@daloyjs/core 1.0.0-rc.6 → 1.0.0-rc.8

package/dist/middleware.d.ts

@@ -470,8 +470,22 @@ export interface RateLimitOptions {
      * Trust x-forwarded-for / x-real-ip when deriving the default key.
      * Off by default because those headers are client-spoofable unless your
      * reverse proxy strips and rewrites them.
+     *
+     * When enabled, the key is the **rightmost** `X-Forwarded-For` entry — the
+     * one your immediate proxy appended — never the attacker-influenceable
+     * leftmost one, so rotating spoofed left entries cannot evade the limit.
+     * Behind more than one proxy hop, set {@link trustedHops} instead.
      */
     trustProxyHeaders?: boolean;
+    /**
+     * Declare exactly how many proxy hops sit between Daloy and the public
+     * internet. Implies proxy-header trust and derives the default key that
+     * many entries from the right of `X-Forwarded-For` via
+     * {@link "./conn-info.js".resolveForwardedClientIp}. Must be an integer in
+     * [1, 64]; validated at construction. Ignored when a custom `keyGenerator`
+     * is supplied.
+     */
+    trustedHops?: number;
     /** When true, set Retry-After header on 429. Default: true. */
     retryAfter?: boolean;
     /**
@@ -546,8 +560,24 @@ export interface LoginThrottleOptions {
     keyGenerator?: (ctx: RateLimitContext) => string;
     /** Shared store for the hard limit. Uses rateLimit()'s in-memory group bucket by default. */
     store?: RateLimitStore;
-    /** Trust x-forwarded-for / x-real-ip when deriving the default key. Default: false. */
+    /** Trust x-forwarded-for / x-real-ip when deriving the default key. Default: false.
+     *
+     * When enabled, the key is the **rightmost** `X-Forwarded-For` entry — the
+     * one your immediate proxy appended — never the attacker-influenceable
+     * leftmost one. Behind more than one proxy hop, set {@link trustedHops}
+     * instead.
+     */
     trustProxyHeaders?: boolean;
+    /**
+     * Declare exactly how many proxy hops sit between Daloy and the public
+     * internet. Implies proxy-header trust and derives the default key that
+     * many entries from the right of `X-Forwarded-For` via
+     * {@link "./conn-info.js".resolveForwardedClientIp}, so rotating spoofed
+     * left entries cannot evade the throttle. Must be an integer in [1, 64];
+     * validated at construction. Ignored when a custom `keyGenerator` is
+     * supplied.
+     */
+    trustedHops?: number;
     /** When true, set Retry-After header on 429. Default: true. */
     retryAfter?: boolean;
     /** Start slowing responses after this many attempts in the same window. Default: 2. */

