@daloyjs/core 1.3.2 → 1.3.3

package/dist/app.d.ts

@@ -1049,7 +1049,7 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      */
     private responseBodySchemaAuditDone;
     /**
-     * Cached merge of `options.hooks` only. Used on the cold 404/405 path
+    * Cached merge of `options.hooks` and secure-header response hooks. Used on the cold 404/405 path
      * and as the baseline for cross-origin guard decisions when no route
      * matches.
      */
@@ -1405,7 +1405,9 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      *
      * Defaults (secure-by-default):
      *  - path: `/healthz`
-     *  - rate-limit: 60 req/min per remote IP, in-memory (per-process)
+    *  - rate-limit: 60 req/min per trusted identity, or a shared global bucket,
+    *    in-memory (per-process). Verified-token and rejected requests use
+    *    separate budgets so unauthenticated traffic cannot exhaust probe capacity.
      *  - auth: opt-in via `token`. In production with `secureDefaults: true`,
      *    registration refuses to add the route without a `token` unless
      *    `acknowledgeUnauthenticated: true` is set, so an unguarded
@@ -1416,6 +1418,9 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      * app.healthcheck({ token: process.env.HEALTH_TOKEN! });
      * ```
      *
+    * @param opts - Probe path, token, and rate-limit policy.
+    * @returns This app for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.18.0
      */
     healthcheck(opts?: HealthRouteOptions): this;
@@ -1428,6 +1433,9 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      *
      * Defaults match {@link App.healthcheck} (path defaults to `/readyz`).
      *
+    * @param opts - Probe path, token, and rate-limit policy.
+    * @returns This app for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.18.0
      */
     readinesscheck(opts?: HealthRouteOptions): this;
@@ -1445,7 +1453,8 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      *
      * The scrape route inherits the same hardened posture as
      * {@link App.healthcheck}: optional bearer token compared via
-     * {@link timingSafeEqual}, a per-IP fixed-window rate limit, and a
+    * {@link timingSafeEqual}, a per-trusted-identity (otherwise global) fixed-window
+    * rate limit with separate verified-token and rejected-request budgets, and a
      * refuse-to-boot guard in production (an unauthenticated `/metrics`
      * endpoint leaks internal route names, latency, and traffic volume) unless
      * a token is supplied or `acknowledgeUnauthenticated: true` is passed.
@@ -1462,6 +1471,7 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      *
      * @param opts - Path, auth, rate-limit, registry, and label configuration.
      * @returns `this` for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.37.0
      */
     metrics(opts?: MetricsRouteOptions): this;
@@ -1674,6 +1684,7 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      * ```
      *
      * @param hooks - Hook bundle applied to subsequent routes.
+    * Secure-header hooks also apply to unmatched routes and early rejections.
      * @returns This `App` instance for chaining.
      */
     use(hooks: Hooks): this;

