@daloyjs/core 1.3.2 → 1.3.4

package/README.md

@@ -491,7 +491,8 @@ miss                         7,742,635 ops/sec
 
 - After traversal checks, exact static routes resolve with an allocation-free
   `Map.get` fast path — **~26M ops/sec**.
-- Dynamic routes walk a trie, **O(path-segments)** regardless of route count.
+- Dynamic routes walk a segment trie in path-length time without backtracking;
+  overlapping routes can require visiting additional branches.
 - Body parsing is lazy and only runs when a route declares a body schema.
 - Path normalization and splitting use index/character scans rather than
   regular expressions.

package/dist/app.d.ts

@@ -1049,7 +1049,7 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      */
     private responseBodySchemaAuditDone;
     /**
-     * Cached merge of `options.hooks` only. Used on the cold 404/405 path
+    * Cached merge of `options.hooks` and secure-header response hooks. Used on the cold 404/405 path
      * and as the baseline for cross-origin guard decisions when no route
      * matches.
      */
@@ -1405,7 +1405,9 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      *
      * Defaults (secure-by-default):
      *  - path: `/healthz`
-     *  - rate-limit: 60 req/min per remote IP, in-memory (per-process)
+    *  - rate-limit: 60 req/min per trusted identity, or a shared global bucket,
+    *    in-memory (per-process). Verified-token and rejected requests use
+    *    separate budgets so unauthenticated traffic cannot exhaust probe capacity.
      *  - auth: opt-in via `token`. In production with `secureDefaults: true`,
      *    registration refuses to add the route without a `token` unless
      *    `acknowledgeUnauthenticated: true` is set, so an unguarded
@@ -1416,6 +1418,9 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      * app.healthcheck({ token: process.env.HEALTH_TOKEN! });
      * ```
      *
+    * @param opts - Probe path, token, and rate-limit policy.
+    * @returns This app for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.18.0
      */
     healthcheck(opts?: HealthRouteOptions): this;
@@ -1428,6 +1433,9 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      *
      * Defaults match {@link App.healthcheck} (path defaults to `/readyz`).
      *
+    * @param opts - Probe path, token, and rate-limit policy.
+    * @returns This app for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.18.0
      */
     readinesscheck(opts?: HealthRouteOptions): this;
@@ -1445,7 +1453,8 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      *
      * The scrape route inherits the same hardened posture as
      * {@link App.healthcheck}: optional bearer token compared via
-     * {@link timingSafeEqual}, a per-IP fixed-window rate limit, and a
+    * {@link timingSafeEqual}, a per-trusted-identity (otherwise global) fixed-window
+    * rate limit with separate verified-token and rejected-request budgets, and a
      * refuse-to-boot guard in production (an unauthenticated `/metrics`
      * endpoint leaks internal route names, latency, and traffic volume) unless
      * a token is supplied or `acknowledgeUnauthenticated: true` is passed.
@@ -1462,6 +1471,7 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      *
      * @param opts - Path, auth, rate-limit, registry, and label configuration.
      * @returns `this` for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.37.0
      */
     metrics(opts?: MetricsRouteOptions): this;
@@ -1674,6 +1684,7 @@ export declare class App<Routes extends readonly RouteDefinition<any, any, any,
      * ```
      *
      * @param hooks - Hook bundle applied to subsequent routes.
+    * Secure-header hooks also apply to unmatched routes and early rejections.
      * @returns This `App` instance for chaining.
      */
     use(hooks: Hooks): this;

