@daloyjs/core 1.0.0-rc.4 → 1.0.0-rc.6

package/dist/compression.js

@@ -217,6 +217,57 @@ function normalizeOptionTokens(values, optionName) {
     }
     return Object.freeze(normalized);
 }
+/**
+ * Read a response body up to `maxBytes`. Returns `null` if the stream
+ * exceeds the cap (body is cancelled; caller should leave the response
+ * uncompressed). Returns an empty buffer when there is no body.
+ *
+ * @param res - Response whose body will be consumed (pass a clone).
+ * @param maxBytes - Inclusive upper bound on buffered size.
+ */
+async function readBodyUpTo(res, maxBytes) {
+    if (!res.body)
+        return new Uint8Array(0);
+    const reader = res.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        // eslint-disable-next-line no-constant-condition
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value || value.byteLength === 0)
+                continue;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel();
+                return null;
+            }
+            chunks.push(value);
+        }
+    }
+    catch {
+        try {
+            await reader.cancel();
+        }
+        catch {
+            /* ignore */
+        }
+        return null;
+    }
+    if (chunks.length === 0)
+        return new Uint8Array(0);
+    if (chunks.length === 1)
+        return chunks[0];
+    const out = new Uint8Array(total);
+    let offset = 0;
+    for (const c of chunks) {
+        out.set(c, offset);
+        offset += c.byteLength;
+    }
+    return out;
+}
 async function compressBytes(bytes, encoding) {
     const Stream = globalThis.CompressionStream;
     const cs = new Stream(encoding);
@@ -297,6 +348,16 @@ export function compression(opts = {}) {
         minimumSize > 2 ** 31 - 1) {
         throw new TypeError("compression(): `minimumSize` must be a finite non-negative integer.");
     }
+    const maxCompressibleBytes = opts.maxCompressibleBytes === undefined ? 1_048_576 : opts.maxCompressibleBytes;
+    if (!Number.isFinite(maxCompressibleBytes) ||
+        !Number.isInteger(maxCompressibleBytes) ||
+        maxCompressibleBytes <= 0 ||
+        maxCompressibleBytes > 2 ** 31 - 1) {
+        throw new TypeError("compression(): `maxCompressibleBytes` must be a positive integer <= 2**31-1.");
+    }
+    if (minimumSize > maxCompressibleBytes) {
+        throw new TypeError("compression(): `minimumSize` must not exceed `maxCompressibleBytes`.");
+    }
     const serverPreferred = opts.encodings && opts.encodings.length > 0
         ? Object.freeze([...opts.encodings])
         : Object.freeze(["br", "gzip", "deflate"]);
@@ -338,7 +399,17 @@ export function compression(opts = {}) {
             const chosen = pickEncoding(accept, serverPreferred, runtimeSupported);
             if (!chosen)
                 return undefined;
-            const original = new Uint8Array(await res.clone().arrayBuffer());
+            // Fast-path skip when Content-Length already exceeds the compress cap
+            // (avoids buffering a known-huge body just to discard it).
+            const declaredLength = res.headers.get("content-length");
+            if (declaredLength !== null) {
+                const n = Number(declaredLength);
+                if (Number.isFinite(n) && n > maxCompressibleBytes)
+                    return undefined;
+            }
+            const original = await readBodyUpTo(res.clone(), maxCompressibleBytes);
+            if (original === null)
+                return undefined; // exceeded cap while streaming
             if (original.byteLength < minimumSize)
                 return undefined;
             const compressed = await compressBytes(original, chosen);

package/dist/config.js

@@ -24,9 +24,7 @@ export class ConfigValidationError extends Error {
     /** Every validation issue, as `{ key, message }` pairs (`key` is the dotted path, `"<root>"`/`"<source>"` for top-level failures). */
     issues;
     constructor(issues) {
-        const summary = issues
-            .map((i) => `  - ${i.key || "<root>"}: ${i.message}`)
-            .join("\n");
+        const summary = issues.map((i) => `  - ${i.key || "<root>"}: ${i.message}`).join("\n");
         super(`defineConfig(): configuration is invalid (${issues.length} issue${issues.length === 1 ? "" : "s"})\n${summary}`);
         this.name = "ConfigValidationError";
         this.issues = issues;

package/dist/conn-info.d.ts

@@ -67,8 +67,11 @@ interface MutableConnInfo {
 }
 /**
  * @internal Adapter helper — attach {@link ConnInfo} to a `Request`. Called
- * by the Node / Bun / Deno / Cloudflare / Vercel / Lambda adapters before
- * `app.fetch(request)`.
+ * by the Node / Bun / Deno / Lambda adapters before `app.fetch(request)`.
+ * The pure edge delegators (Cloudflare, Vercel, Fastly) expose no peer
+ * socket to attach — on those platforms the client address arrives via
+ * platform-set headers, which are governed by the `behindProxy` /
+ * `trustProxyHeaders` policies instead.
  *
  * @param request - Incoming request to tag (stored under a private symbol).
  * @param info - Connection metadata gathered by the adapter.