package/dist/middleware.js

@@ -7,6 +7,7 @@
 import { assertCookieAttributes, readRequestCookie, serializeCookie } from "./cookie.js";
 import { TooManyRequestsError, ForbiddenError } from "./errors.js";
 import { randomId, sanitizeHeaderName, timingSafeEqual } from "./security.js";
+import { resolveForwardedClientIp, resolveForwardedTrust } from "./conn-info.js";
 /**
  * Generate or accept a stable `X-Request-ID` for every request. The id is
  * stamped on `ctx.state.requestId`, mirrored on outgoing response headers,
@@ -775,15 +776,8 @@ export function rateLimit(opts) {
         store = new MemoryStore();
     }
     const groupPrefix = opts.groupId ? `${opts.groupId}:` : "";
-    const keyOf = opts.keyGenerator ??
-        ((ctx) => {
-            if (opts.trustProxyHeaders) {
-                const xff = ctx.request.headers.get("x-forwarded-for");
-                const first = xff ? xff.split(",")[0].trim() : "";
-                return first || ctx.request.headers.get("x-real-ip") || "global";
-            }
-            return "global";
-        });
+    const hops = resolveForwardedTrust("rateLimit()", opts);
+    const keyOf = opts.keyGenerator ?? defaultForwardedRateLimitKey(hops);
     const enforce = async (ctx) => {
         const key = `${groupPrefix}${keyOf(ctx)}`;
         const { count, resetMs } = await store.hit(key, opts.windowMs);
@@ -811,15 +805,22 @@ function assertPositiveInteger(name, value) {
         throw new Error(`loginThrottle(): ${name} must be a positive integer.`);
     }
 }
-function defaultLoginThrottleKey(trustProxyHeaders) {
-    return (ctx) => {
-        if (trustProxyHeaders) {
-            const forwardedFor = ctx.request.headers.get("x-forwarded-for");
-            const firstForwarded = forwardedFor ? forwardedFor.split(",")[0].trim() : "";
-            return firstForwarded || ctx.request.headers.get("x-real-ip") || "global";
-        }
-        return "global";
-    };
+/**
+ * Default rate-limit / login-throttle key: the spoof-resistant forwarded client
+ * IP, or the shared `"global"` bucket when proxy-header trust is off or the
+ * request carries no trustworthy forwarded identity.
+ *
+ * @param hops - Trusted proxy hop count from
+ *   {@link "./conn-info.js".resolveForwardedTrust}, or `undefined` when
+ *   forwarded-header trust is disabled.
+ * @returns A key generator suitable for {@link rateLimit} and
+ *   {@link loginThrottle}.
+ * @internal
+ */
+function defaultForwardedRateLimitKey(hops) {
+    if (hops === undefined)
+        return () => "global";
+    return (ctx) => resolveForwardedClientIp(ctx.request, hops) ?? "global";
 }
 function wait(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
@@ -852,7 +853,8 @@ export function loginThrottle(opts = {}) {
     assertNonNegativeInteger("delayMs", delayMs);
     assertNonNegativeInteger("maxDelayMs", maxDelayMs);
     const groupId = opts.groupId ?? "login";
-    const keyGenerator = opts.keyGenerator ?? defaultLoginThrottleKey(opts.trustProxyHeaders);
+    const hops = resolveForwardedTrust("loginThrottle()", opts);
+    const keyGenerator = opts.keyGenerator ?? defaultForwardedRateLimitKey(hops);
     const limiter = rateLimit({
         windowMs,
         max,

package/dist/safe-redirect.js

@@ -69,6 +69,17 @@ const ALLOWED_REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
 // response-splitting via the `Location` header.
 // eslint-disable-next-line no-control-regex
 const CONTROL_CHAR_RE = /[\u0000-\u001f\u007f-\u009f]/;
+// Reject *percent-encoded* C0 controls and DEL (`%00`-`%1F`, `%7F`) that arrive
+// as literal text in the target (e.g. a still-encoded query value passed
+// straight through). `CONTROL_CHAR_RE` only sees decoded characters, so an
+// encoded tab would otherwise be written verbatim into the `Location` header.
+// Per WHATWG URL that stays same-origin, but legacy WebKit stacks strip
+// decoded tabs/newlines and can re-interpret `/%09/host` as protocol-relative
+// — the trick behind historical Safari open-redirect CVEs. The range is
+// deliberately narrow: UTF-8 continuation bytes live in `%80`-`%BF`, so
+// legitimate percent-encoded non-ASCII paths (e.g. `/s%C3%A9arch`) are
+// unaffected.
+const ENCODED_CONTROL_CHAR_RE = /%(?:0[0-9a-f]|1[0-9a-f]|7f)/i;
 // Any code point above U+00FF (outside Latin-1). Such characters cannot be
 // written to a `Location` header — which is serialized as an ISO-8859-1
 // ByteString, so `Headers.set` throws a raw `TypeError` — and they cover the
@@ -91,6 +102,14 @@ function classify(target, allowedPaths, allowedOrigins) {
     if (CONTROL_CHAR_RE.test(target)) {
         return { ok: false, reason: "invalid-control-characters" };
     }
+    // Encoded control characters (`%09`, `%00`, …) arriving as literal text:
+    // spec-compliant browsers keep `/%09/host` same-origin, but legacy WebKit
+    // strips decoded tabs/newlines and can fold it into an origin-escaping
+    // protocol-relative URL. Refuse rather than rely on every user agent
+    // parsing it the WHATWG way.
+    if (ENCODED_CONTROL_CHAR_RE.test(target)) {
+        return { ok: false, reason: "invalid-control-characters" };
+    }
     // Protocol-relative (`//evil.com`) is the classic open-redirect bypass.
     if (target.startsWith("//"))
         return { ok: false, reason: "protocol-relative" };

