@daloyjs/core 1.0.0-rc.3 → 1.0.0-rc.5

package/dist/middleware.js

@@ -31,7 +31,7 @@ export function requestId(opts = {}) {
     const header = (opts.header ?? "x-request-id").toLowerCase();
     const gen = opts.generator ?? randomId;
     return {
-        beforeHandle(ctx) {
+        preBody(ctx) {
             const incoming = opts.trustIncoming ? ctx.request.headers.get(header) : null;
             const id = incoming && /^[A-Za-z0-9._-]{1,200}$/.test(incoming) ? incoming : gen();
             ctx.state.requestId = id;
@@ -257,6 +257,8 @@ export function secureHeaders(opts = {}) {
         }
     }
     const headerEntries = Object.entries(headers);
+    // Lowercased name set for the common-path fast apply below.
+    const headerKeySet = headerEntries.length > 0 ? new Set(headerEntries.map(([k]) => k)) : null;
     const hooks = {};
     if (cspIsDynamic) {
         hooks.beforeHandle = (ctx) => {
@@ -276,12 +278,40 @@ export function secureHeaders(opts = {}) {
             return undefined;
         };
     }
-    if (headerEntries.length > 0) {
+    if (headerEntries.length > 0 && headerKeySet !== null) {
+        // Apply baseline security headers without overwriting values the handler
+        // (or an earlier hook) already set. Two paths, same accept/reject
+        // semantics:
+        //
+        //  1. Fast path (common): response carries none of our keys (typical
+        //     after serializeResult: content-type + content-length +
+        //     x-request-id only). One cheap forEach over the small response
+        //     header map, then unconditional set of each default — avoids N
+        //     `has()` probes that miss on every request.
+        //  2. Careful path: at least one of our keys is already present; fall
+        //     back to set-if-absent so user-supplied CSP / frame-options / etc.
+        //     still win.
         hooks.onResponse = (res) => {
-            for (const [k, v] of headerEntries) {
-                if (!res.headers.has(k))
+            let conflict = false;
+            // `for...of` over Headers.entries() is faster than the callback-based
+            // forEach and lets us break the instant we find a conflicting header.
+            // WHATWG Headers yields lowercased names, matching headerKeySet.
+            for (const [name] of res.headers) {
+                if (headerKeySet.has(name)) {
+                    conflict = true;
+                    break;
+                }
+            }
+            if (!conflict) {
+                for (const [k, v] of headerEntries)
                     res.headers.set(k, v);
             }
+            else {
+                for (const [k, v] of headerEntries) {
+                    if (!res.headers.has(k))
+                        res.headers.set(k, v);
+                }
+            }
         };
     }
     hooks[SECURE_HEADERS_MARKER] = true;
@@ -460,6 +490,51 @@ export const CSRF_HOOK_MARKER = Symbol.for("daloyjs.middleware.csrf");
  * @since 1.0.0
  */
 export const AUTH_HOOK_MARKER = Symbol.for("daloyjs.auth.hook");
+/**
+ * Internal list of request-budget hooks that must run when a later `preBody`
+ * guard rejects. This preserves registration order for `rateLimit()` before
+ * authentication without moving body-aware middleware ahead of validation.
+ *
+ * @internal
+ */
+export const EARLY_REJECTION_HOOK_MARKER = Symbol.for("daloyjs.middleware.earlyRejectionHooks");
+/**
+ * Compose `preBody` hooks while honoring request-budget hooks registered
+ * before the guard that rejects. Used internally by App and hook combinators.
+ *
+ * @param layers - Hook layers in registration order.
+ * @returns A composed `preBody` hook, or `undefined` when no layer has one.
