@daloyjs/core 1.0.0-rc.4 → 1.0.0-rc.6

package/dist/tenancy.js

@@ -32,6 +32,12 @@
  * (as the first group hook, or in `AppOptions.hooks`) so `ctx.state.tenant`
  * is populated by the time their `keyGenerator` / `scope` callbacks run.
  *
+ * `responseCache()` is a special case in two ways: it partitions on the resolved
+ * tenant **automatically** (no `keyGenerator` needed — see
+ * {@link TENANCY_RESOLVED_MARKER}), and because a mis-ordered cache is a silent
+ * cross-tenant disclosure rather than a merely wrong bucket, mounting it *ahead*
+ * of `tenancy()` refuses to boot in production instead of leaking.
+ *
  * ```ts
  * import { App, tenancy, tenantFromSubdomain, tenantScope, rateLimit } from "@daloyjs/core";
  *
@@ -48,7 +54,7 @@
  *
  * @since 0.42.0
  */
-import { BadRequestError, ForbiddenError, NotFoundError, UnauthorizedError, } from "./errors.js";
+import { BadRequestError, ForbiddenError, NotFoundError, UnauthorizedError } from "./errors.js";
 import { subdomains } from "./subdomains.js";
 /**
  * Conservative default tenant-id grammar: a DNS-label-like token, lowercase
@@ -181,6 +187,41 @@ export function tenantFromClaim(claim, opts = {}) {
         return undefined;
     };
 }
+/** Status codes acceptable for an unresolved-tenant rejection. @since 0.42.0 */
+/**
+ * Marker stamped on the `Hooks` object returned by {@link tenancy}, so the `App`
+ * boot guard can verify that a `responseCache()` in the same chain is mounted
+ * *after* tenancy — i.e. that the tenant is in `ctx.state` by the time the cache
+ * key is built.
+ *
+ * @since 1.0.0
+ */
+export const TENANCY_HOOK_MARKER = Symbol.for("daloyjs.tenancy.hook");
+/**
+ * `ctx.state` symbol under which {@link tenancy} records the tenant it resolved,
+ * independently of the configurable {@link TenancyOptions.stateKey}.
+ *
+ * Consumers that must partition shared state per tenant — notably
+ * `responseCache()`, which folds it into the cache key to prevent cross-tenant
+ * cached-response disclosure (CWE-524) — read this instead of guessing the
+ * `stateKey`. Kept in the global symbol registry so a consumer can re-derive it
+ * with `Symbol.for(...)` without importing this module.
+ *
+ * @since 1.0.0
+ */
+export const TENANCY_RESOLVED_MARKER = Symbol.for("daloyjs.tenancy.resolved");
+/**
+ * Value recorded under {@link TENANCY_RESOLVED_MARKER} when {@link tenancy} ran
+ * but resolved no tenant (only reachable with `tenancy({ require: false })`).
+ *
+ * Distinguishing "tenancy is active and resolved nothing" from "no tenancy at
+ * all" lets a consumer keep tenant-less traffic in its own partition rather than
+ * sharing the unpartitioned one. The leading space cannot occur in a normalized
+ * tenant id, so it can never collide with a real one.
+ *
+ * @since 1.0.0
+ */
+export const TENANT_UNRESOLVED = " unresolved";
 /** Build the right `HttpError` for a configured status. */
 function rejection(status, detail) {
     switch (status) {
@@ -233,8 +274,13 @@ export function tenancy(opts) {
     else if (typeof opts.allow === "function") {
         allowFn = opts.allow;
     }
-    return {
+    const hooks = {
         async beforeHandle(ctx) {
+            const state = ctx.state;
+            // Record "tenancy ran" up front, so a tenant-less request is partitioned
+            // as such by downstream consumers instead of falling into the shared,
+            // unpartitioned bucket alongside resolved tenants.
+            state[TENANCY_RESOLVED_MARKER] = TENANT_UNRESOLVED;
             let raw;
             for (const resolve of resolvers) {
                 raw = await resolve(ctx);
@@ -259,9 +305,14 @@ export function tenancy(opts) {
             if (allowFn && !(await allowFn(id, ctx))) {
                 throw rejection(invalidStatus, "Unknown tenant.");
             }
-            ctx.state[stateKey] = id;
+            state[stateKey] = id;
+            state[TENANCY_RESOLVED_MARKER] = id;
         },
     };
+    // Let the App boot guard see tenancy's position in the hook chain relative to
+    // any responseCache() that must partition on the tenant it resolves.
