
+     * {@link fetchGuard} instance so a compromised or malicious feed host cannot
+     * redirect the request into internal/link-local space (cloud metadata, etc.).
+     * Override with your own client for a non-standard runtime, or with
+     * `fetchGuard({ allowPrivate: true })` for an intentionally internal feed
+     * mirror.
      */
     fetchImpl?: typeof fetch;
     /** Extra request headers (e.g. an API token for a commercial feed). */
@@ -174,6 +178,8 @@ export interface UrlFeedOptions {
  * are skipped by {@link ipReputation}, so a partially-malformed feed still loads
  * its good entries.
  *
+ * The outbound fetch is SSRF-hardened by default (see {@link UrlFeedOptions.fetchImpl}).
+ *
  * @param url - The feed URL.
  * @param opts - Optional feed name, custom `fetch`, and request headers.
  * @returns A feed ready to pass to {@link IpReputationOptions.feeds}.

package/dist/ip-reputation.js

@@ -45,6 +45,7 @@
  * @since 0.37.0
  */
 import { ForbiddenError } from "./errors.js";
+import { fetchGuard } from "./fetch-guard.js";
 import { compileCidrMatcher, matchesMatcher, parseIp, } from "./ip-restriction.js";
 const DEFAULT_REFRESH_MS = 60 * 60_000;
 const DEFAULT_FETCH_TIMEOUT_MS = 30_000;
@@ -74,6 +75,8 @@ function parseFeedLine(line) {
  * are skipped by {@link ipReputation}, so a partially-malformed feed still loads
  * its good entries.
  *
+ * The outbound fetch is SSRF-hardened by default (see {@link UrlFeedOptions.fetchImpl}).
+ *
  * @param url - The feed URL.
  * @param opts - Optional feed name, custom `fetch`, and request headers.
  * @returns A feed ready to pass to {@link IpReputationOptions.feeds}.
@@ -81,7 +84,10 @@ function parseFeedLine(line) {
  */
 export function urlFeed(url, opts = {}) {
     const name = opts.name ?? url;
-    const doFetch = opts.fetchImpl ?? globalThis.fetch;
+    // Secure-by-default: route the outbound feed fetch through fetchGuard() so
+    // redirects are re-validated per hop and internal/metadata targets are
+    // refused, matching createWebhookSender's posture. Callers can override.
+    const doFetch = opts.fetchImpl ?? fetchGuard();
     return {
         name,
         async fetch(signal) {

package/dist/jwk.js

@@ -235,7 +235,7 @@ export function jwk(opts) {
         });
         return cachedVerifier;
     }
-    return {
+    const authHooks = {
         async beforeHandle(ctx) {
             const header = ctx.request.headers.get("authorization") ?? "";
             const match = /^Bearer\s+(.+)$/i.exec(header);
@@ -268,6 +268,11 @@ export function jwk(opts) {
             return undefined;
         },
     };
+    // Same global symbol as middleware's AUTH_HOOK_MARKER (stamped inline to keep
+    // the middleware module out of jwk's bundle): lets the route-auth boot guard
+    // recognize that a route declaring `auth:` is actually enforced here.
+    authHooks[Symbol.for("daloyjs.auth.hook")] = true;
+    return authHooks;
 }
 function extractScopes(payload) {
     // RFC 8693 / OAuth2: `scope` is a space-delimited string; some IdPs emit

package/dist/mcp.d.ts

@@ -39,9 +39,16 @@ export type McpJsonObject = {
 };
 /**
  * JSON Schema fragment advertised to MCP clients for a tool or prompt
- * argument object. DaloyJS does not bundle a schema validator here, so the
- * schema is documentation and client-side guidance. Validate sensitive inputs
- * inside your handler before touching databases, files, or remote services.
+ * argument object.
+ *
+ * For a tool's `inputSchema`, DaloyJS enforces the commonly-used,
+ * security-relevant subset of JSON Schema server-side (see
+ * {@link validateMcpInput}) BEFORE the tool handler runs, rejecting a
+ * `tools/call` whose arguments violate it with JSON-RPC `-32602`. Keywords
+ * outside that subset (`pattern`, `format`, `$ref`,
+ * `anyOf`/`oneOf`/`allOf`, …) are advertised to clients but NOT enforced —
+ * validate any constraint expressed only through those keywords inside your
+ * handler before touching databases, files, or remote services.