package/dist/app.js

@@ -479,7 +479,7 @@ export class App {
      */
     responseBodySchemaAuditDone = false;
     /**
-     * Cached merge of `options.hooks` only. Used on the cold 404/405 path
+    * Cached merge of `options.hooks` and secure-header response hooks. Used on the cold 404/405 path
      * and as the baseline for cross-origin guard decisions when no route
      * matches.
      */
@@ -487,7 +487,12 @@ export class App {
     _globalCorsAllowsCache;
     get globalHooks() {
         if (this._globalHooksCache === undefined) {
-            this._globalHooksCache = mergeHooks([this.options.hooks ?? {}]);
+            this._globalHooksCache = mergeHooks([
+                this.options.hooks ?? {},
+                ...this.groupHooks
+                    .filter(hook => hook[SECURE_HEADERS_MARKER] === true)
+                    .map(hook => ({ onSend: hook.onSend, onResponse: hook.onResponse })),
+            ]);
         }
         return this._globalHooksCache;
     }
@@ -829,8 +834,13 @@ export class App {
             return;
         }
         const origin = request.headers.get("origin");
-        if (!origin || origin === "null")
+        if (!origin)
             return;
+        if (origin === "null") {
+            if (corsOriginAllows.some((allows) => allows(origin)))
+                return;
+            throw new ForbiddenError("Cross-origin state-changing request rejected: opaque Origin requires an allowing cors() policy.");
+        }
         // Fast path: when both the Origin header and the request URL are in the
         // trivially-normalized shape (lowercase ASCII scheme://host[:port] with
         // no userinfo / percent-escapes / IPv6 brackets), their origins can be
@@ -1784,7 +1794,9 @@ export class App {
      *
      * Defaults (secure-by-default):
      *  - path: `/healthz`
-     *  - rate-limit: 60 req/min per remote IP, in-memory (per-process)
+    *  - rate-limit: 60 req/min per trusted identity, or a shared global bucket,
+    *    in-memory (per-process). Verified-token and rejected requests use
+    *    separate budgets so unauthenticated traffic cannot exhaust probe capacity.
      *  - auth: opt-in via `token`. In production with `secureDefaults: true`,
      *    registration refuses to add the route without a `token` unless
      *    `acknowledgeUnauthenticated: true` is set, so an unguarded
@@ -1795,6 +1807,9 @@ export class App {
      * app.healthcheck({ token: process.env.HEALTH_TOKEN! });
      * ```
      *
+    * @param opts - Probe path, token, and rate-limit policy.
+    * @returns This app for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.18.0
      */
     healthcheck(opts = {}) {
@@ -1813,6 +1828,9 @@ export class App {
      *
      * Defaults match {@link App.healthcheck} (path defaults to `/readyz`).
      *
+    * @param opts - Probe path, token, and rate-limit policy.
+    * @returns This app for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.18.0
      */
     readinesscheck(opts = {}) {
@@ -1847,7 +1865,8 @@ export class App {
      *
      * The scrape route inherits the same hardened posture as
      * {@link App.healthcheck}: optional bearer token compared via
-     * {@link timingSafeEqual}, a per-IP fixed-window rate limit, and a
+    * {@link timingSafeEqual}, a per-trusted-identity (otherwise global) fixed-window
+    * rate limit with separate verified-token and rejected-request budgets, and a
      * refuse-to-boot guard in production (an unauthenticated `/metrics`
      * endpoint leaks internal route names, latency, and traffic volume) unless
      * a token is supplied or `acknowledgeUnauthenticated: true` is passed.
@@ -1864,6 +1883,7 @@ export class App {
      *
      * @param opts - Path, auth, rate-limit, registry, and label configuration.
      * @returns `this` for chaining.
+    * @throws {Error} If production authentication is missing without acknowledgment.
      * @since 0.37.0
      */
     metrics(opts = {}) {
@@ -1931,8 +1951,11 @@ export class App {
             // Prometheus text exposition rendered by the framework registry.
             acknowledgeNoResponseBodySchema: true,
             handler: async ({ request }) => {
+                const authMatch = token === undefined ? null : /^Bearer\s+(.+)$/i.exec(request.headers.get("authorization") ?? "");
+                const tokenAccepted = token !== undefined && authMatch !== null && timingSafeEqual(authMatch[1], token);
                 if (buckets && rateLimitConfig) {
-                    const key = healthRouteKey(request, trustProxyHeaders);
+                    const identity = healthRouteKey(request, trustProxyHeaders);
+                    const key = token === undefined ? identity : `${tokenAccepted ? "verified" : "unverified"}\u0000${identity}`;
                     const now = Date.now();
                     const entry = buckets.get(key);
                     if (!entry || entry.resetMs <= now) {
@@ -1949,16 +1972,14 @@ export class App {
                     }
                 }
                 if (token !== undefined) {
-                    const h = request.headers.get("authorization") ?? "";
-                    const m = /^Bearer\s+(.+)$/i.exec(h);
-                    if (!m) {
+                    if (!authMatch) {
                         throw new HttpError(401, {
                             type: "https://daloyjs.dev/errors/unauthorized",
                             title: "Unauthorized",
                             detail: "Metrics scrape requires a bearer token.",
                         }, { "www-authenticate": 'Bearer realm="metrics"' });
                     }
-                    if (!timingSafeEqual(m[1], token)) {
+                    if (!tokenAccepted) {
                         throw new ForbiddenError("Invalid metrics scrape token.");
                     }
                 }
@@ -2222,8 +2243,11 @@ export class App {
             // Framework-serialized probe payload; missing schema is intentional.
             acknowledgeNoResponseBodySchema: true,
             handler: async ({ request }) => {
+                const authMatch = token === undefined ? null : /^Bearer\s+(.+)$/i.exec(request.headers.get("authorization") ?? "");
+                const tokenAccepted = token !== undefined && authMatch !== null && timingSafeEqual(authMatch[1], token);
                 if (buckets && rateLimitConfig) {
-                    const key = healthRouteKey(request, trustProxyHeaders);
+                    const identity = healthRouteKey(request, trustProxyHeaders);
+                    const key = token === undefined ? identity : `${tokenAccepted ? "verified" : "unverified"}\u0000${identity}`;
                     const now = Date.now();
                     const entry = buckets.get(key);
                     if (!entry || entry.resetMs <= now) {
@@ -2240,16 +2264,14 @@ export class App {
                     }
                 }
                 if (token !== undefined) {
-                    const h = request.headers.get("authorization") ?? "";
-                    const m = /^Bearer\s+(.+)$/i.exec(h);
-                    if (!m) {
+                    if (!authMatch) {
                         throw new HttpError(401, {
                             type: "https://daloyjs.dev/errors/unauthorized",
                             title: "Unauthorized",
                             detail: "Health probe requires a bearer token.",
                         }, { "www-authenticate": 'Bearer realm="health"' });
                     }
-                    if (!timingSafeEqual(m[1], token)) {
+                    if (!tokenAccepted) {
                         throw new ForbiddenError("Invalid health probe token.");
                     }
                 }
@@ -2459,6 +2481,7 @@ export class App {
      * ```
      *
      * @param hooks - Hook bundle applied to subsequent routes.
+    * Secure-header hooks also apply to unmatched routes and early rejections.
      * @returns This `App` instance for chaining.
      */
     use(hooks) {
@@ -2480,6 +2503,7 @@ export class App {
         }
         this.groupHooks.push(hooks);
         this._coldPathHooksCache = undefined;
+        this._globalHooksCache = undefined;
         if (hooks[CORS_HOOK_MARKER] === true) {
             this.corsOriginAllows = corsOriginAllowsFromHooks(this.groupHooks);
         }

