@daloyjs/core 1.0.0-rc.4 → 1.0.0-rc.6

package/dist/jwt.js

@@ -18,11 +18,7 @@
  * @since 0.21.0
  */
 import { assertTemporalClaims, TemporalClaimError } from "./time-claims.js";
-const SYMMETRIC = new Set([
-    "HS256",
-    "HS384",
-    "HS512",
-]);
+const SYMMETRIC = new Set(["HS256", "HS384", "HS512"]);
 const ASYMMETRIC = new Set([
     "RS256",
     "RS384",
@@ -254,10 +250,14 @@ export function createJwtSigner(opts) {
         opts.key.byteLength < MIN_HS_KEY_BYTES) {
         throw new JwtError("weak_hs_secret", `jwt(): ${alg} secret must be at least ${MIN_HS_KEY_BYTES} bytes (RFC 7518 §3.2); got ${opts.key.byteLength}.`);
     }
-    if (typeof opts.maxLifetimeSeconds !== "number" || !Number.isFinite(opts.maxLifetimeSeconds) || opts.maxLifetimeSeconds <= 0) {
+    if (typeof opts.maxLifetimeSeconds !== "number" ||
+        !Number.isFinite(opts.maxLifetimeSeconds) ||
+        opts.maxLifetimeSeconds <= 0) {
         throw new JwtError("missing_max_lifetime", "jwt(): maxLifetimeSeconds is required and must be a positive number — a token that never expires is wrong in every threat model.");
     }
-    if (opts.acknowledgeNoExp === true && isProductionEnv(opts.env) && opts.secureDefaults !== false) {
+    if (opts.acknowledgeNoExp === true &&
+        isProductionEnv(opts.env) &&
+        opts.secureDefaults !== false) {
         throw new JwtError("ack_no_exp_refused_in_production", "jwt(): acknowledgeNoExp: true is refused in production under secureDefaults — every issued JWT must carry an exp claim.");
     }
     const resolved = (async () => {
@@ -359,18 +359,16 @@ export function createJwtVerifier(opts) {
         allow.add(alg);
     }
     const hasSym = [...allow].some((a) => SYMMETRIC.has(a));
-    if (hasSym &&
-        opts.key instanceof Uint8Array &&
-        opts.key.byteLength < MIN_HS_KEY_BYTES) {
+    if (hasSym && opts.key instanceof Uint8Array && opts.key.byteLength < MIN_HS_KEY_BYTES) {
         throw new JwtError("weak_hs_secret", `jwt(): HS* secret must be at least ${MIN_HS_KEY_BYTES} bytes (RFC 7518 §3.2); got ${opts.key.byteLength}.`);
     }
-    if (hasSym &&
-        opts.refuseSymmetricWithJwk !== false &&
-        looksLikeJwkSource(opts.key)) {
+    if (hasSym && opts.refuseSymmetricWithJwk !== false && looksLikeJwkSource(opts.key)) {
         throw new JwtError("sym_with_jwk_refused", "jwt(): symmetric algorithms (HS*) mixed with a JWK / JWKS key source are refused — this is the documented JWKS confused-deputy attack. Use asymmetric algorithms (RS/PS/ES/EdDSA), or pass refuseSymmetricWithJwk: false to override (not recommended).");
     }
     if (opts.clockSkewSeconds !== undefined) {
-        if (typeof opts.clockSkewSeconds !== "number" || !Number.isFinite(opts.clockSkewSeconds) || opts.clockSkewSeconds < 0) {
+        if (typeof opts.clockSkewSeconds !== "number" ||
+            !Number.isFinite(opts.clockSkewSeconds) ||
+            opts.clockSkewSeconds < 0) {
             throw new JwtError("invalid_clock_skew", "jwt(): clockSkewSeconds must be a non-negative finite number.");
         }
     }

