@daloyjs/core 1.0.0-rc.4 → 1.0.0-rc.6

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6aa5f3fd-e017-5e4a-b206-49dc6d141768",
+  "serialNumber": "urn:uuid:1fe1844d-d5f6-5dd3-b35a-8f79f17a35f5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-12T20:39:15.454Z",
+    "timestamp": "2026-07-26T17:41:07.733Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-rc.4"
+        "version": "1.0.0-rc.6"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.4",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.6",
       "name": "@daloyjs/core",
-      "version": "1.0.0-rc.4",
+      "version": "1.0.0-rc.6",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.4",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.6",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-rc.4",
+        "tagId": "swidtag--daloyjs-core-1.0.0-rc.6",
         "name": "@daloyjs/core",
-        "version": "1.0.0-rc.4",
+        "version": "1.0.0-rc.6",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.4",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.6",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-rc.4",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.4-6aa5f3fd-e017-5e4a-b206-49dc6d141768",
+  "name": "@daloyjs/core-1.0.0-rc.6",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.6-1fe1844d-d5f6-5dd3-b35a-8f79f17a35f5",
   "creationInfo": {
-    "created": "2026-07-12T20:39:15.454Z",
+    "created": "2026-07-26T17:41:07.733Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-rc.4",
+      "versionInfo": "1.0.0-rc.6",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.4"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.6"
         }
       ]
     }

package/dist/security-schemes.js

@@ -28,8 +28,7 @@ export function securitySchemeRequiresPayloadAuth(scheme) {
     if (!scheme || typeof scheme !== "object")
         return false;
     const record = scheme;
-    return (record[REQUIRE_PAYLOAD_AUTH_EXTENSION] === true ||
-        record.requirePayloadAuth === true);
+    return record[REQUIRE_PAYLOAD_AUTH_EXTENSION] === true || record.requirePayloadAuth === true;
 }
 /**
  * Normalize a builder output into a spec-compliant OpenAPI security scheme by

package/dist/security.d.ts

@@ -141,6 +141,11 @@ export declare const SMUGGLING_SINGLETON_HEADERS: readonly string[];
  * Throws {@link BadRequestError} so the framework returns a structured
  * `400 problem+json` instead of forwarding a smuggling-class request.
  *
+ * The framework's dispatch path runs this check, the reserved-prefix check,
+ * and the header-count cap in a single shared walk internally (see
+ * {@link assertInboundHeaderGuards}); calling this helper directly is only
+ * needed for custom pipelines.
+ *
  * @param headers - Normalized request headers to inspect.
  * @since 0.15.0
  */
@@ -179,6 +184,10 @@ export declare const RESERVED_INBOUND_HEADER_PREFIXES: readonly string[];
  * `400 problem+json` instead of routing a request that may be probing
  * for an internal-dispatch bypass.
  *
+ * The framework's dispatch path runs this check and the header-count cap
+ * in a single shared walk internally (see {@link assertInboundHeaderGuards});
+ * calling this helper directly is only needed for custom pipelines.
+ *
  * @param headers - Normalized request headers to inspect (names arrive lowercased).
  * @since 0.36.0
  */
@@ -212,11 +221,43 @@ export declare const DEFAULT_MAX_HEADER_COUNT = 100;
  * framework returns a structured `problem+json` response instead of routing
  * a flood.
  *
+ * The framework's dispatch path runs this check and the reserved-prefix
+ * check in a single shared walk internally (see
+ * {@link assertInboundHeaderGuards}); calling this helper directly is only
+ * needed for custom pipelines.
+ *
  * @param headers - The incoming request headers.
  * @param limit - Maximum distinct header fields to allow. `0` disables.
  * @since 0.38.0
  */
 export declare function assertHeaderCountWithinLimit(headers: Headers, limit: number): void;
+/**
+ * Combined inbound header guards for the dispatch hot path (internal).
+ *
+ * Runs the singleton-duplicate check ({@link assertNoDuplicateSingletonHeaders}),
+ * the reserved-internal-prefix check ({@link assertNoReservedInternalHeaders}),
+ * and the header-count cap ({@link assertHeaderCountWithinLimit}) in a
+ * **single** walk of the header map, with the same observable semantics as
+ * calling the helpers in sequence: any `400`-class violation (duplicate
+ * singleton header or reserved internal header) anywhere in the map is
+ * rejected with `400` even when the map also exceeds the count cap. To
+ * preserve that precedence, the `431` count-cap rejection is deferred until
+ * the scan has covered every header — the same full-walk cost the
+ * sequential helpers already paid.
+ *
+ * A non-positive / non-finite `limit` disables the count cap (same as
+ * {@link assertHeaderCountWithinLimit}) while still rejecting duplicate
+ * singleton headers and reserved internal prefixes.
+ *
+ * @param headers - Normalized request headers (names arrive lowercased).
+ * @param limit - Maximum distinct header fields to allow. `0` disables the count cap.
+ * @throws {BadRequestError} When a duplicate singleton header or a reserved
+ *   internal header is present (takes precedence over the count cap).
+ * @throws {RequestHeaderFieldsTooLargeError} When no `400`-class violation is
+ *   present and the distinct-header count exceeds `limit`.
+ * @since 1.0.0
+ */
+export declare function assertInboundHeaderGuards(headers: Headers, limit: number): void;
 /**
  * Minimum acceptable secret length in bytes for HMAC / signing material in
  * production (boot guard). Matches the OWASP "Secret Management"

