@daloyjs/core 1.0.0-rc.4 → 1.0.0-rc.5

package/dist/security.js

@@ -260,6 +260,11 @@ export const SMUGGLING_SINGLETON_HEADERS = Object.freeze([
  * Throws {@link BadRequestError} so the framework returns a structured
  * `400 problem+json` instead of forwarding a smuggling-class request.
  *
+ * The framework's dispatch path runs this check, the reserved-prefix check,
+ * and the header-count cap in a single shared walk internally (see
+ * {@link assertInboundHeaderGuards}); calling this helper directly is only
+ * needed for custom pipelines.
+ *
  * @param headers - Normalized request headers to inspect.
  * @since 0.15.0
  */
@@ -271,6 +276,13 @@ export function assertNoDuplicateSingletonHeaders(headers) {
         }
     }
 }
+/**
+ * Set view of {@link SMUGGLING_SINGLETON_HEADERS}, built once at module load
+ * so the per-request walk in {@link assertInboundHeaderGuards} pays a Set
+ * lookup instead of three undici `Headers.get()` calls (each of which runs
+ * WebIDL ByteString conversion + header-name token validation).
+ */
+const SMUGGLING_SINGLETON_SET = new Set(SMUGGLING_SINGLETON_HEADERS);
 /**
  * Reserved inbound header namespaces that an external client must never
  * be allowed to set. These prefixes are owned by the framework so that no
@@ -299,6 +311,29 @@ export const RESERVED_INBOUND_HEADER_PREFIXES = Object.freeze([
     "x-daloy-internal-",
     "x-daloyjs-internal-",
 ]);
+/**
+ * Longest common prefix shared by every entry in
+ * {@link RESERVED_INBOUND_HEADER_PREFIXES}, computed once at module load.
+ *
+ * Used by {@link assertInboundHeaderGuards} as a cheap first-pass filter so
+ * the inner prefix loop is skipped for the overwhelming majority of header
+ * names. Because it is *derived* from the list (never hardcoded), adding a
+ * future reserved prefix that diverges simply shrinks this filter — in the
+ * worst case to `""`, where `String.prototype.startsWith("")` is always
+ * `true` and every header falls through to the full prefix scan. The fast
+ * path can therefore never cause a reserved header to be silently accepted.
+ */
+const RESERVED_PREFIX_COMMON = (() => {
+    let common = RESERVED_INBOUND_HEADER_PREFIXES[0] ?? "";
+    for (const prefix of RESERVED_INBOUND_HEADER_PREFIXES) {
+        let i = 0;
+        const max = Math.min(common.length, prefix.length);
+        while (i < max && common.charCodeAt(i) === prefix.charCodeAt(i))
+            i++;
+        common = common.slice(0, i);
+    }
+    return common;
+})();
 /**
  * Reject requests that carry any header in
  * {@link RESERVED_INBOUND_HEADER_PREFIXES}. See that constant for the
@@ -308,6 +343,10 @@ export const RESERVED_INBOUND_HEADER_PREFIXES = Object.freeze([
  * `400 problem+json` instead of routing a request that may be probing
  * for an internal-dispatch bypass.
  *
+ * The framework's dispatch path runs this check and the header-count cap
+ * in a single shared walk internally (see {@link assertInboundHeaderGuards});
+ * calling this helper directly is only needed for custom pipelines.
+ *
  * @param headers - Normalized request headers to inspect (names arrive lowercased).
  * @since 0.36.0
  */
@@ -352,6 +391,11 @@ export const DEFAULT_MAX_HEADER_COUNT = 100;
  * framework returns a structured `problem+json` response instead of routing
  * a flood.
  *
+ * The framework's dispatch path runs this check and the reserved-prefix
+ * check in a single shared walk internally (see
+ * {@link assertInboundHeaderGuards}); calling this helper directly is only
+ * needed for custom pipelines.
+ *
  * @param headers - The incoming request headers.
  * @param limit - Maximum distinct header fields to allow. `0` disables.
