@daloyjs/core 1.3.1 → 1.3.3

package/dist/mtls.js

@@ -68,6 +68,8 @@ export function getClientCertificate(request) {
  * Normalize a Node `getPeerCertificate(true)` result into a
  * {@link ClientCertificate}. Returns `undefined` for the empty object Node
  * returns when the peer presented no certificate.
+ * Quoted SAN values are decoded without treating their embedded commas as
+ * identity separators. Malformed SAN lists yield no identities for allowlists.
  *
  * @param raw - The structured peer-certificate object from the TLS socket.
  * @param verified - Whether the socket reported `authorized === true` (the
@@ -148,13 +150,58 @@ function parseCertDate(value) {
 function parseNodeSubjectAltName(san) {
     if (typeof san !== "string" || san.length === 0)
         return [];
-    // Node renders SANs as `DNS:a, IP Address:1.2.3.4, URI:spiffe://...`.
     const out = [];
-    for (const piece of san.split(",")) {
+    const quoted = san.includes('"');
+    const pieces = quoted ? [] : san.split(",");
+    if (quoted) {
+        let start = 0;
+        let inQuotes = false;
+        let escaped = false;
+        for (let index = 0; index < san.length; index++) {
+            const char = san[index];
+            if (escaped) {
+                escaped = false;
+            }
+            else if (inQuotes && char === "\\") {
+                escaped = true;
+            }
+            else if (char === '"') {
+                inQuotes = !inQuotes;
+            }
+            else if (char === "," && !inQuotes) {
+                pieces.push(san.slice(start, index));
+                start = index + 1;
+            }
+        }
+        if (inQuotes || escaped)
+            return [];
+        pieces.push(san.slice(start));
+    }
+    for (const piece of pieces) {
         const trimmed = piece.trim();
         if (trimmed.length === 0)
             continue;
-        out.push(trimmed.replace(/^IP Address:/i, "IP:"));
+        const colon = trimmed.indexOf(":");
+        if (colon < 1)
+            return [];
+        if (!quoted) {
+            out.push(trimmed.replace(/^IP Address:/i, "IP:"));
+            continue;
+        }
+        const type = trimmed.slice(0, colon);
+        let value = trimmed.slice(colon + 1);
+        if (value.startsWith('"')) {
+            try {
+                value = JSON.parse(value);
+            }
+            catch {
+                return [];
+            }
+        }
+        else if (quoted && value.includes('"')) {
+            return [];
+        }
+        out.push(`${type.toLowerCase() === "ip address" ? "IP" : type}:${value}`);
     }
     return out;
 }
@@ -209,9 +256,10 @@ function cnFromDN(dn) {
  * Parse an Envoy `X-Forwarded-Client-Cert` (XFCC) header value into a
  * {@link ClientCertificate}. XFCC is a comma-separated list of proxy elements,
  * each a `;`-delimited set of `Key=Value` pairs (`Hash`, `Subject`, `URI`,
- * `DNS`, `Cert`, …). The **first** element is the client closest to the origin
- * and is the one returned. Because Envoy only emits XFCC for connections it
- * mutually authenticated, the result is marked `verified: true`.
+ * `DNS`, `Cert`, …). The **first** element is returned. The `verified: true`
+ * result is a trusted-proxy assertion, not cryptographic verification by this
+ * parser. The terminator must verify client certificates, strip incoming XFCC,
+ * and replace it with its own value. Append-only forwarding is insufficient.
  *
  * @param headerValue Raw XFCC header value; `null`/`undefined` are tolerated.
  * @returns The certificate parsed from the first XFCC element, or `undefined`
@@ -297,6 +345,9 @@ const MISSING_CERT_BODY = JSON.stringify({
  * parsed from a trusted-proxy header, enforces verification + optional
  * allow-lists + validity window + a custom hook, and stamps the accepted
  * certificate on `ctx.state` for downstream handlers.
+ * Header mode requires an origin reachable only through a trusted terminator
+ * that strips and replaces identity headers after certificate verification.
+ * Fingerprint allowlists do not authenticate client-supplied header values.
  *
  * Rejection semantics:
  * - **No certificate presented** → `401` `application/problem+json` with
@@ -330,7 +381,7 @@ export function clientCertAuth(opts = {}) {
     const message = opts.message ?? "Client certificate not permitted";
     const stateKey = opts.stateKey ?? "clientCertificate";
     const now = opts.now ?? Date.now;
-    const allowFingerprints = (opts.allowFingerprints ?? []).map((f) => normalizeFingerprint(f) ?? "");
+    const allowFingerprints = opts.allowFingerprints?.map((f) => normalizeFingerprint(f) ?? "");
     const allowSubjectCNs = opts.allowSubjectCNs;
     const allowIssuerCNs = opts.allowIssuerCNs;
     const allowSANs = opts.allowSANs;
@@ -371,7 +422,7 @@ export function clientCertAuth(opts = {}) {
             if (allowIssuerCNs && !matchesAllowedCN(cert.issuerCN, allowIssuerCNs)) {
                 throw new ForbiddenError(message);
             }
-            if (allowFingerprints.length > 0 && !matchesFingerprint(cert, allowFingerprints)) {
+            if (allowFingerprints !== undefined && !matchesFingerprint(cert, allowFingerprints)) {
                 throw new ForbiddenError(message);
             }
             if (allowSANs && !matchesSAN(cert.subjectAltNames, allowSANs)) {