+    hooks[TENANCY_HOOK_MARKER] = true;
+    return hooks;
 }
 /**
  * Build a `(ctx) => string` key function that reads the resolved tenant and

package/dist/time-claims.js

@@ -69,7 +69,9 @@ export function assertTemporalClaims(claims, opts) {
         if (!isFiniteNumber(claims.exp)) {
             throw new TemporalClaimError("invalid_exp", "payload.exp is not a finite number.");
         }
-        if (now > claims.exp + skew) {
+        // RFC 7519 §4.1.4: current time must be *before* exp. At the exact
+        // expiration second (after skew) the token is no longer valid.
+        if (now >= claims.exp + skew) {
             throw new TemporalClaimError("token_expired", "token has expired (exp).");
         }
     }

package/dist/waf.js

@@ -45,12 +45,7 @@ import { ForbiddenError } from "./errors.js";
 import { hasMongoOperatorKeys } from "./security.js";
 import { readRemoteAddress } from "./conn-info.js";
 /** The four built-in rule categories, in stable order. */
-const ALL_RULE_IDS = Object.freeze([
-    "sqli",
-    "xss",
-    "nosqli",
-    "cmdi",
-]);
+const ALL_RULE_IDS = Object.freeze(["sqli", "xss", "nosqli", "cmdi"]);
 /** Default anomaly score contributed by each rule when it matches. */
 const DEFAULT_RULE_SCORE = 5;
 /** Default total anomaly score at which a request is blocked / reported. */
@@ -69,6 +64,13 @@ const SQLI_SIGNATURES = Object.freeze([
     /\bUNION\b[\s\S]{0,40}?\bSELECT\b/i,
     /\b(?:OR|AND)\b\s+['"]?\d+['"]?\s*=\s*['"]?\d+/i,
     /'\s*(?:OR|AND)\s+'?[\w]+'?\s*=\s*'?[\w]+/i,
+    // Parenthesized subquery behind a boolean operator — `1 OR (SELECT 1)`. The
+    // tautology patterns above anchor on `= <digit>`, so a subquery carrying no
+    // comparison slipped through. Paired with the comment-stripped inspection
+    // variant this also catches `1/**/OR/**/(SELECT/**/1)`. High confidence:
+    // prose query values virtually never contain `OR (` immediately followed by
+    // the SELECT keyword.
+    /\b(?:OR|AND)\s*\(\s*SELECT\b/i,
     /;\s*(?:DROP|DELETE|INSERT|UPDATE|TRUNCATE|ALTER|CREATE)\b/i,
     /\b(?:SLEEP|BENCHMARK|PG_SLEEP)\s*\(/i,
     /\bWAITFOR\s+DELAY\b/i,
@@ -161,6 +163,105 @@ function safeDecode(value) {
         return value;
     }
 }
+/**
+ * Maximum percent-decode passes applied when expanding inspection variants.
+ *
+ * One pass matches what most HTTP stacks hand the handler. A second pass
+ * catches classic double-encoding WAF evasions (`%2527` → `%27` → `'`). A
+ * third is omitted on purpose: deeper recursive decoding inflates false
+ * positives on legitimately percent-bearing text and is not how frameworks
+ * deliver query/path values.
+ */
+const MAX_DECODE_PASSES = 2;
+/**
+ * Control characters that are NOT matched by JS `\s`, used to split keywords
+ * past whitespace-anchored signatures (e.g. `1'%00OR%001=1`).
+ *
+ * U+0009-U+000D (\t \n \v \f \r) are deliberately absent: `\s` already
+ * matches them and every signature separates tokens with `\s`, `\b`, or
+ * `[\s\S]`, so normalizing them would only duplicate an existing variant.
+ *
+ * Hoisted to module scope so the hot path neither re-creates the RegExp object
+ * nor pays literal-evaluation overhead per inspected value. The probe is
+ * non-global (stateless `test()`); the replace copy is global and `replace()`
+ * resets `lastIndex`, so neither carries state between calls.
