@daloyjs/core 1.3.1 → 1.3.2

package/dist/compression.d.ts

@@ -115,6 +115,8 @@ export declare function _resetCompressionRuntimeProbeForTests(): void;
  * - response already declares a `Content-Encoding`;
  * - response declares a `Set-Cookie` (response is mutating auth state);
  * - response body byte length is below `minimumSize` (default `1024`);
+ * - response body exceeds `maxCompressibleBytes` while reading; only the
+ *   capture clone is cancelled, without waiting for the client to consume it;
  * - response `Content-Type` is in the always-on already-compressed
  *   deny-list (image/video/audio/archives/fonts/wasm/pdf, with
  *   `image/svg+xml` carved back in as compressible XML).

package/dist/compression.js

@@ -20,6 +20,7 @@
  *
  * @since 0.25.0
  */
+import { readResponseBodyUpTo } from "./internal-body.js";
 /**
  * Internal marker stamped on the hook so a future audit gate can confirm
  * the BREACH-aware middleware is installed (audit-item parity).
@@ -217,57 +218,6 @@ function normalizeOptionTokens(values, optionName) {
     }
     return Object.freeze(normalized);
 }
-/**
- * Read a response body up to `maxBytes`. Returns `null` if the stream
- * exceeds the cap (body is cancelled; caller should leave the response
- * uncompressed). Returns an empty buffer when there is no body.
- *
- * @param res - Response whose body will be consumed (pass a clone).
- * @param maxBytes - Inclusive upper bound on buffered size.
- */
-async function readBodyUpTo(res, maxBytes) {
-    if (!res.body)
-        return new Uint8Array(0);
-    const reader = res.body.getReader();
-    const chunks = [];
-    let total = 0;
-    try {
-        // eslint-disable-next-line no-constant-condition
-        while (true) {
-            const { done, value } = await reader.read();
-            if (done)
-                break;
-            if (!value || value.byteLength === 0)
-                continue;
-            total += value.byteLength;
-            if (total > maxBytes) {
-                await reader.cancel();
-                return null;
-            }
-            chunks.push(value);
-        }
-    }
-    catch {
-        try {
-            await reader.cancel();
-        }
-        catch {
-            /* ignore */
-        }
-        return null;
-    }
-    if (chunks.length === 0)
-        return new Uint8Array(0);
-    if (chunks.length === 1)
-        return chunks[0];
-    const out = new Uint8Array(total);
-    let offset = 0;
-    for (const c of chunks) {
-        out.set(c, offset);
-        offset += c.byteLength;
-    }
-    return out;
-}
 async function compressBytes(bytes, encoding) {
     const Stream = globalThis.CompressionStream;
     const cs = new Stream(encoding);
@@ -317,6 +267,8 @@ async function compressBytes(bytes, encoding) {
  * - response already declares a `Content-Encoding`;
  * - response declares a `Set-Cookie` (response is mutating auth state);
  * - response body byte length is below `minimumSize` (default `1024`);
+ * - response body exceeds `maxCompressibleBytes` while reading; only the
+ *   capture clone is cancelled, without waiting for the client to consume it;
  * - response `Content-Type` is in the always-on already-compressed
  *   deny-list (image/video/audio/archives/fonts/wasm/pdf, with
  *   `image/svg+xml` carved back in as compressible XML).
@@ -407,7 +359,7 @@ export function compression(opts = {}) {
                 if (Number.isFinite(n) && n > maxCompressibleBytes)
                     return undefined;
             }
-            const original = await readBodyUpTo(res.clone(), maxCompressibleBytes);
+            const original = await readResponseBodyUpTo(res.clone(), maxCompressibleBytes).catch(() => null);
             if (original === null)
                 return undefined; // exceeded cap while streaming
             if (original.byteLength < minimumSize)

package/dist/fetch-guard.d.ts

@@ -254,7 +254,15 @@ export interface FetchGuardOptions {
  * @param options - Guard configuration; see {@link FetchGuardOptions}. Omit
  *   for the strict default posture (public IPs over `http:`/`https:` only).
  * @returns A `fetch`-compatible function that validates every hop (including
- *   redirects) and throws {@link SsrfBlockedError} on refusal.
+ *   redirects). Cross-origin redirects remove `Authorization`, `Cookie`,
+ *   `Proxy-Authorization`, and explicit `Host` headers; same-origin redirects
+ *   preserve them. Custom credential headers must not be used with untrusted
+ *   redirect destinations; use `redirect: "error"` or `"manual"` in that case.
+ * @throws {Error} If no underlying fetch implementation is available.
+ * @throws {SsrfBlockedError} The returned function throws when a destination
+ *   or redirect chain violates the configured policy; network errors propagate.
+ * @throws {TypeError} The returned function throws on invalid requests or
+ *   redirects when `redirect: "error"` is selected.
  * @since 0.34.0
  */
 export declare function fetchGuard(options?: FetchGuardOptions): typeof fetch;

package/dist/fetch-guard.js

@@ -176,7 +176,15 @@ const UNIQUE_LOCAL = ["fc00::/7"];
  * @param options - Guard configuration; see {@link FetchGuardOptions}. Omit
  *   for the strict default posture (public IPs over `http:`/`https:` only).
  * @returns A `fetch`-compatible function that validates every hop (including
- *   redirects) and throws {@link SsrfBlockedError} on refusal.
+ *   redirects). Cross-origin redirects remove `Authorization`, `Cookie`,
+ *   `Proxy-Authorization`, and explicit `Host` headers; same-origin redirects
+ *   preserve them. Custom credential headers must not be used with untrusted
+ *   redirect destinations; use `redirect: "error"` or `"manual"` in that case.
+ * @throws {Error} If no underlying fetch implementation is available.
+ * @throws {SsrfBlockedError} The returned function throws when a destination
+ *   or redirect chain violates the configured policy; network errors propagate.
+ * @throws {TypeError} The returned function throws on invalid requests or
+ *   redirects when `redirect: "error"` is selected.
  * @since 0.34.0
  */
 export function fetchGuard(options = {}) {
@@ -371,6 +379,12 @@ export function fetchGuard(options = {}) {
                     referrerPolicy: request.referrerPolicy,
                 })
                 : new Request(next, request);
+            if (next.origin !== currentUrl.origin) {
+                request.headers.delete("authorization");
+                request.headers.delete("cookie");
+                request.headers.delete("proxy-authorization");
+                request.headers.delete("host");
+            }
             currentUrl = next;
         }
     };