  *
  * @since 1.0.0
  */
@@ -195,8 +202,11 @@ export interface McpToolAnnotations {
  * Handler for a single MCP tool.
  *
  * @typeParam TArgs - Type expected in `params.arguments` for this tool.
- * @param args - Tool arguments supplied by the MCP client. They are typed for
- *   developer experience but are still untrusted JSON at runtime.
+ * @param args - Tool arguments supplied by the MCP client. They have already
+ *   been validated against this tool's `inputSchema` (enforced subset — see
+ *   {@link validateMcpInput}) and had prototype-pollution keys stripped, so the
+ *   declared shape holds at runtime. Constraints expressed only through
+ *   unsupported schema keywords (e.g. `pattern`) remain the handler's job.
  * @param ctx - Request metadata and the original HTTP request.
  * @returns Text shorthand or a full {@link McpToolResult}.
  * @throws {McpToolError} for caller-correctable failures that should be
@@ -209,9 +219,11 @@ export type McpToolHandler<TArgs extends Record<string, unknown> = Record<string
  * Definition of a callable MCP tool.
  *
  * Tools are model-controlled in MCP: clients may let the language model decide
- * when to call them. Treat every tool as a public API operation and enforce
- * authentication, authorization, rate limits, and validation before side
- * effects.
+ * when to call them. Treat every tool as a public API operation. DaloyJS
+ * enforces the tool's `inputSchema` (enforced subset — see
+ * {@link validateMcpInput}) before the handler runs; you remain responsible for
+ * authentication, authorization, rate limits, and any validation beyond that
+ * subset before side effects.
  *
  * @typeParam TArgs - Type expected by this tool's handler.
  * @since 1.0.0
@@ -492,6 +504,31 @@ export interface McpHandlerOptions {
  * @since 1.0.0
  */
 export type McpHandler = (request: Request) => Promise<Response>;
+/**
+ * Minimal, dependency-free JSON Schema validator for MCP tool arguments.
+ *
+ * DaloyJS core bundles no third-party schema library, so this implements the
+ * commonly-used, security-relevant subset of JSON Schema — enough to reject the
+ * untrusted `tools/call` argument shapes that matter before a tool handler
+ * runs: wrong `type` (including `integer`), missing `required` properties,
+ * unexpected keys under `additionalProperties: false`, `enum`/`const`
+ * violations, and basic string/number/array bounds (`minLength`/`maxLength`,
+ * `minimum`/`maximum`, `minItems`/`maxItems`). Nested `properties`, `items`,
+ * and object-form `additionalProperties` are validated recursively.
+ *
+ * Keywords outside this subset (`pattern`, `format`, `$ref`,
+ * `anyOf`/`oneOf`/`allOf`, etc.) are intentionally NOT enforced — notably
+ * `pattern` is skipped so a developer-authored regex can never become a ReDoS
+ * sink against attacker-controlled input. Handlers must still validate any
+ * constraint expressed only through those keywords.
+ *
+ * @param schema - The tool's advertised `inputSchema`.
+ * @param value - The untrusted `params.arguments` value from the client.
+ * @returns A list of human-readable validation errors; empty when the value
+ *   satisfies the enforced subset of the schema.
+ * @since 1.0.0
+ */
+export declare function validateMcpInput(schema: McpJsonSchema, value: unknown): string[];
 /**
  * Create a dependency-free MCP Streamable HTTP endpoint handler.
  *
@@ -544,6 +581,25 @@ export type McpHandler = (request: Request) => Promise<Response>;
  * @since 1.0.0
  */
 export declare function createMcpHandler(options: McpHandlerOptions): McpHandler;
+/**
+ * Options for {@link mcpRoutes}.
+ *
+ * @since 1.0.0
+ */
+export interface McpRoutesOptions {
+    /**
+     * Set `true` to intentionally expose the MCP endpoint WITHOUT authentication,
+     * opting the `POST` transport out of the App's production route-auth boot
+     * guard. Only do this for a genuinely public MCP server — MCP tools are
+     * model-controlled and can trigger side effects, so an unauthenticated
+     * endpoint is a high-impact default. When left `false` (the default), a
+     * production `secureDefaults` App refuses to boot unless an authentication
+     * hook covers the MCP route.
