@daloyjs/core 1.0.0-rc.5 → 1.0.0-rc.7

package/dist/response-cache.js

@@ -32,6 +32,31 @@
  *   the rate-limit store, with an in-memory {@link MemoryResponseCacheStore}
  *   default; supply a shared backend (e.g. Redis) for multi-instance fleets.
  *
+ * ## Cross-principal isolation (CWE-524)
+ *
+ * A shared response cache is only as safe as its key. Anything that varies the
+ * response but not the key becomes a cross-principal disclosure: the next caller
+ * of the same URL receives the previous caller's private body. This module is
+ * fail-closed on every principal dimension the framework can see:
+ *
+ * - **Authority.** The key is built from the *effective request URI* (scheme +
+ *   authority + path + query) per RFC 9111 §4, so one process serving several
+ *   hostnames (vanity domains, subdomain-per-customer) never shares an entry
+ *   across them.
+ * - **Credentials.** Requests carrying `Authorization` **or** `Cookie` bypass
+ *   the shared cache entirely unless the caller is identified (see
+ *   {@link ResponseCacheOptions.principal}) or the header is explicitly declared
+ *   shareable (see {@link ResponseCacheOptions.cacheAuthenticatedRequests}).
+ * - **Tenant.** When `tenancy()` has resolved a tenant for the request, that
+ *   tenant is folded into the key automatically — no `keyGenerator` wiring
+ *   required, and it applies to a custom `keyGenerator` too.
+ * - **Declared variants.** A response's own `Vary` header is honoured as a
+ *   secondary key (RFC 9111 §4.1): an entry is replayed only to a request whose
+ *   values for those fields match the ones it was stored with. `cors()` emits
+ *   `Vary: Origin` and `compression()` emits `Vary: Accept-Encoding`, so
+ *   without this one caller's `Access-Control-Allow-Origin` — or their gzipped
+ *   body — would be served to the next. `Vary: *` is never stored.
+ *
  * This module is dependency-free and uses only Web Standard
  * `Request`/`Response` + `Headers`, so it runs unchanged on Node, Bun, Deno,
  * Cloudflare Workers, and Vercel.
@@ -42,6 +67,30 @@
 import { markSchemaValidatedResponse } from "./internal-response.js";
 /** Internal `ctx.state` key carrying the pending cache key between hooks. */
 const PENDING_STATE_KEY = "__responseCachePending";
+/**
+ * Marker stamped on the `Hooks` object returned by {@link responseCache}, so the
+ * `App` boot guard can detect a cache mounted *ahead of* `tenancy()` — an order
+ * in which the tenant is not yet in `ctx.state` when the cache key is built, and
+ * automatic tenant partitioning therefore cannot protect the entry.
+ *
+ * @since 1.0.0
+ */
+export const RESPONSE_CACHE_HOOK_MARKER = Symbol.for("daloyjs.response-cache.hook");
+/**
+ * `ctx.state` symbol under which `tenancy()` records the tenant it resolved for
+ * the request, or its `TENANT_UNRESOLVED` sentinel when it ran and resolved
+ * nothing. Either way the value is a string, so it partitions the cache key —
+ * which keeps tenant-less traffic out of the resolved tenants' entries without
+ * this module needing to know the sentinel's value.
+ *
+ * Re-derived from the global symbol registry rather than imported from
+ * `tenancy.js` so that using `responseCache()` never pulls the tenancy module
+ * into the bundle — the same technique `app.ts` uses for the MCP route marker.
+ * Must match the string in `tenancy.ts`.
+ *
+ * @internal
+ */
+const TENANCY_RESOLVED_MARKER = Symbol.for("daloyjs.tenancy.resolved");
 /**
  * Process-wide registry of in-memory stores shared by
  * {@link ResponseCacheOptions.groupId}.
@@ -58,21 +107,49 @@ const SHARED_RESPONSE_CACHE_STORES = new Map();
 export function _resetSharedResponseCacheStoresForTests() {
     SHARED_RESPONSE_CACHE_STORES.clear();
 }
-// ---------- Default store ----------
 /**
  * In-memory {@link ResponseCacheStore}. Suitable for tests and single-process
- * deployments. Expired entries are dropped on access; the map is
- * opportunistically pruned so it cannot grow without bound.
+ * deployments.
+ *
+ * Expired entries are dropped on access. The map is bounded on **both** entry
+ * count and retained body bytes ({@link MemoryResponseCacheStoreOptions}):
+ * pruning expired entries alone cannot bound it, because every entry in a burst
+ * of requests for distinct URLs is unexpired for the whole TTL. An attacker
+ * rotating a query string would otherwise grow the map without limit until the
+ * process runs out of memory.