package/dist/fetch-resilience.d.ts

@@ -283,6 +283,10 @@ export interface ResilientFetchOptions {
  * Wrap a `fetch` with per-call timeout, retry-with-backoff, and a shared
  * circuit breaker. The returned function has the same call signature as
  * the global `fetch`.
+ * Response bodies discarded for a retry are cancelled before backoff without
+ * waiting for producer cancellation. The final response remains caller-owned.
+ * Caller cancellation preserves arbitrary abort reasons and never counts as
+ * an upstream failure or schedules another retry.
  *
  * Layer it over {@link fetchGuard} to keep SSRF protection underneath:
  *

package/dist/fetch-resilience.js

@@ -348,6 +348,10 @@ function isAbortError(err) {
  * Wrap a `fetch` with per-call timeout, retry-with-backoff, and a shared
  * circuit breaker. The returned function has the same call signature as
  * the global `fetch`.
+ * Response bodies discarded for a retry are cancelled before backoff without
+ * waiting for producer cancellation. The final response remains caller-owned.
+ * Caller cancellation preserves arbitrary abort reasons and never counts as
+ * an upstream failure or schedules another retry.
  *
  * Layer it over {@link fetchGuard} to keep SSRF protection underneath:
  *
@@ -416,6 +420,7 @@ export function resilientFetch(options = {}) {
         // the caller's signal can be combined per attempt.
         const request = new Request(input, init);
         const callerSignal = init?.signal ?? request.signal;
+        callerSignal?.throwIfAborted();
         const run = async () => {
             let lastError;
             for (let attempt = 1; attempt <= retries + 1; attempt++) {
@@ -428,8 +433,7 @@ export function resilientFetch(options = {}) {
                 catch (err) {
                     cleanup();
                     // Caller cancelled: never retry, never count as upstream failure.
-                    if (isAbortError(err) && callerSignal?.aborted)
-                        throw err;
+                    callerSignal?.throwIfAborted();
                     // An SSRF refusal from an underlying fetchGuard is a hard, terminal
                     // decision about the request itself — never retried.
                     if (err instanceof Error && err.name === "SsrfBlockedError")
@@ -441,8 +445,7 @@ export function resilientFetch(options = {}) {
                         const delay = backoffFor(attempt);
                         options.onRetry?.(ctx, delay);
                         await sleep(delay, callerSignal ?? undefined);
-                        if (callerSignal?.aborted)
-                            throw lastError;
+                        callerSignal?.throwIfAborted();
                         continue;
                     }
                     throw lastError;
@@ -452,9 +455,9 @@ export function resilientFetch(options = {}) {
                 if (attempt <= retries && shouldRetry(ctx)) {
                     const delay = backoffFor(attempt, response);
                     options.onRetry?.(ctx, delay);
+                    void response.body?.cancel().catch(() => undefined);
                     await sleep(delay, callerSignal ?? undefined);
-                    if (callerSignal?.aborted)
-                        return response;
+                    callerSignal?.throwIfAborted();
                     continue;
                 }
                 return response;
@@ -476,7 +479,7 @@ export function resilientFetch(options = {}) {
             // SSRF refusals and caller aborts are not upstream health signals.
             if (err instanceof CircuitOpenError)
                 throw err;
-            const isCallerAbort = isAbortError(err) && callerSignal?.aborted;
+            const isCallerAbort = callerSignal?.aborted;
             const isSsrf = err instanceof Error && err.name === "SsrfBlockedError";
             if (isCallerAbort || isSsrf)
                 breaker.release();

package/dist/http-signatures.d.ts

@@ -39,7 +39,11 @@ import type { Hooks } from "./types.js";
  * @since 0.37.0
  */
 export type HttpSignatureAlgorithm = "hmac-sha256" | "ed25519" | "ecdsa-p256-sha256" | "ecdsa-p384-sha384" | "rsa-pss-sha512" | "rsa-v1_5-sha256";
-/** Key material accepted by the signer/verifier. */
+/**
+ * Key material accepted by the signer/verifier. Imported keys must match the
+ * selected algorithm's family, hash and curve, with the same 32-byte HMAC and
+ * 2048-bit RSA minimums as raw keys.
+ */
 export type HttpSignatureKeyMaterial = CryptoKey | Uint8Array | JsonWebKey;
 /**
  * A resolved verification key, optionally pinning the algorithm it may be used
@@ -134,7 +138,8 @@ export interface MessageSignature {
  * @returns The `Signature-Input` / `Signature` header values plus the exact
  *   signature base that was signed.
  * @throws {TypeError} for unsupported algorithms, weak HMAC keys, or
- *   unserializable parameter values.
+ *   unserializable parameter values. Imported keys must match the selected
+ *   algorithm's family, hash and curve and meet its strength floor.
  * @throws {Error} when a covered component cannot be resolved (e.g. a covered
  *   header is missing) or WebCrypto is unavailable.
  * @since 0.37.0
@@ -245,7 +250,8 @@ export interface VerifyMessageOptions {
     requiredTag?: string;
     /**
      * Replay check. When provided, a `nonce` is required and the signature is
-     * rejected if this returns `true`.
+     * rejected if this returns `true`. Called only after cryptographic verification
+     * succeeds; implementations that record nonces must check and record atomically.
      */
     isReplay?: (nonce: string, info: KeyResolutionInfo) => boolean | Promise<boolean>;
     /** Clock used for age checks. Returns milliseconds. Defaults to `Date.now`. */
@@ -255,6 +261,7 @@ export interface VerifyMessageOptions {
  * Verify an HTTP Message Signature (RFC 9421) on a received message. Returns a
  * structured result and never throws on a bad/forged signature — only on a
  * programming error (e.g. WebCrypto unavailable).
+ * Imported keys that violate the algorithm or strength policy return invalid_key.
  *
  * @param opts - Received message plus verification policy (algorithm
  *   allowlist, key resolver, freshness / replay checks); see
@@ -300,6 +307,8 @@ export interface HttpSignatureAuthOptions extends Omit<VerifyMessageOptions, "me
  * requests. On success the {@link VerifySuccess} is stamped on `ctx.state`; on
  * a missing (unless `optional`) or invalid signature it throws
  * {@link UnauthorizedError} (`401` + `Cache-Control: no-store`).
+ * Verification runs before body I/O and before stored-response middleware,
+ * so cache hits and idempotency replays cannot skip signature authentication.
  *
  * @param opts - Verification policy plus middleware knobs; see
  *   {@link HttpSignatureAuthOptions}.

