@daloyjs/core 1.0.0-rc.3 → 1.0.0-rc.4

package/dist/internal-response.js

@@ -0,0 +1,27 @@
+/**
+ * Responses reconstructed by first-party cache/idempotency middleware from a
+ * previously finalized response. The original response already crossed the
+ * route's schema-validation boundary, so replaying its stored bytes does not
+ * create the opaque-success bypass guarded by `App`.
+ */
+const schemaValidatedResponses = new WeakSet();
+/**
+ * Mark a framework-generated replay as having crossed response validation.
+ * This is an internal capability and is not exported from the package barrel.
+ *
+ * @param response - Reconstructed response containing previously validated bytes.
+ * @returns The same response for allocation-free call-site composition.
+ */
+export function markSchemaValidatedResponse(response) {
+    schemaValidatedResponses.add(response);
+    return response;
+}
+/**
+ * Test whether a response is a trusted first-party replay of validated bytes.
+ *
+ * @param response - Hook response being considered for fail-closed handling.
+ * @returns `true` only for responses marked by first-party replay middleware.
+ */
+export function isSchemaValidatedResponse(response) {
+    return schemaValidatedResponses.has(response);
+}

package/dist/jwk.d.ts

@@ -1,5 +1,5 @@
 import { type JwtAlgorithm } from "./jwt.js";
-import type { BaseContext, Hooks } from "./types.js";
+import type { Hooks, PreBodyContext } from "./types.js";
 /** Asymmetric algorithms accepted by {@link jwk}. */
 export type JwkAlgorithm = Exclude<JwtAlgorithm, "HS256" | "HS384" | "HS512">;
 /** Minimal JWKS document shape (RFC 7517 §5). */
@@ -12,8 +12,12 @@ export interface JwkSet {
  * `https://` URL (fetched with TTL caching), or a custom async resolver.
  */
 export type JwkSource = JwkSet | string | (() => JwkSet | Promise<JwkSet>);
-/** Per-request payload-revalidation hook. */
-export type JwkVerifyHook = (payload: Record<string, unknown>, ctx: BaseContext<any, any>) => boolean | void | Promise<boolean | void>;
+/**
+ * Per-request payload-revalidation hook run before request-body I/O.
+ * The supplied {@link PreBodyContext} exposes raw headers/query/params and an
+ * always-`undefined` body.
+ */
+export type JwkVerifyHook = (payload: Record<string, unknown>, ctx: PreBodyContext<any>) => boolean | void | Promise<boolean | void>;
 /**
  * Options for {@link jwk}: the JWKS source and asymmetric algorithm allowlist
  * are required; issuer / audience / clock-skew checks, JWKS fetch caching,
@@ -61,10 +65,10 @@ export interface JwkOptions {
      */
     fetch?: typeof fetch;
     /**
-    * Optional per-request revalidation hook. Returning `false` rejects the
-    * request with `403`; returning `true` or `undefined` accepts. Use for
-    * revocation lists / token-version counters / "user changed password since
-    * this JWT was issued".
+     * Optional per-request revalidation hook. Returning `false` rejects the
+     * request with `403`; returning `true` or `undefined` accepts. Use for
+     * revocation lists / token-version counters / "user changed password since
+     * this JWT was issued". Runs before request-body I/O.
      *
      * @since 0.22.0
      */

package/dist/jwk.js

@@ -30,9 +30,15 @@
 import { ForbiddenError } from "./errors.js";
 import { createJwtVerifier, JwtError, } from "./jwt.js";
 const ALLOWED_JWK_ALGS = new Set([
-    "RS256", "RS384", "RS512",
-    "PS256", "PS384", "PS512",
-    "ES256", "ES384", "ES512",
+    "RS256",
+    "RS384",
+    "RS512",
+    "PS256",
+    "PS384",
+    "PS512",
+    "ES256",
+    "ES384",
+    "ES512",
     "EdDSA",
 ]);
 function unauthorized(realm, errorCode, description) {
@@ -59,9 +65,7 @@ function sanitizeAuthParam(value) {
     return value.replace(/[\u0000-\u001f\u007f"\\]/g, "");
 }
 function isJwkSet(value) {
-    return (typeof value === "object" &&
-        value !== null &&
-        Array.isArray(value.keys));
+    return (typeof value === "object" && value !== null && Array.isArray(value.keys));
 }
 function findJwkByKid(jwks, kid) {
     for (const k of jwks.keys) {
@@ -236,7 +240,7 @@ export function jwk(opts) {
         return cachedVerifier;
     }
     const authHooks = {
-        async beforeHandle(ctx) {
+        async preBody(ctx) {
             const header = ctx.request.headers.get("authorization") ?? "";
             const match = /^Bearer\s+(.+)$/i.exec(header);
             if (!match) {