package/dist/logger.d.ts

@@ -133,4 +133,49 @@ export declare function createLogger(opts?: ConsoleLoggerOptions): Logger;
  * @since 0.1.0
  */
 export declare const noopLogger: Logger;
+/**
+ * Query parameter names whose values are redacted when a request URL is
+ * bound into a log record. Case-insensitive. Covers OAuth redirect params,
+ * API keys in query strings, signed-URL tokens, session identifiers, and the
+ * exact-named parameters of AWS SigV4 / GCS V4 presigned URLs (the `x-amz-*`
+ * and `x-goog-*` families are additionally matched by prefix — see
+ * {@link SENSITIVE_URL_QUERY_KEY_PREFIXES}).
+ *
+ * @since 1.0.0
+ */
+export declare const SENSITIVE_URL_QUERY_KEYS: readonly string[];
+/**
+ * Case-insensitive query-key prefixes whose values are always redacted in a
+ * logged URL. Covers the full AWS SigV4 (`X-Amz-*`) and GCS V4 (`X-Goog-*`)
+ * presigned-URL parameter families so a signature never leaks even if a
+ * provider adds a new signed parameter name. Redacting the non-secret members
+ * of the bundle (`X-Amz-Date`, `X-Amz-Expires`, …) is harmless in a log line.
+ *
+ * @since 1.0.0
+ */
+export declare const SENSITIVE_URL_QUERY_KEY_PREFIXES: readonly string[];
+/**
+ * Produce a log-safe form of a request URL.
+ *
+ * Keeps scheme, host, and path for operability. Redacts values of
+ * {@link SENSITIVE_URL_QUERY_KEYS} / {@link SENSITIVE_URL_QUERY_KEY_PREFIXES}
+ * (and JWT-like / credential-like query values) so OAuth `?code=`,
+ * `?access_token=`, and presigned-URL signatures (`?X-Amz-Signature=`,
+ * `?X-Goog-Signature=`) never land in durable error logs under the field name
+ * `url` (which the structured redactor does not rename-match).
+ *
+ * Malformed URLs fall back to the path-only prefix before `?` / `#`.
+ *
+ * This runs once per request on the logging path, so it fast-paths the common
+ * case: a URL with no query, no fragment, and no userinfo (`@`) delimiter is
+ * already log-safe and is returned verbatim without the WHATWG URL parse (about
+ * an order of magnitude cheaper). The `@` guard preserves userinfo stripping
+ * for the rare inputs that carry credentials in the authority — `request.url`
+ * itself never does, but this is a public utility.
+ *
+ * @param url - Absolute or relative request URL (typically `request.url`).
+ * @returns A string safe to attach as a logger binding.
+ * @since 1.0.0
+ */
+export declare function sanitizeUrlForLog(url: string): string;
 export {};