  * @since 0.38.0
@@ -370,6 +414,67 @@ export function assertHeaderCountWithinLimit(headers, limit) {
         }
     });
 }
+/**
+ * Combined inbound header guards for the dispatch hot path (internal).
+ *
+ * Runs the singleton-duplicate check ({@link assertNoDuplicateSingletonHeaders}),
+ * the reserved-internal-prefix check ({@link assertNoReservedInternalHeaders}),
+ * and the header-count cap ({@link assertHeaderCountWithinLimit}) in a
+ * **single** walk of the header map, with the same observable semantics as
+ * calling the helpers in sequence: any `400`-class violation (duplicate
+ * singleton header or reserved internal header) anywhere in the map is
+ * rejected with `400` even when the map also exceeds the count cap. To
+ * preserve that precedence, the `431` count-cap rejection is deferred until
+ * the scan has covered every header — the same full-walk cost the
+ * sequential helpers already paid.
+ *
+ * A non-positive / non-finite `limit` disables the count cap (same as
+ * {@link assertHeaderCountWithinLimit}) while still rejecting duplicate
+ * singleton headers and reserved internal prefixes.
+ *
+ * @param headers - Normalized request headers (names arrive lowercased).
+ * @param limit - Maximum distinct header fields to allow. `0` disables the count cap.
+ * @throws {BadRequestError} When a duplicate singleton header or a reserved
+ *   internal header is present (takes precedence over the count cap).
+ * @throws {RequestHeaderFieldsTooLargeError} When no `400`-class violation is
+ *   present and the distinct-header count exceeds `limit`.
+ * @since 1.0.0
+ */
+export function assertInboundHeaderGuards(headers, limit) {
+    const enforceCount = limit > 0 && Number.isFinite(limit);
+    let count = 0;
+    let overLimit = false;
+    // Single forEach: singleton-duplicate rejection + reserved-prefix rejection
+    // + distinct-name count. The 400-class checks throw immediately; the
+    // count-cap rejection is deferred past the walk so a violation after
+    // position `limit` still yields 400 (matching the sequential guards,
+    // where the 400-class scans ran first).
+    headers.forEach((value, name) => {
+        // Smuggling-singleton check: the WHATWG Headers collection coalesces
+        // duplicate fields to a comma-joined value, so "value contains a comma"
+        // means the client sent the header more than once (same semantics as
+        // assertNoDuplicateSingletonHeaders, folded into this walk to avoid
+        // three extra undici Headers.get() calls per request).
+        if (SMUGGLING_SINGLETON_SET.has(name) && value.indexOf(",") !== -1) {
+            throw new BadRequestError(`Duplicate ${name} header rejected`);
+        }
+        // Fast path: skip the inner prefix loop unless the name starts with the
+        // common prefix shared by every reserved prefix (derived at module load
+        // from RESERVED_INBOUND_HEADER_PREFIXES — see RESERVED_PREFIX_COMMON —
+        // so this filter can never silently drop a future reserved prefix).