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1fe1844d-d5f6-5dd3-b35a-8f79f17a35f5",
+  "serialNumber": "urn:uuid:91539bfb-7f26-5f45-8628-f7951991c7ca",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-26T17:41:07.733Z",
+    "timestamp": "2026-07-30T16:25:43.763Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.0.0-rc.6"
+        "version": "1.0.0-rc.8"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.6",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.0.0-rc.8",
       "name": "@daloyjs/core",
-      "version": "1.0.0-rc.6",
+      "version": "1.0.0-rc.8",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.6",
+      "purl": "pkg:npm/@daloyjs/core@1.0.0-rc.8",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.0.0-rc.6",
+        "tagId": "swidtag--daloyjs-core-1.0.0-rc.8",
         "name": "@daloyjs/core",
-        "version": "1.0.0-rc.6",
+        "version": "1.0.0-rc.8",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.6",
+      "ref": "pkg:npm/@daloyjs/core@1.0.0-rc.8",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.0.0-rc.6",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.6-1fe1844d-d5f6-5dd3-b35a-8f79f17a35f5",
+  "name": "@daloyjs/core-1.0.0-rc.8",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.0.0-rc.8-91539bfb-7f26-5f45-8628-f7951991c7ca",
   "creationInfo": {
-    "created": "2026-07-26T17:41:07.733Z",
+    "created": "2026-07-30T16:25:43.763Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.0.0-rc.6",
+      "versionInfo": "1.0.0-rc.8",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.6"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.0.0-rc.8"
         }
       ]
     }

package/dist/types.d.ts

@@ -305,6 +305,37 @@ export interface PreBodyContext<P extends string = string> {
         headers: Headers;
     };
 }
+/**
+ * Context handed to the caller-supplied resolvers of the network-identity
+ * access-control gates — `geoBlock`, `ipRestriction`, `botGuard`, `autoBan` and
+ * `ipReputation`.
+ *
+ * Those gates enforce from {@link Hooks.preBody} so a `responseCache()` hit
+ * cannot preempt them (see SECURITY.md, "Hook phase decides what a
+ * short-circuiting middleware can preempt"). Their callbacks therefore run
+ * before body I/O and before *any* `beforeHandle` middleware, which means:
+ *
+ * - `body` is always `undefined` — nothing has been parsed yet.
+ * - `state` holds only what `onRequest` / an earlier `preBody` layer put there.
+ *   In particular it does **not** hold anything `session()` or another
+ *   `beforeHandle` layer resolves.
+ *
+ * The alias exists so that is a compile error instead of a runtime surprise.
+ * Typing these callbacks on the full {@link BaseContext} — whose `body` widens
+ * to `any` — let `(ctx) => ctx.body.email` type-check and then silently evaluate
+ * to `undefined` at run time. The consequence differed per gate and two of the
+ * five failed *silently*: `ipReputation` fails open on an unresolved IP, and
+ * `autoBan` stopped recording strikes altogether because it never got an
+ * identity to attribute them to.
+ *
+ * Resolve identity from `request` (headers, URL), `params`, `query`, or state a
+ * `preBody` layer set. If a value genuinely requires the parsed body, it cannot
+ * be a `preBody` gate input — see {@link "./auto-ban.js".AutoBanOptions.keyGenerator},
+ * which falls back to a later phase for exactly that case.
+ *
+ * @since 1.0.0-rc.8
+ */
+export type IdentityGateContext = PreBodyContext<any>;
 /**
  * Lifecycle hooks fired around request handling. Hooks compose pipeline-style
  * — the global hooks (`AppOptions.hooks`) run first, then group hooks added