package/dist/response-cache.d.ts

@@ -355,6 +355,10 @@ export declare class MemoryResponseCacheStore implements ResponseCacheStore {
  * `no-store` / `private` / `no-cache`, carrying `Set-Cookie` or `Vary: *`,
  * failing {@link ResponseCacheOptions.cacheableStatus}, or larger than
  * {@link ResponseCacheOptions.maxBodyBytes} are never cached.
+ * The byte cap is enforced while reading the response clone; exceeding it
+ * stops capture without waiting for EOF or consuming the client's branch.
+ * Replays require every scope aggregated from the route's requireScopes hooks;
+ * callers without those scopes continue to the normal authorization chain.
  *
  * A response that declares `Vary` is stored as a **variant**: the request's
  * values for those fields are recorded alongside it, and the entry is replayed

package/dist/response-cache.js

@@ -65,6 +65,8 @@
  * @since 0.37.0
  */
 import { markSchemaValidatedResponse } from "./internal-response.js";
+import { readResponseBodyUpTo } from "./internal-body.js";
+import { hasReplayScopes } from "./internal-replay.js";
 /** Internal `ctx.state` key carrying the pending cache key between hooks. */
 const PENDING_STATE_KEY = "__responseCachePending";
 /**
@@ -420,6 +422,10 @@ function isPromiseLike(value) {
  * `no-store` / `private` / `no-cache`, carrying `Set-Cookie` or `Vary: *`,
  * failing {@link ResponseCacheOptions.cacheableStatus}, or larger than
  * {@link ResponseCacheOptions.maxBodyBytes} are never cached.
+ * The byte cap is enforced while reading the response clone; exceeding it
+ * stops capture without waiting for EOF or consuming the client's branch.
+ * Replays require every scope aggregated from the route's requireScopes hooks;
+ * callers without those scopes continue to the normal authorization chain.
  *
  * A response that declares `Vary` is stored as a **variant**: the request's
  * values for those fields are recorded alongside it, and the entry is replayed
@@ -522,6 +528,8 @@ export function responseCache(opts = {}) {
     }
     const hooks = {
         async beforeHandle(ctx) {
+            if (!hasReplayScopes(ctx))
+                return undefined;
             const method = ctx.request.method.toUpperCase();
             if (!methods.has(method))
                 return undefined;
@@ -641,8 +649,8 @@ export function responseCache(opts = {}) {
                     res.headers.set(statusHeaderName, "MISS");
                 return undefined;
             }
-            const buf = new Uint8Array(await res.clone().arrayBuffer());
-            if (buf.byteLength > maxBodyBytes) {
+            const buf = await readResponseBodyUpTo(res.clone(), maxBodyBytes);
+            if (buf === null) {
                 if (statusHeaderName)
                     res.headers.set(statusHeaderName, "MISS");
                 return undefined;