+        if (name.startsWith(RESERVED_PREFIX_COMMON)) {
+            for (const prefix of RESERVED_INBOUND_HEADER_PREFIXES) {
+                if (name.startsWith(prefix)) {
+                    throw new BadRequestError(`Reserved internal header rejected: ${name}`);
+                }
+            }
+        }
+        if (enforceCount && ++count > limit)
+            overLimit = true;
+    });
+    if (overLimit)
+        throw new RequestHeaderFieldsTooLargeError(limit);
+}
 /**
  * Minimum acceptable secret length in bytes for HMAC / signing material in
  * production (boot guard). Matches the OWASP "Secret Management"
@@ -635,12 +740,8 @@ export async function verifyWebhookSignature(opts) {
         if (Math.abs(nowSeconds - timestamp.seconds) > tolerance)
             return false;
     }
-    const payloadBytes = typeof opts.payload === "string"
-        ? new TextEncoder().encode(opts.payload)
-        : opts.payload;
-    const secretBytes = typeof opts.secret === "string"
-        ? new TextEncoder().encode(opts.secret)
-        : opts.secret;
+    const payloadBytes = typeof opts.payload === "string" ? new TextEncoder().encode(opts.payload) : opts.payload;
+    const secretBytes = typeof opts.secret === "string" ? new TextEncoder().encode(opts.secret) : opts.secret;
     const providedBytes = decodeWebhookSignature(opts.signature, algo.name, algo.signatureBytes);
     if (!providedBytes)
         return false;
@@ -675,12 +776,8 @@ export async function signWebhookPayload(opts) {
             throw new TypeError("signWebhookPayload(): timestamp must be a non-negative integer number of seconds");
         }
     }
-    const payloadBytes = typeof opts.payload === "string"
-        ? new TextEncoder().encode(opts.payload)
-        : opts.payload;
-    const secretBytes = typeof opts.secret === "string"
-        ? new TextEncoder().encode(opts.secret)
-        : opts.secret;
+    const payloadBytes = typeof opts.payload === "string" ? new TextEncoder().encode(opts.payload) : opts.payload;
+    const secretBytes = typeof opts.secret === "string" ? new TextEncoder().encode(opts.secret) : opts.secret;
     const c = globalThis.crypto;
     if (!c?.subtle)
         throw new Error("WebCrypto unavailable: cannot sign webhook payload");
@@ -701,9 +798,28 @@ export async function signWebhookPayload(opts) {
 const CONTROL_CHAR_RE = /[\x00-\x1f\x7f]/g;
 const WINDOWS_RESERVED_CHARS_RE = /[<>:"|?*]/g;
 const WINDOWS_RESERVED_NAMES = new Set([
-    "con", "prn", "aux", "nul",
-    "com1", "com2", "com3", "com4", "com5", "com6", "com7", "com8", "com9",
-    "lpt1", "lpt2", "lpt3", "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9",
+    "con",
+    "prn",
+    "aux",
+    "nul",
+    "com1",
+    "com2",
+    "com3",
+    "com4",
+    "com5",
+    "com6",
+    "com7",
+    "com8",
+    "com9",
+    "lpt1",
+    "lpt2",
+    "lpt3",
+    "lpt4",
+    "lpt5",
+    "lpt6",
+    "lpt7",
+    "lpt8",
+    "lpt9",
 ]);
 /**
  * Return a single-segment, storage-safe basename derived from a

package/dist/session.d.ts

@@ -38,7 +38,13 @@ export declare const SESSION_HOOK_MARKER: unique symbol;
 export declare const SESSION_SECRETS_MARKER: unique symbol;
 /** A persisted session entry as stored by a {@link SessionStore}. */
 export interface SessionRecord {
-    /** Arbitrary serializable session payload. Mutating this object marks the session dirty. */
+    /**
+     * Arbitrary JSON-serializable session payload. Mutating this object (including
+     * nested properties and array elements via the proxy on
+     * `ctx.state.session.data`) marks the session dirty so it is persisted on
+     * the response. Prefer plain objects/arrays/primitives; non-cloneable
+     * values (functions, DOM nodes) are not supported.
+     */
     data: Record<string, unknown>;
     /** Absolute expiration as ms since epoch. */
     expiresAt: number;
@@ -110,7 +116,12 @@ export interface SessionOptions {
 export type SessionContext = {
     /** Current session id. Refreshed by `regenerate()`. */
     readonly id: string;
-    /** Session payload. Mutating this object marks the session dirty. */
+    /**
+     * Session payload. Top-level and nested mutations (including array element
+     * writes) mark the session dirty so {@link SessionStore.set} runs on the
+     * response. Prefer `set`/`delete` for top-level keys when you do not need
+     * nested objects.