package/dist/http-signatures.js

@@ -167,7 +167,7 @@ async function importKey(alg, material, usage) {
     const spec = algSpec(alg);
     const c = getCrypto();
     if (isCryptoKey(material)) {
-        assertRsaModulusFloor(alg, material);
+        assertKeyPolicy(alg, material);
         return material;
     }
     if (material instanceof Uint8Array) {
@@ -177,15 +177,31 @@ async function importKey(alg, material, usage) {
         if (material.byteLength < MIN_HMAC_KEY_BYTES) {
             throw new TypeError(`http-signatures: hmac-sha256 secret must be at least ${MIN_HMAC_KEY_BYTES} bytes (RFC 7518 §3.2); got ${material.byteLength}.`);
         }
-        return c.subtle.importKey("raw", material, spec.importParams, false, [usage]);
+        return c.subtle.importKey("raw", material, spec.importParams, false, [
+            usage,
+        ]);
     }
     if (isJsonWebKey(material)) {
         const key = await c.subtle.importKey("jwk", material, spec.importParams, false, [usage]);
-        assertRsaModulusFloor(alg, key);
+        assertKeyPolicy(alg, key);
         return key;
     }
     throw new TypeError("http-signatures: unsupported key material.");
 }
+function assertKeyPolicy(alg, key) {
+    const expected = algSpec(alg).importParams;
+    const actual = key.algorithm;
+    if (actual.name !== expected.name ||
+        (expected.hash !== undefined && actual.hash?.name !== expected.hash) ||
+        (expected.namedCurve !== undefined && actual.namedCurve !== expected.namedCurve)) {
+        throw new TypeError(`http-signatures: key algorithm does not match ${alg}; family, hash and curve must match.`);
+    }
+    if (expected.name === "HMAC" &&
+        (!Number.isFinite(actual.length) || actual.length < MIN_HMAC_KEY_BYTES * 8)) {
+        throw new TypeError(`http-signatures: hmac-sha256 secret must be at least ${MIN_HMAC_KEY_BYTES} bytes (RFC 7518 §3.2).`);
+    }
+    assertRsaModulusFloor(alg, key);
+}
 function serializeSfString(s) {
     for (let i = 0; i < s.length; i++) {
         const code = s.charCodeAt(i);
@@ -518,7 +534,8 @@ function parseComponentSpec(spec) {
  * @returns The `Signature-Input` / `Signature` header values plus the exact
  *   signature base that was signed.
  * @throws {TypeError} for unsupported algorithms, weak HMAC keys, or
- *   unserializable parameter values.
+ *   unserializable parameter values. Imported keys must match the selected
+ *   algorithm's family, hash and curve and meet its strength floor.
  * @throws {Error} when a covered component cannot be resolved (e.g. a covered
  *   header is missing) or WebCrypto is unavailable.
  * @since 0.37.0
@@ -585,6 +602,7 @@ function fail(reason) {
  * Verify an HTTP Message Signature (RFC 9421) on a received message. Returns a
  * structured result and never throws on a bad/forged signature — only on a
  * programming error (e.g. WebCrypto unavailable).
+ * Imported keys that violate the algorithm or strength policy return invalid_key.
  *
  * @param opts - Received message plus verification policy (algorithm
  *   allowlist, key resolver, freshness / replay checks); see
@@ -671,12 +689,8 @@ export async function verifyMessage(opts) {
         return fail("signature_expired");
     }
     // Replay check.
-    if (opts.isReplay) {
-        if (params.nonce === undefined)
-            return fail("missing_nonce");
-        if (await opts.isReplay(params.nonce, info))
-            return fail("replay_detected");
-    }
+    if (opts.isReplay && params.nonce === undefined)
+        return fail("missing_nonce");
     // Resolve the key + effective algorithm (defeating algorithm-confusion).
     const resolved = await opts.resolveKey(info);
     if (resolved === undefined)
@@ -730,6 +744,9 @@ export async function verifyMessage(opts) {
     }
     if (!ok)
         return fail("invalid_signature");
+    if (opts.isReplay && (await opts.isReplay(params.nonce, info))) {
+        return fail("replay_detected");
+    }
     return {
         valid: true,
         label,
@@ -765,6 +782,8 @@ export function verifyRequest(request, opts) {
  * requests. On success the {@link VerifySuccess} is stamped on `ctx.state`; on
  * a missing (unless `optional`) or invalid signature it throws
  * {@link UnauthorizedError} (`401` + `Cache-Control: no-store`).
+ * Verification runs before body I/O and before stored-response middleware,
+ * so cache hits and idempotency replays cannot skip signature authentication.
  *
  * @param opts - Verification policy plus middleware knobs; see
  *   {@link HttpSignatureAuthOptions}.
@@ -775,7 +794,7 @@ export function httpSignatureAuth(opts) {
     const stateKey = opts.stateKey ?? "httpSignature";
     const message = opts.message ?? "Valid HTTP message signature required";
     const authHooks = {
-        async beforeHandle(ctx) {
+        async preBody(ctx) {
             const headers = ctx.request.headers;
             if (opts.optional && !headers.has("signature"))
                 return undefined;