+     *
+     * @defaultValue false
+     */
+    public?: boolean;
+}
 /**
  * Build the Daloy route definitions for a Streamable HTTP MCP endpoint.
  *
@@ -552,8 +608,16 @@ export declare function createMcpHandler(options: McpHandlerOptions): McpHandler
  * its public contract and auth policy, while the MCP server can use its own
  * bearer token, rate limit, network allowlist, and tool set.
  *
+ * By default the `POST` transport route is stamped so that a production
+ * `secureDefaults` App **refuses to boot** unless an authentication hook covers
+ * it — MCP tools are model-controlled and side-effecting. Cover the route with
+ * an auth middleware (e.g. `app.use(bearerAuth({ ... }))`), or pass
+ * `{ public: true }` to intentionally expose a public MCP server.
+ *
  * @param path - Public MCP endpoint path, usually `"/mcp"`.
  * @param handler - Handler returned by {@link createMcpHandler}.
+ * @param options - See {@link McpRoutesOptions}; pass `{ public: true }` to opt
+ *   out of the auth boot guard.
  * @returns Route definitions for `POST`, `GET`, and `OPTIONS` on the same
  *   path. `POST` is the actual MCP transport; `GET` gives a human-readable
  *   405 hint because this helper does not open server-initiated SSE streams;
@@ -564,11 +628,18 @@ export declare function createMcpHandler(options: McpHandlerOptions): McpHandler
  * const app = new App();
  * const mcp = createMcpHandler({ serverInfo, tools });
  *
+ * // Authenticated MCP server (satisfies the production boot guard):
+ * app.use(bearerAuth({ validate: (t) => timingSafeEqual(t, process.env.MCP_TOKEN!) }));
  * for (const route of mcpRoutes("/mcp", mcp)) {
  *   app.route(route);
  * }
+ *
+ * // ...or an intentionally public MCP server:
+ * for (const route of mcpRoutes("/mcp", mcp, { public: true })) {
+ *   app.route(route);
+ * }
  * ```
  *
  * @since 1.0.0
  */
-export declare function mcpRoutes(path: PathString, handler: McpHandler): RouteDefinition<PathString, "GET" | "POST" | "OPTIONS">[];
+export declare function mcpRoutes(path: PathString, handler: McpHandler, options?: McpRoutesOptions): RouteDefinition<PathString, "GET" | "POST" | "OPTIONS">[];

package/dist/mcp.js

@@ -1,3 +1,4 @@
+import { safeJsonParse } from "./security.js";
 /**
  * Latest MCP protocol version DaloyJS negotiates by default.
  *
@@ -125,6 +126,165 @@ function asRecord(value) {
         ? value
         : {};
 }
+/** Hard cap on reported validation errors so a hostile payload can't inflate the response. */
+const MAX_MCP_VALIDATION_ERRORS = 20;
+/** Recursion-depth cap so a deeply-nested payload can't exhaust the stack. */
+const MAX_MCP_SCHEMA_DEPTH = 64;
+/** Narrow an arbitrary JSON value to a schema object (`{}`), excluding arrays/null. */
+function isSchemaObject(v) {
+    return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+/** Report the JSON type of a value using JSON Schema's type names. */
+function jsonTypeOf(v) {
+    if (v === null)
+        return "null";
+    if (Array.isArray(v))
+        return "array";
+    return typeof v;
+}
+/** Test a value against a single JSON Schema `type` keyword. */
+function matchesJsonType(type, value) {
+    switch (type) {
+        case "integer":
+            return typeof value === "number" && Number.isInteger(value);
+        case "number":
+            return typeof value === "number" && Number.isFinite(value);
+        case "string":
+            return typeof value === "string";
+        case "boolean":
+            return typeof value === "boolean";
+        case "null":
+            return value === null;
+        case "object":
+            return value !== null && typeof value === "object" && !Array.isArray(value);
+        case "array":
+            return Array.isArray(value);
+        default:
+            // Unknown type keyword — do not reject; treat as unconstrained.
