@daloyjs/core 1.0.0-rc.3 → 1.0.0-rc.5

package/dist/security.d.ts

@@ -141,6 +141,11 @@ export declare const SMUGGLING_SINGLETON_HEADERS: readonly string[];
  * Throws {@link BadRequestError} so the framework returns a structured
  * `400 problem+json` instead of forwarding a smuggling-class request.
  *
+ * The framework's dispatch path runs this check, the reserved-prefix check,
+ * and the header-count cap in a single shared walk internally (see
+ * {@link assertInboundHeaderGuards}); calling this helper directly is only
+ * needed for custom pipelines.
+ *
  * @param headers - Normalized request headers to inspect.
  * @since 0.15.0
  */
@@ -179,6 +184,10 @@ export declare const RESERVED_INBOUND_HEADER_PREFIXES: readonly string[];
  * `400 problem+json` instead of routing a request that may be probing
  * for an internal-dispatch bypass.
  *
+ * The framework's dispatch path runs this check and the header-count cap
+ * in a single shared walk internally (see {@link assertInboundHeaderGuards});
+ * calling this helper directly is only needed for custom pipelines.
+ *
  * @param headers - Normalized request headers to inspect (names arrive lowercased).
  * @since 0.36.0
  */
@@ -212,11 +221,43 @@ export declare const DEFAULT_MAX_HEADER_COUNT = 100;
  * framework returns a structured `problem+json` response instead of routing
  * a flood.
  *
+ * The framework's dispatch path runs this check and the reserved-prefix
+ * check in a single shared walk internally (see
+ * {@link assertInboundHeaderGuards}); calling this helper directly is only
+ * needed for custom pipelines.
+ *
  * @param headers - The incoming request headers.
  * @param limit - Maximum distinct header fields to allow. `0` disables.
  * @since 0.38.0
  */
 export declare function assertHeaderCountWithinLimit(headers: Headers, limit: number): void;
+/**
+ * Combined inbound header guards for the dispatch hot path (internal).
+ *
+ * Runs the singleton-duplicate check ({@link assertNoDuplicateSingletonHeaders}),
+ * the reserved-internal-prefix check ({@link assertNoReservedInternalHeaders}),
+ * and the header-count cap ({@link assertHeaderCountWithinLimit}) in a
+ * **single** walk of the header map, with the same observable semantics as
+ * calling the helpers in sequence: any `400`-class violation (duplicate
+ * singleton header or reserved internal header) anywhere in the map is
+ * rejected with `400` even when the map also exceeds the count cap. To
+ * preserve that precedence, the `431` count-cap rejection is deferred until
+ * the scan has covered every header — the same full-walk cost the
+ * sequential helpers already paid.
+ *
+ * A non-positive / non-finite `limit` disables the count cap (same as
+ * {@link assertHeaderCountWithinLimit}) while still rejecting duplicate
+ * singleton headers and reserved internal prefixes.
+ *
+ * @param headers - Normalized request headers (names arrive lowercased).
+ * @param limit - Maximum distinct header fields to allow. `0` disables the count cap.
+ * @throws {BadRequestError} When a duplicate singleton header or a reserved
+ *   internal header is present (takes precedence over the count cap).
+ * @throws {RequestHeaderFieldsTooLargeError} When no `400`-class violation is
+ *   present and the distinct-header count exceeds `limit`.
+ * @since 1.0.0
+ */
+export declare function assertInboundHeaderGuards(headers: Headers, limit: number): void;
 /**
  * Minimum acceptable secret length in bytes for HMAC / signing material in
  * production (boot guard). Matches the OWASP "Secret Management"
@@ -460,3 +501,24 @@ export declare function hasMongoOperatorKeys(value: unknown): boolean;
  * @since 0.35.0
  */
 export declare function assertNoMongoOperators(value: unknown): void;
+/**
+ * Like {@link safeJsonParse}, but additionally enforces structural limits
+ * (total object keys across the tree and maximum nesting depth) to defend
+ * against wide-object / hash-flood and deep-nesting DoS payloads that stay
+ * under the byte cap.