package/dist/idempotency.d.ts

@@ -214,6 +214,8 @@ export interface IdempotencyOptions {
  * alone is not a bound — it only drops records that have *expired*, so a stream
  * of unique keys inside the TTL grew the map linearly no matter how often it ran,
  * with each entry pinning a stored response body.
+ * Late completions of evicted reservations use the same capacity policy;
+ * completing a retained entry updates it without evicting another record.
  *
  * Evicting a live record can only cost exactly-once semantics for a retry that
  * arrives after the eviction — it re-executes rather than replaying. That is the
@@ -235,7 +237,14 @@ export declare class MemoryIdempotencyStore implements IdempotencyStore {
      * the in-memory store derives expiry from `record.expiresAt`.
      */
     reserve(key: string, record: IdempotencyRecord, _ttlMs?: number): IdempotencyRecord | null;
-    /** @inheritDoc */
+    /**
+     * Persist a completed response, enforcing capacity even if its reservation
+     * was evicted while the handler ran.
+     * @param key - Reservation key to complete.
+     * @param record - Completed record with response data and expiry.
+     * @param _ttlMs - Unused; expiry is derived from record.expiresAt.
+     * @returns Nothing. A new entry may evict the oldest retained record.
+     */
     complete(key: string, record: IdempotencyRecord, _ttlMs?: number): void;
     /** @inheritDoc */
     release(key: string): void;
@@ -278,6 +287,12 @@ export declare const IDEMPOTENCY_HOOK_MARKER: unique symbol;
  * Responses that fail {@link IdempotencyOptions.cacheableStatus} (server errors
  * by default) or exceed {@link IdempotencyOptions.maxResponseBytes} are not
  * cached and the reservation is released so the client can retry.
+ * The byte cap is enforced while reading the response clone; exceeding it
+ * stops capture without waiting for EOF or consuming the client's branch.
+ * Replays require every scope aggregated from the route's requireScopes hooks;
+ * callers without those scopes continue to the normal authorization chain.
+ * Empty Authorization headers do not resolve a principal and cannot bypass
+ * the default cookie-bearing-request scope guard.
  *
  * @example
  * ```ts

package/dist/idempotency.js

@@ -33,6 +33,8 @@
  */
 import { BadRequestError, ConflictError, HttpError } from "./errors.js";
 import { markSchemaValidatedResponse } from "./internal-response.js";
+import { readResponseBodyUpTo } from "./internal-body.js";
+import { hasReplayScopes } from "./internal-replay.js";
 const enc = new TextEncoder();
 /** Internal `ctx.state` key carrying the reservation between hooks. */
 const PENDING_STATE_KEY = "__idempotencyPending";
@@ -73,6 +75,8 @@ const DEFAULT_MAX_IDEMPOTENCY_ENTRIES = 10_000;
  * alone is not a bound — it only drops records that have *expired*, so a stream
  * of unique keys inside the TTL grew the map linearly no matter how often it ran,
  * with each entry pinning a stored response body.
+ * Late completions of evicted reservations use the same capacity policy;
+ * completing a retained entry updates it without evicting another record.
  *
  * Evicting a live record can only cost exactly-once semantics for a retry that
  * arrives after the eviction — it re-executes rather than replaying. That is the
@@ -117,8 +121,19 @@ export class MemoryIdempotencyStore {
         this.map.set(key, record);
         return null;
     }
-    /** @inheritDoc */
+    /**
+     * Persist a completed response, enforcing capacity even if its reservation
+     * was evicted while the handler ran.
+     * @param key - Reservation key to complete.
+     * @param record - Completed record with response data and expiry.
+     * @param _ttlMs - Unused; expiry is derived from record.expiresAt.
+     * @returns Nothing. A new entry may evict the oldest retained record.
+     */
     complete(key, record, _ttlMs) {
+        if (!this.map.has(key)) {
+            this.reserve(key, record, _ttlMs);
+            return;
+        }
         this.map.set(key, record);
     }
     /** @inheritDoc */
@@ -266,8 +281,8 @@ const NEVER_REPLAYED_HEADERS = new Set([
     "x-request-id",
 ]);
 async function captureResponse(res, maxBytes) {
-    const buf = new Uint8Array(await res.clone().arrayBuffer());
-    if (buf.byteLength > maxBytes)
+    const buf = await readResponseBodyUpTo(res.clone(), maxBytes);
+    if (buf === null)
         return null;
     const headers = [];
     res.headers.forEach((value, name) => {
@@ -326,6 +341,12 @@ export const IDEMPOTENCY_HOOK_MARKER = Symbol.for("daloyjs.idempotency.hook");
  * Responses that fail {@link IdempotencyOptions.cacheableStatus} (server errors
  * by default) or exceed {@link IdempotencyOptions.maxResponseBytes} are not
  * cached and the reservation is released so the client can retry.
+ * The byte cap is enforced while reading the response clone; exceeding it
+ * stops capture without waiting for EOF or consuming the client's branch.
+ * Replays require every scope aggregated from the route's requireScopes hooks;
+ * callers without those scopes continue to the normal authorization chain.
+ * Empty Authorization headers do not resolve a principal and cannot bypass
+ * the default cookie-bearing-request scope guard.
  *
  * @example
  * ```ts
@@ -376,6 +397,8 @@ export function idempotency(opts = {}) {
     const keyPrefix = opts.groupId ? `${opts.groupId}:` : "";
     const hooks = {
         async beforeHandle(ctx) {
+            if (!hasReplayScopes(ctx))
+                return undefined;
             const method = ctx.request.method.toUpperCase();
             if (!methods.has(method))
                 return undefined;
@@ -423,11 +446,11 @@ export function idempotency(opts = {}) {
             // is never stored or replayed (see {@link NEVER_REPLAYED_HEADERS}), so a
             // coarse namespace cannot escalate into handing over a live session.
             if (!opts.scope &&
-                scopeRaw === undefined &&
+                !scopeRaw &&
                 !allowUnscopedCallers &&
                 ctx.request.headers.has("cookie")) {
                 throw new Error("idempotency(): cannot determine the calling principal for a cookie-bearing request. " +
-                    "The default scope reads the Authorization header, which this request does not carry, " +
+                    "The default scope reads the Authorization header, which this request does not carry with a non-empty value, " +
                     "so every cookie-authenticated caller would share one idempotency namespace and could " +
                     "replay another caller's stored response (CWE-524). Pass " +
                     "`scope: (ctx) => ctx.state.session?.id` (or another stable per-caller id), or set " +