+ *
+ * Eviction is FIFO over insertion order (expired entries first), which `Map`
+ * gives in O(1) per eviction.
  */
 export class MemoryResponseCacheStore {
     map = new Map();
+    maxEntries;
+    maxBytes;
+    /** Running sum of `entry.body.length` over `map`, kept in step with writes. */
+    bytes = 0;
+    /**
+     * @param opts - Capacity limits; see {@link MemoryResponseCacheStoreOptions}.
+     * @throws TypeError if either limit is not a positive integer.
+     */
+    constructor(opts = {}) {
+        const maxEntries = opts.maxEntries ?? 10_000;
+        const maxBytes = opts.maxBytes ?? 64 * 1024 * 1024;
+        if (!Number.isInteger(maxEntries) || maxEntries <= 0) {
+            throw new TypeError("MemoryResponseCacheStore: maxEntries must be a positive integer.");
+        }
+        if (!Number.isInteger(maxBytes) || maxBytes <= 0) {
+            throw new TypeError("MemoryResponseCacheStore: maxBytes must be a positive integer.");
+        }
+        this.maxEntries = maxEntries;
+        this.maxBytes = maxBytes;
+    }
     /** @inheritDoc */
     get(key) {
         const entry = this.map.get(key);
         if (!entry)
             return null;
         if (entry.staleUntil <= Date.now()) {
-            this.map.delete(key);
+            this.drop(key, entry);
             return null;
         }
         return entry;
@@ -83,24 +160,47 @@ export class MemoryResponseCacheStore {
      * here: the in-memory store derives freshness from `entry.freshUntil`.
      */
     set(key, entry, _ttlMs) {
+        const existing = this.map.get(key);
+        if (existing)
+            this.bytes -= existing.body.length;
         this.map.set(key, entry);
-        if (this.map.size > 10_000)
-            this.prune();
+        this.bytes += entry.body.length;
+        if (this.map.size > this.maxEntries || this.bytes > this.maxBytes)
+            this.evict();
     }
     /** @inheritDoc */
     delete(key) {
+        const entry = this.map.get(key);
+        if (entry)
+            this.drop(key, entry);
+    }
+    /** Remove one entry, keeping the byte counter in step. */
+    drop(key, entry) {
         this.map.delete(key);
+        this.bytes -= entry.body.length;
     }
-    prune() {
+    /**
+     * Bring the map back under both limits: expired entries first, then
+     * oldest-inserted, since `Map` iterates in insertion order.
+     */
+    evict() {
         const now = Date.now();
         for (const [k, v] of this.map) {
+            if (this.map.size <= this.maxEntries && this.bytes <= this.maxBytes)
+                return;
             if (v.staleUntil <= now)
-                this.map.delete(k);
+                this.drop(k, v);
+        }
+        for (const [k, v] of this.map) {
+            if (this.map.size <= this.maxEntries && this.bytes <= this.maxBytes)
+                return;
+            this.drop(k, v);
         }
     }
     /** Test helper. Remove every entry. */
     clear() {
         this.map.clear();
+        this.bytes = 0;
     }
     /** Test helper. Number of stored entries (including expired). */
     size() {
@@ -167,14 +267,123 @@ function freshnessFromResponse(res) {
     // No explicit directive: fall back to the configured ttl (undefined marker).
     return undefined;
 }
+/**
+ * Build the default cache-key body: the method plus the **effective request
+ * URI** (scheme + authority + path + query), plus any {@link
+ * ResponseCacheOptions.varyHeaders} values.
+ *
+ * Including the authority is what keeps one process serving several hostnames
+ * from sharing entries across them (RFC 9111 §4 keys a cache on the target URI,
+ * which includes the authority). `Request.url` is already an absolute,
+ * normalized serialization (host lower-cased, default port elided), so it is
+ * used directly — no `URL` object is allocated on this hot path. Only the
+ * fragment, which is meaningless to a cache and never sent by HTTP clients, is
+ * trimmed.
+ */
 function defaultKey(ctx, varyHeaders) {
-    const url = new URL(ctx.request.url);
-    let key = `${ctx.request.method} ${url.pathname}${url.search}`;
+    const url = ctx.request.url;
+    const hash = url.indexOf("#");
+    let key = `${ctx.request.method} ${hash === -1 ? url : url.slice(0, hash)}`;
     for (const name of varyHeaders) {
         key += `\n${name}: ${ctx.request.headers.get(name) ?? ""}`;
     }
     return key;
 }
+/**
+ * Append a length-prefixed `name=value` component to a cache-key partition.