package/dist/mcp.js

@@ -1,4 +1,4 @@
-import { safeJsonParse } from "./security.js";
+import { safeJsonParseLimited } from "./security.js";
 /**
  * Latest MCP protocol version DaloyJS negotiates by default.
  *
@@ -693,11 +693,10 @@ export function createMcpHandler(options) {
         }
         let message;
         try {
-            // `safeJsonParse` strips `__proto__` / `constructor` / `prototype` keys so
-            // an untrusted MCP client cannot smuggle prototype-pollution-shaped keys
-            // into a tool handler's arguments — matching the REST body parsers'
-            // secure-by-default posture (see `safeJsonParse` in security.ts).
-            message = safeJsonParse(raw);
+            // Use the limited parser (proto stripping + key/depth bounds) so an
+            // untrusted MCP client cannot DoS us with wide or deeply-nested JSON-RPC
+            // payloads, even within the MCP body cap. Matches the REST body parsers.
+            message = safeJsonParseLimited(raw);
         }
         catch {
             return rpcError(null, PARSE_ERROR, "Invalid JSON in request body.", undefined, 400, headers);
@@ -789,6 +788,10 @@ export function mcpRoutes(path, handler, options = {}) {
             path,
             operationId: "mcpPost",
             summary: "MCP Streamable HTTP endpoint",
+            // The transport handler owns JSON-RPC serialization and may also emit
+            // empty/streaming responses, so its web-standard Response is
+            // intentionally opaque to Daloy's response serializer.
+            acknowledgeNoResponseBodySchema: true,
             responses,
             handler: ({ request }) => handler(request),
         },
@@ -797,6 +800,7 @@ export function mcpRoutes(path, handler, options = {}) {
             path,
             operationId: "mcpGet",
             summary: "MCP Streamable HTTP discovery hint",
+            acknowledgeNoResponseBodySchema: true,
             responses,
             handler: ({ request }) => handler(request),
         },
@@ -805,6 +809,7 @@ export function mcpRoutes(path, handler, options = {}) {
             path,
             operationId: "mcpOptions",
             summary: "MCP Streamable HTTP preflight",
+            acknowledgeNoResponseBodySchema: true,
             responses,
             handler: ({ request }) => handler(request),
         },

