@daloyjs/core 1.0.0-rc.7 → 1.0.0-rc.9

package/dist/waf.js

@@ -188,15 +188,32 @@ const MAX_DECODE_PASSES = 2;
  */
 const CONTROL_CHAR_PROBE = /[\u0000-\u0008\u000e-\u001f\u007f]/;
 const CONTROL_CHAR_GLOBAL = /[\u0000-\u0008\u000e-\u001f\u007f]/g;
+/**
+ * Non-ASCII probe used to skip {@link String.prototype.normalize} on the pure
+ * ASCII hot path. Fullwidth Latin (U+FF01–U+FF5E), compatibility ideographs,
+ * and other NFKC-collapsible code points only appear when this matches.
+ *
+ * Hoisted so the hot path neither re-creates the RegExp nor pays a
+ * literal-evaluation cost per inspected value.
+ */
+const NON_ASCII_PROBE = /[^\x00-\x7F]/;
 /**
  * Expand a single inbound string into the variants the WAF should scan.
  *
  * Includes the raw value, up to {@link MAX_DECODE_PASSES} percent-decodes,
  * a `+`→space form (URLSearchParams parity), a SQL-comment-stripped
  * form so comment-split keywords (e.g. OR wrapped in block comments) score
- * the same as the whitespace-separated form, and a control-character→space
+ * the same as the whitespace-separated form, a control-character→space
  * form so embedded NUL / escape bytes cannot split keywords past the
- * whitespace-anchored signatures (e.g. `1'%00OR%001=1` → `1' OR 1=1`).
+ * whitespace-anchored signatures (e.g. `1'%00OR%001=1` → `1' OR 1=1`), and
+ * an NFKC-normalized form so fullwidth / compatibility-homoglyph keywords
+ * (e.g. `ｕｎｉｏｎ ｓｅｌｅｃｔ`) score the same as their ASCII counterparts.
+ *
+ * The NFKC fold is applied to the decode chain *before* the `+` / comment /
+ * control-character passes, and its output joins that chain, so the transforms
+ * **compose**: a payload mixing homoglyphs with comment- or NUL-splitting
+ * (`＇%00ＯＲ%00＇１＇＝＇１`) still converges on the ASCII form the signatures
+ * anchor on. Closing each evasion only in isolation leaves the combination open.
  *
  * Scanning variants is pure defense-in-depth: the handler still receives
  * whatever the framework's single-decode path produced. Each variant is
@@ -228,6 +245,25 @@ function inspectionVariants(value, maxValueLength) {
     }
     // Snapshot before secondary transforms so we only expand the decode chain.
     const decodedChain = out.slice();
+    // Fold compatibility characters FIRST, and extend the chain with the folded
+    // forms, so the secondary transforms below run on them too. Order matters:
+    // pushing the NFKC form after the loop (or without extending `decodedChain`)
+    // leaves each evasion closed only in isolation, and composing two of them
+    // reopens the hole — `＇%00ＯＲ%00＇１＇＝＇１` folds to a NUL-split ASCII
+    // tautology that the control-char pass would catch, and control-strips to a
+    // fullwidth tautology that the fold would catch, but neither variant is ever
+    // subjected to the other transform. Extending the chain makes the passes
+    // compose, so any combination of fold + decode + comment/control/`+`
+    // splitting converges on the same ASCII form the signatures anchor on.
+    for (const v of out.slice()) {
+        if (NON_ASCII_PROBE.test(v)) {
+            const nfkc = v.normalize("NFKC");
+            if (nfkc !== v) {
+                push(nfkc);
+                decodedChain.push(nfkc);
+            }
+        }
+    }
     for (const v of decodedChain) {
         if (v.includes("+"))
             push(v.replace(/\+/g, " "));