package/dist/waf.js

@@ -188,15 +188,32 @@ const MAX_DECODE_PASSES = 2;
  */
 const CONTROL_CHAR_PROBE = /[\u0000-\u0008\u000e-\u001f\u007f]/;
 const CONTROL_CHAR_GLOBAL = /[\u0000-\u0008\u000e-\u001f\u007f]/g;
+/**
+ * Non-ASCII probe used to skip {@link String.prototype.normalize} on the pure
+ * ASCII hot path. Fullwidth Latin (U+FF01–U+FF5E), compatibility ideographs,
+ * and other NFKC-collapsible code points only appear when this matches.
+ *
+ * Hoisted so the hot path neither re-creates the RegExp nor pays a
+ * literal-evaluation cost per inspected value.
+ */
+const NON_ASCII_PROBE = /[^\x00-\x7F]/;
 /**
  * Expand a single inbound string into the variants the WAF should scan.
  *
  * Includes the raw value, up to {@link MAX_DECODE_PASSES} percent-decodes,
  * a `+`→space form (URLSearchParams parity), a SQL-comment-stripped
  * form so comment-split keywords (e.g. OR wrapped in block comments) score
- * the same as the whitespace-separated form, and a control-character→space
+ * the same as the whitespace-separated form, a control-character→space
  * form so embedded NUL / escape bytes cannot split keywords past the
- * whitespace-anchored signatures (e.g. `1'%00OR%001=1` → `1' OR 1=1`).
+ * whitespace-anchored signatures (e.g. `1'%00OR%001=1` → `1' OR 1=1`), and
+ * an NFKC-normalized form so fullwidth / compatibility-homoglyph keywords
+ * (e.g. `ｕｎｉｏｎ ｓｅｌｅｃｔ`) score the same as their ASCII counterparts.
+ *
+ * The NFKC fold is applied to the decode chain *before* the `+` / comment /
+ * control-character passes, and its output joins that chain, so the transforms
+ * **compose**: a payload mixing homoglyphs with comment- or NUL-splitting
+ * (`＇%00ＯＲ%00＇１＇＝＇１`) still converges on the ASCII form the signatures
+ * anchor on. Closing each evasion only in isolation leaves the combination open.
  *
  * Scanning variants is pure defense-in-depth: the handler still receives
  * whatever the framework's single-decode path produced. Each variant is
@@ -228,6 +245,25 @@ function inspectionVariants(value, maxValueLength) {
     }
     // Snapshot before secondary transforms so we only expand the decode chain.
     const decodedChain = out.slice();
+    // Fold compatibility characters FIRST, and extend the chain with the folded
+    // forms, so the secondary transforms below run on them too. Order matters:
+    // pushing the NFKC form after the loop (or without extending `decodedChain`)
+    // leaves each evasion closed only in isolation, and composing two of them
+    // reopens the hole — `＇%00ＯＲ%00＇１＇＝＇１` folds to a NUL-split ASCII
+    // tautology that the control-char pass would catch, and control-strips to a
+    // fullwidth tautology that the fold would catch, but neither variant is ever
+    // subjected to the other transform. Extending the chain makes the passes
+    // compose, so any combination of fold + decode + comment/control/`+`
+    // splitting converges on the same ASCII form the signatures anchor on.
+    for (const v of out.slice()) {
+        if (NON_ASCII_PROBE.test(v)) {
+            const nfkc = v.normalize("NFKC");
+            if (nfkc !== v) {
+                push(nfkc);
+                decodedChain.push(nfkc);
+            }
+        }
+    }
     for (const v of decodedChain) {
         if (v.includes("+"))
             push(v.replace(/\+/g, " "));