package/dist/conn-info.js

@@ -21,8 +21,11 @@
 const CONN_INFO_SYMBOL = Symbol.for("daloyjs.connInfo");
 /**
  * @internal Adapter helper — attach {@link ConnInfo} to a `Request`. Called
- * by the Node / Bun / Deno / Cloudflare / Vercel / Lambda adapters before
- * `app.fetch(request)`.
+ * by the Node / Bun / Deno / Lambda adapters before `app.fetch(request)`.
+ * The pure edge delegators (Cloudflare, Vercel, Fastly) expose no peer
+ * socket to attach — on those platforms the client address arrives via
+ * platform-set headers, which are governed by the `behindProxy` /
+ * `trustProxyHeaders` policies instead.
  *
  * @param request - Incoming request to tag (stored under a private symbol).
  * @param info - Connection metadata gathered by the adapter.

package/dist/errors.d.ts

@@ -364,9 +364,18 @@ export declare class TooManyRequestsError extends HttpError {
 }
 /**
  * `408 Request Timeout` — thrown when a handler exceeds
- * {@link AppOptions.requestTimeoutMs}. The framework aborts the in-flight
- * handler when this fires (handlers should respect the `AbortSignal` on
- * `ctx.request.signal` to clean up).
+ * {@link AppOptions.requestTimeoutMs}.
+ *
+ * When the timeout fires the framework aborts `ctx.request.signal` (with a
+ * `TimeoutError` reason) so a handler that forwarded that signal to downstream
+ * I/O — `fetch`, a DB driver — sees those calls reject and can unwind. It does
+ * **not** forcibly terminate the handler: single-threaded JS cannot preempt
+ * running code, so CPU-bound or non-cooperative work continues in the
+ * background until it observes the aborted signal or finishes. Forward
+ * `ctx.request.signal` into every cancellable downstream call to get the
+ * benefit. (Signal firing is wired on the Node adapter and any runtime whose
+ * request shim honors the abort hook; direct `app.fetch()` callers still get
+ * the `408` but no signal abort.)
  *
  * @param ms - The configured timeout that was exceeded.
  * @since 0.1.0

package/dist/errors.js

@@ -40,9 +40,7 @@ export class MessageLeakError extends Error {
     /** The refused headers, each with its name and the reason it was disallowed. */
     offendingHeaders;
     constructor(offendingHeaders) {
-        const summary = offendingHeaders
-            .map((h) => `${h.name} (${h.reason})`)
-            .join(", ");
+        const summary = offendingHeaders.map((h) => `${h.name} (${h.reason})`).join(", ");
         super(`httpError({ res }): custom error response carries disallowed header(s): ${summary}. ` +
             "Only WWW-Authenticate, Proxy-Authenticate, Retry-After, Content-Type, " +
             "Content-Language, Content-Length, and Cache-Control (no-store|no-cache) " +
@@ -212,8 +210,7 @@ export class HttpError extends Error {
      * @returns A `Response` with `Content-Type: application/problem+json`.
      */
     toResponse(opts = {}) {
-        const isProd = opts.production ??
-            (typeof process !== "undefined" && process.env?.NODE_ENV === "production");
+        const isProd = opts.production ?? (typeof process !== "undefined" && process.env?.NODE_ENV === "production");
         const out = { ...this.problem };
         if (isProd && this.status >= 500) {
             delete out.detail; // do not leak internals
@@ -483,9 +480,18 @@ export class TooManyRequestsError extends HttpError {
 }
 /**
  * `408 Request Timeout` — thrown when a handler exceeds
- * {@link AppOptions.requestTimeoutMs}. The framework aborts the in-flight
- * handler when this fires (handlers should respect the `AbortSignal` on
- * `ctx.request.signal` to clean up).
+ * {@link AppOptions.requestTimeoutMs}.
+ *
+ * When the timeout fires the framework aborts `ctx.request.signal` (with a
+ * `TimeoutError` reason) so a handler that forwarded that signal to downstream
+ * I/O — `fetch`, a DB driver — sees those calls reject and can unwind. It does
+ * **not** forcibly terminate the handler: single-threaded JS cannot preempt
+ * running code, so CPU-bound or non-cooperative work continues in the
+ * background until it observes the aborted signal or finishes. Forward
+ * `ctx.request.signal` into every cancellable downstream call to get the
+ * benefit. (Signal firing is wired on the Node adapter and any runtime whose
+ * request shim honors the abort hook; direct `app.fetch()` callers still get
+ * the `408` but no signal abort.)
  *
  * @param ms - The configured timeout that was exceeded.
  * @since 0.1.0

