@daloyjs/core 1.3.3 → 1.3.4

package/README.md

@@ -491,7 +491,8 @@ miss                         7,742,635 ops/sec
 
 - After traversal checks, exact static routes resolve with an allocation-free
   `Map.get` fast path — **~26M ops/sec**.
-- Dynamic routes walk a trie, **O(path-segments)** regardless of route count.
+- Dynamic routes walk a segment trie in path-length time without backtracking;
+  overlapping routes can require visiting additional branches.
 - Body parsing is lazy and only runs when a route declares a body schema.
 - Path normalization and splitting use index/character scans rather than
   regular expressions.

package/dist/router.d.ts

@@ -3,7 +3,8 @@
  *
  * Performance:
  *   - Exact static (parameter-free) paths resolve via a Map lookup — O(1).
- *   - Dynamic paths walk a trie, O(path-segments) regardless of route count.
+ *   - Dynamic paths walk a segment trie, visiting static branches before
+ *     parameters and wildcards. Backtracking cost depends on overlapping routes.
  *   - Path normalization and splitting avoid regular expressions.
  *
  * Safety:
@@ -23,12 +24,15 @@ export interface RouteMatch<T> {
 /**
  * Trie/radix router with a static-route fast path. Registers handlers via
  * {@link Router.add} and resolves them with {@link Router.find}. Rejects
- * duplicate routes, duplicate operationIds, conflicting param names, and
- * path-traversal lookups.
+ * duplicate routes, duplicate operationIds, conflicting or unsafe capture names,
+ * and raw path-traversal lookups.
  */
 export declare class Router<T> {
     private root;
     private operationIds;
+    private hasDynamicRoutes;
+    private revision;
+    private staticMethods;
     /** Static (no-param/no-wildcard) routes for O(1) lookup. */
     private staticTable;
     /**
@@ -38,16 +42,22 @@ export declare class Router<T> {
      *
      * @param method - HTTP method to register the handler under.
      * @param path - Route path; supports `:param` and a trailing `*wildcard`.
-     * @param handler - Value returned by {@link Router.find} on a match.
+     * @param handler - Value returned by {@link Router.find} on a match, including
+     *   falsy values or `undefined`.
      * @param operationId - Optional unique id; tracked to reject duplicates.
      * @throws Error on a duplicate route, duplicate `operationId`, or conflicting
-     *   param names at the same trie position.
+     *   parameter or wildcard names at the same trie position, empty, repeated,
+     *   or prototype-sensitive capture names, or a nonterminal wildcard.
+     *   Failed registration does not reserve the `operationId`.
      */
     add(method: HttpMethod, path: string, handler: T, operationId?: string): void;
     /**
      * Look up the handler registered for the given method and path. Tries the
      * static fast path first, then walks the trie, extracting and decoding path
      * params. Path-traversal lookups (`..`, `//`) are rejected up front.
+     * Handler tables inherit only from an empty, frozen, prototype-free base:
+     * Object.prototype properties never count as routes, including for untyped
+     * runtime method values.
      *
      * @param method - HTTP method to match.
      * @param path - Request path to resolve, including any dynamic segments.
@@ -55,7 +65,15 @@ export declare class Router<T> {
      *   route matches the method + path.
      */
     find(method: HttpMethod, path: string): RouteMatch<T> | undefined;
-    /** Returns the set of methods registered at this exact path (for 405 responses). */
+    /**
+     * Return the methods registered at the matched path for 405 responses.
+     * Static-only routers skip trie traversal. Results are fresh arrays and
+     * reflect routes registered after earlier lookups. Only validated registered
+     * static paths are cached, bounding cache size by the static route count.
+     * @param path - Request path, subject to the same traversal and empty-segment
+     *   rejection as {@link Router.find}.
+     * @returns Registered methods, or an empty array for rejected or unmatched paths.
+     */
     allowedMethods(path: string): HttpMethod[];
     private walk;
 }