package/dist/internal-body.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Read a response clone while enforcing an inclusive byte limit.
+ *
+ * @param response - A clone whose body may be consumed or cancelled.
+ * @param maxBytes - Maximum retained response bytes, validated by the caller.
+ * @returns Captured bytes, or null as soon as the stream exceeds the limit.
+ *   Cancelling a tee branch is not awaited because the other branch may still
+ *   be waiting for its consumer. The original response remains readable.
+ * @throws Propagates stream read errors without converting them to cached data.
+ * @internal
+ */
+export declare function readResponseBodyUpTo(response: Response, maxBytes: number): Promise<Uint8Array | null>;

package/dist/internal-body.js

@@ -0,0 +1,45 @@
+/**
+ * Read a response clone while enforcing an inclusive byte limit.
+ *
+ * @param response - A clone whose body may be consumed or cancelled.
+ * @param maxBytes - Maximum retained response bytes, validated by the caller.
+ * @returns Captured bytes, or null as soon as the stream exceeds the limit.
+ *   Cancelling a tee branch is not awaited because the other branch may still
+ *   be waiting for its consumer. The original response remains readable.
+ * @throws Propagates stream read errors without converting them to cached data.
+ * @internal
+ */
+export async function readResponseBodyUpTo(response, maxBytes) {
+    if (!response.body)
+        return new Uint8Array(0);
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value.byteLength === 0)
+                continue;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                void reader.cancel().catch(() => undefined);
+                return null;
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    if (chunks.length === 1)
+        return chunks[0];
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}

package/dist/internal-replay.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Check the scope requirements aggregated by App before a stored-response hook.
+ *
+ * @param context - Current request state, including requirements installed by
+ *   App.mergeBeforeHandle and the user resolved by upstream authentication.
+ * @returns True when no scope guard applies or the current user owns every
+ *   required scope. False tells replay middleware to defer to the normal hook
+ *   chain without reading, reserving, or capturing a stored response. The
+ *   downstream requireScopes hook remains responsible for rejecting access.
+ * @internal
+ */
+export declare function hasReplayScopes(context: {
+    readonly state: Readonly<Record<string, unknown>>;
+}): boolean;

package/dist/internal-replay.js

@@ -0,0 +1,21 @@
+/**
+ * Check the scope requirements aggregated by App before a stored-response hook.
+ *
+ * @param context - Current request state, including requirements installed by
+ *   App.mergeBeforeHandle and the user resolved by upstream authentication.
+ * @returns True when no scope guard applies or the current user owns every
+ *   required scope. False tells replay middleware to defer to the normal hook
+ *   chain without reading, reserving, or capturing a stored response. The
+ *   downstream requireScopes hook remains responsible for rejecting access.
+ * @internal
+ */
+export function hasReplayScopes(context) {
+    const required = context.state.__daloyRequiredScopes;
+    if (!Array.isArray(required) || required.length === 0)
+        return true;
+    const user = context.state.user;
+    if (!user || typeof user !== "object")
+        return false;
+    const owned = user.scopes;
+    return (Array.isArray(owned) && required.every((scope) => owned.includes(scope)));
+}

package/dist/jwk.d.ts

@@ -9,7 +9,8 @@ export interface JwkSet {
 }
 /**
  * Source for the verifier's public keys. Either an in-memory JWKS, a
- * `https://` URL (fetched with TTL caching), or a custom async resolver.
+ * `https://` URL (fetched directly with TTL caching; redirects are refused),
+ * or a custom async resolver.
  */
 export type JwkSource = JwkSet | string | (() => JwkSet | Promise<JwkSet>);
 /**
@@ -61,7 +62,8 @@ export interface JwkOptions {
     maxStaleSeconds?: number;
     /**
      * Optional `fetch` implementation override (mainly for tests). Defaults
-     * to global `fetch`.
+      * to global `fetch`. Overrides must honor `redirect: "error"` to preserve
+      * the configured HTTPS signing-key authority.
      */
     fetch?: typeof fetch;
     /**
@@ -79,6 +81,8 @@ export interface JwkOptions {
  * algorithms at construction time, requires every token to carry a `kid`
  * header, matches that `kid` against the JWKS, and cross-checks the JWT
  * header `alg` against the JWK's own `alg` (when present).
+ * URL sources are fetched with redirects disabled; redirecting refreshes
+ * follow the existing last-good-key grace policy, never installing new keys.
  *
  * @example
  * ```ts

package/dist/jwk.js

@@ -16,6 +16,7 @@
  *   `alg`, the two MUST agree (RFC 7517 §4.4 cross-check).
  * - `exp` / `nbf` / `iat` validated on every verify.
  * - JWKS URLs MUST be `https://` (refused at construction otherwise).
+ *   Redirects are refused so the HTTPS/key-authority boundary is not bypassed.
  * - Optional `verify(payload, ctx)` revalidation hook for
  *   revocation lists, token-version counters, etc.
  *
@@ -93,6 +94,7 @@ function makeJwksLoader(source, fetchImpl, ttlSeconds, maxStaleSeconds) {
                 try {
                     const res = await fetchImpl(source, {
                         headers: { accept: "application/json" },
+                        redirect: "error",
                     });
                     if (!res.ok) {
                         throw new Error(`jwk(): JWKS fetch failed with status ${res.status}.`);
@@ -144,6 +146,8 @@ function makeJwksLoader(source, fetchImpl, ttlSeconds, maxStaleSeconds) {
  * algorithms at construction time, requires every token to carry a `kid`
  * header, matches that `kid` against the JWKS, and cross-checks the JWT
  * header `alg` against the JWK's own `alg` (when present).
+ * URL sources are fetched with redirects disabled; redirecting refreshes
+ * follow the existing last-good-key grace policy, never installing new keys.
  *
  * @example
  * ```ts