package/dist/websocket.d.ts

@@ -20,13 +20,24 @@ export declare const WS_OPCODE: {
     readonly PING: 9;
     readonly PONG: 10;
 };
-/** Common RFC 6455 / IANA close codes. */
+/**
+ * Common RFC 6455 / IANA close codes.
+ *
+ * `NO_STATUS_RECEIVED` (1005) and `ABNORMAL_CLOSURE` (1006) are **receive-only
+ * sentinels**: RFC 6455 §7.4.1 reserves them for reporting a local condition to
+ * the application and forbids them in a CLOSE frame on the wire. Passing either
+ * to `close()` or {@link encodeClosePayload} throws
+ * {@link WebSocketProtocolError} — to close with no status code, send an empty
+ * payload instead.
+ */
 export declare const WS_CLOSE_CODE: {
     readonly NORMAL_CLOSURE: 1000;
     readonly GOING_AWAY: 1001;
     readonly PROTOCOL_ERROR: 1002;
     readonly UNSUPPORTED_DATA: 1003;
+    /** Receive-only sentinel — never send this on the wire. */
     readonly NO_STATUS_RECEIVED: 1005;
+    /** Receive-only sentinel — never send this on the wire. */
     readonly ABNORMAL_CLOSURE: 1006;
     readonly INVALID_PAYLOAD: 1007;
     readonly POLICY_VIOLATION: 1008;
@@ -479,13 +490,37 @@ export declare function encodeFrame(opts: {
     payload?: Uint8Array;
     mask?: boolean;
 }): Uint8Array;
+/**
+ * Whether `code` may legally appear in a CLOSE frame on the wire per
+ * RFC 6455 §7.1.6 / §7.4.
+ *
+ * Valid: `1000`–`1014` from the registered range, minus the three codes
+ * §7.4.1 reserves for local reporting only (`1004` unassigned, `1005`
+ * "no status received", `1006` "abnormal closure"), plus the `3000`–`4999`
+ * library/application range. Everything else — `0`–`999`, `1015`+, and all of
+ * `2000`–`2999` — is a protocol violation.
+ *
+ * Used on both sides of the codec so the framework can never *emit* a code it
+ * would reject on receipt.
+ *
+ * @param code - Candidate close status code.
+ * @returns `true` when the code is legal in a wire CLOSE frame.
+ * @since 1.0.0-rc.8
+ */
+export declare function isValidWireCloseCode(code: number): boolean;
 /**
  * Encode a CLOSE frame payload (`uint16 code` + optional UTF-8 reason).
  *
- * @param code - RFC 6455 close status code, written big-endian.
+ * @param code - RFC 6455 close status code, written big-endian. Must be legal
+ *   on the wire — see {@link isValidWireCloseCode}. To close with *no* status
+ *   code, send an empty payload rather than passing `1005`.
  * @param reason - Optional human-readable reason. Defaults to `""`.
  * @returns The 2+N byte close payload.
- * @throws WebSocketProtocolError when the encoded reason exceeds 123 bytes.
+ * @throws WebSocketProtocolError when the encoded reason exceeds 123 bytes, or
+ *   when `code` is not valid on the wire. Validating here as well as in
+ *   {@link decodeClosePayload} keeps the codec symmetric: without it the
+ *   framework could emit a frame its own decoder — and any conforming peer —
+ *   must reject with `1002`.
  */
 export declare function encodeClosePayload(code: number, reason?: string): Uint8Array;
 /**
@@ -493,8 +528,16 @@ export declare function encodeClosePayload(code: number, reason?: string): Uint8
  *
  * @param payload - Unmasked close-frame payload bytes.
  * @returns The close `code` and decoded UTF-8 `reason`.
- * @throws WebSocketProtocolError when the payload is exactly 1 byte or the
- *   reason is not valid UTF-8.
+ * @throws WebSocketProtocolError when the payload is exactly 1 byte, the
+ *   reason is not valid UTF-8, or the status code is not valid on the wire —
+ *   see {@link isValidWireCloseCode}. Without this check an endpoint would
+ *   echo an attacker-supplied invalid code (e.g. 999) back in its own CLOSE
+ *   frame instead of failing the connection with a 1002 protocol error.
+ *
+ * Note the asymmetry in the empty-payload case: a peer that closes with no
+ * status code yields the `1005` *sentinel*, which is deliberately not legal to
+ * send back. An endpoint echoing that close must reply with an empty payload,
+ * not with `1005`.
  */
 export declare function decodeClosePayload(payload: Uint8Array): {
     code: number;