package/dist/etag.js

@@ -38,7 +38,10 @@ async function sha1Hex(bytes) {
 }
 function inmMatches(headerValue, candidate) {
     // RFC 7232 §3.2: comma-separated list of entity tags or `*`.
-    const list = headerValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    const list = headerValue
+        .split(",")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
     if (list.length === 0)
         return false;
     for (const tag of list) {
@@ -97,7 +100,14 @@ export function etag(opts = {}) {
             const inm = ctx?.request?.headers.get("if-none-match");
             if (inm && inmMatches(inm, value)) {
                 const stripped = new Headers();
-                for (const allow of ["cache-control", "content-location", "date", "etag", "expires", "vary"]) {
+                for (const allow of [
+                    "cache-control",
+                    "content-location",
+                    "date",
+                    "etag",
+                    "expires",
+                    "vary",
+                ]) {
                     const v = headers.get(allow);
                     if (v !== null)
                         stripped.set(allow, v);

package/dist/fetch-guard.d.ts

@@ -54,13 +54,14 @@
  * a `127.0.0.1` / `169.254.169.254` at connect time, slipping past the
  * library-level check. To close the window:
  *
- *  0. **Built-in, `http:` only** (recommended for cloud-metadata defense):
- *     set {@link FetchGuardOptions.pinDns} `: true`. On Node, `http:`
- *     requests are then dispatched through `node:http` with the socket
- *     pinned to the validated IP (and the original `Host` header
- *     preserved), so there is no connect-time re-resolution to rebind.
- *     `https:` is not pinned by this knob — see its docs — so the items
- *     below still matter for TLS upstreams.
+ *  0. **Built-in, `http:` only** (default on Node):
+ *     {@link FetchGuardOptions.pinDns} defaults to `true` on Node-like
+ *     runtimes (and `false` elsewhere). On Node, `http:` requests are
+ *     then dispatched through `node:http` with the socket pinned to the
+ *     validated IP (and the original `Host` header preserved), so there
+ *     is no connect-time re-resolution to rebind. Set `pinDns: false` to
+ *     opt out. `https:` is not pinned by this knob — see its docs — so
+ *     the items below still matter for TLS upstreams.
  *  1. **Operator-side** (recommended): block egress to RFC1918 /
  *     loopback / link-local at the VPC / firewall layer. This neutralises
  *     the rebinding even if the application is naïve.
@@ -93,7 +94,7 @@
  *
  * @since 0.34.0
  */
-export type SsrfBlockReason = "protocol-not-allowed" | "host-not-allowed" | "dns-resolution-failed" | "address-not-allowed" | "too-many-redirects" | "invalid-url";
+export type SsrfBlockReason = "protocol-not-allowed" | "host-not-allowed" | "dns-resolution-failed" | "address-not-allowed" | "too-many-redirects" | "credentials-in-url" | "invalid-url";
 /**
  * Thrown by {@link fetchGuard} when an outbound request is refused. Never
  * thrown for ordinary network failures — those bubble through unchanged
@@ -188,14 +189,20 @@ export interface FetchGuardOptions {
      * by connecting the socket to the exact IP that was validated, instead of
      * letting the underlying client re-resolve the hostname at connect time.
      *
-     * When `true` (default `false`), a request to a hostname that resolves to a
-     * validated address is dispatched through Node's built-in `node:http` with
-     * the connection pinned to that address and the original `Host` header
-     * preserved — so virtual-host routing still works while an attacker's
-     * TTL=0 rebinding to `127.0.0.1` / `169.254.169.254` can no longer take
-     * effect between validation and connect.
+     * When `true`, a request to a hostname that resolves to a validated address
+     * is dispatched through Node's built-in `node:http` with the connection
+     * pinned to that address and the original `Host` header preserved — so
+     * virtual-host routing still works while an attacker's TTL=0 rebinding to
+     * `127.0.0.1` / `169.254.169.254` can no longer take effect between
+     * validation and connect.
      *
-     * **Scope and caveats** (read before enabling):
+     * **Default:** `true` on Node-like runtimes (`process.versions.node` is a
+     * non-empty string), `false` elsewhere (Workers / edge sandboxes without
+     * `node:http`). Pass `pinDns: false` to opt out on Node, or `pinDns: true`
+     * on a non-Node runtime only if you can tolerate the loud error when the
+     * pin path cannot load `node:http`.
+     *
+     * **Scope and caveats** (read before changing the default):
      *
      * - **`http:` only.** `https:` is intentionally NOT pinned here: pinning a
      *   TLS connection to an IP while keeping hostname-based SNI / certificate
@@ -204,16 +211,17 @@ export interface FetchGuardOptions {
      *   the documented TOCTOU caveat. The prime rebinding target — cloud
      *   metadata at `http://169.254.169.254` — is `http:`, so this still closes
      *   the highest-value vector.
-     * - **Node only.** It uses `node:http`; on runtimes without it (Workers,
-     *   some edge sandboxes) an `http:` pinned dispatch throws a clear error so
-     *   the misconfiguration is loud rather than a silent no-op.
+     * - **Node only for the pin path.** It uses `node:http`; when `pinDns` is
+     *   explicitly `true` on a runtime without it, an `http:` pinned dispatch
+     *   throws a clear error so the misconfiguration is loud rather than a
+     *   silent no-op.
      * - **Bypasses `options.fetch`** for the pinned `http:` path (it must own the
      *   socket), and negotiates no response compression (`Accept-Encoding:
      *   identity`) so body semantics match a plain `fetch`.
      *
      * Requests to a literal-IP host or an `allowHosts` entry are never pinned
      * (the former already connects to an exact IP; the latter is an explicit
-     * operator trust). Default `false`.
+     * operator trust).
      *
      * @since 0.44.0
      */