+ *
+ * The limits are checked with a single pre-parse text scan
+ * ({@link assertJsonTextStructure}), so an oversized structure is rejected
+ * *before* it is parsed or allocated. On success the text is handed to
+ * {@link safeJsonParse}, which applies the same prototype-pollution stripping
+ * as every other body parser — so the security posture is identical, only the
+ * structural bounds are added.
+ *
+ * @param text - JSON text. Empty string returns `undefined`.
+ * @param maxKeys - Maximum total object keys (0 or negative = unlimited).
+ * @param maxDepth - Maximum nesting depth (0 or negative = unlimited).
+ * @returns Parsed value (with dangerous keys stripped).
+ * @throws {BadRequestError} on invalid JSON or when limits are exceeded.
+ * @since 1.0.0
+ */
+export declare function safeJsonParseLimited(text: string, maxKeys?: number, maxDepth?: number): unknown;

package/dist/security.js

@@ -260,6 +260,11 @@ export const SMUGGLING_SINGLETON_HEADERS = Object.freeze([
  * Throws {@link BadRequestError} so the framework returns a structured
  * `400 problem+json` instead of forwarding a smuggling-class request.
  *
+ * The framework's dispatch path runs this check, the reserved-prefix check,
+ * and the header-count cap in a single shared walk internally (see
+ * {@link assertInboundHeaderGuards}); calling this helper directly is only
+ * needed for custom pipelines.
+ *
  * @param headers - Normalized request headers to inspect.
  * @since 0.15.0
  */
@@ -271,6 +276,13 @@ export function assertNoDuplicateSingletonHeaders(headers) {
         }
     }
 }
+/**
+ * Set view of {@link SMUGGLING_SINGLETON_HEADERS}, built once at module load
+ * so the per-request walk in {@link assertInboundHeaderGuards} pays a Set
+ * lookup instead of three undici `Headers.get()` calls (each of which runs
+ * WebIDL ByteString conversion + header-name token validation).
+ */
+const SMUGGLING_SINGLETON_SET = new Set(SMUGGLING_SINGLETON_HEADERS);
 /**
  * Reserved inbound header namespaces that an external client must never
  * be allowed to set. These prefixes are owned by the framework so that no
@@ -299,6 +311,29 @@ export const RESERVED_INBOUND_HEADER_PREFIXES = Object.freeze([
     "x-daloy-internal-",
     "x-daloyjs-internal-",
 ]);
+/**
+ * Longest common prefix shared by every entry in
+ * {@link RESERVED_INBOUND_HEADER_PREFIXES}, computed once at module load.
+ *
+ * Used by {@link assertInboundHeaderGuards} as a cheap first-pass filter so
+ * the inner prefix loop is skipped for the overwhelming majority of header
+ * names. Because it is *derived* from the list (never hardcoded), adding a
+ * future reserved prefix that diverges simply shrinks this filter — in the
+ * worst case to `""`, where `String.prototype.startsWith("")` is always
+ * `true` and every header falls through to the full prefix scan. The fast
+ * path can therefore never cause a reserved header to be silently accepted.
+ */
+const RESERVED_PREFIX_COMMON = (() => {
+    let common = RESERVED_INBOUND_HEADER_PREFIXES[0] ?? "";
+    for (const prefix of RESERVED_INBOUND_HEADER_PREFIXES) {
+        let i = 0;
+        const max = Math.min(common.length, prefix.length);
+        while (i < max && common.charCodeAt(i) === prefix.charCodeAt(i))
+            i++;
+        common = common.slice(0, i);
+    }
+    return common;
+})();
 /**
  * Reject requests that carry any header in
  * {@link RESERVED_INBOUND_HEADER_PREFIXES}. See that constant for the
@@ -308,6 +343,10 @@ export const RESERVED_INBOUND_HEADER_PREFIXES = Object.freeze([
  * `400 problem+json` instead of routing a request that may be probing
  * for an internal-dispatch bypass.
  *
+ * The framework's dispatch path runs this check and the header-count cap
+ * in a single shared walk internally (see {@link assertInboundHeaderGuards});
+ * calling this helper directly is only needed for custom pipelines.
+ *
  * @param headers - Normalized request headers to inspect (names arrive lowercased).