package/dist/websocket.d.ts

@@ -20,13 +20,24 @@ export declare const WS_OPCODE: {
     readonly PING: 9;
     readonly PONG: 10;
 };
-/** Common RFC 6455 / IANA close codes. */
+/**
+ * Common RFC 6455 / IANA close codes.
+ *
+ * `NO_STATUS_RECEIVED` (1005) and `ABNORMAL_CLOSURE` (1006) are **receive-only
+ * sentinels**: RFC 6455 §7.4.1 reserves them for reporting a local condition to
+ * the application and forbids them in a CLOSE frame on the wire. Passing either
+ * to `close()` or {@link encodeClosePayload} throws
+ * {@link WebSocketProtocolError} — to close with no status code, send an empty
+ * payload instead.
+ */
 export declare const WS_CLOSE_CODE: {
     readonly NORMAL_CLOSURE: 1000;
     readonly GOING_AWAY: 1001;
     readonly PROTOCOL_ERROR: 1002;
     readonly UNSUPPORTED_DATA: 1003;
+    /** Receive-only sentinel — never send this on the wire. */
     readonly NO_STATUS_RECEIVED: 1005;
+    /** Receive-only sentinel — never send this on the wire. */
     readonly ABNORMAL_CLOSURE: 1006;
     readonly INVALID_PAYLOAD: 1007;
     readonly POLICY_VIOLATION: 1008;
@@ -479,13 +490,37 @@ export declare function encodeFrame(opts: {
     payload?: Uint8Array;
     mask?: boolean;
 }): Uint8Array;
+/**
+ * Whether `code` may legally appear in a CLOSE frame on the wire per
+ * RFC 6455 §7.1.6 / §7.4.
+ *
+ * Valid: `1000`–`1014` from the registered range, minus the three codes
+ * §7.4.1 reserves for local reporting only (`1004` unassigned, `1005`
+ * "no status received", `1006` "abnormal closure"), plus the `3000`–`4999`
+ * library/application range. Everything else — `0`–`999`, `1015`+, and all of
+ * `2000`–`2999` — is a protocol violation.
+ *
+ * Used on both sides of the codec so the framework can never *emit* a code it
+ * would reject on receipt.
+ *
+ * @param code - Candidate close status code.
+ * @returns `true` when the code is legal in a wire CLOSE frame.
+ * @since 1.0.0-rc.8
+ */
+export declare function isValidWireCloseCode(code: number): boolean;
 /**
  * Encode a CLOSE frame payload (`uint16 code` + optional UTF-8 reason).
  *
- * @param code - RFC 6455 close status code, written big-endian.
+ * @param code - RFC 6455 close status code, written big-endian. Must be legal
+ *   on the wire — see {@link isValidWireCloseCode}. To close with *no* status
+ *   code, send an empty payload rather than passing `1005`.
  * @param reason - Optional human-readable reason. Defaults to `""`.
  * @returns The 2+N byte close payload.
- * @throws WebSocketProtocolError when the encoded reason exceeds 123 bytes.
+ * @throws WebSocketProtocolError when the encoded reason exceeds 123 bytes, or
+ *   when `code` is not valid on the wire. Validating here as well as in
+ *   {@link decodeClosePayload} keeps the codec symmetric: without it the
+ *   framework could emit a frame its own decoder — and any conforming peer —
+ *   must reject with `1002`.
  */
 export declare function encodeClosePayload(code: number, reason?: string): Uint8Array;
 /**
@@ -493,8 +528,16 @@ export declare function encodeClosePayload(code: number, reason?: string): Uint8
  *
  * @param payload - Unmasked close-frame payload bytes.
  * @returns The close `code` and decoded UTF-8 `reason`.
- * @throws WebSocketProtocolError when the payload is exactly 1 byte or the
- *   reason is not valid UTF-8.
+ * @throws WebSocketProtocolError when the payload is exactly 1 byte, the
+ *   reason is not valid UTF-8, or the status code is not valid on the wire —
+ *   see {@link isValidWireCloseCode}. Without this check an endpoint would
+ *   echo an attacker-supplied invalid code (e.g. 999) back in its own CLOSE
+ *   frame instead of failing the connection with a 1002 protocol error.
+ *
+ * Note the asymmetry in the empty-payload case: a peer that closes with no
+ * status code yields the `1005` *sentinel*, which is deliberately not legal to
+ * send back. An endpoint echoing that close must reply with an empty payload,
+ * not with `1005`.
  */
 export declare function decodeClosePayload(payload: Uint8Array): {
     code: number;