package/dist/logger.js

@@ -34,6 +34,17 @@ export const DEFAULT_REDACT_KEYS = Object.freeze([
     "refresh_token",
     "id_token",
     "client_secret",
+    // A structured field literally named `private_key` is always a secret and
+    // has a negligible false-positive rate as a log-field name (mirrors the
+    // existing `client_secret`). The broader OAuth/session query-string names
+    // (`code`, `state`, `id`, `key`, `sid`, `session`, `signature`, `sig`,
+    // `auth`, …) are DELIBERATELY NOT here: those are extremely common,
+    // non-secret structured field names (record ids, sort keys, UI state) and
+    // redacting them at every depth would corrupt normal operational logs.
+    // Secrets that ride in a *URL query string* are handled instead by
+    // {@link sanitizeUrlForLog} / {@link SENSITIVE_URL_QUERY_KEYS}, which only
+    // applies to the `url` field where the query context makes them sensitive.
+    "private_key",
     // AI / LLM provider credential headers and body fields. Added in response
     // to the LiteLLM 2026 "AI blast radius" incident class (Snyk 2026,
     // CVE-2026-42208 + CVE-2026-33634) — an AI gateway that brokers prompts
@@ -265,3 +276,127 @@ export const noopLogger = {
         return noopLogger;
     },
 };
+/**
+ * Query parameter names whose values are redacted when a request URL is
+ * bound into a log record. Case-insensitive. Covers OAuth redirect params,
+ * API keys in query strings, signed-URL tokens, session identifiers, and the
+ * exact-named parameters of AWS SigV4 / GCS V4 presigned URLs (the `x-amz-*`
+ * and `x-goog-*` families are additionally matched by prefix — see
+ * {@link SENSITIVE_URL_QUERY_KEY_PREFIXES}).
+ *
+ * @since 1.0.0
+ */
+export const SENSITIVE_URL_QUERY_KEYS = Object.freeze([
+    "authorization",
+    "access_token",
+    "refresh_token",
+    "id_token",
+    "token",
+    "api_key",
+    "apikey",
+    "api-key",
+    "key",
+    "password",
+    "passwd",
+    "secret",
+    "client_secret",
+    "code",
+    "state",
+    "session_state",
+    "session",
+    "sid",
+    "signature",
+    "sig",
+    "auth",
+    "private_key",
+    "x-api-key",
+    // AWS SigV4 presigned URL parameters. `X-Amz-Signature` is the secret; the
+    // credential (embeds the access-key id) and session token are equally
+    // sensitive. Also covered by the `x-amz-` prefix below.
+    "x-amz-signature",
+    "x-amz-credential",
+    "x-amz-security-token",
+    // Google Cloud Storage V4 signed URL parameters. Also covered by `x-goog-`.
+    "x-goog-signature",
+    "x-goog-credential",
+    "googleaccessid",
+]);
+/**
+ * Case-insensitive query-key prefixes whose values are always redacted in a
+ * logged URL. Covers the full AWS SigV4 (`X-Amz-*`) and GCS V4 (`X-Goog-*`)
+ * presigned-URL parameter families so a signature never leaks even if a
+ * provider adds a new signed parameter name. Redacting the non-secret members
+ * of the bundle (`X-Amz-Date`, `X-Amz-Expires`, …) is harmless in a log line.
+ *
+ * @since 1.0.0
+ */
+export const SENSITIVE_URL_QUERY_KEY_PREFIXES = Object.freeze([
+    "x-amz-",
+    "x-goog-",
+]);
+const SENSITIVE_URL_QUERY_KEY_SET = new Set(SENSITIVE_URL_QUERY_KEYS.map((k) => k.toLowerCase()));
+/**
+ * Whether a URL query-parameter name is treated as secret-bearing when a
+ * request URL is bound into a log record. True when the lower-cased name is in
+ * {@link SENSITIVE_URL_QUERY_KEYS} or starts with a
+ * {@link SENSITIVE_URL_QUERY_KEY_PREFIXES} entry.
+ *
+ * @param lowerKey - Already-lower-cased query-parameter name.
+ * @returns `true` if the value should be redacted.
+ */
+function isSensitiveUrlQueryKey(lowerKey) {
+    if (SENSITIVE_URL_QUERY_KEY_SET.has(lowerKey))
+        return true;
+    for (const prefix of SENSITIVE_URL_QUERY_KEY_PREFIXES) {
+        if (lowerKey.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
+/**
+ * Produce a log-safe form of a request URL.
+ *
+ * Keeps scheme, host, and path for operability. Redacts values of
+ * {@link SENSITIVE_URL_QUERY_KEYS} / {@link SENSITIVE_URL_QUERY_KEY_PREFIXES}
+ * (and JWT-like / credential-like query values) so OAuth `?code=`,
+ * `?access_token=`, and presigned-URL signatures (`?X-Amz-Signature=`,
+ * `?X-Goog-Signature=`) never land in durable error logs under the field name
+ * `url` (which the structured redactor does not rename-match).
+ *
+ * Malformed URLs fall back to the path-only prefix before `?` / `#`.
+ *
+ * This runs once per request on the logging path, so it fast-paths the common
+ * case: a URL with no query, no fragment, and no userinfo (`@`) delimiter is
+ * already log-safe and is returned verbatim without the WHATWG URL parse (about
+ * an order of magnitude cheaper). The `@` guard preserves userinfo stripping
+ * for the rare inputs that carry credentials in the authority — `request.url`
+ * itself never does, but this is a public utility.
+ *
+ * @param url - Absolute or relative request URL (typically `request.url`).
+ * @returns A string safe to attach as a logger binding.
+ * @since 1.0.0
+ */
+export function sanitizeUrlForLog(url) {
+    if (url.indexOf("?") === -1 && url.indexOf("#") === -1 && url.indexOf("@") === -1) {
+        return url;
+    }
+    try {
+        const parsed = new URL(url);
+        if (parsed.search === "" && parsed.hash === "") {
+            return `${parsed.origin}${parsed.pathname}`;
+        }
+        const safe = new URL(parsed.origin + parsed.pathname);
+        for (const [key, value] of parsed.searchParams) {
+            const lower = key.toLowerCase();
+            const sensitiveKey = isSensitiveUrlQueryKey(lower);
+            const sensitiveValue = JWT_LIKE_RE.test(value) || CREDENTIAL_LIKE_RE.test(value);
+            CREDENTIAL_LIKE_RE.lastIndex = 0;
+            safe.searchParams.append(key, sensitiveKey || sensitiveValue ? "[REDACTED]" : value);
+        }
+        return safe.toString();
+    }
+    catch {
+        const cut = url.search(/[?#]/);
+        return cut === -1 ? url : url.slice(0, cut);
+    }
+}