package/dist/security.js

@@ -260,6 +260,11 @@ export const SMUGGLING_SINGLETON_HEADERS = Object.freeze([
  * Throws {@link BadRequestError} so the framework returns a structured
  * `400 problem+json` instead of forwarding a smuggling-class request.
  *
+ * The framework's dispatch path runs this check, the reserved-prefix check,
+ * and the header-count cap in a single shared walk internally (see
+ * {@link assertInboundHeaderGuards}); calling this helper directly is only
+ * needed for custom pipelines.
+ *
  * @param headers - Normalized request headers to inspect.
  * @since 0.15.0
  */
@@ -271,6 +276,13 @@ export function assertNoDuplicateSingletonHeaders(headers) {
         }
     }
 }
+/**
+ * Set view of {@link SMUGGLING_SINGLETON_HEADERS}, built once at module load
+ * so the per-request walk in {@link assertInboundHeaderGuards} pays a Set
+ * lookup instead of three undici `Headers.get()` calls (each of which runs
+ * WebIDL ByteString conversion + header-name token validation).
+ */
+const SMUGGLING_SINGLETON_SET = new Set(SMUGGLING_SINGLETON_HEADERS);
 /**
  * Reserved inbound header namespaces that an external client must never
  * be allowed to set. These prefixes are owned by the framework so that no
@@ -299,6 +311,29 @@ export const RESERVED_INBOUND_HEADER_PREFIXES = Object.freeze([
     "x-daloy-internal-",
     "x-daloyjs-internal-",
 ]);
+/**
+ * Longest common prefix shared by every entry in
+ * {@link RESERVED_INBOUND_HEADER_PREFIXES}, computed once at module load.
+ *
+ * Used by {@link assertInboundHeaderGuards} as a cheap first-pass filter so
+ * the inner prefix loop is skipped for the overwhelming majority of header
+ * names. Because it is *derived* from the list (never hardcoded), adding a
+ * future reserved prefix that diverges simply shrinks this filter — in the
+ * worst case to `""`, where `String.prototype.startsWith("")` is always
+ * `true` and every header falls through to the full prefix scan. The fast
+ * path can therefore never cause a reserved header to be silently accepted.
+ */
+const RESERVED_PREFIX_COMMON = (() => {
+    let common = RESERVED_INBOUND_HEADER_PREFIXES[0] ?? "";
+    for (const prefix of RESERVED_INBOUND_HEADER_PREFIXES) {
+        let i = 0;
+        const max = Math.min(common.length, prefix.length);
+        while (i < max && common.charCodeAt(i) === prefix.charCodeAt(i))
+            i++;
+        common = common.slice(0, i);
+    }
+    return common;
+})();
 /**
  * Reject requests that carry any header in
  * {@link RESERVED_INBOUND_HEADER_PREFIXES}. See that constant for the
@@ -308,6 +343,10 @@ export const RESERVED_INBOUND_HEADER_PREFIXES = Object.freeze([
  * `400 problem+json` instead of routing a request that may be probing
  * for an internal-dispatch bypass.
  *
+ * The framework's dispatch path runs this check and the header-count cap
+ * in a single shared walk internally (see {@link assertInboundHeaderGuards});
+ * calling this helper directly is only needed for custom pipelines.
+ *
  * @param headers - Normalized request headers to inspect (names arrive lowercased).
  * @since 0.36.0
  */
@@ -352,6 +391,11 @@ export const DEFAULT_MAX_HEADER_COUNT = 100;
  * framework returns a structured `problem+json` response instead of routing
  * a flood.
  *
+ * The framework's dispatch path runs this check and the reserved-prefix
+ * check in a single shared walk internally (see
+ * {@link assertInboundHeaderGuards}); calling this helper directly is only
+ * needed for custom pipelines.
+ *
  * @param headers - The incoming request headers.
  * @param limit - Maximum distinct header fields to allow. `0` disables.
  * @since 0.38.0
@@ -370,6 +414,67 @@ export function assertHeaderCountWithinLimit(headers, limit) {
         }
     });
 }
+/**
+ * Combined inbound header guards for the dispatch hot path (internal).
+ *
+ * Runs the singleton-duplicate check ({@link assertNoDuplicateSingletonHeaders}),
+ * the reserved-internal-prefix check ({@link assertNoReservedInternalHeaders}),
+ * and the header-count cap ({@link assertHeaderCountWithinLimit}) in a
+ * **single** walk of the header map, with the same observable semantics as
+ * calling the helpers in sequence: any `400`-class violation (duplicate
+ * singleton header or reserved internal header) anywhere in the map is
+ * rejected with `400` even when the map also exceeds the count cap. To
+ * preserve that precedence, the `431` count-cap rejection is deferred until
+ * the scan has covered every header — the same full-walk cost the
+ * sequential helpers already paid.
+ *
+ * A non-positive / non-finite `limit` disables the count cap (same as
+ * {@link assertHeaderCountWithinLimit}) while still rejecting duplicate
+ * singleton headers and reserved internal prefixes.
+ *
+ * @param headers - Normalized request headers (names arrive lowercased).