  * @since 0.36.0
  */
@@ -352,6 +391,11 @@ export const DEFAULT_MAX_HEADER_COUNT = 100;
  * framework returns a structured `problem+json` response instead of routing
  * a flood.
  *
+ * The framework's dispatch path runs this check and the reserved-prefix
+ * check in a single shared walk internally (see
+ * {@link assertInboundHeaderGuards}); calling this helper directly is only
+ * needed for custom pipelines.
+ *
  * @param headers - The incoming request headers.
  * @param limit - Maximum distinct header fields to allow. `0` disables.
  * @since 0.38.0
@@ -370,6 +414,67 @@ export function assertHeaderCountWithinLimit(headers, limit) {
         }
     });
 }
+/**
+ * Combined inbound header guards for the dispatch hot path (internal).
+ *
+ * Runs the singleton-duplicate check ({@link assertNoDuplicateSingletonHeaders}),
+ * the reserved-internal-prefix check ({@link assertNoReservedInternalHeaders}),
+ * and the header-count cap ({@link assertHeaderCountWithinLimit}) in a
+ * **single** walk of the header map, with the same observable semantics as
+ * calling the helpers in sequence: any `400`-class violation (duplicate
+ * singleton header or reserved internal header) anywhere in the map is
+ * rejected with `400` even when the map also exceeds the count cap. To
+ * preserve that precedence, the `431` count-cap rejection is deferred until
+ * the scan has covered every header — the same full-walk cost the
+ * sequential helpers already paid.
+ *
+ * A non-positive / non-finite `limit` disables the count cap (same as
+ * {@link assertHeaderCountWithinLimit}) while still rejecting duplicate
+ * singleton headers and reserved internal prefixes.
+ *
+ * @param headers - Normalized request headers (names arrive lowercased).
+ * @param limit - Maximum distinct header fields to allow. `0` disables the count cap.
+ * @throws {BadRequestError} When a duplicate singleton header or a reserved
+ *   internal header is present (takes precedence over the count cap).
+ * @throws {RequestHeaderFieldsTooLargeError} When no `400`-class violation is
+ *   present and the distinct-header count exceeds `limit`.
+ * @since 1.0.0
+ */
+export function assertInboundHeaderGuards(headers, limit) {
+    const enforceCount = limit > 0 && Number.isFinite(limit);
+    let count = 0;
+    let overLimit = false;
+    // Single forEach: singleton-duplicate rejection + reserved-prefix rejection
+    // + distinct-name count. The 400-class checks throw immediately; the
+    // count-cap rejection is deferred past the walk so a violation after
+    // position `limit` still yields 400 (matching the sequential guards,
+    // where the 400-class scans ran first).
+    headers.forEach((value, name) => {
+        // Smuggling-singleton check: the WHATWG Headers collection coalesces
+        // duplicate fields to a comma-joined value, so "value contains a comma"
+        // means the client sent the header more than once (same semantics as
+        // assertNoDuplicateSingletonHeaders, folded into this walk to avoid
+        // three extra undici Headers.get() calls per request).
+        if (SMUGGLING_SINGLETON_SET.has(name) && value.indexOf(",") !== -1) {
+            throw new BadRequestError(`Duplicate ${name} header rejected`);
+        }
+        // Fast path: skip the inner prefix loop unless the name starts with the
+        // common prefix shared by every reserved prefix (derived at module load
+        // from RESERVED_INBOUND_HEADER_PREFIXES — see RESERVED_PREFIX_COMMON —
+        // so this filter can never silently drop a future reserved prefix).