package/dist/middleware.d.ts

@@ -4,7 +4,7 @@
  * All middlewares return `Hooks` objects so they compose with `app.use(...)`,
  * groups, and per-route hooks identically.
  */
-import type { Hooks, BaseContext } from "./types.js";
+import type { Hooks, BaseContext, PreBodyContext } from "./types.js";
 import { timingSafeEqual } from "./security.js";
 /** Options for {@link requestId}. */
 export interface RequestIdOptions {
@@ -327,6 +327,23 @@ export declare const CSRF_HOOK_MARKER: unique symbol;
  * @since 1.0.0
  */
 export declare const AUTH_HOOK_MARKER: unique symbol;
+/**
+ * Internal list of request-budget hooks that must run when a later `preBody`
+ * guard rejects. This preserves registration order for `rateLimit()` before
+ * authentication without moving body-aware middleware ahead of validation.
+ *
+ * @internal
+ */
+export declare const EARLY_REJECTION_HOOK_MARKER: unique symbol;
+/**
+ * Compose `preBody` hooks while honoring request-budget hooks registered
+ * before the guard that rejects. Used internally by App and hook combinators.
+ *
+ * @param layers - Hook layers in registration order.
+ * @returns A composed `preBody` hook, or `undefined` when no layer has one.
+ * @internal
+ */
+export declare function _mergePreBodyWithEarlyRejections(layers: Hooks[]): NonNullable<Hooks["preBody"]> | undefined;
 /**
  * Mark a custom {@link Hooks} bundle as performing request authentication.
  *
@@ -343,7 +360,7 @@ export declare const AUTH_HOOK_MARKER: unique symbol;
  * @example
  * ```ts
  * app.use(markAuthHook({
- *   async beforeHandle(ctx) {
+ *   async preBody(ctx) {
  *     if (!(await myVerify(ctx.request))) throw new UnauthorizedError();
  *   },
  * }));
@@ -426,14 +443,27 @@ export interface RateLimitStore {
         resetMs: number;
     }>;
 }
+/**
+ * Context accepted by rate-limit key generators. It is validated on the
+ * ordinary path, but may be a pre-body context when a limiter registered
+ * before authentication counts an early credential rejection.
+ *
+ * @since 1.0.0
+ */
+export type RateLimitContext = PreBodyContext<any> | BaseContext<any, any>;
 /** Options for {@link rateLimit}. */
 export interface RateLimitOptions {
     /** Rolling-window width in milliseconds (e.g. `60_000` for one minute). */
     windowMs: number;
     /** Maximum allowed requests per `windowMs` per key. */
     max: number;
-    /** Derive the bucket key from `ctx`. Default returns `"global"`. */
-    keyGenerator?: (ctx: BaseContext<any, any>) => string;
+    /**
+     * Derive the bucket key from `ctx`. Default returns `"global"`. When the
+     * limiter precedes `preBody` authentication, it also receives failed
+     * attempts before body I/O; rely only on the raw request and state populated
+     * by earlier `preBody` hooks.
+     */
+    keyGenerator?: (ctx: RateLimitContext) => string;
     /** Custom backend (default: shared in-memory store). */
     store?: RateLimitStore;
     /**
@@ -483,6 +513,11 @@ export declare function _resetSharedRateLimitStoresForTests(): void;
  * `X-Forwarded-For` / `X-Real-IP` when behind a trusted proxy, or supply a
  * custom `keyGenerator` (e.g. derive from the authenticated user id).
  *
+ * Registration order remains security-significant: a limiter placed before a
+ * `preBody` auth hook counts rejected credentials and can replace the later
+ * `401` with `429`, without consuming the request body. On ordinary accepted
+ * requests it retains the validated `beforeHandle` timing.
+ *
  * @example
  * ```ts
  * import { rateLimit } from "@daloyjs/core";
@@ -508,7 +543,7 @@ export interface LoginThrottleOptions {
     /** Shared bucket id. Default: `"login"`. */
     groupId?: string;
     /** Derive the caller key. Defaults to trusted proxy headers only when enabled. */
-    keyGenerator?: (ctx: BaseContext<any, any>) => string;
+    keyGenerator?: (ctx: RateLimitContext) => string;
     /** Shared store for the hard limit. Uses rateLimit()'s in-memory group bucket by default. */
     store?: RateLimitStore;
     /** Trust x-forwarded-for / x-real-ip when deriving the default key. Default: false. */
@@ -530,6 +565,8 @@ export interface LoginThrottleOptions {
  * Mount the same `loginThrottle()` instance (or multiple instances with the
  * same `groupId`) across related routes so an attacker cannot bypass the limit
  * by rotating between password, OTP, and reset endpoints.
+ * When registered before `preBody` authentication it counts and progressively
+ * delays rejected credentials without consuming a declared request body.
  *
  * @param opts - Throttle tuning (see {@link LoginThrottleOptions}); every field has a safe default.
  * @returns A {@link Hooks} bundle ready for `app.use(...)` or per-route `hooks`.
@@ -588,7 +625,7 @@ export declare function timing(headerName?: string): Hooks;
  *
  * @since 0.22.0
  */
-export type BearerAuthVerifyHook<TCredentials = string> = (credentials: TCredentials, ctx: BaseContext<any, any>) => boolean | void | Promise<boolean | void>;
+export type BearerAuthVerifyHook<TCredentials = string> = (credentials: TCredentials, ctx: PreBodyContext<any>) => boolean | void | Promise<boolean | void>;
 /** Options for {@link bearerAuth}. */