+ * @internal
+ */
+export function _mergePreBodyWithEarlyRejections(layers) {
+    if (!layers.some((hooks) => hooks.preBody !== undefined))
+        return undefined;
+    return async (ctx) => {
+        const pending = [];
+        for (const hooks of layers) {
+            const early = hooks[EARLY_REJECTION_HOOK_MARKER];
+            if (Array.isArray(early)) {
+                for (const candidate of early) {
+                    if (typeof candidate === "function")
+                        pending.push(candidate);
+                }
+            }
+            if (hooks.preBody === undefined)
+                continue;
+            const result = await hooks.preBody(ctx);
+            if (!(result instanceof Response))
+                continue;
+            let response = result;
+            for (const hook of pending) {
+                const replacement = await hook(ctx);
+                if (replacement instanceof Response)
+                    response = replacement;
+            }
+            return response;
+        }
+        return undefined;
+    };
+}
 /**
  * Mark a custom {@link Hooks} bundle as performing request authentication.
  *
@@ -476,7 +551,7 @@ export const AUTH_HOOK_MARKER = Symbol.for("daloyjs.auth.hook");
  * @example
  * ```ts
  * app.use(markAuthHook({
- *   async beforeHandle(ctx) {
+ *   async preBody(ctx) {
  *     if (!(await myVerify(ctx.request))) throw new UnauthorizedError();
  *   },
  * }));
@@ -663,6 +738,11 @@ class MemoryStore {
  * `X-Forwarded-For` / `X-Real-IP` when behind a trusted proxy, or supply a
  * custom `keyGenerator` (e.g. derive from the authenticated user id).
  *
+ * Registration order remains security-significant: a limiter placed before a
+ * `preBody` auth hook counts rejected credentials and can replace the later
+ * `401` with `429`, without consuming the request body. On ordinary accepted
+ * requests it retains the validated `beforeHandle` timing.
+ *
  * @example
  * ```ts
  * import { rateLimit } from "@daloyjs/core";
@@ -704,21 +784,22 @@ export function rateLimit(opts) {
             }
             return "global";
         });
-    return {
-        async beforeHandle(ctx) {
-            const key = `${groupPrefix}${keyOf(ctx)}`;
-            const { count, resetMs } = await store.hit(key, opts.windowMs);
-            const remaining = Math.max(0, opts.max - count);
-            ctx.set.headers.set("x-ratelimit-limit", String(opts.max));
-            ctx.set.headers.set("x-ratelimit-remaining", String(remaining));
-            ctx.set.headers.set("x-ratelimit-reset", String(Math.ceil(resetMs / 1000)));
-            if (count > opts.max) {
-                const retry = Math.ceil((resetMs - Date.now()) / 1000);
-                throw new TooManyRequestsError(opts.retryAfter !== false ? retry : undefined);
-            }
-            return undefined;
-        },
+    const enforce = async (ctx) => {
+        const key = `${groupPrefix}${keyOf(ctx)}`;
+        const { count, resetMs } = await store.hit(key, opts.windowMs);
+        const remaining = Math.max(0, opts.max - count);
+        ctx.set.headers.set("x-ratelimit-limit", String(opts.max));
+        ctx.set.headers.set("x-ratelimit-remaining", String(remaining));
+        ctx.set.headers.set("x-ratelimit-reset", String(Math.ceil(resetMs / 1000)));
+        if (count > opts.max) {
+            const retry = Math.ceil((resetMs - Date.now()) / 1000);
+            throw new TooManyRequestsError(opts.retryAfter !== false ? retry : undefined);
+        }
+        return undefined;
     };
+    const hooks = { beforeHandle: enforce };
+    hooks[EARLY_REJECTION_HOOK_MARKER] = [enforce];
+    return hooks;
 }
 function assertNonNegativeInteger(name, value) {
     if (!Number.isInteger(value) || value < 0) {
@@ -751,6 +832,8 @@ function wait(ms) {
  * Mount the same `loginThrottle()` instance (or multiple instances with the
  * same `groupId`) across related routes so an attacker cannot bypass the limit
  * by rotating between password, OTP, and reset endpoints.
+ * When registered before `preBody` authentication it counts and progressively
+ * delays rejected credentials without consuming a declared request body.
  *
  * @param opts - Throttle tuning (see {@link LoginThrottleOptions}); every field has a safe default.
  * @returns A {@link Hooks} bundle ready for `app.use(...)` or per-route `hooks`.