+ */
+const CONTROL_CHAR_PROBE = /[\u0000-\u0008\u000e-\u001f\u007f]/;
+const CONTROL_CHAR_GLOBAL = /[\u0000-\u0008\u000e-\u001f\u007f]/g;
+/**
+ * Expand a single inbound string into the variants the WAF should scan.
+ *
+ * Includes the raw value, up to {@link MAX_DECODE_PASSES} percent-decodes,
+ * a `+`→space form (URLSearchParams parity), a SQL-comment-stripped
+ * form so comment-split keywords (e.g. OR wrapped in block comments) score
+ * the same as the whitespace-separated form, and a control-character→space
+ * form so embedded NUL / escape bytes cannot split keywords past the
+ * whitespace-anchored signatures (e.g. `1'%00OR%001=1` → `1' OR 1=1`).
+ *
+ * Scanning variants is pure defense-in-depth: the handler still receives
+ * whatever the framework's single-decode path produced. Each variant is
+ * truncated to `maxValueLength` and deduplicated so hostile inputs cannot
+ * explode the scan set.
+ *
+ * @param value - Raw or already-decoded string from path/query/header/body.
+ * @param maxValueLength - Cap applied to every variant before scanning.
+ * @returns Deduplicated inspection variants in stable insertion order.
+ */
+function inspectionVariants(value, maxValueLength) {
+    const seen = new Set();
+    const out = [];
+    const push = (v) => {
+        const truncated = v.length > maxValueLength ? v.slice(0, maxValueLength) : v;
+        if (!seen.has(truncated)) {
+            seen.add(truncated);
+            out.push(truncated);
+        }
+    };
+    let current = value;
+    push(current);
+    for (let i = 0; i < MAX_DECODE_PASSES; i++) {
+        const decoded = safeDecode(current);
+        if (decoded === current)
+            break;
+        push(decoded);
+        current = decoded;
+    }
+    // Snapshot before secondary transforms so we only expand the decode chain.
+    const decodedChain = out.slice();
+    for (const v of decodedChain) {
+        if (v.includes("+"))
+            push(v.replace(/\+/g, " "));
+        if (v.includes("/*"))
+            push(v.replace(/\/\*[\s\S]*?\*\//g, " "));
+        // Control characters (notably NUL) are not `\s`, so `1'%00OR%001=1` split
+        // `OR` from `1=1` and walked past the whitespace-anchored signatures. Scan
+        // a control-char→space form; benign traffic carries almost no C0 bytes, so
+        // the false-positive surface is negligible.
+        //
+        // The class deliberately excludes U+0009-U+000D (\t \n \v \f \r): JS `\s`
+        // already matches those, and every signature separates tokens with `\s`,
+        // `\b`, or `[\s\S]`, so normalizing them only ever yields a variant that
+        // scores identically to one already in the set. Including them cost ~13%
+        // on every request carrying a multi-line body or query value.
+        if (CONTROL_CHAR_PROBE.test(v)) {
+            push(v.replace(CONTROL_CHAR_GLOBAL, " "));
+        }
+    }
+    return out;
+}
+/**
+ * Scan every inspection variant of `value` for the active rule set.
+ *
+ * @see inspectionVariants
+ */
+function scanValueVariants(value, location, rules, scored, maxValueLength) {
+    for (const variant of inspectionVariants(value, maxValueLength)) {
+        scanValue(variant, location, rules, scored);
+        // Early exit once every rule has already fired — no further variants needed.
+        if (scored.size === rules.length)
+            return;
+    }
+}
 /**
  * Collect up to `maxNodes` string values from a parsed body value (object /
  * array / scalar), each truncated to `maxValueLength`. Depth and node count are
@@ -268,37 +369,29 @@ export function waf(opts = {}) {
             const scored = new Map();
             const url = new URL(ctx.request.url);
             if (inspectPath) {
-                scanValue(safeDecode(url.pathname), "path", rules, scored);
+                // Path is scanned across raw + up to two decode passes so double-
+                // encoded traversal / injection tokens in path segments still score.