 export interface BearerAuthOptions {
     /** Cheap, stateless token check (signature / format). */
@@ -616,6 +653,8 @@ export interface BearerAuthOptions {
  * optional `verify` hook is the integration point for revocation
  * lists, token-version counters, and other per-request invalidation checks
  * that `validate` cannot answer statelessly.
+ * Both checks run before request-body I/O; `verify` receives a
+ * {@link PreBodyContext} whose `body` is always `undefined`.
  *
  * @example
  * ```ts
@@ -757,13 +796,15 @@ export interface BasicAuthOptions {
      * after the framework has stamped `ctx.state.user`. Use this to decorate
      * `ctx.state` with extra fields (typed via `AppState`) so handlers do not
      * re-parse the `Authorization` header in every route.
+     * Runs before request-body I/O with a {@link PreBodyContext}; `ctx.body` is
+     * always `undefined`.
      *
      * @since 0.22.0
      */
     onAuthSuccess?: (creds: {
         username: string;
         password: string;
-    }, ctx: BaseContext<any, any>) => void | Promise<void>;
+    }, ctx: PreBodyContext<any>) => void | Promise<void>;
 }
 /**
  * HTTP Basic Authentication middleware (RFC 7617).

package/dist/middleware.js

@@ -31,7 +31,7 @@ export function requestId(opts = {}) {
     const header = (opts.header ?? "x-request-id").toLowerCase();
     const gen = opts.generator ?? randomId;
     return {
-        beforeHandle(ctx) {
+        preBody(ctx) {
             const incoming = opts.trustIncoming ? ctx.request.headers.get(header) : null;
             const id = incoming && /^[A-Za-z0-9._-]{1,200}$/.test(incoming) ? incoming : gen();
             ctx.state.requestId = id;
@@ -460,6 +460,51 @@ export const CSRF_HOOK_MARKER = Symbol.for("daloyjs.middleware.csrf");
  * @since 1.0.0
  */
 export const AUTH_HOOK_MARKER = Symbol.for("daloyjs.auth.hook");
+/**
+ * Internal list of request-budget hooks that must run when a later `preBody`
+ * guard rejects. This preserves registration order for `rateLimit()` before
+ * authentication without moving body-aware middleware ahead of validation.
+ *
+ * @internal
+ */
+export const EARLY_REJECTION_HOOK_MARKER = Symbol.for("daloyjs.middleware.earlyRejectionHooks");
+/**
+ * Compose `preBody` hooks while honoring request-budget hooks registered
+ * before the guard that rejects. Used internally by App and hook combinators.
+ *
+ * @param layers - Hook layers in registration order.
+ * @returns A composed `preBody` hook, or `undefined` when no layer has one.
+ * @internal
+ */
+export function _mergePreBodyWithEarlyRejections(layers) {
+    if (!layers.some((hooks) => hooks.preBody !== undefined))
+        return undefined;
+    return async (ctx) => {
+        const pending = [];
+        for (const hooks of layers) {
+            const early = hooks[EARLY_REJECTION_HOOK_MARKER];
+            if (Array.isArray(early)) {
+                for (const candidate of early) {
+                    if (typeof candidate === "function")
+                        pending.push(candidate);
+                }
+            }
+            if (hooks.preBody === undefined)
+                continue;
+            const result = await hooks.preBody(ctx);
+            if (!(result instanceof Response))
+                continue;
+            let response = result;
+            for (const hook of pending) {
+                const replacement = await hook(ctx);
+                if (replacement instanceof Response)
+                    response = replacement;
+            }
+            return response;
+        }
+        return undefined;
+    };
+}
 /**
  * Mark a custom {@link Hooks} bundle as performing request authentication.
  *
@@ -476,7 +521,7 @@ export const AUTH_HOOK_MARKER = Symbol.for("daloyjs.auth.hook");
  * @example
  * ```ts
  * app.use(markAuthHook({
- *   async beforeHandle(ctx) {
+ *   async preBody(ctx) {
  *     if (!(await myVerify(ctx.request))) throw new UnauthorizedError();
  *   },
  * }));
@@ -663,6 +708,11 @@ class MemoryStore {
  * `X-Forwarded-For` / `X-Real-IP` when behind a trusted proxy, or supply a
  * custom `keyGenerator` (e.g. derive from the authenticated user id).
  *
+ * Registration order remains security-significant: a limiter placed before a
+ * `preBody` auth hook counts rejected credentials and can replace the later
+ * `401` with `429`, without consuming the request body. On ordinary accepted
+ * requests it retains the validated `beforeHandle` timing.
+ *
  * @example
  * ```ts
  * import { rateLimit } from "@daloyjs/core";
@@ -704,21 +754,22 @@ export function rateLimit(opts) {
             }
             return "global";
         });
-    return {
-        async beforeHandle(ctx) {
-            const key = `${groupPrefix}${keyOf(ctx)}`;
-            const { count, resetMs } = await store.hit(key, opts.windowMs);
-            const remaining = Math.max(0, opts.max - count);
-            ctx.set.headers.set("x-ratelimit-limit", String(opts.max));
-            ctx.set.headers.set("x-ratelimit-remaining", String(remaining));
-            ctx.set.headers.set("x-ratelimit-reset", String(Math.ceil(resetMs / 1000)));
-            if (count > opts.max) {