+ *
+ * The length prefix makes the component unambiguous, so a principal id
+ * containing the delimiter (or a whole forged key fragment) cannot be crafted to
+ * collide with a different partition — cache-key injection.
+ */
+function appendPartition(partition, name, value) {
+    return `${partition}${name}=${value.length}:${value}\n`;
+}
+/**
+ * Response headers that must never be persisted in a cache entry, because they
+ * describe *this hop* or *this request* rather than the stored representation.
+ *
+ * - The RFC 9111 §3.1 / RFC 9110 §7.6.1 hop-by-hop set. Replaying a stored
+ *   `Transfer-Encoding: chunked` onto a fixed-length cached body, or a stored
+ *   `Connection` token, corrupts message framing for every later caller.
+ * - `Age`, which is recomputed from `storedAt` on every serve.
+ * - `X-Request-Id`, the default correlation id written by `requestId()`. It
+ *   identifies the *one* request that populated the entry; replaying it makes
+ *   every subsequent caller report a trace id belonging to someone else's
+ *   request, and tells an attacker whether their own seed is still being
+ *   served (a cache-state oracle).
+ *
+ * Extend for a custom correlation header via
+ * {@link ResponseCacheOptions.excludeHeaders}.
+ */
+const NEVER_CACHED_HEADERS = new Set([
+    "age",
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "x-request-id",
+]);
+/**
+ * Split a response's `Vary` header into normalized field names.
+ *
+ * @param raw - Raw `Vary` header value, or `null` when absent.
+ * @returns `"*"` when the response is declared unreusable by any secondary key,
+ *   a sorted, de-duplicated, lower-cased field list otherwise (empty when the
+ *   header is absent or lists nothing usable). Sorting makes the derived key
+ *   independent of the order the emitting middleware happened to append in.
+ */
+function parseVary(raw) {
+    if (!raw)
+        return [];
+    const fields = new Set();
+    for (const part of raw.split(",")) {
+        const name = part.trim().toLowerCase();
+        if (!name)
+            continue;
+        if (name === "*")
+            return "*";
+        fields.add(name);
+    }
+    return [...fields].sort();
+}
+/**
+ * Derive the secondary cache key for a request: the values it carries for each
+ * field the stored response varies on.
+ *
+ * Uses the same length-prefixed encoding as {@link appendPartition}, so a header
+ * value containing the delimiter cannot be crafted to collide with a different
+ * variant.
+ *
+ * @param headers - The request's headers.
+ * @param fields - Lower-cased field names from {@link parseVary}.
+ * @returns An unambiguous encoding of those fields' values.
+ */
+function varyKeyFor(headers, fields) {
+    let key = "";
+    for (const name of fields)
+        key = appendPartition(key, name, headers.get(name) ?? "");
+    return key;
+}
+/**
+ * Store key for one variant of a primary key.
+ *
+ * Variants live under their own keys so they coexist instead of evicting each
+ * other. A single slot per primary key would make every alternation between
+ * (say) a gzip client and an identity client a miss — and hand an attacker a
+ * cache-defeat DoS: rotate `Origin` or `Accept-Encoding` and every request runs
+ * the handler.
+ *
+ * The separator is a NUL byte, which cannot appear in a header value, so a
+ * variant key can never collide with a primary key.
+ */
+function variantKey(primary, varyKey) {
+    return `${primary}\u0000v\u0000${varyKey}`;
+}
 function buildResponseFromCache(entry, outcome, statusHeaderName, isHead) {
     const headers = new Headers();
     for (const [name, value] of entry.headers)
@@ -208,10 +417,17 @@ function isPromiseLike(value) {
  *
  * Request `Cache-Control: no-store` bypasses the cache entirely; `no-cache`
  * bypasses the read but still refreshes the stored entry. Responses marked
- * `no-store` / `private` / `no-cache`, carrying `Set-Cookie`, failing
- * {@link ResponseCacheOptions.cacheableStatus}, or larger than
+ * `no-store` / `private` / `no-cache`, carrying `Set-Cookie` or `Vary: *`,
+ * failing {@link ResponseCacheOptions.cacheableStatus}, or larger than
  * {@link ResponseCacheOptions.maxBodyBytes} are never cached.