package/dist/conn-info.d.ts

@@ -108,7 +108,7 @@ export declare function assertBehindProxy(cfg: BehindProxyConfig | undefined): v
  * @param header - Raw `X-Forwarded-For` header value, or `null` when absent.
  * @param hops - Declared number of trusted proxy hops (must be >= 1).
  * @returns The client IP at the declared hop, or `undefined` when the chain
- *   is too short or `hops < 1`.
+ *   is too short, the selected slot is not an IP, or `hops < 1`.
  * @internal
  */
 export declare function pickForwardedForByHops(header: string | null, hops: number): string | undefined;
@@ -216,7 +216,8 @@ export declare function resolveTrustedProxyMatchers(name: string, opts: {
  *   {@link resolveTrustedProxyMatchers}. When supplied, forwarded headers
  *   are honoured only if the immediate peer matches; otherwise `undefined`.
  * @returns The resolved client IP, or `undefined` when no forwarded identity
- *   is available. Callers decide their own posture for `undefined`
+ *   is available. Placeholder and malformed identities are rejected without
+ *   shifting the selected hop. Callers decide their own posture for `undefined`
  *   (fail-closed 403, fail-open skip, or a shared `"global"` bucket).
  * @since 1.0.0-rc.7
  */

package/dist/conn-info.js

@@ -101,7 +101,7 @@ export function assertBehindProxy(cfg) {
  * @param header - Raw `X-Forwarded-For` header value, or `null` when absent.
  * @param hops - Declared number of trusted proxy hops (must be >= 1).
  * @returns The client IP at the declared hop, or `undefined` when the chain
- *   is too short or `hops < 1`.
+ *   is too short, the selected slot is not an IP, or `hops < 1`.
  * @internal
  */
 export function pickForwardedForByHops(header, hops) {
@@ -109,13 +109,13 @@ export function pickForwardedForByHops(header, hops) {
         return undefined;
     const parts = header
         .split(",")
-        .map((p) => p.trim())
-        .filter((p) => p.length > 0);
+        .map((p) => p.trim());
     if (parts.length < hops)
         return undefined;
     // Right-to-left: index 0 is the last hop closest to Daloy. The client
     // typically lives at parts[parts.length - hops].
-    return parts[parts.length - hops];
+    const selected = parts[parts.length - hops];
+    return selected && parseIp(selected) ? selected : undefined;
 }
 /**
  * Validate a middleware's forwarded-header trust options and resolve them into
@@ -274,7 +274,8 @@ function isTrustedPeer(request, trustedPeers) {
  *   {@link resolveTrustedProxyMatchers}. When supplied, forwarded headers
  *   are honoured only if the immediate peer matches; otherwise `undefined`.
  * @returns The resolved client IP, or `undefined` when no forwarded identity
- *   is available. Callers decide their own posture for `undefined`
+ *   is available. Placeholder and malformed identities are rejected without
+ *   shifting the selected hop. Callers decide their own posture for `undefined`
  *   (fail-closed 403, fail-open skip, or a shared `"global"` bucket).
  * @since 1.0.0-rc.7
  */
@@ -282,9 +283,9 @@ export function resolveForwardedClientIp(request, hops = 1, trustedPeers) {
     if (trustedPeers !== undefined && !isTrustedPeer(request, trustedPeers)) {
         return undefined;
     }
-    const picked = pickForwardedForByHops(request.headers.get("x-forwarded-for"), hops);
-    if (picked)
-        return picked;
+    const forwarded = request.headers.get("x-forwarded-for");
+    if (forwarded !== null)
+        return pickForwardedForByHops(forwarded, hops);
     // Fail closed past one hop. A chain that produced fewer than `hops` entries
     // means the request never traversed the declared topology — a direct-to-origin
     // request that skipped the CDN, say — so no forwarded value it carries is
@@ -298,7 +299,8 @@ export function resolveForwardedClientIp(request, hops = 1, trustedPeers) {
     // identity", not "the identity the caller asked me to believe".
     if (hops !== 1)
         return undefined;
-    return request.headers.get("x-real-ip") ?? undefined;
+    const realIp = request.headers.get("x-real-ip")?.trim();
+    return realIp && parseIp(realIp) ? realIp : undefined;
 }
 /**
  * Compiled-CIDR cache for {@link resolveClientIp}'s `{ cidrs }` branch. Keyed

package/dist/fetch-guard.d.ts

@@ -260,7 +260,8 @@ export interface FetchGuardOptions {
  *   redirect destinations; use `redirect: "error"` or `"manual"` in that case.
  * @throws {Error} If no underlying fetch implementation is available.
  * @throws {SsrfBlockedError} The returned function throws when a destination
- *   or redirect chain violates the configured policy; network errors propagate.
+ *   or redirect chain violates policy, including malformed URLs and userinfo.
+ *   Userinfo is removed from error URLs; network errors propagate.
  * @throws {TypeError} The returned function throws on invalid requests or
  *   redirects when `redirect: "error"` is selected.
  * @since 0.34.0