+        if (name.startsWith(RESERVED_PREFIX_COMMON)) {
+            for (const prefix of RESERVED_INBOUND_HEADER_PREFIXES) {
+                if (name.startsWith(prefix)) {
+                    throw new BadRequestError(`Reserved internal header rejected: ${name}`);
+                }
+            }
+        }
+        if (enforceCount && ++count > limit)
+            overLimit = true;
+    });
+    if (overLimit)
+        throw new RequestHeaderFieldsTooLargeError(limit);
+}
 /**
  * Minimum acceptable secret length in bytes for HMAC / signing material in
  * production (boot guard). Matches the OWASP "Secret Management"
@@ -635,12 +740,8 @@ export async function verifyWebhookSignature(opts) {
         if (Math.abs(nowSeconds - timestamp.seconds) > tolerance)
             return false;
     }
-    const payloadBytes = typeof opts.payload === "string"
-        ? new TextEncoder().encode(opts.payload)
-        : opts.payload;
-    const secretBytes = typeof opts.secret === "string"
-        ? new TextEncoder().encode(opts.secret)
-        : opts.secret;
+    const payloadBytes = typeof opts.payload === "string" ? new TextEncoder().encode(opts.payload) : opts.payload;
+    const secretBytes = typeof opts.secret === "string" ? new TextEncoder().encode(opts.secret) : opts.secret;
     const providedBytes = decodeWebhookSignature(opts.signature, algo.name, algo.signatureBytes);
     if (!providedBytes)
         return false;
@@ -675,12 +776,8 @@ export async function signWebhookPayload(opts) {
             throw new TypeError("signWebhookPayload(): timestamp must be a non-negative integer number of seconds");
         }
     }
-    const payloadBytes = typeof opts.payload === "string"
-        ? new TextEncoder().encode(opts.payload)
-        : opts.payload;
-    const secretBytes = typeof opts.secret === "string"
-        ? new TextEncoder().encode(opts.secret)
-        : opts.secret;
+    const payloadBytes = typeof opts.payload === "string" ? new TextEncoder().encode(opts.payload) : opts.payload;
+    const secretBytes = typeof opts.secret === "string" ? new TextEncoder().encode(opts.secret) : opts.secret;
     const c = globalThis.crypto;
     if (!c?.subtle)
         throw new Error("WebCrypto unavailable: cannot sign webhook payload");
@@ -701,9 +798,28 @@ export async function signWebhookPayload(opts) {
 const CONTROL_CHAR_RE = /[\x00-\x1f\x7f]/g;
 const WINDOWS_RESERVED_CHARS_RE = /[<>:"|?*]/g;
 const WINDOWS_RESERVED_NAMES = new Set([
-    "con", "prn", "aux", "nul",
-    "com1", "com2", "com3", "com4", "com5", "com6", "com7", "com8", "com9",
-    "lpt1", "lpt2", "lpt3", "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9",
+    "con",
+    "prn",
+    "aux",
+    "nul",
+    "com1",
+    "com2",
+    "com3",
+    "com4",
+    "com5",
+    "com6",
+    "com7",
+    "com8",
+    "com9",
+    "lpt1",
+    "lpt2",
+    "lpt3",
+    "lpt4",
+    "lpt5",
+    "lpt6",
+    "lpt7",
+    "lpt8",
+    "lpt9",
 ]);
 /**
  * Return a single-segment, storage-safe basename derived from a
@@ -876,3 +992,92 @@ export function assertNoMongoOperators(value) {
         throw new BadRequestError("Operator-prefixed key rejected");
     }
 }
+/**
+ * Enforces structural limits by scanning raw JSON *text* in a single
+ * allocation-free pass, before the value is parsed — so a wide-object or
+ * deep-nesting bomb is rejected without ever being materialized into memory.
+ *
+ * Object keys are counted via `:` delimiters that sit outside string literals:
+ * every JSON object member is `"key": value`, and array elements carry no
+ * colon, so the number of structural colons equals the total object-key count
+ * across the whole tree. Nesting depth tracks the running `{`/`[` … `}`/`]`
+ * balance, again ignoring characters inside strings. Both checks short-circuit
+ * the instant a limit is exceeded, giving bounded-time rejection.
+ *
+ * This mirrors the accounting of the older recursive object walk but costs one
+ * tight character loop instead of a second full traversal of the parsed graph,
+ * keeping the common (small-body) path close to a bare `JSON.parse`.
+ *
+ * @param text - The raw JSON text (already known to be non-empty).
+ * @param maxKeys - Maximum total object keys (`<= 0` disables the key check).
+ * @param maxDepth - Maximum nesting depth (`<= 0` disables the depth check).