  *
+ * A response that declares `Vary` is stored as a **variant**: the request's
+ * values for those fields are recorded alongside it, and the entry is replayed
+ * only to a request whose values match. A mismatch is a miss, so the handler
+ * runs and the entry is re-stored for that variant. This applies to `Vary`
+ * written by any middleware in the chain — notably `cors()` (`Origin`) and
+ * `compression()` (`Accept-Encoding`) — with no configuration.
+ *
  * @example
  * ```ts
  * import { App, responseCache } from "@daloyjs/core";
@@ -250,9 +466,23 @@ export function responseCache(opts = {}) {
         throw new Error("responseCache(): maxBodyBytes must be a positive integer.");
     }
     const methods = new Set((opts.methods ?? ["GET", "HEAD"]).map((m) => m.toUpperCase()));
-    const cacheAuthenticatedRequests = opts.cacheAuthenticatedRequests === true;
     const cacheableStatus = opts.cacheableStatus ?? ((status) => status === 200);
     const varyHeaders = (opts.varyHeaders ?? []).map((h) => h.toLowerCase());
+    const principal = opts.principal;
+    const excludedHeaders = opts.excludeHeaders?.length
+        ? new Set([...NEVER_CACHED_HEADERS, ...opts.excludeHeaders.map((h) => h.toLowerCase())])
+        : NEVER_CACHED_HEADERS;
+    // Resolve the per-header credential policy once, at construction. A credential
+    // header counts as "handled" when the caller declared it shareable, or when it
+    // is in `varyHeaders` (its value then partitions the key by itself).
+    const credentialOptIn = opts.cacheAuthenticatedRequests;
+    const optInAll = credentialOptIn === true;
+    const authorizationHandled = optInAll ||
+        (typeof credentialOptIn === "object" && credentialOptIn?.authorization === true) ||
+        varyHeaders.includes("authorization");
+    const cookieHandled = optInAll ||
+        (typeof credentialOptIn === "object" && credentialOptIn?.cookie === true) ||
+        varyHeaders.includes("cookie");
     const statusHeaderName = opts.statusHeaderName === null ? null : (opts.statusHeaderName ?? "x-cache").toLowerCase();
     const ttlMs = ttlSeconds * 1_000;
     const swrMs = swrSeconds * 1_000;
@@ -290,37 +520,88 @@ export function responseCache(opts = {}) {
             .catch(() => undefined)
             .finally(() => refreshing.delete(key));
     }
-    return {
+    const hooks = {
         async beforeHandle(ctx) {
             const method = ctx.request.method.toUpperCase();
             if (!methods.has(method))
                 return undefined;
-            // RFC 9111 §3.5 / CWE-524: a shared cache keyed on method+URL must not
-            // store or reuse a response to an Authorization-bearing request, or it
-            // would serve one principal's private data to the next caller. Opt in
-            // via `cacheAuthenticatedRequests` for genuinely shareable content.
-            if (!cacheAuthenticatedRequests && ctx.request.headers.has("authorization")) {
-                return undefined;
-            }
-            const reqCc = parseCacheControl(ctx.request.headers.get("cache-control"));
+            const headers = ctx.request.headers;
+            // Checked before `principal` runs so a fully bypassed request never pays
+            // for the caller's callback.
+            const reqCc = parseCacheControl(headers.get("cache-control"));
             if (reqCc.has("no-store"))
                 return undefined;
+            // Identify the caller, if the app can. A non-empty principal is folded
+            // into the key below, which is what makes caching a credentialed response
+            // safe: the entry belongs to that principal alone. Not wrapped in a
+            // try/catch, matching `keyGenerator`: a throwing option is a bug in the
+            // app, and swallowing it would hide the misconfiguration.
+            const principalId = principal ? (principal(ctx) ?? null) : null;
+            // RFC 9111 §3.5 / CWE-524: a shared cache keyed on the request URI must not
+            // store or reuse a response to a credentialed request, or it would serve
+            // one principal's private data to the next caller. `Cookie` counts as a
+            // credential alongside `Authorization` — a session cookie is the most
+            // common way a response becomes private. An unhandled credential is only
+            // safe once `principal` has named the caller.
+            if (!principalId &&
+                ((!authorizationHandled && headers.has("authorization")) ||
+                    (!cookieHandled && headers.has("cookie")))) {
+                return undefined;
+            }
             const rawKey = opts.keyGenerator ? opts.keyGenerator(ctx) : defaultKey(ctx, varyHeaders);
             if (rawKey === null)
                 return undefined;
-            const key = `${keyPrefix}${rawKey}`;
+            // Partition the key by everything the framework knows about the caller
+            // that the URI does not already express. Applied around `keyGenerator`
+            // output too, so a custom generator cannot widen the partition. Skipped
+            // entirely — no allocation — for the common unpartitioned public request.