package/dist/app.js

@@ -479,7 +479,7 @@ export class App {
      */
     responseBodySchemaAuditDone = false;
     /**
-     * Cached merge of `options.hooks` only. Used on the cold 404/405 path
+    * Cached merge of `options.hooks` and secure-header response hooks. Used on the cold 404/405 path
      * and as the baseline for cross-origin guard decisions when no route
      * matches.
      */
@@ -487,7 +487,12 @@ export class App {
     _globalCorsAllowsCache;
     get globalHooks() {
         if (this._globalHooksCache === undefined) {
-            this._globalHooksCache = mergeHooks([this.options.hooks ?? {}]);
+            this._globalHooksCache = mergeHooks([
+                this.options.hooks ?? {},
+                ...this.groupHooks
+                    .filter(hook => hook[SECURE_HEADERS_MARKER] === true)
+                    .map(hook => ({ onSend: hook.onSend, onResponse: hook.onResponse })),
+            ]);
         }
         return this._globalHooksCache;
     }
@@ -829,8 +834,13 @@ export class App {
             return;
         }
         const origin = request.headers.get("origin");
-        if (!origin || origin === "null")
+        if (!origin)
             return;
+        if (origin === "null") {
+            if (corsOriginAllows.some((allows) => allows(origin)))
+                return;
+            throw new ForbiddenError("Cross-origin state-changing request rejected: opaque Origin requires an allowing cors() policy.");
+        }
         // Fast path: when both the Origin header and the request URL are in the
         // trivially-normalized shape (lowercase ASCII scheme://host[:port] with
         // no userinfo / percent-escapes / IPv6 brackets), their origins can be
@@ -1784,7 +1794,9 @@ export class App {
      *
      * Defaults (secure-by-default):
      *  - path: `/healthz`
-     *  - rate-limit: 60 req/min per remote IP, in-memory (per-process)
+    *  - rate-limit: 60 req/min per trusted identity, or a shared global bucket,
+    *    in-memory (per-process). Verified-token and rejected requests use
+    *    separate budgets so unauthenticated traffic cannot exhaust probe capacity.
      *  - auth: opt-in via `token`. In production with `secureDefaults: true`,
      *    registration refuses to add the route without a `token` unless
      *    `acknowledgeUnauthenticated: true` is set, so an unguarded
@@ -1795,6 +1807,9 @@ export class App {
      * app.healthcheck({ token: process.env.HEALTH_TOKEN! });
      * ```
      *
+    * @param opts - Probe path, token, and rate-limit policy.
+    * @returns This app for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.18.0
      */
     healthcheck(opts = {}) {
@@ -1813,6 +1828,9 @@ export class App {
      *
      * Defaults match {@link App.healthcheck} (path defaults to `/readyz`).
      *
+    * @param opts - Probe path, token, and rate-limit policy.
+    * @returns This app for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.18.0
      */
     readinesscheck(opts = {}) {
@@ -1847,7 +1865,8 @@ export class App {
      *
      * The scrape route inherits the same hardened posture as
      * {@link App.healthcheck}: optional bearer token compared via
-     * {@link timingSafeEqual}, a per-IP fixed-window rate limit, and a
+    * {@link timingSafeEqual}, a per-trusted-identity (otherwise global) fixed-window
+    * rate limit with separate verified-token and rejected-request budgets, and a
      * refuse-to-boot guard in production (an unauthenticated `/metrics`
      * endpoint leaks internal route names, latency, and traffic volume) unless
      * a token is supplied or `acknowledgeUnauthenticated: true` is passed.
@@ -1864,6 +1883,7 @@ export class App {
      *
      * @param opts - Path, auth, rate-limit, registry, and label configuration.
      * @returns `this` for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.37.0
      */
     metrics(opts = {}) {
@@ -1931,8 +1951,11 @@ export class App {
             // Prometheus text exposition rendered by the framework registry.
             acknowledgeNoResponseBodySchema: true,
             handler: async ({ request }) => {