@@ -784,30 +867,31 @@ export function loginThrottle(opts = {}) {
         slowdownBuckets = new Map();
         SHARED_LOGIN_THROTTLE_BUCKETS.set(groupId, slowdownBuckets);
     }
-    return {
-        async beforeHandle(ctx) {
-            const now = Date.now();
-            const key = `${groupId}:${keyGenerator(ctx)}`;
-            let bucket = slowdownBuckets.get(key);
-            if (!bucket || bucket.resetMs <= now) {
-                bucket = { count: 0, resetMs: now + windowMs };
-                slowdownBuckets.set(key, bucket);
-            }
-            bucket.count += 1;
-            if (slowdownBuckets.size > 10_000) {
-                for (const [bucketKey, value] of slowdownBuckets) {
-                    if (value.resetMs <= now)
-                        slowdownBuckets.delete(bucketKey);
-                }
-            }
-            if (bucket.count > delayAfter && delayMs > 0 && maxDelayMs > 0) {
-                const delay = Math.min(maxDelayMs, (bucket.count - delayAfter) * delayMs);
-                if (delay > 0)
-                    await wait(delay);
+    const enforce = async (ctx) => {
+        const now = Date.now();
+        const key = `${groupId}:${keyGenerator(ctx)}`;
+        let bucket = slowdownBuckets.get(key);
+        if (!bucket || bucket.resetMs <= now) {
+            bucket = { count: 0, resetMs: now + windowMs };
+            slowdownBuckets.set(key, bucket);
+        }
+        bucket.count += 1;
+        if (slowdownBuckets.size > 10_000) {
+            for (const [bucketKey, value] of slowdownBuckets) {
+                if (value.resetMs <= now)
+                    slowdownBuckets.delete(bucketKey);
             }
-            return limiter.beforeHandle?.(ctx);
-        },
+        }
+        if (bucket.count > delayAfter && delayMs > 0 && maxDelayMs > 0) {
+            const delay = Math.min(maxDelayMs, (bucket.count - delayAfter) * delayMs);
+            if (delay > 0)
+                await wait(delay);
+        }
+        return limiter.beforeHandle?.(ctx);
     };
+    const hooks = { beforeHandle: enforce };
+    hooks[EARLY_REJECTION_HOOK_MARKER] = [enforce];
+    return hooks;
 }
 // ---------- Timing ----------
 /**
@@ -851,6 +935,8 @@ export function timing(headerName = "server-timing") {
  * optional `verify` hook is the integration point for revocation
  * lists, token-version counters, and other per-request invalidation checks
  * that `validate` cannot answer statelessly.
+ * Both checks run before request-body I/O; `verify` receives a
+ * {@link PreBodyContext} whose `body` is always `undefined`.
  *
  * @example
  * ```ts
@@ -880,7 +966,7 @@ export function bearerAuth(opts) {
         throw new Error("bearerAuth(): realm must not contain quotes, CR, LF, or NUL bytes.");
     }
     return markAuthHook({
-        async beforeHandle(ctx) {
+        async preBody(ctx) {
             const h = ctx.request.headers.get("authorization") ?? "";
             const m = /^Bearer\s+(.+)$/i.exec(h);
             if (!m) {
@@ -1157,7 +1243,7 @@ export function basicAuth(opts) {
         throw new Error("basicAuth(): maxCredentialBytes must be a positive integer.");
     }
     return markAuthHook({
-        async beforeHandle(ctx) {
+        async preBody(ctx) {
             const header = ctx.request.headers.get("authorization") ?? "";
             const match = BASIC_AUTH_TOKEN_RE.exec(header);
             if (!match || match[1].length > maxBytes)

package/dist/mtls.d.ts

@@ -27,7 +27,7 @@
  * @module
  * @since 0.37.0
  */
-import type { BaseContext, Hooks } from "./types.js";
+import type { Hooks, PreBodyContext } from "./types.js";
 /**
  * Normalized view of a TLS client certificate, independent of how it was
  * obtained (native socket vs. forwarded proxy header). Every field except
@@ -197,9 +197,9 @@ export interface ClientCertAuthOptions {
     /**
      * Override how the certificate is sourced. Defaults to reading whatever the
      * adapter attached via {@link setClientCertificate} (native TLS), falling
-     * back to {@link header} parsing when configured.