+     */
     readonly data: Record<string, unknown>;
     /** Read a single payload key. */
     get<T = unknown>(key: string): T | undefined;

package/dist/session.js

@@ -104,21 +104,106 @@ function sessionCookieAttributes(opts) {
 function markDirty(internal) {
     internal.dirty = true;
 }
-function makeSessionContext(id, data, internal, regenerate) {
-    const proxy = new Proxy(data, {
-        set(target, key, value) {
-            target[key] = value;
-            markDirty(internal);
-            return true;
+/**
+ * Deep-clone a session payload so store load/store never shares nested object
+ * references with the live request-scoped data.
+ *
+ * Prefers {@link structuredClone} (available on every supported runtime:
+ * Node >= 17, Deno, Bun, Workers, Vercel edge). Unlike a JSON round-trip it
+ * preserves `Date`, `Map`, `Set`, typed arrays, `BigInt`, and `undefined`
+ * property values, and it handles cyclic graphs — so a session that legitimately
+ * holds those values is neither silently corrupted (JSON stringifies a `Date`
+ * to a string and drops `undefined`) nor rejected (JSON throws on `BigInt` or a
+ * cycle). Falls back to the JSON round-trip only for the rare value
+ * `structuredClone` cannot copy (e.g. a function), which is unsupported in a
+ * session payload anyway.
+ *
+ * @param value - Session data tree (a plain object).
+ * @returns An independent deep copy.
+ */
+function cloneSessionData(value) {
+    if (typeof structuredClone === "function") {
+        try {
+            return structuredClone(value);
+        }
+        catch {
+            // structuredClone throws on non-cloneable values (functions, symbols);
+            // fall through to the JSON round-trip for best-effort compatibility.
+        }
+    }
+    return JSON.parse(JSON.stringify(value));
+}
+/**
+ * Whether a value should be wrapped by the deep dirty-tracking proxy: only
+ * plain objects and arrays. Exotic objects (`Date`, `Map`, `Set`, `RegExp`,
+ * typed arrays, class instances) are returned unwrapped so methods that rely
+ * on an internal slot as `this` (e.g. `Date.prototype.getTime`) keep working —
+ * a proxy would break them. Reassigning such a value on its parent is still
+ * dirty-tracked; only in-place internal mutation of the exotic value is not.
+ *
+ * @param value - Candidate nested value.
+ * @returns `true` for plain objects / arrays.
+ */
+function isProxyableContainer(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    if (Array.isArray(value))
+        return true;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Recursive proxy that marks the session dirty on any nested set/delete,
+ * including array element assignment. Nested plain objects and arrays returned
+ * from `get` are re-wrapped so mutations deep in the tree are observed.
+ *
+ * Proxies are memoized per underlying target in `cache` (a {@link WeakMap}), so
+ * reading the same nested object twice yields the *same* proxy and object
+ * identity is preserved (`data.user === data.user`). The cache is scoped to a
+ * single session context (one request), so it never leaks across requests and
+ * its keys are collected with their targets.
+ *
+ * @param target - Underlying plain object/array held by the session.
+ * @param onDirty - Invoked on every successful mutation.
+ * @param cache - Per-context target→proxy memo table.
+ * @returns A proxy with the same surface as `target`.
+ */
+function createDeepDirtyProxy(target, onDirty, cache) {
+    const existing = cache.get(target);
+    if (existing)
+        return existing;
+    const proxy = new Proxy(target, {
+        get(t, prop, receiver) {
+            const value = Reflect.get(t, prop, receiver);
+            if (isProxyableContainer(value)) {
+                return createDeepDirtyProxy(value, onDirty, cache);
+            }
+            return value;
         },
-        deleteProperty(target, key) {
-            const had = key in target;
-            delete target[key];
-            if (had)
-                markDirty(internal);
-            return true;
+        set(t, prop, value, receiver) {
+            const ok = Reflect.set(t, prop, value, receiver);
+            if (ok)
+                onDirty();
+            return ok;
+        },
+        deleteProperty(t, prop) {
+            const had = Reflect.has(t, prop);
+            const ok = Reflect.deleteProperty(t, prop);
+            if (ok && had)
+                onDirty();
+            return ok;
         },
     });
+    cache.set(target, proxy);
+    return proxy;
+}
+function makeSessionContext(id, data, internal, regenerate) {
+    const onDirty = () => {
+        markDirty(internal);
+    };
+    // Per-request memo table so nested reads return a stable proxy identity.