+ * @throws {BadRequestError} When the key or depth limit is exceeded.
+ * @internal
+ */
+function assertJsonTextStructure(text, maxKeys, maxDepth) {
+    let depth = 0;
+    let keyCount = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < text.length; i++) {
+        const c = text.charCodeAt(i);
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (c === 0x5c /* \ */)
+                escaped = true;
+            else if (c === 0x22 /* " */)
+                inString = false;
+            continue;
+        }
+        switch (c) {
+            case 0x22 /* " */:
+                inString = true;
+                break;
+            case 0x7b /* { */:
+            case 0x5b /* [ */:
+                depth++;
+                if (maxDepth > 0 && depth > maxDepth) {
+                    throw new BadRequestError("JSON exceeds maximum nesting depth");
+                }
+                break;
+            case 0x7d /* } */:
+            case 0x5d /* ] */:
+                depth--;
+                break;
+            case 0x3a /* : */:
+                if (maxKeys > 0 && ++keyCount > maxKeys) {
+                    throw new BadRequestError("JSON exceeds maximum key count");
+                }
+                break;
+        }
+    }
+}
+/**
+ * Like {@link safeJsonParse}, but additionally enforces structural limits
+ * (total object keys across the tree and maximum nesting depth) to defend
+ * against wide-object / hash-flood and deep-nesting DoS payloads that stay
+ * under the byte cap.
+ *
+ * The limits are checked with a single pre-parse text scan
+ * ({@link assertJsonTextStructure}), so an oversized structure is rejected
+ * *before* it is parsed or allocated. On success the text is handed to
+ * {@link safeJsonParse}, which applies the same prototype-pollution stripping
+ * as every other body parser — so the security posture is identical, only the
+ * structural bounds are added.
+ *
+ * @param text - JSON text. Empty string returns `undefined`.
+ * @param maxKeys - Maximum total object keys (0 or negative = unlimited).
+ * @param maxDepth - Maximum nesting depth (0 or negative = unlimited).
+ * @returns Parsed value (with dangerous keys stripped).
+ * @throws {BadRequestError} on invalid JSON or when limits are exceeded.
+ * @since 1.0.0
+ */
+export function safeJsonParseLimited(text, maxKeys = 10_000, maxDepth = 50) {
+    if (text.length === 0)
+        return undefined;
+    if (maxKeys > 0 || maxDepth > 0) {
+        assertJsonTextStructure(text, maxKeys, maxDepth);
+    }
+    return safeJsonParse(text);
+}

package/dist/session.d.ts

@@ -38,7 +38,13 @@ export declare const SESSION_HOOK_MARKER: unique symbol;
 export declare const SESSION_SECRETS_MARKER: unique symbol;
 /** A persisted session entry as stored by a {@link SessionStore}. */
 export interface SessionRecord {
-    /** Arbitrary serializable session payload. Mutating this object marks the session dirty. */
+    /**
+     * Arbitrary JSON-serializable session payload. Mutating this object (including
+     * nested properties and array elements via the proxy on
+     * `ctx.state.session.data`) marks the session dirty so it is persisted on
+     * the response. Prefer plain objects/arrays/primitives; non-cloneable
+     * values (functions, DOM nodes) are not supported.
+     */
     data: Record<string, unknown>;
     /** Absolute expiration as ms since epoch. */
     expiresAt: number;
@@ -110,7 +116,12 @@ export interface SessionOptions {
 export type SessionContext = {
     /** Current session id. Refreshed by `regenerate()`. */
     readonly id: string;
-    /** Session payload. Mutating this object marks the session dirty. */
+    /**
+     * Session payload. Top-level and nested mutations (including array element
+     * writes) mark the session dirty so {@link SessionStore.set} runs on the
+     * response. Prefer `set`/`delete` for top-level keys when you do not need
+     * nested objects.
+     */
     readonly data: Record<string, unknown>;
     /** Read a single payload key. */
     get<T = unknown>(key: string): T | undefined;

package/dist/session.js

@@ -104,21 +104,106 @@ function sessionCookieAttributes(opts) {
 function markDirty(internal) {
     internal.dirty = true;
 }
-function makeSessionContext(id, data, internal, regenerate) {
-    const proxy = new Proxy(data, {
-        set(target, key, value) {
-            target[key] = value;
-            markDirty(internal);
-            return true;
+/**
+ * Deep-clone a session payload so store load/store never shares nested object
+ * references with the live request-scoped data.