package/dist/fetch-guard.js

@@ -54,13 +54,14 @@
  * a `127.0.0.1` / `169.254.169.254` at connect time, slipping past the
  * library-level check. To close the window:
  *
- *  0. **Built-in, `http:` only** (recommended for cloud-metadata defense):
- *     set {@link FetchGuardOptions.pinDns} `: true`. On Node, `http:`
- *     requests are then dispatched through `node:http` with the socket
- *     pinned to the validated IP (and the original `Host` header
- *     preserved), so there is no connect-time re-resolution to rebind.
- *     `https:` is not pinned by this knob — see its docs — so the items
- *     below still matter for TLS upstreams.
+ *  0. **Built-in, `http:` only** (default on Node):
+ *     {@link FetchGuardOptions.pinDns} defaults to `true` on Node-like
+ *     runtimes (and `false` elsewhere). On Node, `http:` requests are
+ *     then dispatched through `node:http` with the socket pinned to the
+ *     validated IP (and the original `Host` header preserved), so there
+ *     is no connect-time re-resolution to rebind. Set `pinDns: false` to
+ *     opt out. `https:` is not pinned by this knob — see its docs — so
+ *     the items below still matter for TLS upstreams.
  *  1. **Operator-side** (recommended): block egress to RFC1918 /
  *     loopback / link-local at the VPC / firewall layer. This neutralises
  *     the rebinding even if the application is naïve.
@@ -112,6 +113,20 @@ export class SsrfBlockedError extends Error {
             this.address = address;
     }
 }
+/**
+ * Whether this runtime looks like Node (or a Node-compatible host such as Bun)
+ * where `node:http` DNS pinning is available.
+ *
+ * Used as the default for {@link FetchGuardOptions.pinDns} so Node apps get
+ * rebinding defense without an opt-in, while Workers / pure edge runtimes keep
+ * the non-pinning path.
+ */
+function defaultPinDnsEnabled() {
+    return (typeof process !== "undefined" &&
+        process.versions != null &&
+        typeof process.versions.node === "string" &&
+        process.versions.node.length > 0);
+}
 // Always-on deny matchers. No option flips these.
 const ALWAYS_DENY = [
     "0.0.0.0/8", // "this network"
@@ -185,7 +200,11 @@ export function fetchGuard(options = {}) {
         throw new Error("fetchGuard(): no global fetch available; pass options.fetch.");
     }
     const resolveFn = options.resolve ?? createDefaultResolver();
-    const pinDns = options.pinDns === true;
+    // Secure default on Node when using the built-in fetch: pin http: sockets
+    // to the validated IP. A custom `options.fetch` owns its own socket / DNS
+    // policy, so pinDns stays off unless the caller opts in. Non-Node runtimes
+    // default off (no node:http). Opt out on Node with `pinDns: false`.
+    const pinDns = options.pinDns ?? (options.fetch === undefined && defaultPinDnsEnabled());
     for (const c of ALWAYS_DENY)
         hardDenyMatchers.push(compileCidrMatcher(c));
     for (const c of options.denyAddresses ?? [])
@@ -269,6 +288,29 @@ export function fetchGuard(options = {}) {
         return addrs[0];
     }
     const guarded = async (input, init) => {
+        // A URL carrying userinfo (`http://user:pass@internal/`) is a classic SSRF
+        // obfuscation — the real host hides after the `@`. undici's `Request`
+        // constructor refuses such URLs with a raw `TypeError`, which would fire
+        // *before* our host validation and escape the `SsrfBlockedError` contract,
+        // so callers misclassify a blocked SSRF attempt as an ordinary upstream
+        // failure. Detect and refuse it ourselves with a typed error first. The
+        // credentials are stripped from the URL recorded on the error so a
+        // caller-supplied secret never leaks into logs. Malformed URLs fall
+        // through to the handling below, which raises `SsrfBlockedError("invalid-url")`.
+        if (typeof input === "string" || input instanceof URL) {
+            let pre;
+            try {
+                pre = new URL(input);
+            }
+            catch {
+                pre = undefined;
+            }
+            if (pre && (pre.username !== "" || pre.password !== "")) {
+                pre.username = "";
+                pre.password = "";
+                throw new SsrfBlockedError(pre.toString(), "credentials-in-url");
+            }
+        }
         let request = new Request(input, init);
         const userRedirect = (init?.redirect ?? request.redirect);
         // Always dispatch underlying calls with redirect: "manual" so we can