+ * @param limit - Maximum distinct header fields to allow. `0` disables the count cap.
+ * @throws {BadRequestError} When a duplicate singleton header or a reserved
+ *   internal header is present (takes precedence over the count cap).
+ * @throws {RequestHeaderFieldsTooLargeError} When no `400`-class violation is
+ *   present and the distinct-header count exceeds `limit`.
+ * @since 1.0.0
+ */
+export function assertInboundHeaderGuards(headers, limit) {
+    const enforceCount = limit > 0 && Number.isFinite(limit);
+    let count = 0;
+    let overLimit = false;
+    // Single forEach: singleton-duplicate rejection + reserved-prefix rejection
+    // + distinct-name count. The 400-class checks throw immediately; the
+    // count-cap rejection is deferred past the walk so a violation after
+    // position `limit` still yields 400 (matching the sequential guards,
+    // where the 400-class scans ran first).
+    headers.forEach((value, name) => {
+        // Smuggling-singleton check: the WHATWG Headers collection coalesces
+        // duplicate fields to a comma-joined value, so "value contains a comma"
+        // means the client sent the header more than once (same semantics as
+        // assertNoDuplicateSingletonHeaders, folded into this walk to avoid
+        // three extra undici Headers.get() calls per request).
+        if (SMUGGLING_SINGLETON_SET.has(name) && value.indexOf(",") !== -1) {
+            throw new BadRequestError(`Duplicate ${name} header rejected`);
+        }
+        // Fast path: skip the inner prefix loop unless the name starts with the
+        // common prefix shared by every reserved prefix (derived at module load
+        // from RESERVED_INBOUND_HEADER_PREFIXES — see RESERVED_PREFIX_COMMON —
+        // so this filter can never silently drop a future reserved prefix).
+        if (name.startsWith(RESERVED_PREFIX_COMMON)) {
+            for (const prefix of RESERVED_INBOUND_HEADER_PREFIXES) {
+                if (name.startsWith(prefix)) {
+                    throw new BadRequestError(`Reserved internal header rejected: ${name}`);
+                }
+            }
+        }
+        if (enforceCount && ++count > limit)
+            overLimit = true;
+    });
+    if (overLimit)
+        throw new RequestHeaderFieldsTooLargeError(limit);
+}
 /**
  * Minimum acceptable secret length in bytes for HMAC / signing material in
  * production (boot guard). Matches the OWASP "Secret Management"
@@ -635,12 +740,8 @@ export async function verifyWebhookSignature(opts) {
         if (Math.abs(nowSeconds - timestamp.seconds) > tolerance)
             return false;
     }
-    const payloadBytes = typeof opts.payload === "string"
-        ? new TextEncoder().encode(opts.payload)
-        : opts.payload;
-    const secretBytes = typeof opts.secret === "string"
-        ? new TextEncoder().encode(opts.secret)
-        : opts.secret;
+    const payloadBytes = typeof opts.payload === "string" ? new TextEncoder().encode(opts.payload) : opts.payload;
+    const secretBytes = typeof opts.secret === "string" ? new TextEncoder().encode(opts.secret) : opts.secret;
     const providedBytes = decodeWebhookSignature(opts.signature, algo.name, algo.signatureBytes);
     if (!providedBytes)
         return false;
@@ -675,12 +776,8 @@ export async function signWebhookPayload(opts) {
             throw new TypeError("signWebhookPayload(): timestamp must be a non-negative integer number of seconds");
         }
     }
-    const payloadBytes = typeof opts.payload === "string"
-        ? new TextEncoder().encode(opts.payload)
-        : opts.payload;
-    const secretBytes = typeof opts.secret === "string"
-        ? new TextEncoder().encode(opts.secret)
-        : opts.secret;
+    const payloadBytes = typeof opts.payload === "string" ? new TextEncoder().encode(opts.payload) : opts.payload;
+    const secretBytes = typeof opts.secret === "string" ? new TextEncoder().encode(opts.secret) : opts.secret;
     const c = globalThis.crypto;
     if (!c?.subtle)
         throw new Error("WebCrypto unavailable: cannot sign webhook payload");
@@ -701,9 +798,28 @@ export async function signWebhookPayload(opts) {
 const CONTROL_CHAR_RE = /[\x00-\x1f\x7f]/g;
 const WINDOWS_RESERVED_CHARS_RE = /[<>:"|?*]/g;
 const WINDOWS_RESERVED_NAMES = new Set([
-    "con", "prn", "aux", "nul",
-    "com1", "com2", "com3", "com4", "com5", "com6", "com7", "com8", "com9",
-    "lpt1", "lpt2", "lpt3", "lpt4", "lpt5", "lpt6", "lpt7", "lpt8", "lpt9",
+    "con",
+    "prn",
+    "aux",
+    "nul",
+    "com1",
+    "com2",
+    "com3",
+    "com4",
+    "com5",
+    "com6",
+    "com7",
+    "com8",
+    "com9",
+    "lpt1",
+    "lpt2",
+    "lpt3",
+    "lpt4",
+    "lpt5",
+    "lpt6",
+    "lpt7",
+    "lpt8",
+    "lpt9",
 ]);
 /**
  * Return a single-segment, storage-safe basename derived from a