+                const authMatch = token === undefined ? null : /^Bearer\s+(.+)$/i.exec(request.headers.get("authorization") ?? "");
+                const tokenAccepted = token !== undefined && authMatch !== null && timingSafeEqual(authMatch[1], token);
                 if (buckets && rateLimitConfig) {
-                    const key = healthRouteKey(request, trustProxyHeaders);
+                    const identity = healthRouteKey(request, trustProxyHeaders);
+                    const key = token === undefined ? identity : `${tokenAccepted ? "verified" : "unverified"}\u0000${identity}`;
                     const now = Date.now();
                     const entry = buckets.get(key);
                     if (!entry || entry.resetMs <= now) {
@@ -1949,16 +1972,14 @@ export class App {
                     }
                 }
                 if (token !== undefined) {
-                    const h = request.headers.get("authorization") ?? "";
-                    const m = /^Bearer\s+(.+)$/i.exec(h);
-                    if (!m) {
+                    if (!authMatch) {
                         throw new HttpError(401, {
                             type: "https://daloyjs.dev/errors/unauthorized",
                             title: "Unauthorized",
                             detail: "Metrics scrape requires a bearer token.",
                         }, { "www-authenticate": 'Bearer realm="metrics"' });
                     }
-                    if (!timingSafeEqual(m[1], token)) {
+                    if (!tokenAccepted) {
                         throw new ForbiddenError("Invalid metrics scrape token.");
                     }
                 }
@@ -2222,8 +2243,11 @@ export class App {
             // Framework-serialized probe payload; missing schema is intentional.
             acknowledgeNoResponseBodySchema: true,
             handler: async ({ request }) => {
+                const authMatch = token === undefined ? null : /^Bearer\s+(.+)$/i.exec(request.headers.get("authorization") ?? "");
+                const tokenAccepted = token !== undefined && authMatch !== null && timingSafeEqual(authMatch[1], token);
                 if (buckets && rateLimitConfig) {
-                    const key = healthRouteKey(request, trustProxyHeaders);
+                    const identity = healthRouteKey(request, trustProxyHeaders);
+                    const key = token === undefined ? identity : `${tokenAccepted ? "verified" : "unverified"}\u0000${identity}`;
                     const now = Date.now();
                     const entry = buckets.get(key);
                     if (!entry || entry.resetMs <= now) {
@@ -2240,16 +2264,14 @@ export class App {
                     }
                 }
                 if (token !== undefined) {
-                    const h = request.headers.get("authorization") ?? "";
-                    const m = /^Bearer\s+(.+)$/i.exec(h);
-                    if (!m) {
+                    if (!authMatch) {
                         throw new HttpError(401, {
                             type: "https://daloyjs.dev/errors/unauthorized",
                             title: "Unauthorized",
                             detail: "Health probe requires a bearer token.",
                         }, { "www-authenticate": 'Bearer realm="health"' });
                     }
-                    if (!timingSafeEqual(m[1], token)) {
+                    if (!tokenAccepted) {
                         throw new ForbiddenError("Invalid health probe token.");
                     }
                 }
@@ -2459,6 +2481,7 @@ export class App {
      * ```
      *
      * @param hooks - Hook bundle applied to subsequent routes.
+    * Secure-header hooks also apply to unmatched routes and early rejections.
      * @returns This `App` instance for chaining.
      */
     use(hooks) {
@@ -2480,6 +2503,7 @@ export class App {
         }
         this.groupHooks.push(hooks);
         this._coldPathHooksCache = undefined;
+        this._globalHooksCache = undefined;
         if (hooks[CORS_HOOK_MARKER] === true) {
             this.corsOriginAllows = corsOriginAllowsFromHooks(this.groupHooks);
         }