+            let partition = "";
+            const tenant = ctx.state[TENANCY_RESOLVED_MARKER];
+            if (typeof tenant === "string") {
+                partition = appendPartition(partition, "tenant", tenant);
+            }
+            if (principalId) {
+                partition = appendPartition(partition, "principal", principalId);
+            }
+            const key = `${keyPrefix}${partition}${rawKey}`;
             // `no-cache` bypasses the read but still allows a fresh write below.
             const bypassRead = reqCc.has("no-cache");
             if (!bypassRead) {
                 const getResult = store.get(key);
-                const entry = isPromiseLike(getResult) ? await getResult : getResult;
+                let entry = isPromiseLike(getResult) ? await getResult : getResult;
+                let servedKey = key;
+                // RFC 9111 §4.1: an entry stored for a response that declared `Vary`
+                // is reusable only for a request whose values for those fields match
+                // the ones it was stored with. Without this, `cors()`'s `Vary: Origin`
+                // and `compression()`'s `Vary: Accept-Encoding` are silently ignored
+                // and one caller's variant — their `Access-Control-Allow-Origin`, their
+                // content-coding, their negotiated language — is served to the next.
+                //
+                // The entry at the primary key doubles as the hint that tells us *which*
+                // fields matter, so the common single-variant case costs one `get`. On a
+                // mismatch we know the field list and can look the right variant up
+                // directly, which is what keeps several variants of one URL alive at
+                // once instead of each evicting the last.
+                if (entry?.vary?.length) {
+                    const wanted = varyKeyFor(headers, entry.vary);
+                    if (entry.varyKey !== wanted) {
+                        servedKey = variantKey(key, wanted);
+                        const variantResult = store.get(servedKey);
+                        entry = isPromiseLike(variantResult) ? await variantResult : variantResult;
+                        // A stored variant records the field list it was keyed on; if that
+                        // has since changed (the handler now varies on something else), the
+                        // recorded key no longer means what we just computed.
+                        if (entry && varyKeyFor(headers, entry.vary ?? []) !== entry.varyKey)
+                            entry = null;
+                    }
+                }
                 if (entry) {
                     const now = Date.now();
                     if (now < entry.freshUntil) {
                         return buildResponseFromCache(entry, "HIT", statusHeaderName, method === "HEAD");
                     }
                     if (revalidate && now < entry.staleUntil) {
-                        backgroundRefresh(key, ctx.request);
+                        backgroundRefresh(servedKey, ctx.request);
                         return buildResponseFromCache(entry, "STALE", statusHeaderName, method === "HEAD");
                     }
                 }
@@ -351,6 +632,15 @@ export function responseCache(opts = {}) {
                     res.headers.set(statusHeaderName, "MISS");
                 return undefined;
             }
+            // RFC 9111 §4.1: `Vary: *` declares the response unreusable for any other
+            // request, whatever its headers. There is no secondary key that can make
+            // it safe, so it is never stored.
+            const vary = parseVary(res.headers.get("vary"));
+            if (vary === "*") {
+                if (statusHeaderName)
+                    res.headers.set(statusHeaderName, "MISS");
+                return undefined;
+            }
             const buf = new Uint8Array(await res.clone().arrayBuffer());
             if (buf.byteLength > maxBodyBytes) {
                 if (statusHeaderName)
@@ -359,22 +649,37 @@ export function responseCache(opts = {}) {
             }
             const headers = [];
             res.headers.forEach((value, name) => {
-                // `Age` is recomputed on every serve; never persist a stale one.
-                if (name === "age")
+                // Hop-by-hop and per-request headers describe this exchange, not the
+                // stored representation; replaying them corrupts framing or leaks one
+                // caller's correlation id to the next.