package/dist/jwt.d.ts

@@ -34,7 +34,11 @@ export interface JwtVerified {
     /** Decoded claims payload after signature and time-claim checks passed. */
     readonly payload: Record<string, unknown>;
 }
-/** Key material accepted by the signer/verifier. */
+/**
+ * Key material accepted by the signer/verifier. Imported keys must match the
+ * selected algorithm's family, hash and curve. Every HMAC key format must meet
+ * the 32-byte minimum, and every RSA key must have a 2048-bit modulus or larger.
+ */
 export type JwtKeyMaterial = CryptoKey | Uint8Array | JsonWebKey;
 /** Options for {@link createJwtSigner}. */
 export interface JwtSignerOptions {
@@ -116,11 +120,14 @@ export interface JwtVerifierOptions {
  * function refuses payloads without an `exp` claim (unless
  * `acknowledgeNoExp: true` was set at construction outside production) and
  * refuses payloads whose `exp - (iat | now)` exceeds `maxLifetimeSeconds`.
+ * Imported keys must match the algorithm's family, hash and curve; HMAC and
+ * RSA strength floors apply to CryptoKey and JWK inputs as well as raw bytes.
  *
  * @param opts - Algorithm, key, and lifetime policy; see {@link JwtSignerOptions}.
  * @returns An object whose `sign(payload)` resolves to the compact JWS string.
  * @throws {JwtError} for `alg: "none"`, unknown algorithms, weak keys, a
  *   missing/invalid `maxLifetimeSeconds`, or `acknowledgeNoExp` in production.
+ *   `sign()` also rejects imported keys that violate algorithm or strength policy.
  * @since 0.21.0
  */
 export declare function createJwtSigner(opts: JwtSignerOptions): {
@@ -132,12 +139,15 @@ export declare function createJwtSigner(opts: JwtSignerOptions): {
  * `alg: "none"` and any token whose header `alg` is not in the allowlist;
  * refuses-at-construction when a symmetric algorithm (`HS*`) is mixed with
  * a JWK / JWKS-shaped key source (the documented confused-deputy attack).
+ * Imported keys must match the algorithm's family, hash and curve; HMAC and
+ * RSA strength floors apply to CryptoKey and JWK inputs as well as raw bytes.
  *
  * @param opts - Allowlist, key source, and claim checks; see {@link JwtVerifierOptions}.
  * @returns An object whose `verify(token)` resolves to the decoded
  *   {@link JwtVerified} or rejects with {@link JwtError}.
  * @throws {JwtError} at construction for an empty/invalid allowlist, `"none"`
  *   in the allowlist, weak HS* secrets, or HS* mixed with a JWK source.
+ *   `verify()` also rejects imported keys that violate algorithm or strength policy.
  * @since 0.21.0
  */
 export declare function createJwtVerifier(opts: JwtVerifierOptions): {

package/dist/jwt.js

@@ -158,7 +158,7 @@ async function importKey(alg, material, usage) {
     const params = algParams(alg);
     const c = getCrypto();
     if (isCryptoKey(material)) {
-        assertRsaModulusFloor(alg, material);
+        assertKeyPolicy(alg, material);
         return material;
     }
     if (material instanceof Uint8Array) {
@@ -185,11 +185,24 @@ async function importKey(alg, material, usage) {
                         ? { name: "RSASSA-PKCS1-v1_5", hash: params.hash }
                         : { name: "Ed25519" };
         const imported = await c.subtle.importKey("jwk", material, importAlgorithm, false, [usage]);
-        assertRsaModulusFloor(alg, imported);
+        assertKeyPolicy(alg, imported);
         return imported;
     }
     throw new JwtError("invalid_key", "jwt(): unsupported key material.");
 }
+function assertKeyPolicy(alg, key) {
+    const params = algParams(alg);
+    const algorithm = key.algorithm;
+    if (algorithm.name !== params.name ||
+        (params.hash !== undefined && params.name !== "ECDSA" && algorithm.hash?.name !== params.hash) ||
+        (params.namedCurve !== undefined && algorithm.namedCurve !== params.namedCurve)) {
+        throw new JwtError("key_algorithm_mismatch", `jwt(): key algorithm does not match ${alg}; the key family, hash and curve must match the declared JWT algorithm.`);
+    }
+    if (params.name === "HMAC" && (!Number.isFinite(algorithm.length) || algorithm.length < MIN_HS_KEY_BYTES * 8)) {
+        throw new JwtError("weak_hs_secret", `jwt(): ${alg} secret must be at least ${MIN_HS_KEY_BYTES} bytes (RFC 7518 §3.2).`);
+    }
+    assertRsaModulusFloor(alg, key);
+}
 /**
  * Refuse RSA keys whose modulus is shorter than {@link MIN_RSA_KEY_BITS}.
  * Only applies to `RS*` / `PS*` algorithms — non-RSA keys are ignored. The
@@ -224,11 +237,14 @@ function buildSignAlgorithm(alg) {
  * function refuses payloads without an `exp` claim (unless
  * `acknowledgeNoExp: true` was set at construction outside production) and
  * refuses payloads whose `exp - (iat | now)` exceeds `maxLifetimeSeconds`.
+ * Imported keys must match the algorithm's family, hash and curve; HMAC and
+ * RSA strength floors apply to CryptoKey and JWK inputs as well as raw bytes.
  *
  * @param opts - Algorithm, key, and lifetime policy; see {@link JwtSignerOptions}.
  * @returns An object whose `sign(payload)` resolves to the compact JWS string.
  * @throws {JwtError} for `alg: "none"`, unknown algorithms, weak keys, a
  *   missing/invalid `maxLifetimeSeconds`, or `acknowledgeNoExp` in production.
+ *   `sign()` also rejects imported keys that violate algorithm or strength policy.
  * @since 0.21.0
  */
 export function createJwtSigner(opts) {
@@ -338,12 +354,15 @@ function normalizeStringSet(value) {
  * `alg: "none"` and any token whose header `alg` is not in the allowlist;
  * refuses-at-construction when a symmetric algorithm (`HS*`) is mixed with
  * a JWK / JWKS-shaped key source (the documented confused-deputy attack).
+ * Imported keys must match the algorithm's family, hash and curve; HMAC and
+ * RSA strength floors apply to CryptoKey and JWK inputs as well as raw bytes.
  *
  * @param opts - Allowlist, key source, and claim checks; see {@link JwtVerifierOptions}.
  * @returns An object whose `verify(token)` resolves to the decoded
  *   {@link JwtVerified} or rejects with {@link JwtError}.
  * @throws {JwtError} at construction for an empty/invalid allowlist, `"none"`
  *   in the allowlist, weak HS* secrets, or HS* mixed with a JWK source.
+ *   `verify()` also rejects imported keys that violate algorithm or strength policy.
  * @since 0.21.0
  */
 export function createJwtVerifier(opts) {