+ *
+ * Prefers {@link structuredClone} (available on every supported runtime:
+ * Node >= 17, Deno, Bun, Workers, Vercel edge). Unlike a JSON round-trip it
+ * preserves `Date`, `Map`, `Set`, typed arrays, `BigInt`, and `undefined`
+ * property values, and it handles cyclic graphs — so a session that legitimately
+ * holds those values is neither silently corrupted (JSON stringifies a `Date`
+ * to a string and drops `undefined`) nor rejected (JSON throws on `BigInt` or a
+ * cycle). Falls back to the JSON round-trip only for the rare value
+ * `structuredClone` cannot copy (e.g. a function), which is unsupported in a
+ * session payload anyway.
+ *
+ * @param value - Session data tree (a plain object).
+ * @returns An independent deep copy.
+ */
+function cloneSessionData(value) {
+    if (typeof structuredClone === "function") {
+        try {
+            return structuredClone(value);
+        }
+        catch {
+            // structuredClone throws on non-cloneable values (functions, symbols);
+            // fall through to the JSON round-trip for best-effort compatibility.
+        }
+    }
+    return JSON.parse(JSON.stringify(value));
+}
+/**
+ * Whether a value should be wrapped by the deep dirty-tracking proxy: only
+ * plain objects and arrays. Exotic objects (`Date`, `Map`, `Set`, `RegExp`,
+ * typed arrays, class instances) are returned unwrapped so methods that rely
+ * on an internal slot as `this` (e.g. `Date.prototype.getTime`) keep working —
+ * a proxy would break them. Reassigning such a value on its parent is still
+ * dirty-tracked; only in-place internal mutation of the exotic value is not.
+ *
+ * @param value - Candidate nested value.
+ * @returns `true` for plain objects / arrays.
+ */
+function isProxyableContainer(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    if (Array.isArray(value))
+        return true;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Recursive proxy that marks the session dirty on any nested set/delete,
+ * including array element assignment. Nested plain objects and arrays returned
+ * from `get` are re-wrapped so mutations deep in the tree are observed.
+ *
+ * Proxies are memoized per underlying target in `cache` (a {@link WeakMap}), so
+ * reading the same nested object twice yields the *same* proxy and object
+ * identity is preserved (`data.user === data.user`). The cache is scoped to a
+ * single session context (one request), so it never leaks across requests and
+ * its keys are collected with their targets.
+ *
+ * @param target - Underlying plain object/array held by the session.
+ * @param onDirty - Invoked on every successful mutation.
+ * @param cache - Per-context target→proxy memo table.
+ * @returns A proxy with the same surface as `target`.
+ */
+function createDeepDirtyProxy(target, onDirty, cache) {
+    const existing = cache.get(target);
+    if (existing)
+        return existing;
+    const proxy = new Proxy(target, {
+        get(t, prop, receiver) {
+            const value = Reflect.get(t, prop, receiver);
+            if (isProxyableContainer(value)) {
+                return createDeepDirtyProxy(value, onDirty, cache);
+            }
+            return value;
         },
-        deleteProperty(target, key) {
-            const had = key in target;
-            delete target[key];
-            if (had)
-                markDirty(internal);
-            return true;
+        set(t, prop, value, receiver) {
+            const ok = Reflect.set(t, prop, value, receiver);
+            if (ok)
+                onDirty();
+            return ok;
+        },
+        deleteProperty(t, prop) {
+            const had = Reflect.has(t, prop);
+            const ok = Reflect.deleteProperty(t, prop);
+            if (ok && had)
+                onDirty();
+            return ok;
         },
     });
+    cache.set(target, proxy);
+    return proxy;
+}
+function makeSessionContext(id, data, internal, regenerate) {
+    const onDirty = () => {
+        markDirty(internal);
+    };
+    // Per-request memo table so nested reads return a stable proxy identity.