package/dist/geo-block.js

@@ -90,12 +90,10 @@ export function geoBlock(opts) {
     const hasLookup = typeof opts.lookupCountry === "function";
     const hasResolve = typeof opts.resolveCountry === "function";
     if (hasLookup === hasResolve) {
-        throw new Error('geoBlock(): exactly one of "lookupCountry" or "resolveCountry" must ' +
-            "be provided.");
+        throw new Error('geoBlock(): exactly one of "lookupCountry" or "resolveCountry" must ' + "be provided.");
     }
     if (opts.mode !== undefined && opts.mode !== "block" && opts.mode !== "log") {
-        throw new Error(`geoBlock(): invalid mode ${JSON.stringify(opts.mode)}; expected ` +
-            '"block" or "log".');
+        throw new Error(`geoBlock(): invalid mode ${JSON.stringify(opts.mode)}; expected ` + '"block" or "log".');
     }
     const allow = new Set((opts.allow ?? []).map(normalizeConfiguredCode));
     const deny = new Set((opts.deny ?? []).map(normalizeConfiguredCode));
@@ -107,8 +105,7 @@ export function geoBlock(opts) {
     const onBlock = opts.onBlock;
     const lookupCountry = opts.lookupCountry;
     const resolveCountry = opts.resolveCountry;
-    const resolveIp = opts.resolveIp ??
-        (opts.trustProxyHeaders ? forwardedIpResolver : noIpResolver);
+    const resolveIp = opts.resolveIp ?? (opts.trustProxyHeaders ? forwardedIpResolver : noIpResolver);
     return {
         async beforeHandle(ctx) {
             let ip;
@@ -120,9 +117,7 @@ export function geoBlock(opts) {
                 ip = resolveIp(ctx) ?? undefined;
                 rawCountry = ip ? await lookupCountry(ip) : undefined;
             }
-            const country = rawCountry && rawCountry.trim()
-                ? rawCountry.trim().toUpperCase()
-                : undefined;
+            const country = rawCountry && rawCountry.trim() ? rawCountry.trim().toUpperCase() : undefined;
             let reason;
             if (!country) {
                 if (!allowUnknown)

package/dist/hashing.js

@@ -22,7 +22,7 @@
  *
  * @since 0.15.0
  */
-import { randomBytes, scrypt as scryptCb, timingSafeEqual as nodeTimingSafeEqual } from "node:crypto";
+import { randomBytes, scrypt as scryptCb, timingSafeEqual as nodeTimingSafeEqual, } from "node:crypto";
 // OWASP-aligned scrypt parameters (Password Storage Cheat Sheet, 2024).
 const SCRYPT_N = 1 << 17; // 131072
 const SCRYPT_R = 8;

package/dist/http-signatures.d.ts

@@ -229,7 +229,10 @@ export interface VerifyMessageOptions {
     label?: string;
     /**
      * Component identifiers that MUST be covered. Defaults to
-     * `["@method", "@path"]`. Pass `[]` to disable the check (not recommended).
+     * `["@method", "@target-uri"]` so the verifier binds scheme, authority,
+     * path, **and query** (matching {@link signMessage}'s default covered set).
+     * Prefer this over bare `@path`, which leaves query parameters unsigned.
+     * Pass `[]` to disable the check (not recommended).
      */
     requiredComponents?: string[];
     /** Require the `created` parameter. Defaults to `true`. */