package/dist/mcp.js

@@ -355,10 +355,16 @@ function compileUriTemplate(template) {
 const LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "[::1]"]);
 /**
  * Streamable HTTP DNS-rebinding defense: decide whether a browser `Origin`
- * may talk to this MCP endpoint. Same-origin and loopback origins are always
- * allowed; anything else must be explicitly allowlisted.
+ * may talk to this MCP endpoint.
+ *
+ * Loopback origins (`localhost` / `127.0.0.1` / `[::1]` / `*.localhost`) are
+ * allowed for local development. Every non-loopback origin must appear in
+ * the configured allowlist. We deliberately do **not** treat
+ * `Origin.host === request Host` as sufficient: under DNS rebinding both
+ * can be the attacker hostname resolving to the target IP, which would
+ * silently bypass an implicit same-origin check.
  */
-function isAllowedOrigin(origin, request, allowlist) {
+function isAllowedOrigin(origin, _request, allowlist) {
     const normalized = origin.toLowerCase();
     if (allowlist.has(normalized))
         return true;
@@ -374,12 +380,7 @@ function isAllowedOrigin(origin, request, allowlist) {
     const hostname = parsed.hostname;
     if (LOOPBACK_HOSTNAMES.has(hostname) || hostname.endsWith(".localhost"))
         return true;
-    try {
-        return parsed.host === new URL(request.url).host;
-    }
-    catch {
-        return false;
-    }
+    return false;
 }
 /**
  * Create a dependency-free MCP Streamable HTTP endpoint handler.

package/dist/middleware.js

@@ -257,6 +257,8 @@ export function secureHeaders(opts = {}) {
         }
     }
     const headerEntries = Object.entries(headers);
+    // Lowercased name set for the common-path fast apply below.
+    const headerKeySet = headerEntries.length > 0 ? new Set(headerEntries.map(([k]) => k)) : null;
     const hooks = {};
     if (cspIsDynamic) {
         hooks.beforeHandle = (ctx) => {
@@ -276,12 +278,40 @@ export function secureHeaders(opts = {}) {
             return undefined;
         };
     }
-    if (headerEntries.length > 0) {
+    if (headerEntries.length > 0 && headerKeySet !== null) {
+        // Apply baseline security headers without overwriting values the handler
+        // (or an earlier hook) already set. Two paths, same accept/reject
+        // semantics:
+        //
+        //  1. Fast path (common): response carries none of our keys (typical
+        //     after serializeResult: content-type + content-length +
+        //     x-request-id only). One cheap forEach over the small response
+        //     header map, then unconditional set of each default — avoids N
+        //     `has()` probes that miss on every request.
+        //  2. Careful path: at least one of our keys is already present; fall
+        //     back to set-if-absent so user-supplied CSP / frame-options / etc.
+        //     still win.
         hooks.onResponse = (res) => {
-            for (const [k, v] of headerEntries) {
-                if (!res.headers.has(k))
+            let conflict = false;
+            // `for...of` over Headers.entries() is faster than the callback-based
+            // forEach and lets us break the instant we find a conflicting header.
+            // WHATWG Headers yields lowercased names, matching headerKeySet.
+            for (const [name] of res.headers) {
+                if (headerKeySet.has(name)) {
+                    conflict = true;
+                    break;
+                }
+            }
+            if (!conflict) {
+                for (const [k, v] of headerEntries)
                     res.headers.set(k, v);
             }
+            else {
+                for (const [k, v] of headerEntries) {
+                    if (!res.headers.has(k))
+                        res.headers.set(k, v);
+                }
+            }
         };
     }
     hooks[SECURE_HEADERS_MARKER] = true;

package/dist/mtls.js

@@ -415,7 +415,12 @@ function certFromHeaders(request, cfg) {
     const sanRaw = readHeader(request, cfg.san);
     const verifyRaw = cfg.verify ? readHeader(request, cfg.verify) : undefined;
     const successValue = (cfg.verifySuccessValue ?? "SUCCESS").toLowerCase();
-    const verified = cfg.verify === undefined ? true : (verifyRaw ?? "").toLowerCase() === successValue;
+    // Without a configured verification header there is no cryptographic proof
+    // the terminator validated the chain. Default to unverified so
+    // requireVerified (default true) rejects spoofed identity-only headers.
+    // Operators that intentionally trust a proxy which only forwards identity
+    // must set requireVerified: false (and keep a strict behindProxy posture).
+    const verified = cfg.verify === undefined ? false : (verifyRaw ?? "").toLowerCase() === successValue;
     const sans = [];
     if (sanRaw) {
         for (const piece of sanRaw.split(",")) {