-                const retry = Math.ceil((resetMs - Date.now()) / 1000);
-                throw new TooManyRequestsError(opts.retryAfter !== false ? retry : undefined);
-            }
-            return undefined;
-        },
+    const enforce = async (ctx) => {
+        const key = `${groupPrefix}${keyOf(ctx)}`;
+        const { count, resetMs } = await store.hit(key, opts.windowMs);
+        const remaining = Math.max(0, opts.max - count);
+        ctx.set.headers.set("x-ratelimit-limit", String(opts.max));
+        ctx.set.headers.set("x-ratelimit-remaining", String(remaining));
+        ctx.set.headers.set("x-ratelimit-reset", String(Math.ceil(resetMs / 1000)));
+        if (count > opts.max) {
+            const retry = Math.ceil((resetMs - Date.now()) / 1000);
+            throw new TooManyRequestsError(opts.retryAfter !== false ? retry : undefined);
+        }
+        return undefined;
     };
+    const hooks = { beforeHandle: enforce };
+    hooks[EARLY_REJECTION_HOOK_MARKER] = [enforce];
+    return hooks;
 }
 function assertNonNegativeInteger(name, value) {
     if (!Number.isInteger(value) || value < 0) {
@@ -751,6 +802,8 @@ function wait(ms) {
  * Mount the same `loginThrottle()` instance (or multiple instances with the
  * same `groupId`) across related routes so an attacker cannot bypass the limit
  * by rotating between password, OTP, and reset endpoints.
+ * When registered before `preBody` authentication it counts and progressively
+ * delays rejected credentials without consuming a declared request body.
  *
  * @param opts - Throttle tuning (see {@link LoginThrottleOptions}); every field has a safe default.
  * @returns A {@link Hooks} bundle ready for `app.use(...)` or per-route `hooks`.
@@ -784,30 +837,31 @@ export function loginThrottle(opts = {}) {
         slowdownBuckets = new Map();
         SHARED_LOGIN_THROTTLE_BUCKETS.set(groupId, slowdownBuckets);
     }
-    return {
-        async beforeHandle(ctx) {
-            const now = Date.now();
-            const key = `${groupId}:${keyGenerator(ctx)}`;
-            let bucket = slowdownBuckets.get(key);
-            if (!bucket || bucket.resetMs <= now) {
-                bucket = { count: 0, resetMs: now + windowMs };
-                slowdownBuckets.set(key, bucket);
-            }
-            bucket.count += 1;
-            if (slowdownBuckets.size > 10_000) {
-                for (const [bucketKey, value] of slowdownBuckets) {
-                    if (value.resetMs <= now)
-                        slowdownBuckets.delete(bucketKey);
-                }
-            }
-            if (bucket.count > delayAfter && delayMs > 0 && maxDelayMs > 0) {
-                const delay = Math.min(maxDelayMs, (bucket.count - delayAfter) * delayMs);
-                if (delay > 0)
-                    await wait(delay);
+    const enforce = async (ctx) => {
+        const now = Date.now();
+        const key = `${groupId}:${keyGenerator(ctx)}`;
+        let bucket = slowdownBuckets.get(key);
+        if (!bucket || bucket.resetMs <= now) {
+            bucket = { count: 0, resetMs: now + windowMs };
+            slowdownBuckets.set(key, bucket);
+        }
+        bucket.count += 1;
+        if (slowdownBuckets.size > 10_000) {
+            for (const [bucketKey, value] of slowdownBuckets) {
+                if (value.resetMs <= now)
+                    slowdownBuckets.delete(bucketKey);
             }
-            return limiter.beforeHandle?.(ctx);
-        },
+        }
+        if (bucket.count > delayAfter && delayMs > 0 && maxDelayMs > 0) {
+            const delay = Math.min(maxDelayMs, (bucket.count - delayAfter) * delayMs);
+            if (delay > 0)
+                await wait(delay);
+        }
+        return limiter.beforeHandle?.(ctx);
     };
+    const hooks = { beforeHandle: enforce };
+    hooks[EARLY_REJECTION_HOOK_MARKER] = [enforce];
+    return hooks;
 }
 // ---------- Timing ----------
 /**
@@ -851,6 +905,8 @@ export function timing(headerName = "server-timing") {
  * optional `verify` hook is the integration point for revocation
  * lists, token-version counters, and other per-request invalidation checks
  * that `validate` cannot answer statelessly.
+ * Both checks run before request-body I/O; `verify` receives a
+ * {@link PreBodyContext} whose `body` is always `undefined`.
  *
  * @example
  * ```ts
@@ -880,7 +936,7 @@ export function bearerAuth(opts) {
         throw new Error("bearerAuth(): realm must not contain quotes, CR, LF, or NUL bytes.");
     }
     return markAuthHook({
-        async beforeHandle(ctx) {
+        async preBody(ctx) {
             const h = ctx.request.headers.get("authorization") ?? "";
             const m = /^Bearer\s+(.+)$/i.exec(h);
             if (!m) {
@@ -1157,7 +1213,7 @@ export function basicAuth(opts) {
         throw new Error("basicAuth(): maxCredentialBytes must be a positive integer.");
     }
     return markAuthHook({
-        async beforeHandle(ctx) {
+        async preBody(ctx) {
             const header = ctx.request.headers.get("authorization") ?? "";
             const match = BASIC_AUTH_TOKEN_RE.exec(header);
             if (!match || match[1].length > maxBytes)