package/dist/http-signatures.js

@@ -61,8 +61,7 @@ const ENC = new TextEncoder();
 // WebCrypto + encoding helpers
 // ---------------------------------------------------------------------------
 function getCrypto() {
-    const c = globalThis
-        .crypto;
+    const c = globalThis.crypto;
     if (!c?.subtle) {
         throw new Error("http-signatures: WebCrypto SubtleCrypto API is unavailable on this runtime.");
     }
@@ -181,9 +180,7 @@ async function importKey(alg, material, usage) {
         return c.subtle.importKey("raw", material, spec.importParams, false, [usage]);
     }
     if (isJsonWebKey(material)) {
-        const key = await c.subtle.importKey("jwk", material, spec.importParams, false, [
-            usage,
-        ]);
+        const key = await c.subtle.importKey("jwk", material, spec.importParams, false, [usage]);
         assertRsaModulusFloor(alg, key);
         return key;
     }
@@ -435,6 +432,15 @@ function resolveComponentValue(c, msg) {
                 if (values.length === 0) {
                     throw new ComponentError(`@query-param;name="${c.paramName}" is not present in the query`);
                 }
+                // Reject multi-value params: signing only the first value while an app
+                // or intermediary uses the last value (or the full array) is a classic
+                // HTTP parameter-pollution differential. Prefer `@query` / `@target-uri`
+                // when multiple values are legitimate.
+                if (values.length > 1) {
+                    throw new ComponentError(`@query-param;name="${c.paramName}" appears ${values.length} times; ` +
+                        "duplicate query parameters are not supported (parameter pollution risk). " +
+                        "Cover `@query` or `@target-uri` instead, or send a single value.");
+                }
                 return values[0];
             }
             case "@status":
@@ -631,7 +637,10 @@ export async function verifyMessage(opts) {
         ...(params.tag !== undefined ? { tag: params.tag } : {}),
     };
     // Required components.
-    const requiredComponents = opts.requiredComponents ?? ["@method", "@path"];
+    // Align with signMessage()'s default covered components so a default sign
+    // is accepted by a default verify, and so query/authority cannot be swapped
+    // out under a signature that only bound `@path`.
+    const requiredComponents = opts.requiredComponents ?? ["@method", "@target-uri"];
     const coveredIds = input.components.map(serializeComponentId);
     for (const req of requiredComponents) {
         const wanted = serializeComponentId(parseComponentSpec(req));
@@ -674,9 +683,7 @@ export async function verifyMessage(opts) {
         return fail("key_not_found");
     let keyMaterial;
     let pinnedAlg;
-    if (resolved instanceof Uint8Array ||
-        isCryptoKey(resolved) ||
-        isJsonWebKey(resolved)) {
+    if (resolved instanceof Uint8Array || isCryptoKey(resolved) || isJsonWebKey(resolved)) {
         keyMaterial = resolved;
     }
     else {