package/dist/conn-info.d.ts

@@ -108,7 +108,7 @@ export declare function assertBehindProxy(cfg: BehindProxyConfig | undefined): v
  * @param header - Raw `X-Forwarded-For` header value, or `null` when absent.
  * @param hops - Declared number of trusted proxy hops (must be >= 1).
  * @returns The client IP at the declared hop, or `undefined` when the chain
- *   is too short or `hops < 1`.
+ *   is too short, the selected slot is not an IP, or `hops < 1`.
  * @internal
  */
 export declare function pickForwardedForByHops(header: string | null, hops: number): string | undefined;
@@ -216,7 +216,8 @@ export declare function resolveTrustedProxyMatchers(name: string, opts: {
  *   {@link resolveTrustedProxyMatchers}. When supplied, forwarded headers
  *   are honoured only if the immediate peer matches; otherwise `undefined`.
  * @returns The resolved client IP, or `undefined` when no forwarded identity
- *   is available. Callers decide their own posture for `undefined`
+ *   is available. Placeholder and malformed identities are rejected without
+ *   shifting the selected hop. Callers decide their own posture for `undefined`
  *   (fail-closed 403, fail-open skip, or a shared `"global"` bucket).
  * @since 1.0.0-rc.7
  */

package/dist/conn-info.js

@@ -101,7 +101,7 @@ export function assertBehindProxy(cfg) {
  * @param header - Raw `X-Forwarded-For` header value, or `null` when absent.
  * @param hops - Declared number of trusted proxy hops (must be >= 1).
  * @returns The client IP at the declared hop, or `undefined` when the chain
- *   is too short or `hops < 1`.
+ *   is too short, the selected slot is not an IP, or `hops < 1`.
  * @internal
  */
 export function pickForwardedForByHops(header, hops) {
@@ -109,13 +109,13 @@ export function pickForwardedForByHops(header, hops) {
         return undefined;
     const parts = header
         .split(",")
-        .map((p) => p.trim())
-        .filter((p) => p.length > 0);
+        .map((p) => p.trim());
     if (parts.length < hops)
         return undefined;
     // Right-to-left: index 0 is the last hop closest to Daloy. The client
     // typically lives at parts[parts.length - hops].
-    return parts[parts.length - hops];
+    const selected = parts[parts.length - hops];
+    return selected && parseIp(selected) ? selected : undefined;
 }
 /**
  * Validate a middleware's forwarded-header trust options and resolve them into
@@ -274,7 +274,8 @@ function isTrustedPeer(request, trustedPeers) {
  *   {@link resolveTrustedProxyMatchers}. When supplied, forwarded headers
  *   are honoured only if the immediate peer matches; otherwise `undefined`.
  * @returns The resolved client IP, or `undefined` when no forwarded identity
- *   is available. Callers decide their own posture for `undefined`
+ *   is available. Placeholder and malformed identities are rejected without
+ *   shifting the selected hop. Callers decide their own posture for `undefined`
  *   (fail-closed 403, fail-open skip, or a shared `"global"` bucket).
  * @since 1.0.0-rc.7
  */
@@ -282,9 +283,9 @@ export function resolveForwardedClientIp(request, hops = 1, trustedPeers) {
     if (trustedPeers !== undefined && !isTrustedPeer(request, trustedPeers)) {
         return undefined;
     }
-    const picked = pickForwardedForByHops(request.headers.get("x-forwarded-for"), hops);
-    if (picked)
-        return picked;
+    const forwarded = request.headers.get("x-forwarded-for");
+    if (forwarded !== null)
+        return pickForwardedForByHops(forwarded, hops);
     // Fail closed past one hop. A chain that produced fewer than `hops` entries
     // means the request never traversed the declared topology — a direct-to-origin
     // request that skipped the CDN, say — so no forwarded value it carries is
@@ -298,7 +299,8 @@ export function resolveForwardedClientIp(request, hops = 1, trustedPeers) {
     // identity", not "the identity the caller asked me to believe".
     if (hops !== 1)
         return undefined;
-    return request.headers.get("x-real-ip") ?? undefined;
+    const realIp = request.headers.get("x-real-ip")?.trim();
+    return realIp && parseIp(realIp) ? realIp : undefined;
 }
 /**
  * Compiled-CIDR cache for {@link resolveClientIp}'s `{ cidrs }` branch. Keyed

package/dist/fetch-guard.d.ts

@@ -260,7 +260,8 @@ export interface FetchGuardOptions {
  *   redirect destinations; use `redirect: "error"` or `"manual"` in that case.
  * @throws {Error} If no underlying fetch implementation is available.
  * @throws {SsrfBlockedError} The returned function throws when a destination
- *   or redirect chain violates the configured policy; network errors propagate.
+ *   or redirect chain violates policy, including malformed URLs and userinfo.
+ *   Userinfo is removed from error URLs; network errors propagate.
  * @throws {TypeError} The returned function throws on invalid requests or
  *   redirects when `redirect: "error"` is selected.
  * @since 0.34.0