package/dist/fetch-guard.js

@@ -182,7 +182,8 @@ const UNIQUE_LOCAL = ["fc00::/7"];
  *   redirect destinations; use `redirect: "error"` or `"manual"` in that case.
  * @throws {Error} If no underlying fetch implementation is available.
  * @throws {SsrfBlockedError} The returned function throws when a destination
- *   or redirect chain violates the configured policy; network errors propagate.
+ *   or redirect chain violates policy, including malformed URLs and userinfo.
+ *   Userinfo is removed from error URLs; network errors propagate.
  * @throws {TypeError} The returned function throws on invalid requests or
  *   redirects when `redirect: "error"` is selected.
  * @since 0.34.0
@@ -311,9 +312,9 @@ export function fetchGuard(options = {}) {
                 pre = new URL(input);
             }
             catch {
-                pre = undefined;
+                throw new SsrfBlockedError("[invalid URL]", "invalid-url");
             }
-            if (pre && (pre.username !== "" || pre.password !== "")) {
+            if (pre.username !== "" || pre.password !== "") {
                 pre.username = "";
                 pre.password = "";
                 throw new SsrfBlockedError(pre.toString(), "credentials-in-url");
@@ -362,6 +363,12 @@ export function fetchGuard(options = {}) {
             catch {
                 throw new SsrfBlockedError(loc, "invalid-url");
             }
+            if (next.username !== "" || next.password !== "") {
+                next.username = "";
+                next.password = "";
+                void res.body?.cancel().catch(() => undefined);
+                throw new SsrfBlockedError(next.toString(), "credentials-in-url");
+            }
             // Per fetch spec: 303 (and 301/302 for non-GET/HEAD in practice) downgrade to GET.
             const method = request.method.toUpperCase();
             const shouldDowngrade = res.status === 303 ||

package/dist/logger.d.ts

@@ -58,7 +58,7 @@ export interface LoggerRedactionOptions {
      * @since 0.69.0
      */
     redactCredentialLikeStrings?: boolean;
-    /** Maximum recursion depth when walking nested objects. Default: 6. */
+    /** Maximum recursion depth when walking nested objects. Deeper objects and arrays are censored in full. Default: 6. */
     maxDepth?: number;
 }
 /**
@@ -98,6 +98,8 @@ interface ResolvedRedaction {
  * matches `cfg.keys` and any string value shaped like a JWT (when
  * `cfg.redactJwt` is on) with `cfg.censor`. Exported for direct use by
  * custom logger implementations that want the same defaults.
+ * Objects and arrays beyond the depth budget are replaced with the censor,
+ * rather than serialized without inspecting their contents.
  *
  * @param record - Log record to redact. Mutated in place (cycle-safe, depth-capped).
  * @param cfg - Resolved redaction settings (key set, censor, JWT/credential toggles, max depth).

package/dist/logger.js

@@ -133,6 +133,8 @@ function redactString(value, cfg) {
  * matches `cfg.keys` and any string value shaped like a JWT (when
  * `cfg.redactJwt` is on) with `cfg.censor`. Exported for direct use by
  * custom logger implementations that want the same defaults.
+ * Objects and arrays beyond the depth budget are replaced with the censor,
+ * rather than serialized without inspecting their contents.
  *
  * @param record - Log record to redact. Mutated in place (cycle-safe, depth-capped).
  * @param cfg - Resolved redaction settings (key set, censor, JWT/credential toggles, max depth).
@@ -159,6 +161,9 @@ function walkRedact(node, cfg, depth, seen) {
                 if (replaced !== v)
                     node[i] = replaced;
             }
+            else if (v !== null && typeof v === "object" && depth >= cfg.maxDepth) {
+                node[i] = cfg.censor;
+            }
             else {
                 walkRedact(v, cfg, depth + 1, seen);
             }
@@ -178,6 +183,9 @@ function walkRedact(node, cfg, depth, seen) {
             if (replaced !== v)
                 obj[key] = replaced;
         }
+        else if (v !== null && typeof v === "object" && depth >= cfg.maxDepth) {
+            obj[key] = cfg.censor;
+        }
         else {
             walkRedact(v, cfg, depth + 1, seen);
         }

package/dist/mtls.d.ts

@@ -144,9 +144,10 @@ export declare function normalizePeerCertificate(raw: PeerCertificateLike | null
  * Parse an Envoy `X-Forwarded-Client-Cert` (XFCC) header value into a
  * {@link ClientCertificate}. XFCC is a comma-separated list of proxy elements,
  * each a `;`-delimited set of `Key=Value` pairs (`Hash`, `Subject`, `URI`,
- * `DNS`, `Cert`, …). The **first** element is the client closest to the origin
- * and is the one returned. Because Envoy only emits XFCC for connections it
- * mutually authenticated, the result is marked `verified: true`.
+ * `DNS`, `Cert`, …). The **first** element is returned. The `verified: true`
+ * result is a trusted-proxy assertion, not cryptographic verification by this
+ * parser. The terminator must verify client certificates, strip incoming XFCC,
+ * and replace it with its own value. Append-only forwarding is insufficient.
  *
  * @param headerValue Raw XFCC header value; `null`/`undefined` are tolerated.
  * @returns The certificate parsed from the first XFCC element, or `undefined`
@@ -258,6 +259,9 @@ export interface ClientCertAuthOptions {
  * parsed from a trusted-proxy header, enforces verification + optional
  * allow-lists + validity window + a custom hook, and stamps the accepted
  * certificate on `ctx.state` for downstream handlers.
+ * Header mode requires an origin reachable only through a trusted terminator
+ * that strips and replaces identity headers after certificate verification.
+ * Fingerprint allowlists do not authenticate client-supplied header values.
  *
  * Rejection semantics:
  * - **No certificate presented** → `401` `application/problem+json` with