package/dist/session.d.ts

@@ -38,7 +38,13 @@ export declare const SESSION_HOOK_MARKER: unique symbol;
 export declare const SESSION_SECRETS_MARKER: unique symbol;
 /** A persisted session entry as stored by a {@link SessionStore}. */
 export interface SessionRecord {
-    /** Arbitrary serializable session payload. Mutating this object marks the session dirty. */
+    /**
+     * Arbitrary JSON-serializable session payload. Mutating this object (including
+     * nested properties and array elements via the proxy on
+     * `ctx.state.session.data`) marks the session dirty so it is persisted on
+     * the response. Prefer plain objects/arrays/primitives; non-cloneable
+     * values (functions, DOM nodes) are not supported.
+     */
     data: Record<string, unknown>;
     /** Absolute expiration as ms since epoch. */
     expiresAt: number;
@@ -110,7 +116,12 @@ export interface SessionOptions {
 export type SessionContext = {
     /** Current session id. Refreshed by `regenerate()`. */
     readonly id: string;
-    /** Session payload. Mutating this object marks the session dirty. */
+    /**
+     * Session payload. Top-level and nested mutations (including array element
+     * writes) mark the session dirty so {@link SessionStore.set} runs on the
+     * response. Prefer `set`/`delete` for top-level keys when you do not need
+     * nested objects.
+     */
     readonly data: Record<string, unknown>;
     /** Read a single payload key. */
     get<T = unknown>(key: string): T | undefined;