package/dist/mtls.d.ts

@@ -27,7 +27,7 @@
  * @module
  * @since 0.37.0
  */
-import type { BaseContext, Hooks } from "./types.js";
+import type { Hooks, PreBodyContext } from "./types.js";
 /**
  * Normalized view of a TLS client certificate, independent of how it was
  * obtained (native socket vs. forwarded proxy header). Every field except
@@ -197,9 +197,9 @@ export interface ClientCertAuthOptions {
     /**
      * Override how the certificate is sourced. Defaults to reading whatever the
      * adapter attached via {@link setClientCertificate} (native TLS), falling
-     * back to {@link header} parsing when configured.
+     * back to {@link header} parsing when configured. Runs before body I/O.
      */
-    resolve?: (ctx: BaseContext<any, any>) => ClientCertificate | undefined;
+    resolve?: (ctx: PreBodyContext<any>) => ClientCertificate | undefined;
     /**
      * Read the certificate from a trusted-proxy header instead of (or in
      * addition to) the native adapter source. **Spoofable** unless the app is
@@ -237,9 +237,10 @@ export interface ClientCertAuthOptions {
     checkValidity?: boolean;
     /**
      * Custom per-request check, run after all built-in checks pass. Returning
-     * `false` rejects with `403`; `true`/`undefined` accepts.
+     * `false` rejects with `403`; `true`/`undefined` accepts. The context body is
+     * unavailable because certificate authentication runs before body I/O.
      */
-    verify?: (cert: ClientCertificate, ctx: BaseContext<any, any>) => boolean | void | Promise<boolean | void>;
+    verify?: (cert: ClientCertificate, ctx: PreBodyContext<any>) => boolean | void | Promise<boolean | void>;
     /** Rejection message for the `403` responses. Default: `"Client certificate not permitted"`. */
     message?: string;
     /** `ctx.state` key the accepted certificate is stamped on. Default: `"clientCertificate"`. */