+     * back to {@link header} parsing when configured. Runs before body I/O.
      */
-    resolve?: (ctx: BaseContext<any, any>) => ClientCertificate | undefined;
+    resolve?: (ctx: PreBodyContext<any>) => ClientCertificate | undefined;
     /**
      * Read the certificate from a trusted-proxy header instead of (or in
      * addition to) the native adapter source. **Spoofable** unless the app is
@@ -237,9 +237,10 @@ export interface ClientCertAuthOptions {
     checkValidity?: boolean;
     /**
      * Custom per-request check, run after all built-in checks pass. Returning
-     * `false` rejects with `403`; `true`/`undefined` accepts.
+     * `false` rejects with `403`; `true`/`undefined` accepts. The context body is
+     * unavailable because certificate authentication runs before body I/O.
      */
-    verify?: (cert: ClientCertificate, ctx: BaseContext<any, any>) => boolean | void | Promise<boolean | void>;
+    verify?: (cert: ClientCertificate, ctx: PreBodyContext<any>) => boolean | void | Promise<boolean | void>;
     /** Rejection message for the `403` responses. Default: `"Client certificate not permitted"`. */
     message?: string;
     /** `ctx.state` key the accepted certificate is stamped on. Default: `"clientCertificate"`. */

package/dist/mtls.js

@@ -348,7 +348,7 @@ export function clientCertAuth(opts = {}) {
             return undefined;
         });
     const authHooks = {
-        async beforeHandle(ctx) {
+        async preBody(ctx) {
             const cert = resolve(ctx);
             if (!cert) {
                 return new Response(MISSING_CERT_BODY, {
@@ -396,11 +396,7 @@ function assertHeaderConfig(cfg) {
     if (cfg.format === "xfcc")
         return;
     if (cfg.format === "structured") {
-        if (!cfg.subjectDN &&
-            !cfg.fingerprint &&
-            !cfg.san &&
-            !cfg.serialNumber &&
-            !cfg.issuerDN) {
+        if (!cfg.subjectDN && !cfg.fingerprint && !cfg.san && !cfg.serialNumber && !cfg.issuerDN) {
             throw new Error("clientCertAuth(): structured header config must name at least one of subjectDN/issuerDN/fingerprint/serialNumber/san.");
         }
         return;
@@ -419,9 +415,12 @@ function certFromHeaders(request, cfg) {
     const sanRaw = readHeader(request, cfg.san);
     const verifyRaw = cfg.verify ? readHeader(request, cfg.verify) : undefined;
     const successValue = (cfg.verifySuccessValue ?? "SUCCESS").toLowerCase();
-    const verified = cfg.verify === undefined
-        ? true
-        : (verifyRaw ?? "").toLowerCase() === successValue;
+    // Without a configured verification header there is no cryptographic proof
+    // the terminator validated the chain. Default to unverified so
+    // requireVerified (default true) rejects spoofed identity-only headers.
+    // Operators that intentionally trust a proxy which only forwards identity
+    // must set requireVerified: false (and keep a strict behindProxy posture).
+    const verified = cfg.verify === undefined ? false : (verifyRaw ?? "").toLowerCase() === successValue;
     const sans = [];
     if (sanRaw) {
         for (const piece of sanRaw.split(",")) {

package/dist/openapi.js

@@ -208,7 +208,7 @@ function buildOperation(route, path) {
             ? { ...(metaResponseExamples ?? {}), ...(spec.examples ?? {}) }
             : undefined;
         responses[status] = {
-            description: spec.description,
+            description: spec.description ?? `HTTP ${status} response`,
             ...(spec.body
                 ? {
                     content: {

package/dist/pagination.js

@@ -28,6 +28,7 @@
  * @since 0.37.0
  */
 import { BadRequestError } from "./errors.js";
+import { safeJsonParseLimited } from "./security.js";
 import { isForbiddenObjectKey } from "./security.js";
 /**
  * Hard cap on the length of an encoded cursor string accepted by
@@ -91,7 +92,9 @@ export function decodeCursor(cursor) {
     }
     let parsed;
     try {
-        parsed = JSON.parse(json);
+        // Use limited parse for structural safety (wide/deep cursors).