package/dist/mtls.js

@@ -256,9 +256,10 @@ function cnFromDN(dn) {
  * Parse an Envoy `X-Forwarded-Client-Cert` (XFCC) header value into a
  * {@link ClientCertificate}. XFCC is a comma-separated list of proxy elements,
  * each a `;`-delimited set of `Key=Value` pairs (`Hash`, `Subject`, `URI`,
- * `DNS`, `Cert`, …). The **first** element is the client closest to the origin
- * and is the one returned. Because Envoy only emits XFCC for connections it
- * mutually authenticated, the result is marked `verified: true`.
+ * `DNS`, `Cert`, …). The **first** element is returned. The `verified: true`
+ * result is a trusted-proxy assertion, not cryptographic verification by this
+ * parser. The terminator must verify client certificates, strip incoming XFCC,
+ * and replace it with its own value. Append-only forwarding is insufficient.
  *
  * @param headerValue Raw XFCC header value; `null`/`undefined` are tolerated.
  * @returns The certificate parsed from the first XFCC element, or `undefined`
@@ -344,6 +345,9 @@ const MISSING_CERT_BODY = JSON.stringify({
  * parsed from a trusted-proxy header, enforces verification + optional
  * allow-lists + validity window + a custom hook, and stamps the accepted
  * certificate on `ctx.state` for downstream handlers.
+ * Header mode requires an origin reachable only through a trusted terminator
+ * that strips and replaces identity headers after certificate verification.
+ * Fingerprint allowlists do not authenticate client-supplied header values.
  *
  * Rejection semantics:
  * - **No certificate presented** → `401` `application/problem+json` with

package/dist/router.d.ts

@@ -3,11 +3,13 @@
  *
  * Performance:
  *   - Exact static (parameter-free) paths resolve via a Map lookup — O(1).
- *   - Dynamic paths walk a trie, O(path-segments) regardless of route count.
+ *   - Dynamic paths walk a segment trie, visiting static branches before
+ *     parameters and wildcards. Backtracking cost depends on overlapping routes.
  *   - Path normalization and splitting avoid regular expressions.
  *
  * Safety:
- *   - Path traversal (`..`) and empty segments are rejected at lookup time.
+ *   - Raw `/../`, trailing `/..`, and empty segments are rejected at lookup time.
+ *   - Decoded parameters are untrusted data, not sanitized filesystem paths.
  *   - Duplicate routes and duplicate operationIds throw at registration.
  *   - Wildcard segments must be terminal.
  */
@@ -22,12 +24,15 @@ export interface RouteMatch<T> {
 /**
  * Trie/radix router with a static-route fast path. Registers handlers via
  * {@link Router.add} and resolves them with {@link Router.find}. Rejects
- * duplicate routes, duplicate operationIds, conflicting param names, and
- * path-traversal lookups.
+ * duplicate routes, duplicate operationIds, conflicting or unsafe capture names,
+ * and raw path-traversal lookups.
  */
 export declare class Router<T> {
     private root;
     private operationIds;
+    private hasDynamicRoutes;
+    private revision;
+    private staticMethods;
     /** Static (no-param/no-wildcard) routes for O(1) lookup. */
     private staticTable;
     /**
@@ -37,16 +42,22 @@ export declare class Router<T> {
      *
      * @param method - HTTP method to register the handler under.
      * @param path - Route path; supports `:param` and a trailing `*wildcard`.
-     * @param handler - Value returned by {@link Router.find} on a match.
+     * @param handler - Value returned by {@link Router.find} on a match, including
+     *   falsy values or `undefined`.
      * @param operationId - Optional unique id; tracked to reject duplicates.
      * @throws Error on a duplicate route, duplicate `operationId`, or conflicting
-     *   param names at the same trie position.
+     *   parameter or wildcard names at the same trie position, empty, repeated,
+     *   or prototype-sensitive capture names, or a nonterminal wildcard.
+     *   Failed registration does not reserve the `operationId`.
      */
     add(method: HttpMethod, path: string, handler: T, operationId?: string): void;
     /**
      * Look up the handler registered for the given method and path. Tries the
      * static fast path first, then walks the trie, extracting and decoding path
      * params. Path-traversal lookups (`..`, `//`) are rejected up front.
+     * Handler tables inherit only from an empty, frozen, prototype-free base:
+     * Object.prototype properties never count as routes, including for untyped
+     * runtime method values.
      *
      * @param method - HTTP method to match.
      * @param path - Request path to resolve, including any dynamic segments.
@@ -54,7 +65,15 @@ export declare class Router<T> {
      *   route matches the method + path.
      */
     find(method: HttpMethod, path: string): RouteMatch<T> | undefined;
-    /** Returns the set of methods registered at this exact path (for 405 responses). */
+    /**
+     * Return the methods registered at the matched path for 405 responses.
+     * Static-only routers skip trie traversal. Results are fresh arrays and
+     * reflect routes registered after earlier lookups. Only validated registered
+     * static paths are cached, bounding cache size by the static route count.
+     * @param path - Request path, subject to the same traversal and empty-segment
+     *   rejection as {@link Router.find}.
+     * @returns Registered methods, or an empty array for rejected or unmatched paths.
+     */
     allowedMethods(path: string): HttpMethod[];
     private walk;
 }