package/dist/mtls.d.ts

@@ -128,6 +128,8 @@ export interface PeerCertificateLike {
  * Normalize a Node `getPeerCertificate(true)` result into a
  * {@link ClientCertificate}. Returns `undefined` for the empty object Node
  * returns when the peer presented no certificate.
+ * Quoted SAN values are decoded without treating their embedded commas as
+ * identity separators. Malformed SAN lists yield no identities for allowlists.
  *
  * @param raw - The structured peer-certificate object from the TLS socket.
  * @param verified - Whether the socket reported `authorized === true` (the
@@ -220,6 +222,8 @@ export interface ClientCertAuthOptions {
     /**
      * If set, the certificate's SHA-256 fingerprint must match one of these
      * (compared in constant time; colons/spaces and case are ignored).
+    * An empty list denies every certificate; omit this option to disable
+    * fingerprint restrictions while retaining the other certificate checks.
      */
     allowFingerprints?: readonly string[];
     /**

package/dist/mtls.js

@@ -68,6 +68,8 @@ export function getClientCertificate(request) {
  * Normalize a Node `getPeerCertificate(true)` result into a
  * {@link ClientCertificate}. Returns `undefined` for the empty object Node
  * returns when the peer presented no certificate.
+ * Quoted SAN values are decoded without treating their embedded commas as
+ * identity separators. Malformed SAN lists yield no identities for allowlists.
  *
  * @param raw - The structured peer-certificate object from the TLS socket.
  * @param verified - Whether the socket reported `authorized === true` (the
@@ -148,13 +150,58 @@ function parseCertDate(value) {
 function parseNodeSubjectAltName(san) {
     if (typeof san !== "string" || san.length === 0)
         return [];
-    // Node renders SANs as `DNS:a, IP Address:1.2.3.4, URI:spiffe://...`.
     const out = [];
-    for (const piece of san.split(",")) {
+    const quoted = san.includes('"');
+    const pieces = quoted ? [] : san.split(",");
+    if (quoted) {
+        let start = 0;
+        let inQuotes = false;
+        let escaped = false;
+        for (let index = 0; index < san.length; index++) {
+            const char = san[index];
+            if (escaped) {
+                escaped = false;
+            }
+            else if (inQuotes && char === "\\") {
+                escaped = true;
+            }
+            else if (char === '"') {
+                inQuotes = !inQuotes;
+            }
+            else if (char === "," && !inQuotes) {
+                pieces.push(san.slice(start, index));
+                start = index + 1;
+            }
+        }
+        if (inQuotes || escaped)
+            return [];
+        pieces.push(san.slice(start));
+    }
+    for (const piece of pieces) {
         const trimmed = piece.trim();
         if (trimmed.length === 0)
             continue;
-        out.push(trimmed.replace(/^IP Address:/i, "IP:"));
+        const colon = trimmed.indexOf(":");
+        if (colon < 1)
+            return [];
+        if (!quoted) {
+            out.push(trimmed.replace(/^IP Address:/i, "IP:"));
+            continue;
+        }
+        const type = trimmed.slice(0, colon);
+        let value = trimmed.slice(colon + 1);
+        if (value.startsWith('"')) {
+            try {
+                value = JSON.parse(value);
+            }
+            catch {
+                return [];
+            }
+        }
+        else if (quoted && value.includes('"')) {
+            return [];
+        }
+        out.push(`${type.toLowerCase() === "ip address" ? "IP" : type}:${value}`);
     }
     return out;
 }
@@ -330,7 +377,7 @@ export function clientCertAuth(opts = {}) {
     const message = opts.message ?? "Client certificate not permitted";
     const stateKey = opts.stateKey ?? "clientCertificate";
     const now = opts.now ?? Date.now;
-    const allowFingerprints = (opts.allowFingerprints ?? []).map((f) => normalizeFingerprint(f) ?? "");
+    const allowFingerprints = opts.allowFingerprints?.map((f) => normalizeFingerprint(f) ?? "");
     const allowSubjectCNs = opts.allowSubjectCNs;
     const allowIssuerCNs = opts.allowIssuerCNs;
     const allowSANs = opts.allowSANs;
@@ -371,7 +418,7 @@ export function clientCertAuth(opts = {}) {
             if (allowIssuerCNs && !matchesAllowedCN(cert.issuerCN, allowIssuerCNs)) {
                 throw new ForbiddenError(message);
             }
-            if (allowFingerprints.length > 0 && !matchesFingerprint(cert, allowFingerprints)) {
+            if (allowFingerprints !== undefined && !matchesFingerprint(cert, allowFingerprints)) {
                 throw new ForbiddenError(message);
             }
             if (allowSANs && !matchesSAN(cert.subjectAltNames, allowSANs)) {