+        // Cursors are length-capped at 4k so even default limits are very generous here.
+        parsed = safeJsonParseLimited(json, 1000, 20);
     }
     catch {
         throw new BadRequestError("Malformed pagination cursor.");

package/dist/response-cache.js

@@ -39,6 +39,7 @@
  * @module
  * @since 0.37.0
  */
+import { markSchemaValidatedResponse } from "./internal-response.js";
 /** Internal `ctx.state` key carrying the pending cache key between hooks. */
 const PENDING_STATE_KEY = "__responseCachePending";
 /**
@@ -183,7 +184,7 @@ function buildResponseFromCache(entry, outcome, statusHeaderName, isHead) {
     if (statusHeaderName)
         headers.set(statusHeaderName, outcome);
     const body = isHead || entry.body === "" ? null : base64ToBytes(entry.body);
-    return new Response(body, { status: entry.status, headers });
+    return markSchemaValidatedResponse(new Response(body, { status: entry.status, headers }));
 }
 function isPromiseLike(value) {
     return (value !== null &&

package/dist/router.d.ts

@@ -2,9 +2,9 @@
  * Trie / radix-style router with a static-route fast path.
  *
  * Performance:
- *   - Static (parameter-free) paths resolve via a single Map.get — O(1).
+ *   - Exact static (parameter-free) paths resolve via a Map lookup — O(1).
  *   - Dynamic paths walk a trie, O(path-segments) regardless of route count.
- *   - Path string is split by `indexOf` rather than a regex/replace.
+ *   - Path normalization and splitting avoid regular expressions.
  *
  * Safety:
  *   - Path traversal (`..`) and empty segments are rejected at lookup time.

package/dist/router.js

@@ -2,9 +2,9 @@
  * Trie / radix-style router with a static-route fast path.
  *
  * Performance:
- *   - Static (parameter-free) paths resolve via a single Map.get — O(1).
+ *   - Exact static (parameter-free) paths resolve via a Map lookup — O(1).
  *   - Dynamic paths walk a trie, O(path-segments) regardless of route count.
- *   - Path string is split by `indexOf` rather than a regex/replace.
+ *   - Path normalization and splitting avoid regular expressions.
  *
  * Safety:
  *   - Path traversal (`..`) and empty segments are rejected at lookup time.
@@ -102,9 +102,12 @@ export class Router {
         if (path.includes("/../") || path.endsWith("/..") || path.includes("//")) {
             return undefined;
         }
-        // Static fast path.
-        const normalized = path.replace(/\/+$/, "") || "/";
-        const staticEntry = this.staticTable.get(normalized);
+        // Static fast path. Avoid allocating a normalized string for the common
+        // exact-path case; only trim when a trailing slash is actually present.
+        let staticEntry = this.staticTable.get(path);
+        if (!staticEntry && path.endsWith("/")) {
+            staticEntry = this.staticTable.get(trimTrailingSlashes(path));
+        }
         if (staticEntry && staticEntry[method]) {
             return { handler: staticEntry[method], params: {} };
         }
@@ -120,8 +123,10 @@ export class Router {
     }
     /** Returns the set of methods registered at this exact path (for 405 responses). */
     allowedMethods(path) {
-        const normalized = path.replace(/\/+$/, "") || "/";
-        const fromStatic = this.staticTable.get(normalized);
+        let fromStatic = this.staticTable.get(path);
+        if (!fromStatic && path.endsWith("/")) {
+            fromStatic = this.staticTable.get(trimTrailingSlashes(path));
+        }
         if (fromStatic)
             return Object.keys(fromStatic);
         const segments = splitPath(path);
@@ -165,6 +170,8 @@ export class Router {
  * than letting a `URIError` bubble up as a generic 500.