package/dist/router.js

@@ -3,26 +3,33 @@
  *
  * Performance:
  *   - Exact static (parameter-free) paths resolve via a Map lookup — O(1).
- *   - Dynamic paths walk a trie, O(path-segments) regardless of route count.
+ *   - Dynamic paths walk a segment trie, visiting static branches before
+ *     parameters and wildcards. Backtracking cost depends on overlapping routes.
  *   - Path normalization and splitting avoid regular expressions.
  *
  * Safety:
- *   - Path traversal (`..`) and empty segments are rejected at lookup time.
+ *   - Raw `/../`, trailing `/..`, and empty segments are rejected at lookup time.
+ *   - Decoded parameters are untrusted data, not sanitized filesystem paths.
  *   - Duplicate routes and duplicate operationIds throw at registration.
  *   - Wildcard segments must be terminal.
  */
+import { isForbiddenObjectKey } from "./security.js";
+const handlerPrototype = Object.freeze(Object.create(null));
 function createNode() {
-    return { children: new Map(), handlers: {} };
+    return { children: new Map(), handlers: undefined };
 }
 /**
  * Trie/radix router with a static-route fast path. Registers handlers via
  * {@link Router.add} and resolves them with {@link Router.find}. Rejects
- * duplicate routes, duplicate operationIds, conflicting param names, and
- * path-traversal lookups.
+ * duplicate routes, duplicate operationIds, conflicting or unsafe capture names,
+ * and raw path-traversal lookups.
  */
 export class Router {
     root = createNode();
     operationIds = new Set();
+    hasDynamicRoutes = false;
+    revision = 0;
+    staticMethods = new Map();
     /** Static (no-param/no-wildcard) routes for O(1) lookup. */
     staticTable = new Map();
     /**
@@ -32,28 +39,47 @@ export class Router {
      *
      * @param method - HTTP method to register the handler under.
      * @param path - Route path; supports `:param` and a trailing `*wildcard`.
-     * @param handler - Value returned by {@link Router.find} on a match.
+     * @param handler - Value returned by {@link Router.find} on a match, including
+     *   falsy values or `undefined`.
      * @param operationId - Optional unique id; tracked to reject duplicates.
      * @throws Error on a duplicate route, duplicate `operationId`, or conflicting
-     *   param names at the same trie position.
+     *   parameter or wildcard names at the same trie position, empty, repeated,
+     *   or prototype-sensitive capture names, or a nonterminal wildcard.
+     *   Failed registration does not reserve the `operationId`.
      */
     add(method, path, handler, operationId) {
         const segments = splitPath(path);
         if (operationId && this.operationIds.has(operationId))
             throw new Error(`Duplicate operationId: "${operationId}"`);
-        if (operationId)
-            this.operationIds.add(operationId);
-        const isStatic = segments.every((s) => !s.startsWith(":") && !s.startsWith("*"));
+        let captureNames;
+        for (let index = 0; index < segments.length; index++) {
+            const segment = segments[index];
+            const wildcard = segment.startsWith("*");
+            if (wildcard && index !== segments.length - 1) {
+                throw new Error(`Wildcard must be the terminal segment: ${path}`);
+            }
+            if (wildcard || segment.startsWith(":")) {
+                const name = wildcard && segment.length === 1 ? "wildcard" : segment.slice(1);
+                if (!name || isForbiddenObjectKey(name) || captureNames?.has(name)) {
+                    throw new Error(`Invalid or duplicate capture name: "${name}" in ${path}`);
+                }
+                (captureNames ??= new Set()).add(name);
+            }
+        }
+        const isStatic = captureNames === undefined;
         const normalized = "/" + segments.join("/");
         if (isStatic) {
             let entry = this.staticTable.get(normalized);
             if (!entry) {
-                entry = {};
+                entry = Object.create(handlerPrototype);
                 this.staticTable.set(normalized, entry);
             }
-            if (entry[method])
+            if (Object.hasOwn(entry, method))
                 throw new Error(`Duplicate route: ${method} ${path}`);
             entry[method] = handler;
+            this.revision++;
+            if (operationId)
+                this.operationIds.add(operationId);
             return;
         }
         let node = this.root;
@@ -70,7 +96,12 @@ export class Router {
             }
             else if (seg.startsWith("*")) {
                 const name = seg.length > 1 ? seg.slice(1) : "wildcard";
-                node.wildcardChild = { name, node: createNode() };
+                if (!node.wildcardChild) {
+                    node.wildcardChild = { name, node: createNode() };
+                }
+                else if (node.wildcardChild.name !== name) {
+                    throw new Error(`Conflicting wildcard names at same position: "${node.wildcardChild.name}" vs "${name}"`);
+                }
                 node = node.wildcardChild.node;
                 break;
             }
@@ -83,14 +114,22 @@ export class Router {
                 node = next;
             }
         }
-        if (node.handlers[method])
+        node.handlers ??= Object.create(handlerPrototype);
+        if (Object.hasOwn(node.handlers, method))
             throw new Error(`Duplicate route: ${method} ${path}`);
         node.handlers[method] = handler;
+        this.hasDynamicRoutes = true;
+        this.revision++;
+        if (operationId)
+            this.operationIds.add(operationId);
     }
     /**
      * Look up the handler registered for the given method and path. Tries the
      * static fast path first, then walks the trie, extracting and decoding path
      * params. Path-traversal lookups (`..`, `//`) are rejected up front.
+     * Handler tables inherit only from an empty, frozen, prototype-free base:
+     * Object.prototype properties never count as routes, including for untyped
+     * runtime method values.
      *
      * @param method - HTTP method to match.
      * @param path - Request path to resolve, including any dynamic segments.
@@ -108,8 +147,11 @@ export class Router {
         if (!staticEntry && path.endsWith("/")) {
             staticEntry = this.staticTable.get(trimTrailingSlashes(path));
         }
-        if (staticEntry && staticEntry[method]) {
-            return { handler: staticEntry[method], params: {} };
+        if (staticEntry) {
+            const handler = staticEntry[method];
+            if (handler !== undefined || Object.hasOwn(staticEntry, method)) {
+                return { handler: handler, params: {} };
+            }
         }
         const segments = splitPath(path);
         const params = {};
@@ -117,25 +159,51 @@ export class Router {
         if (!found)
             return undefined;
         const handler = found.handlers[method];
-        if (!handler)
+        if (handler === undefined && !Object.hasOwn(found.handlers, method))
             return undefined;
-        return { handler, params };
+        return { handler: handler, params };
     }
-    /** Returns the set of methods registered at this exact path (for 405 responses). */
+    /**
+     * Return the methods registered at the matched path for 405 responses.
+     * Static-only routers skip trie traversal. Results are fresh arrays and
+     * reflect routes registered after earlier lookups. Only validated registered
+     * static paths are cached, bounding cache size by the static route count.
+     * @param path - Request path, subject to the same traversal and empty-segment
+     *   rejection as {@link Router.find}.
+     * @returns Registered methods, or an empty array for rejected or unmatched paths.
+     */
     allowedMethods(path) {
+        const cached = this.staticMethods.get(path);
+        if (cached?.revision === this.revision)
+            return cached.methods.slice();
+        if (path.includes("/../") || path.endsWith("/..") || path.includes("//")) {
+            return [];
+        }
         let fromStatic = this.staticTable.get(path);
         if (!fromStatic && path.endsWith("/")) {
             fromStatic = this.staticTable.get(trimTrailingSlashes(path));
         }
-        if (fromStatic)
-            return Object.keys(fromStatic);
-        const segments = splitPath(path);
-        const found = this.walk(this.root, segments, 0, {});
-        return found ? Object.keys(found.handlers) : [];
+        const found = this.hasDynamicRoutes
+            ? this.walk(this.root, splitPath(path), 0, {})
+            : undefined;
+        if (!fromStatic)
+            return found ? Object.keys(found.handlers) : [];
+        const methods = Object.keys(fromStatic);
+        if (found) {
+            for (const method of Object.keys(found.handlers)) {
+                if (!Object.hasOwn(fromStatic, method))
+                    methods.push(method);
+            }
+        }
+        this.staticMethods.set(trimTrailingSlashes(path), {
+            revision: this.revision,
+            methods,
+        });
+        return methods.slice();
     }
     walk(node, segs, i, params) {
         if (i === segs.length)
-            return node;
+            return node.handlers ? node : undefined;
         const seg = segs[i];
         const staticNext = node.children.get(seg);
         if (staticNext) {