package/dist/response-cache.d.ts

@@ -355,6 +355,10 @@ export declare class MemoryResponseCacheStore implements ResponseCacheStore {
  * `no-store` / `private` / `no-cache`, carrying `Set-Cookie` or `Vary: *`,
  * failing {@link ResponseCacheOptions.cacheableStatus}, or larger than
  * {@link ResponseCacheOptions.maxBodyBytes} are never cached.
+ * The byte cap is enforced while reading the response clone; exceeding it
+ * stops capture without waiting for EOF or consuming the client's branch.
+ * Replays require every scope aggregated from the route's requireScopes hooks;
+ * callers without those scopes continue to the normal authorization chain.
  *
  * A response that declares `Vary` is stored as a **variant**: the request's
  * values for those fields are recorded alongside it, and the entry is replayed

package/dist/response-cache.js

@@ -65,6 +65,8 @@
  * @since 0.37.0
  */
 import { markSchemaValidatedResponse } from "./internal-response.js";
+import { readResponseBodyUpTo } from "./internal-body.js";
+import { hasReplayScopes } from "./internal-replay.js";
 /** Internal `ctx.state` key carrying the pending cache key between hooks. */
 const PENDING_STATE_KEY = "__responseCachePending";
 /**
@@ -420,6 +422,10 @@ function isPromiseLike(value) {
  * `no-store` / `private` / `no-cache`, carrying `Set-Cookie` or `Vary: *`,
  * failing {@link ResponseCacheOptions.cacheableStatus}, or larger than
  * {@link ResponseCacheOptions.maxBodyBytes} are never cached.
+ * The byte cap is enforced while reading the response clone; exceeding it
+ * stops capture without waiting for EOF or consuming the client's branch.
+ * Replays require every scope aggregated from the route's requireScopes hooks;
+ * callers without those scopes continue to the normal authorization chain.
  *
  * A response that declares `Vary` is stored as a **variant**: the request's
  * values for those fields are recorded alongside it, and the entry is replayed
@@ -522,6 +528,8 @@ export function responseCache(opts = {}) {
     }
     const hooks = {
         async beforeHandle(ctx) {
+            if (!hasReplayScopes(ctx))
+                return undefined;
             const method = ctx.request.method.toUpperCase();
             if (!methods.has(method))
                 return undefined;
@@ -641,8 +649,8 @@ export function responseCache(opts = {}) {
                     res.headers.set(statusHeaderName, "MISS");
                 return undefined;
             }
-            const buf = new Uint8Array(await res.clone().arrayBuffer());
-            if (buf.byteLength > maxBodyBytes) {
+            const buf = await readResponseBodyUpTo(res.clone(), maxBodyBytes);
+            if (buf === null) {
                 if (statusHeaderName)
                     res.headers.set(statusHeaderName, "MISS");
                 return undefined;

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3be788cc-3073-595a-871d-593791c06327",
+  "serialNumber": "urn:uuid:e5e6316e-26ff-52ae-9520-4b82d88c8397",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-29T14:05:07.830Z",
+    "timestamp": "2026-09-08T07:08:54.894Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.3.1"
+        "version": "1.3.2"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.3.1",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.3.2",
       "name": "@daloyjs/core",
-      "version": "1.3.1",
+      "version": "1.3.2",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.3.1",
+      "purl": "pkg:npm/@daloyjs/core@1.3.2",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.3.1",
+        "tagId": "swidtag--daloyjs-core-1.3.2",
         "name": "@daloyjs/core",
-        "version": "1.3.1",
+        "version": "1.3.2",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.3.1",
+      "ref": "pkg:npm/@daloyjs/core@1.3.2",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.3.1",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.1-3be788cc-3073-595a-871d-593791c06327",
+  "name": "@daloyjs/core-1.3.2",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.2-e5e6316e-26ff-52ae-9520-4b82d88c8397",
   "creationInfo": {
-    "created": "2026-08-29T14:05:07.830Z",
+    "created": "2026-09-08T07:08:54.894Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.3.1",
+      "versionInfo": "1.3.2",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.1"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.2"
         }
       ]
     }

package/dist/webhook-delivery.d.ts

@@ -252,6 +252,8 @@ export interface WebhookSenderOptions {
  * dead-letters a single {@link WebhookEvent}, resolving to a
  * {@link WebhookDeliveryResult} (it does not throw on ordinary delivery
  * failure).
+ * Intermediate response bodies are cancelled before retry backoff without
+ * waiting for producer cancellation; the final response remains caller-owned.
  *
  * @example
  * ```ts

package/dist/webhook-delivery.js

@@ -133,6 +133,8 @@ function randomId() {
  * dead-letters a single {@link WebhookEvent}, resolving to a
  * {@link WebhookDeliveryResult} (it does not throw on ordinary delivery
  * failure).
+ * Intermediate response bodies are cancelled before retry backoff without
+ * waiting for producer cancellation; the final response remains caller-owned.
  *
  * @example
  * ```ts
@@ -277,6 +279,7 @@ export function createWebhookSender(options) {
                 });
                 if (!retryable)
                     break;
+                void response.body?.cancel().catch(() => undefined);
                 await sleep(delayMs);
                 continue;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops \u2014 distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -266,8 +266,8 @@
     "red-team:live": "node --import tsx red-team-live/run.ts",
     "red-team:live:mcp": "node --import tsx red-team-live/mcp-attacks.ts",
     "red-team:live:wave2": "node --import tsx red-team-live/skill-wave2-attacks.ts",
-    "coverage": "node --import tsx --test --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-lines=90 --test-coverage-functions=90 tests/**/*.test.ts",
-    "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include='dist-coverage/src/**' --test-coverage-branches=92 dist-coverage/tests/**/*.test.js",
+    "coverage": "node --import tsx --test --experimental-test-coverage --test-coverage-include=\"src/**\" --test-coverage-lines=90 --test-coverage-functions=90 tests/**/*.test.ts",
+    "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include=\"dist-coverage/src/**\" --test-coverage-branches=92 dist-coverage/tests/**/*.test.js",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json && tsc -p tests/tsconfig.json --noEmit && tsc -p red-team-live/tsconfig.json --noEmit",
     "typecheck:tests": "tsc -p tests/tsconfig.json --noEmit",
     "format": "prettier --write .",