package/dist/fetch-guard.js

@@ -182,7 +182,8 @@ const UNIQUE_LOCAL = ["fc00::/7"];
  *   redirect destinations; use `redirect: "error"` or `"manual"` in that case.
  * @throws {Error} If no underlying fetch implementation is available.
  * @throws {SsrfBlockedError} The returned function throws when a destination
- *   or redirect chain violates the configured policy; network errors propagate.
+ *   or redirect chain violates policy, including malformed URLs and userinfo.
+ *   Userinfo is removed from error URLs; network errors propagate.
  * @throws {TypeError} The returned function throws on invalid requests or
  *   redirects when `redirect: "error"` is selected.
  * @since 0.34.0
@@ -311,9 +312,9 @@ export function fetchGuard(options = {}) {
                 pre = new URL(input);
             }
             catch {
-                pre = undefined;
+                throw new SsrfBlockedError("[invalid URL]", "invalid-url");
             }
-            if (pre && (pre.username !== "" || pre.password !== "")) {
+            if (pre.username !== "" || pre.password !== "") {
                 pre.username = "";
                 pre.password = "";
                 throw new SsrfBlockedError(pre.toString(), "credentials-in-url");
@@ -362,6 +363,12 @@ export function fetchGuard(options = {}) {
             catch {
                 throw new SsrfBlockedError(loc, "invalid-url");
             }
+            if (next.username !== "" || next.password !== "") {
+                next.username = "";
+                next.password = "";
+                void res.body?.cancel().catch(() => undefined);
+                throw new SsrfBlockedError(next.toString(), "credentials-in-url");
+            }
             // Per fetch spec: 303 (and 301/302 for non-GET/HEAD in practice) downgrade to GET.
             const method = request.method.toUpperCase();
             const shouldDowngrade = res.status === 303 ||

package/dist/logger.d.ts

@@ -58,7 +58,7 @@ export interface LoggerRedactionOptions {
      * @since 0.69.0
      */
     redactCredentialLikeStrings?: boolean;
-    /** Maximum recursion depth when walking nested objects. Default: 6. */
+    /** Maximum recursion depth when walking nested objects. Deeper objects and arrays are censored in full. Default: 6. */
     maxDepth?: number;
 }
 /**
@@ -98,6 +98,8 @@ interface ResolvedRedaction {
  * matches `cfg.keys` and any string value shaped like a JWT (when
  * `cfg.redactJwt` is on) with `cfg.censor`. Exported for direct use by
  * custom logger implementations that want the same defaults.
+ * Objects and arrays beyond the depth budget are replaced with the censor,
+ * rather than serialized without inspecting their contents.
  *
  * @param record - Log record to redact. Mutated in place (cycle-safe, depth-capped).
  * @param cfg - Resolved redaction settings (key set, censor, JWT/credential toggles, max depth).

package/dist/logger.js

@@ -133,6 +133,8 @@ function redactString(value, cfg) {
  * matches `cfg.keys` and any string value shaped like a JWT (when
  * `cfg.redactJwt` is on) with `cfg.censor`. Exported for direct use by
  * custom logger implementations that want the same defaults.
+ * Objects and arrays beyond the depth budget are replaced with the censor,
+ * rather than serialized without inspecting their contents.
  *
  * @param record - Log record to redact. Mutated in place (cycle-safe, depth-capped).
  * @param cfg - Resolved redaction settings (key set, censor, JWT/credential toggles, max depth).
@@ -159,6 +161,9 @@ function walkRedact(node, cfg, depth, seen) {
                 if (replaced !== v)
                     node[i] = replaced;
             }
+            else if (v !== null && typeof v === "object" && depth >= cfg.maxDepth) {
+                node[i] = cfg.censor;
+            }
             else {
                 walkRedact(v, cfg, depth + 1, seen);
             }
@@ -178,6 +183,9 @@ function walkRedact(node, cfg, depth, seen) {
             if (replaced !== v)
                 obj[key] = replaced;
         }
+        else if (v !== null && typeof v === "object" && depth >= cfg.maxDepth) {
+            obj[key] = cfg.censor;
+        }
         else {
             walkRedact(v, cfg, depth + 1, seen);
         }