package/dist/router.d.ts

@@ -7,7 +7,8 @@
  *   - Path normalization and splitting avoid regular expressions.
  *
  * Safety:
- *   - Path traversal (`..`) and empty segments are rejected at lookup time.
+ *   - Raw `/../`, trailing `/..`, and empty segments are rejected at lookup time.
+ *   - Decoded parameters are untrusted data, not sanitized filesystem paths.
  *   - Duplicate routes and duplicate operationIds throw at registration.
  *   - Wildcard segments must be terminal.
  */

package/dist/router.js

@@ -7,7 +7,8 @@
  *   - Path normalization and splitting avoid regular expressions.
  *
  * Safety:
- *   - Path traversal (`..`) and empty segments are rejected at lookup time.
+ *   - Raw `/../`, trailing `/..`, and empty segments are rejected at lookup time.
+ *   - Decoded parameters are untrusted data, not sanitized filesystem paths.
  *   - Duplicate routes and duplicate operationIds throw at registration.
  *   - Wildcard segments must be terminal.
  */

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3be788cc-3073-595a-871d-593791c06327",
+  "serialNumber": "urn:uuid:6545c557-5cea-599b-8286-d910b13cb482",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-29T14:05:07.830Z",
+    "timestamp": "2026-09-10T10:47:58.279Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.3.1"
+        "version": "1.3.3"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.3.1",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.3.3",
       "name": "@daloyjs/core",
-      "version": "1.3.1",
+      "version": "1.3.3",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.3.1",
+      "purl": "pkg:npm/@daloyjs/core@1.3.3",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.3.1",
+        "tagId": "swidtag--daloyjs-core-1.3.3",
         "name": "@daloyjs/core",
-        "version": "1.3.1",
+        "version": "1.3.3",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.3.1",
+      "ref": "pkg:npm/@daloyjs/core@1.3.3",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.3.1",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.1-3be788cc-3073-595a-871d-593791c06327",
+  "name": "@daloyjs/core-1.3.3",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.3-6545c557-5cea-599b-8286-d910b13cb482",
   "creationInfo": {
-    "created": "2026-08-29T14:05:07.830Z",
+    "created": "2026-09-10T10:47:58.279Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.3.1",
+      "versionInfo": "1.3.3",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.1"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.3"
         }
       ]
     }

package/dist/scheduler.d.ts

@@ -228,6 +228,7 @@ export interface CronFields {
  * Supported syntax per field: `*`, lists (`1,2,3`), ranges (`1-5`), steps
  * (`*\/5`, `1-10/2`), and case-insensitive month (`JAN`–`DEC`) / day
  * (`SUN`–`SAT`) names. Day-of-week accepts both `0` and `7` for Sunday.
+ * Numeric weekday ranges are expanded before Sunday aliases are normalized.
  *
  * @param expression - A cron expression or alias.
  * @returns The compiled field sets.
@@ -245,6 +246,7 @@ export declare function parseCron(expression: string): CronFields;
  * @returns The next matching `Date`.
  * @throws {@link CronParseError} if no match occurs within five years
  *   (an unsatisfiable expression).
+ * @throws {RangeError} If `after` is invalid or the timezone is unsupported.
  * @since 0.37.0
  */
 export declare function nextCronRun(expression: string | CronFields, after?: Date, timeZone?: string): Date;