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e5e6316e-26ff-52ae-9520-4b82d88c8397",
+  "serialNumber": "urn:uuid:ea6ea660-6d6a-5827-8fe5-9def13029bef",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-08T07:08:54.894Z",
+    "timestamp": "2026-09-13T02:28:52.478Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.3.2"
+        "version": "1.3.4"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.3.2",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.3.4",
       "name": "@daloyjs/core",
-      "version": "1.3.2",
+      "version": "1.3.4",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.3.2",
+      "purl": "pkg:npm/@daloyjs/core@1.3.4",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.3.2",
+        "tagId": "swidtag--daloyjs-core-1.3.4",
         "name": "@daloyjs/core",
-        "version": "1.3.2",
+        "version": "1.3.4",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.3.2",
+      "ref": "pkg:npm/@daloyjs/core@1.3.4",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.3.2",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.2-e5e6316e-26ff-52ae-9520-4b82d88c8397",
+  "name": "@daloyjs/core-1.3.4",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.4-ea6ea660-6d6a-5827-8fe5-9def13029bef",
   "creationInfo": {
-    "created": "2026-09-08T07:08:54.894Z",
+    "created": "2026-09-13T02:28:52.478Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.3.2",
+      "versionInfo": "1.3.4",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.2"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.4"
         }
       ]
     }

package/dist/scheduler.d.ts

@@ -228,6 +228,7 @@ export interface CronFields {
  * Supported syntax per field: `*`, lists (`1,2,3`), ranges (`1-5`), steps
  * (`*\/5`, `1-10/2`), and case-insensitive month (`JAN`–`DEC`) / day
  * (`SUN`–`SAT`) names. Day-of-week accepts both `0` and `7` for Sunday.
+ * Numeric weekday ranges are expanded before Sunday aliases are normalized.
  *
  * @param expression - A cron expression or alias.
  * @returns The compiled field sets.
@@ -245,6 +246,7 @@ export declare function parseCron(expression: string): CronFields;
  * @returns The next matching `Date`.
  * @throws {@link CronParseError} if no match occurs within five years
  *   (an unsatisfiable expression).
+ * @throws {RangeError} If `after` is invalid or the timezone is unsupported.
  * @since 0.37.0
  */
 export declare function nextCronRun(expression: string | CronFields, after?: Date, timeZone?: string): Date;