+    const proxyCache = new WeakMap();
+    const proxy = createDeepDirtyProxy(data, onDirty, proxyCache);
     let currentId = id;
     return {
         get id() {
@@ -271,6 +356,7 @@ export function session(opts) {
                 destroyed: false,
                 regenerated: false,
                 created: false,
+                rawData: {},
             };
             const raw = readRequestCookie(ctx.request.headers.get("cookie"), cookieName);
             internal.hadCookie = raw !== null;
@@ -287,7 +373,9 @@ export function session(opts) {
                             const rec = await store.get(candidateId);
                             if (rec && rec.expiresAt > Date.now()) {
                                 id = candidateId;
-                                data = rec.data ? { ...rec.data } : {};
+                                // Deep-clone so nested mutations cannot mutate the store's
+                                // retained object graph without going through dirty tracking.
+                                data = rec.data ? cloneSessionData(rec.data) : {};
                             }
                             break;
                         }
@@ -326,6 +414,9 @@ export function session(opts) {
                 internal.originalId = null;
                 return next;
             };
+            // Retain the raw object so onSend can deep-clone it directly.
+            // `regenerate` mutates this same reference, so it stays authoritative.
+            internal.rawData = data;
             const sessionCtx = makeSessionContext(id, data, internal, regenerate);
             const state = ctx.state;
             state[STATE_KEY] = sessionCtx;
@@ -347,8 +438,9 @@ export function session(opts) {
                 }
                 return undefined;
             }
-            const sessionCtx = state[STATE_KEY];
-            const data = sessionCtx.data;
+            // Clone the raw (un-proxied) data: structuredClone rejects a Proxy, and
+            // the proxy writes through to this object so it holds every mutation.
+            const data = internal.rawData;
             const sid = internal.activeId;
             const expiresAt = Date.now() + internal.ttlMs;
             // A brand-new, untouched session is a no-op unless saveUninitialized is on.
@@ -357,13 +449,15 @@ export function session(opts) {
                 return undefined;
             const mustPersist = internal.dirty || internal.created || internal.regenerated;
             if (mustPersist) {
-                await store.set(sid, { data: { ...data }, expiresAt });
+                // Deep-clone so nested mutations persist as an independent tree and
+                // never share references with the store.
+                await store.set(sid, { data: cloneSessionData(data), expiresAt });
             }
             else if (internal.rolling) {
                 if (store.touch)
                     await store.touch(sid, expiresAt);
                 else
-                    await store.set(sid, { data: { ...data }, expiresAt });
+                    await store.set(sid, { data: cloneSessionData(data), expiresAt });
             }
             if (internal.regenerated && internal.originalId && internal.originalId !== sid) {
                 await store.destroy(internal.originalId);

package/dist/time-claims.js

@@ -69,7 +69,9 @@ export function assertTemporalClaims(claims, opts) {
         if (!isFiniteNumber(claims.exp)) {
             throw new TemporalClaimError("invalid_exp", "payload.exp is not a finite number.");
         }
-        if (now > claims.exp + skew) {
+        // RFC 7519 §4.1.4: current time must be *before* exp. At the exact
+        // expiration second (after skew) the token is no longer valid.
+        if (now >= claims.exp + skew) {
             throw new TemporalClaimError("token_expired", "token has expired (exp).");
         }
     }

package/dist/waf.js

@@ -161,6 +161,75 @@ function safeDecode(value) {
         return value;
     }
 }
+/**
+ * Maximum percent-decode passes applied when expanding inspection variants.
+ *
+ * One pass matches what most HTTP stacks hand the handler. A second pass
+ * catches classic double-encoding WAF evasions (`%2527` → `%27` → `'`). A
+ * third is omitted on purpose: deeper recursive decoding inflates false
+ * positives on legitimately percent-bearing text and is not how frameworks
+ * deliver query/path values.
