@basaltkit/hono 1.3.0 → 1.4.0

package/README.md

@@ -224,6 +224,7 @@ In this mode errors are still standardized (each handler wraps `toErrorResponse`
 | Option | Type | Required? | Default | Description |
 |---|---|---|---|---|
 | `routes` | `BasaltRoute[]` | No | `[]` | Routes (created with `route()` from `@basaltkit/http`) to mount. |
+| `allowUnguardedMeta` | `boolean \| string[]` | No | fail loud at boot | Waives the boot check that every route declaring security meta (`auth`, `can`, `teamRole`) has a registered guard enforcing it (`UnguardedRouteMetaError` otherwise). `true` waives everything (edge/gateway auth); an array waives specific keys. |
 | `app` | `Hono` | No | `new Hono()` | Bring your own Hono app; otherwise a new one is created. |
 
 Behavior: registers the Hono app on the `HONO` token and an `HttpServerCollector` on the `HTTP_SERVER` token. On the `app:booted` event it mounts, in order: *after-hooks* middleware (metrics/tracing, measuring duration), *pre-hooks* middleware (security/CORS/rate limit; if one of these responds, the route doesn't run), the Basalt routes, and the extra edge plugin routes (`/livez`, `/metrics`, `/openapi.json`, …). Publishes the routes to the `'http:routes'` metadata bucket for OpenAPI/CLI/SDK.

package/dist/index.d.ts

@@ -8,6 +8,13 @@ export declare const DEFAULT_BODY_LIMIT = 1048576;
 export declare function registerRoutes(app: Hono<any>, routes: BasaltRoute[], container?: Container, enrichers?: RequestEnricher[], guards?: RouteGuard[]): void;
 export interface HonoPluginOptions {
     routes?: BasaltRoute[];
+    /**
+     * Waives the boot-time check that every route declaring security meta
+     * (`auth`, `can`, `teamRole`) has a registered guard enforcing it. Pass
+     * `true` to waive everything (e.g. authentication handled at an outer
+     * edge/gateway), or an array of specific keys. Default: fail loud at boot.
+     */
+    allowUnguardedMeta?: boolean | string[];
     /** Bring your own Hono app; otherwise a fresh one is created. */
     app?: Hono<any>;
     /**

package/dist/index.js

@@ -1,5 +1,5 @@
 import { Container, createToken, definePlugin, ensureMetadata } from '@basaltkit/core';
-import { NOT_FOUND_RESPONSE, HttpServerCollector, HTTP_SERVER, runRoute, toErrorResponse, isSseResponse, sseProducerOf, driveSse, SSE_HEADERS, } from '@basaltkit/http';
+import { NOT_FOUND_RESPONSE, HttpServerCollector, HTTP_SERVER, runRoute, toErrorResponse, isSseResponse, sseProducerOf, driveSse, SSE_HEADERS, GUARDED_META_BUCKET, assertRoutesGuarded, } from '@basaltkit/http';
 import { Hono } from 'hono';
 export const HONO = createToken('hono');
 /** Default maximum request body size (1 MiB) — override via honoPlugin({ bodyLimit }). */
@@ -156,6 +156,9 @@ export function honoPlugin(options = {}) {
             const metadata = ensureMetadata(container);
             const enrichers = metadata.get('http:enrichers');
             const guards = metadata.get('http:guards');
+            // Fail loud BEFORE traffic if a route declares security meta (auth/can/
+            // teamRole) that no registered guard enforces — it would serve open.
+            assertRoutesGuarded(routes, new Set(metadata.get(GUARDED_META_BUCKET)), options.allowUnguardedMeta);
             // Mount once edge plugins have registered their hooks/routes.
             const bodyLimit = options.bodyLimit ?? DEFAULT_BODY_LIMIT;
             hooks.on('app:booted', () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@basaltkit/hono",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Hono adapter for Basalt: run the same typed routes, enrichers and guards on Hono (Node, Bun, Deno, edge) as on Fastify or Express.",
   "license": "MIT",
   "type": "module",
@@ -14,8 +14,8 @@
     "dist"
   ],
   "dependencies": {
-    "@basaltkit/core": "^1.1.2",
-    "@basaltkit/http": "^1.10.0"
+    "@basaltkit/core": "^1.3.0",
+    "@basaltkit/http": "^1.12.0"
   },
   "peerDependencies": {
     "hono": "^4.0.0"