package/dist/websocket.js

@@ -53,13 +53,24 @@ export const WS_OPCODE = {
     PING: 0x9,
     PONG: 0xa,
 };
-/** Common RFC 6455 / IANA close codes. */
+/**
+ * Common RFC 6455 / IANA close codes.
+ *
+ * `NO_STATUS_RECEIVED` (1005) and `ABNORMAL_CLOSURE` (1006) are **receive-only
+ * sentinels**: RFC 6455 §7.4.1 reserves them for reporting a local condition to
+ * the application and forbids them in a CLOSE frame on the wire. Passing either
+ * to `close()` or {@link encodeClosePayload} throws
+ * {@link WebSocketProtocolError} — to close with no status code, send an empty
+ * payload instead.
+ */
 export const WS_CLOSE_CODE = {
     NORMAL_CLOSURE: 1000,
     GOING_AWAY: 1001,
     PROTOCOL_ERROR: 1002,
     UNSUPPORTED_DATA: 1003,
+    /** Receive-only sentinel — never send this on the wire. */
     NO_STATUS_RECEIVED: 1005,
+    /** Receive-only sentinel — never send this on the wire. */
     ABNORMAL_CLOSURE: 1006,
     INVALID_PAYLOAD: 1007,
     POLICY_VIOLATION: 1008,
@@ -667,15 +678,45 @@ export function encodeFrame(opts) {
     }
     return out;
 }
+/**
+ * Whether `code` may legally appear in a CLOSE frame on the wire per
+ * RFC 6455 §7.1.6 / §7.4.
+ *
+ * Valid: `1000`–`1014` from the registered range, minus the three codes
+ * §7.4.1 reserves for local reporting only (`1004` unassigned, `1005`
+ * "no status received", `1006` "abnormal closure"), plus the `3000`–`4999`
+ * library/application range. Everything else — `0`–`999`, `1015`+, and all of
+ * `2000`–`2999` — is a protocol violation.
+ *
+ * Used on both sides of the codec so the framework can never *emit* a code it
+ * would reject on receipt.
+ *
+ * @param code - Candidate close status code.
+ * @returns `true` when the code is legal in a wire CLOSE frame.
+ * @since 1.0.0-rc.8
+ */
+export function isValidWireCloseCode(code) {
+    return ((code >= 1000 && code <= 1014 && code !== 1004 && code !== 1005 && code !== 1006) ||
+        (code >= 3000 && code <= 4999));
+}
 /**
  * Encode a CLOSE frame payload (`uint16 code` + optional UTF-8 reason).
  *
- * @param code - RFC 6455 close status code, written big-endian.
+ * @param code - RFC 6455 close status code, written big-endian. Must be legal
+ *   on the wire — see {@link isValidWireCloseCode}. To close with *no* status
+ *   code, send an empty payload rather than passing `1005`.
  * @param reason - Optional human-readable reason. Defaults to `""`.
  * @returns The 2+N byte close payload.
- * @throws WebSocketProtocolError when the encoded reason exceeds 123 bytes.
+ * @throws WebSocketProtocolError when the encoded reason exceeds 123 bytes, or
+ *   when `code` is not valid on the wire. Validating here as well as in
+ *   {@link decodeClosePayload} keeps the codec symmetric: without it the
+ *   framework could emit a frame its own decoder — and any conforming peer —
+ *   must reject with `1002`.
  */
 export function encodeClosePayload(code, reason = "") {
+    if (!isValidWireCloseCode(code)) {
+        throw new WebSocketProtocolError(`Invalid close status code ${code}`);
+    }
     const reasonBytes = enc.encode(reason);
     if (reasonBytes.length > WS_MAX_CONTROL_PAYLOAD - 2) {
         throw new WebSocketProtocolError("Close reason exceeds 123 bytes");
@@ -691,8 +732,16 @@ export function encodeClosePayload(code, reason = "") {
  *
  * @param payload - Unmasked close-frame payload bytes.
  * @returns The close `code` and decoded UTF-8 `reason`.
- * @throws WebSocketProtocolError when the payload is exactly 1 byte or the
- *   reason is not valid UTF-8.
+ * @throws WebSocketProtocolError when the payload is exactly 1 byte, the
+ *   reason is not valid UTF-8, or the status code is not valid on the wire —
+ *   see {@link isValidWireCloseCode}. Without this check an endpoint would
+ *   echo an attacker-supplied invalid code (e.g. 999) back in its own CLOSE
+ *   frame instead of failing the connection with a 1002 protocol error.
+ *
+ * Note the asymmetry in the empty-payload case: a peer that closes with no
+ * status code yields the `1005` *sentinel*, which is deliberately not legal to
+ * send back. An endpoint echoing that close must reply with an empty payload,
+ * not with `1005`.
  */
 export function decodeClosePayload(payload) {
     if (payload.length === 0)
@@ -700,6 +749,9 @@ export function decodeClosePayload(payload) {
     if (payload.length === 1)
         throw new WebSocketProtocolError("Close payload must be empty or ≥2 bytes");
     const code = (payload[0] << 8) | payload[1];
+    if (!isValidWireCloseCode(code)) {
+        throw new WebSocketProtocolError(`Invalid close status code ${code}`);
+    }
     const reason = new TextDecoder("utf-8", { fatal: true }).decode(payload.subarray(2));
     return { code, reason };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.0.0-rc.7",
-  "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
+  "version": "1.0.0-rc.9",
+  "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops \u2014 distributed via pnpm.",
   "type": "module",
   "publishConfig": {
     "access": "public"
@@ -258,7 +258,7 @@
     "red-team:live": "node --import tsx red-team-live/run.ts",
     "coverage": "node --import tsx --test --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-lines=90 --test-coverage-functions=90 tests/**/*.test.ts",
     "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include='dist-coverage/src/**' --test-coverage-branches=92 dist-coverage/tests/**/*.test.js",
-    "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json && tsc -p tests/tsconfig.json --noEmit",
+    "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json && tsc -p tests/tsconfig.json --noEmit && tsc -p red-team-live/tsconfig.json --noEmit",
     "typecheck:tests": "tsc -p tests/tsconfig.json --noEmit",
     "format": "prettier --write .",
     "gen:openapi": "node --import tsx scripts/dump-openapi.ts",
@@ -297,10 +297,12 @@
     "verify:sbom": "node --import tsx scripts/verify-sbom.ts",
     "verify:breaking-changes": "node --import tsx scripts/verify-breaking-changes.ts",
     "verify:docs-links": "node --import tsx scripts/verify-docs-links.ts",
+    "verify:jsr-packaging": "npx --yes jsr publish --dry-run --allow-dirty",
     "scan:staged-secrets": "node --import tsx scripts/scan-staged-secrets.ts",
     "hooks:install": "node --import tsx scripts/install-git-hooks.ts",
     "audit": "pnpm audit --prod",
-    "prepublishOnly": "pnpm build && pnpm gen:sbom"
+    "prepublishOnly": "pnpm build && pnpm gen:sbom",
+    "typecheck:red-team-live": "tsc -p red-team-live/tsconfig.json --noEmit"
   },
   "files": [
     "dist",