+ */
+const MAX_DECODE_PASSES = 2;
+/**
+ * Expand a single inbound string into the variants the WAF should scan.
+ *
+ * Includes the raw value, up to {@link MAX_DECODE_PASSES} percent-decodes,
+ * a `+`→space form (URLSearchParams parity), and a SQL-comment-stripped
+ * form so comment-split keywords (e.g. OR wrapped in block comments) score
+ * the same as the whitespace-separated form.
+ *
+ * Scanning variants is pure defense-in-depth: the handler still receives
+ * whatever the framework's single-decode path produced. Each variant is
+ * truncated to `maxValueLength` and deduplicated so hostile inputs cannot
+ * explode the scan set.
+ *
+ * @param value - Raw or already-decoded string from path/query/header/body.
+ * @param maxValueLength - Cap applied to every variant before scanning.
+ * @returns Deduplicated inspection variants in stable insertion order.
+ */
+function inspectionVariants(value, maxValueLength) {
+    const seen = new Set();
+    const out = [];
+    const push = (v) => {
+        const truncated = v.length > maxValueLength ? v.slice(0, maxValueLength) : v;
+        if (!seen.has(truncated)) {
+            seen.add(truncated);
+            out.push(truncated);
+        }
+    };
+    let current = value;
+    push(current);
+    for (let i = 0; i < MAX_DECODE_PASSES; i++) {
+        const decoded = safeDecode(current);
+        if (decoded === current)
+            break;
+        push(decoded);
+        current = decoded;
+    }
+    // Snapshot before secondary transforms so we only expand the decode chain.
+    const decodedChain = out.slice();
+    for (const v of decodedChain) {
+        if (v.includes("+"))
+            push(v.replace(/\+/g, " "));
+        if (v.includes("/*"))
+            push(v.replace(/\/\*[\s\S]*?\*\//g, " "));
+    }
+    return out;
+}
+/**
+ * Scan every inspection variant of `value` for the active rule set.
+ *
+ * @see inspectionVariants
+ */
+function scanValueVariants(value, location, rules, scored, maxValueLength) {
+    for (const variant of inspectionVariants(value, maxValueLength)) {
+        scanValue(variant, location, rules, scored);
+        // Early exit once every rule has already fired — no further variants needed.
+        if (scored.size === rules.length)
+            return;
+    }
+}
 /**
  * Collect up to `maxNodes` string values from a parsed body value (object /
  * array / scalar), each truncated to `maxValueLength`. Depth and node count are
@@ -268,37 +337,29 @@ export function waf(opts = {}) {
             const scored = new Map();
             const url = new URL(ctx.request.url);
             if (inspectPath) {
-                scanValue(safeDecode(url.pathname), "path", rules, scored);
+                // Path is scanned across raw + up to two decode passes so double-
+                // encoded traversal / injection tokens in path segments still score.
+                scanValueVariants(url.pathname, "path", rules, scored, maxValueLength);
             }
             if (inspectQuery && url.search.length > 1) {
-                // Scan both the raw query string and a best-effort decoded form so an
-                // encoded payload (`%27%20OR%201=1`) is caught after normalization.
-                // This is a SINGLE decode on purpose: the framework's request path also
-                // decodes the query exactly once, so the WAF sees the same bytes the
-                // handler will. Recursive decoding is deliberately avoided — it would
-                // false-positive on values that legitimately contain percent-encoded
-                // text, and a double-encoded payload stays inert (`%3Cscript%3E`) all
-                // the way to the handler. See red-team-attacks-6 "DOCUMENTED LIMITATION".