package/dist/scheduler.js

@@ -145,6 +145,7 @@ function parseField(field, min, max, fieldName, names) {
  * Supported syntax per field: `*`, lists (`1,2,3`), ranges (`1-5`), steps
  * (`*\/5`, `1-10/2`), and case-insensitive month (`JAN`–`DEC`) / day
  * (`SUN`–`SAT`) names. Day-of-week accepts both `0` and `7` for Sunday.
+ * Numeric weekday ranges are expanded before Sunday aliases are normalized.
  *
  * @param expression - A cron expression or alias.
  * @returns The compiled field sets.
@@ -167,7 +168,9 @@ export function parseCron(expression) {
     const dayOfMonth = parseField(dom, 1, 31, "day-of-month");
     const month = parseField(mon, 1, 12, "month", MONTH_NAMES);
     // Day-of-week allows 7 as an alias for Sunday; normalize 7 -> 0.
-    const dowRaw = parseField(dow.replace(/7/g, "0"), 0, 6, "day-of-week", DAY_NAMES);
+    const dowRaw = parseField(dow, 0, 7, "day-of-week", DAY_NAMES);
+    if (dowRaw.delete(7))
+        dowRaw.add(0);
     return {
         minute,
         hour,
@@ -187,8 +190,8 @@ const WEEKDAY_INDEX = {
     Fri: 5,
     Sat: 6,
 };
-function wallClockOf(date, timeZone) {
-    if (timeZone === undefined || timeZone === "UTC") {
+function wallClockOf(date, formatter) {
+    if (formatter === undefined) {
         return {
             minute: date.getUTCMinutes(),
             hour: date.getUTCHours(),
@@ -197,16 +200,7 @@ function wallClockOf(date, timeZone) {
             dayOfWeek: date.getUTCDay(),
         };
     }
-    const parts = new Intl.DateTimeFormat("en-US", {
-        timeZone,
-        hour12: false,
-        year: "numeric",
-        month: "numeric",
-        day: "numeric",
-        hour: "numeric",
-        minute: "numeric",
-        weekday: "short",
-    }).formatToParts(date);
+    const parts = formatter.formatToParts(date);
     const get = (type) => parts.find((p) => p.type === type)?.value ?? "0";
     let hour = Number(get("hour"));
     if (hour === 24)
@@ -253,15 +247,38 @@ const MAX_LOOKAHEAD_MINUTES = 5 * 366 * 24 * 60;
  * @returns The next matching `Date`.
  * @throws {@link CronParseError} if no match occurs within five years
  *   (an unsatisfiable expression).
+ * @throws {RangeError} If `after` is invalid or the timezone is unsupported.
  * @since 0.37.0
  */
 export function nextCronRun(expression, after = new Date(), timeZone) {
     const fields = typeof expression === "string" ? parseCron(expression) : expression;
+    if (!Number.isFinite(after.getTime()))
+        throw new RangeError("Invalid cron search date.");
+    const formatter = timeZone === undefined || timeZone === "UTC"
+        ? undefined
+        : new Intl.DateTimeFormat("en-US", {
+            timeZone,
+            hour12: false,
+            year: "numeric",
+            month: "numeric",
+            day: "numeric",
+            hour: "numeric",
+            minute: "numeric",
+            weekday: "short",
+        });
+    if (fields.domRestricted && !fields.dowRestricted) {
+        const possible = [...fields.month].some(month => {
+            const maxDay = new Date(Date.UTC(2000, month, 0)).getUTCDate();
+            return [...fields.dayOfMonth].some(day => day <= maxDay);
+        });
+        if (!possible)
+            throw new CronParseError("Cron expression has no valid calendar day.");
+    }
     // Advance to the start of the next whole minute.
     const start = Math.floor(after.getTime() / 60_000) * 60_000 + 60_000;
     for (let i = 0; i < MAX_LOOKAHEAD_MINUTES; i++) {
         const candidate = new Date(start + i * 60_000);
-        if (matches(fields, wallClockOf(candidate, timeZone)))
+        if (matches(fields, wallClockOf(candidate, formatter)))
             return candidate;
     }
     throw new CronParseError(`Cron expression matches no time within five years (unsatisfiable).`);