package/dist/multipart.js

@@ -55,9 +55,7 @@ function isBlobLike(v) {
     if (v == null || typeof v !== "object")
         return false;
     const b = v;
-    return (typeof b.size === "number" &&
-        typeof b.type === "string" &&
-        typeof b.arrayBuffer === "function");
+    return (typeof b.size === "number" && typeof b.type === "string" && typeof b.arrayBuffer === "function");
 }
 function mimeMatches(actual, pattern) {
     const a = actual.toLowerCase();
@@ -137,11 +135,7 @@ function normalizeCustomMagicSignature(value) {
             throw new Error("fileField(): magicBytes.bytes entries must be integers in [0, 255].");
         }
     }
-    const mimes = value.mime === undefined
-        ? []
-        : typeof value.mime === "string"
-            ? [value.mime]
-            : [...value.mime];
+    const mimes = value.mime === undefined ? [] : typeof value.mime === "string" ? [value.mime] : [...value.mime];
     return {
         label: value.label ?? bytes.map((byte) => byte.toString(16).padStart(2, "0")).join(" "),
         mimes,
@@ -186,9 +180,10 @@ function asciiPrefix(bytes) {
         const byte = bytes[i];
         // Keep printable ASCII + common whitespace; replace everything else with
         // a space so keyword searches still work across NULs / UTF-16 padding.
-        out += byte === 0x09 || byte === 0x0a || byte === 0x0d || (byte >= 0x20 && byte <= 0x7e)
-            ? String.fromCharCode(byte)
-            : " ";
+        out +=
+            byte === 0x09 || byte === 0x0a || byte === 0x0d || (byte >= 0x20 && byte <= 0x7e)
+                ? String.fromCharCode(byte)
+                : " ";
     }
     return out.toLowerCase();
 }
@@ -200,7 +195,9 @@ function detectScriptableImagePayload(bytes) {
     }
     // ImageMagick MVG / MSL — vector / scripting formats that can shell out
     // through the `url:`, `ephemeral:`, `msl:` coders (ImageTragick).
-    if (prefix.includes("push graphic-context") || prefix.startsWith("<msl>") || prefix.includes("<image ")) {
+    if (prefix.includes("push graphic-context") ||
+        prefix.startsWith("<msl>") ||
+        prefix.includes("<image ")) {
         return "mvg-or-msl";
     }
     // SVG — XML-based and routinely carries `<script>` / external references.

package/dist/openapi.d.ts

@@ -14,7 +14,7 @@ export { httpBearerScheme, httpBasicScheme, apiKeyScheme, oauth2Scheme, openIdCo
 export type { ApiKeyLocation, ApiKeyScheme, ApiKeySchemeOptions, HttpBasicScheme, HttpBasicSchemeOptions, HttpBearerScheme, HttpBearerSchemeOptions, OAuth2AuthorizationCodeFlow, OAuth2ClientCredentialsFlow, OAuth2Flows, OAuth2ImplicitFlow, OAuth2PasswordFlow, OAuth2Scheme, OAuth2SchemeOptions, OpenIdConnectScheme, OpenIdConnectSchemeOptions, SecurityScheme, } from "./security-schemes.js";
 export { discriminator, discriminatedUnion } from "./discriminator.js";
 export type { DiscriminatorObject, DiscriminatedUnion, DiscriminatedUnionOptions, } from "./discriminator.js";
-export type { CallbackDefinition, CallbackMap, CallbackOperation, } from "./types.js";
+export type { CallbackDefinition, CallbackMap, CallbackOperation } from "./types.js";
 /** OpenAPI [Info Object](https://spec.openapis.org/oas/v3.1.0#info-object) header fields. */
 export interface OpenAPIInfo {
     /** Human-readable API title shown by Swagger UI / Scalar. */

package/dist/openapi.js

@@ -102,8 +102,8 @@ function buildOperation(route, path) {
     const mergedTags = mergeTags(route.tags, meta?.tags);
     const op = {
         ...(route.operationId ? { operationId: route.operationId } : {}),
-        ...(route.summary ?? meta?.summary ? { summary: route.summary ?? meta?.summary } : {}),
-        ...(route.description ?? meta?.description
+        ...((route.summary ?? meta?.summary) ? { summary: route.summary ?? meta?.summary } : {}),
+        ...((route.description ?? meta?.description)
             ? { description: route.description ?? meta?.description }
             : {}),
         ...(mergedTags.length ? { tags: mergedTags } : {}),

package/dist/rate-limit-redis.d.ts

@@ -64,10 +64,10 @@ export interface RedisRateLimitStoreOptions {
      */
     prefix?: string;
     /**
-    * Called when the underlying Redis call throws. The default behavior is
-    * fail-open, which allows the request and reports it as the first hit in a
-    * fresh local window. Override to fail-closed or to wire into your
-    * structured logger.
+     * Called when the underlying Redis call throws. The default behavior is
+     * fail-open, which allows the request and reports it as the first hit in a
+     * fresh local window. Override to fail-closed or to wire into your
+     * structured logger.
      */
     onError?: (err: unknown) => "fail-open" | "fail-closed";
 }