+                // Scan the raw query, bounded multi-decode variants, and each
+                // URLSearchParams key/value. Multi-decode (max 2) closes classic
+                // double-encoding WAF evasions (`%2527` → `%27` → `'`) without open-
+                // ended recursive decoding. URLSearchParams also turns `+` into
+                // space; inspectionVariants covers that form so `1+OR+1=1` scores
+                // the same as `1 OR 1=1` (parser-differential defense).
                 const raw = url.search.slice(1);
-                scanValue(raw, "query", rules, scored);
-                const decoded = safeDecode(raw);
-                if (decoded !== raw)
-                    scanValue(decoded, "query", rules, scored);
-                // Additionally inspect each key/value the way the app's OWN query parser
-                // (`URLSearchParams`) decodes them: notably `+` becomes a space, which a
-                // plain `decodeURIComponent` does NOT do. Without this, `1+OR+1=1` slipped
-                // past the WAF while the handler still received `1 OR 1=1` (a parser
-                // differential — the WAF must inspect the bytes the app actually parses).
+                scanValueVariants(raw, "query", rules, scored, maxValueLength);
                 for (const [k, v] of url.searchParams) {
-                    scanValue(k, "query", rules, scored);
-                    scanValue(v, "query", rules, scored);
+                    scanValueVariants(k, "query", rules, scored, maxValueLength);
+                    scanValueVariants(v, "query", rules, scored, maxValueLength);
                 }
             }
             if (headerAllowlist.length > 0) {
                 for (const name of headerAllowlist) {
                     const value = ctx.request.headers.get(name);
                     if (value)
-                        scanValue(value, "header", rules, scored);
+                        scanValueVariants(value, "header", rules, scored, maxValueLength);
                 }
             }
             if (inspectBody && ctx.body !== undefined && ctx.body !== null) {
@@ -316,14 +377,13 @@ export function waf(opts = {}) {
                     });
                 }
                 if (typeof ctx.body === "string") {
-                    scanValue(ctx.body.length > maxValueLength
-                        ? ctx.body.slice(0, maxValueLength)
-                        : ctx.body, "body", rules, scored);
+                    scanValueVariants(ctx.body, "body", rules, scored, maxValueLength);
                 }
                 else if (typeof ctx.body === "object") {
                     const strings = collectBodyStrings(ctx.body, maxBodyNodes, maxValueLength);
-                    for (const value of strings)
-                        scanValue(value, "body", rules, scored);
+                    for (const value of strings) {
+                        scanValueVariants(value, "body", rules, scored, maxValueLength);
+                    }
                 }
             }
             if (scored.size === 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-rc.4",
+  "version": "1.0.0-rc.5",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -236,12 +236,12 @@
     }
   },
   "devDependencies": {
-    "@hey-api/openapi-ts": "^0.99.0",
+    "@hey-api/openapi-ts": "0.0.0-next-20260711024907",
     "@types/node": "^26.0.1",
     "fast-check": "^4.8.0",
     "prettier": "^3.8.3",
     "tsx": "^4.22.3",
-    "typescript": "^6.0.3",
+    "typescript": "^7.0.2",
     "zod": "^4.4.3"
   },
   "scripts": {
@@ -249,9 +249,10 @@
     "dev": "tsc -w -p tsconfig.json",
     "example": "node --import tsx examples/basic.ts",
     "bench": "node --import tsx bench/router.bench.ts",
-    "bench:serverless": "node --import tsx bench/serverless-cold-path.bench.ts",
+    "bench:serverless": "pnpm build && node --import tsx bench/serverless-cold-path.bench.ts",
     "bench:json": "node --import tsx bench/json-body.bench.ts",
     "bench:json-e2e": "node --import tsx bench/json-body-e2e.bench.ts",
+    "bench:ablation": "pnpm build && node --import tsx bench/ablation.bench.ts",
     "test": "node --import tsx --test tests/**/*.test.ts",
     "test:red-team": "node --import tsx --test tests/red-team-attacks.test.ts tests/red-team-attacks-2.test.ts tests/red-team-attacks-3.test.ts tests/red-team-attacks-4.test.ts tests/red-team-attacks-5.test.ts tests/red-team-attacks-6.test.ts tests/red-team-attacks-7.test.ts tests/red-team-attacks-8.test.ts tests/red-team-attacks-9.test.ts tests/red-team-attacks-10.test.ts",
     "red-team:live": "node --import tsx red-team-live/run.ts",