  */
 function safeDecodeURIComponent(segment) {
+    if (!segment.includes("%"))
+        return segment;
     try {
         return decodeURIComponent(segment);
     }
@@ -187,9 +194,17 @@ function decodeSegments(segs, index) {
     }
     return parts.join("/");
 }
+function trimTrailingSlashes(path) {
+    if (path.length === 0)
+        return "/";
+    let end = path.length;
+    while (end > 1 && path.charCodeAt(end - 1) === 47)
+        end--;
+    return end === path.length ? path : path.slice(0, end);
+}
 function splitPath(path) {
-    const clean = path.replace(/\/+$/, "") || "/";
+    const clean = trimTrailingSlashes(path);
     if (clean === "/")
         return [];
-    return clean.replace(/^\//, "").split("/");
+    return (clean.charCodeAt(0) === 47 ? clean.slice(1) : clean).split("/");
 }

package/dist/safe-redirect.d.ts

@@ -19,6 +19,10 @@
  *   Percent-encoded protocol-relative path prefixes such as `/%2f%2f`
  *   are also refused so downstream decoders cannot turn a same-origin
  *   `Location` into an origin-escaping redirect.
+ * - Same-origin paths carrying any code point above `U+00FF` are refused:
+ *   they cannot be represented in the ISO-8859-1 `Location` header, and this
+ *   also blocks the Unicode slash homographs (`U+2044` `⁄`, `U+2215` `∕`,
+ *   `U+FF0F` `／`) that `NFKC` normalization can fold into `/`.
  * - Absolute URLs are only allowed when their `origin` exactly matches
  *   one of the entries in `allowedOrigins`.
  * - `javascript:`, `data:`, `vbscript:`, and `file:` schemes are always
@@ -31,7 +35,10 @@
  * ```ts
  * import { safeRedirect } from "@daloyjs/core";
  *
- * app.get("/login/callback", (ctx) => {
+ * app.get("/login/callback", {
+ *   acknowledgeNoResponseBodySchema: true,
+ *   responses: { 303: {} },
+ * }, (ctx) => {
  *   const next = new URL(ctx.request.url).searchParams.get("next") ?? "/";
  *   return safeRedirect(next, {
  *     allowedPaths: ["/", "/dashboard", "/account"],
@@ -44,7 +51,7 @@
  * @since 0.35.0
  */
 /** Reason an open-redirect candidate was refused. */
-export type SafeRedirectBlockReason = "empty-target" | "invalid-control-characters" | "protocol-relative" | "backslash-path" | "path-not-allowed" | "origin-not-allowed" | "scheme-not-allowed" | "parse-failed";
+export type SafeRedirectBlockReason = "empty-target" | "invalid-control-characters" | "non-latin1-target" | "protocol-relative" | "backslash-path" | "path-not-allowed" | "origin-not-allowed" | "scheme-not-allowed" | "parse-failed";
 /** Thrown when {@link safeRedirect} refuses a candidate URL and no `fallback` is configured. */
 export declare class OpenRedirectBlockedError extends Error {
     /** Machine-readable {@link SafeRedirectBlockReason} explaining the refusal. */

package/dist/safe-redirect.js

@@ -19,6 +19,10 @@
  *   Percent-encoded protocol-relative path prefixes such as `/%2f%2f`
  *   are also refused so downstream decoders cannot turn a same-origin
  *   `Location` into an origin-escaping redirect.
+ * - Same-origin paths carrying any code point above `U+00FF` are refused:
+ *   they cannot be represented in the ISO-8859-1 `Location` header, and this
+ *   also blocks the Unicode slash homographs (`U+2044` `⁄`, `U+2215` `∕`,
+ *   `U+FF0F` `／`) that `NFKC` normalization can fold into `/`.
  * - Absolute URLs are only allowed when their `origin` exactly matches
  *   one of the entries in `allowedOrigins`.
  * - `javascript:`, `data:`, `vbscript:`, and `file:` schemes are always
@@ -31,7 +35,10 @@
  * ```ts
  * import { safeRedirect } from "@daloyjs/core";
  *
- * app.get("/login/callback", (ctx) => {
+ * app.get("/login/callback", {
+ *   acknowledgeNoResponseBodySchema: true,
+ *   responses: { 303: {} },
+ * }, (ctx) => {
  *   const next = new URL(ctx.request.url).searchParams.get("next") ?? "/";
  *   return safeRedirect(next, {
  *     allowedPaths: ["/", "/dashboard", "/account"],
@@ -62,6 +69,12 @@ const ALLOWED_REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 // response-splitting via the `Location` header.