package/dist/websocket.js

@@ -53,13 +53,24 @@ export const WS_OPCODE = {
     PING: 0x9,
     PONG: 0xa,
 };
-/** Common RFC 6455 / IANA close codes. */
+/**
+ * Common RFC 6455 / IANA close codes.
+ *
+ * `NO_STATUS_RECEIVED` (1005) and `ABNORMAL_CLOSURE` (1006) are **receive-only
+ * sentinels**: RFC 6455 §7.4.1 reserves them for reporting a local condition to
+ * the application and forbids them in a CLOSE frame on the wire. Passing either
+ * to `close()` or {@link encodeClosePayload} throws
+ * {@link WebSocketProtocolError} — to close with no status code, send an empty
+ * payload instead.
+ */
 export const WS_CLOSE_CODE = {
     NORMAL_CLOSURE: 1000,
     GOING_AWAY: 1001,
     PROTOCOL_ERROR: 1002,
     UNSUPPORTED_DATA: 1003,
+    /** Receive-only sentinel — never send this on the wire. */
     NO_STATUS_RECEIVED: 1005,
+    /** Receive-only sentinel — never send this on the wire. */
     ABNORMAL_CLOSURE: 1006,
     INVALID_PAYLOAD: 1007,
     POLICY_VIOLATION: 1008,
@@ -667,15 +678,45 @@ export function encodeFrame(opts) {
     }
     return out;
 }
+/**
+ * Whether `code` may legally appear in a CLOSE frame on the wire per
+ * RFC 6455 §7.1.6 / §7.4.
+ *
+ * Valid: `1000`–`1014` from the registered range, minus the three codes
+ * §7.4.1 reserves for local reporting only (`1004` unassigned, `1005`
+ * "no status received", `1006` "abnormal closure"), plus the `3000`–`4999`
+ * library/application range. Everything else — `0`–`999`, `1015`+, and all of
+ * `2000`–`2999` — is a protocol violation.
+ *
+ * Used on both sides of the codec so the framework can never *emit* a code it
+ * would reject on receipt.
+ *
+ * @param code - Candidate close status code.
+ * @returns `true` when the code is legal in a wire CLOSE frame.
+ * @since 1.0.0-rc.8
+ */
+export function isValidWireCloseCode(code) {
+    return ((code >= 1000 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006) ||
+        (code >= 3000 && code <= 4999));
+}
 /**
  * Encode a CLOSE frame payload (`uint16 code` + optional UTF-8 reason).
  *
- * @param code - RFC 6455 close status code, written big-endian.
+ * @param code - RFC 6455 close status code, written big-endian. Must be legal
+ *   on the wire — see {@link isValidWireCloseCode}. To close with *no* status
+ *   code, send an empty payload rather than passing `1005`.
  * @param reason - Optional human-readable reason. Defaults to `""`.
  * @returns The 2+N byte close payload.
- * @throws WebSocketProtocolError when the encoded reason exceeds 123 bytes.
+ * @throws WebSocketProtocolError when the encoded reason exceeds 123 bytes, or
+ *   when `code` is not valid on the wire. Validating here as well as in
+ *   {@link decodeClosePayload} keeps the codec symmetric: without it the
+ *   framework could emit a frame its own decoder — and any conforming peer —
+ *   must reject with `1002`.
  */
 export function encodeClosePayload(code, reason = "") {
+    if (!isValidWireCloseCode(code)) {
+        throw new WebSocketProtocolError(`Invalid close status code ${code}`);
+    }
     const reasonBytes = enc.encode(reason);
     if (reasonBytes.length > WS_MAX_CONTROL_PAYLOAD - 2) {
         throw new WebSocketProtocolError("Close reason exceeds 123 bytes");
@@ -691,8 +732,16 @@ export function encodeClosePayload(code, reason = "") {