package/dist/session.js

@@ -104,21 +104,106 @@ function sessionCookieAttributes(opts) {
 function markDirty(internal) {
     internal.dirty = true;
 }
-function makeSessionContext(id, data, internal, regenerate) {
-    const proxy = new Proxy(data, {
-        set(target, key, value) {
-            target[key] = value;
-            markDirty(internal);
-            return true;
+/**
+ * Deep-clone a session payload so store load/store never shares nested object
+ * references with the live request-scoped data.
+ *
+ * Prefers {@link structuredClone} (available on every supported runtime:
+ * Node >= 17, Deno, Bun, Workers, Vercel edge). Unlike a JSON round-trip it
+ * preserves `Date`, `Map`, `Set`, typed arrays, `BigInt`, and `undefined`
+ * property values, and it handles cyclic graphs — so a session that legitimately
+ * holds those values is neither silently corrupted (JSON stringifies a `Date`
+ * to a string and drops `undefined`) nor rejected (JSON throws on `BigInt` or a
+ * cycle). Falls back to the JSON round-trip only for the rare value
+ * `structuredClone` cannot copy (e.g. a function), which is unsupported in a
+ * session payload anyway.
+ *
+ * @param value - Session data tree (a plain object).
+ * @returns An independent deep copy.
+ */
+function cloneSessionData(value) {
+    if (typeof structuredClone === "function") {
+        try {
+            return structuredClone(value);
+        }
+        catch {
+            // structuredClone throws on non-cloneable values (functions, symbols);
+            // fall through to the JSON round-trip for best-effort compatibility.
+        }
+    }
+    return JSON.parse(JSON.stringify(value));
+}
+/**
+ * Whether a value should be wrapped by the deep dirty-tracking proxy: only
+ * plain objects and arrays. Exotic objects (`Date`, `Map`, `Set`, `RegExp`,
+ * typed arrays, class instances) are returned unwrapped so methods that rely
+ * on an internal slot as `this` (e.g. `Date.prototype.getTime`) keep working —
+ * a proxy would break them. Reassigning such a value on its parent is still
+ * dirty-tracked; only in-place internal mutation of the exotic value is not.
+ *
+ * @param value - Candidate nested value.
+ * @returns `true` for plain objects / arrays.
+ */
+function isProxyableContainer(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    if (Array.isArray(value))
+        return true;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+/**
+ * Recursive proxy that marks the session dirty on any nested set/delete,
+ * including array element assignment. Nested plain objects and arrays returned
+ * from `get` are re-wrapped so mutations deep in the tree are observed.
+ *
+ * Proxies are memoized per underlying target in `cache` (a {@link WeakMap}), so
+ * reading the same nested object twice yields the *same* proxy and object
+ * identity is preserved (`data.user === data.user`). The cache is scoped to a
+ * single session context (one request), so it never leaks across requests and
+ * its keys are collected with their targets.
+ *
+ * @param target - Underlying plain object/array held by the session.
+ * @param onDirty - Invoked on every successful mutation.
+ * @param cache - Per-context target→proxy memo table.
+ * @returns A proxy with the same surface as `target`.
+ */
+function createDeepDirtyProxy(target, onDirty, cache) {
+    const existing = cache.get(target);
+    if (existing)
+        return existing;
+    const proxy = new Proxy(target, {
+        get(t, prop, receiver) {
+            const value = Reflect.get(t, prop, receiver);
+            if (isProxyableContainer(value)) {
+                return createDeepDirtyProxy(value, onDirty, cache);
+            }
+            return value;
         },
-        deleteProperty(target, key) {
-            const had = key in target;
-            delete target[key];
-            if (had)
-                markDirty(internal);
-            return true;
+        set(t, prop, value, receiver) {