 // eslint-disable-next-line no-control-regex
 const CONTROL_CHAR_RE = /[\u0000-\u001f\u007f-\u009f]/;
+// Any code point above U+00FF (outside Latin-1). Such characters cannot be
+// written to a `Location` header — which is serialized as an ISO-8859-1
+// ByteString, so `Headers.set` throws a raw `TypeError` — and they cover the
+// Unicode slash homographs (U+2044, U+2215, U+FF0F) used to smuggle a
+// protocol-relative redirect past a same-origin path check.
+const NON_LATIN1_RE = /[^\x00-\xff]/;
 function buildResponse(location, status, headers) {
     const merged = new Headers(headers);
     merged.set("Location", location);
@@ -94,6 +107,14 @@ function classify(target, allowedPaths, allowedOrigins) {
         // user agents and proxies — refuse them outright.
         if (target.includes("\\"))
             return { ok: false, reason: "backslash-path" };
+        // The path is written verbatim into the `Location` header (an ISO-8859-1
+        // ByteString). A code point above U+00FF cannot live there — `Headers.set`
+        // would throw a raw `TypeError`, escaping this helper's typed error
+        // contract and surfacing to callers as an uncaught 500 — so refuse it here
+        // with a proper `OpenRedirectBlockedError`. This also blocks Unicode slash
+        // homographs that normalization can fold into an origin-escaping `//`.
+        if (NON_LATIN1_RE.test(target))
+            return { ok: false, reason: "non-latin1-target" };
         if (allowedPaths.length === 0) {
             return { ok: false, reason: "path-not-allowed" };
         }
@@ -188,10 +209,14 @@ export function safeRedirect(target, options = {}) {
     if (result.ok)
         return buildResponse(result.location, status, options.headers);
     if (options.fallback !== undefined) {
-        if (!options.fallback.startsWith("/") || options.fallback.startsWith("//")) {
-            throw new TypeError(`safeRedirect: fallback must be a same-origin path starting with "/"; got ${options.fallback}`);
+        // Fallback must pass the same path safety checks as a primary same-origin
+        // target (no protocol-relative, no backslash confusion, no controls).
+        // Do not widen Location emission beyond what classify() would accept.
+        const fallbackResult = classify(options.fallback, ["/*"], []);
+        if (!fallbackResult.ok || !options.fallback.startsWith("/") || options.fallback.startsWith("//")) {
+            throw new TypeError(`safeRedirect: fallback must be a safe same-origin path starting with "/"; got ${options.fallback}`);
         }
-        return buildResponse(options.fallback, status, options.headers);
+        return buildResponse(fallbackResult.location, status, options.headers);
     }
     throw new OpenRedirectBlockedError(result.reason, target);
 }

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:50e7cfc8-73fe-5f9a-96b0-38df20d401b5",
+  "serialNumber": "urn:uuid:4d7ef2ca-7207-5a53-933a-75950561ff0c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-09T19:29:34.036Z",
+    "timestamp": "2026-07-20T09:04:35.490Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-rc.3"
+        "version": "1.0.0-rc.5"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.3",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.5",
       "name": "@daloyjs/core",
-      "version": "1.0.0-rc.3",
+      "version": "1.0.0-rc.5",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.3",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.5",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-rc.3",
+        "tagId": "swidtag--daloyjs-core-1.0.0-rc.5",
         "name": "@daloyjs/core",
-        "version": "1.0.0-rc.3",
+        "version": "1.0.0-rc.5",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.3",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.5",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-rc.3",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.3-50e7cfc8-73fe-5f9a-96b0-38df20d401b5",
+  "name": "@daloyjs/core-1.0.0-rc.5",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.5-4d7ef2ca-7207-5a53-933a-75950561ff0c",
   "creationInfo": {
-    "created": "2026-07-09T19:29:34.036Z",
+    "created": "2026-07-20T09:04:35.490Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-rc.3",
+      "versionInfo": "1.0.0-rc.5",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.3"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.5"
         }
       ]
     }