package/dist/index.d.ts

@@ -74,7 +74,7 @@ export { defineConfig, ConfigValidationError } from "./config.js";
 export type { ConfigSource, DefineConfigOptions } from "./config.js";
 export type { RequestIdOptions, SecureHeadersOptions, CspDirectivesOptions, CorsOptions, CorsOriginAllow, RateLimitOptions, RateLimitContext, RateLimitStore, LoginThrottleOptions, CsrfOptions, CsrfCookieOptions, FetchMetadataOptions, BasicAuthOptions, } from "./middleware.js";
 export type { BearerAuthOptions, BearerAuthVerifyHook } from "./middleware.js";
-export { createLogger, noopLogger, DEFAULT_REDACT_KEYS } from "./logger.js";
+export { createLogger, noopLogger, DEFAULT_REDACT_KEYS, SENSITIVE_URL_QUERY_KEYS, sanitizeUrlForLog, } from "./logger.js";
 export type { Logger, LogLevel, ConsoleLoggerOptions, LoggerRedactionOptions } from "./logger.js";
 export type { ScalarJsonPrimitive, ScalarJsonValue, ScalarReferenceConfiguration, ScalarTheme, RedocConfiguration, RedocHtmlOptions, SwaggerUiConfiguration, SwaggerUiHtmlOptions, AsyncApiHtmlOptions, DocsAssetOptions, DocsAuthLauncherOptions, } from "./docs.js";
 export { formatStartupBanner, printStartupBanner } from "./banner.js";
@@ -89,7 +89,7 @@ export { session, rotateSession, signValue, verifySignedValue, MemorySessionStor
 export type { SessionOptions, SessionCookieOptions, SessionContext, SessionRecord, SessionStore, SessionState, RotateSessionOptions, } from "./session.js";
 export { idempotency, MemoryIdempotencyStore, _resetSharedIdempotencyStoresForTests, } from "./idempotency.js";
 export type { IdempotencyOptions, IdempotencyStore, IdempotencyRecord, StoredIdempotentResponse, } from "./idempotency.js";
-export { responseCache, MemoryResponseCacheStore, _resetSharedResponseCacheStoresForTests, } from "./response-cache.js";
+export { responseCache, MemoryResponseCacheStore, RESPONSE_CACHE_HOOK_MARKER, _resetSharedResponseCacheStoresForTests, } from "./response-cache.js";
 export type { ResponseCacheOptions, ResponseCacheStore, CachedResponse } from "./response-cache.js";
 export { encodeCursor, decodeCursor, buildLinkHeader, buildPageLinks, paginationQuery, MAX_CURSOR_LENGTH, } from "./pagination.js";
 export type { PaginationLink, PageLinkOptions, PageLinks, PaginationQueryOptions, PaginationParams, PaginationQuerySchema, } from "./pagination.js";
@@ -99,7 +99,7 @@ export { fileField, multipartObject, isFileFieldSchema, isMultipartObjectSchema,
 export type { FileFieldSchema, FileFieldOptions, FileMagicBytesOption, FileMagicBytesSignature, MultipartObjectOptions, MultipartShape, UploadedFile, } from "./multipart.js";
 export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACING_SPAN_STATUS_OK, TRACING_SPAN_STATUS_ERROR, } from "./tracing.js";
 export type { OtelTracingOptions, TracingAttributes, TracingAttributeValue, TracingSpan, TracingStartSpanOptions, TracingTracer, } from "./tracing.js";
-export { tenancy, tenantScope, tenantFromSubdomain, tenantFromHeader, tenantFromPathPrefix, tenantFromClaim, defaultTenantNormalize, } from "./tenancy.js";
+export { tenancy, tenantScope, tenantFromSubdomain, tenantFromHeader, tenantFromPathPrefix, tenantFromClaim, defaultTenantNormalize, TENANCY_HOOK_MARKER, TENANCY_RESOLVED_MARKER, TENANT_UNRESOLVED, } from "./tenancy.js";
 export type { TenancyOptions, TenantResolver, TenantScopeOptions, SubdomainTenantOptions, PathPrefixTenantOptions, ClaimTenantOptions, UnresolvedStatus, InvalidStatus, } from "./tenancy.js";
 export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, checkWebSocketOrigin, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";
 export type { WebSocketConnection, WebSocketContext, WebSocketHandler, WebSocketMeta, WebSocketRouteEntry, NormalizedWebSocketOptions, WebSocketBeforeUpgrade, HandshakeResult, ParsedFrame, MessageEvent as WebSocketMessageEvent, FrameSinkEvents, } from "./websocket.js";