+                if (excludedHeaders.has(name))
                     return;
                 headers.push([name, value]);
             });
             const now = Date.now();
             const freshMs = freshness ?? ttlMs;
+            const ttl = freshMs + swrMs;
+            const varyKey = vary.length ? varyKeyFor(ctx.request.headers, vary) : undefined;
             const entry = {
                 status: res.status,
                 headers,
                 body: buf.byteLength ? bytesToBase64(buf) : "",
                 storedAt: now,
                 freshUntil: now + freshMs,
-                staleUntil: now + freshMs + swrMs,
+                staleUntil: now + ttl,
+                ...(varyKey === undefined ? {} : { vary, varyKey }),
             };
-            const setResult = store.set(pending.key, entry, freshMs + swrMs);
+            // A varying response is written twice: once under its own variant key, so
+            // it survives other variants of the same URL being cached, and once at
+            // the primary key, where the next lookup reads it as the hint naming the
+            // fields that matter. The primary copy is the most recently stored
+            // variant, so that one is served in a single `get`.
+            if (varyKey !== undefined) {
+                const variantResult = store.set(variantKey(pending.key, varyKey), entry, ttl);
+                if (isPromiseLike(variantResult))
+                    await variantResult;
+            }
+            const setResult = store.set(pending.key, entry, ttl);
             if (isPromiseLike(setResult))
                 await setResult;
             if (statusHeaderName)
@@ -382,4 +687,8 @@ export function responseCache(opts = {}) {
             return undefined;
         },
     };
+    // Let the App boot guard see that a response cache is in this hook chain, and
+    // where in the order it sits relative to `tenancy()`.
+    hooks[RESPONSE_CACHE_HOOK_MARKER] = true;
+    return hooks;
 }

package/dist/safe-redirect.js

@@ -213,7 +213,9 @@ export function safeRedirect(target, options = {}) {
         // target (no protocol-relative, no backslash confusion, no controls).
         // Do not widen Location emission beyond what classify() would accept.
         const fallbackResult = classify(options.fallback, ["/*"], []);
-        if (!fallbackResult.ok || !options.fallback.startsWith("/") || options.fallback.startsWith("//")) {
+        if (!fallbackResult.ok ||
+            !options.fallback.startsWith("/") ||
+            options.fallback.startsWith("//")) {
             throw new TypeError(`safeRedirect: fallback must be a safe same-origin path starting with "/"; got ${options.fallback}`);
         }
         return buildResponse(fallbackResult.location, status, options.headers);

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4d7ef2ca-7207-5a53-933a-75950561ff0c",
+  "serialNumber": "urn:uuid:01ee81d6-1bb6-55ca-b05e-3e30279d9f5c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-20T09:04:35.490Z",
+    "timestamp": "2026-07-29T20:03:05.244Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-rc.5"
+        "version": "1.0.0-rc.7"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.5",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.7",
       "name": "@daloyjs/core",
-      "version": "1.0.0-rc.5",
+      "version": "1.0.0-rc.7",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.5",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.7",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-rc.5",
+        "tagId": "swidtag--daloyjs-core-1.0.0-rc.7",
         "name": "@daloyjs/core",
-        "version": "1.0.0-rc.5",
+        "version": "1.0.0-rc.7",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.5",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.7",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-rc.5",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.5-4d7ef2ca-7207-5a53-933a-75950561ff0c",
+  "name": "@daloyjs/core-1.0.0-rc.7",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.7-01ee81d6-1bb6-55ca-b05e-3e30279d9f5c",
   "creationInfo": {
-    "created": "2026-07-20T09:04:35.490Z",
+    "created": "2026-07-29T20:03:05.244Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-rc.5",
+      "versionInfo": "1.0.0-rc.7",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.5"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.7"
         }
       ]
     }

package/dist/security-schemes.js

@@ -28,8 +28,7 @@ export function securitySchemeRequiresPayloadAuth(scheme) {
     if (!scheme || typeof scheme !== "object")
         return false;
     const record = scheme;
-    return (record[REQUIRE_PAYLOAD_AUTH_EXTENSION] === true ||
-        record.requirePayloadAuth === true);
+    return record[REQUIRE_PAYLOAD_AUTH_EXTENSION] === true || record.requirePayloadAuth === true;
 }
 /**
  * Normalize a builder output into a spec-compliant OpenAPI security scheme by

package/dist/subdomains.js

@@ -126,10 +126,7 @@ export function subdomains(hostname, opts = {}) {
         }
         return resultFor(host, base);
     }
-    const suffixes = new Set([
-        ...PSL_PUBLIC_SUFFIXES,
-        ...(opts.extraSuffixes ?? []),
-    ]);
+    const suffixes = new Set([...PSL_PUBLIC_SUFFIXES, ...(opts.extraSuffixes ?? [])]);
     const labels = host.split(".");
     // Walk from the longest suffix candidate down to the shortest so the
     // longest match wins (`s3.amazonaws.com` beats `com`).