+    const proxyCache = new WeakMap();
+    const proxy = createDeepDirtyProxy(data, onDirty, proxyCache);
     let currentId = id;
     return {
         get id() {
@@ -271,6 +356,7 @@ export function session(opts) {
                 destroyed: false,
                 regenerated: false,
                 created: false,
+                rawData: {},
             };
             const raw = readRequestCookie(ctx.request.headers.get("cookie"), cookieName);
             internal.hadCookie = raw !== null;
@@ -287,7 +373,9 @@ export function session(opts) {
                             const rec = await store.get(candidateId);
                             if (rec && rec.expiresAt > Date.now()) {
                                 id = candidateId;
-                                data = rec.data ? { ...rec.data } : {};
+                                // Deep-clone so nested mutations cannot mutate the store's
+                                // retained object graph without going through dirty tracking.
+                                data = rec.data ? cloneSessionData(rec.data) : {};
                             }
                             break;
                         }
@@ -326,6 +414,9 @@ export function session(opts) {
                 internal.originalId = null;
                 return next;
             };
+            // Retain the raw object so onSend can deep-clone it directly.
+            // `regenerate` mutates this same reference, so it stays authoritative.
+            internal.rawData = data;
             const sessionCtx = makeSessionContext(id, data, internal, regenerate);
             const state = ctx.state;
             state[STATE_KEY] = sessionCtx;
@@ -347,8 +438,9 @@ export function session(opts) {
                 }
                 return undefined;
             }
-            const sessionCtx = state[STATE_KEY];
-            const data = sessionCtx.data;
+            // Clone the raw (un-proxied) data: structuredClone rejects a Proxy, and
+            // the proxy writes through to this object so it holds every mutation.
+            const data = internal.rawData;
             const sid = internal.activeId;
             const expiresAt = Date.now() + internal.ttlMs;
             // A brand-new, untouched session is a no-op unless saveUninitialized is on.
@@ -357,13 +449,15 @@ export function session(opts) {
                 return undefined;
             const mustPersist = internal.dirty || internal.created || internal.regenerated;
             if (mustPersist) {
-                await store.set(sid, { data: { ...data }, expiresAt });
+                // Deep-clone so nested mutations persist as an independent tree and
+                // never share references with the store.
+                await store.set(sid, { data: cloneSessionData(data), expiresAt });
             }
             else if (internal.rolling) {
                 if (store.touch)
                     await store.touch(sid, expiresAt);
                 else
-                    await store.set(sid, { data: { ...data }, expiresAt });
+                    await store.set(sid, { data: cloneSessionData(data), expiresAt });
             }
             if (internal.regenerated && internal.originalId && internal.originalId !== sid) {
                 await store.destroy(internal.originalId);

package/dist/tenancy.d.ts

@@ -48,7 +48,7 @@
  *
  * @since 0.42.0
  */
-import type { BaseContext, Hooks } from "./types.js";
+import type { BaseContext, Hooks, PreBodyContext } from "./types.js";
 /**
  * Resolves a raw (un-normalized) tenant id from a request, or a nullish value
  * when this strategy cannot determine one. Resolvers are tried in order and
@@ -249,4 +249,4 @@ export interface TenantScopeOptions {
  * @returns A key function suitable for `keyGenerator` / `scope`.
  * @since 0.42.0
  */
-export declare function tenantScope(opts?: TenantScopeOptions): (ctx: BaseContext<any, any>) => string;
+export declare function tenantScope(opts?: TenantScopeOptions): (ctx: BaseContext<any, any> | PreBodyContext<any>) => string;

package/dist/time-claims.js

@@ -69,7 +69,9 @@ export function assertTemporalClaims(claims, opts) {
         if (!isFiniteNumber(claims.exp)) {
             throw new TemporalClaimError("invalid_exp", "payload.exp is not a finite number.");
         }
-        if (now > claims.exp + skew) {
+        // RFC 7519 §4.1.4: current time must be *before* exp. At the exact
+        // expiration second (after skew) the token is no longer valid.
+        if (now >= claims.exp + skew) {
             throw new TemporalClaimError("token_expired", "token has expired (exp).");
         }
     }