@basaltkit/express 1.3.0 → 1.4.0

package/README.md

@@ -212,6 +212,7 @@ In this mode each handler already handles its own errors (the wrapper responds w
 | Option | Type | Required? | Default | Description |
 |---|---|---|---|---|
 | `routes` | `BasaltRoute[]` | No | `[]` | Routes (created with `route()` from `@basaltkit/http`) to mount. |
+| `allowUnguardedMeta` | `boolean \| string[]` | No | fail loud at boot | Waives the boot check that every route declaring security meta (`auth`, `can`, `teamRole`) has a registered guard enforcing it (`UnguardedRouteMetaError` otherwise). `true` waives everything (edge/gateway auth); an array waives specific keys. |
 | `app` | `Express` | No | new `express()` | Bring your own Express app; either way, `express.json()` is added. |
 
 Behavior: registers the Express app under the `EXPRESS` token and an `HttpServerCollector` under the `HTTP_SERVER` token. On the `app:booted` event it mounts everything in the order Express requires: *after-hooks* middleware (metrics/tracing, via `res.on('finish')`) → *pre-hooks* middleware (security/CORS/rate limit; if one of them responds, the route doesn't run) → Basalt routes → extra routes from edge plugins (`/livez`, `/metrics`, …). Publishes the routes in the `'http:routes'` metadata bucket for OpenAPI/CLI/SDK.

package/dist/index.d.ts

@@ -6,6 +6,13 @@ export declare const EXPRESS: import("@basaltkit/core").Token<Express>;
 export declare function registerRoutes(app: Express, routes: BasaltRoute[], container?: Container, enrichers?: RequestEnricher[], guards?: RouteGuard[]): void;
 export interface ExpressPluginOptions {
     routes?: BasaltRoute[];
+    /**
+     * Waives the boot-time check that every route declaring security meta
+     * (`auth`, `can`, `teamRole`) has a registered guard enforcing it. Pass
+     * `true` to waive everything (e.g. authentication handled at an outer
+     * edge/gateway), or an array of specific keys. Default: fail loud at boot.
+     */
+    allowUnguardedMeta?: boolean | string[];
     /** Bring your own Express app; otherwise one is created with `express.json()`. */
     app?: Express;
     /**

package/dist/index.js

@@ -1,5 +1,5 @@
 import { Container, createToken, definePlugin, ensureMetadata } from '@basaltkit/core';
-import { NOT_FOUND_RESPONSE, HttpServerCollector, HTTP_SERVER, runRoute, toErrorResponse, isSseResponse, sseProducerOf, driveSse, SSE_HEADERS, } from '@basaltkit/http';
+import { NOT_FOUND_RESPONSE, HttpServerCollector, HTTP_SERVER, runRoute, toErrorResponse, isSseResponse, sseProducerOf, driveSse, SSE_HEADERS, GUARDED_META_BUCKET, assertRoutesGuarded, } from '@basaltkit/http';
 import express, {} from 'express';
 export const EXPRESS = createToken('express');
 function toNeutralRequest(req) {
@@ -112,6 +112,9 @@ export function expressPlugin(options = {}) {
             const metadata = ensureMetadata(container);
             const enrichers = metadata.get('http:enrichers');
             const guards = metadata.get('http:guards');
+            // Fail loud BEFORE traffic if a route declares security meta (auth/can/
+            // teamRole) that no registered guard enforces — it would serve open.
+            assertRoutesGuarded(routes, new Set(metadata.get(GUARDED_META_BUCKET)), options.allowUnguardedMeta);
             const router = app;
             // Mount everything once edge plugins have registered their hooks/routes,
             // in the order Express needs: after-hooks → pre-hooks → routes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/express",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Express adapter for Basalt: run the same typed routes, enrichers and guards on Express that you would on Fastify or Hono.",
   "license": "MIT",
   "type": "module",
@@ -14,8 +14,8 @@
     "dist"
   ],
   "dependencies": {
-    "@basaltkit/core": "^1.1.2",
-    "@basaltkit/http": "^1.10.0"
+    "@basaltkit/core": "^1.3.0",
+    "@basaltkit/http": "^1.12.0"
   },
   "peerDependencies": {
     "express": "^4.19.0 || ^5.0.0"