package/dist/scheduler.js

@@ -145,6 +145,7 @@ function parseField(field, min, max, fieldName, names) {
  * Supported syntax per field: `*`, lists (`1,2,3`), ranges (`1-5`), steps
  * (`*\/5`, `1-10/2`), and case-insensitive month (`JAN`–`DEC`) / day
  * (`SUN`–`SAT`) names. Day-of-week accepts both `0` and `7` for Sunday.
+ * Numeric weekday ranges are expanded before Sunday aliases are normalized.
  *
  * @param expression - A cron expression or alias.
  * @returns The compiled field sets.
@@ -167,7 +168,9 @@ export function parseCron(expression) {
     const dayOfMonth = parseField(dom, 1, 31, "day-of-month");
     const month = parseField(mon, 1, 12, "month", MONTH_NAMES);
     // Day-of-week allows 7 as an alias for Sunday; normalize 7 -> 0.
-    const dowRaw = parseField(dow.replace(/7/g, "0"), 0, 6, "day-of-week", DAY_NAMES);
+    const dowRaw = parseField(dow, 0, 7, "day-of-week", DAY_NAMES);
+    if (dowRaw.delete(7))
+        dowRaw.add(0);
     return {
         minute,
         hour,
@@ -187,8 +190,8 @@ const WEEKDAY_INDEX = {
     Fri: 5,
     Sat: 6,
 };
-function wallClockOf(date, timeZone) {
-    if (timeZone === undefined || timeZone === "UTC") {
+function wallClockOf(date, formatter) {
+    if (formatter === undefined) {
         return {
             minute: date.getUTCMinutes(),
             hour: date.getUTCHours(),
@@ -197,16 +200,7 @@ function wallClockOf(date, timeZone) {
             dayOfWeek: date.getUTCDay(),
         };
     }
-    const parts = new Intl.DateTimeFormat("en-US", {
-        timeZone,
-        hour12: false,
-        year: "numeric",
-        month: "numeric",
-        day: "numeric",
-        hour: "numeric",
-        minute: "numeric",
-        weekday: "short",
-    }).formatToParts(date);
+    const parts = formatter.formatToParts(date);
     const get = (type) => parts.find((p) => p.type === type)?.value ?? "0";
     let hour = Number(get("hour"));
     if (hour === 24)
@@ -253,15 +247,38 @@ const MAX_LOOKAHEAD_MINUTES = 5 * 366 * 24 * 60;
  * @returns The next matching `Date`.
  * @throws {@link CronParseError} if no match occurs within five years
  *   (an unsatisfiable expression).
+ * @throws {RangeError} If `after` is invalid or the timezone is unsupported.
  * @since 0.37.0
  */
 export function nextCronRun(expression, after = new Date(), timeZone) {
     const fields = typeof expression === "string" ? parseCron(expression) : expression;
+    if (!Number.isFinite(after.getTime()))
+        throw new RangeError("Invalid cron search date.");
+    const formatter = timeZone === undefined || timeZone === "UTC"
+        ? undefined
+        : new Intl.DateTimeFormat("en-US", {
+            timeZone,
+            hour12: false,
+            year: "numeric",
+            month: "numeric",
+            day: "numeric",
+            hour: "numeric",
+            minute: "numeric",
+            weekday: "short",
+        });
+    if (fields.domRestricted && !fields.dowRestricted) {
+        const possible = [...fields.month].some(month => {
+            const maxDay = new Date(Date.UTC(2000, month, 0)).getUTCDate();
+            return [...fields.dayOfMonth].some(day => day <= maxDay);
+        });
+        if (!possible)
+            throw new CronParseError("Cron expression has no valid calendar day.");
+    }
     // Advance to the start of the next whole minute.
     const start = Math.floor(after.getTime() / 60_000) * 60_000 + 60_000;
     for (let i = 0; i < MAX_LOOKAHEAD_MINUTES; i++) {
         const candidate = new Date(start + i * 60_000);
-        if (matches(fields, wallClockOf(candidate, timeZone)))
+        if (matches(fields, wallClockOf(candidate, formatter)))
             return candidate;
     }
     throw new CronParseError(`Cron expression matches no time within five years (unsatisfiable).`);

package/dist/waf.js

@@ -268,7 +268,7 @@ function inspectionVariants(value, maxValueLength) {
         if (v.includes("+"))
             push(v.replace(/\+/g, " "));
         if (v.includes("/*"))
-            push(v.replace(/\/\*[\s\S]*?\*\//g, " "));
+            push(stripBlockComments(v));
         // Control characters (notably NUL) are not `\s`, so `1'%00OR%001=1` split
         // `OR` from `1=1` and walked past the whitespace-anchored signatures. Scan
         // a control-char→space form; benign traffic carries almost no C0 bytes, so
@@ -285,6 +285,24 @@ function inspectionVariants(value, maxValueLength) {
     }
     return out;
 }
+function stripBlockComments(value) {
+    let cursor = 0;
+    const parts = [];
+    for (;;) {
+        const start = value.indexOf("/*", cursor);
+        if (start < 0)
+            break;
+        const end = value.indexOf("*/", start + 2);
+        if (end < 0)
+            break;
+        parts.push(value.slice(cursor, start), " ");
+        cursor = end + 2;
+    }
+    if (cursor === 0)
+        return value;
+    parts.push(value.slice(cursor));
+    return parts.join("");
+}
 /**
  * Scan every inspection variant of `value` for the active rule set.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.3.2",
+  "version": "1.3.4",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops \u2014 distributed via pnpm.",
   "type": "module",
   "publishConfig": {
@@ -319,6 +319,6 @@
     "bin",
     "README.md"
   ],
-  "packageManager": "pnpm@11.1.3",
+  "packageManager": "pnpm@12.3.0",
   "dependencies": {}
 }