  *
  * @param payload - Unmasked close-frame payload bytes.
  * @returns The close `code` and decoded UTF-8 `reason`.
- * @throws WebSocketProtocolError when the payload is exactly 1 byte or the
- *   reason is not valid UTF-8.
+ * @throws WebSocketProtocolError when the payload is exactly 1 byte, the
+ *   reason is not valid UTF-8, or the status code is not valid on the wire —
+ *   see {@link isValidWireCloseCode}. Without this check an endpoint would
+ *   echo an attacker-supplied invalid code (e.g. 999) back in its own CLOSE
+ *   frame instead of failing the connection with a 1002 protocol error.
+ *
+ * Note the asymmetry in the empty-payload case: a peer that closes with no
+ * status code yields the `1005` *sentinel*, which is deliberately not legal to
+ * send back. An endpoint echoing that close must reply with an empty payload,
+ * not with `1005`.
  */
 export function decodeClosePayload(payload) {
     if (payload.length === 0)
@@ -700,6 +749,9 @@ export function decodeClosePayload(payload) {
     if (payload.length === 1)
         throw new WebSocketProtocolError("Close payload must be empty or ≥2 bytes");
     const code = (payload[0] << 8) | payload[1];
+    if (!isValidWireCloseCode(code)) {
+        throw new WebSocketProtocolError(`Invalid close status code ${code}`);
+    }
     const reason = new TextDecoder("utf-8", { fatal: true }).decode(payload.subarray(2));
     return { code, reason };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-rc.6",
-  "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
+  "version": "1.0.0-rc.8",
+  "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops \u2014 distributed via pnpm.",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -258,7 +258,7 @@
     "red-team:live": "node --import tsx red-team-live/run.ts",
     "coverage": "node --import tsx --test --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-lines=90 --test-coverage-functions=90 tests/**/*.test.ts",
     "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include='dist-coverage/src/**' --test-coverage-branches=92 dist-coverage/tests/**/*.test.js",
-    "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json && tsc -p tests/tsconfig.json --noEmit",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json && tsc -p tests/tsconfig.json --noEmit && tsc -p red-team-live/tsconfig.json --noEmit",
     "typecheck:tests": "tsc -p tests/tsconfig.json --noEmit",
     "format": "prettier --write .",
     "gen:openapi": "node --import tsx scripts/dump-openapi.ts",
@@ -297,10 +297,12 @@
     "verify:sbom": "node --import tsx scripts/verify-sbom.ts",
     "verify:breaking-changes": "node --import tsx scripts/verify-breaking-changes.ts",
     "verify:docs-links": "node --import tsx scripts/verify-docs-links.ts",
+    "verify:jsr-packaging": "npx --yes jsr publish --dry-run --allow-dirty",
     "scan:staged-secrets": "node --import tsx scripts/scan-staged-secrets.ts",
     "hooks:install": "node --import tsx scripts/install-git-hooks.ts",
     "audit": "pnpm audit --prod",
-    "prepublishOnly": "pnpm build && pnpm gen:sbom"
+    "prepublishOnly": "pnpm build && pnpm gen:sbom",
+    "typecheck:red-team-live": "tsc -p red-team-live/tsconfig.json --noEmit"
   },
   "files": [
     "dist",