package/dist/mtls.d.ts

@@ -144,9 +144,10 @@ export declare function normalizePeerCertificate(raw: PeerCertificateLike | null
  * Parse an Envoy `X-Forwarded-Client-Cert` (XFCC) header value into a
  * {@link ClientCertificate}. XFCC is a comma-separated list of proxy elements,
  * each a `;`-delimited set of `Key=Value` pairs (`Hash`, `Subject`, `URI`,
- * `DNS`, `Cert`, …). The **first** element is the client closest to the origin
- * and is the one returned. Because Envoy only emits XFCC for connections it
- * mutually authenticated, the result is marked `verified: true`.
+ * `DNS`, `Cert`, …). The **first** element is returned. The `verified: true`
+ * result is a trusted-proxy assertion, not cryptographic verification by this
+ * parser. The terminator must verify client certificates, strip incoming XFCC,
+ * and replace it with its own value. Append-only forwarding is insufficient.
  *
  * @param headerValue Raw XFCC header value; `null`/`undefined` are tolerated.
  * @returns The certificate parsed from the first XFCC element, or `undefined`
@@ -258,6 +259,9 @@ export interface ClientCertAuthOptions {
  * parsed from a trusted-proxy header, enforces verification + optional
  * allow-lists + validity window + a custom hook, and stamps the accepted
  * certificate on `ctx.state` for downstream handlers.
+ * Header mode requires an origin reachable only through a trusted terminator
+ * that strips and replaces identity headers after certificate verification.
+ * Fingerprint allowlists do not authenticate client-supplied header values.
  *
  * Rejection semantics:
  * - **No certificate presented** → `401` `application/problem+json` with

package/dist/mtls.js

@@ -256,9 +256,10 @@ function cnFromDN(dn) {
  * Parse an Envoy `X-Forwarded-Client-Cert` (XFCC) header value into a
  * {@link ClientCertificate}. XFCC is a comma-separated list of proxy elements,
  * each a `;`-delimited set of `Key=Value` pairs (`Hash`, `Subject`, `URI`,
- * `DNS`, `Cert`, …). The **first** element is the client closest to the origin
- * and is the one returned. Because Envoy only emits XFCC for connections it
- * mutually authenticated, the result is marked `verified: true`.
+ * `DNS`, `Cert`, …). The **first** element is returned. The `verified: true`
+ * result is a trusted-proxy assertion, not cryptographic verification by this
+ * parser. The terminator must verify client certificates, strip incoming XFCC,
+ * and replace it with its own value. Append-only forwarding is insufficient.
  *
  * @param headerValue Raw XFCC header value; `null`/`undefined` are tolerated.
  * @returns The certificate parsed from the first XFCC element, or `undefined`
@@ -344,6 +345,9 @@ const MISSING_CERT_BODY = JSON.stringify({
  * parsed from a trusted-proxy header, enforces verification + optional
  * allow-lists + validity window + a custom hook, and stamps the accepted
  * certificate on `ctx.state` for downstream handlers.
+ * Header mode requires an origin reachable only through a trusted terminator
+ * that strips and replaces identity headers after certificate verification.
+ * Fingerprint allowlists do not authenticate client-supplied header values.
  *
  * Rejection semantics:
  * - **No certificate presented** → `401` `application/problem+json` with

package/dist/router.d.ts

@@ -7,7 +7,8 @@
  *   - Path normalization and splitting avoid regular expressions.
  *
  * Safety:
- *   - Path traversal (`..`) and empty segments are rejected at lookup time.
+ *   - Raw `/../`, trailing `/..`, and empty segments are rejected at lookup time.
+ *   - Decoded parameters are untrusted data, not sanitized filesystem paths.
  *   - Duplicate routes and duplicate operationIds throw at registration.
  *   - Wildcard segments must be terminal.
  */

package/dist/router.js

@@ -7,7 +7,8 @@
  *   - Path normalization and splitting avoid regular expressions.
  *
  * Safety:
- *   - Path traversal (`..`) and empty segments are rejected at lookup time.
+ *   - Raw `/../`, trailing `/..`, and empty segments are rejected at lookup time.
+ *   - Decoded parameters are untrusted data, not sanitized filesystem paths.
  *   - Duplicate routes and duplicate operationIds throw at registration.
  *   - Wildcard segments must be terminal.
  */