package/dist/router.js

@@ -3,7 +3,8 @@
  *
  * Performance:
  *   - Exact static (parameter-free) paths resolve via a Map lookup — O(1).
- *   - Dynamic paths walk a trie, O(path-segments) regardless of route count.
+ *   - Dynamic paths walk a segment trie, visiting static branches before
+ *     parameters and wildcards. Backtracking cost depends on overlapping routes.
  *   - Path normalization and splitting avoid regular expressions.
  *
  * Safety:
@@ -12,18 +13,23 @@
  *   - Duplicate routes and duplicate operationIds throw at registration.
  *   - Wildcard segments must be terminal.
  */
+import { isForbiddenObjectKey } from "./security.js";
+const handlerPrototype = Object.freeze(Object.create(null));
 function createNode() {
-    return { children: new Map(), handlers: {} };
+    return { children: new Map(), handlers: undefined };
 }
 /**
  * Trie/radix router with a static-route fast path. Registers handlers via
  * {@link Router.add} and resolves them with {@link Router.find}. Rejects
- * duplicate routes, duplicate operationIds, conflicting param names, and
- * path-traversal lookups.
+ * duplicate routes, duplicate operationIds, conflicting or unsafe capture names,
+ * and raw path-traversal lookups.
  */
 export class Router {
     root = createNode();
     operationIds = new Set();
+    hasDynamicRoutes = false;
+    revision = 0;
+    staticMethods = new Map();
     /** Static (no-param/no-wildcard) routes for O(1) lookup. */
     staticTable = new Map();
     /**
@@ -33,28 +39,47 @@ export class Router {
      *
      * @param method - HTTP method to register the handler under.
      * @param path - Route path; supports `:param` and a trailing `*wildcard`.
-     * @param handler - Value returned by {@link Router.find} on a match.
+     * @param handler - Value returned by {@link Router.find} on a match, including
+     *   falsy values or `undefined`.
      * @param operationId - Optional unique id; tracked to reject duplicates.
      * @throws Error on a duplicate route, duplicate `operationId`, or conflicting
-     *   param names at the same trie position.
+     *   parameter or wildcard names at the same trie position, empty, repeated,
+     *   or prototype-sensitive capture names, or a nonterminal wildcard.
+     *   Failed registration does not reserve the `operationId`.
      */
     add(method, path, handler, operationId) {
         const segments = splitPath(path);
         if (operationId && this.operationIds.has(operationId))
             throw new Error(`Duplicate operationId: "${operationId}"`);
-        if (operationId)
-            this.operationIds.add(operationId);
-        const isStatic = segments.every((s) => !s.startsWith(":") && !s.startsWith("*"));
+        let captureNames;
+        for (let index = 0; index < segments.length; index++) {
+            const segment = segments[index];
+            const wildcard = segment.startsWith("*");
+            if (wildcard && index !== segments.length - 1) {
+                throw new Error(`Wildcard must be the terminal segment: ${path}`);
+            }
+            if (wildcard || segment.startsWith(":")) {
+                const name = wildcard && segment.length === 1 ? "wildcard" : segment.slice(1);
+                if (!name || isForbiddenObjectKey(name) || captureNames?.has(name)) {
+                    throw new Error(`Invalid or duplicate capture name: "${name}" in ${path}`);
+                }
+                (captureNames ??= new Set()).add(name);
+            }
+        }
+        const isStatic = captureNames === undefined;
         const normalized = "/" + segments.join("/");
         if (isStatic) {
             let entry = this.staticTable.get(normalized);
             if (!entry) {
-                entry = {};
+                entry = Object.create(handlerPrototype);
                 this.staticTable.set(normalized, entry);
             }
-            if (entry[method])
+            if (Object.hasOwn(entry, method))
                 throw new Error(`Duplicate route: ${method} ${path}`);
             entry[method] = handler;
+            this.revision++;
+            if (operationId)
+                this.operationIds.add(operationId);
             return;
         }
         let node = this.root;
@@ -71,7 +96,12 @@ export class Router {
             }
             else if (seg.startsWith("*")) {
                 const name = seg.length > 1 ? seg.slice(1) : "wildcard";
-                node.wildcardChild = { name, node: createNode() };
+                if (!node.wildcardChild) {
+                    node.wildcardChild = { name, node: createNode() };