package/dist/index.js

@@ -38,17 +38,17 @@ export { waf } from "./waf.js";
 export { safeRedirect, OpenRedirectBlockedError } from "./safe-redirect.js";
 export { loadShedding, LOAD_SHEDDING_MARKER } from "./load-shedding.js";
 export { defineConfig, ConfigValidationError } from "./config.js";
-export { createLogger, noopLogger, DEFAULT_REDACT_KEYS } from "./logger.js";
+export { createLogger, noopLogger, DEFAULT_REDACT_KEYS, SENSITIVE_URL_QUERY_KEYS, sanitizeUrlForLog, } from "./logger.js";
 export { formatStartupBanner, printStartupBanner } from "./banner.js";
 export { sseStream, sseResponse, ndjsonStream, ndjsonResponse } from "./streaming.js";
 export { httpBearerScheme, httpBasicScheme, apiKeyScheme, oauth2Scheme, openIdConnectScheme, REQUIRE_PAYLOAD_AUTH_EXTENSION, securitySchemeRequiresPayloadAuth, toOpenAPISecurityScheme, } from "./security-schemes.js";
 export { discriminator, discriminatedUnion } from "./discriminator.js";
 export { session, rotateSession, signValue, verifySignedValue, MemorySessionStore, SESSION_HOOK_MARKER, SESSION_SECRETS_MARKER, } from "./session.js";
 export { idempotency, MemoryIdempotencyStore, _resetSharedIdempotencyStoresForTests, } from "./idempotency.js";
-export { responseCache, MemoryResponseCacheStore, _resetSharedResponseCacheStoresForTests, } from "./response-cache.js";
+export { responseCache, MemoryResponseCacheStore, RESPONSE_CACHE_HOOK_MARKER, _resetSharedResponseCacheStoresForTests, } from "./response-cache.js";
 export { encodeCursor, decodeCursor, buildLinkHeader, buildPageLinks, paginationQuery, MAX_CURSOR_LENGTH, } from "./pagination.js";
 export { MetricsRegistry, Counter, Gauge, Histogram, httpMetrics, DEFAULT_DURATION_BUCKETS, PROMETHEUS_CONTENT_TYPE, } from "./metrics.js";
 export { fileField, multipartObject, isFileFieldSchema, isMultipartObjectSchema, } from "./multipart.js";
 export { otelTracing, TRACING_SPAN_KIND_SERVER, TRACING_SPAN_STATUS_UNSET, TRACING_SPAN_STATUS_OK, TRACING_SPAN_STATUS_ERROR, } from "./tracing.js";
-export { tenancy, tenantScope, tenantFromSubdomain, tenantFromHeader, tenantFromPathPrefix, tenantFromClaim, defaultTenantNormalize, } from "./tenancy.js";
+export { tenancy, tenantScope, tenantFromSubdomain, tenantFromHeader, tenantFromPathPrefix, tenantFromClaim, defaultTenantNormalize, TENANCY_HOOK_MARKER, TENANCY_RESOLVED_MARKER, TENANT_UNRESOLVED, } from "./tenancy.js";
 export { defineWebSocket, WebSocketRegistry, WebSocketProtocolError, WebSocketPayloadTooLargeError, WS_GUID, WS_READY_STATE, WS_OPCODE, WS_CLOSE_CODE, WS_MAX_CONTROL_PAYLOAD, DEFAULT_WS_BACKPRESSURE_LIMIT, DEFAULT_WS_MAX_PAYLOAD_LENGTH, DEFAULT_WS_IDLE_TIMEOUT_SECONDS, computeAcceptKey, parseSubprotocols, validateSelectedSubprotocol, validateUpgrade, checkWebSocketOrigin, parseFrame, encodeFrame, encodeClosePayload, decodeClosePayload, encodeSendPayload, normalizeWebSocketOptions, wsRateLimit, FrameSink, FRAME_INCOMPLETE, } from "./websocket.js";

package/dist/ip-reputation.js

@@ -46,7 +46,7 @@
  */
 import { ForbiddenError } from "./errors.js";
 import { fetchGuard } from "./fetch-guard.js";
-import { compileCidrMatcher, matchesMatcher, parseIp, } from "./ip-restriction.js";
+import { compileCidrMatcher, matchesMatcher, parseIp } from "./ip-restriction.js";
 const DEFAULT_REFRESH_MS = 60 * 60_000;
 const DEFAULT_FETCH_TIMEOUT_MS = 30_000;
 const DEFAULT_MESSAGE = "IP address not permitted";

package/dist/ip-restriction.js

@@ -40,8 +40,7 @@ export function ipRestriction(opts) {
     }
     const allow = (opts.allow ?? []).map(compileCidrMatcher);
     const deny = (opts.deny ?? []).map(compileCidrMatcher);
-    const resolveIp = opts.resolveIp ??
-        (opts.trustProxyHeaders ? forwardedIpResolver : noIpResolver);
+    const resolveIp = opts.resolveIp ?? (opts.trustProxyHeaders ? forwardedIpResolver : noIpResolver);
     const message = opts.message ?? "IP address not permitted";
     return {
         beforeHandle(ctx) {
@@ -200,11 +199,7 @@ function parseIPv6(input) {
             return undefined;
         const hi = (v4.bytes[0] << 8) | v4.bytes[1];
         const lo = (v4.bytes[2] << 8) | v4.bytes[3];
-        working =
-            working.slice(0, lastColon + 1) +
-                hi.toString(16) +
-                ":" +
-                lo.toString(16);
+        working = working.slice(0, lastColon + 1) + hi.toString(16) + ":" + lo.toString(16);
     }
     const parts = working.split("::");
     if (parts.length > 2)
@@ -217,11 +212,7 @@ function parseIPv6(input) {
     if (parts.length === 1 && explicit !== 8)
         return undefined;
     const missing = parts.length === 2 ? 8 - explicit : 0;
-    const groups = [
-        ...headGroups,
-        ...Array.from({ length: missing }, () => "0"),
-        ...tailGroups,
-    ];
+    const groups = [...headGroups, ...Array.from({ length: missing }, () => "0"), ...tailGroups];
     if (groups.length !== 8)
         return undefined;
     const bytes = new Uint8Array(16);