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e5e6316e-26ff-52ae-9520-4b82d88c8397",
+  "serialNumber": "urn:uuid:6545c557-5cea-599b-8286-d910b13cb482",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-08T07:08:54.894Z",
+    "timestamp": "2026-09-10T10:47:58.279Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.3.2"
+        "version": "1.3.3"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.3.2",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.3.3",
       "name": "@daloyjs/core",
-      "version": "1.3.2",
+      "version": "1.3.3",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.3.2",
+      "purl": "pkg:npm/@daloyjs/core@1.3.3",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.3.2",
+        "tagId": "swidtag--daloyjs-core-1.3.3",
         "name": "@daloyjs/core",
-        "version": "1.3.2",
+        "version": "1.3.3",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.3.2",
+      "ref": "pkg:npm/@daloyjs/core@1.3.3",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.3.2",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.2-e5e6316e-26ff-52ae-9520-4b82d88c8397",
+  "name": "@daloyjs/core-1.3.3",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.3-6545c557-5cea-599b-8286-d910b13cb482",
   "creationInfo": {
-    "created": "2026-09-08T07:08:54.894Z",
+    "created": "2026-09-10T10:47:58.279Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.3.2",
+      "versionInfo": "1.3.3",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.2"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.3"
         }
       ]
     }

package/dist/scheduler.d.ts

@@ -228,6 +228,7 @@ export interface CronFields {
  * Supported syntax per field: `*`, lists (`1,2,3`), ranges (`1-5`), steps
  * (`*\/5`, `1-10/2`), and case-insensitive month (`JAN`–`DEC`) / day
  * (`SUN`–`SAT`) names. Day-of-week accepts both `0` and `7` for Sunday.
+ * Numeric weekday ranges are expanded before Sunday aliases are normalized.
  *
  * @param expression - A cron expression or alias.
  * @returns The compiled field sets.
@@ -245,6 +246,7 @@ export declare function parseCron(expression: string): CronFields;
  * @returns The next matching `Date`.
  * @throws {@link CronParseError} if no match occurs within five years
  *   (an unsatisfiable expression).
+ * @throws {RangeError} If `after` is invalid or the timezone is unsupported.
  * @since 0.37.0
  */
 export declare function nextCronRun(expression: string | CronFields, after?: Date, timeZone?: string): Date;