+                }
+                else if (node.wildcardChild.name !== name) {
+                    throw new Error(`Conflicting wildcard names at same position: "${node.wildcardChild.name}" vs "${name}"`);
+                }
                 node = node.wildcardChild.node;
                 break;
             }
@@ -84,14 +114,22 @@ export class Router {
                 node = next;
             }
         }
-        if (node.handlers[method])
+        node.handlers ??= Object.create(handlerPrototype);
+        if (Object.hasOwn(node.handlers, method))
             throw new Error(`Duplicate route: ${method} ${path}`);
         node.handlers[method] = handler;
+        this.hasDynamicRoutes = true;
+        this.revision++;
+        if (operationId)
+            this.operationIds.add(operationId);
     }
     /**
      * Look up the handler registered for the given method and path. Tries the
      * static fast path first, then walks the trie, extracting and decoding path
      * params. Path-traversal lookups (`..`, `//`) are rejected up front.
+     * Handler tables inherit only from an empty, frozen, prototype-free base:
+     * Object.prototype properties never count as routes, including for untyped
+     * runtime method values.
      *
      * @param method - HTTP method to match.
      * @param path - Request path to resolve, including any dynamic segments.
@@ -109,8 +147,11 @@ export class Router {
         if (!staticEntry && path.endsWith("/")) {
             staticEntry = this.staticTable.get(trimTrailingSlashes(path));
         }
-        if (staticEntry && staticEntry[method]) {
-            return { handler: staticEntry[method], params: {} };
+        if (staticEntry) {
+            const handler = staticEntry[method];
+            if (handler !== undefined || Object.hasOwn(staticEntry, method)) {
+                return { handler: handler, params: {} };
+            }
         }
         const segments = splitPath(path);
         const params = {};
@@ -118,25 +159,51 @@ export class Router {
         if (!found)
             return undefined;
         const handler = found.handlers[method];
-        if (!handler)
+        if (handler === undefined && !Object.hasOwn(found.handlers, method))
             return undefined;
-        return { handler, params };
+        return { handler: handler, params };
     }
-    /** Returns the set of methods registered at this exact path (for 405 responses). */
+    /**
+     * Return the methods registered at the matched path for 405 responses.
+     * Static-only routers skip trie traversal. Results are fresh arrays and
+     * reflect routes registered after earlier lookups. Only validated registered
+     * static paths are cached, bounding cache size by the static route count.
+     * @param path - Request path, subject to the same traversal and empty-segment
+     *   rejection as {@link Router.find}.
+     * @returns Registered methods, or an empty array for rejected or unmatched paths.
+     */
     allowedMethods(path) {
+        const cached = this.staticMethods.get(path);
+        if (cached?.revision === this.revision)
+            return cached.methods.slice();
+        if (path.includes("/../") || path.endsWith("/..") || path.includes("//")) {
+            return [];
+        }
         let fromStatic = this.staticTable.get(path);
         if (!fromStatic && path.endsWith("/")) {
             fromStatic = this.staticTable.get(trimTrailingSlashes(path));
         }
-        if (fromStatic)
-            return Object.keys(fromStatic);
-        const segments = splitPath(path);
-        const found = this.walk(this.root, segments, 0, {});
-        return found ? Object.keys(found.handlers) : [];
+        const found = this.hasDynamicRoutes
+            ? this.walk(this.root, splitPath(path), 0, {})
+            : undefined;
+        if (!fromStatic)
+            return found ? Object.keys(found.handlers) : [];
+        const methods = Object.keys(fromStatic);
+        if (found) {
+            for (const method of Object.keys(found.handlers)) {
+                if (!Object.hasOwn(fromStatic, method))
+                    methods.push(method);
+            }
+        }
+        this.staticMethods.set(trimTrailingSlashes(path), {
+            revision: this.revision,
+            methods,
+        });
+        return methods.slice();
     }
     walk(node, segs, i, params) {
         if (i === segs.length)
-            return node;
+            return node.handlers ? node : undefined;
         const seg = segs[i];
         const staticNext = node.children.get(seg);
         if (staticNext) {