+                scanValueVariants(url.pathname, "path", rules, scored, maxValueLength);
             }
             if (inspectQuery && url.search.length > 1) {
-                // Scan both the raw query string and a best-effort decoded form so an
-                // encoded payload (`%27%20OR%201=1`) is caught after normalization.
-                // This is a SINGLE decode on purpose: the framework's request path also
-                // decodes the query exactly once, so the WAF sees the same bytes the
-                // handler will. Recursive decoding is deliberately avoided — it would
-                // false-positive on values that legitimately contain percent-encoded
-                // text, and a double-encoded payload stays inert (`%3Cscript%3E`) all
-                // the way to the handler. See red-team-attacks-6 "DOCUMENTED LIMITATION".
+                // Scan the raw query, bounded multi-decode variants, and each
+                // URLSearchParams key/value. Multi-decode (max 2) closes classic
+                // double-encoding WAF evasions (`%2527` → `%27` → `'`) without open-
+                // ended recursive decoding. URLSearchParams also turns `+` into
+                // space; inspectionVariants covers that form so `1+OR+1=1` scores
+                // the same as `1 OR 1=1` (parser-differential defense).
                 const raw = url.search.slice(1);
-                scanValue(raw, "query", rules, scored);
-                const decoded = safeDecode(raw);
-                if (decoded !== raw)
-                    scanValue(decoded, "query", rules, scored);
-                // Additionally inspect each key/value the way the app's OWN query parser
-                // (`URLSearchParams`) decodes them: notably `+` becomes a space, which a
-                // plain `decodeURIComponent` does NOT do. Without this, `1+OR+1=1` slipped
-                // past the WAF while the handler still received `1 OR 1=1` (a parser
-                // differential — the WAF must inspect the bytes the app actually parses).
+                scanValueVariants(raw, "query", rules, scored, maxValueLength);
                 for (const [k, v] of url.searchParams) {
-                    scanValue(k, "query", rules, scored);
-                    scanValue(v, "query", rules, scored);
+                    scanValueVariants(k, "query", rules, scored, maxValueLength);
+                    scanValueVariants(v, "query", rules, scored, maxValueLength);
                 }
             }
             if (headerAllowlist.length > 0) {
                 for (const name of headerAllowlist) {
                     const value = ctx.request.headers.get(name);
                     if (value)
-                        scanValue(value, "header", rules, scored);
+                        scanValueVariants(value, "header", rules, scored, maxValueLength);
                 }
             }
             if (inspectBody && ctx.body !== undefined && ctx.body !== null) {
@@ -316,14 +409,13 @@ export function waf(opts = {}) {
                     });
                 }
                 if (typeof ctx.body === "string") {
-                    scanValue(ctx.body.length > maxValueLength
-                        ? ctx.body.slice(0, maxValueLength)
-                        : ctx.body, "body", rules, scored);
+                    scanValueVariants(ctx.body, "body", rules, scored, maxValueLength);
                 }
                 else if (typeof ctx.body === "object") {
                     const strings = collectBodyStrings(ctx.body, maxBodyNodes, maxValueLength);
-                    for (const value of strings)
-                        scanValue(value, "body", rules, scored);
+                    for (const value of strings) {
+                        scanValueVariants(value, "body", rules, scored, maxValueLength);
+                    }
                 }
             }
             if (scored.size === 0)

package/dist/webhook-delivery.js

@@ -256,11 +256,25 @@ export function createWebhookSender(options) {
                 lastError = undefined;
                 if (response.ok) {
                     options.onAttempt?.({ id, attempt, status: response.status, willRetry: false });
-                    return { ok: true, id, eventType: event.eventType, attempts: attempt, status: response.status, response, deadLettered: false };
+                    return {
+                        ok: true,
+                        id,
+                        eventType: event.eventType,
+                        attempts: attempt,
+                        status: response.status,
+                        response,
+                        deadLettered: false,
+                    };
                 }
                 const retryable = retryStatuses.has(response.status) && attempt < maxAttempts;
                 const delayMs = retryable ? backoffFor(attempt, response) : undefined;
-                options.onAttempt?.({ id, attempt, status: response.status, willRetry: retryable, delayMs });
+                options.onAttempt?.({
+                    id,
+                    attempt,
+                    status: response.status,
+                    willRetry: retryable,
+                    delayMs,
+                });
                 if (!retryable)
                     break;
                 await sleep(delayMs);
@@ -291,7 +305,9 @@ export function createWebhookSender(options) {
                 contentType,
                 attempts: madeAttempts,
                 ...(lastStatus !== undefined ? { lastStatus } : {}),
-                ...(lastError !== undefined ? { lastError: lastError instanceof Error ? lastError.message : String(lastError) } : {}),
+                ...(lastError !== undefined
+                    ? { lastError: lastError instanceof Error ? lastError.message : String(lastError) }
+                    : {}),
                 timestamp,
                 failedAt: now(),
             });

package/dist/websocket.d.ts

@@ -445,14 +445,22 @@ export declare const FRAME_INCOMPLETE: unique symbol;
  * @param buf - Buffered socket bytes beginning at a frame boundary.