+            return true;
+    }
+}
+/** Structural equality for `enum`/`const` comparison (sufficient for JSON scalars/objects). */
+function deepEqualJson(a, b) {
+    return JSON.stringify(a) === JSON.stringify(b);
+}
+/** Recursive worker for {@link validateMcpInput}. Pushes human-readable errors into `errors`. */
+function validateSchemaNode(schema, value, path, errors, depth) {
+    if (errors.length >= MAX_MCP_VALIDATION_ERRORS)
+        return;
+    if (depth > MAX_MCP_SCHEMA_DEPTH) {
+        errors.push(`${path}: exceeds maximum validation depth`);
+        return;
+    }
+    // type (string or array-of-strings). A type mismatch stops deeper,
+    // type-dependent checks for this node to avoid a cascade of noise.
+    const typeKw = schema.type;
+    if (typeof typeKw === "string") {
+        if (!matchesJsonType(typeKw, value)) {
+            errors.push(`${path}: expected ${typeKw}, got ${jsonTypeOf(value)}`);
+            return;
+        }
+    }
+    else if (Array.isArray(typeKw)) {
+        const types = typeKw.filter((t) => typeof t === "string");
+        if (types.length > 0 && !types.some((t) => matchesJsonType(t, value))) {
+            errors.push(`${path}: expected one of [${types.join(", ")}], got ${jsonTypeOf(value)}`);
+            return;
+        }
+    }
+    if (Array.isArray(schema.enum) && !schema.enum.some((e) => deepEqualJson(e, value))) {
+        errors.push(`${path}: value is not one of the allowed enum values`);
+    }
+    if ("const" in schema && !deepEqualJson(schema.const, value)) {
+        errors.push(`${path}: value does not equal the required constant`);
+    }
+    if (typeof value === "string") {
+        if (typeof schema.minLength === "number" && value.length < schema.minLength) {
+            errors.push(`${path}: string shorter than minLength ${schema.minLength}`);
+        }
+        if (typeof schema.maxLength === "number" && value.length > schema.maxLength) {
+            errors.push(`${path}: string longer than maxLength ${schema.maxLength}`);
+        }
+    }
+    if (typeof value === "number") {
+        if (typeof schema.minimum === "number" && value < schema.minimum) {
+            errors.push(`${path}: number below minimum ${schema.minimum}`);
+        }
+        if (typeof schema.maximum === "number" && value > schema.maximum) {
+            errors.push(`${path}: number above maximum ${schema.maximum}`);
+        }
+    }
+    if (Array.isArray(value)) {
+        if (typeof schema.minItems === "number" && value.length < schema.minItems) {
+            errors.push(`${path}: array has fewer than minItems ${schema.minItems}`);
+        }
+        if (typeof schema.maxItems === "number" && value.length > schema.maxItems) {
+            errors.push(`${path}: array has more than maxItems ${schema.maxItems}`);
+        }
+        if (isSchemaObject(schema.items)) {
+            for (let i = 0; i < value.length; i++) {
+                validateSchemaNode(schema.items, value[i], `${path}[${i}]`, errors, depth + 1);
+                if (errors.length >= MAX_MCP_VALIDATION_ERRORS)
+                    return;
+            }
+        }
+    }
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        const obj = value;
+        const props = isSchemaObject(schema.properties) ? schema.properties : undefined;
+        if (Array.isArray(schema.required)) {
+            for (const req of schema.required) {
+                if (typeof req === "string" && !Object.prototype.hasOwnProperty.call(obj, req)) {
+                    errors.push(`${path}.${req}: required property is missing`);
+                }
+            }
+        }
+        const addl = schema.additionalProperties;
+        for (const key of Object.keys(obj)) {
+            const sub = props && isSchemaObject(props[key]) ? props[key] : undefined;
+            if (sub) {
+                validateSchemaNode(sub, obj[key], `${path}.${key}`, errors, depth + 1);
+            }
+            else if (addl === false) {
+                errors.push(`${path}.${key}: unexpected property (additionalProperties is false)`);
+            }
+            else if (isSchemaObject(addl)) {
+                validateSchemaNode(addl, obj[key], `${path}.${key}`, errors, depth + 1);
+            }
+            if (errors.length >= MAX_MCP_VALIDATION_ERRORS)
+                return;
+        }
+    }
+}
+/**
+ * Minimal, dependency-free JSON Schema validator for MCP tool arguments.