package/dist/scheduler.js

@@ -145,6 +145,7 @@ function parseField(field, min, max, fieldName, names) {
  * Supported syntax per field: `*`, lists (`1,2,3`), ranges (`1-5`), steps
  * (`*\/5`, `1-10/2`), and case-insensitive month (`JAN`–`DEC`) / day
  * (`SUN`–`SAT`) names. Day-of-week accepts both `0` and `7` for Sunday.
+ * Numeric weekday ranges are expanded before Sunday aliases are normalized.
  *
  * @param expression - A cron expression or alias.
  * @returns The compiled field sets.
@@ -167,7 +168,9 @@ export function parseCron(expression) {
     const dayOfMonth = parseField(dom, 1, 31, "day-of-month");
     const month = parseField(mon, 1, 12, "month", MONTH_NAMES);
     // Day-of-week allows 7 as an alias for Sunday; normalize 7 -> 0.
-    const dowRaw = parseField(dow.replace(/7/g, "0"), 0, 6, "day-of-week", DAY_NAMES);
+    const dowRaw = parseField(dow, 0, 7, "day-of-week", DAY_NAMES);
+    if (dowRaw.delete(7))
+        dowRaw.add(0);
     return {
         minute,
         hour,
@@ -187,8 +190,8 @@ const WEEKDAY_INDEX = {
     Fri: 5,
     Sat: 6,
 };
-function wallClockOf(date, timeZone) {
-    if (timeZone === undefined || timeZone === "UTC") {
+function wallClockOf(date, formatter) {
+    if (formatter === undefined) {
         return {
             minute: date.getUTCMinutes(),
             hour: date.getUTCHours(),
@@ -197,16 +200,7 @@ function wallClockOf(date, timeZone) {
             dayOfWeek: date.getUTCDay(),
         };
     }
-    const parts = new Intl.DateTimeFormat("en-US", {
-        timeZone,
-        hour12: false,
-        year: "numeric",
-        month: "numeric",
-        day: "numeric",
-        hour: "numeric",
-        minute: "numeric",
-        weekday: "short",
-    }).formatToParts(date);
+    const parts = formatter.formatToParts(date);
     const get = (type) => parts.find((p) => p.type === type)?.value ?? "0";
     let hour = Number(get("hour"));
     if (hour === 24)
@@ -253,15 +247,38 @@ const MAX_LOOKAHEAD_MINUTES = 5 * 366 * 24 * 60;
  * @returns The next matching `Date`.
  * @throws {@link CronParseError} if no match occurs within five years
  *   (an unsatisfiable expression).
+ * @throws {RangeError} If `after` is invalid or the timezone is unsupported.
  * @since 0.37.0
  */
 export function nextCronRun(expression, after = new Date(), timeZone) {
     const fields = typeof expression === "string" ? parseCron(expression) : expression;
+    if (!Number.isFinite(after.getTime()))
+        throw new RangeError("Invalid cron search date.");
+    const formatter = timeZone === undefined || timeZone === "UTC"
+        ? undefined
+        : new Intl.DateTimeFormat("en-US", {
+            timeZone,
+            hour12: false,
+            year: "numeric",
+            month: "numeric",
+            day: "numeric",
+            hour: "numeric",
+            minute: "numeric",
+            weekday: "short",
+        });
+    if (fields.domRestricted && !fields.dowRestricted) {
+        const possible = [...fields.month].some(month => {
+            const maxDay = new Date(Date.UTC(2000, month, 0)).getUTCDate();
+            return [...fields.dayOfMonth].some(day => day <= maxDay);
+        });
+        if (!possible)
+            throw new CronParseError("Cron expression has no valid calendar day.");
+    }
     // Advance to the start of the next whole minute.
     const start = Math.floor(after.getTime() / 60_000) * 60_000 + 60_000;
     for (let i = 0; i < MAX_LOOKAHEAD_MINUTES; i++) {
         const candidate = new Date(start + i * 60_000);
-        if (matches(fields, wallClockOf(candidate, timeZone)))
+        if (matches(fields, wallClockOf(candidate, formatter)))
             return candidate;
     }
     throw new CronParseError(`Cron expression matches no time within five years (unsatisfiable).`);

package/dist/waf.js

@@ -268,7 +268,7 @@ function inspectionVariants(value, maxValueLength) {
         if (v.includes("+"))
             push(v.replace(/\+/g, " "));
         if (v.includes("/*"))
-            push(v.replace(/\/\*[\s\S]*?\*\//g, " "));
+            push(stripBlockComments(v));
         // Control characters (notably NUL) are not `\s`, so `1'%00OR%001=1` split
         // `OR` from `1=1` and walked past the whitespace-anchored signatures. Scan
         // a control-char→space form; benign traffic carries almost no C0 bytes, so
@@ -285,6 +285,24 @@ function inspectionVariants(value, maxValueLength) {
     }
     return out;
 }
+function stripBlockComments(value) {
+    let cursor = 0;
+    const parts = [];
+    for (;;) {
+        const start = value.indexOf("/*", cursor);
+        if (start < 0)
+            break;
+        const end = value.indexOf("*/", start + 2);
+        if (end < 0)
+            break;
+        parts.push(value.slice(cursor, start), " ");
+        cursor = end + 2;
+    }
+    if (cursor === 0)
+        return value;
+    parts.push(value.slice(cursor));
+    return parts.join("");
+}
 /**
  * Scan every inspection variant of `value` for the active rule set.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops \u2014 distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -319,6 +319,6 @@
     "bin",
     "README.md"
   ],
-  "packageManager": "pnpm@11.1.3",
+  "packageManager": "pnpm@12.3.0",
   "dependencies": {}
 }