  * @param opts - `requireMask: true` enforces the RFC 6455 rule that
  *   client-to-server frames are masked. Defaults to `{}` (not enforced).
+ *   `maxPayload` rejects data frames whose **declared** payload length
+ *   exceeds the limit as soon as the header is parsed, before the payload
+ *   bytes have arrived — this keeps a slow-or-stalled sender from making
+ *   the caller buffer an oversized incomplete frame. Control frames are
+ *   already capped at 125 bytes and are not affected.
  * @returns The decoded {@link ParsedFrame}, or {@link FRAME_INCOMPLETE}
  *   when more bytes are needed.
  * @throws WebSocketProtocolError on RSV bits, unknown opcodes, fragmented
  *   or oversized control frames, unmasked client frames, or payload lengths
  *   above `Number.MAX_SAFE_INTEGER`.
+ * @throws WebSocketPayloadTooLargeError when `maxPayload` is set and a data
+ *   frame declares a payload length above it.
  */
 export declare function parseFrame(buf: Uint8Array, opts?: {
     requireMask?: boolean;
+    maxPayload?: number;
 }): ParsedFrame | typeof FRAME_INCOMPLETE;
 /**
  * Encode a single frame. By default the frame is emitted unmasked (server

package/dist/websocket.js

@@ -92,7 +92,8 @@ function assertWebSocketOriginPolicy(policy) {
     }
 }
 function schemaToJson(schema) {
-    const converter = schema?.toJSONSchema;
+    const converter = schema
+        ?.toJSONSchema;
     if (typeof converter !== "function")
         return undefined;
     try {
@@ -501,11 +502,18 @@ export const FRAME_INCOMPLETE = Symbol("daloy.ws.frameIncomplete");
  * @param buf - Buffered socket bytes beginning at a frame boundary.
  * @param opts - `requireMask: true` enforces the RFC 6455 rule that
  *   client-to-server frames are masked. Defaults to `{}` (not enforced).
+ *   `maxPayload` rejects data frames whose **declared** payload length
+ *   exceeds the limit as soon as the header is parsed, before the payload
+ *   bytes have arrived — this keeps a slow-or-stalled sender from making
+ *   the caller buffer an oversized incomplete frame. Control frames are
+ *   already capped at 125 bytes and are not affected.
  * @returns The decoded {@link ParsedFrame}, or {@link FRAME_INCOMPLETE}
  *   when more bytes are needed.
  * @throws WebSocketProtocolError on RSV bits, unknown opcodes, fragmented
  *   or oversized control frames, unmasked client frames, or payload lengths
  *   above `Number.MAX_SAFE_INTEGER`.
+ * @throws WebSocketPayloadTooLargeError when `maxPayload` is set and a data
+ *   frame declares a payload length above it.