+ *
+ * DaloyJS core bundles no third-party schema library, so this implements the
+ * commonly-used, security-relevant subset of JSON Schema — enough to reject the
+ * untrusted `tools/call` argument shapes that matter before a tool handler
+ * runs: wrong `type` (including `integer`), missing `required` properties,
+ * unexpected keys under `additionalProperties: false`, `enum`/`const`
+ * violations, and basic string/number/array bounds (`minLength`/`maxLength`,
+ * `minimum`/`maximum`, `minItems`/`maxItems`). Nested `properties`, `items`,
+ * and object-form `additionalProperties` are validated recursively.
+ *
+ * Keywords outside this subset (`pattern`, `format`, `$ref`,
+ * `anyOf`/`oneOf`/`allOf`, etc.) are intentionally NOT enforced — notably
+ * `pattern` is skipped so a developer-authored regex can never become a ReDoS
+ * sink against attacker-controlled input. Handlers must still validate any
+ * constraint expressed only through those keywords.
+ *
+ * @param schema - The tool's advertised `inputSchema`.
+ * @param value - The untrusted `params.arguments` value from the client.
+ * @returns A list of human-readable validation errors; empty when the value
+ *   satisfies the enforced subset of the schema.
+ * @since 1.0.0
+ */
+export function validateMcpInput(schema, value) {
+    const errors = [];
+    validateSchemaNode(schema, value, "arguments", errors, 0);
+    return errors;
+}
 function publicTool(tool) {
     const { handler: _handler, ...rest } = tool;
     return rest;
@@ -382,8 +542,18 @@ export function createMcpHandler(options) {
                 if (!tool) {
                     return rpcError(id, INVALID_PARAMS, `Unknown tool: ${name || "<missing>"}`, undefined, 200, headers);
                 }
+                // Enforce the tool's advertised inputSchema on the untrusted client
+                // arguments BEFORE the handler runs, so a handler is never handed a
+                // payload that violates its own contract (wrong types, missing required
+                // fields, unexpected keys). Protocol-level validation failures map to
+                // JSON-RPC -32602 (Invalid params).
+                const rawArgs = params.arguments === undefined ? {} : params.arguments;
+                const validationErrors = validateMcpInput(tool.inputSchema, rawArgs);
+                if (validationErrors.length > 0) {
+                    return rpcError(id, INVALID_PARAMS, `Invalid arguments for tool "${name}": ${validationErrors[0]}`, { validationErrors }, 200, headers);
+                }
                 try {
-                    const result = await tool.handler(asRecord(params.arguments), ctx);
+                    const result = await tool.handler(asRecord(rawArgs), ctx);
                     return rpcResult(id, normalizeToolResult(result), headers);
                 }
                 catch (error) {
@@ -523,7 +693,11 @@ export function createMcpHandler(options) {
         }
         let message;
         try {
-            message = JSON.parse(raw);
+            // `safeJsonParse` strips `__proto__` / `constructor` / `prototype` keys so
+            // an untrusted MCP client cannot smuggle prototype-pollution-shaped keys
+            // into a tool handler's arguments — matching the REST body parsers'
+            // secure-by-default posture (see `safeJsonParse` in security.ts).
+            message = safeJsonParse(raw);
         }
         catch {
             return rpcError(null, PARSE_ERROR, "Invalid JSON in request body.", undefined, 400, headers);
@@ -565,8 +739,16 @@ export function createMcpHandler(options) {
  * its public contract and auth policy, while the MCP server can use its own
  * bearer token, rate limit, network allowlist, and tool set.
  *
+ * By default the `POST` transport route is stamped so that a production
+ * `secureDefaults` App **refuses to boot** unless an authentication hook covers
+ * it — MCP tools are model-controlled and side-effecting. Cover the route with
+ * an auth middleware (e.g. `app.use(bearerAuth({ ... }))`), or pass
+ * `{ public: true }` to intentionally expose a public MCP server.
+ *
  * @param path - Public MCP endpoint path, usually `"/mcp"`.
  * @param handler - Handler returned by {@link createMcpHandler}.
+ * @param options - See {@link McpRoutesOptions}; pass `{ public: true }` to opt
+ *   out of the auth boot guard.