package/dist/mtls.js

@@ -348,7 +348,7 @@ export function clientCertAuth(opts = {}) {
             return undefined;
         });
     const authHooks = {
-        async beforeHandle(ctx) {
+        async preBody(ctx) {
             const cert = resolve(ctx);
             if (!cert) {
                 return new Response(MISSING_CERT_BODY, {
@@ -396,11 +396,7 @@ function assertHeaderConfig(cfg) {
     if (cfg.format === "xfcc")
         return;
     if (cfg.format === "structured") {
-        if (!cfg.subjectDN &&
-            !cfg.fingerprint &&
-            !cfg.san &&
-            !cfg.serialNumber &&
-            !cfg.issuerDN) {
+        if (!cfg.subjectDN && !cfg.fingerprint && !cfg.san && !cfg.serialNumber && !cfg.issuerDN) {
             throw new Error("clientCertAuth(): structured header config must name at least one of subjectDN/issuerDN/fingerprint/serialNumber/san.");
         }
         return;
@@ -419,9 +415,7 @@ function certFromHeaders(request, cfg) {
     const sanRaw = readHeader(request, cfg.san);
     const verifyRaw = cfg.verify ? readHeader(request, cfg.verify) : undefined;
     const successValue = (cfg.verifySuccessValue ?? "SUCCESS").toLowerCase();
-    const verified = cfg.verify === undefined
-        ? true
-        : (verifyRaw ?? "").toLowerCase() === successValue;
+    const verified = cfg.verify === undefined ? true : (verifyRaw ?? "").toLowerCase() === successValue;
     const sans = [];
     if (sanRaw) {
         for (const piece of sanRaw.split(",")) {

package/dist/openapi.js

@@ -208,7 +208,7 @@ function buildOperation(route, path) {
             ? { ...(metaResponseExamples ?? {}), ...(spec.examples ?? {}) }
             : undefined;
         responses[status] = {
-            description: spec.description,
+            description: spec.description ?? `HTTP ${status} response`,
             ...(spec.body
                 ? {
                     content: {

package/dist/pagination.js

@@ -28,6 +28,7 @@
  * @since 0.37.0
  */
 import { BadRequestError } from "./errors.js";
+import { safeJsonParseLimited } from "./security.js";
 import { isForbiddenObjectKey } from "./security.js";
 /**
  * Hard cap on the length of an encoded cursor string accepted by
@@ -91,7 +92,9 @@ export function decodeCursor(cursor) {
     }
     let parsed;
     try {
-        parsed = JSON.parse(json);
+        // Use limited parse for structural safety (wide/deep cursors).
+        // Cursors are length-capped at 4k so even default limits are very generous here.
+        parsed = safeJsonParseLimited(json, 1000, 20);
     }
     catch {
         throw new BadRequestError("Malformed pagination cursor.");

package/dist/response-cache.js

@@ -39,6 +39,7 @@
  * @module
  * @since 0.37.0
  */
+import { markSchemaValidatedResponse } from "./internal-response.js";
 /** Internal `ctx.state` key carrying the pending cache key between hooks. */
 const PENDING_STATE_KEY = "__responseCachePending";
 /**
@@ -183,7 +184,7 @@ function buildResponseFromCache(entry, outcome, statusHeaderName, isHead) {
     if (statusHeaderName)
         headers.set(statusHeaderName, outcome);
     const body = isHead || entry.body === "" ? null : base64ToBytes(entry.body);
-    return new Response(body, { status: entry.status, headers });
+    return markSchemaValidatedResponse(new Response(body, { status: entry.status, headers }));
 }
 function isPromiseLike(value) {
     return (value !== null &&

package/dist/safe-redirect.d.ts

@@ -31,7 +31,10 @@
  * ```ts
  * import { safeRedirect } from "@daloyjs/core";
  *
- * app.get("/login/callback", (ctx) => {
+ * app.get("/login/callback", {
+ *   acknowledgeNoResponseBodySchema: true,
+ *   responses: { 303: {} },
+ * }, (ctx) => {
  *   const next = new URL(ctx.request.url).searchParams.get("next") ?? "/";
  *   return safeRedirect(next, {
  *     allowedPaths: ["/", "/dashboard", "/account"],

package/dist/safe-redirect.js

@@ -31,7 +31,10 @@
  * ```ts
  * import { safeRedirect } from "@daloyjs/core";
  *
- * app.get("/login/callback", (ctx) => {
+ * app.get("/login/callback", {
+ *   acknowledgeNoResponseBodySchema: true,
+ *   responses: { 303: {} },
+ * }, (ctx) => {
  *   const next = new URL(ctx.request.url).searchParams.get("next") ?? "/";
  *   return safeRedirect(next, {
  *     allowedPaths: ["/", "/dashboard", "/account"],