  */
 export function parseFrame(buf, opts = {}) {
     if (buf.length < 2)
@@ -525,9 +533,7 @@ export function parseFrame(buf, opts = {}) {
             throw new WebSocketProtocolError("Control frames must not be fragmented");
         if (payloadLen > WS_MAX_CONTROL_PAYLOAD)
             throw new WebSocketProtocolError("Control frame payload exceeds 125 bytes");
-        if (opcode !== WS_OPCODE.CLOSE &&
-            opcode !== WS_OPCODE.PING &&
-            opcode !== WS_OPCODE.PONG)
+        if (opcode !== WS_OPCODE.CLOSE && opcode !== WS_OPCODE.PING && opcode !== WS_OPCODE.PONG)
             throw new WebSocketProtocolError(`Unknown control opcode 0x${opcode.toString(16)}`);
     }
     else if (opcode !== WS_OPCODE.CONTINUATION &&
@@ -558,6 +564,14 @@ export function parseFrame(buf, opts = {}) {
         payloadLen = hi * 2 ** 32 + lo;
         offset += 8;
     }
+    // Reject oversized declared lengths as soon as the header is complete —
+    // before waiting on mask or payload bytes — so an attacker cannot make the
+    // caller buffer an unbounded incomplete frame by trickling payload bytes.
+    // Cumulative accounting across fragments stays with the caller; a declared
+    // length above the limit always implies the assembled message exceeds it.
+    if ((opcode & 0x8) === 0 && opts.maxPayload !== undefined && payloadLen > opts.maxPayload) {
+        throw new WebSocketPayloadTooLargeError(opts.maxPayload, payloadLen);
+    }
     if (opts.requireMask && !masked) {
         throw new WebSocketProtocolError("Client frames must be masked");
     }
@@ -745,6 +759,7 @@ export class FrameSink {
             while (this.buffer.length > 0) {
                 const frame = parseFrame(this.buffer, {
                     requireMask: this.opts.requireMask,
+                    maxPayload: this.opts.maxPayloadLength,
                 });
                 if (frame === FRAME_INCOMPLETE)
                     return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-rc.4",
+  "version": "1.0.0-rc.6",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -236,12 +236,12 @@
     }
   },
   "devDependencies": {
-    "@hey-api/openapi-ts": "^0.99.0",
+    "@hey-api/openapi-ts": "0.0.0-next-20260711024907",
     "@types/node": "^26.0.1",
     "fast-check": "^4.8.0",
     "prettier": "^3.8.3",
     "tsx": "^4.22.3",
-    "typescript": "^6.0.3",
+    "typescript": "^7.0.2",
     "zod": "^4.4.3"
   },
   "scripts": {
@@ -249,11 +249,12 @@
     "dev": "tsc -w -p tsconfig.json",
     "example": "node --import tsx examples/basic.ts",
     "bench": "node --import tsx bench/router.bench.ts",
-    "bench:serverless": "node --import tsx bench/serverless-cold-path.bench.ts",
+    "bench:serverless": "pnpm build && node --import tsx bench/serverless-cold-path.bench.ts",
     "bench:json": "node --import tsx bench/json-body.bench.ts",
     "bench:json-e2e": "node --import tsx bench/json-body-e2e.bench.ts",
+    "bench:ablation": "pnpm build && node --import tsx bench/ablation.bench.ts",
     "test": "node --import tsx --test tests/**/*.test.ts",
-    "test:red-team": "node --import tsx --test tests/red-team-attacks.test.ts tests/red-team-attacks-2.test.ts tests/red-team-attacks-3.test.ts tests/red-team-attacks-4.test.ts tests/red-team-attacks-5.test.ts tests/red-team-attacks-6.test.ts tests/red-team-attacks-7.test.ts tests/red-team-attacks-8.test.ts tests/red-team-attacks-9.test.ts tests/red-team-attacks-10.test.ts",
+    "test:red-team": "node --import tsx --test tests/red-team-attacks.test.ts tests/red-team-attacks-2.test.ts tests/red-team-attacks-3.test.ts tests/red-team-attacks-4.test.ts tests/red-team-attacks-5.test.ts tests/red-team-attacks-6.test.ts tests/red-team-attacks-7.test.ts tests/red-team-attacks-8.test.ts tests/red-team-attacks-9.test.ts tests/red-team-attacks-10.test.ts tests/red-team-attacks-11.test.ts",
     "red-team:live": "node --import tsx red-team-live/run.ts",
     "coverage": "node --import tsx --test --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-lines=90 --test-coverage-functions=90 tests/**/*.test.ts",
     "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include='dist-coverage/src/**' --test-coverage-branches=92 dist-coverage/tests/**/*.test.js",