+            const ok = Reflect.set(t, prop, value, receiver);
+            if (ok)
+                onDirty();
+            return ok;
+        },
+        deleteProperty(t, prop) {
+            const had = Reflect.has(t, prop);
+            const ok = Reflect.deleteProperty(t, prop);
+            if (ok && had)
+                onDirty();
+            return ok;
         },
     });
+    cache.set(target, proxy);
+    return proxy;
+}
+function makeSessionContext(id, data, internal, regenerate) {
+    const onDirty = () => {
+        markDirty(internal);
+    };
+    // Per-request memo table so nested reads return a stable proxy identity.
+    const proxyCache = new WeakMap();
+    const proxy = createDeepDirtyProxy(data, onDirty, proxyCache);
     let currentId = id;
     return {
         get id() {
@@ -271,6 +356,7 @@ export function session(opts) {
                 destroyed: false,
                 regenerated: false,
                 created: false,
+                rawData: {},
             };
             const raw = readRequestCookie(ctx.request.headers.get("cookie"), cookieName);
             internal.hadCookie = raw !== null;
@@ -287,7 +373,9 @@ export function session(opts) {
                             const rec = await store.get(candidateId);
                             if (rec && rec.expiresAt > Date.now()) {
                                 id = candidateId;
-                                data = rec.data ? { ...rec.data } : {};
+                                // Deep-clone so nested mutations cannot mutate the store's
+                                // retained object graph without going through dirty tracking.
+                                data = rec.data ? cloneSessionData(rec.data) : {};
                             }
                             break;
                         }
@@ -326,6 +414,9 @@ export function session(opts) {
                 internal.originalId = null;
                 return next;
             };
+            // Retain the raw object so onSend can deep-clone it directly.
+            // `regenerate` mutates this same reference, so it stays authoritative.
+            internal.rawData = data;
             const sessionCtx = makeSessionContext(id, data, internal, regenerate);
             const state = ctx.state;
             state[STATE_KEY] = sessionCtx;
@@ -347,8 +438,9 @@ export function session(opts) {
                 }
                 return undefined;
             }
-            const sessionCtx = state[STATE_KEY];
-            const data = sessionCtx.data;
+            // Clone the raw (un-proxied) data: structuredClone rejects a Proxy, and
+            // the proxy writes through to this object so it holds every mutation.
+            const data = internal.rawData;
             const sid = internal.activeId;
             const expiresAt = Date.now() + internal.ttlMs;
             // A brand-new, untouched session is a no-op unless saveUninitialized is on.
@@ -357,13 +449,15 @@ export function session(opts) {
                 return undefined;
             const mustPersist = internal.dirty || internal.created || internal.regenerated;
             if (mustPersist) {
-                await store.set(sid, { data: { ...data }, expiresAt });
+                // Deep-clone so nested mutations persist as an independent tree and
+                // never share references with the store.
+                await store.set(sid, { data: cloneSessionData(data), expiresAt });
             }
             else if (internal.rolling) {
                 if (store.touch)
                     await store.touch(sid, expiresAt);
                 else
-                    await store.set(sid, { data: { ...data }, expiresAt });
+                    await store.set(sid, { data: cloneSessionData(data), expiresAt });
             }
             if (internal.regenerated && internal.originalId && internal.originalId !== sid) {
                 await store.destroy(internal.originalId);