package/dist/waf.js

@@ -268,7 +268,7 @@ function inspectionVariants(value, maxValueLength) {
         if (v.includes("+"))
             push(v.replace(/\+/g, " "));
         if (v.includes("/*"))
-            push(v.replace(/\/\*[\s\S]*?\*\//g, " "));
+            push(stripBlockComments(v));
         // Control characters (notably NUL) are not `\s`, so `1'%00OR%001=1` split
         // `OR` from `1=1` and walked past the whitespace-anchored signatures. Scan
         // a control-char→space form; benign traffic carries almost no C0 bytes, so
@@ -285,6 +285,24 @@ function inspectionVariants(value, maxValueLength) {
     }
     return out;
 }
+function stripBlockComments(value) {
+    let cursor = 0;
+    const parts = [];
+    for (;;) {
+        const start = value.indexOf("/*", cursor);
+        if (start < 0)
+            break;
+        const end = value.indexOf("*/", start + 2);
+        if (end < 0)
+            break;
+        parts.push(value.slice(cursor, start), " ");
+        cursor = end + 2;
+    }
+    if (cursor === 0)
+        return value;
+    parts.push(value.slice(cursor));
+    return parts.join("");
+}
 /**
  * Scan every inspection variant of `value` for the active rule set.
  *

package/dist/webhook-delivery.d.ts

@@ -252,6 +252,8 @@ export interface WebhookSenderOptions {
  * dead-letters a single {@link WebhookEvent}, resolving to a
  * {@link WebhookDeliveryResult} (it does not throw on ordinary delivery
  * failure).
+ * Intermediate response bodies are cancelled before retry backoff without
+ * waiting for producer cancellation; the final response remains caller-owned.
  *
  * @example
  * ```ts

package/dist/webhook-delivery.js

@@ -133,6 +133,8 @@ function randomId() {
  * dead-letters a single {@link WebhookEvent}, resolving to a
  * {@link WebhookDeliveryResult} (it does not throw on ordinary delivery
  * failure).
+ * Intermediate response bodies are cancelled before retry backoff without
+ * waiting for producer cancellation; the final response remains caller-owned.
  *
  * @example
  * ```ts
@@ -277,6 +279,7 @@ export function createWebhookSender(options) {
                 });
                 if (!retryable)
                     break;
+                void response.body?.cancel().catch(() => undefined);
                 await sleep(delayMs);
                 continue;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.3.1",
+  "version": "1.3.3",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops \u2014 distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -266,8 +266,8 @@
     "red-team:live": "node --import tsx red-team-live/run.ts",
     "red-team:live:mcp": "node --import tsx red-team-live/mcp-attacks.ts",
     "red-team:live:wave2": "node --import tsx red-team-live/skill-wave2-attacks.ts",
-    "coverage": "node --import tsx --test --experimental-test-coverage --test-coverage-include='src/**' --test-coverage-lines=90 --test-coverage-functions=90 tests/**/*.test.ts",
-    "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include='dist-coverage/src/**' --test-coverage-branches=92 dist-coverage/tests/**/*.test.js",
+    "coverage": "node --import tsx --test --experimental-test-coverage --test-coverage-include=\"src/**\" --test-coverage-lines=90 --test-coverage-functions=90 tests/**/*.test.ts",
+    "coverage:branches": "tsc -p tsconfig.coverage.json && node --test --experimental-test-coverage --test-coverage-include=\"dist-coverage/src/**\" --test-coverage-branches=92 dist-coverage/tests/**/*.test.js",
     "typecheck": "tsc --noEmit && tsc -p tsconfig.typetest.json && tsc -p tests/tsconfig.json --noEmit && tsc -p red-team-live/tsconfig.json --noEmit",
     "typecheck:tests": "tsc -p tests/tsconfig.json --noEmit",
     "format": "prettier --write .",
@@ -319,6 +319,6 @@
     "bin",
     "README.md"
   ],
-  "packageManager": "pnpm@11.1.3",
+  "packageManager": "pnpm@12.3.0",
   "dependencies": {}
 }