  * @returns Route definitions for `POST`, `GET`, and `OPTIONS` on the same
  *   path. `POST` is the actual MCP transport; `GET` gives a human-readable
  *   405 hint because this helper does not open server-initiated SSE streams;
@@ -577,14 +759,21 @@ export function createMcpHandler(options) {
  * const app = new App();
  * const mcp = createMcpHandler({ serverInfo, tools });
  *
+ * // Authenticated MCP server (satisfies the production boot guard):
+ * app.use(bearerAuth({ validate: (t) => timingSafeEqual(t, process.env.MCP_TOKEN!) }));
  * for (const route of mcpRoutes("/mcp", mcp)) {
  *   app.route(route);
  * }
+ *
+ * // ...or an intentionally public MCP server:
+ * for (const route of mcpRoutes("/mcp", mcp, { public: true })) {
+ *   app.route(route);
+ * }
  * ```
  *
  * @since 1.0.0
  */
-export function mcpRoutes(path, handler) {
+export function mcpRoutes(path, handler, options = {}) {
     const responses = {
         200: { description: "MCP JSON-RPC response", body: MCP_JSON_RESPONSE_SCHEMA },
         202: { description: "MCP notification accepted", body: MCP_JSON_RESPONSE_SCHEMA },
@@ -594,7 +783,7 @@ export function mcpRoutes(path, handler) {
         405: { description: "Unsupported MCP transport method" },
         413: { description: "MCP request body too large" },
     };
-    return [
+    const routes = [
         {
             method: "POST",
             path,
@@ -620,4 +809,17 @@ export function mcpRoutes(path, handler) {
             handler: ({ request }) => handler(request),
         },
     ];
+    // Unless explicitly public, stamp the POST transport (the route that executes
+    // tools/call) with the global-registry marker the App boot guard reads. GET
+    // (405 hint) and OPTIONS (preflight) are not marked: preflight must stay
+    // credential-free. Uses the same string as app.ts's MCP_ROUTE_MARKER; kept as
+    // a bare Symbol.for so the App core never imports this module.
+    if (options.public !== true) {
+        for (const route of routes) {
+            if (route.method === "POST") {
+                route[Symbol.for("daloyjs.mcp.route")] = true;
+            }
+        }
+    }
+    return routes;
 }

package/dist/middleware.d.ts

@@ -314,6 +314,44 @@ export declare const CORS_WILDCARD_ORIGIN_MARKER: unique symbol;
  * @since 0.17.0
  */
 export declare const CSRF_HOOK_MARKER: unique symbol;
+/**
+ * Marker stamped on a {@link Hooks} bundle that authenticates the request —
+ * i.e. rejects callers without valid credentials. Built-in auth middlewares
+ * (`bearerAuth`, `basicAuth`, `jwk`, `httpSignatureAuth`, `clientCertAuth`)
+ * stamp it so the framework's route-auth boot guard can confirm that any route
+ * declaring an `auth:` requirement is actually enforced by a hook rather than
+ * being silently public (a `security` entry in the OpenAPI doc with no runtime
+ * check). Wrap a custom authentication hook with {@link markAuthHook} to opt it
+ * into the same guard.
+ *
+ * @since 1.0.0
+ */
+export declare const AUTH_HOOK_MARKER: unique symbol;
+/**
+ * Mark a custom {@link Hooks} bundle as performing request authentication.
+ *
+ * Use this when you authenticate with your own hook (not one of the built-in
+ * auth middlewares) but still declare `auth:` on the protected routes: it
+ * stamps {@link AUTH_HOOK_MARKER} so the production route-auth boot guard treats
+ * those routes as enforced. It is also the correct escape hatch when
+ * authentication is performed by an upstream gateway/mesh and the in-app hook
+ * is intentionally a pass-through.
+ *
+ * @param hooks - The hook bundle to mark (mutated in place and returned).
+ * @returns The same `hooks` object, now stamped as an auth hook.
+ *
+ * @example
+ * ```ts
+ * app.use(markAuthHook({
+ *   async beforeHandle(ctx) {
+ *     if (!(await myVerify(ctx.request))) throw new UnauthorizedError();
+ *   },
+ * }));
+ * ```
+ *
+ * @since 1.0.0
+ */
+export declare function markAuthHook(hooks: Hooks): Hooks;
 /** Predicate stamped on a CORS `Hooks` object that returns `true` for allowed origins. */
 export type CorsOriginAllow = (origin: string) => boolean;
 /** Options for {@link cors}. */