package/dist/subdomains.js

@@ -126,10 +126,7 @@ export function subdomains(hostname, opts = {}) {
         }
         return resultFor(host, base);
     }
-    const suffixes = new Set([
-        ...PSL_PUBLIC_SUFFIXES,
-        ...(opts.extraSuffixes ?? []),
-    ]);
+    const suffixes = new Set([...PSL_PUBLIC_SUFFIXES, ...(opts.extraSuffixes ?? [])]);
     const labels = host.split(".");
     // Walk from the longest suffix candidate down to the shortest so the
     // longest match wins (`s3.amazonaws.com` beats `com`).

package/dist/tenancy.d.ts

@@ -32,6 +32,12 @@
  * (as the first group hook, or in `AppOptions.hooks`) so `ctx.state.tenant`
  * is populated by the time their `keyGenerator` / `scope` callbacks run.
  *
+ * `responseCache()` is a special case in two ways: it partitions on the resolved
+ * tenant **automatically** (no `keyGenerator` needed — see
+ * {@link TENANCY_RESOLVED_MARKER}), and because a mis-ordered cache is a silent
+ * cross-tenant disclosure rather than a merely wrong bucket, mounting it *ahead*
+ * of `tenancy()` refuses to boot in production instead of leaking.
+ *
  * ```ts
  * import { App, tenancy, tenantFromSubdomain, tenantScope, rateLimit } from "@daloyjs/core";
  *
@@ -161,6 +167,40 @@ export interface ClaimTenantOptions {
  */
 export declare function tenantFromClaim(claim: string, opts?: ClaimTenantOptions): TenantResolver;
 /** Status codes acceptable for an unresolved-tenant rejection. @since 0.42.0 */
+/**
+ * Marker stamped on the `Hooks` object returned by {@link tenancy}, so the `App`
+ * boot guard can verify that a `responseCache()` in the same chain is mounted
+ * *after* tenancy — i.e. that the tenant is in `ctx.state` by the time the cache
+ * key is built.
+ *
+ * @since 1.0.0
+ */
+export declare const TENANCY_HOOK_MARKER: unique symbol;
+/**
+ * `ctx.state` symbol under which {@link tenancy} records the tenant it resolved,
+ * independently of the configurable {@link TenancyOptions.stateKey}.
+ *
+ * Consumers that must partition shared state per tenant — notably
+ * `responseCache()`, which folds it into the cache key to prevent cross-tenant
+ * cached-response disclosure (CWE-524) — read this instead of guessing the
+ * `stateKey`. Kept in the global symbol registry so a consumer can re-derive it
+ * with `Symbol.for(...)` without importing this module.
+ *
+ * @since 1.0.0
+ */
+export declare const TENANCY_RESOLVED_MARKER: unique symbol;
+/**
+ * Value recorded under {@link TENANCY_RESOLVED_MARKER} when {@link tenancy} ran
+ * but resolved no tenant (only reachable with `tenancy({ require: false })`).
+ *
+ * Distinguishing "tenancy is active and resolved nothing" from "no tenancy at
+ * all" lets a consumer keep tenant-less traffic in its own partition rather than
+ * sharing the unpartitioned one. The leading space cannot occur in a normalized
+ * tenant id, so it can never collide with a real one.
+ *
+ * @since 1.0.0
+ */
+export declare const TENANT_UNRESOLVED = " unresolved";
 export type UnresolvedStatus = 400 | 401 | 403 | 404;
 /** Status codes acceptable for an unknown/disallowed-tenant rejection. @since 0.42.0 */
 export type InvalidStatus = 400 | 403 | 404;