package/dist/sbom.cdx.json

@@ -1,15 +1,15 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6545c557-5cea-599b-8286-d910b13cb482",
+  "serialNumber": "urn:uuid:ea6ea660-6d6a-5827-8fe5-9def13029bef",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T10:47:58.279Z",
+    "timestamp": "2026-09-13T02:28:52.478Z",
     "tools": [
       {
         "vendor": "DaloyJS",
         "name": "daloy-generate-sbom",
-        "version": "1.3.3"
+        "version": "1.3.4"
       }
     ],
     "authors": [
@@ -19,11 +19,11 @@
     ],
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/@daloyjs/core@1.3.3",
+      "bom-ref": "pkg:npm/@daloyjs/core@1.3.4",
       "name": "@daloyjs/core",
-      "version": "1.3.3",
+      "version": "1.3.4",
       "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops — distributed via pnpm.",
-      "purl": "pkg:npm/@daloyjs/core@1.3.3",
+      "purl": "pkg:npm/@daloyjs/core@1.3.4",
       "licenses": [
         {
           "license": {
@@ -46,9 +46,9 @@
         }
       ],
       "swid": {
-        "tagId": "swidtag--daloyjs-core-1.3.3",
+        "tagId": "swidtag--daloyjs-core-1.3.4",
         "name": "@daloyjs/core",
-        "version": "1.3.3",
+        "version": "1.3.4",
         "tagVersion": 0,
         "patch": false
       }
@@ -57,7 +57,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "pkg:npm/@daloyjs/core@1.3.3",
+      "ref": "pkg:npm/@daloyjs/core@1.3.4",
       "dependsOn": []
     }
   ]

package/dist/sbom.spdx.json

@@ -2,10 +2,10 @@
   "spdxVersion": "SPDX-2.3",
   "dataLicense": "CC0-1.0",
   "SPDXID": "SPDXRef-DOCUMENT",
-  "name": "@daloyjs/core-1.3.3",
-  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.3-6545c557-5cea-599b-8286-d910b13cb482",
+  "name": "@daloyjs/core-1.3.4",
+  "documentNamespace": "https://github.com/daloyjs/daloy/sbom/@daloyjs/core-1.3.4-ea6ea660-6d6a-5827-8fe5-9def13029bef",
   "creationInfo": {
-    "created": "2026-09-10T10:47:58.279Z",
+    "created": "2026-09-13T02:28:52.478Z",
     "creators": [
       "Tool: daloy-generate-sbom",
       "Organization: DaloyJS"
@@ -16,7 +16,7 @@
     {
       "SPDXID": "SPDXRef-Package--daloyjs-core",
       "name": "@daloyjs/core",
-      "versionInfo": "1.3.3",
+      "versionInfo": "1.3.4",
       "downloadLocation": "https://github.com/daloyjs/daloy",
       "filesAnalyzed": false,
       "licenseConcluded": "MIT",
@@ -27,7 +27,7 @@
         {
           "referenceCategory": "PACKAGE-MANAGER",
           "referenceType": "purl",
-          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.3"
+          "referenceLocator": "pkg:npm/@daloyjs/core@1.3.4"
         }
       ]
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@daloyjs/core",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "description": "DaloyJS is a runtime-portable, contract-first TypeScript web framework with built-in OpenAPI (Hey API), typed client generation, large-scale maintainability, and security-first defaults. Hono-grade portability, Elysia-grade DX, FastAPI-grade docs, Fastify-grade ops \u2014 distributed via pnpm.",
   "type": "module",
   "publishConfig": {